MLK-16042-1: Add bcmdhd v1.363 PCIE driver
authorTiberiu Breana <andrei-tiberiu.breana@nxp.com>
Thu, 20 Jul 2017 13:17:49 +0000 (16:17 +0300)
committerNitin Garg <nitin.garg@nxp.com>
Mon, 19 Mar 2018 20:33:53 +0000 (15:33 -0500)
Add another bcmdhd driver version (v1.363) for PCIE devices.
This will be used for WiFi modules such as Murata 1FD (BCM89359)
or 1CX (BCM4356).

Signed-off-by: Tiberiu Breana <andrei-tiberiu.breana@nxp.com>
168 files changed:
drivers/net/wireless/Kconfig
drivers/net/wireless/Makefile
drivers/net/wireless/bcmdhd/Kconfig
drivers/net/wireless/bcmdhd_1363/Kconfig [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/Makefile [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/aiutils.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/bcm_app_utils.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/bcmevent.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/bcmsdh.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/bcmsdh_linux.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/bcmsdh_sdmmc.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/bcmsdh_sdmmc_linux.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/bcmsdspi_linux.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/bcmspibrcm.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/bcmutils.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/bcmwifi_channels.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/bcmwifi_channels.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/bcmwifi_rates.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/bcmxtlv.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_bandsteer.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_bandsteer.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_bta.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_bta.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_bus.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_buzzz.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_cdc.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_cfg80211.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_cfg80211.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_cfg_vendor.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_common.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_custom_gpio.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_dbg.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_flowring.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_flowring.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_ip.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_ip.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_linux.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_linux.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_linux_platdev.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_linux_sched.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_linux_wq.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_linux_wq.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_msgbuf.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_pcie.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_pcie.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_pcie_linux.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_pno.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_pno.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_proto.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_rtt.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_rtt.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_sdio.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_wlfc.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dhd_wlfc.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dngl_stats.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/dngl_wlhdr.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/hnd_pktpool.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/hnd_pktq.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/hndpmu.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/aidmp.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/bcm_cfg.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/bcm_mpool_pub.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/bcm_ring.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/bcmcdc.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/bcmdefs.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/bcmdevs.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/bcmendian.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/bcmmsgbuf.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/bcmnvram.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/bcmpcie.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/bcmpcispi.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/bcmperf.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/bcmsdbus.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/bcmsdh.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/bcmsdh_sdmmc.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/bcmsdpcm.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/bcmsdspi.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/bcmsdstd.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/bcmspi.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/bcmspibrcm.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/bcmsrom_fmt.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/bcmsrom_tbl.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/bcmutils.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/brcm_nl80211.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/dbus.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/devctrl_if/wlioctl_defs.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/dhdioctl.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/epivers.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/event_log.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/hnd_armtrap.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/hnd_cons.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/hnd_pktpool.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/hnd_pktq.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/hndpmu.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/hndsoc.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/linux_osl.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/linuxver.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/miniopt.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/msgtrace.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/osl.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/osl_decl.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/osl_ext.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/packed_section_end.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/packed_section_start.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/pcicfg.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/pcie_core.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/proto/802.11.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/proto/802.11_bta.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/proto/802.11e.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/proto/802.1d.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/proto/802.3.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/proto/bcmdhcp.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/proto/bcmeth.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/proto/bcmevent.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/proto/bcmip.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/proto/bcmipv6.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/proto/bcmtcp.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/proto/bcmudp.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/proto/bt_amp_hci.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/proto/eapol.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/proto/ethernet.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/proto/event_log_set.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/proto/event_log_tag.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/proto/p2p.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/proto/sdspi.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/proto/vlan.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/proto/wpa.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/proto/wps.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/rte_ioctl.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/sbchipc.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/sbconfig.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/sbhnddma.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/sbpcmcia.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/sbsdio.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/sbsdpcmdev.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/sbsocram.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/sbsysmem.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/sdio.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/sdioh.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/sdiovar.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/siutils.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/spid.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/trxhdr.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/typedefs.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/wlfc_proto.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/wlioctl.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/include/wlioctl_utils.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/linux_osl.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/pcie_core.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/sbutils.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/siutils.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/siutils_priv.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/uamp_api.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/wl_android.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/wl_android.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/wl_cfg80211.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/wl_cfg80211.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/wl_cfg_btcoex.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/wl_cfgp2p.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/wl_cfgp2p.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/wl_cfgvendor.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/wl_cfgvendor.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/wl_dbg.h [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/wl_linux_mon.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/wl_roam.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/wldev_common.c [new file with mode: 0644]
drivers/net/wireless/bcmdhd_1363/wldev_common.h [new file with mode: 0644]

index f0b4e54..591686b 100644 (file)
@@ -22,6 +22,7 @@ source "drivers/net/wireless/ath/Kconfig"
 source "drivers/net/wireless/atmel/Kconfig"
 source "drivers/net/wireless/broadcom/Kconfig"
 source "drivers/net/wireless/bcmdhd/Kconfig"
+source "drivers/net/wireless/bcmdhd_1363/Kconfig"
 source "drivers/net/wireless/cisco/Kconfig"
 source "drivers/net/wireless/intel/Kconfig"
 source "drivers/net/wireless/intersil/Kconfig"
index 50a9228..c2e5add 100644 (file)
@@ -6,6 +6,7 @@ obj-$(CONFIG_WLAN_VENDOR_ADMTEK) += admtek/
 obj-$(CONFIG_WLAN_VENDOR_ATH) += ath/
 obj-$(CONFIG_WLAN_VENDOR_ATMEL) += atmel/
 obj-$(CONFIG_BCMDHD)   += bcmdhd/
+obj-$(CONFIG_BCMDHD_1363)    += bcmdhd_1363/
 obj-$(CONFIG_WLAN_VENDOR_BROADCOM) += broadcom/
 obj-$(CONFIG_WLAN_VENDOR_CISCO) += cisco/
 obj-$(CONFIG_WLAN_VENDOR_INTEL) += intel/
index 7234910..a69ecc3 100644 (file)
@@ -1,5 +1,5 @@
 config BCMDHD
-       tristate "Broadcom FullMAC wireless cards support"
+       tristate "Broadcom FullMAC wireless cards support v1.141"
        ---help---
          This module adds support for wireless adapters based on
          Broadcom FullMAC chipset.
@@ -11,10 +11,6 @@ config BCMDHD_SDIO
        tristate "SDIO bus interface support"
        depends on BCMDHD && MMC
 
-config BCMDHD_PCIE
-       bool "PCIe bus interface support"
-       depends on BCMDHD && PCI && !BCMDHD_SDIO
-
 config BCM4339
        tristate "BCM4339 support"
        depends on BCMDHD
diff --git a/drivers/net/wireless/bcmdhd_1363/Kconfig b/drivers/net/wireless/bcmdhd_1363/Kconfig
new file mode 100644 (file)
index 0000000..9b845cc
--- /dev/null
@@ -0,0 +1,53 @@
+config BCMDHD_1363
+       tristate "Broadcom FullMAC wireless cards support v1.363"
+       depends on !BCMDHD
+       ---help---
+         This module adds support for wireless adapters based on
+         Broadcom FullMAC chipset.
+
+         If you choose to build a module, it'll be called dhd. Say M if
+         unsure.
+
+config BCMDHD_PCIE
+       bool "PCIe bus interface support"
+       depends on BCMDHD_1363 && PCI && !BCMDHD_SDIO
+
+config BCM4359
+       bool "BCM4359 support"
+       depends on BCMDHD_1363
+       default y
+
+config BCMDHD_FW_PATH
+       depends on BCMDHD_1363
+       string "Firmware path"
+       default "/system/vendor/firmware/fw_bcmdhd.bin"
+       ---help---
+         Path to the firmware file.
+
+config BCMDHD_NVRAM_PATH
+       depends on BCMDHD_1363
+       string "NVRAM path"
+       default "/system/etc/wifi/bcmdhd.cal"
+       ---help---
+         Path to the calibration file.
+
+config DHD_USE_STATIC_BUF
+       bool "Enable memory preallocation"
+       depends on BCMDHD_1363
+       default n
+       ---help---
+         Use memory preallocated in platform
+
+config DHD_USE_SCHED_SCAN
+       bool "Use CFG80211 sched scan"
+       depends on BCMDHD_1363 && CFG80211
+       default n
+       ---help---
+         Use CFG80211 sched scan
+
+config DHD_SET_RANDOM_MAC_VAL
+hex "Vendor OUI"
+depends on BCMDHD_1363
+default 0x001A11
+ ---help---
+Set vendor OUI for SoftAP
diff --git a/drivers/net/wireless/bcmdhd_1363/Makefile b/drivers/net/wireless/bcmdhd_1363/Makefile
new file mode 100644 (file)
index 0000000..330509e
--- /dev/null
@@ -0,0 +1,315 @@
+# bcmdhd
+#####################
+# Basic features
+#####################
+
+DHDCFLAGS += -Wall -Wstrict-prototypes -Dlinux -DLINUX -DBCMDRIVER            \
+       -DBCMDONGLEHOST -DUNRELEASEDCHIP -DBCMDMA32 -DBCMFILEIMAGE            \
+       -DDHDTHREAD -DSHOW_EVENTS -DBCMDBG -DWLP2P                            \
+       -DWIFI_ACT_FRAME -DKEEP_ALIVE -DCSCAN -DPKT_FILTER_SUPPORT            \
+       -DEMBEDDED_PLATFORM -DPNO_SUPPORT                                     \
+       -DDHD_DONOT_FORWARD_BCMEVENT_AS_NETWORK_PKT                           \
+       -DCUSTOMER_HW2 -DGET_CUSTOM_MAC_ENABLE                                \
+       -DSHOW_LOGTRACE -DSEC_ENHANCEMENT
+
+# ARP offload feature
+#DHDCFLAGS += -DARP_OFFLOAD_SUPPORT
+
+# FW_COREDUMP
+#DHDCFLAGS += -DDHD_FW_COREDUMP
+
+# Enable below macro if __DATE__ & __TIME__ are deprecated by compiler
+DHDCFLAGS += -DDHD_VERSION_NO_DATE_TIME
+
+#################
+# Common feature
+#################
+
+# DT-based architecture
+DHDCFLAGS += -DCONFIG_DTS
+
+DHDCFLAGS += -DWL_VIRTUAL_APSTA
+
+DHDCFLAGS += -DWL_CFG80211
+# Print out kernel panic point of file and line info when assertion happened
+DHDCFLAGS += -DBCMASSERT_LOG
+
+# ARCH specific flags
+# In case of x86 architechture, pls enable below flag
+#DHDCFLAGS += -D__X86
+
+# CUSTOMER4 flags
+DHDCFLAGS += -DDHD_PKTID_AUDIT_ENABLED
+DHDCFLAGS += -DSUPPORT_HIDDEN_AP -DDHD_LOSSLESS_ROAMING
+DHDCFLAGS += -DPASS_ALL_MCAST_PKTS -DESCAN_BUF_OVERFLOW_MGMT -DPKTPRIO_OVERRIDE
+DHDCFLAGS += -DUSE_INITIAL_SHORT_DWELL_TIME -DWL_NEWCFG_PRIVCMD_SUPPORT
+DHDCFLAGS += -DENABLE_BCN_LI_BCN_WAKEUP -DSOFTAP_UAPSD_OFF
+DHDCFLAGS += -DSUPPORT_LTECX -DSUPPORT_2G_VHT
+DHDCFLAGS += -DSUPPORT_WL_TXPOWER -DBLOCK_IPV6_PACKET -DSUPPORT_DEEP_SLEEP
+DHDCFLAGS += -DSUPPORT_AMPDU_MPDU_CMD -DSOFTAP_SEND_HANGEVT -DNUM_SCB_MAX_PROBE=3
+DHDCFLAGS += -DCUSTOM_AMSDU_AGGSF=2
+DHDCFLAGS += -DCUSTOM_IBSS_AMPDU_BA_WSIZE=16
+DHDCFLAGS += -DCUSTOM_TCPACK_DELAY_TIME=10
+DHDCFLAGS += -DDEBUGFS_CFG80211
+DHDCFLAGS += -DSUPPORT_SOFTAP_WPAWPA2_MIXED
+
+# keepalive
+DHDCFLAGS += -DCUSTOM_KEEP_ALIVE_SETTING=28000
+
+DHDCFLAGS += -DVSDB
+
+# For p2p connection issue
+DHDCFLAGS += -DWL_SCB_TIMEOUT=10
+
+# TDLS enable
+#DHDCFLAGS += -DWLTDLS -DWLTDLS_AUTO_ENABLE
+# For TDLS tear down inactive time 40 sec
+#DHDCFLAGS += -DCUSTOM_TDLS_IDLE_MODE_SETTING=10000
+# for TDLS RSSI HIGH for establishing TDLS link
+#DHDCFLAGS += -DCUSTOM_TDLS_RSSI_THRESHOLD_HIGH=-80
+# for TDLS RSSI HIGH for tearing down TDLS link
+#DHDCFLAGS += -DCUSTOM_TDLS_RSSI_THRESHOLD_LOW=-85
+
+# Roaming
+DHDCFLAGS += -DROAM_AP_ENV_DETECTION
+DHDCFLAGS += -DROAM_ENABLE -DROAM_CHANNEL_CACHE -DROAM_API
+DHDCFLAGS += -DENABLE_FW_ROAM_SUSPEND
+# Roaming trigger
+DHDCFLAGS += -DCUSTOM_ROAM_TRIGGER_SETTING=-75
+DHDCFLAGS += -DCUSTOM_ROAM_DELTA_SETTING=10
+# Set PM 2 always regardless suspend/resume
+DHDCFLAGS += -DSUPPORT_PM2_ONLY
+
+# For special PNO Event keep wake lock for 10sec
+DHDCFLAGS += -DCUSTOM_PNO_EVENT_LOCK_xTIME=10
+DHDCFLAGS += -DMIRACAST_AMPDU_SIZE=8
+
+# Gscan suppport
+#DHDCFLAGS += -DGSCAN_SUPPORT
+
+# Early suspend
+DHDCFLAGS += -DDHD_USE_EARLYSUSPEND
+
+# For Scan result patch
+DHDCFLAGS += -DESCAN_RESULT_PATCH
+
+# For Static Buffer
+ifeq ($(CONFIG_DHD_USE_STATIC_BUF),y)
+  DHDCFLAGS += -DENHANCED_STATIC_BUF
+  DHDCFLAGS += -DSTATIC_WL_PRIV_STRUCT
+endif
+ifneq ($(CONFIG_DHD_USE_SCHED_SCAN),)
+DHDCFLAGS += -DWL_SCHED_SCAN
+endif
+
+# Ioctl timeout 5000ms
+DHDCFLAGS += -DIOCTL_RESP_TIMEOUT=5000
+
+# Prevent rx thread monopolize
+DHDCFLAGS += -DWAIT_DEQUEUE
+
+# Config PM Control
+DHDCFLAGS += -DDHD_PM_CONTROL_FROM_FILE
+
+# idle count
+DHDCFLAGS += -DDHD_USE_IDLECOUNT
+
+# SKB TAILPAD to avoid out of boundary memory access
+DHDCFLAGS += -DDHDENABLE_TAILPAD
+
+# Wi-Fi Direct
+DHDCFLAGS += -DWL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+DHDCFLAGS += -DWL_CFG80211_STA_EVENT
+DHDCFLAGS += -DWL_IFACE_COMB_NUM_CHANNELS
+DHDCFLAGS += -DWL_ENABLE_P2P_IF
+#SCAN time
+DHDCFLAGS += -DCUSTOM_SET_SHORT_DWELL_TIME
+DHDCFLAGS += -DCUSTOM_FORCE_NODFS_FLAG
+
+# SoftAP
+DHDCFLAGS += -DDISABLE_11H_SOFTAP
+DHDCFLAGS += -DSET_RANDOM_MAC_SOFTAP
+DHDCFLAGS += -DWL_CFG80211_ACL
+
+#Disable FRAMEBURST on VSDB
+DHDCFLAGS += -DDISABLE_FRAMEBURST_VSDB
+
+##########################
+# driver type
+# m: module type driver
+# y: built-in type driver
+##########################
+DRIVER_TYPE ?= $(CONFIG_BCMDHD_1363)
+DRIVERX_TYPE ?= $(CONFIG_BCMDHDX)
+
+#########################
+# Chip dependent feature
+#########################
+
+ifneq ($(filter y, $(CONFIG_BCM4359)),)
+  DHDCFLAGS += -DUSE_WL_TXBF
+  DHDCFLAGS += -DUSE_WL_FRAMEBURST
+  DHDCFLAGS += -DCUSTOM_DPC_CPUCORE=0
+  DHDCFLAGS += -DPROP_TXSTATUS_VSDB
+  DHDCFLAGS += -DCUSTOM_PSPRETEND_THR=30
+  DHDCFLAGS += -DMAX_AP_CLIENT_CNT=10
+  DHDCFLAGS += -DMAX_GO_CLIENT_CNT=5
+# New Features
+  DHDCFLAGS += -DWL11U
+  DHDCFLAGS += -DMFP
+  DHDCFLAGS += -DDHD_ENABLE_LPC
+  DHDCFLAGS += -DCUSTOM_COUNTRY_CODE
+  DHDCFLAGS += -DSAR_SUPPORT
+# debug info
+  DHDCFLAGS += -DDHD_WAKE_STATUS
+
+ifneq ($(CONFIG_BCMDHD_PCIE),)
+  DHDCFLAGS += -DPCIE_FULL_DONGLE -DBCMPCIE -DCUSTOM_DPC_PRIO_SETTING=-1
+# tput enhancement
+  DHDCFLAGS += -DCUSTOM_AMPDU_BA_WSIZE=64
+  DHDCFLAGS += -DCUSTOM_AMPDU_MPDU=48
+  DHDCFLAGS += -DCUSTOM_AMPDU_RELEASE=32
+  DHDCFLAGS += -DPROP_TXSTATUS_VSDB
+# Disable watchdog thread
+  DHDCFLAGS += -DCUSTOM_DHD_WATCHDOG_MS=0
+  DHDCFLAGS += -DMAX_CNTL_TX_TIMEOUT=1
+  DHDCFLAGS += -DSUPPORT_LINKDOWN_RECOVERY
+# Add Load Balance Feature here
+  DHDCFLAGS += -DDHD_LB
+  DHDCFLAGS += -DDHD_LB_RXP
+  DHDCFLAGS += -DDHD_LB_STATS
+endif
+
+ifneq ($(CONFIG_BCMDHD_SDIO),)
+  DHDCFLAGS += -DBDC -DDHD_BCMEVENTS -DMMC_SDIO_ABORT
+# Macros for HW-OOB
+  DHDCFLAGS += -DOOB_INTR_ONLY -DHW_OOB
+# Enable Below macro for In-Band interrupt
+#  DHDCFLAGS += -DSDIO_ISR_THREAD
+  DHDCFLAGS += -DBCMSDIO -DBCMLXSDMMC -DUSE_SDIOFIFO_IOVAR
+  DHDCFLAGS += -DPROP_TXSTATUS
+  DHDCFLAGS += -DCUSTOM_AMPDU_MPDU=16
+  DHDCFLAGS += -DCUSTOM_AMPDU_BA_WSIZE=64
+# tput enhancement
+  DHDCFLAGS += -DCUSTOM_GLOM_SETTING=8 -DCUSTOM_RXCHAIN=1
+  DHDCFLAGS += -DUSE_DYNAMIC_F2_BLKSIZE -DDYNAMIC_F2_BLKSIZE_FOR_NONLEGACY=128
+  DHDCFLAGS += -DBCMSDIOH_TXGLOM -DCUSTOM_TXGLOM=1 -DBCMSDIOH_TXGLOM_HIGHSPEED
+  DHDCFLAGS += -DDHDTCPACK_SUPPRESS
+  DHDCFLAGS += -DRXFRAME_THREAD
+  DHDCFLAGS += -DREPEAT_READFRAME
+  DHDCFLAGS += -DCUSTOM_MAX_TXGLOM_SIZE=40
+  DHDCFLAGS += -DMAX_HDR_READ=128
+  DHDCFLAGS += -DDHD_FIRSTREAD=128
+  # bcn_timeout
+  DHDCFLAGS += -DCUSTOM_BCN_TIMEOUT=5
+  DHDCFLAGS += -DWLFC_STATE_PREALLOC
+endif
+
+ifeq ($(CONFIG_DHD_USE_STATIC_BUF),y)
+  DHDCFLAGS += -DDHD_USE_STATIC_IOCTLBUF
+endif
+  DHDCFLAGS += -DDONGLE_ENABLE_ISOLATION
+# Print 802.1X packets
+  DHDCFLAGS += -DDHD_8021X_DUMP
+# Print DHCP packets
+  DHDCFLAGS += -DDHD_DHCP_DUMP
+endif
+
+ifneq ($(CONFIG_BCM4339),)
+  DHDCFLAGS += -DBCM4339_CHIP -DHW_OOB
+
+  # tput enhancement
+  DHDCFLAGS += -DCUSTOM_GLOM_SETTING=8 -DCUSTOM_RXCHAIN=1
+  DHDCFLAGS += -DUSE_DYNAMIC_F2_BLKSIZE -DDYNAMIC_F2_BLKSIZE_FOR_NONLEGACY=128
+  DHDCFLAGS += -DBCMSDIOH_TXGLOM -DCUSTOM_TXGLOM=1 -DBCMSDIOH_TXGLOM_HIGHSPEED
+  DHDCFLAGS += -DDHDTCPACK_SUPPRESS
+  DHDCFLAGS += -DUSE_WL_TXBF
+  DHDCFLAGS += -DUSE_WL_FRAMEBURST
+  DHDCFLAGS += -DRXFRAME_THREAD
+  DHDCFLAGS += -DCUSTOM_AMPDU_BA_WSIZE=64
+  DHDCFLAGS += -DCUSTOM_DPC_CPUCORE=0
+  DHDCFLAGS += -DPROP_TXSTATUS_VSDB
+  DHDCFLAGS += -DCUSTOM_MAX_TXGLOM_SIZE=32
+
+  # New Features
+  DHDCFLAGS += -DWL11U
+  DHDCFLAGS += -DDHD_ENABLE_LPC
+  DHDCFLAGS += -DCUSTOM_PSPRETEND_THR=30
+endif
+
+
+#EXTRA_LDFLAGS += --strip-debug
+
+ifeq ($(DRIVER_TYPE),y)
+  DHDCFLAGS += -DENABLE_INSMOD_NO_FW_LOAD
+  DHDCFLAGS += -DUSE_LATE_INITCALL_SYNC
+endif
+
+ifeq ($(DRIVERX_TYPE),y)
+  DHDCFLAGS += -DENABLE_INSMOD_NO_FW_LOAD
+  DHDCFLAGS += -DUSE_LATE_INITCALL_SYNC
+endif
+
+ifneq ($(DRIVERX_TYPE),)
+  DHDCFLAGS += -DBCMDHDX
+endif
+
+DHDOFILES := dhd_pno.o dhd_common.o dhd_ip.o dhd_custom_gpio.o \
+       dhd_linux.o dhd_linux_sched.o dhd_cfg80211.o dhd_linux_wq.o aiutils.o bcmevent.o \
+       bcmutils.o bcmwifi_channels.o hndpmu.o linux_osl.o sbutils.o siutils.o \
+       wl_android.o wl_roam.o wl_cfg80211.o wl_cfgp2p.o wl_cfg_btcoex.o wldev_common.o wl_linux_mon.o  \
+       dhd_linux_platdev.o dhd_pno.o dhd_linux_wq.o hnd_pktq.o hnd_pktpool.o
+
+# RTT support
+#DHDCFLAGS += -DRTT_SUPPORT -DRTT_DEBUG
+#DHDOFILES += dhd_rtt.o bcmxtlv.o bcm_app_utils.o
+
+# Vendor Extension support
+#DHDCFLAGS += -DWL_VENDOR_EXT_SUPPORT
+#DHDOFILES += wl_cfgvendor.o
+
+# Bandsteer support
+#DHDCFLAGS += -DDHD_BANDSTEER
+#DHDOFILES +=  dhd_bandsteer.o
+
+# DRIVER start/stop support
+#DHDCFLAGS += -DENABLE_INSMOD_NO_FW_LOAD -DKEEP_WIFION_OPTION
+
+ifneq ($(CONFIG_BCMDHD_PCIE),)
+  DHDOFILES += dhd_pcie.o dhd_pcie_linux.o dhd_msgbuf.o dhd_flowring.o
+  DHDOFILES += pcie_core.o
+endif
+
+
+ifneq ($(CONFIG_BCMDHD_SDIO),)
+  DHDOFILES += bcmsdh.o bcmsdh_linux.o bcmsdh_sdmmc.o bcmsdh_sdmmc_linux.o
+  DHDOFILES += dhd_cdc.o dhd_wlfc.o dhd_sdio.o
+endif
+
+
+ifneq ($(CONFIG_BCMDHD_1363),)
+  bcmdhd-objs := $(DHDOFILES)
+  obj-$(DRIVER_TYPE)   += bcmdhd.o
+endif
+
+ifneq ($(CONFIG_BCMDHDX),)
+  bcmdhdx-objs := $(DHDOFILES)
+  obj-$(DRIVERX_TYPE)   += bcmdhdx.o
+endif
+
+EXTRA_CFLAGS += $(DHDCFLAGS) -DDHD_DEBUG
+EXTRA_CFLAGS += -DSRCBASE=\"$(src)\"
+EXTRA_CFLAGS += -I$(src)/include/ -I$(src)/
+KBUILD_CFLAGS += -I$(LINUXDIR)/include -I$(shell pwd)
+
+all:
+       @echo "$(MAKE) --no-print-directory -C $(KDIR) SUBDIRS=$(CURDIR) modules"
+       @$(MAKE) --no-print-directory -C $(KDIR) SUBDIRS=$(CURDIR) modules
+
+clean:
+       rm -rf *.o *.ko *.mod.c *~ .*.cmd *.o.cmd .*.o.cmd \
+       Module.symvers modules.order .tmp_versions modules.builtin
+
+install:
+       @$(MAKE) --no-print-directory -C $(KDIR) \
+               SUBDIRS=$(CURDIR) modules_install
diff --git a/drivers/net/wireless/bcmdhd_1363/aiutils.c b/drivers/net/wireless/bcmdhd_1363/aiutils.c
new file mode 100644 (file)
index 0000000..3440dbc
--- /dev/null
@@ -0,0 +1,1284 @@
+/*
+ * Misc utility routines for accessing chip-specific features
+ * of the SiliconBackplane-based Broadcom chips.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: aiutils.c 607900 2015-12-22 13:38:53Z $
+ */
+#include <bcm_cfg.h>
+#include <typedefs.h>
+#include <bcmdefs.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <siutils.h>
+#include <hndsoc.h>
+#include <sbchipc.h>
+#include <pcicfg.h>
+
+#include "siutils_priv.h"
+
+#define BCM47162_DMP() (0)
+#define BCM5357_DMP() (0)
+#define BCM53573_DMP() (0)
+#define BCM4707_DMP() (0)
+#define PMU_DMP() (0)
+#define GCI_DMP() (0)
+#define remap_coreid(sih, coreid)      (coreid)
+#define remap_corerev(sih, corerev)    (corerev)
+
+/* EROM parsing */
+
+static uint32
+get_erom_ent(si_t *sih, uint32 **eromptr, uint32 mask, uint32 match)
+{
+       uint32 ent;
+       uint inv = 0, nom = 0;
+       uint32 size = 0;
+
+       while (TRUE) {
+               ent = R_REG(si_osh(sih), *eromptr);
+               (*eromptr)++;
+
+               if (mask == 0)
+                       break;
+
+               if ((ent & ER_VALID) == 0) {
+                       inv++;
+                       continue;
+               }
+
+               if (ent == (ER_END | ER_VALID))
+                       break;
+
+               if ((ent & mask) == match)
+                       break;
+
+               /* escape condition related EROM size if it has invalid values */
+               size += sizeof(*eromptr);
+               if (size >= ER_SZ_MAX) {
+                       SI_ERROR(("Failed to find end of EROM marker\n"));
+                       break;
+               }
+
+               nom++;
+       }
+
+       SI_VMSG(("%s: Returning ent 0x%08x\n", __FUNCTION__, ent));
+       if (inv + nom) {
+               SI_VMSG(("  after %d invalid and %d non-matching entries\n", inv, nom));
+       }
+       return ent;
+}
+
+static uint32
+get_asd(si_t *sih, uint32 **eromptr, uint sp, uint ad, uint st, uint32 *addrl, uint32 *addrh,
+        uint32 *sizel, uint32 *sizeh)
+{
+       uint32 asd, sz, szd;
+
+       asd = get_erom_ent(sih, eromptr, ER_VALID, ER_VALID);
+       if (((asd & ER_TAG1) != ER_ADD) ||
+           (((asd & AD_SP_MASK) >> AD_SP_SHIFT) != sp) ||
+           ((asd & AD_ST_MASK) != st)) {
+               /* This is not what we want, "push" it back */
+               (*eromptr)--;
+               return 0;
+       }
+       *addrl = asd & AD_ADDR_MASK;
+       if (asd & AD_AG32)
+               *addrh = get_erom_ent(sih, eromptr, 0, 0);
+       else
+               *addrh = 0;
+       *sizeh = 0;
+       sz = asd & AD_SZ_MASK;
+       if (sz == AD_SZ_SZD) {
+               szd = get_erom_ent(sih, eromptr, 0, 0);
+               *sizel = szd & SD_SZ_MASK;
+               if (szd & SD_SG32)
+                       *sizeh = get_erom_ent(sih, eromptr, 0, 0);
+       } else
+               *sizel = AD_SZ_BASE << (sz >> AD_SZ_SHIFT);
+
+       SI_VMSG(("  SP %d, ad %d: st = %d, 0x%08x_0x%08x @ 0x%08x_0x%08x\n",
+               sp, ad, st, *sizeh, *sizel, *addrh, *addrl));
+
+       return asd;
+}
+
+static void
+ai_hwfixup(si_info_t *sii)
+{
+}
+
+
+/* parse the enumeration rom to identify all cores */
+void
+ai_scan(si_t *sih, void *regs, uint devid)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       chipcregs_t *cc = (chipcregs_t *)regs;
+       uint32 erombase, *eromptr, *eromlim;
+
+       erombase = R_REG(sii->osh, &cc->eromptr);
+
+       switch (BUSTYPE(sih->bustype)) {
+       case SI_BUS:
+               eromptr = (uint32 *)REG_MAP(erombase, SI_CORE_SIZE);
+               break;
+
+       case PCI_BUS:
+               /* Set wrappers address */
+               sii->curwrap = (void *)((uintptr)regs + SI_CORE_SIZE);
+
+               /* Now point the window at the erom */
+               OSL_PCI_WRITE_CONFIG(sii->osh, PCI_BAR0_WIN, 4, erombase);
+               eromptr = regs;
+               break;
+
+#ifdef BCMSDIO
+       case SPI_BUS:
+       case SDIO_BUS:
+               eromptr = (uint32 *)(uintptr)erombase;
+               break;
+#endif /* BCMSDIO */
+
+       case PCMCIA_BUS:
+       default:
+               SI_ERROR(("Don't know how to do AXI enumertion on bus %d\n", sih->bustype));
+               ASSERT(0);
+               return;
+       }
+       eromlim = eromptr + (ER_REMAPCONTROL / sizeof(uint32));
+
+       SI_VMSG(("ai_scan: regs = 0x%p, erombase = 0x%08x, eromptr = 0x%p, eromlim = 0x%p\n",
+                regs, erombase, eromptr, eromlim));
+       while (eromptr < eromlim) {
+               uint32 cia, cib, cid, mfg, crev, nmw, nsw, nmp, nsp;
+               uint32 mpd, asd, addrl, addrh, sizel, sizeh;
+               uint i, j, idx;
+               bool br;
+
+               br = FALSE;
+
+               /* Grok a component */
+               cia = get_erom_ent(sih, &eromptr, ER_TAG, ER_CI);
+               if (cia == (ER_END | ER_VALID)) {
+                       SI_VMSG(("Found END of erom after %d cores\n", sii->numcores));
+                       ai_hwfixup(sii);
+                       return;
+               }
+
+               cib = get_erom_ent(sih, &eromptr, 0, 0);
+
+               if ((cib & ER_TAG) != ER_CI) {
+                       SI_ERROR(("CIA not followed by CIB\n"));
+                       goto error;
+               }
+
+               cid = (cia & CIA_CID_MASK) >> CIA_CID_SHIFT;
+               mfg = (cia & CIA_MFG_MASK) >> CIA_MFG_SHIFT;
+               crev = (cib & CIB_REV_MASK) >> CIB_REV_SHIFT;
+               nmw = (cib & CIB_NMW_MASK) >> CIB_NMW_SHIFT;
+               nsw = (cib & CIB_NSW_MASK) >> CIB_NSW_SHIFT;
+               nmp = (cib & CIB_NMP_MASK) >> CIB_NMP_SHIFT;
+               nsp = (cib & CIB_NSP_MASK) >> CIB_NSP_SHIFT;
+
+#ifdef BCMDBG_SI
+               SI_VMSG(("Found component 0x%04x/0x%04x rev %d at erom addr 0x%p, with nmw = %d, "
+                        "nsw = %d, nmp = %d & nsp = %d\n",
+                        mfg, cid, crev, eromptr - 1, nmw, nsw, nmp, nsp));
+#else
+               BCM_REFERENCE(crev);
+#endif
+
+               if (((mfg == MFGID_ARM) && (cid == DEF_AI_COMP)) || (nsp == 0))
+                       continue;
+               if ((nmw + nsw == 0)) {
+                       /* A component which is not a core */
+                       if (cid == OOB_ROUTER_CORE_ID) {
+                               asd = get_asd(sih, &eromptr, 0, 0, AD_ST_SLAVE,
+                                       &addrl, &addrh, &sizel, &sizeh);
+                               if (asd != 0) {
+                                       sii->oob_router = addrl;
+                               }
+                       }
+                       if (cid != GMAC_COMMON_4706_CORE_ID && cid != NS_CCB_CORE_ID &&
+                               cid != PMU_CORE_ID && cid != GCI_CORE_ID)
+                               continue;
+               }
+
+               idx = sii->numcores;
+
+               cores_info->cia[idx] = cia;
+               cores_info->cib[idx] = cib;
+               cores_info->coreid[idx] = remap_coreid(sih, cid);
+
+               for (i = 0; i < nmp; i++) {
+                       mpd = get_erom_ent(sih, &eromptr, ER_VALID, ER_VALID);
+                       if ((mpd & ER_TAG) != ER_MP) {
+                               SI_ERROR(("Not enough MP entries for component 0x%x\n", cid));
+                               goto error;
+                       }
+                       SI_VMSG(("  Master port %d, mp: %d id: %d\n", i,
+                                (mpd & MPD_MP_MASK) >> MPD_MP_SHIFT,
+                                (mpd & MPD_MUI_MASK) >> MPD_MUI_SHIFT));
+               }
+
+               /* First Slave Address Descriptor should be port 0:
+                * the main register space for the core
+                */
+               asd = get_asd(sih, &eromptr, 0, 0, AD_ST_SLAVE, &addrl, &addrh, &sizel, &sizeh);
+               if (asd == 0) {
+                       do {
+                       /* Try again to see if it is a bridge */
+                       asd = get_asd(sih, &eromptr, 0, 0, AD_ST_BRIDGE, &addrl, &addrh,
+                                     &sizel, &sizeh);
+                       if (asd != 0)
+                               br = TRUE;
+                       else {
+                                       if (br == TRUE) {
+                                               break;
+                                       }
+                                       else if ((addrh != 0) || (sizeh != 0) ||
+                                               (sizel != SI_CORE_SIZE)) {
+                                               SI_ERROR(("addrh = 0x%x\t sizeh = 0x%x\t size1 ="
+                                                       "0x%x\n", addrh, sizeh, sizel));
+                                               SI_ERROR(("First Slave ASD for"
+                                                       "core 0x%04x malformed "
+                                                       "(0x%08x)\n", cid, asd));
+                                               goto error;
+                                       }
+                               }
+                       } while (1);
+               }
+               cores_info->coresba[idx] = addrl;
+               cores_info->coresba_size[idx] = sizel;
+               /* Get any more ASDs in port 0 */
+               j = 1;
+               do {
+                       asd = get_asd(sih, &eromptr, 0, j, AD_ST_SLAVE, &addrl, &addrh,
+                                     &sizel, &sizeh);
+                       if ((asd != 0) && (j == 1) && (sizel == SI_CORE_SIZE)) {
+                               cores_info->coresba2[idx] = addrl;
+                               cores_info->coresba2_size[idx] = sizel;
+                       }
+                       j++;
+               } while (asd != 0);
+
+               /* Go through the ASDs for other slave ports */
+               for (i = 1; i < nsp; i++) {
+                       j = 0;
+                       do {
+                               asd = get_asd(sih, &eromptr, i, j, AD_ST_SLAVE, &addrl, &addrh,
+                                             &sizel, &sizeh);
+
+                               if (asd == 0)
+                                       break;
+                               j++;
+                       } while (1);
+                       if (j == 0) {
+                               SI_ERROR((" SP %d has no address descriptors\n", i));
+                               goto error;
+                       }
+               }
+
+               /* Now get master wrappers */
+               for (i = 0; i < nmw; i++) {
+                       asd = get_asd(sih, &eromptr, i, 0, AD_ST_MWRAP, &addrl, &addrh,
+                                     &sizel, &sizeh);
+                       if (asd == 0) {
+                               SI_ERROR(("Missing descriptor for MW %d\n", i));
+                               goto error;
+                       }
+                       if ((sizeh != 0) || (sizel != SI_CORE_SIZE)) {
+                               SI_ERROR(("Master wrapper %d is not 4KB\n", i));
+                               goto error;
+                       }
+                       if (i == 0)
+                               cores_info->wrapba[idx] = addrl;
+                       else if (i == 1)
+                               cores_info->wrapba2[idx] = addrl;
+               }
+
+               /* And finally slave wrappers */
+               for (i = 0; i < nsw; i++) {
+                       uint fwp = (nsp == 1) ? 0 : 1;
+                       asd = get_asd(sih, &eromptr, fwp + i, 0, AD_ST_SWRAP, &addrl, &addrh,
+                                     &sizel, &sizeh);
+
+                       /* cache APB bridge wrapper address for set/clear timeout */
+                       if ((mfg == MFGID_ARM) && (cid == APB_BRIDGE_ID)) {
+                               ASSERT(sii->num_br < SI_MAXBR);
+                               sii->br_wrapba[sii->num_br++] = addrl;
+                       }
+                       if (asd == 0) {
+                               SI_ERROR(("Missing descriptor for SW %d\n", i));
+                               goto error;
+                       }
+                       if ((sizeh != 0) || (sizel != SI_CORE_SIZE)) {
+                               SI_ERROR(("Slave wrapper %d is not 4KB\n", i));
+                               goto error;
+                       }
+                       if ((nmw == 0) && (i == 0))
+                               cores_info->wrapba[idx] = addrl;
+                       else if ((nmw == 0) && (i == 1))
+                               cores_info->wrapba2[idx] = addrl;
+               }
+
+
+               /* Don't record bridges */
+               if (br)
+                       continue;
+
+               /* Done with core */
+               sii->numcores++;
+       }
+
+       SI_ERROR(("Reached end of erom without finding END"));
+
+error:
+       sii->numcores = 0;
+       return;
+}
+
+#define AI_SETCOREIDX_MAPSIZE(coreid) \
+       (((coreid) == NS_CCB_CORE_ID) ? 15 * SI_CORE_SIZE : SI_CORE_SIZE)
+
+/* This function changes the logical "focus" to the indicated core.
+ * Return the current core's virtual address.
+ */
+static void *
+_ai_setcoreidx(si_t *sih, uint coreidx, uint use_wrap2)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint32 addr, wrap, wrap2;
+       void *regs;
+
+       if (coreidx >= MIN(sii->numcores, SI_MAXCORES))
+               return (NULL);
+
+       addr = cores_info->coresba[coreidx];
+       wrap = cores_info->wrapba[coreidx];
+       wrap2 = cores_info->wrapba2[coreidx];
+
+       /*
+        * If the user has provided an interrupt mask enabled function,
+        * then assert interrupts are disabled before switching the core.
+        */
+       ASSERT((sii->intrsenabled_fn == NULL) || !(*(sii)->intrsenabled_fn)((sii)->intr_arg));
+
+       switch (BUSTYPE(sih->bustype)) {
+       case SI_BUS:
+               /* map new one */
+               if (!cores_info->regs[coreidx]) {
+                       cores_info->regs[coreidx] = REG_MAP(addr,
+                               AI_SETCOREIDX_MAPSIZE(cores_info->coreid[coreidx]));
+                       ASSERT(GOODREGS(cores_info->regs[coreidx]));
+               }
+               sii->curmap = regs = cores_info->regs[coreidx];
+               if (!cores_info->wrappers[coreidx] && (wrap != 0)) {
+                       cores_info->wrappers[coreidx] = REG_MAP(wrap, SI_CORE_SIZE);
+                       ASSERT(GOODREGS(cores_info->wrappers[coreidx]));
+               }
+               if (!cores_info->wrappers2[coreidx] && (wrap2 != 0)) {
+                       cores_info->wrappers2[coreidx] = REG_MAP(wrap2, SI_CORE_SIZE);
+                       ASSERT(GOODREGS(cores_info->wrappers2[coreidx]));
+               }
+               if (use_wrap2)
+                       sii->curwrap = cores_info->wrappers2[coreidx];
+               else
+                       sii->curwrap = cores_info->wrappers[coreidx];
+               break;
+
+       case PCI_BUS:
+               /* point bar0 window */
+               OSL_PCI_WRITE_CONFIG(sii->osh, PCI_BAR0_WIN, 4, addr);
+               regs = sii->curmap;
+               /* point bar0 2nd 4KB window to the primary wrapper */
+               if (use_wrap2)
+                       wrap = wrap2;
+               if (PCIE_GEN2(sii))
+                       OSL_PCI_WRITE_CONFIG(sii->osh, PCIE2_BAR0_WIN2, 4, wrap);
+               else
+                       OSL_PCI_WRITE_CONFIG(sii->osh, PCI_BAR0_WIN2, 4, wrap);
+               break;
+
+#ifdef BCMSDIO
+       case SPI_BUS:
+       case SDIO_BUS:
+               sii->curmap = regs = (void *)((uintptr)addr);
+               if (use_wrap2)
+                       sii->curwrap = (void *)((uintptr)wrap2);
+               else
+                       sii->curwrap = (void *)((uintptr)wrap);
+               break;
+#endif /* BCMSDIO */
+
+       case PCMCIA_BUS:
+       default:
+               ASSERT(0);
+               regs = NULL;
+               break;
+       }
+
+       sii->curmap = regs;
+       sii->curidx = coreidx;
+
+       return regs;
+}
+
+void *
+ai_setcoreidx(si_t *sih, uint coreidx)
+{
+       return _ai_setcoreidx(sih, coreidx, 0);
+}
+
+void *
+ai_setcoreidx_2ndwrap(si_t *sih, uint coreidx)
+{
+       return _ai_setcoreidx(sih, coreidx, 1);
+}
+
+void
+ai_coreaddrspaceX(si_t *sih, uint asidx, uint32 *addr, uint32 *size)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       chipcregs_t *cc = NULL;
+       uint32 erombase, *eromptr, *eromlim;
+       uint i, j, cidx;
+       uint32 cia, cib, nmp, nsp;
+       uint32 asd, addrl, addrh, sizel, sizeh;
+
+       for (i = 0; i < sii->numcores; i++) {
+               if (cores_info->coreid[i] == CC_CORE_ID) {
+                       cc = (chipcregs_t *)cores_info->regs[i];
+                       break;
+               }
+       }
+       if (cc == NULL)
+               goto error;
+
+       erombase = R_REG(sii->osh, &cc->eromptr);
+       eromptr = (uint32 *)REG_MAP(erombase, SI_CORE_SIZE);
+       eromlim = eromptr + (ER_REMAPCONTROL / sizeof(uint32));
+
+       cidx = sii->curidx;
+       cia = cores_info->cia[cidx];
+       cib = cores_info->cib[cidx];
+
+       nmp = (cib & CIB_NMP_MASK) >> CIB_NMP_SHIFT;
+       nsp = (cib & CIB_NSP_MASK) >> CIB_NSP_SHIFT;
+
+       /* scan for cores */
+       while (eromptr < eromlim) {
+               if ((get_erom_ent(sih, &eromptr, ER_TAG, ER_CI) == cia) &&
+                       (get_erom_ent(sih, &eromptr, 0, 0) == cib)) {
+                       break;
+               }
+       }
+
+       /* skip master ports */
+       for (i = 0; i < nmp; i++)
+               get_erom_ent(sih, &eromptr, ER_VALID, ER_VALID);
+
+       /* Skip ASDs in port 0 */
+       asd = get_asd(sih, &eromptr, 0, 0, AD_ST_SLAVE, &addrl, &addrh, &sizel, &sizeh);
+       if (asd == 0) {
+               /* Try again to see if it is a bridge */
+               asd = get_asd(sih, &eromptr, 0, 0, AD_ST_BRIDGE, &addrl, &addrh,
+                             &sizel, &sizeh);
+       }
+
+       j = 1;
+       do {
+               asd = get_asd(sih, &eromptr, 0, j, AD_ST_SLAVE, &addrl, &addrh,
+                             &sizel, &sizeh);
+               j++;
+       } while (asd != 0);
+
+       /* Go through the ASDs for other slave ports */
+       for (i = 1; i < nsp; i++) {
+               j = 0;
+               do {
+                       asd = get_asd(sih, &eromptr, i, j, AD_ST_SLAVE, &addrl, &addrh,
+                               &sizel, &sizeh);
+                       if (asd == 0)
+                               break;
+
+                       if (!asidx--) {
+                               *addr = addrl;
+                               *size = sizel;
+                               return;
+                       }
+                       j++;
+               } while (1);
+
+               if (j == 0) {
+                       SI_ERROR((" SP %d has no address descriptors\n", i));
+                       break;
+               }
+       }
+
+error:
+       *size = 0;
+       return;
+}
+
+/* Return the number of address spaces in current core */
+int
+ai_numaddrspaces(si_t *sih)
+{
+       return 2;
+}
+
+/* Return the address of the nth address space in the current core */
+uint32
+ai_addrspace(si_t *sih, uint asidx)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint cidx;
+
+       cidx = sii->curidx;
+
+       if (asidx == 0)
+               return cores_info->coresba[cidx];
+       else if (asidx == 1)
+               return cores_info->coresba2[cidx];
+       else {
+               SI_ERROR(("%s: Need to parse the erom again to find addr space %d\n",
+                         __FUNCTION__, asidx));
+               return 0;
+       }
+}
+
+/* Return the size of the nth address space in the current core */
+uint32
+ai_addrspacesize(si_t *sih, uint asidx)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint cidx;
+
+       cidx = sii->curidx;
+
+       if (asidx == 0)
+               return cores_info->coresba_size[cidx];
+       else if (asidx == 1)
+               return cores_info->coresba2_size[cidx];
+       else {
+               SI_ERROR(("%s: Need to parse the erom again to find addr space %d\n",
+                         __FUNCTION__, asidx));
+               return 0;
+       }
+}
+
+uint
+ai_flag(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+       aidmp_t *ai;
+
+       if (BCM47162_DMP()) {
+               SI_ERROR(("%s: Attempting to read MIPS DMP registers on 47162a0", __FUNCTION__));
+               return sii->curidx;
+       }
+       if (BCM5357_DMP()) {
+               SI_ERROR(("%s: Attempting to read USB20H DMP registers on 5357b0\n", __FUNCTION__));
+               return sii->curidx;
+       }
+       if (BCM4707_DMP()) {
+               SI_ERROR(("%s: Attempting to read CHIPCOMMONB DMP registers on 4707\n",
+                       __FUNCTION__));
+               return sii->curidx;
+       }
+       if (BCM53573_DMP()) {
+               SI_ERROR(("%s: Attempting to read DMP registers on 53573\n", __FUNCTION__));
+               return sii->curidx;
+       }
+#ifdef REROUTE_OOBINT
+       if (PMU_DMP()) {
+               SI_ERROR(("%s: Attempting to read PMU DMP registers\n",
+                       __FUNCTION__));
+               return PMU_OOB_BIT;
+       }
+#else
+       if (PMU_DMP()) {
+               uint idx, flag;
+               idx = sii->curidx;
+               ai_setcoreidx(sih, SI_CC_IDX);
+               flag = ai_flag_alt(sih);
+               ai_setcoreidx(sih, idx);
+               return flag;
+       }
+#endif /* REROUTE_OOBINT */
+
+       ai = sii->curwrap;
+       ASSERT(ai != NULL);
+
+       return (R_REG(sii->osh, &ai->oobselouta30) & 0x1f);
+}
+
+uint
+ai_flag_alt(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+       aidmp_t *ai;
+
+       if (BCM47162_DMP()) {
+               SI_ERROR(("%s: Attempting to read MIPS DMP registers on 47162a0", __FUNCTION__));
+               return sii->curidx;
+       }
+       if (BCM5357_DMP()) {
+               SI_ERROR(("%s: Attempting to read USB20H DMP registers on 5357b0\n", __FUNCTION__));
+               return sii->curidx;
+       }
+       if (BCM4707_DMP()) {
+               SI_ERROR(("%s: Attempting to read CHIPCOMMONB DMP registers on 4707\n",
+                       __FUNCTION__));
+               return sii->curidx;
+       }
+#ifdef REROUTE_OOBINT
+       if (PMU_DMP()) {
+               SI_ERROR(("%s: Attempting to read PMU DMP registers\n",
+                       __FUNCTION__));
+               return PMU_OOB_BIT;
+       }
+#endif /* REROUTE_OOBINT */
+
+       ai = sii->curwrap;
+
+       return ((R_REG(sii->osh, &ai->oobselouta30) >> AI_OOBSEL_1_SHIFT) & AI_OOBSEL_MASK);
+}
+
+void
+ai_setint(si_t *sih, int siflag)
+{
+}
+
+uint
+ai_wrap_reg(si_t *sih, uint32 offset, uint32 mask, uint32 val)
+{
+       si_info_t *sii = SI_INFO(sih);
+       uint32 *map = (uint32 *) sii->curwrap;
+
+       if (mask || val) {
+               uint32 w = R_REG(sii->osh, map+(offset/4));
+               w &= ~mask;
+               w |= val;
+               W_REG(sii->osh, map+(offset/4), w);
+       }
+
+       return (R_REG(sii->osh, map+(offset/4)));
+}
+
+uint
+ai_corevendor(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint32 cia;
+
+       cia = cores_info->cia[sii->curidx];
+       return ((cia & CIA_MFG_MASK) >> CIA_MFG_SHIFT);
+}
+
+uint
+ai_corerev(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint32 cib;
+
+
+       cib = cores_info->cib[sii->curidx];
+       return remap_corerev(sih, (cib & CIB_REV_MASK) >> CIB_REV_SHIFT);
+}
+
+bool
+ai_iscoreup(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+       aidmp_t *ai;
+
+       ai = sii->curwrap;
+
+       return (((R_REG(sii->osh, &ai->ioctrl) & (SICF_FGC | SICF_CLOCK_EN)) == SICF_CLOCK_EN) &&
+               ((R_REG(sii->osh, &ai->resetctrl) & AIRC_RESET) == 0));
+}
+
+/*
+ * Switch to 'coreidx', issue a single arbitrary 32bit register mask&set operation,
+ * switch back to the original core, and return the new value.
+ *
+ * When using the silicon backplane, no fiddling with interrupts or core switches is needed.
+ *
+ * Also, when using pci/pcie, we can optimize away the core switching for pci registers
+ * and (on newer pci cores) chipcommon registers.
+ */
+uint
+ai_corereg(si_t *sih, uint coreidx, uint regoff, uint mask, uint val)
+{
+       uint origidx = 0;
+       uint32 *r = NULL;
+       uint w;
+       uint intr_val = 0;
+       bool fast = FALSE;
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+
+       ASSERT(GOODIDX(coreidx));
+       ASSERT(regoff < SI_CORE_SIZE);
+       ASSERT((val & ~mask) == 0);
+
+       if (coreidx >= SI_MAXCORES)
+               return 0;
+
+       if (BUSTYPE(sih->bustype) == SI_BUS) {
+               /* If internal bus, we can always get at everything */
+               fast = TRUE;
+               /* map if does not exist */
+               if (!cores_info->regs[coreidx]) {
+                       cores_info->regs[coreidx] = REG_MAP(cores_info->coresba[coreidx],
+                                                   SI_CORE_SIZE);
+                       ASSERT(GOODREGS(cores_info->regs[coreidx]));
+               }
+               r = (uint32 *)((uchar *)cores_info->regs[coreidx] + regoff);
+       } else if (BUSTYPE(sih->bustype) == PCI_BUS) {
+               /* If pci/pcie, we can get at pci/pcie regs and on newer cores to chipc */
+
+               if ((cores_info->coreid[coreidx] == CC_CORE_ID) && SI_FAST(sii)) {
+                       /* Chipc registers are mapped at 12KB */
+
+                       fast = TRUE;
+                       r = (uint32 *)((char *)sii->curmap + PCI_16KB0_CCREGS_OFFSET + regoff);
+               } else if (sii->pub.buscoreidx == coreidx) {
+                       /* pci registers are at either in the last 2KB of an 8KB window
+                        * or, in pcie and pci rev 13 at 8KB
+                        */
+                       fast = TRUE;
+                       if (SI_FAST(sii))
+                               r = (uint32 *)((char *)sii->curmap +
+                                              PCI_16KB0_PCIREGS_OFFSET + regoff);
+                       else
+                               r = (uint32 *)((char *)sii->curmap +
+                                              ((regoff >= SBCONFIGOFF) ?
+                                               PCI_BAR0_PCISBR_OFFSET : PCI_BAR0_PCIREGS_OFFSET) +
+                                              regoff);
+               }
+       }
+
+       if (!fast) {
+               INTR_OFF(sii, intr_val);
+
+               /* save current core index */
+               origidx = si_coreidx(&sii->pub);
+
+               /* switch core */
+               r = (uint32*) ((uchar*) ai_setcoreidx(&sii->pub, coreidx) + regoff);
+       }
+       ASSERT(r != NULL);
+
+       /* mask and set */
+       if (mask || val) {
+               w = (R_REG(sii->osh, r) & ~mask) | val;
+               W_REG(sii->osh, r, w);
+       }
+
+       /* readback */
+       w = R_REG(sii->osh, r);
+
+       if (!fast) {
+               /* restore core index */
+               if (origidx != coreidx)
+                       ai_setcoreidx(&sii->pub, origidx);
+
+               INTR_RESTORE(sii, intr_val);
+       }
+
+       return (w);
+}
+
+/*
+ * If there is no need for fiddling with interrupts or core switches (typically silicon
+ * back plane registers, pci registers and chipcommon registers), this function
+ * returns the register offset on this core to a mapped address. This address can
+ * be used for W_REG/R_REG directly.
+ *
+ * For accessing registers that would need a core switch, this function will return
+ * NULL.
+ */
+uint32 *
+ai_corereg_addr(si_t *sih, uint coreidx, uint regoff)
+{
+       uint32 *r = NULL;
+       bool fast = FALSE;
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+
+       ASSERT(GOODIDX(coreidx));
+       ASSERT(regoff < SI_CORE_SIZE);
+
+       if (coreidx >= SI_MAXCORES)
+               return 0;
+
+       if (BUSTYPE(sih->bustype) == SI_BUS) {
+               /* If internal bus, we can always get at everything */
+               fast = TRUE;
+               /* map if does not exist */
+               if (!cores_info->regs[coreidx]) {
+                       cores_info->regs[coreidx] = REG_MAP(cores_info->coresba[coreidx],
+                                                   SI_CORE_SIZE);
+                       ASSERT(GOODREGS(cores_info->regs[coreidx]));
+               }
+               r = (uint32 *)((uchar *)cores_info->regs[coreidx] + regoff);
+       } else if (BUSTYPE(sih->bustype) == PCI_BUS) {
+               /* If pci/pcie, we can get at pci/pcie regs and on newer cores to chipc */
+
+               if ((cores_info->coreid[coreidx] == CC_CORE_ID) && SI_FAST(sii)) {
+                       /* Chipc registers are mapped at 12KB */
+
+                       fast = TRUE;
+                       r = (uint32 *)((char *)sii->curmap + PCI_16KB0_CCREGS_OFFSET + regoff);
+               } else if (sii->pub.buscoreidx == coreidx) {
+                       /* pci registers are at either in the last 2KB of an 8KB window
+                        * or, in pcie and pci rev 13 at 8KB
+                        */
+                       fast = TRUE;
+                       if (SI_FAST(sii))
+                               r = (uint32 *)((char *)sii->curmap +
+                                              PCI_16KB0_PCIREGS_OFFSET + regoff);
+                       else
+                               r = (uint32 *)((char *)sii->curmap +
+                                              ((regoff >= SBCONFIGOFF) ?
+                                               PCI_BAR0_PCISBR_OFFSET : PCI_BAR0_PCIREGS_OFFSET) +
+                                              regoff);
+               }
+       }
+
+       if (!fast) {
+               ASSERT(sii->curidx == coreidx);
+               r = (uint32*) ((uchar*)sii->curmap + regoff);
+       }
+
+       return (r);
+}
+
+void
+ai_core_disable(si_t *sih, uint32 bits)
+{
+       si_info_t *sii = SI_INFO(sih);
+       volatile uint32 dummy;
+       uint32 status;
+       aidmp_t *ai;
+
+
+       ASSERT(GOODREGS(sii->curwrap));
+       ai = sii->curwrap;
+
+       /* if core is already in reset, just return */
+       if (R_REG(sii->osh, &ai->resetctrl) & AIRC_RESET)
+               return;
+
+       /* ensure there are no pending backplane operations */
+       SPINWAIT(((status = R_REG(sii->osh, &ai->resetstatus)) != 0), 300);
+
+       /* if pending backplane ops still, try waiting longer */
+       if (status != 0) {
+               /* 300usecs was sufficient to allow backplane ops to clear for big hammer */
+               /* during driver load we may need more time */
+               SPINWAIT(((status = R_REG(sii->osh, &ai->resetstatus)) != 0), 10000);
+               /* if still pending ops, continue on and try disable anyway */
+               /* this is in big hammer path, so don't call wl_reinit in this case... */
+       }
+
+       W_REG(sii->osh, &ai->resetctrl, AIRC_RESET);
+       dummy = R_REG(sii->osh, &ai->resetctrl);
+       BCM_REFERENCE(dummy);
+       OSL_DELAY(1);
+
+       W_REG(sii->osh, &ai->ioctrl, bits);
+       dummy = R_REG(sii->osh, &ai->ioctrl);
+       BCM_REFERENCE(dummy);
+       OSL_DELAY(10);
+}
+
+/* reset and re-enable a core
+ * inputs:
+ * bits - core specific bits that are set during and after reset sequence
+ * resetbits - core specific bits that are set only during reset sequence
+ */
+static void
+_ai_core_reset(si_t *sih, uint32 bits, uint32 resetbits)
+{
+       si_info_t *sii = SI_INFO(sih);
+       aidmp_t *ai;
+       volatile uint32 dummy;
+       uint loop_counter = 10;
+#ifdef CUSTOMER_HW4_DEBUG
+       printf("%s: bits: 0x%x, resetbits: 0x%x\n", __FUNCTION__, bits, resetbits);
+#endif
+
+       ASSERT(GOODREGS(sii->curwrap));
+       ai = sii->curwrap;
+
+       /* ensure there are no pending backplane operations */
+       SPINWAIT(((dummy = R_REG(sii->osh, &ai->resetstatus)) != 0), 300);
+#ifdef CUSTOMER_HW4_DEBUG
+       printf("%s: resetstatus: %p dummy: %x\n", __FUNCTION__, &ai->resetstatus, dummy);
+#endif
+
+
+       /* put core into reset state */
+#ifdef CUSTOMER_HW4_DEBUG
+       printf("%s: resetctrl: %p\n", __FUNCTION__, &ai->resetctrl);
+#endif
+       W_REG(sii->osh, &ai->resetctrl, AIRC_RESET);
+       OSL_DELAY(10);
+
+       /* ensure there are no pending backplane operations */
+       SPINWAIT((R_REG(sii->osh, &ai->resetstatus) != 0), 300);
+
+       W_REG(sii->osh, &ai->ioctrl, (bits | resetbits | SICF_FGC | SICF_CLOCK_EN));
+       dummy = R_REG(sii->osh, &ai->ioctrl);
+#ifdef CUSTOMER_HW4_DEBUG
+       printf("%s: ioctrl: %p dummy: 0x%x\n", __FUNCTION__, &ai->ioctrl, dummy);
+#endif
+       BCM_REFERENCE(dummy);
+
+       /* ensure there are no pending backplane operations */
+       SPINWAIT(((dummy = R_REG(sii->osh, &ai->resetstatus)) != 0), 300);
+
+
+       while (R_REG(sii->osh, &ai->resetctrl) != 0 && --loop_counter != 0) {
+               /* ensure there are no pending backplane operations */
+               SPINWAIT(((dummy = R_REG(sii->osh, &ai->resetstatus)) != 0), 300);
+
+
+               /* take core out of reset */
+               W_REG(sii->osh, &ai->resetctrl, 0);
+#ifdef CUSTOMER_HW4_DEBUG
+               printf("%s: loop_counter: %d resetstatus: %p resetctrl: %p\n",
+                       __FUNCTION__, loop_counter, &ai->resetstatus, &ai->resetctrl);
+#endif
+
+               /* ensure there are no pending backplane operations */
+               SPINWAIT((R_REG(sii->osh, &ai->resetstatus) != 0), 300);
+       }
+
+
+       W_REG(sii->osh, &ai->ioctrl, (bits | SICF_CLOCK_EN));
+       dummy = R_REG(sii->osh, &ai->ioctrl);
+#ifdef CUSTOMER_HW4_DEBUG
+       printf("%s: ioctl: %p dummy: 0x%x\n", __FUNCTION__, &ai->ioctrl, dummy);
+#endif
+       BCM_REFERENCE(dummy);
+       OSL_DELAY(1);
+}
+
+void
+ai_core_reset(si_t *sih, uint32 bits, uint32 resetbits)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint idx = sii->curidx;
+
+       if (cores_info->wrapba2[idx] != 0) {
+               ai_setcoreidx_2ndwrap(sih, idx);
+               _ai_core_reset(sih, bits, resetbits);
+               ai_setcoreidx(sih, idx);
+       }
+
+       _ai_core_reset(sih, bits, resetbits);
+}
+
+void
+ai_core_cflags_wo(si_t *sih, uint32 mask, uint32 val)
+{
+       si_info_t *sii = SI_INFO(sih);
+       aidmp_t *ai;
+       uint32 w;
+
+
+       if (BCM47162_DMP()) {
+               SI_ERROR(("%s: Accessing MIPS DMP register (ioctrl) on 47162a0",
+                         __FUNCTION__));
+               return;
+       }
+       if (BCM5357_DMP()) {
+               SI_ERROR(("%s: Accessing USB20H DMP register (ioctrl) on 5357\n",
+                         __FUNCTION__));
+               return;
+       }
+       if (BCM4707_DMP()) {
+               SI_ERROR(("%s: Accessing CHIPCOMMONB DMP register (ioctrl) on 4707\n",
+                       __FUNCTION__));
+               return;
+       }
+       if (PMU_DMP()) {
+               SI_ERROR(("%s: Accessing PMU DMP register (ioctrl)\n",
+                       __FUNCTION__));
+               return;
+       }
+
+       ASSERT(GOODREGS(sii->curwrap));
+       ai = sii->curwrap;
+
+       ASSERT((val & ~mask) == 0);
+
+       if (mask || val) {
+               w = ((R_REG(sii->osh, &ai->ioctrl) & ~mask) | val);
+               W_REG(sii->osh, &ai->ioctrl, w);
+       }
+}
+
+uint32
+ai_core_cflags(si_t *sih, uint32 mask, uint32 val)
+{
+       si_info_t *sii = SI_INFO(sih);
+       aidmp_t *ai;
+       uint32 w;
+
+       if (BCM47162_DMP()) {
+               SI_ERROR(("%s: Accessing MIPS DMP register (ioctrl) on 47162a0",
+                         __FUNCTION__));
+               return 0;
+       }
+       if (BCM5357_DMP()) {
+               SI_ERROR(("%s: Accessing USB20H DMP register (ioctrl) on 5357\n",
+                         __FUNCTION__));
+               return 0;
+       }
+       if (BCM4707_DMP()) {
+               SI_ERROR(("%s: Accessing CHIPCOMMONB DMP register (ioctrl) on 4707\n",
+                       __FUNCTION__));
+               return 0;
+       }
+
+       if (PMU_DMP()) {
+               SI_ERROR(("%s: Accessing PMU DMP register (ioctrl)\n",
+                       __FUNCTION__));
+               return 0;
+       }
+       ASSERT(GOODREGS(sii->curwrap));
+       ai = sii->curwrap;
+
+       ASSERT((val & ~mask) == 0);
+
+       if (mask || val) {
+               w = ((R_REG(sii->osh, &ai->ioctrl) & ~mask) | val);
+               W_REG(sii->osh, &ai->ioctrl, w);
+       }
+
+       return R_REG(sii->osh, &ai->ioctrl);
+}
+
+uint32
+ai_core_sflags(si_t *sih, uint32 mask, uint32 val)
+{
+       si_info_t *sii = SI_INFO(sih);
+       aidmp_t *ai;
+       uint32 w;
+
+       if (BCM47162_DMP()) {
+               SI_ERROR(("%s: Accessing MIPS DMP register (iostatus) on 47162a0",
+                         __FUNCTION__));
+               return 0;
+       }
+       if (BCM5357_DMP()) {
+               SI_ERROR(("%s: Accessing USB20H DMP register (iostatus) on 5357\n",
+                         __FUNCTION__));
+               return 0;
+       }
+       if (BCM4707_DMP()) {
+               SI_ERROR(("%s: Accessing CHIPCOMMONB DMP register (ioctrl) on 4707\n",
+                       __FUNCTION__));
+               return 0;
+       }
+       if (PMU_DMP()) {
+               SI_ERROR(("%s: Accessing PMU DMP register (ioctrl)\n",
+                       __FUNCTION__));
+               return 0;
+       }
+
+       ASSERT(GOODREGS(sii->curwrap));
+       ai = sii->curwrap;
+
+       ASSERT((val & ~mask) == 0);
+       ASSERT((mask & ~SISF_CORE_BITS) == 0);
+
+       if (mask || val) {
+               w = ((R_REG(sii->osh, &ai->iostatus) & ~mask) | val);
+               W_REG(sii->osh, &ai->iostatus, w);
+       }
+
+       return R_REG(sii->osh, &ai->iostatus);
+}
+
+#if defined(BCMDBG_PHYDUMP)
+/* print interesting aidmp registers */
+void
+ai_dumpregs(si_t *sih, struct bcmstrbuf *b)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       osl_t *osh;
+       aidmp_t *ai;
+       uint i;
+
+       osh = sii->osh;
+
+       for (i = 0; i < sii->numcores; i++) {
+               si_setcoreidx(&sii->pub, i);
+               ai = sii->curwrap;
+
+               bcm_bprintf(b, "core 0x%x: \n", cores_info->coreid[i]);
+               if (BCM47162_DMP()) {
+                       bcm_bprintf(b, "Skipping mips74k in 47162a0\n");
+                       continue;
+               }
+               if (BCM5357_DMP()) {
+                       bcm_bprintf(b, "Skipping usb20h in 5357\n");
+                       continue;
+               }
+               if (BCM4707_DMP()) {
+                       bcm_bprintf(b, "Skipping chipcommonb in 4707\n");
+                       continue;
+               }
+
+               if (PMU_DMP()) {
+                       bcm_bprintf(b, "Skipping pmu core\n");
+                       continue;
+               }
+
+               bcm_bprintf(b, "ioctrlset 0x%x ioctrlclear 0x%x ioctrl 0x%x iostatus 0x%x"
+                           "ioctrlwidth 0x%x iostatuswidth 0x%x\n"
+                           "resetctrl 0x%x resetstatus 0x%x resetreadid 0x%x resetwriteid 0x%x\n"
+                           "errlogctrl 0x%x errlogdone 0x%x errlogstatus 0x%x"
+                           "errlogaddrlo 0x%x errlogaddrhi 0x%x\n"
+                           "errlogid 0x%x errloguser 0x%x errlogflags 0x%x\n"
+                           "intstatus 0x%x config 0x%x itcr 0x%x\n",
+                           R_REG(osh, &ai->ioctrlset),
+                           R_REG(osh, &ai->ioctrlclear),
+                           R_REG(osh, &ai->ioctrl),
+                           R_REG(osh, &ai->iostatus),
+                           R_REG(osh, &ai->ioctrlwidth),
+                           R_REG(osh, &ai->iostatuswidth),
+                           R_REG(osh, &ai->resetctrl),
+                           R_REG(osh, &ai->resetstatus),
+                           R_REG(osh, &ai->resetreadid),
+                           R_REG(osh, &ai->resetwriteid),
+                           R_REG(osh, &ai->errlogctrl),
+                           R_REG(osh, &ai->errlogdone),
+                           R_REG(osh, &ai->errlogstatus),
+                           R_REG(osh, &ai->errlogaddrlo),
+                           R_REG(osh, &ai->errlogaddrhi),
+                           R_REG(osh, &ai->errlogid),
+                           R_REG(osh, &ai->errloguser),
+                           R_REG(osh, &ai->errlogflags),
+                           R_REG(osh, &ai->intstatus),
+                           R_REG(osh, &ai->config),
+                           R_REG(osh, &ai->itcr));
+       }
+}
+#endif 
+
+
+void
+ai_enable_backplane_timeouts(si_t *sih)
+{
+#ifdef AXI_TIMEOUTS
+       si_info_t *sii = SI_INFO(sih);
+       aidmp_t *ai;
+       int i;
+
+       for (i = 0; i < sii->num_br; ++i) {
+               ai = (aidmp_t *) sii->br_wrapba[i];
+               W_REG(sii->osh, &ai->errlogctrl, (1 << AIELC_TO_ENAB_SHIFT) |
+                     ((AXI_TO_VAL << AIELC_TO_EXP_SHIFT) & AIELC_TO_EXP_MASK));
+       }
+#endif /* AXI_TIMEOUTS */
+}
+
+void
+ai_clear_backplane_to(si_t *sih)
+{
+#ifdef AXI_TIMEOUTS
+       si_info_t *sii = SI_INFO(sih);
+       aidmp_t *ai;
+       int i;
+       uint32 errlogstatus;
+
+       for (i = 0; i < sii->num_br; ++i) {
+               ai = (aidmp_t *) sii->br_wrapba[i];
+               /* check for backplane timeout & clear backplane hang */
+               errlogstatus = R_REG(sii->osh, &ai->errlogstatus);
+
+               if ((errlogstatus & AIELS_TIMEOUT_MASK) != 0) {
+                       /* set ErrDone to clear the condition */
+                       W_REG(sii->osh, &ai->errlogdone, AIELD_ERRDONE_MASK);
+
+                       /* SPINWAIT on errlogstatus timeout status bits */
+                       while (R_REG(sii->osh, &ai->errlogstatus) & AIELS_TIMEOUT_MASK)
+                               ;
+
+                       /* only reset APB Bridge on timeout (not slave error, or dec error) */
+                       switch (errlogstatus & AIELS_TIMEOUT_MASK) {
+                       case 0x1:
+                               printf("AXI slave error");
+                               break;
+                       case 0x2:
+                               /* reset APB Bridge */
+                               OR_REG(sii->osh, &ai->resetctrl, AIRC_RESET);
+                               /* sync write */
+                               (void)R_REG(sii->osh, &ai->resetctrl);
+                               /* clear Reset bit */
+                               AND_REG(sii->osh, &ai->resetctrl, ~(AIRC_RESET));
+                               /* sync write */
+                               (void)R_REG(sii->osh, &ai->resetctrl);
+                               printf("AXI timeout");
+                               break;
+                       case 0x3:
+                               printf("AXI decode error");
+                               break;
+                       default:
+                               ;       /* should be impossible */
+                       }
+                       printf("; APB Bridge %d\n", i);
+                       printf("\t errlog: lo 0x%08x, hi 0x%08x, id 0x%08x, flags 0x%08x",
+                               R_REG(sii->osh, &ai->errlogaddrlo),
+                               R_REG(sii->osh, &ai->errlogaddrhi),
+                               R_REG(sii->osh, &ai->errlogid),
+                               R_REG(sii->osh, &ai->errlogflags));
+                       printf(", status 0x%08x\n", errlogstatus);
+               }
+       }
+#endif /* AXI_TIMEOUTS */
+}
diff --git a/drivers/net/wireless/bcmdhd_1363/bcm_app_utils.c b/drivers/net/wireless/bcmdhd_1363/bcm_app_utils.c
new file mode 100644 (file)
index 0000000..b0b0fbe
--- /dev/null
@@ -0,0 +1,1012 @@
+/*
+ * Misc utility routines used by kernel or app-level.
+ * Contents are wifi-specific, used by any kernel or app-level
+ * software that might want wifi things as it grows.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcm_app_utils.c 547371 2015-04-08 12:51:39Z $
+ */
+
+#include <typedefs.h>
+
+#ifdef BCMDRIVER
+#include <osl.h>
+#define strtoul(nptr, endptr, base) bcm_strtoul((nptr), (endptr), (base))
+#define tolower(c) (bcm_isupper((c)) ? ((c) + 'a' - 'A') : (c))
+#else /* BCMDRIVER */
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <ctype.h>
+#ifndef ASSERT
+#define ASSERT(exp)
+#endif
+#endif /* BCMDRIVER */
+#include <bcmwifi_channels.h>
+
+#if defined(WIN32) && (defined(BCMDLL) || defined(WLMDLL))
+#include <bcmstdlib.h> /* For wl/exe/GNUmakefile.brcm_wlu and GNUmakefile.wlm_dll */
+#endif
+
+#include <bcmutils.h>
+#include <wlioctl.h>
+#include <wlioctl_utils.h>
+
+#ifndef BCMDRIVER
+/*     Take an array of measurments representing a single channel over time and return
+       a summary. Currently implemented as a simple average but could easily evolve
+       into more cpomplex alogrithms.
+*/
+cca_congest_channel_req_t *
+cca_per_chan_summary(cca_congest_channel_req_t *input, cca_congest_channel_req_t *avg, bool percent)
+{
+       int sec;
+       cca_congest_t totals;
+
+       totals.duration  = 0;
+       totals.congest_ibss  = 0;
+       totals.congest_obss  = 0;
+       totals.interference  = 0;
+       avg->num_secs = 0;
+
+       for (sec = 0; sec < input->num_secs; sec++) {
+               if (input->secs[sec].duration) {
+                       totals.duration += input->secs[sec].duration;
+                       totals.congest_ibss += input->secs[sec].congest_ibss;
+                       totals.congest_obss += input->secs[sec].congest_obss;
+                       totals.interference += input->secs[sec].interference;
+                       avg->num_secs++;
+               }
+       }
+       avg->chanspec = input->chanspec;
+
+       if (!avg->num_secs || !totals.duration)
+               return (avg);
+
+       if (percent) {
+               avg->secs[0].duration = totals.duration / avg->num_secs;
+               avg->secs[0].congest_ibss = totals.congest_ibss * 100/totals.duration;
+               avg->secs[0].congest_obss = totals.congest_obss * 100/totals.duration;
+               avg->secs[0].interference = totals.interference * 100/totals.duration;
+       } else {
+               avg->secs[0].duration = totals.duration / avg->num_secs;
+               avg->secs[0].congest_ibss = totals.congest_ibss / avg->num_secs;
+               avg->secs[0].congest_obss = totals.congest_obss / avg->num_secs;
+               avg->secs[0].interference = totals.interference / avg->num_secs;
+       }
+
+       return (avg);
+}
+
+static void
+cca_info(uint8 *bitmap, int num_bits, int *left, int *bit_pos)
+{
+       int i;
+       for (*left = 0, i = 0; i < num_bits; i++) {
+               if (isset(bitmap, i)) {
+                       (*left)++;
+                       *bit_pos = i;
+               }
+       }
+}
+
+static uint8
+spec_to_chan(chanspec_t chspec)
+{
+       uint8 center_ch, edge, primary, sb;
+
+       center_ch = CHSPEC_CHANNEL(chspec);
+
+       if (CHSPEC_IS20(chspec)) {
+               return center_ch;
+       } else {
+               /* the lower edge of the wide channel is half the bw from
+                * the center channel.
+                */
+               if (CHSPEC_IS40(chspec)) {
+                       edge = center_ch - CH_20MHZ_APART;
+               } else {
+                       /* must be 80MHz (until we support more) */
+                       ASSERT(CHSPEC_IS80(chspec));
+                       edge = center_ch - CH_40MHZ_APART;
+               }
+
+               /* find the channel number of the lowest 20MHz primary channel */
+               primary = edge + CH_10MHZ_APART;
+
+               /* select the actual subband */
+               sb = (chspec & WL_CHANSPEC_CTL_SB_MASK) >> WL_CHANSPEC_CTL_SB_SHIFT;
+               primary = primary + sb * CH_20MHZ_APART;
+
+               return primary;
+       }
+}
+
+/*
+       Take an array of measumrements representing summaries of different channels.
+       Return a recomended channel.
+       Interference is evil, get rid of that first.
+       Then hunt for lowest Other bss traffic.
+       Don't forget that channels with low duration times may not have accurate readings.
+       For the moment, do not overwrite input array.
+*/
+int
+cca_analyze(cca_congest_channel_req_t *input[], int num_chans, uint flags, chanspec_t *answer)
+{
+       uint8 *bitmap = NULL;   /* 38 Max channels needs 5 bytes  = 40 */
+       int i, left, winner, ret_val = 0;
+       uint32 min_obss = 1 << 30;
+       uint bitmap_sz;
+
+       bitmap_sz = CEIL(num_chans, NBBY);
+       bitmap = (uint8 *)malloc(bitmap_sz);
+       if (bitmap == NULL) {
+               printf("unable to allocate memory\n");
+               return BCME_NOMEM;
+       }
+
+       memset(bitmap, 0, bitmap_sz);
+       /* Initially, all channels are up for consideration */
+       for (i = 0; i < num_chans; i++) {
+               if (input[i]->chanspec)
+                       setbit(bitmap, i);
+       }
+       cca_info(bitmap, num_chans, &left, &i);
+       if (!left) {
+               ret_val = CCA_ERRNO_TOO_FEW;
+               goto f_exit;
+       }
+
+       /* Filter for 2.4 GHz Band */
+       if (flags & CCA_FLAG_2G_ONLY) {
+               for (i = 0; i < num_chans; i++) {
+                       if (!CHSPEC_IS2G(input[i]->chanspec))
+                               clrbit(bitmap, i);
+               }
+       }
+       cca_info(bitmap, num_chans, &left, &i);
+       if (!left) {
+               ret_val = CCA_ERRNO_BAND;
+               goto f_exit;
+       }
+
+       /* Filter for 5 GHz Band */
+       if (flags & CCA_FLAG_5G_ONLY) {
+               for (i = 0; i < num_chans; i++) {
+                       if (!CHSPEC_IS5G(input[i]->chanspec))
+                               clrbit(bitmap, i);
+               }
+       }
+       cca_info(bitmap, num_chans, &left, &i);
+       if (!left) {
+               ret_val = CCA_ERRNO_BAND;
+               goto f_exit;
+       }
+
+       /* Filter for Duration */
+       if (!(flags & CCA_FLAG_IGNORE_DURATION)) {
+               for (i = 0; i < num_chans; i++) {
+                       if (input[i]->secs[0].duration < CCA_THRESH_MILLI)
+                               clrbit(bitmap, i);
+               }
+       }
+       cca_info(bitmap, num_chans, &left, &i);
+       if (!left) {
+               ret_val = CCA_ERRNO_DURATION;
+               goto f_exit;
+       }
+
+       /* Filter for 1 6 11 on 2.4 Band */
+       if (flags &  CCA_FLAGS_PREFER_1_6_11) {
+               int tmp_channel = spec_to_chan(input[i]->chanspec);
+               int is2g = CHSPEC_IS2G(input[i]->chanspec);
+               for (i = 0; i < num_chans; i++) {
+                       if (is2g && tmp_channel != 1 && tmp_channel != 6 && tmp_channel != 11)
+                               clrbit(bitmap, i);
+               }
+       }
+       cca_info(bitmap, num_chans, &left, &i);
+       if (!left) {
+               ret_val = CCA_ERRNO_PREF_CHAN;
+               goto f_exit;
+       }
+
+       /* Toss high interference interference */
+       if (!(flags & CCA_FLAG_IGNORE_INTERFER)) {
+               for (i = 0; i < num_chans; i++) {
+                       if (input[i]->secs[0].interference > CCA_THRESH_INTERFERE)
+                               clrbit(bitmap, i);
+               }
+               cca_info(bitmap, num_chans, &left, &i);
+               if (!left) {
+                       ret_val = CCA_ERRNO_INTERFER;
+                       goto f_exit;
+               }
+       }
+
+       /* Now find lowest obss */
+       winner = 0;
+       for (i = 0; i < num_chans; i++) {
+               if (isset(bitmap, i) && input[i]->secs[0].congest_obss < min_obss) {
+                       winner = i;
+                       min_obss = input[i]->secs[0].congest_obss;
+               }
+       }
+       *answer = input[winner]->chanspec;
+       f_exit:
+       free(bitmap);   /* free the allocated memory for bitmap */
+       return ret_val;
+}
+#endif /* !BCMDRIVER */
+
+/* offset of cntmember by sizeof(uint32) from the first cnt variable, txframe. */
+#define IDX_IN_WL_CNT_VER_6_T(cntmember)               \
+       ((OFFSETOF(wl_cnt_ver_6_t, cntmember) - OFFSETOF(wl_cnt_ver_6_t, txframe)) / sizeof(uint32))
+
+#define IDX_IN_WL_CNT_VER_11_T(cntmember)              \
+       ((OFFSETOF(wl_cnt_ver_11_t, cntmember) - OFFSETOF(wl_cnt_ver_11_t, txframe))    \
+       / sizeof(uint32))
+
+/* Exclude version and length fields */
+#define NUM_OF_CNT_IN_WL_CNT_VER_6_T   \
+       ((sizeof(wl_cnt_ver_6_t) - 2 * sizeof(uint16)) / sizeof(uint32))
+/* Exclude macstat cnt variables. wl_cnt_ver_6_t only has 62 macstat cnt variables. */
+#define NUM_OF_WLCCNT_IN_WL_CNT_VER_6_T                        \
+       (NUM_OF_CNT_IN_WL_CNT_VER_6_T - (WL_CNT_MCST_VAR_NUM - 2))
+
+/* Exclude version and length fields */
+#define NUM_OF_CNT_IN_WL_CNT_VER_11_T  \
+       ((sizeof(wl_cnt_ver_11_t) - 2 * sizeof(uint16)) / sizeof(uint32))
+/* Exclude 64 macstat cnt variables. */
+#define NUM_OF_WLCCNT_IN_WL_CNT_VER_11_T               \
+       (NUM_OF_CNT_IN_WL_CNT_VER_11_T - WL_CNT_MCST_VAR_NUM)
+
+/* Index conversion table from wl_cnt_ver_6_t to wl_cnt_wlc_t */
+static const uint8 wlcntver6t_to_wlcntwlct[NUM_OF_WLCCNT_IN_WL_CNT_VER_6_T] = {
+       IDX_IN_WL_CNT_VER_6_T(txframe),
+       IDX_IN_WL_CNT_VER_6_T(txbyte),
+       IDX_IN_WL_CNT_VER_6_T(txretrans),
+       IDX_IN_WL_CNT_VER_6_T(txerror),
+       IDX_IN_WL_CNT_VER_6_T(txctl),
+       IDX_IN_WL_CNT_VER_6_T(txprshort),
+       IDX_IN_WL_CNT_VER_6_T(txserr),
+       IDX_IN_WL_CNT_VER_6_T(txnobuf),
+       IDX_IN_WL_CNT_VER_6_T(txnoassoc),
+       IDX_IN_WL_CNT_VER_6_T(txrunt),
+       IDX_IN_WL_CNT_VER_6_T(txchit),
+       IDX_IN_WL_CNT_VER_6_T(txcmiss),
+       IDX_IN_WL_CNT_VER_6_T(txuflo),
+       IDX_IN_WL_CNT_VER_6_T(txphyerr),
+       IDX_IN_WL_CNT_VER_6_T(txphycrs),
+       IDX_IN_WL_CNT_VER_6_T(rxframe),
+       IDX_IN_WL_CNT_VER_6_T(rxbyte),
+       IDX_IN_WL_CNT_VER_6_T(rxerror),
+       IDX_IN_WL_CNT_VER_6_T(rxctl),
+       IDX_IN_WL_CNT_VER_6_T(rxnobuf),
+       IDX_IN_WL_CNT_VER_6_T(rxnondata),
+       IDX_IN_WL_CNT_VER_6_T(rxbadds),
+       IDX_IN_WL_CNT_VER_6_T(rxbadcm),
+       IDX_IN_WL_CNT_VER_6_T(rxfragerr),
+       IDX_IN_WL_CNT_VER_6_T(rxrunt),
+       IDX_IN_WL_CNT_VER_6_T(rxgiant),
+       IDX_IN_WL_CNT_VER_6_T(rxnoscb),
+       IDX_IN_WL_CNT_VER_6_T(rxbadproto),
+       IDX_IN_WL_CNT_VER_6_T(rxbadsrcmac),
+       IDX_IN_WL_CNT_VER_6_T(rxbadda),
+       IDX_IN_WL_CNT_VER_6_T(rxfilter),
+       IDX_IN_WL_CNT_VER_6_T(rxoflo),
+       IDX_IN_WL_CNT_VER_6_T(rxuflo),
+       IDX_IN_WL_CNT_VER_6_T(rxuflo) + 1,
+       IDX_IN_WL_CNT_VER_6_T(rxuflo) + 2,
+       IDX_IN_WL_CNT_VER_6_T(rxuflo) + 3,
+       IDX_IN_WL_CNT_VER_6_T(rxuflo) + 4,
+       IDX_IN_WL_CNT_VER_6_T(rxuflo) + 5,
+       IDX_IN_WL_CNT_VER_6_T(d11cnt_txrts_off),
+       IDX_IN_WL_CNT_VER_6_T(d11cnt_rxcrc_off),
+       IDX_IN_WL_CNT_VER_6_T(d11cnt_txnocts_off),
+       IDX_IN_WL_CNT_VER_6_T(dmade),
+       IDX_IN_WL_CNT_VER_6_T(dmada),
+       IDX_IN_WL_CNT_VER_6_T(dmape),
+       IDX_IN_WL_CNT_VER_6_T(reset),
+       IDX_IN_WL_CNT_VER_6_T(tbtt),
+       IDX_IN_WL_CNT_VER_6_T(txdmawar),
+       IDX_IN_WL_CNT_VER_6_T(pkt_callback_reg_fail),
+       IDX_IN_WL_CNT_VER_6_T(txfrag),
+       IDX_IN_WL_CNT_VER_6_T(txmulti),
+       IDX_IN_WL_CNT_VER_6_T(txfail),
+       IDX_IN_WL_CNT_VER_6_T(txretry),
+       IDX_IN_WL_CNT_VER_6_T(txretrie),
+       IDX_IN_WL_CNT_VER_6_T(rxdup),
+       IDX_IN_WL_CNT_VER_6_T(txrts),
+       IDX_IN_WL_CNT_VER_6_T(txnocts),
+       IDX_IN_WL_CNT_VER_6_T(txnoack),
+       IDX_IN_WL_CNT_VER_6_T(rxfrag),
+       IDX_IN_WL_CNT_VER_6_T(rxmulti),
+       IDX_IN_WL_CNT_VER_6_T(rxcrc),
+       IDX_IN_WL_CNT_VER_6_T(txfrmsnt),
+       IDX_IN_WL_CNT_VER_6_T(rxundec),
+       IDX_IN_WL_CNT_VER_6_T(tkipmicfaill),
+       IDX_IN_WL_CNT_VER_6_T(tkipcntrmsr),
+       IDX_IN_WL_CNT_VER_6_T(tkipreplay),
+       IDX_IN_WL_CNT_VER_6_T(ccmpfmterr),
+       IDX_IN_WL_CNT_VER_6_T(ccmpreplay),
+       IDX_IN_WL_CNT_VER_6_T(ccmpundec),
+       IDX_IN_WL_CNT_VER_6_T(fourwayfail),
+       IDX_IN_WL_CNT_VER_6_T(wepundec),
+       IDX_IN_WL_CNT_VER_6_T(wepicverr),
+       IDX_IN_WL_CNT_VER_6_T(decsuccess),
+       IDX_IN_WL_CNT_VER_6_T(tkipicverr),
+       IDX_IN_WL_CNT_VER_6_T(wepexcluded),
+       IDX_IN_WL_CNT_VER_6_T(txchanrej),
+       IDX_IN_WL_CNT_VER_6_T(psmwds),
+       IDX_IN_WL_CNT_VER_6_T(phywatchdog),
+       IDX_IN_WL_CNT_VER_6_T(prq_entries_handled),
+       IDX_IN_WL_CNT_VER_6_T(prq_undirected_entries),
+       IDX_IN_WL_CNT_VER_6_T(prq_bad_entries),
+       IDX_IN_WL_CNT_VER_6_T(atim_suppress_count),
+       IDX_IN_WL_CNT_VER_6_T(bcn_template_not_ready),
+       IDX_IN_WL_CNT_VER_6_T(bcn_template_not_ready_done),
+       IDX_IN_WL_CNT_VER_6_T(late_tbtt_dpc),
+       IDX_IN_WL_CNT_VER_6_T(rx1mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx2mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx5mbps5),
+       IDX_IN_WL_CNT_VER_6_T(rx6mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx9mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx11mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx12mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx18mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx24mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx36mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx48mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx54mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx108mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx162mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx216mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx270mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx324mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx378mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx432mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx486mbps),
+       IDX_IN_WL_CNT_VER_6_T(rx540mbps),
+       IDX_IN_WL_CNT_VER_6_T(rfdisable),
+       IDX_IN_WL_CNT_VER_6_T(txexptime),
+       IDX_IN_WL_CNT_VER_6_T(txmpdu_sgi),
+       IDX_IN_WL_CNT_VER_6_T(rxmpdu_sgi),
+       IDX_IN_WL_CNT_VER_6_T(txmpdu_stbc),
+       IDX_IN_WL_CNT_VER_6_T(rxmpdu_stbc),
+       IDX_IN_WL_CNT_VER_6_T(rxundec_mcst),
+       IDX_IN_WL_CNT_VER_6_T(tkipmicfaill_mcst),
+       IDX_IN_WL_CNT_VER_6_T(tkipcntrmsr_mcst),
+       IDX_IN_WL_CNT_VER_6_T(tkipreplay_mcst),
+       IDX_IN_WL_CNT_VER_6_T(ccmpfmterr_mcst),
+       IDX_IN_WL_CNT_VER_6_T(ccmpreplay_mcst),
+       IDX_IN_WL_CNT_VER_6_T(ccmpundec_mcst),
+       IDX_IN_WL_CNT_VER_6_T(fourwayfail_mcst),
+       IDX_IN_WL_CNT_VER_6_T(wepundec_mcst),
+       IDX_IN_WL_CNT_VER_6_T(wepicverr_mcst),
+       IDX_IN_WL_CNT_VER_6_T(decsuccess_mcst),
+       IDX_IN_WL_CNT_VER_6_T(tkipicverr_mcst),
+       IDX_IN_WL_CNT_VER_6_T(wepexcluded_mcst)
+};
+
+/* Index conversion table from wl_cnt_ver_11_t to wl_cnt_wlc_t */
+static const uint8 wlcntver11t_to_wlcntwlct[NUM_OF_WLCCNT_IN_WL_CNT_VER_11_T] = {
+       IDX_IN_WL_CNT_VER_11_T(txframe),
+       IDX_IN_WL_CNT_VER_11_T(txbyte),
+       IDX_IN_WL_CNT_VER_11_T(txretrans),
+       IDX_IN_WL_CNT_VER_11_T(txerror),
+       IDX_IN_WL_CNT_VER_11_T(txctl),
+       IDX_IN_WL_CNT_VER_11_T(txprshort),
+       IDX_IN_WL_CNT_VER_11_T(txserr),
+       IDX_IN_WL_CNT_VER_11_T(txnobuf),
+       IDX_IN_WL_CNT_VER_11_T(txnoassoc),
+       IDX_IN_WL_CNT_VER_11_T(txrunt),
+       IDX_IN_WL_CNT_VER_11_T(txchit),
+       IDX_IN_WL_CNT_VER_11_T(txcmiss),
+       IDX_IN_WL_CNT_VER_11_T(txuflo),
+       IDX_IN_WL_CNT_VER_11_T(txphyerr),
+       IDX_IN_WL_CNT_VER_11_T(txphycrs),
+       IDX_IN_WL_CNT_VER_11_T(rxframe),
+       IDX_IN_WL_CNT_VER_11_T(rxbyte),
+       IDX_IN_WL_CNT_VER_11_T(rxerror),
+       IDX_IN_WL_CNT_VER_11_T(rxctl),
+       IDX_IN_WL_CNT_VER_11_T(rxnobuf),
+       IDX_IN_WL_CNT_VER_11_T(rxnondata),
+       IDX_IN_WL_CNT_VER_11_T(rxbadds),
+       IDX_IN_WL_CNT_VER_11_T(rxbadcm),
+       IDX_IN_WL_CNT_VER_11_T(rxfragerr),
+       IDX_IN_WL_CNT_VER_11_T(rxrunt),
+       IDX_IN_WL_CNT_VER_11_T(rxgiant),
+       IDX_IN_WL_CNT_VER_11_T(rxnoscb),
+       IDX_IN_WL_CNT_VER_11_T(rxbadproto),
+       IDX_IN_WL_CNT_VER_11_T(rxbadsrcmac),
+       IDX_IN_WL_CNT_VER_11_T(rxbadda),
+       IDX_IN_WL_CNT_VER_11_T(rxfilter),
+       IDX_IN_WL_CNT_VER_11_T(rxoflo),
+       IDX_IN_WL_CNT_VER_11_T(rxuflo),
+       IDX_IN_WL_CNT_VER_11_T(rxuflo) + 1,
+       IDX_IN_WL_CNT_VER_11_T(rxuflo) + 2,
+       IDX_IN_WL_CNT_VER_11_T(rxuflo) + 3,
+       IDX_IN_WL_CNT_VER_11_T(rxuflo) + 4,
+       IDX_IN_WL_CNT_VER_11_T(rxuflo) + 5,
+       IDX_IN_WL_CNT_VER_11_T(d11cnt_txrts_off),
+       IDX_IN_WL_CNT_VER_11_T(d11cnt_rxcrc_off),
+       IDX_IN_WL_CNT_VER_11_T(d11cnt_txnocts_off),
+       IDX_IN_WL_CNT_VER_11_T(dmade),
+       IDX_IN_WL_CNT_VER_11_T(dmada),
+       IDX_IN_WL_CNT_VER_11_T(dmape),
+       IDX_IN_WL_CNT_VER_11_T(reset),
+       IDX_IN_WL_CNT_VER_11_T(tbtt),
+       IDX_IN_WL_CNT_VER_11_T(txdmawar),
+       IDX_IN_WL_CNT_VER_11_T(pkt_callback_reg_fail),
+       IDX_IN_WL_CNT_VER_11_T(txfrag),
+       IDX_IN_WL_CNT_VER_11_T(txmulti),
+       IDX_IN_WL_CNT_VER_11_T(txfail),
+       IDX_IN_WL_CNT_VER_11_T(txretry),
+       IDX_IN_WL_CNT_VER_11_T(txretrie),
+       IDX_IN_WL_CNT_VER_11_T(rxdup),
+       IDX_IN_WL_CNT_VER_11_T(txrts),
+       IDX_IN_WL_CNT_VER_11_T(txnocts),
+       IDX_IN_WL_CNT_VER_11_T(txnoack),
+       IDX_IN_WL_CNT_VER_11_T(rxfrag),
+       IDX_IN_WL_CNT_VER_11_T(rxmulti),
+       IDX_IN_WL_CNT_VER_11_T(rxcrc),
+       IDX_IN_WL_CNT_VER_11_T(txfrmsnt),
+       IDX_IN_WL_CNT_VER_11_T(rxundec),
+       IDX_IN_WL_CNT_VER_11_T(tkipmicfaill),
+       IDX_IN_WL_CNT_VER_11_T(tkipcntrmsr),
+       IDX_IN_WL_CNT_VER_11_T(tkipreplay),
+       IDX_IN_WL_CNT_VER_11_T(ccmpfmterr),
+       IDX_IN_WL_CNT_VER_11_T(ccmpreplay),
+       IDX_IN_WL_CNT_VER_11_T(ccmpundec),
+       IDX_IN_WL_CNT_VER_11_T(fourwayfail),
+       IDX_IN_WL_CNT_VER_11_T(wepundec),
+       IDX_IN_WL_CNT_VER_11_T(wepicverr),
+       IDX_IN_WL_CNT_VER_11_T(decsuccess),
+       IDX_IN_WL_CNT_VER_11_T(tkipicverr),
+       IDX_IN_WL_CNT_VER_11_T(wepexcluded),
+       IDX_IN_WL_CNT_VER_11_T(txchanrej),
+       IDX_IN_WL_CNT_VER_11_T(psmwds),
+       IDX_IN_WL_CNT_VER_11_T(phywatchdog),
+       IDX_IN_WL_CNT_VER_11_T(prq_entries_handled),
+       IDX_IN_WL_CNT_VER_11_T(prq_undirected_entries),
+       IDX_IN_WL_CNT_VER_11_T(prq_bad_entries),
+       IDX_IN_WL_CNT_VER_11_T(atim_suppress_count),
+       IDX_IN_WL_CNT_VER_11_T(bcn_template_not_ready),
+       IDX_IN_WL_CNT_VER_11_T(bcn_template_not_ready_done),
+       IDX_IN_WL_CNT_VER_11_T(late_tbtt_dpc),
+       IDX_IN_WL_CNT_VER_11_T(rx1mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx2mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx5mbps5),
+       IDX_IN_WL_CNT_VER_11_T(rx6mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx9mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx11mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx12mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx18mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx24mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx36mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx48mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx54mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx108mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx162mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx216mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx270mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx324mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx378mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx432mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx486mbps),
+       IDX_IN_WL_CNT_VER_11_T(rx540mbps),
+       IDX_IN_WL_CNT_VER_11_T(rfdisable),
+       IDX_IN_WL_CNT_VER_11_T(txexptime),
+       IDX_IN_WL_CNT_VER_11_T(txmpdu_sgi),
+       IDX_IN_WL_CNT_VER_11_T(rxmpdu_sgi),
+       IDX_IN_WL_CNT_VER_11_T(txmpdu_stbc),
+       IDX_IN_WL_CNT_VER_11_T(rxmpdu_stbc),
+       IDX_IN_WL_CNT_VER_11_T(rxundec_mcst),
+       IDX_IN_WL_CNT_VER_11_T(tkipmicfaill_mcst),
+       IDX_IN_WL_CNT_VER_11_T(tkipcntrmsr_mcst),
+       IDX_IN_WL_CNT_VER_11_T(tkipreplay_mcst),
+       IDX_IN_WL_CNT_VER_11_T(ccmpfmterr_mcst),
+       IDX_IN_WL_CNT_VER_11_T(ccmpreplay_mcst),
+       IDX_IN_WL_CNT_VER_11_T(ccmpundec_mcst),
+       IDX_IN_WL_CNT_VER_11_T(fourwayfail_mcst),
+       IDX_IN_WL_CNT_VER_11_T(wepundec_mcst),
+       IDX_IN_WL_CNT_VER_11_T(wepicverr_mcst),
+       IDX_IN_WL_CNT_VER_11_T(decsuccess_mcst),
+       IDX_IN_WL_CNT_VER_11_T(tkipicverr_mcst),
+       IDX_IN_WL_CNT_VER_11_T(wepexcluded_mcst),
+       IDX_IN_WL_CNT_VER_11_T(dma_hang),
+       IDX_IN_WL_CNT_VER_11_T(reinit),
+       IDX_IN_WL_CNT_VER_11_T(pstatxucast),
+       IDX_IN_WL_CNT_VER_11_T(pstatxnoassoc),
+       IDX_IN_WL_CNT_VER_11_T(pstarxucast),
+       IDX_IN_WL_CNT_VER_11_T(pstarxbcmc),
+       IDX_IN_WL_CNT_VER_11_T(pstatxbcmc),
+       IDX_IN_WL_CNT_VER_11_T(cso_passthrough),
+       IDX_IN_WL_CNT_VER_11_T(cso_normal),
+       IDX_IN_WL_CNT_VER_11_T(chained),
+       IDX_IN_WL_CNT_VER_11_T(chainedsz1),
+       IDX_IN_WL_CNT_VER_11_T(unchained),
+       IDX_IN_WL_CNT_VER_11_T(maxchainsz),
+       IDX_IN_WL_CNT_VER_11_T(currchainsz),
+       IDX_IN_WL_CNT_VER_11_T(pciereset),
+       IDX_IN_WL_CNT_VER_11_T(cfgrestore),
+       IDX_IN_WL_CNT_VER_11_T(reinitreason),
+       IDX_IN_WL_CNT_VER_11_T(reinitreason) + 1,
+       IDX_IN_WL_CNT_VER_11_T(reinitreason) + 2,
+       IDX_IN_WL_CNT_VER_11_T(reinitreason) + 3,
+       IDX_IN_WL_CNT_VER_11_T(reinitreason) + 4,
+       IDX_IN_WL_CNT_VER_11_T(reinitreason) + 5,
+       IDX_IN_WL_CNT_VER_11_T(reinitreason) + 6,
+       IDX_IN_WL_CNT_VER_11_T(reinitreason) + 7,
+       IDX_IN_WL_CNT_VER_11_T(rxrtry),
+       IDX_IN_WL_CNT_VER_11_T(rxmpdu_mu),
+       IDX_IN_WL_CNT_VER_11_T(txbar),
+       IDX_IN_WL_CNT_VER_11_T(rxbar),
+       IDX_IN_WL_CNT_VER_11_T(txpspoll),
+       IDX_IN_WL_CNT_VER_11_T(rxpspoll),
+       IDX_IN_WL_CNT_VER_11_T(txnull),
+       IDX_IN_WL_CNT_VER_11_T(rxnull),
+       IDX_IN_WL_CNT_VER_11_T(txqosnull),
+       IDX_IN_WL_CNT_VER_11_T(rxqosnull),
+       IDX_IN_WL_CNT_VER_11_T(txassocreq),
+       IDX_IN_WL_CNT_VER_11_T(rxassocreq),
+       IDX_IN_WL_CNT_VER_11_T(txreassocreq),
+       IDX_IN_WL_CNT_VER_11_T(rxreassocreq),
+       IDX_IN_WL_CNT_VER_11_T(txdisassoc),
+       IDX_IN_WL_CNT_VER_11_T(rxdisassoc),
+       IDX_IN_WL_CNT_VER_11_T(txassocrsp),
+       IDX_IN_WL_CNT_VER_11_T(rxassocrsp),
+       IDX_IN_WL_CNT_VER_11_T(txreassocrsp),
+       IDX_IN_WL_CNT_VER_11_T(rxreassocrsp),
+       IDX_IN_WL_CNT_VER_11_T(txauth),
+       IDX_IN_WL_CNT_VER_11_T(rxauth),
+       IDX_IN_WL_CNT_VER_11_T(txdeauth),
+       IDX_IN_WL_CNT_VER_11_T(rxdeauth),
+       IDX_IN_WL_CNT_VER_11_T(txprobereq),
+       IDX_IN_WL_CNT_VER_11_T(rxprobereq),
+       IDX_IN_WL_CNT_VER_11_T(txprobersp),
+       IDX_IN_WL_CNT_VER_11_T(rxprobersp),
+       IDX_IN_WL_CNT_VER_11_T(txaction),
+       IDX_IN_WL_CNT_VER_11_T(rxaction)
+};
+
+/* Index conversion table from wl_cnt_ver_11_t to
+ * either wl_cnt_ge40mcst_v1_t or wl_cnt_lt40mcst_v1_t
+ */
+static const uint8 wlcntver11t_to_wlcntXX40mcstv1t[WL_CNT_MCST_VAR_NUM] = {
+       IDX_IN_WL_CNT_VER_11_T(txallfrm),
+       IDX_IN_WL_CNT_VER_11_T(txrtsfrm),
+       IDX_IN_WL_CNT_VER_11_T(txctsfrm),
+       IDX_IN_WL_CNT_VER_11_T(txackfrm),
+       IDX_IN_WL_CNT_VER_11_T(txdnlfrm),
+       IDX_IN_WL_CNT_VER_11_T(txbcnfrm),
+       IDX_IN_WL_CNT_VER_11_T(txfunfl),
+       IDX_IN_WL_CNT_VER_11_T(txfunfl) + 1,
+       IDX_IN_WL_CNT_VER_11_T(txfunfl) + 2,
+       IDX_IN_WL_CNT_VER_11_T(txfunfl) + 3,
+       IDX_IN_WL_CNT_VER_11_T(txfunfl) + 4,
+       IDX_IN_WL_CNT_VER_11_T(txfunfl) + 5,
+       IDX_IN_WL_CNT_VER_11_T(txfbw),
+       IDX_IN_WL_CNT_VER_11_T(txmpdu),
+       IDX_IN_WL_CNT_VER_11_T(txtplunfl),
+       IDX_IN_WL_CNT_VER_11_T(txphyerror),
+       IDX_IN_WL_CNT_VER_11_T(pktengrxducast),
+       IDX_IN_WL_CNT_VER_11_T(pktengrxdmcast),
+       IDX_IN_WL_CNT_VER_11_T(rxfrmtoolong),
+       IDX_IN_WL_CNT_VER_11_T(rxfrmtooshrt),
+       IDX_IN_WL_CNT_VER_11_T(rxinvmachdr),
+       IDX_IN_WL_CNT_VER_11_T(rxbadfcs),
+       IDX_IN_WL_CNT_VER_11_T(rxbadplcp),
+       IDX_IN_WL_CNT_VER_11_T(rxcrsglitch),
+       IDX_IN_WL_CNT_VER_11_T(rxstrt),
+       IDX_IN_WL_CNT_VER_11_T(rxdfrmucastmbss),
+       IDX_IN_WL_CNT_VER_11_T(rxmfrmucastmbss),
+       IDX_IN_WL_CNT_VER_11_T(rxcfrmucast),
+       IDX_IN_WL_CNT_VER_11_T(rxrtsucast),
+       IDX_IN_WL_CNT_VER_11_T(rxctsucast),
+       IDX_IN_WL_CNT_VER_11_T(rxackucast),
+       IDX_IN_WL_CNT_VER_11_T(rxdfrmocast),
+       IDX_IN_WL_CNT_VER_11_T(rxmfrmocast),
+       IDX_IN_WL_CNT_VER_11_T(rxcfrmocast),
+       IDX_IN_WL_CNT_VER_11_T(rxrtsocast),
+       IDX_IN_WL_CNT_VER_11_T(rxctsocast),
+       IDX_IN_WL_CNT_VER_11_T(rxdfrmmcast),
+       IDX_IN_WL_CNT_VER_11_T(rxmfrmmcast),
+       IDX_IN_WL_CNT_VER_11_T(rxcfrmmcast),
+       IDX_IN_WL_CNT_VER_11_T(rxbeaconmbss),
+       IDX_IN_WL_CNT_VER_11_T(rxdfrmucastobss),
+       IDX_IN_WL_CNT_VER_11_T(rxbeaconobss),
+       IDX_IN_WL_CNT_VER_11_T(rxrsptmout),
+       IDX_IN_WL_CNT_VER_11_T(bcntxcancl),
+       IDX_IN_WL_CNT_VER_11_T(rxnodelim),
+       IDX_IN_WL_CNT_VER_11_T(rxf0ovfl),
+       IDX_IN_WL_CNT_VER_11_T(rxf1ovfl),
+       IDX_IN_WL_CNT_VER_11_T(rxf2ovfl),
+       IDX_IN_WL_CNT_VER_11_T(txsfovfl),
+       IDX_IN_WL_CNT_VER_11_T(pmqovfl),
+       IDX_IN_WL_CNT_VER_11_T(rxcgprqfrm),
+       IDX_IN_WL_CNT_VER_11_T(rxcgprsqovfl),
+       IDX_IN_WL_CNT_VER_11_T(txcgprsfail),
+       IDX_IN_WL_CNT_VER_11_T(txcgprssuc),
+       IDX_IN_WL_CNT_VER_11_T(prs_timeout),
+       IDX_IN_WL_CNT_VER_11_T(rxnack),
+       IDX_IN_WL_CNT_VER_11_T(frmscons),
+       IDX_IN_WL_CNT_VER_11_T(txnack),
+       IDX_IN_WL_CNT_VER_11_T(rxback),
+       IDX_IN_WL_CNT_VER_11_T(txback),
+       IDX_IN_WL_CNT_VER_11_T(bphy_rxcrsglitch),
+       IDX_IN_WL_CNT_VER_11_T(rxdrop20s),
+       IDX_IN_WL_CNT_VER_11_T(rxtoolate),
+       IDX_IN_WL_CNT_VER_11_T(bphy_badplcp)
+};
+
+/* For mcst offsets that were not used. (2 Pads) */
+#define INVALID_MCST_IDX ((uint8)(-1))
+/* Index conversion table from wl_cnt_ver_11_t to wl_cnt_v_le10_mcst_t */
+static const uint8 wlcntver11t_to_wlcntvle10mcstt[WL_CNT_MCST_VAR_NUM] = {
+       IDX_IN_WL_CNT_VER_11_T(txallfrm),
+       IDX_IN_WL_CNT_VER_11_T(txrtsfrm),
+       IDX_IN_WL_CNT_VER_11_T(txctsfrm),
+       IDX_IN_WL_CNT_VER_11_T(txackfrm),
+       IDX_IN_WL_CNT_VER_11_T(txdnlfrm),
+       IDX_IN_WL_CNT_VER_11_T(txbcnfrm),
+       IDX_IN_WL_CNT_VER_11_T(txfunfl),
+       IDX_IN_WL_CNT_VER_11_T(txfunfl) + 1,
+       IDX_IN_WL_CNT_VER_11_T(txfunfl) + 2,
+       IDX_IN_WL_CNT_VER_11_T(txfunfl) + 3,
+       IDX_IN_WL_CNT_VER_11_T(txfunfl) + 4,
+       IDX_IN_WL_CNT_VER_11_T(txfunfl) + 5,
+       IDX_IN_WL_CNT_VER_11_T(txfbw),
+       INVALID_MCST_IDX,
+       IDX_IN_WL_CNT_VER_11_T(txtplunfl),
+       IDX_IN_WL_CNT_VER_11_T(txphyerror),
+       IDX_IN_WL_CNT_VER_11_T(pktengrxducast),
+       IDX_IN_WL_CNT_VER_11_T(pktengrxdmcast),
+       IDX_IN_WL_CNT_VER_11_T(rxfrmtoolong),
+       IDX_IN_WL_CNT_VER_11_T(rxfrmtooshrt),
+       IDX_IN_WL_CNT_VER_11_T(rxinvmachdr),
+       IDX_IN_WL_CNT_VER_11_T(rxbadfcs),
+       IDX_IN_WL_CNT_VER_11_T(rxbadplcp),
+       IDX_IN_WL_CNT_VER_11_T(rxcrsglitch),
+       IDX_IN_WL_CNT_VER_11_T(rxstrt),
+       IDX_IN_WL_CNT_VER_11_T(rxdfrmucastmbss),
+       IDX_IN_WL_CNT_VER_11_T(rxmfrmucastmbss),
+       IDX_IN_WL_CNT_VER_11_T(rxcfrmucast),
+       IDX_IN_WL_CNT_VER_11_T(rxrtsucast),
+       IDX_IN_WL_CNT_VER_11_T(rxctsucast),
+       IDX_IN_WL_CNT_VER_11_T(rxackucast),
+       IDX_IN_WL_CNT_VER_11_T(rxdfrmocast),
+       IDX_IN_WL_CNT_VER_11_T(rxmfrmocast),
+       IDX_IN_WL_CNT_VER_11_T(rxcfrmocast),
+       IDX_IN_WL_CNT_VER_11_T(rxrtsocast),
+       IDX_IN_WL_CNT_VER_11_T(rxctsocast),
+       IDX_IN_WL_CNT_VER_11_T(rxdfrmmcast),
+       IDX_IN_WL_CNT_VER_11_T(rxmfrmmcast),
+       IDX_IN_WL_CNT_VER_11_T(rxcfrmmcast),
+       IDX_IN_WL_CNT_VER_11_T(rxbeaconmbss),
+       IDX_IN_WL_CNT_VER_11_T(rxdfrmucastobss),
+       IDX_IN_WL_CNT_VER_11_T(rxbeaconobss),
+       IDX_IN_WL_CNT_VER_11_T(rxrsptmout),
+       IDX_IN_WL_CNT_VER_11_T(bcntxcancl),
+       INVALID_MCST_IDX,
+       IDX_IN_WL_CNT_VER_11_T(rxf0ovfl),
+       IDX_IN_WL_CNT_VER_11_T(rxf1ovfl),
+       IDX_IN_WL_CNT_VER_11_T(rxf2ovfl),
+       IDX_IN_WL_CNT_VER_11_T(txsfovfl),
+       IDX_IN_WL_CNT_VER_11_T(pmqovfl),
+       IDX_IN_WL_CNT_VER_11_T(rxcgprqfrm),
+       IDX_IN_WL_CNT_VER_11_T(rxcgprsqovfl),
+       IDX_IN_WL_CNT_VER_11_T(txcgprsfail),
+       IDX_IN_WL_CNT_VER_11_T(txcgprssuc),
+       IDX_IN_WL_CNT_VER_11_T(prs_timeout),
+       IDX_IN_WL_CNT_VER_11_T(rxnack),
+       IDX_IN_WL_CNT_VER_11_T(frmscons),
+       IDX_IN_WL_CNT_VER_11_T(txnack),
+       IDX_IN_WL_CNT_VER_11_T(rxback),
+       IDX_IN_WL_CNT_VER_11_T(txback),
+       IDX_IN_WL_CNT_VER_11_T(bphy_rxcrsglitch),
+       IDX_IN_WL_CNT_VER_11_T(rxdrop20s),
+       IDX_IN_WL_CNT_VER_11_T(rxtoolate),
+       IDX_IN_WL_CNT_VER_11_T(bphy_badplcp)
+};
+
+
+/* Index conversion table from wl_cnt_ver_6_t to wl_cnt_v_le10_mcst_t */
+static const uint8 wlcntver6t_to_wlcntvle10mcstt[WL_CNT_MCST_VAR_NUM] = {
+       IDX_IN_WL_CNT_VER_6_T(txallfrm),
+       IDX_IN_WL_CNT_VER_6_T(txrtsfrm),
+       IDX_IN_WL_CNT_VER_6_T(txctsfrm),
+       IDX_IN_WL_CNT_VER_6_T(txackfrm),
+       IDX_IN_WL_CNT_VER_6_T(txdnlfrm),
+       IDX_IN_WL_CNT_VER_6_T(txbcnfrm),
+       IDX_IN_WL_CNT_VER_6_T(txfunfl),
+       IDX_IN_WL_CNT_VER_6_T(txfunfl) + 1,
+       IDX_IN_WL_CNT_VER_6_T(txfunfl) + 2,
+       IDX_IN_WL_CNT_VER_6_T(txfunfl) + 3,
+       IDX_IN_WL_CNT_VER_6_T(txfunfl) + 4,
+       IDX_IN_WL_CNT_VER_6_T(txfunfl) + 5,
+       IDX_IN_WL_CNT_VER_6_T(txfbw),
+       INVALID_MCST_IDX,
+       IDX_IN_WL_CNT_VER_6_T(txtplunfl),
+       IDX_IN_WL_CNT_VER_6_T(txphyerror),
+       IDX_IN_WL_CNT_VER_6_T(pktengrxducast),
+       IDX_IN_WL_CNT_VER_6_T(pktengrxdmcast),
+       IDX_IN_WL_CNT_VER_6_T(rxfrmtoolong),
+       IDX_IN_WL_CNT_VER_6_T(rxfrmtooshrt),
+       IDX_IN_WL_CNT_VER_6_T(rxinvmachdr),
+       IDX_IN_WL_CNT_VER_6_T(rxbadfcs),
+       IDX_IN_WL_CNT_VER_6_T(rxbadplcp),
+       IDX_IN_WL_CNT_VER_6_T(rxcrsglitch),
+       IDX_IN_WL_CNT_VER_6_T(rxstrt),
+       IDX_IN_WL_CNT_VER_6_T(rxdfrmucastmbss),
+       IDX_IN_WL_CNT_VER_6_T(rxmfrmucastmbss),
+       IDX_IN_WL_CNT_VER_6_T(rxcfrmucast),
+       IDX_IN_WL_CNT_VER_6_T(rxrtsucast),
+       IDX_IN_WL_CNT_VER_6_T(rxctsucast),
+       IDX_IN_WL_CNT_VER_6_T(rxackucast),
+       IDX_IN_WL_CNT_VER_6_T(rxdfrmocast),
+       IDX_IN_WL_CNT_VER_6_T(rxmfrmocast),
+       IDX_IN_WL_CNT_VER_6_T(rxcfrmocast),
+       IDX_IN_WL_CNT_VER_6_T(rxrtsocast),
+       IDX_IN_WL_CNT_VER_6_T(rxctsocast),
+       IDX_IN_WL_CNT_VER_6_T(rxdfrmmcast),
+       IDX_IN_WL_CNT_VER_6_T(rxmfrmmcast),
+       IDX_IN_WL_CNT_VER_6_T(rxcfrmmcast),
+       IDX_IN_WL_CNT_VER_6_T(rxbeaconmbss),
+       IDX_IN_WL_CNT_VER_6_T(rxdfrmucastobss),
+       IDX_IN_WL_CNT_VER_6_T(rxbeaconobss),
+       IDX_IN_WL_CNT_VER_6_T(rxrsptmout),
+       IDX_IN_WL_CNT_VER_6_T(bcntxcancl),
+       INVALID_MCST_IDX,
+       IDX_IN_WL_CNT_VER_6_T(rxf0ovfl),
+       IDX_IN_WL_CNT_VER_6_T(rxf1ovfl),
+       IDX_IN_WL_CNT_VER_6_T(rxf2ovfl),
+       IDX_IN_WL_CNT_VER_6_T(txsfovfl),
+       IDX_IN_WL_CNT_VER_6_T(pmqovfl),
+       IDX_IN_WL_CNT_VER_6_T(rxcgprqfrm),
+       IDX_IN_WL_CNT_VER_6_T(rxcgprsqovfl),
+       IDX_IN_WL_CNT_VER_6_T(txcgprsfail),
+       IDX_IN_WL_CNT_VER_6_T(txcgprssuc),
+       IDX_IN_WL_CNT_VER_6_T(prs_timeout),
+       IDX_IN_WL_CNT_VER_6_T(rxnack),
+       IDX_IN_WL_CNT_VER_6_T(frmscons),
+       IDX_IN_WL_CNT_VER_6_T(txnack),
+       IDX_IN_WL_CNT_VER_6_T(rxback),
+       IDX_IN_WL_CNT_VER_6_T(txback),
+       IDX_IN_WL_CNT_VER_6_T(bphy_rxcrsglitch),
+       IDX_IN_WL_CNT_VER_6_T(rxdrop20s),
+       IDX_IN_WL_CNT_VER_6_T(rxtoolate),
+       IDX_IN_WL_CNT_VER_6_T(bphy_badplcp)
+};
+
+/* copy wlc layer counters from old type cntbuf to wl_cnt_wlc_t type. */
+static int
+wl_copy_wlccnt(uint16 cntver, uint32 *dst, uint32 *src, uint8 src_max_idx)
+{
+       uint i;
+       if (dst == NULL || src == NULL) {
+               return BCME_ERROR;
+       }
+
+       /* Init wlccnt with invalid value. Unchanged value will not be printed out */
+       for (i = 0; i < (sizeof(wl_cnt_wlc_t) / sizeof(uint32)); i++) {
+               dst[i] = INVALID_CNT_VAL;
+       }
+
+       if (cntver == WL_CNT_VERSION_6) {
+               for (i = 0; i < NUM_OF_WLCCNT_IN_WL_CNT_VER_6_T; i++) {
+                       if (wlcntver6t_to_wlcntwlct[i] >= src_max_idx) {
+                       /* src buffer does not have counters from here */
+                               break;
+                       }
+                       dst[i] = src[wlcntver6t_to_wlcntwlct[i]];
+               }
+       } else {
+               for (i = 0; i < NUM_OF_WLCCNT_IN_WL_CNT_VER_11_T; i++) {
+                       if (wlcntver11t_to_wlcntwlct[i] >= src_max_idx) {
+                       /* src buffer does not have counters from here */
+                               break;
+                       }
+                       dst[i] = src[wlcntver11t_to_wlcntwlct[i]];
+               }
+       }
+       return BCME_OK;
+}
+
+/* copy macstat counters from old type cntbuf to wl_cnt_v_le10_mcst_t type. */
+static int
+wl_copy_macstat_upto_ver10(uint16 cntver, uint32 *dst, uint32 *src)
+{
+       uint i;
+
+       if (dst == NULL || src == NULL) {
+               return BCME_ERROR;
+       }
+
+       if (cntver == WL_CNT_VERSION_6) {
+               for (i = 0; i < WL_CNT_MCST_VAR_NUM; i++) {
+                       if (wlcntver6t_to_wlcntvle10mcstt[i] == INVALID_MCST_IDX) {
+                               /* This mcst counter does not exist in wl_cnt_ver_6_t */
+                               dst[i] = INVALID_CNT_VAL;
+                       } else {
+                               dst[i] = src[wlcntver6t_to_wlcntvle10mcstt[i]];
+                       }
+               }
+       } else {
+               for (i = 0; i < WL_CNT_MCST_VAR_NUM; i++) {
+                       if (wlcntver11t_to_wlcntvle10mcstt[i] == INVALID_MCST_IDX) {
+                               /* This mcst counter does not exist in wl_cnt_ver_11_t */
+                               dst[i] = INVALID_CNT_VAL;
+                       } else {
+                               dst[i] = src[wlcntver11t_to_wlcntvle10mcstt[i]];
+                       }
+               }
+       }
+       return BCME_OK;
+}
+
+static int
+wl_copy_macstat_ver11(uint32 *dst, uint32 *src)
+{
+       uint i;
+
+       if (dst == NULL || src == NULL) {
+               return BCME_ERROR;
+       }
+
+       for (i = 0; i < WL_CNT_MCST_VAR_NUM; i++) {
+               dst[i] = src[wlcntver11t_to_wlcntXX40mcstv1t[i]];
+       }
+       return BCME_OK;
+}
+
+/**
+ * Translate non-xtlv 'wl counters' IOVar buffer received by old driver/FW to xtlv format.
+ * Parameters:
+ *     cntbuf: pointer to non-xtlv 'wl counters' IOVar buffer received by old driver/FW.
+ *             Newly translated xtlv format is written to this pointer.
+ *     buflen: length of the "cntbuf" without any padding.
+ *     corerev: chip core revision of the driver/FW.
+ */
+int
+wl_cntbuf_to_xtlv_format(void *ctx, void *cntbuf, int buflen, uint32 corerev)
+{
+       wl_cnt_wlc_t *wlccnt = NULL;
+       uint32 *macstat = NULL;
+       xtlv_desc_t xtlv_desc[3];
+       uint16 mcst_xtlv_id;
+       int res = BCME_OK;
+       wl_cnt_info_t *cntinfo = cntbuf;
+       void *xtlvbuf_p = cntinfo->data;
+       uint16 ver = cntinfo->version;
+       uint16 xtlvbuflen = (uint16)buflen;
+       uint16 src_max_idx;
+#ifdef BCMDRIVER
+       osl_t *osh = ctx;
+#else
+       BCM_REFERENCE(ctx);
+#endif
+
+       if (ver == WL_CNT_T_VERSION) {
+               /* Already in xtlv format. */
+               goto exit;
+       }
+
+#ifdef BCMDRIVER
+       wlccnt = MALLOC(osh, sizeof(*wlccnt));
+       macstat = MALLOC(osh, WL_CNT_MCST_STRUCT_SZ);
+#else
+       wlccnt = (wl_cnt_wlc_t *)malloc(sizeof(*wlccnt));
+       macstat = (uint32 *)malloc(WL_CNT_MCST_STRUCT_SZ);
+#endif
+       if (!wlccnt) {
+               printf("wl_cntbuf_to_xtlv_format malloc fail!\n");
+               res = BCME_NOMEM;
+               goto exit;
+       }
+
+       /* Check if the max idx in the struct exceeds the boundary of uint8 */
+       if (NUM_OF_CNT_IN_WL_CNT_VER_6_T > ((uint8)(-1) + 1) ||
+               NUM_OF_CNT_IN_WL_CNT_VER_11_T > ((uint8)(-1) + 1)) {
+               printf("wlcntverXXt_to_wlcntwlct and src_max_idx need"
+                       " to be of uint16 instead of uint8\n");
+               res = BCME_ERROR;
+               goto exit;
+       }
+
+       /* Exclude version and length fields in either wlc_cnt_ver_6_t or wlc_cnt_ver_11_t */
+       src_max_idx = (cntinfo->datalen - OFFSETOF(wl_cnt_info_t, data)) / sizeof(uint32);
+
+       if (src_max_idx > (uint8)(-1)) {
+               printf("wlcntverXXt_to_wlcntwlct and src_max_idx need"
+                       " to be of uint16 instead of uint8\n"
+                       "Try updating wl utility to the latest.\n");
+               res = BCME_ERROR;
+       }
+
+       /* Copy wlc layer counters to wl_cnt_wlc_t */
+       res = wl_copy_wlccnt(ver, (uint32 *)wlccnt, (uint32 *)cntinfo->data, (uint8)src_max_idx);
+       if (res != BCME_OK) {
+               printf("wl_copy_wlccnt fail!\n");
+               goto exit;
+       }
+
+       /* Copy macstat counters to wl_cnt_wlc_t */
+       if (ver == WL_CNT_VERSION_11) {
+               res = wl_copy_macstat_ver11(macstat, (uint32 *)cntinfo->data);
+               if (res != BCME_OK) {
+                       printf("wl_copy_macstat_ver11 fail!\n");
+                       goto exit;
+               }
+               if (corerev >= 40) {
+                       mcst_xtlv_id = WL_CNT_XTLV_GE40_UCODE_V1;
+               } else {
+                       mcst_xtlv_id = WL_CNT_XTLV_LT40_UCODE_V1;
+               }
+       } else {
+               res = wl_copy_macstat_upto_ver10(ver, macstat, (uint32 *)cntinfo->data);
+               if (res != BCME_OK) {
+                       printf("wl_copy_macstat_upto_ver10 fail!\n");
+                       goto exit;
+               }
+               mcst_xtlv_id = WL_CNT_XTLV_CNTV_LE10_UCODE;
+       }
+
+       xtlv_desc[0].type = WL_CNT_XTLV_WLC;
+       xtlv_desc[0].len = sizeof(*wlccnt);
+       xtlv_desc[0].ptr = wlccnt;
+
+       xtlv_desc[1].type = mcst_xtlv_id;
+       xtlv_desc[1].len = WL_CNT_MCST_STRUCT_SZ;
+       xtlv_desc[1].ptr = macstat;
+
+       xtlv_desc[2].type = 0;
+       xtlv_desc[2].len = 0;
+       xtlv_desc[2].ptr = NULL;
+
+       memset(cntbuf, 0, WL_CNTBUF_MAX_SIZE);
+
+       res = bcm_pack_xtlv_buf_from_mem(&xtlvbuf_p, &xtlvbuflen,
+               xtlv_desc, BCM_XTLV_OPTION_ALIGN32);
+       cntinfo->datalen = (buflen - xtlvbuflen);
+exit:
+#ifdef BCMDRIVER
+       if (wlccnt) {
+               MFREE(osh, wlccnt, sizeof(*wlccnt));
+       }
+       if (macstat) {
+               MFREE(osh, macstat, WL_CNT_MCST_STRUCT_SZ);
+       }
+#else
+       if (wlccnt) {
+               free(wlccnt);
+       }
+       if (macstat) {
+               free(macstat);
+       }
+#endif
+       return res;
+}
diff --git a/drivers/net/wireless/bcmdhd_1363/bcmevent.c b/drivers/net/wireless/bcmdhd_1363/bcmevent.c
new file mode 100644 (file)
index 0000000..7b51a02
--- /dev/null
@@ -0,0 +1,356 @@
+/*
+ * bcmevent read-only data shared by kernel or app layers
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmevent.c 647135 2016-07-04 06:04:52Z $
+ */
+
+#include <typedefs.h>
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <proto/ethernet.h>
+#include <proto/bcmeth.h>
+#include <proto/bcmevent.h>
+#include <proto/802.11.h>
+
+/* Table of event name strings for UIs and debugging dumps */
+typedef struct {
+       uint event;
+       const char *name;
+} bcmevent_name_str_t;
+
+/* Use the actual name for event tracing */
+#define BCMEVENT_NAME(_event) {(_event), #_event}
+
+static const bcmevent_name_str_t bcmevent_names[] = {
+       BCMEVENT_NAME(WLC_E_SET_SSID),
+       BCMEVENT_NAME(WLC_E_JOIN),
+       BCMEVENT_NAME(WLC_E_START),
+       BCMEVENT_NAME(WLC_E_AUTH),
+       BCMEVENT_NAME(WLC_E_AUTH_IND),
+       BCMEVENT_NAME(WLC_E_DEAUTH),
+       BCMEVENT_NAME(WLC_E_DEAUTH_IND),
+       BCMEVENT_NAME(WLC_E_ASSOC),
+       BCMEVENT_NAME(WLC_E_ASSOC_IND),
+       BCMEVENT_NAME(WLC_E_REASSOC),
+       BCMEVENT_NAME(WLC_E_REASSOC_IND),
+       BCMEVENT_NAME(WLC_E_DISASSOC),
+       BCMEVENT_NAME(WLC_E_DISASSOC_IND),
+       BCMEVENT_NAME(WLC_E_QUIET_START),
+       BCMEVENT_NAME(WLC_E_QUIET_END),
+       BCMEVENT_NAME(WLC_E_BEACON_RX),
+       BCMEVENT_NAME(WLC_E_LINK),
+       BCMEVENT_NAME(WLC_E_MIC_ERROR),
+       BCMEVENT_NAME(WLC_E_NDIS_LINK),
+       BCMEVENT_NAME(WLC_E_ROAM),
+       BCMEVENT_NAME(WLC_E_TXFAIL),
+       BCMEVENT_NAME(WLC_E_PMKID_CACHE),
+       BCMEVENT_NAME(WLC_E_RETROGRADE_TSF),
+       BCMEVENT_NAME(WLC_E_PRUNE),
+       BCMEVENT_NAME(WLC_E_AUTOAUTH),
+       BCMEVENT_NAME(WLC_E_EAPOL_MSG),
+       BCMEVENT_NAME(WLC_E_SCAN_COMPLETE),
+       BCMEVENT_NAME(WLC_E_ADDTS_IND),
+       BCMEVENT_NAME(WLC_E_DELTS_IND),
+       BCMEVENT_NAME(WLC_E_BCNSENT_IND),
+       BCMEVENT_NAME(WLC_E_BCNRX_MSG),
+       BCMEVENT_NAME(WLC_E_BCNLOST_MSG),
+       BCMEVENT_NAME(WLC_E_ROAM_PREP),
+       BCMEVENT_NAME(WLC_E_PFN_NET_FOUND),
+       BCMEVENT_NAME(WLC_E_PFN_SCAN_ALLGONE),
+       BCMEVENT_NAME(WLC_E_PFN_NET_LOST),
+#if defined(IBSS_PEER_DISCOVERY_EVENT)
+       BCMEVENT_NAME(WLC_E_IBSS_ASSOC),
+#endif /* defined(IBSS_PEER_DISCOVERY_EVENT) */
+       BCMEVENT_NAME(WLC_E_RADIO),
+       BCMEVENT_NAME(WLC_E_PSM_WATCHDOG),
+       BCMEVENT_NAME(WLC_E_PROBREQ_MSG),
+       BCMEVENT_NAME(WLC_E_SCAN_CONFIRM_IND),
+       BCMEVENT_NAME(WLC_E_PSK_SUP),
+       BCMEVENT_NAME(WLC_E_COUNTRY_CODE_CHANGED),
+       BCMEVENT_NAME(WLC_E_EXCEEDED_MEDIUM_TIME),
+       BCMEVENT_NAME(WLC_E_ICV_ERROR),
+       BCMEVENT_NAME(WLC_E_UNICAST_DECODE_ERROR),
+       BCMEVENT_NAME(WLC_E_MULTICAST_DECODE_ERROR),
+       BCMEVENT_NAME(WLC_E_TRACE),
+       BCMEVENT_NAME(WLC_E_IF),
+#ifdef WLP2P
+       BCMEVENT_NAME(WLC_E_P2P_DISC_LISTEN_COMPLETE),
+#endif
+       BCMEVENT_NAME(WLC_E_RSSI),
+       BCMEVENT_NAME(WLC_E_EXTLOG_MSG),
+       BCMEVENT_NAME(WLC_E_ACTION_FRAME),
+       BCMEVENT_NAME(WLC_E_ACTION_FRAME_RX),
+       BCMEVENT_NAME(WLC_E_ACTION_FRAME_COMPLETE),
+#ifdef BCMWAPI_WAI
+       BCMEVENT_NAME(WLC_E_WAI_STA_EVENT),
+       BCMEVENT_NAME(WLC_E_WAI_MSG),
+#endif /* BCMWAPI_WAI */
+       BCMEVENT_NAME(WLC_E_ESCAN_RESULT),
+       BCMEVENT_NAME(WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE),
+#ifdef WLP2P
+       BCMEVENT_NAME(WLC_E_PROBRESP_MSG),
+       BCMEVENT_NAME(WLC_E_P2P_PROBREQ_MSG),
+#endif
+#ifdef PROP_TXSTATUS
+       BCMEVENT_NAME(WLC_E_FIFO_CREDIT_MAP),
+#endif
+       BCMEVENT_NAME(WLC_E_WAKE_EVENT),
+       BCMEVENT_NAME(WLC_E_DCS_REQUEST),
+       BCMEVENT_NAME(WLC_E_RM_COMPLETE),
+#ifdef WLMEDIA_HTSF
+       BCMEVENT_NAME(WLC_E_HTSFSYNC),
+#endif
+       BCMEVENT_NAME(WLC_E_OVERLAY_REQ),
+       BCMEVENT_NAME(WLC_E_CSA_COMPLETE_IND),
+       BCMEVENT_NAME(WLC_E_EXCESS_PM_WAKE_EVENT),
+       BCMEVENT_NAME(WLC_E_PFN_SCAN_NONE),
+       BCMEVENT_NAME(WLC_E_PFN_SCAN_ALLGONE),
+#ifdef SOFTAP
+       BCMEVENT_NAME(WLC_E_GTK_PLUMBED),
+#endif
+       BCMEVENT_NAME(WLC_E_ASSOC_REQ_IE),
+       BCMEVENT_NAME(WLC_E_ASSOC_RESP_IE),
+       BCMEVENT_NAME(WLC_E_BEACON_FRAME_RX),
+#ifdef WLTDLS
+       BCMEVENT_NAME(WLC_E_TDLS_PEER_EVENT),
+#endif /* WLTDLS */
+       BCMEVENT_NAME(WLC_E_NATIVE),
+#ifdef WLPKTDLYSTAT
+       BCMEVENT_NAME(WLC_E_PKTDELAY_IND),
+#endif /* WLPKTDLYSTAT */
+       BCMEVENT_NAME(WLC_E_SERVICE_FOUND),
+       BCMEVENT_NAME(WLC_E_GAS_FRAGMENT_RX),
+       BCMEVENT_NAME(WLC_E_GAS_COMPLETE),
+       BCMEVENT_NAME(WLC_E_P2PO_ADD_DEVICE),
+       BCMEVENT_NAME(WLC_E_P2PO_DEL_DEVICE),
+#ifdef WLWNM
+       BCMEVENT_NAME(WLC_E_WNM_STA_SLEEP),
+#endif /* WLWNM */
+#if defined(WL_PROXDETECT)
+       BCMEVENT_NAME(WLC_E_PROXD),
+#endif
+       BCMEVENT_NAME(WLC_E_CCA_CHAN_QUAL),
+       BCMEVENT_NAME(WLC_E_BSSID),
+#ifdef PROP_TXSTATUS
+       BCMEVENT_NAME(WLC_E_BCMC_CREDIT_SUPPORT),
+#endif
+       BCMEVENT_NAME(WLC_E_PSTA_PRIMARY_INTF_IND),
+       BCMEVENT_NAME(WLC_E_TXFAIL_THRESH),
+#ifdef GSCAN_SUPPORT
+       BCMEVENT_NAME(WLC_E_PFN_GSCAN_FULL_RESULT),
+       BCMEVENT_NAME(WLC_E_PFN_SWC),
+#endif /* GSCAN_SUPPORT */
+#ifdef WLBSSLOAD_REPORT
+       BCMEVENT_NAME(WLC_E_BSS_LOAD),
+#endif
+#if defined(BT_WIFI_HANDOVER) || defined(WL_TBOW)
+       BCMEVENT_NAME(WLC_E_BT_WIFI_HANDOVER_REQ),
+#endif
+       BCMEVENT_NAME(WLC_E_AUTHORIZED),
+       BCMEVENT_NAME(WLC_E_PROBREQ_MSG_RX),
+       BCMEVENT_NAME(WLC_E_CSA_START_IND),
+       BCMEVENT_NAME(WLC_E_CSA_DONE_IND),
+       BCMEVENT_NAME(WLC_E_CSA_FAILURE_IND),
+       BCMEVENT_NAME(WLC_E_RMC_EVENT),
+       BCMEVENT_NAME(WLC_E_DPSTA_INTF_IND),
+       BCMEVENT_NAME(WLC_E_SDB_TRANSITION),
+};
+
+
+const char *bcmevent_get_name(uint event_type)
+{
+       /* note:  first coded this as a static const but some
+        * ROMs already have something called event_name so
+        * changed it so we don't have a variable for the
+        * 'unknown string
+        */
+       const char *event_name = NULL;
+
+       uint idx;
+       for (idx = 0; idx < (uint)ARRAYSIZE(bcmevent_names); idx++) {
+
+               if (bcmevent_names[idx].event == event_type) {
+                       event_name = bcmevent_names[idx].name;
+                       break;
+               }
+       }
+
+       /* if we find an event name in the array, return it.
+        * otherwise return unknown string.
+        */
+       return ((event_name) ? event_name : "Unknown Event");
+}
+
+void
+wl_event_to_host_order(wl_event_msg_t * evt)
+{
+       /* Event struct members passed from dongle to host are stored in network
+       * byte order. Convert all members to host-order.
+       */
+       evt->event_type = ntoh32(evt->event_type);
+       evt->flags = ntoh16(evt->flags);
+       evt->status = ntoh32(evt->status);
+       evt->reason = ntoh32(evt->reason);
+       evt->auth_type = ntoh32(evt->auth_type);
+       evt->datalen = ntoh32(evt->datalen);
+       evt->version = ntoh16(evt->version);
+}
+
+void
+wl_event_to_network_order(wl_event_msg_t * evt)
+{
+       /* Event struct members passed from dongle to host are stored in network
+       * byte order. Convert all members to host-order.
+       */
+       evt->event_type = hton32(evt->event_type);
+       evt->flags = hton16(evt->flags);
+       evt->status = hton32(evt->status);
+       evt->reason = hton32(evt->reason);
+       evt->auth_type = hton32(evt->auth_type);
+       evt->datalen = hton32(evt->datalen);
+       evt->version = hton16(evt->version);
+}
+
+/*
+ * Validate if the event is proper and if valid copy event header to event.
+ * If proper event pointer is passed, to just validate, pass NULL to event.
+ *
+ * Return values are
+ *     BCME_OK - It is a BRCM event or BRCM dongle event
+ *     BCME_NOTFOUND - Not BRCM, not an event, may be okay
+ *     BCME_BADLEN - Bad length, should not process, just drop
+ */
+int
+is_wlc_event_frame(void *pktdata, uint pktlen, uint16 exp_usr_subtype,
+       bcm_event_msg_u_t *out_event)
+{
+       uint16 len;
+       uint16 subtype;
+       uint16 usr_subtype;
+       bcm_event_t *bcm_event;
+       uint8 *pktend;
+       int err = BCME_OK;
+
+       pktend = (uint8 *)pktdata + pktlen;
+       bcm_event = (bcm_event_t *)pktdata;
+
+       /* only care about 16-bit subtype / length versions */
+       if ((uint8 *)&bcm_event->bcm_hdr < pktend) {
+               uint8 short_subtype = *(uint8 *)&bcm_event->bcm_hdr;
+               if (!(short_subtype & 0x80)) {
+                       err = BCME_NOTFOUND;
+                       goto done;
+               }
+       }
+
+       /* must have both ether_header and bcmeth_hdr */
+       if (pktlen < OFFSETOF(bcm_event_t, event)) {
+               err = BCME_BADLEN;
+               goto done;
+       }
+
+       /* check length in bcmeth_hdr */
+       len = ntoh16_ua((void *)&bcm_event->bcm_hdr.length);
+
+       /* match on subtype, oui and usr subtype for BRCM events */
+       subtype = ntoh16_ua((void *)&bcm_event->bcm_hdr.subtype);
+       if (subtype != BCMILCP_SUBTYPE_VENDOR_LONG) {
+               err = BCME_NOTFOUND;
+               goto done;
+       }
+
+       if (bcmp(BRCM_OUI, &bcm_event->bcm_hdr.oui[0], DOT11_OUI_LEN)) {
+               err = BCME_NOTFOUND;
+               goto done;
+       }
+
+       /* if it is a bcm_event or bcm_dngl_event_t, validate it */
+       usr_subtype = ntoh16_ua((void *)&bcm_event->bcm_hdr.usr_subtype);
+       switch (usr_subtype) {
+       case BCMILCP_BCM_SUBTYPE_EVENT:
+               if (pktlen < sizeof(bcm_event_t)) {
+                       err = BCME_BADLEN;
+                       goto done;
+               }
+
+               len = (uint16)sizeof(bcm_event_t) +
+                       (uint16)ntoh32_ua((void *)&bcm_event->event.datalen);
+               if ((uint8 *)pktdata + len > pktend) {
+                       err = BCME_BADLEN;
+                       goto done;
+               }
+
+               if (exp_usr_subtype && (exp_usr_subtype != usr_subtype)) {
+                       err = BCME_NOTFOUND;
+                       goto done;
+               }
+
+               if (out_event) {
+                       /* ensure BRCM event pkt aligned */
+                       memcpy(&out_event->event, &bcm_event->event, sizeof(wl_event_msg_t));
+               }
+
+               break;
+
+       case BCMILCP_BCM_SUBTYPE_DNGLEVENT:
+#if defined(HEALTH_CHECK) || defined(DNGL_EVENT_SUPPORT)
+               if (pktlen < sizeof(bcm_dngl_event_t)) {
+                       err = BCME_BADLEN;
+                       goto done;
+               }
+
+               len = sizeof(bcm_dngl_event_t) +
+                       ntoh16_ua((void *)&((bcm_dngl_event_t *)pktdata)->dngl_event.datalen);
+               if ((uint8 *)pktdata + len > pktend) {
+                       err = BCME_BADLEN;
+                       goto done;
+               }
+
+               if (exp_usr_subtype && (exp_usr_subtype != usr_subtype)) {
+                       err = BCME_NOTFOUND;
+                       goto done;
+               }
+
+               if (out_event) {
+                       /* ensure BRCM dngl event pkt aligned */
+                       memcpy(&out_event->dngl_event, &((bcm_dngl_event_t *)pktdata)->dngl_event,
+                               sizeof(bcm_dngl_event_msg_t));
+               }
+
+               break;
+#else
+               err = BCME_UNSUPPORTED;
+               break;
+#endif /* HEALTH_CHECK || DNGL_EVENT_SUPPORT */
+
+       default:
+               err = BCME_NOTFOUND;
+               goto done;
+       }
+
+done:
+       return err;
+}
diff --git a/drivers/net/wireless/bcmdhd_1363/bcmsdh.c b/drivers/net/wireless/bcmdhd_1363/bcmsdh.c
new file mode 100644 (file)
index 0000000..9e477b2
--- /dev/null
@@ -0,0 +1,708 @@
+/*
+ *  BCMSDH interface glue
+ *  implement bcmsdh API for SDIOH driver
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmsdh.c 514727 2014-11-12 03:02:48Z $
+ */
+
+/**
+ * @file bcmsdh.c
+ */
+
+/* ****************** BCMSDH Interface Functions *************************** */
+
+#include <typedefs.h>
+#include <bcmdevs.h>
+#include <bcmendian.h>
+#include <bcmutils.h>
+#include <hndsoc.h>
+#include <siutils.h>
+#include <osl.h>
+
+#include <bcmsdh.h>    /* BRCM API for SDIO clients (such as wl, dhd) */
+#include <bcmsdbus.h>  /* common SDIO/controller interface */
+#include <sbsdio.h>    /* SDIO device core hardware definitions. */
+#include <sdio.h>      /* SDIO Device and Protocol Specs */
+
+#define SDIOH_API_ACCESS_RETRY_LIMIT   2
+const uint bcmsdh_msglevel = BCMSDH_ERROR_VAL;
+
+/* local copy of bcm sd handler */
+bcmsdh_info_t * l_bcmsdh = NULL;
+
+
+#if defined(OOB_INTR_ONLY) && defined(HW_OOB)
+extern int
+sdioh_enable_hw_oob_intr(void *sdioh, bool enable);
+
+void
+bcmsdh_enable_hw_oob_intr(bcmsdh_info_t *sdh, bool enable)
+{
+       sdioh_enable_hw_oob_intr(sdh->sdioh, enable);
+}
+#endif
+
+/* Attach BCMSDH layer to SDIO Host Controller Driver
+ *
+ * @param osh OSL Handle.
+ * @param cfghdl Configuration Handle.
+ * @param regsva Virtual address of controller registers.
+ * @param irq Interrupt number of SDIO controller.
+ *
+ * @return bcmsdh_info_t Handle to BCMSDH context.
+ */
+bcmsdh_info_t *
+bcmsdh_attach(osl_t *osh, void *sdioh, ulong *regsva)
+{
+       bcmsdh_info_t *bcmsdh;
+
+       if ((bcmsdh = (bcmsdh_info_t *)MALLOC(osh, sizeof(bcmsdh_info_t))) == NULL) {
+               BCMSDH_ERROR(("bcmsdh_attach: out of memory, malloced %d bytes\n", MALLOCED(osh)));
+               return NULL;
+       }
+       bzero((char *)bcmsdh, sizeof(bcmsdh_info_t));
+       bcmsdh->sdioh = sdioh;
+       bcmsdh->osh = osh;
+       bcmsdh->init_success = TRUE;
+       *regsva = SI_ENUM_BASE;
+
+       /* Report the BAR, to fix if needed */
+       bcmsdh->sbwad = SI_ENUM_BASE;
+
+       /* save the handler locally */
+       l_bcmsdh = bcmsdh;
+
+       return bcmsdh;
+}
+
+int
+bcmsdh_detach(osl_t *osh, void *sdh)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+       if (bcmsdh != NULL) {
+               MFREE(osh, bcmsdh, sizeof(bcmsdh_info_t));
+       }
+
+       l_bcmsdh = NULL;
+
+       return 0;
+}
+
+int
+bcmsdh_iovar_op(void *sdh, const char *name,
+                void *params, int plen, void *arg, int len, bool set)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       return sdioh_iovar_op(bcmsdh->sdioh, name, params, plen, arg, len, set);
+}
+
+bool
+bcmsdh_intr_query(void *sdh)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+       bool on;
+
+       ASSERT(bcmsdh);
+       status = sdioh_interrupt_query(bcmsdh->sdioh, &on);
+       if (SDIOH_API_SUCCESS(status))
+               return FALSE;
+       else
+               return on;
+}
+
+int
+bcmsdh_intr_enable(void *sdh)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+       ASSERT(bcmsdh);
+
+       status = sdioh_interrupt_set(bcmsdh->sdioh, TRUE);
+       return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+int
+bcmsdh_intr_disable(void *sdh)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+       ASSERT(bcmsdh);
+
+       status = sdioh_interrupt_set(bcmsdh->sdioh, FALSE);
+       return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+int
+bcmsdh_intr_reg(void *sdh, bcmsdh_cb_fn_t fn, void *argh)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+       ASSERT(bcmsdh);
+
+       status = sdioh_interrupt_register(bcmsdh->sdioh, fn, argh);
+       return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+int
+bcmsdh_intr_dereg(void *sdh)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+       ASSERT(bcmsdh);
+
+       status = sdioh_interrupt_deregister(bcmsdh->sdioh);
+       return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+#if defined(DHD_DEBUG)
+bool
+bcmsdh_intr_pending(void *sdh)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+       ASSERT(sdh);
+       return sdioh_interrupt_pending(bcmsdh->sdioh);
+}
+#endif
+
+
+int
+bcmsdh_devremove_reg(void *sdh, bcmsdh_cb_fn_t fn, void *argh)
+{
+       ASSERT(sdh);
+
+       /* don't support yet */
+       return BCME_UNSUPPORTED;
+}
+
+/**
+ * Read from SDIO Configuration Space
+ * @param sdh SDIO Host context.
+ * @param func_num Function number to read from.
+ * @param addr Address to read from.
+ * @param err Error return.
+ * @return value read from SDIO configuration space.
+ */
+uint8
+bcmsdh_cfg_read(void *sdh, uint fnc_num, uint32 addr, int *err)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+#ifdef SDIOH_API_ACCESS_RETRY_LIMIT
+       int32 retry = 0;
+#endif
+       uint8 data = 0;
+
+       if (!bcmsdh)
+               bcmsdh = l_bcmsdh;
+
+       ASSERT(bcmsdh->init_success);
+
+#ifdef SDIOH_API_ACCESS_RETRY_LIMIT
+       do {
+               if (retry)      /* wait for 1 ms till bus get settled down */
+                       OSL_DELAY(1000);
+#endif
+       status = sdioh_cfg_read(bcmsdh->sdioh, fnc_num, addr, (uint8 *)&data);
+#ifdef SDIOH_API_ACCESS_RETRY_LIMIT
+       } while (!SDIOH_API_SUCCESS(status) && (retry++ < SDIOH_API_ACCESS_RETRY_LIMIT));
+#endif
+       if (err)
+               *err = (SDIOH_API_SUCCESS(status) ? 0 : BCME_SDIO_ERROR);
+
+       BCMSDH_INFO(("%s:fun = %d, addr = 0x%x, uint8data = 0x%x\n", __FUNCTION__,
+                   fnc_num, addr, data));
+
+       return data;
+}
+
+void
+bcmsdh_cfg_write(void *sdh, uint fnc_num, uint32 addr, uint8 data, int *err)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+#ifdef SDIOH_API_ACCESS_RETRY_LIMIT
+       int32 retry = 0;
+#endif
+
+       if (!bcmsdh)
+               bcmsdh = l_bcmsdh;
+
+       ASSERT(bcmsdh->init_success);
+
+#ifdef SDIOH_API_ACCESS_RETRY_LIMIT
+       do {
+               if (retry)      /* wait for 1 ms till bus get settled down */
+                       OSL_DELAY(1000);
+#endif
+       status = sdioh_cfg_write(bcmsdh->sdioh, fnc_num, addr, (uint8 *)&data);
+#ifdef SDIOH_API_ACCESS_RETRY_LIMIT
+       } while (!SDIOH_API_SUCCESS(status) && (retry++ < SDIOH_API_ACCESS_RETRY_LIMIT));
+#endif
+       if (err)
+               *err = SDIOH_API_SUCCESS(status) ? 0 : BCME_SDIO_ERROR;
+
+       BCMSDH_INFO(("%s:fun = %d, addr = 0x%x, uint8data = 0x%x\n", __FUNCTION__,
+                   fnc_num, addr, data));
+}
+
+uint32
+bcmsdh_cfg_read_word(void *sdh, uint fnc_num, uint32 addr, int *err)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+       uint32 data = 0;
+
+       if (!bcmsdh)
+               bcmsdh = l_bcmsdh;
+
+       ASSERT(bcmsdh->init_success);
+
+       status = sdioh_request_word(bcmsdh->sdioh, SDIOH_CMD_TYPE_NORMAL, SDIOH_READ, fnc_num,
+                                   addr, &data, 4);
+
+       if (err)
+               *err = (SDIOH_API_SUCCESS(status) ? 0 : BCME_SDIO_ERROR);
+
+       BCMSDH_INFO(("%s:fun = %d, addr = 0x%x, uint32data = 0x%x\n", __FUNCTION__,
+                   fnc_num, addr, data));
+
+       return data;
+}
+
+void
+bcmsdh_cfg_write_word(void *sdh, uint fnc_num, uint32 addr, uint32 data, int *err)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+
+       if (!bcmsdh)
+               bcmsdh = l_bcmsdh;
+
+       ASSERT(bcmsdh->init_success);
+
+       status = sdioh_request_word(bcmsdh->sdioh, SDIOH_CMD_TYPE_NORMAL, SDIOH_WRITE, fnc_num,
+                                   addr, &data, 4);
+
+       if (err)
+               *err = (SDIOH_API_SUCCESS(status) ? 0 : BCME_SDIO_ERROR);
+
+       BCMSDH_INFO(("%s:fun = %d, addr = 0x%x, uint32data = 0x%x\n", __FUNCTION__, fnc_num,
+                    addr, data));
+}
+
+
+int
+bcmsdh_cis_read(void *sdh, uint func, uint8 *cis, uint length)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+
+       uint8 *tmp_buf, *tmp_ptr;
+       uint8 *ptr;
+       bool ascii = func & ~0xf;
+       func &= 0x7;
+
+       if (!bcmsdh)
+               bcmsdh = l_bcmsdh;
+
+       ASSERT(bcmsdh->init_success);
+       ASSERT(cis);
+       ASSERT(length <= SBSDIO_CIS_SIZE_LIMIT);
+
+       status = sdioh_cis_read(bcmsdh->sdioh, func, cis, length);
+
+       if (ascii) {
+               /* Move binary bits to tmp and format them into the provided buffer. */
+               if ((tmp_buf = (uint8 *)MALLOC(bcmsdh->osh, length)) == NULL) {
+                       BCMSDH_ERROR(("%s: out of memory\n", __FUNCTION__));
+                       return BCME_NOMEM;
+               }
+               bcopy(cis, tmp_buf, length);
+               for (tmp_ptr = tmp_buf, ptr = cis; ptr < (cis + length - 4); tmp_ptr++) {
+                       ptr += snprintf((char*)ptr, (cis + length - ptr - 4),
+                               "%.2x ", *tmp_ptr & 0xff);
+                       if ((((tmp_ptr - tmp_buf) + 1) & 0xf) == 0)
+                               ptr += snprintf((char *)ptr, (cis + length - ptr -4), "\n");
+               }
+               MFREE(bcmsdh->osh, tmp_buf, length);
+       }
+
+       return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+
+int
+bcmsdhsdio_set_sbaddr_window(void *sdh, uint32 address, bool force_set)
+{
+       int err = 0;
+       uint bar0 = address & ~SBSDIO_SB_OFT_ADDR_MASK;
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+       if (bar0 != bcmsdh->sbwad || force_set) {
+               bcmsdh_cfg_write(bcmsdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRLOW,
+                       (address >> 8) & SBSDIO_SBADDRLOW_MASK, &err);
+               if (!err)
+                       bcmsdh_cfg_write(bcmsdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRMID,
+                               (address >> 16) & SBSDIO_SBADDRMID_MASK, &err);
+               if (!err)
+                       bcmsdh_cfg_write(bcmsdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRHIGH,
+                               (address >> 24) & SBSDIO_SBADDRHIGH_MASK, &err);
+
+               if (!err)
+                       bcmsdh->sbwad = bar0;
+               else
+                       /* invalidate cached window var */
+                       bcmsdh->sbwad = 0;
+
+       }
+
+       return err;
+}
+
+uint32
+bcmsdh_reg_read(void *sdh, uint32 addr, uint size)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+       uint32 word = 0;
+
+       BCMSDH_INFO(("%s:fun = 1, addr = 0x%x, ", __FUNCTION__, addr));
+
+       if (!bcmsdh)
+               bcmsdh = l_bcmsdh;
+
+       ASSERT(bcmsdh->init_success);
+
+       if (bcmsdhsdio_set_sbaddr_window(bcmsdh, addr, FALSE))
+               return 0xFFFFFFFF;
+
+       addr &= SBSDIO_SB_OFT_ADDR_MASK;
+       if (size == 4)
+               addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+
+       status = sdioh_request_word(bcmsdh->sdioh, SDIOH_CMD_TYPE_NORMAL,
+               SDIOH_READ, SDIO_FUNC_1, addr, &word, size);
+
+       bcmsdh->regfail = !(SDIOH_API_SUCCESS(status));
+
+       BCMSDH_INFO(("uint32data = 0x%x\n", word));
+
+       /* if ok, return appropriately masked word */
+       if (SDIOH_API_SUCCESS(status)) {
+               switch (size) {
+                       case sizeof(uint8):
+                               return (word & 0xff);
+                       case sizeof(uint16):
+                               return (word & 0xffff);
+                       case sizeof(uint32):
+                               return word;
+                       default:
+                               bcmsdh->regfail = TRUE;
+
+               }
+       }
+
+       /* otherwise, bad sdio access or invalid size */
+       BCMSDH_ERROR(("%s: error reading addr 0x%04x size %d\n", __FUNCTION__, addr, size));
+       return 0xFFFFFFFF;
+}
+
+uint32
+bcmsdh_reg_write(void *sdh, uint32 addr, uint size, uint32 data)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+       int err = 0;
+
+       BCMSDH_INFO(("%s:fun = 1, addr = 0x%x, uint%ddata = 0x%x\n",
+                    __FUNCTION__, addr, size*8, data));
+
+       if (!bcmsdh)
+               bcmsdh = l_bcmsdh;
+
+       ASSERT(bcmsdh->init_success);
+
+       if ((err = bcmsdhsdio_set_sbaddr_window(bcmsdh, addr, FALSE)))
+               return err;
+
+       addr &= SBSDIO_SB_OFT_ADDR_MASK;
+       if (size == 4)
+               addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+       status = sdioh_request_word(bcmsdh->sdioh, SDIOH_CMD_TYPE_NORMAL, SDIOH_WRITE, SDIO_FUNC_1,
+                                   addr, &data, size);
+       bcmsdh->regfail = !(SDIOH_API_SUCCESS(status));
+
+       if (SDIOH_API_SUCCESS(status))
+               return 0;
+
+       BCMSDH_ERROR(("%s: error writing 0x%08x to addr 0x%04x size %d\n",
+                     __FUNCTION__, data, addr, size));
+       return 0xFFFFFFFF;
+}
+
+bool
+bcmsdh_regfail(void *sdh)
+{
+       return ((bcmsdh_info_t *)sdh)->regfail;
+}
+
+int
+bcmsdh_recv_buf(void *sdh, uint32 addr, uint fn, uint flags,
+                uint8 *buf, uint nbytes, void *pkt,
+                bcmsdh_cmplt_fn_t complete_fn, void *handle)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+       uint incr_fix;
+       uint width;
+       int err = 0;
+
+       ASSERT(bcmsdh);
+       ASSERT(bcmsdh->init_success);
+
+       BCMSDH_INFO(("%s:fun = %d, addr = 0x%x, size = %d\n",
+                    __FUNCTION__, fn, addr, nbytes));
+
+       /* Async not implemented yet */
+       ASSERT(!(flags & SDIO_REQ_ASYNC));
+       if (flags & SDIO_REQ_ASYNC)
+               return BCME_UNSUPPORTED;
+
+       if ((err = bcmsdhsdio_set_sbaddr_window(bcmsdh, addr, FALSE)))
+               return err;
+
+       addr &= SBSDIO_SB_OFT_ADDR_MASK;
+
+       incr_fix = (flags & SDIO_REQ_FIXED) ? SDIOH_DATA_FIX : SDIOH_DATA_INC;
+       width = (flags & SDIO_REQ_4BYTE) ? 4 : 2;
+       if (width == 4)
+               addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+
+       status = sdioh_request_buffer(bcmsdh->sdioh, SDIOH_DATA_PIO, incr_fix,
+                                     SDIOH_READ, fn, addr, width, nbytes, buf, pkt);
+
+       return (SDIOH_API_SUCCESS(status) ? 0 : BCME_SDIO_ERROR);
+}
+
+int
+bcmsdh_send_buf(void *sdh, uint32 addr, uint fn, uint flags,
+                uint8 *buf, uint nbytes, void *pkt,
+                bcmsdh_cmplt_fn_t complete_fn, void *handle)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+       uint incr_fix;
+       uint width;
+       int err = 0;
+
+       ASSERT(bcmsdh);
+       ASSERT(bcmsdh->init_success);
+
+       BCMSDH_INFO(("%s:fun = %d, addr = 0x%x, size = %d\n",
+                   __FUNCTION__, fn, addr, nbytes));
+
+       /* Async not implemented yet */
+       ASSERT(!(flags & SDIO_REQ_ASYNC));
+       if (flags & SDIO_REQ_ASYNC)
+               return BCME_UNSUPPORTED;
+
+       if ((err = bcmsdhsdio_set_sbaddr_window(bcmsdh, addr, FALSE)))
+               return err;
+
+       addr &= SBSDIO_SB_OFT_ADDR_MASK;
+
+       incr_fix = (flags & SDIO_REQ_FIXED) ? SDIOH_DATA_FIX : SDIOH_DATA_INC;
+       width = (flags & SDIO_REQ_4BYTE) ? 4 : 2;
+       if (width == 4)
+               addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+
+       status = sdioh_request_buffer(bcmsdh->sdioh, SDIOH_DATA_PIO, incr_fix,
+                                     SDIOH_WRITE, fn, addr, width, nbytes, buf, pkt);
+
+       return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+int
+bcmsdh_rwdata(void *sdh, uint rw, uint32 addr, uint8 *buf, uint nbytes)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       SDIOH_API_RC status;
+
+       ASSERT(bcmsdh);
+       ASSERT(bcmsdh->init_success);
+       ASSERT((addr & SBSDIO_SBWINDOW_MASK) == 0);
+
+       addr &= SBSDIO_SB_OFT_ADDR_MASK;
+       addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+
+       status = sdioh_request_buffer(bcmsdh->sdioh, SDIOH_DATA_PIO, SDIOH_DATA_INC,
+                                     (rw ? SDIOH_WRITE : SDIOH_READ), SDIO_FUNC_1,
+                                     addr, 4, nbytes, buf, NULL);
+
+       return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+int
+bcmsdh_abort(void *sdh, uint fn)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+       return sdioh_abort(bcmsdh->sdioh, fn);
+}
+
+int
+bcmsdh_start(void *sdh, int stage)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+       return sdioh_start(bcmsdh->sdioh, stage);
+}
+
+int
+bcmsdh_stop(void *sdh)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+       return sdioh_stop(bcmsdh->sdioh);
+}
+
+int
+bcmsdh_waitlockfree(void *sdh)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+       return sdioh_waitlockfree(bcmsdh->sdioh);
+}
+
+
+int
+bcmsdh_query_device(void *sdh)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+       bcmsdh->vendevid = (VENDOR_BROADCOM << 16) | 0;
+       return (bcmsdh->vendevid);
+}
+
+uint
+bcmsdh_query_iofnum(void *sdh)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+       if (!bcmsdh)
+               bcmsdh = l_bcmsdh;
+
+       return (sdioh_query_iofnum(bcmsdh->sdioh));
+}
+
+int
+bcmsdh_reset(bcmsdh_info_t *sdh)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+       return sdioh_sdio_reset(bcmsdh->sdioh);
+}
+
+void *bcmsdh_get_sdioh(bcmsdh_info_t *sdh)
+{
+       ASSERT(sdh);
+       return sdh->sdioh;
+}
+
+/* Function to pass device-status bits to DHD. */
+uint32
+bcmsdh_get_dstatus(void *sdh)
+{
+       return 0;
+}
+uint32
+bcmsdh_cur_sbwad(void *sdh)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+       if (!bcmsdh)
+               bcmsdh = l_bcmsdh;
+
+       return (bcmsdh->sbwad);
+}
+
+void
+bcmsdh_chipinfo(void *sdh, uint32 chip, uint32 chiprev)
+{
+       return;
+}
+
+
+int
+bcmsdh_sleep(void *sdh, bool enab)
+{
+#ifdef SDIOH_SLEEP_ENABLED
+       bcmsdh_info_t *p = (bcmsdh_info_t *)sdh;
+       sdioh_info_t *sd = (sdioh_info_t *)(p->sdioh);
+
+       return sdioh_sleep(sd, enab);
+#else
+       return BCME_UNSUPPORTED;
+#endif
+}
+
+int
+bcmsdh_gpio_init(void *sdh)
+{
+       bcmsdh_info_t *p = (bcmsdh_info_t *)sdh;
+       sdioh_info_t *sd = (sdioh_info_t *)(p->sdioh);
+
+       return sdioh_gpio_init(sd);
+}
+
+bool
+bcmsdh_gpioin(void *sdh, uint32 gpio)
+{
+       bcmsdh_info_t *p = (bcmsdh_info_t *)sdh;
+       sdioh_info_t *sd = (sdioh_info_t *)(p->sdioh);
+
+       return sdioh_gpioin(sd, gpio);
+}
+
+int
+bcmsdh_gpioouten(void *sdh, uint32 gpio)
+{
+       bcmsdh_info_t *p = (bcmsdh_info_t *)sdh;
+       sdioh_info_t *sd = (sdioh_info_t *)(p->sdioh);
+
+       return sdioh_gpioouten(sd, gpio);
+}
+
+int
+bcmsdh_gpioout(void *sdh, uint32 gpio, bool enab)
+{
+       bcmsdh_info_t *p = (bcmsdh_info_t *)sdh;
+       sdioh_info_t *sd = (sdioh_info_t *)(p->sdioh);
+
+       return sdioh_gpioout(sd, gpio, enab);
+}
diff --git a/drivers/net/wireless/bcmdhd_1363/bcmsdh_linux.c b/drivers/net/wireless/bcmdhd_1363/bcmsdh_linux.c
new file mode 100644 (file)
index 0000000..9addd32
--- /dev/null
@@ -0,0 +1,473 @@
+/*
+ * SDIO access interface for drivers - linux specific (pci only)
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmsdh_linux.c 662741 2016-11-08 09:37:17Z $
+ */
+
+/**
+ * @file bcmsdh_linux.c
+ */
+
+#define __UNDEF_NO_VERSION__
+
+#include <typedefs.h>
+#include <linuxver.h>
+#include <linux/pci.h>
+#include <linux/completion.h>
+
+#include <osl.h>
+#include <pcicfg.h>
+#include <bcmdefs.h>
+#include <bcmdevs.h>
+#include <linux/irq.h>
+extern void dhdsdio_isr(void * args);
+#include <bcmutils.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#if defined(CONFIG_ARCH_ODIN)
+#include <linux/platform_data/gpio-odin.h>
+#endif /* defined(CONFIG_ARCH_ODIN) */
+#include <dhd_linux.h>
+
+/* driver info, initialized when bcmsdh_register is called */
+static bcmsdh_driver_t drvinfo = {NULL, NULL, NULL, NULL};
+
+typedef enum {
+       DHD_INTR_INVALID = 0,
+       DHD_INTR_INBAND,
+       DHD_INTR_HWOOB,
+       DHD_INTR_SWOOB
+} DHD_HOST_INTR_TYPE;
+
+/* the BCMSDH module comprises the generic part (bcmsdh.c) and OS specific layer (e.g.
+ * bcmsdh_linux.c). Put all OS specific variables (e.g. irq number and flags) here rather
+ * than in the common structure bcmsdh_info. bcmsdh_info only keeps a handle (os_ctx) to this
+ * structure.
+ */
+typedef struct bcmsdh_os_info {
+       DHD_HOST_INTR_TYPE      intr_type;
+       int                     oob_irq_num;    /* valid when hardware or software oob in use */
+       unsigned long           oob_irq_flags;  /* valid when hardware or software oob in use */
+       bool                    oob_irq_registered;
+       bool                    oob_irq_enabled;
+       bool                    oob_irq_wake_enabled;
+       spinlock_t              oob_irq_spinlock;
+       bcmsdh_cb_fn_t          oob_irq_handler;
+       void                    *oob_irq_handler_context;
+       void                    *context;       /* context returned from upper layer */
+       void                    *sdioh;         /* handle to lower layer (sdioh) */
+       void                    *dev;           /* handle to the underlying device */
+       bool                    dev_wake_enabled;
+} bcmsdh_os_info_t;
+
+/* debugging macros */
+#define SDLX_MSG(x)
+
+/**
+ * Checks to see if vendor and device IDs match a supported SDIO Host Controller.
+ */
+bool
+bcmsdh_chipmatch(uint16 vendor, uint16 device)
+{
+       /* Add other vendors and devices as required */
+
+#ifdef BCMSDIOH_STD
+       /* Check for Arasan host controller */
+       if (vendor == VENDOR_SI_IMAGE) {
+               return (TRUE);
+       }
+       /* Check for BRCM 27XX Standard host controller */
+       if (device == BCM27XX_SDIOH_ID && vendor == VENDOR_BROADCOM) {
+               return (TRUE);
+       }
+       /* Check for BRCM Standard host controller */
+       if (device == SDIOH_FPGA_ID && vendor == VENDOR_BROADCOM) {
+               return (TRUE);
+       }
+       /* Check for TI PCIxx21 Standard host controller */
+       if (device == PCIXX21_SDIOH_ID && vendor == VENDOR_TI) {
+               return (TRUE);
+       }
+       if (device == PCIXX21_SDIOH0_ID && vendor == VENDOR_TI) {
+               return (TRUE);
+       }
+       /* Ricoh R5C822 Standard SDIO Host */
+       if (device == R5C822_SDIOH_ID && vendor == VENDOR_RICOH) {
+               return (TRUE);
+       }
+       /* JMicron Standard SDIO Host */
+       if (device == JMICRON_SDIOH_ID && vendor == VENDOR_JMICRON) {
+               return (TRUE);
+       }
+
+#endif /* BCMSDIOH_STD */
+#ifdef BCMSDIOH_SPI
+       /* This is the PciSpiHost. */
+       if (device == SPIH_FPGA_ID && vendor == VENDOR_BROADCOM) {
+               printf("Found PCI SPI Host Controller\n");
+               return (TRUE);
+       }
+
+#endif /* BCMSDIOH_SPI */
+
+       return (FALSE);
+}
+
+void* bcmsdh_probe(osl_t *osh, void *dev, void *sdioh, void *adapter_info, uint bus_type,
+       uint bus_num, uint slot_num)
+{
+       ulong regs;
+       bcmsdh_info_t *bcmsdh;
+       uint32 vendevid;
+       bcmsdh_os_info_t *bcmsdh_osinfo = NULL;
+#ifdef OOB_PARAM
+       wifi_adapter_info_t *adapter = (wifi_adapter_info_t *)adapter_info;
+#endif /* OOB_PARAM */
+
+       bcmsdh = bcmsdh_attach(osh, sdioh, &regs);
+       if (bcmsdh == NULL) {
+               SDLX_MSG(("%s: bcmsdh_attach failed\n", __FUNCTION__));
+               goto err;
+       }
+       bcmsdh_osinfo = MALLOC(osh, sizeof(bcmsdh_os_info_t));
+       if (bcmsdh_osinfo == NULL) {
+               SDLX_MSG(("%s: failed to allocate bcmsdh_os_info_t\n", __FUNCTION__));
+               goto err;
+       }
+       bzero((char *)bcmsdh_osinfo, sizeof(bcmsdh_os_info_t));
+       bcmsdh->os_cxt = bcmsdh_osinfo;
+       bcmsdh_osinfo->sdioh = sdioh;
+       bcmsdh_osinfo->dev = dev;
+       osl_set_bus_handle(osh, bcmsdh);
+
+#if !defined(CONFIG_HAS_WAKELOCK) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36))
+       if (dev && device_init_wakeup(dev, true) == 0)
+               bcmsdh_osinfo->dev_wake_enabled = TRUE;
+#endif /* !defined(CONFIG_HAS_WAKELOCK) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36)) */
+
+#if defined(OOB_INTR_ONLY)
+       OOB_PARAM_IF(!(adapter->oob_disable)) {
+               spin_lock_init(&bcmsdh_osinfo->oob_irq_spinlock);
+               /* Get customer specific OOB IRQ parametres: IRQ number as IRQ type */
+               bcmsdh_osinfo->oob_irq_num = wifi_platform_get_irq_number(adapter_info,
+                       &bcmsdh_osinfo->oob_irq_flags);
+               if  (bcmsdh_osinfo->oob_irq_num < 0) {
+                       SDLX_MSG(("%s: Host OOB irq is not defined\n", __FUNCTION__));
+                       goto err;
+               }
+       }
+#endif /* defined(OOB_INTR_ONLY) */
+
+       /* Read the vendor/device ID from the CIS */
+       vendevid = bcmsdh_query_device(bcmsdh);
+       /* try to attach to the target device */
+       bcmsdh_osinfo->context = drvinfo.probe((vendevid >> 16), (vendevid & 0xFFFF), bus_num,
+               slot_num, 0, bus_type, (void *)regs, osh, bcmsdh);
+       if (bcmsdh_osinfo->context == NULL) {
+               SDLX_MSG(("%s: device attach failed\n", __FUNCTION__));
+               goto err;
+       }
+
+       return bcmsdh;
+
+       /* error handling */
+err:
+       if (bcmsdh != NULL)
+               bcmsdh_detach(osh, bcmsdh);
+       if (bcmsdh_osinfo != NULL)
+               MFREE(osh, bcmsdh_osinfo, sizeof(bcmsdh_os_info_t));
+       return NULL;
+}
+
+int bcmsdh_remove(bcmsdh_info_t *bcmsdh)
+{
+       bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+
+#if !defined(CONFIG_HAS_WAKELOCK) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36))
+       if (bcmsdh_osinfo->dev)
+               device_init_wakeup(bcmsdh_osinfo->dev, false);
+       bcmsdh_osinfo->dev_wake_enabled = FALSE;
+#endif /* !defined(CONFIG_HAS_WAKELOCK) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36)) */
+
+       drvinfo.remove(bcmsdh_osinfo->context);
+       MFREE(bcmsdh->osh, bcmsdh->os_cxt, sizeof(bcmsdh_os_info_t));
+       bcmsdh_detach(bcmsdh->osh, bcmsdh);
+
+       return 0;
+}
+
+int bcmsdh_suspend(bcmsdh_info_t *bcmsdh)
+{
+       bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+
+       if (drvinfo.suspend && drvinfo.suspend(bcmsdh_osinfo->context))
+               return -EBUSY;
+       return 0;
+}
+
+int bcmsdh_resume(bcmsdh_info_t *bcmsdh)
+{
+       bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+
+       if (drvinfo.resume)
+               return drvinfo.resume(bcmsdh_osinfo->context);
+       return 0;
+}
+
+extern int bcmsdh_register_client_driver(void);
+extern void bcmsdh_unregister_client_driver(void);
+extern int sdio_func_reg_notify(void* semaphore);
+extern void sdio_func_unreg_notify(void);
+
+#if defined(BCMLXSDMMC)
+int bcmsdh_reg_sdio_notify(void* semaphore)
+{
+       return sdio_func_reg_notify(semaphore);
+}
+
+void bcmsdh_unreg_sdio_notify(void)
+{
+       sdio_func_unreg_notify();
+}
+#endif /* defined(BCMLXSDMMC) */
+
+int
+bcmsdh_register(bcmsdh_driver_t *driver)
+{
+       int error = 0;
+
+       drvinfo = *driver;
+       SDLX_MSG(("%s: register client driver\n", __FUNCTION__));
+       error = bcmsdh_register_client_driver();
+       if (error)
+               SDLX_MSG(("%s: failed %d\n", __FUNCTION__, error));
+
+       return error;
+}
+
+void
+bcmsdh_unregister(void)
+{
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+               if (bcmsdh_pci_driver.node.next == NULL)
+                       return;
+#endif
+
+       bcmsdh_unregister_client_driver();
+}
+
+void bcmsdh_dev_pm_stay_awake(bcmsdh_info_t *bcmsdh)
+{
+#if !defined(CONFIG_HAS_WAKELOCK) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36))
+       bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+       pm_stay_awake(bcmsdh_osinfo->dev);
+#endif /* !defined(CONFIG_HAS_WAKELOCK) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36)) */
+}
+
+void bcmsdh_dev_relax(bcmsdh_info_t *bcmsdh)
+{
+#if !defined(CONFIG_HAS_WAKELOCK) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36))
+       bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+       pm_relax(bcmsdh_osinfo->dev);
+#endif /* !defined(CONFIG_HAS_WAKELOCK) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36)) */
+}
+
+bool bcmsdh_dev_pm_enabled(bcmsdh_info_t *bcmsdh)
+{
+       bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+
+       return bcmsdh_osinfo->dev_wake_enabled;
+}
+
+#if defined(OOB_INTR_ONLY)
+void bcmsdh_oob_intr_set(bcmsdh_info_t *bcmsdh, bool enable)
+{
+       unsigned long flags;
+       bcmsdh_os_info_t *bcmsdh_osinfo;
+
+       if (!bcmsdh)
+               return;
+
+       bcmsdh_osinfo = bcmsdh->os_cxt;
+       spin_lock_irqsave(&bcmsdh_osinfo->oob_irq_spinlock, flags);
+       if (bcmsdh_osinfo->oob_irq_enabled != enable) {
+               if (enable)
+                       enable_irq(bcmsdh_osinfo->oob_irq_num);
+               else
+                       disable_irq_nosync(bcmsdh_osinfo->oob_irq_num);
+               bcmsdh_osinfo->oob_irq_enabled = enable;
+       }
+       spin_unlock_irqrestore(&bcmsdh_osinfo->oob_irq_spinlock, flags);
+}
+
+static irqreturn_t wlan_oob_irq(int irq, void *dev_id)
+{
+       bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)dev_id;
+       bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+
+       bcmsdh_oob_intr_set(bcmsdh, FALSE);
+       bcmsdh_osinfo->oob_irq_handler(bcmsdh_osinfo->oob_irq_handler_context);
+
+       return IRQ_HANDLED;
+}
+
+int bcmsdh_oob_intr_register(bcmsdh_info_t *bcmsdh, bcmsdh_cb_fn_t oob_irq_handler,
+       void* oob_irq_handler_context)
+{
+       int err = 0;
+       bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+
+       SDLX_MSG(("%s: Enter\n", __FUNCTION__));
+       if (bcmsdh_osinfo->oob_irq_registered) {
+               SDLX_MSG(("%s: irq is already registered\n", __FUNCTION__));
+               return -EBUSY;
+       }
+       SDLX_MSG(("%s OOB irq=%d flags=%X \n", __FUNCTION__,
+               (int)bcmsdh_osinfo->oob_irq_num, (int)bcmsdh_osinfo->oob_irq_flags));
+       bcmsdh_osinfo->oob_irq_handler = oob_irq_handler;
+       bcmsdh_osinfo->oob_irq_handler_context = oob_irq_handler_context;
+#if defined(CONFIG_ARCH_ODIN)
+       err = odin_gpio_sms_request_irq(bcmsdh_osinfo->oob_irq_num, wlan_oob_irq,
+               bcmsdh_osinfo->oob_irq_flags, "bcmsdh_sdmmc", bcmsdh);
+#else
+       err = request_irq(bcmsdh_osinfo->oob_irq_num, wlan_oob_irq,
+               bcmsdh_osinfo->oob_irq_flags, "bcmsdh_sdmmc", bcmsdh);
+#endif /* defined(CONFIG_ARCH_ODIN) */
+       if (err) {
+               SDLX_MSG(("%s: request_irq failed with %d\n", __FUNCTION__, err));
+               return err;
+       }
+
+               err = enable_irq_wake(bcmsdh_osinfo->oob_irq_num);
+               if (!err)
+                       bcmsdh_osinfo->oob_irq_wake_enabled = TRUE;
+       bcmsdh_osinfo->oob_irq_enabled = TRUE;
+       bcmsdh_osinfo->oob_irq_registered = TRUE;
+       return err;
+}
+
+void bcmsdh_oob_intr_unregister(bcmsdh_info_t *bcmsdh)
+{
+       int err = 0;
+       bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+
+       SDLX_MSG(("%s: Enter\n", __FUNCTION__));
+       if (!bcmsdh_osinfo->oob_irq_registered) {
+               SDLX_MSG(("%s: irq is not registered\n", __FUNCTION__));
+               return;
+       }
+       if (bcmsdh_osinfo->oob_irq_wake_enabled) {
+                       err = disable_irq_wake(bcmsdh_osinfo->oob_irq_num);
+                       if (!err)
+                               bcmsdh_osinfo->oob_irq_wake_enabled = FALSE;
+       }
+       if (bcmsdh_osinfo->oob_irq_enabled) {
+               disable_irq(bcmsdh_osinfo->oob_irq_num);
+               bcmsdh_osinfo->oob_irq_enabled = FALSE;
+       }
+       free_irq(bcmsdh_osinfo->oob_irq_num, bcmsdh);
+       bcmsdh_osinfo->oob_irq_registered = FALSE;
+}
+#endif 
+
+/* Module parameters specific to each host-controller driver */
+
+extern uint sd_msglevel;       /* Debug message level */
+module_param(sd_msglevel, uint, 0);
+
+extern uint sd_power;  /* 0 = SD Power OFF, 1 = SD Power ON. */
+module_param(sd_power, uint, 0);
+
+extern uint sd_clock;  /* SD Clock Control, 0 = SD Clock OFF, 1 = SD Clock ON */
+module_param(sd_clock, uint, 0);
+
+extern uint sd_divisor;        /* Divisor (-1 means external clock) */
+module_param(sd_divisor, uint, 0);
+
+extern uint sd_sdmode; /* Default is SD4, 0=SPI, 1=SD1, 2=SD4 */
+module_param(sd_sdmode, uint, 0);
+
+extern uint sd_hiok;   /* Ok to use hi-speed mode */
+module_param(sd_hiok, uint, 0);
+
+extern uint sd_f2_blocksize;
+module_param(sd_f2_blocksize, int, 0);
+
+#ifdef BCMSDIOH_STD
+extern int sd_uhsimode;
+module_param(sd_uhsimode, int, 0);
+extern uint sd_tuning_period;
+module_param(sd_tuning_period, uint, 0);
+extern int sd_delay_value;
+module_param(sd_delay_value, uint, 0);
+
+/* SDIO Drive Strength for UHSI mode specific to SDIO3.0 */
+extern char dhd_sdiod_uhsi_ds_override[2];
+module_param_string(dhd_sdiod_uhsi_ds_override, dhd_sdiod_uhsi_ds_override, 2, 0);
+
+#endif
+
+#ifdef BCMSDH_MODULE
+EXPORT_SYMBOL(bcmsdh_attach);
+EXPORT_SYMBOL(bcmsdh_detach);
+EXPORT_SYMBOL(bcmsdh_intr_query);
+EXPORT_SYMBOL(bcmsdh_intr_enable);
+EXPORT_SYMBOL(bcmsdh_intr_disable);
+EXPORT_SYMBOL(bcmsdh_intr_reg);
+EXPORT_SYMBOL(bcmsdh_intr_dereg);
+
+#if defined(DHD_DEBUG)
+EXPORT_SYMBOL(bcmsdh_intr_pending);
+#endif
+
+EXPORT_SYMBOL(bcmsdh_devremove_reg);
+EXPORT_SYMBOL(bcmsdh_cfg_read);
+EXPORT_SYMBOL(bcmsdh_cfg_write);
+EXPORT_SYMBOL(bcmsdh_cis_read);
+EXPORT_SYMBOL(bcmsdh_reg_read);
+EXPORT_SYMBOL(bcmsdh_reg_write);
+EXPORT_SYMBOL(bcmsdh_regfail);
+EXPORT_SYMBOL(bcmsdh_send_buf);
+EXPORT_SYMBOL(bcmsdh_recv_buf);
+
+EXPORT_SYMBOL(bcmsdh_rwdata);
+EXPORT_SYMBOL(bcmsdh_abort);
+EXPORT_SYMBOL(bcmsdh_query_device);
+EXPORT_SYMBOL(bcmsdh_query_iofnum);
+EXPORT_SYMBOL(bcmsdh_iovar_op);
+EXPORT_SYMBOL(bcmsdh_register);
+EXPORT_SYMBOL(bcmsdh_unregister);
+EXPORT_SYMBOL(bcmsdh_chipmatch);
+EXPORT_SYMBOL(bcmsdh_reset);
+EXPORT_SYMBOL(bcmsdh_waitlockfree);
+
+EXPORT_SYMBOL(bcmsdh_get_dstatus);
+EXPORT_SYMBOL(bcmsdh_cfg_read_word);
+EXPORT_SYMBOL(bcmsdh_cfg_write_word);
+EXPORT_SYMBOL(bcmsdh_cur_sbwad);
+EXPORT_SYMBOL(bcmsdh_chipinfo);
+
+#endif /* BCMSDH_MODULE */
diff --git a/drivers/net/wireless/bcmdhd_1363/bcmsdh_sdmmc.c b/drivers/net/wireless/bcmdhd_1363/bcmsdh_sdmmc.c
new file mode 100644 (file)
index 0000000..9181fc5
--- /dev/null
@@ -0,0 +1,1509 @@
+/*
+ * BCMSDH Function Driver for the native SDIO/MMC driver in the Linux Kernel
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Proprietary,Open:>>
+ *
+ * $Id: bcmsdh_sdmmc.c 662741 2016-11-08 09:37:17Z $
+ */
+#include <typedefs.h>
+
+#include <bcmdevs.h>
+#include <bcmendian.h>
+#include <bcmutils.h>
+#include <osl.h>
+#include <sdio.h>      /* SDIO Device and Protocol Specs */
+#include <sdioh.h>     /* Standard SDIO Host Controller Specification */
+#include <bcmsdbus.h>  /* bcmsdh to/from specific controller APIs */
+#include <sdiovar.h>   /* ioctl/iovars */
+
+#include <linux/mmc/core.h>
+#include <linux/mmc/host.h>
+#include <linux/mmc/card.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/mmc/sdio_ids.h>
+
+#include <dngl_stats.h>
+#include <dhd.h>
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined(CONFIG_PM_SLEEP)
+#include <linux/suspend.h>
+extern volatile bool dhd_mmc_suspend;
+#endif
+#include "bcmsdh_sdmmc.h"
+
+#ifndef BCMSDH_MODULE
+extern int sdio_function_init(void);
+extern void sdio_function_cleanup(void);
+#endif /* BCMSDH_MODULE */
+
+#if !defined(OOB_INTR_ONLY) || defined(OOB_PARAM)
+static void IRQHandler(struct sdio_func *func);
+static void IRQHandlerF2(struct sdio_func *func);
+#endif /* !defined(OOB_INTR_ONLY) || defined(OOB_PARAM) */
+static int sdioh_sdmmc_get_cisaddr(sdioh_info_t *sd, uint32 regaddr);
+
+#ifdef OOB_PARAM
+extern int sdioh_get_oob_disable(sdioh_info_t *sd);
+#endif /* OOB_PARAM */
+
+#if defined(CUSTOMER_IMX) && defined(NO_SDIO_RESET)
+static int sdio_reset_comm(struct mmc_card *card)
+{
+       return 0;
+}
+#else
+extern int sdio_reset_comm(struct mmc_card *card);
+#endif /* defined(CUSTOMER_IMX) && defined(NO_SDIO_RESET) */
+
+#define DEFAULT_SDIO_F2_BLKSIZE                512
+#ifndef CUSTOM_SDIO_F2_BLKSIZE
+#define CUSTOM_SDIO_F2_BLKSIZE         DEFAULT_SDIO_F2_BLKSIZE
+#endif
+
+#define MAX_IO_RW_EXTENDED_BLK         511
+
+uint sd_sdmode = SDIOH_MODE_SD4;       /* Use SD4 mode by default */
+uint sd_f2_blocksize = CUSTOM_SDIO_F2_BLKSIZE;
+uint sd_divisor = 2;                   /* Default 48MHz/2 = 24MHz */
+
+uint sd_power = 1;             /* Default to SD Slot powered ON */
+uint sd_clock = 1;             /* Default to SD Clock turned ON */
+uint sd_hiok = FALSE;  /* Don't use hi-speed mode by default */
+uint sd_msglevel = 0x01;
+uint sd_use_dma = TRUE;
+
+#ifndef CUSTOM_RXCHAIN
+#define CUSTOM_RXCHAIN 0
+#endif
+
+DHD_PM_RESUME_WAIT_INIT(sdioh_request_byte_wait);
+DHD_PM_RESUME_WAIT_INIT(sdioh_request_word_wait);
+DHD_PM_RESUME_WAIT_INIT(sdioh_request_packet_wait);
+DHD_PM_RESUME_WAIT_INIT(sdioh_request_buffer_wait);
+
+#define DMA_ALIGN_MASK 0x03
+#define MMC_SDIO_ABORT_RETRY_LIMIT 5
+
+int sdioh_sdmmc_card_regread(sdioh_info_t *sd, int func, uint32 regaddr, int regsize, uint32 *data);
+
+static int
+sdioh_sdmmc_card_enablefuncs(sdioh_info_t *sd)
+{
+       int err_ret;
+       uint32 fbraddr;
+       uint8 func;
+
+       sd_trace(("%s\n", __FUNCTION__));
+
+       /* Get the Card's common CIS address */
+       sd->com_cis_ptr = sdioh_sdmmc_get_cisaddr(sd, SDIOD_CCCR_CISPTR_0);
+       sd->func_cis_ptr[0] = sd->com_cis_ptr;
+       sd_info(("%s: Card's Common CIS Ptr = 0x%x\n", __FUNCTION__, sd->com_cis_ptr));
+
+       /* Get the Card's function CIS (for each function) */
+       for (fbraddr = SDIOD_FBR_STARTADDR, func = 1;
+            func <= sd->num_funcs; func++, fbraddr += SDIOD_FBR_SIZE) {
+               sd->func_cis_ptr[func] = sdioh_sdmmc_get_cisaddr(sd, SDIOD_FBR_CISPTR_0 + fbraddr);
+               sd_info(("%s: Function %d CIS Ptr = 0x%x\n",
+                        __FUNCTION__, func, sd->func_cis_ptr[func]));
+       }
+
+       sd->func_cis_ptr[0] = sd->com_cis_ptr;
+       sd_info(("%s: Card's Common CIS Ptr = 0x%x\n", __FUNCTION__, sd->com_cis_ptr));
+
+       /* Enable Function 1 */
+       sdio_claim_host(sd->func[1]);
+       err_ret = sdio_enable_func(sd->func[1]);
+       sdio_release_host(sd->func[1]);
+       if (err_ret) {
+               sd_err(("bcmsdh_sdmmc: Failed to enable F1 Err: 0x%08x", err_ret));
+       }
+
+       return FALSE;
+}
+
+/*
+ *     Public entry points & extern's
+ */
+extern sdioh_info_t *
+sdioh_attach(osl_t *osh, struct sdio_func *func)
+{
+       sdioh_info_t *sd = NULL;
+       int err_ret;
+
+       sd_trace(("%s\n", __FUNCTION__));
+
+       if (func == NULL) {
+               sd_err(("%s: sdio function device is NULL\n", __FUNCTION__));
+               return NULL;
+       }
+
+       if ((sd = (sdioh_info_t *)MALLOC(osh, sizeof(sdioh_info_t))) == NULL) {
+               sd_err(("sdioh_attach: out of memory, malloced %d bytes\n", MALLOCED(osh)));
+               return NULL;
+       }
+       bzero((char *)sd, sizeof(sdioh_info_t));
+       sd->osh = osh;
+       sd->fake_func0.num = 0;
+       sd->fake_func0.card = func->card;
+       sd->func[0] = &sd->fake_func0;
+       sd->func[1] = func->card->sdio_func[0];
+       sd->func[2] = func->card->sdio_func[1];
+       sd->num_funcs = 2;
+       sd->sd_blockmode = TRUE;
+       sd->use_client_ints = TRUE;
+       sd->client_block_size[0] = 64;
+       sd->use_rxchain = CUSTOM_RXCHAIN;
+       if (sd->func[1] == NULL || sd->func[2] == NULL) {
+               sd_err(("%s: func 1 or 2 is null \n", __FUNCTION__));
+               goto fail;
+       }
+       sdio_set_drvdata(sd->func[1], sd);
+
+       sdio_claim_host(sd->func[1]);
+       sd->client_block_size[1] = 64;
+       err_ret = sdio_set_block_size(sd->func[1], 64);
+       sdio_release_host(sd->func[1]);
+       if (err_ret) {
+               sd_err(("bcmsdh_sdmmc: Failed to set F1 blocksize(%d)\n", err_ret));
+               goto fail;
+       }
+
+       sdio_claim_host(sd->func[2]);
+       sd->client_block_size[2] = sd_f2_blocksize;
+       err_ret = sdio_set_block_size(sd->func[2], sd_f2_blocksize);
+       sdio_release_host(sd->func[2]);
+       if (err_ret) {
+               sd_err(("bcmsdh_sdmmc: Failed to set F2 blocksize to %d(%d)\n",
+                       sd_f2_blocksize, err_ret));
+               goto fail;
+       }
+
+       sdioh_sdmmc_card_enablefuncs(sd);
+
+       sd_trace(("%s: Done\n", __FUNCTION__));
+       return sd;
+
+fail:
+       MFREE(sd->osh, sd, sizeof(sdioh_info_t));
+       return NULL;
+}
+
+
+extern SDIOH_API_RC
+sdioh_detach(osl_t *osh, sdioh_info_t *sd)
+{
+       sd_trace(("%s\n", __FUNCTION__));
+
+       if (sd) {
+
+               /* Disable Function 2 */
+               if (sd->func[2]) {
+                       sdio_claim_host(sd->func[2]);
+                       sdio_disable_func(sd->func[2]);
+                       sdio_release_host(sd->func[2]);
+               }
+
+               /* Disable Function 1 */
+               if (sd->func[1]) {
+                       sdio_claim_host(sd->func[1]);
+                       sdio_disable_func(sd->func[1]);
+                       sdio_release_host(sd->func[1]);
+               }
+
+               sd->func[1] = NULL;
+               sd->func[2] = NULL;
+
+               MFREE(sd->osh, sd, sizeof(sdioh_info_t));
+       }
+       return SDIOH_API_RC_SUCCESS;
+}
+
+#if defined(OOB_INTR_ONLY) && defined(HW_OOB)
+
+extern SDIOH_API_RC
+sdioh_enable_func_intr(sdioh_info_t *sd)
+{
+       uint8 reg;
+       int err;
+
+       if (sd->func[0] == NULL) {
+               sd_err(("%s: function 0 pointer is NULL\n", __FUNCTION__));
+               return SDIOH_API_RC_FAIL;
+       }
+
+       sdio_claim_host(sd->func[0]);
+       reg = sdio_readb(sd->func[0], SDIOD_CCCR_INTEN, &err);
+       if (err) {
+               sd_err(("%s: error for read SDIO_CCCR_IENx : 0x%x\n", __FUNCTION__, err));
+               sdio_release_host(sd->func[0]);
+               return SDIOH_API_RC_FAIL;
+       }
+       /* Enable F1 and F2 interrupts, clear master enable */
+       reg &= ~INTR_CTL_MASTER_EN;
+       reg |= (INTR_CTL_FUNC1_EN | INTR_CTL_FUNC2_EN);
+       sdio_writeb(sd->func[0], reg, SDIOD_CCCR_INTEN, &err);
+       sdio_release_host(sd->func[0]);
+
+       if (err) {
+               sd_err(("%s: error for write SDIO_CCCR_IENx : 0x%x\n", __FUNCTION__, err));
+               return SDIOH_API_RC_FAIL;
+       }
+
+       return SDIOH_API_RC_SUCCESS;
+}
+
+extern SDIOH_API_RC
+sdioh_disable_func_intr(sdioh_info_t *sd)
+{
+       uint8 reg;
+       int err;
+
+       if (sd->func[0] == NULL) {
+               sd_err(("%s: function 0 pointer is NULL\n", __FUNCTION__));
+               return SDIOH_API_RC_FAIL;
+       }
+
+       sdio_claim_host(sd->func[0]);
+       reg = sdio_readb(sd->func[0], SDIOD_CCCR_INTEN, &err);
+       if (err) {
+               sd_err(("%s: error for read SDIO_CCCR_IENx : 0x%x\n", __FUNCTION__, err));
+               sdio_release_host(sd->func[0]);
+               return SDIOH_API_RC_FAIL;
+       }
+       reg &= ~(INTR_CTL_FUNC1_EN | INTR_CTL_FUNC2_EN);
+       /* Disable master interrupt with the last function interrupt */
+       if (!(reg & 0xFE))
+               reg = 0;
+       sdio_writeb(sd->func[0], reg, SDIOD_CCCR_INTEN, &err);
+       sdio_release_host(sd->func[0]);
+
+       if (err) {
+               sd_err(("%s: error for write SDIO_CCCR_IENx : 0x%x\n", __FUNCTION__, err));
+               return SDIOH_API_RC_FAIL;
+       }
+
+       return SDIOH_API_RC_SUCCESS;
+}
+#endif /* defined(OOB_INTR_ONLY) && defined(HW_OOB) */
+
+/* Configure callback to client when we recieve client interrupt */
+extern SDIOH_API_RC
+sdioh_interrupt_register(sdioh_info_t *sd, sdioh_cb_fn_t fn, void *argh)
+{
+       sd_trace(("%s: Entering\n", __FUNCTION__));
+       if (fn == NULL) {
+               sd_err(("%s: interrupt handler is NULL, not registering\n", __FUNCTION__));
+               return SDIOH_API_RC_FAIL;
+       }
+#if !defined(OOB_INTR_ONLY) || defined(OOB_PARAM)
+       OOB_PARAM_IF(dhd_get_oob_disable(argh)) {
+               sd->intr_handler = fn;
+               sd->intr_handler_arg = argh;
+               sd->intr_handler_valid = TRUE;
+
+               /* register and unmask irq */
+               if (sd->func[2]) {
+                       sdio_claim_host(sd->func[2]);
+                       sdio_claim_irq(sd->func[2], IRQHandlerF2);
+                       sdio_release_host(sd->func[2]);
+               }
+
+               if (sd->func[1]) {
+                       sdio_claim_host(sd->func[1]);
+                       sdio_claim_irq(sd->func[1], IRQHandler);
+                       sdio_release_host(sd->func[1]);
+               }
+       } OOB_PARAM_ELSE()
+#endif /* !defined(OOB_INTR_ONLY) || defined(OOB_PARAM) */
+#if defined(OOB_INTR_ONLY)
+       {
+#if defined(HW_OOB)
+               sdioh_enable_func_intr(sd);
+#endif /* defined(HW_OOB) */
+       }
+#endif /* defined(OOB_INTR_ONLY) */
+
+       return SDIOH_API_RC_SUCCESS;
+}
+
+extern SDIOH_API_RC
+sdioh_interrupt_deregister(sdioh_info_t *sd)
+{
+       sd_trace(("%s: Entering\n", __FUNCTION__));
+
+#if !defined(OOB_INTR_ONLY) || defined(OOB_PARAM)
+       OOB_PARAM_IF(sd->intr_handler_valid) {
+               if (sd->func[1]) {
+                       /* register and unmask irq */
+                       sdio_claim_host(sd->func[1]);
+                       sdio_release_irq(sd->func[1]);
+                       sdio_release_host(sd->func[1]);
+               }
+
+               if (sd->func[2]) {
+                       /* Claim host controller F2 */
+                       sdio_claim_host(sd->func[2]);
+                       sdio_release_irq(sd->func[2]);
+                       /* Release host controller F2 */
+                       sdio_release_host(sd->func[2]);
+               }
+
+               sd->intr_handler_valid = FALSE;
+               sd->intr_handler = NULL;
+               sd->intr_handler_arg = NULL;
+       } OOB_PARAM_ELSE()
+#endif /* !defined(OOB_INTR_ONLY) || defined(OOB_PARAM) */
+#if defined(OOB_INTR_ONLY)
+       {
+#if defined(HW_OOB)
+               sdioh_disable_func_intr(sd);
+#endif /* defined(HW_OOB) */
+       }
+#endif /* defined(OOB_INTR_ONLY) */
+
+       return SDIOH_API_RC_SUCCESS;
+}
+
+extern SDIOH_API_RC
+sdioh_interrupt_query(sdioh_info_t *sd, bool *onoff)
+{
+       sd_trace(("%s: Entering\n", __FUNCTION__));
+       *onoff = sd->client_intr_enabled;
+       return SDIOH_API_RC_SUCCESS;
+}
+
+#if defined(DHD_DEBUG)
+extern bool
+sdioh_interrupt_pending(sdioh_info_t *sd)
+{
+       return (0);
+}
+#endif
+
+uint
+sdioh_query_iofnum(sdioh_info_t *sd)
+{
+       return sd->num_funcs;
+}
+
+/* IOVar table */
+enum {
+       IOV_MSGLEVEL = 1,
+       IOV_BLOCKMODE,
+       IOV_BLOCKSIZE,
+       IOV_DMA,
+       IOV_USEINTS,
+       IOV_NUMINTS,
+       IOV_NUMLOCALINTS,
+       IOV_HOSTREG,
+       IOV_DEVREG,
+       IOV_DIVISOR,
+       IOV_SDMODE,
+       IOV_HISPEED,
+       IOV_HCIREGS,
+       IOV_POWER,
+       IOV_CLOCK,
+       IOV_RXCHAIN
+};
+
+const bcm_iovar_t sdioh_iovars[] = {
+       {"sd_msglevel", IOV_MSGLEVEL,   0,      IOVT_UINT32,    0 },
+       {"sd_blockmode", IOV_BLOCKMODE, 0,      IOVT_BOOL,      0 },
+       {"sd_blocksize", IOV_BLOCKSIZE, 0,      IOVT_UINT32,    0 }, /* ((fn << 16) | size) */
+       {"sd_dma",      IOV_DMA,        0,      IOVT_BOOL,      0 },
+       {"sd_ints",     IOV_USEINTS,    0,      IOVT_BOOL,      0 },
+       {"sd_numints",  IOV_NUMINTS,    0,      IOVT_UINT32,    0 },
+       {"sd_numlocalints", IOV_NUMLOCALINTS, 0, IOVT_UINT32,   0 },
+       {"sd_hostreg",  IOV_HOSTREG,    0,      IOVT_BUFFER,    sizeof(sdreg_t) },
+       {"sd_devreg",   IOV_DEVREG,     0,      IOVT_BUFFER,    sizeof(sdreg_t) },
+       {"sd_divisor",  IOV_DIVISOR,    0,      IOVT_UINT32,    0 },
+       {"sd_power",    IOV_POWER,      0,      IOVT_UINT32,    0 },
+       {"sd_clock",    IOV_CLOCK,      0,      IOVT_UINT32,    0 },
+       {"sd_mode",     IOV_SDMODE,     0,      IOVT_UINT32,    100},
+       {"sd_highspeed", IOV_HISPEED,   0,      IOVT_UINT32,    0 },
+       {"sd_rxchain",  IOV_RXCHAIN,    0,      IOVT_BOOL,      0 },
+       {NULL, 0, 0, 0, 0 }
+};
+
+int
+sdioh_iovar_op(sdioh_info_t *si, const char *name,
+                           void *params, int plen, void *arg, int len, bool set)
+{
+       const bcm_iovar_t *vi = NULL;
+       int bcmerror = 0;
+       int val_size;
+       int32 int_val = 0;
+       bool bool_val;
+       uint32 actionid;
+
+       ASSERT(name);
+       ASSERT(len >= 0);
+
+       /* Get must have return space; Set does not take qualifiers */
+       ASSERT(set || (arg && len));
+       ASSERT(!set || (!params && !plen));
+
+       sd_trace(("%s: Enter (%s %s)\n", __FUNCTION__, (set ? "set" : "get"), name));
+
+       if ((vi = bcm_iovar_lookup(sdioh_iovars, name)) == NULL) {
+               bcmerror = BCME_UNSUPPORTED;
+               goto exit;
+       }
+
+       if ((bcmerror = bcm_iovar_lencheck(vi, arg, len, set)) != 0)
+               goto exit;
+
+       /* Set up params so get and set can share the convenience variables */
+       if (params == NULL) {
+               params = arg;
+               plen = len;
+       }
+
+       if (vi->type == IOVT_VOID)
+               val_size = 0;
+       else if (vi->type == IOVT_BUFFER)
+               val_size = len;
+       else
+               val_size = sizeof(int);
+
+       if (plen >= (int)sizeof(int_val))
+               bcopy(params, &int_val, sizeof(int_val));
+
+       bool_val = (int_val != 0) ? TRUE : FALSE;
+       BCM_REFERENCE(bool_val);
+
+       actionid = set ? IOV_SVAL(vi->varid) : IOV_GVAL(vi->varid);
+       switch (actionid) {
+       case IOV_GVAL(IOV_MSGLEVEL):
+               int_val = (int32)sd_msglevel;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_MSGLEVEL):
+               sd_msglevel = int_val;
+               break;
+
+       case IOV_GVAL(IOV_BLOCKMODE):
+               int_val = (int32)si->sd_blockmode;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_BLOCKMODE):
+               si->sd_blockmode = (bool)int_val;
+               /* Haven't figured out how to make non-block mode with DMA */
+               break;
+
+       case IOV_GVAL(IOV_BLOCKSIZE):
+               if ((uint32)int_val > si->num_funcs) {
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+               int_val = (int32)si->client_block_size[int_val];
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_BLOCKSIZE):
+       {
+               uint func = ((uint32)int_val >> 16);
+               uint blksize = (uint16)int_val;
+               uint maxsize;
+
+               if (func > si->num_funcs) {
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+
+               switch (func) {
+               case 0: maxsize = 32; break;
+               case 1: maxsize = BLOCK_SIZE_4318; break;
+               case 2: maxsize = BLOCK_SIZE_4328; break;
+               default: maxsize = 0;
+               }
+               if (blksize > maxsize) {
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+               if (!blksize) {
+                       blksize = maxsize;
+               }
+
+               /* Now set it */
+               si->client_block_size[func] = blksize;
+
+#ifdef USE_DYNAMIC_F2_BLKSIZE
+               if (si->func[func] == NULL) {
+                       sd_err(("%s: SDIO Device not present\n", __FUNCTION__));
+                       bcmerror = BCME_NORESOURCE;
+                       break;
+               }
+               sdio_claim_host(si->func[func]);
+               bcmerror = sdio_set_block_size(si->func[func], blksize);
+               if (bcmerror)
+                       sd_err(("%s: Failed to set F%d blocksize to %d(%d)\n",
+                               __FUNCTION__, func, blksize, bcmerror));
+               sdio_release_host(si->func[func]);
+#endif /* USE_DYNAMIC_F2_BLKSIZE */
+               break;
+       }
+
+       case IOV_GVAL(IOV_RXCHAIN):
+               int_val = (int32)si->use_rxchain;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_GVAL(IOV_DMA):
+               int_val = (int32)si->sd_use_dma;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_DMA):
+               si->sd_use_dma = (bool)int_val;
+               break;
+
+       case IOV_GVAL(IOV_USEINTS):
+               int_val = (int32)si->use_client_ints;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_USEINTS):
+               si->use_client_ints = (bool)int_val;
+               if (si->use_client_ints)
+                       si->intmask |= CLIENT_INTR;
+               else
+                       si->intmask &= ~CLIENT_INTR;
+
+               break;
+
+       case IOV_GVAL(IOV_DIVISOR):
+               int_val = (uint32)sd_divisor;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_DIVISOR):
+               sd_divisor = int_val;
+               break;
+
+       case IOV_GVAL(IOV_POWER):
+               int_val = (uint32)sd_power;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_POWER):
+               sd_power = int_val;
+               break;
+
+       case IOV_GVAL(IOV_CLOCK):
+               int_val = (uint32)sd_clock;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_CLOCK):
+               sd_clock = int_val;
+               break;
+
+       case IOV_GVAL(IOV_SDMODE):
+               int_val = (uint32)sd_sdmode;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_SDMODE):
+               sd_sdmode = int_val;
+               break;
+
+       case IOV_GVAL(IOV_HISPEED):
+               int_val = (uint32)sd_hiok;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_HISPEED):
+               sd_hiok = int_val;
+               break;
+
+       case IOV_GVAL(IOV_NUMINTS):
+               int_val = (int32)si->intrcount;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_GVAL(IOV_NUMLOCALINTS):
+               int_val = (int32)0;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_GVAL(IOV_HOSTREG):
+       {
+               sdreg_t *sd_ptr = (sdreg_t *)params;
+
+               if (sd_ptr->offset < SD_SysAddr || sd_ptr->offset > SD_MaxCurCap) {
+                       sd_err(("%s: bad offset 0x%x\n", __FUNCTION__, sd_ptr->offset));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+
+               sd_trace(("%s: rreg%d at offset %d\n", __FUNCTION__,
+                                 (sd_ptr->offset & 1) ? 8 : ((sd_ptr->offset & 2) ? 16 : 32),
+                                 sd_ptr->offset));
+               if (sd_ptr->offset & 1)
+                       int_val = 8; /* sdioh_sdmmc_rreg8(si, sd_ptr->offset); */
+               else if (sd_ptr->offset & 2)
+                       int_val = 16; /* sdioh_sdmmc_rreg16(si, sd_ptr->offset); */
+               else
+                       int_val = 32; /* sdioh_sdmmc_rreg(si, sd_ptr->offset); */
+
+               bcopy(&int_val, arg, sizeof(int_val));
+               break;
+       }
+
+       case IOV_SVAL(IOV_HOSTREG):
+       {
+               sdreg_t *sd_ptr = (sdreg_t *)params;
+
+               if (sd_ptr->offset < SD_SysAddr || sd_ptr->offset > SD_MaxCurCap) {
+                       sd_err(("%s: bad offset 0x%x\n", __FUNCTION__, sd_ptr->offset));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+
+               sd_trace(("%s: wreg%d value 0x%08x at offset %d\n", __FUNCTION__, sd_ptr->value,
+                                 (sd_ptr->offset & 1) ? 8 : ((sd_ptr->offset & 2) ? 16 : 32),
+                                 sd_ptr->offset));
+               break;
+       }
+
+       case IOV_GVAL(IOV_DEVREG):
+       {
+               sdreg_t *sd_ptr = (sdreg_t *)params;
+               uint8 data = 0;
+
+               if (sdioh_cfg_read(si, sd_ptr->func, sd_ptr->offset, &data)) {
+                       bcmerror = BCME_SDIO_ERROR;
+                       break;
+               }
+
+               int_val = (int)data;
+               bcopy(&int_val, arg, sizeof(int_val));
+               break;
+       }
+
+       case IOV_SVAL(IOV_DEVREG):
+       {
+               sdreg_t *sd_ptr = (sdreg_t *)params;
+               uint8 data = (uint8)sd_ptr->value;
+
+               if (sdioh_cfg_write(si, sd_ptr->func, sd_ptr->offset, &data)) {
+                       bcmerror = BCME_SDIO_ERROR;
+                       break;
+               }
+               break;
+       }
+
+       default:
+               bcmerror = BCME_UNSUPPORTED;
+               break;
+       }
+exit:
+
+       return bcmerror;
+}
+
+#if defined(OOB_INTR_ONLY) && defined(HW_OOB)
+
+SDIOH_API_RC
+sdioh_enable_hw_oob_intr(sdioh_info_t *sd, bool enable)
+{
+       SDIOH_API_RC status;
+       uint8 data;
+
+       if (enable)
+               data = SDIO_SEPINT_MASK | SDIO_SEPINT_OE | SDIO_SEPINT_ACT_HI;
+       else
+               data = SDIO_SEPINT_ACT_HI;      /* disable hw oob interrupt */
+
+       status = sdioh_request_byte(sd, SDIOH_WRITE, 0, SDIOD_CCCR_BRCM_SEPINT, &data);
+       return status;
+}
+#endif /* defined(OOB_INTR_ONLY) && defined(HW_OOB) */
+
+extern SDIOH_API_RC
+sdioh_cfg_read(sdioh_info_t *sd, uint fnc_num, uint32 addr, uint8 *data)
+{
+       SDIOH_API_RC status;
+       /* No lock needed since sdioh_request_byte does locking */
+       status = sdioh_request_byte(sd, SDIOH_READ, fnc_num, addr, data);
+       return status;
+}
+
+extern SDIOH_API_RC
+sdioh_cfg_write(sdioh_info_t *sd, uint fnc_num, uint32 addr, uint8 *data)
+{
+       /* No lock needed since sdioh_request_byte does locking */
+       SDIOH_API_RC status;
+       status = sdioh_request_byte(sd, SDIOH_WRITE, fnc_num, addr, data);
+       return status;
+}
+
+static int
+sdioh_sdmmc_get_cisaddr(sdioh_info_t *sd, uint32 regaddr)
+{
+       /* read 24 bits and return valid 17 bit addr */
+       int i;
+       uint32 scratch, regdata;
+       uint8 *ptr = (uint8 *)&scratch;
+       for (i = 0; i < 3; i++) {
+               if ((sdioh_sdmmc_card_regread (sd, 0, regaddr, 1, &regdata)) != SUCCESS)
+                       sd_err(("%s: Can't read!\n", __FUNCTION__));
+
+               *ptr++ = (uint8) regdata;
+               regaddr++;
+       }
+
+       /* Only the lower 17-bits are valid */
+       scratch = ltoh32(scratch);
+       scratch &= 0x0001FFFF;
+       return (scratch);
+}
+
+extern SDIOH_API_RC
+sdioh_cis_read(sdioh_info_t *sd, uint func, uint8 *cisd, uint32 length)
+{
+       uint32 count;
+       int offset;
+       uint32 foo;
+       uint8 *cis = cisd;
+
+       sd_trace(("%s: Func = %d\n", __FUNCTION__, func));
+
+       if (!sd->func_cis_ptr[func]) {
+               bzero(cis, length);
+               sd_err(("%s: no func_cis_ptr[%d]\n", __FUNCTION__, func));
+               return SDIOH_API_RC_FAIL;
+       }
+
+       sd_err(("%s: func_cis_ptr[%d]=0x%04x\n", __FUNCTION__, func, sd->func_cis_ptr[func]));
+
+       for (count = 0; count < length; count++) {
+               offset =  sd->func_cis_ptr[func] + count;
+               if (sdioh_sdmmc_card_regread (sd, 0, offset, 1, &foo) < 0) {
+                       sd_err(("%s: regread failed: Can't read CIS\n", __FUNCTION__));
+                       return SDIOH_API_RC_FAIL;
+               }
+
+               *cis = (uint8)(foo & 0xff);
+               cis++;
+       }
+
+       return SDIOH_API_RC_SUCCESS;
+}
+
+extern SDIOH_API_RC
+sdioh_request_byte(sdioh_info_t *sd, uint rw, uint func, uint regaddr, uint8 *byte)
+{
+       int err_ret = 0;
+#if defined(MMC_SDIO_ABORT)
+       int sdio_abort_retry = MMC_SDIO_ABORT_RETRY_LIMIT;
+#endif
+
+       sd_info(("%s: rw=%d, func=%d, addr=0x%05x\n", __FUNCTION__, rw, func, regaddr));
+
+       DHD_PM_RESUME_WAIT(sdioh_request_byte_wait);
+       DHD_PM_RESUME_RETURN_ERROR(SDIOH_API_RC_FAIL);
+       if(rw) { /* CMD52 Write */
+               if (func == 0) {
+                       /* Can only directly write to some F0 registers.  Handle F2 enable
+                        * as a special case.
+                        */
+                       if (regaddr == SDIOD_CCCR_IOEN) {
+                               if (sd->func[2]) {
+                                       sdio_claim_host(sd->func[2]);
+                                       if (*byte & SDIO_FUNC_ENABLE_2) {
+                                               /* Enable Function 2 */
+                                               err_ret = sdio_enable_func(sd->func[2]);
+                                               if (err_ret) {
+                                                       sd_err(("bcmsdh_sdmmc: enable F2 failed:%d",
+                                                               err_ret));
+                                               }
+                                       } else {
+                                               /* Disable Function 2 */
+                                               err_ret = sdio_disable_func(sd->func[2]);
+                                               if (err_ret) {
+                                                       sd_err(("bcmsdh_sdmmc: Disab F2 failed:%d",
+                                                               err_ret));
+                                               }
+                                       }
+                                       sdio_release_host(sd->func[2]);
+                               }
+                       }
+#if defined(MMC_SDIO_ABORT)
+                       /* to allow abort command through F1 */
+                       else if (regaddr == SDIOD_CCCR_IOABORT) {
+                               while (sdio_abort_retry--) {
+                                       if (sd->func[func]) {
+                                               sdio_claim_host(sd->func[func]);
+                                               /*
+                                                * this sdio_f0_writeb() can be replaced with
+                                                * another api depending upon MMC driver change.
+                                                * As of this time, this is temporaray one
+                                                */
+                                               sdio_writeb(sd->func[func],
+                                                       *byte, regaddr, &err_ret);
+                                               sdio_release_host(sd->func[func]);
+                                       }
+                                       if (!err_ret)
+                                               break;
+                               }
+                       }
+#endif /* MMC_SDIO_ABORT */
+                       else if (regaddr < 0xF0) {
+                               sd_err(("bcmsdh_sdmmc: F0 Wr:0x%02x: write disallowed\n", regaddr));
+                       } else {
+                               /* Claim host controller, perform F0 write, and release */
+                               if (sd->func[func]) {
+                                       sdio_claim_host(sd->func[func]);
+                                       sdio_f0_writeb(sd->func[func],
+                                               *byte, regaddr, &err_ret);
+                                       sdio_release_host(sd->func[func]);
+                               }
+                       }
+               } else {
+                       /* Claim host controller, perform Fn write, and release */
+                       if (sd->func[func]) {
+                               sdio_claim_host(sd->func[func]);
+                               sdio_writeb(sd->func[func], *byte, regaddr, &err_ret);
+                               sdio_release_host(sd->func[func]);
+                       }
+               }
+       } else { /* CMD52 Read */
+               /* Claim host controller, perform Fn read, and release */
+               if (sd->func[func]) {
+                       sdio_claim_host(sd->func[func]);
+                       if (func == 0) {
+                               *byte = sdio_f0_readb(sd->func[func], regaddr, &err_ret);
+                       } else {
+                               *byte = sdio_readb(sd->func[func], regaddr, &err_ret);
+                       }
+                       sdio_release_host(sd->func[func]);
+               }
+       }
+
+       if (err_ret) {
+               if ((regaddr == 0x1001F) && ((err_ret == -ETIMEDOUT) || (err_ret == -EILSEQ))) {
+               } else {
+                       sd_err(("bcmsdh_sdmmc: Failed to %s byte F%d:@0x%05x=%02x, Err: %d\n",
+                               rw ? "Write" : "Read", func, regaddr, *byte, err_ret));
+               }
+       }
+
+       return ((err_ret == 0) ? SDIOH_API_RC_SUCCESS : SDIOH_API_RC_FAIL);
+}
+
+extern SDIOH_API_RC
+sdioh_request_word(sdioh_info_t *sd, uint cmd_type, uint rw, uint func, uint addr,
+                                   uint32 *word, uint nbytes)
+{
+       int err_ret = SDIOH_API_RC_FAIL;
+#if defined(MMC_SDIO_ABORT)
+       int sdio_abort_retry = MMC_SDIO_ABORT_RETRY_LIMIT;
+#endif
+
+       if (func == 0) {
+               sd_err(("%s: Only CMD52 allowed to F0.\n", __FUNCTION__));
+               return SDIOH_API_RC_FAIL;
+       }
+
+       sd_info(("%s: cmd_type=%d, rw=%d, func=%d, addr=0x%05x, nbytes=%d\n",
+                __FUNCTION__, cmd_type, rw, func, addr, nbytes));
+
+       DHD_PM_RESUME_WAIT(sdioh_request_word_wait);
+       DHD_PM_RESUME_RETURN_ERROR(SDIOH_API_RC_FAIL);
+       /* Claim host controller */
+       sdio_claim_host(sd->func[func]);
+
+       if(rw) { /* CMD52 Write */
+               if (nbytes == 4) {
+                       sdio_writel(sd->func[func], *word, addr, &err_ret);
+               } else if (nbytes == 2) {
+                       sdio_writew(sd->func[func], (*word & 0xFFFF), addr, &err_ret);
+               } else {
+                       sd_err(("%s: Invalid nbytes: %d\n", __FUNCTION__, nbytes));
+               }
+       } else { /* CMD52 Read */
+               if (nbytes == 4) {
+                       *word = sdio_readl(sd->func[func], addr, &err_ret);
+               } else if (nbytes == 2) {
+                       *word = sdio_readw(sd->func[func], addr, &err_ret) & 0xFFFF;
+               } else {
+                       sd_err(("%s: Invalid nbytes: %d\n", __FUNCTION__, nbytes));
+               }
+       }
+
+       /* Release host controller */
+       sdio_release_host(sd->func[func]);
+
+       if (err_ret) {
+#if defined(MMC_SDIO_ABORT)
+               /* Any error on CMD53 transaction should abort that function using function 0. */
+               while (sdio_abort_retry--) {
+                       if (sd->func[0]) {
+                               sdio_claim_host(sd->func[0]);
+                               /*
+                                * this sdio_f0_writeb() can be replaced with another api
+                                * depending upon MMC driver change.
+                                * As of this time, this is temporaray one
+                                */
+                               sdio_writeb(sd->func[0],
+                                       func, SDIOD_CCCR_IOABORT, &err_ret);
+                               sdio_release_host(sd->func[0]);
+                       }
+                       if (!err_ret)
+                               break;
+               }
+               if (err_ret)
+#endif /* MMC_SDIO_ABORT */
+               {
+                       sd_err(("bcmsdh_sdmmc: Failed to %s word, Err: 0x%08x",
+                               rw ? "Write" : "Read", err_ret));
+               }
+       }
+
+       return ((err_ret == 0) ? SDIOH_API_RC_SUCCESS : SDIOH_API_RC_FAIL);
+}
+
+static SDIOH_API_RC
+sdioh_request_packet_chain(sdioh_info_t *sd, uint fix_inc, uint write, uint func,
+                     uint addr, void *pkt)
+{
+       bool fifo = (fix_inc == SDIOH_DATA_FIX);
+       int err_ret = 0;
+       void *pnext;
+       uint ttl_len, pkt_offset;
+       uint blk_num;
+       uint blk_size;
+       uint max_blk_count;
+       uint max_req_size;
+       struct mmc_request mmc_req;
+       struct mmc_command mmc_cmd;
+       struct mmc_data mmc_dat;
+       uint32 sg_count;
+       struct sdio_func *sdio_func = sd->func[func];
+       struct mmc_host *host = sdio_func->card->host;
+
+       sd_trace(("%s: Enter\n", __FUNCTION__));
+       ASSERT(pkt);
+       DHD_PM_RESUME_WAIT(sdioh_request_packet_wait);
+       DHD_PM_RESUME_RETURN_ERROR(SDIOH_API_RC_FAIL);
+
+       blk_size = sd->client_block_size[func];
+       max_blk_count = min(host->max_blk_count, (uint)MAX_IO_RW_EXTENDED_BLK);
+       max_req_size = min(max_blk_count * blk_size, host->max_req_size);
+
+       pkt_offset = 0;
+       pnext = pkt;
+
+       while (pnext != NULL) {
+               ttl_len = 0;
+               sg_count = 0;
+               memset(&mmc_req, 0, sizeof(struct mmc_request));
+               memset(&mmc_cmd, 0, sizeof(struct mmc_command));
+               memset(&mmc_dat, 0, sizeof(struct mmc_data));
+               sg_init_table(sd->sg_list, ARRAYSIZE(sd->sg_list));
+
+               /* Set up scatter-gather DMA descriptors. this loop is to find out the max
+                * data we can transfer with one command 53. blocks per command is limited by
+                * host max_req_size and 9-bit max block number. when the total length of this
+                * packet chain is bigger than max_req_size, use multiple SD_IO_RW_EXTENDED
+                * commands (each transfer is still block aligned)
+                */
+               while (pnext != NULL && ttl_len < max_req_size) {
+                       int pkt_len;
+                       int sg_data_size;
+                       uint8 *pdata = (uint8*)PKTDATA(sd->osh, pnext);
+
+                       ASSERT(pdata != NULL);
+                       pkt_len = PKTLEN(sd->osh, pnext);
+                       sd_trace(("%s[%d] data=%p, len=%d\n", __FUNCTION__, write, pdata, pkt_len));
+                       /* sg_count is unlikely larger than the array size, and this is
+                        * NOT something we can handle here, but in case it happens, PLEASE put
+                        * a restriction on max tx/glom count (based on host->max_segs).
+                        */
+                       if (sg_count >= ARRAYSIZE(sd->sg_list)) {
+                               sd_err(("%s: sg list entries exceed limit\n", __FUNCTION__));
+                               return (SDIOH_API_RC_FAIL);
+                       }
+                       pdata += pkt_offset;
+
+                       sg_data_size = pkt_len - pkt_offset;
+                       if (sg_data_size > max_req_size - ttl_len)
+                               sg_data_size = max_req_size - ttl_len;
+                       /* some platforms put a restriction on the data size of each scatter-gather
+                        * DMA descriptor, use multiple sg buffers when xfer_size is bigger than
+                        * max_seg_size
+                        */
+                       if (sg_data_size > host->max_seg_size)
+                               sg_data_size = host->max_seg_size;
+                       sg_set_buf(&sd->sg_list[sg_count++], pdata, sg_data_size);
+
+                       ttl_len += sg_data_size;
+                       pkt_offset += sg_data_size;
+                       if (pkt_offset == pkt_len) {
+                               pnext = PKTNEXT(sd->osh, pnext);
+                               pkt_offset = 0;
+                       }
+               }
+
+               if (ttl_len % blk_size != 0) {
+                       sd_err(("%s, data length %d not aligned to block size %d\n",
+                               __FUNCTION__,  ttl_len, blk_size));
+                       return SDIOH_API_RC_FAIL;
+               }
+               blk_num = ttl_len / blk_size;
+               mmc_dat.sg = sd->sg_list;
+               mmc_dat.sg_len = sg_count;
+               mmc_dat.blksz = blk_size;
+               mmc_dat.blocks = blk_num;
+               mmc_dat.flags = write ? MMC_DATA_WRITE : MMC_DATA_READ;
+               mmc_cmd.opcode = 53; /* SD_IO_RW_EXTENDED */
+               mmc_cmd.arg = write ? 1<<31 : 0;
+               mmc_cmd.arg |= (func & 0x7) << 28;
+               mmc_cmd.arg |= 1<<27;
+               mmc_cmd.arg |= fifo ? 0 : 1<<26;
+               mmc_cmd.arg |= (addr & 0x1FFFF) << 9;
+               mmc_cmd.arg |= blk_num & 0x1FF;
+               mmc_cmd.flags = MMC_RSP_SPI_R5 | MMC_RSP_R5 | MMC_CMD_ADTC;
+               mmc_req.cmd = &mmc_cmd;
+               mmc_req.data = &mmc_dat;
+               if (!fifo)
+                       addr += ttl_len;
+
+               sdio_claim_host(sdio_func);
+               mmc_set_data_timeout(&mmc_dat, sdio_func->card);
+               mmc_wait_for_req(host, &mmc_req);
+               sdio_release_host(sdio_func);
+
+               err_ret = mmc_cmd.error? mmc_cmd.error : mmc_dat.error;
+               if (0 != err_ret) {
+                       sd_err(("%s:CMD53 %s failed with code %d\n",
+                               __FUNCTION__, write ? "write" : "read", err_ret));
+                       return SDIOH_API_RC_FAIL;
+               }
+       }
+
+       sd_trace(("%s: Exit\n", __FUNCTION__));
+       return SDIOH_API_RC_SUCCESS;
+}
+
+static SDIOH_API_RC
+sdioh_buffer_tofrom_bus(sdioh_info_t *sd, uint fix_inc, uint write, uint func,
+                     uint addr, uint8 *buf, uint len)
+{
+       bool fifo = (fix_inc == SDIOH_DATA_FIX);
+       int err_ret = 0;
+
+       sd_trace(("%s: Enter\n", __FUNCTION__));
+       ASSERT(buf);
+
+       /* NOTE:
+        * For all writes, each packet length is aligned to 32 (or 4)
+        * bytes in dhdsdio_txpkt_preprocess, and for glom the last packet length
+        * is aligned to block boundary. If you want to align each packet to
+        * a custom size, please do it in dhdsdio_txpkt_preprocess, NOT here
+        *
+        * For reads, the alignment is doen in sdioh_request_buffer.
+        *
+        */
+       sdio_claim_host(sd->func[func]);
+
+       if ((write) && (!fifo))
+               err_ret = sdio_memcpy_toio(sd->func[func], addr, buf, len);
+       else if (write)
+               err_ret = sdio_memcpy_toio(sd->func[func], addr, buf, len);
+       else if (fifo)
+               err_ret = sdio_readsb(sd->func[func], buf, addr, len);
+       else
+               err_ret = sdio_memcpy_fromio(sd->func[func], buf, addr, len);
+
+       sdio_release_host(sd->func[func]);
+
+       if (err_ret)
+               sd_err(("%s: %s FAILED %p, addr=0x%05x, pkt_len=%d, ERR=%d\n", __FUNCTION__,
+                      (write) ? "TX" : "RX", buf, addr, len, err_ret));
+       else
+               sd_trace(("%s: %s xfr'd %p, addr=0x%05x, len=%d\n", __FUNCTION__,
+                       (write) ? "TX" : "RX", buf, addr, len));
+
+       sd_trace(("%s: Exit\n", __FUNCTION__));
+       return ((err_ret == 0) ? SDIOH_API_RC_SUCCESS : SDIOH_API_RC_FAIL);
+}
+
+
+/*
+ * This function takes a buffer or packet, and fixes everything up so that in the
+ * end, a DMA-able packet is created.
+ *
+ * A buffer does not have an associated packet pointer, and may or may not be aligned.
+ * A packet may consist of a single packet, or a packet chain.  If it is a packet chain,
+ * then all the packets in the chain must be properly aligned.  If the packet data is not
+ * aligned, then there may only be one packet, and in this case, it is copied to a new
+ * aligned packet.
+ *
+ */
+extern SDIOH_API_RC
+sdioh_request_buffer(sdioh_info_t *sd, uint pio_dma, uint fix_inc, uint write, uint func,
+       uint addr, uint reg_width, uint buf_len, uint8 *buffer, void *pkt)
+{
+       SDIOH_API_RC status;
+       void *tmppkt;
+
+       sd_trace(("%s: Enter\n", __FUNCTION__));
+       DHD_PM_RESUME_WAIT(sdioh_request_buffer_wait);
+       DHD_PM_RESUME_RETURN_ERROR(SDIOH_API_RC_FAIL);
+
+       if (pkt) {
+               /* packet chain, only used for tx/rx glom, all packets length
+                * are aligned, total length is a block multiple
+                */
+               if (PKTNEXT(sd->osh, pkt))
+                       return sdioh_request_packet_chain(sd, fix_inc, write, func, addr, pkt);
+
+               /* non-glom mode, ignore the buffer parameter and use the packet pointer
+                * (this shouldn't happen)
+                */
+               buffer = PKTDATA(sd->osh, pkt);
+               buf_len = PKTLEN(sd->osh, pkt);
+       }
+
+       ASSERT(buffer);
+
+       /* buffer and length are aligned, use it directly so we can avoid memory copy */
+       if (((ulong)buffer & DMA_ALIGN_MASK) == 0 && (buf_len & DMA_ALIGN_MASK) == 0)
+               return sdioh_buffer_tofrom_bus(sd, fix_inc, write, func, addr, buffer, buf_len);
+
+       sd_err(("%s: [%d] doing memory copy buf=%p, len=%d\n",
+               __FUNCTION__, write, buffer, buf_len));
+
+       /* otherwise, a memory copy is needed as the input buffer is not aligned */
+       tmppkt = PKTGET_STATIC(sd->osh, buf_len + DEFAULT_SDIO_F2_BLKSIZE, write ? TRUE : FALSE);
+       if (tmppkt == NULL) {
+               sd_err(("%s: PKTGET failed: len %d\n", __FUNCTION__, buf_len));
+               return SDIOH_API_RC_FAIL;
+       }
+
+       if (write)
+               bcopy(buffer, PKTDATA(sd->osh, tmppkt), buf_len);
+
+       status = sdioh_buffer_tofrom_bus(sd, fix_inc, write, func, addr,
+               PKTDATA(sd->osh, tmppkt), ROUNDUP(buf_len, (DMA_ALIGN_MASK+1)));
+
+       if (!write)
+               bcopy(PKTDATA(sd->osh, tmppkt), buffer, buf_len);
+
+       PKTFREE_STATIC(sd->osh, tmppkt, write ? TRUE : FALSE);
+
+       return status;
+}
+
+/* this function performs "abort" for both of host & device */
+extern int
+sdioh_abort(sdioh_info_t *sd, uint func)
+{
+#if defined(MMC_SDIO_ABORT)
+       char t_func = (char) func;
+#endif /* defined(MMC_SDIO_ABORT) */
+       sd_trace(("%s: Enter\n", __FUNCTION__));
+
+#if defined(MMC_SDIO_ABORT)
+       /* issue abort cmd52 command through F1 */
+       sdioh_request_byte(sd, SD_IO_OP_WRITE, SDIO_FUNC_0, SDIOD_CCCR_IOABORT, &t_func);
+#endif /* defined(MMC_SDIO_ABORT) */
+
+       sd_trace(("%s: Exit\n", __FUNCTION__));
+       return SDIOH_API_RC_SUCCESS;
+}
+
+/* Reset and re-initialize the device */
+int sdioh_sdio_reset(sdioh_info_t *si)
+{
+       sd_trace(("%s: Enter\n", __FUNCTION__));
+       sd_trace(("%s: Exit\n", __FUNCTION__));
+       return SDIOH_API_RC_SUCCESS;
+}
+
+/* Disable device interrupt */
+void
+sdioh_sdmmc_devintr_off(sdioh_info_t *sd)
+{
+       sd_trace(("%s: %d\n", __FUNCTION__, sd->use_client_ints));
+       sd->intmask &= ~CLIENT_INTR;
+}
+
+/* Enable device interrupt */
+void
+sdioh_sdmmc_devintr_on(sdioh_info_t *sd)
+{
+       sd_trace(("%s: %d\n", __FUNCTION__, sd->use_client_ints));
+       sd->intmask |= CLIENT_INTR;
+}
+
+/* Read client card reg */
+int
+sdioh_sdmmc_card_regread(sdioh_info_t *sd, int func, uint32 regaddr, int regsize, uint32 *data)
+{
+
+       if ((func == 0) || (regsize == 1)) {
+               uint8 temp = 0;
+
+               sdioh_request_byte(sd, SDIOH_READ, func, regaddr, &temp);
+               *data = temp;
+               *data &= 0xff;
+               sd_data(("%s: byte read data=0x%02x\n",
+                        __FUNCTION__, *data));
+       } else {
+               sdioh_request_word(sd, 0, SDIOH_READ, func, regaddr, data, regsize);
+               if (regsize == 2)
+                       *data &= 0xffff;
+
+               sd_data(("%s: word read data=0x%08x\n",
+                        __FUNCTION__, *data));
+       }
+
+       return SUCCESS;
+}
+
+#if !defined(OOB_INTR_ONLY) || defined(OOB_PARAM)
+/* bcmsdh_sdmmc interrupt handler */
+static void IRQHandler(struct sdio_func *func)
+{
+       sdioh_info_t *sd;
+
+       sd = sdio_get_drvdata(func);
+
+       ASSERT(sd != NULL);
+       sdio_release_host(sd->func[0]);
+
+       if (sd->use_client_ints) {
+               sd->intrcount++;
+               ASSERT(sd->intr_handler);
+               ASSERT(sd->intr_handler_arg);
+               (sd->intr_handler)(sd->intr_handler_arg);
+       } else {
+               sd_err(("bcmsdh_sdmmc: ***IRQHandler\n"));
+
+               sd_err(("%s: Not ready for intr: enabled %d, handler %p\n",
+                       __FUNCTION__, sd->client_intr_enabled, sd->intr_handler));
+       }
+
+       sdio_claim_host(sd->func[0]);
+}
+
+/* bcmsdh_sdmmc interrupt handler for F2 (dummy handler) */
+static void IRQHandlerF2(struct sdio_func *func)
+{
+       sd_trace(("bcmsdh_sdmmc: ***IRQHandlerF2\n"));
+}
+#endif /* !defined(OOB_INTR_ONLY) || defined(OOB_PARAM) */
+
+#ifdef NOTUSED
+/* Write client card reg */
+static int
+sdioh_sdmmc_card_regwrite(sdioh_info_t *sd, int func, uint32 regaddr, int regsize, uint32 data)
+{
+
+       if ((func == 0) || (regsize == 1)) {
+               uint8 temp;
+
+               temp = data & 0xff;
+               sdioh_request_byte(sd, SDIOH_READ, func, regaddr, &temp);
+               sd_data(("%s: byte write data=0x%02x\n",
+                        __FUNCTION__, data));
+       } else {
+               if (regsize == 2)
+                       data &= 0xffff;
+
+               sdioh_request_word(sd, 0, SDIOH_READ, func, regaddr, &data, regsize);
+
+               sd_data(("%s: word write data=0x%08x\n",
+                        __FUNCTION__, data));
+       }
+
+       return SUCCESS;
+}
+#endif /* NOTUSED */
+
+int
+sdioh_start(sdioh_info_t *sd, int stage)
+{
+       int ret;
+
+       if (!sd) {
+               sd_err(("%s Failed, sd is NULL\n", __FUNCTION__));
+               return (0);
+       }
+
+       /* Need to do this stages as we can't enable the interrupt till
+               downloading of the firmware is complete, other wise polling
+               sdio access will come in way
+       */
+       if (sd->func[0]) {
+                       if (stage == 0) {
+               /* Since the power to the chip is killed, we will have
+                       re enumerate the device again. Set the block size
+                       and enable the fucntion 1 for in preparation for
+                       downloading the code
+               */
+               /* sdio_reset_comm() - has been fixed in latest kernel/msm.git for Linux
+                  2.6.27. The implementation prior to that is buggy, and needs broadcom's
+                  patch for it
+               */
+               if ((ret = sdio_reset_comm(sd->func[0]->card))) {
+                       sd_err(("%s Failed, error = %d\n", __FUNCTION__, ret));
+                       return ret;
+               }
+               else {
+                       sd->num_funcs = 2;
+                       sd->sd_blockmode = TRUE;
+                       sd->use_client_ints = TRUE;
+                       sd->client_block_size[0] = 64;
+
+                       if (sd->func[1]) {
+                               /* Claim host controller */
+                               sdio_claim_host(sd->func[1]);
+
+                               sd->client_block_size[1] = 64;
+                               ret = sdio_set_block_size(sd->func[1], 64);
+                               if (ret) {
+                                       sd_err(("bcmsdh_sdmmc: Failed to set F1 "
+                                               "blocksize(%d)\n", ret));
+                               }
+
+                               /* Release host controller F1 */
+                               sdio_release_host(sd->func[1]);
+                       }
+
+                       if (sd->func[2]) {
+                               /* Claim host controller F2 */
+                               sdio_claim_host(sd->func[2]);
+
+                               sd->client_block_size[2] = sd_f2_blocksize;
+                               ret = sdio_set_block_size(sd->func[2], sd_f2_blocksize);
+                               if (ret) {
+                                       sd_err(("bcmsdh_sdmmc: Failed to set F2 "
+                                               "blocksize to %d(%d)\n", sd_f2_blocksize, ret));
+                               }
+
+                               /* Release host controller F2 */
+                               sdio_release_host(sd->func[2]);
+                       }
+
+                       sdioh_sdmmc_card_enablefuncs(sd);
+                       }
+               } else {
+#if !defined(OOB_INTR_ONLY) || defined(OOB_PARAM)
+                       OOB_PARAM_IF(sdioh_get_oob_disable(sd)) {
+                               sdio_claim_host(sd->func[0]);
+                               if (sd->func[2])
+                                       sdio_claim_irq(sd->func[2], IRQHandlerF2);
+                               if (sd->func[1])
+                                       sdio_claim_irq(sd->func[1], IRQHandler);
+                               sdio_release_host(sd->func[0]);
+                       } OOB_PARAM_ELSE()
+#endif /* !defined(OOB_INTR_ONLY) || defined(OOB_PARAM) */
+#if defined(OOB_INTR_ONLY)
+                       {
+#if defined(HW_OOB)
+                               sdioh_enable_func_intr(sd);
+#endif /* defined(HW_OOB) */
+                               bcmsdh_oob_intr_set(sd->bcmsdh, TRUE);
+                       }
+#endif /* defined(OOB_INTR_ONLY) */
+               }
+       }
+       else
+               sd_err(("%s Failed\n", __FUNCTION__));
+
+       return (0);
+}
+
+int
+sdioh_stop(sdioh_info_t *sd)
+{
+       /* MSM7201A Android sdio stack has bug with interrupt
+               So internaly within SDIO stack they are polling
+               which cause issue when device is turned off. So
+               unregister interrupt with SDIO stack to stop the
+               polling
+       */
+       if (sd->func[0]) {
+#if !defined(OOB_INTR_ONLY) || defined(OOB_PARAM)
+               OOB_PARAM_IF(sdioh_get_oob_disable(sd)) {
+                       sdio_claim_host(sd->func[0]);
+                       if (sd->func[1])
+                               sdio_release_irq(sd->func[1]);
+                       if (sd->func[2])
+                               sdio_release_irq(sd->func[2]);
+                       sdio_release_host(sd->func[0]);
+               } OOB_PARAM_ELSE()
+#endif /* !defined(OOB_INTR_ONLY) || defined(OOB_PARAM) */
+#if defined(OOB_INTR_ONLY)
+               {
+#if defined(HW_OOB)
+                       sdioh_disable_func_intr(sd);
+#endif
+                       bcmsdh_oob_intr_set(sd->bcmsdh, FALSE);
+               }
+#endif /* defined(OOB_INTR_ONLY) */
+       }
+       else
+               sd_err(("%s Failed\n", __FUNCTION__));
+       return (0);
+}
+
+int
+sdioh_waitlockfree(sdioh_info_t *sd)
+{
+       return (1);
+}
+
+
+SDIOH_API_RC
+sdioh_gpioouten(sdioh_info_t *sd, uint32 gpio)
+{
+       return SDIOH_API_RC_FAIL;
+}
+
+SDIOH_API_RC
+sdioh_gpioout(sdioh_info_t *sd, uint32 gpio, bool enab)
+{
+       return SDIOH_API_RC_FAIL;
+}
+
+bool
+sdioh_gpioin(sdioh_info_t *sd, uint32 gpio)
+{
+       return FALSE;
+}
+
+SDIOH_API_RC
+sdioh_gpio_init(sdioh_info_t *sd)
+{
+       return SDIOH_API_RC_FAIL;
+}
diff --git a/drivers/net/wireless/bcmdhd_1363/bcmsdh_sdmmc_linux.c b/drivers/net/wireless/bcmdhd_1363/bcmsdh_sdmmc_linux.c
new file mode 100644 (file)
index 0000000..1e91196
--- /dev/null
@@ -0,0 +1,409 @@
+/*
+ * BCMSDH Function Driver for the native SDIO/MMC driver in the Linux Kernel
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Proprietary,Open:>>
+ *
+ * $Id: bcmsdh_sdmmc_linux.c 662764 2016-11-10 09:38:01Z $
+ */
+
+#include <typedefs.h>
+#include <bcmutils.h>
+#include <sdio.h>      /* SDIO Device and Protocol Specs */
+#include <bcmsdbus.h>  /* bcmsdh to/from specific controller APIs */
+#include <sdiovar.h>   /* to get msglevel bit values */
+
+#include <linux/sched.h>       /* request_irq() */
+
+#include <linux/mmc/core.h>
+#include <linux/mmc/card.h>
+#include <linux/mmc/host.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/mmc/sdio_ids.h>
+#include <dhd_linux.h>
+#include <bcmsdh_sdmmc.h>
+#include <dhd_dbg.h>
+
+#if !defined(SDIO_VENDOR_ID_BROADCOM)
+#define SDIO_VENDOR_ID_BROADCOM                0x02d0
+#endif /* !defined(SDIO_VENDOR_ID_BROADCOM) */
+
+#define SDIO_DEVICE_ID_BROADCOM_DEFAULT        0x0000
+
+#if !defined(SDIO_DEVICE_ID_BROADCOM_4325_SDGWB)
+#define SDIO_DEVICE_ID_BROADCOM_4325_SDGWB     0x0492  /* BCM94325SDGWB */
+#endif /* !defined(SDIO_DEVICE_ID_BROADCOM_4325_SDGWB) */
+#if !defined(SDIO_DEVICE_ID_BROADCOM_4325)
+#define SDIO_DEVICE_ID_BROADCOM_4325   0x0493
+#endif /* !defined(SDIO_DEVICE_ID_BROADCOM_4325) */
+#if !defined(SDIO_DEVICE_ID_BROADCOM_4329)
+#define SDIO_DEVICE_ID_BROADCOM_4329   0x4329
+#endif /* !defined(SDIO_DEVICE_ID_BROADCOM_4329) */
+#if !defined(SDIO_DEVICE_ID_BROADCOM_4319)
+#define SDIO_DEVICE_ID_BROADCOM_4319   0x4319
+#endif /* !defined(SDIO_DEVICE_ID_BROADCOM_4319) */
+#if !defined(SDIO_DEVICE_ID_BROADCOM_4330)
+#define SDIO_DEVICE_ID_BROADCOM_4330   0x4330
+#endif /* !defined(SDIO_DEVICE_ID_BROADCOM_4330) */
+#if !defined(SDIO_DEVICE_ID_BROADCOM_4334)
+#define SDIO_DEVICE_ID_BROADCOM_4334    0x4334
+#endif /* !defined(SDIO_DEVICE_ID_BROADCOM_4334) */
+#if !defined(SDIO_DEVICE_ID_BROADCOM_4324)
+#define SDIO_DEVICE_ID_BROADCOM_4324    0x4324
+#endif /* !defined(SDIO_DEVICE_ID_BROADCOM_4324) */
+#if !defined(SDIO_DEVICE_ID_BROADCOM_43239)
+#define SDIO_DEVICE_ID_BROADCOM_43239    43239
+#endif /* !defined(SDIO_DEVICE_ID_BROADCOM_43239) */
+
+extern void wl_cfg80211_set_parent_dev(void *dev);
+extern void sdioh_sdmmc_devintr_off(sdioh_info_t *sd);
+extern void sdioh_sdmmc_devintr_on(sdioh_info_t *sd);
+extern void* bcmsdh_probe(osl_t *osh, void *dev, void *sdioh, void *adapter_info, uint bus_type,
+       uint bus_num, uint slot_num);
+extern int bcmsdh_remove(bcmsdh_info_t *bcmsdh);
+
+int sdio_function_init(void);
+void sdio_function_cleanup(void);
+
+#define DESCRIPTION "bcmsdh_sdmmc Driver"
+#define AUTHOR "Broadcom Corporation"
+
+/* module param defaults */
+static int clockoverride = 0;
+
+module_param(clockoverride, int, 0644);
+MODULE_PARM_DESC(clockoverride, "SDIO card clock override");
+
+/* Maximum number of bcmsdh_sdmmc devices supported by driver */
+#define BCMSDH_SDMMC_MAX_DEVICES 1
+
+extern volatile bool dhd_mmc_suspend;
+
+static int sdioh_probe(struct sdio_func *func)
+{
+       int host_idx = func->card->host->index;
+       uint32 rca = func->card->rca;
+       wifi_adapter_info_t *adapter;
+       osl_t *osh = NULL;
+       sdioh_info_t *sdioh = NULL;
+
+       sd_err(("bus num (host idx)=%d, slot num (rca)=%d\n", host_idx, rca));
+       adapter = dhd_wifi_platform_get_adapter(SDIO_BUS, host_idx, rca);
+       if (adapter  != NULL)
+               sd_err(("found adapter info '%s'\n", adapter->name));
+       else
+               sd_err(("can't find adapter info for this chip\n"));
+
+#ifdef WL_CFG80211
+       wl_cfg80211_set_parent_dev(&func->dev);
+#endif
+
+        /* allocate SDIO Host Controller state info */
+        osh = osl_attach(&func->dev, SDIO_BUS, TRUE);
+        if (osh == NULL) {
+                sd_err(("%s: osl_attach failed\n", __FUNCTION__));
+                goto fail;
+        }
+        osl_static_mem_init(osh, adapter);
+        sdioh = sdioh_attach(osh, func);
+        if (sdioh == NULL) {
+                sd_err(("%s: sdioh_attach failed\n", __FUNCTION__));
+                goto fail;
+        }
+        sdioh->bcmsdh = bcmsdh_probe(osh, &func->dev, sdioh, adapter, SDIO_BUS, host_idx, rca);
+        if (sdioh->bcmsdh == NULL) {
+                sd_err(("%s: bcmsdh_probe failed\n", __FUNCTION__));
+                goto fail;
+        }
+
+       sdio_set_drvdata(func, sdioh);
+       return 0;
+
+fail:
+       if (sdioh != NULL)
+               sdioh_detach(osh, sdioh);
+       if (osh != NULL)
+               osl_detach(osh);
+       return -ENOMEM;
+}
+
+static void sdioh_remove(struct sdio_func *func)
+{
+       sdioh_info_t *sdioh;
+       osl_t *osh;
+
+       sdioh = sdio_get_drvdata(func);
+       if (sdioh == NULL) {
+               sd_err(("%s: error, no sdioh handler found\n", __FUNCTION__));
+               return;
+       }
+
+       osh = sdioh->osh;
+       bcmsdh_remove(sdioh->bcmsdh);
+       sdioh_detach(osh, sdioh);
+       osl_detach(osh);
+}
+
+static int bcmsdh_sdmmc_probe(struct sdio_func *func,
+                              const struct sdio_device_id *id)
+{
+       int ret = 0;
+
+       if (func == NULL)
+               return -EINVAL;
+
+       sd_err(("bcmsdh_sdmmc: %s Enter\n", __FUNCTION__));
+       sd_info(("sdio_bcmsdh: func->class=%x\n", func->class));
+       sd_info(("sdio_vendor: 0x%04x\n", func->vendor));
+       sd_info(("sdio_device: 0x%04x\n", func->device));
+       sd_info(("Function#: 0x%04x\n", func->num));
+
+       /* 4318 doesn't have function 2 */
+       if ((func->num == 2) || (func->num == 1 && func->device == 0x4))
+               ret = sdioh_probe(func);
+
+       return ret;
+}
+
+static void bcmsdh_sdmmc_remove(struct sdio_func *func)
+{
+       if (func == NULL) {
+               sd_err(("%s is called with NULL SDIO function pointer\n", __FUNCTION__));
+               return;
+       }
+
+       sd_trace(("bcmsdh_sdmmc: %s Enter\n", __FUNCTION__));
+       sd_info(("sdio_bcmsdh: func->class=%x\n", func->class));
+       sd_info(("sdio_vendor: 0x%04x\n", func->vendor));
+       sd_info(("sdio_device: 0x%04x\n", func->device));
+       sd_info(("Function#: 0x%04x\n", func->num));
+
+       if ((func->num == 2) || (func->num == 1 && func->device == 0x4))
+               sdioh_remove(func);
+}
+
+/* devices we support, null terminated */
+static const struct sdio_device_id bcmsdh_sdmmc_ids[] = {
+       { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_DEFAULT) },
+       { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4325_SDGWB) },
+       { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4325) },
+       { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4329) },
+       { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4319) },
+       { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4330) },
+       { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4334) },
+       { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4324) },
+       { SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_43239) },
+       { SDIO_DEVICE_CLASS(SDIO_CLASS_NONE)            },
+       { /* end: all zeroes */                         },
+};
+
+MODULE_DEVICE_TABLE(sdio, bcmsdh_sdmmc_ids);
+
+#ifdef OOB_PARAM
+uint
+sdioh_get_oob_disable(sdioh_info_t *sd)
+{
+       int host_idx = sd->func[0]->card->host->index;
+       uint32 rca = sd->func[0]->card->rca;
+       wifi_adapter_info_t *adapter;
+
+       adapter = dhd_wifi_platform_get_adapter(SDIO_BUS, host_idx, rca);
+
+       return adapter->oob_disable;
+}
+#endif /* OOB_PARAM */
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)) && defined(CONFIG_PM)
+static int bcmsdh_sdmmc_suspend(struct device *pdev)
+{
+       int err;
+       sdioh_info_t *sdioh;
+       struct sdio_func *func = dev_to_sdio_func(pdev);
+       mmc_pm_flag_t sdio_flags;
+
+       sd_err(("%s Enter\n", __FUNCTION__));
+       if (func->num != 2)
+               return 0;
+
+       dhd_mmc_suspend = TRUE;
+       sdioh = sdio_get_drvdata(func);
+       err = bcmsdh_suspend(sdioh->bcmsdh);
+       if (err) {
+               dhd_mmc_suspend = FALSE;
+               return err;
+       }
+
+       sdio_flags = sdio_get_host_pm_caps(func);
+       if (!(sdio_flags & MMC_PM_KEEP_POWER)) {
+               sd_err(("%s: can't keep power while host is suspended\n", __FUNCTION__));
+               dhd_mmc_suspend = FALSE;
+               return  -EINVAL;
+       }
+
+       /* keep power while host suspended */
+       err = sdio_set_host_pm_flags(func, MMC_PM_KEEP_POWER);
+       if (err) {
+               sd_err(("%s: error while trying to keep power\n", __FUNCTION__));
+               dhd_mmc_suspend = FALSE;
+               return err;
+       }
+#if defined(OOB_INTR_ONLY)
+       OOB_PARAM_IF(!(sdioh_get_oob_disable(sdioh))) {
+               bcmsdh_oob_intr_set(sdioh->bcmsdh, FALSE);
+       }
+#endif 
+       smp_mb();
+
+       return 0;
+}
+
+static int bcmsdh_sdmmc_resume(struct device *pdev)
+{
+       struct sdio_func *func = dev_to_sdio_func(pdev);
+       sdioh_info_t *sdioh;
+
+
+       sd_err(("%s Enter\n", __FUNCTION__));
+       if (func->num != 2)
+               return 0;
+
+       dhd_mmc_suspend = FALSE;
+       sdioh = sdio_get_drvdata(func);
+       bcmsdh_resume(sdioh->bcmsdh);
+
+       smp_mb();
+       return 0;
+}
+
+static const struct dev_pm_ops bcmsdh_sdmmc_pm_ops = {
+       .suspend        = bcmsdh_sdmmc_suspend,
+       .resume         = bcmsdh_sdmmc_resume,
+};
+#endif  /* (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)) && defined(CONFIG_PM) */
+
+#if defined(BCMLXSDMMC)
+static struct semaphore *notify_semaphore = NULL;
+
+static int dummy_probe(struct sdio_func *func,
+                              const struct sdio_device_id *id)
+{
+       if (func && (func->num != 2)) {
+               return 0;
+       }
+
+       if (notify_semaphore)
+               up(notify_semaphore);
+       return 0;
+}
+
+static void dummy_remove(struct sdio_func *func)
+{
+}
+
+static struct sdio_driver dummy_sdmmc_driver = {
+       .probe          = dummy_probe,
+       .remove         = dummy_remove,
+       .name           = "dummy_sdmmc",
+       .id_table       = bcmsdh_sdmmc_ids,
+       };
+
+int sdio_func_reg_notify(void* semaphore)
+{
+       notify_semaphore = semaphore;
+       return sdio_register_driver(&dummy_sdmmc_driver);
+}
+
+void sdio_func_unreg_notify(void)
+{
+       OSL_SLEEP(15);
+       sdio_unregister_driver(&dummy_sdmmc_driver);
+}
+
+#endif /* defined(BCMLXSDMMC) */
+
+static struct sdio_driver bcmsdh_sdmmc_driver = {
+       .probe          = bcmsdh_sdmmc_probe,
+       .remove         = bcmsdh_sdmmc_remove,
+       .name           = "bcmsdh_sdmmc",
+       .id_table       = bcmsdh_sdmmc_ids,
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)) && defined(CONFIG_PM)
+       .drv = {
+       .pm     = &bcmsdh_sdmmc_pm_ops,
+       },
+#endif /* (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)) && defined(CONFIG_PM) */
+       };
+
+struct sdos_info {
+       sdioh_info_t *sd;
+       spinlock_t lock;
+};
+
+/* Interrupt enable/disable */
+SDIOH_API_RC
+sdioh_interrupt_set(sdioh_info_t *sd, bool enable)
+{
+       if (!sd)
+               return BCME_BADARG;
+
+       sd_trace(("%s: %s\n", __FUNCTION__, enable ? "Enabling" : "Disabling"));
+       return SDIOH_API_RC_SUCCESS;
+}
+
+#ifdef BCMSDH_MODULE
+static int __init
+bcmsdh_module_init(void)
+{
+       int error = 0;
+       error = sdio_function_init();
+       return error;
+}
+
+static void __exit
+bcmsdh_module_cleanup(void)
+{
+       sdio_function_cleanup();
+}
+
+module_init(bcmsdh_module_init);
+module_exit(bcmsdh_module_cleanup);
+
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION(DESCRIPTION);
+MODULE_AUTHOR(AUTHOR);
+
+#endif /* BCMSDH_MODULE */
+/*
+ * module init
+*/
+int bcmsdh_register_client_driver(void)
+{
+       return sdio_register_driver(&bcmsdh_sdmmc_driver);
+}
+
+/*
+ * module cleanup
+*/
+void bcmsdh_unregister_client_driver(void)
+{
+       sdio_unregister_driver(&bcmsdh_sdmmc_driver);
+}
diff --git a/drivers/net/wireless/bcmdhd_1363/bcmsdspi_linux.c b/drivers/net/wireless/bcmdhd_1363/bcmsdspi_linux.c
new file mode 100644 (file)
index 0000000..b7091e5
--- /dev/null
@@ -0,0 +1,252 @@
+/*
+ * Broadcom SPI Host Controller Driver - Linux Per-port
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmsdspi_linux.c 514727 2014-11-12 03:02:48Z $
+ */
+
+#include <typedefs.h>
+#include <bcmutils.h>
+
+#include <bcmsdbus.h>          /* bcmsdh to/from specific controller APIs */
+#include <sdiovar.h>           /* to get msglevel bit values */
+
+#include <pcicfg.h>
+#include <sdio.h>              /* SDIO Device and Protocol Specs */
+#include <linux/sched.h>       /* request_irq(), free_irq() */
+#include <bcmsdspi.h>
+#include <bcmspi.h>
+
+extern uint sd_crc;
+module_param(sd_crc, uint, 0);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+#define KERNEL26
+#endif
+
+struct sdos_info {
+       sdioh_info_t *sd;
+       spinlock_t lock;
+       wait_queue_head_t intr_wait_queue;
+};
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+#define BLOCKABLE()    (!in_atomic())
+#else
+#define BLOCKABLE()    (!in_interrupt())
+#endif
+
+/* Interrupt handler */
+static irqreturn_t
+sdspi_isr(int irq, void *dev_id
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 20)
+, struct pt_regs *ptregs
+#endif
+)
+{
+       sdioh_info_t *sd;
+       struct sdos_info *sdos;
+       bool ours;
+
+       sd = (sdioh_info_t *)dev_id;
+       sd->local_intrcount++;
+
+       if (!sd->card_init_done) {
+               sd_err(("%s: Hey Bogus intr...not even initted: irq %d\n", __FUNCTION__, irq));
+               return IRQ_RETVAL(FALSE);
+       } else {
+               ours = spi_check_client_intr(sd, NULL);
+
+               /* For local interrupts, wake the waiting process */
+               if (ours && sd->got_hcint) {
+                       sdos = (struct sdos_info *)sd->sdos_info;
+                       wake_up_interruptible(&sdos->intr_wait_queue);
+               }
+
+               return IRQ_RETVAL(ours);
+       }
+}
+
+
+/* Register with Linux for interrupts */
+int
+spi_register_irq(sdioh_info_t *sd, uint irq)
+{
+       sd_trace(("Entering %s: irq == %d\n", __FUNCTION__, irq));
+       if (request_irq(irq, sdspi_isr, IRQF_SHARED, "bcmsdspi", sd) < 0) {
+               sd_err(("%s: request_irq() failed\n", __FUNCTION__));
+               return ERROR;
+       }
+       return SUCCESS;
+}
+
+/* Free Linux irq */
+void
+spi_free_irq(uint irq, sdioh_info_t *sd)
+{
+       free_irq(irq, sd);
+}
+
+/* Map Host controller registers */
+uint32 *
+spi_reg_map(osl_t *osh, uintptr addr, int size)
+{
+       return (uint32 *)REG_MAP(addr, size);
+}
+
+void
+spi_reg_unmap(osl_t *osh, uintptr addr, int size)
+{
+       REG_UNMAP((void*)(uintptr)addr);
+}
+
+int
+spi_osinit(sdioh_info_t *sd)
+{
+       struct sdos_info *sdos;
+
+       sdos = (struct sdos_info*)MALLOC(sd->osh, sizeof(struct sdos_info));
+       sd->sdos_info = (void*)sdos;
+       if (sdos == NULL)
+               return BCME_NOMEM;
+
+       sdos->sd = sd;
+       spin_lock_init(&sdos->lock);
+       init_waitqueue_head(&sdos->intr_wait_queue);
+       return BCME_OK;
+}
+
+void
+spi_osfree(sdioh_info_t *sd)
+{
+       struct sdos_info *sdos;
+       ASSERT(sd && sd->sdos_info);
+
+       sdos = (struct sdos_info *)sd->sdos_info;
+       MFREE(sd->osh, sdos, sizeof(struct sdos_info));
+}
+
+/* Interrupt enable/disable */
+SDIOH_API_RC
+sdioh_interrupt_set(sdioh_info_t *sd, bool enable)
+{
+       ulong flags;
+       struct sdos_info *sdos;
+
+       sd_trace(("%s: %s\n", __FUNCTION__, enable ? "Enabling" : "Disabling"));
+
+       sdos = (struct sdos_info *)sd->sdos_info;
+       ASSERT(sdos);
+
+       if (!(sd->host_init_done && sd->card_init_done)) {
+               sd_err(("%s: Card & Host are not initted - bailing\n", __FUNCTION__));
+               return SDIOH_API_RC_FAIL;
+       }
+
+       if (enable && !(sd->intr_handler && sd->intr_handler_arg)) {
+               sd_err(("%s: no handler registered, will not enable\n", __FUNCTION__));
+               return SDIOH_API_RC_FAIL;
+       }
+
+       /* Ensure atomicity for enable/disable calls */
+       spin_lock_irqsave(&sdos->lock, flags);
+
+       sd->client_intr_enabled = enable;
+       if (enable && !sd->lockcount)
+               spi_devintr_on(sd);
+       else
+               spi_devintr_off(sd);
+
+       spin_unlock_irqrestore(&sdos->lock, flags);
+
+       return SDIOH_API_RC_SUCCESS;
+}
+
+/* Protect against reentrancy (disable device interrupts while executing) */
+void
+spi_lock(sdioh_info_t *sd)
+{
+       ulong flags;
+       struct sdos_info *sdos;
+
+       sdos = (struct sdos_info *)sd->sdos_info;
+       ASSERT(sdos);
+
+       sd_trace(("%s: %d\n", __FUNCTION__, sd->lockcount));
+
+       spin_lock_irqsave(&sdos->lock, flags);
+       if (sd->lockcount) {
+               sd_err(("%s: Already locked!\n", __FUNCTION__));
+               ASSERT(sd->lockcount == 0);
+       }
+       spi_devintr_off(sd);
+       sd->lockcount++;
+       spin_unlock_irqrestore(&sdos->lock, flags);
+}
+
+/* Enable client interrupt */
+void
+spi_unlock(sdioh_info_t *sd)
+{
+       ulong flags;
+       struct sdos_info *sdos;
+
+       sd_trace(("%s: %d, %d\n", __FUNCTION__, sd->lockcount, sd->client_intr_enabled));
+       ASSERT(sd->lockcount > 0);
+
+       sdos = (struct sdos_info *)sd->sdos_info;
+       ASSERT(sdos);
+
+       spin_lock_irqsave(&sdos->lock, flags);
+       if (--sd->lockcount == 0 && sd->client_intr_enabled) {
+               spi_devintr_on(sd);
+       }
+       spin_unlock_irqrestore(&sdos->lock, flags);
+}
+
+void spi_waitbits(sdioh_info_t *sd, bool yield)
+{
+#ifndef BCMSDYIELD
+       ASSERT(!yield);
+#endif
+       sd_trace(("%s: yield %d canblock %d\n",
+                 __FUNCTION__, yield, BLOCKABLE()));
+
+       /* Clear the "interrupt happened" flag and last intrstatus */
+       sd->got_hcint = FALSE;
+
+#ifdef BCMSDYIELD
+       if (yield && BLOCKABLE()) {
+               struct sdos_info *sdos;
+               sdos = (struct sdos_info *)sd->sdos_info;
+               /* Wait for the indication, the interrupt will be masked when the ISR fires. */
+               wait_event_interruptible(sdos->intr_wait_queue, (sd->got_hcint));
+       } else
+#endif /* BCMSDYIELD */
+       {
+               spi_spinbits(sd);
+       }
+
+}
diff --git a/drivers/net/wireless/bcmdhd_1363/bcmspibrcm.c b/drivers/net/wireless/bcmdhd_1363/bcmspibrcm.c
new file mode 100644 (file)
index 0000000..5b793b0
--- /dev/null
@@ -0,0 +1,1823 @@
+/*
+ * Broadcom BCMSDH to gSPI Protocol Conversion Layer
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmspibrcm.c 662542 2016-10-28 03:26:10Z $
+ */
+
+#define HSMODE
+
+#include <typedefs.h>
+
+#include <bcmdevs.h>
+#include <bcmendian.h>
+#include <bcmutils.h>
+#include <osl.h>
+#include <hndsoc.h>
+#include <siutils.h>
+#include <sbchipc.h>
+#include <sbsdio.h>    /* SDIO device core hardware definitions. */
+#include <spid.h>
+
+#include <bcmsdbus.h>  /* bcmsdh to/from specific controller APIs */
+#include <sdiovar.h>   /* ioctl/iovars */
+#include <sdio.h>      /* SDIO Device and Protocol Specs */
+
+#include <pcicfg.h>
+
+
+#include <bcmspibrcm.h>
+#include <bcmspi.h>
+
+/* these are for the older cores... for newer cores we have control for each of them */
+#define F0_RESPONSE_DELAY      16
+#define F1_RESPONSE_DELAY      16
+#define F2_RESPONSE_DELAY      F0_RESPONSE_DELAY
+
+
+#define GSPI_F0_RESP_DELAY             0
+#define GSPI_F1_RESP_DELAY             F1_RESPONSE_DELAY
+#define GSPI_F2_RESP_DELAY             0
+#define GSPI_F3_RESP_DELAY             0
+
+#define CMDLEN         4
+
+#define DWORDMODE_ON (sd->chip == BCM4329_CHIP_ID) && (sd->chiprev == 2) && (sd->dwordmode == TRUE)
+
+/* Globals */
+#if defined(DHD_DEBUG)
+uint sd_msglevel = SDH_ERROR_VAL;
+#else
+uint sd_msglevel = 0;
+#endif 
+
+uint sd_hiok = FALSE;          /* Use hi-speed mode if available? */
+uint sd_sdmode = SDIOH_MODE_SPI;               /* Use SD4 mode by default */
+uint sd_f2_blocksize = 64;             /* Default blocksize */
+
+
+uint sd_divisor = 2;
+uint sd_power = 1;             /* Default to SD Slot powered ON */
+uint sd_clock = 1;             /* Default to SD Clock turned ON */
+uint sd_crc = 0;               /* Default to SPI CRC Check turned OFF */
+uint sd_pci_slot = 0xFFFFffff; /* Used to force selection of a particular PCI slot */
+
+uint8  spi_outbuf[SPI_MAX_PKT_LEN];
+uint8  spi_inbuf[SPI_MAX_PKT_LEN];
+
+/* 128bytes buffer is enough to clear data-not-available and program response-delay F0 bits
+ * assuming we will not exceed F0 response delay > 100 bytes at 48MHz.
+ */
+#define BUF2_PKT_LEN   128
+uint8  spi_outbuf2[BUF2_PKT_LEN];
+uint8  spi_inbuf2[BUF2_PKT_LEN];
+
+#define SPISWAP_WD4(x) bcmswap32(x);
+#define SPISWAP_WD2(x) (bcmswap16(x & 0xffff)) | \
+                                               (bcmswap16((x & 0xffff0000) >> 16) << 16);
+
+/* Prototypes */
+static bool bcmspi_test_card(sdioh_info_t *sd);
+static bool bcmspi_host_device_init_adapt(sdioh_info_t *sd);
+static int bcmspi_set_highspeed_mode(sdioh_info_t *sd, bool hsmode);
+static int bcmspi_cmd_issue(sdioh_info_t *sd, bool use_dma, uint32 cmd_arg,
+                           uint32 *data, uint32 datalen);
+static int bcmspi_card_regread(sdioh_info_t *sd, int func, uint32 regaddr,
+                              int regsize, uint32 *data);
+static int bcmspi_card_regwrite(sdioh_info_t *sd, int func, uint32 regaddr,
+                               int regsize, uint32 data);
+static int bcmspi_card_bytewrite(sdioh_info_t *sd, int func, uint32 regaddr,
+                               uint8 *data);
+static int bcmspi_driver_init(sdioh_info_t *sd);
+static int bcmspi_card_buf(sdioh_info_t *sd, int rw, int func, bool fifo,
+                          uint32 addr, int nbytes, uint32 *data);
+static int bcmspi_card_regread_fixedaddr(sdioh_info_t *sd, int func, uint32 regaddr, int regsize,
+                                 uint32 *data);
+static void bcmspi_cmd_getdstatus(sdioh_info_t *sd, uint32 *dstatus_buffer);
+static int bcmspi_update_stats(sdioh_info_t *sd, uint32 cmd_arg);
+
+/*
+ *  Public entry points & extern's
+ */
+extern sdioh_info_t *
+sdioh_attach(osl_t *osh, void *bar0, uint irq)
+{
+       sdioh_info_t *sd;
+
+       sd_trace(("%s\n", __FUNCTION__));
+       if ((sd = (sdioh_info_t *)MALLOC(osh, sizeof(sdioh_info_t))) == NULL) {
+               sd_err(("%s: out of memory, malloced %d bytes\n", __FUNCTION__, MALLOCED(osh)));
+               return NULL;
+       }
+       bzero((char *)sd, sizeof(sdioh_info_t));
+       sd->osh = osh;
+       if (spi_osinit(sd) != 0) {
+               sd_err(("%s: spi_osinit() failed\n", __FUNCTION__));
+               MFREE(sd->osh, sd, sizeof(sdioh_info_t));
+               return NULL;
+       }
+
+       sd->bar0 = bar0;
+       sd->irq = irq;
+       sd->intr_handler = NULL;
+       sd->intr_handler_arg = NULL;
+       sd->intr_handler_valid = FALSE;
+
+       /* Set defaults */
+       sd->use_client_ints = TRUE;
+       sd->sd_use_dma = FALSE; /* DMA Not supported */
+
+       /* Spi device default is 16bit mode, change to 4 when device is changed to 32bit
+        * mode
+        */
+       sd->wordlen = 2;
+
+
+       if (!spi_hw_attach(sd)) {
+               sd_err(("%s: spi_hw_attach() failed\n", __FUNCTION__));
+               spi_osfree(sd);
+               MFREE(sd->osh, sd, sizeof(sdioh_info_t));
+               return (NULL);
+       }
+
+       if (bcmspi_driver_init(sd) != SUCCESS) {
+               sd_err(("%s: bcmspi_driver_init() failed()\n", __FUNCTION__));
+               spi_hw_detach(sd);
+               spi_osfree(sd);
+               MFREE(sd->osh, sd, sizeof(sdioh_info_t));
+               return (NULL);
+       }
+
+       if (spi_register_irq(sd, irq) != SUCCESS) {
+               sd_err(("%s: spi_register_irq() failed for irq = %d\n", __FUNCTION__, irq));
+               spi_hw_detach(sd);
+               spi_osfree(sd);
+               MFREE(sd->osh, sd, sizeof(sdioh_info_t));
+               return (NULL);
+       }
+
+       sd_trace(("%s: Done\n", __FUNCTION__));
+
+       return sd;
+}
+
+extern SDIOH_API_RC
+sdioh_detach(osl_t *osh, sdioh_info_t *sd)
+{
+       sd_trace(("%s\n", __FUNCTION__));
+       if (sd) {
+               sd_err(("%s: detaching from hardware\n", __FUNCTION__));
+               spi_free_irq(sd->irq, sd);
+               spi_hw_detach(sd);
+               spi_osfree(sd);
+               MFREE(sd->osh, sd, sizeof(sdioh_info_t));
+       }
+       return SDIOH_API_RC_SUCCESS;
+}
+
+/* Configure callback to client when we recieve client interrupt */
+extern SDIOH_API_RC
+sdioh_interrupt_register(sdioh_info_t *sd, sdioh_cb_fn_t fn, void *argh)
+{
+       sd_trace(("%s: Entering\n", __FUNCTION__));
+#if !defined(OOB_INTR_ONLY) || defined(OOB_PARAM)
+       OOB_PARAM_IF(dhd_get_oob_disable(argh)) {
+               sd->intr_handler = fn;
+               sd->intr_handler_arg = argh;
+               sd->intr_handler_valid = TRUE;
+       }
+#endif /* !defined(OOB_INTR_ONLY) || defined(OOB_PARAM) */
+       return SDIOH_API_RC_SUCCESS;
+}
+
+extern SDIOH_API_RC
+sdioh_interrupt_deregister(sdioh_info_t *sd)
+{
+       sd_trace(("%s: Entering\n", __FUNCTION__));
+#if !defined(OOB_INTR_ONLY) || defined(OOB_PARAM)
+       OOB_PARAM_IF(sd->intr_handler_valid) {
+               sd->intr_handler_valid = FALSE;
+               sd->intr_handler = NULL;
+               sd->intr_handler_arg = NULL;
+       }
+#endif /* !defined(OOB_INTR_ONLY) || defined(OOB_PARAM) */
+       return SDIOH_API_RC_SUCCESS;
+}
+
+extern SDIOH_API_RC
+sdioh_interrupt_query(sdioh_info_t *sd, bool *onoff)
+{
+       sd_trace(("%s: Entering\n", __FUNCTION__));
+       *onoff = sd->client_intr_enabled;
+       return SDIOH_API_RC_SUCCESS;
+}
+
+#if defined(DHD_DEBUG)
+extern bool
+sdioh_interrupt_pending(sdioh_info_t *sd)
+{
+       return 0;
+}
+#endif
+
+extern SDIOH_API_RC
+sdioh_query_device(sdioh_info_t *sd)
+{
+       /* Return a BRCM ID appropriate to the dongle class */
+       return (sd->num_funcs > 1) ? BCM4329_D11N_ID : BCM4318_D11G_ID;
+}
+
+/* Provide dstatus bits of spi-transaction for dhd layers. */
+extern uint32
+sdioh_get_dstatus(sdioh_info_t *sd)
+{
+       return sd->card_dstatus;
+}
+
+extern void
+sdioh_chipinfo(sdioh_info_t *sd, uint32 chip, uint32 chiprev)
+{
+       sd->chip = chip;
+       sd->chiprev = chiprev;
+}
+
+extern void
+sdioh_dwordmode(sdioh_info_t *sd, bool set)
+{
+       uint8 reg = 0;
+       int status;
+
+       if ((status = sdioh_request_byte(sd, SDIOH_READ, SPI_FUNC_0, SPID_STATUS_ENABLE, &reg)) !=
+            SUCCESS) {
+               sd_err(("%s: Failed to set dwordmode in gSPI\n", __FUNCTION__));
+               return;
+       }
+
+       if (set) {
+               reg |= DWORD_PKT_LEN_EN;
+               sd->dwordmode = TRUE;
+               sd->client_block_size[SPI_FUNC_2] = 4096; /* h2spi's limit is 4KB, we support 8KB */
+       } else {
+               reg &= ~DWORD_PKT_LEN_EN;
+               sd->dwordmode = FALSE;
+               sd->client_block_size[SPI_FUNC_2] = 2048;
+       }
+
+       if ((status = sdioh_request_byte(sd, SDIOH_WRITE, SPI_FUNC_0, SPID_STATUS_ENABLE, &reg)) !=
+            SUCCESS) {
+               sd_err(("%s: Failed to set dwordmode in gSPI\n", __FUNCTION__));
+               return;
+       }
+}
+
+
+uint
+sdioh_query_iofnum(sdioh_info_t *sd)
+{
+       return sd->num_funcs;
+}
+
+/* IOVar table */
+enum {
+       IOV_MSGLEVEL = 1,
+       IOV_BLOCKMODE,
+       IOV_BLOCKSIZE,
+       IOV_DMA,
+       IOV_USEINTS,
+       IOV_NUMINTS,
+       IOV_NUMLOCALINTS,
+       IOV_HOSTREG,
+       IOV_DEVREG,
+       IOV_DIVISOR,
+       IOV_SDMODE,
+       IOV_HISPEED,
+       IOV_HCIREGS,
+       IOV_POWER,
+       IOV_CLOCK,
+       IOV_SPIERRSTATS,
+       IOV_RESP_DELAY_ALL
+};
+
+const bcm_iovar_t sdioh_iovars[] = {
+       {"sd_msglevel", IOV_MSGLEVEL,   0,      IOVT_UINT32,    0 },
+       {"sd_blocksize", IOV_BLOCKSIZE, 0,      IOVT_UINT32,    0 }, /* ((fn << 16) | size) */
+       {"sd_dma",      IOV_DMA,        0,      IOVT_BOOL,      0 },
+       {"sd_ints",     IOV_USEINTS,    0,      IOVT_BOOL,      0 },
+       {"sd_numints",  IOV_NUMINTS,    0,      IOVT_UINT32,    0 },
+       {"sd_numlocalints", IOV_NUMLOCALINTS, 0, IOVT_UINT32,   0 },
+       {"sd_hostreg",  IOV_HOSTREG,    0,      IOVT_BUFFER,    sizeof(sdreg_t) },
+       {"sd_devreg",   IOV_DEVREG,     0,      IOVT_BUFFER,    sizeof(sdreg_t) },
+       {"sd_divisor",  IOV_DIVISOR,    0,      IOVT_UINT32,    0 },
+       {"sd_power",    IOV_POWER,      0,      IOVT_UINT32,    0 },
+       {"sd_clock",    IOV_CLOCK,      0,      IOVT_UINT32,    0 },
+       {"sd_mode",     IOV_SDMODE,     0,      IOVT_UINT32,    100},
+       {"sd_highspeed",        IOV_HISPEED,    0,      IOVT_UINT32,    0},
+       {"spi_errstats", IOV_SPIERRSTATS, 0, IOVT_BUFFER, sizeof(struct spierrstats_t) },
+       {"spi_respdelay",       IOV_RESP_DELAY_ALL,     0,      IOVT_BOOL,      0 },
+       {NULL, 0, 0, 0, 0 }
+};
+
+int
+sdioh_iovar_op(sdioh_info_t *si, const char *name,
+               void *params, int plen, void *arg, int len, bool set)
+{
+       const bcm_iovar_t *vi = NULL;
+       int bcmerror = 0;
+       int val_size;
+       int32 int_val = 0;
+       bool bool_val;
+       uint32 actionid;
+/*
+       sdioh_regs_t *regs;
+*/
+
+       ASSERT(name);
+       ASSERT(len >= 0);
+
+       /* Get must have return space; Set does not take qualifiers */
+       ASSERT(set || (arg && len));
+       ASSERT(!set || (!params && !plen));
+
+       sd_trace(("%s: Enter (%s %s)\n", __FUNCTION__, (set ? "set" : "get"), name));
+
+       if ((vi = bcm_iovar_lookup(sdioh_iovars, name)) == NULL) {
+               bcmerror = BCME_UNSUPPORTED;
+               goto exit;
+       }
+
+       if ((bcmerror = bcm_iovar_lencheck(vi, arg, len, set)) != 0)
+               goto exit;
+
+       /* Set up params so get and set can share the convenience variables */
+       if (params == NULL) {
+               params = arg;
+               plen = len;
+       }
+
+       if (vi->type == IOVT_VOID)
+               val_size = 0;
+       else if (vi->type == IOVT_BUFFER)
+               val_size = len;
+       else
+               val_size = sizeof(int);
+
+       if (plen >= (int)sizeof(int_val))
+               bcopy(params, &int_val, sizeof(int_val));
+
+       bool_val = (int_val != 0) ? TRUE : FALSE;
+
+       actionid = set ? IOV_SVAL(vi->varid) : IOV_GVAL(vi->varid);
+       switch (actionid) {
+       case IOV_GVAL(IOV_MSGLEVEL):
+               int_val = (int32)sd_msglevel;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_MSGLEVEL):
+               sd_msglevel = int_val;
+               break;
+
+       case IOV_GVAL(IOV_BLOCKSIZE):
+               if ((uint32)int_val > si->num_funcs) {
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+               int_val = (int32)si->client_block_size[int_val];
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_GVAL(IOV_DMA):
+               int_val = (int32)si->sd_use_dma;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_DMA):
+               si->sd_use_dma = (bool)int_val;
+               break;
+
+       case IOV_GVAL(IOV_USEINTS):
+               int_val = (int32)si->use_client_ints;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_USEINTS):
+               break;
+
+       case IOV_GVAL(IOV_DIVISOR):
+               int_val = (uint32)sd_divisor;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_DIVISOR):
+               sd_divisor = int_val;
+               if (!spi_start_clock(si, (uint16)sd_divisor)) {
+                       sd_err(("%s: set clock failed\n", __FUNCTION__));
+                       bcmerror = BCME_ERROR;
+               }
+               break;
+
+       case IOV_GVAL(IOV_POWER):
+               int_val = (uint32)sd_power;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_POWER):
+               sd_power = int_val;
+               break;
+
+       case IOV_GVAL(IOV_CLOCK):
+               int_val = (uint32)sd_clock;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_CLOCK):
+               sd_clock = int_val;
+               break;
+
+       case IOV_GVAL(IOV_SDMODE):
+               int_val = (uint32)sd_sdmode;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_SDMODE):
+               sd_sdmode = int_val;
+               break;
+
+       case IOV_GVAL(IOV_HISPEED):
+               int_val = (uint32)sd_hiok;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_HISPEED):
+               sd_hiok = int_val;
+
+               if (!bcmspi_set_highspeed_mode(si, (bool)sd_hiok)) {
+                       sd_err(("%s: Failed changing highspeed mode to %d.\n",
+                               __FUNCTION__, sd_hiok));
+                       bcmerror = BCME_ERROR;
+                       return ERROR;
+               }
+               break;
+
+       case IOV_GVAL(IOV_NUMINTS):
+               int_val = (int32)si->intrcount;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_GVAL(IOV_NUMLOCALINTS):
+               int_val = (int32)si->local_intrcount;
+               bcopy(&int_val, arg, val_size);
+               break;
+       case IOV_GVAL(IOV_DEVREG):
+       {
+               sdreg_t *sd_ptr = (sdreg_t *)params;
+               uint8 data;
+
+               if (sdioh_cfg_read(si, sd_ptr->func, sd_ptr->offset, &data)) {
+                       bcmerror = BCME_SDIO_ERROR;
+                       break;
+               }
+
+               int_val = (int)data;
+               bcopy(&int_val, arg, sizeof(int_val));
+               break;
+       }
+
+       case IOV_SVAL(IOV_DEVREG):
+       {
+               sdreg_t *sd_ptr = (sdreg_t *)params;
+               uint8 data = (uint8)sd_ptr->value;
+
+               if (sdioh_cfg_write(si, sd_ptr->func, sd_ptr->offset, &data)) {
+                       bcmerror = BCME_SDIO_ERROR;
+                       break;
+               }
+               break;
+       }
+
+
+       case IOV_GVAL(IOV_SPIERRSTATS):
+       {
+               bcopy(&si->spierrstats, arg, sizeof(struct spierrstats_t));
+               break;
+       }
+
+       case IOV_SVAL(IOV_SPIERRSTATS):
+       {
+               bzero(&si->spierrstats, sizeof(struct spierrstats_t));
+               break;
+       }
+
+       case IOV_GVAL(IOV_RESP_DELAY_ALL):
+               int_val = (int32)si->resp_delay_all;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_RESP_DELAY_ALL):
+               si->resp_delay_all = (bool)int_val;
+               int_val = STATUS_ENABLE|INTR_WITH_STATUS;
+               if (si->resp_delay_all)
+                       int_val |= RESP_DELAY_ALL;
+               else {
+                       if (bcmspi_card_regwrite(si, SPI_FUNC_0, SPID_RESPONSE_DELAY, 1,
+                            F1_RESPONSE_DELAY) != SUCCESS) {
+                               sd_err(("%s: Unable to set response delay.\n", __FUNCTION__));
+                               bcmerror = BCME_SDIO_ERROR;
+                               break;
+                       }
+               }
+
+               if (bcmspi_card_regwrite(si, SPI_FUNC_0, SPID_STATUS_ENABLE, 1, int_val)
+                    != SUCCESS) {
+                       sd_err(("%s: Unable to set response delay.\n", __FUNCTION__));
+                       bcmerror = BCME_SDIO_ERROR;
+                       break;
+               }
+               break;
+
+       default:
+               bcmerror = BCME_UNSUPPORTED;
+               break;
+       }
+exit:
+
+       return bcmerror;
+}
+
+extern SDIOH_API_RC
+sdioh_cfg_read(sdioh_info_t *sd, uint fnc_num, uint32 addr, uint8 *data)
+{
+       SDIOH_API_RC status;
+       /* No lock needed since sdioh_request_byte does locking */
+       status = sdioh_request_byte(sd, SDIOH_READ, fnc_num, addr, data);
+       return status;
+}
+
+extern SDIOH_API_RC
+sdioh_cfg_write(sdioh_info_t *sd, uint fnc_num, uint32 addr, uint8 *data)
+{
+       /* No lock needed since sdioh_request_byte does locking */
+       SDIOH_API_RC status;
+
+       if ((fnc_num == SPI_FUNC_1) && (addr == SBSDIO_FUNC1_FRAMECTRL)) {
+               uint8 dummy_data;
+               status = sdioh_cfg_read(sd, fnc_num, addr, &dummy_data);
+               if (status) {
+                       sd_err(("sdioh_cfg_read() failed.\n"));
+                       return status;
+               }
+       }
+
+       status = sdioh_request_byte(sd, SDIOH_WRITE, fnc_num, addr, data);
+       return status;
+}
+
+extern SDIOH_API_RC
+sdioh_cis_read(sdioh_info_t *sd, uint func, uint8 *cisd, uint32 length)
+{
+       uint32 count;
+       int offset;
+       uint32 cis_byte;
+       uint16 *cis = (uint16 *)cisd;
+       uint bar0 = SI_ENUM_BASE;
+       int status;
+       uint8 data;
+
+       sd_trace(("%s: Func %d\n", __FUNCTION__, func));
+
+       spi_lock(sd);
+
+       /* Set sb window address to 0x18000000 */
+       data = (bar0 >> 8) & SBSDIO_SBADDRLOW_MASK;
+       status = bcmspi_card_bytewrite(sd, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRLOW, &data);
+       if (status == SUCCESS) {
+               data = (bar0 >> 16) & SBSDIO_SBADDRMID_MASK;
+               status = bcmspi_card_bytewrite(sd, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRMID, &data);
+       } else {
+               sd_err(("%s: Unable to set sb-addr-windows\n", __FUNCTION__));
+               spi_unlock(sd);
+               return (BCME_ERROR);
+       }
+       if (status == SUCCESS) {
+               data = (bar0 >> 24) & SBSDIO_SBADDRHIGH_MASK;
+               status = bcmspi_card_bytewrite(sd, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRHIGH, &data);
+       } else {
+               sd_err(("%s: Unable to set sb-addr-windows\n", __FUNCTION__));
+               spi_unlock(sd);
+               return (BCME_ERROR);
+       }
+
+       offset =  CC_SROM_OTP; /* OTP offset in chipcommon. */
+       for (count = 0; count < length/2; count++) {
+               if (bcmspi_card_regread (sd, SDIO_FUNC_1, offset, 2, &cis_byte) < 0) {
+                       sd_err(("%s: regread failed: Can't read CIS\n", __FUNCTION__));
+                       spi_unlock(sd);
+                       return (BCME_ERROR);
+               }
+
+               *cis = (uint16)cis_byte;
+               cis++;
+               offset += 2;
+       }
+
+       spi_unlock(sd);
+
+       return (BCME_OK);
+}
+
+extern SDIOH_API_RC
+sdioh_request_byte(sdioh_info_t *sd, uint rw, uint func, uint regaddr, uint8 *byte)
+{
+       int status;
+       uint32 cmd_arg;
+       uint32 dstatus;
+       uint32 data = (uint32)(*byte);
+
+       spi_lock(sd);
+
+       cmd_arg = 0;
+       cmd_arg = SFIELD(cmd_arg, SPI_FUNCTION, func);
+       cmd_arg = SFIELD(cmd_arg, SPI_ACCESS, 1);       /* Incremental access */
+       cmd_arg = SFIELD(cmd_arg, SPI_REG_ADDR, regaddr);
+       cmd_arg = SFIELD(cmd_arg, SPI_RW_FLAG, rw == SDIOH_READ ? 0 : 1);
+       cmd_arg = SFIELD(cmd_arg, SPI_LEN, 1);
+
+       if (rw == SDIOH_READ) {
+               sd_trace(("%s: RD cmd_arg=0x%x func=%d regaddr=0x%x\n",
+                         __FUNCTION__, cmd_arg, func, regaddr));
+       } else {
+               sd_trace(("%s: WR cmd_arg=0x%x func=%d regaddr=0x%x data=0x%x\n",
+                         __FUNCTION__, cmd_arg, func, regaddr, data));
+       }
+
+       if ((status = bcmspi_cmd_issue(sd, sd->sd_use_dma, cmd_arg, &data, 1)) != SUCCESS) {
+               spi_unlock(sd);
+               return status;
+       }
+
+       if (rw == SDIOH_READ) {
+               *byte = (uint8)data;
+               sd_trace(("%s: RD result=0x%x\n", __FUNCTION__, *byte));
+       }
+
+       bcmspi_cmd_getdstatus(sd, &dstatus);
+       if (dstatus)
+               sd_trace(("dstatus=0x%x\n", dstatus));
+
+       spi_unlock(sd);
+       return SDIOH_API_RC_SUCCESS;
+}
+
+extern SDIOH_API_RC
+sdioh_request_word(sdioh_info_t *sd, uint cmd_type, uint rw, uint func, uint addr,
+                   uint32 *word, uint nbytes)
+{
+       int status;
+
+       spi_lock(sd);
+
+       if (rw == SDIOH_READ)
+               status = bcmspi_card_regread(sd, func, addr, nbytes, word);
+       else
+               status = bcmspi_card_regwrite(sd, func, addr, nbytes, *word);
+
+       spi_unlock(sd);
+       return (status == SUCCESS ?  SDIOH_API_RC_SUCCESS : SDIOH_API_RC_FAIL);
+}
+
+extern SDIOH_API_RC
+sdioh_request_buffer(sdioh_info_t *sd, uint pio_dma, uint fix_inc, uint rw, uint func,
+                     uint addr, uint reg_width, uint buflen_u, uint8 *buffer, void *pkt)
+{
+       int len;
+       int buflen = (int)buflen_u;
+       bool fifo = (fix_inc == SDIOH_DATA_FIX);
+
+       spi_lock(sd);
+
+       ASSERT(reg_width == 4);
+       ASSERT(buflen_u < (1 << 30));
+       ASSERT(sd->client_block_size[func]);
+
+       sd_data(("%s: %c len %d r_cnt %d t_cnt %d, pkt @0x%p\n",
+                __FUNCTION__, rw == SDIOH_READ ? 'R' : 'W',
+                buflen_u, sd->r_cnt, sd->t_cnt, pkt));
+
+       /* Break buffer down into blocksize chunks. */
+       while (buflen > 0) {
+               len = MIN(sd->client_block_size[func], buflen);
+               if (bcmspi_card_buf(sd, rw, func, fifo, addr, len, (uint32 *)buffer) != SUCCESS) {
+                       sd_err(("%s: bcmspi_card_buf %s failed\n",
+                               __FUNCTION__, rw == SDIOH_READ ? "Read" : "Write"));
+                       spi_unlock(sd);
+                       return SDIOH_API_RC_FAIL;
+               }
+               buffer += len;
+               buflen -= len;
+               if (!fifo)
+                       addr += len;
+       }
+       spi_unlock(sd);
+       return SDIOH_API_RC_SUCCESS;
+}
+
+/* This function allows write to gspi bus when another rd/wr function is deep down the call stack.
+ * Its main aim is to have simpler spi writes rather than recursive writes.
+ * e.g. When there is a need to program response delay on the fly after detecting the SPI-func
+ * this call will allow to program the response delay.
+ */
+static int
+bcmspi_card_byterewrite(sdioh_info_t *sd, int func, uint32 regaddr, uint8 byte)
+{
+       uint32 cmd_arg;
+       uint32 datalen = 1;
+       uint32 hostlen;
+
+       cmd_arg = 0;
+
+       cmd_arg = SFIELD(cmd_arg, SPI_RW_FLAG, 1);
+       cmd_arg = SFIELD(cmd_arg, SPI_ACCESS, 1);       /* Incremental access */
+       cmd_arg = SFIELD(cmd_arg, SPI_FUNCTION, func);
+       cmd_arg = SFIELD(cmd_arg, SPI_REG_ADDR, regaddr);
+       cmd_arg = SFIELD(cmd_arg, SPI_LEN, datalen);
+
+       sd_trace(("%s cmd_arg = 0x%x\n", __FUNCTION__, cmd_arg));
+
+
+       /* Set up and issue the SPI command.  MSByte goes out on bus first.  Increase datalen
+        * according to the wordlen mode(16/32bit) the device is in.
+        */
+       ASSERT(sd->wordlen == 4 || sd->wordlen == 2);
+       datalen = ROUNDUP(datalen, sd->wordlen);
+
+       /* Start by copying command in the spi-outbuffer */
+       if (sd->wordlen == 4) { /* 32bit spid */
+               *(uint32 *)spi_outbuf2 = SPISWAP_WD4(cmd_arg);
+               if (datalen & 0x3)
+                       datalen += (4 - (datalen & 0x3));
+       } else if (sd->wordlen == 2) { /* 16bit spid */
+               *(uint32 *)spi_outbuf2 = SPISWAP_WD2(cmd_arg);
+               if (datalen & 0x1)
+                       datalen++;
+       } else {
+               sd_err(("%s: Host is %d bit spid, could not create SPI command.\n",
+                       __FUNCTION__, 8 * sd->wordlen));
+               return ERROR;
+       }
+
+       /* for Write, put the data into the output buffer  */
+       if (datalen != 0) {
+                       if (sd->wordlen == 4) { /* 32bit spid */
+                               *(uint32 *)&spi_outbuf2[CMDLEN] = SPISWAP_WD4(byte);
+                       } else if (sd->wordlen == 2) { /* 16bit spid */
+                               *(uint32 *)&spi_outbuf2[CMDLEN] = SPISWAP_WD2(byte);
+                       }
+       }
+
+       /* +4 for cmd, +4 for dstatus */
+       hostlen = datalen + 8;
+       hostlen += (4 - (hostlen & 0x3));
+       spi_sendrecv(sd, spi_outbuf2, spi_inbuf2, hostlen);
+
+       /* Last 4bytes are dstatus.  Device is configured to return status bits. */
+       if (sd->wordlen == 4) { /* 32bit spid */
+               sd->card_dstatus = SPISWAP_WD4(*(uint32 *)&spi_inbuf2[datalen + CMDLEN ]);
+       } else if (sd->wordlen == 2) { /* 16bit spid */
+               sd->card_dstatus = SPISWAP_WD2(*(uint32 *)&spi_inbuf2[datalen + CMDLEN ]);
+       } else {
+               sd_err(("%s: Host is %d bit machine, could not read SPI dstatus.\n",
+                       __FUNCTION__, 8 * sd->wordlen));
+               return ERROR;
+       }
+
+       if (sd->card_dstatus)
+               sd_trace(("dstatus after byte rewrite = 0x%x\n", sd->card_dstatus));
+
+       return (BCME_OK);
+}
+
+/* Program the response delay corresponding to the spi function */
+static int
+bcmspi_prog_resp_delay(sdioh_info_t *sd, int func, uint8 resp_delay)
+{
+       if (sd->resp_delay_all == FALSE)
+               return (BCME_OK);
+
+       if (sd->prev_fun == func)
+               return (BCME_OK);
+
+       if (F0_RESPONSE_DELAY == F1_RESPONSE_DELAY)
+               return (BCME_OK);
+
+       bcmspi_card_byterewrite(sd, SPI_FUNC_0, SPID_RESPONSE_DELAY, resp_delay);
+
+       /* Remember function for which to avoid reprogramming resp-delay in next iteration */
+       sd->prev_fun = func;
+
+       return (BCME_OK);
+
+}
+
+#define GSPI_RESYNC_PATTERN    0x0
+
+/* A resync pattern is a 32bit MOSI line with all zeros. Its a special command in gSPI.
+ * It resets the spi-bkplane logic so that all F1 related ping-pong buffer logic is
+ * synchronised and all queued resuests are cancelled.
+ */
+static int
+bcmspi_resync_f1(sdioh_info_t *sd)
+{
+       uint32 cmd_arg = GSPI_RESYNC_PATTERN, data = 0, datalen = 0;
+
+
+       /* Set up and issue the SPI command.  MSByte goes out on bus first.  Increase datalen
+        * according to the wordlen mode(16/32bit) the device is in.
+        */
+       ASSERT(sd->wordlen == 4 || sd->wordlen == 2);
+       datalen = ROUNDUP(datalen, sd->wordlen);
+
+       /* Start by copying command in the spi-outbuffer */
+       *(uint32 *)spi_outbuf2 = cmd_arg;
+
+       /* for Write, put the data into the output buffer  */
+       *(uint32 *)&spi_outbuf2[CMDLEN] = data;
+
+       /* +4 for cmd, +4 for dstatus */
+       spi_sendrecv(sd, spi_outbuf2, spi_inbuf2, datalen + 8);
+
+       /* Last 4bytes are dstatus.  Device is configured to return status bits. */
+       if (sd->wordlen == 4) { /* 32bit spid */
+               sd->card_dstatus = SPISWAP_WD4(*(uint32 *)&spi_inbuf2[datalen + CMDLEN ]);
+       } else if (sd->wordlen == 2) { /* 16bit spid */
+               sd->card_dstatus = SPISWAP_WD2(*(uint32 *)&spi_inbuf2[datalen + CMDLEN ]);
+       } else {
+               sd_err(("%s: Host is %d bit machine, could not read SPI dstatus.\n",
+                       __FUNCTION__, 8 * sd->wordlen));
+               return ERROR;
+       }
+
+       if (sd->card_dstatus)
+               sd_trace(("dstatus after resync pattern write = 0x%x\n", sd->card_dstatus));
+
+       return (BCME_OK);
+}
+
+uint32 dstatus_count = 0;
+
+static int
+bcmspi_update_stats(sdioh_info_t *sd, uint32 cmd_arg)
+{
+       uint32 dstatus = sd->card_dstatus;
+       struct spierrstats_t *spierrstats = &sd->spierrstats;
+       int err = SUCCESS;
+
+       sd_trace(("cmd = 0x%x, dstatus = 0x%x\n", cmd_arg, dstatus));
+
+       /* Store dstatus of last few gSPI transactions */
+       spierrstats->dstatus[dstatus_count % NUM_PREV_TRANSACTIONS] = dstatus;
+       spierrstats->spicmd[dstatus_count % NUM_PREV_TRANSACTIONS] = cmd_arg;
+       dstatus_count++;
+
+       if (sd->card_init_done == FALSE)
+               return err;
+
+       if (dstatus & STATUS_DATA_NOT_AVAILABLE) {
+               spierrstats->dna++;
+               sd_trace(("Read data not available on F1 addr = 0x%x\n",
+                       GFIELD(cmd_arg, SPI_REG_ADDR)));
+               /* Clear dna bit */
+               bcmspi_card_byterewrite(sd, SPI_FUNC_0, SPID_INTR_REG, DATA_UNAVAILABLE);
+       }
+
+       if (dstatus & STATUS_UNDERFLOW) {
+               spierrstats->rdunderflow++;
+               sd_err(("FIFO underflow happened due to current F2 read command.\n"));
+       }
+
+       if (dstatus & STATUS_OVERFLOW) {
+               spierrstats->wroverflow++;
+               sd_err(("FIFO overflow happened due to current (F1/F2) write command.\n"));
+               bcmspi_card_byterewrite(sd, SPI_FUNC_0, SPID_INTR_REG, F1_OVERFLOW);
+               bcmspi_resync_f1(sd);
+               sd_err(("Recovering from F1 FIFO overflow.\n"));
+       }
+
+       if (dstatus & STATUS_F2_INTR) {
+               spierrstats->f2interrupt++;
+               sd_trace(("Interrupt from F2.  SW should clear corresponding IntStatus bits\n"));
+       }
+
+       if (dstatus & STATUS_F3_INTR) {
+               spierrstats->f3interrupt++;
+               sd_err(("Interrupt from F3.  SW should clear corresponding IntStatus bits\n"));
+       }
+
+       if (dstatus & STATUS_HOST_CMD_DATA_ERR) {
+               spierrstats->hostcmddataerr++;
+               sd_err(("Error in CMD or Host data, detected by CRC/Checksum (optional)\n"));
+       }
+
+       if (dstatus & STATUS_F2_PKT_AVAILABLE) {
+               spierrstats->f2pktavailable++;
+               sd_trace(("Packet is available/ready in F2 TX FIFO\n"));
+               sd_trace(("Packet length = %d\n", sd->dwordmode ?
+                        ((dstatus & STATUS_F2_PKT_LEN_MASK) >> (STATUS_F2_PKT_LEN_SHIFT - 2)) :
+                        ((dstatus & STATUS_F2_PKT_LEN_MASK) >> STATUS_F2_PKT_LEN_SHIFT)));
+       }
+
+       if (dstatus & STATUS_F3_PKT_AVAILABLE) {
+               spierrstats->f3pktavailable++;
+               sd_err(("Packet is available/ready in F3 TX FIFO\n"));
+               sd_err(("Packet length = %d\n",
+                       (dstatus & STATUS_F3_PKT_LEN_MASK) >> STATUS_F3_PKT_LEN_SHIFT));
+       }
+
+       return err;
+}
+
+extern int
+sdioh_abort(sdioh_info_t *sd, uint func)
+{
+       return 0;
+}
+
+int
+sdioh_start(sdioh_info_t *sd, int stage)
+{
+       return SUCCESS;
+}
+
+int
+sdioh_stop(sdioh_info_t *sd)
+{
+       return SUCCESS;
+}
+
+int
+sdioh_waitlockfree(sdioh_info_t *sd)
+{
+       return SUCCESS;
+}
+
+
+/*
+ * Private/Static work routines
+ */
+static int
+bcmspi_host_init(sdioh_info_t *sd)
+{
+
+       /* Default power on mode */
+       sd->sd_mode = SDIOH_MODE_SPI;
+       sd->polled_mode = TRUE;
+       sd->host_init_done = TRUE;
+       sd->card_init_done = FALSE;
+       sd->adapter_slot = 1;
+
+       return (SUCCESS);
+}
+
+static int
+get_client_blocksize(sdioh_info_t *sd)
+{
+       uint32 regdata[2];
+       int status;
+
+       /* Find F1/F2/F3 max packet size */
+       if ((status = bcmspi_card_regread(sd, 0, SPID_F1_INFO_REG,
+                                        8, regdata)) != SUCCESS) {
+               return status;
+       }
+
+       sd_trace(("pkt_size regdata[0] = 0x%x, regdata[1] = 0x%x\n",
+               regdata[0], regdata[1]));
+
+       sd->client_block_size[1] = (regdata[0] & F1_MAX_PKT_SIZE) >> 2;
+       sd_trace(("Func1 blocksize = %d\n", sd->client_block_size[1]));
+       ASSERT(sd->client_block_size[1] == BLOCK_SIZE_F1);
+
+       sd->client_block_size[2] = ((regdata[0] >> 16) & F2_MAX_PKT_SIZE) >> 2;
+       sd_trace(("Func2 blocksize = %d\n", sd->client_block_size[2]));
+       ASSERT(sd->client_block_size[2] == BLOCK_SIZE_F2);
+
+       sd->client_block_size[3] = (regdata[1] & F3_MAX_PKT_SIZE) >> 2;
+       sd_trace(("Func3 blocksize = %d\n", sd->client_block_size[3]));
+       ASSERT(sd->client_block_size[3] == BLOCK_SIZE_F3);
+
+       return 0;
+}
+
+static int
+bcmspi_client_init(sdioh_info_t *sd)
+{
+       uint32  status_en_reg = 0;
+       sd_trace(("%s: Powering up slot %d\n", __FUNCTION__, sd->adapter_slot));
+
+#ifdef HSMODE
+       if (!spi_start_clock(sd, (uint16)sd_divisor)) {
+               sd_err(("spi_start_clock failed\n"));
+               return ERROR;
+       }
+#else
+       /* Start at ~400KHz clock rate for initialization */
+       if (!spi_start_clock(sd, 128)) {
+               sd_err(("spi_start_clock failed\n"));
+               return ERROR;
+       }
+#endif /* HSMODE */
+
+       if (!bcmspi_host_device_init_adapt(sd)) {
+               sd_err(("bcmspi_host_device_init_adapt failed\n"));
+               return ERROR;
+       }
+
+       if (!bcmspi_test_card(sd)) {
+               sd_err(("bcmspi_test_card failed\n"));
+               return ERROR;
+       }
+
+       sd->num_funcs = SPI_MAX_IOFUNCS;
+
+       get_client_blocksize(sd);
+
+       /* Apply resync pattern cmd with all zeros to reset spi-bkplane F1 logic */
+       bcmspi_resync_f1(sd);
+
+       sd->dwordmode = FALSE;
+
+       bcmspi_card_regread(sd, 0, SPID_STATUS_ENABLE, 1, &status_en_reg);
+
+       sd_trace(("%s: Enabling interrupt with dstatus \n", __FUNCTION__));
+       status_en_reg |= INTR_WITH_STATUS;
+
+       if (bcmspi_card_regwrite(sd, SPI_FUNC_0, SPID_STATUS_ENABLE, 1,
+           status_en_reg & 0xff) != SUCCESS) {
+               sd_err(("%s: Unable to set response delay for all fun's.\n", __FUNCTION__));
+               return ERROR;
+       }
+
+#ifndef HSMODE
+       /* After configuring for High-Speed mode, set the desired clock rate. */
+       if (!spi_start_clock(sd, 4)) {
+               sd_err(("spi_start_clock failed\n"));
+               return ERROR;
+       }
+#endif /* HSMODE */
+
+       /* check to see if the response delay needs to be programmed properly */
+       {
+               uint32 f1_respdelay = 0;
+               bcmspi_card_regread(sd, 0, SPID_RESP_DELAY_F1, 1, &f1_respdelay);
+               if ((f1_respdelay == 0) || (f1_respdelay == 0xFF)) {
+                       /* older sdiodevice core and has no separte resp delay for each of */
+                       sd_err(("older corerev < 4 so use the same resp delay for all funcs\n"));
+                       sd->resp_delay_new = FALSE;
+               }
+               else {
+                       /* older sdiodevice core and has no separte resp delay for each of */
+                       int ret_val;
+                       sd->resp_delay_new = TRUE;
+                       sd_err(("new corerev >= 4 so set the resp delay for each of the funcs\n"));
+                       sd_trace(("resp delay for funcs f0(%d), f1(%d), f2(%d), f3(%d)\n",
+                               GSPI_F0_RESP_DELAY, GSPI_F1_RESP_DELAY,
+                               GSPI_F2_RESP_DELAY, GSPI_F3_RESP_DELAY));
+                       ret_val = bcmspi_card_regwrite(sd, SPI_FUNC_0, SPID_RESP_DELAY_F0, 1,
+                               GSPI_F0_RESP_DELAY);
+                       if (ret_val != SUCCESS) {
+                               sd_err(("%s: Unable to set response delay for F0\n", __FUNCTION__));
+                               return ERROR;
+                       }
+                       ret_val = bcmspi_card_regwrite(sd, SPI_FUNC_0, SPID_RESP_DELAY_F1, 1,
+                               GSPI_F1_RESP_DELAY);
+                       if (ret_val != SUCCESS) {
+                               sd_err(("%s: Unable to set response delay for F1\n", __FUNCTION__));
+                               return ERROR;
+                       }
+                       ret_val = bcmspi_card_regwrite(sd, SPI_FUNC_0, SPID_RESP_DELAY_F2, 1,
+                               GSPI_F2_RESP_DELAY);
+                       if (ret_val != SUCCESS) {
+                               sd_err(("%s: Unable to set response delay for F2\n", __FUNCTION__));
+                               return ERROR;
+                       }
+                       ret_val = bcmspi_card_regwrite(sd, SPI_FUNC_0, SPID_RESP_DELAY_F3, 1,
+                               GSPI_F3_RESP_DELAY);
+                       if (ret_val != SUCCESS) {
+                               sd_err(("%s: Unable to set response delay for F2\n", __FUNCTION__));
+                               return ERROR;
+                       }
+               }
+       }
+
+
+       sd->card_init_done = TRUE;
+
+       /* get the device rev to program the prop respdelays */
+
+       return SUCCESS;
+}
+
+static int
+bcmspi_set_highspeed_mode(sdioh_info_t *sd, bool hsmode)
+{
+       uint32 regdata;
+       int status;
+
+       if ((status = bcmspi_card_regread(sd, 0, SPID_CONFIG,
+                                        4, &regdata)) != SUCCESS)
+               return status;
+
+       sd_trace(("In %s spih-ctrl = 0x%x \n", __FUNCTION__, regdata));
+
+
+       if (hsmode == TRUE) {
+               sd_trace(("Attempting to enable High-Speed mode.\n"));
+
+               if (regdata & HIGH_SPEED_MODE) {
+                       sd_trace(("Device is already in High-Speed mode.\n"));
+                       return status;
+               } else {
+                       regdata |= HIGH_SPEED_MODE;
+                       sd_trace(("Writing %08x to device at %08x\n", regdata, SPID_CONFIG));
+                       if ((status = bcmspi_card_regwrite(sd, 0, SPID_CONFIG,
+                                                         4, regdata)) != SUCCESS) {
+                               return status;
+                       }
+               }
+       } else {
+               sd_trace(("Attempting to disable High-Speed mode.\n"));
+
+               if (regdata & HIGH_SPEED_MODE) {
+                       regdata &= ~HIGH_SPEED_MODE;
+                       sd_trace(("Writing %08x to device at %08x\n", regdata, SPID_CONFIG));
+                       if ((status = bcmspi_card_regwrite(sd, 0, SPID_CONFIG,
+                                                         4, regdata)) != SUCCESS)
+                               return status;
+               }
+                else {
+                       sd_trace(("Device is already in Low-Speed mode.\n"));
+                       return status;
+               }
+       }
+       spi_controller_highspeed_mode(sd, hsmode);
+
+       return TRUE;
+}
+
+#define bcmspi_find_curr_mode(sd) { \
+       sd->wordlen = 2; \
+       status = bcmspi_card_regread_fixedaddr(sd, 0, SPID_TEST_READ, 4, &regdata); \
+       regdata &= 0xff; \
+       if ((regdata == 0xad) || (regdata == 0x5b) || \
+           (regdata == 0x5d) || (regdata == 0x5a)) \
+               break; \
+       sd->wordlen = 4; \
+       status = bcmspi_card_regread_fixedaddr(sd, 0, SPID_TEST_READ, 4, &regdata); \
+       regdata &= 0xff; \
+       if ((regdata == 0xad) || (regdata == 0x5b) || \
+           (regdata == 0x5d) || (regdata == 0x5a)) \
+               break; \
+       sd_trace(("Silicon testability issue: regdata = 0x%x." \
+               " Expected 0xad, 0x5a, 0x5b or 0x5d.\n", regdata)); \
+       OSL_DELAY(100000); \
+}
+
+#define INIT_ADAPT_LOOP                100
+
+/* Adapt clock-phase-speed-bitwidth between host and device */
+static bool
+bcmspi_host_device_init_adapt(sdioh_info_t *sd)
+{
+       uint32 wrregdata, regdata = 0;
+       int status;
+       int i;
+
+       /* Due to a silicon testability issue, the first command from the Host
+        * to the device will get corrupted (first bit will be lost). So the
+        * Host should poll the device with a safe read request. ie: The Host
+        * should try to read F0 addr 0x14 using the Fixed address mode
+        * (This will prevent a unintended write command to be detected by device)
+        */
+       for (i = 0; i < INIT_ADAPT_LOOP; i++) {
+       /* If device was not power-cycled it will stay in 32bit mode with
+        * response-delay-all bit set.  Alternate the iteration so that
+        * read either with or without response-delay for F0 to succeed.
+        */
+               bcmspi_find_curr_mode(sd);
+               sd->resp_delay_all = (i & 0x1) ? TRUE : FALSE;
+
+               bcmspi_find_curr_mode(sd);
+               sd->dwordmode = TRUE;
+
+               bcmspi_find_curr_mode(sd);
+               sd->dwordmode = FALSE;
+       }
+
+       /* Bail out, device not detected */
+       if (i == INIT_ADAPT_LOOP)
+               return FALSE;
+
+       /* Softreset the spid logic */
+       if ((sd->dwordmode) || (sd->wordlen == 4)) {
+               bcmspi_card_regwrite(sd, 0, SPID_RESET_BP, 1, RESET_ON_WLAN_BP_RESET|RESET_SPI);
+               bcmspi_card_regread(sd, 0, SPID_RESET_BP, 1, &regdata);
+               sd_trace(("reset reg read = 0x%x\n", regdata));
+               sd_trace(("dwordmode = %d, wordlen = %d, resp_delay_all = %d\n", sd->dwordmode,
+                      sd->wordlen, sd->resp_delay_all));
+               /* Restore default state after softreset */
+               sd->wordlen = 2;
+               sd->dwordmode = FALSE;
+       }
+
+       if (sd->wordlen == 4) {
+               if ((status = bcmspi_card_regread(sd, 0, SPID_TEST_READ, 4, &regdata)) !=
+                    SUCCESS)
+                               return FALSE;
+               if (regdata == TEST_RO_DATA_32BIT_LE) {
+                       sd_trace(("Spid is already in 32bit LE mode. Value read = 0x%x\n",
+                                 regdata));
+                       sd_trace(("Spid power was left on.\n"));
+               } else {
+                       sd_err(("Spid power was left on but signature read failed."
+                               " Value read = 0x%x\n", regdata));
+                       return FALSE;
+               }
+       } else {
+               sd->wordlen = 2;
+
+#define CTRL_REG_DEFAULT       0x00010430 /* according to the host m/c */
+
+               wrregdata = (CTRL_REG_DEFAULT);
+
+               if ((status = bcmspi_card_regread(sd, 0, SPID_TEST_READ, 4, &regdata)) != SUCCESS)
+                       return FALSE;
+               sd_trace(("(we are still in 16bit mode) 32bit READ LE regdata = 0x%x\n", regdata));
+
+#ifndef HSMODE
+               wrregdata |= (CLOCK_PHASE | CLOCK_POLARITY);
+               wrregdata &= ~HIGH_SPEED_MODE;
+               bcmspi_card_regwrite(sd, 0, SPID_CONFIG, 4, wrregdata);
+#endif /* HSMODE */
+
+               for (i = 0; i < INIT_ADAPT_LOOP; i++) {
+                       if ((regdata == 0xfdda7d5b) || (regdata == 0xfdda7d5a)) {
+                               sd_trace(("0xfeedbead was leftshifted by 1-bit.\n"));
+                               if ((status = bcmspi_card_regread(sd, 0, SPID_TEST_READ, 4,
+                                    &regdata)) != SUCCESS)
+                                       return FALSE;
+                       }
+                       OSL_DELAY(1000);
+               }
+
+#if defined(CHANGE_SPI_INTR_POLARITY_ACTIVE_HIGH)
+               /* Change to host controller intr-polarity of active-high */
+               wrregdata |= INTR_POLARITY;
+#else
+               /* Change to host controller intr-polarity of active-low */
+               wrregdata &= ~INTR_POLARITY;
+#endif /* CHANGE_SPI_INTR_POLARITY_ACTIVE_HIGH */
+
+               sd_trace(("(we are still in 16bit mode) 32bit Write LE reg-ctrl-data = 0x%x\n",
+                       wrregdata));
+               /* Change to 32bit mode */
+               wrregdata |= WORD_LENGTH_32;
+               bcmspi_card_regwrite(sd, 0, SPID_CONFIG, 4, wrregdata);
+
+               /* Change command/data packaging in 32bit LE mode */
+               sd->wordlen = 4;
+
+               if ((status = bcmspi_card_regread(sd, 0, SPID_TEST_READ, 4, &regdata)) != SUCCESS)
+                       return FALSE;
+
+               if (regdata == TEST_RO_DATA_32BIT_LE) {
+                       sd_trace(("Read spid passed. Value read = 0x%x\n", regdata));
+                       sd_trace(("Spid had power-on cycle OR spi was soft-resetted \n"));
+               } else {
+                       sd_err(("Stale spid reg values read as it was kept powered. Value read ="
+                         "0x%x\n", regdata));
+                       return FALSE;
+               }
+       }
+
+
+       return TRUE;
+}
+
+static bool
+bcmspi_test_card(sdioh_info_t *sd)
+{
+       uint32 regdata;
+       int status;
+
+       if ((status = bcmspi_card_regread(sd, 0, SPID_TEST_READ, 4, &regdata)) != SUCCESS)
+               return FALSE;
+
+       if (regdata == (TEST_RO_DATA_32BIT_LE))
+               sd_trace(("32bit LE regdata = 0x%x\n", regdata));
+       else {
+               sd_trace(("Incorrect 32bit LE regdata = 0x%x\n", regdata));
+               return FALSE;
+       }
+
+
+#define RW_PATTERN1    0xA0A1A2A3
+#define RW_PATTERN2    0x4B5B6B7B
+
+       regdata = RW_PATTERN1;
+       if ((status = bcmspi_card_regwrite(sd, 0, SPID_TEST_RW, 4, regdata)) != SUCCESS)
+               return FALSE;
+       regdata = 0;
+       if ((status = bcmspi_card_regread(sd, 0, SPID_TEST_RW, 4, &regdata)) != SUCCESS)
+               return FALSE;
+       if (regdata != RW_PATTERN1) {
+               sd_err(("Write-Read spid failed. Value wrote = 0x%x, Value read = 0x%x\n",
+                       RW_PATTERN1, regdata));
+               return FALSE;
+       } else
+               sd_trace(("R/W spid passed. Value read = 0x%x\n", regdata));
+
+       regdata = RW_PATTERN2;
+       if ((status = bcmspi_card_regwrite(sd, 0, SPID_TEST_RW, 4, regdata)) != SUCCESS)
+               return FALSE;
+       regdata = 0;
+       if ((status = bcmspi_card_regread(sd, 0, SPID_TEST_RW, 4, &regdata)) != SUCCESS)
+               return FALSE;
+       if (regdata != RW_PATTERN2) {
+               sd_err(("Write-Read spid failed. Value wrote = 0x%x, Value read = 0x%x\n",
+                       RW_PATTERN2, regdata));
+               return FALSE;
+       } else
+               sd_trace(("R/W spid passed. Value read = 0x%x\n", regdata));
+
+       return TRUE;
+}
+
+static int
+bcmspi_driver_init(sdioh_info_t *sd)
+{
+       sd_trace(("%s\n", __FUNCTION__));
+       if ((bcmspi_host_init(sd)) != SUCCESS) {
+               return ERROR;
+       }
+
+       if (bcmspi_client_init(sd) != SUCCESS) {
+               return ERROR;
+       }
+
+       return SUCCESS;
+}
+
+/* Read device reg */
+static int
+bcmspi_card_regread(sdioh_info_t *sd, int func, uint32 regaddr, int regsize, uint32 *data)
+{
+       int status;
+       uint32 cmd_arg, dstatus;
+
+       ASSERT(regsize);
+
+       if (func == 2)
+               sd_trace(("Reg access on F2 will generate error indication in dstatus bits.\n"));
+
+       cmd_arg = 0;
+       cmd_arg = SFIELD(cmd_arg, SPI_RW_FLAG, 0);
+       cmd_arg = SFIELD(cmd_arg, SPI_ACCESS, 1);       /* Incremental access */
+       cmd_arg = SFIELD(cmd_arg, SPI_FUNCTION, func);
+       cmd_arg = SFIELD(cmd_arg, SPI_REG_ADDR, regaddr);
+       cmd_arg = SFIELD(cmd_arg, SPI_LEN, regsize == BLOCK_SIZE_F2 ? 0 : regsize);
+
+       sd_trace(("%s: RD cmd_arg=0x%x func=%d regaddr=0x%x regsize=%d\n",
+                 __FUNCTION__, cmd_arg, func, regaddr, regsize));
+
+       if ((status = bcmspi_cmd_issue(sd, sd->sd_use_dma, cmd_arg, data, regsize)) != SUCCESS)
+               return status;
+
+       bcmspi_cmd_getdstatus(sd, &dstatus);
+       if (dstatus)
+               sd_trace(("dstatus =0x%x\n", dstatus));
+
+       return SUCCESS;
+}
+
+static int
+bcmspi_card_regread_fixedaddr(sdioh_info_t *sd, int func, uint32 regaddr, int regsize, uint32 *data)
+{
+
+       int status;
+       uint32 cmd_arg;
+       uint32 dstatus;
+
+       ASSERT(regsize);
+
+       if (func == 2)
+               sd_trace(("Reg access on F2 will generate error indication in dstatus bits.\n"));
+
+       cmd_arg = 0;
+       cmd_arg = SFIELD(cmd_arg, SPI_RW_FLAG, 0);
+       cmd_arg = SFIELD(cmd_arg, SPI_ACCESS, 0);       /* Fixed access */
+       cmd_arg = SFIELD(cmd_arg, SPI_FUNCTION, func);
+       cmd_arg = SFIELD(cmd_arg, SPI_REG_ADDR, regaddr);
+       cmd_arg = SFIELD(cmd_arg, SPI_LEN, regsize);
+
+       sd_trace(("%s: RD cmd_arg=0x%x func=%d regaddr=0x%x regsize=%d\n",
+                 __FUNCTION__, cmd_arg, func, regaddr, regsize));
+
+       if ((status = bcmspi_cmd_issue(sd, sd->sd_use_dma, cmd_arg, data, regsize)) != SUCCESS)
+               return status;
+
+       sd_trace(("%s: RD result=0x%x\n", __FUNCTION__, *data));
+
+       bcmspi_cmd_getdstatus(sd, &dstatus);
+       sd_trace(("dstatus =0x%x\n", dstatus));
+       return SUCCESS;
+}
+
+/* write a device register */
+static int
+bcmspi_card_regwrite(sdioh_info_t *sd, int func, uint32 regaddr, int regsize, uint32 data)
+{
+       int status;
+       uint32 cmd_arg, dstatus;
+
+       ASSERT(regsize);
+
+       cmd_arg = 0;
+
+       cmd_arg = SFIELD(cmd_arg, SPI_RW_FLAG, 1);
+       cmd_arg = SFIELD(cmd_arg, SPI_ACCESS, 1);       /* Incremental access */
+       cmd_arg = SFIELD(cmd_arg, SPI_FUNCTION, func);
+       cmd_arg = SFIELD(cmd_arg, SPI_REG_ADDR, regaddr);
+       cmd_arg = SFIELD(cmd_arg, SPI_LEN, regsize == BLOCK_SIZE_F2 ? 0 : regsize);
+
+       sd_trace(("%s: WR cmd_arg=0x%x func=%d regaddr=0x%x regsize=%d data=0x%x\n",
+                 __FUNCTION__, cmd_arg, func, regaddr, regsize, data));
+
+       if ((status = bcmspi_cmd_issue(sd, sd->sd_use_dma, cmd_arg, &data, regsize)) != SUCCESS)
+               return status;
+
+       bcmspi_cmd_getdstatus(sd, &dstatus);
+       if (dstatus)
+               sd_trace(("dstatus=0x%x\n", dstatus));
+
+       return SUCCESS;
+}
+
+/* write a device register - 1 byte */
+static int
+bcmspi_card_bytewrite(sdioh_info_t *sd, int func, uint32 regaddr, uint8 *byte)
+{
+       int status;
+       uint32 cmd_arg;
+       uint32 dstatus;
+       uint32 data = (uint32)(*byte);
+
+       cmd_arg = 0;
+       cmd_arg = SFIELD(cmd_arg, SPI_FUNCTION, func);
+       cmd_arg = SFIELD(cmd_arg, SPI_ACCESS, 1);       /* Incremental access */
+       cmd_arg = SFIELD(cmd_arg, SPI_REG_ADDR, regaddr);
+       cmd_arg = SFIELD(cmd_arg, SPI_RW_FLAG, 1);
+       cmd_arg = SFIELD(cmd_arg, SPI_LEN, 1);
+
+       sd_trace(("%s: WR cmd_arg=0x%x func=%d regaddr=0x%x data=0x%x\n",
+                 __FUNCTION__, cmd_arg, func, regaddr, data));
+
+       if ((status = bcmspi_cmd_issue(sd, sd->sd_use_dma, cmd_arg, &data, 1)) != SUCCESS)
+               return status;
+
+       bcmspi_cmd_getdstatus(sd, &dstatus);
+       if (dstatus)
+               sd_trace(("dstatus =0x%x\n", dstatus));
+
+       return SUCCESS;
+}
+
+void
+bcmspi_cmd_getdstatus(sdioh_info_t *sd, uint32 *dstatus_buffer)
+{
+       *dstatus_buffer = sd->card_dstatus;
+}
+
+/* 'data' is of type uint32 whereas other buffers are of type uint8 */
+static int
+bcmspi_cmd_issue(sdioh_info_t *sd, bool use_dma, uint32 cmd_arg,
+                uint32 *data, uint32 datalen)
+{
+       uint32  i, j;
+       uint8   resp_delay = 0;
+       int     err = SUCCESS;
+       uint32  hostlen;
+       uint32 spilen = 0;
+       uint32 dstatus_idx = 0;
+       uint16 templen, buslen, len, *ptr = NULL;
+
+       sd_trace(("spi cmd = 0x%x\n", cmd_arg));
+
+       if (DWORDMODE_ON) {
+               spilen = GFIELD(cmd_arg, SPI_LEN);
+               if ((GFIELD(cmd_arg, SPI_FUNCTION) == SPI_FUNC_0) ||
+                   (GFIELD(cmd_arg, SPI_FUNCTION) == SPI_FUNC_1))
+                       dstatus_idx = spilen * 3;
+
+               if ((GFIELD(cmd_arg, SPI_FUNCTION) == SPI_FUNC_2) &&
+                   (GFIELD(cmd_arg, SPI_RW_FLAG) == 1)) {
+                       spilen = spilen << 2;
+                       dstatus_idx = (spilen % 16) ? (16 - (spilen % 16)) : 0;
+                       /* convert len to mod16 size */
+                       spilen = ROUNDUP(spilen, 16);
+                       cmd_arg = SFIELD(cmd_arg, SPI_LEN, (spilen >> 2));
+               }
+       }
+
+       /* Set up and issue the SPI command.  MSByte goes out on bus first.  Increase datalen
+        * according to the wordlen mode(16/32bit) the device is in.
+        */
+       if (sd->wordlen == 4) { /* 32bit spid */
+               *(uint32 *)spi_outbuf = SPISWAP_WD4(cmd_arg);
+               if (datalen & 0x3)
+                       datalen += (4 - (datalen & 0x3));
+       } else if (sd->wordlen == 2) { /* 16bit spid */
+               *(uint32 *)spi_outbuf = SPISWAP_WD2(cmd_arg);
+               if (datalen & 0x1)
+                       datalen++;
+               if (datalen < 4)
+                       datalen = ROUNDUP(datalen, 4);
+       } else {
+               sd_err(("Host is %d bit spid, could not create SPI command.\n",
+                       8 * sd->wordlen));
+               return ERROR;
+       }
+
+       /* for Write, put the data into the output buffer */
+       if (GFIELD(cmd_arg, SPI_RW_FLAG) == 1) {
+               /* We send len field of hw-header always a mod16 size, both from host and dongle */
+               if (DWORDMODE_ON) {
+                       if (GFIELD(cmd_arg, SPI_FUNCTION) == SPI_FUNC_2) {
+                               ptr = (uint16 *)&data[0];
+                               templen = *ptr;
+                               /* ASSERT(*ptr == ~*(ptr + 1)); */
+                               templen = ROUNDUP(templen, 16);
+                               *ptr = templen;
+                               sd_trace(("actual tx len = %d\n", (uint16)(~*(ptr+1))));
+                       }
+               }
+
+               if (datalen != 0) {
+                       for (i = 0; i < datalen/4; i++) {
+                               if (sd->wordlen == 4) { /* 32bit spid */
+                                       *(uint32 *)&spi_outbuf[i * 4 + CMDLEN] =
+                                               SPISWAP_WD4(data[i]);
+                               } else if (sd->wordlen == 2) { /* 16bit spid */
+                                       *(uint32 *)&spi_outbuf[i * 4 + CMDLEN] =
+                                               SPISWAP_WD2(data[i]);
+                               }
+                       }
+               }
+       }
+
+       /* Append resp-delay number of bytes and clock them out for F0/1/2 reads. */
+       if ((GFIELD(cmd_arg, SPI_RW_FLAG) == 0)) {
+               int func = GFIELD(cmd_arg, SPI_FUNCTION);
+               switch (func) {
+                       case 0:
+                               if (sd->resp_delay_new)
+                                       resp_delay = GSPI_F0_RESP_DELAY;
+                               else
+                                       resp_delay = sd->resp_delay_all ? F0_RESPONSE_DELAY : 0;
+                               break;
+                       case 1:
+                               if (sd->resp_delay_new)
+                                       resp_delay = GSPI_F1_RESP_DELAY;
+                               else
+                                       resp_delay = F1_RESPONSE_DELAY;
+                               break;
+                       case 2:
+                               if (sd->resp_delay_new)
+                                       resp_delay = GSPI_F2_RESP_DELAY;
+                               else
+                                       resp_delay = sd->resp_delay_all ? F2_RESPONSE_DELAY : 0;
+                               break;
+                       default:
+                               ASSERT(0);
+                               break;
+               }
+               /* Program response delay */
+               if (sd->resp_delay_new == FALSE)
+                       bcmspi_prog_resp_delay(sd, func, resp_delay);
+       }
+
+       /* +4 for cmd and +4 for dstatus */
+       hostlen = datalen + 8 + resp_delay;
+       hostlen += dstatus_idx;
+       hostlen += (4 - (hostlen & 0x3));
+       spi_sendrecv(sd, spi_outbuf, spi_inbuf, hostlen);
+
+       /* for Read, get the data into the input buffer */
+       if (datalen != 0) {
+               if (GFIELD(cmd_arg, SPI_RW_FLAG) == 0) { /* if read cmd */
+                       for (j = 0; j < datalen/4; j++) {
+                               if (sd->wordlen == 4) { /* 32bit spid */
+                                       data[j] = SPISWAP_WD4(*(uint32 *)&spi_inbuf[j * 4 +
+                                                   CMDLEN + resp_delay]);
+                               } else if (sd->wordlen == 2) { /* 16bit spid */
+                                       data[j] = SPISWAP_WD2(*(uint32 *)&spi_inbuf[j * 4 +
+                                                   CMDLEN + resp_delay]);
+                               }
+                       }
+
+                       if ((DWORDMODE_ON) && (GFIELD(cmd_arg, SPI_FUNCTION) == SPI_FUNC_2)) {
+                               ptr = (uint16 *)&data[0];
+                               templen = *ptr;
+                               buslen = len = ~(*(ptr + 1));
+                               buslen = ROUNDUP(buslen, 16);
+                               /* populate actual len in hw-header */
+                               if (templen == buslen)
+                                       *ptr = len;
+                       }
+               }
+       }
+
+       /* Restore back the len field of the hw header */
+       if (DWORDMODE_ON) {
+               if ((GFIELD(cmd_arg, SPI_FUNCTION) == SPI_FUNC_2) &&
+                   (GFIELD(cmd_arg, SPI_RW_FLAG) == 1)) {
+                       ptr = (uint16 *)&data[0];
+                       *ptr = (uint16)(~*(ptr+1));
+               }
+       }
+
+       dstatus_idx += (datalen + CMDLEN + resp_delay);
+       /* Last 4bytes are dstatus.  Device is configured to return status bits. */
+       if (sd->wordlen == 4) { /* 32bit spid */
+               sd->card_dstatus = SPISWAP_WD4(*(uint32 *)&spi_inbuf[dstatus_idx]);
+       } else if (sd->wordlen == 2) { /* 16bit spid */
+               sd->card_dstatus = SPISWAP_WD2(*(uint32 *)&spi_inbuf[dstatus_idx]);
+       } else {
+               sd_err(("Host is %d bit machine, could not read SPI dstatus.\n",
+                       8 * sd->wordlen));
+               return ERROR;
+       }
+       if (sd->card_dstatus == 0xffffffff) {
+               sd_err(("looks like not a GSPI device or device is not powered.\n"));
+       }
+
+       err = bcmspi_update_stats(sd, cmd_arg);
+
+       return err;
+
+}
+
+static int
+bcmspi_card_buf(sdioh_info_t *sd, int rw, int func, bool fifo,
+                uint32 addr, int nbytes, uint32 *data)
+{
+       int status;
+       uint32 cmd_arg;
+       bool write = rw == SDIOH_READ ? 0 : 1;
+       uint retries = 0;
+
+       bool enable;
+       uint32  spilen;
+
+       cmd_arg = 0;
+
+       ASSERT(nbytes);
+       ASSERT(nbytes <= sd->client_block_size[func]);
+
+       if (write) sd->t_cnt++; else sd->r_cnt++;
+
+       if (func == 2) {
+               /* Frame len check limited by gSPI. */
+               if ((nbytes > 2000) && write) {
+                       sd_trace((">2KB write: F2 wr of %d bytes\n", nbytes));
+               }
+               /* ASSERT(nbytes <= 2048); Fix bigger len gspi issue and uncomment. */
+               /* If F2 fifo on device is not ready to receive data, don't do F2 transfer */
+               if (write) {
+                       uint32 dstatus;
+                       /* check F2 ready with cached one */
+                       bcmspi_cmd_getdstatus(sd, &dstatus);
+                       if ((dstatus & STATUS_F2_RX_READY) == 0) {
+                               retries = WAIT_F2RXFIFORDY;
+                               enable = 0;
+                               while (retries-- && !enable) {
+                                       OSL_DELAY(WAIT_F2RXFIFORDY_DELAY * 1000);
+                                       bcmspi_card_regread(sd, SPI_FUNC_0, SPID_STATUS_REG, 4,
+                                                          &dstatus);
+                                       if (dstatus & STATUS_F2_RX_READY)
+                                               enable = TRUE;
+                               }
+                               if (!enable) {
+                                       struct spierrstats_t *spierrstats = &sd->spierrstats;
+                                       spierrstats->f2rxnotready++;
+                                       sd_err(("F2 FIFO is not ready to receive data.\n"));
+                                       return ERROR;
+                               }
+                               sd_trace(("No of retries on F2 ready %d\n",
+                                       (WAIT_F2RXFIFORDY - retries)));
+                       }
+               }
+       }
+
+       /* F2 transfers happen on 0 addr */
+       addr = (func == 2) ? 0 : addr;
+
+       /* In pio mode buffer is read using fixed address fifo in func 1 */
+       if ((func == 1) && (fifo))
+               cmd_arg = SFIELD(cmd_arg, SPI_ACCESS, 0);
+       else
+               cmd_arg = SFIELD(cmd_arg, SPI_ACCESS, 1);
+
+       cmd_arg = SFIELD(cmd_arg, SPI_FUNCTION, func);
+       cmd_arg = SFIELD(cmd_arg, SPI_REG_ADDR, addr);
+       cmd_arg = SFIELD(cmd_arg, SPI_RW_FLAG, write);
+       spilen = sd->data_xfer_count = MIN(sd->client_block_size[func], nbytes);
+       if ((sd->dwordmode == TRUE) && (GFIELD(cmd_arg, SPI_FUNCTION) == SPI_FUNC_2)) {
+               /* convert len to mod4 size */
+               spilen = spilen + ((spilen & 0x3) ? (4 - (spilen & 0x3)): 0);
+               cmd_arg = SFIELD(cmd_arg, SPI_LEN, (spilen >> 2));
+       } else
+               cmd_arg = SFIELD(cmd_arg, SPI_LEN, spilen);
+
+       if ((func == 2) && (fifo == 1)) {
+               sd_data(("%s: %s func %d, %s, addr 0x%x, len %d bytes, r_cnt %d t_cnt %d\n",
+                         __FUNCTION__, write ? "Wr" : "Rd", func, "INCR",
+                         addr, nbytes, sd->r_cnt, sd->t_cnt));
+       }
+
+       sd_trace(("%s cmd_arg = 0x%x\n", __FUNCTION__, cmd_arg));
+       sd_data(("%s: %s func %d, %s, addr 0x%x, len %d bytes, r_cnt %d t_cnt %d\n",
+                __FUNCTION__, write ? "Wd" : "Rd", func, "INCR",
+                addr, nbytes, sd->r_cnt, sd->t_cnt));
+
+
+       if ((status = bcmspi_cmd_issue(sd, sd->sd_use_dma, cmd_arg, data, nbytes)) != SUCCESS) {
+               sd_err(("%s: cmd_issue failed for %s\n", __FUNCTION__,
+                       (write ? "write" : "read")));
+               return status;
+       }
+
+       /* gSPI expects that hw-header-len is equal to spi-command-len */
+       if ((func == 2) && (rw == SDIOH_WRITE) && (sd->dwordmode == FALSE)) {
+               ASSERT((uint16)sd->data_xfer_count == (uint16)(*data & 0xffff));
+               ASSERT((uint16)sd->data_xfer_count == (uint16)(~((*data & 0xffff0000) >> 16)));
+       }
+
+       if ((nbytes > 2000) && !write) {
+               sd_trace((">2KB read: F2 rd of %d bytes\n", nbytes));
+       }
+
+       return SUCCESS;
+}
+
+/* Reset and re-initialize the device */
+int
+sdioh_sdio_reset(sdioh_info_t *si)
+{
+       si->card_init_done = FALSE;
+       return bcmspi_client_init(si);
+}
+
+SDIOH_API_RC
+sdioh_gpioouten(sdioh_info_t *sd, uint32 gpio)
+{
+       return SDIOH_API_RC_FAIL;
+}
+
+SDIOH_API_RC
+sdioh_gpioout(sdioh_info_t *sd, uint32 gpio, bool enab)
+{
+       return SDIOH_API_RC_FAIL;
+}
+
+bool
+sdioh_gpioin(sdioh_info_t *sd, uint32 gpio)
+{
+       return FALSE;
+}
+
+SDIOH_API_RC
+sdioh_gpio_init(sdioh_info_t *sd)
+{
+       return SDIOH_API_RC_FAIL;
+}
diff --git a/drivers/net/wireless/bcmdhd_1363/bcmutils.c b/drivers/net/wireless/bcmdhd_1363/bcmutils.c
new file mode 100644 (file)
index 0000000..8f5a154
--- /dev/null
@@ -0,0 +1,3581 @@
+/*
+ * Driver O/S-independent utility routines
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmutils.c 665091 2017-05-19 06:11:53Z $
+ */
+
+#include <bcm_cfg.h>
+#include <typedefs.h>
+#include <bcmdefs.h>
+#include <stdarg.h>
+#ifdef BCMDRIVER
+
+#include <osl.h>
+#include <bcmutils.h>
+
+#else /* !BCMDRIVER */
+
+#include <stdio.h>
+#include <string.h>
+#include <bcmutils.h>
+
+#if defined(BCMEXTSUP)
+#include <bcm_osl.h>
+#endif
+
+#ifndef ASSERT
+#define ASSERT(exp)
+#endif
+
+#endif /* !BCMDRIVER */
+
+#include <bcmendian.h>
+#include <bcmdevs.h>
+#include <proto/ethernet.h>
+#include <proto/vlan.h>
+#include <proto/bcmip.h>
+#include <proto/802.1d.h>
+#include <proto/802.11.h>
+
+
+void *_bcmutils_dummy_fn = NULL;
+
+
+
+
+#ifdef BCMDRIVER
+
+
+
+/* copy a pkt buffer chain into a buffer */
+uint
+pktcopy(osl_t *osh, void *p, uint offset, int len, uchar *buf)
+{
+       uint n, ret = 0;
+
+       if (len < 0)
+               len = 4096;     /* "infinite" */
+
+       /* skip 'offset' bytes */
+       for (; p && offset; p = PKTNEXT(osh, p)) {
+               if (offset < (uint)PKTLEN(osh, p))
+                       break;
+               offset -= PKTLEN(osh, p);
+       }
+
+       if (!p)
+               return 0;
+
+       /* copy the data */
+       for (; p && len; p = PKTNEXT(osh, p)) {
+               n = MIN((uint)PKTLEN(osh, p) - offset, (uint)len);
+               bcopy(PKTDATA(osh, p) + offset, buf, n);
+               buf += n;
+               len -= n;
+               ret += n;
+               offset = 0;
+       }
+
+       return ret;
+}
+
+/* copy a buffer into a pkt buffer chain */
+uint
+pktfrombuf(osl_t *osh, void *p, uint offset, int len, uchar *buf)
+{
+       uint n, ret = 0;
+
+
+       /* skip 'offset' bytes */
+       for (; p && offset; p = PKTNEXT(osh, p)) {
+               if (offset < (uint)PKTLEN(osh, p))
+                       break;
+               offset -= PKTLEN(osh, p);
+       }
+
+       if (!p)
+               return 0;
+
+       /* copy the data */
+       for (; p && len; p = PKTNEXT(osh, p)) {
+               n = MIN((uint)PKTLEN(osh, p) - offset, (uint)len);
+               bcopy(buf, PKTDATA(osh, p) + offset, n);
+               buf += n;
+               len -= n;
+               ret += n;
+               offset = 0;
+       }
+
+       return ret;
+}
+
+
+
+/* return total length of buffer chain */
+uint BCMFASTPATH
+pkttotlen(osl_t *osh, void *p)
+{
+       uint total;
+       int len;
+
+       total = 0;
+       for (; p; p = PKTNEXT(osh, p)) {
+               len = PKTLEN(osh, p);
+               total += len;
+#ifdef BCMLFRAG
+               if (BCMLFRAG_ENAB()) {
+                       if (PKTISFRAG(osh, p)) {
+                               total += PKTFRAGTOTLEN(osh, p);
+                       }
+               }
+#endif
+       }
+
+       return (total);
+}
+
+/* return the last buffer of chained pkt */
+void *
+pktlast(osl_t *osh, void *p)
+{
+       for (; PKTNEXT(osh, p); p = PKTNEXT(osh, p))
+               ;
+
+       return (p);
+}
+
+/* count segments of a chained packet */
+uint BCMFASTPATH
+pktsegcnt(osl_t *osh, void *p)
+{
+       uint cnt;
+
+       for (cnt = 0; p; p = PKTNEXT(osh, p)) {
+               cnt++;
+#ifdef BCMLFRAG
+               if (BCMLFRAG_ENAB()) {
+                       if (PKTISFRAG(osh, p)) {
+                               cnt += PKTFRAGTOTNUM(osh, p);
+                       }
+               }
+#endif
+       }
+
+       return cnt;
+}
+
+
+/* count segments of a chained packet */
+uint BCMFASTPATH
+pktsegcnt_war(osl_t *osh, void *p)
+{
+       uint cnt;
+       uint8 *pktdata;
+       uint len, remain, align64;
+
+       for (cnt = 0; p; p = PKTNEXT(osh, p)) {
+               cnt++;
+               len = PKTLEN(osh, p);
+               if (len > 128) {
+                       pktdata = (uint8 *)PKTDATA(osh, p);     /* starting address of data */
+                       /* Check for page boundary straddle (2048B) */
+                       if (((uintptr)pktdata & ~0x7ff) != ((uintptr)(pktdata+len) & ~0x7ff))
+                               cnt++;
+
+                       align64 = (uint)((uintptr)pktdata & 0x3f);      /* aligned to 64B */
+                       align64 = (64 - align64) & 0x3f;
+                       len -= align64;         /* bytes from aligned 64B to end */
+                       /* if aligned to 128B, check for MOD 128 between 1 to 4B */
+                       remain = len % 128;
+                       if (remain > 0 && remain <= 4)
+                               cnt++;          /* add extra seg */
+               }
+       }
+
+       return cnt;
+}
+
+uint8 * BCMFASTPATH
+pktdataoffset(osl_t *osh, void *p,  uint offset)
+{
+       uint total = pkttotlen(osh, p);
+       uint pkt_off = 0, len = 0;
+       uint8 *pdata = (uint8 *) PKTDATA(osh, p);
+
+       if (offset > total)
+               return NULL;
+
+       for (; p; p = PKTNEXT(osh, p)) {
+               pdata = (uint8 *) PKTDATA(osh, p);
+               pkt_off = offset - len;
+               len += PKTLEN(osh, p);
+               if (len > offset)
+                       break;
+       }
+       return (uint8*) (pdata+pkt_off);
+}
+
+
+/* given a offset in pdata, find the pkt seg hdr */
+void *
+pktoffset(osl_t *osh, void *p,  uint offset)
+{
+       uint total = pkttotlen(osh, p);
+       uint len = 0;
+
+       if (offset > total)
+               return NULL;
+
+       for (; p; p = PKTNEXT(osh, p)) {
+               len += PKTLEN(osh, p);
+               if (len > offset)
+                       break;
+       }
+       return p;
+}
+
+#endif /* BCMDRIVER */
+
+#if !defined(BCMROMOFFLOAD_EXCLUDE_BCMUTILS_FUNCS)
+const unsigned char bcm_ctype[] = {
+
+       _BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,                        /* 0-7 */
+       _BCM_C, _BCM_C|_BCM_S, _BCM_C|_BCM_S, _BCM_C|_BCM_S, _BCM_C|_BCM_S, _BCM_C|_BCM_S, _BCM_C,
+       _BCM_C, /* 8-15 */
+       _BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,                        /* 16-23 */
+       _BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,                        /* 24-31 */
+       _BCM_S|_BCM_SP,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,                /* 32-39 */
+       _BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,                        /* 40-47 */
+       _BCM_D,_BCM_D,_BCM_D,_BCM_D,_BCM_D,_BCM_D,_BCM_D,_BCM_D,                        /* 48-55 */
+       _BCM_D,_BCM_D,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,                        /* 56-63 */
+       _BCM_P, _BCM_U|_BCM_X, _BCM_U|_BCM_X, _BCM_U|_BCM_X, _BCM_U|_BCM_X, _BCM_U|_BCM_X,
+       _BCM_U|_BCM_X, _BCM_U, /* 64-71 */
+       _BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,                        /* 72-79 */
+       _BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,                        /* 80-87 */
+       _BCM_U,_BCM_U,_BCM_U,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,                        /* 88-95 */
+       _BCM_P, _BCM_L|_BCM_X, _BCM_L|_BCM_X, _BCM_L|_BCM_X, _BCM_L|_BCM_X, _BCM_L|_BCM_X,
+       _BCM_L|_BCM_X, _BCM_L, /* 96-103 */
+       _BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L, /* 104-111 */
+       _BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L, /* 112-119 */
+       _BCM_L,_BCM_L,_BCM_L,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_C, /* 120-127 */
+       0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,         /* 128-143 */
+       0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,         /* 144-159 */
+       _BCM_S|_BCM_SP, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P,
+       _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, /* 160-175 */
+       _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P,
+       _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, /* 176-191 */
+       _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U,
+       _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, /* 192-207 */
+       _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_P, _BCM_U, _BCM_U, _BCM_U,
+       _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_L, /* 208-223 */
+       _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L,
+       _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, /* 224-239 */
+       _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_P, _BCM_L, _BCM_L, _BCM_L,
+       _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L /* 240-255 */
+};
+
+ulong
+bcm_strtoul(const char *cp, char **endp, uint base)
+{
+       ulong result, last_result = 0, value;
+       bool minus;
+
+       minus = FALSE;
+
+       while (bcm_isspace(*cp))
+               cp++;
+
+       if (cp[0] == '+')
+               cp++;
+       else if (cp[0] == '-') {
+               minus = TRUE;
+               cp++;
+       }
+
+       if (base == 0) {
+               if (cp[0] == '0') {
+                       if ((cp[1] == 'x') || (cp[1] == 'X')) {
+                               base = 16;
+                               cp = &cp[2];
+                       } else {
+                               base = 8;
+                               cp = &cp[1];
+                       }
+               } else
+                       base = 10;
+       } else if (base == 16 && (cp[0] == '0') && ((cp[1] == 'x') || (cp[1] == 'X'))) {
+               cp = &cp[2];
+       }
+
+       result = 0;
+
+       while (bcm_isxdigit(*cp) &&
+              (value = bcm_isdigit(*cp) ? *cp-'0' : bcm_toupper(*cp)-'A'+10) < base) {
+               result = result*base + value;
+               /* Detected overflow */
+               if (result < last_result && !minus)
+                       return (ulong)-1;
+               last_result = result;
+               cp++;
+       }
+
+       if (minus)
+               result = (ulong)(-(long)result);
+
+       if (endp)
+               *endp = DISCARD_QUAL(cp, char);
+       return (result);
+}
+int
+bcm_atoi(const char *s)
+{
+       return (int)bcm_strtoul(s, NULL, 10);
+}
+
+/* return pointer to location of substring 'needle' in 'haystack' */
+char *
+bcmstrstr(const char *haystack, const char *needle)
+{
+       int len, nlen;
+       int i;
+
+       if ((haystack == NULL) || (needle == NULL))
+               return DISCARD_QUAL(haystack, char);
+
+       nlen = (int)strlen(needle);
+       len = (int)strlen(haystack) - nlen + 1;
+
+       for (i = 0; i < len; i++)
+               if (memcmp(needle, &haystack[i], nlen) == 0)
+                       return DISCARD_QUAL(&haystack[i], char);
+       return (NULL);
+}
+
+char *
+bcmstrnstr(const char *s, uint s_len, const char *substr, uint substr_len)
+{
+       for (; s_len >= substr_len; s++, s_len--)
+               if (strncmp(s, substr, substr_len) == 0)
+                       return DISCARD_QUAL(s, char);
+
+       return NULL;
+}
+
+char *
+bcmstrcat(char *dest, const char *src)
+{
+       char *p;
+
+       p = dest + strlen(dest);
+
+       while ((*p++ = *src++) != '\0')
+               ;
+
+       return (dest);
+}
+
+char *
+bcmstrncat(char *dest, const char *src, uint size)
+{
+       char *endp;
+       char *p;
+
+       p = dest + strlen(dest);
+       endp = p + size;
+
+       while (p != endp && (*p++ = *src++) != '\0')
+               ;
+
+       return (dest);
+}
+
+
+/****************************************************************************
+* Function:   bcmstrtok
+*
+* Purpose:
+*  Tokenizes a string. This function is conceptually similiar to ANSI C strtok(),
+*  but allows strToken() to be used by different strings or callers at the same
+*  time. Each call modifies '*string' by substituting a NULL character for the
+*  first delimiter that is encountered, and updates 'string' to point to the char
+*  after the delimiter. Leading delimiters are skipped.
+*
+* Parameters:
+*  string      (mod) Ptr to string ptr, updated by token.
+*  delimiters  (in)  Set of delimiter characters.
+*  tokdelim    (out) Character that delimits the returned token. (May
+*                    be set to NULL if token delimiter is not required).
+*
+* Returns:  Pointer to the next token found. NULL when no more tokens are found.
+*****************************************************************************
+*/
+char *
+bcmstrtok(char **string, const char *delimiters, char *tokdelim)
+{
+       unsigned char *str;
+       unsigned long map[8];
+       int count;
+       char *nextoken;
+
+       if (tokdelim != NULL) {
+               /* Prime the token delimiter */
+               *tokdelim = '\0';
+       }
+
+       /* Clear control map */
+       for (count = 0; count < 8; count++) {
+               map[count] = 0;
+       }
+
+       /* Set bits in delimiter table */
+       do {
+               map[*delimiters >> 5] |= (1 << (*delimiters & 31));
+       }
+       while (*delimiters++);
+
+       str = (unsigned char*)*string;
+
+       /* Find beginning of token (skip over leading delimiters). Note that
+        * there is no token iff this loop sets str to point to the terminal
+        * null (*str == '\0')
+        */
+       while (((map[*str >> 5] & (1 << (*str & 31))) && *str) || (*str == ' ')) {
+               str++;
+       }
+
+       nextoken = (char*)str;
+
+       /* Find the end of the token. If it is not the end of the string,
+        * put a null there.
+        */
+       for (; *str; str++) {
+               if (map[*str >> 5] & (1 << (*str & 31))) {
+                       if (tokdelim != NULL) {
+                               *tokdelim = *str;
+                       }
+
+                       *str++ = '\0';
+                       break;
+               }
+       }
+
+       *string = (char*)str;
+
+       /* Determine if a token has been found. */
+       if (nextoken == (char *) str) {
+               return NULL;
+       }
+       else {
+               return nextoken;
+       }
+}
+
+
+#define xToLower(C) \
+       ((C >= 'A' && C <= 'Z') ? (char)((int)C - (int)'A' + (int)'a') : C)
+
+
+/****************************************************************************
+* Function:   bcmstricmp
+*
+* Purpose:    Compare to strings case insensitively.
+*
+* Parameters: s1 (in) First string to compare.
+*             s2 (in) Second string to compare.
+*
+* Returns:    Return 0 if the two strings are equal, -1 if t1 < t2 and 1 if
+*             t1 > t2, when ignoring case sensitivity.
+*****************************************************************************
+*/
+int
+bcmstricmp(const char *s1, const char *s2)
+{
+       char dc, sc;
+
+       while (*s2 && *s1) {
+               dc = xToLower(*s1);
+               sc = xToLower(*s2);
+               if (dc < sc) return -1;
+               if (dc > sc) return 1;
+               s1++;
+               s2++;
+       }
+
+       if (*s1 && !*s2) return 1;
+       if (!*s1 && *s2) return -1;
+       return 0;
+}
+
+
+/****************************************************************************
+* Function:   bcmstrnicmp
+*
+* Purpose:    Compare to strings case insensitively, upto a max of 'cnt'
+*             characters.
+*
+* Parameters: s1  (in) First string to compare.
+*             s2  (in) Second string to compare.
+*             cnt (in) Max characters to compare.
+*
+* Returns:    Return 0 if the two strings are equal, -1 if t1 < t2 and 1 if
+*             t1 > t2, when ignoring case sensitivity.
+*****************************************************************************
+*/
+int
+bcmstrnicmp(const char* s1, const char* s2, int cnt)
+{
+       char dc, sc;
+
+       while (*s2 && *s1 && cnt) {
+               dc = xToLower(*s1);
+               sc = xToLower(*s2);
+               if (dc < sc) return -1;
+               if (dc > sc) return 1;
+               s1++;
+               s2++;
+               cnt--;
+       }
+
+       if (!cnt) return 0;
+       if (*s1 && !*s2) return 1;
+       if (!*s1 && *s2) return -1;
+       return 0;
+}
+
+/* parse a xx:xx:xx:xx:xx:xx format ethernet address */
+int
+bcm_ether_atoe(const char *p, struct ether_addr *ea)
+{
+       int i = 0;
+       char *ep;
+
+       for (;;) {
+               ea->octet[i++] = (char) bcm_strtoul(p, &ep, 16);
+               p = ep;
+               if (!*p++ || i == 6)
+                       break;
+       }
+
+       return (i == 6);
+}
+
+int
+bcm_atoicrc(const char *p, int *crc)
+{
+       char *ep;
+
+       *crc = bcm_strtoul(p, &ep, 16);
+       p = ep;
+       if (!*p++)
+               return 0;
+       else
+               return -1;
+}
+
+char *Dates[] = { "Jan ", "Feb ", "Mar ", "Apr ", "May ", "Jun ", "Jul ", "Aug ",
+       "Sep ", "Oct ", "Nov ", "Dec ", 0 };
+
+void
+wipedates(const char *cp, int size)
+{
+       char **dp;
+       char *np;
+       char *ep;
+       for (dp = Dates; *dp; dp++) {
+               np = (void *)bcmstrnstr(cp, size, *dp, strlen(*dp));
+               if (np) {
+                       ep = np + strlen(np) + 1;
+                       ep += strlen(np);
+                       while (np < ep) {
+                               *np++ = 0;
+                       }
+               }
+       }
+}
+
+int
+bcm_atoipv4(const char *p, struct ipv4_addr *ip)
+{
+
+       int i = 0;
+       char *c;
+       for (;;) {
+               ip->addr[i++] = (uint8)bcm_strtoul(p, &c, 0);
+               if (*c++ != '.' || i == IPV4_ADDR_LEN)
+                       break;
+               p = c;
+       }
+       return (i == IPV4_ADDR_LEN);
+}
+#endif /* !BCMROMOFFLOAD_EXCLUDE_BCMUTILS_FUNCS */
+
+
+#if defined(CONFIG_USBRNDIS_RETAIL) || defined(NDIS_MINIPORT_DRIVER)
+/* registry routine buffer preparation utility functions:
+ * parameter order is like strncpy, but returns count
+ * of bytes copied. Minimum bytes copied is null char(1)/wchar(2)
+ */
+ulong
+wchar2ascii(char *abuf, ushort *wbuf, ushort wbuflen, ulong abuflen)
+{
+       ulong copyct = 1;
+       ushort i;
+
+       if (abuflen == 0)
+               return 0;
+
+       /* wbuflen is in bytes */
+       wbuflen /= sizeof(ushort);
+
+       for (i = 0; i < wbuflen; ++i) {
+               if (--abuflen == 0)
+                       break;
+               *abuf++ = (char) *wbuf++;
+               ++copyct;
+       }
+       *abuf = '\0';
+
+       return copyct;
+}
+#endif /* CONFIG_USBRNDIS_RETAIL || NDIS_MINIPORT_DRIVER */
+
+char *
+bcm_ether_ntoa(const struct ether_addr *ea, char *buf)
+{
+       static const char hex[] =
+         {
+                 '0', '1', '2', '3', '4', '5', '6', '7',
+                 '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'
+         };
+       const uint8 *octet = ea->octet;
+       char *p = buf;
+       int i;
+
+       for (i = 0; i < 6; i++, octet++) {
+               *p++ = hex[(*octet >> 4) & 0xf];
+               *p++ = hex[*octet & 0xf];
+               *p++ = ':';
+       }
+
+       *(p-1) = '\0';
+
+       return (buf);
+}
+
+char *
+bcm_ip_ntoa(struct ipv4_addr *ia, char *buf)
+{
+       snprintf(buf, 16, "%d.%d.%d.%d",
+                ia->addr[0], ia->addr[1], ia->addr[2], ia->addr[3]);
+       return (buf);
+}
+
+char *
+bcm_ipv6_ntoa(void *ipv6, char *buf)
+{
+       /* Implementing RFC 5952 Sections 4 + 5 */
+       /* Not thoroughly tested */
+       uint16 tmp[8];
+       uint16 *a = &tmp[0];
+       char *p = buf;
+       int i, i_max = -1, cnt = 0, cnt_max = 1;
+       uint8 *a4 = NULL;
+       memcpy((uint8 *)&tmp[0], (uint8 *)ipv6, IPV6_ADDR_LEN);
+
+       for (i = 0; i < IPV6_ADDR_LEN/2; i++) {
+               if (a[i]) {
+                       if (cnt > cnt_max) {
+                               cnt_max = cnt;
+                               i_max = i - cnt;
+                       }
+                       cnt = 0;
+               } else
+                       cnt++;
+       }
+       if (cnt > cnt_max) {
+               cnt_max = cnt;
+               i_max = i - cnt;
+       }
+       if (i_max == 0 &&
+               /* IPv4-translated: ::ffff:0:a.b.c.d */
+               ((cnt_max == 4 && a[4] == 0xffff && a[5] == 0) ||
+               /* IPv4-mapped: ::ffff:a.b.c.d */
+               (cnt_max == 5 && a[5] == 0xffff)))
+               a4 = (uint8*) (a + 6);
+
+       for (i = 0; i < IPV6_ADDR_LEN/2; i++) {
+               if ((uint8*) (a + i) == a4) {
+                       snprintf(p, 16, ":%u.%u.%u.%u", a4[0], a4[1], a4[2], a4[3]);
+                       break;
+               } else if (i == i_max) {
+                       *p++ = ':';
+                       i += cnt_max - 1;
+                       p[0] = ':';
+                       p[1] = '\0';
+               } else {
+                       if (i)
+                               *p++ = ':';
+                       p += snprintf(p, 8, "%x", ntoh16(a[i]));
+               }
+       }
+
+       return buf;
+}
+#ifdef BCMDRIVER
+
+void
+bcm_mdelay(uint ms)
+{
+       uint i;
+
+       for (i = 0; i < ms; i++) {
+               OSL_DELAY(1000);
+       }
+}
+
+
+
+
+
+#if defined(DHD_DEBUG)
+/* pretty hex print a pkt buffer chain */
+void
+prpkt(const char *msg, osl_t *osh, void *p0)
+{
+       void *p;
+
+       if (msg && (msg[0] != '\0'))
+               printf("%s:\n", msg);
+
+       for (p = p0; p; p = PKTNEXT(osh, p))
+               prhex(NULL, PKTDATA(osh, p), PKTLEN(osh, p));
+}
+#endif 
+
+/* Takes an Ethernet frame and sets out-of-bound PKTPRIO.
+ * Also updates the inplace vlan tag if requested.
+ * For debugging, it returns an indication of what it did.
+ */
+uint BCMFASTPATH
+pktsetprio(void *pkt, bool update_vtag)
+{
+       struct ether_header *eh;
+       struct ethervlan_header *evh;
+       uint8 *pktdata;
+       int priority = 0;
+       int rc = 0;
+
+       pktdata = (uint8 *)PKTDATA(OSH_NULL, pkt);
+       ASSERT(ISALIGNED((uintptr)pktdata, sizeof(uint16)));
+
+       eh = (struct ether_header *) pktdata;
+
+       if (eh->ether_type == hton16(ETHER_TYPE_8021Q)) {
+               uint16 vlan_tag;
+               int vlan_prio, dscp_prio = 0;
+
+               evh = (struct ethervlan_header *)eh;
+
+               vlan_tag = ntoh16(evh->vlan_tag);
+               vlan_prio = (int) (vlan_tag >> VLAN_PRI_SHIFT) & VLAN_PRI_MASK;
+
+               if ((evh->ether_type == hton16(ETHER_TYPE_IP)) ||
+                       (evh->ether_type == hton16(ETHER_TYPE_IPV6))) {
+                       uint8 *ip_body = pktdata + sizeof(struct ethervlan_header);
+                       uint8 tos_tc = IP_TOS46(ip_body);
+                       dscp_prio = (int)(tos_tc >> IPV4_TOS_PREC_SHIFT);
+               }
+
+               /* DSCP priority gets precedence over 802.1P (vlan tag) */
+               if (dscp_prio != 0) {
+                       priority = dscp_prio;
+                       rc |= PKTPRIO_VDSCP;
+               } else {
+                       priority = vlan_prio;
+                       rc |= PKTPRIO_VLAN;
+               }
+               /*
+                * If the DSCP priority is not the same as the VLAN priority,
+                * then overwrite the priority field in the vlan tag, with the
+                * DSCP priority value. This is required for Linux APs because
+                * the VLAN driver on Linux, overwrites the skb->priority field
+                * with the priority value in the vlan tag
+                */
+               if (update_vtag && (priority != vlan_prio)) {
+                       vlan_tag &= ~(VLAN_PRI_MASK << VLAN_PRI_SHIFT);
+                       vlan_tag |= (uint16)priority << VLAN_PRI_SHIFT;
+                       evh->vlan_tag = hton16(vlan_tag);
+                       rc |= PKTPRIO_UPD;
+               }
+#ifdef DHD_LOSSLESS_ROAMING
+       } else if (eh->ether_type == hton16(ETHER_TYPE_802_1X)) {
+               priority = PRIO_8021D_NC;
+               rc = PKTPRIO_DSCP;
+#endif /* DHD_LOSSLESS_ROAMING */
+       } else if ((eh->ether_type == hton16(ETHER_TYPE_IP)) ||
+               (eh->ether_type == hton16(ETHER_TYPE_IPV6))) {
+               uint8 *ip_body = pktdata + sizeof(struct ether_header);
+               uint8 tos_tc = IP_TOS46(ip_body);
+               uint8 dscp = tos_tc >> IPV4_TOS_DSCP_SHIFT;
+               switch (dscp) {
+               case DSCP_EF:
+                       priority = PRIO_8021D_VO;
+                       break;
+               case DSCP_AF31:
+               case DSCP_AF32:
+               case DSCP_AF33:
+                       priority = PRIO_8021D_CL;
+                       break;
+               case DSCP_AF21:
+               case DSCP_AF22:
+               case DSCP_AF23:
+               case DSCP_AF11:
+               case DSCP_AF12:
+               case DSCP_AF13:
+                       priority = PRIO_8021D_EE;
+                       break;
+               default:
+                       priority = (int)(tos_tc >> IPV4_TOS_PREC_SHIFT);
+                       break;
+               }
+
+               rc |= PKTPRIO_DSCP;
+       }
+
+       ASSERT(priority >= 0 && priority <= MAXPRIO);
+       PKTSETPRIO(pkt, priority);
+       return (rc | priority);
+}
+
+/* lookup user priority for specified DSCP */
+static uint8
+dscp2up(uint8 *up_table, uint8 dscp)
+{
+       uint8 user_priority = 255;
+
+       /* lookup up from table if parameters valid */
+       if (up_table != NULL && dscp < UP_TABLE_MAX) {
+               user_priority = up_table[dscp];
+       }
+
+       /* 255 is unused value so return up from dscp */
+       if (user_priority == 255) {
+               user_priority = dscp >> (IPV4_TOS_PREC_SHIFT - IPV4_TOS_DSCP_SHIFT);
+       }
+
+       return user_priority;
+}
+
+/* set user priority by QoS Map Set table (UP table), table size is UP_TABLE_MAX */
+uint BCMFASTPATH
+pktsetprio_qms(void *pkt, uint8* up_table, bool update_vtag)
+{
+       if (up_table) {
+               uint8 *pktdata;
+               uint pktlen;
+               uint8 dscp;
+               uint user_priority = 0;
+               uint rc = 0;
+
+               pktdata = (uint8 *)PKTDATA(OSH_NULL, pkt);
+               pktlen = PKTLEN(OSH_NULL, pkt);
+
+               if (pktgetdscp(pktdata, pktlen, &dscp)) {
+                       rc = PKTPRIO_DSCP;
+                       user_priority = dscp2up(up_table, dscp);
+                       PKTSETPRIO(pkt, user_priority);
+               }
+
+               return (rc | user_priority);
+       } else {
+               return pktsetprio(pkt, update_vtag);
+       }
+}
+
+/* Returns TRUE and DSCP if IP header found, FALSE otherwise.
+ */
+bool BCMFASTPATH
+pktgetdscp(uint8 *pktdata, uint pktlen, uint8 *dscp)
+{
+       struct ether_header *eh;
+       struct ethervlan_header *evh;
+       uint8 *ip_body;
+       bool rc = FALSE;
+
+       /* minimum length is ether header and IP header */
+       if (pktlen < sizeof(struct ether_header) + IPV4_MIN_HEADER_LEN)
+               return FALSE;
+
+       eh = (struct ether_header *) pktdata;
+
+       if (eh->ether_type == HTON16(ETHER_TYPE_IP)) {
+               ip_body = pktdata + sizeof(struct ether_header);
+               *dscp = IP_DSCP46(ip_body);
+               rc = TRUE;
+       }
+       else if (eh->ether_type == HTON16(ETHER_TYPE_8021Q)) {
+               evh = (struct ethervlan_header *)eh;
+
+               /* minimum length is ethervlan header and IP header */
+               if (pktlen >= sizeof(struct ethervlan_header) + IPV4_MIN_HEADER_LEN &&
+                       evh->ether_type == HTON16(ETHER_TYPE_IP)) {
+                       ip_body = pktdata + sizeof(struct ethervlan_header);
+                       *dscp = IP_DSCP46(ip_body);
+                       rc = TRUE;
+               }
+       }
+
+       return rc;
+}
+
+/* The 0.5KB string table is not removed by compiler even though it's unused */
+
+static char bcm_undeferrstr[32];
+static const char *bcmerrorstrtable[] = BCMERRSTRINGTABLE;
+
+/* Convert the error codes into related error strings  */
+const char *
+bcmerrorstr(int bcmerror)
+{
+       /* check if someone added a bcmerror code but forgot to add errorstring */
+       ASSERT(ABS(BCME_LAST) == (ARRAYSIZE(bcmerrorstrtable) - 1));
+
+       if (bcmerror > 0 || bcmerror < BCME_LAST) {
+               snprintf(bcm_undeferrstr, sizeof(bcm_undeferrstr), "Undefined error %d", bcmerror);
+               return bcm_undeferrstr;
+       }
+
+       ASSERT(strlen(bcmerrorstrtable[-bcmerror]) < BCME_STRLEN);
+
+       return bcmerrorstrtable[-bcmerror];
+}
+
+
+
+/* iovar table lookup */
+/* could mandate sorted tables and do a binary search */
+const bcm_iovar_t*
+bcm_iovar_lookup(const bcm_iovar_t *table, const char *name)
+{
+       const bcm_iovar_t *vi;
+       const char *lookup_name;
+
+       /* skip any ':' delimited option prefixes */
+       lookup_name = strrchr(name, ':');
+       if (lookup_name != NULL)
+               lookup_name++;
+       else
+               lookup_name = name;
+
+       ASSERT(table != NULL);
+
+       for (vi = table; vi->name; vi++) {
+               if (!strcmp(vi->name, lookup_name))
+                       return vi;
+       }
+       /* ran to end of table */
+
+       return NULL; /* var name not found */
+}
+
+int
+bcm_iovar_lencheck(const bcm_iovar_t *vi, void *arg, int len, bool set)
+{
+       int bcmerror = 0;
+
+       /* length check on io buf */
+       switch (vi->type) {
+       case IOVT_BOOL:
+       case IOVT_INT8:
+       case IOVT_INT16:
+       case IOVT_INT32:
+       case IOVT_UINT8:
+       case IOVT_UINT16:
+       case IOVT_UINT32:
+               /* all integers are int32 sized args at the ioctl interface */
+               if (len < (int)sizeof(int)) {
+                       bcmerror = BCME_BUFTOOSHORT;
+               }
+               break;
+
+       case IOVT_BUFFER:
+               /* buffer must meet minimum length requirement */
+               if (len < vi->minlen) {
+                       bcmerror = BCME_BUFTOOSHORT;
+               }
+               break;
+
+       case IOVT_VOID:
+               if (!set) {
+                       /* Cannot return nil... */
+                       bcmerror = BCME_UNSUPPORTED;
+               } else if (len) {
+                       /* Set is an action w/o parameters */
+                       bcmerror = BCME_BUFTOOLONG;
+               }
+               break;
+
+       default:
+               /* unknown type for length check in iovar info */
+               ASSERT(0);
+               bcmerror = BCME_UNSUPPORTED;
+       }
+
+       return bcmerror;
+}
+
+#endif /* BCMDRIVER */
+
+#ifdef BCM_OBJECT_TRACE
+
+#define BCM_OBJECT_MERGE_SAME_OBJ      0
+
+/* some place may add / remove the object to trace list for Linux: */
+/* add:    osl_alloc_skb dev_alloc_skb skb_realloc_headroom dhd_start_xmit */
+/* remove: osl_pktfree dev_kfree_skb netif_rx */
+
+#define BCM_OBJDBG_COUNT          (1024 * 100)
+static spinlock_t dbgobj_lock;
+#define        BCM_OBJDBG_LOCK_INIT()    spin_lock_init(&dbgobj_lock)
+#define        BCM_OBJDBG_LOCK_DESTROY()
+#define        BCM_OBJDBG_LOCK           spin_lock_irqsave
+#define        BCM_OBJDBG_UNLOCK         spin_unlock_irqrestore
+
+#define BCM_OBJDBG_ADDTOHEAD      0
+#define BCM_OBJDBG_ADDTOTAIL      1
+
+#define BCM_OBJDBG_CALLER_LEN     32
+struct bcm_dbgobj {
+       struct bcm_dbgobj *prior;
+       struct bcm_dbgobj *next;
+       uint32 flag;
+       void   *obj;
+       uint32 obj_sn;
+       uint32 obj_state;
+       uint32 line;
+       char   caller[BCM_OBJDBG_CALLER_LEN];
+};
+
+static struct bcm_dbgobj *dbgobj_freehead = NULL;
+static struct bcm_dbgobj *dbgobj_freetail = NULL;
+static struct bcm_dbgobj *dbgobj_objhead = NULL;
+static struct bcm_dbgobj *dbgobj_objtail = NULL;
+
+static uint32 dbgobj_sn = 0;
+static int dbgobj_count = 0;
+static struct bcm_dbgobj bcm_dbg_objs[BCM_OBJDBG_COUNT];
+
+void
+bcm_object_trace_init(void)
+{
+       int i = 0;
+       BCM_OBJDBG_LOCK_INIT();
+       memset(&bcm_dbg_objs, 0x00, sizeof(struct bcm_dbgobj) * BCM_OBJDBG_COUNT);
+       dbgobj_freehead = &bcm_dbg_objs[0];
+       dbgobj_freetail = &bcm_dbg_objs[BCM_OBJDBG_COUNT - 1];
+
+       for (i = 0; i < BCM_OBJDBG_COUNT; ++i) {
+               bcm_dbg_objs[i].next = (i == (BCM_OBJDBG_COUNT - 1)) ?
+                       dbgobj_freehead : &bcm_dbg_objs[i + 1];
+               bcm_dbg_objs[i].prior = (i == 0) ?
+                       dbgobj_freetail : &bcm_dbg_objs[i - 1];
+       }
+}
+
+void
+bcm_object_trace_deinit(void)
+{
+       if (dbgobj_objhead || dbgobj_objtail) {
+               printf("%s: not all objects are released\n", __FUNCTION__);
+               ASSERT(0);
+       }
+       BCM_OBJDBG_LOCK_DESTROY();
+}
+
+static void
+bcm_object_rm_list(struct bcm_dbgobj **head, struct bcm_dbgobj **tail,
+       struct bcm_dbgobj *dbgobj)
+{
+       if ((dbgobj == *head) && (dbgobj == *tail)) {
+               *head = NULL;
+               *tail = NULL;
+       } else if (dbgobj == *head) {
+               *head = (*head)->next;
+       } else if (dbgobj == *tail) {
+               *tail = (*tail)->prior;
+       }
+       dbgobj->next->prior = dbgobj->prior;
+       dbgobj->prior->next = dbgobj->next;
+}
+
+static void
+bcm_object_add_list(struct bcm_dbgobj **head, struct bcm_dbgobj **tail,
+       struct bcm_dbgobj *dbgobj, int addtotail)
+{
+       if (!(*head) && !(*tail)) {
+               *head = dbgobj;
+               *tail = dbgobj;
+               dbgobj->next = dbgobj;
+               dbgobj->prior = dbgobj;
+       } else if ((*head) && (*tail)) {
+               (*tail)->next = dbgobj;
+               (*head)->prior = dbgobj;
+               dbgobj->next = *head;
+               dbgobj->prior = *tail;
+               if (addtotail == BCM_OBJDBG_ADDTOTAIL)
+                       *tail = dbgobj;
+               else
+                       *head = dbgobj;
+       } else {
+               ASSERT(0); /* can't be this case */
+       }
+}
+
+static INLINE void
+bcm_object_movetoend(struct bcm_dbgobj **head, struct bcm_dbgobj **tail,
+       struct bcm_dbgobj *dbgobj, int movetotail)
+{
+       if ((*head) && (*tail)) {
+               if (movetotail == BCM_OBJDBG_ADDTOTAIL) {
+                       if (dbgobj != (*tail)) {
+                               bcm_object_rm_list(head, tail, dbgobj);
+                               bcm_object_add_list(head, tail, dbgobj, movetotail);
+                       }
+               } else {
+                       if (dbgobj != (*head)) {
+                               bcm_object_rm_list(head, tail, dbgobj);
+                               bcm_object_add_list(head, tail, dbgobj, movetotail);
+                       }
+               }
+       } else {
+               ASSERT(0); /* can't be this case */
+       }
+}
+
+void
+bcm_object_trace_opr(void *obj, uint32 opt, const char *caller, int line)
+{
+       struct bcm_dbgobj *dbgobj;
+       unsigned long flags;
+
+       BCM_REFERENCE(flags);
+       BCM_OBJDBG_LOCK(&dbgobj_lock, flags);
+
+       if (opt == BCM_OBJDBG_ADD_PKT ||
+               opt == BCM_OBJDBG_ADD) {
+               dbgobj = dbgobj_objtail;
+               while (dbgobj) {
+                       if (dbgobj->obj == obj) {
+                               printf("%s: obj %p allocated from %s(%d),"
+                                       " allocate again from %s(%d)\n",
+                                       __FUNCTION__, dbgobj->obj,
+                                       dbgobj->caller, dbgobj->line,
+                                       caller, line);
+                               ASSERT(0);
+                               goto EXIT;
+                       }
+                       dbgobj = dbgobj->prior;
+                       if (dbgobj == dbgobj_objtail)
+                               break;
+               }
+
+#if BCM_OBJECT_MERGE_SAME_OBJ
+               dbgobj = dbgobj_freetail;
+               while (dbgobj) {
+                       if (dbgobj->obj == obj) {
+                               goto FREED_ENTRY_FOUND;
+                       }
+                       dbgobj = dbgobj->prior;
+                       if (dbgobj == dbgobj_freetail)
+                               break;
+               }
+#endif /* BCM_OBJECT_MERGE_SAME_OBJ */
+
+               dbgobj = dbgobj_freehead;
+#if BCM_OBJECT_MERGE_SAME_OBJ
+FREED_ENTRY_FOUND:
+#endif /* BCM_OBJECT_MERGE_SAME_OBJ */
+               if (!dbgobj) {
+                       printf("%s: already got %d objects ?????????????????????\n",
+                               __FUNCTION__, BCM_OBJDBG_COUNT);
+                       ASSERT(0);
+                       goto EXIT;
+               }
+
+               bcm_object_rm_list(&dbgobj_freehead, &dbgobj_freetail, dbgobj);
+               dbgobj->obj = obj;
+               strncpy(dbgobj->caller, caller, BCM_OBJDBG_CALLER_LEN);
+               dbgobj->caller[BCM_OBJDBG_CALLER_LEN-1] = '\0';
+               dbgobj->line = line;
+               dbgobj->flag = 0;
+               if (opt == BCM_OBJDBG_ADD_PKT) {
+                       dbgobj->obj_sn = dbgobj_sn++;
+                       dbgobj->obj_state = 0;
+                       /* first 4 bytes is pkt sn */
+                       if (((unsigned long)PKTTAG(obj)) & 0x3)
+                               printf("pkt tag address not aligned by 4: %p\n", PKTTAG(obj));
+                       *(uint32*)PKTTAG(obj) = dbgobj->obj_sn;
+               }
+               bcm_object_add_list(&dbgobj_objhead, &dbgobj_objtail, dbgobj,
+                       BCM_OBJDBG_ADDTOTAIL);
+
+               dbgobj_count++;
+
+       } else if (opt == BCM_OBJDBG_REMOVE) {
+               dbgobj = dbgobj_objtail;
+               while (dbgobj) {
+                       if (dbgobj->obj == obj) {
+                               if (dbgobj->flag) {
+                                       printf("%s: rm flagged obj %p flag 0x%08x from %s(%d)\n",
+                                               __FUNCTION__, obj, dbgobj->flag, caller, line);
+                               }
+                               bcm_object_rm_list(&dbgobj_objhead, &dbgobj_objtail, dbgobj);
+                               memset(dbgobj->caller, 0x00, BCM_OBJDBG_CALLER_LEN);
+                               strncpy(dbgobj->caller, caller, BCM_OBJDBG_CALLER_LEN);
+                               dbgobj->caller[BCM_OBJDBG_CALLER_LEN-1] = '\0';
+                               dbgobj->line = line;
+                               bcm_object_add_list(&dbgobj_freehead, &dbgobj_freetail, dbgobj,
+                                       BCM_OBJDBG_ADDTOTAIL);
+                               dbgobj_count--;
+                               goto EXIT;
+                       }
+                       dbgobj = dbgobj->prior;
+                       if (dbgobj == dbgobj_objtail)
+                               break;
+               }
+
+               dbgobj = dbgobj_freetail;
+               while (dbgobj && dbgobj->obj) {
+                       if (dbgobj->obj == obj) {
+                               printf("%s: obj %p already freed from from %s(%d),"
+                                       " try free again from %s(%d)\n",
+                                       __FUNCTION__, obj,
+                                       dbgobj->caller, dbgobj->line,
+                                       caller, line);
+                               //ASSERT(0); /* release same obj more than one time? */
+                               goto EXIT;
+                       }
+                       dbgobj = dbgobj->prior;
+                       if (dbgobj == dbgobj_freetail)
+                               break;
+               }
+
+               printf("%s: ################### release none-existing obj %p from %s(%d)\n",
+                       __FUNCTION__, obj, caller, line);
+               //ASSERT(0); /* release same obj more than one time? */
+
+       }
+
+EXIT:
+       BCM_OBJDBG_UNLOCK(&dbgobj_lock, flags);
+       return;
+}
+
+void
+bcm_object_trace_upd(void *obj, void *obj_new)
+{
+       struct bcm_dbgobj *dbgobj;
+       unsigned long flags;
+
+       BCM_REFERENCE(flags);
+       BCM_OBJDBG_LOCK(&dbgobj_lock, flags);
+
+       dbgobj = dbgobj_objtail;
+       while (dbgobj) {
+               if (dbgobj->obj == obj) {
+                       dbgobj->obj = obj_new;
+                       if (dbgobj != dbgobj_objtail) {
+                               bcm_object_movetoend(&dbgobj_objhead, &dbgobj_objtail,
+                                       dbgobj, BCM_OBJDBG_ADDTOTAIL);
+                       }
+                       goto EXIT;
+               }
+               dbgobj = dbgobj->prior;
+               if (dbgobj == dbgobj_objtail)
+                       break;
+       }
+
+EXIT:
+       BCM_OBJDBG_UNLOCK(&dbgobj_lock, flags);
+       return;
+}
+
+void
+bcm_object_trace_chk(void *obj, uint32 chksn, uint32 sn,
+       const char *caller, int line)
+{
+       struct bcm_dbgobj *dbgobj;
+       unsigned long flags;
+
+       BCM_REFERENCE(flags);
+       BCM_OBJDBG_LOCK(&dbgobj_lock, flags);
+
+       dbgobj = dbgobj_objtail;
+       while (dbgobj) {
+               if ((dbgobj->obj == obj) &&
+                       ((!chksn) || (dbgobj->obj_sn == sn))) {
+                       if (dbgobj != dbgobj_objtail) {
+                               bcm_object_movetoend(&dbgobj_objhead, &dbgobj_objtail,
+                                       dbgobj, BCM_OBJDBG_ADDTOTAIL);
+                       }
+                       goto EXIT;
+               }
+               dbgobj = dbgobj->prior;
+               if (dbgobj == dbgobj_objtail)
+                       break;
+       }
+
+       dbgobj = dbgobj_freetail;
+       while (dbgobj) {
+               if ((dbgobj->obj == obj) &&
+                       ((!chksn) || (dbgobj->obj_sn == sn))) {
+                       printf("%s: (%s:%d) obj %p (sn %d state %d) was freed from %s(%d)\n",
+                               __FUNCTION__, caller, line,
+                               dbgobj->obj, dbgobj->obj_sn, dbgobj->obj_state,
+                               dbgobj->caller, dbgobj->line);
+                       goto EXIT;
+               }
+               else if (dbgobj->obj == NULL) {
+                       break;
+               }
+               dbgobj = dbgobj->prior;
+               if (dbgobj == dbgobj_freetail)
+                       break;
+       }
+
+       printf("%s: obj %p not found, check from %s(%d), chksn %s, sn %d\n",
+               __FUNCTION__, obj, caller, line, chksn ? "yes" : "no", sn);
+       dbgobj = dbgobj_objtail;
+       while (dbgobj) {
+               printf("%s: (%s:%d) obj %p sn %d was allocated from %s(%d)\n",
+                               __FUNCTION__, caller, line,
+                               dbgobj->obj, dbgobj->obj_sn, dbgobj->caller, dbgobj->line);
+               dbgobj = dbgobj->prior;
+               if (dbgobj == dbgobj_objtail)
+                       break;
+       }
+
+EXIT:
+       BCM_OBJDBG_UNLOCK(&dbgobj_lock, flags);
+       return;
+}
+
+void
+bcm_object_feature_set(void *obj, uint32 type, uint32 value)
+{
+       struct bcm_dbgobj *dbgobj;
+       unsigned long flags;
+
+       BCM_REFERENCE(flags);
+       BCM_OBJDBG_LOCK(&dbgobj_lock, flags);
+
+       dbgobj = dbgobj_objtail;
+       while (dbgobj) {
+               if (dbgobj->obj == obj) {
+                       if (type == BCM_OBJECT_FEATURE_FLAG) {
+                               if (value & BCM_OBJECT_FEATURE_CLEAR)
+                                       dbgobj->flag &= ~(value);
+                               else
+                                       dbgobj->flag |= (value);
+                       } else if (type == BCM_OBJECT_FEATURE_PKT_STATE) {
+                               dbgobj->obj_state = value;
+                       }
+                       if (dbgobj != dbgobj_objtail) {
+                               bcm_object_movetoend(&dbgobj_objhead, &dbgobj_objtail,
+                                       dbgobj, BCM_OBJDBG_ADDTOTAIL);
+                       }
+                       goto EXIT;
+               }
+               dbgobj = dbgobj->prior;
+               if (dbgobj == dbgobj_objtail)
+                       break;
+       }
+
+       printf("%s: obj %p not found in active list\n", __FUNCTION__, obj);
+       ASSERT(0);
+
+EXIT:
+       BCM_OBJDBG_UNLOCK(&dbgobj_lock, flags);
+       return;
+}
+
+int
+bcm_object_feature_get(void *obj, uint32 type, uint32 value)
+{
+       int rtn = 0;
+       struct bcm_dbgobj *dbgobj;
+       unsigned long flags;
+
+       BCM_REFERENCE(flags);
+       BCM_OBJDBG_LOCK(&dbgobj_lock, flags);
+
+       dbgobj = dbgobj_objtail;
+       while (dbgobj) {
+               if (dbgobj->obj == obj) {
+                       if (type == BCM_OBJECT_FEATURE_FLAG) {
+                               rtn = (dbgobj->flag & value) & (~BCM_OBJECT_FEATURE_CLEAR);
+                       }
+                       if (dbgobj != dbgobj_objtail) {
+                               bcm_object_movetoend(&dbgobj_objhead, &dbgobj_objtail,
+                                       dbgobj, BCM_OBJDBG_ADDTOTAIL);
+                       }
+                       goto EXIT;
+               }
+               dbgobj = dbgobj->prior;
+               if (dbgobj == dbgobj_objtail)
+                       break;
+       }
+
+       printf("%s: obj %p not found in active list\n", __FUNCTION__, obj);
+       ASSERT(0);
+
+EXIT:
+       BCM_OBJDBG_UNLOCK(&dbgobj_lock, flags);
+       return rtn;
+}
+
+#endif /* BCM_OBJECT_TRACE */
+
+uint8 *
+bcm_write_tlv(int type, const void *data, int datalen, uint8 *dst)
+{
+       uint8 *new_dst = dst;
+       bcm_tlv_t *dst_tlv = (bcm_tlv_t *)dst;
+
+       /* dst buffer should always be valid */
+       ASSERT(dst);
+
+       /* data len must be within valid range */
+       ASSERT((datalen >= 0) && (datalen <= BCM_TLV_MAX_DATA_SIZE));
+
+       /* source data buffer pointer should be valid, unless datalen is 0
+        * meaning no data with this TLV
+        */
+       ASSERT((data != NULL) || (datalen == 0));
+
+       /* only do work if the inputs are valid
+        * - must have a dst to write to AND
+        * - datalen must be within range AND
+        * - the source data pointer must be non-NULL if datalen is non-zero
+        * (this last condition detects datalen > 0 with a NULL data pointer)
+        */
+       if ((dst != NULL) &&
+           ((datalen >= 0) && (datalen <= BCM_TLV_MAX_DATA_SIZE)) &&
+           ((data != NULL) || (datalen == 0))) {
+
+               /* write type, len fields */
+               dst_tlv->id = (uint8)type;
+               dst_tlv->len = (uint8)datalen;
+
+               /* if data is present, copy to the output buffer and update
+                * pointer to output buffer
+                */
+               if (datalen > 0) {
+
+                       memcpy(dst_tlv->data, data, datalen);
+               }
+
+               /* update the output destination poitner to point past
+                * the TLV written
+                */
+               new_dst = dst + BCM_TLV_HDR_SIZE + datalen;
+       }
+
+       return (new_dst);
+}
+
+uint8 *
+bcm_write_tlv_safe(int type, const void *data, int datalen, uint8 *dst, int dst_maxlen)
+{
+       uint8 *new_dst = dst;
+
+       if ((datalen >= 0) && (datalen <= BCM_TLV_MAX_DATA_SIZE)) {
+
+               /* if len + tlv hdr len is more than destlen, don't do anything
+                * just return the buffer untouched
+                */
+               if ((int)(datalen + BCM_TLV_HDR_SIZE) <= dst_maxlen) {
+
+                       new_dst = bcm_write_tlv(type, data, datalen, dst);
+               }
+       }
+
+       return (new_dst);
+}
+
+uint8 *
+bcm_copy_tlv(const void *src, uint8 *dst)
+{
+       uint8 *new_dst = dst;
+       const bcm_tlv_t *src_tlv = (const bcm_tlv_t *)src;
+       uint totlen;
+
+       ASSERT(dst && src);
+       if (dst && src) {
+
+               totlen = BCM_TLV_HDR_SIZE + src_tlv->len;
+               memcpy(dst, src_tlv, totlen);
+               new_dst = dst + totlen;
+       }
+
+       return (new_dst);
+}
+
+
+uint8 *bcm_copy_tlv_safe(const void *src, uint8 *dst, int dst_maxlen)
+{
+       uint8 *new_dst = dst;
+       const bcm_tlv_t *src_tlv = (const bcm_tlv_t *)src;
+
+       ASSERT(src);
+       if (src) {
+               if (bcm_valid_tlv(src_tlv, dst_maxlen)) {
+                       new_dst = bcm_copy_tlv(src, dst);
+               }
+       }
+
+       return (new_dst);
+}
+
+
+#if !defined(BCMROMOFFLOAD_EXCLUDE_BCMUTILS_FUNCS)
+/*******************************************************************************
+ * crc8
+ *
+ * Computes a crc8 over the input data using the polynomial:
+ *
+ *       x^8 + x^7 +x^6 + x^4 + x^2 + 1
+ *
+ * The caller provides the initial value (either CRC8_INIT_VALUE
+ * or the previous returned value) to allow for processing of
+ * discontiguous blocks of data.  When generating the CRC the
+ * caller is responsible for complementing the final return value
+ * and inserting it into the byte stream.  When checking, a final
+ * return value of CRC8_GOOD_VALUE indicates a valid CRC.
+ *
+ * Reference: Dallas Semiconductor Application Note 27
+ *   Williams, Ross N., "A Painless Guide to CRC Error Detection Algorithms",
+ *     ver 3, Aug 1993, ross@guest.adelaide.edu.au, Rocksoft Pty Ltd.,
+ *     ftp://ftp.rocksoft.com/clients/rocksoft/papers/crc_v3.txt
+ *
+ * ****************************************************************************
+ */
+
+static const uint8 crc8_table[256] = {
+    0x00, 0xF7, 0xB9, 0x4E, 0x25, 0xD2, 0x9C, 0x6B,
+    0x4A, 0xBD, 0xF3, 0x04, 0x6F, 0x98, 0xD6, 0x21,
+    0x94, 0x63, 0x2D, 0xDA, 0xB1, 0x46, 0x08, 0xFF,
+    0xDE, 0x29, 0x67, 0x90, 0xFB, 0x0C, 0x42, 0xB5,
+    0x7F, 0x88, 0xC6, 0x31, 0x5A, 0xAD, 0xE3, 0x14,
+    0x35, 0xC2, 0x8C, 0x7B, 0x10, 0xE7, 0xA9, 0x5E,
+    0xEB, 0x1C, 0x52, 0xA5, 0xCE, 0x39, 0x77, 0x80,
+    0xA1, 0x56, 0x18, 0xEF, 0x84, 0x73, 0x3D, 0xCA,
+    0xFE, 0x09, 0x47, 0xB0, 0xDB, 0x2C, 0x62, 0x95,
+    0xB4, 0x43, 0x0D, 0xFA, 0x91, 0x66, 0x28, 0xDF,
+    0x6A, 0x9D, 0xD3, 0x24, 0x4F, 0xB8, 0xF6, 0x01,
+    0x20, 0xD7, 0x99, 0x6E, 0x05, 0xF2, 0xBC, 0x4B,
+    0x81, 0x76, 0x38, 0xCF, 0xA4, 0x53, 0x1D, 0xEA,
+    0xCB, 0x3C, 0x72, 0x85, 0xEE, 0x19, 0x57, 0xA0,
+    0x15, 0xE2, 0xAC, 0x5B, 0x30, 0xC7, 0x89, 0x7E,
+    0x5F, 0xA8, 0xE6, 0x11, 0x7A, 0x8D, 0xC3, 0x34,
+    0xAB, 0x5C, 0x12, 0xE5, 0x8E, 0x79, 0x37, 0xC0,
+    0xE1, 0x16, 0x58, 0xAF, 0xC4, 0x33, 0x7D, 0x8A,
+    0x3F, 0xC8, 0x86, 0x71, 0x1A, 0xED, 0xA3, 0x54,
+    0x75, 0x82, 0xCC, 0x3B, 0x50, 0xA7, 0xE9, 0x1E,
+    0xD4, 0x23, 0x6D, 0x9A, 0xF1, 0x06, 0x48, 0xBF,
+    0x9E, 0x69, 0x27, 0xD0, 0xBB, 0x4C, 0x02, 0xF5,
+    0x40, 0xB7, 0xF9, 0x0E, 0x65, 0x92, 0xDC, 0x2B,
+    0x0A, 0xFD, 0xB3, 0x44, 0x2F, 0xD8, 0x96, 0x61,
+    0x55, 0xA2, 0xEC, 0x1B, 0x70, 0x87, 0xC9, 0x3E,
+    0x1F, 0xE8, 0xA6, 0x51, 0x3A, 0xCD, 0x83, 0x74,
+    0xC1, 0x36, 0x78, 0x8F, 0xE4, 0x13, 0x5D, 0xAA,
+    0x8B, 0x7C, 0x32, 0xC5, 0xAE, 0x59, 0x17, 0xE0,
+    0x2A, 0xDD, 0x93, 0x64, 0x0F, 0xF8, 0xB6, 0x41,
+    0x60, 0x97, 0xD9, 0x2E, 0x45, 0xB2, 0xFC, 0x0B,
+    0xBE, 0x49, 0x07, 0xF0, 0x9B, 0x6C, 0x22, 0xD5,
+    0xF4, 0x03, 0x4D, 0xBA, 0xD1, 0x26, 0x68, 0x9F
+};
+
+#define CRC_INNER_LOOP(n, c, x) \
+       (c) = ((c) >> 8) ^ crc##n##_table[((c) ^ (x)) & 0xff]
+
+uint8
+hndcrc8(
+       uint8 *pdata,   /* pointer to array of data to process */
+       uint  nbytes,   /* number of input data bytes to process */
+       uint8 crc       /* either CRC8_INIT_VALUE or previous return value */
+)
+{
+       /* hard code the crc loop instead of using CRC_INNER_LOOP macro
+        * to avoid the undefined and unnecessary (uint8 >> 8) operation.
+        */
+       while (nbytes-- > 0)
+               crc = crc8_table[(crc ^ *pdata++) & 0xff];
+
+       return crc;
+}
+
+/*******************************************************************************
+ * crc16
+ *
+ * Computes a crc16 over the input data using the polynomial:
+ *
+ *       x^16 + x^12 +x^5 + 1
+ *
+ * The caller provides the initial value (either CRC16_INIT_VALUE
+ * or the previous returned value) to allow for processing of
+ * discontiguous blocks of data.  When generating the CRC the
+ * caller is responsible for complementing the final return value
+ * and inserting it into the byte stream.  When checking, a final
+ * return value of CRC16_GOOD_VALUE indicates a valid CRC.
+ *
+ * Reference: Dallas Semiconductor Application Note 27
+ *   Williams, Ross N., "A Painless Guide to CRC Error Detection Algorithms",
+ *     ver 3, Aug 1993, ross@guest.adelaide.edu.au, Rocksoft Pty Ltd.,
+ *     ftp://ftp.rocksoft.com/clients/rocksoft/papers/crc_v3.txt
+ *
+ * ****************************************************************************
+ */
+
+static const uint16 crc16_table[256] = {
+    0x0000, 0x1189, 0x2312, 0x329B, 0x4624, 0x57AD, 0x6536, 0x74BF,
+    0x8C48, 0x9DC1, 0xAF5A, 0xBED3, 0xCA6C, 0xDBE5, 0xE97E, 0xF8F7,
+    0x1081, 0x0108, 0x3393, 0x221A, 0x56A5, 0x472C, 0x75B7, 0x643E,
+    0x9CC9, 0x8D40, 0xBFDB, 0xAE52, 0xDAED, 0xCB64, 0xF9FF, 0xE876,
+    0x2102, 0x308B, 0x0210, 0x1399, 0x6726, 0x76AF, 0x4434, 0x55BD,
+    0xAD4A, 0xBCC3, 0x8E58, 0x9FD1, 0xEB6E, 0xFAE7, 0xC87C, 0xD9F5,
+    0x3183, 0x200A, 0x1291, 0x0318, 0x77A7, 0x662E, 0x54B5, 0x453C,
+    0xBDCB, 0xAC42, 0x9ED9, 0x8F50, 0xFBEF, 0xEA66, 0xD8FD, 0xC974,
+    0x4204, 0x538D, 0x6116, 0x709F, 0x0420, 0x15A9, 0x2732, 0x36BB,
+    0xCE4C, 0xDFC5, 0xED5E, 0xFCD7, 0x8868, 0x99E1, 0xAB7A, 0xBAF3,
+    0x5285, 0x430C, 0x7197, 0x601E, 0x14A1, 0x0528, 0x37B3, 0x263A,
+    0xDECD, 0xCF44, 0xFDDF, 0xEC56, 0x98E9, 0x8960, 0xBBFB, 0xAA72,
+    0x6306, 0x728F, 0x4014, 0x519D, 0x2522, 0x34AB, 0x0630, 0x17B9,
+    0xEF4E, 0xFEC7, 0xCC5C, 0xDDD5, 0xA96A, 0xB8E3, 0x8A78, 0x9BF1,
+    0x7387, 0x620E, 0x5095, 0x411C, 0x35A3, 0x242A, 0x16B1, 0x0738,
+    0xFFCF, 0xEE46, 0xDCDD, 0xCD54, 0xB9EB, 0xA862, 0x9AF9, 0x8B70,
+    0x8408, 0x9581, 0xA71A, 0xB693, 0xC22C, 0xD3A5, 0xE13E, 0xF0B7,
+    0x0840, 0x19C9, 0x2B52, 0x3ADB, 0x4E64, 0x5FED, 0x6D76, 0x7CFF,
+    0x9489, 0x8500, 0xB79B, 0xA612, 0xD2AD, 0xC324, 0xF1BF, 0xE036,
+    0x18C1, 0x0948, 0x3BD3, 0x2A5A, 0x5EE5, 0x4F6C, 0x7DF7, 0x6C7E,
+    0xA50A, 0xB483, 0x8618, 0x9791, 0xE32E, 0xF2A7, 0xC03C, 0xD1B5,
+    0x2942, 0x38CB, 0x0A50, 0x1BD9, 0x6F66, 0x7EEF, 0x4C74, 0x5DFD,
+    0xB58B, 0xA402, 0x9699, 0x8710, 0xF3AF, 0xE226, 0xD0BD, 0xC134,
+    0x39C3, 0x284A, 0x1AD1, 0x0B58, 0x7FE7, 0x6E6E, 0x5CF5, 0x4D7C,
+    0xC60C, 0xD785, 0xE51E, 0xF497, 0x8028, 0x91A1, 0xA33A, 0xB2B3,
+    0x4A44, 0x5BCD, 0x6956, 0x78DF, 0x0C60, 0x1DE9, 0x2F72, 0x3EFB,
+    0xD68D, 0xC704, 0xF59F, 0xE416, 0x90A9, 0x8120, 0xB3BB, 0xA232,
+    0x5AC5, 0x4B4C, 0x79D7, 0x685E, 0x1CE1, 0x0D68, 0x3FF3, 0x2E7A,
+    0xE70E, 0xF687, 0xC41C, 0xD595, 0xA12A, 0xB0A3, 0x8238, 0x93B1,
+    0x6B46, 0x7ACF, 0x4854, 0x59DD, 0x2D62, 0x3CEB, 0x0E70, 0x1FF9,
+    0xF78F, 0xE606, 0xD49D, 0xC514, 0xB1AB, 0xA022, 0x92B9, 0x8330,
+    0x7BC7, 0x6A4E, 0x58D5, 0x495C, 0x3DE3, 0x2C6A, 0x1EF1, 0x0F78
+};
+
+uint16
+hndcrc16(
+    uint8 *pdata,  /* pointer to array of data to process */
+    uint nbytes, /* number of input data bytes to process */
+    uint16 crc     /* either CRC16_INIT_VALUE or previous return value */
+)
+{
+       while (nbytes-- > 0)
+               CRC_INNER_LOOP(16, crc, *pdata++);
+       return crc;
+}
+
+static const uint32 crc32_table[256] = {
+    0x00000000, 0x77073096, 0xEE0E612C, 0x990951BA,
+    0x076DC419, 0x706AF48F, 0xE963A535, 0x9E6495A3,
+    0x0EDB8832, 0x79DCB8A4, 0xE0D5E91E, 0x97D2D988,
+    0x09B64C2B, 0x7EB17CBD, 0xE7B82D07, 0x90BF1D91,
+    0x1DB71064, 0x6AB020F2, 0xF3B97148, 0x84BE41DE,
+    0x1ADAD47D, 0x6DDDE4EB, 0xF4D4B551, 0x83D385C7,
+    0x136C9856, 0x646BA8C0, 0xFD62F97A, 0x8A65C9EC,
+    0x14015C4F, 0x63066CD9, 0xFA0F3D63, 0x8D080DF5,
+    0x3B6E20C8, 0x4C69105E, 0xD56041E4, 0xA2677172,
+    0x3C03E4D1, 0x4B04D447, 0xD20D85FD, 0xA50AB56B,
+    0x35B5A8FA, 0x42B2986C, 0xDBBBC9D6, 0xACBCF940,
+    0x32D86CE3, 0x45DF5C75, 0xDCD60DCF, 0xABD13D59,
+    0x26D930AC, 0x51DE003A, 0xC8D75180, 0xBFD06116,
+    0x21B4F4B5, 0x56B3C423, 0xCFBA9599, 0xB8BDA50F,
+    0x2802B89E, 0x5F058808, 0xC60CD9B2, 0xB10BE924,
+    0x2F6F7C87, 0x58684C11, 0xC1611DAB, 0xB6662D3D,
+    0x76DC4190, 0x01DB7106, 0x98D220BC, 0xEFD5102A,
+    0x71B18589, 0x06B6B51F, 0x9FBFE4A5, 0xE8B8D433,
+    0x7807C9A2, 0x0F00F934, 0x9609A88E, 0xE10E9818,
+    0x7F6A0DBB, 0x086D3D2D, 0x91646C97, 0xE6635C01,
+    0x6B6B51F4, 0x1C6C6162, 0x856530D8, 0xF262004E,
+    0x6C0695ED, 0x1B01A57B, 0x8208F4C1, 0xF50FC457,
+    0x65B0D9C6, 0x12B7E950, 0x8BBEB8EA, 0xFCB9887C,
+    0x62DD1DDF, 0x15DA2D49, 0x8CD37CF3, 0xFBD44C65,
+    0x4DB26158, 0x3AB551CE, 0xA3BC0074, 0xD4BB30E2,
+    0x4ADFA541, 0x3DD895D7, 0xA4D1C46D, 0xD3D6F4FB,
+    0x4369E96A, 0x346ED9FC, 0xAD678846, 0xDA60B8D0,
+    0x44042D73, 0x33031DE5, 0xAA0A4C5F, 0xDD0D7CC9,
+    0x5005713C, 0x270241AA, 0xBE0B1010, 0xC90C2086,
+    0x5768B525, 0x206F85B3, 0xB966D409, 0xCE61E49F,
+    0x5EDEF90E, 0x29D9C998, 0xB0D09822, 0xC7D7A8B4,
+    0x59B33D17, 0x2EB40D81, 0xB7BD5C3B, 0xC0BA6CAD,
+    0xEDB88320, 0x9ABFB3B6, 0x03B6E20C, 0x74B1D29A,
+    0xEAD54739, 0x9DD277AF, 0x04DB2615, 0x73DC1683,
+    0xE3630B12, 0x94643B84, 0x0D6D6A3E, 0x7A6A5AA8,
+    0xE40ECF0B, 0x9309FF9D, 0x0A00AE27, 0x7D079EB1,
+    0xF00F9344, 0x8708A3D2, 0x1E01F268, 0x6906C2FE,
+    0xF762575D, 0x806567CB, 0x196C3671, 0x6E6B06E7,
+    0xFED41B76, 0x89D32BE0, 0x10DA7A5A, 0x67DD4ACC,
+    0xF9B9DF6F, 0x8EBEEFF9, 0x17B7BE43, 0x60B08ED5,
+    0xD6D6A3E8, 0xA1D1937E, 0x38D8C2C4, 0x4FDFF252,
+    0xD1BB67F1, 0xA6BC5767, 0x3FB506DD, 0x48B2364B,
+    0xD80D2BDA, 0xAF0A1B4C, 0x36034AF6, 0x41047A60,
+    0xDF60EFC3, 0xA867DF55, 0x316E8EEF, 0x4669BE79,
+    0xCB61B38C, 0xBC66831A, 0x256FD2A0, 0x5268E236,
+    0xCC0C7795, 0xBB0B4703, 0x220216B9, 0x5505262F,
+    0xC5BA3BBE, 0xB2BD0B28, 0x2BB45A92, 0x5CB36A04,
+    0xC2D7FFA7, 0xB5D0CF31, 0x2CD99E8B, 0x5BDEAE1D,
+    0x9B64C2B0, 0xEC63F226, 0x756AA39C, 0x026D930A,
+    0x9C0906A9, 0xEB0E363F, 0x72076785, 0x05005713,
+    0x95BF4A82, 0xE2B87A14, 0x7BB12BAE, 0x0CB61B38,
+    0x92D28E9B, 0xE5D5BE0D, 0x7CDCEFB7, 0x0BDBDF21,
+    0x86D3D2D4, 0xF1D4E242, 0x68DDB3F8, 0x1FDA836E,
+    0x81BE16CD, 0xF6B9265B, 0x6FB077E1, 0x18B74777,
+    0x88085AE6, 0xFF0F6A70, 0x66063BCA, 0x11010B5C,
+    0x8F659EFF, 0xF862AE69, 0x616BFFD3, 0x166CCF45,
+    0xA00AE278, 0xD70DD2EE, 0x4E048354, 0x3903B3C2,
+    0xA7672661, 0xD06016F7, 0x4969474D, 0x3E6E77DB,
+    0xAED16A4A, 0xD9D65ADC, 0x40DF0B66, 0x37D83BF0,
+    0xA9BCAE53, 0xDEBB9EC5, 0x47B2CF7F, 0x30B5FFE9,
+    0xBDBDF21C, 0xCABAC28A, 0x53B39330, 0x24B4A3A6,
+    0xBAD03605, 0xCDD70693, 0x54DE5729, 0x23D967BF,
+    0xB3667A2E, 0xC4614AB8, 0x5D681B02, 0x2A6F2B94,
+    0xB40BBE37, 0xC30C8EA1, 0x5A05DF1B, 0x2D02EF8D
+};
+
+/*
+ * crc input is CRC32_INIT_VALUE for a fresh start, or previous return value if
+ * accumulating over multiple pieces.
+ */
+uint32
+hndcrc32(uint8 *pdata, uint nbytes, uint32 crc)
+{
+       uint8 *pend;
+       pend = pdata + nbytes;
+       while (pdata < pend)
+               CRC_INNER_LOOP(32, crc, *pdata++);
+
+       return crc;
+}
+
+#ifdef notdef
+#define CLEN   1499    /*  CRC Length */
+#define CBUFSIZ        (CLEN+4)
+#define CNBUFS         5 /* # of bufs */
+
+void
+testcrc32(void)
+{
+       uint j, k, l;
+       uint8 *buf;
+       uint len[CNBUFS];
+       uint32 crcr;
+       uint32 crc32tv[CNBUFS] =
+               {0xd2cb1faa, 0xd385c8fa, 0xf5b4f3f3, 0x55789e20, 0x00343110};
+
+       ASSERT((buf = MALLOC(CBUFSIZ*CNBUFS)) != NULL);
+
+       /* step through all possible alignments */
+       for (l = 0; l <= 4; l++) {
+               for (j = 0; j < CNBUFS; j++) {
+                       len[j] = CLEN;
+                       for (k = 0; k < len[j]; k++)
+                               *(buf + j*CBUFSIZ + (k+l)) = (j+k) & 0xff;
+               }
+
+               for (j = 0; j < CNBUFS; j++) {
+                       crcr = crc32(buf + j*CBUFSIZ + l, len[j], CRC32_INIT_VALUE);
+                       ASSERT(crcr == crc32tv[j]);
+               }
+       }
+
+       MFREE(buf, CBUFSIZ*CNBUFS);
+       return;
+}
+#endif /* notdef */
+
+/*
+ * Advance from the current 1-byte tag/1-byte length/variable-length value
+ * triple, to the next, returning a pointer to the next.
+ * If the current or next TLV is invalid (does not fit in given buffer length),
+ * NULL is returned.
+ * *buflen is not modified if the TLV elt parameter is invalid, or is decremented
+ * by the TLV parameter's length if it is valid.
+ */
+bcm_tlv_t *
+bcm_next_tlv(bcm_tlv_t *elt, int *buflen)
+{
+       int len;
+
+       /* validate current elt */
+       if (!bcm_valid_tlv(elt, *buflen)) {
+               return NULL;
+       }
+
+       /* advance to next elt */
+       len = elt->len;
+       elt = (bcm_tlv_t*)(elt->data + len);
+       *buflen -= (TLV_HDR_LEN + len);
+
+       /* validate next elt */
+       if (!bcm_valid_tlv(elt, *buflen)) {
+               return NULL;
+       }
+
+       return elt;
+}
+
+/*
+ * Traverse a string of 1-byte tag/1-byte length/variable-length value
+ * triples, returning a pointer to the substring whose first element
+ * matches tag
+ */
+bcm_tlv_t *
+bcm_parse_tlvs(void *buf, int buflen, uint key)
+{
+       bcm_tlv_t *elt;
+       int totlen;
+
+       if ((elt = (bcm_tlv_t*)buf) == NULL) {
+               return NULL;
+       }
+       totlen = buflen;
+
+       /* find tagged parameter */
+       while (totlen >= TLV_HDR_LEN) {
+               int len = elt->len;
+
+               /* validate remaining totlen */
+               if ((elt->id == key) && (totlen >= (int)(len + TLV_HDR_LEN))) {
+
+                       return (elt);
+               }
+
+               elt = (bcm_tlv_t*)((uint8*)elt + (len + TLV_HDR_LEN));
+               totlen -= (len + TLV_HDR_LEN);
+       }
+
+       return NULL;
+}
+
+/*
+ * Traverse a string of 1-byte tag/1-byte length/variable-length value
+ * triples, returning a pointer to the substring whose first element
+ * matches tag
+ * return NULL if not found or length field < min_varlen
+ */
+bcm_tlv_t *
+bcm_parse_tlvs_min_bodylen(void *buf, int buflen, uint key, int min_bodylen)
+{
+       bcm_tlv_t * ret = bcm_parse_tlvs(buf, buflen, key);
+       if (ret == NULL || ret->len < min_bodylen) {
+               return NULL;
+       }
+       return ret;
+}
+
+/*
+ * Traverse a string of 1-byte tag/1-byte length/variable-length value
+ * triples, returning a pointer to the substring whose first element
+ * matches tag.  Stop parsing when we see an element whose ID is greater
+ * than the target key.
+ */
+bcm_tlv_t *
+bcm_parse_ordered_tlvs(void *buf, int buflen, uint key)
+{
+       bcm_tlv_t *elt;
+       int totlen;
+
+       elt = (bcm_tlv_t*)buf;
+       totlen = buflen;
+
+       /* find tagged parameter */
+       while (totlen >= TLV_HDR_LEN) {
+               uint id = elt->id;
+               int len = elt->len;
+
+               /* Punt if we start seeing IDs > than target key */
+               if (id > key) {
+                       return (NULL);
+               }
+
+               /* validate remaining totlen */
+               if ((id == key) && (totlen >= (int)(len + TLV_HDR_LEN))) {
+                       return (elt);
+               }
+
+               elt = (bcm_tlv_t*)((uint8*)elt + (len + TLV_HDR_LEN));
+               totlen -= (len + TLV_HDR_LEN);
+       }
+       return NULL;
+}
+#endif /* !BCMROMOFFLOAD_EXCLUDE_BCMUTILS_FUNCS */
+
+#if defined(WLMSG_PRHDRS) || defined(WLMSG_PRPKT) || defined(WLMSG_ASSOC) || \
+       defined(DHD_DEBUG)
+int
+bcm_format_field(const bcm_bit_desc_ex_t *bd, uint32 flags, char* buf, int len)
+{
+       int i, slen = 0;
+       uint32 bit, mask;
+       const char *name;
+       mask = bd->mask;
+       if (len < 2 || !buf)
+               return 0;
+
+       buf[0] = '\0';
+
+       for (i = 0;  (name = bd->bitfield[i].name) != NULL; i++) {
+               bit = bd->bitfield[i].bit;
+               if ((flags & mask) == bit) {
+                       if (len > (int)strlen(name)) {
+                               slen = strlen(name);
+                               strncpy(buf, name, slen+1);
+                       }
+                       break;
+               }
+       }
+       return slen;
+}
+
+int
+bcm_format_flags(const bcm_bit_desc_t *bd, uint32 flags, char* buf, int len)
+{
+       int i;
+       char* p = buf;
+       char hexstr[16];
+       int slen = 0, nlen = 0;
+       uint32 bit;
+       const char* name;
+
+       if (len < 2 || !buf)
+               return 0;
+
+       buf[0] = '\0';
+
+       for (i = 0; flags != 0; i++) {
+               bit = bd[i].bit;
+               name = bd[i].name;
+               if (bit == 0 && flags != 0) {
+                       /* print any unnamed bits */
+                       snprintf(hexstr, 16, "0x%X", flags);
+                       name = hexstr;
+                       flags = 0;      /* exit loop */
+               } else if ((flags & bit) == 0)
+                       continue;
+               flags &= ~bit;
+               nlen = strlen(name);
+               slen += nlen;
+               /* count btwn flag space */
+               if (flags != 0)
+                       slen += 1;
+               /* need NULL char as well */
+               if (len <= slen)
+                       break;
+               /* copy NULL char but don't count it */
+               strncpy(p, name, nlen + 1);
+               p += nlen;
+               /* copy btwn flag space and NULL char */
+               if (flags != 0)
+                       p += snprintf(p, 2, " ");
+       }
+
+       /* indicate the str was too short */
+       if (flags != 0) {
+               p += snprintf(p, 2, ">");
+       }
+
+       return (int)(p - buf);
+}
+#endif 
+
+/* print bytes formatted as hex to a string. return the resulting string length */
+int
+bcm_format_hex(char *str, const void *bytes, int len)
+{
+       int i;
+       char *p = str;
+       const uint8 *src = (const uint8*)bytes;
+
+       for (i = 0; i < len; i++) {
+               p += snprintf(p, 3, "%02X", *src);
+               src++;
+       }
+       return (int)(p - str);
+}
+
+/* pretty hex print a contiguous buffer */
+void
+prhex(const char *msg, uchar *buf, uint nbytes)
+{
+       char line[128], *p;
+       int len = sizeof(line);
+       int nchar;
+       uint i;
+
+       if (msg && (msg[0] != '\0'))
+               printf("%s:\n", msg);
+
+       p = line;
+       for (i = 0; i < nbytes; i++) {
+               if (i % 16 == 0) {
+                       nchar = snprintf(p, len, "  %04x: ", i);        /* line prefix */
+                       p += nchar;
+                       len -= nchar;
+               }
+               if (len > 0) {
+                       nchar = snprintf(p, len, "%02x ", buf[i]);
+                       p += nchar;
+                       len -= nchar;
+               }
+
+               if (i % 16 == 15) {
+                       printf("%s\n", line);           /* flush line */
+                       p = line;
+                       len = sizeof(line);
+               }
+       }
+
+       /* flush last partial line */
+       if (p != line)
+               printf("%s\n", line);
+}
+
+static const char *crypto_algo_names[] = {
+       "NONE",
+       "WEP1",
+       "TKIP",
+       "WEP128",
+       "AES_CCM",
+       "AES_OCB_MSDU",
+       "AES_OCB_MPDU",
+       "NALG",
+       "UNDEF",
+       "UNDEF",
+       "UNDEF",
+#ifdef BCMWAPI_WAI
+       "WAPI",
+#else
+       "UNDEF"
+#endif
+       "PMK",
+       "BIP",
+       "AES_GCM",
+       "AES_CCM256",
+       "AES_GCM256",
+       "BIP_CMAC256",
+       "BIP_GMAC",
+       "BIP_GMAC256",
+       "UNDEF"
+};
+
+const char *
+bcm_crypto_algo_name(uint algo)
+{
+       return (algo < ARRAYSIZE(crypto_algo_names)) ? crypto_algo_names[algo] : "ERR";
+}
+
+
+char *
+bcm_chipname(uint chipid, char *buf, uint len)
+{
+       const char *fmt;
+
+       fmt = ((chipid > 0xa000) || (chipid < 0x4000)) ? "%d" : "%x";
+       snprintf(buf, len, fmt, chipid);
+       return buf;
+}
+
+/* Produce a human-readable string for boardrev */
+char *
+bcm_brev_str(uint32 brev, char *buf)
+{
+       if (brev < 0x100)
+               snprintf(buf, 8, "%d.%d", (brev & 0xf0) >> 4, brev & 0xf);
+       else
+               snprintf(buf, 8, "%c%03x", ((brev & 0xf000) == 0x1000) ? 'P' : 'A', brev & 0xfff);
+
+       return (buf);
+}
+
+#define BUFSIZE_TODUMP_ATONCE 512 /* Buffer size */
+
+/* dump large strings to console */
+void
+printbig(char *buf)
+{
+       uint len, max_len;
+       char c;
+
+       len = (uint)strlen(buf);
+
+       max_len = BUFSIZE_TODUMP_ATONCE;
+
+       while (len > max_len) {
+               c = buf[max_len];
+               buf[max_len] = '\0';
+               printf("%s", buf);
+               buf[max_len] = c;
+
+               buf += max_len;
+               len -= max_len;
+       }
+       /* print the remaining string */
+       printf("%s\n", buf);
+       return;
+}
+
+/* routine to dump fields in a fileddesc structure */
+uint
+bcmdumpfields(bcmutl_rdreg_rtn read_rtn, void *arg0, uint arg1, struct fielddesc *fielddesc_array,
+       char *buf, uint32 bufsize)
+{
+       uint  filled_len;
+       int len;
+       struct fielddesc *cur_ptr;
+
+       filled_len = 0;
+       cur_ptr = fielddesc_array;
+
+       while (bufsize > 1) {
+               if (cur_ptr->nameandfmt == NULL)
+                       break;
+               len = snprintf(buf, bufsize, cur_ptr->nameandfmt,
+                              read_rtn(arg0, arg1, cur_ptr->offset));
+               /* check for snprintf overflow or error */
+               if (len < 0 || (uint32)len >= bufsize)
+                       len = bufsize - 1;
+               buf += len;
+               bufsize -= len;
+               filled_len += len;
+               cur_ptr++;
+       }
+       return filled_len;
+}
+
+uint
+bcm_mkiovar(const char *name, char *data, uint datalen, char *buf, uint buflen)
+{
+       uint len;
+
+       len = (uint)strlen(name) + 1;
+
+       if ((len + datalen) > buflen)
+               return 0;
+
+       strncpy(buf, name, buflen);
+
+       /* append data onto the end of the name string */
+       memcpy(&buf[len], data, datalen);
+       len += datalen;
+
+       return len;
+}
+
+/* Quarter dBm units to mW
+ * Table starts at QDBM_OFFSET, so the first entry is mW for qdBm=153
+ * Table is offset so the last entry is largest mW value that fits in
+ * a uint16.
+ */
+
+#define QDBM_OFFSET 153                /* Offset for first entry */
+#define QDBM_TABLE_LEN 40      /* Table size */
+
+/* Smallest mW value that will round up to the first table entry, QDBM_OFFSET.
+ * Value is ( mW(QDBM_OFFSET - 1) + mW(QDBM_OFFSET) ) / 2
+ */
+#define QDBM_TABLE_LOW_BOUND 6493 /* Low bound */
+
+/* Largest mW value that will round down to the last table entry,
+ * QDBM_OFFSET + QDBM_TABLE_LEN-1.
+ * Value is ( mW(QDBM_OFFSET + QDBM_TABLE_LEN - 1) + mW(QDBM_OFFSET + QDBM_TABLE_LEN) ) / 2.
+ */
+#define QDBM_TABLE_HIGH_BOUND 64938 /* High bound */
+
+static const uint16 nqdBm_to_mW_map[QDBM_TABLE_LEN] = {
+/* qdBm:       +0      +1      +2      +3      +4      +5      +6      +7 */
+/* 153: */      6683,  7079,   7499,   7943,   8414,   8913,   9441,   10000,
+/* 161: */      10593, 11220,  11885,  12589,  13335,  14125,  14962,  15849,
+/* 169: */      16788, 17783,  18836,  19953,  21135,  22387,  23714,  25119,
+/* 177: */      26607, 28184,  29854,  31623,  33497,  35481,  37584,  39811,
+/* 185: */      42170, 44668,  47315,  50119,  53088,  56234,  59566,  63096
+};
+
+uint16
+bcm_qdbm_to_mw(uint8 qdbm)
+{
+       uint factor = 1;
+       int idx = qdbm - QDBM_OFFSET;
+
+       if (idx >= QDBM_TABLE_LEN) {
+               /* clamp to max uint16 mW value */
+               return 0xFFFF;
+       }
+
+       /* scale the qdBm index up to the range of the table 0-40
+        * where an offset of 40 qdBm equals a factor of 10 mW.
+        */
+       while (idx < 0) {
+               idx += 40;
+               factor *= 10;
+       }
+
+       /* return the mW value scaled down to the correct factor of 10,
+        * adding in factor/2 to get proper rounding.
+        */
+       return ((nqdBm_to_mW_map[idx] + factor/2) / factor);
+}
+
+uint8
+bcm_mw_to_qdbm(uint16 mw)
+{
+       uint8 qdbm;
+       int offset;
+       uint mw_uint = mw;
+       uint boundary;
+
+       /* handle boundary case */
+       if (mw_uint <= 1)
+               return 0;
+
+       offset = QDBM_OFFSET;
+
+       /* move mw into the range of the table */
+       while (mw_uint < QDBM_TABLE_LOW_BOUND) {
+               mw_uint *= 10;
+               offset -= 40;
+       }
+
+       for (qdbm = 0; qdbm < QDBM_TABLE_LEN-1; qdbm++) {
+               boundary = nqdBm_to_mW_map[qdbm] + (nqdBm_to_mW_map[qdbm+1] -
+                                                   nqdBm_to_mW_map[qdbm])/2;
+               if (mw_uint < boundary) break;
+       }
+
+       qdbm += (uint8)offset;
+
+       return (qdbm);
+}
+
+
+uint
+bcm_bitcount(uint8 *bitmap, uint length)
+{
+       uint bitcount = 0, i;
+       uint8 tmp;
+       for (i = 0; i < length; i++) {
+               tmp = bitmap[i];
+               while (tmp) {
+                       bitcount++;
+                       tmp &= (tmp - 1);
+               }
+       }
+       return bitcount;
+}
+
+#if defined(BCMDRIVER) || defined(WL_UNITTEST)
+
+/* triggers bcm_bprintf to print to kernel log */
+bool bcm_bprintf_bypass = FALSE;
+
+/* Initialization of bcmstrbuf structure */
+void
+bcm_binit(struct bcmstrbuf *b, char *buf, uint size)
+{
+       b->origsize = b->size = size;
+       b->origbuf = b->buf = buf;
+}
+
+/* Buffer sprintf wrapper to guard against buffer overflow */
+int
+bcm_bprintf(struct bcmstrbuf *b, const char *fmt, ...)
+{
+       va_list ap;
+       int r;
+
+       va_start(ap, fmt);
+
+       r = vsnprintf(b->buf, b->size, fmt, ap);
+       if (bcm_bprintf_bypass == TRUE) {
+               printf(b->buf);
+               goto exit;
+       }
+
+       /* Non Ansi C99 compliant returns -1,
+        * Ansi compliant return r >= b->size,
+        * bcmstdlib returns 0, handle all
+        */
+       /* r == 0 is also the case when strlen(fmt) is zero.
+        * typically the case when "" is passed as argument.
+        */
+       if ((r == -1) || (r >= (int)b->size)) {
+               b->size = 0;
+       } else {
+               b->size -= r;
+               b->buf += r;
+       }
+
+exit:
+       va_end(ap);
+
+       return r;
+}
+
+void
+bcm_bprhex(struct bcmstrbuf *b, const char *msg, bool newline, const uint8 *buf, int len)
+{
+       int i;
+
+       if (msg != NULL && msg[0] != '\0')
+               bcm_bprintf(b, "%s", msg);
+       for (i = 0; i < len; i ++)
+               bcm_bprintf(b, "%02X", buf[i]);
+       if (newline)
+               bcm_bprintf(b, "\n");
+}
+
+void
+bcm_inc_bytes(uchar *num, int num_bytes, uint8 amount)
+{
+       int i;
+
+       for (i = 0; i < num_bytes; i++) {
+               num[i] += amount;
+               if (num[i] >= amount)
+                       break;
+               amount = 1;
+       }
+}
+
+int
+bcm_cmp_bytes(const uchar *arg1, const uchar *arg2, uint8 nbytes)
+{
+       int i;
+
+       for (i = nbytes - 1; i >= 0; i--) {
+               if (arg1[i] != arg2[i])
+                       return (arg1[i] - arg2[i]);
+       }
+       return 0;
+}
+
+void
+bcm_print_bytes(const char *name, const uchar *data, int len)
+{
+       int i;
+       int per_line = 0;
+
+       printf("%s: %d \n", name ? name : "", len);
+       for (i = 0; i < len; i++) {
+               printf("%02x ", *data++);
+               per_line++;
+               if (per_line == 16) {
+                       per_line = 0;
+                       printf("\n");
+               }
+       }
+       printf("\n");
+}
+
+/* Look for vendor-specific IE with specified OUI and optional type */
+bcm_tlv_t *
+bcm_find_vendor_ie(void *tlvs, int tlvs_len, const char *voui, uint8 *type, int type_len)
+{
+       bcm_tlv_t *ie;
+       uint8 ie_len;
+
+       ie = (bcm_tlv_t*)tlvs;
+
+       /* make sure we are looking at a valid IE */
+       if (ie == NULL || !bcm_valid_tlv(ie, tlvs_len)) {
+               return NULL;
+       }
+
+       /* Walk through the IEs looking for an OUI match */
+       do {
+               ie_len = ie->len;
+               if ((ie->id == DOT11_MNG_PROPR_ID) &&
+                   (ie_len >= (DOT11_OUI_LEN + type_len)) &&
+                   !bcmp(ie->data, voui, DOT11_OUI_LEN))
+               {
+                       /* compare optional type */
+                       if (type_len == 0 ||
+                           !bcmp(&ie->data[DOT11_OUI_LEN], type, type_len)) {
+                               return (ie);            /* a match */
+                       }
+               }
+       } while ((ie = bcm_next_tlv(ie, &tlvs_len)) != NULL);
+
+       return NULL;
+}
+
+#if defined(WLTINYDUMP) || defined(WLMSG_INFORM) || defined(WLMSG_ASSOC) || \
+       defined(WLMSG_PRPKT) || defined(WLMSG_WSEC)
+#define SSID_FMT_BUF_LEN       ((4 * DOT11_MAX_SSID_LEN) + 1)
+
+int
+bcm_format_ssid(char* buf, const uchar ssid[], uint ssid_len)
+{
+       uint i, c;
+       char *p = buf;
+       char *endp = buf + SSID_FMT_BUF_LEN;
+
+       if (ssid_len > DOT11_MAX_SSID_LEN) ssid_len = DOT11_MAX_SSID_LEN;
+
+       for (i = 0; i < ssid_len; i++) {
+               c = (uint)ssid[i];
+               if (c == '\\') {
+                       *p++ = '\\';
+                       *p++ = '\\';
+               } else if (bcm_isprint((uchar)c)) {
+                       *p++ = (char)c;
+               } else {
+                       p += snprintf(p, (endp - p), "\\x%02X", c);
+               }
+       }
+       *p = '\0';
+       ASSERT(p < endp);
+
+       return (int)(p - buf);
+}
+#endif 
+
+#endif /* BCMDRIVER || WL_UNITTEST */
+
+/*
+ * ProcessVars:Takes a buffer of "<var>=<value>\n" lines read from a file and ending in a NUL.
+ * also accepts nvram files which are already in the format of <var1>=<value>\0\<var2>=<value2>\0
+ * Removes carriage returns, empty lines, comment lines, and converts newlines to NULs.
+ * Shortens buffer as needed and pads with NULs.  End of buffer is marked by two NULs.
+*/
+
+unsigned int
+process_nvram_vars(char *varbuf, unsigned int len)
+{
+       char *dp;
+       bool findNewline;
+       int column;
+       unsigned int buf_len, n;
+       unsigned int pad = 0;
+
+       dp = varbuf;
+
+       findNewline = FALSE;
+       column = 0;
+
+       for (n = 0; n < len; n++) {
+               if (varbuf[n] == '\r')
+                       continue;
+               if (findNewline && varbuf[n] != '\n')
+                       continue;
+               findNewline = FALSE;
+               if (varbuf[n] == '#') {
+                       findNewline = TRUE;
+                       continue;
+               }
+               if (varbuf[n] == '\n') {
+                       if (column == 0)
+                               continue;
+                       *dp++ = 0;
+                       column = 0;
+                       continue;
+               }
+               *dp++ = varbuf[n];
+               column++;
+       }
+       buf_len = (unsigned int)(dp - varbuf);
+       if (buf_len % 4) {
+               pad = 4 - buf_len % 4;
+               if (pad && (buf_len + pad <= len)) {
+                       buf_len += pad;
+               }
+       }
+
+       while (dp < varbuf + n)
+               *dp++ = 0;
+
+       return buf_len;
+}
+
+/* calculate a * b + c */
+void
+bcm_uint64_multiple_add(uint32* r_high, uint32* r_low, uint32 a, uint32 b, uint32 c)
+{
+#define FORMALIZE(var) {cc += (var & 0x80000000) ? 1 : 0; var &= 0x7fffffff;}
+       uint32 r1, r0;
+       uint32 a1, a0, b1, b0, t, cc = 0;
+
+       a1 = a >> 16;
+       a0 = a & 0xffff;
+       b1 = b >> 16;
+       b0 = b & 0xffff;
+
+       r0 = a0 * b0;
+       FORMALIZE(r0);
+
+       t = (a1 * b0) << 16;
+       FORMALIZE(t);
+
+       r0 += t;
+       FORMALIZE(r0);
+
+       t = (a0 * b1) << 16;
+       FORMALIZE(t);
+
+       r0 += t;
+       FORMALIZE(r0);
+
+       FORMALIZE(c);
+
+       r0 += c;
+       FORMALIZE(r0);
+
+       r0 |= (cc % 2) ? 0x80000000 : 0;
+       r1 = a1 * b1 + ((a1 * b0) >> 16) + ((b1 * a0) >> 16) + (cc / 2);
+
+       *r_high = r1;
+       *r_low = r0;
+}
+
+/* calculate a / b */
+void
+bcm_uint64_divide(uint32* r, uint32 a_high, uint32 a_low, uint32 b)
+{
+       uint32 a1 = a_high, a0 = a_low, r0 = 0;
+
+       if (b < 2)
+               return;
+
+       while (a1 != 0) {
+               r0 += (0xffffffff / b) * a1;
+               bcm_uint64_multiple_add(&a1, &a0, ((0xffffffff % b) + 1) % b, a1, a0);
+       }
+
+       r0 += a0 / b;
+       *r = r0;
+}
+
+#ifndef setbit /* As in the header file */
+#ifdef BCMUTILS_BIT_MACROS_USE_FUNCS
+/* Set bit in byte array. */
+void
+setbit(void *array, uint bit)
+{
+       ((uint8 *)array)[bit / NBBY] |= 1 << (bit % NBBY);
+}
+
+/* Clear bit in byte array. */
+void
+clrbit(void *array, uint bit)
+{
+       ((uint8 *)array)[bit / NBBY] &= ~(1 << (bit % NBBY));
+}
+
+/* Test if bit is set in byte array. */
+bool
+isset(const void *array, uint bit)
+{
+       return (((const uint8 *)array)[bit / NBBY] & (1 << (bit % NBBY)));
+}
+
+/* Test if bit is clear in byte array. */
+bool
+isclr(const void *array, uint bit)
+{
+       return ((((const uint8 *)array)[bit / NBBY] & (1 << (bit % NBBY))) == 0);
+}
+#endif /* BCMUTILS_BIT_MACROS_USE_FUNCS */
+#endif /* setbit */
+
+void
+set_bitrange(void *array, uint start, uint end, uint maxbit)
+{
+       uint startbyte = start/NBBY;
+       uint endbyte = end/NBBY;
+       uint i, startbytelastbit, endbytestartbit;
+
+       if (end >= start) {
+               if (endbyte - startbyte > 1)
+               {
+                       startbytelastbit = (startbyte+1)*NBBY - 1;
+                       endbytestartbit = endbyte*NBBY;
+                       for (i = startbyte+1; i < endbyte; i++)
+                               ((uint8 *)array)[i] = 0xFF;
+                       for (i = start; i <= startbytelastbit; i++)
+                               setbit(array, i);
+                       for (i = endbytestartbit; i <= end; i++)
+                               setbit(array, i);
+               } else {
+                       for (i = start; i <= end; i++)
+                               setbit(array, i);
+               }
+       }
+       else {
+               set_bitrange(array, start, maxbit, maxbit);
+               set_bitrange(array, 0, end, maxbit);
+       }
+}
+
+void
+bcm_bitprint32(const uint32 u32arg)
+{
+       int i;
+       for (i = NBITS(uint32) - 1; i >= 0; i--) {
+               isbitset(u32arg, i) ? printf("1") : printf("0");
+               if ((i % NBBY) == 0) printf(" ");
+       }
+       printf("\n");
+}
+
+/* calculate checksum for ip header, tcp / udp header / data */
+uint16
+bcm_ip_cksum(uint8 *buf, uint32 len, uint32 sum)
+{
+       while (len > 1) {
+               sum += (buf[0] << 8) | buf[1];
+               buf += 2;
+               len -= 2;
+       }
+
+       if (len > 0) {
+               sum += (*buf) << 8;
+       }
+
+       while (sum >> 16) {
+               sum = (sum & 0xffff) + (sum >> 16);
+       }
+
+       return ((uint16)~sum);
+}
+#if defined(BCMDRIVER) && !defined(_CFEZ_)
+/*
+ * Hierarchical Multiword bitmap based small id allocator.
+ *
+ * Multilevel hierarchy bitmap. (maximum 2 levels)
+ * First hierarchy uses a multiword bitmap to identify 32bit words in the
+ * second hierarchy that have at least a single bit set. Each bit in a word of
+ * the second hierarchy represents a unique ID that may be allocated.
+ *
+ * BCM_MWBMAP_ITEMS_MAX: Maximum number of IDs managed.
+ * BCM_MWBMAP_BITS_WORD: Number of bits in a bitmap word word
+ * BCM_MWBMAP_WORDS_MAX: Maximum number of bitmap words needed for free IDs.
+ * BCM_MWBMAP_WDMAP_MAX: Maximum number of bitmap wordss identifying first non
+ *                       non-zero bitmap word carrying at least one free ID.
+ * BCM_MWBMAP_SHIFT_OP:  Used in MOD, DIV and MUL operations.
+ * BCM_MWBMAP_INVALID_IDX: Value ~0U is treated as an invalid ID
+ *
+ * Design Notes:
+ * BCM_MWBMAP_USE_CNTSETBITS trades CPU for memory. A runtime count of how many
+ * bits are computed each time on allocation and deallocation, requiring 4
+ * array indexed access and 3 arithmetic operations. When not defined, a runtime
+ * count of set bits state is maintained. Upto 32 Bytes per 1024 IDs is needed.
+ * In a 4K max ID allocator, up to 128Bytes are hence used per instantiation.
+ * In a memory limited system e.g. dongle builds, a CPU for memory tradeoff may
+ * be used by defining BCM_MWBMAP_USE_CNTSETBITS.
+ *
+ * Note: wd_bitmap[] is statically declared and is not ROM friendly ... array
+ * size is fixed. No intention to support larger than 4K indice allocation. ID
+ * allocators for ranges smaller than 4K will have a wastage of only 12Bytes
+ * with savings in not having to use an indirect access, had it been dynamically
+ * allocated.
+ */
+#define BCM_MWBMAP_ITEMS_MAX    (64 * 1024)  /* May increase to 64K */
+
+#define BCM_MWBMAP_BITS_WORD    (NBITS(uint32))
+#define BCM_MWBMAP_WORDS_MAX    (BCM_MWBMAP_ITEMS_MAX / BCM_MWBMAP_BITS_WORD)
+#define BCM_MWBMAP_WDMAP_MAX    (BCM_MWBMAP_WORDS_MAX / BCM_MWBMAP_BITS_WORD)
+#define BCM_MWBMAP_SHIFT_OP     (5)
+#define BCM_MWBMAP_MODOP(ix)    ((ix) & (BCM_MWBMAP_BITS_WORD - 1))
+#define BCM_MWBMAP_DIVOP(ix)    ((ix) >> BCM_MWBMAP_SHIFT_OP)
+#define BCM_MWBMAP_MULOP(ix)    ((ix) << BCM_MWBMAP_SHIFT_OP)
+
+/* Redefine PTR() and/or HDL() conversion to invoke audit for debugging */
+#define BCM_MWBMAP_PTR(hdl)            ((struct bcm_mwbmap *)(hdl))
+#define BCM_MWBMAP_HDL(ptr)            ((void *)(ptr))
+
+#if defined(BCM_MWBMAP_DEBUG)
+#define BCM_MWBMAP_AUDIT(mwb) \
+       do { \
+               ASSERT((mwb != NULL) && \
+                      (((struct bcm_mwbmap *)(mwb))->magic == (void *)(mwb))); \
+               bcm_mwbmap_audit(mwb); \
+       } while (0)
+#define MWBMAP_ASSERT(exp)             ASSERT(exp)
+#define MWBMAP_DBG(x)           printf x
+#else   /* !BCM_MWBMAP_DEBUG */
+#define BCM_MWBMAP_AUDIT(mwb)   do {} while (0)
+#define MWBMAP_ASSERT(exp)             do {} while (0)
+#define MWBMAP_DBG(x)
+#endif  /* !BCM_MWBMAP_DEBUG */
+
+
+typedef struct bcm_mwbmap {     /* Hierarchical multiword bitmap allocator    */
+       uint16 wmaps;               /* Total number of words in free wd bitmap    */
+       uint16 imaps;               /* Total number of words in free id bitmap    */
+       int32  ifree;               /* Count of free indices. Used only in audits */
+       uint16 total;               /* Total indices managed by multiword bitmap  */
+
+       void * magic;               /* Audit handle parameter from user           */
+
+       uint32 wd_bitmap[BCM_MWBMAP_WDMAP_MAX]; /* 1st level bitmap of            */
+#if !defined(BCM_MWBMAP_USE_CNTSETBITS)
+       int8   wd_count[BCM_MWBMAP_WORDS_MAX];  /* free id running count, 1st lvl */
+#endif /*  ! BCM_MWBMAP_USE_CNTSETBITS */
+
+       uint32 id_bitmap[0];        /* Second level bitmap                        */
+} bcm_mwbmap_t;
+
+/* Incarnate a hierarchical multiword bitmap based small index allocator. */
+struct bcm_mwbmap *
+bcm_mwbmap_init(osl_t *osh, uint32 items_max)
+{
+       struct bcm_mwbmap * mwbmap_p;
+       uint32 wordix, size, words, extra;
+
+       /* Implementation Constraint: Uses 32bit word bitmap */
+       MWBMAP_ASSERT(BCM_MWBMAP_BITS_WORD == 32U);
+       MWBMAP_ASSERT(BCM_MWBMAP_SHIFT_OP == 5U);
+       MWBMAP_ASSERT(ISPOWEROF2(BCM_MWBMAP_ITEMS_MAX));
+       MWBMAP_ASSERT((BCM_MWBMAP_ITEMS_MAX % BCM_MWBMAP_BITS_WORD) == 0U);
+
+       ASSERT(items_max <= BCM_MWBMAP_ITEMS_MAX);
+
+       /* Determine the number of words needed in the multiword bitmap */
+       extra = BCM_MWBMAP_MODOP(items_max);
+       words = BCM_MWBMAP_DIVOP(items_max) + ((extra != 0U) ? 1U : 0U);
+
+       /* Allocate runtime state of multiword bitmap */
+       /* Note: wd_count[] or wd_bitmap[] are not dynamically allocated */
+       size = sizeof(bcm_mwbmap_t) + (sizeof(uint32) * words);
+       mwbmap_p = (bcm_mwbmap_t *)MALLOC(osh, size);
+       if (mwbmap_p == (bcm_mwbmap_t *)NULL) {
+               ASSERT(0);
+               goto error1;
+       }
+       memset(mwbmap_p, 0, size);
+
+       /* Initialize runtime multiword bitmap state */
+       mwbmap_p->imaps = (uint16)words;
+       mwbmap_p->ifree = (int32)items_max;
+       mwbmap_p->total = (uint16)items_max;
+
+       /* Setup magic, for use in audit of handle */
+       mwbmap_p->magic = BCM_MWBMAP_HDL(mwbmap_p);
+
+       /* Setup the second level bitmap of free indices */
+       /* Mark all indices as available */
+       for (wordix = 0U; wordix < mwbmap_p->imaps; wordix++) {
+               mwbmap_p->id_bitmap[wordix] = (uint32)(~0U);
+#if !defined(BCM_MWBMAP_USE_CNTSETBITS)
+               mwbmap_p->wd_count[wordix] = BCM_MWBMAP_BITS_WORD;
+#endif /*  ! BCM_MWBMAP_USE_CNTSETBITS */
+       }
+
+       /* Ensure that extra indices are tagged as un-available */
+       if (extra) { /* fixup the free ids in last bitmap and wd_count */
+               uint32 * bmap_p = &mwbmap_p->id_bitmap[mwbmap_p->imaps - 1];
+               *bmap_p ^= (uint32)(~0U << extra); /* fixup bitmap */
+#if !defined(BCM_MWBMAP_USE_CNTSETBITS)
+               mwbmap_p->wd_count[mwbmap_p->imaps - 1] = (int8)extra; /* fixup count */
+#endif /*  ! BCM_MWBMAP_USE_CNTSETBITS */
+       }
+
+       /* Setup the first level bitmap hierarchy */
+       extra = BCM_MWBMAP_MODOP(mwbmap_p->imaps);
+       words = BCM_MWBMAP_DIVOP(mwbmap_p->imaps) + ((extra != 0U) ? 1U : 0U);
+
+       mwbmap_p->wmaps = (uint16)words;
+
+       for (wordix = 0U; wordix < mwbmap_p->wmaps; wordix++)
+               mwbmap_p->wd_bitmap[wordix] = (uint32)(~0U);
+       if (extra) {
+               uint32 * bmap_p = &mwbmap_p->wd_bitmap[mwbmap_p->wmaps - 1];
+               *bmap_p ^= (uint32)(~0U << extra); /* fixup bitmap */
+       }
+
+       return mwbmap_p;
+
+error1:
+       return BCM_MWBMAP_INVALID_HDL;
+}
+
+/* Release resources used by multiword bitmap based small index allocator. */
+void
+bcm_mwbmap_fini(osl_t * osh, struct bcm_mwbmap * mwbmap_hdl)
+{
+       bcm_mwbmap_t * mwbmap_p;
+
+       BCM_MWBMAP_AUDIT(mwbmap_hdl);
+       mwbmap_p = BCM_MWBMAP_PTR(mwbmap_hdl);
+
+       MFREE(osh, mwbmap_p, sizeof(struct bcm_mwbmap)
+                            + (sizeof(uint32) * mwbmap_p->imaps));
+       return;
+}
+
+/* Allocate a unique small index using a multiword bitmap index allocator.    */
+uint32 BCMFASTPATH
+bcm_mwbmap_alloc(struct bcm_mwbmap * mwbmap_hdl)
+{
+       bcm_mwbmap_t * mwbmap_p;
+       uint32 wordix, bitmap;
+
+       BCM_MWBMAP_AUDIT(mwbmap_hdl);
+       mwbmap_p = BCM_MWBMAP_PTR(mwbmap_hdl);
+
+       /* Start with the first hierarchy */
+       for (wordix = 0; wordix < mwbmap_p->wmaps; ++wordix) {
+
+               bitmap = mwbmap_p->wd_bitmap[wordix]; /* get the word bitmap */
+
+               if (bitmap != 0U) {
+
+                       uint32 count, bitix, *bitmap_p;
+
+                       bitmap_p = &mwbmap_p->wd_bitmap[wordix];
+
+                       /* clear all except trailing 1 */
+                       bitmap   = (uint32)(((int)(bitmap)) & (-((int)(bitmap))));
+                       MWBMAP_ASSERT(C_bcm_count_leading_zeros(bitmap) ==
+                                     bcm_count_leading_zeros(bitmap));
+                       bitix    = (BCM_MWBMAP_BITS_WORD - 1)
+                                - bcm_count_leading_zeros(bitmap); /* use asm clz */
+                       wordix   = BCM_MWBMAP_MULOP(wordix) + bitix;
+
+                       /* Clear bit if wd count is 0, without conditional branch */
+#if defined(BCM_MWBMAP_USE_CNTSETBITS)
+                       count = bcm_cntsetbits(mwbmap_p->id_bitmap[wordix]) - 1;
+#else  /* ! BCM_MWBMAP_USE_CNTSETBITS */
+                       mwbmap_p->wd_count[wordix]--;
+                       count = mwbmap_p->wd_count[wordix];
+                       MWBMAP_ASSERT(count ==
+                                     (bcm_cntsetbits(mwbmap_p->id_bitmap[wordix]) - 1));
+#endif /* ! BCM_MWBMAP_USE_CNTSETBITS */
+                       MWBMAP_ASSERT(count >= 0);
+
+                       /* clear wd_bitmap bit if id_map count is 0 */
+                       bitmap = (count == 0) << bitix;
+
+                       MWBMAP_DBG((
+                           "Lvl1: bitix<%02u> wordix<%02u>: %08x ^ %08x = %08x wfree %d",
+                           bitix, wordix, *bitmap_p, bitmap, (*bitmap_p) ^ bitmap, count));
+
+                       *bitmap_p ^= bitmap;
+
+                       /* Use bitix in the second hierarchy */
+                       bitmap_p = &mwbmap_p->id_bitmap[wordix];
+
+                       bitmap = mwbmap_p->id_bitmap[wordix]; /* get the id bitmap */
+                       MWBMAP_ASSERT(bitmap != 0U);
+
+                       /* clear all except trailing 1 */
+                       bitmap   = (uint32)(((int)(bitmap)) & (-((int)(bitmap))));
+                       MWBMAP_ASSERT(C_bcm_count_leading_zeros(bitmap) ==
+                                     bcm_count_leading_zeros(bitmap));
+                       bitix    = BCM_MWBMAP_MULOP(wordix)
+                                + (BCM_MWBMAP_BITS_WORD - 1)
+                                - bcm_count_leading_zeros(bitmap); /* use asm clz */
+
+                       mwbmap_p->ifree--; /* decrement system wide free count */
+                       MWBMAP_ASSERT(mwbmap_p->ifree >= 0);
+
+                       MWBMAP_DBG((
+                           "Lvl2: bitix<%02u> wordix<%02u>: %08x ^ %08x = %08x ifree %d",
+                           bitix, wordix, *bitmap_p, bitmap, (*bitmap_p) ^ bitmap,
+                           mwbmap_p->ifree));
+
+                       *bitmap_p ^= bitmap; /* mark as allocated = 1b0 */
+
+                       return bitix;
+               }
+       }
+
+       ASSERT(mwbmap_p->ifree == 0);
+
+       return BCM_MWBMAP_INVALID_IDX;
+}
+
+/* Force an index at a specified position to be in use */
+void
+bcm_mwbmap_force(struct bcm_mwbmap * mwbmap_hdl, uint32 bitix)
+{
+       bcm_mwbmap_t * mwbmap_p;
+       uint32 count, wordix, bitmap, *bitmap_p;
+
+       BCM_MWBMAP_AUDIT(mwbmap_hdl);
+       mwbmap_p = BCM_MWBMAP_PTR(mwbmap_hdl);
+
+       ASSERT(bitix < mwbmap_p->total);
+
+       /* Start with second hierarchy */
+       wordix   = BCM_MWBMAP_DIVOP(bitix);
+       bitmap   = (uint32)(1U << BCM_MWBMAP_MODOP(bitix));
+       bitmap_p = &mwbmap_p->id_bitmap[wordix];
+
+       ASSERT((*bitmap_p & bitmap) == bitmap);
+
+       mwbmap_p->ifree--; /* update free count */
+       ASSERT(mwbmap_p->ifree >= 0);
+
+       MWBMAP_DBG(("Lvl2: bitix<%u> wordix<%u>: %08x ^ %08x = %08x ifree %d",
+                  bitix, wordix, *bitmap_p, bitmap, (*bitmap_p) ^ bitmap,
+                  mwbmap_p->ifree));
+
+       *bitmap_p ^= bitmap; /* mark as in use */
+
+       /* Update first hierarchy */
+       bitix    = wordix;
+
+       wordix   = BCM_MWBMAP_DIVOP(bitix);
+       bitmap_p = &mwbmap_p->wd_bitmap[wordix];
+
+#if defined(BCM_MWBMAP_USE_CNTSETBITS)
+       count = bcm_cntsetbits(mwbmap_p->id_bitmap[bitix]);
+#else  /* ! BCM_MWBMAP_USE_CNTSETBITS */
+       mwbmap_p->wd_count[bitix]--;
+       count = mwbmap_p->wd_count[bitix];
+       MWBMAP_ASSERT(count == bcm_cntsetbits(mwbmap_p->id_bitmap[bitix]));
+#endif /* ! BCM_MWBMAP_USE_CNTSETBITS */
+       MWBMAP_ASSERT(count >= 0);
+
+       bitmap   = (count == 0) << BCM_MWBMAP_MODOP(bitix);
+
+       MWBMAP_DBG(("Lvl1: bitix<%02lu> wordix<%02u>: %08x ^ %08x = %08x wfree %d",
+                  BCM_MWBMAP_MODOP(bitix), wordix, *bitmap_p, bitmap,
+                  (*bitmap_p) ^ bitmap, count));
+
+       *bitmap_p ^= bitmap; /* mark as in use */
+
+       return;
+}
+
+/* Free a previously allocated index back into the multiword bitmap allocator */
+void BCMFASTPATH
+bcm_mwbmap_free(struct bcm_mwbmap * mwbmap_hdl, uint32 bitix)
+{
+       bcm_mwbmap_t * mwbmap_p;
+       uint32 wordix, bitmap, *bitmap_p;
+
+       BCM_MWBMAP_AUDIT(mwbmap_hdl);
+       mwbmap_p = BCM_MWBMAP_PTR(mwbmap_hdl);
+
+       ASSERT(bitix < mwbmap_p->total);
+
+       /* Start with second level hierarchy */
+       wordix   = BCM_MWBMAP_DIVOP(bitix);
+       bitmap   = (1U << BCM_MWBMAP_MODOP(bitix));
+       bitmap_p = &mwbmap_p->id_bitmap[wordix];
+
+       ASSERT((*bitmap_p & bitmap) == 0U);     /* ASSERT not a double free */
+
+       mwbmap_p->ifree++; /* update free count */
+       ASSERT(mwbmap_p->ifree <= mwbmap_p->total);
+
+       MWBMAP_DBG(("Lvl2: bitix<%02u> wordix<%02u>: %08x | %08x = %08x ifree %d",
+                  bitix, wordix, *bitmap_p, bitmap, (*bitmap_p) | bitmap,
+                  mwbmap_p->ifree));
+
+       *bitmap_p |= bitmap; /* mark as available */
+
+       /* Now update first level hierarchy */
+
+       bitix    = wordix;
+
+       wordix   = BCM_MWBMAP_DIVOP(bitix); /* first level's word index */
+       bitmap   = (1U << BCM_MWBMAP_MODOP(bitix));
+       bitmap_p = &mwbmap_p->wd_bitmap[wordix];
+
+#if !defined(BCM_MWBMAP_USE_CNTSETBITS)
+       mwbmap_p->wd_count[bitix]++;
+#endif
+
+#if defined(BCM_MWBMAP_DEBUG)
+       {
+               uint32 count;
+#if defined(BCM_MWBMAP_USE_CNTSETBITS)
+               count = bcm_cntsetbits(mwbmap_p->id_bitmap[bitix]);
+#else  /*  ! BCM_MWBMAP_USE_CNTSETBITS */
+               count = mwbmap_p->wd_count[bitix];
+               MWBMAP_ASSERT(count == bcm_cntsetbits(mwbmap_p->id_bitmap[bitix]));
+#endif /*  ! BCM_MWBMAP_USE_CNTSETBITS */
+
+               MWBMAP_ASSERT(count <= BCM_MWBMAP_BITS_WORD);
+
+               MWBMAP_DBG(("Lvl1: bitix<%02u> wordix<%02u>: %08x | %08x = %08x wfree %d",
+                           bitix, wordix, *bitmap_p, bitmap, (*bitmap_p) | bitmap, count));
+       }
+#endif /* BCM_MWBMAP_DEBUG */
+
+       *bitmap_p |= bitmap;
+
+       return;
+}
+
+/* Fetch the toal number of free indices in the multiword bitmap allocator */
+uint32
+bcm_mwbmap_free_cnt(struct bcm_mwbmap * mwbmap_hdl)
+{
+       bcm_mwbmap_t * mwbmap_p;
+
+       BCM_MWBMAP_AUDIT(mwbmap_hdl);
+       mwbmap_p = BCM_MWBMAP_PTR(mwbmap_hdl);
+
+       ASSERT(mwbmap_p->ifree >= 0);
+
+       return mwbmap_p->ifree;
+}
+
+/* Determine whether an index is inuse or free */
+bool
+bcm_mwbmap_isfree(struct bcm_mwbmap * mwbmap_hdl, uint32 bitix)
+{
+       bcm_mwbmap_t * mwbmap_p;
+       uint32 wordix, bitmap;
+
+       BCM_MWBMAP_AUDIT(mwbmap_hdl);
+       mwbmap_p = BCM_MWBMAP_PTR(mwbmap_hdl);
+
+       ASSERT(bitix < mwbmap_p->total);
+
+       wordix   = BCM_MWBMAP_DIVOP(bitix);
+       bitmap   = (1U << BCM_MWBMAP_MODOP(bitix));
+
+       return ((mwbmap_p->id_bitmap[wordix] & bitmap) != 0U);
+}
+
+/* Debug dump a multiword bitmap allocator */
+void
+bcm_mwbmap_show(struct bcm_mwbmap * mwbmap_hdl)
+{
+       uint32 ix, count;
+       bcm_mwbmap_t * mwbmap_p;
+
+       BCM_MWBMAP_AUDIT(mwbmap_hdl);
+       mwbmap_p = BCM_MWBMAP_PTR(mwbmap_hdl);
+
+       printf("mwbmap_p %p wmaps %u imaps %u ifree %d total %u\n", mwbmap_p,
+              mwbmap_p->wmaps, mwbmap_p->imaps, mwbmap_p->ifree, mwbmap_p->total);
+       for (ix = 0U; ix < mwbmap_p->wmaps; ix++) {
+               printf("\tWDMAP:%2u. 0x%08x\t", ix, mwbmap_p->wd_bitmap[ix]);
+               bcm_bitprint32(mwbmap_p->wd_bitmap[ix]);
+               printf("\n");
+       }
+       for (ix = 0U; ix < mwbmap_p->imaps; ix++) {
+#if defined(BCM_MWBMAP_USE_CNTSETBITS)
+               count = bcm_cntsetbits(mwbmap_p->id_bitmap[ix]);
+#else  /* ! BCM_MWBMAP_USE_CNTSETBITS */
+               count = mwbmap_p->wd_count[ix];
+               MWBMAP_ASSERT(count == bcm_cntsetbits(mwbmap_p->id_bitmap[ix]));
+#endif /* ! BCM_MWBMAP_USE_CNTSETBITS */
+               printf("\tIDMAP:%2u. 0x%08x %02u\t", ix, mwbmap_p->id_bitmap[ix], count);
+               bcm_bitprint32(mwbmap_p->id_bitmap[ix]);
+               printf("\n");
+       }
+
+       return;
+}
+
+/* Audit a hierarchical multiword bitmap */
+void
+bcm_mwbmap_audit(struct bcm_mwbmap * mwbmap_hdl)
+{
+       bcm_mwbmap_t * mwbmap_p;
+       uint32 count, free_cnt = 0U, wordix, idmap_ix, bitix, *bitmap_p;
+
+       mwbmap_p = BCM_MWBMAP_PTR(mwbmap_hdl);
+
+       for (wordix = 0U; wordix < mwbmap_p->wmaps; ++wordix) {
+
+               bitmap_p = &mwbmap_p->wd_bitmap[wordix];
+
+               for (bitix = 0U; bitix < BCM_MWBMAP_BITS_WORD; bitix++) {
+                       if ((*bitmap_p) & (1 << bitix)) {
+                               idmap_ix = BCM_MWBMAP_MULOP(wordix) + bitix;
+#if defined(BCM_MWBMAP_USE_CNTSETBITS)
+                               count = bcm_cntsetbits(mwbmap_p->id_bitmap[idmap_ix]);
+#else  /* ! BCM_MWBMAP_USE_CNTSETBITS */
+                               count = mwbmap_p->wd_count[idmap_ix];
+                               ASSERT(count == bcm_cntsetbits(mwbmap_p->id_bitmap[idmap_ix]));
+#endif /* ! BCM_MWBMAP_USE_CNTSETBITS */
+                               ASSERT(count != 0U);
+                               free_cnt += count;
+                       }
+               }
+       }
+
+       ASSERT((int)free_cnt == mwbmap_p->ifree);
+}
+/* END : Multiword bitmap based 64bit to Unique 32bit Id allocator. */
+
+/* Simple 16bit Id allocator using a stack implementation. */
+typedef struct id16_map {
+       uint32  failures;  /* count of failures */
+       void    *dbg;      /* debug placeholder */
+       uint16  total;     /* total number of ids managed by allocator */
+       uint16  start;     /* start value of 16bit ids to be managed */
+       int     stack_idx; /* index into stack of available ids */
+       uint16  stack[0];  /* stack of 16 bit ids */
+} id16_map_t;
+
+#define ID16_MAP_SZ(items)      (sizeof(id16_map_t) + \
+                                    (sizeof(uint16) * (items)))
+
+#if defined(BCM_DBG)
+
+/* Uncomment BCM_DBG_ID16 to debug double free */
+/* #define BCM_DBG_ID16 */
+
+typedef struct id16_map_dbg {
+       uint16  total;
+       bool    avail[0];
+} id16_map_dbg_t;
+#define ID16_MAP_DBG_SZ(items)  (sizeof(id16_map_dbg_t) + \
+                                    (sizeof(bool) * (items)))
+#define ID16_MAP_MSG(x)         print x
+#else
+#define ID16_MAP_MSG(x)
+#endif /* BCM_DBG */
+
+void * /* Construct an id16 allocator: [start_val16 .. start_val16+total_ids) */
+id16_map_init(osl_t *osh, uint16 total_ids, uint16 start_val16)
+{
+       uint16 idx, val16;
+       id16_map_t * id16_map;
+
+       ASSERT(total_ids > 0);
+
+       /* A start_val16 of ID16_UNDEFINED, allows the caller to fill the id16 map
+        * with random values.
+        */
+       ASSERT((start_val16 == ID16_UNDEFINED) ||
+              (start_val16 + total_ids) < ID16_INVALID);
+
+       id16_map = (id16_map_t *) MALLOC(osh, ID16_MAP_SZ(total_ids));
+       if (id16_map == NULL) {
+               return NULL;
+       }
+
+       id16_map->total = total_ids;
+       id16_map->start = start_val16;
+       id16_map->failures = 0;
+       id16_map->dbg = NULL;
+
+       /*
+        * Populate stack with 16bit id values, commencing with start_val16.
+        * if start_val16 is ID16_UNDEFINED, then do not populate the id16 map.
+        */
+       id16_map->stack_idx = -1;
+
+       if (id16_map->start != ID16_UNDEFINED) {
+               val16 = start_val16;
+
+               for (idx = 0; idx < total_ids; idx++, val16++) {
+                       id16_map->stack_idx = idx;
+                       id16_map->stack[id16_map->stack_idx] = val16;
+               }
+       }
+
+#if defined(BCM_DBG) && defined(BCM_DBG_ID16)
+       if (id16_map->start != ID16_UNDEFINED) {
+               id16_map->dbg = MALLOC(osh, ID16_MAP_DBG_SZ(total_ids));
+
+               if (id16_map->dbg) {
+                       id16_map_dbg_t *id16_map_dbg = (id16_map_dbg_t *)id16_map->dbg;
+
+                       id16_map_dbg->total = total_ids;
+                       for (idx = 0; idx < total_ids; idx++) {
+                               id16_map_dbg->avail[idx] = TRUE;
+                       }
+               }
+       }
+#endif /* BCM_DBG && BCM_DBG_ID16 */
+
+       return (void *)id16_map;
+}
+
+void * /* Destruct an id16 allocator instance */
+id16_map_fini(osl_t *osh, void * id16_map_hndl)
+{
+       uint16 total_ids;
+       id16_map_t * id16_map;
+
+       if (id16_map_hndl == NULL)
+               return NULL;
+
+       id16_map = (id16_map_t *)id16_map_hndl;
+
+       total_ids = id16_map->total;
+       ASSERT(total_ids > 0);
+
+#if defined(BCM_DBG) && defined(BCM_DBG_ID16)
+       if (id16_map->dbg) {
+               MFREE(osh, id16_map->dbg, ID16_MAP_DBG_SZ(total_ids));
+               id16_map->dbg = NULL;
+       }
+#endif /* BCM_DBG && BCM_DBG_ID16 */
+
+       id16_map->total = 0;
+       MFREE(osh, id16_map, ID16_MAP_SZ(total_ids));
+
+       return NULL;
+}
+
+void
+id16_map_clear(void * id16_map_hndl, uint16 total_ids, uint16 start_val16)
+{
+       uint16 idx, val16;
+       id16_map_t * id16_map;
+
+       ASSERT(total_ids > 0);
+       /* A start_val16 of ID16_UNDEFINED, allows the caller to fill the id16 map
+        * with random values.
+        */
+       ASSERT((start_val16 == ID16_UNDEFINED) ||
+              (start_val16 + total_ids) < ID16_INVALID);
+
+       id16_map = (id16_map_t *)id16_map_hndl;
+       if (id16_map == NULL) {
+               return;
+       }
+
+       id16_map->total = total_ids;
+       id16_map->start = start_val16;
+       id16_map->failures = 0;
+
+       /* Populate stack with 16bit id values, commencing with start_val16 */
+       id16_map->stack_idx = -1;
+
+       if (id16_map->start != ID16_UNDEFINED) {
+               val16 = start_val16;
+
+               for (idx = 0; idx < total_ids; idx++, val16++) {
+                       id16_map->stack_idx = idx;
+                       id16_map->stack[id16_map->stack_idx] = val16;
+               }
+       }
+
+#if defined(BCM_DBG) && defined(BCM_DBG_ID16)
+       if (id16_map->start != ID16_UNDEFINED) {
+               if (id16_map->dbg) {
+                       id16_map_dbg_t *id16_map_dbg = (id16_map_dbg_t *)id16_map->dbg;
+
+                       id16_map_dbg->total = total_ids;
+                       for (idx = 0; idx < total_ids; idx++) {
+                               id16_map_dbg->avail[idx] = TRUE;
+                       }
+               }
+       }
+#endif /* BCM_DBG && BCM_DBG_ID16 */
+}
+
+uint16 BCMFASTPATH /* Allocate a unique 16bit id */
+id16_map_alloc(void * id16_map_hndl)
+{
+       uint16 val16;
+       id16_map_t * id16_map;
+
+       ASSERT(id16_map_hndl != NULL);
+
+       id16_map = (id16_map_t *)id16_map_hndl;
+
+       ASSERT(id16_map->total > 0);
+
+       if (id16_map->stack_idx < 0) {
+               id16_map->failures++;
+               return ID16_INVALID;
+       }
+
+       val16 = id16_map->stack[id16_map->stack_idx];
+       id16_map->stack_idx--;
+
+#if defined(BCM_DBG) && defined(BCM_DBG_ID16)
+       ASSERT((id16_map->start == ID16_UNDEFINED) ||
+              (val16 < (id16_map->start + id16_map->total)));
+
+       if (id16_map->dbg) { /* Validate val16 */
+               id16_map_dbg_t *id16_map_dbg = (id16_map_dbg_t *)id16_map->dbg;
+
+               ASSERT(id16_map_dbg->avail[val16 - id16_map->start] == TRUE);
+               id16_map_dbg->avail[val16 - id16_map->start] = FALSE;
+       }
+#endif /* BCM_DBG && BCM_DBG_ID16 */
+
+       return val16;
+}
+
+
+void BCMFASTPATH /* Free a 16bit id value into the id16 allocator */
+id16_map_free(void * id16_map_hndl, uint16 val16)
+{
+       id16_map_t * id16_map;
+
+       ASSERT(id16_map_hndl != NULL);
+
+       id16_map = (id16_map_t *)id16_map_hndl;
+
+#if defined(BCM_DBG) && defined(BCM_DBG_ID16)
+       ASSERT((id16_map->start == ID16_UNDEFINED) ||
+              (val16 < (id16_map->start + id16_map->total)));
+
+       if (id16_map->dbg) { /* Validate val16 */
+               id16_map_dbg_t *id16_map_dbg = (id16_map_dbg_t *)id16_map->dbg;
+
+               ASSERT(id16_map_dbg->avail[val16 - id16_map->start] == FALSE);
+               id16_map_dbg->avail[val16 - id16_map->start] = TRUE;
+       }
+#endif /* BCM_DBG && BCM_DBG_ID16 */
+
+       id16_map->stack_idx++;
+       id16_map->stack[id16_map->stack_idx] = val16;
+}
+
+uint32 /* Returns number of failures to allocate an unique id16 */
+id16_map_failures(void * id16_map_hndl)
+{
+       ASSERT(id16_map_hndl != NULL);
+       return ((id16_map_t *)id16_map_hndl)->failures;
+}
+
+bool
+id16_map_audit(void * id16_map_hndl)
+{
+       int idx;
+       int insane = 0;
+       id16_map_t * id16_map;
+
+       ASSERT(id16_map_hndl != NULL);
+
+       id16_map = (id16_map_t *)id16_map_hndl;
+
+       ASSERT(id16_map->stack_idx >= -1);
+       ASSERT(id16_map->stack_idx < (int)id16_map->total);
+
+       if (id16_map->start == ID16_UNDEFINED)
+               goto done;
+
+       for (idx = 0; idx <= id16_map->stack_idx; idx++) {
+               ASSERT(id16_map->stack[idx] >= id16_map->start);
+               ASSERT(id16_map->stack[idx] < (id16_map->start + id16_map->total));
+
+#if defined(BCM_DBG) && defined(BCM_DBG_ID16)
+               if (id16_map->dbg) {
+                       uint16 val16 = id16_map->stack[idx];
+                       if (((id16_map_dbg_t *)(id16_map->dbg))->avail[val16] != TRUE) {
+                               insane |= 1;
+                               ID16_MAP_MSG(("id16_map<%p>: stack_idx %u invalid val16 %u\n",
+                                       id16_map_hndl, idx, val16));
+                       }
+               }
+#endif /* BCM_DBG && BCM_DBG_ID16 */
+       }
+
+#if defined(BCM_DBG) && defined(BCM_DBG_ID16)
+       if (id16_map->dbg) {
+               uint16 avail = 0; /* Audit available ids counts */
+               for (idx = 0; idx < id16_map_dbg->total; idx++) {
+                       if (((id16_map_dbg_t *)(id16_map->dbg))->avail[idx16] == TRUE)
+                               avail++;
+               }
+               if (avail && (avail != (id16_map->stack_idx + 1))) {
+                       insane |= 1;
+                       ID16_MAP_MSG(("id16_map<%p>: avail %u stack_idx %u\n",
+                               id16_map_hndl, avail, id16_map->stack_idx));
+               }
+       }
+#endif /* BCM_DBG && BCM_DBG_ID16 */
+
+done:
+       /* invoke any other system audits */
+       return (!!insane);
+}
+/* END: Simple id16 allocator */
+
+
+#endif 
+
+/* calculate a >> b; and returns only lower 32 bits */
+void
+bcm_uint64_right_shift(uint32* r, uint32 a_high, uint32 a_low, uint32 b)
+{
+       uint32 a1 = a_high, a0 = a_low, r0 = 0;
+
+       if (b == 0) {
+               r0 = a_low;
+               *r = r0;
+               return;
+       }
+
+       if (b < 32) {
+               a0 = a0 >> b;
+               a1 = a1 & ((1 << b) - 1);
+               a1 = a1 << (32 - b);
+               r0 = a0 | a1;
+               *r = r0;
+               return;
+       } else {
+               r0 = a1 >> (b - 32);
+               *r = r0;
+               return;
+       }
+
+}
+
+/* calculate a + b where a is a 64 bit number and b is a 32 bit number */
+void
+bcm_add_64(uint32* r_hi, uint32* r_lo, uint32 offset)
+{
+       uint32 r1_lo = *r_lo;
+       (*r_lo) += offset;
+       if (*r_lo < r1_lo)
+               (*r_hi) ++;
+}
+
+/* calculate a - b where a is a 64 bit number and b is a 32 bit number */
+void
+bcm_sub_64(uint32* r_hi, uint32* r_lo, uint32 offset)
+{
+       uint32 r1_lo = *r_lo;
+       (*r_lo) -= offset;
+       if (*r_lo > r1_lo)
+               (*r_hi) --;
+}
+
+#ifdef DEBUG_COUNTER
+#if (OSL_SYSUPTIME_SUPPORT == TRUE)
+void counter_printlog(counter_tbl_t *ctr_tbl)
+{
+       uint32 now;
+
+       if (!ctr_tbl->enabled)
+               return;
+
+       now = OSL_SYSUPTIME();
+
+       if (now - ctr_tbl->prev_log_print > ctr_tbl->log_print_interval) {
+               uint8 i = 0;
+               printf("counter_print(%s %d):", ctr_tbl->name, now - ctr_tbl->prev_log_print);
+
+               for (i = 0; i < ctr_tbl->needed_cnt; i++) {
+                       printf(" %u", ctr_tbl->cnt[i]);
+               }
+               printf("\n");
+
+               ctr_tbl->prev_log_print = now;
+               bzero(ctr_tbl->cnt, CNTR_TBL_MAX * sizeof(uint));
+       }
+}
+#else
+/* OSL_SYSUPTIME is not supported so no way to get time */
+#define counter_printlog(a) do {} while (0)
+#endif /* OSL_SYSUPTIME_SUPPORT == TRUE */
+#endif /* DEBUG_COUNTER */
+
+#if defined(BCMDRIVER) && !defined(_CFEZ_)
+void
+dll_pool_detach(void * osh, dll_pool_t * pool, uint16 elems_max, uint16 elem_size)
+{
+       uint32 mem_size;
+       mem_size = sizeof(dll_pool_t) + (elems_max * elem_size);
+       if (pool)
+               MFREE(osh, pool, mem_size);
+}
+dll_pool_t *
+dll_pool_init(void * osh, uint16 elems_max, uint16 elem_size)
+{
+       uint32 mem_size, i;
+       dll_pool_t * dll_pool_p;
+       dll_t * elem_p;
+
+       ASSERT(elem_size > sizeof(dll_t));
+
+       mem_size = sizeof(dll_pool_t) + (elems_max * elem_size);
+
+       if ((dll_pool_p = (dll_pool_t *)MALLOCZ(osh, mem_size)) == NULL) {
+               printf("dll_pool_init: elems_max<%u> elem_size<%u> malloc failure\n",
+                       elems_max, elem_size);
+               ASSERT(0);
+               return dll_pool_p;
+       }
+
+       dll_init(&dll_pool_p->free_list);
+       dll_pool_p->elems_max = elems_max;
+       dll_pool_p->elem_size = elem_size;
+
+       elem_p = dll_pool_p->elements;
+       for (i = 0; i < elems_max; i++) {
+               dll_append(&dll_pool_p->free_list, elem_p);
+               elem_p = (dll_t *)((uintptr)elem_p + elem_size);
+       }
+
+       dll_pool_p->free_count = elems_max;
+
+       return dll_pool_p;
+}
+
+
+void *
+dll_pool_alloc(dll_pool_t * dll_pool_p)
+{
+       dll_t * elem_p;
+
+       if (dll_pool_p->free_count == 0) {
+               ASSERT(dll_empty(&dll_pool_p->free_list));
+               return NULL;
+       }
+
+       elem_p = dll_head_p(&dll_pool_p->free_list);
+       dll_delete(elem_p);
+       dll_pool_p->free_count -= 1;
+
+       return (void *)elem_p;
+}
+
+void
+dll_pool_free(dll_pool_t * dll_pool_p, void * elem_p)
+{
+       dll_t * node_p = (dll_t *)elem_p;
+       dll_prepend(&dll_pool_p->free_list, node_p);
+       dll_pool_p->free_count += 1;
+}
+
+
+void
+dll_pool_free_tail(dll_pool_t * dll_pool_p, void * elem_p)
+{
+       dll_t * node_p = (dll_t *)elem_p;
+       dll_append(&dll_pool_p->free_list, node_p);
+       dll_pool_p->free_count += 1;
+}
+
+#endif 
diff --git a/drivers/net/wireless/bcmdhd_1363/bcmwifi_channels.c b/drivers/net/wireless/bcmdhd_1363/bcmwifi_channels.c
new file mode 100644 (file)
index 0000000..efe7171
--- /dev/null
@@ -0,0 +1,1253 @@
+/*
+ * Misc utility routines used by kernel or app-level.
+ * Contents are wifi-specific, used by any kernel or app-level
+ * software that might want wifi things as it grows.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmwifi_channels.c 591285 2015-10-07 11:56:29Z $
+ */
+
+#include <bcm_cfg.h>
+#include <typedefs.h>
+#include <bcmutils.h>
+
+#ifdef BCMDRIVER
+#include <osl.h>
+#define strtoul(nptr, endptr, base) bcm_strtoul((nptr), (endptr), (base))
+#define tolower(c) (bcm_isupper((c)) ? ((c) + 'a' - 'A') : (c))
+#else
+#include <stdio.h>
+#include <stdlib.h>
+#include <ctype.h>
+#ifndef ASSERT
+#define ASSERT(exp)
+#endif
+#endif /* BCMDRIVER */
+
+#include <bcmwifi_channels.h>
+
+#if defined(WIN32) && (defined(BCMDLL) || defined(WLMDLL))
+#include <bcmstdlib.h>         /* For wl/exe/GNUmakefile.brcm_wlu and GNUmakefile.wlm_dll */
+#endif
+
+/* Definitions for D11AC capable Chanspec type */
+
+/* Chanspec ASCII representation with 802.11ac capability:
+ * [<band> 'g'] <channel> ['/'<bandwidth> [<ctl-sideband>]['/'<1st80channel>'-'<2nd80channel>]]
+ *
+ * <band>:
+ *      (optional) 2, 3, 4, 5 for 2.4GHz, 3GHz, 4GHz, and 5GHz respectively.
+ *      Default value is 2g if channel <= 14, otherwise 5g.
+ * <channel>:
+ *      channel number of the 5MHz, 10MHz, 20MHz channel,
+ *      or primary channel of 40MHz, 80MHz, 160MHz, or 80+80MHz channel.
+ * <bandwidth>:
+ *      (optional) 5, 10, 20, 40, 80, 160, or 80+80. Default value is 20.
+ * <primary-sideband>:
+ *      (only for 2.4GHz band 40MHz) U for upper sideband primary, L for lower.
+ *
+ *      For 2.4GHz band 40MHz channels, the same primary channel may be the
+ *      upper sideband for one 40MHz channel, and the lower sideband for an
+ *      overlapping 40MHz channel.  The U/L disambiguates which 40MHz channel
+ *      is being specified.
+ *
+ *      For 40MHz in the 5GHz band and all channel bandwidths greater than
+ *      40MHz, the U/L specificaion is not allowed since the channels are
+ *      non-overlapping and the primary sub-band is derived from its
+ *      position in the wide bandwidth channel.
+ *
+ * <1st80Channel>:
+ * <2nd80Channel>:
+ *      Required for 80+80, otherwise not allowed.
+ *      Specifies the center channel of the first and second 80MHz band.
+ *
+ * In its simplest form, it is a 20MHz channel number, with the implied band
+ * of 2.4GHz if channel number <= 14, and 5GHz otherwise.
+ *
+ * To allow for backward compatibility with scripts, the old form for
+ * 40MHz channels is also allowed: <channel><ctl-sideband>
+ *
+ * <channel>:
+ *     primary channel of 40MHz, channel <= 14 is 2GHz, otherwise 5GHz
+ * <ctl-sideband>:
+ *     "U" for upper, "L" for lower (or lower case "u" "l")
+ *
+ * 5 GHz Examples:
+ *      Chanspec        BW        Center Ch  Channel Range  Primary Ch
+ *      5g8             20MHz     8          -              -
+ *      52              20MHz     52         -              -
+ *      52/40           40MHz     54         52-56          52
+ *      56/40           40MHz     54         52-56          56
+ *      52/80           80MHz     58         52-64          52
+ *      56/80           80MHz     58         52-64          56
+ *      60/80           80MHz     58         52-64          60
+ *      64/80           80MHz     58         52-64          64
+ *      52/160          160MHz    50         36-64          52
+ *      36/160          160MGz    50         36-64          36
+ *      36/80+80/42-106 80+80MHz  42,106     36-48,100-112  36
+ *
+ * 2 GHz Examples:
+ *      Chanspec        BW        Center Ch  Channel Range  Primary Ch
+ *      2g8             20MHz     8          -              -
+ *      8               20MHz     8          -              -
+ *      6               20MHz     6          -              -
+ *      6/40l           40MHz     8          6-10           6
+ *      6l              40MHz     8          6-10           6
+ *      6/40u           40MHz     4          2-6            6
+ *      6u              40MHz     4          2-6            6
+ */
+
+/* bandwidth ASCII string */
+static const char *wf_chspec_bw_str[] =
+{
+       "5",
+       "10",
+       "20",
+       "40",
+       "80",
+       "160",
+       "80+80",
+#ifdef WL11ULB
+       "2.5"
+#else /* WL11ULB */
+       "na"
+#endif /* WL11ULB */
+};
+
+static const uint8 wf_chspec_bw_mhz[] =
+{5, 10, 20, 40, 80, 160, 160};
+
+#define WF_NUM_BW \
+       (sizeof(wf_chspec_bw_mhz)/sizeof(uint8))
+
+/* 40MHz channels in 5GHz band */
+static const uint8 wf_5g_40m_chans[] =
+{38, 46, 54, 62, 102, 110, 118, 126, 134, 142, 151, 159};
+#define WF_NUM_5G_40M_CHANS \
+       (sizeof(wf_5g_40m_chans)/sizeof(uint8))
+
+/* 80MHz channels in 5GHz band */
+static const uint8 wf_5g_80m_chans[] =
+{42, 58, 106, 122, 138, 155};
+#define WF_NUM_5G_80M_CHANS \
+       (sizeof(wf_5g_80m_chans)/sizeof(uint8))
+
+/* 160MHz channels in 5GHz band */
+static const uint8 wf_5g_160m_chans[] =
+{50, 114};
+#define WF_NUM_5G_160M_CHANS \
+       (sizeof(wf_5g_160m_chans)/sizeof(uint8))
+
+
+/* convert bandwidth from chanspec to MHz */
+static uint
+bw_chspec_to_mhz(chanspec_t chspec)
+{
+       uint bw;
+
+       bw = (chspec & WL_CHANSPEC_BW_MASK) >> WL_CHANSPEC_BW_SHIFT;
+       return (bw >= WF_NUM_BW ? 0 : wf_chspec_bw_mhz[bw]);
+}
+
+/* bw in MHz, return the channel count from the center channel to the
+ * the channel at the edge of the band
+ */
+static uint8
+center_chan_to_edge(uint bw)
+{
+       /* edge channels separated by BW - 10MHz on each side
+        * delta from cf to edge is half of that,
+        * MHz to channel num conversion is 5MHz/channel
+        */
+       return (uint8)(((bw - 20) / 2) / 5);
+}
+
+/* return channel number of the low edge of the band
+ * given the center channel and BW
+ */
+static uint8
+channel_low_edge(uint center_ch, uint bw)
+{
+       return (uint8)(center_ch - center_chan_to_edge(bw));
+}
+
+/* return side band number given center channel and control channel
+ * return -1 on error
+ */
+static int
+channel_to_sb(uint center_ch, uint ctl_ch, uint bw)
+{
+       uint lowest = channel_low_edge(center_ch, bw);
+       uint sb;
+
+       if ((ctl_ch - lowest) % 4) {
+               /* bad ctl channel, not mult 4 */
+               return -1;
+       }
+
+       sb = ((ctl_ch - lowest) / 4);
+
+       /* sb must be a index to a 20MHz channel in range */
+       if (sb >= (bw / 20)) {
+               /* ctl_ch must have been too high for the center_ch */
+               return -1;
+       }
+
+       return sb;
+}
+
+/* return control channel given center channel and side band */
+static uint8
+channel_to_ctl_chan(uint center_ch, uint bw, uint sb)
+{
+       return (uint8)(channel_low_edge(center_ch, bw) + sb * 4);
+}
+
+/* return index of 80MHz channel from channel number
+ * return -1 on error
+ */
+static int
+channel_80mhz_to_id(uint ch)
+{
+       uint i;
+       for (i = 0; i < WF_NUM_5G_80M_CHANS; i ++) {
+               if (ch == wf_5g_80m_chans[i])
+                       return i;
+       }
+
+       return -1;
+}
+
+/* wrapper function for wf_chspec_ntoa. In case of an error it puts
+ * the original chanspec in the output buffer, prepended with "invalid".
+ * Can be directly used in print routines as it takes care of null
+ */
+char *
+wf_chspec_ntoa_ex(chanspec_t chspec, char *buf)
+{
+       if (wf_chspec_ntoa(chspec, buf) == NULL)
+               snprintf(buf, CHANSPEC_STR_LEN, "invalid 0x%04x", chspec);
+       return buf;
+}
+
+/* given a chanspec and a string buffer, format the chanspec as a
+ * string, and return the original pointer a.
+ * Min buffer length must be CHANSPEC_STR_LEN.
+ * On error return NULL
+ */
+char *
+wf_chspec_ntoa(chanspec_t chspec, char *buf)
+{
+       const char *band;
+       uint ctl_chan;
+
+       if (wf_chspec_malformed(chspec))
+               return NULL;
+
+       band = "";
+
+       /* check for non-default band spec */
+       if ((CHSPEC_IS2G(chspec) && CHSPEC_CHANNEL(chspec) > CH_MAX_2G_CHANNEL) ||
+           (CHSPEC_IS5G(chspec) && CHSPEC_CHANNEL(chspec) <= CH_MAX_2G_CHANNEL))
+               band = (CHSPEC_IS2G(chspec)) ? "2g" : "5g";
+
+       /* ctl channel */
+       ctl_chan = wf_chspec_ctlchan(chspec);
+
+       /* bandwidth and ctl sideband */
+       if (CHSPEC_IS20(chspec)) {
+               snprintf(buf, CHANSPEC_STR_LEN, "%s%d", band, ctl_chan);
+       } else if (!CHSPEC_IS8080(chspec)) {
+               const char *bw;
+               const char *sb = "";
+
+               bw = wf_chspec_bw_str[(chspec & WL_CHANSPEC_BW_MASK) >> WL_CHANSPEC_BW_SHIFT];
+
+#ifdef CHANSPEC_NEW_40MHZ_FORMAT
+               /* ctl sideband string if needed for 2g 40MHz */
+               if (CHSPEC_IS40(chspec) && CHSPEC_IS2G(chspec)) {
+                       sb = CHSPEC_SB_UPPER(chspec) ? "u" : "l";
+               }
+
+               snprintf(buf, CHANSPEC_STR_LEN, "%s%d/%s%s", band, ctl_chan, bw, sb);
+#else
+               /* ctl sideband string instead of BW for 40MHz */
+               if (CHSPEC_IS40(chspec)) {
+                       sb = CHSPEC_SB_UPPER(chspec) ? "u" : "l";
+                       snprintf(buf, CHANSPEC_STR_LEN, "%s%d%s", band, ctl_chan, sb);
+               } else {
+                       snprintf(buf, CHANSPEC_STR_LEN, "%s%d/%s", band, ctl_chan, bw);
+               }
+#endif /* CHANSPEC_NEW_40MHZ_FORMAT */
+
+       } else {
+               /* 80+80 */
+               uint chan1 = (chspec & WL_CHANSPEC_CHAN1_MASK) >> WL_CHANSPEC_CHAN1_SHIFT;
+               uint chan2 = (chspec & WL_CHANSPEC_CHAN2_MASK) >> WL_CHANSPEC_CHAN2_SHIFT;
+
+               /* convert to channel number */
+               chan1 = (chan1 < WF_NUM_5G_80M_CHANS) ? wf_5g_80m_chans[chan1] : 0;
+               chan2 = (chan2 < WF_NUM_5G_80M_CHANS) ? wf_5g_80m_chans[chan2] : 0;
+
+               /* Outputs a max of CHANSPEC_STR_LEN chars including '\0'  */
+               snprintf(buf, CHANSPEC_STR_LEN, "%d/80+80/%d-%d", ctl_chan, chan1, chan2);
+       }
+
+       return (buf);
+}
+
+static int
+read_uint(const char **p, unsigned int *num)
+{
+       unsigned long val;
+       char *endp = NULL;
+
+       val = strtoul(*p, &endp, 10);
+       /* if endp is the initial pointer value, then a number was not read */
+       if (endp == *p)
+               return 0;
+
+       /* advance the buffer pointer to the end of the integer string */
+       *p = endp;
+       /* return the parsed integer */
+       *num = (unsigned int)val;
+
+       return 1;
+}
+
+/* given a chanspec string, convert to a chanspec.
+ * On error return 0
+ */
+chanspec_t
+wf_chspec_aton(const char *a)
+{
+       chanspec_t chspec;
+       uint chspec_ch, chspec_band, bw, chspec_bw, chspec_sb;
+       uint num, ctl_ch;
+       uint ch1, ch2;
+       char c, sb_ul = '\0';
+       int i;
+
+       bw = 20;
+       chspec_sb = 0;
+       chspec_ch = ch1 = ch2 = 0;
+
+       /* parse channel num or band */
+       if (!read_uint(&a, &num))
+               return 0;
+       /* if we are looking at a 'g', then the first number was a band */
+       c = tolower((int)a[0]);
+       if (c == 'g') {
+               a++; /* consume the char */
+
+               /* band must be "2" or "5" */
+               if (num == 2)
+                       chspec_band = WL_CHANSPEC_BAND_2G;
+               else if (num == 5)
+                       chspec_band = WL_CHANSPEC_BAND_5G;
+               else
+                       return 0;
+
+               /* read the channel number */
+               if (!read_uint(&a, &ctl_ch))
+                       return 0;
+
+               c = tolower((int)a[0]);
+       }
+       else {
+               /* first number is channel, use default for band */
+               ctl_ch = num;
+               chspec_band = ((ctl_ch <= CH_MAX_2G_CHANNEL) ?
+                              WL_CHANSPEC_BAND_2G : WL_CHANSPEC_BAND_5G);
+       }
+
+       if (c == '\0') {
+               /* default BW of 20MHz */
+               chspec_bw = WL_CHANSPEC_BW_20;
+               goto done_read;
+       }
+
+       a ++; /* consume the 'u','l', or '/' */
+
+       /* check 'u'/'l' */
+       if (c == 'u' || c == 'l') {
+               sb_ul = c;
+               chspec_bw = WL_CHANSPEC_BW_40;
+               goto done_read;
+       }
+
+       /* next letter must be '/' */
+       if (c != '/')
+               return 0;
+
+       /* read bandwidth */
+       if (!read_uint(&a, &bw))
+               return 0;
+
+       /* convert to chspec value */
+       if (bw == 2) {
+               chspec_bw = WL_CHANSPEC_BW_2P5;
+       } else if (bw == 5) {
+               chspec_bw = WL_CHANSPEC_BW_5;
+       } else if (bw == 10) {
+               chspec_bw = WL_CHANSPEC_BW_10;
+       } else if (bw == 20) {
+               chspec_bw = WL_CHANSPEC_BW_20;
+       } else if (bw == 40) {
+               chspec_bw = WL_CHANSPEC_BW_40;
+       } else if (bw == 80) {
+               chspec_bw = WL_CHANSPEC_BW_80;
+       } else if (bw == 160) {
+               chspec_bw = WL_CHANSPEC_BW_160;
+       } else {
+               return 0;
+       }
+
+       /* So far we have <band>g<chan>/<bw>
+        * Can now be followed by u/l if bw = 40,
+        * or '+80' if bw = 80, to make '80+80' bw,
+        * or '.5' if bw = 2.5 to make '2.5' bw .
+        */
+
+       c = tolower((int)a[0]);
+
+       /* if we have a 2g/40 channel, we should have a l/u spec now */
+       if (chspec_band == WL_CHANSPEC_BAND_2G && bw == 40) {
+               if (c == 'u' || c == 'l') {
+                       a ++; /* consume the u/l char */
+                       sb_ul = c;
+                       goto done_read;
+               }
+       }
+
+       /* check for 80+80 */
+       if (c == '+') {
+               /* 80+80 */
+               const char plus80[] = "80/";
+
+               /* must be looking at '+80/'
+                * check and consume this string.
+                */
+               chspec_bw = WL_CHANSPEC_BW_8080;
+
+               a ++; /* consume the char '+' */
+
+               /* consume the '80/' string */
+               for (i = 0; i < 3; i++) {
+                       if (*a++ != plus80[i]) {
+                               return 0;
+                       }
+               }
+
+               /* read primary 80MHz channel */
+               if (!read_uint(&a, &ch1))
+                       return 0;
+
+               /* must followed by '-' */
+               if (a[0] != '-')
+                       return 0;
+               a ++; /* consume the char */
+
+               /* read secondary 80MHz channel */
+               if (!read_uint(&a, &ch2))
+                       return 0;
+       } else if (c == '.') {
+               /* 2.5 */
+               /* must be looking at '.5'
+                * check and consume this string.
+                */
+               chspec_bw = WL_CHANSPEC_BW_2P5;
+
+               a ++; /* consume the char '.' */
+
+               /* consume the '5' string */
+               if (*a++ != '5') {
+                       return 0;
+               }
+       }
+
+done_read:
+       /* skip trailing white space */
+       while (a[0] == ' ') {
+               a ++;
+       }
+
+       /* must be end of string */
+       if (a[0] != '\0')
+               return 0;
+
+       /* Now have all the chanspec string parts read;
+        * chspec_band, ctl_ch, chspec_bw, sb_ul, ch1, ch2.
+        * chspec_band and chspec_bw are chanspec values.
+        * Need to convert ctl_ch, sb_ul, and ch1,ch2 into
+        * a center channel (or two) and sideband.
+        */
+
+       /* if a sb u/l string was given, just use that,
+        * guaranteed to be bw = 40 by sting parse.
+        */
+       if (sb_ul != '\0') {
+               if (sb_ul == 'l') {
+                       chspec_ch = UPPER_20_SB(ctl_ch);
+                       chspec_sb = WL_CHANSPEC_CTL_SB_LLL;
+               } else if (sb_ul == 'u') {
+                       chspec_ch = LOWER_20_SB(ctl_ch);
+                       chspec_sb = WL_CHANSPEC_CTL_SB_LLU;
+               }
+       }
+       /* if the bw is 20, center and sideband are trivial */
+       else if (BW_LE20(chspec_bw)) {
+               chspec_ch = ctl_ch;
+               chspec_sb = WL_CHANSPEC_CTL_SB_NONE;
+       }
+       /* if the bw is 40/80/160, not 80+80, a single method
+        * can be used to to find the center and sideband
+        */
+       else if (chspec_bw != WL_CHANSPEC_BW_8080) {
+               /* figure out ctl sideband based on ctl channel and bandwidth */
+               const uint8 *center_ch = NULL;
+               int num_ch = 0;
+               int sb = -1;
+
+               if (chspec_bw == WL_CHANSPEC_BW_40) {
+                       center_ch = wf_5g_40m_chans;
+                       num_ch = WF_NUM_5G_40M_CHANS;
+               } else if (chspec_bw == WL_CHANSPEC_BW_80) {
+                       center_ch = wf_5g_80m_chans;
+                       num_ch = WF_NUM_5G_80M_CHANS;
+               } else if (chspec_bw == WL_CHANSPEC_BW_160) {
+                       center_ch = wf_5g_160m_chans;
+                       num_ch = WF_NUM_5G_160M_CHANS;
+               } else {
+                       return 0;
+               }
+
+               for (i = 0; i < num_ch; i ++) {
+                       sb = channel_to_sb(center_ch[i], ctl_ch, bw);
+                       if (sb >= 0) {
+                               chspec_ch = center_ch[i];
+                               chspec_sb = sb << WL_CHANSPEC_CTL_SB_SHIFT;
+                               break;
+                       }
+               }
+
+               /* check for no matching sb/center */
+               if (sb < 0) {
+                       return 0;
+               }
+       }
+       /* Otherwise, bw is 80+80. Figure out channel pair and sb */
+       else {
+               int ch1_id = 0, ch2_id = 0;
+               int sb;
+
+               /* look up the channel ID for the specified channel numbers */
+               ch1_id = channel_80mhz_to_id(ch1);
+               ch2_id = channel_80mhz_to_id(ch2);
+
+               /* validate channels */
+               if (ch1_id < 0 || ch2_id < 0)
+                       return 0;
+
+               /* combine 2 channel IDs in channel field of chspec */
+               chspec_ch = (((uint)ch1_id << WL_CHANSPEC_CHAN1_SHIFT) |
+                            ((uint)ch2_id << WL_CHANSPEC_CHAN2_SHIFT));
+
+               /* figure out primary 20 MHz sideband */
+
+               /* is the primary channel contained in the 1st 80MHz channel? */
+               sb = channel_to_sb(ch1, ctl_ch, bw);
+               if (sb < 0) {
+                       /* no match for primary channel 'ctl_ch' in segment0 80MHz channel */
+                       return 0;
+               }
+
+               chspec_sb = sb << WL_CHANSPEC_CTL_SB_SHIFT;
+       }
+
+       chspec = (chspec_ch | chspec_band | chspec_bw | chspec_sb);
+
+       if (wf_chspec_malformed(chspec))
+               return 0;
+
+       return chspec;
+}
+
+/*
+ * Verify the chanspec is using a legal set of parameters, i.e. that the
+ * chanspec specified a band, bw, ctl_sb and channel and that the
+ * combination could be legal given any set of circumstances.
+ * RETURNS: TRUE is the chanspec is malformed, false if it looks good.
+ */
+bool
+wf_chspec_malformed(chanspec_t chanspec)
+{
+       uint chspec_bw = CHSPEC_BW(chanspec);
+       uint chspec_ch = CHSPEC_CHANNEL(chanspec);
+
+       /* must be 2G or 5G band */
+       if (CHSPEC_IS2G(chanspec)) {
+               /* must be valid bandwidth */
+               if (!BW_LE40(chspec_bw)) {
+                       return TRUE;
+               }
+       } else if (CHSPEC_IS5G(chanspec)) {
+               if (chspec_bw == WL_CHANSPEC_BW_8080) {
+                       uint ch1_id, ch2_id;
+
+                       /* channel IDs in 80+80 must be in range */
+                       ch1_id = CHSPEC_CHAN1(chanspec);
+                       ch2_id = CHSPEC_CHAN2(chanspec);
+                       if (ch1_id >= WF_NUM_5G_80M_CHANS || ch2_id >= WF_NUM_5G_80M_CHANS)
+                               return TRUE;
+
+               } else if (BW_LE160(chspec_bw)) {
+                       if (chspec_ch > MAXCHANNEL) {
+                               return TRUE;
+                       }
+               } else {
+                       /* invalid bandwidth */
+                       return TRUE;
+               }
+       } else {
+               /* must be 2G or 5G band */
+               return TRUE;
+       }
+
+       /* side band needs to be consistent with bandwidth */
+       if (BW_LE20(chspec_bw)) {
+               if (CHSPEC_CTL_SB(chanspec) != WL_CHANSPEC_CTL_SB_LLL)
+                       return TRUE;
+       } else if (chspec_bw == WL_CHANSPEC_BW_40) {
+               if (CHSPEC_CTL_SB(chanspec) > WL_CHANSPEC_CTL_SB_LLU)
+                       return TRUE;
+       } else if (chspec_bw == WL_CHANSPEC_BW_80 ||
+                  chspec_bw == WL_CHANSPEC_BW_8080) {
+               if (CHSPEC_CTL_SB(chanspec) > WL_CHANSPEC_CTL_SB_LUU)
+                       return TRUE;
+       }
+       else if (chspec_bw == WL_CHANSPEC_BW_160) {
+               ASSERT(CHSPEC_CTL_SB(chanspec) <= WL_CHANSPEC_CTL_SB_UUU);
+       }
+       return FALSE;
+}
+
+/*
+ * Verify the chanspec specifies a valid channel according to 802.11.
+ * RETURNS: TRUE if the chanspec is a valid 802.11 channel
+ */
+bool
+wf_chspec_valid(chanspec_t chanspec)
+{
+       uint chspec_bw = CHSPEC_BW(chanspec);
+       uint chspec_ch = CHSPEC_CHANNEL(chanspec);
+
+       if (wf_chspec_malformed(chanspec))
+               return FALSE;
+
+       if (CHSPEC_IS2G(chanspec)) {
+               /* must be valid bandwidth and channel range */
+               if (BW_LE20(chspec_bw)) {
+                       if (chspec_ch >= 1 && chspec_ch <= 14)
+                               return TRUE;
+               } else if (chspec_bw == WL_CHANSPEC_BW_40) {
+                       if (chspec_ch >= 3 && chspec_ch <= 11)
+                               return TRUE;
+               }
+       } else if (CHSPEC_IS5G(chanspec)) {
+               if (chspec_bw == WL_CHANSPEC_BW_8080) {
+                       uint16 ch1, ch2;
+
+                       ch1 = wf_5g_80m_chans[CHSPEC_CHAN1(chanspec)];
+                       ch2 = wf_5g_80m_chans[CHSPEC_CHAN2(chanspec)];
+
+                       /* the two channels must be separated by more than 80MHz by VHT req */
+                       if ((ch2 > ch1 + CH_80MHZ_APART) ||
+                           (ch1 > ch2 + CH_80MHZ_APART))
+                               return TRUE;
+               } else {
+                       const uint8 *center_ch;
+                       uint num_ch, i;
+
+                       if (BW_LE40(chspec_bw)) {
+                               center_ch = wf_5g_40m_chans;
+                               num_ch = WF_NUM_5G_40M_CHANS;
+                       } else if (chspec_bw == WL_CHANSPEC_BW_80) {
+                               center_ch = wf_5g_80m_chans;
+                               num_ch = WF_NUM_5G_80M_CHANS;
+                       } else if (chspec_bw == WL_CHANSPEC_BW_160) {
+                               center_ch = wf_5g_160m_chans;
+                               num_ch = WF_NUM_5G_160M_CHANS;
+                       } else {
+                               /* invalid bandwidth */
+                               return FALSE;
+                       }
+
+                       /* check for a valid center channel */
+                       if (BW_LE20(chspec_bw)) {
+                               /* We don't have an array of legal 20MHz 5G channels, but they are
+                                * each side of the legal 40MHz channels.  Check the chanspec
+                                * channel against either side of the 40MHz channels.
+                                */
+                               for (i = 0; i < num_ch; i ++) {
+                                       if (chspec_ch == (uint)LOWER_20_SB(center_ch[i]) ||
+                                           chspec_ch == (uint)UPPER_20_SB(center_ch[i]))
+                                               break; /* match found */
+                               }
+
+                               if (i == num_ch) {
+                                       /* check for channel 165 which is not the side band
+                                        * of 40MHz 5G channel
+                                        */
+                                       if (chspec_ch == 165)
+                                               i = 0;
+
+                                       /* check for legacy JP channels on failure */
+                                       if (chspec_ch == 34 || chspec_ch == 38 ||
+                                           chspec_ch == 42 || chspec_ch == 46)
+                                               i = 0;
+                               }
+                       } else {
+                               /* check the chanspec channel to each legal channel */
+                               for (i = 0; i < num_ch; i ++) {
+                                       if (chspec_ch == center_ch[i])
+                                               break; /* match found */
+                               }
+                       }
+
+                       if (i < num_ch) {
+                               /* match found */
+                               return TRUE;
+                       }
+               }
+       }
+
+       return FALSE;
+}
+
+/*
+ * This function returns the channel number that control traffic is being sent on, for 20MHz
+ * channels this is just the channel number, for 40MHZ, 80MHz, 160MHz channels it is the 20MHZ
+ * sideband depending on the chanspec selected
+ */
+uint8
+wf_chspec_ctlchan(chanspec_t chspec)
+{
+       uint center_chan;
+       uint bw_mhz;
+       uint sb;
+
+       ASSERT(!wf_chspec_malformed(chspec));
+
+       /* Is there a sideband ? */
+       if (CHSPEC_BW_LE20(chspec)) {
+               return CHSPEC_CHANNEL(chspec);
+       } else {
+               sb = CHSPEC_CTL_SB(chspec) >> WL_CHANSPEC_CTL_SB_SHIFT;
+
+               if (CHSPEC_IS8080(chspec)) {
+                       /* For an 80+80 MHz channel, the sideband 'sb' field is an 80 MHz sideband
+                        * (LL, LU, UL, LU) for the 80 MHz frequency segment 0.
+                        */
+                       uint chan_id = CHSPEC_CHAN1(chspec);
+
+                       bw_mhz = 80;
+
+                       /* convert from channel index to channel number */
+                       center_chan = wf_5g_80m_chans[chan_id];
+               }
+               else {
+                       bw_mhz = bw_chspec_to_mhz(chspec);
+                       center_chan = CHSPEC_CHANNEL(chspec) >> WL_CHANSPEC_CHAN_SHIFT;
+               }
+
+               return (channel_to_ctl_chan(center_chan, bw_mhz, sb));
+       }
+}
+
+/* given a chanspec, return the bandwidth string */
+char *
+wf_chspec_to_bw_str(chanspec_t chspec)
+{
+               return (char *)wf_chspec_bw_str[(CHSPEC_BW(chspec) >> WL_CHANSPEC_BW_SHIFT)];
+}
+
+/*
+ * This function returns the chanspec of the control channel of a given chanspec
+ */
+chanspec_t
+wf_chspec_ctlchspec(chanspec_t chspec)
+{
+       chanspec_t ctl_chspec = chspec;
+       uint8 ctl_chan;
+
+       ASSERT(!wf_chspec_malformed(chspec));
+
+       /* Is there a sideband ? */
+       if (!CHSPEC_BW_LE20(chspec)) {
+               ctl_chan = wf_chspec_ctlchan(chspec);
+               ctl_chspec = ctl_chan | WL_CHANSPEC_BW_20;
+               ctl_chspec |= CHSPEC_BAND(chspec);
+       }
+       return ctl_chspec;
+}
+
+/* return chanspec given control channel and bandwidth
+ * return 0 on error
+ */
+uint16
+wf_channel2chspec(uint ctl_ch, uint bw)
+{
+       uint16 chspec;
+       const uint8 *center_ch = NULL;
+       int num_ch = 0;
+       int sb = -1;
+       int i = 0;
+
+       chspec = ((ctl_ch <= CH_MAX_2G_CHANNEL) ? WL_CHANSPEC_BAND_2G : WL_CHANSPEC_BAND_5G);
+
+       chspec |= bw;
+
+       if (bw == WL_CHANSPEC_BW_40) {
+               center_ch = wf_5g_40m_chans;
+               num_ch = WF_NUM_5G_40M_CHANS;
+               bw = 40;
+       } else if (bw == WL_CHANSPEC_BW_80) {
+               center_ch = wf_5g_80m_chans;
+               num_ch = WF_NUM_5G_80M_CHANS;
+               bw = 80;
+       } else if (bw == WL_CHANSPEC_BW_160) {
+               center_ch = wf_5g_160m_chans;
+               num_ch = WF_NUM_5G_160M_CHANS;
+               bw = 160;
+       } else if (BW_LE20(bw)) {
+               chspec |= ctl_ch;
+               return chspec;
+       } else {
+               return 0;
+       }
+
+       for (i = 0; i < num_ch; i ++) {
+               sb = channel_to_sb(center_ch[i], ctl_ch, bw);
+               if (sb >= 0) {
+                       chspec |= center_ch[i];
+                       chspec |= (sb << WL_CHANSPEC_CTL_SB_SHIFT);
+                       break;
+               }
+       }
+
+       /* check for no matching sb/center */
+       if (sb < 0) {
+               return 0;
+       }
+
+       return chspec;
+}
+
+/*
+ * This function returns the chanspec for the primary 40MHz of an 80MHz channel.
+ * The control sideband specifies the same 20MHz channel that the 80MHz channel is using
+ * as the primary 20MHz channel.
+ */
+extern chanspec_t wf_chspec_primary40_chspec(chanspec_t chspec)
+{
+       chanspec_t chspec40 = chspec;
+       uint center_chan;
+       uint sb;
+
+       ASSERT(!wf_chspec_malformed(chspec));
+
+       /* if the chanspec is > 80MHz, use the helper routine to find the primary 80 MHz channel */
+       if (CHSPEC_IS8080(chspec) || CHSPEC_IS160(chspec)) {
+               chspec = wf_chspec_primary80_chspec(chspec);
+       }
+
+       /* determine primary 40 MHz sub-channel of an 80 MHz chanspec */
+       if (CHSPEC_IS80(chspec)) {
+               center_chan = CHSPEC_CHANNEL(chspec);
+               sb = CHSPEC_CTL_SB(chspec);
+
+               if (sb < WL_CHANSPEC_CTL_SB_UL) {
+                       /* Primary 40MHz is on lower side */
+                       center_chan -= CH_20MHZ_APART;
+                       /* sideband bits are the same for LL/LU and L/U */
+               } else {
+                       /* Primary 40MHz is on upper side */
+                       center_chan += CH_20MHZ_APART;
+                       /* sideband bits need to be adjusted by UL offset */
+                       sb -= WL_CHANSPEC_CTL_SB_UL;
+               }
+
+               /* Create primary 40MHz chanspec */
+               chspec40 = (WL_CHANSPEC_BAND_5G | WL_CHANSPEC_BW_40 |
+                           sb | center_chan);
+       }
+
+       return chspec40;
+}
+
+/*
+ * Return the channel number for a given frequency and base frequency.
+ * The returned channel number is relative to the given base frequency.
+ * If the given base frequency is zero, a base frequency of 5 GHz is assumed for
+ * frequencies from 5 - 6 GHz, and 2.407 GHz is assumed for 2.4 - 2.5 GHz.
+ *
+ * Frequency is specified in MHz.
+ * The base frequency is specified as (start_factor * 500 kHz).
+ * Constants WF_CHAN_FACTOR_2_4_G, WF_CHAN_FACTOR_5_G are defined for
+ * 2.4 GHz and 5 GHz bands.
+ *
+ * The returned channel will be in the range [1, 14] in the 2.4 GHz band
+ * and [0, 200] otherwise.
+ * -1 is returned if the start_factor is WF_CHAN_FACTOR_2_4_G and the
+ * frequency is not a 2.4 GHz channel, or if the frequency is not and even
+ * multiple of 5 MHz from the base frequency to the base plus 1 GHz.
+ *
+ * Reference 802.11 REVma, section 17.3.8.3, and 802.11B section 18.4.6.2
+ */
+int
+wf_mhz2channel(uint freq, uint start_factor)
+{
+       int ch = -1;
+       uint base;
+       int offset;
+
+       /* take the default channel start frequency */
+       if (start_factor == 0) {
+               if (freq >= 2400 && freq <= 2500)
+                       start_factor = WF_CHAN_FACTOR_2_4_G;
+               else if (freq >= 5000 && freq <= 6000)
+                       start_factor = WF_CHAN_FACTOR_5_G;
+       }
+
+       if (freq == 2484 && start_factor == WF_CHAN_FACTOR_2_4_G)
+               return 14;
+
+       base = start_factor / 2;
+
+       /* check that the frequency is in 1GHz range of the base */
+       if ((freq < base) || (freq > base + 1000))
+               return -1;
+
+       offset = freq - base;
+       ch = offset / 5;
+
+       /* check that frequency is a 5MHz multiple from the base */
+       if (offset != (ch * 5))
+               return -1;
+
+       /* restricted channel range check for 2.4G */
+       if (start_factor == WF_CHAN_FACTOR_2_4_G && (ch < 1 || ch > 13))
+               return -1;
+
+       return ch;
+}
+
+/*
+ * Return the center frequency in MHz of the given channel and base frequency.
+ * The channel number is interpreted relative to the given base frequency.
+ *
+ * The valid channel range is [1, 14] in the 2.4 GHz band and [0, 200] otherwise.
+ * The base frequency is specified as (start_factor * 500 kHz).
+ * Constants WF_CHAN_FACTOR_2_4_G, WF_CHAN_FACTOR_4_G, and WF_CHAN_FACTOR_5_G
+ * are defined for 2.4 GHz, 4 GHz, and 5 GHz bands.
+ * The channel range of [1, 14] is only checked for a start_factor of
+ * WF_CHAN_FACTOR_2_4_G (4814 = 2407 * 2).
+ * Odd start_factors produce channels on .5 MHz boundaries, in which case
+ * the answer is rounded down to an integral MHz.
+ * -1 is returned for an out of range channel.
+ *
+ * Reference 802.11 REVma, section 17.3.8.3, and 802.11B section 18.4.6.2
+ */
+int
+wf_channel2mhz(uint ch, uint start_factor)
+{
+       int freq;
+
+       if ((start_factor == WF_CHAN_FACTOR_2_4_G && (ch < 1 || ch > 14)) ||
+           (ch > 200))
+               freq = -1;
+       else if ((start_factor == WF_CHAN_FACTOR_2_4_G) && (ch == 14))
+               freq = 2484;
+       else
+               freq = ch * 5 + start_factor / 2;
+
+       return freq;
+}
+
+static const uint16 sidebands[] = {
+       WL_CHANSPEC_CTL_SB_LLL, WL_CHANSPEC_CTL_SB_LLU,
+       WL_CHANSPEC_CTL_SB_LUL, WL_CHANSPEC_CTL_SB_LUU,
+       WL_CHANSPEC_CTL_SB_ULL, WL_CHANSPEC_CTL_SB_ULU,
+       WL_CHANSPEC_CTL_SB_UUL, WL_CHANSPEC_CTL_SB_UUU
+};
+
+/*
+ * Returns the chanspec 80Mhz channel corresponding to the following input
+ * parameters
+ *
+ *     primary_channel - primary 20Mhz channel
+ *     center_channel   - center frequecny of the 80Mhz channel
+ *
+ * The center_channel can be one of {42, 58, 106, 122, 138, 155}
+ *
+ * returns INVCHANSPEC in case of error
+ */
+chanspec_t
+wf_chspec_80(uint8 center_channel, uint8 primary_channel)
+{
+
+       chanspec_t chanspec = INVCHANSPEC;
+       chanspec_t chanspec_cur;
+       uint i;
+
+       for (i = 0; i < WF_NUM_SIDEBANDS_80MHZ; i++) {
+               chanspec_cur = CH80MHZ_CHSPEC(center_channel, sidebands[i]);
+               if (primary_channel == wf_chspec_ctlchan(chanspec_cur)) {
+                       chanspec = chanspec_cur;
+                       break;
+               }
+       }
+       /* If the loop ended early, we are good, otherwise we did not
+       * find a 80MHz chanspec with the given center_channel that had a primary channel
+       *matching the given primary_channel.
+       */
+       return chanspec;
+}
+
+/*
+ * Returns the 80+80 chanspec corresponding to the following input parameters
+ *
+ *    primary_20mhz - Primary 20 MHz channel
+ *    chan0 - center channel number of one frequency segment
+ *    chan1 - center channel number of the other frequency segment
+ *
+ * Parameters chan0 and chan1 are channel numbers in {42, 58, 106, 122, 138, 155}.
+ * The primary channel must be contained in one of the 80MHz channels. This routine
+ * will determine which frequency segment is the primary 80 MHz segment.
+ *
+ * Returns INVCHANSPEC in case of error.
+ *
+ * Refer to IEEE802.11ac section 22.3.14 "Channelization".
+ */
+chanspec_t
+wf_chspec_get8080_chspec(uint8 primary_20mhz, uint8 chan0, uint8 chan1)
+{
+       int sb = 0;
+       uint16 chanspec = 0;
+       int chan0_id = 0, chan1_id = 0;
+       int seg0, seg1;
+
+       chan0_id = channel_80mhz_to_id(chan0);
+       chan1_id = channel_80mhz_to_id(chan1);
+
+       /* make sure the channel numbers were valid */
+       if (chan0_id == -1 || chan1_id == -1)
+               return INVCHANSPEC;
+
+       /* does the primary channel fit with the 1st 80MHz channel ? */
+       sb = channel_to_sb(chan0, primary_20mhz, 80);
+       if (sb >= 0) {
+               /* yes, so chan0 is frequency segment 0, and chan1 is seg 1 */
+               seg0 = chan0_id;
+               seg1 = chan1_id;
+       } else {
+               /* no, so does the primary channel fit with the 2nd 80MHz channel ? */
+               sb = channel_to_sb(chan1, primary_20mhz, 80);
+               if (sb < 0) {
+                       /* no match for ctl_ch to either 80MHz center channel */
+                       return INVCHANSPEC;
+               }
+               /* swapped, so chan1 is frequency segment 0, and chan0 is seg 1 */
+               seg0 = chan1_id;
+               seg1 = chan0_id;
+       }
+
+       chanspec = ((seg0 << WL_CHANSPEC_CHAN1_SHIFT) |
+                   (seg1 << WL_CHANSPEC_CHAN2_SHIFT) |
+                   (sb << WL_CHANSPEC_CTL_SB_SHIFT) |
+                   WL_CHANSPEC_BW_8080 |
+                   WL_CHANSPEC_BAND_5G);
+
+       return chanspec;
+}
+
+/*
+ * This function returns the 80Mhz channel for the given id.
+ */
+static uint8
+wf_chspec_get80Mhz_ch(uint8 chan_80Mhz_id)
+{
+       if (chan_80Mhz_id < WF_NUM_5G_80M_CHANS)
+               return wf_5g_80m_chans[chan_80Mhz_id];
+
+       return 0;
+}
+
+/*
+ * Returns the primary 80 Mhz channel for the provided chanspec
+ *
+ *    chanspec - Input chanspec for which the 80MHz primary channel has to be retrieved
+ *
+ *  returns -1 in case the provided channel is 20/40 Mhz chanspec
+ */
+
+uint8
+wf_chspec_primary80_channel(chanspec_t chanspec)
+{
+       uint8 primary80_chan;
+
+       if (CHSPEC_IS80(chanspec))      {
+               primary80_chan = CHSPEC_CHANNEL(chanspec);
+       }
+       else if (CHSPEC_IS8080(chanspec)) {
+               /* Channel ID 1 corresponds to frequency segment 0, the primary 80 MHz segment */
+               primary80_chan = wf_chspec_get80Mhz_ch(CHSPEC_CHAN1(chanspec));
+       }
+       else if (CHSPEC_IS160(chanspec)) {
+               uint8 center_chan = CHSPEC_CHANNEL(chanspec);
+               uint sb = CHSPEC_CTL_SB(chanspec) >> WL_CHANSPEC_CTL_SB_SHIFT;
+
+               /* based on the sb value primary 80 channel can be retrieved
+                * if sb is in range 0 to 3 the lower band is the 80Mhz primary band
+                */
+               if (sb < 4) {
+                       primary80_chan = center_chan - CH_40MHZ_APART;
+               }
+               /* if sb is in range 4 to 7 the upper band is the 80Mhz primary band */
+               else
+               {
+                       primary80_chan = center_chan + CH_40MHZ_APART;
+               }
+       }
+       else {
+               /* for 20 and 40 Mhz */
+               primary80_chan = -1;
+       }
+       return primary80_chan;
+}
+
+/*
+ * Returns the secondary 80 Mhz channel for the provided chanspec
+ *
+ *    chanspec - Input chanspec for which the 80MHz secondary channel has to be retrieved
+ *
+ *  returns -1 in case the provided channel is 20/40/80 Mhz chanspec
+ */
+uint8
+wf_chspec_secondary80_channel(chanspec_t chanspec)
+{
+       uint8 secondary80_chan;
+
+       if (CHSPEC_IS8080(chanspec)) {
+               secondary80_chan = wf_chspec_get80Mhz_ch(CHSPEC_CHAN2(chanspec));
+       }
+       else if (CHSPEC_IS160(chanspec)) {
+               uint8 center_chan = CHSPEC_CHANNEL(chanspec);
+               uint sb = CHSPEC_CTL_SB(chanspec) >> WL_CHANSPEC_CTL_SB_SHIFT;
+
+               /* based on the sb value  secondary 80 channel can be retrieved
+                * if sb is in range 0 to 3 upper band is the secondary 80Mhz band
+                */
+               if (sb < 4) {
+                       secondary80_chan = center_chan + CH_40MHZ_APART;
+               }
+               /* if sb is in range 4 to 7 the lower band is the secondary 80Mhz band */
+               else
+               {
+                       secondary80_chan = center_chan - CH_40MHZ_APART;
+               }
+       }
+       else {
+               /* for 20, 40, and 80 Mhz */
+               secondary80_chan = -1;
+       }
+       return secondary80_chan;
+}
+
+/*
+ * This function returns the chanspec for the primary 80MHz of an 160MHz or 80+80 channel.
+ *
+ *    chanspec - Input chanspec for which the primary 80Mhz chanspec has to be retreived
+ *
+ *  returns the input chanspec in case the provided chanspec is an 80 MHz chanspec
+ *  returns INVCHANSPEC in case the provided channel is 20/40 MHz chanspec
+ */
+chanspec_t
+wf_chspec_primary80_chspec(chanspec_t chspec)
+{
+       chanspec_t chspec80;
+       uint center_chan;
+       uint sb;
+
+       ASSERT(!wf_chspec_malformed(chspec));
+       if (CHSPEC_IS80(chspec)) {
+               chspec80 = chspec;
+       }
+       else if (CHSPEC_IS8080(chspec)) {
+
+               /* Channel ID 1 corresponds to frequency segment 0, the primary 80 MHz segment */
+               center_chan = wf_chspec_get80Mhz_ch(CHSPEC_CHAN1(chspec));
+
+               sb = CHSPEC_CTL_SB(chspec);
+
+               /* Create primary 80MHz chanspec */
+               chspec80 = (WL_CHANSPEC_BAND_5G | WL_CHANSPEC_BW_80 | sb | center_chan);
+       }
+       else if (CHSPEC_IS160(chspec)) {
+               center_chan = CHSPEC_CHANNEL(chspec);
+               sb = CHSPEC_CTL_SB(chspec);
+
+               if (sb < WL_CHANSPEC_CTL_SB_ULL) {
+                       /* Primary 80MHz is on lower side */
+                       center_chan -= CH_40MHZ_APART;
+               }
+               else {
+                       /* Primary 80MHz is on upper side */
+                       center_chan += CH_40MHZ_APART;
+                       sb -= WL_CHANSPEC_CTL_SB_ULL;
+               }
+               /* Create primary 80MHz chanspec */
+               chspec80 = (WL_CHANSPEC_BAND_5G | WL_CHANSPEC_BW_80 | sb | center_chan);
+       }
+       else {
+               chspec80 = INVCHANSPEC;
+       }
+
+       return chspec80;
+}
+
+#ifdef WL11AC_80P80
+uint8
+wf_chspec_channel(chanspec_t chspec)
+{
+       if (CHSPEC_IS8080(chspec)) {
+               return wf_chspec_primary80_channel(chspec);
+       }
+       else {
+               return ((uint8)((chspec) & WL_CHANSPEC_CHAN_MASK));
+       }
+}
+#endif /* WL11AC_80P80 */
diff --git a/drivers/net/wireless/bcmdhd_1363/bcmwifi_channels.h b/drivers/net/wireless/bcmdhd_1363/bcmwifi_channels.h
new file mode 100644 (file)
index 0000000..2ebb32f
--- /dev/null
@@ -0,0 +1,631 @@
+/*
+ * Misc utility routines for WL and Apps
+ * This header file housing the define and function prototype use by
+ * both the wl driver, tools & Apps.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmwifi_channels.h 591285 2015-10-07 11:56:29Z $
+ */
+
+#ifndef        _bcmwifi_channels_h_
+#define        _bcmwifi_channels_h_
+
+
+/* A chanspec holds the channel number, band, bandwidth and control sideband */
+typedef uint16 chanspec_t;
+
+/* channel defines */
+#define CH_UPPER_SB                    0x01
+#define CH_LOWER_SB                    0x02
+#define CH_EWA_VALID                   0x04
+#define CH_80MHZ_APART                 16
+#define CH_40MHZ_APART                 8
+#define CH_20MHZ_APART                 4
+#define CH_10MHZ_APART                 2
+#define CH_5MHZ_APART                  1       /* 2G band channels are 5 Mhz apart */
+#define CH_MAX_2G_CHANNEL              14      /* Max channel in 2G band */
+
+/* maximum # channels the s/w supports */
+#define MAXCHANNEL             224     /* max # supported channels. The max channel no is above,
+                                        * this is that + 1 rounded up to a multiple of NBBY (8).
+                                        * DO NOT MAKE it > 255: channels are uint8's all over
+                                        */
+#define MAXCHANNEL_NUM (MAXCHANNEL - 1)        /* max channel number */
+
+/* channel bitvec */
+typedef struct {
+       uint8   vec[MAXCHANNEL/8];   /* bitvec of channels */
+} chanvec_t;
+
+/* make sure channel num is within valid range */
+#define CH_NUM_VALID_RANGE(ch_num) ((ch_num) > 0 && (ch_num) <= MAXCHANNEL_NUM)
+
+#define CHSPEC_CTLOVLP(sp1, sp2, sep)  \
+       (ABS(wf_chspec_ctlchan(sp1) - wf_chspec_ctlchan(sp2)) < (sep))
+
+/* All builds use the new 11ac ratespec/chanspec */
+#undef  D11AC_IOTYPES
+#define D11AC_IOTYPES
+
+#define WL_CHANSPEC_CHAN_MASK          0x00ff
+#define WL_CHANSPEC_CHAN_SHIFT         0
+#define WL_CHANSPEC_CHAN1_MASK         0x000f
+#define WL_CHANSPEC_CHAN1_SHIFT                0
+#define WL_CHANSPEC_CHAN2_MASK         0x00f0
+#define WL_CHANSPEC_CHAN2_SHIFT                4
+
+#define WL_CHANSPEC_CTL_SB_MASK                0x0700
+#define WL_CHANSPEC_CTL_SB_SHIFT       8
+#define WL_CHANSPEC_CTL_SB_LLL         0x0000
+#define WL_CHANSPEC_CTL_SB_LLU         0x0100
+#define WL_CHANSPEC_CTL_SB_LUL         0x0200
+#define WL_CHANSPEC_CTL_SB_LUU         0x0300
+#define WL_CHANSPEC_CTL_SB_ULL         0x0400
+#define WL_CHANSPEC_CTL_SB_ULU         0x0500
+#define WL_CHANSPEC_CTL_SB_UUL         0x0600
+#define WL_CHANSPEC_CTL_SB_UUU         0x0700
+#define WL_CHANSPEC_CTL_SB_LL          WL_CHANSPEC_CTL_SB_LLL
+#define WL_CHANSPEC_CTL_SB_LU          WL_CHANSPEC_CTL_SB_LLU
+#define WL_CHANSPEC_CTL_SB_UL          WL_CHANSPEC_CTL_SB_LUL
+#define WL_CHANSPEC_CTL_SB_UU          WL_CHANSPEC_CTL_SB_LUU
+#define WL_CHANSPEC_CTL_SB_L           WL_CHANSPEC_CTL_SB_LLL
+#define WL_CHANSPEC_CTL_SB_U           WL_CHANSPEC_CTL_SB_LLU
+#define WL_CHANSPEC_CTL_SB_LOWER       WL_CHANSPEC_CTL_SB_LLL
+#define WL_CHANSPEC_CTL_SB_UPPER       WL_CHANSPEC_CTL_SB_LLU
+#define WL_CHANSPEC_CTL_SB_NONE                WL_CHANSPEC_CTL_SB_LLL
+
+#define WL_CHANSPEC_BW_MASK            0x3800
+#define WL_CHANSPEC_BW_SHIFT           11
+#define WL_CHANSPEC_BW_5               0x0000
+#define WL_CHANSPEC_BW_10              0x0800
+#define WL_CHANSPEC_BW_20              0x1000
+#define WL_CHANSPEC_BW_40              0x1800
+#define WL_CHANSPEC_BW_80              0x2000
+#define WL_CHANSPEC_BW_160             0x2800
+#define WL_CHANSPEC_BW_8080            0x3000
+#define WL_CHANSPEC_BW_2P5             0x3800
+
+#define WL_CHANSPEC_BAND_MASK          0xc000
+#define WL_CHANSPEC_BAND_SHIFT         14
+#define WL_CHANSPEC_BAND_2G            0x0000
+#define WL_CHANSPEC_BAND_3G            0x4000
+#define WL_CHANSPEC_BAND_4G            0x8000
+#define WL_CHANSPEC_BAND_5G            0xc000
+#define INVCHANSPEC                    255
+#define MAX_CHANSPEC                           0xFFFF
+
+/* channel defines */
+#define LOWER_20_SB(channel)           (((channel) > CH_10MHZ_APART) ? \
+                                       ((channel) - CH_10MHZ_APART) : 0)
+#define UPPER_20_SB(channel)           (((channel) < (MAXCHANNEL - CH_10MHZ_APART)) ? \
+                                       ((channel) + CH_10MHZ_APART) : 0)
+
+#define LL_20_SB(channel) (((channel) > 3 * CH_10MHZ_APART) ? ((channel) - 3 * CH_10MHZ_APART) : 0)
+#define UU_20_SB(channel)      (((channel) < (MAXCHANNEL - 3 * CH_10MHZ_APART)) ? \
+                               ((channel) + 3 * CH_10MHZ_APART) : 0)
+#define LU_20_SB(channel) LOWER_20_SB(channel)
+#define UL_20_SB(channel) UPPER_20_SB(channel)
+
+#define LOWER_40_SB(channel)           ((channel) - CH_20MHZ_APART)
+#define UPPER_40_SB(channel)           ((channel) + CH_20MHZ_APART)
+#define CHSPEC_WLCBANDUNIT(chspec)     (CHSPEC_IS5G(chspec) ? BAND_5G_INDEX : BAND_2G_INDEX)
+#define CH20MHZ_CHSPEC(channel)                (chanspec_t)((chanspec_t)(channel) | WL_CHANSPEC_BW_20 | \
+                                       (((channel) <= CH_MAX_2G_CHANNEL) ? \
+                                       WL_CHANSPEC_BAND_2G : WL_CHANSPEC_BAND_5G))
+#define CH2P5MHZ_CHSPEC(channel)       (chanspec_t)((chanspec_t)(channel) | WL_CHANSPEC_BW_2P5 | \
+                                               (((channel) <= CH_MAX_2G_CHANNEL) ? \
+                                               WL_CHANSPEC_BAND_2G : WL_CHANSPEC_BAND_5G))
+#define CH5MHZ_CHSPEC(channel)         (chanspec_t)((chanspec_t)(channel) | WL_CHANSPEC_BW_5 | \
+                                               (((channel) <= CH_MAX_2G_CHANNEL) ? \
+                                               WL_CHANSPEC_BAND_2G : WL_CHANSPEC_BAND_5G))
+#define CH10MHZ_CHSPEC(channel)                (chanspec_t)((chanspec_t)(channel) | WL_CHANSPEC_BW_10 | \
+                                               (((channel) <= CH_MAX_2G_CHANNEL) ? \
+                                               WL_CHANSPEC_BAND_2G : WL_CHANSPEC_BAND_5G))
+#define NEXT_20MHZ_CHAN(channel)       (((channel) < (MAXCHANNEL - CH_20MHZ_APART)) ? \
+                                       ((channel) + CH_20MHZ_APART) : 0)
+#define CH40MHZ_CHSPEC(channel, ctlsb) (chanspec_t) \
+                                       ((channel) | (ctlsb) | WL_CHANSPEC_BW_40 | \
+                                       ((channel) <= CH_MAX_2G_CHANNEL ? WL_CHANSPEC_BAND_2G : \
+                                       WL_CHANSPEC_BAND_5G))
+#define CH80MHZ_CHSPEC(channel, ctlsb) (chanspec_t) \
+                                       ((channel) | (ctlsb) | \
+                                        WL_CHANSPEC_BW_80 | WL_CHANSPEC_BAND_5G)
+#define CH160MHZ_CHSPEC(channel, ctlsb)        (chanspec_t) \
+                                       ((channel) | (ctlsb) | \
+                                        WL_CHANSPEC_BW_160 | WL_CHANSPEC_BAND_5G)
+#define CHBW_CHSPEC(bw, channel)       (chanspec_t)((chanspec_t)(channel) | (bw) | \
+                                                       (((channel) <= CH_MAX_2G_CHANNEL) ? \
+                                                       WL_CHANSPEC_BAND_2G : WL_CHANSPEC_BAND_5G))
+
+/* simple MACROs to get different fields of chanspec */
+#ifdef WL11AC_80P80
+#define CHSPEC_CHANNEL(chspec) wf_chspec_channel(chspec)
+#else
+#define CHSPEC_CHANNEL(chspec) ((uint8)((chspec) & WL_CHANSPEC_CHAN_MASK))
+#endif
+#define CHSPEC_CHAN1(chspec)   ((chspec) & WL_CHANSPEC_CHAN1_MASK) >> WL_CHANSPEC_CHAN1_SHIFT
+#define CHSPEC_CHAN2(chspec)   ((chspec) & WL_CHANSPEC_CHAN2_MASK) >> WL_CHANSPEC_CHAN2_SHIFT
+#define CHSPEC_BAND(chspec)            ((chspec) & WL_CHANSPEC_BAND_MASK)
+#define CHSPEC_CTL_SB(chspec)  ((chspec) & WL_CHANSPEC_CTL_SB_MASK)
+#define CHSPEC_BW(chspec)              ((chspec) & WL_CHANSPEC_BW_MASK)
+
+#ifdef WL11N_20MHZONLY
+
+#define CHSPEC_IS2P5(chspec)   0
+#define CHSPEC_IS5(chspec)     0
+#define CHSPEC_IS10(chspec)    0
+#define CHSPEC_IS20(chspec)    1
+#ifndef CHSPEC_IS40
+#define CHSPEC_IS40(chspec)    0
+#endif
+#ifndef CHSPEC_IS80
+#define CHSPEC_IS80(chspec)    0
+#endif
+#ifndef CHSPEC_IS160
+#define CHSPEC_IS160(chspec)   0
+#endif
+#ifndef CHSPEC_IS8080
+#define CHSPEC_IS8080(chspec)  0
+#endif
+#define BW_LE20(bw)            TRUE
+#define CHSPEC_ISLE20(chspec)  TRUE
+#else /* !WL11N_20MHZONLY */
+
+#define CHSPEC_IS2P5(chspec)   (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_2P5)
+#define CHSPEC_IS5(chspec)     (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_5)
+#define CHSPEC_IS10(chspec)    (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_10)
+#define CHSPEC_IS20(chspec)    (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_20)
+#ifndef CHSPEC_IS40
+#define CHSPEC_IS40(chspec)    (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_40)
+#endif
+#ifndef CHSPEC_IS80
+#define CHSPEC_IS80(chspec)    (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_80)
+#endif
+#ifndef CHSPEC_IS160
+#define CHSPEC_IS160(chspec)   (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_160)
+#endif
+#ifndef CHSPEC_IS8080
+#define CHSPEC_IS8080(chspec)  (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_8080)
+#endif
+
+#ifdef WL11ULB
+#define BW_LT20(bw)            (((bw) == WL_CHANSPEC_BW_2P5) || \
+                               ((bw) == WL_CHANSPEC_BW_5) || \
+                               ((bw) == WL_CHANSPEC_BW_10))
+#define CHSPEC_BW_LT20(chspec) (BW_LT20(CHSPEC_BW(chspec)))
+/* This MACRO is strictly to avoid abandons in existing code with ULB feature and is in no way
+ * optimial to use. Should be replaced with CHSPEC_BW_LE() instead
+ */
+#define BW_LE20(bw)            (((bw) == WL_CHANSPEC_BW_2P5) || \
+                               ((bw) == WL_CHANSPEC_BW_5) || \
+                               ((bw) == WL_CHANSPEC_BW_10) || \
+                               ((bw) == WL_CHANSPEC_BW_20))
+#define CHSPEC_ISLE20(chspec)  (BW_LE20(CHSPEC_BW(chspec)))
+
+#else /* WL11ULB */
+#define BW_LE20(bw)            ((bw) == WL_CHANSPEC_BW_20)
+#define CHSPEC_ISLE20(chspec)  (CHSPEC_IS20(chspec))
+#endif /* WL11ULB */
+#endif /* !WL11N_20MHZONLY */
+
+#define BW_LE40(bw)            (BW_LE20(bw) || ((bw) == WL_CHANSPEC_BW_40))
+#define BW_LE80(bw)            (BW_LE40(bw) || ((bw) == WL_CHANSPEC_BW_80))
+#define BW_LE160(bw)           (BW_LE80(bw) || ((bw) == WL_CHANSPEC_BW_160))
+#define CHSPEC_BW_LE20(chspec) (BW_LE20(CHSPEC_BW(chspec)))
+#define CHSPEC_IS5G(chspec)    (((chspec) & WL_CHANSPEC_BAND_MASK) == WL_CHANSPEC_BAND_5G)
+#define CHSPEC_IS2G(chspec)    (((chspec) & WL_CHANSPEC_BAND_MASK) == WL_CHANSPEC_BAND_2G)
+#define CHSPEC_SB_UPPER(chspec)        \
+       ((((chspec) & WL_CHANSPEC_CTL_SB_MASK) == WL_CHANSPEC_CTL_SB_UPPER) && \
+       (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_40))
+#define CHSPEC_SB_LOWER(chspec)        \
+       ((((chspec) & WL_CHANSPEC_CTL_SB_MASK) == WL_CHANSPEC_CTL_SB_LOWER) && \
+       (((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_40))
+#define CHSPEC2WLC_BAND(chspec) (CHSPEC_IS5G(chspec) ? WLC_BAND_5G : WLC_BAND_2G)
+
+/**
+ * Number of chars needed for wf_chspec_ntoa() destination character buffer.
+ */
+#define CHANSPEC_STR_LEN    20
+
+
+#define CHSPEC_IS_BW_160_WIDE(chspec) (CHSPEC_BW(chspec) == WL_CHANSPEC_BW_160 ||\
+       CHSPEC_BW(chspec) == WL_CHANSPEC_BW_8080)
+
+/* BW inequality comparisons, LE (<=), GE (>=), LT (<), GT (>), comparisons can be made
+* as simple numeric comparisons, with the exception that 160 is the same BW as 80+80,
+* but have different numeric values; (WL_CHANSPEC_BW_160 < WL_CHANSPEC_BW_8080).
+*
+* The LT/LE/GT/GE macros check first checks whether both chspec bandwidth and bw are 160 wide.
+* If both chspec bandwidth and bw is not 160 wide, then the comparison is made.
+*/
+#ifdef WL11ULB
+#define CHSPEC_BW_GE(chspec, bw) \
+       (((CHSPEC_IS_BW_160_WIDE(chspec) &&\
+       ((bw) == WL_CHANSPEC_BW_160 || (bw) == WL_CHANSPEC_BW_8080)) ||\
+       (CHSPEC_BW(chspec) >= (bw))) && \
+       (!(CHSPEC_BW(chspec) == WL_CHANSPEC_BW_2P5 && (bw) != WL_CHANSPEC_BW_2P5)))
+#else /* WL11ULB */
+#define CHSPEC_BW_GE(chspec, bw) \
+               ((CHSPEC_IS_BW_160_WIDE(chspec) &&\
+               ((bw) == WL_CHANSPEC_BW_160 || (bw) == WL_CHANSPEC_BW_8080)) ||\
+               (CHSPEC_BW(chspec) >= (bw)))
+#endif /* WL11ULB */
+
+#ifdef WL11ULB
+#define CHSPEC_BW_LE(chspec, bw) \
+       (((CHSPEC_IS_BW_160_WIDE(chspec) &&\
+       ((bw) == WL_CHANSPEC_BW_160 || (bw) == WL_CHANSPEC_BW_8080)) ||\
+       (CHSPEC_BW(chspec) <= (bw))) || \
+       (CHSPEC_BW(chspec) == WL_CHANSPEC_BW_2P5))
+#else /* WL11ULB */
+#define CHSPEC_BW_LE(chspec, bw) \
+               ((CHSPEC_IS_BW_160_WIDE(chspec) &&\
+               ((bw) == WL_CHANSPEC_BW_160 || (bw) == WL_CHANSPEC_BW_8080)) ||\
+               (CHSPEC_BW(chspec) <= (bw)))
+#endif /* WL11ULB */
+
+#ifdef WL11ULB
+#define CHSPEC_BW_GT(chspec, bw) \
+       ((!(CHSPEC_IS_BW_160_WIDE(chspec) &&\
+       ((bw) == WL_CHANSPEC_BW_160 || (bw) == WL_CHANSPEC_BW_8080)) &&\
+       (CHSPEC_BW(chspec) > (bw))) && \
+       (CHSPEC_BW(chspec) != WL_CHANSPEC_BW_2P5))
+#else /* WL11ULB */
+#define CHSPEC_BW_GT(chspec, bw) \
+               (!(CHSPEC_IS_BW_160_WIDE(chspec) &&\
+               ((bw) == WL_CHANSPEC_BW_160 || (bw) == WL_CHANSPEC_BW_8080)) &&\
+               (CHSPEC_BW(chspec) > (bw)))
+#endif /* WL11ULB */
+
+#ifdef WL11ULB
+#define CHSPEC_BW_LT(chspec, bw) \
+       ((!(CHSPEC_IS_BW_160_WIDE(chspec) &&\
+       ((bw) == WL_CHANSPEC_BW_160 || (bw) == WL_CHANSPEC_BW_8080)) &&\
+       (CHSPEC_BW(chspec) < (bw))) || \
+       ((CHSPEC_BW(chspec) == WL_CHANSPEC_BW_2P5 && (bw) != WL_CHANSPEC_BW_2P5)))
+#else /* WL11ULB */
+#define CHSPEC_BW_LT(chspec, bw) \
+               (!(CHSPEC_IS_BW_160_WIDE(chspec) &&\
+               ((bw) == WL_CHANSPEC_BW_160 || (bw) == WL_CHANSPEC_BW_8080)) &&\
+               (CHSPEC_BW(chspec) < (bw)))
+#endif /* WL11ULB */
+
+/* Legacy Chanspec defines
+ * These are the defines for the previous format of the chanspec_t
+ */
+#define WL_LCHANSPEC_CHAN_MASK         0x00ff
+#define WL_LCHANSPEC_CHAN_SHIFT                     0
+
+#define WL_LCHANSPEC_CTL_SB_MASK       0x0300
+#define WL_LCHANSPEC_CTL_SB_SHIFT           8
+#define WL_LCHANSPEC_CTL_SB_LOWER      0x0100
+#define WL_LCHANSPEC_CTL_SB_UPPER      0x0200
+#define WL_LCHANSPEC_CTL_SB_NONE       0x0300
+
+#define WL_LCHANSPEC_BW_MASK           0x0C00
+#define WL_LCHANSPEC_BW_SHIFT              10
+#define WL_LCHANSPEC_BW_10             0x0400
+#define WL_LCHANSPEC_BW_20             0x0800
+#define WL_LCHANSPEC_BW_40             0x0C00
+
+#define WL_LCHANSPEC_BAND_MASK         0xf000
+#define WL_LCHANSPEC_BAND_SHIFT                    12
+#define WL_LCHANSPEC_BAND_5G           0x1000
+#define WL_LCHANSPEC_BAND_2G           0x2000
+
+#define LCHSPEC_CHANNEL(chspec)        ((uint8)((chspec) & WL_LCHANSPEC_CHAN_MASK))
+#define LCHSPEC_BAND(chspec)   ((chspec) & WL_LCHANSPEC_BAND_MASK)
+#define LCHSPEC_CTL_SB(chspec) ((chspec) & WL_LCHANSPEC_CTL_SB_MASK)
+#define LCHSPEC_BW(chspec)     ((chspec) & WL_LCHANSPEC_BW_MASK)
+#define LCHSPEC_IS10(chspec)   (((chspec) & WL_LCHANSPEC_BW_MASK) == WL_LCHANSPEC_BW_10)
+#define LCHSPEC_IS20(chspec)   (((chspec) & WL_LCHANSPEC_BW_MASK) == WL_LCHANSPEC_BW_20)
+#define LCHSPEC_IS40(chspec)   (((chspec) & WL_LCHANSPEC_BW_MASK) == WL_LCHANSPEC_BW_40)
+#define LCHSPEC_IS5G(chspec)   (((chspec) & WL_LCHANSPEC_BAND_MASK) == WL_LCHANSPEC_BAND_5G)
+#define LCHSPEC_IS2G(chspec)   (((chspec) & WL_LCHANSPEC_BAND_MASK) == WL_LCHANSPEC_BAND_2G)
+
+#define LCHSPEC_SB_UPPER(chspec)       \
+       ((((chspec) & WL_LCHANSPEC_CTL_SB_MASK) == WL_LCHANSPEC_CTL_SB_UPPER) && \
+       (((chspec) & WL_LCHANSPEC_BW_MASK) == WL_LCHANSPEC_BW_40))
+#define LCHSPEC_SB_LOWER(chspec)       \
+       ((((chspec) & WL_LCHANSPEC_CTL_SB_MASK) == WL_LCHANSPEC_CTL_SB_LOWER) && \
+       (((chspec) & WL_LCHANSPEC_BW_MASK) == WL_LCHANSPEC_BW_40))
+
+#define LCHSPEC_CREATE(chan, band, bw, sb)  ((uint16)((chan) | (sb) | (bw) | (band)))
+
+#define CH20MHZ_LCHSPEC(channel) \
+       (chanspec_t)((chanspec_t)(channel) | WL_LCHANSPEC_BW_20 | \
+       WL_LCHANSPEC_CTL_SB_NONE | (((channel) <= CH_MAX_2G_CHANNEL) ? \
+       WL_LCHANSPEC_BAND_2G : WL_LCHANSPEC_BAND_5G))
+
+/*
+ * WF_CHAN_FACTOR_* constants are used to calculate channel frequency
+ * given a channel number.
+ * chan_freq = chan_factor * 500Mhz + chan_number * 5
+ */
+
+/**
+ * Channel Factor for the starting frequence of 2.4 GHz channels.
+ * The value corresponds to 2407 MHz.
+ */
+#define WF_CHAN_FACTOR_2_4_G           4814    /* 2.4 GHz band, 2407 MHz */
+
+/**
+ * Channel Factor for the starting frequence of 5 GHz channels.
+ * The value corresponds to 5000 MHz.
+ */
+#define WF_CHAN_FACTOR_5_G             10000   /* 5   GHz band, 5000 MHz */
+
+/**
+ * Channel Factor for the starting frequence of 4.9 GHz channels.
+ * The value corresponds to 4000 MHz.
+ */
+#define WF_CHAN_FACTOR_4_G             8000    /* 4.9 GHz band for Japan */
+
+#define WLC_2G_25MHZ_OFFSET            5       /* 2.4GHz band channel offset */
+
+/**
+ *  No of sub-band vlaue of the specified Mhz chanspec
+ */
+#define WF_NUM_SIDEBANDS_40MHZ   2
+#define WF_NUM_SIDEBANDS_80MHZ   4
+#define WF_NUM_SIDEBANDS_8080MHZ 4
+#define WF_NUM_SIDEBANDS_160MHZ  8
+
+/**
+ * Convert chanspec to ascii string
+ *
+ * @param      chspec          chanspec format
+ * @param      buf             ascii string of chanspec
+ *
+ * @return     pointer to buf with room for at least CHANSPEC_STR_LEN bytes
+ *             Original chanspec in case of error
+ *
+ * @see                CHANSPEC_STR_LEN
+ */
+extern char * wf_chspec_ntoa_ex(chanspec_t chspec, char *buf);
+
+/**
+ * Convert chanspec to ascii string
+ *
+ * @param      chspec          chanspec format
+ * @param      buf             ascii string of chanspec
+ *
+ * @return     pointer to buf with room for at least CHANSPEC_STR_LEN bytes
+ *             NULL in case of error
+ *
+ * @see                CHANSPEC_STR_LEN
+ */
+extern char * wf_chspec_ntoa(chanspec_t chspec, char *buf);
+
+/**
+ * Convert ascii string to chanspec
+ *
+ * @param      a     pointer to input string
+ *
+ * @return     >= 0 if successful or 0 otherwise
+ */
+extern chanspec_t wf_chspec_aton(const char *a);
+
+/**
+ * Verify the chanspec fields are valid.
+ *
+ * Verify the chanspec is using a legal set field values, i.e. that the chanspec
+ * specified a band, bw, ctl_sb and channel and that the combination could be
+ * legal given some set of circumstances.
+ *
+ * @param      chanspec   input chanspec to verify
+ *
+ * @return TRUE if the chanspec is malformed, FALSE if it looks good.
+ */
+extern bool wf_chspec_malformed(chanspec_t chanspec);
+
+/**
+ * Verify the chanspec specifies a valid channel according to 802.11.
+ *
+ * @param      chanspec   input chanspec to verify
+ *
+ * @return TRUE if the chanspec is a valid 802.11 channel
+ */
+extern bool wf_chspec_valid(chanspec_t chanspec);
+
+/**
+ * Return the primary (control) channel.
+ *
+ * This function returns the channel number of the primary 20MHz channel. For
+ * 20MHz channels this is just the channel number. For 40MHz or wider channels
+ * it is the primary 20MHz channel specified by the chanspec.
+ *
+ * @param      chspec    input chanspec
+ *
+ * @return Returns the channel number of the primary 20MHz channel
+ */
+extern uint8 wf_chspec_ctlchan(chanspec_t chspec);
+
+/*
+ * Return the bandwidth string.
+ *
+ * This function returns the bandwidth string for the passed chanspec.
+ *
+ * @param      chspec    input chanspec
+ *
+ * @return Returns the bandwidth string
+ */
+extern char * wf_chspec_to_bw_str(chanspec_t chspec);
+
+/**
+ * Return the primary (control) chanspec.
+ *
+ * This function returns the chanspec of the primary 20MHz channel. For 20MHz
+ * channels this is just the chanspec. For 40MHz or wider channels it is the
+ * chanspec of the primary 20MHZ channel specified by the chanspec.
+ *
+ * @param      chspec    input chanspec
+ *
+ * @return Returns the chanspec of the primary 20MHz channel
+ */
+extern chanspec_t wf_chspec_ctlchspec(chanspec_t chspec);
+
+/**
+ * Return a channel number corresponding to a frequency.
+ *
+ * This function returns the chanspec for the primary 40MHz of an 80MHz channel.
+ * The control sideband specifies the same 20MHz channel that the 80MHz channel is using
+ * as the primary 20MHz channel.
+ */
+extern chanspec_t wf_chspec_primary40_chspec(chanspec_t chspec);
+
+/*
+ * Return the channel number for a given frequency and base frequency.
+ * The returned channel number is relative to the given base frequency.
+ * If the given base frequency is zero, a base frequency of 5 GHz is assumed for
+ * frequencies from 5 - 6 GHz, and 2.407 GHz is assumed for 2.4 - 2.5 GHz.
+ *
+ * Frequency is specified in MHz.
+ * The base frequency is specified as (start_factor * 500 kHz).
+ * Constants WF_CHAN_FACTOR_2_4_G, WF_CHAN_FACTOR_5_G are defined for
+ * 2.4 GHz and 5 GHz bands.
+ *
+ * The returned channel will be in the range [1, 14] in the 2.4 GHz band
+ * and [0, 200] otherwise.
+ * -1 is returned if the start_factor is WF_CHAN_FACTOR_2_4_G and the
+ * frequency is not a 2.4 GHz channel, or if the frequency is not and even
+ * multiple of 5 MHz from the base frequency to the base plus 1 GHz.
+ *
+ * Reference 802.11 REVma, section 17.3.8.3, and 802.11B section 18.4.6.2
+ *
+ * @param      freq          frequency in MHz
+ * @param      start_factor  base frequency in 500 kHz units, e.g. 10000 for 5 GHz
+ *
+ * @return Returns a channel number
+ *
+ * @see  WF_CHAN_FACTOR_2_4_G
+ * @see  WF_CHAN_FACTOR_5_G
+ */
+extern int wf_mhz2channel(uint freq, uint start_factor);
+
+/**
+ * Return the center frequency in MHz of the given channel and base frequency.
+ *
+ * Return the center frequency in MHz of the given channel and base frequency.
+ * The channel number is interpreted relative to the given base frequency.
+ *
+ * The valid channel range is [1, 14] in the 2.4 GHz band and [0, 200] otherwise.
+ * The base frequency is specified as (start_factor * 500 kHz).
+ * Constants WF_CHAN_FACTOR_2_4_G, WF_CHAN_FACTOR_5_G are defined for
+ * 2.4 GHz and 5 GHz bands.
+ * The channel range of [1, 14] is only checked for a start_factor of
+ * WF_CHAN_FACTOR_2_4_G (4814).
+ * Odd start_factors produce channels on .5 MHz boundaries, in which case
+ * the answer is rounded down to an integral MHz.
+ * -1 is returned for an out of range channel.
+ *
+ * Reference 802.11 REVma, section 17.3.8.3, and 802.11B section 18.4.6.2
+ *
+ * @param      channel       input channel number
+ * @param      start_factor  base frequency in 500 kHz units, e.g. 10000 for 5 GHz
+ *
+ * @return Returns a frequency in MHz
+ *
+ * @see  WF_CHAN_FACTOR_2_4_G
+ * @see  WF_CHAN_FACTOR_5_G
+ */
+extern int wf_channel2mhz(uint channel, uint start_factor);
+
+/**
+ * Returns the chanspec 80Mhz channel corresponding to the following input
+ * parameters
+ *
+ *     primary_channel - primary 20Mhz channel
+ *     center_channel   - center frequecny of the 80Mhz channel
+ *
+ * The center_channel can be one of {42, 58, 106, 122, 138, 155}
+ *
+ * returns INVCHANSPEC in case of error
+ */
+extern chanspec_t wf_chspec_80(uint8 center_channel, uint8 primary_channel);
+
+/**
+ * Convert ctl chan and bw to chanspec
+ *
+ * @param      ctl_ch          channel
+ * @param      bw              bandwidth
+ *
+ * @return     > 0 if successful or 0 otherwise
+ *
+ */
+extern uint16 wf_channel2chspec(uint ctl_ch, uint bw);
+
+extern uint wf_channel2freq(uint channel);
+extern uint wf_freq2channel(uint freq);
+
+/*
+ * Returns the 80+80 MHz chanspec corresponding to the following input parameters
+ *
+ *    primary_20mhz - Primary 20 MHz channel
+ *    chan0_80MHz - center channel number of one frequency segment
+ *    chan1_80MHz - center channel number of the other frequency segment
+ *
+ * Parameters chan0_80MHz and chan1_80MHz are channel numbers in {42, 58, 106, 122, 138, 155}.
+ * The primary channel must be contained in one of the 80MHz channels. This routine
+ * will determine which frequency segment is the primary 80 MHz segment.
+ *
+ * Returns INVCHANSPEC in case of error.
+ *
+ * Refer to IEEE802.11ac section 22.3.14 "Channelization".
+ */
+extern chanspec_t wf_chspec_get8080_chspec(uint8 primary_20mhz,
+       uint8 chan0_80Mhz, uint8 chan1_80Mhz);
+
+/*
+ * Returns the primary 80 Mhz channel for the provided chanspec
+ *
+ *    chanspec - Input chanspec for which the 80MHz primary channel has to be retrieved
+ *
+ *  returns -1 in case the provided channel is 20/40 Mhz chanspec
+ */
+extern uint8 wf_chspec_primary80_channel(chanspec_t chanspec);
+
+/*
+ * Returns the secondary 80 Mhz channel for the provided chanspec
+ *
+ *    chanspec - Input chanspec for which the 80MHz secondary channel has to be retrieved
+ *
+ *  returns -1 in case the provided channel is 20/40 Mhz chanspec
+ */
+extern uint8 wf_chspec_secondary80_channel(chanspec_t chanspec);
+
+/*
+ * This function returns the chanspec for the primary 80MHz of an 160MHz or 80+80 channel.
+ */
+extern chanspec_t wf_chspec_primary80_chspec(chanspec_t chspec);
+
+#ifdef WL11AC_80P80
+/*
+ * This function returns the centre chanel for the given chanspec.
+ * In case of 80+80 chanspec it returns the primary 80 Mhz centre channel
+ */
+extern uint8 wf_chspec_channel(chanspec_t chspec);
+#endif
+#endif /* _bcmwifi_channels_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/bcmwifi_rates.h b/drivers/net/wireless/bcmdhd_1363/bcmwifi_rates.h
new file mode 100644 (file)
index 0000000..487a4ba
--- /dev/null
@@ -0,0 +1,793 @@
+/*
+ * Indices for 802.11 a/b/g/n/ac 1-3 chain symmetric transmit rates
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmwifi_rates.h 591285 2015-10-07 11:56:29Z $
+ */
+
+#ifndef _bcmwifi_rates_h_
+#define _bcmwifi_rates_h_
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+
+
+#define WL_RATESET_SZ_DSSS             4
+#define WL_RATESET_SZ_OFDM             8
+#define WL_RATESET_SZ_VHT_MCS  10
+#define WL_RATESET_SZ_VHT_MCS_P        12
+
+#if defined(WLPROPRIETARY_11N_RATES)
+#define WL_RATESET_SZ_HT_MCS   WL_RATESET_SZ_VHT_MCS
+#else
+#define WL_RATESET_SZ_HT_MCS   8
+#endif
+
+#define WL_RATESET_SZ_HT_IOCTL 8       /* MAC histogram, compatibility with wl utility */
+
+#define WL_TX_CHAINS_MAX               4
+
+#define WL_RATE_DISABLED               (-128) /* Power value corresponding to unsupported rate */
+
+/* Transmit channel bandwidths */
+typedef enum wl_tx_bw {
+       WL_TX_BW_20,
+       WL_TX_BW_40,
+       WL_TX_BW_80,
+       WL_TX_BW_20IN40,
+       WL_TX_BW_20IN80,
+       WL_TX_BW_40IN80,
+       WL_TX_BW_160,
+       WL_TX_BW_20IN160,
+       WL_TX_BW_40IN160,
+       WL_TX_BW_80IN160,
+       WL_TX_BW_ALL,
+       WL_TX_BW_8080,
+       WL_TX_BW_8080CHAN2,
+       WL_TX_BW_20IN8080,
+       WL_TX_BW_40IN8080,
+       WL_TX_BW_80IN8080,
+       WL_TX_BW_2P5,
+       WL_TX_BW_5,
+       WL_TX_BW_10
+} wl_tx_bw_t;
+
+
+/*
+ * Transmit modes.
+ * Not all modes are listed here, only those required for disambiguation. e.g. SPEXP is not listed
+ */
+typedef enum wl_tx_mode {
+       WL_TX_MODE_NONE,
+       WL_TX_MODE_STBC,
+       WL_TX_MODE_CDD,
+       WL_TX_MODE_TXBF,
+       WL_NUM_TX_MODES
+} wl_tx_mode_t;
+
+
+/* Number of transmit chains */
+typedef enum wl_tx_chains {
+       WL_TX_CHAINS_1 = 1,
+       WL_TX_CHAINS_2,
+       WL_TX_CHAINS_3,
+       WL_TX_CHAINS_4
+} wl_tx_chains_t;
+
+
+/* Number of transmit streams */
+typedef enum wl_tx_nss {
+       WL_TX_NSS_1 = 1,
+       WL_TX_NSS_2,
+       WL_TX_NSS_3,
+       WL_TX_NSS_4
+} wl_tx_nss_t;
+
+
+/* This enum maps each rate to a CLM index */
+
+typedef enum clm_rates {
+       /************
+       * 1 chain  *
+       ************
+       */
+
+       /* 1 Stream */
+       WL_RATE_1X1_DSSS_1            = 0,
+       WL_RATE_1X1_DSSS_2            = 1,
+       WL_RATE_1X1_DSSS_5_5          = 2,
+       WL_RATE_1X1_DSSS_11           = 3,
+
+       WL_RATE_1X1_OFDM_6            = 4,
+       WL_RATE_1X1_OFDM_9            = 5,
+       WL_RATE_1X1_OFDM_12           = 6,
+       WL_RATE_1X1_OFDM_18           = 7,
+       WL_RATE_1X1_OFDM_24           = 8,
+       WL_RATE_1X1_OFDM_36           = 9,
+       WL_RATE_1X1_OFDM_48           = 10,
+       WL_RATE_1X1_OFDM_54           = 11,
+
+       WL_RATE_1X1_MCS0              = 12,
+       WL_RATE_1X1_MCS1              = 13,
+       WL_RATE_1X1_MCS2              = 14,
+       WL_RATE_1X1_MCS3              = 15,
+       WL_RATE_1X1_MCS4              = 16,
+       WL_RATE_1X1_MCS5              = 17,
+       WL_RATE_1X1_MCS6              = 18,
+       WL_RATE_1X1_MCS7              = 19,
+       WL_RATE_P_1X1_MCS87           = 20,
+       WL_RATE_P_1X1_MCS88           = 21,
+
+       WL_RATE_1X1_VHT0SS1           = 12,
+       WL_RATE_1X1_VHT1SS1           = 13,
+       WL_RATE_1X1_VHT2SS1           = 14,
+       WL_RATE_1X1_VHT3SS1           = 15,
+       WL_RATE_1X1_VHT4SS1           = 16,
+       WL_RATE_1X1_VHT5SS1           = 17,
+       WL_RATE_1X1_VHT6SS1           = 18,
+       WL_RATE_1X1_VHT7SS1           = 19,
+       WL_RATE_1X1_VHT8SS1           = 20,
+       WL_RATE_1X1_VHT9SS1           = 21,
+       WL_RATE_P_1X1_VHT10SS1        = 22,
+       WL_RATE_P_1X1_VHT11SS1        = 23,
+
+
+       /************
+       * 2 chains *
+       ************
+       */
+
+       /* 1 Stream expanded + 1 */
+       WL_RATE_1X2_DSSS_1            = 24,
+       WL_RATE_1X2_DSSS_2            = 25,
+       WL_RATE_1X2_DSSS_5_5          = 26,
+       WL_RATE_1X2_DSSS_11           = 27,
+
+       WL_RATE_1X2_CDD_OFDM_6        = 28,
+       WL_RATE_1X2_CDD_OFDM_9        = 29,
+       WL_RATE_1X2_CDD_OFDM_12       = 30,
+       WL_RATE_1X2_CDD_OFDM_18       = 31,
+       WL_RATE_1X2_CDD_OFDM_24       = 32,
+       WL_RATE_1X2_CDD_OFDM_36       = 33,
+       WL_RATE_1X2_CDD_OFDM_48       = 34,
+       WL_RATE_1X2_CDD_OFDM_54       = 35,
+
+       WL_RATE_1X2_CDD_MCS0          = 36,
+       WL_RATE_1X2_CDD_MCS1          = 37,
+       WL_RATE_1X2_CDD_MCS2          = 38,
+       WL_RATE_1X2_CDD_MCS3          = 39,
+       WL_RATE_1X2_CDD_MCS4          = 40,
+       WL_RATE_1X2_CDD_MCS5          = 41,
+       WL_RATE_1X2_CDD_MCS6          = 42,
+       WL_RATE_1X2_CDD_MCS7          = 43,
+       WL_RATE_P_1X2_CDD_MCS87       = 44,
+       WL_RATE_P_1X2_CDD_MCS88       = 45,
+
+       WL_RATE_1X2_VHT0SS1           = 36,
+       WL_RATE_1X2_VHT1SS1           = 37,
+       WL_RATE_1X2_VHT2SS1           = 38,
+       WL_RATE_1X2_VHT3SS1           = 39,
+       WL_RATE_1X2_VHT4SS1           = 40,
+       WL_RATE_1X2_VHT5SS1           = 41,
+       WL_RATE_1X2_VHT6SS1           = 42,
+       WL_RATE_1X2_VHT7SS1           = 43,
+       WL_RATE_1X2_VHT8SS1           = 44,
+       WL_RATE_1X2_VHT9SS1           = 45,
+       WL_RATE_P_1X2_VHT10SS1        = 46,
+       WL_RATE_P_1X2_VHT11SS1        = 47,
+
+       /* 2 Streams */
+       WL_RATE_2X2_STBC_MCS0         = 48,
+       WL_RATE_2X2_STBC_MCS1         = 49,
+       WL_RATE_2X2_STBC_MCS2         = 50,
+       WL_RATE_2X2_STBC_MCS3         = 51,
+       WL_RATE_2X2_STBC_MCS4         = 52,
+       WL_RATE_2X2_STBC_MCS5         = 53,
+       WL_RATE_2X2_STBC_MCS6         = 54,
+       WL_RATE_2X2_STBC_MCS7         = 55,
+       WL_RATE_P_2X2_STBC_MCS87      = 56,
+       WL_RATE_P_2X2_STBC_MCS88      = 57,
+
+       WL_RATE_2X2_STBC_VHT0SS1      = 48,
+       WL_RATE_2X2_STBC_VHT1SS1      = 49,
+       WL_RATE_2X2_STBC_VHT2SS1      = 50,
+       WL_RATE_2X2_STBC_VHT3SS1      = 51,
+       WL_RATE_2X2_STBC_VHT4SS1      = 52,
+       WL_RATE_2X2_STBC_VHT5SS1      = 53,
+       WL_RATE_2X2_STBC_VHT6SS1      = 54,
+       WL_RATE_2X2_STBC_VHT7SS1      = 55,
+       WL_RATE_2X2_STBC_VHT8SS1      = 56,
+       WL_RATE_2X2_STBC_VHT9SS1      = 57,
+       WL_RATE_P_2X2_STBC_VHT10SS1   = 58,
+       WL_RATE_P_2X2_STBC_VHT11SS1   = 59,
+
+       WL_RATE_2X2_SDM_MCS8          = 60,
+       WL_RATE_2X2_SDM_MCS9          = 61,
+       WL_RATE_2X2_SDM_MCS10         = 62,
+       WL_RATE_2X2_SDM_MCS11         = 63,
+       WL_RATE_2X2_SDM_MCS12         = 64,
+       WL_RATE_2X2_SDM_MCS13         = 65,
+       WL_RATE_2X2_SDM_MCS14         = 66,
+       WL_RATE_2X2_SDM_MCS15         = 67,
+       WL_RATE_P_2X2_SDM_MCS99       = 68,
+       WL_RATE_P_2X2_SDM_MCS100      = 69,
+
+       WL_RATE_2X2_VHT0SS2           = 60,
+       WL_RATE_2X2_VHT1SS2           = 61,
+       WL_RATE_2X2_VHT2SS2           = 62,
+       WL_RATE_2X2_VHT3SS2           = 63,
+       WL_RATE_2X2_VHT4SS2           = 64,
+       WL_RATE_2X2_VHT5SS2           = 65,
+       WL_RATE_2X2_VHT6SS2           = 66,
+       WL_RATE_2X2_VHT7SS2           = 67,
+       WL_RATE_2X2_VHT8SS2           = 68,
+       WL_RATE_2X2_VHT9SS2           = 69,
+       WL_RATE_P_2X2_VHT10SS2        = 70,
+       WL_RATE_P_2X2_VHT11SS2        = 71,
+
+       /****************************
+        * TX Beamforming, 2 chains *
+        ****************************
+        */
+
+       /* 1 Stream expanded + 1 */
+       WL_RATE_1X2_TXBF_OFDM_6       = 72,
+       WL_RATE_1X2_TXBF_OFDM_9       = 73,
+       WL_RATE_1X2_TXBF_OFDM_12      = 74,
+       WL_RATE_1X2_TXBF_OFDM_18      = 75,
+       WL_RATE_1X2_TXBF_OFDM_24      = 76,
+       WL_RATE_1X2_TXBF_OFDM_36      = 77,
+       WL_RATE_1X2_TXBF_OFDM_48      = 78,
+       WL_RATE_1X2_TXBF_OFDM_54      = 79,
+
+       WL_RATE_1X2_TXBF_MCS0         = 80,
+       WL_RATE_1X2_TXBF_MCS1         = 81,
+       WL_RATE_1X2_TXBF_MCS2         = 82,
+       WL_RATE_1X2_TXBF_MCS3         = 83,
+       WL_RATE_1X2_TXBF_MCS4         = 84,
+       WL_RATE_1X2_TXBF_MCS5         = 85,
+       WL_RATE_1X2_TXBF_MCS6         = 86,
+       WL_RATE_1X2_TXBF_MCS7         = 87,
+       WL_RATE_P_1X2_TXBF_MCS87      = 88,
+       WL_RATE_P_1X2_TXBF_MCS88      = 89,
+
+       WL_RATE_1X2_TXBF_VHT0SS1      = 80,
+       WL_RATE_1X2_TXBF_VHT1SS1      = 81,
+       WL_RATE_1X2_TXBF_VHT2SS1      = 82,
+       WL_RATE_1X2_TXBF_VHT3SS1      = 83,
+       WL_RATE_1X2_TXBF_VHT4SS1      = 84,
+       WL_RATE_1X2_TXBF_VHT5SS1      = 85,
+       WL_RATE_1X2_TXBF_VHT6SS1      = 86,
+       WL_RATE_1X2_TXBF_VHT7SS1      = 87,
+       WL_RATE_1X2_TXBF_VHT8SS1      = 88,
+       WL_RATE_1X2_TXBF_VHT9SS1      = 89,
+       WL_RATE_P_1X2_TXBF_VHT10SS1   = 90,
+       WL_RATE_P_1X2_TXBF_VHT11SS1   = 91,
+
+       /* 2 Streams */
+       WL_RATE_2X2_TXBF_SDM_MCS8     = 92,
+       WL_RATE_2X2_TXBF_SDM_MCS9     = 93,
+       WL_RATE_2X2_TXBF_SDM_MCS10    = 94,
+       WL_RATE_2X2_TXBF_SDM_MCS11    = 95,
+       WL_RATE_2X2_TXBF_SDM_MCS12    = 96,
+       WL_RATE_2X2_TXBF_SDM_MCS13    = 97,
+       WL_RATE_2X2_TXBF_SDM_MCS14    = 98,
+       WL_RATE_2X2_TXBF_SDM_MCS15    = 99,
+       WL_RATE_P_2X2_TXBF_SDM_MCS99  = 100,
+       WL_RATE_P_2X2_TXBF_SDM_MCS100 = 101,
+
+       WL_RATE_2X2_TXBF_VHT0SS2      = 92,
+       WL_RATE_2X2_TXBF_VHT1SS2      = 93,
+       WL_RATE_2X2_TXBF_VHT2SS2      = 94,
+       WL_RATE_2X2_TXBF_VHT3SS2      = 95,
+       WL_RATE_2X2_TXBF_VHT4SS2      = 96,
+       WL_RATE_2X2_TXBF_VHT5SS2      = 97,
+       WL_RATE_2X2_TXBF_VHT6SS2      = 98,
+       WL_RATE_2X2_TXBF_VHT7SS2      = 99,
+       WL_RATE_2X2_TXBF_VHT8SS2      = 100,
+       WL_RATE_2X2_TXBF_VHT9SS2      = 101,
+       WL_RATE_P_2X2_TXBF_VHT10SS2   = 102,
+       WL_RATE_P_2X2_TXBF_VHT11SS2   = 103,
+
+
+       /************
+       * 3 chains *
+       ************
+       */
+
+       /* 1 Stream expanded + 2 */
+       WL_RATE_1X3_DSSS_1            = 104,
+       WL_RATE_1X3_DSSS_2            = 105,
+       WL_RATE_1X3_DSSS_5_5          = 106,
+       WL_RATE_1X3_DSSS_11           = 107,
+
+       WL_RATE_1X3_CDD_OFDM_6        = 108,
+       WL_RATE_1X3_CDD_OFDM_9        = 109,
+       WL_RATE_1X3_CDD_OFDM_12       = 110,
+       WL_RATE_1X3_CDD_OFDM_18       = 111,
+       WL_RATE_1X3_CDD_OFDM_24       = 112,
+       WL_RATE_1X3_CDD_OFDM_36       = 113,
+       WL_RATE_1X3_CDD_OFDM_48       = 114,
+       WL_RATE_1X3_CDD_OFDM_54       = 115,
+
+       WL_RATE_1X3_CDD_MCS0          = 116,
+       WL_RATE_1X3_CDD_MCS1          = 117,
+       WL_RATE_1X3_CDD_MCS2          = 118,
+       WL_RATE_1X3_CDD_MCS3          = 119,
+       WL_RATE_1X3_CDD_MCS4          = 120,
+       WL_RATE_1X3_CDD_MCS5          = 121,
+       WL_RATE_1X3_CDD_MCS6          = 122,
+       WL_RATE_1X3_CDD_MCS7          = 123,
+       WL_RATE_P_1X3_CDD_MCS87       = 124,
+       WL_RATE_P_1X3_CDD_MCS88       = 125,
+
+       WL_RATE_1X3_VHT0SS1           = 116,
+       WL_RATE_1X3_VHT1SS1           = 117,
+       WL_RATE_1X3_VHT2SS1           = 118,
+       WL_RATE_1X3_VHT3SS1           = 119,
+       WL_RATE_1X3_VHT4SS1           = 120,
+       WL_RATE_1X3_VHT5SS1           = 121,
+       WL_RATE_1X3_VHT6SS1           = 122,
+       WL_RATE_1X3_VHT7SS1           = 123,
+       WL_RATE_1X3_VHT8SS1           = 124,
+       WL_RATE_1X3_VHT9SS1           = 125,
+       WL_RATE_P_1X3_VHT10SS1        = 126,
+       WL_RATE_P_1X3_VHT11SS1        = 127,
+
+       /* 2 Streams expanded + 1 */
+       WL_RATE_2X3_STBC_MCS0         = 128,
+       WL_RATE_2X3_STBC_MCS1         = 129,
+       WL_RATE_2X3_STBC_MCS2         = 130,
+       WL_RATE_2X3_STBC_MCS3         = 131,
+       WL_RATE_2X3_STBC_MCS4         = 132,
+       WL_RATE_2X3_STBC_MCS5         = 133,
+       WL_RATE_2X3_STBC_MCS6         = 134,
+       WL_RATE_2X3_STBC_MCS7         = 135,
+       WL_RATE_P_2X3_STBC_MCS87      = 136,
+       WL_RATE_P_2X3_STBC_MCS88      = 137,
+
+       WL_RATE_2X3_STBC_VHT0SS1      = 128,
+       WL_RATE_2X3_STBC_VHT1SS1      = 129,
+       WL_RATE_2X3_STBC_VHT2SS1      = 130,
+       WL_RATE_2X3_STBC_VHT3SS1      = 131,
+       WL_RATE_2X3_STBC_VHT4SS1      = 132,
+       WL_RATE_2X3_STBC_VHT5SS1      = 133,
+       WL_RATE_2X3_STBC_VHT6SS1      = 134,
+       WL_RATE_2X3_STBC_VHT7SS1      = 135,
+       WL_RATE_2X3_STBC_VHT8SS1      = 136,
+       WL_RATE_2X3_STBC_VHT9SS1      = 137,
+       WL_RATE_P_2X3_STBC_VHT10SS1   = 138,
+       WL_RATE_P_2X3_STBC_VHT11SS1   = 139,
+
+       WL_RATE_2X3_SDM_MCS8          = 140,
+       WL_RATE_2X3_SDM_MCS9          = 141,
+       WL_RATE_2X3_SDM_MCS10         = 142,
+       WL_RATE_2X3_SDM_MCS11         = 143,
+       WL_RATE_2X3_SDM_MCS12         = 144,
+       WL_RATE_2X3_SDM_MCS13         = 145,
+       WL_RATE_2X3_SDM_MCS14         = 146,
+       WL_RATE_2X3_SDM_MCS15         = 147,
+       WL_RATE_P_2X3_SDM_MCS99       = 148,
+       WL_RATE_P_2X3_SDM_MCS100      = 149,
+
+       WL_RATE_2X3_VHT0SS2           = 140,
+       WL_RATE_2X3_VHT1SS2           = 141,
+       WL_RATE_2X3_VHT2SS2           = 142,
+       WL_RATE_2X3_VHT3SS2           = 143,
+       WL_RATE_2X3_VHT4SS2           = 144,
+       WL_RATE_2X3_VHT5SS2           = 145,
+       WL_RATE_2X3_VHT6SS2           = 146,
+       WL_RATE_2X3_VHT7SS2           = 147,
+       WL_RATE_2X3_VHT8SS2           = 148,
+       WL_RATE_2X3_VHT9SS2           = 149,
+       WL_RATE_P_2X3_VHT10SS2        = 150,
+       WL_RATE_P_2X3_VHT11SS2        = 151,
+
+       /* 3 Streams */
+       WL_RATE_3X3_SDM_MCS16         = 152,
+       WL_RATE_3X3_SDM_MCS17         = 153,
+       WL_RATE_3X3_SDM_MCS18         = 154,
+       WL_RATE_3X3_SDM_MCS19         = 155,
+       WL_RATE_3X3_SDM_MCS20         = 156,
+       WL_RATE_3X3_SDM_MCS21         = 157,
+       WL_RATE_3X3_SDM_MCS22         = 158,
+       WL_RATE_3X3_SDM_MCS23         = 159,
+       WL_RATE_P_3X3_SDM_MCS101      = 160,
+       WL_RATE_P_3X3_SDM_MCS102      = 161,
+
+       WL_RATE_3X3_VHT0SS3           = 152,
+       WL_RATE_3X3_VHT1SS3           = 153,
+       WL_RATE_3X3_VHT2SS3           = 154,
+       WL_RATE_3X3_VHT3SS3           = 155,
+       WL_RATE_3X3_VHT4SS3           = 156,
+       WL_RATE_3X3_VHT5SS3           = 157,
+       WL_RATE_3X3_VHT6SS3           = 158,
+       WL_RATE_3X3_VHT7SS3           = 159,
+       WL_RATE_3X3_VHT8SS3           = 160,
+       WL_RATE_3X3_VHT9SS3           = 161,
+       WL_RATE_P_3X3_VHT10SS3        = 162,
+       WL_RATE_P_3X3_VHT11SS3        = 163,
+
+
+       /****************************
+        * TX Beamforming, 3 chains *
+        ****************************
+        */
+
+       /* 1 Stream expanded + 2 */
+       WL_RATE_1X3_TXBF_OFDM_6       = 164,
+       WL_RATE_1X3_TXBF_OFDM_9       = 165,
+       WL_RATE_1X3_TXBF_OFDM_12      = 166,
+       WL_RATE_1X3_TXBF_OFDM_18      = 167,
+       WL_RATE_1X3_TXBF_OFDM_24      = 168,
+       WL_RATE_1X3_TXBF_OFDM_36      = 169,
+       WL_RATE_1X3_TXBF_OFDM_48      = 170,
+       WL_RATE_1X3_TXBF_OFDM_54      = 171,
+
+       WL_RATE_1X3_TXBF_MCS0         = 172,
+       WL_RATE_1X3_TXBF_MCS1         = 173,
+       WL_RATE_1X3_TXBF_MCS2         = 174,
+       WL_RATE_1X3_TXBF_MCS3         = 175,
+       WL_RATE_1X3_TXBF_MCS4         = 176,
+       WL_RATE_1X3_TXBF_MCS5         = 177,
+       WL_RATE_1X3_TXBF_MCS6         = 178,
+       WL_RATE_1X3_TXBF_MCS7         = 179,
+       WL_RATE_P_1X3_TXBF_MCS87      = 180,
+       WL_RATE_P_1X3_TXBF_MCS88      = 181,
+
+       WL_RATE_1X3_TXBF_VHT0SS1      = 172,
+       WL_RATE_1X3_TXBF_VHT1SS1      = 173,
+       WL_RATE_1X3_TXBF_VHT2SS1      = 174,
+       WL_RATE_1X3_TXBF_VHT3SS1      = 175,
+       WL_RATE_1X3_TXBF_VHT4SS1      = 176,
+       WL_RATE_1X3_TXBF_VHT5SS1      = 177,
+       WL_RATE_1X3_TXBF_VHT6SS1      = 178,
+       WL_RATE_1X3_TXBF_VHT7SS1      = 179,
+       WL_RATE_1X3_TXBF_VHT8SS1      = 180,
+       WL_RATE_1X3_TXBF_VHT9SS1      = 181,
+       WL_RATE_P_1X3_TXBF_VHT10SS1   = 182,
+       WL_RATE_P_1X3_TXBF_VHT11SS1   = 183,
+
+       /* 2 Streams expanded + 1 */
+       WL_RATE_2X3_TXBF_SDM_MCS8     = 184,
+       WL_RATE_2X3_TXBF_SDM_MCS9     = 185,
+       WL_RATE_2X3_TXBF_SDM_MCS10    = 186,
+       WL_RATE_2X3_TXBF_SDM_MCS11    = 187,
+       WL_RATE_2X3_TXBF_SDM_MCS12    = 188,
+       WL_RATE_2X3_TXBF_SDM_MCS13    = 189,
+       WL_RATE_2X3_TXBF_SDM_MCS14    = 190,
+       WL_RATE_2X3_TXBF_SDM_MCS15    = 191,
+       WL_RATE_P_2X3_TXBF_SDM_MCS99  = 192,
+       WL_RATE_P_2X3_TXBF_SDM_MCS100 = 193,
+
+       WL_RATE_2X3_TXBF_VHT0SS2      = 184,
+       WL_RATE_2X3_TXBF_VHT1SS2      = 185,
+       WL_RATE_2X3_TXBF_VHT2SS2      = 186,
+       WL_RATE_2X3_TXBF_VHT3SS2      = 187,
+       WL_RATE_2X3_TXBF_VHT4SS2      = 188,
+       WL_RATE_2X3_TXBF_VHT5SS2      = 189,
+       WL_RATE_2X3_TXBF_VHT6SS2      = 190,
+       WL_RATE_2X3_TXBF_VHT7SS2      = 191,
+       WL_RATE_2X3_TXBF_VHT8SS2      = 192,
+       WL_RATE_2X3_TXBF_VHT9SS2      = 193,
+       WL_RATE_P_2X3_TXBF_VHT10SS2   = 194,
+       WL_RATE_P_2X3_TXBF_VHT11SS2   = 195,
+
+       /* 3 Streams */
+       WL_RATE_3X3_TXBF_SDM_MCS16    = 196,
+       WL_RATE_3X3_TXBF_SDM_MCS17    = 197,
+       WL_RATE_3X3_TXBF_SDM_MCS18    = 198,
+       WL_RATE_3X3_TXBF_SDM_MCS19    = 199,
+       WL_RATE_3X3_TXBF_SDM_MCS20    = 200,
+       WL_RATE_3X3_TXBF_SDM_MCS21    = 201,
+       WL_RATE_3X3_TXBF_SDM_MCS22    = 202,
+       WL_RATE_3X3_TXBF_SDM_MCS23    = 203,
+       WL_RATE_P_3X3_TXBF_SDM_MCS101 = 204,
+       WL_RATE_P_3X3_TXBF_SDM_MCS102 = 205,
+
+       WL_RATE_3X3_TXBF_VHT0SS3      = 196,
+       WL_RATE_3X3_TXBF_VHT1SS3      = 197,
+       WL_RATE_3X3_TXBF_VHT2SS3      = 198,
+       WL_RATE_3X3_TXBF_VHT3SS3      = 199,
+       WL_RATE_3X3_TXBF_VHT4SS3      = 200,
+       WL_RATE_3X3_TXBF_VHT5SS3      = 201,
+       WL_RATE_3X3_TXBF_VHT6SS3      = 202,
+       WL_RATE_3X3_TXBF_VHT7SS3      = 203,
+       WL_RATE_3X3_TXBF_VHT8SS3      = 204,
+       WL_RATE_3X3_TXBF_VHT9SS3      = 205,
+       WL_RATE_P_3X3_TXBF_VHT10SS3   = 206,
+       WL_RATE_P_3X3_TXBF_VHT11SS3   = 207,
+
+
+       /************
+       * 4 chains *
+       ************
+       */
+
+       /* 1 Stream expanded + 3 */
+       WL_RATE_1X4_DSSS_1            = 208,
+       WL_RATE_1X4_DSSS_2            = 209,
+       WL_RATE_1X4_DSSS_5_5          = 210,
+       WL_RATE_1X4_DSSS_11           = 211,
+
+       WL_RATE_1X4_CDD_OFDM_6        = 212,
+       WL_RATE_1X4_CDD_OFDM_9        = 213,
+       WL_RATE_1X4_CDD_OFDM_12       = 214,
+       WL_RATE_1X4_CDD_OFDM_18       = 215,
+       WL_RATE_1X4_CDD_OFDM_24       = 216,
+       WL_RATE_1X4_CDD_OFDM_36       = 217,
+       WL_RATE_1X4_CDD_OFDM_48       = 218,
+       WL_RATE_1X4_CDD_OFDM_54       = 219,
+
+       WL_RATE_1X4_CDD_MCS0          = 220,
+       WL_RATE_1X4_CDD_MCS1          = 221,
+       WL_RATE_1X4_CDD_MCS2          = 222,
+       WL_RATE_1X4_CDD_MCS3          = 223,
+       WL_RATE_1X4_CDD_MCS4          = 224,
+       WL_RATE_1X4_CDD_MCS5          = 225,
+       WL_RATE_1X4_CDD_MCS6          = 226,
+       WL_RATE_1X4_CDD_MCS7          = 227,
+       WL_RATE_P_1X4_CDD_MCS87       = 228,
+       WL_RATE_P_1X4_CDD_MCS88       = 229,
+
+       WL_RATE_1X4_VHT0SS1           = 220,
+       WL_RATE_1X4_VHT1SS1           = 221,
+       WL_RATE_1X4_VHT2SS1           = 222,
+       WL_RATE_1X4_VHT3SS1           = 223,
+       WL_RATE_1X4_VHT4SS1           = 224,
+       WL_RATE_1X4_VHT5SS1           = 225,
+       WL_RATE_1X4_VHT6SS1           = 226,
+       WL_RATE_1X4_VHT7SS1           = 227,
+       WL_RATE_1X4_VHT8SS1           = 228,
+       WL_RATE_1X4_VHT9SS1           = 229,
+       WL_RATE_P_1X4_VHT10SS1        = 230,
+       WL_RATE_P_1X4_VHT11SS1        = 231,
+
+       /* 2 Streams expanded + 2 */
+       WL_RATE_2X4_STBC_MCS0         = 232,
+       WL_RATE_2X4_STBC_MCS1         = 233,
+       WL_RATE_2X4_STBC_MCS2         = 234,
+       WL_RATE_2X4_STBC_MCS3         = 235,
+       WL_RATE_2X4_STBC_MCS4         = 236,
+       WL_RATE_2X4_STBC_MCS5         = 237,
+       WL_RATE_2X4_STBC_MCS6         = 238,
+       WL_RATE_2X4_STBC_MCS7         = 239,
+       WL_RATE_P_2X4_STBC_MCS87      = 240,
+       WL_RATE_P_2X4_STBC_MCS88      = 241,
+
+       WL_RATE_2X4_STBC_VHT0SS1      = 232,
+       WL_RATE_2X4_STBC_VHT1SS1      = 233,
+       WL_RATE_2X4_STBC_VHT2SS1      = 234,
+       WL_RATE_2X4_STBC_VHT3SS1      = 235,
+       WL_RATE_2X4_STBC_VHT4SS1      = 236,
+       WL_RATE_2X4_STBC_VHT5SS1      = 237,
+       WL_RATE_2X4_STBC_VHT6SS1      = 238,
+       WL_RATE_2X4_STBC_VHT7SS1      = 239,
+       WL_RATE_2X4_STBC_VHT8SS1      = 240,
+       WL_RATE_2X4_STBC_VHT9SS1      = 241,
+       WL_RATE_P_2X4_STBC_VHT10SS1   = 242,
+       WL_RATE_P_2X4_STBC_VHT11SS1   = 243,
+
+       WL_RATE_2X4_SDM_MCS8          = 244,
+       WL_RATE_2X4_SDM_MCS9          = 245,
+       WL_RATE_2X4_SDM_MCS10         = 246,
+       WL_RATE_2X4_SDM_MCS11         = 247,
+       WL_RATE_2X4_SDM_MCS12         = 248,
+       WL_RATE_2X4_SDM_MCS13         = 249,
+       WL_RATE_2X4_SDM_MCS14         = 250,
+       WL_RATE_2X4_SDM_MCS15         = 251,
+       WL_RATE_P_2X4_SDM_MCS99       = 252,
+       WL_RATE_P_2X4_SDM_MCS100      = 253,
+
+       WL_RATE_2X4_VHT0SS2           = 244,
+       WL_RATE_2X4_VHT1SS2           = 245,
+       WL_RATE_2X4_VHT2SS2           = 246,
+       WL_RATE_2X4_VHT3SS2           = 247,
+       WL_RATE_2X4_VHT4SS2           = 248,
+       WL_RATE_2X4_VHT5SS2           = 249,
+       WL_RATE_2X4_VHT6SS2           = 250,
+       WL_RATE_2X4_VHT7SS2           = 251,
+       WL_RATE_2X4_VHT8SS2           = 252,
+       WL_RATE_2X4_VHT9SS2           = 253,
+       WL_RATE_P_2X4_VHT10SS2        = 254,
+       WL_RATE_P_2X4_VHT11SS2        = 255,
+
+       /* 3 Streams expanded + 1 */
+       WL_RATE_3X4_SDM_MCS16         = 256,
+       WL_RATE_3X4_SDM_MCS17         = 257,
+       WL_RATE_3X4_SDM_MCS18         = 258,
+       WL_RATE_3X4_SDM_MCS19         = 259,
+       WL_RATE_3X4_SDM_MCS20         = 260,
+       WL_RATE_3X4_SDM_MCS21         = 261,
+       WL_RATE_3X4_SDM_MCS22         = 262,
+       WL_RATE_3X4_SDM_MCS23         = 263,
+       WL_RATE_P_3X4_SDM_MCS101      = 264,
+       WL_RATE_P_3X4_SDM_MCS102      = 265,
+
+       WL_RATE_3X4_VHT0SS3           = 256,
+       WL_RATE_3X4_VHT1SS3           = 257,
+       WL_RATE_3X4_VHT2SS3           = 258,
+       WL_RATE_3X4_VHT3SS3           = 259,
+       WL_RATE_3X4_VHT4SS3           = 260,
+       WL_RATE_3X4_VHT5SS3           = 261,
+       WL_RATE_3X4_VHT6SS3           = 262,
+       WL_RATE_3X4_VHT7SS3           = 263,
+       WL_RATE_3X4_VHT8SS3           = 264,
+       WL_RATE_3X4_VHT9SS3           = 265,
+       WL_RATE_P_3X4_VHT10SS3        = 266,
+       WL_RATE_P_3X4_VHT11SS3        = 267,
+
+
+       /* 4 Streams */
+       WL_RATE_4X4_SDM_MCS24         = 268,
+       WL_RATE_4X4_SDM_MCS25         = 269,
+       WL_RATE_4X4_SDM_MCS26         = 270,
+       WL_RATE_4X4_SDM_MCS27         = 271,
+       WL_RATE_4X4_SDM_MCS28         = 272,
+       WL_RATE_4X4_SDM_MCS29         = 273,
+       WL_RATE_4X4_SDM_MCS30         = 274,
+       WL_RATE_4X4_SDM_MCS31         = 275,
+       WL_RATE_P_4X4_SDM_MCS103      = 276,
+       WL_RATE_P_4X4_SDM_MCS104      = 277,
+
+       WL_RATE_4X4_VHT0SS4           = 268,
+       WL_RATE_4X4_VHT1SS4           = 269,
+       WL_RATE_4X4_VHT2SS4           = 270,
+       WL_RATE_4X4_VHT3SS4           = 271,
+       WL_RATE_4X4_VHT4SS4           = 272,
+       WL_RATE_4X4_VHT5SS4           = 273,
+       WL_RATE_4X4_VHT6SS4           = 274,
+       WL_RATE_4X4_VHT7SS4           = 275,
+       WL_RATE_4X4_VHT8SS4           = 276,
+       WL_RATE_4X4_VHT9SS4           = 277,
+       WL_RATE_P_4X4_VHT10SS4        = 278,
+       WL_RATE_P_4X4_VHT11SS4        = 279,
+
+
+       /****************************
+        * TX Beamforming, 4 chains *
+        ****************************
+        */
+
+       /* 1 Stream expanded + 3 */
+       WL_RATE_1X4_TXBF_OFDM_6       = 280,
+       WL_RATE_1X4_TXBF_OFDM_9       = 281,
+       WL_RATE_1X4_TXBF_OFDM_12      = 282,
+       WL_RATE_1X4_TXBF_OFDM_18      = 283,
+       WL_RATE_1X4_TXBF_OFDM_24      = 284,
+       WL_RATE_1X4_TXBF_OFDM_36      = 285,
+       WL_RATE_1X4_TXBF_OFDM_48      = 286,
+       WL_RATE_1X4_TXBF_OFDM_54      = 287,
+
+       WL_RATE_1X4_TXBF_MCS0         = 288,
+       WL_RATE_1X4_TXBF_MCS1         = 289,
+       WL_RATE_1X4_TXBF_MCS2         = 290,
+       WL_RATE_1X4_TXBF_MCS3         = 291,
+       WL_RATE_1X4_TXBF_MCS4         = 292,
+       WL_RATE_1X4_TXBF_MCS5         = 293,
+       WL_RATE_1X4_TXBF_MCS6         = 294,
+       WL_RATE_1X4_TXBF_MCS7         = 295,
+       WL_RATE_P_1X4_TXBF_MCS87      = 296,
+       WL_RATE_P_1X4_TXBF_MCS88      = 297,
+
+       WL_RATE_1X4_TXBF_VHT0SS1      = 288,
+       WL_RATE_1X4_TXBF_VHT1SS1      = 289,
+       WL_RATE_1X4_TXBF_VHT2SS1      = 290,
+       WL_RATE_1X4_TXBF_VHT3SS1      = 291,
+       WL_RATE_1X4_TXBF_VHT4SS1      = 292,
+       WL_RATE_1X4_TXBF_VHT5SS1      = 293,
+       WL_RATE_1X4_TXBF_VHT6SS1      = 294,
+       WL_RATE_1X4_TXBF_VHT7SS1      = 295,
+       WL_RATE_1X4_TXBF_VHT8SS1      = 296,
+       WL_RATE_1X4_TXBF_VHT9SS1      = 297,
+       WL_RATE_P_1X4_TXBF_VHT10SS1   = 298,
+       WL_RATE_P_1X4_TXBF_VHT11SS1   = 299,
+
+       /* 2 Streams expanded + 2 */
+       WL_RATE_2X4_TXBF_SDM_MCS8     = 300,
+       WL_RATE_2X4_TXBF_SDM_MCS9     = 301,
+       WL_RATE_2X4_TXBF_SDM_MCS10    = 302,
+       WL_RATE_2X4_TXBF_SDM_MCS11    = 303,
+       WL_RATE_2X4_TXBF_SDM_MCS12    = 304,
+       WL_RATE_2X4_TXBF_SDM_MCS13    = 305,
+       WL_RATE_2X4_TXBF_SDM_MCS14    = 306,
+       WL_RATE_2X4_TXBF_SDM_MCS15    = 307,
+       WL_RATE_P_2X4_TXBF_SDM_MCS99  = 308,
+       WL_RATE_P_2X4_TXBF_SDM_MCS100 = 309,
+
+       WL_RATE_2X4_TXBF_VHT0SS2      = 300,
+       WL_RATE_2X4_TXBF_VHT1SS2      = 301,
+       WL_RATE_2X4_TXBF_VHT2SS2      = 302,
+       WL_RATE_2X4_TXBF_VHT3SS2      = 303,
+       WL_RATE_2X4_TXBF_VHT4SS2      = 304,
+       WL_RATE_2X4_TXBF_VHT5SS2      = 305,
+       WL_RATE_2X4_TXBF_VHT6SS2      = 306,
+       WL_RATE_2X4_TXBF_VHT7SS2      = 307,
+       WL_RATE_2X4_TXBF_VHT8SS2      = 308,
+       WL_RATE_2X4_TXBF_VHT9SS2      = 309,
+       WL_RATE_P_2X4_TXBF_VHT10SS2   = 310,
+       WL_RATE_P_2X4_TXBF_VHT11SS2   = 311,
+
+       /* 3 Streams expanded + 1 */
+       WL_RATE_3X4_TXBF_SDM_MCS16    = 312,
+       WL_RATE_3X4_TXBF_SDM_MCS17    = 313,
+       WL_RATE_3X4_TXBF_SDM_MCS18    = 314,
+       WL_RATE_3X4_TXBF_SDM_MCS19    = 315,
+       WL_RATE_3X4_TXBF_SDM_MCS20    = 316,
+       WL_RATE_3X4_TXBF_SDM_MCS21    = 317,
+       WL_RATE_3X4_TXBF_SDM_MCS22    = 318,
+       WL_RATE_3X4_TXBF_SDM_MCS23    = 319,
+       WL_RATE_P_3X4_TXBF_SDM_MCS101 = 320,
+       WL_RATE_P_3X4_TXBF_SDM_MCS102 = 321,
+
+       WL_RATE_3X4_TXBF_VHT0SS3      = 312,
+       WL_RATE_3X4_TXBF_VHT1SS3      = 313,
+       WL_RATE_3X4_TXBF_VHT2SS3      = 314,
+       WL_RATE_3X4_TXBF_VHT3SS3      = 315,
+       WL_RATE_3X4_TXBF_VHT4SS3      = 316,
+       WL_RATE_3X4_TXBF_VHT5SS3      = 317,
+       WL_RATE_3X4_TXBF_VHT6SS3      = 318,
+       WL_RATE_3X4_TXBF_VHT7SS3      = 319,
+       WL_RATE_P_3X4_TXBF_VHT8SS3    = 320,
+       WL_RATE_P_3X4_TXBF_VHT9SS3    = 321,
+       WL_RATE_P_3X4_TXBF_VHT10SS3   = 322,
+       WL_RATE_P_3X4_TXBF_VHT11SS3   = 323,
+
+       /* 4 Streams */
+       WL_RATE_4X4_TXBF_SDM_MCS24    = 324,
+       WL_RATE_4X4_TXBF_SDM_MCS25    = 325,
+       WL_RATE_4X4_TXBF_SDM_MCS26    = 326,
+       WL_RATE_4X4_TXBF_SDM_MCS27    = 327,
+       WL_RATE_4X4_TXBF_SDM_MCS28    = 328,
+       WL_RATE_4X4_TXBF_SDM_MCS29    = 329,
+       WL_RATE_4X4_TXBF_SDM_MCS30    = 330,
+       WL_RATE_4X4_TXBF_SDM_MCS31    = 331,
+       WL_RATE_P_4X4_TXBF_SDM_MCS103 = 332,
+       WL_RATE_P_4X4_TXBF_SDM_MCS104 = 333,
+
+       WL_RATE_4X4_TXBF_VHT0SS4      = 324,
+       WL_RATE_4X4_TXBF_VHT1SS4      = 325,
+       WL_RATE_4X4_TXBF_VHT2SS4      = 326,
+       WL_RATE_4X4_TXBF_VHT3SS4      = 327,
+       WL_RATE_4X4_TXBF_VHT4SS4      = 328,
+       WL_RATE_4X4_TXBF_VHT5SS4      = 329,
+       WL_RATE_4X4_TXBF_VHT6SS4      = 330,
+       WL_RATE_4X4_TXBF_VHT7SS4      = 331,
+       WL_RATE_P_4X4_TXBF_VHT8SS4    = 332,
+       WL_RATE_P_4X4_TXBF_VHT9SS4    = 333,
+       WL_RATE_P_4X4_TXBF_VHT10SS4   = 334,
+       WL_RATE_P_4X4_TXBF_VHT11SS4   = 335
+
+} clm_rates_t;
+
+/* Number of rate codes */
+#define WL_NUMRATES 336
+
+#ifdef __cplusplus
+}
+#endif /* __cplusplus */
+
+#endif /* _bcmwifi_rates_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/bcmxtlv.c b/drivers/net/wireless/bcmdhd_1363/bcmxtlv.c
new file mode 100644 (file)
index 0000000..a9213b7
--- /dev/null
@@ -0,0 +1,457 @@
+/*
+ * Driver O/S-independent utility routines
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmxtlv.c 527361 2015-01-17 01:48:34Z $
+ */
+
+#include <bcm_cfg.h>
+
+#include <typedefs.h>
+#include <bcmdefs.h>
+
+#include <stdarg.h>
+
+#ifdef BCMDRIVER
+#include <osl.h>
+#else /* !BCMDRIVER */
+       #include <stdlib.h> /* AS!!! */
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#ifndef ASSERT
+#define ASSERT(exp)
+#endif
+INLINE void* MALLOCZ(void *o, size_t s) { BCM_REFERENCE(o); return calloc(1, s); }
+INLINE void MFREE(void *o, void *p, size_t s) { BCM_REFERENCE(o); BCM_REFERENCE(s); free(p); }
+#endif /* !BCMDRIVER */
+
+#include <bcmendian.h>
+#include <bcmutils.h>
+
+static INLINE int bcm_xtlv_size_for_data(int dlen, bcm_xtlv_opts_t opts)
+{
+       return ((opts & BCM_XTLV_OPTION_ALIGN32) ? ALIGN_SIZE(dlen + BCM_XTLV_HDR_SIZE, 4)
+               : (dlen + BCM_XTLV_HDR_SIZE));
+}
+
+bcm_xtlv_t *
+bcm_next_xtlv(bcm_xtlv_t *elt, int *buflen, bcm_xtlv_opts_t opts)
+{
+       int sz;
+       /* advance to next elt */
+       sz = BCM_XTLV_SIZE(elt, opts);
+       elt = (bcm_xtlv_t*)((uint8 *)elt + sz);
+       *buflen -= sz;
+
+       /* validate next elt */
+       if (!bcm_valid_xtlv(elt, *buflen, opts))
+               return NULL;
+
+       return elt;
+}
+
+int
+bcm_xtlv_buf_init(bcm_xtlvbuf_t *tlv_buf, uint8 *buf, uint16 len, bcm_xtlv_opts_t opts)
+{
+       if (!tlv_buf || !buf || !len)
+               return BCME_BADARG;
+
+       tlv_buf->opts = opts;
+       tlv_buf->size = len;
+       tlv_buf->head = buf;
+       tlv_buf->buf  = buf;
+       return BCME_OK;
+}
+
+uint16
+bcm_xtlv_buf_len(bcm_xtlvbuf_t *tbuf)
+{
+       if (tbuf == NULL) return 0;
+       return (uint16)(tbuf->buf - tbuf->head);
+}
+uint16
+bcm_xtlv_buf_rlen(bcm_xtlvbuf_t *tbuf)
+{
+       if (tbuf == NULL) return 0;
+       return tbuf->size - bcm_xtlv_buf_len(tbuf);
+}
+uint8 *
+bcm_xtlv_buf(bcm_xtlvbuf_t *tbuf)
+{
+       if (tbuf == NULL) return NULL;
+       return tbuf->buf;
+}
+uint8 *
+bcm_xtlv_head(bcm_xtlvbuf_t *tbuf)
+{
+       if (tbuf == NULL) return NULL;
+       return tbuf->head;
+}
+int
+bcm_xtlv_put_data(bcm_xtlvbuf_t *tbuf, uint16 type, const void *data, uint16 dlen)
+{
+       bcm_xtlv_t *xtlv;
+       int size;
+
+       if (tbuf == NULL)
+               return BCME_BADARG;
+       size = bcm_xtlv_size_for_data(dlen, tbuf->opts);
+       if (bcm_xtlv_buf_rlen(tbuf) < size)
+               return BCME_NOMEM;
+       xtlv = (bcm_xtlv_t *)bcm_xtlv_buf(tbuf);
+       xtlv->id = htol16(type);
+       xtlv->len = htol16(dlen);
+       memcpy(xtlv->data, data, dlen);
+       tbuf->buf += size;
+       return BCME_OK;
+}
+int
+bcm_xtlv_put_8(bcm_xtlvbuf_t *tbuf, uint16 type, const int8 data)
+{
+       bcm_xtlv_t *xtlv;
+       int size;
+
+       if (tbuf == NULL)
+               return BCME_BADARG;
+       size = bcm_xtlv_size_for_data(1, tbuf->opts);
+       if (bcm_xtlv_buf_rlen(tbuf) < size)
+               return BCME_NOMEM;
+       xtlv = (bcm_xtlv_t *)bcm_xtlv_buf(tbuf);
+       xtlv->id = htol16(type);
+       xtlv->len = htol16(sizeof(data));
+       xtlv->data[0] = data;
+       tbuf->buf += size;
+       return BCME_OK;
+}
+int
+bcm_xtlv_put_16(bcm_xtlvbuf_t *tbuf, uint16 type, const int16 data)
+{
+       bcm_xtlv_t *xtlv;
+       int size;
+
+       if (tbuf == NULL)
+               return BCME_BADARG;
+       size = bcm_xtlv_size_for_data(2, tbuf->opts);
+       if (bcm_xtlv_buf_rlen(tbuf) < size)
+               return BCME_NOMEM;
+
+       xtlv = (bcm_xtlv_t *)bcm_xtlv_buf(tbuf);
+       xtlv->id = htol16(type);
+       xtlv->len = htol16(sizeof(data));
+       htol16_ua_store(data, xtlv->data);
+       tbuf->buf += size;
+       return BCME_OK;
+}
+int
+bcm_xtlv_put_32(bcm_xtlvbuf_t *tbuf, uint16 type, const int32 data)
+{
+       bcm_xtlv_t *xtlv;
+       int size;
+
+       if (tbuf == NULL)
+               return BCME_BADARG;
+       size = bcm_xtlv_size_for_data(4, tbuf->opts);
+       if (bcm_xtlv_buf_rlen(tbuf) < size)
+               return BCME_NOMEM;
+       xtlv = (bcm_xtlv_t *)bcm_xtlv_buf(tbuf);
+       xtlv->id = htol16(type);
+       xtlv->len = htol16(sizeof(data));
+       htol32_ua_store(data, xtlv->data);
+       tbuf->buf += size;
+       return BCME_OK;
+}
+
+/*
+ *  upacks xtlv record from buf checks the type
+ *  copies data to callers buffer
+ *  advances tlv pointer to next record
+ *  caller's resposible for dst space check
+ */
+int
+bcm_unpack_xtlv_entry(uint8 **tlv_buf, uint16 xpct_type, uint16 xpct_len, void *dst,
+       bcm_xtlv_opts_t opts)
+{
+       bcm_xtlv_t *ptlv = (bcm_xtlv_t *)*tlv_buf;
+       uint16 len;
+       uint16 type;
+
+       ASSERT(ptlv);
+       /* tlv headr is always packed in LE order */
+       len = ltoh16(ptlv->len);
+       type = ltoh16(ptlv->id);
+       if      (len == 0) {
+               /* z-len tlv headers: allow, but don't process */
+               printf("z-len, skip unpack\n");
+       } else  {
+               if ((type != xpct_type) ||
+                       (len > xpct_len)) {
+                       printf("xtlv_unpack Error: found[type:%d,len:%d] != xpct[type:%d,len:%d]\n",
+                               type, len, xpct_type, xpct_len);
+                       return BCME_BADARG;
+               }
+               /* copy tlv record to caller's buffer */
+               memcpy(dst, ptlv->data, ptlv->len);
+       }
+       *tlv_buf += BCM_XTLV_SIZE(ptlv, opts);
+       return BCME_OK;
+}
+
+/*
+ *  packs user data into tlv record
+ *  advances tlv pointer to next xtlv slot
+ *  buflen is used for tlv_buf space check
+ */
+int
+bcm_pack_xtlv_entry(uint8 **tlv_buf, uint16 *buflen, uint16 type, uint16 len, void *src,
+       bcm_xtlv_opts_t opts)
+{
+       bcm_xtlv_t *ptlv = (bcm_xtlv_t *)*tlv_buf;
+       int size;
+
+       ASSERT(ptlv);
+       ASSERT(src);
+
+       size = bcm_xtlv_size_for_data(len, opts);
+
+       /* copy data from tlv buffer to dst provided by user */
+       if (size > *buflen) {
+               printf("bcm_pack_xtlv_entry: no space tlv_buf: requested:%d, available:%d\n",
+                       size, *buflen);
+               return BCME_BADLEN;
+       }
+       ptlv->id = htol16(type);
+       ptlv->len = htol16(len);
+
+       /* copy callers data */
+       memcpy(ptlv->data, src, len);
+
+       /* advance callers pointer to tlv buff */
+       *tlv_buf += size;
+       /* decrement the len */
+       *buflen -= (uint16)size;
+       return BCME_OK;
+}
+
+/*
+ *  unpack all xtlv records from the issue a callback
+ *  to set function one call per found tlv record
+ */
+int
+bcm_unpack_xtlv_buf(void *ctx, uint8 *tlv_buf, uint16 buflen, bcm_xtlv_opts_t opts,
+       bcm_xtlv_unpack_cbfn_t *cbfn)
+{
+       uint16 len;
+       uint16 type;
+       int res = BCME_OK;
+       int size;
+       bcm_xtlv_t *ptlv;
+       int sbuflen = buflen;
+
+       ASSERT(!buflen || tlv_buf);
+       ASSERT(!buflen || cbfn);
+
+       while (sbuflen >= (int)BCM_XTLV_HDR_SIZE) {
+               ptlv = (bcm_xtlv_t *)tlv_buf;
+
+               /* tlv header is always packed in LE order */
+               len = ltoh16(ptlv->len);
+               type = ltoh16(ptlv->id);
+
+               size = bcm_xtlv_size_for_data(len, opts);
+
+               sbuflen -= size;
+               /* check for possible buffer overrun */
+               if (sbuflen < 0)
+                       break;
+
+               if ((res = cbfn(ctx, ptlv->data, type, len)) != BCME_OK)
+                       break;
+               tlv_buf += size;
+       }
+       return res;
+}
+
+int
+bcm_pack_xtlv_buf(void *ctx, void *tlv_buf, uint16 buflen, bcm_xtlv_opts_t opts,
+       bcm_pack_xtlv_next_info_cbfn_t get_next, bcm_pack_xtlv_pack_next_cbfn_t pack_next,
+       int *outlen)
+{
+       int res = BCME_OK;
+       uint16 tlv_id;
+       uint16 tlv_len;
+       uint8 *startp;
+       uint8 *endp;
+       uint8 *buf;
+       bool more;
+       int size;
+
+       ASSERT(get_next && pack_next);
+
+       buf = (uint8 *)tlv_buf;
+       startp = buf;
+       endp = (uint8 *)buf + buflen;
+       more = TRUE;
+       while (more && (buf < endp)) {
+               more = get_next(ctx, &tlv_id, &tlv_len);
+               size = bcm_xtlv_size_for_data(tlv_len, opts);
+               if ((buf + size) >= endp) {
+                       res = BCME_BUFTOOSHORT;
+                       goto done;
+               }
+
+               htol16_ua_store(tlv_id, buf);
+               htol16_ua_store(tlv_len, buf + sizeof(tlv_id));
+               pack_next(ctx, tlv_id, tlv_len, buf + BCM_XTLV_HDR_SIZE);
+               buf += size;
+       }
+
+       if (more)
+               res = BCME_BUFTOOSHORT;
+
+done:
+       if (outlen) {
+               *outlen = (int)(buf - startp);
+       }
+       return res;
+}
+
+/*
+ *  pack xtlv buffer from memory according to xtlv_desc_t
+ */
+int
+bcm_pack_xtlv_buf_from_mem(void **tlv_buf, uint16 *buflen, xtlv_desc_t *items,
+       bcm_xtlv_opts_t opts)
+{
+       int res = BCME_OK;
+       uint8 *ptlv = (uint8 *)*tlv_buf;
+
+       while (items->type != 0) {
+               if ((res = bcm_pack_xtlv_entry(&ptlv,
+                       buflen, items->type,
+                       items->len, items->ptr, opts) != BCME_OK)) {
+                       break;
+               }
+               items++;
+       }
+       *tlv_buf = ptlv; /* update the external pointer */
+       return res;
+}
+
+/*
+ *  unpack xtlv buffer to memory according to xtlv_desc_t
+ *
+ */
+int
+bcm_unpack_xtlv_buf_to_mem(void *tlv_buf, int *buflen, xtlv_desc_t *items, bcm_xtlv_opts_t opts)
+{
+       int res = BCME_OK;
+       bcm_xtlv_t *elt;
+
+       elt =  bcm_valid_xtlv((bcm_xtlv_t *)tlv_buf, *buflen, opts) ? (bcm_xtlv_t *)tlv_buf : NULL;
+       if (!elt || !items) {
+               res = BCME_BADARG;
+               return res;
+       }
+
+       for (; elt != NULL && res == BCME_OK; elt = bcm_next_xtlv(elt, buflen, opts)) {
+               /*  find matches in desc_t items  */
+               xtlv_desc_t *dst_desc = items;
+               uint16 len = ltoh16(elt->len);
+
+               while (dst_desc->type != 0) {
+                       if (ltoh16(elt->id) == dst_desc->type) {
+                               if (len != dst_desc->len) {
+                                       res = BCME_BADLEN;
+                               } else {
+                                       memcpy(dst_desc->ptr, elt->data, len);
+                               }
+                               break;
+                       }
+                       dst_desc++;
+               }
+       }
+
+       if (res == BCME_OK && *buflen != 0)
+               res =  BCME_BUFTOOSHORT;
+
+       return res;
+}
+
+/*
+ * return data pointer of a given ID from xtlv buffer.
+ * If the specified xTLV ID is found, on return *data_len_out will contain
+ * the the data length of the xTLV ID.
+ */
+void *
+bcm_get_data_from_xtlv_buf(uint8 *tlv_buf, uint16 buflen, uint16 id,
+       uint16 *datalen_out, bcm_xtlv_opts_t opts)
+{
+       void *retptr = NULL;
+       uint16 type, len;
+       int size;
+       bcm_xtlv_t *ptlv;
+       int sbuflen = buflen;
+
+       while (sbuflen >= (int)BCM_XTLV_HDR_SIZE) {
+               ptlv = (bcm_xtlv_t *)tlv_buf;
+
+               /* tlv header is always packed in LE order */
+               type = ltoh16(ptlv->id);
+               len = ltoh16(ptlv->len);
+               size = bcm_xtlv_size_for_data(len, opts);
+
+               sbuflen -= size;
+               /* check for possible buffer overrun */
+               if (sbuflen < 0) {
+                       printf("%s %d: Invalid sbuflen %d\n",
+                               __FUNCTION__, __LINE__, sbuflen);
+                       break;
+               }
+
+               if (id == type) {
+                       retptr = ptlv->data;
+                       if (datalen_out) {
+                               *datalen_out = len;
+                       }
+                       break;
+               }
+               tlv_buf += size;
+       }
+
+       return retptr;
+}
+
+int bcm_xtlv_size(const bcm_xtlv_t *elt, bcm_xtlv_opts_t opts)
+{
+       int size; /* entire size of the XTLV including header, data, and optional padding */
+       int len; /* XTLV's value real length wthout padding */
+
+       len = BCM_XTLV_LEN(elt);
+
+       size = bcm_xtlv_size_for_data(len, opts);
+
+       return size;
+}
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd.h b/drivers/net/wireless/bcmdhd_1363/dhd.h
new file mode 100644 (file)
index 0000000..3fd7f26
--- /dev/null
@@ -0,0 +1,1786 @@
+/*
+ * Header file describing the internal (inter-module) DHD interfaces.
+ *
+ * Provides type definitions and function prototypes used to link the
+ * DHD OS, bus, and protocol modules.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd.h 665091 2017-05-19 06:11:53Z $
+ */
+
+/****************
+ * Common types *
+ */
+
+#ifndef _dhd_h_
+#define _dhd_h_
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/random.h>
+#include <linux/spinlock.h>
+#include <linux/ethtool.h>
+#include <asm/uaccess.h>
+#include <asm/unaligned.h>
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined(CONFIG_HAS_WAKELOCK)
+#include <linux/wakelock.h>
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined (CONFIG_HAS_WAKELOCK) */
+#include <dhd_buzzz.h>
+/* The kernel threading is sdio-specific */
+struct task_struct;
+struct sched_param;
+int setScheduler(struct task_struct *p, int policy, struct sched_param *param);
+int get_scheduler_policy(struct task_struct *p);
+#define MAX_EVENT      16
+
+#define ALL_INTERFACES 0xff
+
+#include <wlioctl.h>
+#include <wlfc_proto.h>
+
+#if defined(BCMWDF)
+#include <wdf.h>
+#include <WdfMiniport.h>
+#endif /* (BCMWDF)  */
+
+#ifdef DEBUG_DPC_THREAD_WATCHDOG
+#define MAX_RESCHED_CNT 600
+#endif /* DEBUG_DPC_THREAD_WATCHDOG */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0) && LINUX_VERSION_CODE < \
+       KERNEL_VERSION(3, 18, 0) || defined(CONFIG_BCMDHD_VENDOR_EXT))
+#define WL_VENDOR_EXT_SUPPORT
+#endif /* 3.13.0 <= LINUX_KERNEL_VERSION < 3.18.0 || CONFIG_BCMDHD_VENDOR_EXT */
+
+
+#if defined(KEEP_ALIVE)
+/* Default KEEP_ALIVE Period is 55 sec to prevent AP from sending Keep Alive probe frame */
+#define KEEP_ALIVE_PERIOD 55000
+#define NULL_PKT_STR   "null_pkt"
+#endif /* KEEP_ALIVE */
+
+/* Forward decls */
+struct dhd_bus;
+struct dhd_prot;
+struct dhd_info;
+struct dhd_ioctl;
+
+/* The level of bus communication with the dongle */
+enum dhd_bus_state {
+       DHD_BUS_DOWN,           /* Not ready for frame transfers */
+       DHD_BUS_LOAD,           /* Download access only (CPU reset) */
+       DHD_BUS_DATA,           /* Ready for frame transfers */
+       DHD_BUS_SUSPEND,        /* Bus has been suspended */
+       DHD_BUS_DOWN_IN_PROGRESS,       /* Bus going Down */
+};
+
+/*
+ * Bit fields to Indicate clean up process that wait till they are finished.
+ * Future synchronizable processes can add their bit filed below and update
+ * their functionalities accordingly
+ */
+#define DHD_BUS_BUSY_IN_TX                   0x01
+#define DHD_BUS_BUSY_IN_SEND_PKT             0x02
+#define DHD_BUS_BUSY_IN_DPC                  0x04
+#define DHD_BUS_BUSY_IN_WD                   0x08
+#define DHD_BUS_BUSY_IN_IOVAR                0x10
+#define DHD_BUS_BUSY_IN_DHD_IOVAR            0x20
+#define DHD_BUS_BUSY_IN_SUSPEND              0x40
+#define DHD_BUS_BUSY_IN_RESUME               0x80
+#define DHD_BUS_BUSY_RPM_SUSPEND_IN_PROGRESS 0x100
+#define DHD_BUS_BUSY_RPM_SUSPEND_DONE        0x200
+#define DHD_BUS_BUSY_RPM_RESUME_IN_PROGRESS  0x400
+#define DHD_BUS_BUSY_RPM_ALL                 (DHD_BUS_BUSY_RPM_SUSPEND_DONE | \
+               DHD_BUS_BUSY_RPM_SUSPEND_IN_PROGRESS | \
+               DHD_BUS_BUSY_RPM_RESUME_IN_PROGRESS)
+
+/* Download Types */
+typedef enum download_type {
+       FW,
+       NVRAM,
+       CLM_BLOB,
+       CLMINFO
+} download_type_t;
+
+
+/* For supporting multiple interfaces */
+#define DHD_MAX_IFS    16
+#define DHD_DEL_IF     -0xE
+#define DHD_BAD_IF     -0xF
+
+enum dhd_op_flags {
+/* Firmware requested operation mode */
+       DHD_FLAG_STA_MODE                               = (1 << (0)), /* STA only */
+       DHD_FLAG_HOSTAP_MODE                            = (1 << (1)), /* SOFTAP only */
+       DHD_FLAG_P2P_MODE                               = (1 << (2)), /* P2P Only */
+       /* STA + P2P */
+       DHD_FLAG_CONCURR_SINGLE_CHAN_MODE = (DHD_FLAG_STA_MODE | DHD_FLAG_P2P_MODE),
+       /* STA + SoftAP */
+       DHD_FLAG_CONCURR_STA_HOSTAP_MODE = (DHD_FLAG_STA_MODE | DHD_FLAG_HOSTAP_MODE),
+       DHD_FLAG_CONCURR_MULTI_CHAN_MODE                = (1 << (4)), /* STA + P2P */
+       /* Current P2P mode for P2P connection */
+       DHD_FLAG_P2P_GC_MODE                            = (1 << (5)),
+       DHD_FLAG_P2P_GO_MODE                            = (1 << (6)),
+       DHD_FLAG_MBSS_MODE                              = (1 << (7)), /* MBSS in future */
+       DHD_FLAG_IBSS_MODE                              = (1 << (8)),
+       DHD_FLAG_MFG_MODE                               = (1 << (9)),
+       DHD_FLAG_RSDB_MODE                              = (1 << (10)),
+       DHD_FLAG_MP2P_MODE                              = (1 << (11))
+};
+
+#define DHD_OPMODE_SUPPORTED(dhd, opmode_flag) \
+       (dhd ? ((((dhd_pub_t *)dhd)->op_mode)  &  opmode_flag) : -1)
+
+/* Max sequential TX/RX Control timeouts to set HANG event */
+#ifndef MAX_CNTL_TX_TIMEOUT
+#define MAX_CNTL_TX_TIMEOUT 2
+#endif /* MAX_CNTL_TX_TIMEOUT */
+#ifndef MAX_CNTL_RX_TIMEOUT
+#define MAX_CNTL_RX_TIMEOUT 1
+#endif /* MAX_CNTL_RX_TIMEOUT */
+
+#define DHD_SCAN_ASSOC_ACTIVE_TIME     40 /* ms: Embedded default Active setting from DHD */
+#define DHD_SCAN_UNASSOC_ACTIVE_TIME 80 /* ms: Embedded def. Unassoc Active setting from DHD */
+#define DHD_SCAN_PASSIVE_TIME          130 /* ms: Embedded default Passive setting from DHD */
+#define DHD_SCAN_HOME_TIME             45 /* ms: Embedded default Home time setting from DHD */
+#define DHD_SCAN_HOME_AWAY_TIME        100 /* ms: Embedded default Home Away time setting from DHD */
+
+#ifndef POWERUP_MAX_RETRY
+#define POWERUP_MAX_RETRY      3 /* how many times we retry to power up the chip */
+#endif
+#ifndef POWERUP_WAIT_MS
+#define POWERUP_WAIT_MS                2000 /* ms: time out in waiting wifi to come up */
+#endif
+#define MAX_NVRAMBUF_SIZE      (16 * 1024) /* max nvram buf size */
+#define MAX_CLM_BUF_SIZE       (32 * 1024) /* max clm blob size */
+#define MAX_CLMINFO_BUF_SIZE   (4 * 1024) /* max clminfo buf size */
+#ifdef DHD_DEBUG
+#define DHD_JOIN_MAX_TIME_DEFAULT 10000 /* ms: Max time out for joining AP */
+#define DHD_SCAN_DEF_TIMEOUT 10000 /* ms: Max time out for scan in progress */
+#endif
+
+#ifndef CONFIG_BCMDHD_CLM_PATH
+#define CONFIG_BCMDHD_CLM_PATH "/system/etc/wifi/bcmdhd_clm.blob"
+#endif /* CONFIG_BCMDHD_CLM_PATH */
+#define WL_CCODE_NULL_COUNTRY  "#n"
+
+#define FW_VER_STR_LEN 128
+#define CLM_VER_STR_LEN        128
+
+enum dhd_bus_wake_state {
+       WAKE_LOCK_OFF,
+       WAKE_LOCK_PRIV,
+       WAKE_LOCK_DPC,
+       WAKE_LOCK_IOCTL,
+       WAKE_LOCK_DOWNLOAD,
+       WAKE_LOCK_TMOUT,
+       WAKE_LOCK_WATCHDOG,
+       WAKE_LOCK_LINK_DOWN_TMOUT,
+       WAKE_LOCK_PNO_FIND_TMOUT,
+       WAKE_LOCK_SOFTAP_SET,
+       WAKE_LOCK_SOFTAP_STOP,
+       WAKE_LOCK_SOFTAP_START,
+       WAKE_LOCK_SOFTAP_THREAD
+};
+
+enum dhd_prealloc_index {
+       DHD_PREALLOC_PROT = 0,
+       DHD_PREALLOC_RXBUF,
+       DHD_PREALLOC_DATABUF,
+       DHD_PREALLOC_OSL_BUF,
+#if defined(STATIC_WL_PRIV_STRUCT)
+       DHD_PREALLOC_WIPHY_ESCAN0 = 5,
+#endif /* STATIC_WL_PRIV_STRUCT */
+       DHD_PREALLOC_DHD_INFO = 7,
+       DHD_PREALLOC_DHD_WLFC_INFO = 8,
+       DHD_PREALLOC_IF_FLOW_LKUP = 9,
+       DHD_PREALLOC_MEMDUMP_BUF = 10,
+       DHD_PREALLOC_MEMDUMP_RAM = 11,
+       DHD_PREALLOC_DHD_WLFC_HANGER = 12,
+       DHD_PREALLOC_PKTID_MAP = 13,
+       DHD_PREALLOC_PKTID_MAP_IOCTL = 14,
+       DHD_PREALLOC_DHD_LOG_DUMP_BUF = 15
+};
+
+enum dhd_dongledump_mode {
+       DUMP_DISABLED = 0,
+       DUMP_MEMONLY,
+       DUMP_MEMFILE,
+       DUMP_MEMFILE_BUGON,
+       DUMP_MEMFILE_MAX
+};
+
+enum dhd_dongledump_type {
+       DUMP_TYPE_RESUMED_ON_TIMEOUT = 1,
+       DUMP_TYPE_D3_ACK_TIMEOUT,
+       DUMP_TYPE_DONGLE_TRAP,
+       DUMP_TYPE_MEMORY_CORRUPTION,
+       DUMP_TYPE_PKTID_AUDIT_FAILURE,
+       DUMP_TYPE_SCAN_TIMEOUT,
+       DUMP_TYPE_SCAN_BUSY,
+       DUMP_TYPE_BY_SYSDUMP,
+       DUMP_TYPE_BY_LIVELOCK,
+       DUMP_TYPE_AP_LINKUP_FAILURE,
+       DUMP_TYPE_AP_ABNORMAL_ACCESS
+};
+
+enum dhd_hang_reason {
+       HANG_REASON_MASK = 0x8000,
+       HANG_REASON_IOCTL_RESP_TIMEOUT = 0x8001,
+       HANG_REASON_DONGLE_TRAP = 0x8002,
+       HANG_REASON_D3_ACK_TIMEOUT = 0x8003,
+       HANG_REASON_BUS_DOWN = 0x8004,
+       HANG_REASON_PCIE_LINK_DOWN = 0x8005,
+       HANG_REASON_MSGBUF_LIVELOCK = 0x8006,
+       HANG_REASON_P2P_IFACE_DEL_FAILURE = 0x8007,
+       HANG_REASON_HT_AVAIL_ERROR = 0x8008,
+       HANG_REASON_PCIE_RC_LINK_UP_FAIL = 0x8009,
+       HANG_REASON_INVALID_EVENT_OR_DATA = 0x800a,
+       HANG_REASON_MAX = 0x800b
+};
+
+enum dhd_rsdb_scan_features {
+       /* Downgraded scan feature for AP active */
+       RSDB_SCAN_DOWNGRADED_AP_SCAN = 0x01,
+       /* Downgraded scan feature for P2P Discovery */
+       RSDB_SCAN_DOWNGRADED_P2P_DISC_SCAN = 0x02,
+       /* Enable channel pruning for ROAM SCAN */
+       RSDB_SCAN_DOWNGRADED_CH_PRUNE_ROAM = 0x10,
+       /* Enable channel pruning for any SCAN */
+       RSDB_SCAN_DOWNGRADED_CH_PRUNE_ALL  = 0x20
+};
+
+/* Packet alignment for most efficient SDIO (can change based on platform) */
+#ifndef DHD_SDALIGN
+#define DHD_SDALIGN    32
+#endif
+#define MEMBLOCK 2048
+/**
+ * DMA-able buffer parameters
+ * - dmaaddr_t is 32bits on a 32bit host.
+ *   dhd_dma_buf::pa may not be used as a sh_addr_t, bcm_addr64_t or uintptr
+ * - dhd_dma_buf::_alloced is ONLY for freeing a DMA-able buffer.
+ */
+typedef struct dhd_dma_buf {
+       void      *va;      /* virtual address of buffer */
+       uint32    len;      /* user requested buffer length */
+       dmaaddr_t pa;       /* physical address of buffer */
+       void      *dmah;    /* dma mapper handle */
+       void      *secdma;  /* secure dma sec_cma_info handle */
+       uint32    _alloced; /* actual size of buffer allocated with align and pad */
+} dhd_dma_buf_t;
+
+/* host reordering packts logic */
+/* followed the structure to hold the reorder buffers (void **p) */
+typedef struct reorder_info {
+       void **p;
+       uint8 flow_id;
+       uint8 cur_idx;
+       uint8 exp_idx;
+       uint8 max_idx;
+       uint8 pend_pkts;
+} reorder_info_t;
+
+#if defined(OOB_PARAM)
+#if !defined(OOB_INTR_ONLY)
+#error OOB_PARAM must be defined with OOB_INTR_ONLY!!
+#endif /* !defined(OOB_INTR_ONLY) */
+
+#define OOB_PARAM_IF(x)                if (x)
+#define OOB_PARAM_ELSE()       else
+
+#else  /* defined(OOB_PARAM) */
+
+#define OOB_PARAM_IF(x)
+#define OOB_PARAM_ELSE()
+#endif /* defined(OOB_PARAM) */
+
+#ifdef DHDTCPACK_SUPPRESS
+
+enum {
+       /* TCPACK suppress off */
+       TCPACK_SUP_OFF,
+       /* Replace TCPACK in txq when new coming one has higher ACK number. */
+       TCPACK_SUP_REPLACE,
+       /* TCPACK_SUP_REPLACE + delayed TCPACK TX unless ACK to PSH DATA.
+        * This will give benefits to Half-Duplex bus interface(e.g. SDIO) that
+        * 1. we are able to read TCP DATA packets first from the bus
+        * 2. TCPACKs that don't need to hurry delivered remains longer in TXQ so can be suppressed.
+        */
+       TCPACK_SUP_DELAYTX,
+       TCPACK_SUP_HOLD,
+       TCPACK_SUP_LAST_MODE
+};
+#endif /* DHDTCPACK_SUPPRESS */
+
+
+/*
+ * Accumulating the queue lengths of all flowring queues in a parent object,
+ * to assert flow control, when the cummulative queue length crosses an upper
+ * threshold defined on a parent object. Upper threshold may be maintained
+ * at a station level, at an interface level, or at a dhd instance.
+ *
+ * cumm_ctr_t abstraction:
+ * cumm_ctr_t abstraction may be enhanced to use an object with a hysterisis
+ * pause on/off threshold callback.
+ * All macros use the address of the cummulative length in the parent objects.
+ *
+ * BCM_GMAC3 builds use a single perimeter lock, as opposed to a per queue lock.
+ * Cummulative counters in parent objects may be updated without spinlocks.
+ *
+ * In non BCM_GMAC3, if a cummulative queue length is desired across all flows
+ * belonging to either of (a station, or an interface or a dhd instance), then
+ * an atomic operation is required using an atomic_t cummulative counters or
+ * using a spinlock. BCM_ROUTER_DHD uses the Linux atomic_t construct.
+ */
+
+/* Cummulative length not supported. */
+typedef uint32 cumm_ctr_t;
+#define DHD_CUMM_CTR_PTR(clen)     ((cumm_ctr_t*)(clen))
+#define DHD_CUMM_CTR(clen)         *(DHD_CUMM_CTR_PTR(clen)) /* accessor */
+#define DHD_CUMM_CTR_READ(clen)    DHD_CUMM_CTR(clen) /* read access */
+#define DHD_CUMM_CTR_INIT(clen)                                                \
+       ASSERT(DHD_CUMM_CTR_PTR(clen) != DHD_CUMM_CTR_PTR(NULL));
+#define DHD_CUMM_CTR_INCR(clen)                                                \
+       ASSERT(DHD_CUMM_CTR_PTR(clen) != DHD_CUMM_CTR_PTR(NULL));
+#define DHD_CUMM_CTR_DECR(clen)                                                \
+       ASSERT(DHD_CUMM_CTR_PTR(clen) != DHD_CUMM_CTR_PTR(NULL));
+
+/* DMA'ing r/w indices for rings supported */
+#ifdef BCM_INDX_TCM /* FW gets r/w indices in TCM */
+#define DMA_INDX_ENAB(dma_indxsup)     0
+#elif defined BCM_INDX_DMA  /* FW gets r/w indices from Host memory */
+#define DMA_INDX_ENAB(dma_indxsup)     1
+#else  /* r/w indices in TCM or host memory based on FW/Host agreement */
+#define DMA_INDX_ENAB(dma_indxsup)     dma_indxsup
+#endif /* BCM_INDX_TCM */
+
+#if defined(WLTDLS) && defined(PCIE_FULL_DONGLE)
+struct tdls_peer_node {
+       uint8 addr[ETHER_ADDR_LEN];
+       struct tdls_peer_node *next;
+};
+typedef struct tdls_peer_node tdls_peer_node_t;
+typedef struct {
+       tdls_peer_node_t *node;
+       uint8 tdls_peer_count;
+} tdls_peer_tbl_t;
+#endif /* defined(WLTDLS) && defined(PCIE_FULL_DONGLE) */
+
+#ifdef DHD_LOG_DUMP
+/* below structure describe ring buffer. */
+struct dhd_log_dump_buf
+{
+       spinlock_t lock;
+       unsigned int wraparound;
+       unsigned long max;
+       unsigned int remain;
+       char* present;
+       char* front;
+       char* buffer;
+};
+
+#define DHD_LOG_DUMP_BUFFER_SIZE       (1024 * 1024)
+#define DHD_LOG_DUMP_MAX_TEMP_BUFFER_SIZE 256
+
+extern void dhd_log_dump_print(const char *fmt, ...);
+extern char *dhd_log_dump_get_timestamp(void);
+#endif /* DHD_LOG_DUMP */
+#define DHD_COMMON_DUMP_PATH   "/data/misc/wifi/log/"
+
+/* Common structure for module and instance linkage */
+typedef struct dhd_pub {
+       /* Linkage ponters */
+       osl_t *osh;             /* OSL handle */
+       struct dhd_bus *bus;    /* Bus module handle */
+       struct dhd_prot *prot;  /* Protocol module handle */
+       struct dhd_info  *info; /* Info module handle */
+
+       /* to NDIS developer, the structure dhd_common is redundant,
+        * please do NOT merge it back from other branches !!!
+        */
+
+
+       /* Internal dhd items */
+       bool up;                /* Driver up/down (to OS) */
+       bool txoff;             /* Transmit flow-controlled */
+       bool dongle_reset;  /* TRUE = DEVRESET put dongle into reset */
+       enum dhd_bus_state busstate;
+       uint dhd_bus_busy_state;        /* Bus busy state */
+       uint hdrlen;            /* Total DHD header length (proto + bus) */
+       uint maxctl;            /* Max size rxctl request from proto to bus */
+       uint rxsz;              /* Rx buffer size bus module should use */
+       uint8 wme_dp;   /* wme discard priority */
+
+       /* Dongle media info */
+       bool iswl;              /* Dongle-resident driver is wl */
+       ulong drv_version;      /* Version of dongle-resident driver */
+       struct ether_addr mac;  /* MAC address obtained from dongle */
+       dngl_stats_t dstats;    /* Stats for dongle-based data */
+
+       /* Additional stats for the bus level */
+       ulong tx_packets;       /* Data packets sent to dongle */
+       ulong tx_dropped;       /* Data packets dropped in dhd */
+       ulong tx_multicast;     /* Multicast data packets sent to dongle */
+       ulong tx_errors;        /* Errors in sending data to dongle */
+       ulong tx_ctlpkts;       /* Control packets sent to dongle */
+       ulong tx_ctlerrs;       /* Errors sending control frames to dongle */
+       ulong rx_packets;       /* Packets sent up the network interface */
+       ulong rx_multicast;     /* Multicast packets sent up the network interface */
+       ulong rx_errors;        /* Errors processing rx data packets */
+       ulong rx_ctlpkts;       /* Control frames processed from dongle */
+       ulong rx_ctlerrs;       /* Errors in processing rx control frames */
+       ulong rx_dropped;       /* Packets dropped locally (no memory) */
+       ulong rx_flushed;  /* Packets flushed due to unscheduled sendup thread */
+       ulong wd_dpc_sched;   /* Number of times dhd dpc scheduled by watchdog timer */
+       ulong rx_pktgetfail; /* Number of PKTGET failures in DHD on RX */
+       ulong tx_pktgetfail; /* Number of PKTGET failures in DHD on TX */
+       ulong rx_readahead_cnt; /* Number of packets where header read-ahead was used. */
+       ulong tx_realloc;       /* Number of tx packets we had to realloc for headroom */
+       ulong fc_packets;       /* Number of flow control pkts recvd */
+
+       /* Last error return */
+       int bcmerror;
+       uint tickcnt;
+
+       /* Last error from dongle */
+       int dongle_error;
+
+       uint8 country_code[WLC_CNTRY_BUF_SZ];
+
+       /* Suspend disable flag and "in suspend" flag */
+       int suspend_disable_flag; /* "1" to disable all extra powersaving during suspend */
+       int in_suspend;                 /* flag set to 1 when early suspend called */
+#ifdef PNO_SUPPORT
+       int pno_enable;                 /* pno status : "1" is pno enable */
+       int pno_suspend;                /* pno suspend status : "1" is pno suspended */
+#endif /* PNO_SUPPORT */
+       /* DTIM skip value, default 0(or 1) means wake each DTIM
+        * 3 means skip 2 DTIMs and wake up 3rd DTIM(9th beacon when AP DTIM is 3)
+        */
+       int suspend_bcn_li_dtim;         /* bcn_li_dtim value in suspend mode */
+#ifdef PKT_FILTER_SUPPORT
+       int early_suspended;    /* Early suspend status */
+       int dhcp_in_progress;   /* DHCP period */
+#endif
+
+       /* Pkt filter defination */
+       char * pktfilter[100];
+       int pktfilter_count;
+
+       wl_country_t dhd_cspec;         /* Current Locale info */
+#ifdef CUSTOM_COUNTRY_CODE
+       u32 dhd_cflags;
+#endif /* CUSTOM_COUNTRY_CODE */
+       bool force_country_change;
+       char eventmask[WL_EVENTING_MASK_LEN];
+       int     op_mode;                                /* STA, HostAPD, WFD, SoftAP */
+
+/* Set this to 1 to use a seperate interface (p2p0) for p2p operations.
+ *  For ICS MR1 releases it should be disable to be compatable with ICS MR1 Framework
+ *  see target dhd-cdc-sdmmc-panda-cfg80211-icsmr1-gpl-debug in Makefile
+ */
+/* #define WL_ENABLE_P2P_IF            1 */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+       struct mutex    wl_start_stop_lock; /* lock/unlock for Android start/stop */
+       struct mutex    wl_softap_lock;          /* lock/unlock for any SoftAP/STA settings */
+#endif 
+
+#ifdef PROP_TXSTATUS
+       bool    wlfc_enabled;
+       int     wlfc_mode;
+       void*   wlfc_state;
+       /*
+       Mode in which the dhd flow control shall operate. Must be set before
+       traffic starts to the device.
+       0 - Do not do any proptxtstatus flow control
+       1 - Use implied credit from a packet status
+       2 - Use explicit credit
+       3 - Only AMPDU hostreorder used. no wlfc.
+       */
+       uint8   proptxstatus_mode;
+       bool    proptxstatus_txoff;
+       bool    proptxstatus_module_ignore;
+       bool    proptxstatus_credit_ignore;
+       bool    proptxstatus_txstatus_ignore;
+
+       bool    wlfc_rxpkt_chk;
+       /*
+        * implement below functions in each platform if needed.
+        */
+       /* platform specific function whether to skip flow control */
+       bool (*skip_fc)(void *dhd);
+       /* platform specific function for wlfc_enable and wlfc_deinit */
+       void (*plat_init)(void *dhd);
+       void (*plat_deinit)(void *dhd);
+#ifdef DHD_WLFC_THREAD
+       bool                wlfc_thread_go;
+       struct task_struct* wlfc_thread;
+       wait_queue_head_t   wlfc_wqhead;
+#endif /* DHD_WLFC_THREAD */
+#endif /* PROP_TXSTATUS */
+#ifdef PNO_SUPPORT
+       void *pno_state;
+#endif
+#ifdef RTT_SUPPORT
+       void *rtt_state;
+#endif
+       bool    dongle_isolation;
+       bool    dongle_trap_occured;    /* flag for sending HANG event to upper layer */
+       bool    iovar_timeout_occured;  /* flag to indicate iovar resumed on timeout */
+#ifdef PCIE_FULL_DONGLE
+       bool    d3ack_timeout_occured;  /* flag to indicate d3ack resumed on timeout */
+#endif /* PCIE_FULL_DONGLE */
+       int   hang_was_sent;
+       int   rxcnt_timeout;            /* counter rxcnt timeout to send HANG */
+       int   txcnt_timeout;            /* counter txcnt timeout to send HANG */
+#ifdef BCMPCIE
+       int   d3ackcnt_timeout;         /* counter d3ack timeout to send HANG */
+#endif /* BCMPCIE */
+       bool hang_report;               /* enable hang report by default */
+       uint16 hang_reason;             /* reason codes for HANG event */
+#ifdef WLMEDIA_HTSF
+       uint8 htsfdlystat_sz; /* Size of delay stats, max 255B */
+#endif
+#ifdef WLTDLS
+       bool tdls_enable;
+#endif
+       struct reorder_info *reorder_bufs[WLHOST_REORDERDATA_MAXFLOWS];
+       #define WLC_IOCTL_MAXBUF_FWCAP  512
+       char  fw_capabilities[WLC_IOCTL_MAXBUF_FWCAP];
+       #define MAXSKBPEND 1024
+       void *skbbuf[MAXSKBPEND];
+       uint32 store_idx;
+       uint32 sent_idx;
+#ifdef DHDTCPACK_SUPPRESS
+       uint8 tcpack_sup_mode;          /* TCPACK suppress mode */
+       void *tcpack_sup_module;        /* TCPACK suppress module */
+       uint32 tcpack_sup_ratio;
+       uint32 tcpack_sup_delay;
+#endif /* DHDTCPACK_SUPPRESS */
+#if defined(ARP_OFFLOAD_SUPPORT)
+       uint32 arp_version;
+#endif
+#ifdef DEBUG_DPC_THREAD_WATCHDOG
+       bool dhd_bug_on;
+#endif /* DEBUG_DPC_THREAD_WATCHDOG */
+#ifdef CUSTOM_SET_CPUCORE
+       struct task_struct * current_dpc;
+       struct task_struct * current_rxf;
+       int chan_isvht80;
+#endif /* CUSTOM_SET_CPUCORE */
+
+
+       void    *sta_pool;          /* pre-allocated pool of sta objects */
+       void    *staid_allocator;   /* allocator of sta indexes */
+#ifdef PCIE_FULL_DONGLE
+       bool    flow_rings_inited;      /* set this flag after initializing flow rings */
+#endif /* PCIE_FULL_DONGLE */
+       void    *flowid_allocator;  /* unique flowid allocator */
+       void    *flow_ring_table;   /* flow ring table, include prot and bus info */
+       void    *if_flow_lkup;      /* per interface flowid lkup hash table */
+       void    *flowid_lock;       /* per os lock for flowid info protection */
+       void    *flowring_list_lock;       /* per os lock for flowring list protection */
+       uint32  num_flow_rings;
+       cumm_ctr_t cumm_ctr;        /* cumm queue length placeholder  */
+       uint32 d2h_sync_mode;       /* D2H DMA completion sync mode */
+       uint8  flow_prio_map[NUMPRIO];
+       uint8   flow_prio_map_type;
+       char enable_log[MAX_EVENT];
+       bool dma_d2h_ring_upd_support;
+       bool dma_h2d_ring_upd_support;
+
+#ifdef DHD_WMF
+       bool wmf_ucast_igmp;
+#ifdef DHD_IGMP_UCQUERY
+       bool wmf_ucast_igmp_query;
+#endif
+#ifdef DHD_UCAST_UPNP
+       bool wmf_ucast_upnp;
+#endif
+#endif /* DHD_WMF */
+#ifdef DHD_L2_FILTER
+       unsigned long l2_filter_cnt;    /* for L2_FILTER ARP table timeout */
+#endif /* DHD_L2_FILTER */
+       uint8 *soc_ram;
+       uint32 soc_ram_length;
+       uint32 memdump_type;
+#ifdef DHD_FW_COREDUMP
+       uint32 memdump_enabled;
+       bool memdump_success;
+#endif /* DHD_FW_COREDUMP */
+#ifdef PCIE_FULL_DONGLE
+#ifdef WLTDLS
+       tdls_peer_tbl_t peer_tbl;
+#endif /* WLTDLS */
+#endif /* PCIE_FULL_DONGLE */
+#ifdef CACHE_FW_IMAGES
+       char    *cached_fw;
+       int     cached_fw_length;
+       char    *cached_nvram;
+       int     cached_nvram_length;
+#endif
+#ifdef WLTDLS
+       uint32 tdls_mode;
+#endif
+#ifdef DHD_LOSSLESS_ROAMING
+       uint8 dequeue_prec_map;
+       uint8 prio_8021x;
+#endif
+       struct mutex wl_up_lock;
+       bool is_fw_download_done;
+#ifdef DHD_LOG_DUMP
+       struct dhd_log_dump_buf dld_buf;
+       unsigned int dld_enable;
+#endif /* DHD_LOG_DUMP */
+       bool max_dtim_enable;         /* use MAX bcn_li_dtim value in suspend mode */
+#ifdef WL_CFG80211
+       /* dual-pcie chip support
+        * reference to private data of cfg80211 structure
+        */
+       void *cfg80211_priv;
+#endif /* WL_CFG80211 */
+
+#ifdef OOB_PARAM
+       uint    oob_disable;
+#endif /* OOB_PARAM */
+} dhd_pub_t;
+
+#ifdef WL_CFG80211
+#define DHD_GET_CFG80211_PRIV(dhdp) ((dhdp)->cfg80211_priv)
+#endif /* WL_CFG80211 */
+
+#if defined(PCIE_FULL_DONGLE)
+
+/* Packet Tag for PCIE Full Dongle DHD */
+typedef struct dhd_pkttag_fd {
+       uint16    flowid;   /* Flowring Id */
+       uint16    dataoff;  /* start of packet */
+       uint16    dma_len;  /* pkt len for DMA_MAP/UNMAP */
+       dmaaddr_t pa;       /* physical address */
+       void      *dmah;    /* dma mapper handle */
+       void      *secdma; /* secure dma sec_cma_info handle */
+} dhd_pkttag_fd_t;
+
+/* Packet Tag for DHD PCIE Full Dongle */
+#define DHD_PKTTAG_FD(pkt)          ((dhd_pkttag_fd_t *)(PKTTAG(pkt)))
+
+#define DHD_PKT_GET_FLOWID(pkt)     ((DHD_PKTTAG_FD(pkt))->flowid)
+#define DHD_PKT_SET_FLOWID(pkt, pkt_flowid) \
+       DHD_PKTTAG_FD(pkt)->flowid = (uint16)(pkt_flowid)
+
+#define DHD_PKT_GET_DATAOFF(pkt)    ((DHD_PKTTAG_FD(pkt))->dataoff)
+#define DHD_PKT_SET_DATAOFF(pkt, pkt_dataoff) \
+       DHD_PKTTAG_FD(pkt)->dataoff = (uint16)(pkt_dataoff)
+
+#define DHD_PKT_GET_DMA_LEN(pkt)    ((DHD_PKTTAG_FD(pkt))->dma_len)
+#define DHD_PKT_SET_DMA_LEN(pkt, pkt_dma_len) \
+       DHD_PKTTAG_FD(pkt)->dma_len = (uint16)(pkt_dma_len)
+
+#define DHD_PKT_GET_PA(pkt)         ((DHD_PKTTAG_FD(pkt))->pa)
+#define DHD_PKT_SET_PA(pkt, pkt_pa) \
+       DHD_PKTTAG_FD(pkt)->pa = (dmaaddr_t)(pkt_pa)
+
+#define DHD_PKT_GET_DMAH(pkt)       ((DHD_PKTTAG_FD(pkt))->dmah)
+#define DHD_PKT_SET_DMAH(pkt, pkt_dmah) \
+       DHD_PKTTAG_FD(pkt)->dmah = (void *)(pkt_dmah)
+
+#define DHD_PKT_GET_SECDMA(pkt)    ((DHD_PKTTAG_FD(pkt))->secdma)
+#define DHD_PKT_SET_SECDMA(pkt, pkt_secdma) \
+       DHD_PKTTAG_FD(pkt)->secdma = (void *)(pkt_secdma)
+#endif /* PCIE_FULL_DONGLE */
+
+#if defined(BCMWDF)
+typedef struct {
+       dhd_pub_t *dhd_pub;
+} dhd_workitem_context_t;
+
+WDF_DECLARE_CONTEXT_TYPE_WITH_NAME(dhd_workitem_context_t, dhd_get_dhd_workitem_context)
+#endif /* (BCMWDF)  */
+
+       #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined(CONFIG_PM_SLEEP)
+
+       #define DHD_PM_RESUME_WAIT_INIT(a) DECLARE_WAIT_QUEUE_HEAD(a);
+       #define _DHD_PM_RESUME_WAIT(a, b) do {\
+                       int retry = 0; \
+                       SMP_RD_BARRIER_DEPENDS(); \
+                       while (dhd_mmc_suspend && retry++ != b) { \
+                               SMP_RD_BARRIER_DEPENDS(); \
+                               wait_event_interruptible_timeout(a, !dhd_mmc_suspend, 1); \
+                       } \
+               }       while (0)
+       #define DHD_PM_RESUME_WAIT(a)           _DHD_PM_RESUME_WAIT(a, 200)
+       #define DHD_PM_RESUME_WAIT_FOREVER(a)   _DHD_PM_RESUME_WAIT(a, ~0)
+       #define DHD_PM_RESUME_RETURN_ERROR(a)   do { \
+                       if (dhd_mmc_suspend) { \
+                               printf("%s[%d]: mmc is still in suspend state!!!\n", \
+                                       __FUNCTION__, __LINE__); \
+                               return a; \
+                       } \
+               } while (0)
+       #define DHD_PM_RESUME_RETURN            do { if (dhd_mmc_suspend) return; } while (0)
+
+       #define DHD_SPINWAIT_SLEEP_INIT(a) DECLARE_WAIT_QUEUE_HEAD(a);
+       #define SPINWAIT_SLEEP(a, exp, us) do { \
+               uint countdown = (us) + 9999; \
+               while ((exp) && (countdown >= 10000)) { \
+                       wait_event_interruptible_timeout(a, FALSE, 1); \
+                       countdown -= 10000; \
+               } \
+       } while (0)
+
+       #else
+
+       #define DHD_PM_RESUME_WAIT_INIT(a)
+       #define DHD_PM_RESUME_WAIT(a)
+       #define DHD_PM_RESUME_WAIT_FOREVER(a)
+       #define DHD_PM_RESUME_RETURN_ERROR(a)
+       #define DHD_PM_RESUME_RETURN
+
+       #define DHD_SPINWAIT_SLEEP_INIT(a)
+       #define SPINWAIT_SLEEP(a, exp, us)  do { \
+               uint countdown = (us) + 9; \
+               while ((exp) && (countdown >= 10)) { \
+                       OSL_DELAY(10);  \
+                       countdown -= 10;  \
+               } \
+       } while (0)
+
+       #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined(CONFIG_PM_SLEEP) */
+
+#ifndef OSL_SLEEP
+#define OSL_SLEEP(ms)          OSL_DELAY(ms*1000)
+#endif /* OSL_SLEEP */
+
+#define DHD_IF_VIF     0x01    /* Virtual IF (Hidden from user) */
+
+#ifdef PNO_SUPPORT
+int dhd_pno_clean(dhd_pub_t *dhd);
+#endif /* PNO_SUPPORT */
+/*
+ *  Wake locks are an Android power management concept. They are used by applications and services
+ *  to request CPU resources.
+ */
+extern int dhd_os_wake_lock(dhd_pub_t *pub);
+extern int dhd_os_wake_unlock(dhd_pub_t *pub);
+extern void dhd_event_wake_lock(dhd_pub_t *pub);
+extern void dhd_event_wake_unlock(dhd_pub_t *pub);
+extern void dhd_pm_wake_lock_timeout(dhd_pub_t *pub, int val);
+extern void dhd_pm_wake_unlock(dhd_pub_t *pub);
+extern void dhd_txfl_wake_lock(dhd_pub_t *pub);
+extern void dhd_txfl_wake_unlock(dhd_pub_t *pub);
+extern int dhd_os_wake_lock_waive(dhd_pub_t *pub);
+extern int dhd_os_wake_lock_restore(dhd_pub_t *pub);
+extern int dhd_os_wake_lock_timeout(dhd_pub_t *pub);
+extern int dhd_os_wake_lock_rx_timeout_enable(dhd_pub_t *pub, int val);
+extern int dhd_os_wake_lock_ctrl_timeout_enable(dhd_pub_t *pub, int val);
+extern int dhd_os_wake_lock_ctrl_timeout_cancel(dhd_pub_t *pub);
+extern int dhd_os_wd_wake_lock(dhd_pub_t *pub);
+extern int dhd_os_wd_wake_unlock(dhd_pub_t *pub);
+extern void dhd_os_wake_lock_init(struct dhd_info *dhd);
+extern void dhd_os_wake_lock_destroy(struct dhd_info *dhd);
+#ifdef BCMPCIE_OOB_HOST_WAKE
+extern void dhd_os_oob_irq_wake_lock_timeout(dhd_pub_t *pub, int val);
+extern void dhd_os_oob_irq_wake_unlock(dhd_pub_t *pub);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+#ifdef DHD_USE_SCAN_WAKELOCK
+extern void dhd_os_scan_wake_lock_timeout(dhd_pub_t *pub, int val);
+extern void dhd_os_scan_wake_unlock(dhd_pub_t *pub);
+#endif /* BCMPCIE_SCAN_WAKELOCK */
+
+inline static void MUTEX_LOCK_SOFTAP_SET_INIT(dhd_pub_t * dhdp)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+       mutex_init(&dhdp->wl_softap_lock);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) */
+}
+
+inline static void MUTEX_LOCK_SOFTAP_SET(dhd_pub_t * dhdp)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+       mutex_lock(&dhdp->wl_softap_lock);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) */
+}
+
+inline static void MUTEX_UNLOCK_SOFTAP_SET(dhd_pub_t * dhdp)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+       mutex_unlock(&dhdp->wl_softap_lock);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) */
+}
+
+#define PRINT_CALL_INFO(str)
+#define PRINT_CALL_INFO_TIMEOUT(str, val)
+#define DHD_OS_WAKE_LOCK(pub) \
+       do { \
+               PRINT_CALL_INFO("call wakelock"); \
+               dhd_os_wake_lock(pub); \
+       } while (0)
+#define DHD_OS_WAKE_UNLOCK(pub) \
+       do { \
+               PRINT_CALL_INFO("call wake_unlock"); \
+               dhd_os_wake_unlock(pub); \
+       } while (0)
+#define DHD_EVENT_WAKE_LOCK(pub) \
+       do { \
+               PRINT_CALL_INFO("call event_wake lock"); \
+       dhd_event_wake_lock(pub); \
+       } while (0)
+#define DHD_EVENT_WAKE_UNLOCK(pub) \
+       do { \
+               PRINT_CALL_INFO("call event_wake unlock"); \
+       dhd_event_wake_unlock(pub); \
+       } while (0)
+#define DHD_PM_WAKE_LOCK_TIMEOUT(pub, val) \
+       do { \
+               PRINT_CALL_INFO("call pm_wake_timeout enable"); \
+       dhd_pm_wake_lock_timeout(pub, val); \
+       } while (0)
+#define DHD_PM_WAKE_UNLOCK(pub) \
+       do { \
+               PRINT_CALL_INFO("call pm_wake unlock"); \
+       dhd_pm_wake_unlock(pub); \
+       } while (0)
+#define DHD_TXFL_WAKE_LOCK(pub) \
+       do { \
+               PRINT_CALL_INFO("call pm_wake_timeout enable"); \
+               dhd_txfl_wake_lock(pub); \
+       } while (0)
+#define DHD_TXFL_WAKE_UNLOCK(pub) \
+       do { \
+               PRINT_CALL_INFO("call pm_wake unlock"); \
+               dhd_txfl_wake_unlock(pub); \
+       } while (0)
+#define DHD_OS_WAKE_LOCK_TIMEOUT(pub) \
+       do { \
+               PRINT_CALL_INFO("call wake_lock_timeout"); \
+               dhd_os_wake_lock_timeout(pub); \
+       } while (0)
+#define DHD_OS_WAKE_LOCK_RX_TIMEOUT_ENABLE(pub, val) \
+       do { \
+               PRINT_CALL_INFO_TIMEOUT("call wake_lock_rx_timeout_enable", val); \
+               dhd_os_wake_lock_rx_timeout_enable(pub, val); \
+       } while (0)
+#define DHD_OS_WAKE_LOCK_CTRL_TIMEOUT_ENABLE(pub, val) \
+       do { \
+               PRINT_CALL_INFO_TIMEOUT("call wake_lock_ctrl_timeout_enable", val); \
+               dhd_os_wake_lock_ctrl_timeout_enable(pub, val); \
+       } while (0)
+#define DHD_OS_WAKE_LOCK_CTRL_TIMEOUT_CANCEL(pub) \
+       do { \
+               PRINT_CALL_INFO("call wake_lock_ctrl_timeout_cancel"); \
+               dhd_os_wake_lock_ctrl_timeout_cancel(pub); \
+       } while (0)
+#define DHD_OS_WAKE_LOCK_WAIVE(pub) \
+       do { \
+               PRINT_CALL_INFO("call wake_lock_waive"); \
+               dhd_os_wake_lock_waive(pub); \
+       } while (0)
+#define DHD_OS_WAKE_LOCK_RESTORE(pub) \
+       do { \
+               PRINT_CALL_INFO("call wake_lock_restore"); \
+               dhd_os_wake_lock_restore(pub); \
+       } while (0)
+#define DHD_OS_WAKE_LOCK_INIT(dhd) \
+       do { \
+               PRINT_CALL_INFO("call wake_lock_init"); \
+               dhd_os_wake_lock_init(dhd); \
+       } while (0)
+#define DHD_OS_WAKE_LOCK_DESTROY(dhd) \
+       do { \
+               PRINT_CALL_INFO("call wake_lock_destroy"); \
+               dhd_os_wake_lock_destroy(dhd); \
+       } while (0)
+
+#define DHD_OS_WD_WAKE_LOCK(pub)               dhd_os_wd_wake_lock(pub)
+#define DHD_OS_WD_WAKE_UNLOCK(pub)             dhd_os_wd_wake_unlock(pub)
+
+#ifdef BCMPCIE_OOB_HOST_WAKE
+#define OOB_WAKE_LOCK_TIMEOUT 500
+#define DHD_OS_OOB_IRQ_WAKE_LOCK_TIMEOUT(pub, val)     dhd_os_oob_irq_wake_lock_timeout(pub, val)
+#define DHD_OS_OOB_IRQ_WAKE_UNLOCK(pub)                        dhd_os_oob_irq_wake_unlock(pub)
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+#ifdef DHD_USE_SCAN_WAKELOCK
+#ifdef DHD_DEBUG_SCAN_WAKELOCK
+#define PRINT_SCAN_CALL(str) printf("%s: %s %d\n", \
+               str, __FUNCTION__, __LINE__)
+#else
+#define PRINT_SCAN_CALL(str)
+#endif /* DHD_DEBUG_SCAN_WAKELOCK */
+#define DHD_OS_SCAN_WAKE_LOCK_TIMEOUT(pub, val) \
+       do { \
+               PRINT_SCAN_CALL("call wake_lock_scan"); \
+               dhd_os_scan_wake_lock_timeout(pub, val); \
+       } while (0)
+#define DHD_OS_SCAN_WAKE_UNLOCK(pub) \
+       do { \
+               PRINT_SCAN_CALL("call wake_unlock_scan"); \
+               dhd_os_scan_wake_unlock(pub); \
+       } while (0)
+#else
+#define DHD_OS_SCAN_WAKE_LOCK_TIMEOUT(pub, val)
+#define DHD_OS_SCAN_WAKE_UNLOCK(pub)
+#endif /* DHD_USE_SCAN_WAKELOCK */
+#define DHD_PACKET_TIMEOUT_MS  500
+#define DHD_EVENT_TIMEOUT_MS   1500
+#define SCAN_WAKE_LOCK_TIMEOUT 10000
+
+/* Enum for IOCTL recieved status */
+typedef enum dhd_ioctl_recieved_status
+{
+       IOCTL_WAIT = 0,
+       IOCTL_RETURN_ON_SUCCESS,
+       IOCTL_RETURN_ON_TRAP,
+       IOCTL_RETURN_ON_BUS_STOP
+} dhd_ioctl_recieved_status_t;
+
+/* interface operations (register, remove) should be atomic, use this lock to prevent race
+ * condition among wifi on/off and interface operation functions
+ */
+void dhd_net_if_lock(struct net_device *dev);
+void dhd_net_if_unlock(struct net_device *dev);
+
+
+typedef enum dhd_attach_states
+{
+       DHD_ATTACH_STATE_INIT = 0x0,
+       DHD_ATTACH_STATE_NET_ALLOC = 0x1,
+       DHD_ATTACH_STATE_DHD_ALLOC = 0x2,
+       DHD_ATTACH_STATE_ADD_IF = 0x4,
+       DHD_ATTACH_STATE_PROT_ATTACH = 0x8,
+       DHD_ATTACH_STATE_WL_ATTACH = 0x10,
+       DHD_ATTACH_STATE_THREADS_CREATED = 0x20,
+       DHD_ATTACH_STATE_WAKELOCKS_INIT = 0x40,
+       DHD_ATTACH_STATE_CFG80211 = 0x80,
+       DHD_ATTACH_STATE_EARLYSUSPEND_DONE = 0x100,
+       DHD_ATTACH_STATE_DONE = 0x200
+} dhd_attach_states_t;
+
+/* Value -1 means we are unsuccessful in creating the kthread. */
+#define DHD_PID_KT_INVALID     -1
+/* Value -2 means we are unsuccessful in both creating the kthread and tasklet */
+#define DHD_PID_KT_TL_INVALID  -2
+
+/*
+ * Exported from dhd OS modules (dhd_linux/dhd_ndis)
+ */
+
+/* Indication from bus module regarding presence/insertion of dongle.
+ * Return dhd_pub_t pointer, used as handle to OS module in later calls.
+ * Returned structure should have bus and prot pointers filled in.
+ * bus_hdrlen specifies required headroom for bus module header.
+ */
+extern dhd_pub_t *dhd_attach(osl_t *osh, struct dhd_bus *bus, uint bus_hdrlen);
+#if defined(WLP2P) && defined(WL_CFG80211)
+/* To allow attach/detach calls corresponding to p2p0 interface  */
+extern int dhd_attach_p2p(dhd_pub_t *);
+extern int dhd_detach_p2p(dhd_pub_t *);
+#endif /* WLP2P && WL_CFG80211 */
+extern int dhd_register_if(dhd_pub_t *dhdp, int idx, bool need_rtnl_lock);
+
+/* Indication from bus module regarding removal/absence of dongle */
+extern void dhd_detach(dhd_pub_t *dhdp);
+extern void dhd_free(dhd_pub_t *dhdp);
+extern void dhd_clear(dhd_pub_t *dhdp);
+
+/* Indication from bus module to change flow-control state */
+extern void dhd_txflowcontrol(dhd_pub_t *dhdp, int ifidx, bool on);
+
+/* Store the status of a connection attempt for later retrieval by an iovar */
+extern void dhd_store_conn_status(uint32 event, uint32 status, uint32 reason);
+
+extern bool dhd_prec_enq(dhd_pub_t *dhdp, struct pktq *q, void *pkt, int prec);
+
+/* Receive frame for delivery to OS.  Callee disposes of rxp. */
+extern void dhd_rx_frame(dhd_pub_t *dhdp, int ifidx, void *rxp, int numpkt, uint8 chan);
+
+/* Return pointer to interface name */
+extern char *dhd_ifname(dhd_pub_t *dhdp, int idx);
+
+/* Request scheduling of the bus dpc */
+extern void dhd_sched_dpc(dhd_pub_t *dhdp);
+
+/* Notify tx completion */
+extern void dhd_txcomplete(dhd_pub_t *dhdp, void *txp, bool success);
+extern void dhd_dpc_enable(dhd_pub_t *dhdp);
+
+#define WIFI_FEATURE_INFRA              0x0001      /* Basic infrastructure mode        */
+#define WIFI_FEATURE_INFRA_5G           0x0002      /* Support for 5 GHz Band           */
+#define WIFI_FEATURE_HOTSPOT            0x0004      /* Support for GAS/ANQP             */
+#define WIFI_FEATURE_P2P                0x0008      /* Wifi-Direct                      */
+#define WIFI_FEATURE_SOFT_AP            0x0010      /* Soft AP                          */
+#define WIFI_FEATURE_GSCAN              0x0020      /* Google-Scan APIs                 */
+#define WIFI_FEATURE_NAN                0x0040      /* Neighbor Awareness Networking    */
+#define WIFI_FEATURE_D2D_RTT            0x0080      /* Device-to-device RTT             */
+#define WIFI_FEATURE_D2AP_RTT           0x0100      /* Device-to-AP RTT                 */
+#define WIFI_FEATURE_BATCH_SCAN         0x0200      /* Batched Scan (legacy)            */
+#define WIFI_FEATURE_PNO                0x0400      /* Preferred network offload        */
+#define WIFI_FEATURE_ADDITIONAL_STA     0x0800      /* Support for two STAs             */
+#define WIFI_FEATURE_TDLS               0x1000      /* Tunnel directed link setup       */
+#define WIFI_FEATURE_TDLS_OFFCHANNEL    0x2000      /* Support for TDLS off channel     */
+#define WIFI_FEATURE_EPR                0x4000      /* Enhanced power reporting         */
+#define WIFI_FEATURE_AP_STA             0x8000      /* Support for AP STA Concurrency   */
+#define WIFI_FEATURE_LINKSTAT           0x10000     /* Support for Linkstats            */
+
+#define MAX_FEATURE_SET_CONCURRRENT_GROUPS  3
+
+extern int dhd_dev_get_feature_set(struct net_device *dev);
+extern int *dhd_dev_get_feature_set_matrix(struct net_device *dev,      int *num);
+#ifdef CUSTOM_FORCE_NODFS_FLAG
+extern int dhd_dev_set_nodfs(struct net_device *dev, uint nodfs);
+#endif /* CUSTOM_FORCE_NODFS_FLAG */
+/* OS independent layer functions */
+extern void dhd_os_dhdiovar_lock(dhd_pub_t *pub);
+extern void dhd_os_dhdiovar_unlock(dhd_pub_t *pub);
+extern int dhd_os_proto_block(dhd_pub_t * pub);
+extern int dhd_os_proto_unblock(dhd_pub_t * pub);
+extern int dhd_os_ioctl_resp_wait(dhd_pub_t * pub, uint * condition);
+extern int dhd_os_ioctl_resp_wake(dhd_pub_t * pub);
+extern unsigned int dhd_os_get_ioctl_resp_timeout(void);
+extern void dhd_os_set_ioctl_resp_timeout(unsigned int timeout_msec);
+extern void dhd_os_ioctl_resp_lock(dhd_pub_t * pub);
+extern void dhd_os_ioctl_resp_unlock(dhd_pub_t * pub);
+extern int dhd_wakeup_ioctl_event(dhd_pub_t *pub, dhd_ioctl_recieved_status_t reason);
+
+#define DHD_OS_IOCTL_RESP_LOCK(x)
+#define DHD_OS_IOCTL_RESP_UNLOCK(x)
+
+
+extern int dhd_os_get_image_block(char * buf, int len, void * image);
+extern void * dhd_os_open_image(char * filename);
+extern int dhd_os_file_size(char *filename);
+extern void dhd_os_close_image(void * image);
+extern void dhd_os_wd_timer(void *bus, uint wdtick);
+#ifdef DHD_PCIE_RUNTIMEPM
+extern void dhd_os_runtimepm_timer(void *bus, uint tick);
+#endif /* DHD_PCIE_RUNTIMEPM */
+extern void dhd_os_sdlock(dhd_pub_t * pub);
+extern void dhd_os_sdunlock(dhd_pub_t * pub);
+extern void dhd_os_sdlock_txq(dhd_pub_t * pub);
+extern void dhd_os_sdunlock_txq(dhd_pub_t * pub);
+extern void dhd_os_sdlock_rxq(dhd_pub_t * pub);
+extern void dhd_os_sdunlock_rxq(dhd_pub_t * pub);
+extern void dhd_os_sdlock_sndup_rxq(dhd_pub_t * pub);
+#ifdef DHDTCPACK_SUPPRESS
+extern unsigned long dhd_os_tcpacklock(dhd_pub_t *pub);
+extern void dhd_os_tcpackunlock(dhd_pub_t *pub, unsigned long flags);
+#endif /* DHDTCPACK_SUPPRESS */
+
+extern int dhd_customer_oob_irq_map(void *adapter, unsigned long *irq_flags_ptr);
+extern int dhd_customer_gpio_wlan_ctrl(void *adapter, int onoff);
+extern int dhd_custom_get_mac_address(void *adapter, unsigned char *buf);
+#ifdef CUSTOM_COUNTRY_CODE
+extern void get_customized_country_code(void *adapter, char *country_iso_code,
+wl_country_t *cspec, u32 flags);
+#else
+extern void get_customized_country_code(void *adapter, char *country_iso_code, wl_country_t *cspec);
+#endif /* CUSTOM_COUNTRY_CODE */
+extern void dhd_os_sdunlock_sndup_rxq(dhd_pub_t * pub);
+extern void dhd_os_sdlock_eventq(dhd_pub_t * pub);
+extern void dhd_os_sdunlock_eventq(dhd_pub_t * pub);
+extern bool dhd_os_check_hang(dhd_pub_t *dhdp, int ifidx, int ret);
+extern int dhd_os_send_hang_message(dhd_pub_t *dhdp);
+extern void dhd_set_version_info(dhd_pub_t *pub, char *fw);
+extern bool dhd_os_check_if_up(dhd_pub_t *pub);
+extern int dhd_os_check_wakelock(dhd_pub_t *pub);
+extern int dhd_os_check_wakelock_all(dhd_pub_t *pub);
+extern int dhd_get_instance(dhd_pub_t *pub);
+#ifdef CUSTOM_SET_CPUCORE
+extern void dhd_set_cpucore(dhd_pub_t *dhd, int set);
+#endif /* CUSTOM_SET_CPUCORE */
+
+#if defined(KEEP_ALIVE)
+extern int dhd_keep_alive_onoff(dhd_pub_t *dhd);
+#endif /* KEEP_ALIVE */
+
+#ifdef SUPPORT_AP_POWERSAVE
+extern int dhd_set_ap_powersave(dhd_pub_t *dhdp, int ifidx, int enable);
+#endif
+
+#if defined(DHD_FW_COREDUMP)
+void dhd_schedule_memdump(dhd_pub_t *dhdp, uint8 *buf, uint32 size);
+#endif /* DHD_FW_COREDUMP */
+
+#ifdef SUPPORT_AP_POWERSAVE
+extern int dhd_set_ap_powersave(dhd_pub_t *dhdp, int ifidx, int enable);
+#endif /* SUPPORT_AP_POWERSAVE */
+
+
+#ifdef PKT_FILTER_SUPPORT
+#define DHD_UNICAST_FILTER_NUM         0
+#define DHD_BROADCAST_FILTER_NUM       1
+#define DHD_MULTICAST4_FILTER_NUM      2
+#define DHD_MULTICAST6_FILTER_NUM      3
+#define DHD_MDNS_FILTER_NUM            4
+#define DHD_ARP_FILTER_NUM             5
+#define DHD_BROADCAST_ARP_FILTER_NUM   6
+#define DHD_IP4BCAST_DROP_FILTER_NUM   7
+extern int dhd_os_enable_packet_filter(dhd_pub_t *dhdp, int val);
+extern void dhd_enable_packet_filter(int value, dhd_pub_t *dhd);
+extern int dhd_packet_filter_add_remove(dhd_pub_t *dhdp, int add_remove, int num);
+extern int net_os_enable_packet_filter(struct net_device *dev, int val);
+extern int net_os_rxfilter_add_remove(struct net_device *dev, int val, int num);
+#define DISCARD_IPV4_MCAST     "102 1 6 IP4_H:16 0xf0 0xe0";
+#define DISCARD_IPV6_MCAST     "103 1 6 IP6_H:24 0xff 0xff";
+#endif /* PKT_FILTER_SUPPORT */
+
+extern int dhd_get_suspend_bcn_li_dtim(dhd_pub_t *dhd);
+extern bool dhd_support_sta_mode(dhd_pub_t *dhd);
+
+extern int write_to_file(dhd_pub_t *dhd, uint8 *buf, int size);
+
+typedef struct {
+       uint32 limit;           /* Expiration time (usec) */
+       uint32 increment;       /* Current expiration increment (usec) */
+       uint32 elapsed;         /* Current elapsed time (usec) */
+       uint32 tick;            /* O/S tick time (usec) */
+} dhd_timeout_t;
+
+#ifdef SHOW_LOGTRACE
+typedef struct {
+       int  num_fmts;
+       char **fmts;
+       char *raw_fmts;
+       char *raw_sstr;
+       uint32 ramstart;
+       uint32 rodata_start;
+       uint32 rodata_end;
+       char *rom_raw_sstr;
+       uint32 rom_ramstart;
+       uint32 rom_rodata_start;
+       uint32 rom_rodata_end;
+} dhd_event_log_t;
+#endif /* SHOW_LOGTRACE */
+
+#if defined(KEEP_ALIVE)
+extern int dhd_dev_start_mkeep_alive(dhd_pub_t *dhd_pub, u8 mkeep_alive_id, u8 *ip_pkt,
+       u16 ip_pkt_len, u8* src_mac_addr, u8* dst_mac_addr, u32 period_msec);
+extern int dhd_dev_stop_mkeep_alive(dhd_pub_t *dhd_pub, u8 mkeep_alive_id);
+#endif /* defined(KEEP_ALIVE) */
+
+extern void dhd_timeout_start(dhd_timeout_t *tmo, uint usec);
+extern int dhd_timeout_expired(dhd_timeout_t *tmo);
+
+extern int dhd_ifname2idx(struct dhd_info *dhd, char *name);
+extern int dhd_net2idx(struct dhd_info *dhd, struct net_device *net);
+extern struct net_device * dhd_idx2net(void *pub, int ifidx);
+extern int net_os_send_hang_message(struct net_device *dev);
+extern int net_os_send_hang_message_reason(struct net_device *dev, const char *string_num);
+extern bool dhd_wowl_cap(void *bus);
+extern int wl_host_event(dhd_pub_t *dhd_pub, int *idx, void *pktdata, size_t pktlen,
+       wl_event_msg_t *, void **data_ptr,  void *);
+
+extern void wl_event_to_host_order(wl_event_msg_t * evt);
+extern int wl_host_event_get_data(void *pktdata, uint pktlen, bcm_event_msg_u_t *evu);
+
+extern int dhd_wl_ioctl(dhd_pub_t *dhd_pub, int ifindex, wl_ioctl_t *ioc, void *buf, int len);
+extern int dhd_wl_ioctl_cmd(dhd_pub_t *dhd_pub, int cmd, void *arg, int len, uint8 set,
+                            int ifindex);
+extern int dhd_wl_ioctl_get_intiovar(dhd_pub_t *dhd_pub, char *name, uint *pval,
+       int cmd, uint8 set, int ifidx);
+extern int dhd_wl_ioctl_set_intiovar(dhd_pub_t *dhd_pub, char *name, uint val,
+       int cmd, uint8 set, int ifidx);
+extern void dhd_common_init(osl_t *osh);
+
+extern int dhd_do_driver_init(struct net_device *net);
+extern int dhd_event_ifadd(struct dhd_info *dhd, struct wl_event_data_if *ifevent,
+       char *name, uint8 *mac);
+extern int dhd_event_ifdel(struct dhd_info *dhd, struct wl_event_data_if *ifevent,
+       char *name, uint8 *mac);
+extern struct net_device* dhd_allocate_if(dhd_pub_t *dhdpub, int ifidx, char *name,
+       uint8 *mac, uint8 bssidx, bool need_rtnl_lock, char *dngl_name);
+extern int dhd_remove_if(dhd_pub_t *dhdpub, int ifidx, bool need_rtnl_lock);
+extern void dhd_vif_add(struct dhd_info *dhd, int ifidx, char * name);
+extern void dhd_vif_del(struct dhd_info *dhd, int ifidx);
+extern void dhd_event(struct dhd_info *dhd, char *evpkt, uint evlen, int ifidx);
+extern void dhd_vif_sendup(struct dhd_info *dhd, int ifidx, uchar *cp, int len);
+
+/* Send packet to dongle via data channel */
+extern int dhd_sendpkt(dhd_pub_t *dhdp, int ifidx, void *pkt);
+
+/* send up locally generated event */
+extern void dhd_sendup_event_common(dhd_pub_t *dhdp, wl_event_msg_t *event, void *data);
+/* Send event to host */
+extern void dhd_sendup_event(dhd_pub_t *dhdp, wl_event_msg_t *event, void *data);
+#ifdef LOG_INTO_TCPDUMP
+extern void dhd_sendup_log(dhd_pub_t *dhdp, void *data, int len);
+#endif /* LOG_INTO_TCPDUMP */
+extern int dhd_bus_devreset(dhd_pub_t *dhdp, uint8 flag);
+extern uint dhd_bus_status(dhd_pub_t *dhdp);
+extern int  dhd_bus_start(dhd_pub_t *dhdp);
+extern int dhd_bus_suspend(dhd_pub_t *dhdpub);
+extern int dhd_bus_resume(dhd_pub_t *dhdpub, int stage);
+extern int dhd_bus_membytes(dhd_pub_t *dhdp, bool set, uint32 address, uint8 *data, uint size);
+extern void dhd_print_buf(void *pbuf, int len, int bytes_per_line);
+extern bool dhd_is_associated(dhd_pub_t *dhd, uint8 ifidx, int *retval);
+#if defined(BCMSDIO) || defined(BCMPCIE)
+extern uint dhd_bus_chip_id(dhd_pub_t *dhdp);
+extern uint dhd_bus_chiprev_id(dhd_pub_t *dhdp);
+extern uint dhd_bus_chippkg_id(dhd_pub_t *dhdp);
+#endif /* defined(BCMSDIO) || defined(BCMPCIE) */
+
+#if defined(KEEP_ALIVE)
+extern int dhd_keep_alive_onoff(dhd_pub_t *dhd);
+#endif /* KEEP_ALIVE */
+
+/* OS spin lock API */
+extern void *dhd_os_spin_lock_init(osl_t *osh);
+extern void dhd_os_spin_lock_deinit(osl_t *osh, void *lock);
+extern unsigned long dhd_os_spin_lock(void *lock);
+void dhd_os_spin_unlock(void *lock, unsigned long flags);
+
+/*
+ * Manage sta objects in an interface. Interface is identified by an ifindex and
+ * sta(s) within an interfaces are managed using a MacAddress of the sta.
+ */
+struct dhd_sta;
+extern struct dhd_sta *dhd_findadd_sta(void *pub, int ifidx, void *ea);
+extern void dhd_del_sta(void *pub, int ifidx, void *ea);
+extern int dhd_get_ap_isolate(dhd_pub_t *dhdp, uint32 idx);
+extern int dhd_set_ap_isolate(dhd_pub_t *dhdp, uint32 idx, int val);
+#if defined(BCM_GMAC3)
+extern int dhd_set_dev_def(dhd_pub_t *dhdp, uint32 idx, int val);
+#endif
+extern int dhd_bssidx2idx(dhd_pub_t *dhdp, uint32 bssidx);
+extern int dhd_os_d3ack_wait(dhd_pub_t * pub, uint * condition);
+extern int dhd_os_d3ack_wake(dhd_pub_t * pub);
+extern int dhd_os_busbusy_wait_negation(dhd_pub_t * pub, uint * condition);
+extern int dhd_os_busbusy_wake(dhd_pub_t * pub);
+
+extern bool dhd_is_concurrent_mode(dhd_pub_t *dhd);
+extern int dhd_iovar(dhd_pub_t *pub, int ifidx, char *name, char *cmd_buf, uint cmd_len, int set);
+typedef enum cust_gpio_modes {
+       WLAN_RESET_ON,
+       WLAN_RESET_OFF,
+       WLAN_POWER_ON,
+       WLAN_POWER_OFF
+} cust_gpio_modes_t;
+
+extern int wl_iw_iscan_set_scan_broadcast_prep(struct net_device *dev, uint flag);
+extern int wl_iw_send_priv_event(struct net_device *dev, char *flag);
+/*
+ * Insmod parameters for debug/test
+ */
+
+/* Watchdog timer interval */
+extern uint dhd_watchdog_ms;
+
+#ifdef DHD_PCIE_RUNTIMEPM
+extern uint dhd_runtimepm_ms;
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+#if defined(DHD_DEBUG)
+/* Console output poll interval */
+extern uint dhd_console_ms;
+extern uint wl_msg_level;
+#endif /* defined(DHD_DEBUG) */
+
+extern uint dhd_slpauto;
+
+/* Use interrupts */
+extern uint dhd_intr;
+
+/* Use polling */
+extern uint dhd_poll;
+
+/* ARP offload agent mode */
+extern uint dhd_arp_mode;
+
+/* ARP offload enable */
+extern uint dhd_arp_enable;
+
+/* Pkt filte enable control */
+extern uint dhd_pkt_filter_enable;
+
+/*  Pkt filter init setup */
+extern uint dhd_pkt_filter_init;
+
+/* Pkt filter mode control */
+extern uint dhd_master_mode;
+
+/* Roaming mode control */
+extern uint dhd_roam_disable;
+
+/* Roaming mode control */
+extern uint dhd_radio_up;
+
+/* Initial idletime ticks (may be -1 for immediate idle, 0 for no idle) */
+extern int dhd_idletime;
+#ifdef DHD_USE_IDLECOUNT
+#define DHD_IDLETIME_TICKS 5
+#else
+#define DHD_IDLETIME_TICKS 1
+#endif /* DHD_USE_IDLECOUNT */
+
+/* SDIO Drive Strength */
+extern uint dhd_sdiod_drive_strength;
+
+/* triggers bcm_bprintf to print to kernel log */
+extern bool bcm_bprintf_bypass;
+
+/* Override to force tx queueing all the time */
+extern uint dhd_force_tx_queueing;
+/* Default KEEP_ALIVE Period is 55 sec to prevent AP from sending Keep Alive probe frame */
+#define DEFAULT_KEEP_ALIVE_VALUE       55000 /* msec */
+#ifndef CUSTOM_KEEP_ALIVE_SETTING
+#define CUSTOM_KEEP_ALIVE_SETTING      DEFAULT_KEEP_ALIVE_VALUE
+#endif /* DEFAULT_KEEP_ALIVE_VALUE */
+
+#define NULL_PKT_STR   "null_pkt"
+
+/* hooks for custom glom setting option via Makefile */
+#define DEFAULT_GLOM_VALUE     -1
+#ifndef CUSTOM_GLOM_SETTING
+#define CUSTOM_GLOM_SETTING    DEFAULT_GLOM_VALUE
+#endif
+#define WL_AUTO_ROAM_TRIGGER -75
+/* hooks for custom Roaming Trigger  setting via Makefile */
+#define DEFAULT_ROAM_TRIGGER_VALUE -75 /* dBm default roam trigger all band */
+#define DEFAULT_ROAM_TRIGGER_SETTING   -1
+#ifndef CUSTOM_ROAM_TRIGGER_SETTING
+#define CUSTOM_ROAM_TRIGGER_SETTING    DEFAULT_ROAM_TRIGGER_VALUE
+#endif
+
+/* hooks for custom Roaming Romaing  setting via Makefile */
+#define DEFAULT_ROAM_DELTA_VALUE  10 /* dBm default roam delta all band */
+#define DEFAULT_ROAM_DELTA_SETTING     -1
+#ifndef CUSTOM_ROAM_DELTA_SETTING
+#define CUSTOM_ROAM_DELTA_SETTING      DEFAULT_ROAM_DELTA_VALUE
+#endif
+
+/* hooks for custom PNO Event wake lock to guarantee enough time
+       for the Platform to detect Event before system suspended
+*/
+#define DEFAULT_PNO_EVENT_LOCK_xTIME   2       /* multiplay of DHD_PACKET_TIMEOUT_MS */
+#ifndef CUSTOM_PNO_EVENT_LOCK_xTIME
+#define CUSTOM_PNO_EVENT_LOCK_xTIME     DEFAULT_PNO_EVENT_LOCK_xTIME
+#endif
+/* hooks for custom dhd_dpc_prio setting option via Makefile */
+#define DEFAULT_DHP_DPC_PRIO  1
+#ifndef CUSTOM_DPC_PRIO_SETTING
+#define CUSTOM_DPC_PRIO_SETTING        DEFAULT_DHP_DPC_PRIO
+#endif
+
+#ifndef CUSTOM_LISTEN_INTERVAL
+#define CUSTOM_LISTEN_INTERVAL                 LISTEN_INTERVAL
+#endif /* CUSTOM_LISTEN_INTERVAL */
+
+#define DEFAULT_SUSPEND_BCN_LI_DTIM            3
+#ifndef CUSTOM_SUSPEND_BCN_LI_DTIM
+#define CUSTOM_SUSPEND_BCN_LI_DTIM             DEFAULT_SUSPEND_BCN_LI_DTIM
+#endif
+
+#ifndef CUSTOM_RXF_PRIO_SETTING
+#define CUSTOM_RXF_PRIO_SETTING                MAX((CUSTOM_DPC_PRIO_SETTING - 1), 1)
+#endif
+
+#define DEFAULT_WIFI_TURNOFF_DELAY             0
+#define WIFI_TURNOFF_DELAY             DEFAULT_WIFI_TURNOFF_DELAY
+
+#define DEFAULT_WIFI_TURNON_DELAY              200
+#ifndef WIFI_TURNON_DELAY
+#define WIFI_TURNON_DELAY              DEFAULT_WIFI_TURNON_DELAY
+#endif /* WIFI_TURNON_DELAY */
+
+#define DEFAULT_DHD_WATCHDOG_INTERVAL_MS       10 /* msec */
+#ifndef CUSTOM_DHD_WATCHDOG_MS
+#define CUSTOM_DHD_WATCHDOG_MS                 DEFAULT_DHD_WATCHDOG_INTERVAL_MS
+#endif /* DEFAULT_DHD_WATCHDOG_INTERVAL_MS */
+
+#define DEFAULT_ASSOC_RETRY_MAX                        3
+#ifndef CUSTOM_ASSOC_RETRY_MAX
+#define CUSTOM_ASSOC_RETRY_MAX                 DEFAULT_ASSOC_RETRY_MAX
+#endif /* DEFAULT_ASSOC_RETRY_MAX */
+
+
+#ifdef WLTDLS
+#ifndef CUSTOM_TDLS_IDLE_MODE_SETTING
+#define CUSTOM_TDLS_IDLE_MODE_SETTING  60000 /* 60sec to tear down TDLS of not active */
+#endif
+#ifndef CUSTOM_TDLS_RSSI_THRESHOLD_HIGH
+#define CUSTOM_TDLS_RSSI_THRESHOLD_HIGH -70 /* rssi threshold for establishing TDLS link */
+#endif
+#ifndef CUSTOM_TDLS_RSSI_THRESHOLD_LOW
+#define CUSTOM_TDLS_RSSI_THRESHOLD_LOW -80 /* rssi threshold for tearing down TDLS link */
+#endif
+#endif /* WLTDLS */
+
+#define DEFAULT_BCN_TIMEOUT            8
+#ifndef CUSTOM_BCN_TIMEOUT
+#define CUSTOM_BCN_TIMEOUT             DEFAULT_BCN_TIMEOUT
+#endif
+
+#define MAX_DTIM_SKIP_BEACON_INTERVAL  100 /* max allowed associated AP beacon for DTIM skip */
+#ifndef MAX_DTIM_ALLOWED_INTERVAL
+#define MAX_DTIM_ALLOWED_INTERVAL 600 /* max allowed total beacon interval for DTIM skip */
+#endif
+#define NO_DTIM_SKIP 1
+#ifdef SDTEST
+/* Echo packet generator (SDIO), pkts/s */
+extern uint dhd_pktgen;
+
+/* Echo packet len (0 => sawtooth, max 1800) */
+extern uint dhd_pktgen_len;
+#define MAX_PKTGEN_LEN 1800
+#endif
+
+
+/* optionally set by a module_param_string() */
+#define MOD_PARAM_PATHLEN      2048
+#define MOD_PARAM_INFOLEN      512
+
+#ifdef SOFTAP
+extern char fw_path2[MOD_PARAM_PATHLEN];
+#endif
+
+/* Flag to indicate if we should download firmware on driver load */
+extern uint dhd_download_fw_on_driverload;
+extern int allow_delay_fwdl;
+
+extern int dhd_process_cid_mac(dhd_pub_t *dhdp, bool prepost);
+extern int dhd_write_file(const char *filepath, char *buf, int buf_len);
+extern int dhd_read_file(const char *filepath, char *buf, int buf_len);
+extern int dhd_write_file_and_check(const char *filepath, char *buf, int buf_len);
+
+#ifdef READ_MACADDR
+extern int dhd_set_macaddr_from_file(dhd_pub_t *dhdp);
+#else
+static INLINE int dhd_set_macaddr_from_file(dhd_pub_t *dhdp) { return 0; }
+#endif /* READ_MACADDR */
+#ifdef WRITE_MACADDR
+extern int dhd_write_macaddr(struct ether_addr *mac);
+#else
+static INLINE int dhd_write_macaddr(struct ether_addr *mac) { return 0; }
+#endif /* WRITE_MACADDR */
+static INLINE int dhd_check_module_cid(dhd_pub_t *dhdp) { return 0; }
+#ifdef GET_MAC_FROM_OTP
+extern int dhd_check_module_mac(dhd_pub_t *dhdp);
+#else
+static INLINE int dhd_check_module_mac(dhd_pub_t *dhdp) { return 0; }
+#endif /* GET_MAC_FROM_OTP */
+
+#if defined(READ_MACADDR) || defined(WRITE_MACADDR) || defined(GET_MAC_FROM_OTP)
+#define DHD_USE_CISINFO
+#endif 
+
+#ifdef DHD_USE_CISINFO
+int dhd_read_cis(dhd_pub_t *dhdp);
+void dhd_clear_cis(dhd_pub_t *dhdp);
+#else
+static INLINE int dhd_read_cis(dhd_pub_t *dhdp) { return 0; }
+static INLINE void dhd_clear_cis(dhd_pub_t *dhdp) { }
+#endif /* DHD_USE_CISINFO */
+
+
+extern void dhd_wait_for_event(dhd_pub_t *dhd, bool *lockvar);
+extern void dhd_wait_event_wakeup(dhd_pub_t*dhd);
+
+#define IFLOCK_INIT(lock)       *lock = 0
+#define IFLOCK(lock)    while (InterlockedCompareExchange((lock), 1, 0))       \
+       NdisStallExecution(1);
+#define IFUNLOCK(lock)  InterlockedExchange((lock), 0)
+#define IFLOCK_FREE(lock)
+#define FW_SUPPORTED(dhd, capa) ((strstr(dhd->fw_capabilities, " " #capa " ") != NULL))
+#ifdef ARP_OFFLOAD_SUPPORT
+#define MAX_IPV4_ENTRIES       8
+void dhd_arp_offload_set(dhd_pub_t * dhd, int arp_mode);
+void dhd_arp_offload_enable(dhd_pub_t * dhd, int arp_enable);
+
+/* dhd_commn arp offload wrapers */
+void dhd_aoe_hostip_clr(dhd_pub_t *dhd, int idx);
+void dhd_aoe_arp_clr(dhd_pub_t *dhd, int idx);
+int dhd_arp_get_arp_hostip_table(dhd_pub_t *dhd, void *buf, int buflen, int idx);
+void dhd_arp_offload_add_ip(dhd_pub_t *dhd, uint32 ipaddr, int idx);
+#endif /* ARP_OFFLOAD_SUPPORT */
+#ifdef WLTDLS
+int dhd_tdls_enable(struct net_device *dev, bool tdls_on, bool auto_on, struct ether_addr *mac);
+int dhd_tdls_set_mode(dhd_pub_t *dhd, bool wfd_mode);
+#ifdef PCIE_FULL_DONGLE
+void dhd_tdls_update_peer_info(struct net_device *dev, bool connect_disconnect, uint8 *addr);
+#endif /* PCIE_FULL_DONGLE */
+#endif /* WLTDLS */
+/* Neighbor Discovery Offload Support */
+extern int dhd_ndo_enable(dhd_pub_t * dhd, int ndo_enable);
+int dhd_ndo_add_ip(dhd_pub_t *dhd, char* ipaddr, int idx);
+int dhd_ndo_remove_ip(dhd_pub_t *dhd, int idx);
+/* ioctl processing for nl80211 */
+int dhd_ioctl_process(dhd_pub_t *pub, int ifidx, struct dhd_ioctl *ioc, void *data_buf);
+
+void dhd_bus_update_fw_nv_path(struct dhd_bus *bus, char *pfw_path, char *pnv_path);
+void dhd_set_bus_state(void *bus, uint32 state);
+
+/* Remove proper pkts(either one no-frag pkt or whole fragmented pkts) */
+typedef int (*f_droppkt_t)(dhd_pub_t *dhdp, int prec, void* p, bool bPktInQ);
+extern bool dhd_prec_drop_pkts(dhd_pub_t *dhdp, struct pktq *pq, int prec, f_droppkt_t fn);
+
+#ifdef PROP_TXSTATUS
+int dhd_os_wlfc_block(dhd_pub_t *pub);
+int dhd_os_wlfc_unblock(dhd_pub_t *pub);
+extern const uint8 prio2fifo[];
+#endif /* PROP_TXSTATUS */
+
+uint8* dhd_os_prealloc(dhd_pub_t *dhdpub, int section, uint size, bool kmalloc_if_fail);
+void dhd_os_prefree(dhd_pub_t *dhdpub, void *addr, uint size);
+
+#if defined(CONFIG_DHD_USE_STATIC_BUF)
+#define DHD_OS_PREALLOC(dhdpub, section, size) dhd_os_prealloc(dhdpub, section, size, FALSE)
+#define DHD_OS_PREFREE(dhdpub, addr, size) dhd_os_prefree(dhdpub, addr, size)
+#else
+#define DHD_OS_PREALLOC(dhdpub, section, size) MALLOC(dhdpub->osh, size)
+#define DHD_OS_PREFREE(dhdpub, addr, size) MFREE(dhdpub->osh, addr, size)
+#endif /* defined(CONFIG_DHD_USE_STATIC_BUF) */
+
+#ifdef USE_WFA_CERT_CONF
+enum {
+       SET_PARAM_BUS_TXGLOM_MODE,
+       SET_PARAM_ROAMOFF,
+#ifdef USE_WL_FRAMEBURST
+       SET_PARAM_FRAMEBURST,
+#endif /* USE_WL_FRAMEBURST */
+#ifdef USE_WL_TXBF
+       SET_PARAM_TXBF,
+#endif /* USE_WL_TXBF */
+#ifdef PROP_TXSTATUS
+       SET_PARAM_PROPTX,
+       SET_PARAM_PROPTXMODE,
+#endif /* PROP_TXSTATUS */
+       PARAM_LAST_VALUE
+};
+extern int sec_get_param_wfa_cert(dhd_pub_t *dhd, int mode, uint* read_val);
+#endif /* USE_WFA_CERT_CONF */
+
+#define dhd_add_flowid(pub, ifidx, ac_prio, ea, flowid)  do {} while (0)
+#define dhd_del_flowid(pub, ifidx, flowid)               do {} while (0)
+
+extern unsigned long dhd_os_general_spin_lock(dhd_pub_t *pub);
+extern void dhd_os_general_spin_unlock(dhd_pub_t *pub, unsigned long flags);
+
+/** Miscellaenous DHD Spin Locks */
+
+/* Disable router 3GMAC bypass path perimeter lock */
+#define DHD_PERIM_LOCK(dhdp)              do {} while (0)
+#define DHD_PERIM_UNLOCK(dhdp)            do {} while (0)
+#define DHD_PERIM_LOCK_ALL(processor_id)    do {} while (0)
+#define DHD_PERIM_UNLOCK_ALL(processor_id)  do {} while (0)
+
+/* Enable DHD general spin lock/unlock */
+#define DHD_GENERAL_LOCK(dhdp, flags) \
+       (flags) = dhd_os_general_spin_lock(dhdp)
+#define DHD_GENERAL_UNLOCK(dhdp, flags) \
+       dhd_os_general_spin_unlock((dhdp), (flags))
+
+/* Enable DHD flowring spin lock/unlock */
+#define DHD_FLOWRING_LOCK(lock, flags)     (flags) = dhd_os_spin_lock(lock)
+#define DHD_FLOWRING_UNLOCK(lock, flags)   dhd_os_spin_unlock((lock), (flags))
+
+/* Enable DHD common flowring info spin lock/unlock */
+#define DHD_FLOWID_LOCK(lock, flags)       (flags) = dhd_os_spin_lock(lock)
+#define DHD_FLOWID_UNLOCK(lock, flags)     dhd_os_spin_unlock((lock), (flags))
+
+/* Enable DHD common flowring list spin lock/unlock */
+#define DHD_FLOWRING_LIST_LOCK(lock, flags)       (flags) = dhd_os_spin_lock(lock)
+#define DHD_FLOWRING_LIST_UNLOCK(lock, flags)     dhd_os_spin_unlock((lock), (flags))
+
+extern void dhd_dump_to_kernelog(dhd_pub_t *dhdp);
+
+
+#ifdef DHD_L2_FILTER
+extern int dhd_get_parp_status(dhd_pub_t *dhdp, uint32 idx);
+extern int dhd_set_parp_status(dhd_pub_t *dhdp, uint32 idx, int val);
+extern int dhd_get_dhcp_unicast_status(dhd_pub_t *dhdp, uint32 idx);
+extern int dhd_set_dhcp_unicast_status(dhd_pub_t *dhdp, uint32 idx, int val);
+extern int dhd_get_block_ping_status(dhd_pub_t *dhdp, uint32 idx);
+extern int dhd_set_block_ping_status(dhd_pub_t *dhdp, uint32 idx, int val);
+extern int dhd_get_grat_arp_status(dhd_pub_t *dhdp, uint32 idx);
+extern int dhd_set_grat_arp_status(dhd_pub_t *dhdp, uint32 idx, int val);
+#endif /* DHD_L2_FILTER */
+
+typedef struct wl_io_pport {
+       dhd_pub_t *dhd_pub;
+       uint ifidx;
+} wl_io_pport_t;
+
+typedef struct wl_evt_pport {
+       dhd_pub_t *dhd_pub;
+       int *ifidx;
+       void *pktdata;
+       void **data_ptr;
+       void *raw_event;
+} wl_evt_pport_t;
+
+extern void *dhd_pub_shim(dhd_pub_t *dhd_pub);
+#ifdef DHD_FW_COREDUMP
+void dhd_save_fwdump(dhd_pub_t *dhd_pub, void * buffer, uint32 length);
+#endif /* DHD_FW_COREDUMP */
+
+#if defined(SET_RPS_CPUS)
+int dhd_rps_cpus_enable(struct net_device *net, int enable);
+int custom_rps_map_set(struct netdev_rx_queue *queue, char *buf, size_t len);
+void custom_rps_map_clear(struct netdev_rx_queue *queue);
+#define PRIMARY_INF 0
+#define VIRTUAL_INF 1
+#if defined(CONFIG_MACH_UNIVERSAL5433) || defined(CONFIG_MACH_UNIVERSAL7420) || \
+       defined(CONFIG_SOC_EXYNOS8890)
+#define RPS_CPUS_MASK "10"
+#define RPS_CPUS_MASK_P2P "10"
+#define RPS_CPUS_MASK_IBSS "10"
+#define RPS_CPUS_WLAN_CORE_ID 4
+#else
+#define RPS_CPUS_MASK "6"
+#define RPS_CPUS_MASK_P2P "6"
+#define RPS_CPUS_MASK_IBSS "6"
+#endif /* CONFIG_MACH_UNIVERSAL5433 || CONFIG_MACH_UNIVERSAL7420 || CONFIG_SOC_EXYNOS8890 */
+#endif 
+
+int dhd_get_download_buffer(dhd_pub_t  *dhd, char *file_path, download_type_t component,
+       char ** buffer, int *length);
+
+void dhd_free_download_buffer(dhd_pub_t        *dhd, void *buffer, int length);
+
+int dhd_download_clm_blob(dhd_pub_t *dhd, unsigned char *buf, uint32 len);
+
+int dhd_apply_default_clm(dhd_pub_t *dhd, char *clm_path);
+#ifdef DHD_USE_CLMINFO_PARSER
+int dhd_get_clminfo(dhd_pub_t *dhd, char *clm_path);
+#define NUM_OF_COUNTRYS 150
+#endif /* DHD_USE_CLMINFO_PARSER */
+
+#define dhd_is_device_removed(x) FALSE
+#define dhd_os_ind_firmware_stall(x)
+
+#ifdef DHD_FW_COREDUMP
+extern void dhd_get_memdump_info(dhd_pub_t *dhd);
+#endif /* DHD_FW_COREDUMP */
+#ifdef BCMASSERT_LOG
+extern void dhd_get_assert_info(dhd_pub_t *dhd);
+#endif /* BCMASSERT_LOG */
+
+#if defined(DHD_LB_STATS)
+#include <bcmutils.h>
+extern void dhd_lb_stats_init(dhd_pub_t *dhd);
+extern void dhd_lb_stats_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf);
+extern void dhd_lb_stats_update_napi_histo(dhd_pub_t *dhdp, uint32 count);
+extern void dhd_lb_stats_update_txc_histo(dhd_pub_t *dhdp, uint32 count);
+extern void dhd_lb_stats_update_rxc_histo(dhd_pub_t *dhdp, uint32 count);
+extern void dhd_lb_stats_txc_percpu_cnt_incr(dhd_pub_t *dhdp);
+extern void dhd_lb_stats_rxc_percpu_cnt_incr(dhd_pub_t *dhdp);
+#define DHD_LB_STATS_INIT(dhdp) dhd_lb_stats_init(dhdp)
+/* Reset is called from common layer so it takes dhd_pub_t as argument */
+#define DHD_LB_STATS_RESET(dhdp) dhd_lb_stats_init(dhdp)
+#define DHD_LB_STATS_CLR(x)     (x) = 0U
+#define DHD_LB_STATS_INCR(x)    (x) = (x) + 1
+#define DHD_LB_STATS_ADD(x, c)  (x) = (x) + (c)
+#define DHD_LB_STATS_PERCPU_ARR_INCR(x) \
+       { \
+               int cpu = get_cpu(); put_cpu(); \
+               DHD_LB_STATS_INCR(x[cpu]); \
+       }
+#define DHD_LB_STATS_UPDATE_NAPI_HISTO(dhdp, x) dhd_lb_stats_update_napi_histo(dhdp, x)
+#define DHD_LB_STATS_UPDATE_TXC_HISTO(dhdp, x)  dhd_lb_stats_update_txc_histo(dhdp, x)
+#define DHD_LB_STATS_UPDATE_RXC_HISTO(dhdp, x)  dhd_lb_stats_update_rxc_histo(dhdp, x)
+#define DHD_LB_STATS_TXC_PERCPU_CNT_INCR(dhdp)  dhd_lb_stats_txc_percpu_cnt_incr(dhdp)
+#define DHD_LB_STATS_RXC_PERCPU_CNT_INCR(dhdp)  dhd_lb_stats_rxc_percpu_cnt_incr(dhdp)
+#else /* !DHD_LB_STATS */
+#define DHD_LB_STATS_NOOP       do { /* noop */ } while (0)
+#define DHD_LB_STATS_INIT(dhdp)  DHD_LB_STATS_NOOP
+#define DHD_LB_STATS_RESET(dhdp) DHD_LB_STATS_NOOP
+#define DHD_LB_STATS_CLR(x)      DHD_LB_STATS_NOOP
+#define DHD_LB_STATS_INCR(x)     DHD_LB_STATS_NOOP
+#define DHD_LB_STATS_ADD(x, c)   DHD_LB_STATS_NOOP
+#define DHD_LB_STATS_PERCPU_ARR_INCR(x)  DHD_LB_STATS_NOOP
+#define DHD_LB_STATS_UPDATE_NAPI_HISTO(dhd, x) DHD_LB_STATS_NOOP
+#define DHD_LB_STATS_UPDATE_TXC_HISTO(dhd, x) DHD_LB_STATS_NOOP
+#define DHD_LB_STATS_UPDATE_RXC_HISTO(dhd, x) DHD_LB_STATS_NOOP
+#define DHD_LB_STATS_TXC_PERCPU_CNT_INCR(dhdp) DHD_LB_STATS_NOOP
+#define DHD_LB_STATS_RXC_PERCPU_CNT_INCR(dhdp) DHD_LB_STATS_NOOP
+#endif /* !DHD_LB_STATS */
+
+#ifdef DHD_PCIE_RUNTIMEPM
+extern bool dhd_runtimepm_state(dhd_pub_t *dhd);
+extern bool dhd_runtime_bus_wake(struct dhd_bus *bus, bool wait, void *func_addr);
+extern bool dhdpcie_runtime_bus_wake(dhd_pub_t *dhdp, bool wait, void *func_addr);
+extern void dhdpcie_block_runtime_pm(dhd_pub_t *dhdp);
+extern bool dhdpcie_is_resume_done(dhd_pub_t *dhdp);
+extern void dhd_runtime_pm_disable(dhd_pub_t *dhdp);
+extern void dhd_runtime_pm_enable(dhd_pub_t *dhdp);
+/* Disable the Runtime PM and wake up if the bus is already in suspend */
+#define DHD_DISABLE_RUNTIME_PM(dhdp) \
+do { \
+       dhd_runtime_pm_disable(dhdp); \
+} while (0);
+
+/* Enable the Runtime PM */
+#define DHD_ENABLE_RUNTIME_PM(dhdp) \
+do { \
+       dhd_runtime_pm_enable(dhdp); \
+} while (0);
+#else
+#define DHD_DISABLE_RUNTIME_PM(dhdp)
+#define DHD_ENABLE_RUNTIME_PM(dhdp)
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+extern void dhd_memdump_work_schedule(dhd_pub_t *dhdp, unsigned long msecs);
+
+extern bool dhd_query_bus_erros(dhd_pub_t *dhdp);
+
+/*
+ * Enable this macro if you want to track the calls to wake lock
+ * This records can be printed using the following command
+ * cat /sys/bcm-dhd/wklock_trace
+ * DHD_TRACE_WAKE_LOCK supports over linux 2.6.0 version
+ */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+#undef DHD_TRACE_WAKE_LOCK
+#endif /* KERNEL_VER < KERNEL_VERSION(2, 6, 0) */
+
+#if defined(DHD_TRACE_WAKE_LOCK)
+void dhd_wk_lock_stats_dump(dhd_pub_t *dhdp);
+#endif
+
+extern int dhd_prot_debug_info_print(dhd_pub_t *dhd);
+
+#ifdef ENABLE_TEMP_THROTTLING
+#ifndef TEMP_THROTTLE_CONTROL_BIT
+#define TEMP_THROTTLE_CONTROL_BIT 0xd
+#endif
+#endif /* ENABLE_TEMP_THROTTLING */
+
+#ifdef DHD_PKTID_AUDIT_ENABLED
+void dhd_pktid_audit_fail_cb(dhd_pub_t *dhdp);
+#endif /* DHD_PKTID_AUDIT_ENABLED */
+
+int dhd_android_ap_isolate_getval(struct net_device *dev);
+void dhd_android_ap_isolate_setval(struct net_device *dev, int val);
+
+#ifdef OOB_PARAM
+extern uint dhd_get_oob_disable(struct dhd_bus* bus);
+#endif /* OOB_PARAM */
+
+#endif /* _dhd_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_bandsteer.c b/drivers/net/wireless/bcmdhd_1363/dhd_bandsteer.c
new file mode 100644 (file)
index 0000000..620872a
--- /dev/null
@@ -0,0 +1,595 @@
+/*
+ * Band Steering logic
+ *
+ * Feature by which dualband capable PEERs will be
+ * forced move on 5GHz interface
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $ Copyright Cypress Semiconductor $
+ *
+ * $Id: dhd_bandsteer.c 664149 2017-03-07 13:29:02Z $
+ */
+
+#include <typedefs.h>
+#include <linuxver.h>
+#include <osl.h>
+#include <linux/kernel.h>
+#include <linux/time.h>
+#include <bcmutils.h>
+#include <net/cfg80211.h>
+#include <net/rtnetlink.h>
+#include <wl_cfg80211.h>
+#include <wl_android.h>
+#include <wldev_common.h>
+#include <dhd_linux_wq.h>
+#include <dhd_cfg80211.h>
+#include <dhd_bandsteer.h>
+#include <dhd_dbg.h>
+
+/* defines */
+/* BANDSTEER STATE MACHINE STATES */
+#define DHD_BANDSTEER_START                    0x0001
+#define DHD_BANDSTEER_WNM_FRAME_SEND           0x0002
+#define DHD_BANDSTEER_WNM_FRAME_RETRY          0x0004
+#define DHD_BANDSTEER_WNM_FRAME_SENT           0x0008
+#define DHD_BANDSTEER_TRIAL_DONE               0x0080
+
+#define DHD_BANDSTEER_ON_PROCESS_MASK (DHD_BANDSTEER_START | DHD_BANDSTEER_WNM_FRAME_SEND \
+       | DHD_BANDSTEER_WNM_FRAME_RETRY | DHD_BANDSTEER_TRIAL_DONE)
+
+#define DHD_BANDSTEER_WNM_FRAME_MAXRETRY 3
+#define DHD_BANDSTEER_WNM_FRAME_DELAY 1000
+#define MAX_NUM_OF_ASSOCLIST    64
+#define DHD_BANDSTEER_MAXIFACES 2
+
+#define CHANNEL_IS_5G(channel)  (((channel >= 36) && (channel <= 165)) ? \
+true : false)
+
+/* ********************** Function declaration *********************** */
+static s32
+dhd_bandsteer_addmac_to_monitorlist(dhd_bandsteer_context_t *dhd_bandsteer_cntx,  uint8 *mac_addr);
+static s32
+dhd_bandsteer_remove_mac_from_list(dhd_bandsteer_mac_entry_t *dhd_bandsteer_mac, int all);
+static dhd_bandsteer_mac_entry_t*
+dhd_bandsteer_look_for_match(dhd_bandsteer_context_t *dhd_bandsteer_cntx, uint8 *mac_addr);
+static s32
+dhd_bandsteer_tx_wnm_actframe(dhd_bandsteer_mac_entry_t *dhd_bandsteer_mac);
+static void
+dhd_bandsteer_add_to_black_list(dhd_bandsteer_mac_entry_t *dhd_bandsteer_mac);
+
+extern int
+wl_android_set_ap_mac_list(struct net_device *dev, int macmode, struct maclist *maclist);
+
+/* ********************** Function declartion ends ****************** */
+
+static void
+dhd_bandsteer_add_timer(dhd_bandsteer_mac_entry_t *dhd_bandsteer_mac, unsigned long expires)
+{
+       dhd_bandsteer_mac->dhd_bandsteer_timer.expires = jiffies + msecs_to_jiffies(expires);
+       add_timer(&dhd_bandsteer_mac->dhd_bandsteer_timer);
+}
+
+static void
+dhd_bandsteer_delete_timer(dhd_bandsteer_mac_entry_t *dhd_bandsteer_mac)
+{
+       del_timer(&dhd_bandsteer_mac->dhd_bandsteer_timer);
+}
+
+/*
+ * Idea used to call same callback everytime you conifigure timer
+ * based on the status of the mac entry next step will be taken
+ */
+static void
+dhd_bandsteer_state_machine(ulong arg)
+{
+       dhd_bandsteer_mac_entry_t *dhd_bandsteer_mac = (dhd_bandsteer_mac_entry_t *)arg;
+
+       if (dhd_bandsteer_mac == NULL) {
+               DHD_ERROR(("%s: dhd_bandsteer_mac is null\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_TRACE(("%s: Peer STA BandSteer status 0x%x", __FUNCTION__,
+                       dhd_bandsteer_mac->dhd_bandsteer_status));
+
+       switch (dhd_bandsteer_mac->dhd_bandsteer_status) {
+       case DHD_BANDSTEER_START:
+       case DHD_BANDSTEER_WNM_FRAME_RETRY:
+               dhd_bandsteer_mac->dhd_bandsteer_status = DHD_BANDSTEER_WNM_FRAME_SEND;
+               dhd_bandsteer_schedule_work_on_timeout(dhd_bandsteer_mac);
+               break;
+
+       case  DHD_BANDSTEER_WNM_FRAME_SEND:
+               dhd_bandsteer_tx_wnm_actframe(dhd_bandsteer_mac);
+               if (dhd_bandsteer_mac->wnm_frame_counter < DHD_BANDSTEER_WNM_FRAME_MAXRETRY) {
+                       /* Sending out WNM action frame as soon as assoc indication recieved */
+                       dhd_bandsteer_mac->dhd_bandsteer_status = DHD_BANDSTEER_WNM_FRAME_RETRY;
+               }
+               else {
+                       dhd_bandsteer_mac->dhd_bandsteer_status = DHD_BANDSTEER_TRIAL_DONE;
+               }
+               break;
+       case DHD_BANDSTEER_TRIAL_DONE:
+               dhd_bandsteer_remove_mac_from_list(dhd_bandsteer_mac, 0);
+               break;
+       }
+       return;
+}
+
+void
+dhd_bandsteer_workqueue_wrapper(void *handle, void *event_info, u8 event)
+{
+       dhd_bandsteer_mac_entry_t *dhd_bandsteer_mac = (dhd_bandsteer_mac_entry_t *)event_info;
+
+       if (event != DHD_WQ_WORK_BANDSTEER_STEP_MOVE) {
+               DHD_ERROR(("%s: unexpected event \n", __FUNCTION__));
+               return;
+       }
+
+       dhd_bandsteer_state_machine((ulong)dhd_bandsteer_mac);
+}
+
+/*
+ *     This API create and initilize an entry into list which need to be processed later
+ */
+static s32
+dhd_bandsteer_addmac_to_monitorlist(dhd_bandsteer_context_t *dhd_bandsteer_cntx,  uint8 *mac_addr)
+{
+       dhd_bandsteer_mac_entry_t *dhd_bandsteer_mac;
+
+       dhd_bandsteer_mac = kzalloc(sizeof(dhd_bandsteer_mac_entry_t), GFP_KERNEL);
+       if (unlikely(!dhd_bandsteer_mac)) {
+               DHD_ERROR(("%s: alloc failed\n", __FUNCTION__));
+               return BCME_NOMEM;
+       }
+       INIT_LIST_HEAD(&dhd_bandsteer_mac->list);
+       /* pointer dhd_bandsteer_cntx for future use */
+       dhd_bandsteer_mac->dhd_bandsteer_cntx = dhd_bandsteer_cntx;
+
+       dhd_bandsteer_mac->dhd_bandsteer_status = DHD_BANDSTEER_START;
+
+       memcpy(&dhd_bandsteer_mac->mac_addr.octet, mac_addr, ETHER_ADDR_LEN);
+
+       /* Configure timer for 20 Sec */
+       init_timer(&dhd_bandsteer_mac->dhd_bandsteer_timer);
+       dhd_bandsteer_mac->dhd_bandsteer_timer.data = (ulong)dhd_bandsteer_mac;
+       dhd_bandsteer_mac->dhd_bandsteer_timer.function = dhd_bandsteer_state_machine;
+       dhd_bandsteer_mac->wnm_frame_counter = 0;
+
+       /* Add new entry into the list */
+       list_add_tail(&dhd_bandsteer_mac->list,
+                       &dhd_bandsteer_cntx->dhd_bandsteer_monitor_list);
+
+       DHD_TRACE(("%s: " MACDBG " added into list \n", __FUNCTION__,
+                       MAC2STRDBG(dhd_bandsteer_mac->mac_addr.octet)));
+       /* This can be tweaked more */
+       dhd_bandsteer_add_timer(dhd_bandsteer_mac, DHD_BANDSTEER_WNM_FRAME_DELAY);
+
+       return BCME_OK;
+}
+
+/*
+ * This function removes one or all mac entry from the list
+ */
+static s32
+dhd_bandsteer_remove_mac_from_list(dhd_bandsteer_mac_entry_t *dhd_bandsteer_mac, int all)
+{
+       dhd_bandsteer_context_t *dhd_bandsteer_cntx;
+       dhd_bandsteer_mac_entry_t *curr, *next;
+
+       DHD_INFO(("%s: entered \n", __FUNCTION__));
+       /* TODO:probably these sanity lines can be removed */
+       if (dhd_bandsteer_mac == NULL) {
+               DHD_ERROR(("%s: dhd_bandsteer_mac is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       dhd_bandsteer_cntx = dhd_bandsteer_mac->dhd_bandsteer_cntx;
+
+       list_for_each_entry_safe(curr, next,
+                       &dhd_bandsteer_cntx->dhd_bandsteer_monitor_list, list) {
+               if ((curr == dhd_bandsteer_mac) || all) {
+                       DHD_ERROR(("%s: " MACDBG " deleted from list \n", __FUNCTION__,
+                                       MAC2STRDBG(dhd_bandsteer_mac->mac_addr.octet)));
+                       list_del(&dhd_bandsteer_mac->list);
+                       dhd_bandsteer_delete_timer(dhd_bandsteer_mac);
+                       kfree(dhd_bandsteer_mac);
+                       if (!all)
+                               break;
+               }
+       }
+       return BCME_OK;
+}
+
+/*
+ * Logic to find corresponding node in list based given mac address
+ * Returns null if entry not seen
+ */
+static dhd_bandsteer_mac_entry_t*
+dhd_bandsteer_look_for_match(dhd_bandsteer_context_t *dhd_bandsteer_cntx, uint8 *mac_addr)
+{
+       dhd_bandsteer_mac_entry_t *curr = NULL, *next = NULL;
+
+       list_for_each_entry_safe(curr, next,
+                       &dhd_bandsteer_cntx->dhd_bandsteer_monitor_list, list) {
+               if (memcmp(&curr->mac_addr.octet, mac_addr, ETHER_ADDR_LEN) == 0) {
+                       return curr;
+               }
+       }
+       return NULL;
+}
+
+/*
+ * This API will send wnm action frame also configure timeout timer
+ */
+static s32
+dhd_bandsteer_tx_wnm_actframe(dhd_bandsteer_mac_entry_t *dhd_bandsteer_mac)
+{
+       dhd_bandsteer_context_t *dhd_bandsteer_cntx = dhd_bandsteer_mac->dhd_bandsteer_cntx;
+       wl_action_frame_t *action_frame = NULL;
+       wl_af_params_t *af_params = NULL;
+       char *smbuf = NULL;
+       int error = BCME_ERROR;
+       uint8 *bp;
+       dhd_bandsteer_iface_info_t *if_info_5g, *if_info_2g;
+
+       if_info_5g = &dhd_bandsteer_cntx->bsd_ifaces[dhd_bandsteer_cntx->ifidx_5g];
+       if_info_2g = &dhd_bandsteer_cntx->bsd_ifaces[!dhd_bandsteer_cntx->ifidx_5g];
+
+       smbuf = kzalloc(WLC_IOCTL_MAXLEN, GFP_KERNEL);
+       if (smbuf == NULL) {
+               DHD_ERROR(("%s: failed to allocated memory %d bytes\n", __FUNCTION__,
+                               WLC_IOCTL_MAXLEN));
+               goto send_action_frame_out;
+       }
+
+       af_params = (wl_af_params_t *) kzalloc(WL_WIFI_AF_PARAMS_SIZE, GFP_KERNEL);
+       if (af_params == NULL) {
+               DHD_ERROR(("%s: unable to allocate frame\n", __FUNCTION__));
+               goto send_action_frame_out;
+       }
+
+       af_params->channel = if_info_2g->channel;
+       af_params->dwell_time = -1;
+       memcpy(&af_params->BSSID, &dhd_bandsteer_mac->mac_addr.octet, ETHER_ADDR_LEN);
+       action_frame = &af_params->action_frame;
+
+       action_frame->packetId = 0;
+       memcpy(&action_frame->da, &dhd_bandsteer_mac->mac_addr.octet, ETHER_ADDR_LEN);
+
+       dhd_bandsteer_mac->wnm_frame_counter++;
+       bp = (uint8 *)action_frame->data;
+       *bp++ = 0xa; /* Category */
+       *bp++ = 0x7; /* Action ID */
+       *bp++ = dhd_bandsteer_mac->wnm_frame_counter; /* Dialog Token */
+       *bp++ = 0x1; /* Request mode */
+       *bp++ = 0x0; /* disassociation timer has two bytes */
+       *bp++ = 0x0;
+       *bp++ = 0x0; /* Validity interval */
+       *bp++ = 0x34; /* Element ID */
+       *bp++ = 0xd; /* Len */
+       memcpy(bp, if_info_5g->macaddr.octet, ETHER_ADDR_LEN);
+       bp += ETHER_ADDR_LEN;
+       bp +=4; /* Skip BSSID info 4 bytes in size */
+       *bp++ = 0x7d; /* Operating class */
+       *bp++ = if_info_5g->channel; /* Channel number */
+       *bp = 0x0; /* Phy Type */
+
+       action_frame->len = (bp - (uint8 *)&action_frame->data) + 1;
+
+       error = wldev_iovar_setbuf(if_info_2g->ndev, "actframe", af_params,
+                       sizeof(wl_af_params_t), smbuf, WLC_IOCTL_MAXLEN, NULL);
+       if (error) {
+               DHD_ERROR(("Failed to set action frame, error=%d\n", error));
+               goto send_action_frame_out;
+       }
+       DHD_TRACE(("%s: BSS Trans Req frame sent to " MACDBG " try %d\n", __FUNCTION__,
+                       MAC2STRDBG(dhd_bandsteer_mac->mac_addr.octet),
+                       dhd_bandsteer_mac->wnm_frame_counter));
+
+send_action_frame_out:
+       /* Re-schedule the timer */
+       dhd_bandsteer_add_timer(dhd_bandsteer_mac, DHD_BANDSTEER_WNM_FRAME_DELAY);
+       if (af_params)
+               kfree(af_params);
+
+       if (smbuf)
+               kfree(smbuf);
+
+       if (error)
+               return BCME_ERROR;
+
+       return BCME_OK;
+}
+
+/*
+ * Call dhd_bandsteer_remove_mac_from_list()
+ * Add into black list of corresponding interace at present 2.4
+ * Uses existing IOVAR calls
+ */
+static void
+dhd_bandsteer_add_to_black_list(dhd_bandsteer_mac_entry_t *dhd_bandsteer_mac)
+{
+       dhd_bandsteer_context_t *dhd_bandsteer_cntx = dhd_bandsteer_mac->dhd_bandsteer_cntx;
+       dhd_bandsteer_iface_info_t *if_info_2g;
+       int err;
+       int macmode = MACLIST_MODE_DENY;
+       struct maclist *maclist;
+       uint8 *pmaclist_ea;
+       uint8 mac_buf[MAX_NUM_OF_ASSOCLIST *
+               sizeof(struct ether_addr) + sizeof(uint)] = {0};
+
+       if_info_2g = &dhd_bandsteer_cntx->bsd_ifaces[!dhd_bandsteer_cntx->ifidx_5g];
+
+       /* Black listing */
+       DHD_INFO(("%s: Black listing " MACDBG " on 2GHz IF\n", __FUNCTION__,
+                       MAC2STRDBG(dhd_bandsteer_mac->mac_addr.octet)));
+
+       /* Get current black list */
+       if ((err = wldev_ioctl(if_info_2g->ndev, WLC_GET_MACLIST, mac_buf,
+                       sizeof(mac_buf), false)) != 0) {
+               DHD_ERROR(("%s: WLC_GET_MACLIST error=%d\n", __FUNCTION__, err));
+       }
+
+       maclist = (struct maclist *)mac_buf;
+       pmaclist_ea = (uint8*) mac_buf +
+                       (sizeof(struct ether_addr) * maclist->count) + sizeof(uint);
+       maclist->count++;
+
+       memcpy(pmaclist_ea, &dhd_bandsteer_mac->mac_addr.octet, ETHER_ADDR_LEN);
+
+       if ((err = wldev_iovar_setint(if_info_2g->ndev, "probresp_mac_filter", 1)) != BCME_OK) {
+               DHD_ERROR(("%s: failed to set probe response filter err %d\n", __FUNCTION__, err));
+       }
+
+       if ((err = wldev_ioctl(if_info_2g->ndev, WLC_SET_MACMODE, &macmode,
+                       sizeof(macmode), true)) != 0) {
+               DHD_ERROR(("%s: WLC_SET_MACMODE error=%d\n", __FUNCTION__, err));
+       }
+
+       /* set the MAC filter list */
+       if ((err = wldev_ioctl(if_info_2g->ndev, WLC_SET_MACLIST, maclist,
+                       sizeof(int) + sizeof(struct ether_addr) * maclist->count, true)) != 0) {
+               DHD_ERROR(("%s: WLC_SET_MACLIST error=%d\n", __FUNCTION__, err));
+       }
+}
+
+/*
+ * Check if mac association on 2.4 G
+ * If on 2.4
+ *      * Ignore if we have already run Bandsteer cycle for this
+ *     * Add PEER STA mac monitor_list
+ *     * Send BSS transition request frame
+ * Else
+ *     * We recieved assoc on 5g from Mac we forced to move onto 5G
+ */
+s32
+dhd_bandsteer_trigger_bandsteer(struct net_device *ndev, uint8 *mac_addr)
+{
+       struct wireless_dev *__wdev = (struct wireless_dev *)(ndev)->ieee80211_ptr;
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)wiphy_priv(__wdev->wiphy);
+       struct net_device *netdev_5g = NULL;
+       dhd_bandsteer_mac_entry_t *dhd_bandsteer_mac = NULL;
+       dhd_bandsteer_context_t *dhd_bandsteer_cntx = NULL;
+
+       DHD_TRACE(("%s: Start band-steer procedure for " MACDBG "\n", __FUNCTION__,
+                       MAC2STRDBG(mac_addr)));
+
+       if (cfg == NULL) {
+               DHD_ERROR(("%s: bcmcfg is null\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+       if (cfg->dhd_bandsteer_cntx == NULL) {
+               DHD_ERROR(("%s: Band Steering not enabled\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       dhd_bandsteer_cntx = cfg->dhd_bandsteer_cntx;
+
+       netdev_5g = dhd_bandsteer_cntx->bsd_ifaces[dhd_bandsteer_cntx->ifidx_5g].ndev;
+       dhd_bandsteer_mac = dhd_bandsteer_look_for_match(dhd_bandsteer_cntx, mac_addr);
+       if (dhd_bandsteer_mac == NULL) {
+               /*
+                * This STA entry not found in list check if  bandsteer is already done for this
+                * Check if this on 2.4/5Ghz
+                */
+               if (ndev == netdev_5g) {
+                       /* Ignore as device aleady connectd to 5G */
+                       DHD_INFO(("%s: " MACDBG " is on 5GHz interface\n", __FUNCTION__,
+                        MAC2STRDBG(mac_addr)));
+                       return BCME_OK;
+               }
+               else {
+                       dhd_bandsteer_addmac_to_monitorlist(dhd_bandsteer_cntx, mac_addr);
+                       /*
+                        * TODO: Time for us to enable PROB_REQ MSG
+                        */
+               }
+       }
+       else {
+               /*
+                * Start post connect process as bandsteer is successful  for this entry
+                */
+               if (ndev  == netdev_5g) {
+                       DHD_INFO(("%s: Band Steer for " MACDBG " successful\n", __FUNCTION__,
+                                       MAC2STRDBG(mac_addr)));
+                       dhd_bandsteer_add_to_black_list(dhd_bandsteer_mac);
+                       dhd_bandsteer_remove_mac_from_list(dhd_bandsteer_mac, 0);
+                       /* Probabaly add this mac into black list */
+               }
+       }
+       return BCME_OK;
+}
+
+
+
+s32
+dhd_bandsteer_module_init(struct net_device *ndev)
+{
+       /* Initialize */
+       dhd_bandsteer_context_t *dhd_bandsteer_cntx = NULL;
+       struct channel_info ci;
+       uint8 ifidx;
+       struct wireless_dev *__wdev = (struct wireless_dev *)(ndev)->ieee80211_ptr;
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)wiphy_priv(__wdev->wiphy);
+       int err;
+
+       DHD_INFO(("%s: entered\n", __FUNCTION__));
+
+       if (cfg == NULL) {
+               DHD_ERROR(("%s: bcmcfg is  null\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       if (cfg->dhd_bandsteer_cntx != NULL) {
+               DHD_ERROR(("%s: Band Steering already enabled\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       dhd_bandsteer_cntx = (dhd_bandsteer_context_t *)kzalloc(sizeof(dhd_bandsteer_context_t),
+                       GFP_KERNEL);
+       if (unlikely(!dhd_bandsteer_cntx)) {
+               DHD_ERROR(("%s: dhd_bandsteer_cntx alloc failed\n", __FUNCTION__));
+               return BCME_NOMEM;
+       }
+
+       if (dhd_bandsteer_get_ifaces(cfg->pub, &dhd_bandsteer_cntx->bsd_ifaces)) {
+               DHD_ERROR(("%s: AP interfaces count != 2", __FUNCTION__));
+               err = BCME_ERROR;
+               goto failed;
+       }
+
+       for (ifidx = 0; ifidx < DHD_BANDSTEER_MAXIFACES; ifidx++) {
+               err = wldev_iovar_getbuf_bsscfg(dhd_bandsteer_cntx->bsd_ifaces[ifidx].ndev,
+                        "cur_etheraddr", NULL, 0, cfg->ioctl_buf,
+                               WLC_IOCTL_SMLEN, 0, &cfg->ioctl_buf_sync);
+               if (err) {
+                       DHD_ERROR(("%s: Failed to get mac address\n", __FUNCTION__));
+                       goto failed;
+               }
+
+               memcpy(dhd_bandsteer_cntx->bsd_ifaces[ifidx].macaddr.octet,
+                               cfg->ioctl_buf, ETHER_ADDR_LEN);
+
+               memset(&ci, 0, sizeof(struct channel_info));
+               err = wldev_ioctl(dhd_bandsteer_cntx->bsd_ifaces[ifidx].ndev, WLC_GET_CHANNEL,
+                               &ci, sizeof(ci), false);
+               if (err) {
+                       DHD_ERROR(("%s: Failed to get channel\n", __FUNCTION__));
+                       goto failed;
+               }
+               if (CHANNEL_IS_5G(ci.hw_channel))
+                       dhd_bandsteer_cntx->ifidx_5g = ifidx;
+
+               dhd_bandsteer_cntx->bsd_ifaces[ifidx].channel = ci.hw_channel;
+       }
+
+       /* Enable software proberesponse on 2GHz interface */
+       if ((err = wldev_iovar_setint(
+                       dhd_bandsteer_cntx->bsd_ifaces[!dhd_bandsteer_cntx->ifidx_5g].ndev,
+                       "probresp_sw", 1)) != BCME_OK) {
+               DHD_ERROR(("%s: Failed to enable software ProbeRsp err = %d\n", __FUNCTION__, err));
+       }
+
+       if ((err = wldev_iovar_setint(ndev, "bandsteer", 1)) != BCME_OK) {
+               DHD_ERROR(("%s: Failed to enable bandsteer in FW err = %d\n", __FUNCTION__, err));
+       }
+
+
+       INIT_LIST_HEAD(&dhd_bandsteer_cntx->dhd_bandsteer_monitor_list);
+       dhd_bandsteer_cntx->dhd_pub = cfg->pub;
+       cfg->dhd_bandsteer_cntx = (void *) dhd_bandsteer_cntx;
+       return BCME_OK;
+
+failed:
+       kfree(dhd_bandsteer_cntx);
+       return err;
+}
+
+s32
+dhd_bandsteer_module_deinit(struct net_device *ndev)
+{
+       dhd_bandsteer_mac_entry_t *dhd_bandsteer_mac = NULL;
+       dhd_bandsteer_context_t *dhd_bandsteer_cntx = NULL;
+       struct wireless_dev *__wdev = (struct wireless_dev *)(ndev)->ieee80211_ptr;
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)wiphy_priv(__wdev->wiphy);
+       int macmode = MACLIST_MODE_DISABLED;
+       int err;
+       struct maclist maclist;
+
+       DHD_INFO(("%s: entered\n", __FUNCTION__));
+
+       if (cfg == NULL) {
+               DHD_ERROR(("%s: bcmcfg is null\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       if (cfg->dhd_bandsteer_cntx == NULL) {
+               DHD_ERROR(("%s: Band Steering not enabled\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       dhd_bandsteer_cntx = cfg->dhd_bandsteer_cntx;
+
+       /* Disable mac filter */
+       if ((err = wldev_ioctl(dhd_bandsteer_cntx->bsd_ifaces[!dhd_bandsteer_cntx->ifidx_5g].ndev,
+                       WLC_SET_MACMODE, &macmode, sizeof(macmode), true)) != 0) {
+               DHD_ERROR(("%s: WLC_SET_MACMODE error=%d\n", __FUNCTION__, err));
+       }
+
+       /* Set the MAC filter list */
+       memset(&maclist, 0, sizeof(struct maclist));
+       if ((err = wldev_ioctl(dhd_bandsteer_cntx->bsd_ifaces[!dhd_bandsteer_cntx->ifidx_5g].ndev,
+                       WLC_SET_MACLIST, &maclist, sizeof(struct maclist), true)) != 0) {
+               DHD_ERROR(("%s: WLC_SET_MACLIST error=%d\n", __FUNCTION__, err));
+       }
+
+       /* Disable software proberesponse on 2GHz interface */
+       if ((err = wldev_iovar_setint(
+                       dhd_bandsteer_cntx->bsd_ifaces[!dhd_bandsteer_cntx->ifidx_5g].ndev,
+                       "probresp_sw", 0)) != BCME_OK) {
+               DHD_ERROR(("%s: Failed to disable software ProbeRsp err = %d\n",
+                               __FUNCTION__, err));
+       }
+
+       if ((err = wldev_iovar_setint(ndev, "bandsteer", 0)) != BCME_OK) {
+               DHD_ERROR(("%s: Failed to disable bandsteer in FW err = %d\n", __FUNCTION__, err));
+       }
+
+       /* Get the first element of the list & pass it to remove */
+       if (dhd_bandsteer_cntx->dhd_bandsteer_monitor_list.next  !=
+                       &dhd_bandsteer_cntx->dhd_bandsteer_monitor_list) {
+               dhd_bandsteer_mac = (dhd_bandsteer_mac_entry_t *)list_entry(
+                               dhd_bandsteer_cntx->dhd_bandsteer_monitor_list.next,
+                               dhd_bandsteer_mac_entry_t, list);
+       }
+
+       if (dhd_bandsteer_mac) {
+               dhd_bandsteer_remove_mac_from_list(dhd_bandsteer_mac, 1);
+       }
+
+       kfree(dhd_bandsteer_cntx);
+       cfg->dhd_bandsteer_cntx = NULL;
+       return BCME_OK;
+}
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_bandsteer.h b/drivers/net/wireless/bcmdhd_1363/dhd_bandsteer.h
new file mode 100644 (file)
index 0000000..0467cbf
--- /dev/null
@@ -0,0 +1,75 @@
+/*
+ * Band Steering logic
+ *
+ * Feature by which dualband capable PEERs will be
+ * forced move on 5GHz interface
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $ Copyright Cypress Semiconductor $
+ *
+ * $Id: dhd_bandsteer.h 664149 2017-03-07 13:29:02Z $
+ */
+
+#ifndef _dhd_bandsteer_h_
+#define _dhd_bandsteer_h_
+
+/* Local Types */
+typedef struct dhd_bandsteer_context dhd_bandsteer_context_t;
+
+typedef struct dhd_bandsteer_iface_info {
+       s32 bssidx;
+       s32 channel;
+       struct ether_addr macaddr;
+       struct net_device *ndev;
+} dhd_bandsteer_iface_info_t;
+
+typedef struct dhd_bandsteer_mac_entry {
+       struct list_head list;  // Pointer to head of the list
+       uint32 dhd_bandsteer_status;    // Usefull in timer call back
+       dhd_bandsteer_context_t *dhd_bandsteer_cntx;
+       struct timer_list dhd_bandsteer_timer;  // Callback to Advance BS STATEMACHINE
+       uint8 wnm_frame_counter;
+       struct ether_addr mac_addr;
+} dhd_bandsteer_mac_entry_t;
+
+struct dhd_bandsteer_context {
+       struct list_head dhd_bandsteer_monitor_list;
+       uint8 ifidx_5g;
+       dhd_bandsteer_iface_info_t bsd_ifaces[2]; /* idx 0 5G, 1 2G */
+       void *dhd_pub;
+};
+
+/* Local Types ends */
+
+/* ********************** Function declaration *********************** */
+void dhd_bandsteer_process_disassoc(dhd_bandsteer_context_t *dhd_bandsteer_cntx,
+       const wl_event_msg_t *e);
+s32 dhd_bandsteer_module_init(struct net_device *ndev);
+s32 dhd_bandsteer_module_deinit(struct net_device *ndev);
+void dhd_bandsteer_schedule_work_on_timeout(dhd_bandsteer_mac_entry_t *dhd_bandsteer_mac);
+void dhd_bandsteer_workqueue_wrapper(void *handle, void *event_info, u8 event);
+s32 dhd_bandsteer_get_ifaces(void *pub, void *ifaces);
+s32 dhd_bandsteer_trigger_bandsteer(struct net_device *, uint8 *);
+/* ********************** Function declartion ends ****************** */
+#endif /*  _dhd_bandsteer_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_bta.c b/drivers/net/wireless/bcmdhd_1363/dhd_bta.c
new file mode 100644 (file)
index 0000000..1c2be05
--- /dev/null
@@ -0,0 +1,340 @@
+/*
+ * BT-AMP support routines
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_bta.c 514727 2014-11-12 03:02:48Z $
+ */
+#error "WLBTAMP is not defined"
+
+#include <typedefs.h>
+#include <osl.h>
+#include <bcmcdc.h>
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <proto/802.11.h>
+#include <proto/802.11_bta.h>
+#include <proto/bt_amp_hci.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_bus.h>
+#include <dhd_proto.h>
+#include <dhdioctl.h>
+#include <dhd_dbg.h>
+
+#include <dhd_bta.h>
+
+
+#ifdef SEND_HCI_CMD_VIA_IOCTL
+#define BTA_HCI_CMD_MAX_LEN HCI_CMD_PREAMBLE_SIZE + HCI_CMD_DATA_SIZE
+
+/* Send HCI cmd via wl iovar HCI_cmd to the dongle. */
+int
+dhd_bta_docmd(dhd_pub_t *pub, void *cmd_buf, uint cmd_len)
+{
+       amp_hci_cmd_t *cmd = (amp_hci_cmd_t *)cmd_buf;
+       uint8 buf[BTA_HCI_CMD_MAX_LEN + 16];
+       uint len = sizeof(buf);
+       wl_ioctl_t ioc;
+
+       if (cmd_len < HCI_CMD_PREAMBLE_SIZE)
+               return BCME_BADLEN;
+
+       if ((uint)cmd->plen + HCI_CMD_PREAMBLE_SIZE > cmd_len)
+               return BCME_BADLEN;
+
+       len = bcm_mkiovar("HCI_cmd",
+               (char *)cmd, (uint)cmd->plen + HCI_CMD_PREAMBLE_SIZE, (char *)buf, len);
+
+
+       memset(&ioc, 0, sizeof(ioc));
+
+       ioc.cmd = WLC_SET_VAR;
+       ioc.buf = buf;
+       ioc.len = len;
+       ioc.set = TRUE;
+
+       return dhd_wl_ioctl(pub, &ioc, ioc.buf, ioc.len);
+}
+#else /* !SEND_HCI_CMD_VIA_IOCTL */
+
+static void
+dhd_bta_flush_hcidata(dhd_pub_t *pub, uint16 llh)
+{
+       int prec;
+       struct pktq *q;
+       uint count = 0;
+
+       q = dhd_bus_txq(pub->bus);
+       if (q == NULL)
+               return;
+
+       DHD_BTA(("dhd: flushing HCI ACL data for logical link %u...\n", llh));
+
+       dhd_os_sdlock_txq(pub);
+
+       /* Walk through the txq and toss all HCI ACL data packets */
+       PKTQ_PREC_ITER(q, prec) {
+               void *head_pkt = NULL;
+
+               while (pktq_ppeek(q, prec) != head_pkt) {
+                       void *pkt = pktq_pdeq(q, prec);
+                       int ifidx;
+
+                       dhd_prot_hdrpull(pub, &ifidx, pkt, NULL, NULL);
+
+                       if (PKTLEN(pub->osh, pkt) >= RFC1042_HDR_LEN) {
+                               struct ether_header *eh =
+                                       (struct ether_header *)PKTDATA(pub->osh, pkt);
+
+                               if (ntoh16(eh->ether_type) < ETHER_TYPE_MIN) {
+                                       struct dot11_llc_snap_header *lsh =
+                                               (struct dot11_llc_snap_header *)&eh[1];
+
+                                       if (bcmp(lsh, BT_SIG_SNAP_MPROT,
+                                                DOT11_LLC_SNAP_HDR_LEN - 2) == 0 &&
+                                           ntoh16(lsh->type) == BTA_PROT_L2CAP) {
+                                               amp_hci_ACL_data_t *ACL_data =
+                                                       (amp_hci_ACL_data_t *)&lsh[1];
+                                               uint16 handle = ltoh16(ACL_data->handle);
+
+                                               if (HCI_ACL_DATA_HANDLE(handle) == llh) {
+                                                       PKTFREE(pub->osh, pkt, TRUE);
+                                                       count ++;
+                                                       continue;
+                                               }
+                                       }
+                               }
+                       }
+
+                       dhd_prot_hdrpush(pub, ifidx, pkt);
+
+                       if (head_pkt == NULL)
+                               head_pkt = pkt;
+                       pktq_penq(q, prec, pkt);
+               }
+       }
+
+       dhd_os_sdunlock_txq(pub);
+
+       DHD_BTA(("dhd: flushed %u packet(s) for logical link %u...\n", count, llh));
+}
+
+/* Handle HCI cmd locally.
+ * Return 0: continue to send the cmd across SDIO
+ *        < 0: stop, fail
+ *        > 0: stop, succuess
+ */
+static int
+_dhd_bta_docmd(dhd_pub_t *pub, amp_hci_cmd_t *cmd)
+{
+       int status = 0;
+
+       switch (ltoh16_ua((uint8 *)&cmd->opcode)) {
+       case HCI_Enhanced_Flush: {
+               eflush_cmd_parms_t *cmdparms = (eflush_cmd_parms_t *)cmd->parms;
+               dhd_bta_flush_hcidata(pub, ltoh16_ua(cmdparms->llh));
+               break;
+       }
+       default:
+               break;
+       }
+
+       return status;
+}
+
+/* Send HCI cmd encapsulated in BT-SIG frame via data channel to the dongle. */
+int
+dhd_bta_docmd(dhd_pub_t *pub, void *cmd_buf, uint cmd_len)
+{
+       amp_hci_cmd_t *cmd = (amp_hci_cmd_t *)cmd_buf;
+       struct ether_header *eh;
+       struct dot11_llc_snap_header *lsh;
+       osl_t *osh = pub->osh;
+       uint len;
+       void *p;
+       int status;
+
+       if (cmd_len < HCI_CMD_PREAMBLE_SIZE) {
+               DHD_ERROR(("dhd_bta_docmd: short command, cmd_len %u\n", cmd_len));
+               return BCME_BADLEN;
+       }
+
+       if ((len = (uint)cmd->plen + HCI_CMD_PREAMBLE_SIZE) > cmd_len) {
+               DHD_ERROR(("dhd_bta_docmd: malformed command, len %u cmd_len %u\n",
+                          len, cmd_len));
+               /* return BCME_BADLEN; */
+       }
+
+       p = PKTGET(osh, pub->hdrlen + RFC1042_HDR_LEN + len, TRUE);
+       if (p == NULL) {
+               DHD_ERROR(("dhd_bta_docmd: out of memory\n"));
+               return BCME_NOMEM;
+       }
+
+
+       /* intercept and handle the HCI cmd locally */
+       if ((status = _dhd_bta_docmd(pub, cmd)) > 0)
+               return 0;
+       else if (status < 0)
+               return status;
+
+       /* copy in HCI cmd */
+       PKTPULL(osh, p, pub->hdrlen + RFC1042_HDR_LEN);
+       bcopy(cmd, PKTDATA(osh, p), len);
+
+       /* copy in partial Ethernet header with BT-SIG LLC/SNAP header */
+       PKTPUSH(osh, p, RFC1042_HDR_LEN);
+       eh = (struct ether_header *)PKTDATA(osh, p);
+       bzero(eh->ether_dhost, ETHER_ADDR_LEN);
+       ETHER_SET_LOCALADDR(eh->ether_dhost);
+       bcopy(&pub->mac, eh->ether_shost, ETHER_ADDR_LEN);
+       eh->ether_type = hton16(len + DOT11_LLC_SNAP_HDR_LEN);
+       lsh = (struct dot11_llc_snap_header *)&eh[1];
+       bcopy(BT_SIG_SNAP_MPROT, lsh, DOT11_LLC_SNAP_HDR_LEN - 2);
+       lsh->type = 0;
+
+       return dhd_sendpkt(pub, 0, p);
+}
+#endif /* !SEND_HCI_CMD_VIA_IOCTL */
+
+/* Send HCI ACL data to dongle via data channel */
+int
+dhd_bta_tx_hcidata(dhd_pub_t *pub, void *data_buf, uint data_len)
+{
+       amp_hci_ACL_data_t *data = (amp_hci_ACL_data_t *)data_buf;
+       struct ether_header *eh;
+       struct dot11_llc_snap_header *lsh;
+       osl_t *osh = pub->osh;
+       uint len;
+       void *p;
+
+       if (data_len < HCI_ACL_DATA_PREAMBLE_SIZE) {
+               DHD_ERROR(("dhd_bta_tx_hcidata: short data_buf, data_len %u\n", data_len));
+               return BCME_BADLEN;
+       }
+
+       if ((len = (uint)ltoh16(data->dlen) + HCI_ACL_DATA_PREAMBLE_SIZE) > data_len) {
+               DHD_ERROR(("dhd_bta_tx_hcidata: malformed hci data, len %u data_len %u\n",
+                          len, data_len));
+               /* return BCME_BADLEN; */
+       }
+
+       p = PKTGET(osh, pub->hdrlen + RFC1042_HDR_LEN + len, TRUE);
+       if (p == NULL) {
+               DHD_ERROR(("dhd_bta_tx_hcidata: out of memory\n"));
+               return BCME_NOMEM;
+       }
+
+
+       /* copy in HCI ACL data header and HCI ACL data */
+       PKTPULL(osh, p, pub->hdrlen + RFC1042_HDR_LEN);
+       bcopy(data, PKTDATA(osh, p), len);
+
+       /* copy in partial Ethernet header with BT-SIG LLC/SNAP header */
+       PKTPUSH(osh, p, RFC1042_HDR_LEN);
+       eh = (struct ether_header *)PKTDATA(osh, p);
+       bzero(eh->ether_dhost, ETHER_ADDR_LEN);
+       bcopy(&pub->mac, eh->ether_shost, ETHER_ADDR_LEN);
+       eh->ether_type = hton16(len + DOT11_LLC_SNAP_HDR_LEN);
+       lsh = (struct dot11_llc_snap_header *)&eh[1];
+       bcopy(BT_SIG_SNAP_MPROT, lsh, DOT11_LLC_SNAP_HDR_LEN - 2);
+       lsh->type = HTON16(BTA_PROT_L2CAP);
+
+       return dhd_sendpkt(pub, 0, p);
+}
+
+/* txcomplete callback */
+void
+dhd_bta_tx_hcidata_complete(dhd_pub_t *dhdp, void *txp, bool success)
+{
+       uint8 *pktdata = (uint8 *)PKTDATA(dhdp->osh, txp);
+       amp_hci_ACL_data_t *ACL_data = (amp_hci_ACL_data_t *)(pktdata + RFC1042_HDR_LEN);
+       uint16 handle = ltoh16(ACL_data->handle);
+       uint16 llh = HCI_ACL_DATA_HANDLE(handle);
+
+       wl_event_msg_t event;
+       uint8 data[HCI_EVT_PREAMBLE_SIZE + sizeof(num_completed_data_blocks_evt_parms_t)];
+       amp_hci_event_t *evt;
+       num_completed_data_blocks_evt_parms_t *parms;
+
+       uint16 len = HCI_EVT_PREAMBLE_SIZE + sizeof(num_completed_data_blocks_evt_parms_t);
+
+       /* update the event struct */
+       memset(&event, 0, sizeof(event));
+       event.version = hton16(BCM_EVENT_MSG_VERSION);
+       event.event_type = hton32(WLC_E_BTA_HCI_EVENT);
+       event.status = 0;
+       event.reason = 0;
+       event.auth_type = 0;
+       event.datalen = hton32(len);
+       event.flags = 0;
+
+       /* generate Number of Completed Blocks event */
+       evt = (amp_hci_event_t *)data;
+       evt->ecode = HCI_Number_of_Completed_Data_Blocks;
+       evt->plen = sizeof(num_completed_data_blocks_evt_parms_t);
+
+       parms = (num_completed_data_blocks_evt_parms_t *)evt->parms;
+       htol16_ua_store(dhdp->maxdatablks, (uint8 *)&parms->num_blocks);
+       parms->num_handles = 1;
+       htol16_ua_store(llh, (uint8 *)&parms->completed[0].handle);
+       parms->completed[0].pkts = 1;
+       parms->completed[0].blocks = 1;
+
+       dhd_sendup_event_common(dhdp, &event, data);
+}
+
+/* event callback */
+void
+dhd_bta_doevt(dhd_pub_t *dhdp, void *data_buf, uint data_len)
+{
+       amp_hci_event_t *evt = (amp_hci_event_t *)data_buf;
+
+       ASSERT(dhdp);
+       ASSERT(evt);
+
+       switch (evt->ecode) {
+       case HCI_Command_Complete: {
+               cmd_complete_parms_t *parms = (cmd_complete_parms_t *)evt->parms;
+               switch (ltoh16_ua((uint8 *)&parms->opcode)) {
+               case HCI_Read_Data_Block_Size: {
+                       read_data_block_size_evt_parms_t *parms2 =
+                               (read_data_block_size_evt_parms_t *)parms->parms;
+                       dhdp->maxdatablks = ltoh16_ua((uint8 *)&parms2->data_block_num);
+                       break;
+               }
+               }
+               break;
+       }
+
+       case HCI_Flush_Occurred: {
+               flush_occurred_evt_parms_t *evt_parms = (flush_occurred_evt_parms_t *)evt->parms;
+               dhd_bta_flush_hcidata(dhdp, ltoh16_ua((uint8 *)&evt_parms->handle));
+               break;
+       }
+       default:
+               break;
+       }
+}
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_bta.h b/drivers/net/wireless/bcmdhd_1363/dhd_bta.h
new file mode 100644 (file)
index 0000000..dcb5e65
--- /dev/null
@@ -0,0 +1,42 @@
+/*
+ * BT-AMP support routines
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_bta.h 514727 2014-11-12 03:02:48Z $
+ */
+#ifndef __dhd_bta_h__
+#define __dhd_bta_h__
+
+struct dhd_pub;
+
+extern int dhd_bta_docmd(struct dhd_pub *pub, void *cmd_buf, uint cmd_len);
+
+extern void dhd_bta_doevt(struct dhd_pub *pub, void *data_buf, uint data_len);
+
+extern int dhd_bta_tx_hcidata(struct dhd_pub *pub, void *data_buf, uint data_len);
+extern void dhd_bta_tx_hcidata_complete(struct dhd_pub *dhdp, void *txp, bool success);
+
+
+#endif /* __dhd_bta_h__ */
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_bus.h b/drivers/net/wireless/bcmdhd_1363/dhd_bus.h
new file mode 100644 (file)
index 0000000..679e208
--- /dev/null
@@ -0,0 +1,220 @@
+/*
+ * Header file describing the internal (inter-module) DHD interfaces.
+ *
+ * Provides type definitions and function prototypes used to link the
+ * DHD OS, bus, and protocol modules.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_bus.h 647154 2016-07-04 07:23:19Z $
+ */
+
+#ifndef _dhd_bus_h_
+#define _dhd_bus_h_
+
+/*
+ * Exported from dhd bus module (dhd_usb, dhd_sdio)
+ */
+
+/* Indicate (dis)interest in finding dongles. */
+extern int dhd_bus_register(void);
+extern void dhd_bus_unregister(void);
+
+/* Download firmware image and nvram image */
+extern int dhd_bus_download_firmware(struct dhd_bus *bus, osl_t *osh, char *fw_path, char *nv_path);
+
+/* Stop bus module: clear pending frames, disable data flow */
+extern void dhd_bus_stop(struct dhd_bus *bus, bool enforce_mutex);
+
+/* Initialize bus module: prepare for communication w/dongle */
+extern int dhd_bus_init(dhd_pub_t *dhdp, bool enforce_mutex);
+
+/* Get the Bus Idle Time */
+extern void dhd_bus_getidletime(dhd_pub_t *dhdp, int *idletime);
+
+/* Set the Bus Idle Time */
+extern void dhd_bus_setidletime(dhd_pub_t *dhdp, int idle_time);
+
+/* Send a data frame to the dongle.  Callee disposes of txp. */
+#ifdef BCMPCIE
+extern int dhd_bus_txdata(struct dhd_bus *bus, void *txp, uint8 ifidx);
+#else
+extern int dhd_bus_txdata(struct dhd_bus *bus, void *txp);
+#endif
+
+
+/* Send/receive a control message to/from the dongle.
+ * Expects caller to enforce a single outstanding transaction.
+ */
+extern int dhd_bus_txctl(struct dhd_bus *bus, uchar *msg, uint msglen);
+extern int dhd_bus_rxctl(struct dhd_bus *bus, uchar *msg, uint msglen);
+
+/* Watchdog timer function */
+extern bool dhd_bus_watchdog(dhd_pub_t *dhd);
+
+extern int dhd_bus_oob_intr_register(dhd_pub_t *dhdp);
+extern void dhd_bus_oob_intr_unregister(dhd_pub_t *dhdp);
+extern void dhd_bus_oob_intr_set(dhd_pub_t *dhdp, bool enable);
+extern void dhd_bus_dev_pm_stay_awake(dhd_pub_t *dhdpub);
+extern void dhd_bus_dev_pm_relax(dhd_pub_t *dhdpub);
+extern bool dhd_bus_dev_pm_enabled(dhd_pub_t *dhdpub);
+
+#if defined(DHD_DEBUG)
+/* Device console input function */
+extern int dhd_bus_console_in(dhd_pub_t *dhd, uchar *msg, uint msglen);
+#endif /* defined(DHD_DEBUG) */
+
+/* Deferred processing for the bus, return TRUE requests reschedule */
+extern bool dhd_bus_dpc(struct dhd_bus *bus);
+extern void dhd_bus_isr(bool * InterruptRecognized, bool * QueueMiniportHandleInterrupt, void *arg);
+
+
+/* Check for and handle local prot-specific iovar commands */
+extern int dhd_bus_iovar_op(dhd_pub_t *dhdp, const char *name,
+                            void *params, int plen, void *arg, int len, bool set);
+
+/* Add bus dump output to a buffer */
+extern void dhd_bus_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf);
+
+/* Clear any bus counters */
+extern void dhd_bus_clearcounts(dhd_pub_t *dhdp);
+
+/* return the dongle chipid */
+extern uint dhd_bus_chip(struct dhd_bus *bus);
+
+/* return the dongle chiprev */
+extern uint dhd_bus_chiprev(struct dhd_bus *bus);
+
+/* Set user-specified nvram parameters. */
+extern void dhd_bus_set_nvram_params(struct dhd_bus * bus, const char *nvram_params);
+
+extern void *dhd_bus_pub(struct dhd_bus *bus);
+extern void *dhd_bus_txq(struct dhd_bus *bus);
+extern void *dhd_bus_sih(struct dhd_bus *bus);
+extern uint dhd_bus_hdrlen(struct dhd_bus *bus);
+#ifdef BCMSDIO
+extern void dhd_bus_set_dotxinrx(struct dhd_bus *bus, bool val);
+/* return sdio io status */
+extern uint8 dhd_bus_is_ioready(struct dhd_bus *bus);
+#else
+#define dhd_bus_set_dotxinrx(a, b) do {} while (0)
+#endif
+
+#define DHD_SET_BUS_STATE_DOWN(_bus)  do { \
+       (_bus)->dhd->busstate = DHD_BUS_DOWN; \
+} while (0)
+
+/* Register a dummy SDIO client driver in order to be notified of new SDIO device */
+extern int dhd_bus_reg_sdio_notify(void* semaphore);
+extern void dhd_bus_unreg_sdio_notify(void);
+extern void dhd_txglom_enable(dhd_pub_t *dhdp, bool enable);
+extern int dhd_bus_get_ids(struct dhd_bus *bus, uint32 *bus_type, uint32 *bus_num,
+       uint32 *slot_num);
+
+#ifdef BCMPCIE
+enum {
+       /* Scratch buffer confiuguration update */
+       D2H_DMA_SCRATCH_BUF,
+       D2H_DMA_SCRATCH_BUF_LEN,
+
+       /* DMA Indices array buffers for: H2D WR and RD, and D2H WR and RD */
+       H2D_DMA_INDX_WR_BUF, /* update H2D WR dma indices buf base addr to dongle */
+       H2D_DMA_INDX_RD_BUF, /* update H2D RD dma indices buf base addr to dongle */
+       D2H_DMA_INDX_WR_BUF, /* update D2H WR dma indices buf base addr to dongle */
+       D2H_DMA_INDX_RD_BUF, /* update D2H RD dma indices buf base addr to dongle */
+
+       /* DHD sets/gets WR or RD index, in host's H2D and D2H DMA indices buffer */
+       H2D_DMA_INDX_WR_UPD, /* update H2D WR index in H2D WR dma indices buf */
+       H2D_DMA_INDX_RD_UPD, /* update H2D RD index in H2D RD dma indices buf */
+       D2H_DMA_INDX_WR_UPD, /* update D2H WR index in D2H WR dma indices buf */
+       D2H_DMA_INDX_RD_UPD, /* update D2H RD index in D2H RD dma indices buf */
+
+       /* H2D and D2H Mailbox data update */
+       H2D_MB_DATA,
+       D2H_MB_DATA,
+
+       /* (Common) MsgBuf Ring configuration update */
+       RING_BUF_ADDR,       /* update ring base address to dongle */
+       RING_ITEM_LEN,       /* update ring item size to dongle */
+       RING_MAX_ITEMS,      /* update ring max items to dongle */
+
+       /* Update of WR or RD index, for a MsgBuf Ring */
+       RING_RD_UPD,         /* update ring read index from/to dongle */
+       RING_WR_UPD,         /* update ring write index from/to dongle */
+
+       TOTAL_LFRAG_PACKET_CNT,
+       MAX_HOST_RXBUFS
+};
+
+typedef void (*dhd_mb_ring_t) (struct dhd_bus *, uint32);
+extern void dhd_bus_cmn_writeshared(struct dhd_bus *bus, void * data, uint32 len, uint8 type,
+       uint16 ringid);
+extern void dhd_bus_ringbell(struct dhd_bus *bus, uint32 value);
+extern void dhd_bus_cmn_readshared(struct dhd_bus *bus, void* data, uint8 type, uint16 ringid);
+extern uint32 dhd_bus_get_sharedflags(struct dhd_bus *bus);
+extern void dhd_bus_rx_frame(struct dhd_bus *bus, void* pkt, int ifidx, uint pkt_count);
+extern void dhd_bus_start_queue(struct dhd_bus *bus);
+extern void dhd_bus_stop_queue(struct dhd_bus *bus);
+
+extern dhd_mb_ring_t dhd_bus_get_mbintr_fn(struct dhd_bus *bus);
+extern void dhd_bus_write_flow_ring_states(struct dhd_bus *bus,
+       void * data, uint16 flowid);
+extern void dhd_bus_read_flow_ring_states(struct dhd_bus *bus,
+       void * data, uint8 flowid);
+extern int dhd_bus_flow_ring_create_request(struct dhd_bus *bus, void *flow_ring_node);
+extern void dhd_bus_clean_flow_ring(struct dhd_bus *bus, void *flow_ring_node);
+extern void dhd_bus_flow_ring_create_response(struct dhd_bus *bus, uint16 flow_id, int32 status);
+extern int dhd_bus_flow_ring_delete_request(struct dhd_bus *bus, void *flow_ring_node);
+extern void dhd_bus_flow_ring_delete_response(struct dhd_bus *bus, uint16 flowid, uint32 status);
+extern int dhd_bus_flow_ring_flush_request(struct dhd_bus *bus, void *flow_ring_node);
+extern void dhd_bus_flow_ring_flush_response(struct dhd_bus *bus, uint16 flowid, uint32 status);
+extern uint32 dhd_bus_max_h2d_queues(struct dhd_bus *bus);
+extern int dhd_bus_schedule_queue(struct dhd_bus *bus, uint16 flow_id, bool txs);
+extern void dhd_bus_set_linkdown(dhd_pub_t *dhdp, bool val);
+
+
+extern int dhdpcie_bus_clock_start(struct dhd_bus *bus);
+extern int dhdpcie_bus_clock_stop(struct dhd_bus *bus);
+extern int dhdpcie_bus_enable_device(struct dhd_bus *bus);
+extern int dhdpcie_bus_disable_device(struct dhd_bus *bus);
+extern int dhdpcie_bus_alloc_resource(struct dhd_bus *bus);
+extern void dhdpcie_bus_free_resource(struct dhd_bus *bus);
+extern bool dhdpcie_bus_dongle_attach(struct dhd_bus *bus);
+extern int dhd_bus_release_dongle(struct dhd_bus *bus);
+extern int dhd_bus_request_irq(struct dhd_bus *bus);
+
+
+#ifdef DHD_FW_COREDUMP
+extern int dhd_bus_mem_dump(dhd_pub_t *dhd);
+
+extern struct dhd_bus *g_dhd_bus;
+#ifdef BCMDHDX
+extern int dhdx_dongle_mem_dump(void);
+#else
+extern int dhd_dongle_mem_dump(void);
+#endif /* BCMDHDX */
+#endif /* DHD_FW_COREDUMP */
+
+#endif /* BCMPCIE */
+#endif /* _dhd_bus_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_buzzz.h b/drivers/net/wireless/bcmdhd_1363/dhd_buzzz.h
new file mode 100644 (file)
index 0000000..879a3dd
--- /dev/null
@@ -0,0 +1,37 @@
+#ifndef _DHD_BUZZZ_H_INCLUDED_
+#define _DHD_BUZZZ_H_INCLUDED_
+
+/*
+ * Broadcom logging system - Empty implementaiton
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_buzzz.h 591283 2015-10-07 11:52:00Z $
+ */
+
+#define dhd_buzzz_attach()              do { /* noop */ } while (0)
+#define dhd_buzzz_detach()              do { /* noop */ } while (0)
+#define dhd_buzzz_panic(x)              do { /* noop */ } while (0)
+#define BUZZZ_LOG(ID, N, ARG...)    do { /* noop */ } while (0)
+
+#endif /* _DHD_BUZZZ_H_INCLUDED_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_cdc.c b/drivers/net/wireless/bcmdhd_1363/dhd_cdc.c
new file mode 100644 (file)
index 0000000..7f341b6
--- /dev/null
@@ -0,0 +1,814 @@
+/*
+ * DHD Protocol Module for CDC and BDC.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_cdc.c 633939 2016-04-26 06:55:52Z $
+ *
+ * BDC is like CDC, except it includes a header for data packets to convey
+ * packet priority over the bus, and flags (e.g. to indicate checksum status
+ * for dongle offload.)
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+
+#include <bcmutils.h>
+#include <bcmcdc.h>
+#include <bcmendian.h>
+
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_proto.h>
+#include <dhd_bus.h>
+#include <dhd_dbg.h>
+
+
+#ifdef PROP_TXSTATUS
+#include <wlfc_proto.h>
+#include <dhd_wlfc.h>
+#endif
+
+
+#define RETRIES 2              /* # of retries to retrieve matching ioctl response */
+#define BUS_HEADER_LEN (24+DHD_SDALIGN)        /* Must be at least SDPCM_RESERVE
+                                * defined in dhd_sdio.c (amount of header tha might be added)
+                                * plus any space that might be needed for alignment padding.
+                                */
+#define ROUND_UP_MARGIN        2048    /* Biggest SDIO block size possible for
+                                * round off at the end of buffer
+                                */
+
+typedef struct dhd_prot {
+       uint16 reqid;
+       uint8 pending;
+       uint32 lastcmd;
+       uint8 bus_header[BUS_HEADER_LEN];
+       cdc_ioctl_t msg;
+       unsigned char buf[WLC_IOCTL_MAXLEN + ROUND_UP_MARGIN];
+} dhd_prot_t;
+
+
+static int
+dhdcdc_msg(dhd_pub_t *dhd)
+{
+       int err = 0;
+       dhd_prot_t *prot = dhd->prot;
+       int len = ltoh32(prot->msg.len) + sizeof(cdc_ioctl_t);
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       DHD_OS_WAKE_LOCK(dhd);
+
+       /* NOTE : cdc->msg.len holds the desired length of the buffer to be
+        *        returned. Only up to CDC_MAX_MSG_SIZE of this buffer area
+        *        is actually sent to the dongle
+        */
+       if (len > CDC_MAX_MSG_SIZE)
+               len = CDC_MAX_MSG_SIZE;
+
+       /* Send request */
+       err = dhd_bus_txctl(dhd->bus, (uchar*)&prot->msg, len);
+
+       DHD_OS_WAKE_UNLOCK(dhd);
+       return err;
+}
+
+static int
+dhdcdc_cmplt(dhd_pub_t *dhd, uint32 id, uint32 len)
+{
+       int ret;
+       int cdc_len = len + sizeof(cdc_ioctl_t);
+       dhd_prot_t *prot = dhd->prot;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       do {
+               ret = dhd_bus_rxctl(dhd->bus, (uchar*)&prot->msg, cdc_len);
+               if (ret < 0)
+                       break;
+       } while (CDC_IOC_ID(ltoh32(prot->msg.flags)) != id);
+
+       return ret;
+}
+
+static int
+dhdcdc_query_ioctl(dhd_pub_t *dhd, int ifidx, uint cmd, void *buf, uint len, uint8 action)
+{
+       dhd_prot_t *prot = dhd->prot;
+       cdc_ioctl_t *msg = &prot->msg;
+       int ret = 0, retries = 0;
+       uint32 id, flags = 0;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+       DHD_CTL(("%s: cmd %d len %d\n", __FUNCTION__, cmd, len));
+
+
+       /* Respond "bcmerror" and "bcmerrorstr" with local cache */
+       if (cmd == WLC_GET_VAR && buf)
+       {
+               if (!strcmp((char *)buf, "bcmerrorstr"))
+               {
+                       strncpy((char *)buf, bcmerrorstr(dhd->dongle_error), BCME_STRLEN);
+                       goto done;
+               }
+               else if (!strcmp((char *)buf, "bcmerror"))
+               {
+                       *(int *)buf = dhd->dongle_error;
+                       goto done;
+               }
+       }
+
+       memset(msg, 0, sizeof(cdc_ioctl_t));
+
+       msg->cmd = htol32(cmd);
+       msg->len = htol32(len);
+       msg->flags = (++prot->reqid << CDCF_IOC_ID_SHIFT);
+       CDC_SET_IF_IDX(msg, ifidx);
+       /* add additional action bits */
+       action &= WL_IOCTL_ACTION_MASK;
+       msg->flags |= (action << CDCF_IOC_ACTION_SHIFT);
+       msg->flags = htol32(msg->flags);
+
+       if (buf)
+               memcpy(prot->buf, buf, len);
+
+       if ((ret = dhdcdc_msg(dhd)) < 0) {
+               if (!dhd->hang_was_sent)
+               DHD_ERROR(("dhdcdc_query_ioctl: dhdcdc_msg failed w/status %d\n", ret));
+               goto done;
+       }
+
+retry:
+       /* wait for interrupt and get first fragment */
+       if ((ret = dhdcdc_cmplt(dhd, prot->reqid, len)) < 0)
+               goto done;
+
+       flags = ltoh32(msg->flags);
+       id = (flags & CDCF_IOC_ID_MASK) >> CDCF_IOC_ID_SHIFT;
+
+       if ((id < prot->reqid) && (++retries < RETRIES))
+               goto retry;
+       if (id != prot->reqid) {
+               DHD_ERROR(("%s: %s: unexpected request id %d (expected %d)\n",
+                          dhd_ifname(dhd, ifidx), __FUNCTION__, id, prot->reqid));
+               ret = -EINVAL;
+               goto done;
+       }
+
+       /* Copy info buffer */
+       if (buf)
+       {
+               if (ret < (int)len)
+                       len = ret;
+               memcpy(buf, (void*) prot->buf, len);
+       }
+
+       /* Check the ERROR flag */
+       if (flags & CDCF_IOC_ERROR)
+       {
+               ret = ltoh32(msg->status);
+               /* Cache error from dongle */
+               dhd->dongle_error = ret;
+       }
+
+done:
+       return ret;
+}
+
+
+static int
+dhdcdc_set_ioctl(dhd_pub_t *dhd, int ifidx, uint cmd, void *buf, uint len, uint8 action)
+{
+       dhd_prot_t *prot = dhd->prot;
+       cdc_ioctl_t *msg = &prot->msg;
+       int ret = 0;
+       uint32 flags, id;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+       DHD_CTL(("%s: cmd %d len %d\n", __FUNCTION__, cmd, len));
+
+       if (dhd->busstate == DHD_BUS_DOWN) {
+               DHD_ERROR(("%s : bus is down. we have nothing to do\n", __FUNCTION__));
+               return -EIO;
+       }
+
+       /* don't talk to the dongle if fw is about to be reloaded */
+       if (dhd->hang_was_sent) {
+               DHD_ERROR(("%s: HANG was sent up earlier. Not talking to the chip\n",
+                       __FUNCTION__));
+               return -EIO;
+       }
+
+       if (cmd == WLC_SET_PM) {
+               DHD_TRACE_HW4(("%s: SET PM to %d\n", __FUNCTION__, *(char *)buf));
+       }
+
+       memset(msg, 0, sizeof(cdc_ioctl_t));
+
+       msg->cmd = htol32(cmd);
+       msg->len = htol32(len);
+       msg->flags = (++prot->reqid << CDCF_IOC_ID_SHIFT);
+       CDC_SET_IF_IDX(msg, ifidx);
+       /* add additional action bits */
+       action &= WL_IOCTL_ACTION_MASK;
+       msg->flags |= (action << CDCF_IOC_ACTION_SHIFT) | CDCF_IOC_SET;
+       msg->flags = htol32(msg->flags);
+
+       if (buf)
+               memcpy(prot->buf, buf, len);
+
+       if ((ret = dhdcdc_msg(dhd)) < 0) {
+               DHD_ERROR(("%s: dhdcdc_msg failed w/status %d\n", __FUNCTION__, ret));
+               goto done;
+       }
+
+       if ((ret = dhdcdc_cmplt(dhd, prot->reqid, len)) < 0)
+               goto done;
+
+       flags = ltoh32(msg->flags);
+       id = (flags & CDCF_IOC_ID_MASK) >> CDCF_IOC_ID_SHIFT;
+
+       if (id != prot->reqid) {
+               DHD_ERROR(("%s: %s: unexpected request id %d (expected %d)\n",
+                          dhd_ifname(dhd, ifidx), __FUNCTION__, id, prot->reqid));
+               ret = -EINVAL;
+               goto done;
+       }
+
+       /* Check the ERROR flag */
+       if (flags & CDCF_IOC_ERROR)
+       {
+               ret = ltoh32(msg->status);
+               /* Cache error from dongle */
+               dhd->dongle_error = ret;
+       }
+
+done:
+       return ret;
+}
+
+
+int
+dhd_prot_ioctl(dhd_pub_t *dhd, int ifidx, wl_ioctl_t * ioc, void * buf, int len)
+{
+       dhd_prot_t *prot = dhd->prot;
+       int ret = -1;
+       uint8 action;
+
+       if ((dhd->busstate == DHD_BUS_DOWN) || dhd->hang_was_sent) {
+               DHD_ERROR(("%s : bus is down. we have nothing to do\n", __FUNCTION__));
+               goto done;
+       }
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       ASSERT(len <= WLC_IOCTL_MAXLEN);
+
+       if (len > WLC_IOCTL_MAXLEN)
+               goto done;
+
+       if (prot->pending == TRUE) {
+               DHD_ERROR(("CDC packet is pending!!!! cmd=0x%x (%lu) lastcmd=0x%x (%lu)\n",
+                       ioc->cmd, (unsigned long)ioc->cmd, prot->lastcmd,
+                       (unsigned long)prot->lastcmd));
+               if ((ioc->cmd == WLC_SET_VAR) || (ioc->cmd == WLC_GET_VAR)) {
+                       DHD_TRACE(("iovar cmd=%s\n", (char*)buf));
+               }
+               goto done;
+       }
+
+       prot->pending = TRUE;
+       prot->lastcmd = ioc->cmd;
+       action = ioc->set;
+       if (action & WL_IOCTL_ACTION_SET)
+               ret = dhdcdc_set_ioctl(dhd, ifidx, ioc->cmd, buf, len, action);
+       else {
+               ret = dhdcdc_query_ioctl(dhd, ifidx, ioc->cmd, buf, len, action);
+               if (ret > 0)
+                       ioc->used = ret - sizeof(cdc_ioctl_t);
+       }
+
+       /* Too many programs assume ioctl() returns 0 on success */
+       if (ret >= 0)
+               ret = 0;
+       else {
+               cdc_ioctl_t *msg = &prot->msg;
+               ioc->needed = ltoh32(msg->len); /* len == needed when set/query fails from dongle */
+       }
+
+       /* Intercept the wme_dp ioctl here */
+       if ((!ret) && (ioc->cmd == WLC_SET_VAR) && (!strcmp(buf, "wme_dp"))) {
+               int slen, val = 0;
+
+               slen = strlen("wme_dp") + 1;
+               if (len >= (int)(slen + sizeof(int)))
+                       bcopy(((char *)buf + slen), &val, sizeof(int));
+               dhd->wme_dp = (uint8) ltoh32(val);
+       }
+
+       prot->pending = FALSE;
+
+done:
+
+       return ret;
+}
+
+int
+dhd_prot_iovar_op(dhd_pub_t *dhdp, const char *name,
+                  void *params, int plen, void *arg, int len, bool set)
+{
+       return BCME_UNSUPPORTED;
+}
+
+void
+dhd_prot_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf)
+{
+       if (!dhdp || !dhdp->prot)
+               return;
+       bcm_bprintf(strbuf, "Protocol CDC: reqid %d\n", dhdp->prot->reqid);
+#ifdef PROP_TXSTATUS
+       dhd_wlfc_dump(dhdp, strbuf);
+#endif
+}
+
+/*     The FreeBSD PKTPUSH could change the packet buf pinter
+       so we need to make it changable
+*/
+#define PKTBUF pktbuf
+void
+dhd_prot_hdrpush(dhd_pub_t *dhd, int ifidx, void *PKTBUF)
+{
+#ifdef BDC
+       struct bdc_header *h;
+#endif /* BDC */
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+#ifdef BDC
+       /* Push BDC header used to convey priority for buses that don't */
+
+       PKTPUSH(dhd->osh, PKTBUF, BDC_HEADER_LEN);
+
+       h = (struct bdc_header *)PKTDATA(dhd->osh, PKTBUF);
+
+       h->flags = (BDC_PROTO_VER << BDC_FLAG_VER_SHIFT);
+       if (PKTSUMNEEDED(PKTBUF))
+               h->flags |= BDC_FLAG_SUM_NEEDED;
+
+
+       h->priority = (PKTPRIO(PKTBUF) & BDC_PRIORITY_MASK);
+       h->flags2 = 0;
+       h->dataOffset = 0;
+#endif /* BDC */
+       BDC_SET_IF_IDX(h, ifidx);
+}
+#undef PKTBUF  /* Only defined in the above routine */
+
+uint
+dhd_prot_hdrlen(dhd_pub_t *dhd, void *PKTBUF)
+{
+       uint hdrlen = 0;
+#ifdef BDC
+       /* Length of BDC(+WLFC) headers pushed */
+       hdrlen = BDC_HEADER_LEN + (((struct bdc_header *)PKTBUF)->dataOffset * 4);
+#endif
+       return hdrlen;
+}
+
+int
+dhd_prot_hdrpull(dhd_pub_t *dhd, int *ifidx, void *pktbuf, uchar *reorder_buf_info,
+       uint *reorder_info_len)
+{
+#ifdef BDC
+       struct bdc_header *h;
+#endif
+       uint8 data_offset = 0;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+#ifdef BDC
+       if (reorder_info_len)
+               *reorder_info_len = 0;
+       /* Pop BDC header used to convey priority for buses that don't */
+
+       if (PKTLEN(dhd->osh, pktbuf) < BDC_HEADER_LEN) {
+               DHD_ERROR(("%s: rx data too short (%d < %d)\n", __FUNCTION__,
+                          PKTLEN(dhd->osh, pktbuf), BDC_HEADER_LEN));
+               return BCME_ERROR;
+       }
+
+       h = (struct bdc_header *)PKTDATA(dhd->osh, pktbuf);
+
+       if (!ifidx) {
+               /* for tx packet, skip the analysis */
+               data_offset = h->dataOffset;
+               PKTPULL(dhd->osh, pktbuf, BDC_HEADER_LEN);
+               goto exit;
+       }
+
+       *ifidx = BDC_GET_IF_IDX(h);
+
+       if (((h->flags & BDC_FLAG_VER_MASK) >> BDC_FLAG_VER_SHIFT) != BDC_PROTO_VER) {
+               DHD_ERROR(("%s: non-BDC packet received, flags = 0x%x\n",
+                          dhd_ifname(dhd, *ifidx), h->flags));
+               if (((h->flags & BDC_FLAG_VER_MASK) >> BDC_FLAG_VER_SHIFT) == BDC_PROTO_VER_1)
+                       h->dataOffset = 0;
+               else
+               return BCME_ERROR;
+       }
+
+       if (h->flags & BDC_FLAG_SUM_GOOD) {
+               DHD_INFO(("%s: BDC packet received with good rx-csum, flags 0x%x\n",
+                         dhd_ifname(dhd, *ifidx), h->flags));
+               PKTSETSUMGOOD(pktbuf, TRUE);
+       }
+
+       PKTSETPRIO(pktbuf, (h->priority & BDC_PRIORITY_MASK));
+       data_offset = h->dataOffset;
+       PKTPULL(dhd->osh, pktbuf, BDC_HEADER_LEN);
+#endif /* BDC */
+
+
+#ifdef PROP_TXSTATUS
+       if (!DHD_PKTTAG_PKTDIR(PKTTAG(pktbuf))) {
+               /*
+               - parse txstatus only for packets that came from the firmware
+               */
+               dhd_wlfc_parse_header_info(dhd, pktbuf, (data_offset << 2),
+                       reorder_buf_info, reorder_info_len);
+
+       }
+#endif /* PROP_TXSTATUS */
+
+exit:
+       PKTPULL(dhd->osh, pktbuf, (data_offset << 2));
+       return 0;
+}
+
+
+int
+dhd_prot_attach(dhd_pub_t *dhd)
+{
+       dhd_prot_t *cdc;
+
+       if (!(cdc = (dhd_prot_t *)DHD_OS_PREALLOC(dhd, DHD_PREALLOC_PROT, sizeof(dhd_prot_t)))) {
+               DHD_ERROR(("%s: kmalloc failed\n", __FUNCTION__));
+               goto fail;
+       }
+       memset(cdc, 0, sizeof(dhd_prot_t));
+
+       /* ensure that the msg buf directly follows the cdc msg struct */
+       if ((uintptr)(&cdc->msg + 1) != (uintptr)cdc->buf) {
+               DHD_ERROR(("dhd_prot_t is not correctly defined\n"));
+               goto fail;
+       }
+
+       dhd->prot = cdc;
+#ifdef BDC
+       dhd->hdrlen += BDC_HEADER_LEN;
+#endif
+       dhd->maxctl = WLC_IOCTL_MAXLEN + sizeof(cdc_ioctl_t) + ROUND_UP_MARGIN;
+       return 0;
+
+fail:
+       if (cdc != NULL)
+               DHD_OS_PREFREE(dhd, cdc, sizeof(dhd_prot_t));
+       return BCME_NOMEM;
+}
+
+/* ~NOTE~ What if another thread is waiting on the semaphore?  Holding it? */
+void
+dhd_prot_detach(dhd_pub_t *dhd)
+{
+#ifdef PROP_TXSTATUS
+       dhd_wlfc_deinit(dhd);
+#endif
+       DHD_OS_PREFREE(dhd, dhd->prot, sizeof(dhd_prot_t));
+       dhd->prot = NULL;
+}
+
+void
+dhd_prot_dstats(dhd_pub_t *dhd)
+{
+       /*  copy bus stats */
+
+       dhd->dstats.tx_packets = dhd->tx_packets;
+       dhd->dstats.tx_errors = dhd->tx_errors;
+       dhd->dstats.rx_packets = dhd->rx_packets;
+       dhd->dstats.rx_errors = dhd->rx_errors;
+       dhd->dstats.rx_dropped = dhd->rx_dropped;
+       dhd->dstats.multicast = dhd->rx_multicast;
+       return;
+}
+
+int
+dhd_sync_with_dongle(dhd_pub_t *dhd)
+{
+       int ret = 0;
+       wlc_rev_info_t revinfo;
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+#ifdef BCMASSERT_LOG
+       dhd_get_assert_info(dhd);
+#endif /* BCMASSERT_LOG */
+
+       /* Get the device rev info */
+       memset(&revinfo, 0, sizeof(revinfo));
+       ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_REVINFO, &revinfo, sizeof(revinfo), FALSE, 0);
+       if (ret < 0)
+               goto done;
+
+
+       dhd_process_cid_mac(dhd, TRUE);
+       ret = dhd_preinit_ioctls(dhd);
+       dhd_process_cid_mac(dhd, FALSE);
+
+       /* Always assumes wl for now */
+       dhd->iswl = TRUE;
+
+done:
+       return ret;
+}
+
+int dhd_prot_init(dhd_pub_t *dhd)
+{
+       return BCME_OK;
+}
+
+void
+dhd_prot_stop(dhd_pub_t *dhd)
+{
+/* Nothing to do for CDC */
+}
+
+
+static void
+dhd_get_hostreorder_pkts(void *osh, struct reorder_info *ptr, void **pkt,
+       uint32 *pkt_count, void **pplast, uint8 start, uint8 end)
+{
+       void *plast = NULL, *p;
+       uint32 pkt_cnt = 0;
+
+       if (ptr->pend_pkts == 0) {
+               DHD_REORDER(("%s: no packets in reorder queue \n", __FUNCTION__));
+               *pplast = NULL;
+               *pkt_count = 0;
+               *pkt = NULL;
+               return;
+       }
+       do {
+               p = (void *)(ptr->p[start]);
+               ptr->p[start] = NULL;
+
+               if (p != NULL) {
+                       if (plast == NULL)
+                               *pkt = p;
+                       else
+                               PKTSETNEXT(osh, plast, p);
+
+                       plast = p;
+                       pkt_cnt++;
+               }
+               start++;
+               if (start > ptr->max_idx)
+                       start = 0;
+       } while (start != end);
+       *pplast = plast;
+       *pkt_count = pkt_cnt;
+       ptr->pend_pkts -= (uint8)pkt_cnt;
+}
+
+int
+dhd_process_pkt_reorder_info(dhd_pub_t *dhd, uchar *reorder_info_buf, uint reorder_info_len,
+       void **pkt, uint32 *pkt_count)
+{
+       uint8 flow_id, max_idx, cur_idx, exp_idx;
+       struct reorder_info *ptr;
+       uint8 flags;
+       void *cur_pkt, *plast = NULL;
+       uint32 cnt = 0;
+
+       if (pkt == NULL) {
+               if (pkt_count != NULL)
+                       *pkt_count = 0;
+               return 0;
+       }
+
+       flow_id = reorder_info_buf[WLHOST_REORDERDATA_FLOWID_OFFSET];
+       flags = reorder_info_buf[WLHOST_REORDERDATA_FLAGS_OFFSET];
+
+       DHD_REORDER(("flow_id %d, flags 0x%02x, idx(%d, %d, %d)\n", flow_id, flags,
+               reorder_info_buf[WLHOST_REORDERDATA_CURIDX_OFFSET],
+               reorder_info_buf[WLHOST_REORDERDATA_EXPIDX_OFFSET],
+               reorder_info_buf[WLHOST_REORDERDATA_MAXIDX_OFFSET]));
+
+       /* validate flags and flow id */
+       if (flags == 0xFF) {
+               DHD_ERROR(("%s: invalid flags...so ignore this packet\n", __FUNCTION__));
+               *pkt_count = 1;
+               return 0;
+       }
+
+       cur_pkt = *pkt;
+       *pkt = NULL;
+
+       ptr = dhd->reorder_bufs[flow_id];
+       if (flags & WLHOST_REORDERDATA_DEL_FLOW) {
+               uint32 buf_size = sizeof(struct reorder_info);
+
+               DHD_REORDER(("%s: Flags indicating to delete a flow id %d\n",
+                       __FUNCTION__, flow_id));
+
+               if (ptr == NULL) {
+                       DHD_REORDER(("%s: received flags to cleanup, but no flow (%d) yet\n",
+                               __FUNCTION__, flow_id));
+                       *pkt_count = 1;
+                       *pkt = cur_pkt;
+                       return 0;
+               }
+
+               dhd_get_hostreorder_pkts(dhd->osh, ptr, pkt, &cnt, &plast,
+                       ptr->exp_idx, ptr->exp_idx);
+               /* set it to the last packet */
+               if (plast) {
+                       PKTSETNEXT(dhd->osh, plast, cur_pkt);
+                       cnt++;
+               }
+               else {
+                       if (cnt != 0) {
+                               DHD_ERROR(("%s: del flow: something fishy, pending packets %d\n",
+                                       __FUNCTION__, cnt));
+                       }
+                       *pkt = cur_pkt;
+                       cnt = 1;
+               }
+               buf_size += ((ptr->max_idx + 1) * sizeof(void *));
+               MFREE(dhd->osh, ptr, buf_size);
+               dhd->reorder_bufs[flow_id] = NULL;
+               *pkt_count = cnt;
+               return 0;
+       }
+       /* all the other cases depend on the existance of the reorder struct for that flow id */
+       if (ptr == NULL) {
+               uint32 buf_size_alloc = sizeof(reorder_info_t);
+               max_idx = reorder_info_buf[WLHOST_REORDERDATA_MAXIDX_OFFSET];
+
+               buf_size_alloc += ((max_idx + 1) * sizeof(void*));
+               /* allocate space to hold the buffers, index etc */
+
+               DHD_REORDER(("%s: alloc buffer of size %d size, reorder info id %d, maxidx %d\n",
+                       __FUNCTION__, buf_size_alloc, flow_id, max_idx));
+               ptr = (struct reorder_info *)MALLOC(dhd->osh, buf_size_alloc);
+               if (ptr == NULL) {
+                       DHD_ERROR(("%s: Malloc failed to alloc buffer\n", __FUNCTION__));
+                       *pkt_count = 1;
+                       return 0;
+               }
+               bzero(ptr, buf_size_alloc);
+               dhd->reorder_bufs[flow_id] = ptr;
+               ptr->p = (void *)(ptr+1);
+               ptr->max_idx = max_idx;
+       }
+       if (flags & WLHOST_REORDERDATA_NEW_HOLE)  {
+               DHD_REORDER(("%s: new hole, so cleanup pending buffers\n", __FUNCTION__));
+               if (ptr->pend_pkts) {
+                       dhd_get_hostreorder_pkts(dhd->osh, ptr, pkt, &cnt, &plast,
+                               ptr->exp_idx, ptr->exp_idx);
+                       ptr->pend_pkts = 0;
+               }
+               ptr->cur_idx = reorder_info_buf[WLHOST_REORDERDATA_CURIDX_OFFSET];
+               ptr->exp_idx = reorder_info_buf[WLHOST_REORDERDATA_EXPIDX_OFFSET];
+               ptr->max_idx = reorder_info_buf[WLHOST_REORDERDATA_MAXIDX_OFFSET];
+               ptr->p[ptr->cur_idx] = cur_pkt;
+               ptr->pend_pkts++;
+               *pkt_count = cnt;
+       }
+       else if (flags & WLHOST_REORDERDATA_CURIDX_VALID) {
+               cur_idx = reorder_info_buf[WLHOST_REORDERDATA_CURIDX_OFFSET];
+               exp_idx = reorder_info_buf[WLHOST_REORDERDATA_EXPIDX_OFFSET];
+
+
+               if ((exp_idx == ptr->exp_idx) && (cur_idx != ptr->exp_idx)) {
+                       /* still in the current hole */
+                       /* enqueue the current on the buffer chain */
+                       if (ptr->p[cur_idx] != NULL) {
+                               DHD_REORDER(("%s: HOLE: ERROR buffer pending..free it\n",
+                                       __FUNCTION__));
+                               PKTFREE(dhd->osh, ptr->p[cur_idx], TRUE);
+                               ptr->p[cur_idx] = NULL;
+                       }
+                       ptr->p[cur_idx] = cur_pkt;
+                       ptr->pend_pkts++;
+                       ptr->cur_idx = cur_idx;
+                       DHD_REORDER(("%s: fill up a hole..pending packets is %d\n",
+                               __FUNCTION__, ptr->pend_pkts));
+                       *pkt_count = 0;
+                       *pkt = NULL;
+               }
+               else if (ptr->exp_idx == cur_idx) {
+                       /* got the right one ..flush from cur to exp and update exp */
+                       DHD_REORDER(("%s: got the right one now, cur_idx is %d\n",
+                               __FUNCTION__, cur_idx));
+                       if (ptr->p[cur_idx] != NULL) {
+                               DHD_REORDER(("%s: Error buffer pending..free it\n",
+                                       __FUNCTION__));
+                               PKTFREE(dhd->osh, ptr->p[cur_idx], TRUE);
+                               ptr->p[cur_idx] = NULL;
+                       }
+                       ptr->p[cur_idx] = cur_pkt;
+                       ptr->pend_pkts++;
+
+                       ptr->cur_idx = cur_idx;
+                       ptr->exp_idx = exp_idx;
+
+                       dhd_get_hostreorder_pkts(dhd->osh, ptr, pkt, &cnt, &plast,
+                               cur_idx, exp_idx);
+                       *pkt_count = cnt;
+                       DHD_REORDER(("%s: freeing up buffers %d, still pending %d\n",
+                               __FUNCTION__, cnt, ptr->pend_pkts));
+               }
+               else {
+                       uint8 end_idx;
+                       bool flush_current = FALSE;
+                       /* both cur and exp are moved now .. */
+                       DHD_REORDER(("%s:, flow %d, both moved, cur %d(%d), exp %d(%d)\n",
+                               __FUNCTION__, flow_id, ptr->cur_idx, cur_idx,
+                               ptr->exp_idx, exp_idx));
+                       if (flags & WLHOST_REORDERDATA_FLUSH_ALL)
+                               end_idx = ptr->exp_idx;
+                       else
+                               end_idx = exp_idx;
+
+                       /* flush pkts first */
+                       dhd_get_hostreorder_pkts(dhd->osh, ptr, pkt, &cnt, &plast,
+                               ptr->exp_idx, end_idx);
+
+                       if (cur_idx == ptr->max_idx) {
+                               if (exp_idx == 0)
+                                       flush_current = TRUE;
+                       } else {
+                               if (exp_idx == cur_idx + 1)
+                                       flush_current = TRUE;
+                       }
+                       if (flush_current) {
+                               if (plast)
+                                       PKTSETNEXT(dhd->osh, plast, cur_pkt);
+                               else
+                                       *pkt = cur_pkt;
+                               cnt++;
+                       }
+                       else {
+                               ptr->p[cur_idx] = cur_pkt;
+                               ptr->pend_pkts++;
+                       }
+                       ptr->exp_idx = exp_idx;
+                       ptr->cur_idx = cur_idx;
+                       *pkt_count = cnt;
+               }
+       }
+       else {
+               uint8 end_idx;
+               /* no real packet but update to exp_seq...that means explicit window move */
+               exp_idx = reorder_info_buf[WLHOST_REORDERDATA_EXPIDX_OFFSET];
+
+               DHD_REORDER(("%s: move the window, cur_idx is %d, exp is %d, new exp is %d\n",
+                       __FUNCTION__, ptr->cur_idx, ptr->exp_idx, exp_idx));
+               if (flags & WLHOST_REORDERDATA_FLUSH_ALL)
+                       end_idx =  ptr->exp_idx;
+               else
+                       end_idx =  exp_idx;
+
+               dhd_get_hostreorder_pkts(dhd->osh, ptr, pkt, &cnt, &plast, ptr->exp_idx, end_idx);
+               if (plast)
+                       PKTSETNEXT(dhd->osh, plast, cur_pkt);
+               else
+                       *pkt = cur_pkt;
+               cnt++;
+               *pkt_count = cnt;
+               /* set the new expected idx */
+               ptr->exp_idx = exp_idx;
+       }
+       return 0;
+}
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_cfg80211.c b/drivers/net/wireless/bcmdhd_1363/dhd_cfg80211.c
new file mode 100644 (file)
index 0000000..fb35e6f
--- /dev/null
@@ -0,0 +1,266 @@
+/*
+ * Linux cfg80211 driver - Dongle Host Driver (DHD) related
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_cfg80211.c 642340 2016-06-08 09:44:13Z $
+ */
+
+#include <linux/vmalloc.h>
+#include <net/rtnetlink.h>
+
+#include <bcmutils.h>
+#include <wldev_common.h>
+#include <wl_cfg80211.h>
+#include <dhd_cfg80211.h>
+
+#ifdef PKT_FILTER_SUPPORT
+#include <dngl_stats.h>
+#include <dhd.h>
+#endif
+
+#ifdef PKT_FILTER_SUPPORT
+extern uint dhd_pkt_filter_enable;
+extern uint dhd_master_mode;
+extern void dhd_pktfilter_offload_enable(dhd_pub_t * dhd, char *arg, int enable, int master_mode);
+#endif
+
+static int dhd_dongle_up = FALSE;
+
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhdioctl.h>
+#include <wlioctl.h>
+#include <brcm_nl80211.h>
+#include <dhd_cfg80211.h>
+
+static s32 wl_dongle_up(struct net_device *ndev);
+static s32 wl_dongle_down(struct net_device *ndev);
+
+/**
+ * Function implementations
+ */
+
+s32 dhd_cfg80211_init(struct bcm_cfg80211 *cfg)
+{
+       dhd_dongle_up = FALSE;
+       return 0;
+}
+
+s32 dhd_cfg80211_deinit(struct bcm_cfg80211 *cfg)
+{
+       dhd_dongle_up = FALSE;
+       return 0;
+}
+
+s32 dhd_cfg80211_down(struct bcm_cfg80211 *cfg)
+{
+       struct net_device *ndev;
+       s32 err = 0;
+
+       WL_TRACE(("In\n"));
+       if (!dhd_dongle_up) {
+               WL_ERR(("Dongle is already down\n"));
+               return err;
+       }
+
+       ndev = bcmcfg_to_prmry_ndev(cfg);
+       wl_dongle_down(ndev);
+       dhd_dongle_up = FALSE;
+       return 0;
+}
+
+s32 dhd_cfg80211_set_p2p_info(struct bcm_cfg80211 *cfg, int val)
+{
+       dhd_pub_t *dhd =  (dhd_pub_t *)(cfg->pub);
+       dhd->op_mode |= val;
+       WL_ERR(("Set : op_mode=0x%04x\n", dhd->op_mode));
+#ifdef ARP_OFFLOAD_SUPPORT
+       if (dhd->arp_version == 1) {
+               /* IF P2P is enabled, disable arpoe */
+               dhd_arp_offload_set(dhd, 0);
+               dhd_arp_offload_enable(dhd, false);
+       }
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+       return 0;
+}
+
+s32 dhd_cfg80211_clean_p2p_info(struct bcm_cfg80211 *cfg)
+{
+       dhd_pub_t *dhd =  (dhd_pub_t *)(cfg->pub);
+       dhd->op_mode &= ~(DHD_FLAG_P2P_GC_MODE | DHD_FLAG_P2P_GO_MODE);
+       WL_ERR(("Clean : op_mode=0x%04x\n", dhd->op_mode));
+
+#ifdef ARP_OFFLOAD_SUPPORT
+       if (dhd->arp_version == 1) {
+               /* IF P2P is disabled, enable arpoe back for STA mode. */
+               dhd_arp_offload_set(dhd, dhd_arp_mode);
+               dhd_arp_offload_enable(dhd, true);
+       }
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+       return 0;
+}
+
+struct net_device* wl_cfg80211_allocate_if(struct bcm_cfg80211 *cfg, int ifidx, char *name,
+       uint8 *mac, uint8 bssidx, char *dngl_name)
+{
+       return dhd_allocate_if(cfg->pub, ifidx, name, mac, bssidx, FALSE, dngl_name);
+}
+
+int wl_cfg80211_register_if(struct bcm_cfg80211 *cfg, int ifidx, struct net_device* ndev)
+{
+       return dhd_register_if(cfg->pub, ifidx, FALSE);
+}
+
+int wl_cfg80211_remove_if(struct bcm_cfg80211 *cfg, int ifidx, struct net_device* ndev)
+{
+       return dhd_remove_if(cfg->pub, ifidx, FALSE);
+}
+
+struct net_device * dhd_cfg80211_netdev_free(struct net_device *ndev)
+{
+       if (ndev) {
+               if (ndev->ieee80211_ptr) {
+                       kfree(ndev->ieee80211_ptr);
+                       ndev->ieee80211_ptr = NULL;
+               }
+               free_netdev(ndev);
+               return NULL;
+       }
+
+       return ndev;
+}
+
+void dhd_netdev_free(struct net_device *ndev)
+{
+#ifdef WL_CFG80211
+       ndev = dhd_cfg80211_netdev_free(ndev);
+#endif
+       if (ndev)
+               free_netdev(ndev);
+}
+
+static s32
+wl_dongle_up(struct net_device *ndev)
+{
+       s32 err = 0;
+       u32 up = 0;
+
+       err = wldev_ioctl(ndev, WLC_UP, &up, sizeof(up), true);
+       if (unlikely(err)) {
+               WL_ERR(("WLC_UP error (%d)\n", err));
+       }
+       return err;
+}
+
+static s32
+wl_dongle_down(struct net_device *ndev)
+{
+       s32 err = 0;
+       u32 down = 0;
+
+       err = wldev_ioctl(ndev, WLC_DOWN, &down, sizeof(down), true);
+       if (unlikely(err)) {
+               WL_ERR(("WLC_DOWN error (%d)\n", err));
+       }
+       return err;
+}
+
+
+s32 dhd_config_dongle(struct bcm_cfg80211 *cfg)
+{
+#ifndef DHD_SDALIGN
+#define DHD_SDALIGN    32
+#endif
+       struct net_device *ndev;
+       s32 err = 0;
+
+       WL_TRACE(("In\n"));
+       if (dhd_dongle_up) {
+               WL_ERR(("Dongle is already up\n"));
+               return err;
+       }
+
+       ndev = bcmcfg_to_prmry_ndev(cfg);
+
+       err = wl_dongle_up(ndev);
+       if (unlikely(err)) {
+               WL_ERR(("wl_dongle_up failed\n"));
+               goto default_conf_out;
+       }
+       dhd_dongle_up = true;
+
+default_conf_out:
+
+       return err;
+
+}
+
+int dhd_cfgvendor_priv_string_handler(struct bcm_cfg80211 *cfg, struct wireless_dev *wdev,
+       const struct bcm_nlmsg_hdr *nlioc, void *buf)
+{
+       struct net_device *ndev = NULL;
+       dhd_pub_t *dhd;
+       dhd_ioctl_t ioc = { 0 };
+       int ret = 0;
+       int8 index;
+
+       WL_TRACE(("entry: cmd = %d\n", nlioc->cmd));
+
+       dhd = cfg->pub;
+       DHD_OS_WAKE_LOCK(dhd);
+
+       /* send to dongle only if we are not waiting for reload already */
+       if (dhd->hang_was_sent) {
+               WL_ERR(("HANG was sent up earlier\n"));
+               DHD_OS_WAKE_LOCK_CTRL_TIMEOUT_ENABLE(dhd, DHD_EVENT_TIMEOUT_MS);
+               DHD_OS_WAKE_UNLOCK(dhd);
+               return OSL_ERROR(BCME_DONGLE_DOWN);
+       }
+
+       ndev = wdev_to_wlc_ndev(wdev, cfg);
+       index = dhd_net2idx(dhd->info, ndev);
+       if (index == DHD_BAD_IF) {
+               WL_ERR(("Bad ifidx from wdev:%p\n", wdev));
+               ret = BCME_ERROR;
+               goto done;
+       }
+
+       ioc.cmd = nlioc->cmd;
+       ioc.len = nlioc->len;
+       ioc.set = nlioc->set;
+       ioc.driver = nlioc->magic;
+       ret = dhd_ioctl_process(dhd, index, &ioc, buf);
+       if (ret) {
+               WL_TRACE(("dhd_ioctl_process return err %d\n", ret));
+               ret = OSL_ERROR(ret);
+               goto done;
+       }
+
+done:
+       DHD_OS_WAKE_UNLOCK(dhd);
+       return ret;
+}
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_cfg80211.h b/drivers/net/wireless/bcmdhd_1363/dhd_cfg80211.h
new file mode 100644 (file)
index 0000000..ca86f68
--- /dev/null
@@ -0,0 +1,54 @@
+/*
+ * Linux cfg80211 driver - Dongle Host Driver (DHD) related
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_cfg80211.h 591285 2015-10-07 11:56:29Z $
+ */
+
+
+#ifndef __DHD_CFG80211__
+#define __DHD_CFG80211__
+
+#include <wl_cfg80211.h>
+#include <wl_cfgp2p.h>
+#include <brcm_nl80211.h>
+
+#ifndef WL_ERR
+#define WL_ERR CFG80211_ERR
+#endif
+#ifndef WL_TRACE
+#define WL_TRACE CFG80211_TRACE
+#endif
+
+s32 dhd_cfg80211_init(struct bcm_cfg80211 *cfg);
+s32 dhd_cfg80211_deinit(struct bcm_cfg80211 *cfg);
+s32 dhd_cfg80211_down(struct bcm_cfg80211 *cfg);
+s32 dhd_cfg80211_set_p2p_info(struct bcm_cfg80211 *cfg, int val);
+s32 dhd_cfg80211_clean_p2p_info(struct bcm_cfg80211 *cfg);
+s32 dhd_config_dongle(struct bcm_cfg80211 *cfg);
+int dhd_cfgvendor_priv_string_handler(struct bcm_cfg80211 *cfg,
+       struct wireless_dev *wdev, const struct bcm_nlmsg_hdr *nlioc, void  *data);
+
+#endif /* __DHD_CFG80211__ */
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_cfg_vendor.c b/drivers/net/wireless/bcmdhd_1363/dhd_cfg_vendor.c
new file mode 100644 (file)
index 0000000..4ba3827
--- /dev/null
@@ -0,0 +1,174 @@
+/*
+ * Linux cfg80211 vendor command/event handlers of DHD
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_cfg_vendor.c 525516 2015-01-09 23:12:53Z $
+ */
+
+#include <linux/vmalloc.h>
+#include <linuxver.h>
+#include <net/cfg80211.h>
+#include <net/netlink.h>
+
+#include <bcmutils.h>
+#include <wl_cfg80211.h>
+#include <wl_cfgvendor.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_dbg.h>
+#include <dhdioctl.h>
+#include <brcm_nl80211.h>
+
+#ifdef VENDOR_EXT_SUPPORT
+static int dhd_cfgvendor_priv_string_handler(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       const struct bcm_nlmsg_hdr *nlioc = data;
+       struct net_device *ndev = NULL;
+       struct bcm_cfg80211 *cfg;
+       struct sk_buff *reply;
+       void *buf = NULL, *cur;
+       dhd_pub_t *dhd;
+       dhd_ioctl_t ioc = { 0 };
+       int ret = 0, ret_len, payload, msglen;
+       int maxmsglen = PAGE_SIZE - 0x100;
+       int8 index;
+
+       WL_TRACE(("entry: cmd = %d\n", nlioc->cmd));
+       DHD_ERROR(("entry: cmd = %d\n", nlioc->cmd));
+
+       cfg = wiphy_priv(wiphy);
+       dhd = cfg->pub;
+
+       DHD_OS_WAKE_LOCK(dhd);
+
+       /* send to dongle only if we are not waiting for reload already */
+       if (dhd->hang_was_sent) {
+               WL_ERR(("HANG was sent up earlier\n"));
+               DHD_OS_WAKE_LOCK_CTRL_TIMEOUT_ENABLE(dhd, DHD_EVENT_TIMEOUT_MS);
+               DHD_OS_WAKE_UNLOCK(dhd);
+               return OSL_ERROR(BCME_DONGLE_DOWN);
+       }
+
+       len -= sizeof(struct bcm_nlmsg_hdr);
+       ret_len = nlioc->len;
+       if (ret_len > 0 || len > 0) {
+               if (len > DHD_IOCTL_MAXLEN) {
+                       WL_ERR(("oversize input buffer %d\n", len));
+                       len = DHD_IOCTL_MAXLEN;
+               }
+               if (ret_len > DHD_IOCTL_MAXLEN) {
+                       WL_ERR(("oversize return buffer %d\n", ret_len));
+                       ret_len = DHD_IOCTL_MAXLEN;
+               }
+               payload = max(ret_len, len) + 1;
+               buf = vzalloc(payload);
+               if (!buf) {
+                       DHD_OS_WAKE_UNLOCK(dhd);
+                       return -ENOMEM;
+               }
+               memcpy(buf, (void *)nlioc + nlioc->offset, len);
+               *(char *)(buf + len) = '\0';
+       }
+
+       ndev = wdev_to_wlc_ndev(wdev, cfg);
+       index = dhd_net2idx(dhd->info, ndev);
+       if (index == DHD_BAD_IF) {
+               WL_ERR(("Bad ifidx from wdev:%p\n", wdev));
+               ret = BCME_ERROR;
+               goto done;
+       }
+
+       ioc.cmd = nlioc->cmd;
+       ioc.len = nlioc->len;
+       ioc.set = nlioc->set;
+       ioc.driver = nlioc->magic;
+       ret = dhd_ioctl_process(dhd, index, &ioc, buf);
+       if (ret) {
+               WL_TRACE(("dhd_ioctl_process return err %d\n", ret));
+               ret = OSL_ERROR(ret);
+               goto done;
+       }
+
+       cur = buf;
+       while (ret_len > 0) {
+               msglen = nlioc->len > maxmsglen ? maxmsglen : ret_len;
+               ret_len -= msglen;
+               payload = msglen + sizeof(msglen);
+               reply = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, payload);
+               if (!reply) {
+                       WL_ERR(("Failed to allocate reply msg\n"));
+                       ret = -ENOMEM;
+                       break;
+               }
+
+               if (nla_put(reply, BCM_NLATTR_DATA, msglen, cur) ||
+                       nla_put_u16(reply, BCM_NLATTR_LEN, msglen)) {
+                       kfree_skb(reply);
+                       ret = -ENOBUFS;
+                       break;
+               }
+
+               ret = cfg80211_vendor_cmd_reply(reply);
+               if (ret) {
+                       WL_ERR(("testmode reply failed:%d\n", ret));
+                       break;
+               }
+               cur += msglen;
+       }
+
+done:
+       vfree(buf);
+       DHD_OS_WAKE_UNLOCK(dhd);
+       return ret;
+}
+
+const struct wiphy_vendor_command dhd_cfgvendor_cmds [] = {
+       {
+               {
+                       .vendor_id = OUI_BRCM,
+                       .subcmd = BRCM_VENDOR_SCMD_PRIV_STR
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+               .doit = dhd_cfgvendor_priv_string_handler
+       },
+};
+
+int cfgvendor_attach(struct wiphy *wiphy)
+{
+       wiphy->vendor_commands  = dhd_cfgvendor_cmds;
+       wiphy->n_vendor_commands = ARRAY_SIZE(dhd_cfgvendor_cmds);
+
+       return 0;
+}
+
+int cfgvendor_detach(struct wiphy *wiphy)
+{
+       wiphy->vendor_commands  = NULL;
+       wiphy->n_vendor_commands = 0;
+
+       return 0;
+}
+#endif /* VENDOR_EXT_SUPPORT */
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_common.c b/drivers/net/wireless/bcmdhd_1363/dhd_common.c
new file mode 100644 (file)
index 0000000..485ea9a
--- /dev/null
@@ -0,0 +1,4154 @@
+/*
+ * Broadcom Dongle Host Driver (DHD), common DHD core.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_common.c 665079 2017-05-18 10:09:58Z $
+ */
+#include <typedefs.h>
+#include <osl.h>
+
+#include <epivers.h>
+#include <bcmutils.h>
+
+#include <bcmendian.h>
+#include <dngl_stats.h>
+#include <wlioctl.h>
+#include <dhd.h>
+#include <dhd_ip.h>
+#include <proto/bcmevent.h>
+
+#ifdef SHOW_LOGTRACE
+#include <event_log.h>
+#endif /* SHOW_LOGTRACE */
+
+#ifdef BCMPCIE
+#include <dhd_flowring.h>
+#endif
+
+#include <dhd_bus.h>
+#include <dhd_proto.h>
+#include <dhd_dbg.h>
+#include <msgtrace.h>
+
+#ifdef WL_CFG80211
+#include <wl_cfg80211.h>
+#endif
+#ifdef PNO_SUPPORT
+#include <dhd_pno.h>
+#endif
+
+#define htod32(i) (i)
+#define htod16(i) (i)
+#define dtoh32(i) (i)
+#define dtoh16(i) (i)
+#define htodchanspec(i) (i)
+#define dtohchanspec(i) (i)
+
+#ifdef PROP_TXSTATUS
+#include <wlfc_proto.h>
+#include <dhd_wlfc.h>
+#endif
+
+#ifdef DHD_WMF
+#include <dhd_linux.h>
+#include <dhd_wmf_linux.h>
+#endif /* DHD_WMF */
+
+#ifdef DHD_L2_FILTER
+#include <dhd_l2_filter.h>
+#endif /* DHD_L2_FILTER */
+
+#ifdef DHD_PSTA
+#include <dhd_psta.h>
+#endif /* DHD_PSTA */
+
+
+#ifdef WLMEDIA_HTSF
+extern void htsf_update(struct dhd_info *dhd, void *data);
+#endif
+
+#ifdef DHD_LOG_DUMP
+int dhd_msg_level = DHD_ERROR_VAL | DHD_MSGTRACE_VAL | DHD_FWLOG_VAL | DHD_EVENT_VAL;
+#else
+int dhd_msg_level = DHD_ERROR_VAL | DHD_MSGTRACE_VAL | DHD_FWLOG_VAL;
+#endif /* DHD_LOG_DUMP */
+
+
+#if defined(WL_WLC_SHIM)
+#include <wl_shim.h>
+#else
+#endif /* WL_WLC_SHIM */
+
+#if defined(WL_WIRELESS_EXT)
+#include <wl_iw.h>
+#endif 
+
+#ifdef SOFTAP
+char fw_path2[MOD_PARAM_PATHLEN];
+extern bool softap_enabled;
+#endif
+
+/* Last connection success/failure status */
+uint32 dhd_conn_event;
+uint32 dhd_conn_status;
+uint32 dhd_conn_reason;
+
+#if defined(SHOW_EVENTS) && defined(SHOW_LOGTRACE)
+static int check_event_log_sequence_number(uint32 seq_no);
+#endif /* defined(SHOW_EVENTS) && defined(SHOW_LOGTRACE) */
+extern int dhd_iscan_request(void * dhdp, uint16 action);
+extern void dhd_ind_scan_confirm(void *h, bool status);
+extern int dhd_iscan_in_progress(void *h);
+void dhd_iscan_lock(void);
+void dhd_iscan_unlock(void);
+extern int dhd_change_mtu(dhd_pub_t *dhd, int new_mtu, int ifidx);
+#if !defined(AP) && defined(WLP2P)
+extern int dhd_get_concurrent_capabilites(dhd_pub_t *dhd);
+#endif
+
+extern int dhd_socram_dump(struct dhd_bus *bus);
+
+#define MAX_CHUNK_LEN 1408 /* 8 * 8 * 22 */
+
+bool ap_cfg_running = FALSE;
+bool ap_fw_loaded = FALSE;
+
+/* Version string to report */
+#ifdef DHD_DEBUG
+#ifndef SRCBASE
+#define SRCBASE        "drivers/net/wireless/bcmdhd"
+#endif
+#define DHD_COMPILED "\nCompiled in " SRCBASE
+#else
+#define DHD_COMPILED ""
+#endif /* DHD_DEBUG */
+
+#if defined(DHD_VERSION_NO_DATE_TIME)
+const char dhd_version[] = "Dongle Host Driver, version " EPI_VERSION_STR      DHD_COMPILED;
+#else
+#if defined(DHD_DEBUG)
+const char dhd_version[] = "Dongle Host Driver, version " EPI_VERSION_STR
+       DHD_COMPILED " on " __DATE__ " at " __TIME__;
+#else
+const char dhd_version[] = "\nDongle Host Driver, version " EPI_VERSION_STR "\nCompiled from ";
+#endif 
+#endif /* DHD_VERSION_NO_DATE_TIME */
+char fw_version[FW_VER_STR_LEN] = "\0";
+char clm_version[CLM_VER_STR_LEN] = "\0";
+
+void dhd_set_timer(void *bus, uint wdtick);
+
+
+
+/* IOVar table */
+enum {
+       IOV_VERSION = 1,
+       IOV_MSGLEVEL,
+       IOV_BCMERRORSTR,
+       IOV_BCMERROR,
+       IOV_WDTICK,
+       IOV_DUMP,
+       IOV_CLEARCOUNTS,
+       IOV_LOGDUMP,
+       IOV_LOGCAL,
+       IOV_LOGSTAMP,
+       IOV_GPIOOB,
+       IOV_IOCTLTIMEOUT,
+#if defined(DHD_DEBUG)
+       IOV_CONS,
+       IOV_DCONSOLE_POLL,
+       IOV_DHD_JOIN_TIMEOUT_DBG,
+       IOV_SCAN_TIMEOUT,
+#endif /* defined(DHD_DEBUG) */
+#ifdef PROP_TXSTATUS
+       IOV_PROPTXSTATUS_ENABLE,
+       IOV_PROPTXSTATUS_MODE,
+       IOV_PROPTXSTATUS_OPT,
+       IOV_PROPTXSTATUS_MODULE_IGNORE,
+       IOV_PROPTXSTATUS_CREDIT_IGNORE,
+       IOV_PROPTXSTATUS_TXSTATUS_IGNORE,
+       IOV_PROPTXSTATUS_RXPKT_CHK,
+#endif /* PROP_TXSTATUS */
+       IOV_BUS_TYPE,
+#ifdef WLMEDIA_HTSF
+       IOV_WLPKTDLYSTAT_SZ,
+#endif
+       IOV_CHANGEMTU,
+       IOV_HOSTREORDER_FLOWS,
+#ifdef DHDTCPACK_SUPPRESS
+       IOV_TCPACK_SUPPRESS,
+#endif /* DHDTCPACK_SUPPRESS */
+#ifdef DHD_WMF
+       IOV_WMF_BSS_ENAB,
+       IOV_WMF_UCAST_IGMP,
+       IOV_WMF_MCAST_DATA_SENDUP,
+#ifdef WL_IGMP_UCQUERY
+       IOV_WMF_UCAST_IGMP_QUERY,
+#endif /* WL_IGMP_UCQUERY */
+#ifdef DHD_UCAST_UPNP
+       IOV_WMF_UCAST_UPNP,
+#endif /* DHD_UCAST_UPNP */
+#endif /* DHD_WMF */
+       IOV_AP_ISOLATE,
+#ifdef DHD_L2_FILTER
+       IOV_DHCP_UNICAST,
+       IOV_BLOCK_PING,
+       IOV_PROXY_ARP,
+       IOV_GRAT_ARP,
+#endif /* DHD_L2_FILTER */
+#ifdef DHD_PSTA
+       IOV_PSTA,
+#endif /* DHD_PSTA */
+       IOV_CFG80211_OPMODE,
+       IOV_ASSERT_TYPE,
+       IOV_LMTEST,
+       IOV_LAST
+};
+
+const bcm_iovar_t dhd_iovars[] = {
+       {"version",     IOV_VERSION,    0,      IOVT_BUFFER,    sizeof(dhd_version) },
+#ifdef DHD_DEBUG
+       {"msglevel",    IOV_MSGLEVEL,   0,      IOVT_UINT32,    0 },
+#endif /* DHD_DEBUG */
+       {"bcmerrorstr", IOV_BCMERRORSTR, 0, IOVT_BUFFER,        BCME_STRLEN },
+       {"bcmerror",    IOV_BCMERROR,   0,      IOVT_INT8,      0 },
+       {"wdtick",      IOV_WDTICK, 0,  IOVT_UINT32,    0 },
+       {"dump",        IOV_DUMP,       0,      IOVT_BUFFER,    DHD_IOCTL_MAXLEN },
+#ifdef DHD_DEBUG
+       {"cons",        IOV_CONS,       0,      IOVT_BUFFER,    0 },
+       {"dconpoll",    IOV_DCONSOLE_POLL, 0,   IOVT_UINT32,    0 },
+#endif
+       {"clearcounts", IOV_CLEARCOUNTS, 0, IOVT_VOID,  0 },
+       {"gpioob",      IOV_GPIOOB,     0,      IOVT_UINT32,    0 },
+       {"ioctl_timeout",       IOV_IOCTLTIMEOUT,       0,      IOVT_UINT32,    0 },
+#ifdef PROP_TXSTATUS
+       {"proptx",      IOV_PROPTXSTATUS_ENABLE,        0,      IOVT_BOOL,      0 },
+       /*
+       set the proptxtstatus operation mode:
+       0 - Do not do any proptxtstatus flow control
+       1 - Use implied credit from a packet status
+       2 - Use explicit credit
+       */
+       {"ptxmode",     IOV_PROPTXSTATUS_MODE,  0,      IOVT_UINT32,    0 },
+       {"proptx_opt", IOV_PROPTXSTATUS_OPT,    0,      IOVT_UINT32,    0 },
+       {"pmodule_ignore", IOV_PROPTXSTATUS_MODULE_IGNORE, 0, IOVT_BOOL, 0 },
+       {"pcredit_ignore", IOV_PROPTXSTATUS_CREDIT_IGNORE, 0, IOVT_BOOL, 0 },
+       {"ptxstatus_ignore", IOV_PROPTXSTATUS_TXSTATUS_IGNORE, 0, IOVT_BOOL, 0 },
+       {"rxpkt_chk", IOV_PROPTXSTATUS_RXPKT_CHK, 0, IOVT_BOOL, 0 },
+#endif /* PROP_TXSTATUS */
+       {"bustype", IOV_BUS_TYPE, 0, IOVT_UINT32, 0},
+#ifdef WLMEDIA_HTSF
+       {"pktdlystatsz", IOV_WLPKTDLYSTAT_SZ, 0, IOVT_UINT8, 0 },
+#endif
+       {"changemtu", IOV_CHANGEMTU, 0, IOVT_UINT32, 0 },
+       {"host_reorder_flows", IOV_HOSTREORDER_FLOWS, 0, IOVT_BUFFER,
+       (WLHOST_REORDERDATA_MAXFLOWS + 1) },
+#ifdef DHDTCPACK_SUPPRESS
+       {"tcpack_suppress",     IOV_TCPACK_SUPPRESS,    0,      IOVT_UINT8,     0 },
+#endif /* DHDTCPACK_SUPPRESS */
+#ifdef DHD_WMF
+       {"wmf_bss_enable", IOV_WMF_BSS_ENAB,    0,      IOVT_BOOL,      0 },
+       {"wmf_ucast_igmp", IOV_WMF_UCAST_IGMP,  0,      IOVT_BOOL,      0 },
+       {"wmf_mcast_data_sendup", IOV_WMF_MCAST_DATA_SENDUP,    0,      IOVT_BOOL,      0 },
+#ifdef WL_IGMP_UCQUERY
+       {"wmf_ucast_igmp_query", IOV_WMF_UCAST_IGMP_QUERY, (0), IOVT_BOOL, 0 },
+#endif /* WL_IGMP_UCQUERY */
+#ifdef DHD_UCAST_UPNP
+       {"wmf_ucast_upnp", IOV_WMF_UCAST_UPNP, (0), IOVT_BOOL, 0 },
+#endif /* DHD_UCAST_UPNP */
+#endif /* DHD_WMF */
+#ifdef DHD_L2_FILTER
+       {"dhcp_unicast", IOV_DHCP_UNICAST, (0), IOVT_BOOL, 0 },
+#endif /* DHD_L2_FILTER */
+       {"ap_isolate", IOV_AP_ISOLATE, (0), IOVT_BOOL, 0},
+#ifdef DHD_L2_FILTER
+       {"block_ping", IOV_BLOCK_PING, (0), IOVT_BOOL, 0},
+       {"proxy_arp", IOV_PROXY_ARP, (0), IOVT_BOOL, 0},
+       {"grat_arp", IOV_GRAT_ARP, (0), IOVT_BOOL, 0},
+#endif /* DHD_L2_FILTER */
+#ifdef DHD_PSTA
+       /* PSTA/PSR Mode configuration. 0: DIABLED 1: PSTA 2: PSR */
+       {"psta", IOV_PSTA, 0, IOVT_UINT32, 0},
+#endif /* DHD PSTA */
+       {"op_mode",     IOV_CFG80211_OPMODE,    0,      IOVT_UINT32,    0 },
+       {"assert_type", IOV_ASSERT_TYPE, (0), IOVT_UINT32, 0},
+       {"lmtest", IOV_LMTEST,  0,      IOVT_UINT32,    0 },
+       {NULL, 0, 0, 0, 0 }
+};
+
+#define DHD_IOVAR_BUF_SIZE     128
+
+bool
+dhd_query_bus_erros(dhd_pub_t *dhdp)
+{
+       bool ret = FALSE;
+
+       if (dhdp->dongle_reset) {
+               DHD_ERROR(("%s: Dongle Reset occurred, cannot proceed\n",
+                       __FUNCTION__));
+               ret = TRUE;
+       }
+
+       if (dhdp->dongle_trap_occured) {
+               DHD_ERROR(("%s: FW TRAP has occurred, cannot proceed\n",
+                       __FUNCTION__));
+               ret = TRUE;
+       }
+
+       if (dhdp->iovar_timeout_occured) {
+               DHD_ERROR(("%s: Resumed on timeout for previous IOVAR, cannot proceed\n",
+                       __FUNCTION__));
+               ret = TRUE;
+       }
+
+#ifdef PCIE_FULL_DONGLE
+       if (dhdp->d3ack_timeout_occured) {
+               DHD_ERROR(("%s: Resumed on timeout for previous D3ACK, cannot proceed\n",
+                       __FUNCTION__));
+               ret = TRUE;
+       }
+#endif /* PCIE_FULL_DONGLE */
+
+       return ret;
+}
+
+#ifdef DHD_FW_COREDUMP
+void dhd_save_fwdump(dhd_pub_t *dhd_pub, void * buffer, uint32 length)
+{
+       if (dhd_pub->soc_ram) {
+#if defined(CONFIG_DHD_USE_STATIC_BUF) && defined(DHD_USE_STATIC_MEMDUMP)
+               DHD_OS_PREFREE(dhd_pub, dhd_pub->soc_ram, dhd_pub->soc_ram_length);
+#else
+               MFREE(dhd_pub->osh, dhd_pub->soc_ram, dhd_pub->soc_ram_length);
+#endif /* CONFIG_DHD_USE_STATIC_BUF && DHD_USE_STATIC_MEMDUMP */
+               dhd_pub->soc_ram = NULL;
+               dhd_pub->soc_ram_length = 0;
+       }
+
+#if defined(CONFIG_DHD_USE_STATIC_BUF) && defined(DHD_USE_STATIC_MEMDUMP)
+       dhd_pub->soc_ram = (uint8*)DHD_OS_PREALLOC(dhd_pub,
+               DHD_PREALLOC_MEMDUMP_RAM, length);
+       memset(dhd_pub->soc_ram, 0, length);
+#else
+       dhd_pub->soc_ram = (uint8*) MALLOCZ(dhd_pub->osh, length);
+#endif /* CONFIG_DHD_USE_STATIC_BUF && DHD_USE_STATIC_MEMDUMP */
+       if (dhd_pub->soc_ram == NULL) {
+               DHD_ERROR(("%s: Failed to allocate memory for fw crash snap shot.\n",
+                       __FUNCTION__));
+               dhd_pub->memdump_success = FALSE;
+               return;
+       }
+
+       dhd_pub->soc_ram_length = length;
+       memcpy(dhd_pub->soc_ram, buffer, length);
+}
+#endif /* DHD_FW_COREDUMP */
+
+/* to NDIS developer, the structure dhd_common is redundant,
+ * please do NOT merge it back from other branches !!!
+ */
+
+static int
+dhd_dump(dhd_pub_t *dhdp, char *buf, int buflen)
+{
+       char eabuf[ETHER_ADDR_STR_LEN];
+
+       struct bcmstrbuf b;
+       struct bcmstrbuf *strbuf = &b;
+       if (!dhdp || !dhdp->prot || !buf)
+               return BCME_ERROR;
+
+       bcm_binit(strbuf, buf, buflen);
+
+       /* Base DHD info */
+       bcm_bprintf(strbuf, "%s\n", dhd_version);
+       bcm_bprintf(strbuf, "\n");
+       bcm_bprintf(strbuf, "pub.up %d pub.txoff %d pub.busstate %d\n",
+                   dhdp->up, dhdp->txoff, dhdp->busstate);
+       bcm_bprintf(strbuf, "pub.hdrlen %u pub.maxctl %u pub.rxsz %u\n",
+                   dhdp->hdrlen, dhdp->maxctl, dhdp->rxsz);
+       bcm_bprintf(strbuf, "pub.iswl %d pub.drv_version %ld pub.mac %s\n",
+                   dhdp->iswl, dhdp->drv_version, bcm_ether_ntoa(&dhdp->mac, eabuf));
+       bcm_bprintf(strbuf, "pub.bcmerror %d tickcnt %u\n", dhdp->bcmerror, dhdp->tickcnt);
+
+       bcm_bprintf(strbuf, "dongle stats:\n");
+       bcm_bprintf(strbuf, "tx_packets %lu tx_bytes %lu tx_errors %lu tx_dropped %lu\n",
+                   dhdp->dstats.tx_packets, dhdp->dstats.tx_bytes,
+                   dhdp->dstats.tx_errors, dhdp->dstats.tx_dropped);
+       bcm_bprintf(strbuf, "rx_packets %lu rx_bytes %lu rx_errors %lu rx_dropped %lu\n",
+                   dhdp->dstats.rx_packets, dhdp->dstats.rx_bytes,
+                   dhdp->dstats.rx_errors, dhdp->dstats.rx_dropped);
+       bcm_bprintf(strbuf, "multicast %lu\n", dhdp->dstats.multicast);
+
+       bcm_bprintf(strbuf, "bus stats:\n");
+       bcm_bprintf(strbuf, "tx_packets %lu  tx_dropped %lu tx_multicast %lu tx_errors %lu\n",
+                   dhdp->tx_packets, dhdp->tx_dropped, dhdp->tx_multicast, dhdp->tx_errors);
+       bcm_bprintf(strbuf, "tx_ctlpkts %lu tx_ctlerrs %lu\n",
+                   dhdp->tx_ctlpkts, dhdp->tx_ctlerrs);
+       bcm_bprintf(strbuf, "rx_packets %lu rx_multicast %lu rx_errors %lu \n",
+                   dhdp->rx_packets, dhdp->rx_multicast, dhdp->rx_errors);
+       bcm_bprintf(strbuf, "rx_ctlpkts %lu rx_ctlerrs %lu rx_dropped %lu\n",
+                   dhdp->rx_ctlpkts, dhdp->rx_ctlerrs, dhdp->rx_dropped);
+       bcm_bprintf(strbuf, "rx_readahead_cnt %lu tx_realloc %lu\n",
+                   dhdp->rx_readahead_cnt, dhdp->tx_realloc);
+       bcm_bprintf(strbuf, "tx_pktgetfail %lu rx_pktgetfail %lu\n",
+                   dhdp->tx_pktgetfail, dhdp->rx_pktgetfail);
+       bcm_bprintf(strbuf, "\n");
+
+       /* Add any prot info */
+       dhd_prot_dump(dhdp, strbuf);
+       bcm_bprintf(strbuf, "\n");
+
+       /* Add any bus info */
+       dhd_bus_dump(dhdp, strbuf);
+
+
+#if defined(DHD_LB_STATS)
+       dhd_lb_stats_dump(dhdp, strbuf);
+#endif /* DHD_LB_STATS */
+
+       return (!strbuf->size ? BCME_BUFTOOSHORT : 0);
+}
+
+void
+dhd_dump_to_kernelog(dhd_pub_t *dhdp)
+{
+       char buf[512];
+
+       DHD_ERROR(("F/W version: %s\n", fw_version));
+       bcm_bprintf_bypass = TRUE;
+       dhd_dump(dhdp, buf, sizeof(buf));
+       bcm_bprintf_bypass = FALSE;
+}
+
+int
+dhd_wl_ioctl_cmd(dhd_pub_t *dhd_pub, int cmd, void *arg, int len, uint8 set, int ifidx)
+{
+       wl_ioctl_t ioc;
+
+       ioc.cmd = cmd;
+       ioc.buf = arg;
+       ioc.len = len;
+       ioc.set = set;
+
+       return dhd_wl_ioctl(dhd_pub, ifidx, &ioc, arg, len);
+}
+
+int
+dhd_wl_ioctl_get_intiovar(dhd_pub_t *dhd_pub, char *name, uint *pval,
+       int cmd, uint8 set, int ifidx)
+{
+       char iovbuf[WLC_IOCTL_SMLEN];
+       int ret = -1;
+
+       /* memset(iovbuf, 0, sizeof(iovbuf)); */
+       if (bcm_mkiovar(name, NULL, 0, iovbuf, sizeof(iovbuf))) {
+               ret = dhd_wl_ioctl_cmd(dhd_pub, cmd, iovbuf, sizeof(iovbuf), set, ifidx);
+               if (!ret) {
+                       *pval = ltoh32(*((uint*)iovbuf));
+               } else {
+                       DHD_ERROR(("%s: get int iovar %s failed, ERR %d\n",
+                               __FUNCTION__, name, ret));
+               }
+       } else {
+               DHD_ERROR(("%s: mkiovar %s failed\n",
+                       __FUNCTION__, name));
+       }
+
+       return ret;
+}
+
+int
+dhd_wl_ioctl_set_intiovar(dhd_pub_t *dhd_pub, char *name, uint val,
+       int cmd, uint8 set, int ifidx)
+{
+       char iovbuf[WLC_IOCTL_SMLEN];
+       int ret = -1;
+       int lval = htol32(val);
+
+       /* memset(iovbuf, 0, sizeof(iovbuf)); */
+       if (bcm_mkiovar(name, (char*)&lval, sizeof(lval), iovbuf, sizeof(iovbuf))) {
+               ret = dhd_wl_ioctl_cmd(dhd_pub, cmd, iovbuf, sizeof(iovbuf), set, ifidx);
+               if (ret) {
+                       DHD_ERROR(("%s: set int iovar %s failed, ERR %d\n",
+                               __FUNCTION__, name, ret));
+               }
+       } else {
+               DHD_ERROR(("%s: mkiovar %s failed\n",
+                       __FUNCTION__, name));
+       }
+
+       return ret;
+}
+
+int
+dhd_wl_ioctl(dhd_pub_t *dhd_pub, int ifidx, wl_ioctl_t *ioc, void *buf, int len)
+{
+       int ret = BCME_ERROR;
+       unsigned long flags;
+
+       if (dhd_os_proto_block(dhd_pub))
+       {
+#ifdef DHD_LOG_DUMP
+               int slen, i, val, rem, lval;
+               char *pval, *pos, *msg;
+               char tmp[64];
+#endif /* DHD_LOG_DUMP */
+               DHD_GENERAL_LOCK(dhd_pub, flags);
+               if (dhd_pub->busstate == DHD_BUS_DOWN ||
+                               dhd_pub->busstate == DHD_BUS_DOWN_IN_PROGRESS) {
+                       DHD_ERROR(("%s: returning as busstate=%d\n",
+                               __FUNCTION__, dhd_pub->busstate));
+                       DHD_GENERAL_UNLOCK(dhd_pub, flags);
+                       dhd_os_proto_unblock(dhd_pub);
+                       return -ENODEV;
+               }
+               dhd_pub->dhd_bus_busy_state |= DHD_BUS_BUSY_IN_IOVAR;
+               DHD_GENERAL_UNLOCK(dhd_pub, flags);
+
+#ifdef DHD_LOG_DUMP
+               /* WLC_GET_VAR */
+               if (ioc->cmd == WLC_GET_VAR) {
+                       memset(tmp, 0, sizeof(tmp));
+                       bcopy(ioc->buf, tmp, strlen(ioc->buf) + 1);
+               }
+#endif /* DHD_LOG_DUMP */
+#ifdef DHD_PCIE_RUNTIMEPM
+               dhdpcie_runtime_bus_wake(dhd_pub, TRUE, dhd_wl_ioctl);
+#endif /* DHD_PCIE_RUNTIMEPM */
+#if defined(WL_WLC_SHIM)
+               {
+                       struct wl_shim_node *shim = dhd_pub_shim(dhd_pub);
+
+                       wl_io_pport_t io_pport;
+                       io_pport.dhd_pub = dhd_pub;
+                       io_pport.ifidx = ifidx;
+
+                       ret = wl_shim_ioctl(shim, ioc, len, &io_pport);
+                       if (ret != BCME_OK) {
+                               DHD_TRACE(("%s: wl_shim_ioctl(%d) ERR %d\n",
+                                       __FUNCTION__, ioc->cmd, ret));
+                       }
+               }
+#else
+               ret = dhd_prot_ioctl(dhd_pub, ifidx, ioc, buf, len);
+#endif /* defined(WL_WLC_SHIM) */
+
+               if (ret && dhd_pub->up) {
+                       /* Send hang event only if dhd_open() was success */
+                       dhd_os_check_hang(dhd_pub, ifidx, ret);
+               }
+
+               if (ret == -ETIMEDOUT && !dhd_pub->up) {
+                       DHD_ERROR(("%s: 'resumed on timeout' error is "
+                               "occurred before the interface does not"
+                               " bring up\n", __FUNCTION__));
+                       dhd_pub->busstate = DHD_BUS_DOWN;
+               }
+
+               DHD_GENERAL_LOCK(dhd_pub, flags);
+               dhd_pub->dhd_bus_busy_state &= ~DHD_BUS_BUSY_IN_IOVAR;
+               dhd_os_busbusy_wake(dhd_pub);
+               DHD_GENERAL_UNLOCK(dhd_pub, flags);
+
+               dhd_os_proto_unblock(dhd_pub);
+
+#ifdef DHD_LOG_DUMP
+               if (ioc->cmd == WLC_GET_VAR || ioc->cmd == WLC_SET_VAR) {
+                       lval = 0;
+                       slen = strlen(ioc->buf) + 1;
+                       msg = (char*)ioc->buf;
+                       if (ioc->cmd == WLC_GET_VAR) {
+                               msg = tmp;
+                       } else {
+                               int min_len = MIN(ioc->len - slen, sizeof(int));
+                               bcopy((msg + slen), &lval, min_len);
+                       }
+                       DHD_ERROR_EX(("%s: cmd: %d, msg: %s, val: 0x%x, len: %d, set: %d\n",
+                               ioc->cmd == WLC_GET_VAR ? "WLC_GET_VAR" : "WLC_SET_VAR",
+                               ioc->cmd, msg, lval, ioc->len, ioc->set));
+               } else {
+                       slen = ioc->len;
+                       if (ioc->buf != NULL) {
+                               val = *(int*)ioc->buf;
+                               pval = (char*)ioc->buf;
+                               pos = tmp;
+                               rem = sizeof(tmp);
+                               memset(tmp, 0, sizeof(tmp));
+                               for (i = 0; i < slen; i++) {
+                                       pos += snprintf(pos, rem, "%02x ", pval[i]);
+                                       rem = sizeof(tmp) - (int)(pos - tmp);
+                                       if (rem <= 0) {
+                                               break;
+                                       }
+                               }
+                               DHD_ERROR_EX(("WLC_IOCTL: cmd: %d, val: %d(%s), len: %d, set: %d\n",
+                               ioc->cmd, val, tmp, ioc->len, ioc->set));
+                       } else {
+                               DHD_ERROR_EX(("WLC_IOCTL: cmd: %d, buf is NULL\n", ioc->cmd));
+                       }
+               }
+#endif /* DHD_LOG_DUMP */
+       }
+
+       return ret;
+}
+
+uint wl_get_port_num(wl_io_pport_t *io_pport)
+{
+       return 0;
+}
+
+/* Get bssidx from iovar params
+ * Input:   dhd_pub - pointer to dhd_pub_t
+ *         params  - IOVAR params
+ * Output:  idx            - BSS index
+ *         val     - ponter to the IOVAR arguments
+ */
+static int
+dhd_iovar_parse_bssidx(dhd_pub_t *dhd_pub, char *params, int *idx, char **val)
+{
+       char *prefix = "bsscfg:";
+       uint32  bssidx;
+
+       if (!(strncmp(params, prefix, strlen(prefix)))) {
+               /* per bss setting should be prefixed with 'bsscfg:' */
+               char *p = (char *)params + strlen(prefix);
+
+               /* Skip Name */
+               while (*p != '\0')
+                       p++;
+               /* consider null */
+               p = p + 1;
+               bcopy(p, &bssidx, sizeof(uint32));
+               /* Get corresponding dhd index */
+               bssidx = dhd_bssidx2idx(dhd_pub, htod32(bssidx));
+
+               if (bssidx >= DHD_MAX_IFS) {
+                       DHD_ERROR(("%s Wrong bssidx provided\n", __FUNCTION__));
+                       return BCME_ERROR;
+               }
+
+               /* skip bss idx */
+               p += sizeof(uint32);
+               *val = p;
+               *idx = bssidx;
+       } else {
+               DHD_ERROR(("%s: bad parameter for per bss iovar\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       return BCME_OK;
+}
+
+#if defined(DHD_DEBUG) && defined(BCMDHDUSB)
+/* USB Device console input function */
+int dhd_bus_console_in(dhd_pub_t *dhd, uchar *msg, uint msglen)
+{
+       DHD_TRACE(("%s \n", __FUNCTION__));
+
+       return dhd_iovar(dhd, 0, "cons", msg, msglen, 1);
+
+}
+#endif /* DHD_DEBUG && BCMDHDUSB  */
+
+static int
+dhd_doiovar(dhd_pub_t *dhd_pub, const bcm_iovar_t *vi, uint32 actionid, const char *name,
+            void *params, int plen, void *arg, int len, int val_size)
+{
+       int bcmerror = 0;
+       int32 int_val = 0;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+       DHD_TRACE(("%s: actionid = %d; name %s\n", __FUNCTION__, actionid, name));
+
+       if ((bcmerror = bcm_iovar_lencheck(vi, arg, len, IOV_ISSET(actionid))) != 0)
+               goto exit;
+
+       if (plen >= (int)sizeof(int_val))
+               bcopy(params, &int_val, sizeof(int_val));
+
+       switch (actionid) {
+       case IOV_GVAL(IOV_VERSION):
+               /* Need to have checked buffer length */
+               bcm_strncpy_s((char*)arg, len, dhd_version, len);
+               break;
+
+       case IOV_GVAL(IOV_MSGLEVEL):
+               int_val = (int32)dhd_msg_level;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_MSGLEVEL):
+#ifdef WL_CFG80211
+               /* Enable DHD and WL logs in oneshot */
+               if (int_val & DHD_WL_VAL2)
+                       wl_cfg80211_enable_trace(TRUE, int_val & (~DHD_WL_VAL2));
+               else if (int_val & DHD_WL_VAL)
+                       wl_cfg80211_enable_trace(FALSE, WL_DBG_DBG);
+               if (!(int_val & DHD_WL_VAL2))
+#endif /* WL_CFG80211 */
+               dhd_msg_level = int_val;
+               break;
+       case IOV_GVAL(IOV_BCMERRORSTR):
+               bcm_strncpy_s((char *)arg, len, bcmerrorstr(dhd_pub->bcmerror), BCME_STRLEN);
+               ((char *)arg)[BCME_STRLEN - 1] = 0x00;
+               break;
+
+       case IOV_GVAL(IOV_BCMERROR):
+               int_val = (int32)dhd_pub->bcmerror;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_GVAL(IOV_WDTICK):
+               int_val = (int32)dhd_watchdog_ms;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_WDTICK):
+               if (!dhd_pub->up) {
+                       bcmerror = BCME_NOTUP;
+                       break;
+               }
+
+               if (CUSTOM_DHD_WATCHDOG_MS == 0 && int_val == 0) {
+                       dhd_watchdog_ms = (uint)int_val;
+               }
+
+               dhd_os_wd_timer(dhd_pub, (uint)int_val);
+               break;
+
+       case IOV_GVAL(IOV_DUMP):
+               bcmerror = dhd_dump(dhd_pub, arg, len);
+               break;
+
+#ifdef DHD_DEBUG
+       case IOV_GVAL(IOV_DCONSOLE_POLL):
+               int_val = (int32)dhd_console_ms;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_DCONSOLE_POLL):
+               dhd_console_ms = (uint)int_val;
+               break;
+
+       case IOV_SVAL(IOV_CONS):
+               if (len > 0)
+                       bcmerror = dhd_bus_console_in(dhd_pub, arg, len - 1);
+               break;
+#endif /* DHD_DEBUG */
+
+       case IOV_SVAL(IOV_CLEARCOUNTS):
+               dhd_pub->tx_packets = dhd_pub->rx_packets = 0;
+               dhd_pub->tx_errors = dhd_pub->rx_errors = 0;
+               dhd_pub->tx_ctlpkts = dhd_pub->rx_ctlpkts = 0;
+               dhd_pub->tx_ctlerrs = dhd_pub->rx_ctlerrs = 0;
+               dhd_pub->tx_dropped = 0;
+               dhd_pub->rx_dropped = 0;
+               dhd_pub->tx_pktgetfail = 0;
+               dhd_pub->rx_pktgetfail = 0;
+               dhd_pub->rx_readahead_cnt = 0;
+               dhd_pub->tx_realloc = 0;
+               dhd_pub->wd_dpc_sched = 0;
+               memset(&dhd_pub->dstats, 0, sizeof(dhd_pub->dstats));
+               dhd_bus_clearcounts(dhd_pub);
+#ifdef PROP_TXSTATUS
+               /* clear proptxstatus related counters */
+               dhd_wlfc_clear_counts(dhd_pub);
+#endif /* PROP_TXSTATUS */
+               DHD_LB_STATS_RESET(dhd_pub);
+               break;
+
+
+       case IOV_GVAL(IOV_IOCTLTIMEOUT): {
+               int_val = (int32)dhd_os_get_ioctl_resp_timeout();
+               bcopy(&int_val, arg, sizeof(int_val));
+               break;
+       }
+
+       case IOV_SVAL(IOV_IOCTLTIMEOUT): {
+               if (int_val <= 0)
+                       bcmerror = BCME_BADARG;
+               else
+                       dhd_os_set_ioctl_resp_timeout((unsigned int)int_val);
+               break;
+       }
+
+
+#ifdef PROP_TXSTATUS
+       case IOV_GVAL(IOV_PROPTXSTATUS_ENABLE): {
+               bool wlfc_enab = FALSE;
+               bcmerror = dhd_wlfc_get_enable(dhd_pub, &wlfc_enab);
+               if (bcmerror != BCME_OK)
+                       goto exit;
+               int_val = wlfc_enab ? 1 : 0;
+               bcopy(&int_val, arg, val_size);
+               break;
+       }
+       case IOV_SVAL(IOV_PROPTXSTATUS_ENABLE): {
+               bool wlfc_enab = FALSE;
+               bcmerror = dhd_wlfc_get_enable(dhd_pub, &wlfc_enab);
+               if (bcmerror != BCME_OK)
+                       goto exit;
+
+               /* wlfc is already set as desired */
+               if (wlfc_enab == (int_val == 0 ? FALSE : TRUE))
+                       goto exit;
+
+               if (int_val == TRUE)
+                       bcmerror = dhd_wlfc_init(dhd_pub);
+               else
+                       bcmerror = dhd_wlfc_deinit(dhd_pub);
+
+               break;
+       }
+       case IOV_GVAL(IOV_PROPTXSTATUS_MODE):
+               bcmerror = dhd_wlfc_get_mode(dhd_pub, &int_val);
+               if (bcmerror != BCME_OK)
+                       goto exit;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_PROPTXSTATUS_MODE):
+               dhd_wlfc_set_mode(dhd_pub, int_val);
+               break;
+
+       case IOV_GVAL(IOV_PROPTXSTATUS_MODULE_IGNORE):
+               bcmerror = dhd_wlfc_get_module_ignore(dhd_pub, &int_val);
+               if (bcmerror != BCME_OK)
+                       goto exit;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_PROPTXSTATUS_MODULE_IGNORE):
+               dhd_wlfc_set_module_ignore(dhd_pub, int_val);
+               break;
+
+       case IOV_GVAL(IOV_PROPTXSTATUS_CREDIT_IGNORE):
+               bcmerror = dhd_wlfc_get_credit_ignore(dhd_pub, &int_val);
+               if (bcmerror != BCME_OK)
+                       goto exit;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_PROPTXSTATUS_CREDIT_IGNORE):
+               dhd_wlfc_set_credit_ignore(dhd_pub, int_val);
+               break;
+
+       case IOV_GVAL(IOV_PROPTXSTATUS_TXSTATUS_IGNORE):
+               bcmerror = dhd_wlfc_get_txstatus_ignore(dhd_pub, &int_val);
+               if (bcmerror != BCME_OK)
+                       goto exit;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_PROPTXSTATUS_TXSTATUS_IGNORE):
+               dhd_wlfc_set_txstatus_ignore(dhd_pub, int_val);
+               break;
+
+       case IOV_GVAL(IOV_PROPTXSTATUS_RXPKT_CHK):
+               bcmerror = dhd_wlfc_get_rxpkt_chk(dhd_pub, &int_val);
+               if (bcmerror != BCME_OK)
+                       goto exit;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_PROPTXSTATUS_RXPKT_CHK):
+               dhd_wlfc_set_rxpkt_chk(dhd_pub, int_val);
+               break;
+
+#endif /* PROP_TXSTATUS */
+
+       case IOV_GVAL(IOV_BUS_TYPE):
+               /* The dhd application queries the driver to check if its usb or sdio.  */
+#ifdef BCMDHDUSB
+               int_val = BUS_TYPE_USB;
+#endif
+#ifdef BCMSDIO
+               int_val = BUS_TYPE_SDIO;
+#endif
+#ifdef PCIE_FULL_DONGLE
+               int_val = BUS_TYPE_PCIE;
+#endif
+               bcopy(&int_val, arg, val_size);
+               break;
+
+
+#ifdef WLMEDIA_HTSF
+       case IOV_GVAL(IOV_WLPKTDLYSTAT_SZ):
+               int_val = dhd_pub->htsfdlystat_sz;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_WLPKTDLYSTAT_SZ):
+               dhd_pub->htsfdlystat_sz = int_val & 0xff;
+               printf("Setting tsfdlystat_sz:%d\n", dhd_pub->htsfdlystat_sz);
+               break;
+#endif
+       case IOV_SVAL(IOV_CHANGEMTU):
+               int_val &= 0xffff;
+               bcmerror = dhd_change_mtu(dhd_pub, int_val, 0);
+               break;
+
+       case IOV_GVAL(IOV_HOSTREORDER_FLOWS):
+       {
+               uint i = 0;
+               uint8 *ptr = (uint8 *)arg;
+               uint8 count = 0;
+
+               ptr++;
+               for (i = 0; i < WLHOST_REORDERDATA_MAXFLOWS; i++) {
+                       if (dhd_pub->reorder_bufs[i] != NULL) {
+                               *ptr = dhd_pub->reorder_bufs[i]->flow_id;
+                               ptr++;
+                               count++;
+                       }
+               }
+               ptr = (uint8 *)arg;
+               *ptr = count;
+               break;
+       }
+#ifdef DHDTCPACK_SUPPRESS
+       case IOV_GVAL(IOV_TCPACK_SUPPRESS): {
+               int_val = (uint32)dhd_pub->tcpack_sup_mode;
+               bcopy(&int_val, arg, val_size);
+               break;
+       }
+       case IOV_SVAL(IOV_TCPACK_SUPPRESS): {
+               bcmerror = dhd_tcpack_suppress_set(dhd_pub, (uint8)int_val);
+               break;
+       }
+#endif /* DHDTCPACK_SUPPRESS */
+#ifdef DHD_WMF
+       case IOV_GVAL(IOV_WMF_BSS_ENAB): {
+               uint32  bssidx;
+               dhd_wmf_t *wmf;
+               char *val;
+
+               if (dhd_iovar_parse_bssidx(dhd_pub, (char *)name, &bssidx, &val) != BCME_OK) {
+                       DHD_ERROR(("%s: wmf_bss_enable: bad parameter\n", __FUNCTION__));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+
+               wmf = dhd_wmf_conf(dhd_pub, bssidx);
+               int_val = wmf->wmf_enable ? 1 :0;
+               bcopy(&int_val, arg, val_size);
+               break;
+       }
+       case IOV_SVAL(IOV_WMF_BSS_ENAB): {
+               /* Enable/Disable WMF */
+               uint32  bssidx;
+               dhd_wmf_t *wmf;
+               char *val;
+
+               if (dhd_iovar_parse_bssidx(dhd_pub, (char *)name, &bssidx, &val) != BCME_OK) {
+                       DHD_ERROR(("%s: wmf_bss_enable: bad parameter\n", __FUNCTION__));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+
+               ASSERT(val);
+               bcopy(val, &int_val, sizeof(uint32));
+               wmf = dhd_wmf_conf(dhd_pub, bssidx);
+               if (wmf->wmf_enable == int_val)
+                       break;
+               if (int_val) {
+                       /* Enable WMF */
+                       if (dhd_wmf_instance_add(dhd_pub, bssidx) != BCME_OK) {
+                               DHD_ERROR(("%s: Error in creating WMF instance\n",
+                               __FUNCTION__));
+                               break;
+                       }
+                       if (dhd_wmf_start(dhd_pub, bssidx) != BCME_OK) {
+                               DHD_ERROR(("%s: Failed to start WMF\n", __FUNCTION__));
+                               break;
+                       }
+                       wmf->wmf_enable = TRUE;
+               } else {
+                       /* Disable WMF */
+                       wmf->wmf_enable = FALSE;
+                       dhd_wmf_stop(dhd_pub, bssidx);
+                       dhd_wmf_instance_del(dhd_pub, bssidx);
+               }
+               break;
+       }
+       case IOV_GVAL(IOV_WMF_UCAST_IGMP):
+               int_val = dhd_pub->wmf_ucast_igmp ? 1 : 0;
+               bcopy(&int_val, arg, val_size);
+               break;
+       case IOV_SVAL(IOV_WMF_UCAST_IGMP):
+               if (dhd_pub->wmf_ucast_igmp == int_val)
+                       break;
+
+               if (int_val >= OFF && int_val <= ON)
+                       dhd_pub->wmf_ucast_igmp = int_val;
+               else
+                       bcmerror = BCME_RANGE;
+               break;
+       case IOV_GVAL(IOV_WMF_MCAST_DATA_SENDUP):
+               int_val = dhd_wmf_mcast_data_sendup(dhd_pub, 0, FALSE, FALSE);
+               bcopy(&int_val, arg, val_size);
+               break;
+       case IOV_SVAL(IOV_WMF_MCAST_DATA_SENDUP):
+               dhd_wmf_mcast_data_sendup(dhd_pub, 0, TRUE, int_val);
+               break;
+
+#ifdef WL_IGMP_UCQUERY
+       case IOV_GVAL(IOV_WMF_UCAST_IGMP_QUERY):
+               int_val = dhd_pub->wmf_ucast_igmp_query ? 1 : 0;
+               bcopy(&int_val, arg, val_size);
+               break;
+       case IOV_SVAL(IOV_WMF_UCAST_IGMP_QUERY):
+               if (dhd_pub->wmf_ucast_igmp_query == int_val)
+                       break;
+
+               if (int_val >= OFF && int_val <= ON)
+                       dhd_pub->wmf_ucast_igmp_query = int_val;
+               else
+                       bcmerror = BCME_RANGE;
+               break;
+#endif /* WL_IGMP_UCQUERY */
+#ifdef DHD_UCAST_UPNP
+       case IOV_GVAL(IOV_WMF_UCAST_UPNP):
+               int_val = dhd_pub->wmf_ucast_upnp ? 1 : 0;
+               bcopy(&int_val, arg, val_size);
+               break;
+       case IOV_SVAL(IOV_WMF_UCAST_UPNP):
+               if (dhd_pub->wmf_ucast_upnp == int_val)
+                       break;
+
+               if (int_val >= OFF && int_val <= ON)
+                       dhd_pub->wmf_ucast_upnp = int_val;
+               else
+                       bcmerror = BCME_RANGE;
+               break;
+#endif /* DHD_UCAST_UPNP */
+#endif /* DHD_WMF */
+
+
+#ifdef DHD_L2_FILTER
+       case IOV_GVAL(IOV_DHCP_UNICAST): {
+               uint32 bssidx;
+               char *val;
+               if (dhd_iovar_parse_bssidx(dhd_pub, (char *)name, &bssidx, &val) != BCME_OK) {
+                       DHD_ERROR(("%s: IOV_DHCP_UNICAST: bad parameterand name = %s\n",
+                               __FUNCTION__, name));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+               int_val = dhd_get_dhcp_unicast_status(dhd_pub, bssidx);
+               memcpy(arg, &int_val, val_size);
+               break;
+       }
+       case IOV_SVAL(IOV_DHCP_UNICAST): {
+               uint32  bssidx;
+               char *val;
+               if (dhd_iovar_parse_bssidx(dhd_pub, (char *)name, &bssidx, &val) != BCME_OK) {
+                       DHD_ERROR(("%s: IOV_DHCP_UNICAST: bad parameterand name = %s\n",
+                               __FUNCTION__, name));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+               memcpy(&int_val, val, sizeof(int_val));
+               bcmerror = dhd_set_dhcp_unicast_status(dhd_pub, bssidx, int_val ? 1 : 0);
+               break;
+       }
+       case IOV_GVAL(IOV_BLOCK_PING): {
+               uint32 bssidx;
+               char *val;
+
+               if (dhd_iovar_parse_bssidx(dhd_pub, (char *)name, &bssidx, &val) != BCME_OK) {
+                       DHD_ERROR(("%s: IOV_BLOCK_PING: bad parameter\n", __FUNCTION__));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+               int_val = dhd_get_block_ping_status(dhd_pub, bssidx);
+               memcpy(arg, &int_val, val_size);
+               break;
+       }
+       case IOV_SVAL(IOV_BLOCK_PING): {
+               uint32  bssidx;
+               char *val;
+
+               if (dhd_iovar_parse_bssidx(dhd_pub, (char *)name, &bssidx, &val) != BCME_OK) {
+                       DHD_ERROR(("%s: IOV_BLOCK_PING: bad parameter\n", __FUNCTION__));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+               memcpy(&int_val, val, sizeof(int_val));
+               bcmerror = dhd_set_block_ping_status(dhd_pub, bssidx, int_val ? 1 : 0);
+               break;
+       }
+       case IOV_GVAL(IOV_PROXY_ARP): {
+               uint32  bssidx;
+               char *val;
+
+               if (dhd_iovar_parse_bssidx(dhd_pub, (char *)name, &bssidx, &val) != BCME_OK) {
+                       DHD_ERROR(("%s: IOV_PROXY_ARP: bad parameter\n", __FUNCTION__));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+               int_val = dhd_get_parp_status(dhd_pub, bssidx);
+               bcopy(&int_val, arg, val_size);
+               break;
+       }
+       case IOV_SVAL(IOV_PROXY_ARP): {
+               uint32  bssidx;
+               char *val;
+               char iobuf[32];
+
+               if (dhd_iovar_parse_bssidx(dhd_pub, (char *)name, &bssidx, &val) != BCME_OK) {
+                       DHD_ERROR(("%s: IOV_PROXY_ARP: bad parameter\n", __FUNCTION__));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+               bcopy(val, &int_val, sizeof(int_val));
+
+               /* Issue a iovar request to WL to update the proxy arp capability bit
+                * in the Extended Capability IE of beacons/probe responses.
+                */
+               bcm_mkiovar("proxy_arp_advertise", val, sizeof(int_val), iobuf,
+                       sizeof(iobuf));
+               bcmerror =  dhd_wl_ioctl_cmd(dhd_pub, WLC_SET_VAR, iobuf,
+                       sizeof(iobuf),  TRUE, bssidx);
+
+               if (bcmerror == BCME_OK) {
+                       dhd_set_parp_status(dhd_pub, bssidx, int_val ? 1 : 0);
+               }
+               break;
+       }
+       case IOV_GVAL(IOV_GRAT_ARP): {
+               uint32 bssidx;
+               char *val;
+
+               if (dhd_iovar_parse_bssidx(dhd_pub, (char *)name, &bssidx, &val) != BCME_OK) {
+                       DHD_ERROR(("%s: IOV_GRAT_ARP: bad parameter\n", __FUNCTION__));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+               int_val = dhd_get_grat_arp_status(dhd_pub, bssidx);
+               memcpy(arg, &int_val, val_size);
+               break;
+       }
+       case IOV_SVAL(IOV_GRAT_ARP): {
+               uint32  bssidx;
+               char *val;
+
+               if (dhd_iovar_parse_bssidx(dhd_pub, (char *)name, &bssidx, &val) != BCME_OK) {
+                       DHD_ERROR(("%s: IOV_GRAT_ARP: bad parameter\n", __FUNCTION__));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+               memcpy(&int_val, val, sizeof(int_val));
+               bcmerror = dhd_set_grat_arp_status(dhd_pub, bssidx, int_val ? 1 : 0);
+               break;
+       }
+#endif /* DHD_L2_FILTER */
+       case IOV_GVAL(IOV_AP_ISOLATE): {
+               uint32  bssidx;
+               char *val;
+
+               if (dhd_iovar_parse_bssidx(dhd_pub, (char *)name, &bssidx, &val) != BCME_OK) {
+                       DHD_ERROR(("%s: ap isoalate: bad parameter\n", __FUNCTION__));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+
+               int_val = dhd_get_ap_isolate(dhd_pub, bssidx);
+               bcopy(&int_val, arg, val_size);
+               break;
+       }
+       case IOV_SVAL(IOV_AP_ISOLATE): {
+               uint32  bssidx;
+               char *val;
+
+               if (dhd_iovar_parse_bssidx(dhd_pub, (char *)name, &bssidx, &val) != BCME_OK) {
+                       DHD_ERROR(("%s: ap isolate: bad parameter\n", __FUNCTION__));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+
+               ASSERT(val);
+               bcopy(val, &int_val, sizeof(uint32));
+               dhd_set_ap_isolate(dhd_pub, bssidx, int_val);
+               break;
+       }
+#ifdef DHD_PSTA
+       case IOV_GVAL(IOV_PSTA): {
+               int_val = dhd_get_psta_mode(dhd_pub);
+               bcopy(&int_val, arg, val_size);
+               break;
+               }
+       case IOV_SVAL(IOV_PSTA): {
+               if (int_val >= DHD_MODE_PSTA_DISABLED && int_val <= DHD_MODE_PSR) {
+                       dhd_set_psta_mode(dhd_pub, int_val);
+               } else {
+                       bcmerror = BCME_RANGE;
+               }
+               break;
+               }
+#endif /* DHD_PSTA */
+       case IOV_GVAL(IOV_CFG80211_OPMODE): {
+               int_val = (int32)dhd_pub->op_mode;
+               bcopy(&int_val, arg, sizeof(int_val));
+               break;
+               }
+       case IOV_SVAL(IOV_CFG80211_OPMODE): {
+               if (int_val <= 0)
+                       bcmerror = BCME_BADARG;
+               else
+                       dhd_pub->op_mode = int_val;
+               break;
+       }
+
+       case IOV_GVAL(IOV_ASSERT_TYPE):
+               int_val = g_assert_type;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_ASSERT_TYPE):
+               g_assert_type = (uint32)int_val;
+               break;
+
+
+       case IOV_GVAL(IOV_LMTEST): {
+               *(uint32 *)arg = (uint32)lmtest;
+               break;
+       }
+
+       case IOV_SVAL(IOV_LMTEST): {
+               uint32 val = *(uint32 *)arg;
+               if (val > 50)
+                       bcmerror = BCME_BADARG;
+               else {
+                       lmtest = (uint)val;
+                       DHD_ERROR(("%s: lmtest %s\n",
+                               __FUNCTION__, (lmtest == FALSE)? "OFF" : "ON"));
+               }
+               break;
+       }
+
+       default:
+               bcmerror = BCME_UNSUPPORTED;
+               break;
+       }
+
+exit:
+       DHD_TRACE(("%s: actionid %d, bcmerror %d\n", __FUNCTION__, actionid, bcmerror));
+       return bcmerror;
+}
+
+/* Store the status of a connection attempt for later retrieval by an iovar */
+void
+dhd_store_conn_status(uint32 event, uint32 status, uint32 reason)
+{
+       /* Do not overwrite a WLC_E_PRUNE with a WLC_E_SET_SSID
+        * because an encryption/rsn mismatch results in both events, and
+        * the important information is in the WLC_E_PRUNE.
+        */
+       if (!(event == WLC_E_SET_SSID && status == WLC_E_STATUS_FAIL &&
+             dhd_conn_event == WLC_E_PRUNE)) {
+               dhd_conn_event = event;
+               dhd_conn_status = status;
+               dhd_conn_reason = reason;
+       }
+}
+
+bool
+dhd_prec_enq(dhd_pub_t *dhdp, struct pktq *q, void *pkt, int prec)
+{
+       void *p;
+       int eprec = -1;         /* precedence to evict from */
+       bool discard_oldest;
+
+       /* Fast case, precedence queue is not full and we are also not
+        * exceeding total queue length
+        */
+       if (!pktq_pfull(q, prec) && !pktq_full(q)) {
+               pktq_penq(q, prec, pkt);
+               return TRUE;
+       }
+
+       /* Determine precedence from which to evict packet, if any */
+       if (pktq_pfull(q, prec))
+               eprec = prec;
+       else if (pktq_full(q)) {
+               p = pktq_peek_tail(q, &eprec);
+               ASSERT(p);
+               if (eprec > prec || eprec < 0)
+                       return FALSE;
+       }
+
+       /* Evict if needed */
+       if (eprec >= 0) {
+               /* Detect queueing to unconfigured precedence */
+               ASSERT(!pktq_pempty(q, eprec));
+               discard_oldest = AC_BITMAP_TST(dhdp->wme_dp, eprec);
+               if (eprec == prec && !discard_oldest)
+                       return FALSE;           /* refuse newer (incoming) packet */
+               /* Evict packet according to discard policy */
+               p = discard_oldest ? pktq_pdeq(q, eprec) : pktq_pdeq_tail(q, eprec);
+               ASSERT(p);
+#ifdef DHDTCPACK_SUPPRESS
+               if (dhd_tcpack_check_xmit(dhdp, p) == BCME_ERROR) {
+                       DHD_ERROR(("%s %d: tcpack_suppress ERROR!!! Stop using it\n",
+                               __FUNCTION__, __LINE__));
+                       dhd_tcpack_suppress_set(dhdp, TCPACK_SUP_OFF);
+               }
+#endif /* DHDTCPACK_SUPPRESS */
+               PKTFREE(dhdp->osh, p, TRUE);
+       }
+
+       /* Enqueue */
+       p = pktq_penq(q, prec, pkt);
+       ASSERT(p);
+
+       return TRUE;
+}
+
+/*
+ * Functions to drop proper pkts from queue:
+ *     If one pkt in queue is non-fragmented, drop first non-fragmented pkt only
+ *     If all pkts in queue are all fragmented, find and drop one whole set fragmented pkts
+ *     If can't find pkts matching upper 2 cases, drop first pkt anyway
+ */
+bool
+dhd_prec_drop_pkts(dhd_pub_t *dhdp, struct pktq *pq, int prec, f_droppkt_t fn)
+{
+       struct pktq_prec *q = NULL;
+       void *p, *prev = NULL, *next = NULL, *first = NULL, *last = NULL, *prev_first = NULL;
+       pkt_frag_t frag_info;
+
+       ASSERT(dhdp && pq);
+       ASSERT(prec >= 0 && prec < pq->num_prec);
+
+       q = &pq->q[prec];
+       p = q->head;
+
+       if (p == NULL)
+               return FALSE;
+
+       while (p) {
+               frag_info = pkt_frag_info(dhdp->osh, p);
+               if (frag_info == DHD_PKT_FRAG_NONE) {
+                       break;
+               } else if (frag_info == DHD_PKT_FRAG_FIRST) {
+                       if (first) {
+                               /* No last frag pkt, use prev as last */
+                               last = prev;
+                               break;
+                       } else {
+                               first = p;
+                               prev_first = prev;
+                       }
+               } else if (frag_info == DHD_PKT_FRAG_LAST) {
+                       if (first) {
+                               last = p;
+                               break;
+                       }
+               }
+
+               prev = p;
+               p = PKTLINK(p);
+       }
+
+       if ((p == NULL) || ((frag_info != DHD_PKT_FRAG_NONE) && !(first && last))) {
+               /* Not found matching pkts, use oldest */
+               prev = NULL;
+               p = q->head;
+               frag_info = 0;
+       }
+
+       if (frag_info == DHD_PKT_FRAG_NONE) {
+               first = last = p;
+               prev_first = prev;
+       }
+
+       p = first;
+       while (p) {
+               next = PKTLINK(p);
+               q->len--;
+               pq->len--;
+
+               PKTSETLINK(p, NULL);
+
+               if (fn)
+                       fn(dhdp, prec, p, TRUE);
+
+               if (p == last)
+                       break;
+
+               p = next;
+       }
+
+       if (prev_first == NULL) {
+               if ((q->head = next) == NULL)
+                       q->tail = NULL;
+       } else {
+               PKTSETLINK(prev_first, next);
+               if (!next)
+                       q->tail = prev_first;
+       }
+
+       return TRUE;
+}
+
+static int
+dhd_iovar_op(dhd_pub_t *dhd_pub, const char *name,
+       void *params, int plen, void *arg, int len, bool set)
+{
+       int bcmerror = 0;
+       int val_size;
+       const bcm_iovar_t *vi = NULL;
+       uint32 actionid;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       ASSERT(name);
+       ASSERT(len >= 0);
+
+       /* Get MUST have return space */
+       ASSERT(set || (arg && len));
+
+       /* Set does NOT take qualifiers */
+       ASSERT(!set || (!params && !plen));
+
+       if ((vi = bcm_iovar_lookup(dhd_iovars, name)) == NULL) {
+               bcmerror = BCME_UNSUPPORTED;
+               goto exit;
+       }
+
+       DHD_CTL(("%s: %s %s, len %d plen %d\n", __FUNCTION__,
+               name, (set ? "set" : "get"), len, plen));
+
+       /* set up 'params' pointer in case this is a set command so that
+        * the convenience int and bool code can be common to set and get
+        */
+       if (params == NULL) {
+               params = arg;
+               plen = len;
+       }
+
+       if (vi->type == IOVT_VOID)
+               val_size = 0;
+       else if (vi->type == IOVT_BUFFER)
+               val_size = len;
+       else
+               /* all other types are integer sized */
+               val_size = sizeof(int);
+
+       actionid = set ? IOV_SVAL(vi->varid) : IOV_GVAL(vi->varid);
+
+       bcmerror = dhd_doiovar(dhd_pub, vi, actionid, name, params, plen, arg, len, val_size);
+
+exit:
+       return bcmerror;
+}
+
+int
+dhd_ioctl(dhd_pub_t * dhd_pub, dhd_ioctl_t *ioc, void * buf, uint buflen)
+{
+       int bcmerror = 0;
+       unsigned long flags;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (!buf) {
+               return BCME_BADARG;
+       }
+
+       dhd_os_dhdiovar_lock(dhd_pub);
+       switch (ioc->cmd) {
+               case DHD_GET_MAGIC:
+                       if (buflen < sizeof(int))
+                               bcmerror = BCME_BUFTOOSHORT;
+                       else
+                               *(int*)buf = DHD_IOCTL_MAGIC;
+                       break;
+
+               case DHD_GET_VERSION:
+                       if (buflen < sizeof(int))
+                               bcmerror = BCME_BUFTOOSHORT;
+                       else
+                               *(int*)buf = DHD_IOCTL_VERSION;
+                       break;
+
+               case DHD_GET_VAR:
+               case DHD_SET_VAR:
+                       {
+                               char *arg;
+                               uint arglen;
+
+                               DHD_GENERAL_LOCK(dhd_pub, flags);
+                               if (dhd_pub->busstate == DHD_BUS_DOWN ||
+                                               dhd_pub->busstate == DHD_BUS_DOWN_IN_PROGRESS) {
+                                       /* In platforms like FC19, the FW download is done via IOCTL
+                                        * and should not return error for IOCTLs fired before FW
+                                        * Download is done
+                                        */
+                                       if (dhd_pub->is_fw_download_done) {
+                                               DHD_ERROR(("%s: returning as busstate=%d\n",
+                                                               __FUNCTION__, dhd_pub->busstate));
+                                               DHD_GENERAL_UNLOCK(dhd_pub, flags);
+                                               dhd_os_dhdiovar_unlock(dhd_pub);
+                                               return -ENODEV;
+                                       }
+                               }
+                               dhd_pub->dhd_bus_busy_state |= DHD_BUS_BUSY_IN_DHD_IOVAR;
+                               DHD_GENERAL_UNLOCK(dhd_pub, flags);
+#ifdef DHD_PCIE_RUNTIMEPM
+                               dhdpcie_runtime_bus_wake(dhd_pub, TRUE, dhd_ioctl);
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+                               /* scan past the name to any arguments */
+                               for (arg = buf, arglen = buflen; *arg && arglen; arg++, arglen--)
+                                       ;
+
+                               if (*arg) {
+                                       bcmerror = BCME_BUFTOOSHORT;
+                                       goto unlock_exit;
+                               }
+
+                               /* account for the NUL terminator */
+                               arg++, arglen--;
+
+                               /* call with the appropriate arguments */
+                               if (ioc->cmd == DHD_GET_VAR) {
+                                       bcmerror = dhd_iovar_op(dhd_pub, buf, arg, arglen,
+                                                       buf, buflen, IOV_GET);
+                               } else {
+                                       bcmerror = dhd_iovar_op(dhd_pub, buf, NULL, 0,
+                                                       arg, arglen, IOV_SET);
+                               }
+                               if (bcmerror != BCME_UNSUPPORTED) {
+                                       goto unlock_exit;
+                               }
+
+                               /* not in generic table, try protocol module */
+                               if (ioc->cmd == DHD_GET_VAR) {
+                                       bcmerror = dhd_prot_iovar_op(dhd_pub, buf, arg,
+                                                       arglen, buf, buflen, IOV_GET);
+                               } else {
+                                       bcmerror = dhd_prot_iovar_op(dhd_pub, buf,
+                                                       NULL, 0, arg, arglen, IOV_SET);
+                               }
+                               if (bcmerror != BCME_UNSUPPORTED) {
+                                       goto unlock_exit;
+                               }
+
+                               /* if still not found, try bus module */
+                               if (ioc->cmd == DHD_GET_VAR) {
+                                       bcmerror = dhd_bus_iovar_op(dhd_pub, buf,
+                                                       arg, arglen, buf, buflen, IOV_GET);
+                               } else {
+                                       bcmerror = dhd_bus_iovar_op(dhd_pub, buf,
+                                                       NULL, 0, arg, arglen, IOV_SET);
+                               }
+                       }
+                       goto unlock_exit;
+
+               default:
+                       bcmerror = BCME_UNSUPPORTED;
+       }
+       dhd_os_dhdiovar_unlock(dhd_pub);
+       return bcmerror;
+
+unlock_exit:
+       DHD_GENERAL_LOCK(dhd_pub, flags);
+       dhd_pub->dhd_bus_busy_state &= ~DHD_BUS_BUSY_IN_DHD_IOVAR;
+       dhd_os_busbusy_wake(dhd_pub);
+       DHD_GENERAL_UNLOCK(dhd_pub, flags);
+       dhd_os_dhdiovar_unlock(dhd_pub);
+       return bcmerror;
+}
+
+#ifdef SHOW_EVENTS
+#ifdef SHOW_LOGTRACE
+
+#define MAX_NO_OF_ARG  16
+
+#define FMTSTR_SIZE    132
+#define SIZE_LOC_STR   50
+#define MIN_DLEN       4
+#define TAG_BYTES      12
+#define TAG_WORDS      3
+#define ROMSTR_SIZE    200
+
+
+static int
+check_event_log_sequence_number(uint32 seq_no)
+{
+       int32 diff;
+       uint32 ret;
+       static uint32 logtrace_seqnum_prev = 0;
+
+       diff = ntoh32(seq_no)-logtrace_seqnum_prev;
+       switch (diff)
+       {
+               case 0:
+                       ret = -1; /* duplicate packet . drop */
+                       break;
+
+               case 1:
+                       ret =0; /* in order */
+                       break;
+
+               default:
+                       if ((ntoh32(seq_no) == 0) &&
+                               (logtrace_seqnum_prev == 0xFFFFFFFF) ) { /* in-order - Roll over */
+                                       ret = 0;
+                       } else {
+
+                               if (diff > 0) {
+                                       DHD_EVENT(("WLC_E_TRACE:"
+                                               "Event lost (log) seqnum %d nblost %d\n",
+                                               ntoh32(seq_no), (diff-1)));
+                               } else {
+                                       DHD_EVENT(("WLC_E_TRACE:"
+                                               "Event Packets coming out of order!!\n"));
+                               }
+                               ret = 0;
+                       }
+       }
+
+       logtrace_seqnum_prev = ntoh32(seq_no);
+
+       return ret;
+}
+
+static void
+dhd_eventmsg_print(dhd_pub_t *dhd_pub, void *event_data, void *raw_event_ptr,
+               uint datalen, const char *event_name)
+{
+       msgtrace_hdr_t hdr;
+       uint32 nblost;
+       uint8 count;
+       char *s, *p;
+       static uint32 seqnum_prev = 0;
+       uint32 *log_ptr =  NULL;
+       uchar *buf;
+       event_log_hdr_t event_hdr;
+       uint32 i;
+       int32 j;
+
+       dhd_event_log_t *raw_event = (dhd_event_log_t *) raw_event_ptr;
+
+       char fmtstr_loc_buf[FMTSTR_SIZE] = {0};
+       char (*str_buf)[SIZE_LOC_STR] = NULL;
+       char * str_tmpptr = NULL;
+       uint32 addr = 0;
+       uint32 **hdr_ptr = NULL;
+       uint32 h_i = 0;
+       uint32 hdr_ptr_len = 0;
+
+       typedef union {
+               uint32 val;
+               char * addr;
+       } u_arg;
+       u_arg arg[MAX_NO_OF_ARG] = {{0}};
+       char *c_ptr = NULL;
+       char rom_log_str[ROMSTR_SIZE] = {0};
+       uint32 rom_str_len = 0;
+
+       BCM_REFERENCE(arg);
+
+       if (!DHD_FWLOG_ON())
+               return;
+
+       buf = (uchar *) event_data;
+       memcpy(&hdr, buf, MSGTRACE_HDRLEN);
+
+       if (hdr.version != MSGTRACE_VERSION) {
+               DHD_EVENT(("\nMACEVENT: %s [unsupported version --> "
+                       "dhd version:%d dongle version:%d]\n",
+                       event_name, MSGTRACE_VERSION, hdr.version));
+               /* Reset datalen to avoid display below */
+               datalen = 0;
+               return;
+       }
+
+       if (hdr.trace_type == MSGTRACE_HDR_TYPE_MSG) {
+               /* There are 2 bytes available at the end of data */
+               buf[MSGTRACE_HDRLEN + ntoh16(hdr.len)] = '\0';
+
+               if (ntoh32(hdr.discarded_bytes) || ntoh32(hdr.discarded_printf)) {
+                       DHD_FWLOG(("WLC_E_TRACE: [Discarded traces in dongle -->"
+                               "discarded_bytes %d discarded_printf %d]\n",
+                               ntoh32(hdr.discarded_bytes),
+                               ntoh32(hdr.discarded_printf)));
+               }
+
+               nblost = ntoh32(hdr.seqnum) - seqnum_prev - 1;
+               if (nblost > 0) {
+                       DHD_FWLOG(("WLC_E_TRACE:"
+                               "[Event lost (msg) --> seqnum %d nblost %d\n",
+                               ntoh32(hdr.seqnum), nblost));
+               }
+               seqnum_prev = ntoh32(hdr.seqnum);
+
+               /* Display the trace buffer. Advance from
+                * \n to \n to avoid display big
+                * printf (issue with Linux printk )
+                */
+               p = (char *)&buf[MSGTRACE_HDRLEN];
+               while (*p != '\0' && (s = strstr(p, "\n")) != NULL) {
+                       *s = '\0';
+                       DHD_FWLOG(("[FWLOG] %s\n", p));
+                       p = s+1;
+               }
+               if (*p)
+                       DHD_FWLOG(("[FWLOG] %s", p));
+
+               /* Reset datalen to avoid display below */
+               datalen = 0;
+
+       } else if (hdr.trace_type == MSGTRACE_HDR_TYPE_LOG) {
+               /* Let the standard event printing work for now */
+               uint32 timestamp, seq, pktlen;
+
+               if (check_event_log_sequence_number(hdr.seqnum)) {
+
+                       DHD_EVENT(("%s: WLC_E_TRACE:"
+                               "[Event duplicate (log) %d] dropping!!\n",
+                               __FUNCTION__, hdr.seqnum));
+                       return; /* drop duplicate events */
+               }
+
+               p = (char *)&buf[MSGTRACE_HDRLEN];
+               datalen -= MSGTRACE_HDRLEN;
+               pktlen = ltoh16(*((uint16 *)p));
+               seq = ltoh16(*((uint16 *)(p + 2)));
+               p += MIN_DLEN;
+               datalen -= MIN_DLEN;
+               timestamp = ltoh32(*((uint32 *)p));
+               BCM_REFERENCE(pktlen);
+               BCM_REFERENCE(seq);
+               BCM_REFERENCE(timestamp);
+
+               /*
+               * Allocating max possible number of event TAGs in the received buffer
+               * considering  that  each event requires minimum of TAG_BYTES.
+               */
+               hdr_ptr_len = ((datalen/TAG_BYTES)+1) * sizeof(uint32*);
+
+               if ((raw_event->fmts)) {
+                       if (!(str_buf = MALLOCZ(dhd_pub->osh, (MAX_NO_OF_ARG * SIZE_LOC_STR)))) {
+                               DHD_ERROR(("%s: malloc failed str_buf \n", __FUNCTION__));
+                       }
+               }
+
+               if (!(hdr_ptr = MALLOCZ(dhd_pub->osh, hdr_ptr_len))) {
+                       DHD_ERROR(("%s: malloc failed hdr_ptr \n", __FUNCTION__));
+               }
+
+
+               DHD_MSGTRACE_LOG(("EVENT_LOG_HDR[No.%d]: timestamp 0x%08x length = %d\n",
+                               seq, timestamp, pktlen));
+
+               /* (raw_event->fmts) has value */
+
+               log_ptr = (uint32 *) (p + datalen);
+
+               /* Store all hdr pointer while parsing from last of the log buffer
+               * sample format of
+               * 001d3c54 00000064 00000064 001d3c54 001dba08 035d6ce1 0c540639
+               * 001d3c54 00000064 00000064 035d6d89 0c580439
+               * in above example 0c580439 -- 39 is tag , 04 is count, 580c is format number
+               * all these uint32 values comes in reverse order as group as EL data
+               * while decoding we can parse only from last to first
+               */
+
+               while (datalen > MIN_DLEN) {
+                       log_ptr--;
+                       datalen -= MIN_DLEN;
+                       event_hdr.t = *log_ptr;
+                       /*
+                        * Check for partially overriten entries
+                        */
+                       if (log_ptr - (uint32 *) p < event_hdr.count) {
+                               break;
+                       }
+                       /*
+                        * Check argument count (only when format is valid)
+                        */
+                       if ((event_hdr.count > MAX_NO_OF_ARG) &&
+                           (event_hdr.fmt_num != 0xffff)) {
+                               break;
+                       }
+                       /*
+                        * Check for end of the Frame.
+                        */
+                       if (event_hdr.tag ==  EVENT_LOG_TAG_NULL) {
+                               continue;
+                       }
+                       log_ptr[0] = event_hdr.t;
+                       if (h_i < (hdr_ptr_len / sizeof(uint32*))) {
+                               hdr_ptr[h_i++] = log_ptr;
+                       }
+
+                       /* Now place the header at the front
+                        * and copy back.
+                        */
+                       log_ptr -= event_hdr.count;
+
+                       c_ptr = NULL;
+                       datalen = datalen - (event_hdr.count * MIN_DLEN);
+               }
+               datalen = 0;
+
+               /* print all log using stored hdr pointer in reverse order of EL data
+                * which is actually print older log first and then other in order
+                */
+
+               for (j = (h_i-1); j >= 0; j--) {
+                       if (!(hdr_ptr[j])) {
+                               break;
+                       }
+
+                       event_hdr.t = *hdr_ptr[j];
+
+                       log_ptr = hdr_ptr[j];
+
+                       /* Now place the header at the front
+                       * and copy back.
+                       */
+                       log_ptr -= event_hdr.count;
+
+                       if (event_hdr.tag == EVENT_LOG_TAG_ROM_PRINTF) {
+
+                               rom_str_len = ((event_hdr.count)-1) * sizeof(uint32);
+
+                               if (rom_str_len >= (ROMSTR_SIZE -1)) {
+                                       rom_str_len = ROMSTR_SIZE - 1;
+                               }
+
+                               /* copy all ascii data for ROM printf to local string */
+                               memcpy(rom_log_str, log_ptr, rom_str_len);
+                               /* add end of line at last */
+                               rom_log_str[rom_str_len] = '\0';
+
+                               DHD_MSGTRACE_LOG(("EVENT_LOG_ROM[0x%08x]: %s",
+                                       log_ptr[event_hdr.count - 1], rom_log_str));
+
+                               /* Add newline if missing */
+                               if (rom_log_str[strlen(rom_log_str) - 1] != '\n') {
+                                       DHD_EVENT(("\n"));
+                               }
+
+                               memset(rom_log_str, 0, ROMSTR_SIZE);
+
+                               continue;
+                       }
+
+                       /*
+                        * Check For Special Time Stamp Packet
+                        */
+                       if (event_hdr.tag == EVENT_LOG_TAG_TS) {
+                               DHD_MSGTRACE_LOG(("EVENT_LOG_TS[0x%08x]: SYS:%08x CPU:%08x\n",
+                                       log_ptr[event_hdr.count-1], log_ptr[0], log_ptr[1]));
+                               continue;
+                       }
+
+                       /* Simply print out event dump buffer (fmt_num = 0xffff) */
+                       if (!str_buf || event_hdr.fmt_num == 0xffff) {
+                               /*
+                                * Print out raw value if unable to interpret
+                                */
+#ifdef DHD_LOG_DUMP
+                               char buf[256];
+                               char *pos = buf;
+                               memset(buf, 0, sizeof(buf));
+                               pos += snprintf(pos, 256,
+#else
+                               DHD_MSGTRACE_LOG((
+#endif /* DHD_LOG_DUMP */
+                                       "EVENT_LOG_BUF[0x%08x]: tag=%d len=%d fmt=%04x",
+                                       log_ptr[event_hdr.count-1], event_hdr.tag,
+                                       event_hdr.count, event_hdr.fmt_num
+#ifdef DHD_LOG_DUMP
+);
+#else
+));
+#endif /* DHD_LOG_DUMP */
+
+                               for (count = 0; count < (event_hdr.count-1); count++) {
+#ifdef DHD_LOG_DUMP
+                                       if (strlen(buf) >= (256 - 1)) {
+                                               DHD_MSGTRACE_LOG(("%s\n", buf));
+                                               memset(buf, 0, sizeof(buf));
+                                               pos = buf;
+                                       }
+                                       pos += snprintf(pos, (256 - (int)(pos-buf)),
+                                               " %08x", log_ptr[count]);
+#else
+                                       if (count % 8 == 0)
+                                               DHD_MSGTRACE_LOG(("\n\t%08x", log_ptr[count]));
+                                       else
+                                               DHD_MSGTRACE_LOG((" %08x", log_ptr[count]));
+#endif /* DHD_LOG_DUMP */
+                               }
+#ifdef DHD_LOG_DUMP
+                               DHD_MSGTRACE_LOG(("%s\n", buf));
+#else
+                               DHD_MSGTRACE_LOG(("\n"));
+#endif /* DHD_LOG_DUMP */
+                               continue;
+                       }
+
+                       /* Copy the format string to parse %s and add "EVENT_LOG:  */
+                       if ((event_hdr.fmt_num >> 2) < raw_event->num_fmts) {
+                               snprintf(fmtstr_loc_buf, FMTSTR_SIZE,
+                                       "EVENT_LOG[0x%08x]: %s", log_ptr[event_hdr.count-1],
+                                       raw_event->fmts[event_hdr.fmt_num >> 2]);
+                               c_ptr = fmtstr_loc_buf;
+                       } else {
+                               DHD_ERROR(("%s: fmt number out of range \n", __FUNCTION__));
+                               continue;
+                       }
+
+                       for (count = 0; count < (event_hdr.count-1); count++) {
+                               if (c_ptr != NULL) {
+                                       if ((c_ptr = strstr(c_ptr, "%")) != NULL) {
+                                               c_ptr++;
+                                       }
+                               }
+
+                               if ((c_ptr != NULL) && (*c_ptr == 's')) {
+                                       if ((raw_event->raw_sstr) &&
+                                               ((log_ptr[count] > raw_event->rodata_start) &&
+                                               (log_ptr[count] < raw_event->rodata_end))) {
+                                               /* ram static string */
+                                               addr = log_ptr[count] - raw_event->rodata_start;
+                                               str_tmpptr = raw_event->raw_sstr + addr;
+                                               memcpy(str_buf[count], str_tmpptr, SIZE_LOC_STR);
+                                               str_buf[count][SIZE_LOC_STR-1] = '\0';
+                                               arg[count].addr = str_buf[count];
+                                       } else if ((raw_event->rom_raw_sstr) &&
+                                                       ((log_ptr[count] >
+                                                       raw_event->rom_rodata_start) &&
+                                                       (log_ptr[count] <
+                                                       raw_event->rom_rodata_end))) {
+                                               /* rom static string */
+                                               addr = log_ptr[count] - raw_event->rom_rodata_start;
+                                               str_tmpptr = raw_event->rom_raw_sstr + addr;
+                                               memcpy(str_buf[count], str_tmpptr, SIZE_LOC_STR);
+                                               str_buf[count][SIZE_LOC_STR-1] = '\0';
+                                               arg[count].addr = str_buf[count];
+                                       } else {
+                                               /*
+                                               *  Dynamic string OR
+                                               * No data for static string.
+                                               * So store all string's address as string.
+                                               */
+                                               snprintf(str_buf[count], SIZE_LOC_STR, "(s)0x%x",
+                                                       log_ptr[count]);
+                                                       arg[count].addr = str_buf[count];
+                                       }
+                               } else {
+                                       /* Other than string */
+                                       arg[count].val = log_ptr[count];
+                               }
+                       }
+
+                       DHD_MSGTRACE_LOG((fmtstr_loc_buf, arg[0], arg[1], arg[2], arg[3],
+                               arg[4], arg[5], arg[6], arg[7], arg[8], arg[9], arg[10],
+                               arg[11], arg[12], arg[13], arg[14], arg[15]));
+
+                       if (fmtstr_loc_buf[strlen(fmtstr_loc_buf) - 1] != '\n') {
+                               /* Add newline if missing */
+                               DHD_MSGTRACE_LOG(("\n"));
+                       }
+
+                       memset(fmtstr_loc_buf, 0, FMTSTR_SIZE);
+
+                       for (i = 0; i < MAX_NO_OF_ARG; i++) {
+                               arg[i].addr = 0;
+                       }
+                       for (i = 0; i < MAX_NO_OF_ARG; i++) {
+                               memset(str_buf[i], 0, SIZE_LOC_STR);
+                       }
+
+               }
+               DHD_MSGTRACE_LOG(("\n"));
+
+               if (str_buf) {
+                       MFREE(dhd_pub->osh, str_buf, (MAX_NO_OF_ARG * SIZE_LOC_STR));
+               }
+
+               if (hdr_ptr) {
+                       MFREE(dhd_pub->osh, hdr_ptr, hdr_ptr_len);
+               }
+       }
+}
+
+#endif /* SHOW_LOGTRACE */
+
+#define SDB_ENABLE_AP  0x01
+#define SDB_ENABLE_P2P 0x02
+#define SDB_IS_AP(i)   (i & SDB_ENABLE_AP)
+#define SDB_IS_P2P(i)  (i & SDB_ENABLE_P2P)
+
+#define WLC_RSDB_MODE_AUTO_MASK 0x80
+#define WLC_RSDB_EXTRACT_MODE(val) ((int8)((val) & (~(WLC_RSDB_MODE_AUTO_MASK))))
+
+static void
+wl_event_sdb_transition_print(void *event_data, const char *event_name)
+{
+       wl_event_sdb_trans_t *rdata;
+       wl_event_sdb_data_t *value;
+       char *sta_mode = "";
+       int i;
+       char chanbuf[CHANSPEC_STR_LEN];
+       rdata = (wl_event_sdb_trans_t *)event_data;
+
+       if (!rdata) {
+               DHD_ERROR(("%s: event_data is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       if (rdata->version != WL_EVENT_SDB_TRANSITION_VER) {
+               DHD_ERROR(("%s: invalid Version(%d)\n", __FUNCTION__, rdata->version));
+               return;
+       }
+
+       if (rdata->rsdb_mode & WLC_RSDB_MODE_AUTO_MASK) {
+               DHD_ERROR((" RSDB Mode : Auto, "));
+       }
+       DHD_ERROR(("Current RSDB Mode : %d\n", WLC_RSDB_EXTRACT_MODE(rdata->rsdb_mode)));
+
+       for (i = 0; i < rdata->enable_bsscfg; i++) {
+               value = &rdata->values[i];
+
+               if (SDB_IS_P2P(value->is_iftype)) {
+                       sta_mode = SDB_IS_AP(value->is_iftype) ? "P2P_GO" : "P2P_GC";
+               } else {
+                       sta_mode = SDB_IS_AP(value->is_iftype) ? "SoftAP" : "Station";
+               }
+
+               wf_chspec_ntoa_ex(value->chanspec, chanbuf);
+               DHD_ERROR((" wlc%d <%s> \"%s\", %s(0x%04x)\n",
+                       value->wlunit, sta_mode,
+                       value->ssidbuf, chanbuf, value->chanspec));
+       }
+}
+
+
+static void
+wl_show_host_event(dhd_pub_t *dhd_pub, wl_event_msg_t *event, void *event_data,
+       void *raw_event_ptr, char *eventmask)
+{
+       uint i, status, reason;
+       bool group = FALSE, flush_txq = FALSE, link = FALSE;
+       bool host_data = FALSE; /* prints  event data after the case  when set */
+       const char *auth_str;
+       const char *event_name;
+       uchar *buf;
+       char err_msg[256], eabuf[ETHER_ADDR_STR_LEN];
+       uint event_type, flags, auth_type, datalen;
+
+       event_type = ntoh32(event->event_type);
+       flags = ntoh16(event->flags);
+       status = ntoh32(event->status);
+       reason = ntoh32(event->reason);
+       BCM_REFERENCE(reason);
+       auth_type = ntoh32(event->auth_type);
+       datalen = ntoh32(event->datalen);
+
+       /* debug dump of event messages */
+       snprintf(eabuf, sizeof(eabuf), "%02x:%02x:%02x:%02x:%02x:%02x",
+               (uchar)event->addr.octet[0]&0xff,
+               (uchar)event->addr.octet[1]&0xff,
+               (uchar)event->addr.octet[2]&0xff,
+               (uchar)event->addr.octet[3]&0xff,
+               (uchar)event->addr.octet[4]&0xff,
+               (uchar)event->addr.octet[5]&0xff);
+
+       event_name = bcmevent_get_name(event_type);
+       BCM_REFERENCE(event_name);
+
+       if (flags & WLC_EVENT_MSG_LINK)
+               link = TRUE;
+       if (flags & WLC_EVENT_MSG_GROUP)
+               group = TRUE;
+       if (flags & WLC_EVENT_MSG_FLUSHTXQ)
+               flush_txq = TRUE;
+
+       switch (event_type) {
+       case WLC_E_START:
+       case WLC_E_DEAUTH:
+       case WLC_E_DISASSOC:
+               DHD_EVENT(("MACEVENT: %s, MAC %s\n", event_name, eabuf));
+               break;
+
+       case WLC_E_ASSOC_IND:
+       case WLC_E_REASSOC_IND:
+
+               DHD_EVENT(("MACEVENT: %s, MAC %s\n", event_name, eabuf));
+               break;
+
+       case WLC_E_ASSOC:
+       case WLC_E_REASSOC:
+               if (status == WLC_E_STATUS_SUCCESS) {
+                       DHD_EVENT(("MACEVENT: %s, MAC %s, SUCCESS\n", event_name, eabuf));
+               } else if (status == WLC_E_STATUS_TIMEOUT) {
+                       DHD_EVENT(("MACEVENT: %s, MAC %s, TIMEOUT\n", event_name, eabuf));
+               } else if (status == WLC_E_STATUS_FAIL) {
+                       DHD_EVENT(("MACEVENT: %s, MAC %s, FAILURE, reason %d\n",
+                              event_name, eabuf, (int)reason));
+               } else {
+                       DHD_EVENT(("MACEVENT: %s, MAC %s, unexpected status %d\n",
+                              event_name, eabuf, (int)status));
+               }
+               break;
+
+       case WLC_E_DEAUTH_IND:
+       case WLC_E_DISASSOC_IND:
+               DHD_EVENT(("MACEVENT: %s, MAC %s, reason %d\n", event_name, eabuf, (int)reason));
+               break;
+
+       case WLC_E_AUTH:
+       case WLC_E_AUTH_IND:
+               if (auth_type == DOT11_OPEN_SYSTEM)
+                       auth_str = "Open System";
+               else if (auth_type == DOT11_SHARED_KEY)
+                       auth_str = "Shared Key";
+               else {
+                       snprintf(err_msg, sizeof(err_msg), "AUTH unknown: %d", (int)auth_type);
+                       auth_str = err_msg;
+               }
+               if (event_type == WLC_E_AUTH_IND) {
+                       DHD_EVENT(("MACEVENT: %s, MAC %s, %s\n", event_name, eabuf, auth_str));
+               } else if (status == WLC_E_STATUS_SUCCESS) {
+                       DHD_EVENT(("MACEVENT: %s, MAC %s, %s, SUCCESS\n",
+                               event_name, eabuf, auth_str));
+               } else if (status == WLC_E_STATUS_TIMEOUT) {
+                       DHD_EVENT(("MACEVENT: %s, MAC %s, %s, TIMEOUT\n",
+                               event_name, eabuf, auth_str));
+               } else if (status == WLC_E_STATUS_FAIL) {
+                       DHD_EVENT(("MACEVENT: %s, MAC %s, %s, FAILURE, reason %d\n",
+                              event_name, eabuf, auth_str, (int)reason));
+               }
+               BCM_REFERENCE(auth_str);
+
+               break;
+
+       case WLC_E_JOIN:
+       case WLC_E_ROAM:
+       case WLC_E_SET_SSID:
+               if (status == WLC_E_STATUS_SUCCESS) {
+                       DHD_EVENT(("MACEVENT: %s, MAC %s\n", event_name, eabuf));
+               } else if (status == WLC_E_STATUS_FAIL) {
+                       DHD_EVENT(("MACEVENT: %s, failed\n", event_name));
+               } else if (status == WLC_E_STATUS_NO_NETWORKS) {
+                       DHD_EVENT(("MACEVENT: %s, no networks found\n", event_name));
+               } else {
+                       DHD_EVENT(("MACEVENT: %s, unexpected status %d\n",
+                               event_name, (int)status));
+               }
+               break;
+
+       case WLC_E_BEACON_RX:
+               if (status == WLC_E_STATUS_SUCCESS) {
+                       DHD_EVENT(("MACEVENT: %s, SUCCESS\n", event_name));
+               } else if (status == WLC_E_STATUS_FAIL) {
+                       DHD_EVENT(("MACEVENT: %s, FAIL\n", event_name));
+               } else {
+                       DHD_EVENT(("MACEVENT: %s, status %d\n", event_name, status));
+               }
+               break;
+
+       case WLC_E_LINK:
+               DHD_EVENT(("MACEVENT: %s %s\n", event_name, link?"UP":"DOWN"));
+               BCM_REFERENCE(link);
+               break;
+
+       case WLC_E_MIC_ERROR:
+               DHD_EVENT(("MACEVENT: %s, MAC %s, Group %d, Flush %d\n",
+                      event_name, eabuf, group, flush_txq));
+               BCM_REFERENCE(group);
+               BCM_REFERENCE(flush_txq);
+               break;
+
+       case WLC_E_ICV_ERROR:
+       case WLC_E_UNICAST_DECODE_ERROR:
+       case WLC_E_MULTICAST_DECODE_ERROR:
+               DHD_EVENT(("MACEVENT: %s, MAC %s\n",
+                      event_name, eabuf));
+               break;
+
+       case WLC_E_TXFAIL:
+               DHD_EVENT(("MACEVENT: %s, RA %s status %d\n", event_name, eabuf, status));
+               break;
+
+       case WLC_E_ASSOC_REQ_IE:
+       case WLC_E_ASSOC_RESP_IE:
+       case WLC_E_PMKID_CACHE:
+       case WLC_E_SCAN_COMPLETE:
+               DHD_EVENT(("MACEVENT: %s\n", event_name));
+               break;
+
+       case WLC_E_PFN_NET_FOUND:
+       case WLC_E_PFN_NET_LOST:
+       case WLC_E_PFN_SCAN_NONE:
+       case WLC_E_PFN_SCAN_ALLGONE:
+       case WLC_E_PFN_GSCAN_FULL_RESULT:
+       case WLC_E_PFN_SWC:
+               DHD_EVENT(("PNOEVENT: %s\n", event_name));
+               break;
+
+       case WLC_E_PSK_SUP:
+       case WLC_E_PRUNE:
+               DHD_EVENT(("MACEVENT: %s, status %d, reason %d\n",
+                          event_name, (int)status, (int)reason));
+               break;
+
+#ifdef WIFI_ACT_FRAME
+       case WLC_E_ACTION_FRAME:
+               DHD_TRACE(("MACEVENT: %s Bssid %s\n", event_name, eabuf));
+               break;
+#endif /* WIFI_ACT_FRAME */
+
+#ifdef SHOW_LOGTRACE
+       case WLC_E_TRACE:
+       {
+               dhd_eventmsg_print(dhd_pub, event_data, raw_event_ptr, datalen, event_name);
+               break;
+       }
+#endif /* SHOW_LOGTRACE */
+
+       case WLC_E_RSSI:
+               DHD_EVENT(("MACEVENT: %s %d\n", event_name, ntoh32(*((int *)event_data))));
+               break;
+
+       case WLC_E_SERVICE_FOUND:
+       case WLC_E_P2PO_ADD_DEVICE:
+       case WLC_E_P2PO_DEL_DEVICE:
+               DHD_EVENT(("MACEVENT: %s, MAC %s\n", event_name, eabuf));
+               break;
+
+#ifdef BT_WIFI_HANDOBER
+       case WLC_E_BT_WIFI_HANDOVER_REQ:
+               DHD_EVENT(("MACEVENT: %s, MAC %s\n", event_name, eabuf));
+               break;
+#endif
+
+       case WLC_E_CCA_CHAN_QUAL:
+               if (datalen) {
+                       buf = (uchar *) event_data;
+                       DHD_EVENT(("MACEVENT: %s %d, MAC %s, status %d, reason %d, auth %d, "
+                               "channel 0x%02x \n", event_name, event_type, eabuf, (int)status,
+                               (int)reason, (int)auth_type, *(buf + 4)));
+               }
+               break;
+       case WLC_E_ESCAN_RESULT:
+       {
+#ifndef DHD_IFDEBUG
+               DHD_EVENT(("MACEVENT: %s %d, MAC %s, status %d \n",
+                      event_name, event_type, eabuf, (int)status));
+#endif
+       }
+               break;
+       case WLC_E_SDB_TRANSITION:
+               DHD_EVENT(("MACEVENT: %s, status %d, reason %d\n",
+                       event_name, (int)status, (int)reason));
+               wl_event_sdb_transition_print(event_data, event_name);
+               break;
+       default:
+               DHD_EVENT(("MACEVENT: %s %d, MAC %s, status %d, reason %d, auth %d\n",
+                      event_name, event_type, eabuf, (int)status, (int)reason,
+                      (int)auth_type));
+               break;
+       }
+
+       /* show any appended data if message level is set to bytes or host_data is set */
+       if ((DHD_BYTES_ON() || (host_data == TRUE)) && DHD_EVENT_ON() && datalen) {
+               buf = (uchar *) event_data;
+               BCM_REFERENCE(buf);
+               DHD_EVENT((" data (%d) : ", datalen));
+               for (i = 0; i < datalen; i++)
+                       DHD_EVENT((" 0x%02x ", *buf++));
+               DHD_EVENT(("\n"));
+       }
+}
+#endif /* SHOW_EVENTS */
+
+/* Stub for now. Will become real function as soon as shim
+ * is being integrated to Android, Linux etc.
+ */
+int
+wl_event_process_default(wl_event_msg_t *event, struct wl_evt_pport *evt_pport)
+{
+       return BCME_OK;
+}
+
+
+/* Check whether packet is a BRCM event pkt. If it is, record event data. */
+int
+wl_host_event_get_data(void *pktdata, uint pktlen, bcm_event_msg_u_t *evu)
+{
+       int ret;
+
+       ret = is_wlc_event_frame(pktdata, pktlen, 0, evu);
+       if (ret != BCME_OK) {
+               DHD_ERROR(("%s: Invalid event frame, err = %d\n",
+                       __FUNCTION__, ret));
+       }
+
+       return ret;
+}
+
+int
+wl_host_event(dhd_pub_t *dhd_pub, int *ifidx, void *pktdata, size_t pktlen,
+       wl_event_msg_t *event, void **data_ptr, void *raw_event)
+{
+       bcm_event_t *pvt_data = (bcm_event_t *)pktdata;
+       bcm_event_msg_u_t evu;
+       uint8 *event_data;
+       uint32 type, status, datalen;
+       uint16 flags;
+       uint evlen;
+       int ret;
+       uint16 usr_subtype;
+
+       ret = wl_host_event_get_data(pktdata, pktlen, &evu);
+       if (ret != BCME_OK) {
+               return ret;
+       }
+
+       usr_subtype = ntoh16_ua((void *)&pvt_data->bcm_hdr.usr_subtype);
+       switch (usr_subtype) {
+       case BCMILCP_BCM_SUBTYPE_EVENT:
+               memcpy(event, &evu.event, sizeof(wl_event_msg_t));
+               *data_ptr = &pvt_data[1];
+               break;
+       case BCMILCP_BCM_SUBTYPE_DNGLEVENT:
+#ifdef DNGL_EVENT_SUPPORT
+               /* If it is a DNGL event process it first */
+               if (dngl_host_event(dhd_pub, pktdata, &evu.dngl_event, pktlen) == BCME_OK) {
+                       /*
+                        * Return error purposely to prevent DNGL event being processed
+                        * as BRCM event
+                        */
+                       return BCME_ERROR;
+               }
+#endif /* DNGL_EVENT_SUPPORT */
+               return BCME_NOTFOUND;
+       default:
+               return BCME_NOTFOUND;
+       }
+
+       /* start wl_event_msg process */
+       event_data = *data_ptr;
+
+       type = ntoh32_ua((void *)&event->event_type);
+       flags = ntoh16_ua((void *)&event->flags);
+       status = ntoh32_ua((void *)&event->status);
+       datalen = ntoh32_ua((void *)&event->datalen);
+       evlen = datalen + sizeof(bcm_event_t);
+
+       switch (type) {
+#ifdef PROP_TXSTATUS
+       case WLC_E_FIFO_CREDIT_MAP:
+               dhd_wlfc_enable(dhd_pub);
+               dhd_wlfc_FIFOcreditmap_event(dhd_pub, event_data);
+               WLFC_DBGMESG(("WLC_E_FIFO_CREDIT_MAP:(AC0,AC1,AC2,AC3),(BC_MC),(OTHER): "
+                       "(%d,%d,%d,%d),(%d),(%d)\n", event_data[0], event_data[1],
+                       event_data[2],
+                       event_data[3], event_data[4], event_data[5]));
+               break;
+
+       case WLC_E_BCMC_CREDIT_SUPPORT:
+               dhd_wlfc_BCMCCredit_support_event(dhd_pub);
+               break;
+#endif
+
+       case WLC_E_IF:
+               {
+               struct wl_event_data_if *ifevent = (struct wl_event_data_if *)event_data;
+
+               /* Ignore the event if NOIF is set */
+               if (ifevent->reserved & WLC_E_IF_FLAGS_BSSCFG_NOIF) {
+                       DHD_ERROR(("WLC_E_IF: NO_IF set, event Ignored\r\n"));
+                       return (BCME_UNSUPPORTED);
+               }
+#ifdef PCIE_FULL_DONGLE
+               dhd_update_interface_flow_info(dhd_pub, ifevent->ifidx,
+                       ifevent->opcode, ifevent->role);
+#endif
+#ifdef PROP_TXSTATUS
+               {
+                       uint8* ea = pvt_data->eth.ether_dhost;
+                       WLFC_DBGMESG(("WLC_E_IF: idx:%d, action:%s, iftype:%s, "
+                                     "[%02x:%02x:%02x:%02x:%02x:%02x]\n",
+                                     ifevent->ifidx,
+                                     ((ifevent->opcode == WLC_E_IF_ADD) ? "ADD":"DEL"),
+                                     ((ifevent->role == 0) ? "STA":"AP "),
+                                     ea[0], ea[1], ea[2], ea[3], ea[4], ea[5]));
+                       (void)ea;
+
+                       if (ifevent->opcode == WLC_E_IF_CHANGE)
+                               dhd_wlfc_interface_event(dhd_pub,
+                                       eWLFC_MAC_ENTRY_ACTION_UPDATE,
+                                       ifevent->ifidx, ifevent->role, ea);
+                       else
+                               dhd_wlfc_interface_event(dhd_pub,
+                                       ((ifevent->opcode == WLC_E_IF_ADD) ?
+                                       eWLFC_MAC_ENTRY_ACTION_ADD : eWLFC_MAC_ENTRY_ACTION_DEL),
+                                       ifevent->ifidx, ifevent->role, ea);
+
+                       /* dhd already has created an interface by default, for 0 */
+                       if (ifevent->ifidx == 0)
+                               break;
+               }
+#endif /* PROP_TXSTATUS */
+
+               if (ifevent->ifidx > 0 && ifevent->ifidx < DHD_MAX_IFS) {
+                       if (ifevent->opcode == WLC_E_IF_ADD) {
+                               if (dhd_event_ifadd(dhd_pub->info, ifevent, event->ifname,
+                                       event->addr.octet)) {
+
+                                       DHD_ERROR(("%s: dhd_event_ifadd failed ifidx: %d  %s\n",
+                                               __FUNCTION__, ifevent->ifidx, event->ifname));
+                                       return (BCME_ERROR);
+                               }
+                       } else if (ifevent->opcode == WLC_E_IF_DEL) {
+                               dhd_event_ifdel(dhd_pub->info, ifevent, event->ifname,
+                                       event->addr.octet);
+                       } else if (ifevent->opcode == WLC_E_IF_CHANGE) {
+#ifdef WL_CFG80211
+                               wl_cfg80211_notify_ifchange(DHD_GET_CFG80211_PRIV(dhd_pub),
+                                       ifevent->ifidx, event->ifname, event->addr.octet,
+                                       ifevent->bssidx);
+#endif /* WL_CFG80211 */
+                       }
+               } else {
+#if !defined(PROP_TXSTATUS) && !defined(PCIE_FULL_DONGLE) && defined(WL_CFG80211)
+                       DHD_ERROR(("%s: Invalid ifidx %d for %s\n",
+                                  __FUNCTION__, ifevent->ifidx, event->ifname));
+#endif /* !PROP_TXSTATUS && !PCIE_FULL_DONGLE && WL_CFG80211 */
+               }
+                       /* send up the if event: btamp user needs it */
+                       *ifidx = dhd_ifname2idx(dhd_pub->info, event->ifname);
+                       /* push up to external supp/auth */
+                       dhd_event(dhd_pub->info, (char *)pvt_data, evlen, *ifidx);
+               break;
+       }
+
+#ifdef WLMEDIA_HTSF
+       case WLC_E_HTSFSYNC:
+               htsf_update(dhd_pub->info, event_data);
+               break;
+#endif /* WLMEDIA_HTSF */
+       case WLC_E_NDIS_LINK:
+               break;
+       case WLC_E_PFN_NET_FOUND:
+       case WLC_E_PFN_SCAN_ALLGONE: /* share with WLC_E_PFN_BSSID_NET_LOST */
+       case WLC_E_PFN_NET_LOST:
+               break;
+#if defined(PNO_SUPPORT)
+       case WLC_E_PFN_BSSID_NET_FOUND:
+       case WLC_E_PFN_BEST_BATCHING:
+               dhd_pno_event_handler(dhd_pub, event, (void *)event_data);
+               break;
+#endif 
+               /* These are what external supplicant/authenticator wants */
+       case WLC_E_ASSOC_IND:
+       case WLC_E_AUTH_IND:
+       case WLC_E_REASSOC_IND:
+               dhd_findadd_sta(dhd_pub,
+                       dhd_ifname2idx(dhd_pub->info, event->ifname),
+                       &event->addr.octet);
+               break;
+#if defined(DHD_FW_COREDUMP)
+       case WLC_E_PSM_WATCHDOG:
+               DHD_ERROR(("%s: WLC_E_PSM_WATCHDOG event received : \n", __FUNCTION__));
+               if (dhd_socram_dump(dhd_pub->bus) != BCME_OK) {
+                       DHD_ERROR(("%s: socram dump ERROR : \n", __FUNCTION__));
+               }
+       break;
+#endif
+       case WLC_E_LINK:
+#ifdef PCIE_FULL_DONGLE
+               if (dhd_update_interface_link_status(dhd_pub, (uint8)dhd_ifname2idx(dhd_pub->info,
+                       event->ifname), (uint8)flags) != BCME_OK)
+                       break;
+               if (!flags) {
+                       dhd_flow_rings_delete(dhd_pub, (uint8)dhd_ifname2idx(dhd_pub->info,
+                               event->ifname));
+               }
+               /* fall through */
+#endif
+       case WLC_E_DEAUTH:
+       case WLC_E_DEAUTH_IND:
+       case WLC_E_DISASSOC:
+       case WLC_E_DISASSOC_IND:
+               DHD_EVENT(("%s: Link event %d, flags %x, status %x\n",
+                          __FUNCTION__, type, flags, status));
+#ifdef PCIE_FULL_DONGLE
+               if (type != WLC_E_LINK) {
+                       uint8 ifindex = (uint8)dhd_ifname2idx(dhd_pub->info, event->ifname);
+                       uint8 role = dhd_flow_rings_ifindex2role(dhd_pub, ifindex);
+                       uint8 del_sta = TRUE;
+#ifdef WL_CFG80211
+                       if (role == WLC_E_IF_ROLE_STA &&
+                               !wl_cfg80211_is_roam_offload(DHD_GET_CFG80211_PRIV(dhd_pub)) &&
+                               !wl_cfg80211_is_event_from_connected_bssid(
+                                       DHD_GET_CFG80211_PRIV(dhd_pub), event, *ifidx)) {
+                               del_sta = FALSE;
+                       }
+#endif /* WL_CFG80211 */
+
+                       if (del_sta) {
+                               dhd_del_sta(dhd_pub, dhd_ifname2idx(dhd_pub->info,
+                                       event->ifname), &event->addr.octet);
+                               if (role == WLC_E_IF_ROLE_STA) {
+                                       dhd_flow_rings_delete(dhd_pub, ifindex);
+                               } else {
+                                       dhd_flow_rings_delete_for_peer(dhd_pub, ifindex,
+                                               &event->addr.octet[0]);
+                               }
+                       }
+               }
+#endif /* PCIE_FULL_DONGLE */
+               /* fall through */
+       default:
+               *ifidx = dhd_ifname2idx(dhd_pub->info, event->ifname);
+               /* push up to external supp/auth */
+               dhd_event(dhd_pub->info, (char *)pvt_data, evlen, *ifidx);
+               DHD_TRACE(("%s: MAC event %d, flags %x, status %x\n",
+                          __FUNCTION__, type, flags, status));
+               BCM_REFERENCE(flags);
+               BCM_REFERENCE(status);
+
+               break;
+       }
+
+#ifdef SHOW_EVENTS
+       if (DHD_FWLOG_ON() || DHD_EVENT_ON()) {
+               wl_show_host_event(dhd_pub, event,
+                       (void *)event_data, raw_event, dhd_pub->enable_log);
+       }
+#endif /* SHOW_EVENTS */
+
+       return (BCME_OK);
+}
+
+void
+dhd_print_buf(void *pbuf, int len, int bytes_per_line)
+{
+#ifdef DHD_DEBUG
+       int i, j = 0;
+       unsigned char *buf = pbuf;
+
+       if (bytes_per_line == 0) {
+               bytes_per_line = len;
+       }
+
+       for (i = 0; i < len; i++) {
+               printf("%2.2x", *buf++);
+               j++;
+               if (j == bytes_per_line) {
+                       printf("\n");
+                       j = 0;
+               } else {
+                       printf(":");
+               }
+       }
+       printf("\n");
+#endif /* DHD_DEBUG */
+}
+#ifndef strtoul
+#define strtoul(nptr, endptr, base) bcm_strtoul((nptr), (endptr), (base))
+#endif
+
+#ifdef PKT_FILTER_SUPPORT
+/* Convert user's input in hex pattern to byte-size mask */
+static int
+wl_pattern_atoh(char *src, char *dst)
+{
+       int i;
+       if (strncmp(src, "0x", 2) != 0 &&
+           strncmp(src, "0X", 2) != 0) {
+               DHD_ERROR(("Mask invalid format. Needs to start with 0x\n"));
+               return -1;
+       }
+       src = src + 2; /* Skip past 0x */
+       if (strlen(src) % 2 != 0) {
+               DHD_ERROR(("Mask invalid format. Needs to be of even length\n"));
+               return -1;
+       }
+       for (i = 0; *src != '\0'; i++) {
+               char num[3];
+               bcm_strncpy_s(num, sizeof(num), src, 2);
+               num[2] = '\0';
+               dst[i] = (uint8)strtoul(num, NULL, 16);
+               src += 2;
+       }
+       return i;
+}
+
+void
+dhd_pktfilter_offload_enable(dhd_pub_t * dhd, char *arg, int enable, int master_mode)
+{
+       char                            *argv[8];
+       int                                     i = 0;
+       const char                      *str;
+       int                                     buf_len;
+       int                                     str_len;
+       char                            *arg_save = 0, *arg_org = 0;
+       int                                     rc;
+       char                            buf[32] = {0};
+       wl_pkt_filter_enable_t  enable_parm;
+       wl_pkt_filter_enable_t  * pkt_filterp;
+
+       if (!arg)
+               return;
+
+       if (!(arg_save = MALLOC(dhd->osh, strlen(arg) + 1))) {
+               DHD_ERROR(("%s: malloc failed\n", __FUNCTION__));
+               goto fail;
+       }
+       arg_org = arg_save;
+       memcpy(arg_save, arg, strlen(arg) + 1);
+
+       argv[i] = bcmstrtok(&arg_save, " ", 0);
+
+       i = 0;
+       if (argv[i] == NULL) {
+               DHD_ERROR(("No args provided\n"));
+               goto fail;
+       }
+
+       str = "pkt_filter_enable";
+       str_len = strlen(str);
+       bcm_strncpy_s(buf, sizeof(buf) - 1, str, sizeof(buf) - 1);
+       buf[ sizeof(buf) - 1 ] = '\0';
+       buf_len = str_len + 1;
+
+       pkt_filterp = (wl_pkt_filter_enable_t *)(buf + str_len + 1);
+
+       /* Parse packet filter id. */
+       enable_parm.id = htod32(strtoul(argv[i], NULL, 0));
+
+       /* Parse enable/disable value. */
+       enable_parm.enable = htod32(enable);
+
+       buf_len += sizeof(enable_parm);
+       memcpy((char *)pkt_filterp,
+              &enable_parm,
+              sizeof(enable_parm));
+
+       /* Enable/disable the specified filter. */
+       rc = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, buf, buf_len, TRUE, 0);
+       rc = rc >= 0 ? 0 : rc;
+       if (rc)
+               DHD_TRACE(("%s: failed to add pktfilter %s, retcode = %d\n",
+               __FUNCTION__, arg, rc));
+       else
+               DHD_TRACE(("%s: successfully added pktfilter %s\n",
+               __FUNCTION__, arg));
+
+       /* Contorl the master mode */
+       rc = dhd_wl_ioctl_set_intiovar(dhd, "pkt_filter_mode",
+               master_mode, WLC_SET_VAR, TRUE, 0);
+       rc = rc >= 0 ? 0 : rc;
+       if (rc)
+               DHD_TRACE(("%s: failed to add pktfilter %s, retcode = %d\n",
+               __FUNCTION__, arg, rc));
+
+fail:
+       if (arg_org)
+               MFREE(dhd->osh, arg_org, strlen(arg) + 1);
+}
+
+/* Packet filter section: extended filters have named offsets, add table here */
+typedef struct {
+       char *name;
+       uint16 base;
+} wl_pfbase_t;
+
+static wl_pfbase_t basenames[] = { WL_PKT_FILTER_BASE_NAMES };
+
+static int
+wl_pkt_filter_base_parse(char *name)
+{
+       uint i;
+       char *bname, *uname;
+
+       for (i = 0; i < ARRAYSIZE(basenames); i++) {
+               bname = basenames[i].name;
+               for (uname = name; *uname; bname++, uname++) {
+                       if (*bname != bcm_toupper(*uname)) {
+                               break;
+                       }
+               }
+               if (!*uname && !*bname) {
+                       break;
+               }
+       }
+
+       if (i < ARRAYSIZE(basenames)) {
+               return basenames[i].base;
+       } else {
+               return -1;
+       }
+}
+
+void
+dhd_pktfilter_offload_set(dhd_pub_t * dhd, char *arg)
+{
+       const char                      *str;
+       wl_pkt_filter_t         pkt_filter;
+       wl_pkt_filter_t         *pkt_filterp;
+       int                                     buf_len;
+       int                                     str_len;
+       int                             rc;
+       uint32                          mask_size;
+       uint32                          pattern_size;
+       char                            *argv[16], * buf = 0;
+       int                                     i = 0;
+       char                            *arg_save = 0, *arg_org = 0;
+#define BUF_SIZE               2048
+
+       if (!arg)
+               return;
+
+       if (!(arg_save = MALLOC(dhd->osh, strlen(arg) + 1))) {
+               DHD_ERROR(("%s: malloc failed\n", __FUNCTION__));
+               goto fail;
+       }
+
+       arg_org = arg_save;
+
+       if (!(buf = MALLOC(dhd->osh, BUF_SIZE))) {
+               DHD_ERROR(("%s: malloc failed\n", __FUNCTION__));
+               goto fail;
+       }
+
+       memcpy(arg_save, arg, strlen(arg) + 1);
+
+       if (strlen(arg) > BUF_SIZE) {
+               DHD_ERROR(("Not enough buffer %d < %d\n", (int)strlen(arg), (int)sizeof(buf)));
+               goto fail;
+       }
+
+       argv[i] = bcmstrtok(&arg_save, " ", 0);
+       while (argv[i++])
+               argv[i] = bcmstrtok(&arg_save, " ", 0);
+
+       i = 0;
+       if (argv[i] == NULL) {
+               DHD_ERROR(("No args provided\n"));
+               goto fail;
+       }
+
+       str = "pkt_filter_add";
+       str_len = strlen(str);
+       bcm_strncpy_s(buf, BUF_SIZE, str, str_len);
+       buf[ str_len ] = '\0';
+       buf_len = str_len + 1;
+
+       pkt_filterp = (wl_pkt_filter_t *) (buf + str_len + 1);
+
+       /* Parse packet filter id. */
+       pkt_filter.id = htod32(strtoul(argv[i], NULL, 0));
+
+       if (argv[++i] == NULL) {
+               DHD_ERROR(("Polarity not provided\n"));
+               goto fail;
+       }
+
+       /* Parse filter polarity. */
+       pkt_filter.negate_match = htod32(strtoul(argv[i], NULL, 0));
+
+       if (argv[++i] == NULL) {
+               DHD_ERROR(("Filter type not provided\n"));
+               goto fail;
+       }
+
+       /* Parse filter type. */
+       pkt_filter.type = htod32(strtoul(argv[i], NULL, 0));
+
+       if ((pkt_filter.type == 0) || (pkt_filter.type == 1)) {
+               if (argv[++i] == NULL) {
+                       DHD_ERROR(("Offset not provided\n"));
+                       goto fail;
+               }
+
+               /* Parse pattern filter offset. */
+               pkt_filter.u.pattern.offset = htod32(strtoul(argv[i], NULL, 0));
+
+               if (argv[++i] == NULL) {
+                       DHD_ERROR(("Bitmask not provided\n"));
+                       goto fail;
+               }
+
+               /* Parse pattern filter mask. */
+               mask_size =
+                       htod32(wl_pattern_atoh(argv[i],
+                       (char *) pkt_filterp->u.pattern.mask_and_pattern));
+
+               if (argv[++i] == NULL) {
+                       DHD_ERROR(("Pattern not provided\n"));
+                       goto fail;
+               }
+
+               /* Parse pattern filter pattern. */
+               pattern_size =
+                       htod32(wl_pattern_atoh(argv[i],
+                       (char *) &pkt_filterp->u.pattern.mask_and_pattern[mask_size]));
+
+               if (mask_size != pattern_size) {
+                       DHD_ERROR(("Mask and pattern not the same size\n"));
+                       goto fail;
+               }
+
+               pkt_filter.u.pattern.size_bytes = mask_size;
+               buf_len += WL_PKT_FILTER_FIXED_LEN;
+               buf_len += (WL_PKT_FILTER_PATTERN_FIXED_LEN + 2 * mask_size);
+
+               /* Keep-alive attributes are set in local       variable (keep_alive_pkt), and
+               ** then memcpy'ed into buffer (keep_alive_pktp) since there is no
+               ** guarantee that the buffer is properly aligned.
+               */
+               memcpy((char *)pkt_filterp,
+                      &pkt_filter,
+                      WL_PKT_FILTER_FIXED_LEN + WL_PKT_FILTER_PATTERN_FIXED_LEN);
+       } else if ((pkt_filter.type == 2) || (pkt_filter.type == 6)) {
+               int list_cnt = 0;
+               char *endptr = '\0';
+               wl_pkt_filter_pattern_listel_t *pf_el = &pkt_filterp->u.patlist.patterns[0];
+
+               while (argv[++i] != NULL) {
+                       /* Parse pattern filter base and offset. */
+                       if (bcm_isdigit(*argv[i])) {
+                               /* Numeric base */
+                               rc = strtoul(argv[i], &endptr, 0);
+                       } else {
+                               endptr = strchr(argv[i], ':');
+                               if (endptr) {
+                                       *endptr = '\0';
+                                       rc = wl_pkt_filter_base_parse(argv[i]);
+                                       if (rc == -1) {
+                                               printf("Invalid base %s\n", argv[i]);
+                                               goto fail;
+                                       }
+                                       *endptr = ':';
+                               } else {
+                                       printf("Invalid [base:]offset format: %s\n", argv[i]);
+                                       goto fail;
+                               }
+                       }
+
+                       if (*endptr == ':') {
+                               pkt_filter.u.patlist.patterns[0].base_offs = htod16(rc);
+                               rc = strtoul(endptr + 1, &endptr, 0);
+                       } else {
+                               /* Must have had a numeric offset only */
+                               pkt_filter.u.patlist.patterns[0].base_offs = htod16(0);
+                       }
+
+                       if (*endptr) {
+                               printf("Invalid [base:]offset format: %s\n", argv[i]);
+                               goto fail;
+                       }
+                       if (rc > 0x0000FFFF) {
+                               printf("Offset too large\n");
+                               goto fail;
+                       }
+                       pkt_filter.u.patlist.patterns[0].rel_offs = htod16(rc);
+
+                       /* Clear match_flag (may be set in parsing which follows) */
+                       pkt_filter.u.patlist.patterns[0].match_flags = htod16(0);
+
+                       /* Parse pattern filter mask and pattern directly into ioctl buffer */
+                       if (argv[++i] == NULL) {
+                               printf("Bitmask not provided\n");
+                               goto fail;
+                       }
+                       rc = wl_pattern_atoh(argv[i], (char*)pf_el->mask_and_data);
+                       if (rc == -1) {
+                               printf("Rejecting: %s\n", argv[i]);
+                               goto fail;
+                       }
+                       mask_size = htod16(rc);
+
+                       if (argv[++i] == NULL) {
+                               printf("Pattern not provided\n");
+                               goto fail;
+                       }
+
+                       if (*argv[i] == '!') {
+                               pkt_filter.u.patlist.patterns[0].match_flags =
+                               htod16(WL_PKT_FILTER_MFLAG_NEG);
+                               (argv[i])++;
+                       }
+                       if (argv[i] == '\0') {
+                               printf("Pattern not provided\n");
+                               goto fail;
+                       }
+                       rc = wl_pattern_atoh(argv[i], (char*)&pf_el->mask_and_data[rc]);
+                       if (rc == -1) {
+                               printf("Rejecting: %s\n", argv[i]);
+                               goto fail;
+                       }
+                       pattern_size = htod16(rc);
+
+                       if (mask_size != pattern_size) {
+                               printf("Mask and pattern not the same size\n");
+                               goto fail;
+                       }
+
+                       pkt_filter.u.patlist.patterns[0].size_bytes = mask_size;
+
+                       /* Account for the size of this pattern element */
+                       buf_len += WL_PKT_FILTER_PATTERN_LISTEL_FIXED_LEN + 2 * rc;
+
+                       /* And the pattern element fields that were put in a local for
+                        * alignment purposes now get copied to the ioctl buffer.
+                        */
+                       memcpy((char*)pf_el, &pkt_filter.u.patlist.patterns[0],
+                               WL_PKT_FILTER_PATTERN_FIXED_LEN);
+
+                       /* Move to next element location in ioctl buffer */
+                       pf_el = (wl_pkt_filter_pattern_listel_t*)
+                               ((uint8*)pf_el + WL_PKT_FILTER_PATTERN_LISTEL_FIXED_LEN + 2 * rc);
+
+                       /* Count list element */
+                       list_cnt++;
+               }
+
+               /* Account for initial fixed size, and copy initial fixed fields */
+               buf_len += WL_PKT_FILTER_FIXED_LEN + WL_PKT_FILTER_PATTERN_LIST_FIXED_LEN;
+
+               /* Update list count and total size */
+               pkt_filter.u.patlist.list_cnt = list_cnt;
+               pkt_filter.u.patlist.PAD1[0] = 0;
+               pkt_filter.u.patlist.totsize = buf + buf_len - (char*)pkt_filterp;
+               pkt_filter.u.patlist.totsize -= WL_PKT_FILTER_FIXED_LEN;
+
+               memcpy((char *)pkt_filterp, &pkt_filter,
+                       WL_PKT_FILTER_FIXED_LEN + WL_PKT_FILTER_PATTERN_LIST_FIXED_LEN);
+       } else {
+           DHD_ERROR(("Invalid filter type %d\n", pkt_filter.type));
+           goto fail;
+       }
+
+       rc = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, buf, buf_len, TRUE, 0);
+       rc = rc >= 0 ? 0 : rc;
+
+       if (rc)
+               DHD_TRACE(("%s: failed to add pktfilter %s, retcode = %d\n",
+               __FUNCTION__, arg, rc));
+       else
+               DHD_TRACE(("%s: successfully added pktfilter %s\n",
+               __FUNCTION__, arg));
+
+fail:
+       if (arg_org)
+               MFREE(dhd->osh, arg_org, strlen(arg) + 1);
+
+       if (buf)
+               MFREE(dhd->osh, buf, BUF_SIZE);
+}
+
+void
+dhd_pktfilter_offload_delete(dhd_pub_t *dhd, int id)
+{
+       int ret;
+
+       ret = dhd_wl_ioctl_set_intiovar(dhd, "pkt_filter_delete",
+               id, WLC_SET_VAR, TRUE, 0);
+       if (ret < 0) {
+               DHD_ERROR(("%s: Failed to delete filter ID:%d, ret=%d\n",
+                       __FUNCTION__, id, ret));
+       }
+}
+#endif /* PKT_FILTER_SUPPORT */
+
+/* ========================== */
+/* ==== ARP OFFLOAD SUPPORT = */
+/* ========================== */
+#ifdef ARP_OFFLOAD_SUPPORT
+void
+dhd_arp_offload_set(dhd_pub_t * dhd, int arp_mode)
+{
+       int retcode;
+
+       retcode = dhd_wl_ioctl_set_intiovar(dhd, "arp_ol",
+               arp_mode, WLC_SET_VAR, TRUE, 0);
+
+       retcode = retcode >= 0 ? 0 : retcode;
+       if (retcode)
+               DHD_TRACE(("%s: failed to set ARP offload mode to 0x%x, retcode = %d\n",
+                       __FUNCTION__, arp_mode, retcode));
+       else
+               DHD_TRACE(("%s: successfully set ARP offload mode to 0x%x\n",
+                       __FUNCTION__, arp_mode));
+}
+
+void
+dhd_arp_offload_enable(dhd_pub_t * dhd, int arp_enable)
+{
+       int retcode;
+
+       retcode = dhd_wl_ioctl_set_intiovar(dhd, "arpoe",
+               arp_enable, WLC_SET_VAR, TRUE, 0);
+
+       retcode = retcode >= 0 ? 0 : retcode;
+       if (retcode)
+               DHD_TRACE(("%s: failed to enabe ARP offload to %d, retcode = %d\n",
+                       __FUNCTION__, arp_enable, retcode));
+       else
+               DHD_TRACE(("%s: successfully enabed ARP offload to %d\n",
+                       __FUNCTION__, arp_enable));
+       if (arp_enable) {
+               uint32 version;
+               retcode = dhd_wl_ioctl_get_intiovar(dhd, "arp_version",
+                       &version, WLC_GET_VAR, FALSE, 0);
+               if (retcode) {
+                       DHD_INFO(("%s: fail to get version (maybe version 1:retcode = %d\n",
+                               __FUNCTION__, retcode));
+                       dhd->arp_version = 1;
+               }
+               else {
+                       DHD_INFO(("%s: ARP Version= %x\n", __FUNCTION__, version));
+                       dhd->arp_version = version;
+               }
+       }
+}
+
+void
+dhd_aoe_arp_clr(dhd_pub_t *dhd, int idx)
+{
+       int ret = 0;
+       int iov_len = 0;
+       char iovbuf[DHD_IOVAR_BUF_SIZE];
+
+       if (dhd == NULL) return;
+       if (dhd->arp_version == 1)
+               idx = 0;
+
+       iov_len = bcm_mkiovar("arp_table_clear", 0, 0, iovbuf, sizeof(iovbuf));
+       if (!iov_len) {
+               DHD_ERROR(("%s: Insufficient iovar buffer size %zu \n",
+                       __FUNCTION__, sizeof(iovbuf)));
+               return;
+       }
+       if ((ret  = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, iov_len, TRUE, idx)) < 0)
+               DHD_ERROR(("%s failed code %d\n", __FUNCTION__, ret));
+}
+
+void
+dhd_aoe_hostip_clr(dhd_pub_t *dhd, int idx)
+{
+       int ret = 0;
+       int iov_len = 0;
+       char iovbuf[DHD_IOVAR_BUF_SIZE];
+
+       if (dhd == NULL) return;
+       if (dhd->arp_version == 1)
+               idx = 0;
+
+       iov_len = bcm_mkiovar("arp_hostip_clear", 0, 0, iovbuf, sizeof(iovbuf));
+       if (!iov_len) {
+               DHD_ERROR(("%s: Insufficient iovar buffer size %zu \n",
+                       __FUNCTION__, sizeof(iovbuf)));
+               return;
+       }
+       if ((ret  = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, iov_len, TRUE, idx)) < 0)
+               DHD_ERROR(("%s failed code %d\n", __FUNCTION__, ret));
+}
+
+void
+dhd_arp_offload_add_ip(dhd_pub_t *dhd, uint32 ipaddr, int idx)
+{
+       int iov_len = 0;
+       char iovbuf[DHD_IOVAR_BUF_SIZE];
+       int retcode;
+
+
+       if (dhd == NULL) return;
+       if (dhd->arp_version == 1)
+               idx = 0;
+       iov_len = bcm_mkiovar("arp_hostip", (char *)&ipaddr,
+               sizeof(ipaddr), iovbuf, sizeof(iovbuf));
+       if (!iov_len) {
+               DHD_ERROR(("%s: Insufficient iovar buffer size %zu \n",
+                       __FUNCTION__, sizeof(iovbuf)));
+               return;
+       }
+       retcode = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, iov_len, TRUE, idx);
+
+       if (retcode)
+               DHD_TRACE(("%s: ARP ip addr add failed, retcode = %d\n",
+               __FUNCTION__, retcode));
+       else
+               DHD_TRACE(("%s: sARP H ipaddr entry added \n",
+               __FUNCTION__));
+}
+
+int
+dhd_arp_get_arp_hostip_table(dhd_pub_t *dhd, void *buf, int buflen, int idx)
+{
+       int retcode, i;
+       int iov_len;
+       uint32 *ptr32 = buf;
+       bool clr_bottom = FALSE;
+
+       if (!buf)
+               return -1;
+       if (dhd == NULL) return -1;
+       if (dhd->arp_version == 1)
+               idx = 0;
+
+       iov_len = bcm_mkiovar("arp_hostip", 0, 0, buf, buflen);
+       BCM_REFERENCE(iov_len);
+       retcode = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, buf, buflen, FALSE, idx);
+
+       if (retcode) {
+               DHD_TRACE(("%s: ioctl WLC_GET_VAR error %d\n",
+               __FUNCTION__, retcode));
+
+               return -1;
+       }
+
+       /* clean up the buf, ascii reminder */
+       for (i = 0; i < MAX_IPV4_ENTRIES; i++) {
+               if (!clr_bottom) {
+                       if (*ptr32 == 0)
+                               clr_bottom = TRUE;
+               } else {
+                       *ptr32 = 0;
+               }
+               ptr32++;
+       }
+
+       return 0;
+}
+#endif /* ARP_OFFLOAD_SUPPORT  */
+
+/*
+ * Neighbor Discovery Offload: enable NDO feature
+ * Called  by ipv6 event handler when interface comes up/goes down
+ */
+int
+dhd_ndo_enable(dhd_pub_t * dhd, int ndo_enable)
+{
+       int retcode;
+
+       if (dhd == NULL)
+               return -1;
+
+       retcode = dhd_wl_ioctl_set_intiovar(dhd, "ndoe",
+               ndo_enable, WLC_SET_VAR, TRUE, 0);
+       if (retcode)
+               DHD_ERROR(("%s: failed to enabe ndo to %d, retcode = %d\n",
+                       __FUNCTION__, ndo_enable, retcode));
+       else
+               DHD_TRACE(("%s: successfully enabed ndo offload to %d\n",
+                       __FUNCTION__, ndo_enable));
+
+       return retcode;
+}
+
+/*
+ * Neighbor Discover Offload: enable NDO feature
+ * Called  by ipv6 event handler when interface comes up
+ */
+int
+dhd_ndo_add_ip(dhd_pub_t *dhd, char* ipv6addr, int idx)
+{
+       int iov_len = 0;
+       char iovbuf[DHD_IOVAR_BUF_SIZE];
+       int retcode;
+
+       if (dhd == NULL)
+               return -1;
+
+       iov_len = bcm_mkiovar("nd_hostip", (char *)ipv6addr,
+               IPV6_ADDR_LEN, iovbuf, sizeof(iovbuf));
+       if (!iov_len) {
+               DHD_ERROR(("%s: Insufficient iovar buffer size %zu \n",
+                       __FUNCTION__, sizeof(iovbuf)));
+               return -1;
+       }
+       retcode = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, iov_len, TRUE, idx);
+
+       if (retcode)
+               DHD_ERROR(("%s: ndo ip addr add failed, retcode = %d\n",
+               __FUNCTION__, retcode));
+       else
+               DHD_TRACE(("%s: ndo ipaddr entry added \n",
+               __FUNCTION__));
+
+       return retcode;
+}
+/*
+ * Neighbor Discover Offload: enable NDO feature
+ * Called  by ipv6 event handler when interface goes down
+ */
+int
+dhd_ndo_remove_ip(dhd_pub_t *dhd, int idx)
+{
+       int iov_len = 0;
+       char iovbuf[DHD_IOVAR_BUF_SIZE];
+       int retcode;
+
+       if (dhd == NULL)
+               return -1;
+
+       iov_len = bcm_mkiovar("nd_hostip_clear", NULL,
+               0, iovbuf, sizeof(iovbuf));
+       if (!iov_len) {
+               DHD_ERROR(("%s: Insufficient iovar buffer size %zu \n",
+                       __FUNCTION__, sizeof(iovbuf)));
+               return -1;
+       }
+       retcode = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, iov_len, TRUE, idx);
+
+       if (retcode)
+               DHD_ERROR(("%s: ndo ip addr remove failed, retcode = %d\n",
+               __FUNCTION__, retcode));
+       else
+               DHD_TRACE(("%s: ndo ipaddr entry removed \n",
+               __FUNCTION__));
+
+       return retcode;
+}
+
+
+
+/*
+ * returns = TRUE if associated, FALSE if not associated
+ */
+bool dhd_is_associated(dhd_pub_t *dhd, uint8 ifidx, int *retval)
+{
+       char bssid[6], zbuf[6];
+       int ret = -1;
+
+       bzero(bssid, 6);
+       bzero(zbuf, 6);
+
+       ret  = dhd_wl_ioctl_cmd(dhd, WLC_GET_BSSID, (char *)&bssid,
+               ETHER_ADDR_LEN, FALSE, ifidx);
+       DHD_TRACE((" %s WLC_GET_BSSID ioctl res = %d\n", __FUNCTION__, ret));
+
+       if (ret == BCME_NOTASSOCIATED) {
+               DHD_TRACE(("%s: not associated! res:%d\n", __FUNCTION__, ret));
+       }
+
+       if (retval)
+               *retval = ret;
+
+       if (ret < 0)
+               return FALSE;
+
+       if ((memcmp(bssid, zbuf, ETHER_ADDR_LEN) == 0)) {
+               DHD_TRACE(("%s: WLC_GET_BSSID ioctl returned zero bssid\n", __FUNCTION__));
+               return FALSE;
+       }
+       return TRUE;
+}
+
+/* Function to estimate possible DTIM_SKIP value */
+int
+dhd_get_suspend_bcn_li_dtim(dhd_pub_t *dhd)
+{
+       int bcn_li_dtim = 1; /* deafult no dtim skip setting */
+       int ret = -1;
+       int dtim_period = 0;
+       int ap_beacon = 0;
+       int allowed_skip_dtim_cnt = 0;
+       /* Check if associated */
+       if (dhd_is_associated(dhd, 0, NULL) == FALSE) {
+               DHD_TRACE(("%s NOT assoc ret %d\n", __FUNCTION__, ret));
+               goto exit;
+       }
+
+       /* read associated AP beacon interval */
+       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_BCNPRD,
+               &ap_beacon, sizeof(ap_beacon), FALSE, 0)) < 0) {
+               DHD_ERROR(("%s get beacon failed code %d\n", __FUNCTION__, ret));
+               goto exit;
+       }
+
+       /* read associated ap's dtim setup */
+       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_DTIMPRD,
+               &dtim_period, sizeof(dtim_period), FALSE, 0)) < 0) {
+               DHD_ERROR(("%s failed code %d\n", __FUNCTION__, ret));
+               goto exit;
+       }
+
+       /* if not assocated just eixt */
+       if (dtim_period == 0) {
+               goto exit;
+       }
+
+       if (dhd->max_dtim_enable) {
+               bcn_li_dtim = (int) (MAX_DTIM_ALLOWED_INTERVAL / (ap_beacon * dtim_period));
+               if (bcn_li_dtim == 0) {
+                       bcn_li_dtim = 1;
+               }
+       } else {
+               /* attemp to use platform defined dtim skip interval */
+               bcn_li_dtim = dhd->suspend_bcn_li_dtim;
+
+               /* check if sta listen interval fits into AP dtim */
+               if (dtim_period > CUSTOM_LISTEN_INTERVAL) {
+                       /* AP DTIM to big for our Listen Interval : no dtim skiping */
+                       bcn_li_dtim = NO_DTIM_SKIP;
+                       DHD_ERROR(("%s DTIM=%d > Listen=%d : too big ...\n",
+                               __FUNCTION__, dtim_period, CUSTOM_LISTEN_INTERVAL));
+                       goto exit;
+               }
+
+               if ((dtim_period * ap_beacon * bcn_li_dtim) > MAX_DTIM_ALLOWED_INTERVAL) {
+                       allowed_skip_dtim_cnt =
+                               MAX_DTIM_ALLOWED_INTERVAL / (dtim_period * ap_beacon);
+                       bcn_li_dtim =
+                               (allowed_skip_dtim_cnt != 0) ? allowed_skip_dtim_cnt : NO_DTIM_SKIP;
+               }
+
+               if ((bcn_li_dtim * dtim_period) > CUSTOM_LISTEN_INTERVAL) {
+                       /* Round up dtim_skip to fit into STAs Listen Interval */
+                       bcn_li_dtim = (int)(CUSTOM_LISTEN_INTERVAL / dtim_period);
+                       DHD_TRACE(("%s agjust dtim_skip as %d\n", __FUNCTION__, bcn_li_dtim));
+               }
+       }
+
+       DHD_ERROR(("%s beacon=%d bcn_li_dtim=%d DTIM=%d Listen=%d\n",
+               __FUNCTION__, ap_beacon, bcn_li_dtim, dtim_period, CUSTOM_LISTEN_INTERVAL));
+
+exit:
+       return bcn_li_dtim;
+}
+
+/* Check if the mode supports STA MODE */
+bool dhd_support_sta_mode(dhd_pub_t *dhd)
+{
+
+#ifdef  WL_CFG80211
+       if (!(dhd->op_mode & DHD_FLAG_STA_MODE))
+               return FALSE;
+       else
+#endif /* WL_CFG80211 */
+               return TRUE;
+}
+
+#if defined(KEEP_ALIVE)
+int dhd_keep_alive_onoff(dhd_pub_t *dhd)
+{
+       char                            buf[32] = {0};
+       const char                      *str;
+       wl_mkeep_alive_pkt_t    mkeep_alive_pkt = {0};
+       wl_mkeep_alive_pkt_t    *mkeep_alive_pktp;
+       int                                     buf_len;
+       int                                     str_len;
+       int res                                 = -1;
+
+       if (!dhd_support_sta_mode(dhd))
+               return res;
+
+       DHD_TRACE(("%s execution\n", __FUNCTION__));
+
+       str = "mkeep_alive";
+       str_len = strlen(str);
+       strncpy(buf, str, sizeof(buf) - 1);
+       buf[ sizeof(buf) - 1 ] = '\0';
+       mkeep_alive_pktp = (wl_mkeep_alive_pkt_t *) (buf + str_len + 1);
+       mkeep_alive_pkt.period_msec = CUSTOM_KEEP_ALIVE_SETTING;
+       buf_len = str_len + 1;
+       mkeep_alive_pkt.version = htod16(WL_MKEEP_ALIVE_VERSION);
+       mkeep_alive_pkt.length = htod16(WL_MKEEP_ALIVE_FIXED_LEN);
+       /* Setup keep alive zero for null packet generation */
+       mkeep_alive_pkt.keep_alive_id = 0;
+       mkeep_alive_pkt.len_bytes = 0;
+       buf_len += WL_MKEEP_ALIVE_FIXED_LEN;
+       bzero(mkeep_alive_pkt.data, sizeof(mkeep_alive_pkt.data));
+       /* Keep-alive attributes are set in local       variable (mkeep_alive_pkt), and
+        * then memcpy'ed into buffer (mkeep_alive_pktp) since there is no
+        * guarantee that the buffer is properly aligned.
+        */
+       memcpy((char *)mkeep_alive_pktp, &mkeep_alive_pkt, WL_MKEEP_ALIVE_FIXED_LEN);
+
+       res = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, buf, buf_len, TRUE, 0);
+
+       return res;
+}
+#endif /* defined(KEEP_ALIVE) */
+#if defined(WL_WIRELESS_EXT)
+/* Android ComboSCAN support */
+
+/*
+ *  data parsing from ComboScan tlv list
+*/
+int
+wl_iw_parse_data_tlv(char** list_str, void *dst, int dst_size, const char token,
+                     int input_size, int *bytes_left)
+{
+       char* str;
+       uint16 short_temp;
+       uint32 int_temp;
+
+       if ((list_str == NULL) || (*list_str == NULL) ||(bytes_left == NULL) || (*bytes_left < 0)) {
+               DHD_ERROR(("%s error paramters\n", __FUNCTION__));
+               return -1;
+       }
+       str = *list_str;
+
+       /* Clean all dest bytes */
+       memset(dst, 0, dst_size);
+       while (*bytes_left > 0) {
+
+               if (str[0] != token) {
+                       DHD_TRACE(("%s NOT Type=%d get=%d left_parse=%d \n",
+                               __FUNCTION__, token, str[0], *bytes_left));
+                       return -1;
+               }
+
+               *bytes_left -= 1;
+               str += 1;
+
+               if (input_size == 1) {
+                       memcpy(dst, str, input_size);
+               }
+               else if (input_size == 2) {
+                       memcpy(dst, (char *)htod16(memcpy(&short_temp, str, input_size)),
+                               input_size);
+               }
+               else if (input_size == 4) {
+                       memcpy(dst, (char *)htod32(memcpy(&int_temp, str, input_size)),
+                               input_size);
+               }
+
+               *bytes_left -= input_size;
+               str += input_size;
+               *list_str = str;
+               return 1;
+       }
+       return 1;
+}
+
+/*
+ *  channel list parsing from cscan tlv list
+*/
+int
+wl_iw_parse_channel_list_tlv(char** list_str, uint16* channel_list,
+                             int channel_num, int *bytes_left)
+{
+       char* str;
+       int idx = 0;
+
+       if ((list_str == NULL) || (*list_str == NULL) ||(bytes_left == NULL) || (*bytes_left < 0)) {
+               DHD_ERROR(("%s error paramters\n", __FUNCTION__));
+               return -1;
+       }
+       str = *list_str;
+
+       while (*bytes_left > 0) {
+
+               if (str[0] != CSCAN_TLV_TYPE_CHANNEL_IE) {
+                       *list_str = str;
+                       DHD_TRACE(("End channel=%d left_parse=%d %d\n", idx, *bytes_left, str[0]));
+                       return idx;
+               }
+               /* Get proper CSCAN_TLV_TYPE_CHANNEL_IE */
+               *bytes_left -= 1;
+               str += 1;
+
+               if (str[0] == 0) {
+                       /* All channels */
+                       channel_list[idx] = 0x0;
+               }
+               else {
+                       channel_list[idx] = (uint16)str[0];
+                       DHD_TRACE(("%s channel=%d \n", __FUNCTION__,  channel_list[idx]));
+               }
+               *bytes_left -= 1;
+               str += 1;
+
+               if (idx++ > 255) {
+                       DHD_ERROR(("%s Too many channels \n", __FUNCTION__));
+                       return -1;
+               }
+       }
+
+       *list_str = str;
+       return idx;
+}
+
+/* Parse a comma-separated list from list_str into ssid array, starting
+ * at index idx.  Max specifies size of the ssid array.  Parses ssids
+ * and returns updated idx; if idx >= max not all fit, the excess have
+ * not been copied.  Returns -1 on empty string, or on ssid too long.
+ */
+int
+wl_iw_parse_ssid_list(char** list_str, wlc_ssid_t* ssid, int idx, int max)
+{
+       char* str, *ptr;
+
+       if ((list_str == NULL) || (*list_str == NULL))
+               return -1;
+
+       for (str = *list_str; str != NULL; str = ptr) {
+
+               /* check for next TAG */
+               if (!strncmp(str, GET_CHANNEL, strlen(GET_CHANNEL))) {
+                       *list_str        = str + strlen(GET_CHANNEL);
+                       return idx;
+               }
+
+               if ((ptr = strchr(str, ',')) != NULL) {
+                       *ptr++ = '\0';
+               }
+
+               if (strlen(str) > DOT11_MAX_SSID_LEN) {
+                       DHD_ERROR(("ssid <%s> exceeds %d\n", str, DOT11_MAX_SSID_LEN));
+                       return -1;
+               }
+
+               if (strlen(str) == 0)
+                       ssid[idx].SSID_len = 0;
+
+               if (idx < max) {
+                       bzero(ssid[idx].SSID, sizeof(ssid[idx].SSID));
+                       strncpy((char*)ssid[idx].SSID, str, sizeof(ssid[idx].SSID) - 1);
+                       ssid[idx].SSID_len = strlen(str);
+               }
+               idx++;
+       }
+       return idx;
+}
+
+/*
+ * Parse channel list from iwpriv CSCAN
+ */
+int
+wl_iw_parse_channel_list(char** list_str, uint16* channel_list, int channel_num)
+{
+       int num;
+       int val;
+       char* str;
+       char* endptr = NULL;
+
+       if ((list_str == NULL)||(*list_str == NULL))
+               return -1;
+
+       str = *list_str;
+       num = 0;
+       while (strncmp(str, GET_NPROBE, strlen(GET_NPROBE))) {
+               val = (int)strtoul(str, &endptr, 0);
+               if (endptr == str) {
+                       printf("could not parse channel number starting at"
+                               " substring \"%s\" in list:\n%s\n",
+                               str, *list_str);
+                       return -1;
+               }
+               str = endptr + strspn(endptr, " ,");
+
+               if (num == channel_num) {
+                       DHD_ERROR(("too many channels (more than %d) in channel list:\n%s\n",
+                               channel_num, *list_str));
+                       return -1;
+               }
+
+               channel_list[num++] = (uint16)val;
+       }
+       *list_str = str;
+       return num;
+}
+
+#endif 
+
+#if defined(WL_WIRELESS_EXT) || !defined(WL_SCHED_SCAN)
+
+#define PFN_SCAN_TLV_SSID_IE          'S'
+/*
+ *  SSIDs list parsing from PFN scan tlv list
+ */
+int
+wl_iw_parse_ssid_list_tlv(char** list_str, wlc_ssid_ext_t* ssid, int max, int *bytes_left)
+{
+       char* str;
+       int idx = 0;
+
+       if ((list_str == NULL) || (*list_str == NULL) || (*bytes_left < 0)) {
+               DHD_ERROR(("%s error paramters\n", __FUNCTION__));
+               return -1;
+       }
+       str = *list_str;
+       while (*bytes_left > 0) {
+
+               if (str[0] != PFN_SCAN_TLV_SSID_IE) {
+                       *list_str = str;
+                       DHD_TRACE(("nssid=%d left_parse=%d %d\n", idx, *bytes_left, str[0]));
+                       return idx;
+               }
+
+               /* Get proper CSCAN_TLV_TYPE_SSID_IE */
+               *bytes_left -= 1;
+               str += 1;
+
+               if (str[0] == 0) {
+                       /* Broadcast SSID */
+                       ssid[idx].SSID_len = 0;
+                       memset((char*)ssid[idx].SSID, 0x0, DOT11_MAX_SSID_LEN);
+                       *bytes_left -= 1;
+                       str += 1;
+
+                       DHD_TRACE(("BROADCAST SCAN  left=%d\n", *bytes_left));
+               }
+               else if (str[0] <= DOT11_MAX_SSID_LEN) {
+                       /* Get proper SSID size */
+                       ssid[idx].SSID_len = str[0];
+                       *bytes_left -= 1;
+                       str += 1;
+
+                       /* Get SSID */
+                       if (ssid[idx].SSID_len > *bytes_left) {
+                               DHD_ERROR(("%s out of memory range len=%d but left=%d\n",
+                               __FUNCTION__, ssid[idx].SSID_len, *bytes_left));
+                               return -1;
+                       }
+
+                       memcpy((char*)ssid[idx].SSID, str, ssid[idx].SSID_len);
+
+                       *bytes_left -= ssid[idx].SSID_len;
+                       str += ssid[idx].SSID_len;
+                       ssid[idx].hidden = TRUE;
+
+                       DHD_TRACE(("%s :size=%d left=%d\n",
+                               (char*)ssid[idx].SSID, ssid[idx].SSID_len, *bytes_left));
+               }
+               else {
+                       DHD_ERROR(("### SSID size more that %d\n", str[0]));
+                       return -1;
+               }
+
+               if (idx++ >  max) {
+                       DHD_ERROR(("%s number of SSIDs more that %d\n", __FUNCTION__, idx));
+                       return -1;
+               }
+       }
+
+       *list_str = str;
+       return idx;
+}
+
+#endif 
+
+
+/* Given filename and download type,  returns a buffer pointer and length
+ * for download to f/w. Type can be FW or NVRAM.
+ *
+ */
+int dhd_get_download_buffer(dhd_pub_t  *dhd, char *file_path, download_type_t component,
+       char ** buffer, int *length)
+
+{
+       int ret = BCME_ERROR;
+       int len = 0;
+       int file_len;
+       void *image = NULL;
+       uint8 *buf = NULL;
+
+       /* Point to cache if available. */
+#ifdef CACHE_FW_IMAGES
+       if (component == FW) {
+               if (dhd->cached_fw_length) {
+                       len = dhd->cached_fw_length;
+                       buf = dhd->cached_fw;
+               }
+       } else if (component == NVRAM) {
+               if (dhd->cached_nvram_length) {
+                       len = dhd->cached_nvram_length;
+                       buf = dhd->cached_nvram;
+               }
+       } else {
+               return ret;
+       }
+#endif
+       /* No Valid cache found on this call */
+       if (!len) {
+               file_len = *length;
+               *length = 0;
+
+               if (file_path) {
+                       image = dhd_os_open_image(file_path);
+                       if (image == NULL) {
+                               goto err;
+                       }
+               }
+
+               buf = MALLOCZ(dhd->osh, file_len);
+               if (buf == NULL) {
+                       DHD_ERROR(("%s: Failed to allocate memory %d bytes\n",
+                               __FUNCTION__, file_len));
+                       goto err;
+               }
+
+               /* Download image */
+               len = dhd_os_get_image_block(buf, file_len, image);
+               if ((len <= 0 || len > file_len)) {
+                       MFREE(dhd->osh, buf, file_len);
+                       goto err;
+               }
+       }
+
+       ret = BCME_OK;
+       *length = len;
+       *buffer = buf;
+
+       /* Cache if first call. */
+#ifdef CACHE_FW_IMAGES
+       if (component == FW) {
+               if (!dhd->cached_fw_length) {
+                       dhd->cached_fw = buf;
+                       dhd->cached_fw_length = len;
+               }
+       } else if (component == NVRAM) {
+               if (!dhd->cached_nvram_length) {
+                       dhd->cached_nvram = buf;
+                       dhd->cached_nvram_length = len;
+               }
+       }
+#endif
+
+err:
+       if (image)
+               dhd_os_close_image(image);
+
+       return ret;
+}
+
+int
+dhd_download_2_dongle(dhd_pub_t        *dhd, char *iovar, uint16 flag, uint16 dload_type,
+       unsigned char *dload_buf, int len)
+{
+       struct wl_dload_data *dload_ptr = (struct wl_dload_data *)dload_buf;
+       int err = 0;
+       int dload_data_offset;
+       static char iovar_buf[WLC_IOCTL_MEDLEN];
+       int iovar_len;
+
+       memset(iovar_buf, 0, sizeof(iovar_buf));
+
+       dload_data_offset = OFFSETOF(wl_dload_data_t, data);
+       dload_ptr->flag = (DLOAD_HANDLER_VER << DLOAD_FLAG_VER_SHIFT) | flag;
+       dload_ptr->dload_type = dload_type;
+       dload_ptr->len = htod32(len - dload_data_offset);
+       dload_ptr->crc = 0;
+       len = len + 8 - (len%8);
+
+       iovar_len = bcm_mkiovar(iovar, dload_buf,
+               (uint)len, iovar_buf, sizeof(iovar_buf));
+       if (iovar_len == 0) {
+               DHD_ERROR(("%s: insufficient buffer space passed to bcm_mkiovar for '%s' \n",
+                          __FUNCTION__, iovar));
+               return BCME_BUFTOOSHORT;
+       }
+
+       err = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovar_buf,
+                       iovar_len, IOV_SET, 0);
+
+       return err;
+}
+
+int
+dhd_download_clm_blob(dhd_pub_t        *dhd, unsigned char *buf, uint32 len)
+{
+       int chunk_len, cumulative_len = 0;
+       int size2alloc;
+       unsigned char *new_buf;
+       int err = 0, data_offset;
+       uint16 dl_flag = DL_BEGIN;
+
+       data_offset = OFFSETOF(wl_dload_data_t, data);
+       size2alloc = data_offset + MAX_CHUNK_LEN;
+
+       if ((new_buf = (unsigned char *)MALLOCZ(dhd->osh, size2alloc)) != NULL) {
+               do {
+                       if (len >= MAX_CHUNK_LEN)
+                               chunk_len = MAX_CHUNK_LEN;
+                       else
+                               chunk_len = len;
+
+                       memcpy(new_buf + data_offset, buf + cumulative_len, chunk_len);
+                       cumulative_len += chunk_len;
+
+                       if (len - chunk_len == 0)
+                               dl_flag |= DL_END;
+
+                       err = dhd_download_2_dongle(dhd, "clmload", dl_flag, DL_TYPE_CLM,
+                               new_buf, data_offset + chunk_len);
+
+                       dl_flag &= ~DL_BEGIN;
+
+                       len = len - chunk_len;
+               } while ((len > 0) && (err == 0));
+
+               MFREE(dhd->osh, new_buf, size2alloc);
+       } else {
+               err = BCME_NOMEM;
+       }
+
+       return err;
+}
+
+int
+dhd_apply_default_clm(dhd_pub_t *dhd, char *clm_path)
+{
+       char *clm_blob_path;
+       int len;
+       char *memblock = NULL;
+       int err = BCME_OK;
+       char iovbuf[WLC_IOCTL_SMLEN];
+       wl_country_t *cspec;
+
+       if (clm_path[0] != '\0') {
+               if (strlen(clm_path) > MOD_PARAM_PATHLEN) {
+                       DHD_ERROR(("clm path exceeds max len\n"));
+                       return BCME_ERROR;
+               }
+               clm_blob_path = clm_path;
+               DHD_TRACE(("clm path from module param:%s\n", clm_path));
+       } else {
+               clm_blob_path = CONFIG_BCMDHD_CLM_PATH;
+       }
+
+
+       /* If CLM blob file is found on the filesystem, download the file.
+        * After CLM file download or If the blob file is not present,
+        * validate the country code before proceeding with the initialization.
+        * If country code is not valid, fail the initialization.
+        */
+       len = MAX_CLM_BUF_SIZE;
+       dhd_get_download_buffer(dhd, clm_blob_path, CLM_BLOB, &memblock, &len);
+       if ((len > 0) && (len < MAX_CLM_BUF_SIZE) && memblock) {
+               bcm_mkiovar("country", NULL, 0, iovbuf, sizeof(iovbuf));
+               err = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, iovbuf, sizeof(iovbuf), FALSE, 0);
+               if (err) {
+                       DHD_ERROR(("%s: country code get failed\n", __FUNCTION__));
+                       goto exit;
+               }
+
+               cspec = (wl_country_t *)iovbuf;
+               if ((strncmp(cspec->ccode, WL_CCODE_NULL_COUNTRY, WLC_CNTRY_BUF_SZ)) != 0) {
+                       DHD_ERROR(("%s: CLM already exist in F/W, "
+                               "new CLM data will be added to the end of existing CLM data!\n",
+                               __FUNCTION__));
+               }
+
+               /* Found blob file. Download the file */
+               DHD_TRACE(("clm file download from %s \n", clm_blob_path));
+               err = dhd_download_clm_blob(dhd, memblock, len);
+               if (err) {
+                       DHD_ERROR(("%s: CLM download failed err=%d\n", __FUNCTION__, err));
+                       /* Retrieve clmload_status and print */
+                       bcm_mkiovar("clmload_status", NULL, 0, iovbuf, sizeof(iovbuf));
+                       err = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, iovbuf, sizeof(iovbuf), FALSE, 0);
+                       if (err) {
+                               DHD_ERROR(("%s: clmload_status get failed err=%d \n",
+                                       __FUNCTION__, err));
+                       } else {
+                               DHD_ERROR(("%s: clmload_status: %d \n",
+                                       __FUNCTION__, *((int *)iovbuf)));
+                       }
+                       err = BCME_ERROR;
+                       goto exit;
+               } else {
+                       DHD_INFO(("%s: CLM download succeeded \n", __FUNCTION__));
+               }
+       } else {
+               DHD_INFO(("Skipping the clm download. len:%d memblk:%p \n", len, memblock));
+#ifdef DHD_USE_CLMINFO_PARSER
+               err = BCME_ERROR;
+               goto exit;
+#endif /* DHD_USE_CLMINFO_PARSER */
+       }
+
+       /* Verify country code */
+       bcm_mkiovar("country", NULL, 0, iovbuf, sizeof(iovbuf));
+       err = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, iovbuf, sizeof(iovbuf), FALSE, 0);
+       if (err) {
+               DHD_ERROR(("%s: country code get failed\n", __FUNCTION__));
+               goto exit;
+       }
+
+       cspec = (wl_country_t *)iovbuf;
+       if ((strncmp(cspec->ccode, WL_CCODE_NULL_COUNTRY, WLC_CNTRY_BUF_SZ)) == 0) {
+               /* Country code not initialized or CLM download not proper */
+               DHD_ERROR(("country code not initialized\n"));
+               err = BCME_ERROR;
+       }
+
+exit:
+       if (memblock)
+               MFREE(dhd->osh, memblock, MAX_CLM_BUF_SIZE);
+
+       return err;
+}
+#ifdef DHD_USE_CLMINFO_PARSER
+#define CLMINFO_PATH "/installmedia/.clminfo"
+
+extern struct cntry_locales_custom translate_custom_table[NUM_OF_COUNTRYS];
+
+unsigned int
+process_clarification_vars(char *varbuf, unsigned int varbuf_size)
+{
+       char *dp;
+       bool findNewline;
+       int column;
+       unsigned int buf_len, len;
+
+       dp = varbuf;
+
+       findNewline = FALSE;
+       column = 0;
+
+       for (len = 0; len < varbuf_size; len++) {
+               if ((varbuf[len] == '\r') || (varbuf[len] == ' ')) {
+                       continue;
+               }
+               if (findNewline && varbuf[len] != '\n') {
+                       continue;
+               }
+               findNewline = FALSE;
+               if (varbuf[len] == '#') {
+                       findNewline = TRUE;
+                       continue;
+               }
+               if (varbuf[len] == '\n') {
+                       if (column == 0)
+                               continue;
+                       column = 0;
+                       continue;
+               }
+               *dp++ = varbuf[len];
+               column++;
+       }
+       buf_len = (unsigned int)(dp - varbuf);
+
+       while (dp < varbuf + len)
+               *dp++ = 0;
+
+       return buf_len;
+}
+
+int
+dhd_get_clminfo(dhd_pub_t *dhd, char *clm_path)
+{
+       int bcmerror = BCME_OK;
+       char *clminfo_path = CLMINFO_PATH;
+
+       char *memblock = NULL;
+       char *bufp;
+       uint len = MAX_CLMINFO_BUF_SIZE;
+       char *temp_buf = NULL;
+
+       int cnt = 0;
+
+       char tokdelim;
+       int parse_step = 0;
+       /*
+        * Read clm info from the .clminfo file
+        * 1st line : CLM blob file path
+        * 2nd ~ end of line: Country locales table
+        */
+       memset(translate_custom_table, 0, sizeof(translate_custom_table));
+
+       if (dhd_get_download_buffer(dhd, clminfo_path, CLMINFO, &memblock, &len) != 0) {
+               DHD_ERROR(("%s: Cannot open .clminfo file\n", __FUNCTION__));
+               bcmerror = BCME_ERROR;
+               goto out;
+       }
+
+       if ((len > 0) && (len <= MAX_CLMINFO_BUF_SIZE) && memblock) {
+               /* Found clminfo file. Parsing the file */
+               DHD_INFO(("clminfo file parsing from %s \n", clminfo_path));
+
+               bufp = (char *) memblock;
+               bufp[len] = 0;
+
+               /* clean up the file */
+               len = process_clarification_vars(bufp, len);
+
+               temp_buf = MALLOCZ(dhd->osh, MAX_CLMINFO_BUF_SIZE);
+
+               temp_buf = bcmstrtok(&bufp, "=", &tokdelim);
+               /* reduce the len of bufp by token byte(1) and ptr length */
+               len -= (strlen(temp_buf) + 1);
+
+               if (strncmp(temp_buf, "clm_path", 8) != 0) {
+                       DHD_ERROR(("%s: Cannot found clm_path\n", __FUNCTION__));
+                       bcmerror = BCME_ERROR;
+                       goto out;
+               }
+
+               /* read clm_path */
+               strcpy(clm_path, bcmstrtok(&bufp, ";", &tokdelim));
+               len -= (strlen(clm_path) + 1);
+
+               DHD_INFO(("%s: Found clm_path %s\n", __FUNCTION__, clm_path));
+
+               if (len <= 0) {
+                       DHD_ERROR(("%s: Length is invalid\n", __FUNCTION__));
+                       bcmerror = BCME_ERROR;
+                       goto out;
+               }
+
+               /* reserved relocale map[0] to XZ/11 */
+               memcpy(translate_custom_table[cnt].custom_locale, "XZ", strlen("XZ"));
+               translate_custom_table[cnt].custom_locale_rev = 11;
+               DHD_INFO(("%s: Relocale map - iso_aabrev %s custom locale %s "
+                       "custom locale rev %d\n",
+                       __FUNCTION__,
+                       translate_custom_table[cnt].iso_abbrev,
+                       translate_custom_table[cnt].custom_locale,
+                       translate_custom_table[cnt].custom_locale_rev));
+
+               cnt++;
+
+               /* start parsing relocale map */
+               do {
+
+                       if ((bufp[0] == 0) && (len > 0)) {
+                               DHD_ERROR(("%s: First byte is NULL character\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto out;
+                       }
+                       if ((bufp[0] == '=') || (bufp[0] == '/') || (bufp[0] == ';')) {
+                               DHD_ERROR(("%s: Data is invalid\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto out;
+                       }
+
+                       memset(temp_buf, 0, strlen(temp_buf));
+                       /* parsing relocale data */
+                       temp_buf = bcmstrtok(&bufp, "=/;", &tokdelim);
+                       len -= (strlen(temp_buf) + 1);
+
+                       if ((parse_step == 0) && (tokdelim == '=')) {
+                               memcpy(translate_custom_table[cnt].iso_abbrev,
+                                       temp_buf, strlen(temp_buf));
+                               parse_step++;
+                       } else if ((parse_step == 1) && (tokdelim == '/')) {
+                               memcpy(translate_custom_table[cnt].custom_locale,
+                                       temp_buf, strlen(temp_buf));
+                               parse_step++;
+                       } else if ((parse_step == 2) && (tokdelim == ';')) {
+                               char *str, *endptr = NULL;
+                               int locale_rev;
+
+                               str = temp_buf;
+                               locale_rev = (int)strtoul(str, &endptr, 0);
+                               if (*endptr != 0) {
+                                       bcmerror = BCME_ERROR;
+                                       goto out;
+                               }
+
+                               translate_custom_table[cnt].custom_locale_rev = locale_rev;
+
+                               DHD_INFO(("%s: Relocale map - iso_aabrev %s"
+                                       " custom locale %s custom locale rev %d\n",
+                                       __FUNCTION__,
+                                       translate_custom_table[cnt].iso_abbrev,
+                                       translate_custom_table[cnt].custom_locale,
+                                       translate_custom_table[cnt].custom_locale_rev));
+
+                               parse_step = 0;
+                               cnt++;
+                       } else {
+                               DHD_ERROR(("%s: CLM info data format is invalid\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto out;
+                       }
+
+               } while (len > 0);
+       }
+out:
+       if (memblock) {
+               dhd_free_download_buffer(dhd, memblock, MAX_NVRAMBUF_SIZE);
+       }
+       if (temp_buf) {
+               MFREE(dhd->osh, temp_buf, MAX_CLMINFO_BUF_SIZE);
+       }
+       if (bcmerror != BCME_OK) {
+               DHD_ERROR(("%s: .clminfo parsing fail!!\n", __FUNCTION__));
+       }
+
+       return bcmerror;
+}
+#endif /* DHD_USE_CLMINFO_PARSER */
+
+void dhd_free_download_buffer(dhd_pub_t        *dhd, void *buffer, int length)
+{
+#ifdef CACHE_FW_IMAGES
+       return;
+#endif
+       MFREE(dhd->osh, buffer, length);
+}
+/* Parse EAPOL 4 way handshake messages */
+void
+dhd_dump_eapol_4way_message(char *ifname, char *dump_data, bool direction)
+{
+       unsigned char type;
+       int pair, ack, mic, kerr, req, sec, install;
+       unsigned short us_tmp;
+       type = dump_data[18];
+       if (type == 2 || type == 254) {
+               us_tmp = (dump_data[19] << 8) | dump_data[20];
+               pair =  0 != (us_tmp & 0x08);
+               ack = 0  != (us_tmp & 0x80);
+               mic = 0  != (us_tmp & 0x100);
+               kerr =  0 != (us_tmp & 0x400);
+               req = 0  != (us_tmp & 0x800);
+               sec = 0  != (us_tmp & 0x200);
+               install  = 0 != (us_tmp & 0x40);
+               if (!sec && !mic && ack && !install && pair && !kerr && !req) {
+                       DHD_ERROR(("ETHER_TYPE_802_1X[%s] [%s] : M1 of 4way\n",
+                               ifname, direction ? "TX" : "RX"));
+               } else if (pair && !install && !ack && mic && !sec && !kerr && !req) {
+                       DHD_ERROR(("ETHER_TYPE_802_1X[%s] [%s] : M2 of 4way\n",
+                               ifname, direction ? "TX" : "RX"));
+               } else if (pair && ack && mic && sec && !kerr && !req) {
+                       DHD_ERROR(("ETHER_TYPE_802_1X[%s] [%s] : M3 of 4way\n",
+                               ifname, direction ? "TX" : "RX"));
+               } else if (pair && !install && !ack && mic && sec && !req && !kerr) {
+                       DHD_ERROR(("ETHER_TYPE_802_1X[%s] [%s] : M4 of 4way\n",
+                               ifname, direction ? "TX" : "RX"));
+               } else {
+                       DHD_ERROR(("ETHER_TYPE_802_1X[%s] [%s]: ver %d, type %d, replay %d\n",
+                               ifname, direction ? "TX" : "RX",
+                               dump_data[14], dump_data[15], dump_data[30]));
+               }
+       } else {
+               DHD_ERROR(("ETHER_TYPE_802_1X[%s] [%s]: ver %d, type %d, replay %d\n",
+                       ifname, direction ? "TX" : "RX",
+                       dump_data[14], dump_data[15], dump_data[30]));
+       }
+}
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_custom_gpio.c b/drivers/net/wireless/bcmdhd_1363/dhd_custom_gpio.c
new file mode 100644 (file)
index 0000000..09d47d5
--- /dev/null
@@ -0,0 +1,309 @@
+/*
+ * Customer code to add GPIO control during WLAN start/stop
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_custom_gpio.c 591129 2015-10-07 05:22:14Z $
+ */
+
+#include <typedefs.h>
+#include <linuxver.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_linux.h>
+
+#include <wlioctl.h>
+#if defined(WL_WIRELESS_EXT)
+#include <wl_iw.h>
+#endif
+
+#define WL_ERROR(x) printf x
+#define WL_TRACE(x)
+
+#if defined(OOB_INTR_ONLY)
+
+#if defined(BCMLXSDMMC)
+extern int sdioh_mmc_irq(int irq);
+#endif /* (BCMLXSDMMC)  */
+
+/* Customer specific Host GPIO defintion  */
+static int dhd_oob_gpio_num = -1;
+
+module_param(dhd_oob_gpio_num, int, 0644);
+MODULE_PARM_DESC(dhd_oob_gpio_num, "DHD oob gpio number");
+
+/* This function will return:
+ *  1) return :  Host gpio interrupt number per customer platform
+ *  2) irq_flags_ptr : Type of Host interrupt as Level or Edge
+ *
+ *  NOTE :
+ *  Customer should check his platform definitions
+ *  and his Host Interrupt spec
+ *  to figure out the proper setting for his platform.
+ *  Broadcom provides just reference settings as example.
+ *
+ */
+int dhd_customer_oob_irq_map(void *adapter, unsigned long *irq_flags_ptr)
+{
+       int  host_oob_irq = 0;
+
+#if defined(CUSTOMER_HW2)
+       host_oob_irq = wifi_platform_get_irq_number(adapter, irq_flags_ptr);
+
+#else
+#if defined(CUSTOM_OOB_GPIO_NUM)
+       if (dhd_oob_gpio_num < 0) {
+               dhd_oob_gpio_num = CUSTOM_OOB_GPIO_NUM;
+       }
+#endif /* CUSTOMER_OOB_GPIO_NUM */
+
+       if (dhd_oob_gpio_num < 0) {
+               WL_ERROR(("%s: ERROR customer specific Host GPIO is NOT defined \n",
+               __FUNCTION__));
+               return (dhd_oob_gpio_num);
+       }
+
+       WL_ERROR(("%s: customer specific Host GPIO number is (%d)\n",
+                __FUNCTION__, dhd_oob_gpio_num));
+
+#endif 
+
+       return (host_oob_irq);
+}
+#endif 
+
+/* Customer function to control hw specific wlan gpios */
+int
+dhd_customer_gpio_wlan_ctrl(void *adapter, int onoff)
+{
+       int err = 0;
+
+       return err;
+}
+
+#ifdef GET_CUSTOM_MAC_ENABLE
+/* Function to get custom MAC address */
+int
+dhd_custom_get_mac_address(void *adapter, unsigned char *buf)
+{
+       int ret = 0;
+
+       WL_TRACE(("%s Enter\n", __FUNCTION__));
+       if (!buf)
+               return -EINVAL;
+
+       /* Customer access to MAC address stored outside of DHD driver */
+#if defined(CUSTOMER_HW2) && (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35))
+       ret = wifi_platform_get_mac_addr(adapter, buf);
+#endif
+
+#ifdef EXAMPLE_GET_MAC
+       /* EXAMPLE code */
+       {
+               struct ether_addr ea_example = {{0x00, 0x11, 0x22, 0x33, 0x44, 0xFF}};
+               bcopy((char *)&ea_example, buf, sizeof(struct ether_addr));
+       }
+#endif /* EXAMPLE_GET_MAC */
+
+       return ret;
+}
+#endif /* GET_CUSTOM_MAC_ENABLE */
+
+#if !defined(WL_WIRELESS_EXT)
+struct cntry_locales_custom {
+       char iso_abbrev[WLC_CNTRY_BUF_SZ];      /* ISO 3166-1 country abbreviation */
+       char custom_locale[WLC_CNTRY_BUF_SZ];   /* Custom firmware locale */
+       int32 custom_locale_rev;                /* Custom local revisin default -1 */
+};
+#endif /* WL_WIRELESS_EXT */
+
+/* Customized Locale table : OPTIONAL feature */
+const struct cntry_locales_custom translate_custom_table[] = {
+/* Table should be filled out based on custom platform regulatory requirement */
+#ifdef EXAMPLE_TABLE
+       {"",   "XY", 4},  /* Universal if Country code is unknown or empty */
+       {"US", "US", 69}, /* input ISO "US" to : US regrev 69 */
+       {"CA", "US", 69}, /* input ISO "CA" to : US regrev 69 */
+       {"EU", "EU", 5},  /* European union countries to : EU regrev 05 */
+       {"AT", "EU", 5},
+       {"BE", "EU", 5},
+       {"BG", "EU", 5},
+       {"CY", "EU", 5},
+       {"CZ", "EU", 5},
+       {"DK", "EU", 5},
+       {"EE", "EU", 5},
+       {"FI", "EU", 5},
+       {"FR", "EU", 5},
+       {"DE", "EU", 5},
+       {"GR", "EU", 5},
+       {"HU", "EU", 5},
+       {"IE", "EU", 5},
+       {"IT", "EU", 5},
+       {"LV", "EU", 5},
+       {"LI", "EU", 5},
+       {"LT", "EU", 5},
+       {"LU", "EU", 5},
+       {"MT", "EU", 5},
+       {"NL", "EU", 5},
+       {"PL", "EU", 5},
+       {"PT", "EU", 5},
+       {"RO", "EU", 5},
+       {"SK", "EU", 5},
+       {"SI", "EU", 5},
+       {"ES", "EU", 5},
+       {"SE", "EU", 5},
+       {"GB", "EU", 5},
+       {"KR", "XY", 3},
+       {"AU", "XY", 3},
+       {"CN", "XY", 3}, /* input ISO "CN" to : XY regrev 03 */
+       {"TW", "XY", 3},
+       {"AR", "XY", 3},
+       {"MX", "XY", 3},
+       {"IL", "IL", 0},
+       {"CH", "CH", 0},
+       {"TR", "TR", 0},
+       {"NO", "NO", 0},
+#endif /* EXMAPLE_TABLE */
+#if defined(CUSTOMER_HW2)
+#if defined(BCM4335_CHIP)
+       {"",   "XZ", 11},  /* Universal if Country code is unknown or empty */
+#endif
+       {"AE", "AE", 1},
+       {"AR", "AR", 1},
+       {"AT", "AT", 1},
+       {"AU", "AU", 2},
+       {"BE", "BE", 1},
+       {"BG", "BG", 1},
+       {"BN", "BN", 1},
+       {"CA", "CA", 2},
+       {"CH", "CH", 1},
+       {"CY", "CY", 1},
+       {"CZ", "CZ", 1},
+       {"DE", "DE", 3},
+       {"DK", "DK", 1},
+       {"EE", "EE", 1},
+       {"ES", "ES", 1},
+       {"FI", "FI", 1},
+       {"FR", "FR", 1},
+       {"GB", "GB", 1},
+       {"GR", "GR", 1},
+       {"HR", "HR", 1},
+       {"HU", "HU", 1},
+       {"IE", "IE", 1},
+       {"IS", "IS", 1},
+       {"IT", "IT", 1},
+       {"ID", "ID", 1},
+       {"JP", "JP", 8},
+       {"KR", "KR", 24},
+       {"KW", "KW", 1},
+       {"LI", "LI", 1},
+       {"LT", "LT", 1},
+       {"LU", "LU", 1},
+       {"LV", "LV", 1},
+       {"MA", "MA", 1},
+       {"MT", "MT", 1},
+       {"MX", "MX", 1},
+       {"NL", "NL", 1},
+       {"NO", "NO", 1},
+       {"PL", "PL", 1},
+       {"PT", "PT", 1},
+       {"PY", "PY", 1},
+       {"RO", "RO", 1},
+       {"SE", "SE", 1},
+       {"SI", "SI", 1},
+       {"SK", "SK", 1},
+       {"TR", "TR", 7},
+       {"TW", "TW", 1},
+       {"IR", "XZ", 11},       /* Universal if Country code is IRAN, (ISLAMIC REPUBLIC OF) */
+       {"SD", "XZ", 11},       /* Universal if Country code is SUDAN */
+       {"SY", "XZ", 11},       /* Universal if Country code is SYRIAN ARAB REPUBLIC */
+       {"GL", "XZ", 11},       /* Universal if Country code is GREENLAND */
+       {"PS", "XZ", 11},       /* Universal if Country code is PALESTINIAN TERRITORY, OCCUPIED */
+       {"TL", "XZ", 11},       /* Universal if Country code is TIMOR-LESTE (EAST TIMOR) */
+       {"MH", "XZ", 11},       /* Universal if Country code is MARSHALL ISLANDS */
+#ifdef BCM4330_CHIP
+       {"RU", "RU", 1},
+       {"US", "US", 5}
+#endif
+#endif 
+};
+
+
+/* Customized Locale convertor
+*  input : ISO 3166-1 country abbreviation
+*  output: customized cspec
+*/
+#ifdef CUSTOM_COUNTRY_CODE
+void get_customized_country_code(void *adapter, char *country_iso_code,
+  wl_country_t *cspec, u32 flags)
+#else
+void get_customized_country_code(void *adapter, char *country_iso_code, wl_country_t *cspec)
+#endif /* CUSTOM_COUNTRY_CODE */
+{
+#if defined(CUSTOMER_HW2) && (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39))
+
+       struct cntry_locales_custom *cloc_ptr;
+
+       if (!cspec)
+               return;
+#ifdef CUSTOM_COUNTRY_CODE
+       cloc_ptr = wifi_platform_get_country_code(adapter, country_iso_code,
+                  flags);
+#else
+       cloc_ptr = wifi_platform_get_country_code(adapter, country_iso_code);
+#endif /* CUSTOM_COUNTRY_CODE */
+       if (cloc_ptr) {
+               strlcpy(cspec->ccode, cloc_ptr->custom_locale, WLC_CNTRY_BUF_SZ);
+               cspec->rev = cloc_ptr->custom_locale_rev;
+       }
+       return;
+#else
+       int size, i;
+
+       size = ARRAYSIZE(translate_custom_table);
+
+       if (cspec == 0)
+                return;
+
+       if (size == 0)
+                return;
+
+       for (i = 0; i < size; i++) {
+               if (strcmp(country_iso_code, translate_custom_table[i].iso_abbrev) == 0) {
+                       memcpy(cspec->ccode,
+                               translate_custom_table[i].custom_locale, WLC_CNTRY_BUF_SZ);
+                       cspec->rev = translate_custom_table[i].custom_locale_rev;
+                       return;
+               }
+       }
+#ifdef EXAMPLE_TABLE
+       /* if no country code matched return first universal code from translate_custom_table */
+       memcpy(cspec->ccode, translate_custom_table[0].custom_locale, WLC_CNTRY_BUF_SZ);
+       cspec->rev = translate_custom_table[0].custom_locale_rev;
+#endif /* EXMAPLE_TABLE */
+       return;
+#endif /* defined(CUSTOMER_HW2) && (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)) */
+}
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_dbg.h b/drivers/net/wireless/bcmdhd_1363/dhd_dbg.h
new file mode 100644 (file)
index 0000000..ea58894
--- /dev/null
@@ -0,0 +1,193 @@
+/*
+ * Debug/trace/assert driver definitions for Dongle Host Driver.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_dbg.h 598059 2015-11-07 07:31:52Z $
+ */
+
+#ifndef _dhd_dbg_
+#define _dhd_dbg_
+
+#if defined(DHD_DEBUG)
+#ifdef DHD_LOG_DUMP
+extern void dhd_log_dump_print(const char *fmt, ...);
+extern char *dhd_log_dump_get_timestamp(void);
+#define DHD_ERROR(args)        \
+do {   \
+       if (dhd_msg_level & DHD_ERROR_VAL) {    \
+               printf args;    \
+               dhd_log_dump_print("[%s] %s: ", dhd_log_dump_get_timestamp(), __func__);        \
+               dhd_log_dump_print args;        \
+       }       \
+} while (0)
+#else
+#define DHD_ERROR(args)                do {if (dhd_msg_level & DHD_ERROR_VAL) printf args;} while (0)
+#endif /* DHD_LOG_DUMP */
+#define DHD_TRACE(args)                do {if (dhd_msg_level & DHD_TRACE_VAL) printf args;} while (0)
+#define DHD_INFO(args)         do {if (dhd_msg_level & DHD_INFO_VAL) printf args;} while (0)
+#define DHD_DATA(args)         do {if (dhd_msg_level & DHD_DATA_VAL) printf args;} while (0)
+#define DHD_CTL(args)          do {if (dhd_msg_level & DHD_CTL_VAL) printf args;} while (0)
+#define DHD_TIMER(args)                do {if (dhd_msg_level & DHD_TIMER_VAL) printf args;} while (0)
+#define DHD_HDRS(args)         do {if (dhd_msg_level & DHD_HDRS_VAL) printf args;} while (0)
+#define DHD_BYTES(args)                do {if (dhd_msg_level & DHD_BYTES_VAL) printf args;} while (0)
+#define DHD_INTR(args)         do {if (dhd_msg_level & DHD_INTR_VAL) printf args;} while (0)
+#define DHD_GLOM(args)         do {if (dhd_msg_level & DHD_GLOM_VAL) printf args;} while (0)
+#ifdef DHD_LOG_DUMP
+#define DHD_EVENT(args) \
+do {   \
+       if (dhd_msg_level & DHD_EVENT_VAL) {    \
+               printf args;    \
+               dhd_log_dump_print("[%s] %s: ", dhd_log_dump_get_timestamp(), __func__);        \
+               dhd_log_dump_print args;        \
+       }       \
+} while (0)
+#else
+#define DHD_EVENT(args)                do {if (dhd_msg_level & DHD_EVENT_VAL) printf args;} while (0)
+#endif /* DHD_LOG_DUMP */
+#define DHD_BTA(args)          do {if (dhd_msg_level & DHD_BTA_VAL) printf args;} while (0)
+#define DHD_ISCAN(args)                do {if (dhd_msg_level & DHD_ISCAN_VAL) printf args;} while (0)
+#define DHD_ARPOE(args)                do {if (dhd_msg_level & DHD_ARPOE_VAL) printf args;} while (0)
+#define DHD_REORDER(args)      do {if (dhd_msg_level & DHD_REORDER_VAL) printf args;} while (0)
+#define DHD_PNO(args)          do {if (dhd_msg_level & DHD_PNO_VAL) printf args;} while (0)
+#ifdef DHD_LOG_DUMP
+#define DHD_MSGTRACE_LOG(args) \
+do {   \
+       if (dhd_msg_level & DHD_MSGTRACE_VAL) { \
+               printf args;    \
+               dhd_log_dump_print("[%s] %s: ", dhd_log_dump_get_timestamp(), __func__);        \
+               dhd_log_dump_print args;        \
+       }   \
+} while (0)
+#else
+#define DHD_MSGTRACE_LOG(args)  do {if (dhd_msg_level & DHD_MSGTRACE_VAL) printf args;} while (0)
+#endif /* DHD_LOG_DUMP */
+#define DHD_FWLOG(args)                do {if (dhd_msg_level & DHD_FWLOG_VAL) printf args;} while (0)
+#define DHD_RTT(args)          do {if (dhd_msg_level & DHD_RTT_VAL) printf args;} while (0)
+#define DHD_IOV_INFO(args)     do {if (dhd_msg_level & DHD_IOV_INFO_VAL) printf args;} while (0)
+
+#ifdef DHD_LOG_DUMP
+#define DHD_ERROR_EX(args)                  \
+do {                                        \
+       if (dhd_msg_level & DHD_ERROR_VAL) {    \
+               dhd_log_dump_print("[%s] %s: ", dhd_log_dump_get_timestamp(), __func__);        \
+               dhd_log_dump_print args;        \
+       }       \
+} while (0)
+#else
+#define DHD_ERROR_EX(args) DHD_ERROR(args)
+#endif /* DHD_LOG_DUMP */
+
+#ifdef CUSTOMER_HW4_DEBUG
+#define DHD_TRACE_HW4  DHD_ERROR
+#define DHD_INFO_HW4   DHD_ERROR
+#else
+#define DHD_TRACE_HW4  DHD_TRACE
+#define DHD_INFO_HW4   DHD_INFO
+#endif /* CUSTOMER_HW4_DEBUG */
+
+#define DHD_ERROR_ON()         (dhd_msg_level & DHD_ERROR_VAL)
+#define DHD_TRACE_ON()         (dhd_msg_level & DHD_TRACE_VAL)
+#define DHD_INFO_ON()          (dhd_msg_level & DHD_INFO_VAL)
+#define DHD_DATA_ON()          (dhd_msg_level & DHD_DATA_VAL)
+#define DHD_CTL_ON()           (dhd_msg_level & DHD_CTL_VAL)
+#define DHD_TIMER_ON()         (dhd_msg_level & DHD_TIMER_VAL)
+#define DHD_HDRS_ON()          (dhd_msg_level & DHD_HDRS_VAL)
+#define DHD_BYTES_ON()         (dhd_msg_level & DHD_BYTES_VAL)
+#define DHD_INTR_ON()          (dhd_msg_level & DHD_INTR_VAL)
+#define DHD_GLOM_ON()          (dhd_msg_level & DHD_GLOM_VAL)
+#define DHD_EVENT_ON()         (dhd_msg_level & DHD_EVENT_VAL)
+#define DHD_BTA_ON()           (dhd_msg_level & DHD_BTA_VAL)
+#define DHD_ISCAN_ON()         (dhd_msg_level & DHD_ISCAN_VAL)
+#define DHD_ARPOE_ON()         (dhd_msg_level & DHD_ARPOE_VAL)
+#define DHD_REORDER_ON()       (dhd_msg_level & DHD_REORDER_VAL)
+#define DHD_NOCHECKDIED_ON()   (dhd_msg_level & DHD_NOCHECKDIED_VAL)
+#define DHD_PNO_ON()           (dhd_msg_level & DHD_PNO_VAL)
+#define DHD_FWLOG_ON()         (dhd_msg_level & DHD_FWLOG_VAL)
+#define DHD_IOV_INFO_ON()      (dhd_msg_level & DHD_IOV_INFO_VAL)
+
+#else /* defined(BCMDBG) || defined(DHD_DEBUG) */
+
+#define DHD_ERROR(args)                do {printf args;} while (0)
+#define DHD_TRACE(args)
+#define DHD_INFO(args)
+#define DHD_DATA(args)
+#define DHD_CTL(args)
+#define DHD_TIMER(args)
+#define DHD_HDRS(args)
+#define DHD_BYTES(args)
+#define DHD_INTR(args)
+#define DHD_GLOM(args)
+#define DHD_EVENT(args)
+#define DHD_BTA(args)
+#define DHD_ISCAN(args)
+#define DHD_ARPOE(args)
+#define DHD_REORDER(args)
+#define DHD_PNO(args)
+#define DHD_MSGTRACE_LOG(args)
+#define DHD_FWLOG(args)
+#define DHD_IOV_INFO(args)
+#define DHD_ERROR_EX(args) DHD_ERROR(args)
+
+#ifdef CUSTOMER_HW4_DEBUG
+#define DHD_TRACE_HW4  DHD_ERROR
+#define DHD_INFO_HW4   DHD_ERROR
+#else
+#define DHD_TRACE_HW4  DHD_TRACE
+#define DHD_INFO_HW4   DHD_INFO
+#endif /* CUSTOMER_HW4_DEBUG */
+
+#define DHD_ERROR_ON()         0
+#define DHD_TRACE_ON()         0
+#define DHD_INFO_ON()          0
+#define DHD_DATA_ON()          0
+#define DHD_CTL_ON()           0
+#define DHD_TIMER_ON()         0
+#define DHD_HDRS_ON()          0
+#define DHD_BYTES_ON()         0
+#define DHD_INTR_ON()          0
+#define DHD_GLOM_ON()          0
+#define DHD_EVENT_ON()         0
+#define DHD_BTA_ON()           0
+#define DHD_ISCAN_ON()         0
+#define DHD_ARPOE_ON()         0
+#define DHD_REORDER_ON()       0
+#define DHD_NOCHECKDIED_ON()   0
+#define DHD_PNO_ON()           0
+#define DHD_FWLOG_ON()         0
+#define DHD_IOV_INFO_ON()      0
+
+#endif 
+
+#define DHD_LOG(args)
+
+#define DHD_BLOG(cp, size)
+
+#define DHD_NONE(args)
+extern int dhd_msg_level;
+
+/* Defines msg bits */
+#include <dhdioctl.h>
+
+#endif /* _dhd_dbg_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_flowring.c b/drivers/net/wireless/bcmdhd_1363/dhd_flowring.c
new file mode 100644 (file)
index 0000000..c819774
--- /dev/null
@@ -0,0 +1,964 @@
+/*
+ * @file Broadcom Dongle Host Driver (DHD), Flow ring specific code at top level
+ *
+ * Flow rings are transmit traffic (=propagating towards antenna) related entities
+ *
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_flowring.c 591285 2015-10-07 11:56:29Z $
+ */
+
+
+#include <typedefs.h>
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <bcmdevs.h>
+
+#include <proto/ethernet.h>
+#include <proto/bcmevent.h>
+#include <dngl_stats.h>
+
+#include <dhd.h>
+
+#include <dhd_flowring.h>
+#include <dhd_bus.h>
+#include <dhd_proto.h>
+#include <dhd_dbg.h>
+#include <proto/802.1d.h>
+#include <pcie_core.h>
+#include <bcmmsgbuf.h>
+#include <dhd_pcie.h>
+
+
+static INLINE int dhd_flow_queue_throttle(flow_queue_t *queue);
+
+static INLINE uint16 dhd_flowid_find(dhd_pub_t *dhdp, uint8 ifindex,
+                                     uint8 prio, char *sa, char *da);
+
+static INLINE uint16 dhd_flowid_alloc(dhd_pub_t *dhdp, uint8 ifindex,
+                                      uint8 prio, char *sa, char *da);
+
+static INLINE int dhd_flowid_lookup(dhd_pub_t *dhdp, uint8 ifindex,
+                                uint8 prio, char *sa, char *da, uint16 *flowid);
+int BCMFASTPATH dhd_flow_queue_overflow(flow_queue_t *queue, void *pkt);
+
+#define FLOW_QUEUE_PKT_NEXT(p)          PKTLINK(p)
+#define FLOW_QUEUE_PKT_SETNEXT(p, x)    PKTSETLINK((p), (x))
+
+#ifdef DHD_LOSSLESS_ROAMING
+const uint8 prio2ac[8] = { 0, 1, 1, 0, 2, 2, 3, 7 };
+#else
+const uint8 prio2ac[8] = { 0, 1, 1, 0, 2, 2, 3, 3 };
+#endif
+const uint8 prio2tid[8] = { 0, 1, 2, 3, 4, 5, 6, 7 };
+
+/** Queue overflow throttle. Return value: TRUE if throttle needs to be applied */
+static INLINE int
+dhd_flow_queue_throttle(flow_queue_t *queue)
+{
+       return DHD_FLOW_QUEUE_FULL(queue);
+}
+
+int BCMFASTPATH
+dhd_flow_queue_overflow(flow_queue_t *queue, void *pkt)
+{
+       return BCME_NORESOURCE;
+}
+
+/** Returns flow ring given a flowid */
+flow_ring_node_t *
+dhd_flow_ring_node(dhd_pub_t *dhdp, uint16 flowid)
+{
+       flow_ring_node_t * flow_ring_node;
+
+       ASSERT(dhdp != (dhd_pub_t*)NULL);
+       ASSERT(flowid < dhdp->num_flow_rings);
+
+       flow_ring_node = &(((flow_ring_node_t*)(dhdp->flow_ring_table))[flowid]);
+
+       ASSERT(flow_ring_node->flowid == flowid);
+       return flow_ring_node;
+}
+
+/** Returns 'backup' queue given a flowid */
+flow_queue_t *
+dhd_flow_queue(dhd_pub_t *dhdp, uint16 flowid)
+{
+       flow_ring_node_t * flow_ring_node;
+
+       flow_ring_node = dhd_flow_ring_node(dhdp, flowid);
+       return &flow_ring_node->queue;
+}
+
+/* Flow ring's queue management functions */
+
+/** Initialize a flow ring's queue, called on driver initialization. */
+void
+dhd_flow_queue_init(dhd_pub_t *dhdp, flow_queue_t *queue, int max)
+{
+       ASSERT((queue != NULL) && (max > 0));
+
+       dll_init(&queue->list);
+       queue->head = queue->tail = NULL;
+       queue->len = 0;
+
+       /* Set queue's threshold and queue's parent cummulative length counter */
+       ASSERT(max > 1);
+       DHD_FLOW_QUEUE_SET_MAX(queue, max);
+       DHD_FLOW_QUEUE_SET_THRESHOLD(queue, max);
+       DHD_FLOW_QUEUE_SET_CLEN(queue, &dhdp->cumm_ctr);
+
+       queue->failures = 0U;
+       queue->cb = &dhd_flow_queue_overflow;
+}
+
+/** Register an enqueue overflow callback handler */
+void
+dhd_flow_queue_register(flow_queue_t *queue, flow_queue_cb_t cb)
+{
+       ASSERT(queue != NULL);
+       queue->cb = cb;
+}
+
+/**
+ * Enqueue an 802.3 packet at the back of a flow ring's queue. From there, it will travel later on
+ * to the flow ring itself.
+ */
+int BCMFASTPATH
+dhd_flow_queue_enqueue(dhd_pub_t *dhdp, flow_queue_t *queue, void *pkt)
+{
+       int ret = BCME_OK;
+
+       ASSERT(queue != NULL);
+
+       if (dhd_flow_queue_throttle(queue)) {
+               queue->failures++;
+               ret = (*queue->cb)(queue, pkt);
+               goto done;
+       }
+
+       if (queue->head) {
+               FLOW_QUEUE_PKT_SETNEXT(queue->tail, pkt);
+       } else {
+               queue->head = pkt;
+       }
+
+       FLOW_QUEUE_PKT_SETNEXT(pkt, NULL);
+
+       queue->tail = pkt; /* at tail */
+
+       queue->len++;
+       /* increment parent's cummulative length */
+       DHD_CUMM_CTR_INCR(DHD_FLOW_QUEUE_CLEN_PTR(queue));
+
+done:
+       return ret;
+}
+
+/** Dequeue an 802.3 packet from a flow ring's queue, from head (FIFO) */
+void * BCMFASTPATH
+dhd_flow_queue_dequeue(dhd_pub_t *dhdp, flow_queue_t *queue)
+{
+       void * pkt;
+
+       ASSERT(queue != NULL);
+
+       pkt = queue->head; /* from head */
+
+       if (pkt == NULL) {
+               ASSERT((queue->len == 0) && (queue->tail == NULL));
+               goto done;
+       }
+
+       queue->head = FLOW_QUEUE_PKT_NEXT(pkt);
+       if (queue->head == NULL)
+               queue->tail = NULL;
+
+       queue->len--;
+       /* decrement parent's cummulative length */
+       DHD_CUMM_CTR_DECR(DHD_FLOW_QUEUE_CLEN_PTR(queue));
+
+       FLOW_QUEUE_PKT_SETNEXT(pkt, NULL); /* dettach packet from queue */
+
+done:
+       return pkt;
+}
+
+/** Reinsert a dequeued 802.3 packet back at the head */
+void BCMFASTPATH
+dhd_flow_queue_reinsert(dhd_pub_t *dhdp, flow_queue_t *queue, void *pkt)
+{
+       if (queue->head == NULL) {
+               queue->tail = pkt;
+       }
+
+       FLOW_QUEUE_PKT_SETNEXT(pkt, queue->head);
+       queue->head = pkt;
+       queue->len++;
+       /* increment parent's cummulative length */
+       DHD_CUMM_CTR_INCR(DHD_FLOW_QUEUE_CLEN_PTR(queue));
+}
+
+/** Fetch the backup queue for a flowring, and assign flow control thresholds */
+void
+dhd_flow_ring_config_thresholds(dhd_pub_t *dhdp, uint16 flowid,
+                     int queue_budget, int cumm_threshold, void *cumm_ctr)
+{
+       flow_queue_t * queue;
+
+       ASSERT(dhdp != (dhd_pub_t*)NULL);
+       ASSERT(queue_budget > 1);
+       ASSERT(cumm_threshold > 1);
+       ASSERT(cumm_ctr != (void*)NULL);
+
+       queue = dhd_flow_queue(dhdp, flowid);
+
+       DHD_FLOW_QUEUE_SET_MAX(queue, queue_budget); /* Max queue length */
+
+       /* Set the queue's parent threshold and cummulative counter */
+       DHD_FLOW_QUEUE_SET_THRESHOLD(queue, cumm_threshold);
+       DHD_FLOW_QUEUE_SET_CLEN(queue, cumm_ctr);
+}
+
+/** Initializes data structures of multiple flow rings */
+int
+dhd_flow_rings_init(dhd_pub_t *dhdp, uint32 num_flow_rings)
+{
+       uint32 idx;
+       uint32 flow_ring_table_sz;
+       uint32 if_flow_lkup_sz = 0;
+       void * flowid_allocator;
+       flow_ring_table_t *flow_ring_table = NULL;
+       if_flow_lkup_t *if_flow_lkup = NULL;
+       void *lock = NULL;
+       void *list_lock = NULL;
+       unsigned long flags;
+
+       DHD_INFO(("%s\n", __FUNCTION__));
+
+       /* Construct a 16bit flowid allocator */
+       flowid_allocator = id16_map_init(dhdp->osh,
+                              num_flow_rings - FLOW_RING_COMMON, FLOWID_RESERVED);
+       if (flowid_allocator == NULL) {
+               DHD_ERROR(("%s: flowid allocator init failure\n", __FUNCTION__));
+               return BCME_NOMEM;
+       }
+
+       /* Allocate a flow ring table, comprising of requested number of rings */
+       flow_ring_table_sz = (num_flow_rings * sizeof(flow_ring_node_t));
+       flow_ring_table = (flow_ring_table_t *)MALLOCZ(dhdp->osh, flow_ring_table_sz);
+       if (flow_ring_table == NULL) {
+               DHD_ERROR(("%s: flow ring table alloc failure\n", __FUNCTION__));
+               goto fail;
+       }
+
+       /* Initialize flow ring table state */
+       DHD_CUMM_CTR_INIT(&dhdp->cumm_ctr);
+       bzero((uchar *)flow_ring_table, flow_ring_table_sz);
+       for (idx = 0; idx < num_flow_rings; idx++) {
+               flow_ring_table[idx].status = FLOW_RING_STATUS_CLOSED;
+               flow_ring_table[idx].flowid = (uint16)idx;
+               flow_ring_table[idx].lock = dhd_os_spin_lock_init(dhdp->osh);
+               if (flow_ring_table[idx].lock == NULL) {
+                       DHD_ERROR(("%s: Failed to init spinlock for queue!\n", __FUNCTION__));
+                       goto fail;
+               }
+
+               dll_init(&flow_ring_table[idx].list);
+
+               /* Initialize the per flow ring backup queue */
+               dhd_flow_queue_init(dhdp, &flow_ring_table[idx].queue,
+                                   FLOW_RING_QUEUE_THRESHOLD);
+       }
+
+       /* Allocate per interface hash table (for fast lookup from interface to flow ring) */
+       if_flow_lkup_sz = sizeof(if_flow_lkup_t) * DHD_MAX_IFS;
+       if_flow_lkup = (if_flow_lkup_t *)DHD_OS_PREALLOC(dhdp,
+               DHD_PREALLOC_IF_FLOW_LKUP, if_flow_lkup_sz);
+       if (if_flow_lkup == NULL) {
+               DHD_ERROR(("%s: if flow lkup alloc failure\n", __FUNCTION__));
+               goto fail;
+       }
+
+       /* Initialize per interface hash table */
+       for (idx = 0; idx < DHD_MAX_IFS; idx++) {
+               int hash_ix;
+               if_flow_lkup[idx].status = 0;
+               if_flow_lkup[idx].role = 0;
+               for (hash_ix = 0; hash_ix < DHD_FLOWRING_HASH_SIZE; hash_ix++)
+                       if_flow_lkup[idx].fl_hash[hash_ix] = NULL;
+       }
+
+       lock = dhd_os_spin_lock_init(dhdp->osh);
+       if (lock == NULL)
+               goto fail;
+
+       list_lock = dhd_os_spin_lock_init(dhdp->osh);
+       if (list_lock == NULL)
+               goto lock_fail;
+
+       dhdp->flow_prio_map_type = DHD_FLOW_PRIO_AC_MAP;
+       bcopy(prio2ac, dhdp->flow_prio_map, sizeof(uint8) * NUMPRIO);
+#ifdef DHD_LOSSLESS_ROAMING
+       dhdp->dequeue_prec_map = ALLPRIO;
+#endif
+       /* Now populate into dhd pub */
+       DHD_FLOWID_LOCK(lock, flags);
+       dhdp->num_flow_rings = num_flow_rings;
+       dhdp->flowid_allocator = (void *)flowid_allocator;
+       dhdp->flow_ring_table = (void *)flow_ring_table;
+       dhdp->if_flow_lkup = (void *)if_flow_lkup;
+       dhdp->flowid_lock = lock;
+       dhdp->flow_rings_inited = TRUE;
+       dhdp->flowring_list_lock = list_lock;
+       DHD_FLOWID_UNLOCK(lock, flags);
+
+       DHD_INFO(("%s done\n", __FUNCTION__));
+       return BCME_OK;
+
+lock_fail:
+       /* deinit the spinlock */
+       dhd_os_spin_lock_deinit(dhdp->osh, lock);
+
+fail:
+       /* Destruct the per interface flow lkup table */
+       if (if_flow_lkup != NULL) {
+               DHD_OS_PREFREE(dhdp, if_flow_lkup, if_flow_lkup_sz);
+       }
+       if (flow_ring_table != NULL) {
+               for (idx = 0; idx < num_flow_rings; idx++) {
+                       if (flow_ring_table[idx].lock != NULL)
+                               dhd_os_spin_lock_deinit(dhdp->osh, flow_ring_table[idx].lock);
+               }
+               MFREE(dhdp->osh, flow_ring_table, flow_ring_table_sz);
+       }
+       id16_map_fini(dhdp->osh, flowid_allocator);
+
+       return BCME_NOMEM;
+}
+
+/** Deinit Flow Ring specific data structures */
+void dhd_flow_rings_deinit(dhd_pub_t *dhdp)
+{
+       uint16 idx;
+       uint32 flow_ring_table_sz;
+       uint32 if_flow_lkup_sz;
+       flow_ring_table_t *flow_ring_table;
+       unsigned long flags;
+       void *lock;
+
+       DHD_INFO(("dhd_flow_rings_deinit\n"));
+
+       if (!(dhdp->flow_rings_inited)) {
+               DHD_ERROR(("dhd_flow_rings not initialized!\n"));
+               return;
+       }
+
+       if (dhdp->flow_ring_table != NULL) {
+
+               ASSERT(dhdp->num_flow_rings > 0);
+
+               DHD_FLOWID_LOCK(dhdp->flowid_lock, flags);
+               flow_ring_table = (flow_ring_table_t *)dhdp->flow_ring_table;
+               dhdp->flow_ring_table = NULL;
+               DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+               for (idx = 0; idx < dhdp->num_flow_rings; idx++) {
+                       if (flow_ring_table[idx].active) {
+                               dhd_bus_clean_flow_ring(dhdp->bus, &flow_ring_table[idx]);
+                       }
+                       ASSERT(DHD_FLOW_QUEUE_EMPTY(&flow_ring_table[idx].queue));
+
+                       /* Deinit flow ring queue locks before destroying flow ring table */
+                       dhd_os_spin_lock_deinit(dhdp->osh, flow_ring_table[idx].lock);
+                       flow_ring_table[idx].lock = NULL;
+
+               }
+
+               /* Destruct the flow ring table */
+               flow_ring_table_sz = dhdp->num_flow_rings * sizeof(flow_ring_table_t);
+               MFREE(dhdp->osh, flow_ring_table, flow_ring_table_sz);
+       }
+
+       DHD_FLOWID_LOCK(dhdp->flowid_lock, flags);
+
+       /* Destruct the per interface flow lkup table */
+       if (dhdp->if_flow_lkup != NULL) {
+               if_flow_lkup_sz = sizeof(if_flow_lkup_t) * DHD_MAX_IFS;
+               bzero((uchar *)dhdp->if_flow_lkup, if_flow_lkup_sz);
+               DHD_OS_PREFREE(dhdp, dhdp->if_flow_lkup, if_flow_lkup_sz);
+               dhdp->if_flow_lkup = NULL;
+       }
+
+       /* Destruct the flowid allocator */
+       if (dhdp->flowid_allocator != NULL)
+               dhdp->flowid_allocator = id16_map_fini(dhdp->osh, dhdp->flowid_allocator);
+
+       dhdp->num_flow_rings = 0U;
+       bzero(dhdp->flow_prio_map, sizeof(uint8) * NUMPRIO);
+
+       lock = dhdp->flowid_lock;
+       dhdp->flowid_lock = NULL;
+
+       DHD_FLOWID_UNLOCK(lock, flags);
+       dhd_os_spin_lock_deinit(dhdp->osh, lock);
+
+       dhd_os_spin_lock_deinit(dhdp->osh, dhdp->flowring_list_lock);
+       dhdp->flowring_list_lock = NULL;
+
+       ASSERT(dhdp->if_flow_lkup == NULL);
+       ASSERT(dhdp->flowid_allocator == NULL);
+       ASSERT(dhdp->flow_ring_table == NULL);
+       dhdp->flow_rings_inited = FALSE;
+}
+
+/** Uses hash table to quickly map from ifindex to a flow ring 'role' (STA/AP) */
+uint8
+dhd_flow_rings_ifindex2role(dhd_pub_t *dhdp, uint8 ifindex)
+{
+       if_flow_lkup_t *if_flow_lkup = (if_flow_lkup_t *)dhdp->if_flow_lkup;
+       ASSERT(if_flow_lkup);
+       return if_flow_lkup[ifindex].role;
+}
+
+#ifdef WLTDLS
+bool is_tdls_destination(dhd_pub_t *dhdp, uint8 *da)
+{
+       tdls_peer_node_t *cur = dhdp->peer_tbl.node;
+       while (cur != NULL) {
+               if (!memcmp(da, cur->addr, ETHER_ADDR_LEN)) {
+                       return TRUE;
+               }
+               cur = cur->next;
+       }
+       return FALSE;
+}
+#endif /* WLTDLS */
+
+/** Uses hash table to quickly map from ifindex+prio+da to a flow ring id */
+static INLINE uint16
+dhd_flowid_find(dhd_pub_t *dhdp, uint8 ifindex, uint8 prio, char *sa, char *da)
+{
+       int hash;
+       bool ismcast = FALSE;
+       flow_hash_info_t *cur;
+       if_flow_lkup_t *if_flow_lkup;
+       unsigned long flags;
+
+       DHD_FLOWID_LOCK(dhdp->flowid_lock, flags);
+       if_flow_lkup = (if_flow_lkup_t *)dhdp->if_flow_lkup;
+
+       ASSERT(if_flow_lkup);
+
+       if (if_flow_lkup[ifindex].role == WLC_E_IF_ROLE_STA) {
+#ifdef WLTDLS
+               if (dhdp->peer_tbl.tdls_peer_count && !(ETHER_ISMULTI(da)) &&
+                       is_tdls_destination(dhdp, da)) {
+                       hash = DHD_FLOWRING_HASHINDEX(da, prio);
+                       cur = if_flow_lkup[ifindex].fl_hash[hash];
+                       while (cur != NULL) {
+                               if (!memcmp(cur->flow_info.da, da, ETHER_ADDR_LEN)) {
+                                       DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+                                       return cur->flowid;
+                               }
+                               cur = cur->next;
+                       }
+                       DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+                       return FLOWID_INVALID;
+               }
+#endif /* WLTDLS */
+               cur = if_flow_lkup[ifindex].fl_hash[prio];
+               if (cur) {
+                       DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+                       return cur->flowid;
+               }
+       } else {
+
+               if (ETHER_ISMULTI(da)) {
+                       ismcast = TRUE;
+                       hash = 0;
+               } else {
+                       hash = DHD_FLOWRING_HASHINDEX(da, prio);
+               }
+
+               cur = if_flow_lkup[ifindex].fl_hash[hash];
+
+               while (cur) {
+                       if ((ismcast && ETHER_ISMULTI(cur->flow_info.da)) ||
+                               (!memcmp(cur->flow_info.da, da, ETHER_ADDR_LEN) &&
+                               (cur->flow_info.tid == prio))) {
+                               DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+                               return cur->flowid;
+                       }
+                       cur = cur->next;
+               }
+       }
+       DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+
+       DHD_INFO(("%s: cannot find flowid\n", __FUNCTION__));
+       return FLOWID_INVALID;
+} /* dhd_flowid_find */
+
+/** Create unique Flow ID, called when a flow ring is created. */
+static INLINE uint16
+dhd_flowid_alloc(dhd_pub_t *dhdp, uint8 ifindex, uint8 prio, char *sa, char *da)
+{
+       flow_hash_info_t *fl_hash_node, *cur;
+       if_flow_lkup_t *if_flow_lkup;
+       int hash;
+       uint16 flowid;
+       unsigned long flags;
+
+       fl_hash_node = (flow_hash_info_t *) MALLOC(dhdp->osh, sizeof(flow_hash_info_t));
+       memcpy(fl_hash_node->flow_info.da, da, sizeof(fl_hash_node->flow_info.da));
+
+       DHD_FLOWID_LOCK(dhdp->flowid_lock, flags);
+       ASSERT(dhdp->flowid_allocator != NULL);
+       flowid = id16_map_alloc(dhdp->flowid_allocator);
+       DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+
+       if (flowid == FLOWID_INVALID) {
+               MFREE(dhdp->osh, fl_hash_node,  sizeof(flow_hash_info_t));
+               DHD_ERROR(("%s: cannot get free flowid \n", __FUNCTION__));
+               return FLOWID_INVALID;
+       }
+
+       fl_hash_node->flowid = flowid;
+       fl_hash_node->flow_info.tid = prio;
+       fl_hash_node->flow_info.ifindex = ifindex;
+       fl_hash_node->next = NULL;
+
+       DHD_FLOWID_LOCK(dhdp->flowid_lock, flags);
+       if_flow_lkup = (if_flow_lkup_t *)dhdp->if_flow_lkup;
+
+       if (if_flow_lkup[ifindex].role == WLC_E_IF_ROLE_STA) {
+               /* For STA non TDLS dest we allocate entry based on prio only */
+#ifdef WLTDLS
+               if (dhdp->peer_tbl.tdls_peer_count &&
+                       (is_tdls_destination(dhdp, da))) {
+                       hash = DHD_FLOWRING_HASHINDEX(da, prio);
+                       cur = if_flow_lkup[ifindex].fl_hash[hash];
+                       if (cur) {
+                               while (cur->next) {
+                                       cur = cur->next;
+                               }
+                               cur->next = fl_hash_node;
+                       } else {
+                               if_flow_lkup[ifindex].fl_hash[hash] = fl_hash_node;
+                       }
+               } else
+#endif /* WLTDLS */
+                       if_flow_lkup[ifindex].fl_hash[prio] = fl_hash_node;
+       } else {
+
+               /* For bcast/mcast assign first slot in in interface */
+               hash = ETHER_ISMULTI(da) ? 0 : DHD_FLOWRING_HASHINDEX(da, prio);
+               cur = if_flow_lkup[ifindex].fl_hash[hash];
+               if (cur) {
+                       while (cur->next) {
+                               cur = cur->next;
+                       }
+                       cur->next = fl_hash_node;
+               } else
+                       if_flow_lkup[ifindex].fl_hash[hash] = fl_hash_node;
+       }
+       DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+
+       DHD_INFO(("%s: allocated flowid %d\n", __FUNCTION__, fl_hash_node->flowid));
+
+       return fl_hash_node->flowid;
+} /* dhd_flowid_alloc */
+
+/** Get flow ring ID, if not present try to create one */
+static INLINE int
+dhd_flowid_lookup(dhd_pub_t *dhdp, uint8 ifindex,
+                  uint8 prio, char *sa, char *da, uint16 *flowid)
+{
+       uint16 id;
+       flow_ring_node_t *flow_ring_node;
+       flow_ring_table_t *flow_ring_table;
+       unsigned long flags;
+       int ret;
+
+       DHD_INFO(("%s\n", __FUNCTION__));
+
+       if (!dhdp->flow_ring_table) {
+               return BCME_ERROR;
+       }
+
+       flow_ring_table = (flow_ring_table_t *)dhdp->flow_ring_table;
+
+       id = dhd_flowid_find(dhdp, ifindex, prio, sa, da);
+
+       if (id == FLOWID_INVALID) {
+
+               if_flow_lkup_t *if_flow_lkup;
+               if_flow_lkup = (if_flow_lkup_t *)dhdp->if_flow_lkup;
+
+               if (!if_flow_lkup[ifindex].status)
+                       return BCME_ERROR;
+
+
+               id = dhd_flowid_alloc(dhdp, ifindex, prio, sa, da);
+               if (id == FLOWID_INVALID) {
+                       DHD_ERROR(("%s: alloc flowid ifindex %u status %u\n",
+                                  __FUNCTION__, ifindex, if_flow_lkup[ifindex].status));
+                       return BCME_ERROR;
+               }
+
+               /* register this flowid in dhd_pub */
+               dhd_add_flowid(dhdp, ifindex, prio, da, id);
+
+               ASSERT(id < dhdp->num_flow_rings);
+
+               flow_ring_node = (flow_ring_node_t *) &flow_ring_table[id];
+
+               DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+
+               /* Init Flow info */
+               memcpy(flow_ring_node->flow_info.sa, sa, sizeof(flow_ring_node->flow_info.sa));
+               memcpy(flow_ring_node->flow_info.da, da, sizeof(flow_ring_node->flow_info.da));
+               flow_ring_node->flow_info.tid = prio;
+               flow_ring_node->flow_info.ifindex = ifindex;
+               flow_ring_node->active = TRUE;
+               flow_ring_node->status = FLOW_RING_STATUS_PENDING;
+               DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+
+               /* Create and inform device about the new flow */
+               if (dhd_bus_flow_ring_create_request(dhdp->bus, (void *)flow_ring_node)
+                               != BCME_OK) {
+                       DHD_ERROR(("%s: create error %d\n", __FUNCTION__, id));
+                       return BCME_ERROR;
+               }
+
+               *flowid = id;
+               return BCME_OK;
+       } else {
+               /* if the Flow id was found in the hash */
+               ASSERT(id < dhdp->num_flow_rings);
+
+               flow_ring_node = (flow_ring_node_t *) &flow_ring_table[id];
+               DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+
+               /*
+                * If the flow_ring_node is in Open State or Status pending state then
+                * we can return the Flow id to the caller.If the flow_ring_node is in
+                * FLOW_RING_STATUS_PENDING this means the creation is in progress and
+                * hence the packets should be queued.
+                *
+                * If the flow_ring_node is in FLOW_RING_STATUS_DELETE_PENDING Or
+                * FLOW_RING_STATUS_CLOSED, then we should return Error.
+                * Note that if the flowing is being deleted we would mark it as
+                * FLOW_RING_STATUS_DELETE_PENDING.  Now before Dongle could respond and
+                * before we mark it as FLOW_RING_STATUS_CLOSED we could get tx packets.
+                * We should drop the packets in that case.
+                * The decission to return OK should NOT be based on 'active' variable, beause
+                * active is made TRUE when a flow_ring_node gets allocated and is made
+                * FALSE when the flow ring gets removed and does not reflect the True state
+                * of the Flow ring.
+                */
+               if (flow_ring_node->status == FLOW_RING_STATUS_OPEN ||
+                       flow_ring_node->status == FLOW_RING_STATUS_PENDING) {
+                       *flowid = id;
+                       ret = BCME_OK;
+               } else {
+                       *flowid = FLOWID_INVALID;
+                       ret = BCME_ERROR;
+               }
+
+               DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+               return ret;
+
+       } /* Flow Id found in the hash */
+} /* dhd_flowid_lookup */
+
+/**
+ * Assign existing or newly created flowid to an 802.3 packet. This flowid is later on used to
+ * select the flowring to send the packet to the dongle.
+ */
+int BCMFASTPATH
+dhd_flowid_update(dhd_pub_t *dhdp, uint8 ifindex, uint8 prio, void *pktbuf)
+{
+       uint8 *pktdata = (uint8 *)PKTDATA(dhdp->osh, pktbuf);
+       struct ether_header *eh = (struct ether_header *)pktdata;
+       uint16 flowid;
+
+       ASSERT(ifindex < DHD_MAX_IFS);
+
+       if (ifindex >= DHD_MAX_IFS) {
+               return BCME_BADARG;
+       }
+
+       if (!dhdp->flowid_allocator) {
+               DHD_ERROR(("%s: Flow ring not intited yet  \n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       if (dhd_flowid_lookup(dhdp, ifindex, prio, eh->ether_shost, eh->ether_dhost,
+               &flowid) != BCME_OK) {
+               return BCME_ERROR;
+       }
+
+       DHD_INFO(("%s: prio %d flowid %d\n", __FUNCTION__, prio, flowid));
+
+       /* Tag the packet with flowid */
+       DHD_PKT_SET_FLOWID(pktbuf, flowid);
+       return BCME_OK;
+}
+
+void
+dhd_flowid_free(dhd_pub_t *dhdp, uint8 ifindex, uint16 flowid)
+{
+       int hashix;
+       bool found = FALSE;
+       flow_hash_info_t *cur, *prev;
+       if_flow_lkup_t *if_flow_lkup;
+       unsigned long flags;
+
+       DHD_FLOWID_LOCK(dhdp->flowid_lock, flags);
+       if_flow_lkup = (if_flow_lkup_t *)dhdp->if_flow_lkup;
+
+       for (hashix = 0; hashix < DHD_FLOWRING_HASH_SIZE; hashix++) {
+
+               cur = if_flow_lkup[ifindex].fl_hash[hashix];
+
+               if (cur) {
+                       if (cur->flowid == flowid) {
+                               found = TRUE;
+                       }
+
+                       prev = NULL;
+                       while (!found && cur) {
+                               if (cur->flowid == flowid) {
+                                       found = TRUE;
+                                       break;
+                               }
+                               prev = cur;
+                               cur = cur->next;
+                       }
+                       if (found) {
+                               if (!prev) {
+                                       if_flow_lkup[ifindex].fl_hash[hashix] = cur->next;
+                               } else {
+                                       prev->next = cur->next;
+                               }
+
+                               /* deregister flowid from dhd_pub. */
+                               dhd_del_flowid(dhdp, ifindex, flowid);
+
+                               id16_map_free(dhdp->flowid_allocator, flowid);
+                               DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+                               MFREE(dhdp->osh, cur, sizeof(flow_hash_info_t));
+
+                               return;
+                       }
+               }
+       }
+
+       DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+       DHD_ERROR(("%s: could not free flow ring hash entry flowid %d\n",
+                  __FUNCTION__, flowid));
+} /* dhd_flowid_free */
+
+/**
+ * Delete all Flow rings associated with the given interface. Is called when e.g. the dongle
+ * indicates that a wireless link has gone down.
+ */
+void
+dhd_flow_rings_delete(dhd_pub_t *dhdp, uint8 ifindex)
+{
+       uint32 id;
+       flow_ring_table_t *flow_ring_table;
+
+       DHD_INFO(("%s: ifindex %u\n", __FUNCTION__, ifindex));
+
+       ASSERT(ifindex < DHD_MAX_IFS);
+       if (ifindex >= DHD_MAX_IFS)
+               return;
+
+       if (!dhdp->flow_ring_table)
+               return;
+
+       flow_ring_table = (flow_ring_table_t *)dhdp->flow_ring_table;
+       for (id = 0; id < dhdp->num_flow_rings; id++) {
+               if (flow_ring_table[id].active &&
+                   (flow_ring_table[id].flow_info.ifindex == ifindex)) {
+                       dhd_bus_flow_ring_delete_request(dhdp->bus,
+                                                        (void *) &flow_ring_table[id]);
+               }
+       }
+}
+
+/** Delete flow ring(s) for given peer address. Related to AP/AWDL/TDLS functionality. */
+void
+dhd_flow_rings_delete_for_peer(dhd_pub_t *dhdp, uint8 ifindex, char *addr)
+{
+       uint32 id;
+       flow_ring_table_t *flow_ring_table;
+
+       DHD_ERROR(("%s: ifindex %u\n", __FUNCTION__, ifindex));
+
+       ASSERT(ifindex < DHD_MAX_IFS);
+       if (ifindex >= DHD_MAX_IFS)
+               return;
+
+       if (!dhdp->flow_ring_table)
+               return;
+
+       flow_ring_table = (flow_ring_table_t *)dhdp->flow_ring_table;
+       for (id = 0; id < dhdp->num_flow_rings; id++) {
+               if (flow_ring_table[id].active &&
+                       (flow_ring_table[id].flow_info.ifindex == ifindex) &&
+                       (!memcmp(flow_ring_table[id].flow_info.da, addr, ETHER_ADDR_LEN)) &&
+                       (flow_ring_table[id].status != FLOW_RING_STATUS_DELETE_PENDING)) {
+                       DHD_INFO(("%s: deleting flowid %d\n",
+                               __FUNCTION__, flow_ring_table[id].flowid));
+                       dhd_bus_flow_ring_delete_request(dhdp->bus,
+                               (void *) &flow_ring_table[id]);
+               }
+       }
+}
+
+/** Handles interface ADD, CHANGE, DEL indications from the dongle */
+void
+dhd_update_interface_flow_info(dhd_pub_t *dhdp, uint8 ifindex,
+                               uint8 op, uint8 role)
+{
+       if_flow_lkup_t *if_flow_lkup;
+       unsigned long flags;
+
+       ASSERT(ifindex < DHD_MAX_IFS);
+       if (ifindex >= DHD_MAX_IFS)
+               return;
+
+       DHD_INFO(("%s: ifindex %u op %u role is %u \n",
+                 __FUNCTION__, ifindex, op, role));
+       if (!dhdp->flowid_allocator) {
+               DHD_ERROR(("%s: Flow ring not intited yet  \n", __FUNCTION__));
+               return;
+       }
+
+       DHD_FLOWID_LOCK(dhdp->flowid_lock, flags);
+       if_flow_lkup = (if_flow_lkup_t *)dhdp->if_flow_lkup;
+
+       if (op == WLC_E_IF_ADD || op == WLC_E_IF_CHANGE) {
+
+               if_flow_lkup[ifindex].role = role;
+
+               if (role != WLC_E_IF_ROLE_STA) {
+                       if_flow_lkup[ifindex].status = TRUE;
+                       DHD_INFO(("%s: Mcast Flow ring for ifindex %d role is %d \n",
+                                 __FUNCTION__, ifindex, role));
+                       /* Create Mcast Flow */
+               }
+       } else  if (op == WLC_E_IF_DEL) {
+               if_flow_lkup[ifindex].status = FALSE;
+               DHD_INFO(("%s: cleanup all Flow rings for ifindex %d role is %d \n",
+                         __FUNCTION__, ifindex, role));
+       }
+       DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+}
+
+/** Handles a STA 'link' indication from the dongle */
+int
+dhd_update_interface_link_status(dhd_pub_t *dhdp, uint8 ifindex, uint8 status)
+{
+       if_flow_lkup_t *if_flow_lkup;
+       unsigned long flags;
+
+       ASSERT(ifindex < DHD_MAX_IFS);
+       if (ifindex >= DHD_MAX_IFS)
+               return BCME_BADARG;
+
+       DHD_INFO(("%s: ifindex %d status %d\n", __FUNCTION__, ifindex, status));
+
+       DHD_FLOWID_LOCK(dhdp->flowid_lock, flags);
+       if_flow_lkup = (if_flow_lkup_t *)dhdp->if_flow_lkup;
+
+       if (if_flow_lkup[ifindex].role == WLC_E_IF_ROLE_STA) {
+               if (status)
+                       if_flow_lkup[ifindex].status = TRUE;
+               else
+                       if_flow_lkup[ifindex].status = FALSE;
+       }
+       DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+
+       return BCME_OK;
+}
+
+/** Update flow priority mapping, called on IOVAR */
+int dhd_update_flow_prio_map(dhd_pub_t *dhdp, uint8 map)
+{
+       uint16 flowid;
+       flow_ring_node_t *flow_ring_node;
+
+       if (map > DHD_FLOW_PRIO_LLR_MAP)
+               return BCME_BADOPTION;
+
+       /* Check if we need to change prio map */
+       if (map == dhdp->flow_prio_map_type)
+               return BCME_OK;
+
+       /* If any ring is active we cannot change priority mapping for flow rings */
+       for (flowid = 0; flowid < dhdp->num_flow_rings; flowid++) {
+               flow_ring_node = DHD_FLOW_RING(dhdp, flowid);
+               if (flow_ring_node->active)
+                       return BCME_EPERM;
+       }
+
+       /* Inform firmware about new mapping type */
+       if (BCME_OK != dhd_flow_prio_map(dhdp, &map, TRUE))
+               return BCME_ERROR;
+
+       /* update internal structures */
+       dhdp->flow_prio_map_type = map;
+       if (dhdp->flow_prio_map_type == DHD_FLOW_PRIO_TID_MAP)
+               bcopy(prio2tid, dhdp->flow_prio_map, sizeof(uint8) * NUMPRIO);
+       else
+               bcopy(prio2ac, dhdp->flow_prio_map, sizeof(uint8) * NUMPRIO);
+
+       return BCME_OK;
+}
+
+/** Inform firmware on updated flow priority mapping, called on IOVAR */
+int dhd_flow_prio_map(dhd_pub_t *dhd, uint8 *map, bool set)
+{
+       uint8 iovbuf[24];
+       if (!set) {
+               bcm_mkiovar("bus:fl_prio_map", NULL, 0, (char*)iovbuf, sizeof(iovbuf));
+               if (dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, iovbuf, sizeof(iovbuf), FALSE, 0) < 0) {
+                       DHD_ERROR(("%s: failed to get fl_prio_map\n", __FUNCTION__));
+                       return BCME_ERROR;
+               }
+               *map = iovbuf[0];
+               return BCME_OK;
+       }
+       bcm_mkiovar("bus:fl_prio_map", (char *)map, 4, (char*)iovbuf, sizeof(iovbuf));
+       if (dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0) < 0) {
+               DHD_ERROR(("%s: failed to set fl_prio_map \n",
+                       __FUNCTION__));
+               return BCME_ERROR;
+       }
+       return BCME_OK;
+}
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_flowring.h b/drivers/net/wireless/bcmdhd_1363/dhd_flowring.h
new file mode 100644 (file)
index 0000000..5639528
--- /dev/null
@@ -0,0 +1,235 @@
+/*
+ * @file Header file describing the flow rings DHD interfaces.
+ *
+ * Flow rings are transmit traffic (=propagating towards antenna) related entities.
+ *
+ * Provides type definitions and function prototypes used to create, delete and manage flow rings at
+ * high level.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_flowring.h 591285 2015-10-07 11:56:29Z $
+ */
+
+
+/****************
+ * Common types *
+ */
+
+#ifndef _dhd_flowrings_h_
+#define _dhd_flowrings_h_
+
+/* Max pkts held in a flow ring's backup queue */
+#define FLOW_RING_QUEUE_THRESHOLD       (2048)
+
+/* Number of H2D common rings */
+#define FLOW_RING_COMMON                BCMPCIE_H2D_COMMON_MSGRINGS
+
+#define FLOWID_INVALID                  (ID16_INVALID)
+#define FLOWID_RESERVED                 (FLOW_RING_COMMON)
+
+#define FLOW_RING_STATUS_OPEN           0
+#define FLOW_RING_STATUS_PENDING        1
+#define FLOW_RING_STATUS_CLOSED         2
+#define FLOW_RING_STATUS_DELETE_PENDING 3
+#define FLOW_RING_STATUS_FLUSH_PENDING  4
+#define FLOW_RING_STATUS_STA_FREEING    5
+
+#define DHD_FLOWRING_RX_BUFPOST_PKTSZ  2048
+
+#define DHD_FLOW_PRIO_AC_MAP           0
+#define DHD_FLOW_PRIO_TID_MAP          1
+#define DHD_FLOW_PRIO_LLR_MAP          2
+
+/* Pkttag not compatible with PROP_TXSTATUS or WLFC */
+typedef struct dhd_pkttag_fr {
+       uint16  flowid;
+       uint16  ifid;
+       int     dataoff;
+       dmaaddr_t physaddr;
+       uint32 pa_len;
+
+} dhd_pkttag_fr_t;
+
+#define DHD_PKTTAG_SET_FLOWID(tag, flow)    ((tag)->flowid = (uint16)(flow))
+#define DHD_PKTTAG_SET_IFID(tag, idx)       ((tag)->ifid = (uint16)(idx))
+#define DHD_PKTTAG_SET_DATAOFF(tag, offset) ((tag)->dataoff = (int)(offset))
+#define DHD_PKTTAG_SET_PA(tag, pa)          ((tag)->physaddr = (pa))
+#define DHD_PKTTAG_SET_PA_LEN(tag, palen)   ((tag)->pa_len = (palen))
+
+#define DHD_PKTTAG_FLOWID(tag)              ((tag)->flowid)
+#define DHD_PKTTAG_IFID(tag)                ((tag)->ifid)
+#define DHD_PKTTAG_DATAOFF(tag)             ((tag)->dataoff)
+#define DHD_PKTTAG_PA(tag)                  ((tag)->physaddr)
+#define DHD_PKTTAG_PA_LEN(tag)              ((tag)->pa_len)
+
+/* Hashing a MacAddress for lkup into a per interface flow hash table */
+#define DHD_FLOWRING_HASH_SIZE    256
+#define        DHD_FLOWRING_HASHINDEX(ea, prio) \
+              ((((uint8 *)(ea))[3] ^ ((uint8 *)(ea))[4] ^ ((uint8 *)(ea))[5] ^ ((uint8)(prio))) \
+               % DHD_FLOWRING_HASH_SIZE)
+
+#define DHD_IF_ROLE(pub, idx)          (((if_flow_lkup_t *)(pub)->if_flow_lkup)[idx].role)
+#define DHD_IF_ROLE_AP(pub, idx)       (DHD_IF_ROLE(pub, idx) == WLC_E_IF_ROLE_AP)
+#define DHD_IF_ROLE_STA(pub, idx)      (DHD_IF_ROLE(pub, idx) == WLC_E_IF_ROLE_STA)
+#define DHD_IF_ROLE_P2PGO(pub, idx)    (DHD_IF_ROLE(pub, idx) == WLC_E_IF_ROLE_P2P_GO)
+#define DHD_FLOW_RING(dhdp, flowid) \
+       (flow_ring_node_t *)&(((flow_ring_node_t *)((dhdp)->flow_ring_table))[flowid])
+
+struct flow_queue;
+
+/* Flow Ring Queue Enqueue overflow callback */
+typedef int (*flow_queue_cb_t)(struct flow_queue * queue, void * pkt);
+
+/**
+ * Each flow ring has an associated (tx flow controlled) queue. 802.3 packets are transferred
+ * between queue and ring. A packet from the host stack is first added to the queue, and in a later
+ * stage transferred to the flow ring. Packets in the queue are dhd owned, whereas packets in the
+ * flow ring are device owned.
+ */
+typedef struct flow_queue {
+       dll_t  list;                /* manage a flowring queue in a double linked list */
+       void * head;                /* first packet in the queue */
+       void * tail;                /* last packet in the queue */
+       uint16 len;                 /* number of packets in the queue */
+       uint16 max;                 /* maximum or min budget (used in cumm) */
+       uint32 threshold;           /* parent's cummulative length threshold */
+       void * clen_ptr;            /* parent's cummulative length counter */
+       uint32 failures;            /* enqueue failures due to queue overflow */
+       flow_queue_cb_t cb;         /* callback invoked on threshold crossing */
+} flow_queue_t;
+
+#define DHD_FLOW_QUEUE_LEN(queue)       ((int)(queue)->len)
+#define DHD_FLOW_QUEUE_MAX(queue)       ((int)(queue)->max)
+#define DHD_FLOW_QUEUE_THRESHOLD(queue) ((int)(queue)->threshold)
+#define DHD_FLOW_QUEUE_EMPTY(queue)     ((queue)->len == 0)
+#define DHD_FLOW_QUEUE_FAILURES(queue)  ((queue)->failures)
+
+#define DHD_FLOW_QUEUE_AVAIL(queue)     ((int)((queue)->max - (queue)->len))
+#define DHD_FLOW_QUEUE_FULL(queue)      ((queue)->len >= (queue)->max)
+
+#define DHD_FLOW_QUEUE_OVFL(queue, budget)  \
+       (((queue)->len) > budget)
+
+#define DHD_FLOW_QUEUE_SET_MAX(queue, budget) \
+       ((queue)->max) = ((budget) - 1)
+
+/* Queue's cummulative threshold. */
+#define DHD_FLOW_QUEUE_SET_THRESHOLD(queue, cumm_threshold) \
+       ((queue)->threshold) = ((cumm_threshold) - 1)
+
+/* Queue's cummulative length object accessor. */
+#define DHD_FLOW_QUEUE_CLEN_PTR(queue)  ((queue)->clen_ptr)
+
+/* Set a queue's cumm_len point to a parent's cumm_ctr_t cummulative length */
+#define DHD_FLOW_QUEUE_SET_CLEN(queue, parent_clen_ptr)  \
+       ((queue)->clen_ptr) = (void *)(parent_clen_ptr)
+
+/*  see wlfc_proto.h for tx status details */
+#define DHD_FLOWRING_MAXSTATUS_MSGS    5
+#define DHD_FLOWRING_TXSTATUS_CNT_UPDATE(bus, flowid, txstatus)
+/** each flow ring is dedicated to a tid/sa/da combination */
+typedef struct flow_info {
+       uint8           tid;
+       uint8           ifindex;
+       char            sa[ETHER_ADDR_LEN];
+       char            da[ETHER_ADDR_LEN];
+} flow_info_t;
+
+/** a flow ring is used for outbound (towards antenna) 802.3 packets */
+typedef struct flow_ring_node {
+       dll_t           list;  /* manage a constructed flowring in a dll, must be at first place */
+       flow_queue_t    queue; /* queues packets before they enter the flow ring, flow control */
+       bool            active;
+       uint8           status;
+       /*
+        * flowid: unique ID of a flow ring, which can either be unicast or broadcast/multicast. For
+        * unicast flow rings, the flow id accelerates ARM 802.3->802.11 header translation.
+        */
+       uint16          flowid;
+       flow_info_t     flow_info;
+       void            *prot_info;
+       void            *lock; /* lock for flowring access protection */
+} flow_ring_node_t;
+
+typedef flow_ring_node_t flow_ring_table_t;
+
+typedef struct flow_hash_info {
+       uint16                  flowid;
+       flow_info_t             flow_info;
+       struct flow_hash_info   *next;
+} flow_hash_info_t;
+
+typedef struct if_flow_lkup {
+       bool            status;
+       uint8           role; /* Interface role: STA/AP */
+       flow_hash_info_t *fl_hash[DHD_FLOWRING_HASH_SIZE]; /* Lkup Hash table */
+} if_flow_lkup_t;
+
+static INLINE flow_ring_node_t *
+dhd_constlist_to_flowring(dll_t *item)
+{
+       return ((flow_ring_node_t *)item);
+}
+
+/* Exported API */
+
+/* Flow ring's queue management functions */
+extern flow_ring_node_t * dhd_flow_ring_node(dhd_pub_t *dhdp, uint16 flowid);
+extern flow_queue_t * dhd_flow_queue(dhd_pub_t *dhdp, uint16 flowid);
+
+extern void dhd_flow_queue_init(dhd_pub_t *dhdp, flow_queue_t *queue, int max);
+extern void dhd_flow_queue_register(flow_queue_t *queue, flow_queue_cb_t cb);
+extern int  dhd_flow_queue_enqueue(dhd_pub_t *dhdp, flow_queue_t *queue, void *pkt);
+extern void * dhd_flow_queue_dequeue(dhd_pub_t *dhdp, flow_queue_t *queue);
+extern void dhd_flow_queue_reinsert(dhd_pub_t *dhdp, flow_queue_t *queue, void *pkt);
+
+extern void dhd_flow_ring_config_thresholds(dhd_pub_t *dhdp, uint16 flowid,
+                          int queue_budget, int cumm_threshold, void *cumm_ctr);
+extern int  dhd_flow_rings_init(dhd_pub_t *dhdp, uint32 num_flow_rings);
+
+extern void dhd_flow_rings_deinit(dhd_pub_t *dhdp);
+
+extern int dhd_flowid_update(dhd_pub_t *dhdp, uint8 ifindex, uint8 prio,
+                void *pktbuf);
+
+extern void dhd_flowid_free(dhd_pub_t *dhdp, uint8 ifindex, uint16 flowid);
+
+extern void dhd_flow_rings_delete(dhd_pub_t *dhdp, uint8 ifindex);
+
+extern void dhd_flow_rings_delete_for_peer(dhd_pub_t *dhdp, uint8 ifindex,
+                char *addr);
+
+/* Handle Interface ADD, DEL operations */
+extern void dhd_update_interface_flow_info(dhd_pub_t *dhdp, uint8 ifindex,
+                uint8 op, uint8 role);
+
+/* Handle a STA interface link status update */
+extern int dhd_update_interface_link_status(dhd_pub_t *dhdp, uint8 ifindex,
+                uint8 status);
+extern int dhd_flow_prio_map(dhd_pub_t *dhd, uint8 *map, bool set);
+extern int dhd_update_flow_prio_map(dhd_pub_t *dhdp, uint8 map);
+
+extern uint8 dhd_flow_rings_ifindex2role(dhd_pub_t *dhdp, uint8 ifindex);
+#endif /* _dhd_flowrings_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_ip.c b/drivers/net/wireless/bcmdhd_1363/dhd_ip.c
new file mode 100644 (file)
index 0000000..14e4446
--- /dev/null
@@ -0,0 +1,1274 @@
+/*
+ * IP Packet Parser Module.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_ip.c 612549 2016-01-14 07:39:32Z $
+ */
+#include <typedefs.h>
+#include <osl.h>
+
+#include <proto/ethernet.h>
+#include <proto/vlan.h>
+#include <proto/802.3.h>
+#include <proto/bcmip.h>
+#include <bcmendian.h>
+
+#include <dhd_dbg.h>
+
+#include <dhd_ip.h>
+
+#ifdef DHDTCPACK_SUPPRESS
+#include <dhd_bus.h>
+#include <dhd_proto.h>
+#include <proto/bcmtcp.h>
+#endif /* DHDTCPACK_SUPPRESS */
+
+/* special values */
+/* 802.3 llc/snap header */
+static const uint8 llc_snap_hdr[SNAP_HDR_LEN] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00};
+
+pkt_frag_t pkt_frag_info(osl_t *osh, void *p)
+{
+       uint8 *frame;
+       int length;
+       uint8 *pt;                      /* Pointer to type field */
+       uint16 ethertype;
+       struct ipv4_hdr *iph;           /* IP frame pointer */
+       int ipl;                        /* IP frame length */
+       uint16 iph_frag;
+
+       ASSERT(osh && p);
+
+       frame = PKTDATA(osh, p);
+       length = PKTLEN(osh, p);
+
+       /* Process Ethernet II or SNAP-encapsulated 802.3 frames */
+       if (length < ETHER_HDR_LEN) {
+               DHD_INFO(("%s: short eth frame (%d)\n", __FUNCTION__, length));
+               return DHD_PKT_FRAG_NONE;
+       } else if (ntoh16(*(uint16 *)(frame + ETHER_TYPE_OFFSET)) >= ETHER_TYPE_MIN) {
+               /* Frame is Ethernet II */
+               pt = frame + ETHER_TYPE_OFFSET;
+       } else if (length >= ETHER_HDR_LEN + SNAP_HDR_LEN + ETHER_TYPE_LEN &&
+                  !bcmp(llc_snap_hdr, frame + ETHER_HDR_LEN, SNAP_HDR_LEN)) {
+               pt = frame + ETHER_HDR_LEN + SNAP_HDR_LEN;
+       } else {
+               DHD_INFO(("%s: non-SNAP 802.3 frame\n", __FUNCTION__));
+               return DHD_PKT_FRAG_NONE;
+       }
+
+       ethertype = ntoh16(*(uint16 *)pt);
+
+       /* Skip VLAN tag, if any */
+       if (ethertype == ETHER_TYPE_8021Q) {
+               pt += VLAN_TAG_LEN;
+
+               if (pt + ETHER_TYPE_LEN > frame + length) {
+                       DHD_INFO(("%s: short VLAN frame (%d)\n", __FUNCTION__, length));
+                       return DHD_PKT_FRAG_NONE;
+               }
+
+               ethertype = ntoh16(*(uint16 *)pt);
+       }
+
+       if (ethertype != ETHER_TYPE_IP) {
+               DHD_INFO(("%s: non-IP frame (ethertype 0x%x, length %d)\n",
+                       __FUNCTION__, ethertype, length));
+               return DHD_PKT_FRAG_NONE;
+       }
+
+       iph = (struct ipv4_hdr *)(pt + ETHER_TYPE_LEN);
+       ipl = (uint)(length - (pt + ETHER_TYPE_LEN - frame));
+
+       /* We support IPv4 only */
+       if ((ipl < IPV4_OPTIONS_OFFSET) || (IP_VER(iph) != IP_VER_4)) {
+               DHD_INFO(("%s: short frame (%d) or non-IPv4\n", __FUNCTION__, ipl));
+               return DHD_PKT_FRAG_NONE;
+       }
+
+       iph_frag = ntoh16(iph->frag);
+
+       if (iph_frag & IPV4_FRAG_DONT) {
+               return DHD_PKT_FRAG_NONE;
+       } else if ((iph_frag & IPV4_FRAG_MORE) == 0) {
+               return DHD_PKT_FRAG_LAST;
+       } else {
+               return (iph_frag & IPV4_FRAG_OFFSET_MASK)? DHD_PKT_FRAG_CONT : DHD_PKT_FRAG_FIRST;
+       }
+}
+
+#ifdef DHDTCPACK_SUPPRESS
+
+typedef struct {
+       void *pkt_in_q;         /* TCP ACK packet that is already in txq or DelayQ */
+       void *pkt_ether_hdr;    /* Ethernet header pointer of pkt_in_q */
+       int ifidx;
+       uint8 supp_cnt;
+       dhd_pub_t *dhdp;
+       struct timer_list timer;
+} tcpack_info_t;
+
+typedef struct _tdata_psh_info_t {
+       uint32 end_seq;                 /* end seq# of a received TCP PSH DATA pkt */
+       struct _tdata_psh_info_t *next; /* next pointer of the link chain */
+} tdata_psh_info_t;
+
+typedef struct {
+       struct {
+               uint8 src[IPV4_ADDR_LEN];       /* SRC ip addrs of this TCP stream */
+               uint8 dst[IPV4_ADDR_LEN];       /* DST ip addrs of this TCP stream */
+       } ip_addr;
+       struct {
+               uint8 src[TCP_PORT_LEN];        /* SRC tcp ports of this TCP stream */
+               uint8 dst[TCP_PORT_LEN];        /* DST tcp ports of this TCP stream */
+       } tcp_port;
+       tdata_psh_info_t *tdata_psh_info_head;  /* Head of received TCP PSH DATA chain */
+       tdata_psh_info_t *tdata_psh_info_tail;  /* Tail of received TCP PSH DATA chain */
+       uint32 last_used_time;  /* The last time this tcpdata_info was used(in ms) */
+} tcpdata_info_t;
+
+/* TCPACK SUPPRESS module */
+typedef struct {
+       int tcpack_info_cnt;
+       tcpack_info_t tcpack_info_tbl[TCPACK_INFO_MAXNUM];      /* Info of TCP ACK to send */
+       int tcpdata_info_cnt;
+       tcpdata_info_t tcpdata_info_tbl[TCPDATA_INFO_MAXNUM];   /* Info of received TCP DATA */
+       tdata_psh_info_t *tdata_psh_info_pool;  /* Pointer to tdata_psh_info elements pool */
+       tdata_psh_info_t *tdata_psh_info_free;  /* free tdata_psh_info elements chain in pool */
+#ifdef DHDTCPACK_SUP_DBG
+       int psh_info_enq_num;   /* Number of free TCP PSH DATA info elements in pool */
+#endif /* DHDTCPACK_SUP_DBG */
+} tcpack_sup_module_t;
+
+#if defined(DEBUG_COUNTER) && defined(DHDTCPACK_SUP_DBG)
+counter_tbl_t tack_tbl = {"tcpACK", 0, 1000, 10, {0, }, 1};
+#endif /* DEBUG_COUNTER && DHDTCPACK_SUP_DBG */
+
+static void
+_tdata_psh_info_pool_enq(tcpack_sup_module_t *tcpack_sup_mod,
+       tdata_psh_info_t *tdata_psh_info)
+{
+       if ((tcpack_sup_mod == NULL) || (tdata_psh_info == NULL)) {
+               DHD_ERROR(("%s %d: ERROR %p %p\n", __FUNCTION__, __LINE__,
+                       tcpack_sup_mod, tdata_psh_info));
+               return;
+       }
+
+       ASSERT(tdata_psh_info->next == NULL);
+       tdata_psh_info->next = tcpack_sup_mod->tdata_psh_info_free;
+       tcpack_sup_mod->tdata_psh_info_free = tdata_psh_info;
+#ifdef DHDTCPACK_SUP_DBG
+       tcpack_sup_mod->psh_info_enq_num++;
+#endif
+}
+
+static tdata_psh_info_t*
+_tdata_psh_info_pool_deq(tcpack_sup_module_t *tcpack_sup_mod)
+{
+       tdata_psh_info_t *tdata_psh_info = NULL;
+
+       if (tcpack_sup_mod == NULL) {
+               DHD_ERROR(("%s %d: ERROR %p\n", __FUNCTION__, __LINE__,
+                       tcpack_sup_mod));
+               return NULL;
+       }
+
+       tdata_psh_info = tcpack_sup_mod->tdata_psh_info_free;
+       if (tdata_psh_info == NULL)
+               DHD_ERROR(("%s %d: Out of tdata_disc_grp\n", __FUNCTION__, __LINE__));
+       else {
+               tcpack_sup_mod->tdata_psh_info_free = tdata_psh_info->next;
+               tdata_psh_info->next = NULL;
+#ifdef DHDTCPACK_SUP_DBG
+               tcpack_sup_mod->psh_info_enq_num--;
+#endif /* DHDTCPACK_SUP_DBG */
+       }
+
+       return tdata_psh_info;
+}
+
+#ifdef BCMSDIO
+static int _tdata_psh_info_pool_init(dhd_pub_t *dhdp,
+       tcpack_sup_module_t *tcpack_sup_mod)
+{
+       tdata_psh_info_t *tdata_psh_info_pool = NULL;
+       uint i;
+
+       DHD_TRACE(("%s %d: Enter\n", __FUNCTION__, __LINE__));
+
+       if (tcpack_sup_mod == NULL)
+               return BCME_ERROR;
+
+       ASSERT(tcpack_sup_mod->tdata_psh_info_pool == NULL);
+       ASSERT(tcpack_sup_mod->tdata_psh_info_free == NULL);
+
+       tdata_psh_info_pool =
+               MALLOC(dhdp->osh, sizeof(tdata_psh_info_t) * TCPDATA_PSH_INFO_MAXNUM);
+
+       if (tdata_psh_info_pool == NULL)
+               return BCME_NOMEM;
+       bzero(tdata_psh_info_pool, sizeof(tdata_psh_info_t) * TCPDATA_PSH_INFO_MAXNUM);
+#ifdef DHDTCPACK_SUP_DBG
+       tcpack_sup_mod->psh_info_enq_num = 0;
+#endif /* DHDTCPACK_SUP_DBG */
+
+       /* Enqueue newly allocated tcpdata psh info elements to the pool */
+       for (i = 0; i < TCPDATA_PSH_INFO_MAXNUM; i++)
+               _tdata_psh_info_pool_enq(tcpack_sup_mod, &tdata_psh_info_pool[i]);
+
+       ASSERT(tcpack_sup_mod->tdata_psh_info_free != NULL);
+       tcpack_sup_mod->tdata_psh_info_pool = tdata_psh_info_pool;
+
+       return BCME_OK;
+}
+
+static void _tdata_psh_info_pool_deinit(dhd_pub_t *dhdp,
+       tcpack_sup_module_t *tcpack_sup_mod)
+{
+       uint i;
+       tdata_psh_info_t *tdata_psh_info;
+
+       DHD_TRACE(("%s %d: Enter\n", __FUNCTION__, __LINE__));
+
+       if (tcpack_sup_mod == NULL) {
+               DHD_ERROR(("%s %d: ERROR tcpack_sup_mod NULL!\n",
+                       __FUNCTION__, __LINE__));
+               return;
+       }
+
+       for (i = 0; i < tcpack_sup_mod->tcpdata_info_cnt; i++) {
+               tcpdata_info_t *tcpdata_info = &tcpack_sup_mod->tcpdata_info_tbl[i];
+               /* Return tdata_psh_info elements allocated to each tcpdata_info to the pool */
+               while ((tdata_psh_info = tcpdata_info->tdata_psh_info_head)) {
+                       tcpdata_info->tdata_psh_info_head = tdata_psh_info->next;
+                       tdata_psh_info->next = NULL;
+                       _tdata_psh_info_pool_enq(tcpack_sup_mod, tdata_psh_info);
+               }
+               tcpdata_info->tdata_psh_info_tail = NULL;
+       }
+#ifdef DHDTCPACK_SUP_DBG
+       DHD_ERROR(("%s %d: PSH INFO ENQ %d\n",
+               __FUNCTION__, __LINE__, tcpack_sup_mod->psh_info_enq_num));
+#endif /* DHDTCPACK_SUP_DBG */
+
+       i = 0;
+       /* Be sure we recollected all tdata_psh_info elements */
+       while ((tdata_psh_info = tcpack_sup_mod->tdata_psh_info_free)) {
+               tcpack_sup_mod->tdata_psh_info_free = tdata_psh_info->next;
+               tdata_psh_info->next = NULL;
+               i++;
+       }
+       ASSERT(i == TCPDATA_PSH_INFO_MAXNUM);
+       MFREE(dhdp->osh, tcpack_sup_mod->tdata_psh_info_pool,
+               sizeof(tdata_psh_info_t) * TCPDATA_PSH_INFO_MAXNUM);
+       tcpack_sup_mod->tdata_psh_info_pool = NULL;
+
+       return;
+}
+#endif /* BCMSDIO */
+
+static void dhd_tcpack_send(ulong data)
+{
+       tcpack_sup_module_t *tcpack_sup_mod;
+       tcpack_info_t *cur_tbl = (tcpack_info_t *)data;
+       dhd_pub_t *dhdp;
+       int ifidx;
+       void* pkt;
+       unsigned long flags;
+
+       if (!cur_tbl) {
+               return;
+       }
+
+       dhdp = cur_tbl->dhdp;
+       if (!dhdp) {
+               return;
+       }
+
+       flags = dhd_os_tcpacklock(dhdp);
+
+       tcpack_sup_mod = dhdp->tcpack_sup_module;
+       if (!tcpack_sup_mod) {
+               DHD_ERROR(("%s %d: tcpack suppress module NULL!!\n",
+                       __FUNCTION__, __LINE__));
+               dhd_os_tcpackunlock(dhdp, flags);
+               return;
+       }
+       pkt = cur_tbl->pkt_in_q;
+       ifidx = cur_tbl->ifidx;
+       if (!pkt) {
+               dhd_os_tcpackunlock(dhdp, flags);
+               return;
+       }
+       cur_tbl->pkt_in_q = NULL;
+       cur_tbl->pkt_ether_hdr = NULL;
+       cur_tbl->ifidx = 0;
+       cur_tbl->supp_cnt = 0;
+       if (--tcpack_sup_mod->tcpack_info_cnt < 0) {
+               DHD_ERROR(("%s %d: ERROR!!! tcp_ack_info_cnt %d\n",
+                       __FUNCTION__, __LINE__, tcpack_sup_mod->tcpack_info_cnt));
+       }
+
+       dhd_os_tcpackunlock(dhdp, flags);
+
+       dhd_sendpkt(dhdp, ifidx, pkt);
+}
+
+int dhd_tcpack_suppress_set(dhd_pub_t *dhdp, uint8 mode)
+{
+       int ret = BCME_OK;
+       unsigned long flags;
+
+       flags = dhd_os_tcpacklock(dhdp);
+
+       if (dhdp->tcpack_sup_mode == mode) {
+               DHD_ERROR(("%s %d: already set to %d\n", __FUNCTION__, __LINE__, mode));
+               goto exit;
+       }
+
+       if (mode >= TCPACK_SUP_LAST_MODE ||
+#ifndef BCMSDIO
+               mode == TCPACK_SUP_DELAYTX ||
+#endif /* !BCMSDIO */
+               FALSE) {
+               DHD_ERROR(("%s %d: Invalid mode %d\n", __FUNCTION__, __LINE__, mode));
+               ret = BCME_BADARG;
+               goto exit;
+       }
+
+       DHD_TRACE(("%s: %d -> %d\n",
+               __FUNCTION__, dhdp->tcpack_sup_mode, mode));
+
+#ifdef BCMSDIO
+       /* Old tcpack_sup_mode is TCPACK_SUP_DELAYTX */
+       if (dhdp->tcpack_sup_mode == TCPACK_SUP_DELAYTX) {
+               tcpack_sup_module_t *tcpack_sup_mod = dhdp->tcpack_sup_module;
+               /* We won't need tdata_psh_info pool and tcpddata_info_tbl anymore */
+               _tdata_psh_info_pool_deinit(dhdp, tcpack_sup_mod);
+               tcpack_sup_mod->tcpdata_info_cnt = 0;
+               bzero(tcpack_sup_mod->tcpdata_info_tbl,
+                       sizeof(tcpdata_info_t) * TCPDATA_INFO_MAXNUM);
+               /* For half duplex bus interface, tx precedes rx by default */
+               if (dhdp->bus)
+                       dhd_bus_set_dotxinrx(dhdp->bus, TRUE);
+       }
+#endif /* BCMSDIO */
+       dhdp->tcpack_sup_mode = mode;
+
+       if (mode == TCPACK_SUP_OFF) {
+               ASSERT(dhdp->tcpack_sup_module != NULL);
+               /* Clean up timer/data structure for any remaining/pending packet or timer. */
+               dhd_tcpack_info_tbl_clean(dhdp);
+               MFREE(dhdp->osh, dhdp->tcpack_sup_module, sizeof(tcpack_sup_module_t));
+               dhdp->tcpack_sup_module = NULL;
+               goto exit;
+       }
+
+       if (dhdp->tcpack_sup_module == NULL) {
+               tcpack_sup_module_t *tcpack_sup_mod =
+                       MALLOC(dhdp->osh, sizeof(tcpack_sup_module_t));
+               if (tcpack_sup_mod == NULL) {
+                       DHD_ERROR(("%s %d: No MEM\n", __FUNCTION__, __LINE__));
+                       dhdp->tcpack_sup_mode = TCPACK_SUP_OFF;
+                       ret = BCME_NOMEM;
+                       goto exit;
+               }
+               bzero(tcpack_sup_mod, sizeof(tcpack_sup_module_t));
+               dhdp->tcpack_sup_module = tcpack_sup_mod;
+       }
+
+#ifdef BCMSDIO
+       if (mode == TCPACK_SUP_DELAYTX) {
+               ret = _tdata_psh_info_pool_init(dhdp, dhdp->tcpack_sup_module);
+               if (ret != BCME_OK)
+                       DHD_ERROR(("%s %d: pool init fail with %d\n", __FUNCTION__, __LINE__, ret));
+               else if (dhdp->bus)
+                       dhd_bus_set_dotxinrx(dhdp->bus, FALSE);
+       }
+#endif /* BCMSDIO */
+
+       if (mode == TCPACK_SUP_HOLD) {
+               int i;
+               tcpack_sup_module_t *tcpack_sup_mod =
+                       (tcpack_sup_module_t *)dhdp->tcpack_sup_module;
+               dhdp->tcpack_sup_ratio = CUSTOM_TCPACK_SUPP_RATIO;
+               dhdp->tcpack_sup_delay = CUSTOM_TCPACK_DELAY_TIME;
+               for (i = 0; i < TCPACK_INFO_MAXNUM; i++)
+               {
+                       tcpack_sup_mod->tcpack_info_tbl[i].dhdp = dhdp;
+                       init_timer(&tcpack_sup_mod->tcpack_info_tbl[i].timer);
+                       tcpack_sup_mod->tcpack_info_tbl[i].timer.data =
+                               (ulong)&tcpack_sup_mod->tcpack_info_tbl[i];
+                       tcpack_sup_mod->tcpack_info_tbl[i].timer.function = dhd_tcpack_send;
+               }
+       }
+
+exit:
+       dhd_os_tcpackunlock(dhdp, flags);
+       return ret;
+}
+
+void
+dhd_tcpack_info_tbl_clean(dhd_pub_t *dhdp)
+{
+       tcpack_sup_module_t *tcpack_sup_mod = dhdp->tcpack_sup_module;
+       int i;
+       unsigned long flags;
+
+       if (dhdp->tcpack_sup_mode == TCPACK_SUP_OFF)
+               goto exit;
+
+       flags = dhd_os_tcpacklock(dhdp);
+
+       if (!tcpack_sup_mod) {
+               DHD_ERROR(("%s %d: tcpack suppress module NULL!!\n",
+                       __FUNCTION__, __LINE__));
+               dhd_os_tcpackunlock(dhdp, flags);
+               goto exit;
+       }
+
+       if (dhdp->tcpack_sup_mode == TCPACK_SUP_HOLD) {
+               for (i = 0; i < TCPACK_INFO_MAXNUM; i++) {
+                       if (tcpack_sup_mod->tcpack_info_tbl[i].pkt_in_q) {
+                               PKTFREE(dhdp->osh, tcpack_sup_mod->tcpack_info_tbl[i].pkt_in_q,
+                                       TRUE);
+                               tcpack_sup_mod->tcpack_info_tbl[i].pkt_in_q = NULL;
+                               tcpack_sup_mod->tcpack_info_tbl[i].pkt_ether_hdr = NULL;
+                               tcpack_sup_mod->tcpack_info_tbl[i].ifidx = 0;
+                               tcpack_sup_mod->tcpack_info_tbl[i].supp_cnt = 0;
+                       }
+               }
+       } else {
+               tcpack_sup_mod->tcpack_info_cnt = 0;
+               bzero(tcpack_sup_mod->tcpack_info_tbl, sizeof(tcpack_info_t) * TCPACK_INFO_MAXNUM);
+       }
+
+       dhd_os_tcpackunlock(dhdp, flags);
+
+       if (dhdp->tcpack_sup_mode == TCPACK_SUP_HOLD) {
+               for (i = 0; i < TCPACK_INFO_MAXNUM; i++) {
+                       del_timer_sync(&tcpack_sup_mod->tcpack_info_tbl[i].timer);
+               }
+       }
+
+exit:
+       return;
+}
+
+inline int dhd_tcpack_check_xmit(dhd_pub_t *dhdp, void *pkt)
+{
+       uint8 i;
+       tcpack_sup_module_t *tcpack_sup_mod;
+       tcpack_info_t *tcpack_info_tbl;
+       int tbl_cnt;
+       int ret = BCME_OK;
+       void *pdata;
+       uint32 pktlen;
+       unsigned long flags;
+
+       if (dhdp->tcpack_sup_mode == TCPACK_SUP_OFF)
+               goto exit;
+
+       pdata = PKTDATA(dhdp->osh, pkt);
+       pktlen = PKTLEN(dhdp->osh, pkt) - dhd_prot_hdrlen(dhdp, pdata);
+
+       if (pktlen < TCPACKSZMIN || pktlen > TCPACKSZMAX) {
+               DHD_TRACE(("%s %d: Too short or long length %d to be TCP ACK\n",
+                       __FUNCTION__, __LINE__, pktlen));
+               goto exit;
+       }
+
+       flags = dhd_os_tcpacklock(dhdp);
+       tcpack_sup_mod = dhdp->tcpack_sup_module;
+
+       if (!tcpack_sup_mod) {
+               DHD_ERROR(("%s %d: tcpack suppress module NULL!!\n", __FUNCTION__, __LINE__));
+               ret = BCME_ERROR;
+               dhd_os_tcpackunlock(dhdp, flags);
+               goto exit;
+       }
+       tbl_cnt = tcpack_sup_mod->tcpack_info_cnt;
+       tcpack_info_tbl = tcpack_sup_mod->tcpack_info_tbl;
+
+       ASSERT(tbl_cnt <= TCPACK_INFO_MAXNUM);
+
+       for (i = 0; i < tbl_cnt; i++) {
+               if (tcpack_info_tbl[i].pkt_in_q == pkt) {
+                       DHD_TRACE(("%s %d: pkt %p sent out. idx %d, tbl_cnt %d\n",
+                               __FUNCTION__, __LINE__, pkt, i, tbl_cnt));
+                       /* This pkt is being transmitted so remove the tcp_ack_info of it. */
+                       if (i < tbl_cnt - 1) {
+                               bcopy(&tcpack_info_tbl[tbl_cnt - 1],
+                                       &tcpack_info_tbl[i], sizeof(tcpack_info_t));
+                       }
+                       bzero(&tcpack_info_tbl[tbl_cnt - 1], sizeof(tcpack_info_t));
+                       if (--tcpack_sup_mod->tcpack_info_cnt < 0) {
+                               DHD_ERROR(("%s %d: ERROR!!! tcp_ack_info_cnt %d\n",
+                                       __FUNCTION__, __LINE__, tcpack_sup_mod->tcpack_info_cnt));
+                               ret = BCME_ERROR;
+                       }
+                       break;
+               }
+       }
+       dhd_os_tcpackunlock(dhdp, flags);
+
+exit:
+       return ret;
+}
+
+static INLINE bool dhd_tcpdata_psh_acked(dhd_pub_t *dhdp, uint8 *ip_hdr,
+       uint8 *tcp_hdr, uint32 tcp_ack_num)
+{
+       tcpack_sup_module_t *tcpack_sup_mod;
+       int i;
+       tcpdata_info_t *tcpdata_info = NULL;
+       tdata_psh_info_t *tdata_psh_info = NULL;
+       bool ret = FALSE;
+
+       if (dhdp->tcpack_sup_mode != TCPACK_SUP_DELAYTX)
+               goto exit;
+
+       tcpack_sup_mod = dhdp->tcpack_sup_module;
+
+       if (!tcpack_sup_mod) {
+               DHD_ERROR(("%s %d: tcpack suppress module NULL!!\n", __FUNCTION__, __LINE__));
+               goto exit;
+       }
+
+       DHD_TRACE(("%s %d: IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR
+               " TCP port %d %d, ack %u\n", __FUNCTION__, __LINE__,
+               IPV4_ADDR_TO_STR(ntoh32_ua(&ip_hdr[IPV4_SRC_IP_OFFSET])),
+               IPV4_ADDR_TO_STR(ntoh32_ua(&ip_hdr[IPV4_DEST_IP_OFFSET])),
+               ntoh16_ua(&tcp_hdr[TCP_SRC_PORT_OFFSET]),
+               ntoh16_ua(&tcp_hdr[TCP_DEST_PORT_OFFSET]),
+               tcp_ack_num));
+
+       for (i = 0; i < tcpack_sup_mod->tcpdata_info_cnt; i++) {
+               tcpdata_info_t *tcpdata_info_tmp = &tcpack_sup_mod->tcpdata_info_tbl[i];
+               DHD_TRACE(("%s %d: data info[%d], IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR
+                       " TCP port %d %d\n", __FUNCTION__, __LINE__, i,
+                       IPV4_ADDR_TO_STR(ntoh32_ua(tcpdata_info_tmp->ip_addr.src)),
+                       IPV4_ADDR_TO_STR(ntoh32_ua(tcpdata_info_tmp->ip_addr.dst)),
+                       ntoh16_ua(tcpdata_info_tmp->tcp_port.src),
+                       ntoh16_ua(tcpdata_info_tmp->tcp_port.dst)));
+
+               /* If either IP address or TCP port number does not match, skip. */
+               if (memcmp(&ip_hdr[IPV4_SRC_IP_OFFSET],
+                       tcpdata_info_tmp->ip_addr.dst, IPV4_ADDR_LEN) == 0 &&
+                       memcmp(&ip_hdr[IPV4_DEST_IP_OFFSET],
+                       tcpdata_info_tmp->ip_addr.src, IPV4_ADDR_LEN) == 0 &&
+                       memcmp(&tcp_hdr[TCP_SRC_PORT_OFFSET],
+                       tcpdata_info_tmp->tcp_port.dst, TCP_PORT_LEN) == 0 &&
+                       memcmp(&tcp_hdr[TCP_DEST_PORT_OFFSET],
+                       tcpdata_info_tmp->tcp_port.src, TCP_PORT_LEN) == 0) {
+                       tcpdata_info = tcpdata_info_tmp;
+                       break;
+               }
+       }
+
+       if (tcpdata_info == NULL) {
+               DHD_TRACE(("%s %d: no tcpdata_info!\n", __FUNCTION__, __LINE__));
+               goto exit;
+       }
+
+       if (tcpdata_info->tdata_psh_info_head == NULL) {
+               DHD_TRACE(("%s %d: No PSH DATA to be acked!\n", __FUNCTION__, __LINE__));
+       }
+
+       while ((tdata_psh_info = tcpdata_info->tdata_psh_info_head)) {
+               if (IS_TCPSEQ_GE(tcp_ack_num, tdata_psh_info->end_seq)) {
+                       DHD_TRACE(("%s %d: PSH ACKED! %u >= %u\n",
+                               __FUNCTION__, __LINE__, tcp_ack_num, tdata_psh_info->end_seq));
+                       tcpdata_info->tdata_psh_info_head = tdata_psh_info->next;
+                       tdata_psh_info->next = NULL;
+                       _tdata_psh_info_pool_enq(tcpack_sup_mod, tdata_psh_info);
+                       ret = TRUE;
+               } else
+                       break;
+       }
+       if (tdata_psh_info == NULL)
+               tcpdata_info->tdata_psh_info_tail = NULL;
+
+#ifdef DHDTCPACK_SUP_DBG
+       DHD_TRACE(("%s %d: PSH INFO ENQ %d\n",
+               __FUNCTION__, __LINE__, tcpack_sup_mod->psh_info_enq_num));
+#endif /* DHDTCPACK_SUP_DBG */
+
+exit:
+       return ret;
+}
+
+bool
+dhd_tcpack_suppress(dhd_pub_t *dhdp, void *pkt)
+{
+       uint8 *new_ether_hdr;   /* Ethernet header of the new packet */
+       uint16 new_ether_type;  /* Ethernet type of the new packet */
+       uint8 *new_ip_hdr;              /* IP header of the new packet */
+       uint8 *new_tcp_hdr;             /* TCP header of the new packet */
+       uint32 new_ip_hdr_len;  /* IP header length of the new packet */
+       uint32 cur_framelen;
+       uint32 new_tcp_ack_num;         /* TCP acknowledge number of the new packet */
+       uint16 new_ip_total_len;        /* Total length of IP packet for the new packet */
+       uint32 new_tcp_hdr_len;         /* TCP header length of the new packet */
+       tcpack_sup_module_t *tcpack_sup_mod;
+       tcpack_info_t *tcpack_info_tbl;
+       int i;
+       bool ret = FALSE;
+       bool set_dotxinrx = TRUE;
+       unsigned long flags;
+
+
+       if (dhdp->tcpack_sup_mode == TCPACK_SUP_OFF)
+               goto exit;
+
+       new_ether_hdr = PKTDATA(dhdp->osh, pkt);
+       cur_framelen = PKTLEN(dhdp->osh, pkt);
+
+       if (cur_framelen < TCPACKSZMIN || cur_framelen > TCPACKSZMAX) {
+               DHD_TRACE(("%s %d: Too short or long length %d to be TCP ACK\n",
+                       __FUNCTION__, __LINE__, cur_framelen));
+               goto exit;
+       }
+
+       new_ether_type = new_ether_hdr[12] << 8 | new_ether_hdr[13];
+
+       if (new_ether_type != ETHER_TYPE_IP) {
+               DHD_TRACE(("%s %d: Not a IP packet 0x%x\n",
+                       __FUNCTION__, __LINE__, new_ether_type));
+               goto exit;
+       }
+
+       DHD_TRACE(("%s %d: IP pkt! 0x%x\n", __FUNCTION__, __LINE__, new_ether_type));
+
+       new_ip_hdr = new_ether_hdr + ETHER_HDR_LEN;
+       cur_framelen -= ETHER_HDR_LEN;
+
+       ASSERT(cur_framelen >= IPV4_MIN_HEADER_LEN);
+
+       new_ip_hdr_len = IPV4_HLEN(new_ip_hdr);
+       if (IP_VER(new_ip_hdr) != IP_VER_4 || IPV4_PROT(new_ip_hdr) != IP_PROT_TCP) {
+               DHD_TRACE(("%s %d: Not IPv4 nor TCP! ip ver %d, prot %d\n",
+                       __FUNCTION__, __LINE__, IP_VER(new_ip_hdr), IPV4_PROT(new_ip_hdr)));
+               goto exit;
+       }
+
+       new_tcp_hdr = new_ip_hdr + new_ip_hdr_len;
+       cur_framelen -= new_ip_hdr_len;
+
+       ASSERT(cur_framelen >= TCP_MIN_HEADER_LEN);
+
+       DHD_TRACE(("%s %d: TCP pkt!\n", __FUNCTION__, __LINE__));
+
+       /* is it an ack ? Allow only ACK flag, not to suppress others. */
+       if (new_tcp_hdr[TCP_FLAGS_OFFSET] != TCP_FLAG_ACK) {
+               DHD_TRACE(("%s %d: Do not touch TCP flag 0x%x\n",
+                       __FUNCTION__, __LINE__, new_tcp_hdr[TCP_FLAGS_OFFSET]));
+               goto exit;
+       }
+
+       new_ip_total_len = ntoh16_ua(&new_ip_hdr[IPV4_PKTLEN_OFFSET]);
+       new_tcp_hdr_len = 4 * TCP_HDRLEN(new_tcp_hdr[TCP_HLEN_OFFSET]);
+
+       /* This packet has TCP data, so just send */
+       if (new_ip_total_len > new_ip_hdr_len + new_tcp_hdr_len) {
+               DHD_TRACE(("%s %d: Do nothing for TCP DATA\n", __FUNCTION__, __LINE__));
+               goto exit;
+       }
+
+       ASSERT(new_ip_total_len == new_ip_hdr_len + new_tcp_hdr_len);
+
+       new_tcp_ack_num = ntoh32_ua(&new_tcp_hdr[TCP_ACK_NUM_OFFSET]);
+
+       DHD_TRACE(("%s %d: TCP ACK with zero DATA length"
+               " IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR" TCP port %d %d\n",
+               __FUNCTION__, __LINE__,
+               IPV4_ADDR_TO_STR(ntoh32_ua(&new_ip_hdr[IPV4_SRC_IP_OFFSET])),
+               IPV4_ADDR_TO_STR(ntoh32_ua(&new_ip_hdr[IPV4_DEST_IP_OFFSET])),
+               ntoh16_ua(&new_tcp_hdr[TCP_SRC_PORT_OFFSET]),
+               ntoh16_ua(&new_tcp_hdr[TCP_DEST_PORT_OFFSET])));
+
+       /* Look for tcp_ack_info that has the same ip src/dst addrs and tcp src/dst ports */
+       flags = dhd_os_tcpacklock(dhdp);
+#if defined(DEBUG_COUNTER) && defined(DHDTCPACK_SUP_DBG)
+       counter_printlog(&tack_tbl);
+       tack_tbl.cnt[0]++;
+#endif /* DEBUG_COUNTER && DHDTCPACK_SUP_DBG */
+
+       tcpack_sup_mod = dhdp->tcpack_sup_module;
+       tcpack_info_tbl = tcpack_sup_mod->tcpack_info_tbl;
+
+       if (!tcpack_sup_mod) {
+               DHD_ERROR(("%s %d: tcpack suppress module NULL!!\n", __FUNCTION__, __LINE__));
+               ret = BCME_ERROR;
+               dhd_os_tcpackunlock(dhdp, flags);
+               goto exit;
+       }
+
+       if (dhd_tcpdata_psh_acked(dhdp, new_ip_hdr, new_tcp_hdr, new_tcp_ack_num)) {
+               /* This TCPACK is ACK to TCPDATA PSH pkt, so keep set_dotxinrx TRUE */
+#if defined(DEBUG_COUNTER) && defined(DHDTCPACK_SUP_DBG)
+               tack_tbl.cnt[5]++;
+#endif /* DEBUG_COUNTER && DHDTCPACK_SUP_DBG */
+       } else
+               set_dotxinrx = FALSE;
+
+       for (i = 0; i < tcpack_sup_mod->tcpack_info_cnt; i++) {
+               void *oldpkt;   /* TCPACK packet that is already in txq or DelayQ */
+               uint8 *old_ether_hdr, *old_ip_hdr, *old_tcp_hdr;
+               uint32 old_ip_hdr_len, old_tcp_hdr_len;
+               uint32 old_tcpack_num;  /* TCP ACK number of old TCPACK packet in Q */
+
+               if ((oldpkt = tcpack_info_tbl[i].pkt_in_q) == NULL) {
+                       DHD_ERROR(("%s %d: Unexpected error!! cur idx %d, ttl cnt %d\n",
+                               __FUNCTION__, __LINE__, i, tcpack_sup_mod->tcpack_info_cnt));
+                       break;
+               }
+
+               if (PKTDATA(dhdp->osh, oldpkt) == NULL) {
+                       DHD_ERROR(("%s %d: oldpkt data NULL!! cur idx %d, ttl cnt %d\n",
+                               __FUNCTION__, __LINE__, i, tcpack_sup_mod->tcpack_info_cnt));
+                       break;
+               }
+
+               old_ether_hdr = tcpack_info_tbl[i].pkt_ether_hdr;
+               old_ip_hdr = old_ether_hdr + ETHER_HDR_LEN;
+               old_ip_hdr_len = IPV4_HLEN(old_ip_hdr);
+               old_tcp_hdr = old_ip_hdr + old_ip_hdr_len;
+               old_tcp_hdr_len = 4 * TCP_HDRLEN(old_tcp_hdr[TCP_HLEN_OFFSET]);
+
+               DHD_TRACE(("%s %d: oldpkt %p[%d], IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR
+                       " TCP port %d %d\n", __FUNCTION__, __LINE__, oldpkt, i,
+                       IPV4_ADDR_TO_STR(ntoh32_ua(&old_ip_hdr[IPV4_SRC_IP_OFFSET])),
+                       IPV4_ADDR_TO_STR(ntoh32_ua(&old_ip_hdr[IPV4_DEST_IP_OFFSET])),
+                       ntoh16_ua(&old_tcp_hdr[TCP_SRC_PORT_OFFSET]),
+                       ntoh16_ua(&old_tcp_hdr[TCP_DEST_PORT_OFFSET])));
+
+               /* If either of IP address or TCP port number does not match, skip.
+                * Note that src/dst addr fields in ip header are contiguous being 8 bytes in total.
+                * Also, src/dst port fields in TCP header are contiguous being 4 bytes in total.
+                */
+               if (memcmp(&new_ip_hdr[IPV4_SRC_IP_OFFSET],
+                       &old_ip_hdr[IPV4_SRC_IP_OFFSET], IPV4_ADDR_LEN * 2) ||
+                       memcmp(&new_tcp_hdr[TCP_SRC_PORT_OFFSET],
+                       &old_tcp_hdr[TCP_SRC_PORT_OFFSET], TCP_PORT_LEN * 2))
+                       continue;
+
+               old_tcpack_num = ntoh32_ua(&old_tcp_hdr[TCP_ACK_NUM_OFFSET]);
+
+               if (IS_TCPSEQ_GT(new_tcp_ack_num, old_tcpack_num)) {
+                       /* New packet has higher TCP ACK number, so it replaces the old packet */
+                       if (new_ip_hdr_len == old_ip_hdr_len &&
+                               new_tcp_hdr_len == old_tcp_hdr_len) {
+                               ASSERT(memcmp(new_ether_hdr, old_ether_hdr, ETHER_HDR_LEN) == 0);
+                               bcopy(new_ip_hdr, old_ip_hdr, new_ip_total_len);
+                               PKTFREE(dhdp->osh, pkt, FALSE);
+                               DHD_TRACE(("%s %d: TCP ACK replace %u -> %u\n",
+                                       __FUNCTION__, __LINE__, old_tcpack_num, new_tcp_ack_num));
+#if defined(DEBUG_COUNTER) && defined(DHDTCPACK_SUP_DBG)
+                               tack_tbl.cnt[2]++;
+#endif /* DEBUG_COUNTER && DHDTCPACK_SUP_DBG */
+                               ret = TRUE;
+                       } else {
+#if defined(DEBUG_COUNTER) && defined(DHDTCPACK_SUP_DBG)
+                               tack_tbl.cnt[6]++;
+#endif /* DEBUG_COUNTER && DHDTCPACK_SUP_DBG */
+                               DHD_TRACE(("%s %d: lenth mismatch %d != %d || %d != %d"
+                                       " ACK %u -> %u\n", __FUNCTION__, __LINE__,
+                                       new_ip_hdr_len, old_ip_hdr_len,
+                                       new_tcp_hdr_len, old_tcp_hdr_len,
+                                       old_tcpack_num, new_tcp_ack_num));
+                       }
+               } else if (new_tcp_ack_num == old_tcpack_num) {
+                       set_dotxinrx = TRUE;
+                       /* TCPACK retransmission */
+#if defined(DEBUG_COUNTER) && defined(DHDTCPACK_SUP_DBG)
+                       tack_tbl.cnt[3]++;
+#endif /* DEBUG_COUNTER && DHDTCPACK_SUP_DBG */
+               } else {
+                       DHD_TRACE(("%s %d: ACK number reverse old %u(0x%p) new %u(0x%p)\n",
+                               __FUNCTION__, __LINE__, old_tcpack_num, oldpkt,
+                               new_tcp_ack_num, pkt));
+               }
+               dhd_os_tcpackunlock(dhdp, flags);
+               goto exit;
+       }
+
+       if (i == tcpack_sup_mod->tcpack_info_cnt && i < TCPACK_INFO_MAXNUM) {
+               /* No TCPACK packet with the same IP addr and TCP port is found
+                * in tcp_ack_info_tbl. So add this packet to the table.
+                */
+               DHD_TRACE(("%s %d: Add pkt 0x%p(ether_hdr 0x%p) to tbl[%d]\n",
+                       __FUNCTION__, __LINE__, pkt, new_ether_hdr,
+                       tcpack_sup_mod->tcpack_info_cnt));
+
+               tcpack_info_tbl[tcpack_sup_mod->tcpack_info_cnt].pkt_in_q = pkt;
+               tcpack_info_tbl[tcpack_sup_mod->tcpack_info_cnt].pkt_ether_hdr = new_ether_hdr;
+               tcpack_sup_mod->tcpack_info_cnt++;
+#if defined(DEBUG_COUNTER) && defined(DHDTCPACK_SUP_DBG)
+               tack_tbl.cnt[1]++;
+#endif /* DEBUG_COUNTER && DHDTCPACK_SUP_DBG */
+       } else {
+               ASSERT(i == tcpack_sup_mod->tcpack_info_cnt);
+               DHD_TRACE(("%s %d: No empty tcp ack info tbl\n",
+                       __FUNCTION__, __LINE__));
+       }
+       dhd_os_tcpackunlock(dhdp, flags);
+
+exit:
+       /* Unless TCPACK_SUP_DELAYTX, dotxinrx is alwasy TRUE, so no need to set here */
+       if (dhdp->tcpack_sup_mode == TCPACK_SUP_DELAYTX && set_dotxinrx)
+               dhd_bus_set_dotxinrx(dhdp->bus, TRUE);
+
+       return ret;
+}
+
+bool
+dhd_tcpdata_info_get(dhd_pub_t *dhdp, void *pkt)
+{
+       uint8 *ether_hdr;       /* Ethernet header of the new packet */
+       uint16 ether_type;      /* Ethernet type of the new packet */
+       uint8 *ip_hdr;          /* IP header of the new packet */
+       uint8 *tcp_hdr;         /* TCP header of the new packet */
+       uint32 ip_hdr_len;      /* IP header length of the new packet */
+       uint32 cur_framelen;
+       uint16 ip_total_len;    /* Total length of IP packet for the new packet */
+       uint32 tcp_hdr_len;             /* TCP header length of the new packet */
+       uint32 tcp_seq_num;             /* TCP sequence number of the new packet */
+       uint16 tcp_data_len;    /* TCP DATA length that excludes IP and TCP headers */
+       uint32 end_tcp_seq_num; /* TCP seq number of the last byte in the new packet */
+       tcpack_sup_module_t *tcpack_sup_mod;
+       tcpdata_info_t *tcpdata_info = NULL;
+       tdata_psh_info_t *tdata_psh_info;
+
+       int i;
+       bool ret = FALSE;
+       unsigned long flags;
+
+       if (dhdp->tcpack_sup_mode != TCPACK_SUP_DELAYTX)
+               goto exit;
+
+       ether_hdr = PKTDATA(dhdp->osh, pkt);
+       cur_framelen = PKTLEN(dhdp->osh, pkt);
+
+       ether_type = ether_hdr[12] << 8 | ether_hdr[13];
+
+       if (ether_type != ETHER_TYPE_IP) {
+               DHD_TRACE(("%s %d: Not a IP packet 0x%x\n",
+                       __FUNCTION__, __LINE__, ether_type));
+               goto exit;
+       }
+
+       DHD_TRACE(("%s %d: IP pkt! 0x%x\n", __FUNCTION__, __LINE__, ether_type));
+
+       ip_hdr = ether_hdr + ETHER_HDR_LEN;
+       cur_framelen -= ETHER_HDR_LEN;
+
+       ASSERT(cur_framelen >= IPV4_MIN_HEADER_LEN);
+
+       ip_hdr_len = IPV4_HLEN(ip_hdr);
+       if (IP_VER(ip_hdr) != IP_VER_4 || IPV4_PROT(ip_hdr) != IP_PROT_TCP) {
+               DHD_TRACE(("%s %d: Not IPv4 nor TCP! ip ver %d, prot %d\n",
+                       __FUNCTION__, __LINE__, IP_VER(ip_hdr), IPV4_PROT(ip_hdr)));
+               goto exit;
+       }
+
+       tcp_hdr = ip_hdr + ip_hdr_len;
+       cur_framelen -= ip_hdr_len;
+
+       ASSERT(cur_framelen >= TCP_MIN_HEADER_LEN);
+
+       DHD_TRACE(("%s %d: TCP pkt!\n", __FUNCTION__, __LINE__));
+
+       ip_total_len = ntoh16_ua(&ip_hdr[IPV4_PKTLEN_OFFSET]);
+       tcp_hdr_len = 4 * TCP_HDRLEN(tcp_hdr[TCP_HLEN_OFFSET]);
+
+       /* This packet is mere TCP ACK, so do nothing */
+       if (ip_total_len == ip_hdr_len + tcp_hdr_len) {
+               DHD_TRACE(("%s %d: Do nothing for no data TCP ACK\n", __FUNCTION__, __LINE__));
+               goto exit;
+       }
+
+       ASSERT(ip_total_len > ip_hdr_len + tcp_hdr_len);
+
+       if ((tcp_hdr[TCP_FLAGS_OFFSET] & TCP_FLAG_PSH) == 0) {
+               DHD_TRACE(("%s %d: Not interested TCP DATA packet\n", __FUNCTION__, __LINE__));
+               goto exit;
+       }
+
+       DHD_TRACE(("%s %d: TCP DATA with nonzero DATA length"
+               " IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR" TCP port %d %d, flag 0x%x\n",
+               __FUNCTION__, __LINE__,
+               IPV4_ADDR_TO_STR(ntoh32_ua(&ip_hdr[IPV4_SRC_IP_OFFSET])),
+               IPV4_ADDR_TO_STR(ntoh32_ua(&ip_hdr[IPV4_DEST_IP_OFFSET])),
+               ntoh16_ua(&tcp_hdr[TCP_SRC_PORT_OFFSET]),
+               ntoh16_ua(&tcp_hdr[TCP_DEST_PORT_OFFSET]),
+               tcp_hdr[TCP_FLAGS_OFFSET]));
+
+       flags = dhd_os_tcpacklock(dhdp);
+       tcpack_sup_mod = dhdp->tcpack_sup_module;
+
+       if (!tcpack_sup_mod) {
+               DHD_ERROR(("%s %d: tcpack suppress module NULL!!\n", __FUNCTION__, __LINE__));
+               ret = BCME_ERROR;
+               dhd_os_tcpackunlock(dhdp, flags);
+               goto exit;
+       }
+
+       /* Look for tcpdata_info that has the same ip src/dst addrs and tcp src/dst ports */
+       i = 0;
+       while (i < tcpack_sup_mod->tcpdata_info_cnt) {
+               tcpdata_info_t *tdata_info_tmp = &tcpack_sup_mod->tcpdata_info_tbl[i];
+               uint32 now_in_ms = OSL_SYSUPTIME();
+               DHD_TRACE(("%s %d: data info[%d], IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR
+                       " TCP port %d %d\n", __FUNCTION__, __LINE__, i,
+                       IPV4_ADDR_TO_STR(ntoh32_ua(tdata_info_tmp->ip_addr.src)),
+                       IPV4_ADDR_TO_STR(ntoh32_ua(tdata_info_tmp->ip_addr.dst)),
+                       ntoh16_ua(tdata_info_tmp->tcp_port.src),
+                       ntoh16_ua(tdata_info_tmp->tcp_port.dst)));
+
+               /* If both IP address and TCP port number match, we found it so break.
+                * Note that src/dst addr fields in ip header are contiguous being 8 bytes in total.
+                * Also, src/dst port fields in TCP header are contiguous being 4 bytes in total.
+                */
+               if (memcmp(&ip_hdr[IPV4_SRC_IP_OFFSET],
+                       (void *)&tdata_info_tmp->ip_addr, IPV4_ADDR_LEN * 2) == 0 &&
+                       memcmp(&tcp_hdr[TCP_SRC_PORT_OFFSET],
+                       (void *)&tdata_info_tmp->tcp_port, TCP_PORT_LEN * 2) == 0) {
+                       tcpdata_info = tdata_info_tmp;
+                       tcpdata_info->last_used_time = now_in_ms;
+                       break;
+               }
+
+               if (now_in_ms - tdata_info_tmp->last_used_time > TCPDATA_INFO_TIMEOUT) {
+                       tdata_psh_info_t *tdata_psh_info_tmp;
+                       tcpdata_info_t *last_tdata_info;
+
+                       while ((tdata_psh_info_tmp = tdata_info_tmp->tdata_psh_info_head)) {
+                               tdata_info_tmp->tdata_psh_info_head = tdata_psh_info_tmp->next;
+                               tdata_psh_info_tmp->next = NULL;
+                               DHD_TRACE(("%s %d: Clean tdata_psh_info(end_seq %u)!\n",
+                                       __FUNCTION__, __LINE__, tdata_psh_info_tmp->end_seq));
+                               _tdata_psh_info_pool_enq(tcpack_sup_mod, tdata_psh_info_tmp);
+                       }
+#ifdef DHDTCPACK_SUP_DBG
+                       DHD_ERROR(("%s %d: PSH INFO ENQ %d\n",
+                               __FUNCTION__, __LINE__, tcpack_sup_mod->psh_info_enq_num));
+#endif /* DHDTCPACK_SUP_DBG */
+                       tcpack_sup_mod->tcpdata_info_cnt--;
+                       ASSERT(tcpack_sup_mod->tcpdata_info_cnt >= 0);
+
+                       last_tdata_info =
+                               &tcpack_sup_mod->tcpdata_info_tbl[tcpack_sup_mod->tcpdata_info_cnt];
+                       if (i < tcpack_sup_mod->tcpdata_info_cnt) {
+                               ASSERT(last_tdata_info != tdata_info_tmp);
+                               bcopy(last_tdata_info, tdata_info_tmp, sizeof(tcpdata_info_t));
+                       }
+                       bzero(last_tdata_info, sizeof(tcpdata_info_t));
+                       DHD_INFO(("%s %d: tcpdata_info(idx %d) is aged out. ttl cnt is now %d\n",
+                               __FUNCTION__, __LINE__, i, tcpack_sup_mod->tcpdata_info_cnt));
+                       /* Don't increase "i" here, so that the prev last tcpdata_info is checked */
+               } else
+                        i++;
+       }
+
+       tcp_seq_num = ntoh32_ua(&tcp_hdr[TCP_SEQ_NUM_OFFSET]);
+       tcp_data_len = ip_total_len - ip_hdr_len - tcp_hdr_len;
+       end_tcp_seq_num = tcp_seq_num + tcp_data_len;
+
+       if (tcpdata_info == NULL) {
+               ASSERT(i == tcpack_sup_mod->tcpdata_info_cnt);
+               if (i >= TCPDATA_INFO_MAXNUM) {
+                       DHD_TRACE(("%s %d: tcp_data_info_tbl FULL! %d %d"
+                               " IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR" TCP port %d %d\n",
+                               __FUNCTION__, __LINE__, i, tcpack_sup_mod->tcpdata_info_cnt,
+                               IPV4_ADDR_TO_STR(ntoh32_ua(&ip_hdr[IPV4_SRC_IP_OFFSET])),
+                               IPV4_ADDR_TO_STR(ntoh32_ua(&ip_hdr[IPV4_DEST_IP_OFFSET])),
+                               ntoh16_ua(&tcp_hdr[TCP_SRC_PORT_OFFSET]),
+                               ntoh16_ua(&tcp_hdr[TCP_DEST_PORT_OFFSET])));
+                       dhd_os_tcpackunlock(dhdp, flags);
+                       goto exit;
+               }
+               tcpdata_info = &tcpack_sup_mod->tcpdata_info_tbl[i];
+
+               /* No TCP flow with the same IP addr and TCP port is found
+                * in tcp_data_info_tbl. So add this flow to the table.
+                */
+               DHD_INFO(("%s %d: Add data info to tbl[%d]: IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR
+                       " TCP port %d %d\n",
+                       __FUNCTION__, __LINE__, tcpack_sup_mod->tcpdata_info_cnt,
+                       IPV4_ADDR_TO_STR(ntoh32_ua(&ip_hdr[IPV4_SRC_IP_OFFSET])),
+                       IPV4_ADDR_TO_STR(ntoh32_ua(&ip_hdr[IPV4_DEST_IP_OFFSET])),
+                       ntoh16_ua(&tcp_hdr[TCP_SRC_PORT_OFFSET]),
+                       ntoh16_ua(&tcp_hdr[TCP_DEST_PORT_OFFSET])));
+               /* Note that src/dst addr fields in ip header are contiguous being 8 bytes in total.
+                * Also, src/dst port fields in TCP header are contiguous being 4 bytes in total.
+                */
+               bcopy(&ip_hdr[IPV4_SRC_IP_OFFSET], (void *)&tcpdata_info->ip_addr,
+                       IPV4_ADDR_LEN * 2);
+               bcopy(&tcp_hdr[TCP_SRC_PORT_OFFSET], (void *)&tcpdata_info->tcp_port,
+                       TCP_PORT_LEN * 2);
+
+               tcpdata_info->last_used_time = OSL_SYSUPTIME();
+               tcpack_sup_mod->tcpdata_info_cnt++;
+       }
+
+       ASSERT(tcpdata_info != NULL);
+
+       tdata_psh_info = _tdata_psh_info_pool_deq(tcpack_sup_mod);
+#ifdef DHDTCPACK_SUP_DBG
+       DHD_TRACE(("%s %d: PSH INFO ENQ %d\n",
+               __FUNCTION__, __LINE__, tcpack_sup_mod->psh_info_enq_num));
+#endif /* DHDTCPACK_SUP_DBG */
+
+       if (tdata_psh_info == NULL) {
+               DHD_ERROR(("%s %d: No more free tdata_psh_info!!\n", __FUNCTION__, __LINE__));
+               ret = BCME_ERROR;
+               dhd_os_tcpackunlock(dhdp, flags);
+               goto exit;
+       }
+       tdata_psh_info->end_seq = end_tcp_seq_num;
+
+#if defined(DEBUG_COUNTER) && defined(DHDTCPACK_SUP_DBG)
+       tack_tbl.cnt[4]++;
+#endif /* DEBUG_COUNTER && DHDTCPACK_SUP_DBG */
+
+       DHD_TRACE(("%s %d: TCP PSH DATA recvd! end seq %u\n",
+               __FUNCTION__, __LINE__, tdata_psh_info->end_seq));
+
+       ASSERT(tdata_psh_info->next == NULL);
+
+       if (tcpdata_info->tdata_psh_info_head == NULL)
+               tcpdata_info->tdata_psh_info_head = tdata_psh_info;
+       else {
+               ASSERT(tcpdata_info->tdata_psh_info_tail);
+               tcpdata_info->tdata_psh_info_tail->next = tdata_psh_info;
+       }
+       tcpdata_info->tdata_psh_info_tail = tdata_psh_info;
+
+       dhd_os_tcpackunlock(dhdp, flags);
+
+exit:
+       return ret;
+}
+
+bool
+dhd_tcpack_hold(dhd_pub_t *dhdp, void *pkt, int ifidx)
+{
+       uint8 *new_ether_hdr;   /* Ethernet header of the new packet */
+       uint16 new_ether_type;  /* Ethernet type of the new packet */
+       uint8 *new_ip_hdr;              /* IP header of the new packet */
+       uint8 *new_tcp_hdr;             /* TCP header of the new packet */
+       uint32 new_ip_hdr_len;  /* IP header length of the new packet */
+       uint32 cur_framelen;
+       uint32 new_tcp_ack_num;         /* TCP acknowledge number of the new packet */
+       uint16 new_ip_total_len;        /* Total length of IP packet for the new packet */
+       uint32 new_tcp_hdr_len;         /* TCP header length of the new packet */
+       tcpack_sup_module_t *tcpack_sup_mod;
+       tcpack_info_t *tcpack_info_tbl;
+       int i, free_slot = TCPACK_INFO_MAXNUM;
+       bool hold = FALSE;
+       unsigned long flags;
+
+       if (dhdp->tcpack_sup_mode != TCPACK_SUP_HOLD) {
+               goto exit;
+       }
+
+       if (dhdp->tcpack_sup_ratio == 1) {
+               goto exit;
+       }
+
+       new_ether_hdr = PKTDATA(dhdp->osh, pkt);
+       cur_framelen = PKTLEN(dhdp->osh, pkt);
+
+       if (cur_framelen < TCPACKSZMIN || cur_framelen > TCPACKSZMAX) {
+               DHD_TRACE(("%s %d: Too short or long length %d to be TCP ACK\n",
+                       __FUNCTION__, __LINE__, cur_framelen));
+               goto exit;
+       }
+
+       new_ether_type = new_ether_hdr[12] << 8 | new_ether_hdr[13];
+
+       if (new_ether_type != ETHER_TYPE_IP) {
+               DHD_TRACE(("%s %d: Not a IP packet 0x%x\n",
+                       __FUNCTION__, __LINE__, new_ether_type));
+               goto exit;
+       }
+
+       DHD_TRACE(("%s %d: IP pkt! 0x%x\n", __FUNCTION__, __LINE__, new_ether_type));
+
+       new_ip_hdr = new_ether_hdr + ETHER_HDR_LEN;
+       cur_framelen -= ETHER_HDR_LEN;
+
+       ASSERT(cur_framelen >= IPV4_MIN_HEADER_LEN);
+
+       new_ip_hdr_len = IPV4_HLEN(new_ip_hdr);
+       if (IP_VER(new_ip_hdr) != IP_VER_4 || IPV4_PROT(new_ip_hdr) != IP_PROT_TCP) {
+               DHD_TRACE(("%s %d: Not IPv4 nor TCP! ip ver %d, prot %d\n",
+                       __FUNCTION__, __LINE__, IP_VER(new_ip_hdr), IPV4_PROT(new_ip_hdr)));
+               goto exit;
+       }
+
+       new_tcp_hdr = new_ip_hdr + new_ip_hdr_len;
+       cur_framelen -= new_ip_hdr_len;
+
+       ASSERT(cur_framelen >= TCP_MIN_HEADER_LEN);
+
+       DHD_TRACE(("%s %d: TCP pkt!\n", __FUNCTION__, __LINE__));
+
+       /* is it an ack ? Allow only ACK flag, not to suppress others. */
+       if (new_tcp_hdr[TCP_FLAGS_OFFSET] != TCP_FLAG_ACK) {
+               DHD_TRACE(("%s %d: Do not touch TCP flag 0x%x\n",
+                       __FUNCTION__, __LINE__, new_tcp_hdr[TCP_FLAGS_OFFSET]));
+               goto exit;
+       }
+
+       new_ip_total_len = ntoh16_ua(&new_ip_hdr[IPV4_PKTLEN_OFFSET]);
+       new_tcp_hdr_len = 4 * TCP_HDRLEN(new_tcp_hdr[TCP_HLEN_OFFSET]);
+
+       /* This packet has TCP data, so just send */
+       if (new_ip_total_len > new_ip_hdr_len + new_tcp_hdr_len) {
+               DHD_TRACE(("%s %d: Do nothing for TCP DATA\n", __FUNCTION__, __LINE__));
+               goto exit;
+       }
+
+       ASSERT(new_ip_total_len == new_ip_hdr_len + new_tcp_hdr_len);
+
+       new_tcp_ack_num = ntoh32_ua(&new_tcp_hdr[TCP_ACK_NUM_OFFSET]);
+
+       DHD_TRACE(("%s %d: TCP ACK with zero DATA length"
+               " IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR" TCP port %d %d\n",
+               __FUNCTION__, __LINE__,
+               IPV4_ADDR_TO_STR(ntoh32_ua(&new_ip_hdr[IPV4_SRC_IP_OFFSET])),
+               IPV4_ADDR_TO_STR(ntoh32_ua(&new_ip_hdr[IPV4_DEST_IP_OFFSET])),
+               ntoh16_ua(&new_tcp_hdr[TCP_SRC_PORT_OFFSET]),
+               ntoh16_ua(&new_tcp_hdr[TCP_DEST_PORT_OFFSET])));
+
+       /* Look for tcp_ack_info that has the same ip src/dst addrs and tcp src/dst ports */
+       flags = dhd_os_tcpacklock(dhdp);
+
+       tcpack_sup_mod = dhdp->tcpack_sup_module;
+       tcpack_info_tbl = tcpack_sup_mod->tcpack_info_tbl;
+
+       if (!tcpack_sup_mod) {
+               DHD_ERROR(("%s %d: tcpack suppress module NULL!!\n", __FUNCTION__, __LINE__));
+               dhd_os_tcpackunlock(dhdp, flags);
+               goto exit;
+       }
+
+       hold = TRUE;
+
+       for (i = 0; i < TCPACK_INFO_MAXNUM; i++) {
+               void *oldpkt;   /* TCPACK packet that is already in txq or DelayQ */
+               uint8 *old_ether_hdr, *old_ip_hdr, *old_tcp_hdr;
+               uint32 old_ip_hdr_len;
+               uint32 old_tcpack_num;  /* TCP ACK number of old TCPACK packet in Q */
+
+               if ((oldpkt = tcpack_info_tbl[i].pkt_in_q) == NULL) {
+                       if (free_slot == TCPACK_INFO_MAXNUM) {
+                               free_slot = i;
+                       }
+                       continue;
+               }
+
+               if (PKTDATA(dhdp->osh, oldpkt) == NULL) {
+                       DHD_ERROR(("%s %d: oldpkt data NULL!! cur idx %d\n",
+                               __FUNCTION__, __LINE__, i));
+                       hold = FALSE;
+                       dhd_os_tcpackunlock(dhdp, flags);
+                       goto exit;
+               }
+
+               old_ether_hdr = tcpack_info_tbl[i].pkt_ether_hdr;
+               old_ip_hdr = old_ether_hdr + ETHER_HDR_LEN;
+               old_ip_hdr_len = IPV4_HLEN(old_ip_hdr);
+               old_tcp_hdr = old_ip_hdr + old_ip_hdr_len;
+
+               DHD_TRACE(("%s %d: oldpkt %p[%d], IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR
+                       " TCP port %d %d\n", __FUNCTION__, __LINE__, oldpkt, i,
+                       IPV4_ADDR_TO_STR(ntoh32_ua(&old_ip_hdr[IPV4_SRC_IP_OFFSET])),
+                       IPV4_ADDR_TO_STR(ntoh32_ua(&old_ip_hdr[IPV4_DEST_IP_OFFSET])),
+                       ntoh16_ua(&old_tcp_hdr[TCP_SRC_PORT_OFFSET]),
+                       ntoh16_ua(&old_tcp_hdr[TCP_DEST_PORT_OFFSET])));
+
+               /* If either of IP address or TCP port number does not match, skip. */
+               if (memcmp(&new_ip_hdr[IPV4_SRC_IP_OFFSET],
+                       &old_ip_hdr[IPV4_SRC_IP_OFFSET], IPV4_ADDR_LEN * 2) ||
+                       memcmp(&new_tcp_hdr[TCP_SRC_PORT_OFFSET],
+                       &old_tcp_hdr[TCP_SRC_PORT_OFFSET], TCP_PORT_LEN * 2)) {
+                       continue;
+               }
+
+               old_tcpack_num = ntoh32_ua(&old_tcp_hdr[TCP_ACK_NUM_OFFSET]);
+
+               if (IS_TCPSEQ_GE(new_tcp_ack_num, old_tcpack_num)) {
+                       tcpack_info_tbl[i].supp_cnt++;
+                       if (tcpack_info_tbl[i].supp_cnt >= dhdp->tcpack_sup_ratio) {
+                               tcpack_info_tbl[i].pkt_in_q = NULL;
+                               tcpack_info_tbl[i].pkt_ether_hdr = NULL;
+                               tcpack_info_tbl[i].ifidx = 0;
+                               tcpack_info_tbl[i].supp_cnt = 0;
+                               hold = FALSE;
+                       } else {
+                               tcpack_info_tbl[i].pkt_in_q = pkt;
+                               tcpack_info_tbl[i].pkt_ether_hdr = new_ether_hdr;
+                               tcpack_info_tbl[i].ifidx = ifidx;
+                       }
+                       PKTFREE(dhdp->osh, oldpkt, TRUE);
+               } else {
+                       PKTFREE(dhdp->osh, pkt, TRUE);
+               }
+               dhd_os_tcpackunlock(dhdp, flags);
+
+               if (!hold) {
+                       del_timer_sync(&tcpack_info_tbl[i].timer);
+               }
+               goto exit;
+       }
+
+       if (free_slot < TCPACK_INFO_MAXNUM) {
+               /* No TCPACK packet with the same IP addr and TCP port is found
+                * in tcp_ack_info_tbl. So add this packet to the table.
+                */
+               DHD_TRACE(("%s %d: Add pkt 0x%p(ether_hdr 0x%p) to tbl[%d]\n",
+                       __FUNCTION__, __LINE__, pkt, new_ether_hdr,
+                       free_slot));
+
+               tcpack_info_tbl[free_slot].pkt_in_q = pkt;
+               tcpack_info_tbl[free_slot].pkt_ether_hdr = new_ether_hdr;
+               tcpack_info_tbl[free_slot].ifidx = ifidx;
+               tcpack_info_tbl[free_slot].supp_cnt = 1;
+               mod_timer(&tcpack_sup_mod->tcpack_info_tbl[free_slot].timer,
+                       jiffies + msecs_to_jiffies(dhdp->tcpack_sup_delay));
+               tcpack_sup_mod->tcpack_info_cnt++;
+       } else {
+               DHD_TRACE(("%s %d: No empty tcp ack info tbl\n",
+                       __FUNCTION__, __LINE__));
+       }
+       dhd_os_tcpackunlock(dhdp, flags);
+
+exit:
+       return hold;
+}
+#endif /* DHDTCPACK_SUPPRESS */
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_ip.h b/drivers/net/wireless/bcmdhd_1363/dhd_ip.h
new file mode 100644 (file)
index 0000000..c794b91
--- /dev/null
@@ -0,0 +1,85 @@
+/*
+ * Header file describing the common ip parser function.
+ *
+ * Provides type definitions and function prototypes used to parse ip packet.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_ip.h 537119 2015-02-25 04:24:14Z $
+ */
+
+#ifndef _dhd_ip_h_
+#define _dhd_ip_h_
+
+#ifdef DHDTCPACK_SUPPRESS
+#include <dngl_stats.h>
+#include <bcmutils.h>
+#include <dhd.h>
+#endif /* DHDTCPACK_SUPPRESS */
+
+typedef enum pkt_frag
+{
+       DHD_PKT_FRAG_NONE = 0,
+       DHD_PKT_FRAG_FIRST,
+       DHD_PKT_FRAG_CONT,
+       DHD_PKT_FRAG_LAST
+} pkt_frag_t;
+
+extern pkt_frag_t pkt_frag_info(osl_t *osh, void *p);
+
+#ifdef DHDTCPACK_SUPPRESS
+#define        TCPACKSZMIN     (ETHER_HDR_LEN + IPV4_MIN_HEADER_LEN + TCP_MIN_HEADER_LEN)
+/* Size of MAX possible TCP ACK packet. Extra bytes for IP/TCP option fields */
+#define        TCPACKSZMAX     (TCPACKSZMIN + 100)
+
+/* Max number of TCP streams that have own src/dst IP addrs and TCP ports */
+#define TCPACK_INFO_MAXNUM 4
+#define TCPDATA_INFO_MAXNUM 4
+#define TCPDATA_PSH_INFO_MAXNUM (8 * TCPDATA_INFO_MAXNUM)
+
+#define TCPDATA_INFO_TIMEOUT 5000      /* Remove tcpdata_info if inactive for this time (in ms) */
+
+#define DEFAULT_TCPACK_SUPP_RATIO 3
+#ifndef CUSTOM_TCPACK_SUPP_RATIO
+#define CUSTOM_TCPACK_SUPP_RATIO DEFAULT_TCPACK_SUPP_RATIO
+#endif /* CUSTOM_TCPACK_SUPP_RATIO */
+
+#define DEFAULT_TCPACK_DELAY_TIME 10 /* ms */
+#ifndef CUSTOM_TCPACK_DELAY_TIME
+#define CUSTOM_TCPACK_DELAY_TIME DEFAULT_TCPACK_DELAY_TIME
+#endif /* CUSTOM_TCPACK_DELAY_TIME */
+
+extern int dhd_tcpack_suppress_set(dhd_pub_t *dhdp, uint8 on);
+extern void dhd_tcpack_info_tbl_clean(dhd_pub_t *dhdp);
+extern int dhd_tcpack_check_xmit(dhd_pub_t *dhdp, void *pkt);
+extern bool dhd_tcpack_suppress(dhd_pub_t *dhdp, void *pkt);
+extern bool dhd_tcpdata_info_get(dhd_pub_t *dhdp, void *pkt);
+extern bool dhd_tcpack_hold(dhd_pub_t *dhdp, void *pkt, int ifidx);
+/* #define DHDTCPACK_SUP_DBG */
+#if defined(DEBUG_COUNTER) && defined(DHDTCPACK_SUP_DBG)
+extern counter_tbl_t tack_tbl;
+#endif /* DEBUG_COUNTER && DHDTCPACK_SUP_DBG */
+#endif /* DHDTCPACK_SUPPRESS */
+
+#endif /* _dhd_ip_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_linux.c b/drivers/net/wireless/bcmdhd_1363/dhd_linux.c
new file mode 100644 (file)
index 0000000..3bebcea
--- /dev/null
@@ -0,0 +1,14474 @@
+/*
+ * Broadcom Dongle Host Driver (DHD), Linux-specific network interface
+ * Basically selected code segments from usb-cdc.c and usb-rndis.c
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_linux.c 665078 2017-05-18 08:51:32Z $
+ */
+
+#include <typedefs.h>
+#include <linuxver.h>
+#include <osl.h>
+#ifdef SHOW_LOGTRACE
+#include <linux/syscalls.h>
+#include <event_log.h>
+#endif /* SHOW_LOGTRACE */
+
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/inetdevice.h>
+#include <linux/rtnetlink.h>
+#include <linux/etherdevice.h>
+#include <linux/random.h>
+#include <linux/spinlock.h>
+#include <linux/ethtool.h>
+#include <linux/fcntl.h>
+#include <linux/fs.h>
+#include <linux/ip.h>
+#include <linux/reboot.h>
+#include <linux/notifier.h>
+#include <net/addrconf.h>
+#ifdef ENABLE_ADAPTIVE_SCHED
+#include <linux/cpufreq.h>
+#endif /* ENABLE_ADAPTIVE_SCHED */
+
+#include <asm/uaccess.h>
+#include <asm/unaligned.h>
+
+#include <epivers.h>
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <bcmdevs.h>
+
+#include <proto/ethernet.h>
+#include <proto/bcmevent.h>
+#include <proto/vlan.h>
+#include <proto/802.3.h>
+
+#include <dngl_stats.h>
+#include <dhd_linux_wq.h>
+#include <dhd.h>
+#include <dhd_linux.h>
+#ifdef PCIE_FULL_DONGLE
+#include <dhd_flowring.h>
+#endif
+#include <dhd_bus.h>
+#include <dhd_proto.h>
+#include <dhd_dbg.h>
+#ifdef CONFIG_HAS_WAKELOCK
+#include <linux/wakelock.h>
+#endif
+#ifdef WL_CFG80211
+#include <wl_cfg80211.h>
+#endif
+#ifdef PNO_SUPPORT
+#include <dhd_pno.h>
+#endif
+#ifdef RTT_SUPPORT
+#include <dhd_rtt.h>
+#endif
+
+#ifdef CONFIG_COMPAT
+#include <linux/compat.h>
+#endif
+
+#ifdef DHD_WMF
+#include <dhd_wmf_linux.h>
+#endif /* DHD_WMF */
+
+#ifdef DHD_L2_FILTER
+#include <proto/bcmicmp.h>
+#include <bcm_l2_filter.h>
+#include <dhd_l2_filter.h>
+#endif /* DHD_L2_FILTER */
+
+#ifdef DHD_PSTA
+#include <dhd_psta.h>
+#endif /* DHD_PSTA */
+
+
+#ifdef DHDTCPACK_SUPPRESS
+#include <dhd_ip.h>
+#endif /* DHDTCPACK_SUPPRESS */
+
+#ifdef DHD_BANDSTEER
+#include <dhd_bandsteer.h>
+#endif /* DHD_BANDSTEER */
+
+#ifdef DHD_DEBUG_PAGEALLOC
+typedef void (*page_corrupt_cb_t)(void *handle, void *addr_corrupt, size_t len);
+void dhd_page_corrupt_cb(void *handle, void *addr_corrupt, size_t len);
+extern void register_page_corrupt_cb(page_corrupt_cb_t cb, void* handle);
+#endif /* DHD_DEBUG_PAGEALLOC */
+
+
+#if defined(DHD_LB)
+/* Dynamic CPU selection for load balancing */
+#include <linux/cpu.h>
+#include <linux/cpumask.h>
+#include <linux/notifier.h>
+#include <linux/workqueue.h>
+#include <asm/atomic.h>
+
+#if !defined(DHD_LB_PRIMARY_CPUS)
+#define DHD_LB_PRIMARY_CPUS     0x0 /* Big CPU coreids mask */
+#endif
+
+#if !defined(DHD_LB_SECONDARY_CPUS)
+#define DHD_LB_SECONDARY_CPUS   0xFE /* Little CPU coreids mask */
+#endif
+
+#define HIST_BIN_SIZE  8
+
+#if defined(DHD_LB_RXP)
+static void dhd_rx_napi_dispatcher_fn(struct work_struct * work);
+#endif /* DHD_LB_RXP */
+
+#endif /* DHD_LB */
+
+#ifdef WLMEDIA_HTSF
+#include <linux/time.h>
+#include <htsf.h>
+
+#define HTSF_MINLEN 200    /* min. packet length to timestamp */
+#define HTSF_BUS_DELAY 150 /* assume a fix propagation in us  */
+#define TSMAX  1000        /* max no. of timing record kept   */
+#define NUMBIN 34
+
+static uint32 tsidx = 0;
+static uint32 htsf_seqnum = 0;
+uint32 tsfsync;
+struct timeval tsync;
+static uint32 tsport = 5010;
+
+typedef struct histo_ {
+       uint32 bin[NUMBIN];
+} histo_t;
+
+#if !ISPOWEROF2(DHD_SDALIGN)
+#error DHD_SDALIGN is not a power of 2!
+#endif
+
+static histo_t vi_d1, vi_d2, vi_d3, vi_d4;
+#endif /* WLMEDIA_HTSF */
+
+#ifdef STBLINUX
+#ifdef quote_str
+#undef quote_str
+#endif /* quote_str */
+#ifdef to_str
+#undef to_str
+#endif /* quote_str */
+#define to_str(s) #s
+#define quote_str(s) to_str(s)
+
+static char *driver_target = "driver_target: "quote_str(BRCM_DRIVER_TARGET);
+#endif /* STBLINUX */
+
+
+#if defined(SOFTAP)
+extern bool ap_cfg_running;
+extern bool ap_fw_loaded;
+#endif
+extern void dhd_dump_eapol_4way_message(char *ifname, char *dump_data, bool direction);
+
+#ifdef FIX_CPU_MIN_CLOCK
+#include <linux/pm_qos.h>
+#endif /* FIX_CPU_MIN_CLOCK */
+#ifdef SET_RANDOM_MAC_SOFTAP
+#ifndef CONFIG_DHD_SET_RANDOM_MAC_VAL
+#define CONFIG_DHD_SET_RANDOM_MAC_VAL  0x001A11
+#endif
+static u32 vendor_oui = CONFIG_DHD_SET_RANDOM_MAC_VAL;
+#endif /* SET_RANDOM_MAC_SOFTAP */
+#ifdef ENABLE_ADAPTIVE_SCHED
+#define DEFAULT_CPUFREQ_THRESH         1000000 /* threshold frequency : 1000000 = 1GHz */
+#ifndef CUSTOM_CPUFREQ_THRESH
+#define CUSTOM_CPUFREQ_THRESH  DEFAULT_CPUFREQ_THRESH
+#endif /* CUSTOM_CPUFREQ_THRESH */
+#endif /* ENABLE_ADAPTIVE_SCHED */
+
+/* enable HOSTIP cache update from the host side when an eth0:N is up */
+#define AOE_IP_ALIAS_SUPPORT 1
+
+#ifdef BCM_FD_AGGR
+#include <bcm_rpc.h>
+#include <bcm_rpc_tp.h>
+#endif
+#ifdef PROP_TXSTATUS
+#include <wlfc_proto.h>
+#include <dhd_wlfc.h>
+#endif
+
+#include <wl_android.h>
+
+/* Maximum STA per radio */
+#define DHD_MAX_STA     32
+
+
+
+const uint8 wme_fifo2ac[] = { 0, 1, 2, 3, 1, 1 };
+const uint8 prio2fifo[8] = { 1, 0, 0, 1, 2, 2, 3, 3 };
+#define WME_PRIO2AC(prio)  wme_fifo2ac[prio2fifo[(prio)]]
+
+#ifdef ARP_OFFLOAD_SUPPORT
+void aoe_update_host_ipv4_table(dhd_pub_t *dhd_pub, u32 ipa, bool add, int idx);
+static int dhd_inetaddr_notifier_call(struct notifier_block *this,
+       unsigned long event, void *ptr);
+static struct notifier_block dhd_inetaddr_notifier = {
+       .notifier_call = dhd_inetaddr_notifier_call
+};
+/* to make sure we won't register the same notifier twice, otherwise a loop is likely to be
+ * created in kernel notifier link list (with 'next' pointing to itself)
+ */
+static bool dhd_inetaddr_notifier_registered = FALSE;
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+#if defined(CONFIG_IPV6) && defined(IPV6_NDO_SUPPORT)
+static int dhd_inet6addr_notifier_call(struct notifier_block *this,
+       unsigned long event, void *ptr);
+static struct notifier_block dhd_inet6addr_notifier = {
+       .notifier_call = dhd_inet6addr_notifier_call
+};
+/* to make sure we won't register the same notifier twice, otherwise a loop is likely to be
+ * created in kernel notifier link list (with 'next' pointing to itself)
+ */
+static bool dhd_inet6addr_notifier_registered = FALSE;
+#endif /* CONFIG_IPV6 && IPV6_NDO_SUPPORT */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined(CONFIG_PM_SLEEP)
+#include <linux/suspend.h>
+volatile bool dhd_mmc_suspend = FALSE;
+DECLARE_WAIT_QUEUE_HEAD(dhd_dpc_wait);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined(CONFIG_PM_SLEEP) */
+
+#if defined(OOB_INTR_ONLY)
+extern void dhd_enable_oob_intr(struct dhd_bus *bus, bool enable);
+#endif 
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+static void dhd_hang_process(void *dhd_info, void *event_data, u8 event);
+#endif 
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+MODULE_LICENSE("GPL and additional rights");
+#endif /* LinuxVer */
+
+#include <dhd_bus.h>
+
+#ifdef BCM_FD_AGGR
+#define DBUS_RX_BUFFER_SIZE_DHD(net)   (BCM_RPC_TP_DNGL_AGG_MAX_BYTE)
+#else
+#ifndef PROP_TXSTATUS
+#define DBUS_RX_BUFFER_SIZE_DHD(net)   (net->mtu + net->hard_header_len + dhd->pub.hdrlen)
+#else
+#define DBUS_RX_BUFFER_SIZE_DHD(net)   (net->mtu + net->hard_header_len + dhd->pub.hdrlen + 128)
+#endif
+#endif /* BCM_FD_AGGR */
+
+#ifdef PROP_TXSTATUS
+extern bool dhd_wlfc_skip_fc(void *dhd);
+extern void dhd_wlfc_plat_init(void *dhd);
+extern void dhd_wlfc_plat_deinit(void *dhd);
+#endif /* PROP_TXSTATUS */
+#ifdef USE_DYNAMIC_F2_BLKSIZE
+extern uint sd_f2_blocksize;
+extern int dhdsdio_func_blocksize(dhd_pub_t *dhd, int function_num, int block_size);
+#endif /* USE_DYNAMIC_F2_BLKSIZE */
+
+#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 15)
+const char *
+print_tainted()
+{
+       return "";
+}
+#endif /* LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 15) */
+
+/* Linux wireless extension support */
+#if defined(WL_WIRELESS_EXT)
+#include <wl_iw.h>
+extern wl_iw_extra_params_t  g_wl_iw_params;
+#endif /* defined(WL_WIRELESS_EXT) */
+
+#ifdef CONFIG_PARTIALSUSPEND_SLP
+#include <linux/partialsuspend_slp.h>
+#define CONFIG_HAS_EARLYSUSPEND
+#define DHD_USE_EARLYSUSPEND
+#define register_early_suspend         register_pre_suspend
+#define unregister_early_suspend       unregister_pre_suspend
+#define early_suspend                          pre_suspend
+#define EARLY_SUSPEND_LEVEL_BLANK_SCREEN               50
+#else
+#if defined(CONFIG_HAS_EARLYSUSPEND) && defined(DHD_USE_EARLYSUSPEND)
+#include <linux/earlysuspend.h>
+#endif /* defined(CONFIG_HAS_EARLYSUSPEND) && defined(DHD_USE_EARLYSUSPEND) */
+#endif /* CONFIG_PARTIALSUSPEND_SLP */
+
+extern int dhd_get_suspend_bcn_li_dtim(dhd_pub_t *dhd);
+
+#ifdef PKT_FILTER_SUPPORT
+extern void dhd_pktfilter_offload_set(dhd_pub_t * dhd, char *arg);
+extern void dhd_pktfilter_offload_enable(dhd_pub_t * dhd, char *arg, int enable, int master_mode);
+extern void dhd_pktfilter_offload_delete(dhd_pub_t *dhd, int id);
+#endif
+
+
+
+
+
+
+#ifdef DHD_FW_COREDUMP
+static void dhd_mem_dump(void *dhd_info, void *event_info, u8 event);
+#endif /* DHD_FW_COREDUMP */
+#ifdef DHD_LOG_DUMP
+static void dhd_log_dump_init(dhd_pub_t *dhd);
+static void dhd_log_dump_deinit(dhd_pub_t *dhd);
+static void dhd_log_dump(void *handle, void *event_info, u8 event);
+void dhd_schedule_log_dump(dhd_pub_t *dhdp);
+static int do_dhd_log_dump(dhd_pub_t *dhdp);
+#endif /* DHD_LOG_DUMP */
+
+#ifdef DHD_DEBUG_UART
+#include <linux/kmod.h>
+#define DHD_DEBUG_UART_EXEC_PATH       "/system/bin/wldu"
+static void dhd_debug_uart_exec(char *cmd);
+#endif
+
+static int dhd_reboot_callback(struct notifier_block *this, unsigned long code, void *unused);
+static struct notifier_block dhd_reboot_notifier = {
+       .notifier_call = dhd_reboot_callback,
+       .priority = 1,
+};
+
+#ifdef BCMPCIE
+static int is_reboot = 0;
+#endif /* BCMPCIE */
+
+typedef struct dhd_if_event {
+       struct list_head        list;
+       wl_event_data_if_t      event;
+       char                    name[IFNAMSIZ+1];
+       uint8                   mac[ETHER_ADDR_LEN];
+} dhd_if_event_t;
+
+/* Interface control information */
+typedef struct dhd_if {
+       struct dhd_info *info;                  /* back pointer to dhd_info */
+       /* OS/stack specifics */
+       struct net_device *net;
+       int                             idx;                    /* iface idx in dongle */
+       uint                    subunit;                /* subunit */
+       uint8                   mac_addr[ETHER_ADDR_LEN];       /* assigned MAC address */
+       bool                    set_macaddress;
+       bool                    set_multicast;
+       uint8                   bssidx;                 /* bsscfg index for the interface */
+       bool                    attached;               /* Delayed attachment when unset */
+       bool                    txflowcontrol;  /* Per interface flow control indicator */
+       char                    name[IFNAMSIZ+1]; /* linux interface name */
+       char                    dngl_name[IFNAMSIZ+1]; /* corresponding dongle interface name */
+       struct net_device_stats stats;
+#ifdef DHD_WMF
+       dhd_wmf_t               wmf;            /* per bsscfg wmf setting */
+#endif /* DHD_WMF */
+#ifdef PCIE_FULL_DONGLE
+       struct list_head sta_list;              /* sll of associated stations */
+#if !defined(BCM_GMAC3)
+       spinlock_t      sta_list_lock;          /* lock for manipulating sll */
+#endif /* ! BCM_GMAC3 */
+#endif /* PCIE_FULL_DONGLE */
+       uint32  ap_isolate;                     /* ap-isolation settings */
+#ifdef DHD_L2_FILTER
+       bool parp_enable;
+       bool parp_discard;
+       bool parp_allnode;
+       arp_table_t *phnd_arp_table;
+/* for Per BSS modification */
+       bool dhcp_unicast;
+       bool block_ping;
+       bool grat_arp;
+#endif /* DHD_L2_FILTER */
+} dhd_if_t;
+
+#ifdef WLMEDIA_HTSF
+typedef struct {
+       uint32 low;
+       uint32 high;
+} tsf_t;
+
+typedef struct {
+       uint32 last_cycle;
+       uint32 last_sec;
+       uint32 last_tsf;
+       uint32 coef;     /* scaling factor */
+       uint32 coefdec1; /* first decimal  */
+       uint32 coefdec2; /* second decimal */
+} htsf_t;
+
+typedef struct {
+       uint32 t1;
+       uint32 t2;
+       uint32 t3;
+       uint32 t4;
+} tstamp_t;
+
+static tstamp_t ts[TSMAX];
+static tstamp_t maxdelayts;
+static uint32 maxdelay = 0, tspktcnt = 0, maxdelaypktno = 0;
+
+#endif  /* WLMEDIA_HTSF */
+
+struct ipv6_work_info_t {
+       uint8                   if_idx;
+       char                    ipv6_addr[16];
+       unsigned long           event;
+};
+
+#ifdef DHD_DEBUG
+typedef struct dhd_dump {
+       uint8 *buf;
+       int bufsize;
+} dhd_dump_t;
+#endif /* DHD_DEBUG */
+
+/* When Perimeter locks are deployed, any blocking calls must be preceeded
+ * with a PERIM UNLOCK and followed by a PERIM LOCK.
+ * Examples of blocking calls are: schedule_timeout(), down_interruptible(),
+ * wait_event_timeout().
+ */
+
+/* Local private structure (extension of pub) */
+typedef struct dhd_info {
+#if defined(WL_WIRELESS_EXT)
+       wl_iw_t         iw;             /* wireless extensions state (must be first) */
+#endif /* defined(WL_WIRELESS_EXT) */
+       dhd_pub_t pub;
+       dhd_if_t *iflist[DHD_MAX_IFS]; /* for supporting multiple interfaces */
+
+       void *adapter;                  /* adapter information, interrupt, fw path etc. */
+       char fw_path[PATH_MAX];         /* path to firmware image */
+       char nv_path[PATH_MAX];         /* path to nvram vars file */
+
+       /* serialize dhd iovars */
+       struct mutex dhd_iovar_mutex;
+
+       struct semaphore proto_sem;
+#ifdef PROP_TXSTATUS
+       spinlock_t      wlfc_spinlock;
+
+#endif /* PROP_TXSTATUS */
+#ifdef WLMEDIA_HTSF
+       htsf_t  htsf;
+#endif
+       wait_queue_head_t ioctl_resp_wait;
+       wait_queue_head_t d3ack_wait;
+       wait_queue_head_t dhd_bus_busy_state_wait;
+       uint32  default_wd_interval;
+
+       struct timer_list timer;
+       bool wd_timer_valid;
+#ifdef DHD_PCIE_RUNTIMEPM
+       struct timer_list rpm_timer;
+       bool rpm_timer_valid;
+       tsk_ctl_t         thr_rpm_ctl;
+#endif /* DHD_PCIE_RUNTIMEPM */
+       struct tasklet_struct tasklet;
+       spinlock_t      sdlock;
+       spinlock_t      txqlock;
+       spinlock_t      dhd_lock;
+
+       struct semaphore sdsem;
+       tsk_ctl_t       thr_dpc_ctl;
+       tsk_ctl_t       thr_wdt_ctl;
+
+       tsk_ctl_t       thr_rxf_ctl;
+       spinlock_t      rxf_lock;
+       bool            rxthread_enabled;
+
+       /* Wakelocks */
+#if defined(CONFIG_HAS_WAKELOCK) && (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+       struct wake_lock wl_wifi;   /* Wifi wakelock */
+       struct wake_lock wl_rxwake; /* Wifi rx wakelock */
+       struct wake_lock wl_ctrlwake; /* Wifi ctrl wakelock */
+       struct wake_lock wl_wdwake; /* Wifi wd wakelock */
+       struct wake_lock wl_evtwake; /* Wifi event wakelock */
+       struct wake_lock wl_pmwake;   /* Wifi pm handler wakelock */
+       struct wake_lock wl_txflwake; /* Wifi tx flow wakelock */
+#ifdef BCMPCIE_OOB_HOST_WAKE
+       struct wake_lock wl_intrwake; /* Host wakeup wakelock */
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+#ifdef DHD_USE_SCAN_WAKELOCK
+       struct wake_lock wl_scanwake;  /* Wifi scan wakelock */
+#endif /* DHD_USE_SCAN_WAKELOCK */
+#endif /* CONFIG_HAS_WAKELOCK && LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+       /* net_device interface lock, prevent race conditions among net_dev interface
+        * calls and wifi_on or wifi_off
+        */
+       struct mutex dhd_net_if_mutex;
+       struct mutex dhd_suspend_mutex;
+#endif
+       spinlock_t wakelock_spinlock;
+       spinlock_t wakelock_evt_spinlock;
+       uint32 wakelock_counter;
+       int wakelock_wd_counter;
+       int wakelock_rx_timeout_enable;
+       int wakelock_ctrl_timeout_enable;
+       bool waive_wakelock;
+       uint32 wakelock_before_waive;
+
+       /* Thread to issue ioctl for multicast */
+       wait_queue_head_t ctrl_wait;
+       atomic_t pend_8021x_cnt;
+       dhd_attach_states_t dhd_state;
+#ifdef SHOW_LOGTRACE
+       dhd_event_log_t event_data;
+#endif /* SHOW_LOGTRACE */
+
+#if defined(CONFIG_HAS_EARLYSUSPEND) && defined(DHD_USE_EARLYSUSPEND)
+       struct early_suspend early_suspend;
+#endif /* CONFIG_HAS_EARLYSUSPEND && DHD_USE_EARLYSUSPEND */
+
+#ifdef ARP_OFFLOAD_SUPPORT
+       u32 pend_ipaddr;
+#endif /* ARP_OFFLOAD_SUPPORT */
+#ifdef BCM_FD_AGGR
+       void *rpc_th;
+       void *rpc_osh;
+       struct timer_list rpcth_timer;
+       bool rpcth_timer_active;
+       uint8 fdaggr;
+#endif
+#ifdef DHDTCPACK_SUPPRESS
+       spinlock_t      tcpack_lock;
+#endif /* DHDTCPACK_SUPPRESS */
+#ifdef FIX_CPU_MIN_CLOCK
+       bool cpufreq_fix_status;
+       struct mutex cpufreq_fix;
+       struct pm_qos_request dhd_cpu_qos;
+#ifdef FIX_BUS_MIN_CLOCK
+       struct pm_qos_request dhd_bus_qos;
+#endif /* FIX_BUS_MIN_CLOCK */
+#endif /* FIX_CPU_MIN_CLOCK */
+       void                    *dhd_deferred_wq;
+#ifdef DEBUG_CPU_FREQ
+       struct notifier_block freq_trans;
+       int __percpu *new_freq;
+#endif
+       unsigned int unit;
+       struct notifier_block pm_notifier;
+#ifdef DHD_PSTA
+       uint32  psta_mode;      /* PSTA or PSR */
+#endif /* DHD_PSTA */
+#ifdef DHD_DEBUG
+       dhd_dump_t *dump;
+       struct timer_list join_timer;
+       u32 join_timeout_val;
+       bool join_timer_active;
+       uint scan_time_count;
+       struct timer_list scan_timer;
+       bool scan_timer_active;
+#endif
+#if defined(DHD_LB)
+       /* CPU Load Balance dynamic CPU selection */
+
+       /* Variable that tracks the currect CPUs available for candidacy */
+       cpumask_var_t cpumask_curr_avail;
+
+       /* Primary and secondary CPU mask */
+       cpumask_var_t cpumask_primary, cpumask_secondary; /* configuration */
+       cpumask_var_t cpumask_primary_new, cpumask_secondary_new; /* temp */
+
+       struct notifier_block cpu_notifier;
+
+       /* Tasklet to handle Tx Completion packet freeing */
+       struct tasklet_struct tx_compl_tasklet;
+       atomic_t        tx_compl_cpu;
+
+
+       /* Tasklet to handle RxBuf Post during Rx completion */
+       struct tasklet_struct rx_compl_tasklet;
+       atomic_t        rx_compl_cpu;
+
+       /* Napi struct for handling rx packet sendup. Packets are removed from
+        * H2D RxCompl ring and placed into rx_pend_queue. rx_pend_queue is then
+        * appended to rx_napi_queue (w/ lock) and the rx_napi_struct is scheduled
+        * to run to rx_napi_cpu.
+        */
+       struct sk_buff_head   rx_pend_queue  ____cacheline_aligned;
+       struct sk_buff_head   rx_napi_queue  ____cacheline_aligned;
+       struct napi_struct    rx_napi_struct ____cacheline_aligned;
+       atomic_t        rx_napi_cpu; /* cpu on which the napi is dispatched */
+       struct net_device    *rx_napi_netdev; /* netdev of primary interface */
+
+       struct work_struct    rx_napi_dispatcher_work;
+       struct work_struct    tx_compl_dispatcher_work;
+       struct work_struct    rx_compl_dispatcher_work;
+       /* Number of times DPC Tasklet ran */
+       uint32  dhd_dpc_cnt;
+
+       /* Number of times NAPI processing got scheduled */
+       uint32  napi_sched_cnt;
+
+       /* Number of times NAPI processing ran on each available core */
+       uint32  napi_percpu_run_cnt[NR_CPUS];
+
+       /* Number of times RX Completions got scheduled */
+       uint32  rxc_sched_cnt;
+       /* Number of times RX Completion ran on each available core */
+       uint32  rxc_percpu_run_cnt[NR_CPUS];
+
+       /* Number of times TX Completions got scheduled */
+       uint32  txc_sched_cnt;
+       /* Number of times TX Completions ran on each available core */
+       uint32  txc_percpu_run_cnt[NR_CPUS];
+
+       /* CPU status */
+       /* Number of times each CPU came online */
+       uint32  cpu_online_cnt[NR_CPUS];
+
+       /* Number of times each CPU went offline */
+       uint32  cpu_offline_cnt[NR_CPUS];
+
+       /*
+        * Consumer Histogram - NAPI RX Packet processing
+        * -----------------------------------------------
+        * On Each CPU, when the NAPI RX Packet processing call back was invoked
+        * how many packets were processed is captured in this data structure.
+        * Now its difficult to capture the "exact" number of packets processed.
+        * So considering the packet counter to be a 32 bit one, we have a
+        * bucket with 8 bins (2^1, 2^2 ... 2^8). The "number" of packets
+        * processed is rounded off to the next power of 2 and put in the
+        * approriate "bin" the value in the bin gets incremented.
+        * For example, assume that in CPU 1 if NAPI Rx runs 3 times
+        * and the packet count processed is as follows (assume the bin counters are 0)
+        * iteration 1 - 10 (the bin counter 2^4 increments to 1)
+        * iteration 2 - 30 (the bin counter 2^5 increments to 1)
+        * iteration 3 - 15 (the bin counter 2^4 increments by 1 to become 2)
+        */
+       uint32 napi_rx_hist[NR_CPUS][HIST_BIN_SIZE];
+       uint32 txc_hist[NR_CPUS][HIST_BIN_SIZE];
+       uint32 rxc_hist[NR_CPUS][HIST_BIN_SIZE];
+#endif /* DHD_LB */
+
+#if defined(BCM_DNGL_EMBEDIMAGE) || defined(BCM_REQUEST_FW)
+#endif /* defined(BCM_DNGL_EMBEDIMAGE) || defined(BCM_REQUEST_FW) */
+
+       struct kobject dhd_kobj;
+
+       uint32 shub_enable;
+
+       struct delayed_work dhd_memdump_work;
+} dhd_info_t;
+
+#define DHDIF_FWDER(dhdif)      FALSE
+
+/* Flag to indicate if we should download firmware on driver load */
+uint dhd_download_fw_on_driverload = TRUE;
+
+/* Flag to indicate if driver is initialized */
+uint dhd_driver_init_done = FALSE;
+
+/* Definitions to provide path to the firmware and nvram
+ * example nvram_path[MOD_PARAM_PATHLEN]="/projects/wlan/nvram.txt"
+ */
+char firmware_path[MOD_PARAM_PATHLEN];
+char nvram_path[MOD_PARAM_PATHLEN];
+char clm_path[MOD_PARAM_PATHLEN];
+
+module_param_string(clm_path, clm_path, MOD_PARAM_PATHLEN, 0660);
+
+/* backup buffer for firmware and nvram path */
+char fw_bak_path[MOD_PARAM_PATHLEN];
+char nv_bak_path[MOD_PARAM_PATHLEN];
+
+/* information string to keep firmware, chio, cheip version info visiable from log */
+char info_string[MOD_PARAM_INFOLEN];
+module_param_string(info_string, info_string, MOD_PARAM_INFOLEN, 0444);
+int op_mode = 0;
+int disable_proptx = 0;
+module_param(op_mode, int, 0644);
+
+#if defined(DHD_LB_RXP)
+static int dhd_napi_weight = 32;
+module_param(dhd_napi_weight, int, 0644);
+#endif /* DHD_LB_RXP */
+
+extern int wl_control_wl_start(struct net_device *dev);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined(BCMLXSDMMC)
+struct semaphore dhd_registration_sem;
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) */
+
+/* deferred handlers */
+static void dhd_ifadd_event_handler(void *handle, void *event_info, u8 event);
+static void dhd_ifdel_event_handler(void *handle, void *event_info, u8 event);
+static void dhd_set_mac_addr_handler(void *handle, void *event_info, u8 event);
+static void dhd_set_mcast_list_handler(void *handle, void *event_info, u8 event);
+#if defined(CONFIG_IPV6) && defined(IPV6_NDO_SUPPORT)
+static void dhd_inet6_work_handler(void *dhd_info, void *event_data, u8 event);
+#endif /* CONFIG_IPV6 && IPV6_NDO_SUPPORT */
+#ifdef WL_CFG80211
+extern void dhd_netdev_free(struct net_device *ndev);
+#endif /* WL_CFG80211 */
+
+/* Error bits */
+module_param(dhd_msg_level, int, 0);
+
+#ifdef ARP_OFFLOAD_SUPPORT
+/* ARP offload enable */
+uint dhd_arp_enable = TRUE;
+module_param(dhd_arp_enable, uint, 0);
+
+/* ARP offload agent mode : Enable ARP Host Auto-Reply and ARP Peer Auto-Reply */
+
+#ifdef ENABLE_ARP_SNOOP_MODE
+uint dhd_arp_mode = ARP_OL_AGENT | ARP_OL_PEER_AUTO_REPLY | ARP_OL_SNOOP;
+#else
+uint dhd_arp_mode = ARP_OL_AGENT | ARP_OL_PEER_AUTO_REPLY;
+#endif /* ENABLE_ARP_SNOOP_MODE */
+
+module_param(dhd_arp_mode, uint, 0);
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+/* Disable Prop tx */
+module_param(disable_proptx, int, 0644);
+/* load firmware and/or nvram values from the filesystem */
+module_param_string(firmware_path, firmware_path, MOD_PARAM_PATHLEN, 0660);
+module_param_string(nvram_path, nvram_path, MOD_PARAM_PATHLEN, 0660);
+
+/* Watchdog interval */
+
+/* extend watchdog expiration to 2 seconds when DPC is running */
+#define WATCHDOG_EXTEND_INTERVAL (2000)
+
+uint dhd_watchdog_ms = CUSTOM_DHD_WATCHDOG_MS;
+module_param(dhd_watchdog_ms, uint, 0);
+
+#ifdef DHD_PCIE_RUNTIMEPM
+uint dhd_runtimepm_ms = CUSTOM_DHD_RUNTIME_MS;
+#endif /* DHD_PCIE_RUNTIMEPMT */
+#if defined(DHD_DEBUG)
+/* Console poll interval */
+uint dhd_console_ms = 0;
+module_param(dhd_console_ms, uint, 0644);
+#endif /* defined(DHD_DEBUG) */
+
+
+uint dhd_slpauto = TRUE;
+module_param(dhd_slpauto, uint, 0);
+
+#ifdef PKT_FILTER_SUPPORT
+/* Global Pkt filter enable control */
+uint dhd_pkt_filter_enable = TRUE;
+module_param(dhd_pkt_filter_enable, uint, 0);
+#endif
+
+/* Pkt filter init setup */
+uint dhd_pkt_filter_init = 0;
+module_param(dhd_pkt_filter_init, uint, 0);
+
+/* Pkt filter mode control */
+#ifdef GAN_LITE_NAT_KEEPALIVE_FILTER
+uint dhd_master_mode = FALSE;
+#else
+uint dhd_master_mode = TRUE;
+#endif /* GAN_LITE_NAT_KEEPALIVE_FILTER */
+module_param(dhd_master_mode, uint, 0);
+
+int dhd_watchdog_prio = 0;
+module_param(dhd_watchdog_prio, int, 0);
+
+/* DPC thread priority */
+int dhd_dpc_prio = CUSTOM_DPC_PRIO_SETTING;
+module_param(dhd_dpc_prio, int, 0);
+
+/* RX frame thread priority */
+int dhd_rxf_prio = CUSTOM_RXF_PRIO_SETTING;
+module_param(dhd_rxf_prio, int, 0);
+
+int passive_channel_skip = 0;
+module_param(passive_channel_skip, int, (S_IRUSR|S_IWUSR));
+
+#if !defined(BCMDHDUSB)
+extern int dhd_dongle_ramsize;
+module_param(dhd_dongle_ramsize, int, 0);
+#endif /* BCMDHDUSB */
+
+/* Keep track of number of instances */
+static int dhd_found = 0;
+static int instance_base = 0; /* Starting instance number */
+module_param(instance_base, int, 0644);
+
+/* Takes value of LL of OTP param customvar2=0xKKLLMMNN.
+ * LL is module variant
+ */
+uint32 hw_module_variant = 0;
+module_param(hw_module_variant, uint, 0644);
+
+/* Functions to manage sysfs interface for dhd */
+static int dhd_sysfs_init(dhd_info_t *dhd);
+static void dhd_sysfs_exit(dhd_info_t *dhd);
+
+#if defined(DHD_LB)
+
+static void
+dhd_lb_set_default_cpus(dhd_info_t *dhd)
+{
+       /* Default CPU allocation for the jobs */
+       atomic_set(&dhd->rx_napi_cpu, 1);
+       atomic_set(&dhd->rx_compl_cpu, 2);
+       atomic_set(&dhd->tx_compl_cpu, 2);
+}
+
+static void
+dhd_cpumasks_deinit(dhd_info_t *dhd)
+{
+       free_cpumask_var(dhd->cpumask_curr_avail);
+       free_cpumask_var(dhd->cpumask_primary);
+       free_cpumask_var(dhd->cpumask_primary_new);
+       free_cpumask_var(dhd->cpumask_secondary);
+       free_cpumask_var(dhd->cpumask_secondary_new);
+}
+
+static int
+dhd_cpumasks_init(dhd_info_t *dhd)
+{
+       int id;
+       uint32 cpus;
+       int ret = 0;
+
+       if (!alloc_cpumask_var(&dhd->cpumask_curr_avail, GFP_KERNEL) ||
+               !alloc_cpumask_var(&dhd->cpumask_primary, GFP_KERNEL) ||
+               !alloc_cpumask_var(&dhd->cpumask_primary_new, GFP_KERNEL) ||
+               !alloc_cpumask_var(&dhd->cpumask_secondary, GFP_KERNEL) ||
+               !alloc_cpumask_var(&dhd->cpumask_secondary_new, GFP_KERNEL)) {
+               DHD_ERROR(("%s Failed to init cpumasks\n", __FUNCTION__));
+               ret = -ENOMEM;
+               goto fail;
+       }
+
+       cpumask_copy(dhd->cpumask_curr_avail, cpu_online_mask);
+       cpumask_clear(dhd->cpumask_primary);
+       cpumask_clear(dhd->cpumask_secondary);
+
+       cpus = DHD_LB_PRIMARY_CPUS;
+       for (id = 0; id < NR_CPUS; id++) {
+               if (isset(&cpus, id))
+                       cpumask_set_cpu(id, dhd->cpumask_primary);
+       }
+
+       cpus = DHD_LB_SECONDARY_CPUS;
+       for (id = 0; id < NR_CPUS; id++) {
+               if (isset(&cpus, id))
+                       cpumask_set_cpu(id, dhd->cpumask_secondary);
+       }
+
+       return ret;
+fail:
+       dhd_cpumasks_deinit(dhd);
+       return ret;
+}
+
+/*
+ * The CPU Candidacy Algorithm
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ * The available CPUs for selection are divided into two groups
+ *  Primary Set - A CPU mask that carries the First Choice CPUs
+ *  Secondary Set - A CPU mask that carries the Second Choice CPUs.
+ *
+ * There are two types of Job, that needs to be assigned to
+ * the CPUs, from one of the above mentioned CPU group. The Jobs are
+ * 1) Rx Packet Processing - napi_cpu
+ * 2) Completion Processiong (Tx, RX) - compl_cpu
+ *
+ * To begin with both napi_cpu and compl_cpu are on CPU0. Whenever a CPU goes
+ * on-line/off-line the CPU candidacy algorithm is triggerd. The candidacy
+ * algo tries to pickup the first available non boot CPU (CPU0) for napi_cpu.
+ * If there are more processors free, it assigns one to compl_cpu.
+ * It also tries to ensure that both napi_cpu and compl_cpu are not on the same
+ * CPU, as much as possible.
+ *
+ * By design, both Tx and Rx completion jobs are run on the same CPU core, as it
+ * would allow Tx completion skb's to be released into a local free pool from
+ * which the rx buffer posts could have been serviced. it is important to note
+ * that a Tx packet may not have a large enough buffer for rx posting.
+ */
+void dhd_select_cpu_candidacy(dhd_info_t *dhd)
+{
+       uint32 primary_available_cpus; /* count of primary available cpus */
+       uint32 secondary_available_cpus; /* count of secondary available cpus */
+       uint32 napi_cpu = 0; /* cpu selected for napi rx processing */
+       uint32 compl_cpu = 0; /* cpu selected for completion jobs */
+
+       cpumask_clear(dhd->cpumask_primary_new);
+       cpumask_clear(dhd->cpumask_secondary_new);
+
+       /*
+        * Now select from the primary mask. Even if a Job is
+        * already running on a CPU in secondary group, we still move
+        * to primary CPU. So no conditional checks.
+        */
+       cpumask_and(dhd->cpumask_primary_new, dhd->cpumask_primary,
+               dhd->cpumask_curr_avail);
+
+       cpumask_and(dhd->cpumask_secondary_new, dhd->cpumask_secondary,
+               dhd->cpumask_curr_avail);
+
+       primary_available_cpus = cpumask_weight(dhd->cpumask_primary_new);
+
+       if (primary_available_cpus > 0) {
+               napi_cpu = cpumask_first(dhd->cpumask_primary_new);
+
+               /* If no further CPU is available,
+                * cpumask_next returns >= nr_cpu_ids
+                */
+               compl_cpu = cpumask_next(napi_cpu, dhd->cpumask_primary_new);
+               if (compl_cpu >= nr_cpu_ids)
+                       compl_cpu = 0;
+       }
+
+       DHD_INFO(("%s After primary CPU check napi_cpu %d compl_cpu %d\n",
+               __FUNCTION__, napi_cpu, compl_cpu));
+
+       /* -- Now check for the CPUs from the secondary mask -- */
+       secondary_available_cpus = cpumask_weight(dhd->cpumask_secondary_new);
+
+       DHD_INFO(("%s Available secondary cpus %d nr_cpu_ids %d\n",
+               __FUNCTION__, secondary_available_cpus, nr_cpu_ids));
+
+       if (secondary_available_cpus > 0) {
+               /* At this point if napi_cpu is unassigned it means no CPU
+                * is online from Primary Group
+                */
+               if (napi_cpu == 0) {
+                       napi_cpu = cpumask_first(dhd->cpumask_secondary_new);
+                       compl_cpu = cpumask_next(napi_cpu, dhd->cpumask_secondary_new);
+               } else if (compl_cpu == 0) {
+                       compl_cpu = cpumask_first(dhd->cpumask_secondary_new);
+               }
+
+               /* If no CPU was available for completion, choose CPU 0 */
+               if (compl_cpu >= nr_cpu_ids)
+                       compl_cpu = 0;
+       }
+       if ((primary_available_cpus == 0) &&
+               (secondary_available_cpus == 0)) {
+               /* No CPUs available from primary or secondary mask */
+               napi_cpu = 0;
+               compl_cpu = 0;
+       }
+
+       DHD_INFO(("%s After secondary CPU check napi_cpu %d compl_cpu %d\n",
+               __FUNCTION__, napi_cpu, compl_cpu));
+       ASSERT(napi_cpu < nr_cpu_ids);
+       ASSERT(compl_cpu < nr_cpu_ids);
+
+       atomic_set(&dhd->rx_napi_cpu, napi_cpu);
+       atomic_set(&dhd->tx_compl_cpu, compl_cpu);
+       atomic_set(&dhd->rx_compl_cpu, compl_cpu);
+       return;
+}
+
+/*
+ * Function to handle CPU Hotplug notifications.
+ * One of the task it does is to trigger the CPU Candidacy algorithm
+ * for load balancing.
+ */
+int
+dhd_cpu_callback(struct notifier_block *nfb, unsigned long action, void *hcpu)
+{
+       unsigned int cpu = (unsigned int)(long)hcpu;
+
+       dhd_info_t *dhd = container_of(nfb, dhd_info_t, cpu_notifier);
+
+       switch (action)
+       {
+               case CPU_ONLINE:
+                       DHD_LB_STATS_INCR(dhd->cpu_online_cnt[cpu]);
+                       cpumask_set_cpu(cpu, dhd->cpumask_curr_avail);
+                       dhd_select_cpu_candidacy(dhd);
+                       break;
+
+               case CPU_DOWN_PREPARE:
+               case CPU_DOWN_PREPARE_FROZEN:
+                       DHD_LB_STATS_INCR(dhd->cpu_offline_cnt[cpu]);
+                       cpumask_clear_cpu(cpu, dhd->cpumask_curr_avail);
+                       dhd_select_cpu_candidacy(dhd);
+                       break;
+               default:
+                       break;
+       }
+
+       return NOTIFY_OK;
+}
+
+#if defined(DHD_LB_STATS)
+void dhd_lb_stats_init(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd;
+       int i, j;
+
+       if (dhdp == NULL) {
+               DHD_ERROR(("%s(): Invalid argument dhdp is NULL \n",
+                       __FUNCTION__));
+               return;
+       }
+
+       dhd = dhdp->info;
+       if (dhd == NULL) {
+               DHD_ERROR(("%s(): DHD pointer is NULL \n", __FUNCTION__));
+               return;
+       }
+
+       DHD_LB_STATS_CLR(dhd->dhd_dpc_cnt);
+       DHD_LB_STATS_CLR(dhd->napi_sched_cnt);
+       DHD_LB_STATS_CLR(dhd->rxc_sched_cnt);
+       DHD_LB_STATS_CLR(dhd->txc_sched_cnt);
+
+       for (i = 0; i < NR_CPUS; i++) {
+               DHD_LB_STATS_CLR(dhd->napi_percpu_run_cnt[i]);
+               DHD_LB_STATS_CLR(dhd->rxc_percpu_run_cnt[i]);
+               DHD_LB_STATS_CLR(dhd->txc_percpu_run_cnt[i]);
+
+               DHD_LB_STATS_CLR(dhd->cpu_online_cnt[i]);
+               DHD_LB_STATS_CLR(dhd->cpu_offline_cnt[i]);
+       }
+
+       for (i = 0; i < NR_CPUS; i++) {
+               for (j = 0; j < HIST_BIN_SIZE; j++) {
+                       DHD_LB_STATS_CLR(dhd->napi_rx_hist[i][j]);
+                       DHD_LB_STATS_CLR(dhd->txc_hist[i][j]);
+                       DHD_LB_STATS_CLR(dhd->rxc_hist[i][j]);
+               }
+       }
+
+       return;
+}
+
+static void dhd_lb_stats_dump_histo(
+       struct bcmstrbuf *strbuf, uint32 (*hist)[HIST_BIN_SIZE])
+{
+       int i, j;
+       uint32 per_cpu_total[NR_CPUS] = {0};
+       uint32 total = 0;
+
+       bcm_bprintf(strbuf, "CPU: \t\t");
+       for (i = 0; i < num_possible_cpus(); i++)
+               bcm_bprintf(strbuf, "%d\t", i);
+       bcm_bprintf(strbuf, "\nBin\n");
+
+       for (i = 0; i < HIST_BIN_SIZE; i++) {
+               bcm_bprintf(strbuf, "%d:\t\t", 1<<(i+1));
+               for (j = 0; j < num_possible_cpus(); j++) {
+                       bcm_bprintf(strbuf, "%d\t", hist[j][i]);
+               }
+               bcm_bprintf(strbuf, "\n");
+       }
+       bcm_bprintf(strbuf, "Per CPU Total \t");
+       total = 0;
+       for (i = 0; i < num_possible_cpus(); i++) {
+               for (j = 0; j < HIST_BIN_SIZE; j++) {
+                       per_cpu_total[i] += (hist[i][j] * (1<<(j+1)));
+               }
+               bcm_bprintf(strbuf, "%d\t", per_cpu_total[i]);
+               total += per_cpu_total[i];
+       }
+       bcm_bprintf(strbuf, "\nTotal\t\t%d \n", total);
+
+       return;
+}
+
+static inline void dhd_lb_stats_dump_cpu_array(struct bcmstrbuf *strbuf, uint32 *p)
+{
+       int i;
+
+       bcm_bprintf(strbuf, "CPU: \t");
+       for (i = 0; i < num_possible_cpus(); i++)
+               bcm_bprintf(strbuf, "%d\t", i);
+       bcm_bprintf(strbuf, "\n");
+
+       bcm_bprintf(strbuf, "Val: \t");
+       for (i = 0; i < num_possible_cpus(); i++)
+               bcm_bprintf(strbuf, "%u\t", *(p+i));
+       bcm_bprintf(strbuf, "\n");
+       return;
+}
+
+void dhd_lb_stats_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf)
+{
+       dhd_info_t *dhd;
+
+       if (dhdp == NULL || strbuf == NULL) {
+               DHD_ERROR(("%s(): Invalid argument dhdp %p strbuf %p \n",
+                       __FUNCTION__, dhdp, strbuf));
+               return;
+       }
+
+       dhd = dhdp->info;
+       if (dhd == NULL) {
+               DHD_ERROR(("%s(): DHD pointer is NULL \n", __FUNCTION__));
+               return;
+       }
+
+       bcm_bprintf(strbuf, "\ncpu_online_cnt:\n");
+       dhd_lb_stats_dump_cpu_array(strbuf, dhd->cpu_online_cnt);
+
+       bcm_bprintf(strbuf, "cpu_offline_cnt:\n");
+       dhd_lb_stats_dump_cpu_array(strbuf, dhd->cpu_offline_cnt);
+
+       bcm_bprintf(strbuf, "\nsched_cnt: dhd_dpc %u napi %u rxc %u txc %u\n",
+               dhd->dhd_dpc_cnt, dhd->napi_sched_cnt, dhd->rxc_sched_cnt,
+               dhd->txc_sched_cnt);
+#ifdef DHD_LB_RXP
+       bcm_bprintf(strbuf, "napi_percpu_run_cnt:\n");
+       dhd_lb_stats_dump_cpu_array(strbuf, dhd->napi_percpu_run_cnt);
+       bcm_bprintf(strbuf, "\nNAPI Packets Received Histogram:\n");
+       dhd_lb_stats_dump_histo(strbuf, dhd->napi_rx_hist);
+#endif /* DHD_LB_RXP */
+
+#ifdef DHD_LB_RXC
+       bcm_bprintf(strbuf, "rxc_percpu_run_cnt:\n");
+       dhd_lb_stats_dump_cpu_array(strbuf, dhd->rxc_percpu_run_cnt);
+       bcm_bprintf(strbuf, "\nRX Completions (Buffer Post) Histogram:\n");
+       dhd_lb_stats_dump_histo(strbuf, dhd->rxc_hist);
+#endif /* DHD_LB_RXC */
+
+
+#ifdef DHD_LB_TXC
+       bcm_bprintf(strbuf, "txc_percpu_run_cnt:\n");
+       dhd_lb_stats_dump_cpu_array(strbuf, dhd->txc_percpu_run_cnt);
+       bcm_bprintf(strbuf, "\nTX Completions (Buffer Free) Histogram:\n");
+       dhd_lb_stats_dump_histo(strbuf, dhd->txc_hist);
+#endif /* DHD_LB_TXC */
+}
+
+static void dhd_lb_stats_update_histo(uint32 *bin, uint32 count)
+{
+       uint32 bin_power;
+       uint32 *p = NULL;
+
+       bin_power = next_larger_power2(count);
+
+       switch (bin_power) {
+               case   0: break;
+               case   1: /* Fall through intentionally */
+               case   2: p = bin + 0; break;
+               case   4: p = bin + 1; break;
+               case   8: p = bin + 2; break;
+               case  16: p = bin + 3; break;
+               case  32: p = bin + 4; break;
+               case  64: p = bin + 5; break;
+               case 128: p = bin + 6; break;
+               default : p = bin + 7; break;
+       }
+       if (p)
+               *p = *p + 1;
+       return;
+}
+
+extern void dhd_lb_stats_update_napi_histo(dhd_pub_t *dhdp, uint32 count)
+{
+       int cpu;
+       dhd_info_t *dhd = dhdp->info;
+
+       cpu = get_cpu();
+       put_cpu();
+       dhd_lb_stats_update_histo(&dhd->napi_rx_hist[cpu][0], count);
+
+       return;
+}
+
+extern void dhd_lb_stats_update_txc_histo(dhd_pub_t *dhdp, uint32 count)
+{
+       int cpu;
+       dhd_info_t *dhd = dhdp->info;
+
+       cpu = get_cpu();
+       put_cpu();
+       dhd_lb_stats_update_histo(&dhd->txc_hist[cpu][0], count);
+
+       return;
+}
+
+extern void dhd_lb_stats_update_rxc_histo(dhd_pub_t *dhdp, uint32 count)
+{
+       int cpu;
+       dhd_info_t *dhd = dhdp->info;
+
+       cpu = get_cpu();
+       put_cpu();
+       dhd_lb_stats_update_histo(&dhd->rxc_hist[cpu][0], count);
+
+       return;
+}
+
+extern void dhd_lb_stats_txc_percpu_cnt_incr(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd = dhdp->info;
+       DHD_LB_STATS_PERCPU_ARR_INCR(dhd->txc_percpu_run_cnt);
+}
+
+extern void dhd_lb_stats_rxc_percpu_cnt_incr(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd = dhdp->info;
+       DHD_LB_STATS_PERCPU_ARR_INCR(dhd->rxc_percpu_run_cnt);
+}
+
+#endif /* DHD_LB_STATS */
+#endif /* DHD_LB */
+
+
+#if defined(DISABLE_FRAMEBURST_VSDB) && defined(USE_WFA_CERT_CONF)
+int g_frameburst = 1;
+#endif /* DISABLE_FRAMEBURST_VSDB && USE_WFA_CERT_CONF */
+
+static int dhd_get_pend_8021x_cnt(dhd_info_t *dhd);
+
+/* DHD Perimiter lock only used in router with bypass forwarding. */
+#define DHD_PERIM_RADIO_INIT()              do { /* noop */ } while (0)
+#define DHD_PERIM_LOCK_TRY(unit, flag)      do { /* noop */ } while (0)
+#define DHD_PERIM_UNLOCK_TRY(unit, flag)    do { /* noop */ } while (0)
+
+#ifdef PCIE_FULL_DONGLE
+#if defined(BCM_GMAC3)
+#define DHD_IF_STA_LIST_LOCK_INIT(ifp)      do { /* noop */ } while (0)
+#define DHD_IF_STA_LIST_LOCK(ifp, flags)    ({ BCM_REFERENCE(flags); })
+#define DHD_IF_STA_LIST_UNLOCK(ifp, flags)  ({ BCM_REFERENCE(flags); })
+
+#if defined(DHD_IGMP_UCQUERY) || defined(DHD_UCAST_UPNP)
+#define DHD_IF_WMF_UCFORWARD_LOCK(dhd, ifp, slist) ({ BCM_REFERENCE(slist); &(ifp)->sta_list; })
+#define DHD_IF_WMF_UCFORWARD_UNLOCK(dhd, slist) ({ BCM_REFERENCE(slist); })
+#endif /* DHD_IGMP_UCQUERY || DHD_UCAST_UPNP */
+
+#else /* ! BCM_GMAC3 */
+#define DHD_IF_STA_LIST_LOCK_INIT(ifp) spin_lock_init(&(ifp)->sta_list_lock)
+#define DHD_IF_STA_LIST_LOCK(ifp, flags) \
+       spin_lock_irqsave(&(ifp)->sta_list_lock, (flags))
+#define DHD_IF_STA_LIST_UNLOCK(ifp, flags) \
+       spin_unlock_irqrestore(&(ifp)->sta_list_lock, (flags))
+
+#if defined(DHD_IGMP_UCQUERY) || defined(DHD_UCAST_UPNP)
+static struct list_head * dhd_sta_list_snapshot(dhd_info_t *dhd, dhd_if_t *ifp,
+       struct list_head *snapshot_list);
+static void dhd_sta_list_snapshot_free(dhd_info_t *dhd, struct list_head *snapshot_list);
+#define DHD_IF_WMF_UCFORWARD_LOCK(dhd, ifp, slist) ({ dhd_sta_list_snapshot(dhd, ifp, slist); })
+#define DHD_IF_WMF_UCFORWARD_UNLOCK(dhd, slist) ({ dhd_sta_list_snapshot_free(dhd, slist); })
+#endif /* DHD_IGMP_UCQUERY || DHD_UCAST_UPNP */
+
+#endif /* ! BCM_GMAC3 */
+#endif /* PCIE_FULL_DONGLE */
+
+/* Control fw roaming */
+uint dhd_roam_disable = 0;
+
+#ifdef BCMDBGFS
+extern int dhd_dbg_init(dhd_pub_t *dhdp);
+extern void dhd_dbg_remove(void);
+#endif
+
+/* Control radio state */
+uint dhd_radio_up = 1;
+
+/* Network inteface name */
+char iface_name[IFNAMSIZ] = {'\0'};
+module_param_string(iface_name, iface_name, IFNAMSIZ, 0);
+
+/* The following are specific to the SDIO dongle */
+
+/* IOCTL response timeout */
+int dhd_ioctl_timeout_msec = IOCTL_RESP_TIMEOUT;
+
+/* Idle timeout for backplane clock */
+int dhd_idletime = DHD_IDLETIME_TICKS;
+module_param(dhd_idletime, int, 0);
+
+/* Use polling */
+uint dhd_poll = FALSE;
+module_param(dhd_poll, uint, 0);
+
+/* Use interrupts */
+uint dhd_intr = TRUE;
+module_param(dhd_intr, uint, 0);
+
+/* SDIO Drive Strength (in milliamps) */
+uint dhd_sdiod_drive_strength = 6;
+module_param(dhd_sdiod_drive_strength, uint, 0);
+
+#ifdef BCMSDIO
+/* Tx/Rx bounds */
+extern uint dhd_txbound;
+extern uint dhd_rxbound;
+module_param(dhd_txbound, uint, 0);
+module_param(dhd_rxbound, uint, 0);
+
+/* Deferred transmits */
+extern uint dhd_deferred_tx;
+module_param(dhd_deferred_tx, uint, 0);
+
+#endif /* BCMSDIO */
+
+
+#ifdef SDTEST
+/* Echo packet generator (pkts/s) */
+uint dhd_pktgen = 0;
+module_param(dhd_pktgen, uint, 0);
+
+/* Echo packet len (0 => sawtooth, max 2040) */
+uint dhd_pktgen_len = 0;
+module_param(dhd_pktgen_len, uint, 0);
+#endif /* SDTEST */
+
+
+
+/* Allow delayed firmware download for debug purpose */
+int allow_delay_fwdl = FALSE;
+module_param(allow_delay_fwdl, int, 0);
+
+extern char dhd_version[];
+extern char fw_version[];
+extern char clm_version[];
+
+int dhd_net_bus_devreset(struct net_device *dev, uint8 flag);
+static void dhd_net_if_lock_local(dhd_info_t *dhd);
+static void dhd_net_if_unlock_local(dhd_info_t *dhd);
+static void dhd_suspend_lock(dhd_pub_t *dhdp);
+static void dhd_suspend_unlock(dhd_pub_t *dhdp);
+
+#ifdef WLMEDIA_HTSF
+void htsf_update(dhd_info_t *dhd, void *data);
+tsf_t prev_tsf, cur_tsf;
+
+uint32 dhd_get_htsf(dhd_info_t *dhd, int ifidx);
+static int dhd_ioctl_htsf_get(dhd_info_t *dhd, int ifidx);
+static void dhd_dump_latency(void);
+static void dhd_htsf_addtxts(dhd_pub_t *dhdp, void *pktbuf);
+static void dhd_htsf_addrxts(dhd_pub_t *dhdp, void *pktbuf);
+static void dhd_dump_htsfhisto(histo_t *his, char *s);
+#endif /* WLMEDIA_HTSF */
+
+/* Monitor interface */
+int dhd_monitor_init(void *dhd_pub);
+int dhd_monitor_uninit(void);
+
+
+#if defined(WL_WIRELESS_EXT)
+struct iw_statistics *dhd_get_wireless_stats(struct net_device *dev);
+#endif /* defined(WL_WIRELESS_EXT) */
+
+static void dhd_dpc(ulong data);
+/* forward decl */
+extern int dhd_wait_pend8021x(struct net_device *dev);
+void dhd_os_wd_timer_extend(void *bus, bool extend);
+
+#ifdef TOE
+#ifndef BDC
+#error TOE requires BDC
+#endif /* !BDC */
+static int dhd_toe_get(dhd_info_t *dhd, int idx, uint32 *toe_ol);
+static int dhd_toe_set(dhd_info_t *dhd, int idx, uint32 toe_ol);
+#endif /* TOE */
+
+static int dhd_wl_host_event(dhd_info_t *dhd, int *ifidx, void *pktdata, size_t pktlen,
+                             wl_event_msg_t *event_ptr, void **data_ptr);
+
+#if defined(CONFIG_PM_SLEEP)
+static int dhd_pm_callback(struct notifier_block *nfb, unsigned long action, void *ignored)
+{
+       int ret = NOTIFY_DONE;
+       bool suspend = FALSE;
+       dhd_info_t *dhdinfo = (dhd_info_t*)container_of(nfb, struct dhd_info, pm_notifier);
+
+       BCM_REFERENCE(dhdinfo);
+       BCM_REFERENCE(suspend);
+
+       switch (action) {
+       case PM_HIBERNATION_PREPARE:
+       case PM_SUSPEND_PREPARE:
+               suspend = TRUE;
+               break;
+
+       case PM_POST_HIBERNATION:
+       case PM_POST_SUSPEND:
+               suspend = FALSE;
+               break;
+       }
+
+#if defined(SUPPORT_P2P_GO_PS) && defined(PROP_TXSTATUS)
+       if (suspend) {
+               DHD_OS_WAKE_LOCK_WAIVE(&dhdinfo->pub);
+               dhd_wlfc_suspend(&dhdinfo->pub);
+               DHD_OS_WAKE_LOCK_RESTORE(&dhdinfo->pub);
+       } else {
+               dhd_wlfc_resume(&dhdinfo->pub);
+       }
+#endif /* defined(SUPPORT_P2P_GO_PS) && defined(PROP_TXSTATUS) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && (LINUX_VERSION_CODE <= \
+       KERNEL_VERSION(2, 6, 39))
+       dhd_mmc_suspend = suspend;
+       smp_mb();
+#endif
+
+       return ret;
+}
+
+/* to make sure we won't register the same notifier twice, otherwise a loop is likely to be
+ * created in kernel notifier link list (with 'next' pointing to itself)
+ */
+static bool dhd_pm_notifier_registered = FALSE;
+
+extern int register_pm_notifier(struct notifier_block *nb);
+extern int unregister_pm_notifier(struct notifier_block *nb);
+#endif /* CONFIG_PM_SLEEP */
+
+/* Request scheduling of the bus rx frame */
+static void dhd_sched_rxf(dhd_pub_t *dhdp, void *skb);
+static void dhd_os_rxflock(dhd_pub_t *pub);
+static void dhd_os_rxfunlock(dhd_pub_t *pub);
+
+/** priv_link is the link between netdev and the dhdif and dhd_info structs. */
+typedef struct dhd_dev_priv {
+       dhd_info_t * dhd; /* cached pointer to dhd_info in netdevice priv */
+       dhd_if_t   * ifp; /* cached pointer to dhd_if in netdevice priv */
+       int          ifidx; /* interface index */
+} dhd_dev_priv_t;
+
+#define DHD_DEV_PRIV_SIZE       (sizeof(dhd_dev_priv_t))
+#define DHD_DEV_PRIV(dev)       ((dhd_dev_priv_t *)DEV_PRIV(dev))
+#define DHD_DEV_INFO(dev)       (((dhd_dev_priv_t *)DEV_PRIV(dev))->dhd)
+#define DHD_DEV_IFP(dev)        (((dhd_dev_priv_t *)DEV_PRIV(dev))->ifp)
+#define DHD_DEV_IFIDX(dev)      (((dhd_dev_priv_t *)DEV_PRIV(dev))->ifidx)
+
+/** Clear the dhd net_device's private structure. */
+static inline void
+dhd_dev_priv_clear(struct net_device * dev)
+{
+       dhd_dev_priv_t * dev_priv;
+       ASSERT(dev != (struct net_device *)NULL);
+       dev_priv = DHD_DEV_PRIV(dev);
+       dev_priv->dhd = (dhd_info_t *)NULL;
+       dev_priv->ifp = (dhd_if_t *)NULL;
+       dev_priv->ifidx = DHD_BAD_IF;
+}
+
+/** Setup the dhd net_device's private structure. */
+static inline void
+dhd_dev_priv_save(struct net_device * dev, dhd_info_t * dhd, dhd_if_t * ifp,
+                  int ifidx)
+{
+       dhd_dev_priv_t * dev_priv;
+       ASSERT(dev != (struct net_device *)NULL);
+       dev_priv = DHD_DEV_PRIV(dev);
+       dev_priv->dhd = dhd;
+       dev_priv->ifp = ifp;
+       dev_priv->ifidx = ifidx;
+}
+
+#ifdef PCIE_FULL_DONGLE
+
+/** Dummy objects are defined with state representing bad|down.
+ * Performance gains from reducing branch conditionals, instruction parallelism,
+ * dual issue, reducing load shadows, avail of larger pipelines.
+ * Use DHD_XXX_NULL instead of (dhd_xxx_t *)NULL, whenever an object pointer
+ * is accessed via the dhd_sta_t.
+ */
+
+/* Dummy dhd_info object */
+dhd_info_t dhd_info_null = {
+#if defined(BCM_GMAC3)
+       .fwdh = FWDER_NULL,
+#endif
+       .pub = {
+                .info = &dhd_info_null,
+#ifdef DHDTCPACK_SUPPRESS
+                .tcpack_sup_mode = TCPACK_SUP_REPLACE,
+#endif /* DHDTCPACK_SUPPRESS */
+                .up = FALSE,
+                .busstate = DHD_BUS_DOWN
+       }
+};
+#define DHD_INFO_NULL (&dhd_info_null)
+#define DHD_PUB_NULL  (&dhd_info_null.pub)
+
+/* Dummy netdevice object */
+struct net_device dhd_net_dev_null = {
+       .reg_state = NETREG_UNREGISTERED
+};
+#define DHD_NET_DEV_NULL (&dhd_net_dev_null)
+
+/* Dummy dhd_if object */
+dhd_if_t dhd_if_null = {
+#if defined(BCM_GMAC3)
+       .fwdh = FWDER_NULL,
+#endif
+#ifdef WMF
+       .wmf = { .wmf_enable = TRUE },
+#endif
+       .info = DHD_INFO_NULL,
+       .net = DHD_NET_DEV_NULL,
+       .idx = DHD_BAD_IF
+};
+#define DHD_IF_NULL  (&dhd_if_null)
+
+#define DHD_STA_NULL ((dhd_sta_t *)NULL)
+
+/** Interface STA list management. */
+
+/** Fetch the dhd_if object, given the interface index in the dhd. */
+static inline dhd_if_t *dhd_get_ifp(dhd_pub_t *dhdp, uint32 ifidx);
+
+/** Alloc/Free a dhd_sta object from the dhd instances' sta_pool. */
+static void dhd_sta_free(dhd_pub_t *pub, dhd_sta_t *sta);
+static dhd_sta_t * dhd_sta_alloc(dhd_pub_t * dhdp);
+
+/* Delete a dhd_sta or flush all dhd_sta in an interface's sta_list. */
+static void dhd_if_del_sta_list(dhd_if_t * ifp);
+static void    dhd_if_flush_sta(dhd_if_t * ifp);
+
+/* Construct/Destruct a sta pool. */
+static int dhd_sta_pool_init(dhd_pub_t *dhdp, int max_sta);
+static void dhd_sta_pool_fini(dhd_pub_t *dhdp, int max_sta);
+/* Clear the pool of dhd_sta_t objects for built-in type driver */
+static void dhd_sta_pool_clear(dhd_pub_t *dhdp, int max_sta);
+
+
+/* Return interface pointer */
+static inline dhd_if_t *dhd_get_ifp(dhd_pub_t *dhdp, uint32 ifidx)
+{
+       ASSERT(ifidx < DHD_MAX_IFS);
+
+       if (ifidx >= DHD_MAX_IFS)
+               return NULL;
+
+       return dhdp->info->iflist[ifidx];
+}
+
+/** Reset a dhd_sta object and free into the dhd pool. */
+static void
+dhd_sta_free(dhd_pub_t * dhdp, dhd_sta_t * sta)
+{
+       int prio;
+
+       ASSERT((sta != DHD_STA_NULL) && (sta->idx != ID16_INVALID));
+
+       ASSERT((dhdp->staid_allocator != NULL) && (dhdp->sta_pool != NULL));
+
+       /*
+        * Flush and free all packets in all flowring's queues belonging to sta.
+        * Packets in flow ring will be flushed later.
+        */
+       for (prio = 0; prio < (int)NUMPRIO; prio++) {
+               uint16 flowid = sta->flowid[prio];
+
+               if (flowid != FLOWID_INVALID) {
+                       unsigned long flags;
+                       flow_queue_t * queue = dhd_flow_queue(dhdp, flowid);
+                       flow_ring_node_t * flow_ring_node;
+
+#ifdef DHDTCPACK_SUPPRESS
+                       /* Clean tcp_ack_info_tbl in order to prevent access to flushed pkt,
+                        * when there is a newly coming packet from network stack.
+                        */
+                       dhd_tcpack_info_tbl_clean(dhdp);
+#endif /* DHDTCPACK_SUPPRESS */
+
+                       flow_ring_node = dhd_flow_ring_node(dhdp, flowid);
+                       DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+                       flow_ring_node->status = FLOW_RING_STATUS_STA_FREEING;
+
+                       if (!DHD_FLOW_QUEUE_EMPTY(queue)) {
+                               void * pkt;
+                               while ((pkt = dhd_flow_queue_dequeue(dhdp, queue)) != NULL) {
+                                       PKTFREE(dhdp->osh, pkt, TRUE);
+                               }
+                       }
+
+                       DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+                       ASSERT(DHD_FLOW_QUEUE_EMPTY(queue));
+               }
+
+               sta->flowid[prio] = FLOWID_INVALID;
+       }
+
+       id16_map_free(dhdp->staid_allocator, sta->idx);
+       DHD_CUMM_CTR_INIT(&sta->cumm_ctr);
+       sta->ifp = DHD_IF_NULL; /* dummy dhd_if object */
+       sta->ifidx = DHD_BAD_IF;
+       bzero(sta->ea.octet, ETHER_ADDR_LEN);
+       INIT_LIST_HEAD(&sta->list);
+       sta->idx = ID16_INVALID; /* implying free */
+}
+
+/** Allocate a dhd_sta object from the dhd pool. */
+static dhd_sta_t *
+dhd_sta_alloc(dhd_pub_t * dhdp)
+{
+       uint16 idx;
+       dhd_sta_t * sta;
+       dhd_sta_pool_t * sta_pool;
+
+       ASSERT((dhdp->staid_allocator != NULL) && (dhdp->sta_pool != NULL));
+
+       idx = id16_map_alloc(dhdp->staid_allocator);
+       if (idx == ID16_INVALID) {
+               DHD_ERROR(("%s: cannot get free staid\n", __FUNCTION__));
+               return DHD_STA_NULL;
+       }
+
+       sta_pool = (dhd_sta_pool_t *)(dhdp->sta_pool);
+       sta = &sta_pool[idx];
+
+       ASSERT((sta->idx == ID16_INVALID) &&
+              (sta->ifp == DHD_IF_NULL) && (sta->ifidx == DHD_BAD_IF));
+
+       DHD_CUMM_CTR_INIT(&sta->cumm_ctr);
+
+       sta->idx = idx; /* implying allocated */
+
+       return sta;
+}
+
+/** Delete all STAs in an interface's STA list. */
+static void
+dhd_if_del_sta_list(dhd_if_t *ifp)
+{
+       dhd_sta_t *sta, *next;
+       unsigned long flags;
+
+       DHD_IF_STA_LIST_LOCK(ifp, flags);
+
+       list_for_each_entry_safe(sta, next, &ifp->sta_list, list) {
+#if defined(BCM_GMAC3)
+               if (ifp->fwdh) {
+                       /* Remove sta from WOFA forwarder. */
+                       fwder_deassoc(ifp->fwdh, (uint16 *)(sta->ea.octet), (wofa_t)sta);
+               }
+#endif /* BCM_GMAC3 */
+               list_del(&sta->list);
+               dhd_sta_free(&ifp->info->pub, sta);
+       }
+
+       DHD_IF_STA_LIST_UNLOCK(ifp, flags);
+
+       return;
+}
+
+/** Router/GMAC3: Flush all station entries in the forwarder's WOFA database. */
+static void
+dhd_if_flush_sta(dhd_if_t * ifp)
+{
+#if defined(BCM_GMAC3)
+
+       if (ifp && (ifp->fwdh != FWDER_NULL)) {
+               dhd_sta_t *sta, *next;
+               unsigned long flags;
+
+               DHD_IF_STA_LIST_LOCK(ifp, flags);
+
+               list_for_each_entry_safe(sta, next, &ifp->sta_list, list) {
+                       /* Remove any sta entry from WOFA forwarder. */
+                       fwder_flush(ifp->fwdh, (wofa_t)sta);
+               }
+
+               DHD_IF_STA_LIST_UNLOCK(ifp, flags);
+       }
+#endif /* BCM_GMAC3 */
+}
+
+/** Construct a pool of dhd_sta_t objects to be used by interfaces. */
+static int
+dhd_sta_pool_init(dhd_pub_t *dhdp, int max_sta)
+{
+       int idx, prio, sta_pool_memsz;
+       dhd_sta_t * sta;
+       dhd_sta_pool_t * sta_pool;
+       void * staid_allocator;
+
+       ASSERT(dhdp != (dhd_pub_t *)NULL);
+       ASSERT((dhdp->staid_allocator == NULL) && (dhdp->sta_pool == NULL));
+
+       /* dhd_sta objects per radio are managed in a table. id#0 reserved. */
+       staid_allocator = id16_map_init(dhdp->osh, max_sta, 1);
+       if (staid_allocator == NULL) {
+               DHD_ERROR(("%s: sta id allocator init failure\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       /* Pre allocate a pool of dhd_sta objects (one extra). */
+       sta_pool_memsz = ((max_sta + 1) * sizeof(dhd_sta_t)); /* skip idx 0 */
+       sta_pool = (dhd_sta_pool_t *)MALLOC(dhdp->osh, sta_pool_memsz);
+       if (sta_pool == NULL) {
+               DHD_ERROR(("%s: sta table alloc failure\n", __FUNCTION__));
+               id16_map_fini(dhdp->osh, staid_allocator);
+               return BCME_ERROR;
+       }
+
+       dhdp->sta_pool = sta_pool;
+       dhdp->staid_allocator = staid_allocator;
+
+       /* Initialize all sta(s) for the pre-allocated free pool. */
+       bzero((uchar *)sta_pool, sta_pool_memsz);
+       for (idx = max_sta; idx >= 1; idx--) { /* skip sta_pool[0] */
+               sta = &sta_pool[idx];
+               sta->idx = id16_map_alloc(staid_allocator);
+               ASSERT(sta->idx <= max_sta);
+       }
+       /* Now place them into the pre-allocated free pool. */
+       for (idx = 1; idx <= max_sta; idx++) {
+               sta = &sta_pool[idx];
+               for (prio = 0; prio < (int)NUMPRIO; prio++) {
+                       sta->flowid[prio] = FLOWID_INVALID; /* Flow rings do not exist */
+               }
+               dhd_sta_free(dhdp, sta);
+       }
+
+       return BCME_OK;
+}
+
+/** Destruct the pool of dhd_sta_t objects.
+ * Caller must ensure that no STA objects are currently associated with an if.
+ */
+static void
+dhd_sta_pool_fini(dhd_pub_t *dhdp, int max_sta)
+{
+       dhd_sta_pool_t * sta_pool = (dhd_sta_pool_t *)dhdp->sta_pool;
+
+       if (sta_pool) {
+               int idx;
+               int sta_pool_memsz = ((max_sta + 1) * sizeof(dhd_sta_t));
+               for (idx = 1; idx <= max_sta; idx++) {
+                       ASSERT(sta_pool[idx].ifp == DHD_IF_NULL);
+                       ASSERT(sta_pool[idx].idx == ID16_INVALID);
+               }
+               MFREE(dhdp->osh, dhdp->sta_pool, sta_pool_memsz);
+               dhdp->sta_pool = NULL;
+       }
+
+       id16_map_fini(dhdp->osh, dhdp->staid_allocator);
+       dhdp->staid_allocator = NULL;
+}
+
+/* Clear the pool of dhd_sta_t objects for built-in type driver */
+static void
+dhd_sta_pool_clear(dhd_pub_t *dhdp, int max_sta)
+{
+       int idx, prio, sta_pool_memsz;
+       dhd_sta_t * sta;
+       dhd_sta_pool_t * sta_pool;
+       void *staid_allocator;
+
+       if (!dhdp) {
+               DHD_ERROR(("%s: dhdp is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       sta_pool = (dhd_sta_pool_t *)dhdp->sta_pool;
+       staid_allocator = dhdp->staid_allocator;
+
+       if (!sta_pool) {
+               DHD_ERROR(("%s: sta_pool is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       if (!staid_allocator) {
+               DHD_ERROR(("%s: staid_allocator is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       /* clear free pool */
+       sta_pool_memsz = ((max_sta + 1) * sizeof(dhd_sta_t));
+       bzero((uchar *)sta_pool, sta_pool_memsz);
+
+       /* dhd_sta objects per radio are managed in a table. id#0 reserved. */
+       id16_map_clear(staid_allocator, max_sta, 1);
+
+       /* Initialize all sta(s) for the pre-allocated free pool. */
+       for (idx = max_sta; idx >= 1; idx--) { /* skip sta_pool[0] */
+               sta = &sta_pool[idx];
+               sta->idx = id16_map_alloc(staid_allocator);
+               ASSERT(sta->idx <= max_sta);
+       }
+       /* Now place them into the pre-allocated free pool. */
+       for (idx = 1; idx <= max_sta; idx++) {
+               sta = &sta_pool[idx];
+               for (prio = 0; prio < (int)NUMPRIO; prio++) {
+                       sta->flowid[prio] = FLOWID_INVALID; /* Flow rings do not exist */
+               }
+               dhd_sta_free(dhdp, sta);
+       }
+}
+
+/** Find STA with MAC address ea in an interface's STA list. */
+dhd_sta_t *
+dhd_find_sta(void *pub, int ifidx, void *ea)
+{
+       dhd_sta_t *sta;
+       dhd_if_t *ifp;
+       unsigned long flags;
+
+       ASSERT(ea != NULL);
+       ifp = dhd_get_ifp((dhd_pub_t *)pub, ifidx);
+       if (ifp == NULL)
+               return DHD_STA_NULL;
+
+       DHD_IF_STA_LIST_LOCK(ifp, flags);
+
+       list_for_each_entry(sta, &ifp->sta_list, list) {
+               if (!memcmp(sta->ea.octet, ea, ETHER_ADDR_LEN)) {
+                       DHD_IF_STA_LIST_UNLOCK(ifp, flags);
+                       return sta;
+               }
+       }
+
+       DHD_IF_STA_LIST_UNLOCK(ifp, flags);
+
+       return DHD_STA_NULL;
+}
+
+/** Add STA into the interface's STA list. */
+dhd_sta_t *
+dhd_add_sta(void *pub, int ifidx, void *ea)
+{
+       dhd_sta_t *sta;
+       dhd_if_t *ifp;
+       unsigned long flags;
+
+       ASSERT(ea != NULL);
+       ifp = dhd_get_ifp((dhd_pub_t *)pub, ifidx);
+       if (ifp == NULL)
+               return DHD_STA_NULL;
+
+       sta = dhd_sta_alloc((dhd_pub_t *)pub);
+       if (sta == DHD_STA_NULL) {
+               DHD_ERROR(("%s: Alloc failed\n", __FUNCTION__));
+               return DHD_STA_NULL;
+       }
+
+       memcpy(sta->ea.octet, ea, ETHER_ADDR_LEN);
+
+       /* link the sta and the dhd interface */
+       sta->ifp = ifp;
+       sta->ifidx = ifidx;
+       INIT_LIST_HEAD(&sta->list);
+
+       DHD_IF_STA_LIST_LOCK(ifp, flags);
+
+       list_add_tail(&sta->list, &ifp->sta_list);
+
+#if defined(BCM_GMAC3)
+       if (ifp->fwdh) {
+               ASSERT(ISALIGNED(ea, 2));
+               /* Add sta to WOFA forwarder. */
+               fwder_reassoc(ifp->fwdh, (uint16 *)ea, (wofa_t)sta);
+       }
+#endif /* BCM_GMAC3 */
+
+       DHD_IF_STA_LIST_UNLOCK(ifp, flags);
+
+       return sta;
+}
+
+/** Delete STA from the interface's STA list. */
+void
+dhd_del_sta(void *pub, int ifidx, void *ea)
+{
+       dhd_sta_t *sta, *next;
+       dhd_if_t *ifp;
+       unsigned long flags;
+
+       ASSERT(ea != NULL);
+       ifp = dhd_get_ifp((dhd_pub_t *)pub, ifidx);
+       if (ifp == NULL)
+               return;
+
+       DHD_IF_STA_LIST_LOCK(ifp, flags);
+
+       list_for_each_entry_safe(sta, next, &ifp->sta_list, list) {
+               if (!memcmp(sta->ea.octet, ea, ETHER_ADDR_LEN)) {
+#if defined(BCM_GMAC3)
+                       if (ifp->fwdh) { /* Found a sta, remove from WOFA forwarder. */
+                               ASSERT(ISALIGNED(ea, 2));
+                               fwder_deassoc(ifp->fwdh, (uint16 *)ea, (wofa_t)sta);
+                       }
+#endif /* BCM_GMAC3 */
+                       list_del(&sta->list);
+                       dhd_sta_free(&ifp->info->pub, sta);
+               }
+       }
+
+       DHD_IF_STA_LIST_UNLOCK(ifp, flags);
+#ifdef DHD_L2_FILTER
+       if (ifp->parp_enable) {
+               /* clear Proxy ARP cache of specific Ethernet Address */
+               bcm_l2_filter_arp_table_update(((dhd_pub_t*)pub)->osh, ifp->phnd_arp_table, FALSE,
+                       ea, FALSE, ((dhd_pub_t*)pub)->tickcnt);
+       }
+#endif /* DHD_L2_FILTER */
+       return;
+}
+
+/** Add STA if it doesn't exist. Not reentrant. */
+dhd_sta_t*
+dhd_findadd_sta(void *pub, int ifidx, void *ea)
+{
+       dhd_sta_t *sta;
+
+       sta = dhd_find_sta(pub, ifidx, ea);
+
+       if (!sta) {
+               /* Add entry */
+               sta = dhd_add_sta(pub, ifidx, ea);
+       }
+
+       return sta;
+}
+
+#if defined(DHD_IGMP_UCQUERY) || defined(DHD_UCAST_UPNP)
+#if !defined(BCM_GMAC3)
+static struct list_head *
+dhd_sta_list_snapshot(dhd_info_t *dhd, dhd_if_t *ifp, struct list_head *snapshot_list)
+{
+       unsigned long flags;
+       dhd_sta_t *sta, *snapshot;
+
+       INIT_LIST_HEAD(snapshot_list);
+
+       DHD_IF_STA_LIST_LOCK(ifp, flags);
+
+       list_for_each_entry(sta, &ifp->sta_list, list) {
+               /* allocate one and add to snapshot */
+               snapshot = (dhd_sta_t *)MALLOC(dhd->pub.osh, sizeof(dhd_sta_t));
+               if (snapshot == NULL) {
+                       DHD_ERROR(("%s: Cannot allocate memory\n", __FUNCTION__));
+                       continue;
+               }
+
+               memcpy(snapshot->ea.octet, sta->ea.octet, ETHER_ADDR_LEN);
+
+               INIT_LIST_HEAD(&snapshot->list);
+               list_add_tail(&snapshot->list, snapshot_list);
+       }
+
+       DHD_IF_STA_LIST_UNLOCK(ifp, flags);
+
+       return snapshot_list;
+}
+
+static void
+dhd_sta_list_snapshot_free(dhd_info_t *dhd, struct list_head *snapshot_list)
+{
+       dhd_sta_t *sta, *next;
+
+       list_for_each_entry_safe(sta, next, snapshot_list, list) {
+               list_del(&sta->list);
+               MFREE(dhd->pub.osh, sta, sizeof(dhd_sta_t));
+       }
+}
+#endif /* !BCM_GMAC3 */
+#endif /* DHD_IGMP_UCQUERY || DHD_UCAST_UPNP */
+
+#else
+static inline void dhd_if_flush_sta(dhd_if_t * ifp) { }
+static inline void dhd_if_del_sta_list(dhd_if_t *ifp) {}
+static inline int dhd_sta_pool_init(dhd_pub_t *dhdp, int max_sta) { return BCME_OK; }
+static inline void dhd_sta_pool_fini(dhd_pub_t *dhdp, int max_sta) {}
+static inline void dhd_sta_pool_clear(dhd_pub_t *dhdp, int max_sta) {}
+dhd_sta_t *dhd_findadd_sta(void *pub, int ifidx, void *ea) { return NULL; }
+void dhd_del_sta(void *pub, int ifidx, void *ea) {}
+#endif /* PCIE_FULL_DONGLE */
+
+
+#if defined(DHD_LB)
+
+#if defined(DHD_LB_TXC) || defined(DHD_LB_RXC)
+/**
+ * dhd_tasklet_schedule - Function that runs in IPI context of the destination
+ * CPU and schedules a tasklet.
+ * @tasklet: opaque pointer to the tasklet
+ */
+static INLINE void
+dhd_tasklet_schedule(void *tasklet)
+{
+       tasklet_schedule((struct tasklet_struct *)tasklet);
+}
+
+/**
+ * dhd_tasklet_schedule_on - Executes the passed takslet in a given CPU
+ * @tasklet: tasklet to be scheduled
+ * @on_cpu: cpu core id
+ *
+ * If the requested cpu is online, then an IPI is sent to this cpu via the
+ * smp_call_function_single with no wait and the tasklet_schedule function
+ * will be invoked to schedule the specified tasklet on the requested CPU.
+ */
+static void
+dhd_tasklet_schedule_on(struct tasklet_struct *tasklet, int on_cpu)
+{
+       const int wait = 0;
+       smp_call_function_single(on_cpu,
+               dhd_tasklet_schedule, (void *)tasklet, wait);
+}
+#endif /* DHD_LB_TXC || DHD_LB_RXC */
+
+
+#if defined(DHD_LB_TXC)
+/**
+ * dhd_lb_tx_compl_dispatch - load balance by dispatching the tx_compl_tasklet
+ * on another cpu. The tx_compl_tasklet will take care of DMA unmapping and
+ * freeing the packets placed in the tx_compl workq
+ */
+void
+dhd_lb_tx_compl_dispatch(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd = dhdp->info;
+       int curr_cpu, on_cpu;
+
+       if (dhd->rx_napi_netdev == NULL) {
+               DHD_ERROR(("%s: dhd->rx_napi_netdev is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_LB_STATS_INCR(dhd->txc_sched_cnt);
+       /*
+        * If the destination CPU is NOT online or is same as current CPU
+        * no need to schedule the work
+        */
+       curr_cpu = get_cpu();
+       put_cpu();
+
+       on_cpu = atomic_read(&dhd->tx_compl_cpu);
+
+       if ((on_cpu == curr_cpu) || (!cpu_online(on_cpu))) {
+               dhd_tasklet_schedule(&dhd->tx_compl_tasklet);
+       } else {
+               schedule_work(&dhd->tx_compl_dispatcher_work);
+       }
+}
+
+static void dhd_tx_compl_dispatcher_fn(struct work_struct * work)
+{
+       struct dhd_info *dhd =
+               container_of(work, struct dhd_info, tx_compl_dispatcher_work);
+       int cpu;
+
+       get_online_cpus();
+       cpu = atomic_read(&dhd->tx_compl_cpu);
+       if (!cpu_online(cpu))
+               dhd_tasklet_schedule(&dhd->tx_compl_tasklet);
+       else
+               dhd_tasklet_schedule_on(&dhd->tx_compl_tasklet, cpu);
+       put_online_cpus();
+}
+
+#endif /* DHD_LB_TXC */
+
+
+#if defined(DHD_LB_RXC)
+/**
+ * dhd_lb_rx_compl_dispatch - load balance by dispatching the rx_compl_tasklet
+ * on another cpu. The rx_compl_tasklet will take care of reposting rx buffers
+ * in the H2D RxBuffer Post common ring, by using the recycled pktids that were
+ * placed in the rx_compl workq.
+ *
+ * @dhdp: pointer to dhd_pub object
+ */
+void
+dhd_lb_rx_compl_dispatch(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd = dhdp->info;
+       int curr_cpu, on_cpu;
+
+       if (dhd->rx_napi_netdev == NULL) {
+               DHD_ERROR(("%s: dhd->rx_napi_netdev is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_LB_STATS_INCR(dhd->rxc_sched_cnt);
+       /*
+        * If the destination CPU is NOT online or is same as current CPU
+        * no need to schedule the work
+        */
+       curr_cpu = get_cpu();
+       put_cpu();
+
+       on_cpu = atomic_read(&dhd->rx_compl_cpu);
+
+       if ((on_cpu == curr_cpu) || (!cpu_online(on_cpu))) {
+               dhd_tasklet_schedule(&dhd->rx_compl_tasklet);
+       } else {
+               schedule_work(&dhd->rx_compl_dispatcher_work);
+       }
+}
+
+static void dhd_rx_compl_dispatcher_fn(struct work_struct * work)
+{
+       struct dhd_info *dhd =
+               container_of(work, struct dhd_info, rx_compl_dispatcher_work);
+       int cpu;
+
+       get_online_cpus();
+       cpu = atomic_read(&dhd->tx_compl_cpu);
+       if (!cpu_online(cpu))
+               dhd_tasklet_schedule(&dhd->rx_compl_tasklet);
+       else
+               dhd_tasklet_schedule_on(&dhd->rx_compl_tasklet, cpu);
+       put_online_cpus();
+}
+
+#endif /* DHD_LB_RXC */
+
+
+#if defined(DHD_LB_RXP)
+/**
+ * dhd_napi_poll - Load balance napi poll function to process received
+ * packets and send up the network stack using netif_receive_skb()
+ *
+ * @napi: napi object in which context this poll function is invoked
+ * @budget: number of packets to be processed.
+ *
+ * Fetch the dhd_info given the rx_napi_struct. Move all packets from the
+ * rx_napi_queue into a local rx_process_queue (lock and queue move and unlock).
+ * Dequeue each packet from head of rx_process_queue, fetch the ifid from the
+ * packet tag and sendup.
+ */
+static int
+dhd_napi_poll(struct napi_struct *napi, int budget)
+{
+       int ifid;
+       const int pkt_count = 1;
+       const int chan = 0;
+       struct sk_buff * skb;
+       unsigned long flags;
+       struct dhd_info *dhd;
+       int processed = 0;
+       struct sk_buff_head rx_process_queue;
+
+       dhd = container_of(napi, struct dhd_info, rx_napi_struct);
+       DHD_INFO(("%s napi_queue<%d> budget<%d>\n",
+               __FUNCTION__, skb_queue_len(&dhd->rx_napi_queue), budget));
+
+       __skb_queue_head_init(&rx_process_queue);
+
+       /* extract the entire rx_napi_queue into local rx_process_queue */
+       spin_lock_irqsave(&dhd->rx_napi_queue.lock, flags);
+       skb_queue_splice_tail_init(&dhd->rx_napi_queue, &rx_process_queue);
+       spin_unlock_irqrestore(&dhd->rx_napi_queue.lock, flags);
+
+       while ((skb = __skb_dequeue(&rx_process_queue)) != NULL) {
+               OSL_PREFETCH(skb->data);
+
+               ifid = DHD_PKTTAG_IFID((dhd_pkttag_fr_t *)PKTTAG(skb));
+
+               DHD_INFO(("%s dhd_rx_frame pkt<%p> ifid<%d>\n",
+                       __FUNCTION__, skb, ifid));
+
+               dhd_rx_frame(&dhd->pub, ifid, skb, pkt_count, chan);
+               processed++;
+       }
+
+       DHD_LB_STATS_UPDATE_NAPI_HISTO(&dhd->pub, processed);
+
+       DHD_INFO(("%s processed %d\n", __FUNCTION__, processed));
+       napi_complete(napi);
+
+       return budget - 1;
+}
+
+/**
+ * dhd_napi_schedule - Place the napi struct into the current cpus softnet napi
+ * poll list. This function may be invoked via the smp_call_function_single
+ * from a remote CPU.
+ *
+ * This function will essentially invoke __raise_softirq_irqoff(NET_RX_SOFTIRQ)
+ * after the napi_struct is added to the softnet data's poll_list
+ *
+ * @info: pointer to a dhd_info struct
+ */
+static void
+dhd_napi_schedule(void *info)
+{
+       dhd_info_t *dhd = (dhd_info_t *)info;
+
+       DHD_INFO(("%s rx_napi_struct<%p> on cpu<%d>\n",
+               __FUNCTION__, &dhd->rx_napi_struct, atomic_read(&dhd->rx_napi_cpu)));
+
+       /* add napi_struct to softnet data poll list and raise NET_RX_SOFTIRQ */
+       if (napi_schedule_prep(&dhd->rx_napi_struct)) {
+               __napi_schedule(&dhd->rx_napi_struct);
+               DHD_LB_STATS_PERCPU_ARR_INCR(dhd->napi_percpu_run_cnt);
+       }
+
+       /*
+        * If the rx_napi_struct was already running, then we let it complete
+        * processing all its packets. The rx_napi_struct may only run on one
+        * core at a time, to avoid out-of-order handling.
+        */
+}
+
+/**
+ * dhd_napi_schedule_on - API to schedule on a desired CPU core a NET_RX_SOFTIRQ
+ * action after placing the dhd's rx_process napi object in the the remote CPU's
+ * softnet data's poll_list.
+ *
+ * @dhd: dhd_info which has the rx_process napi object
+ * @on_cpu: desired remote CPU id
+ */
+static INLINE int
+dhd_napi_schedule_on(dhd_info_t *dhd, int on_cpu)
+{
+       int wait = 0; /* asynchronous IPI */
+
+       DHD_INFO(("%s dhd<%p> napi<%p> on_cpu<%d>\n",
+               __FUNCTION__, dhd, &dhd->rx_napi_struct, on_cpu));
+
+       if (smp_call_function_single(on_cpu, dhd_napi_schedule, dhd, wait)) {
+               DHD_ERROR(("%s smp_call_function_single on_cpu<%d> failed\n",
+                       __FUNCTION__, on_cpu));
+       }
+
+       DHD_LB_STATS_INCR(dhd->napi_sched_cnt);
+
+       return 0;
+}
+
+/*
+ * Call get_online_cpus/put_online_cpus around dhd_napi_schedule_on
+ * Why should we do this?
+ * The candidacy algorithm is run from the call back function
+ * registered to CPU hotplug notifier. This call back happens from Worker
+ * context. The dhd_napi_schedule_on is also from worker context.
+ * Note that both of this can run on two different CPUs at the same time.
+ * So we can possibly have a window where a given CPUn is being brought
+ * down from CPUm while we try to run a function on CPUn.
+ * To prevent this its better have the whole code to execute an SMP
+ * function under get_online_cpus.
+ * This function call ensures that hotplug mechanism does not kick-in
+ * until we are done dealing with online CPUs
+ * If the hotplug worker is already running, no worries because the
+ * candidacy algo would then reflect the same in dhd->rx_napi_cpu.
+ *
+ * The below mentioned code structure is proposed in
+ * https://www.kernel.org/doc/Documentation/cpu-hotplug.txt
+ * for the question
+ * Q: I need to ensure that a particular cpu is not removed when there is some
+ *    work specific to this cpu is in progress
+ *
+ * According to the documentation calling get_online_cpus is NOT required, if
+ * we are running from tasklet context. Since dhd_rx_napi_dispatcher_fn can
+ * run from Work Queue context we have to call these functions
+ */
+static void dhd_rx_napi_dispatcher_fn(struct work_struct * work)
+{
+       struct dhd_info *dhd =
+               container_of(work, struct dhd_info, rx_napi_dispatcher_work);
+       int cpu;
+
+       get_online_cpus();
+       cpu = atomic_read(&dhd->rx_napi_cpu);
+       if (!cpu_online(cpu))
+               dhd_napi_schedule(dhd);
+       else
+               dhd_napi_schedule_on(dhd, cpu);
+       put_online_cpus();
+}
+
+/**
+ * dhd_lb_rx_napi_dispatch - load balance by dispatching the rx_napi_struct
+ * to run on another CPU. The rx_napi_struct's poll function will retrieve all
+ * the packets enqueued into the rx_napi_queue and sendup.
+ * The producer's rx packet queue is appended to the rx_napi_queue before
+ * dispatching the rx_napi_struct.
+ */
+void
+dhd_lb_rx_napi_dispatch(dhd_pub_t *dhdp)
+{
+       unsigned long flags;
+       dhd_info_t *dhd = dhdp->info;
+       int curr_cpu;
+       int on_cpu;
+
+       if (dhd->rx_napi_netdev == NULL) {
+               DHD_ERROR(("%s: dhd->rx_napi_netdev is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_INFO(("%s append napi_queue<%d> pend_queue<%d>\n", __FUNCTION__,
+               skb_queue_len(&dhd->rx_napi_queue), skb_queue_len(&dhd->rx_pend_queue)));
+
+       /* append the producer's queue of packets to the napi's rx process queue */
+       spin_lock_irqsave(&dhd->rx_napi_queue.lock, flags);
+       skb_queue_splice_tail_init(&dhd->rx_pend_queue, &dhd->rx_napi_queue);
+       spin_unlock_irqrestore(&dhd->rx_napi_queue.lock, flags);
+
+       /*
+        * If the destination CPU is NOT online or is same as current CPU
+        * no need to schedule the work
+        */
+       curr_cpu = get_cpu();
+       put_cpu();
+
+       on_cpu = atomic_read(&dhd->rx_napi_cpu);
+
+       if ((on_cpu == curr_cpu) || (!cpu_online(on_cpu))) {
+               dhd_napi_schedule(dhd);
+       } else {
+               schedule_work(&dhd->rx_napi_dispatcher_work);
+       }
+}
+
+/**
+ * dhd_lb_rx_pkt_enqueue - Enqueue the packet into the producer's queue
+ */
+void
+dhd_lb_rx_pkt_enqueue(dhd_pub_t *dhdp, void *pkt, int ifidx)
+{
+       dhd_info_t *dhd = dhdp->info;
+
+       DHD_INFO(("%s enqueue pkt<%p> ifidx<%d> pend_queue<%d>\n", __FUNCTION__,
+               pkt, ifidx, skb_queue_len(&dhd->rx_pend_queue)));
+       DHD_PKTTAG_SET_IFID((dhd_pkttag_fr_t *)PKTTAG(pkt), ifidx);
+       __skb_queue_tail(&dhd->rx_pend_queue, pkt);
+}
+#endif /* DHD_LB_RXP */
+
+#endif /* DHD_LB */
+
+static void dhd_memdump_work_handler(struct work_struct * work)
+{
+       struct dhd_info *dhd =
+               container_of(work, struct dhd_info, dhd_memdump_work.work);
+
+       BCM_REFERENCE(dhd);
+#ifdef BCMPCIE
+       dhd_prot_collect_memdump(&dhd->pub);
+#endif
+}
+
+
+/** Returns dhd iflist index corresponding the the bssidx provided by apps */
+int dhd_bssidx2idx(dhd_pub_t *dhdp, uint32 bssidx)
+{
+       dhd_if_t *ifp;
+       dhd_info_t *dhd = dhdp->info;
+       int i;
+
+       ASSERT(bssidx < DHD_MAX_IFS);
+       ASSERT(dhdp);
+
+       for (i = 0; i < DHD_MAX_IFS; i++) {
+               ifp = dhd->iflist[i];
+               if (ifp && (ifp->bssidx == bssidx)) {
+                       DHD_TRACE(("Index manipulated for %s from %d to %d\n",
+                               ifp->name, bssidx, i));
+                       break;
+               }
+       }
+       return i;
+}
+
+static inline int dhd_rxf_enqueue(dhd_pub_t *dhdp, void* skb)
+{
+       uint32 store_idx;
+       uint32 sent_idx;
+
+       if (!skb) {
+               DHD_ERROR(("dhd_rxf_enqueue: NULL skb!!!\n"));
+               return BCME_ERROR;
+       }
+
+       dhd_os_rxflock(dhdp);
+       store_idx = dhdp->store_idx;
+       sent_idx = dhdp->sent_idx;
+       if (dhdp->skbbuf[store_idx] != NULL) {
+               /* Make sure the previous packets are processed */
+               dhd_os_rxfunlock(dhdp);
+#ifdef RXF_DEQUEUE_ON_BUSY
+               DHD_TRACE(("dhd_rxf_enqueue: pktbuf not consumed %p, store idx %d sent idx %d\n",
+                       skb, store_idx, sent_idx));
+               return BCME_BUSY;
+#else /* RXF_DEQUEUE_ON_BUSY */
+               DHD_ERROR(("dhd_rxf_enqueue: pktbuf not consumed %p, store idx %d sent idx %d\n",
+                       skb, store_idx, sent_idx));
+               /* removed msleep here, should use wait_event_timeout if we
+                * want to give rx frame thread a chance to run
+                */
+#if defined(WAIT_DEQUEUE)
+               OSL_SLEEP(1);
+#endif
+               return BCME_ERROR;
+#endif /* RXF_DEQUEUE_ON_BUSY */
+       }
+       DHD_TRACE(("dhd_rxf_enqueue: Store SKB %p. idx %d -> %d\n",
+               skb, store_idx, (store_idx + 1) & (MAXSKBPEND - 1)));
+       dhdp->skbbuf[store_idx] = skb;
+       dhdp->store_idx = (store_idx + 1) & (MAXSKBPEND - 1);
+       dhd_os_rxfunlock(dhdp);
+
+       return BCME_OK;
+}
+
+static inline void* dhd_rxf_dequeue(dhd_pub_t *dhdp)
+{
+       uint32 store_idx;
+       uint32 sent_idx;
+       void *skb;
+
+       dhd_os_rxflock(dhdp);
+
+       store_idx = dhdp->store_idx;
+       sent_idx = dhdp->sent_idx;
+       skb = dhdp->skbbuf[sent_idx];
+
+       if (skb == NULL) {
+               dhd_os_rxfunlock(dhdp);
+               DHD_ERROR(("dhd_rxf_dequeue: Dequeued packet is NULL, store idx %d sent idx %d\n",
+                       store_idx, sent_idx));
+               return NULL;
+       }
+
+       dhdp->skbbuf[sent_idx] = NULL;
+       dhdp->sent_idx = (sent_idx + 1) & (MAXSKBPEND - 1);
+
+       DHD_TRACE(("dhd_rxf_dequeue: netif_rx_ni(%p), sent idx %d\n",
+               skb, sent_idx));
+
+       dhd_os_rxfunlock(dhdp);
+
+       return skb;
+}
+
+int dhd_process_cid_mac(dhd_pub_t *dhdp, bool prepost)
+{
+       if (prepost) { /* pre process */
+               dhd_read_cis(dhdp);
+               dhd_check_module_cid(dhdp);
+               dhd_check_module_mac(dhdp);
+               dhd_set_macaddr_from_file(dhdp);
+       } else { /* post process */
+               dhd_write_macaddr(&dhdp->mac);
+               dhd_clear_cis(dhdp);
+       }
+
+       return 0;
+}
+
+#ifdef PKT_FILTER_SUPPORT
+#ifndef GAN_LITE_NAT_KEEPALIVE_FILTER
+static bool
+_turn_on_arp_filter(dhd_pub_t *dhd, int op_mode)
+{
+       bool _apply = FALSE;
+       /* In case of IBSS mode, apply arp pkt filter */
+       if (op_mode & DHD_FLAG_IBSS_MODE) {
+               _apply = TRUE;
+               goto exit;
+       }
+       /* In case of P2P GO or GC, apply pkt filter to pass arp pkt to host */
+       if ((op_mode & (DHD_FLAG_P2P_GC_MODE | DHD_FLAG_P2P_GO_MODE))) {
+               _apply = TRUE;
+               goto exit;
+       }
+
+exit:
+       return _apply;
+}
+#endif /* !GAN_LITE_NAT_KEEPALIVE_FILTER */
+
+void
+dhd_set_packet_filter(dhd_pub_t *dhd)
+{
+       int i;
+
+       DHD_TRACE(("%s: enter\n", __FUNCTION__));
+       if (dhd_pkt_filter_enable) {
+               for (i = 0; i < dhd->pktfilter_count; i++) {
+                       dhd_pktfilter_offload_set(dhd, dhd->pktfilter[i]);
+               }
+       }
+}
+
+void
+dhd_enable_packet_filter(int value, dhd_pub_t *dhd)
+{
+       int i;
+
+       DHD_ERROR(("%s: enter, value = %d\n", __FUNCTION__, value));
+
+       if ((dhd->op_mode & DHD_FLAG_HOSTAP_MODE) && value) {
+               DHD_ERROR(("%s: DHD_FLAG_HOSTAP_MODE\n", __FUNCTION__));
+               return;
+       }
+       /* 1 - Enable packet filter, only allow unicast packet to send up */
+       /* 0 - Disable packet filter */
+       if (dhd_pkt_filter_enable && (!value ||
+           (dhd_support_sta_mode(dhd) && !dhd->dhcp_in_progress)))
+           {
+               for (i = 0; i < dhd->pktfilter_count; i++) {
+#ifndef GAN_LITE_NAT_KEEPALIVE_FILTER
+                       if (value && (i == DHD_ARP_FILTER_NUM) &&
+                               !_turn_on_arp_filter(dhd, dhd->op_mode)) {
+                               DHD_TRACE(("Do not turn on ARP white list pkt filter:"
+                                       "val %d, cnt %d, op_mode 0x%x\n",
+                                       value, i, dhd->op_mode));
+                               continue;
+                       }
+#endif /* !GAN_LITE_NAT_KEEPALIVE_FILTER */
+                       dhd_pktfilter_offload_enable(dhd, dhd->pktfilter[i],
+                               value, dhd_master_mode);
+               }
+       }
+}
+
+int
+dhd_packet_filter_add_remove(dhd_pub_t *dhdp, int add_remove, int num)
+{
+       char *filterp = NULL;
+       int filter_id = 0;
+
+       switch (num) {
+               case DHD_BROADCAST_FILTER_NUM:
+                       filterp = "101 0 0 0 0xFFFFFFFFFFFF 0xFFFFFFFFFFFF";
+                       filter_id = 101;
+                       break;
+               case DHD_MULTICAST4_FILTER_NUM:
+                       filter_id = 102;
+                       if (FW_SUPPORTED(dhdp, pf6)) {
+                               if (dhdp->pktfilter[num] != NULL) {
+                                       dhd_pktfilter_offload_delete(dhdp, filter_id);
+                                       dhdp->pktfilter[num] = NULL;
+                               }
+                               if (!add_remove) {
+                                       filterp = DISCARD_IPV4_MCAST;
+                                       add_remove = 1;
+                                       break;
+                               }
+                       }
+                       filterp = "102 0 0 0 0xFFFFFF 0x01005E";
+                       break;
+               case DHD_MULTICAST6_FILTER_NUM:
+                       filter_id = 103;
+                       if (FW_SUPPORTED(dhdp, pf6)) {
+                               if (dhdp->pktfilter[num] != NULL) {
+                                       dhd_pktfilter_offload_delete(dhdp, filter_id);
+                                       dhdp->pktfilter[num] = NULL;
+                               }
+                               if (!add_remove) {
+                                       filterp = DISCARD_IPV6_MCAST;
+                                       add_remove = 1;
+                                       break;
+                               }
+                       }
+                       filterp = "103 0 0 0 0xFFFF 0x3333";
+                       break;
+               case DHD_MDNS_FILTER_NUM:
+                       filterp = "104 0 0 0 0xFFFFFFFFFFFF 0x01005E0000FB";
+                       filter_id = 104;
+                       break;
+               case DHD_ARP_FILTER_NUM:
+                       filterp = "105 0 0 12 0xFFFF 0x0806";
+                       filter_id = 105;
+                       break;
+               case DHD_BROADCAST_ARP_FILTER_NUM:
+                       filterp = "106 0 0 0 0xFFFFFFFFFFFF0000000000000806"
+                               " 0xFFFFFFFFFFFF0000000000000806";
+                       filter_id = 106;
+                       break;
+               default:
+                       return -EINVAL;
+       }
+
+       /* Add filter */
+       if (add_remove) {
+               dhdp->pktfilter[num] = filterp;
+               dhd_pktfilter_offload_set(dhdp, dhdp->pktfilter[num]);
+       } else { /* Delete filter */
+               if (dhdp->pktfilter[num]) {
+                       dhd_pktfilter_offload_delete(dhdp, filter_id);
+                       dhdp->pktfilter[num] = NULL;
+               }
+       }
+
+       return 0;
+}
+#endif /* PKT_FILTER_SUPPORT */
+
+static int dhd_set_suspend(int value, dhd_pub_t *dhd)
+{
+#ifndef SUPPORT_PM2_ONLY
+       int power_mode = PM_MAX;
+#endif /* SUPPORT_PM2_ONLY */
+#ifdef SUPPORT_SENSORHUB
+       shub_control_t shub_ctl;
+#endif /* SUPPORT_SENSORHUB */
+       /* wl_pkt_filter_enable_t       enable_parm; */
+       char iovbuf[32];
+       int bcn_li_dtim = 0; /* Default bcn_li_dtim in resume mode is 0 */
+#ifdef DHD_USE_EARLYSUSPEND
+#ifdef CUSTOM_BCN_TIMEOUT_IN_SUSPEND
+       int bcn_timeout = 0;
+#endif /* CUSTOM_BCN_TIMEOUT_IN_SUSPEND */
+#ifdef CUSTOM_ROAM_TIME_THRESH_IN_SUSPEND
+       int roam_time_thresh = 0;       /* (ms) */
+#endif /* CUSTOM_ROAM_TIME_THRESH_IN_SUSPEND */
+#ifndef ENABLE_FW_ROAM_SUSPEND
+       uint roamvar = 1;
+#endif /* ENABLE_FW_ROAM_SUSPEND */
+#ifdef ENABLE_BCN_LI_BCN_WAKEUP
+       int bcn_li_bcn;
+#endif /* ENABLE_BCN_LI_BCN_WAKEUP */
+       uint nd_ra_filter = 0;
+       int ret = 0;
+#endif /* DHD_USE_EARLYSUSPEND */
+#ifdef PASS_ALL_MCAST_PKTS
+       struct dhd_info *dhdinfo;
+       uint32 allmulti;
+       uint i;
+#endif /* PASS_ALL_MCAST_PKTS */
+#ifdef DYNAMIC_SWOOB_DURATION
+#ifndef CUSTOM_INTR_WIDTH
+#define CUSTOM_INTR_WIDTH 100
+       int intr_width = 0;
+#endif /* CUSTOM_INTR_WIDTH */
+#endif /* DYNAMIC_SWOOB_DURATION */
+       if (!dhd)
+               return -ENODEV;
+
+#ifdef PASS_ALL_MCAST_PKTS
+       dhdinfo = dhd->info;
+#endif /* PASS_ALL_MCAST_PKTS */
+
+       DHD_TRACE(("%s: enter, value = %d in_suspend=%d\n",
+               __FUNCTION__, value, dhd->in_suspend));
+
+       dhd_suspend_lock(dhd);
+
+#ifdef CUSTOM_SET_CPUCORE
+       DHD_TRACE(("%s set cpucore(suspend%d)\n", __FUNCTION__, value));
+       /* set specific cpucore */
+       dhd_set_cpucore(dhd, TRUE);
+#endif /* CUSTOM_SET_CPUCORE */
+       if (dhd->up) {
+               if (value && dhd->in_suspend) {
+#ifdef PKT_FILTER_SUPPORT
+                               dhd->early_suspended = 1;
+#endif
+                               /* Kernel suspended */
+                               DHD_ERROR(("%s: force extra Suspend setting \n", __FUNCTION__));
+
+#ifdef SUPPORT_SENSORHUB
+                               shub_ctl.enable = 1;
+                               shub_ctl.cmd = 0x000;
+                               shub_ctl.op_mode = 1;
+                               shub_ctl.interval = 0;
+                               if (dhd->info->shub_enable == 1) {
+                                       bcm_mkiovar("shub_msreq", (char *)&shub_ctl,
+                                               sizeof(shub_ctl), iovbuf, sizeof(iovbuf));
+                                       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR,
+                                               iovbuf, sizeof(iovbuf), TRUE, 0)) < 0) {
+                                               DHD_ERROR(("%s SensorHub MS start: failed %d\n",
+                                                       __FUNCTION__, ret));
+                                       }
+                               }
+#endif /* SUPPORT_SENSORHUB */
+
+#ifndef SUPPORT_PM2_ONLY
+                               dhd_wl_ioctl_cmd(dhd, WLC_SET_PM, (char *)&power_mode,
+                                                sizeof(power_mode), TRUE, 0);
+#endif /* SUPPORT_PM2_ONLY */
+
+#ifdef PKT_FILTER_SUPPORT
+                               /* Enable packet filter,
+                                * only allow unicast packet to send up
+                                */
+                               dhd_enable_packet_filter(1, dhd);
+#endif /* PKT_FILTER_SUPPORT */
+
+#ifdef PASS_ALL_MCAST_PKTS
+                               allmulti = 0;
+                               bcm_mkiovar("allmulti", (char *)&allmulti, 4,
+                                       iovbuf, sizeof(iovbuf));
+                               for (i = 0; i < DHD_MAX_IFS; i++) {
+                                       if (dhdinfo->iflist[i] && dhdinfo->iflist[i]->net)
+                                               dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+                                                       sizeof(iovbuf), TRUE, i);
+                               }
+#endif /* PASS_ALL_MCAST_PKTS */
+
+                               /* If DTIM skip is set up as default, force it to wake
+                                * each third DTIM for better power savings.  Note that
+                                * one side effect is a chance to miss BC/MC packet.
+                                */
+#ifdef WLTDLS
+                               /* Do not set bcn_li_ditm on WFD mode */
+                               if (dhd->tdls_mode) {
+                                       bcn_li_dtim = 0;
+                               } else
+#endif /* WLTDLS */
+                               bcn_li_dtim = dhd_get_suspend_bcn_li_dtim(dhd);
+                               bcm_mkiovar("bcn_li_dtim", (char *)&bcn_li_dtim,
+                                       4, iovbuf, sizeof(iovbuf));
+                               if (dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf),
+                                       TRUE, 0) < 0)
+                                       DHD_ERROR(("%s: set dtim failed\n", __FUNCTION__));
+
+#ifdef DHD_USE_EARLYSUSPEND
+#ifdef CUSTOM_BCN_TIMEOUT_IN_SUSPEND
+                               bcn_timeout = CUSTOM_BCN_TIMEOUT_IN_SUSPEND;
+                               bcm_mkiovar("bcn_timeout", (char *)&bcn_timeout,
+                                       4, iovbuf, sizeof(iovbuf));
+                               dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+#endif /* CUSTOM_BCN_TIMEOUT_IN_SUSPEND */
+#ifdef CUSTOM_ROAM_TIME_THRESH_IN_SUSPEND
+                               roam_time_thresh = CUSTOM_ROAM_TIME_THRESH_IN_SUSPEND;
+                               bcm_mkiovar("roam_time_thresh", (char *)&roam_time_thresh,
+                                       4, iovbuf, sizeof(iovbuf));
+                               dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+#endif /* CUSTOM_ROAM_TIME_THRESH_IN_SUSPEND */
+#ifndef ENABLE_FW_ROAM_SUSPEND
+                               /* Disable firmware roaming during suspend */
+                               bcm_mkiovar("roam_off", (char *)&roamvar, 4,
+                                       iovbuf, sizeof(iovbuf));
+                               dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+#endif /* ENABLE_FW_ROAM_SUSPEND */
+#ifdef ENABLE_BCN_LI_BCN_WAKEUP
+                               bcn_li_bcn = 0;
+                               bcm_mkiovar("bcn_li_bcn", (char *)&bcn_li_bcn,
+                                       4, iovbuf, sizeof(iovbuf));
+                               dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+#endif /* ENABLE_BCN_LI_BCN_WAKEUP */
+                               if (FW_SUPPORTED(dhd, ndoe)) {
+                                       /* enable IPv6 RA filter in  firmware during suspend */
+                                       nd_ra_filter = 1;
+                                       bcm_mkiovar("nd_ra_filter_enable", (char *)&nd_ra_filter, 4,
+                                               iovbuf, sizeof(iovbuf));
+                                       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+                                               sizeof(iovbuf), TRUE, 0)) < 0)
+                                               DHD_ERROR(("failed to set nd_ra_filter (%d)\n",
+                                                       ret));
+                               }
+#ifdef DYNAMIC_SWOOB_DURATION
+                               intr_width = CUSTOM_INTR_WIDTH;
+                               bcm_mkiovar("bus:intr_width", (char *)&intr_width, 4,
+                                       iovbuf, sizeof(iovbuf));
+                               if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+                                               sizeof(iovbuf), TRUE, 0)) < 0) {
+                                       DHD_ERROR(("failed to set intr_width (%d)\n", ret));
+                               }
+#endif /* DYNAMIC_SWOOB_DURATION */
+#endif /* DHD_USE_EARLYSUSPEND */
+                       } else {
+#ifdef PKT_FILTER_SUPPORT
+                               dhd->early_suspended = 0;
+#endif
+                               /* Kernel resumed  */
+                               DHD_ERROR(("%s: Remove extra suspend setting \n", __FUNCTION__));
+
+#ifdef SUPPORT_SENSORHUB
+                               shub_ctl.enable = 1;
+                               shub_ctl.cmd = 0x000;
+                               shub_ctl.op_mode = 0;
+                               shub_ctl.interval = 0;
+                               if (dhd->info->shub_enable == 1) {
+                                       bcm_mkiovar("shub_msreq", (char *)&shub_ctl,
+                                               sizeof(shub_ctl), iovbuf, sizeof(iovbuf));
+                                       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR,
+                                               iovbuf, sizeof(iovbuf), TRUE, 0)) < 0) {
+                                               DHD_ERROR(("%s SensorHub MS stop: failed %d\n",
+                                                       __FUNCTION__, ret));
+                                       }
+                               }
+#endif /* SUPPORT_SENSORHUB */
+
+
+#ifdef DYNAMIC_SWOOB_DURATION
+                               intr_width = 0;
+                               bcm_mkiovar("bus:intr_width", (char *)&intr_width, 4,
+                                       iovbuf, sizeof(iovbuf));
+                               if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+                                               sizeof(iovbuf), TRUE, 0)) < 0) {
+                                       DHD_ERROR(("failed to set intr_width (%d)\n", ret));
+                               }
+#endif /* DYNAMIC_SWOOB_DURATION */
+#ifndef SUPPORT_PM2_ONLY
+                               power_mode = PM_FAST;
+                               dhd_wl_ioctl_cmd(dhd, WLC_SET_PM, (char *)&power_mode,
+                                                sizeof(power_mode), TRUE, 0);
+#endif /* SUPPORT_PM2_ONLY */
+#ifdef PKT_FILTER_SUPPORT
+                               /* disable pkt filter */
+                               dhd_enable_packet_filter(0, dhd);
+#endif /* PKT_FILTER_SUPPORT */
+#ifdef PASS_ALL_MCAST_PKTS
+                               allmulti = 1;
+                               bcm_mkiovar("allmulti", (char *)&allmulti, 4,
+                                       iovbuf, sizeof(iovbuf));
+                               for (i = 0; i < DHD_MAX_IFS; i++) {
+                                       if (dhdinfo->iflist[i] && dhdinfo->iflist[i]->net)
+                                               dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+                                                       sizeof(iovbuf), TRUE, i);
+                               }
+#endif /* PASS_ALL_MCAST_PKTS */
+
+                               /* restore pre-suspend setting for dtim_skip */
+                               bcm_mkiovar("bcn_li_dtim", (char *)&bcn_li_dtim,
+                                       4, iovbuf, sizeof(iovbuf));
+
+                               dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+#ifdef DHD_USE_EARLYSUSPEND
+#ifdef CUSTOM_BCN_TIMEOUT_IN_SUSPEND
+                               bcn_timeout = CUSTOM_BCN_TIMEOUT;
+                               bcm_mkiovar("bcn_timeout", (char *)&bcn_timeout,
+                                       4, iovbuf, sizeof(iovbuf));
+                               dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+#endif /* CUSTOM_BCN_TIMEOUT_IN_SUSPEND */
+#ifdef CUSTOM_ROAM_TIME_THRESH_IN_SUSPEND
+                               roam_time_thresh = 2000;
+                               bcm_mkiovar("roam_time_thresh", (char *)&roam_time_thresh,
+                                       4, iovbuf, sizeof(iovbuf));
+                               dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+#endif /* CUSTOM_ROAM_TIME_THRESH_IN_SUSPEND */
+#ifndef ENABLE_FW_ROAM_SUSPEND
+                               roamvar = dhd_roam_disable;
+                               bcm_mkiovar("roam_off", (char *)&roamvar, 4, iovbuf,
+                                       sizeof(iovbuf));
+                               dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+#endif /* ENABLE_FW_ROAM_SUSPEND */
+#ifdef ENABLE_BCN_LI_BCN_WAKEUP
+                               bcn_li_bcn = 1;
+                               bcm_mkiovar("bcn_li_bcn", (char *)&bcn_li_bcn,
+                                       4, iovbuf, sizeof(iovbuf));
+                               dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+#endif /* ENABLE_BCN_LI_BCN_WAKEUP */
+                               if (FW_SUPPORTED(dhd, ndoe)) {
+                                       /* disable IPv6 RA filter in  firmware during suspend */
+                                       nd_ra_filter = 0;
+                                       bcm_mkiovar("nd_ra_filter_enable", (char *)&nd_ra_filter, 4,
+                                               iovbuf, sizeof(iovbuf));
+                                       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+                                               sizeof(iovbuf), TRUE, 0)) < 0)
+                                               DHD_ERROR(("failed to set nd_ra_filter (%d)\n",
+                                                       ret));
+                               }
+#endif /* DHD_USE_EARLYSUSPEND */
+                       }
+       }
+       dhd_suspend_unlock(dhd);
+
+       return 0;
+}
+
+static int dhd_suspend_resume_helper(struct dhd_info *dhd, int val, int force)
+{
+       dhd_pub_t *dhdp = &dhd->pub;
+       int ret = 0;
+
+       DHD_OS_WAKE_LOCK(dhdp);
+       DHD_PERIM_LOCK(dhdp);
+
+       /* Set flag when early suspend was called */
+       dhdp->in_suspend = val;
+       if ((force || !dhdp->suspend_disable_flag) &&
+               dhd_support_sta_mode(dhdp))
+       {
+               ret = dhd_set_suspend(val, dhdp);
+       }
+
+       DHD_PERIM_UNLOCK(dhdp);
+       DHD_OS_WAKE_UNLOCK(dhdp);
+       return ret;
+}
+
+#if defined(CONFIG_HAS_EARLYSUSPEND) && defined(DHD_USE_EARLYSUSPEND)
+static void dhd_early_suspend(struct early_suspend *h)
+{
+       struct dhd_info *dhd = container_of(h, struct dhd_info, early_suspend);
+       DHD_TRACE_HW4(("%s: enter\n", __FUNCTION__));
+
+       if (dhd)
+               dhd_suspend_resume_helper(dhd, 1, 0);
+}
+
+static void dhd_late_resume(struct early_suspend *h)
+{
+       struct dhd_info *dhd = container_of(h, struct dhd_info, early_suspend);
+       DHD_TRACE_HW4(("%s: enter\n", __FUNCTION__));
+
+       if (dhd)
+               dhd_suspend_resume_helper(dhd, 0, 0);
+}
+#endif /* CONFIG_HAS_EARLYSUSPEND && DHD_USE_EARLYSUSPEND */
+
+/*
+ * Generalized timeout mechanism.  Uses spin sleep with exponential back-off until
+ * the sleep time reaches one jiffy, then switches over to task delay.  Usage:
+ *
+ *      dhd_timeout_start(&tmo, usec);
+ *      while (!dhd_timeout_expired(&tmo))
+ *              if (poll_something())
+ *                      break;
+ *      if (dhd_timeout_expired(&tmo))
+ *              fatal();
+ */
+
+void
+dhd_timeout_start(dhd_timeout_t *tmo, uint usec)
+{
+       tmo->limit = usec;
+       tmo->increment = 0;
+       tmo->elapsed = 0;
+       tmo->tick = jiffies_to_usecs(1);
+}
+
+int
+dhd_timeout_expired(dhd_timeout_t *tmo)
+{
+       /* Does nothing the first call */
+       if (tmo->increment == 0) {
+               tmo->increment = 1;
+               return 0;
+       }
+
+       if (tmo->elapsed >= tmo->limit)
+               return 1;
+
+       /* Add the delay that's about to take place */
+       tmo->elapsed += tmo->increment;
+
+       if ((!CAN_SLEEP()) || tmo->increment < tmo->tick) {
+               OSL_DELAY(tmo->increment);
+               tmo->increment *= 2;
+               if (tmo->increment > tmo->tick)
+                       tmo->increment = tmo->tick;
+       } else {
+               wait_queue_head_t delay_wait;
+               DECLARE_WAITQUEUE(wait, current);
+               init_waitqueue_head(&delay_wait);
+               add_wait_queue(&delay_wait, &wait);
+               set_current_state(TASK_INTERRUPTIBLE);
+               (void)schedule_timeout(1);
+               remove_wait_queue(&delay_wait, &wait);
+               set_current_state(TASK_RUNNING);
+       }
+
+       return 0;
+}
+
+int
+dhd_net2idx(dhd_info_t *dhd, struct net_device *net)
+{
+       int i = 0;
+
+       if (!dhd) {
+               DHD_ERROR(("%s : DHD_BAD_IF return\n", __FUNCTION__));
+               return DHD_BAD_IF;
+       }
+
+       while (i < DHD_MAX_IFS) {
+               if (dhd->iflist[i] && dhd->iflist[i]->net && (dhd->iflist[i]->net == net))
+                       return i;
+               i++;
+       }
+
+       return DHD_BAD_IF;
+}
+
+struct net_device * dhd_idx2net(void *pub, int ifidx)
+{
+       struct dhd_pub *dhd_pub = (struct dhd_pub *)pub;
+       struct dhd_info *dhd_info;
+
+       if (!dhd_pub || ifidx < 0 || ifidx >= DHD_MAX_IFS)
+               return NULL;
+       dhd_info = dhd_pub->info;
+       if (dhd_info && dhd_info->iflist[ifidx])
+               return dhd_info->iflist[ifidx]->net;
+       return NULL;
+}
+
+int
+dhd_ifname2idx(dhd_info_t *dhd, char *name)
+{
+       int i = DHD_MAX_IFS;
+
+       ASSERT(dhd);
+
+       if (name == NULL || *name == '\0')
+               return 0;
+
+       while (--i > 0)
+               if (dhd->iflist[i] && !strncmp(dhd->iflist[i]->dngl_name, name, IFNAMSIZ))
+                               break;
+
+       DHD_TRACE(("%s: return idx %d for \"%s\"\n", __FUNCTION__, i, name));
+
+       return i;       /* default - the primary interface */
+}
+
+char *
+dhd_ifname(dhd_pub_t *dhdp, int ifidx)
+{
+       dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+
+       ASSERT(dhd);
+
+       if (ifidx < 0 || ifidx >= DHD_MAX_IFS) {
+               DHD_ERROR(("%s: ifidx %d out of range\n", __FUNCTION__, ifidx));
+               return "<if_bad>";
+       }
+
+       if (dhd->iflist[ifidx] == NULL) {
+               DHD_ERROR(("%s: null i/f %d\n", __FUNCTION__, ifidx));
+               return "<if_null>";
+       }
+
+       if (dhd->iflist[ifidx]->net)
+               return dhd->iflist[ifidx]->net->name;
+
+       return "<if_none>";
+}
+
+uint8 *
+dhd_bssidx2bssid(dhd_pub_t *dhdp, int idx)
+{
+       int i;
+       dhd_info_t *dhd = (dhd_info_t *)dhdp;
+
+       ASSERT(dhd);
+       for (i = 0; i < DHD_MAX_IFS; i++)
+       if (dhd->iflist[i] && dhd->iflist[i]->bssidx == idx)
+               return dhd->iflist[i]->mac_addr;
+
+       return NULL;
+}
+
+
+static void
+_dhd_set_multicast_list(dhd_info_t *dhd, int ifidx)
+{
+       struct net_device *dev;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)
+       struct netdev_hw_addr *ha;
+#else
+       struct dev_mc_list *mclist;
+#endif
+       uint32 allmulti, cnt;
+
+       wl_ioctl_t ioc;
+       char *buf, *bufp;
+       uint buflen;
+       int ret;
+
+       if (!dhd->iflist[ifidx]) {
+               DHD_ERROR(("%s : dhd->iflist[%d] was NULL\n", __FUNCTION__, ifidx));
+               return;
+       }
+       dev = dhd->iflist[ifidx]->net;
+       if (!dev)
+               return;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+       netif_addr_lock_bh(dev);
+#endif /* LINUX >= 2.6.27 */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)
+       cnt = netdev_mc_count(dev);
+#else
+       cnt = dev->mc_count;
+#endif /* LINUX >= 2.6.35 */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+       netif_addr_unlock_bh(dev);
+#endif /* LINUX >= 2.6.27 */
+
+       /* Determine initial value of allmulti flag */
+       allmulti = (dev->flags & IFF_ALLMULTI) ? TRUE : FALSE;
+
+#ifdef PASS_ALL_MCAST_PKTS
+#ifdef PKT_FILTER_SUPPORT
+       if (!dhd->pub.early_suspended)
+#endif /* PKT_FILTER_SUPPORT */
+               allmulti = TRUE;
+#endif /* PASS_ALL_MCAST_PKTS */
+
+       /* Send down the multicast list first. */
+
+
+       buflen = sizeof("mcast_list") + sizeof(cnt) + (cnt * ETHER_ADDR_LEN);
+       if (!(bufp = buf = MALLOC(dhd->pub.osh, buflen))) {
+               DHD_ERROR(("%s: out of memory for mcast_list, cnt %d\n",
+                          dhd_ifname(&dhd->pub, ifidx), cnt));
+               return;
+       }
+
+       strncpy(bufp, "mcast_list", buflen - 1);
+       bufp[buflen - 1] = '\0';
+       bufp += strlen("mcast_list") + 1;
+
+       cnt = htol32(cnt);
+       memcpy(bufp, &cnt, sizeof(cnt));
+       bufp += sizeof(cnt);
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+       netif_addr_lock_bh(dev);
+#endif /* LINUX >= 2.6.27 */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)
+       netdev_for_each_mc_addr(ha, dev) {
+               if (!cnt)
+                       break;
+               memcpy(bufp, ha->addr, ETHER_ADDR_LEN);
+               bufp += ETHER_ADDR_LEN;
+               cnt--;
+       }
+#else /* LINUX < 2.6.35 */
+       for (mclist = dev->mc_list; (mclist && (cnt > 0));
+               cnt--, mclist = mclist->next) {
+               memcpy(bufp, (void *)mclist->dmi_addr, ETHER_ADDR_LEN);
+               bufp += ETHER_ADDR_LEN;
+       }
+#endif /* LINUX >= 2.6.35 */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+       netif_addr_unlock_bh(dev);
+#endif /* LINUX >= 2.6.27 */
+
+       memset(&ioc, 0, sizeof(ioc));
+       ioc.cmd = WLC_SET_VAR;
+       ioc.buf = buf;
+       ioc.len = buflen;
+       ioc.set = TRUE;
+
+       ret = dhd_wl_ioctl(&dhd->pub, ifidx, &ioc, ioc.buf, ioc.len);
+       if (ret < 0) {
+               DHD_ERROR(("%s: set mcast_list failed, cnt %d\n",
+                       dhd_ifname(&dhd->pub, ifidx), cnt));
+               allmulti = cnt ? TRUE : allmulti;
+       }
+
+       MFREE(dhd->pub.osh, buf, buflen);
+
+       /* Now send the allmulti setting.  This is based on the setting in the
+        * net_device flags, but might be modified above to be turned on if we
+        * were trying to set some addresses and dongle rejected it...
+        */
+
+       buflen = sizeof("allmulti") + sizeof(allmulti);
+       if (!(buf = MALLOC(dhd->pub.osh, buflen))) {
+               DHD_ERROR(("%s: out of memory for allmulti\n", dhd_ifname(&dhd->pub, ifidx)));
+               return;
+       }
+       allmulti = htol32(allmulti);
+
+       if (!bcm_mkiovar("allmulti", (void*)&allmulti, sizeof(allmulti), buf, buflen)) {
+               DHD_ERROR(("%s: mkiovar failed for allmulti, datalen %d buflen %u\n",
+                          dhd_ifname(&dhd->pub, ifidx), (int)sizeof(allmulti), buflen));
+               MFREE(dhd->pub.osh, buf, buflen);
+               return;
+       }
+
+
+       memset(&ioc, 0, sizeof(ioc));
+       ioc.cmd = WLC_SET_VAR;
+       ioc.buf = buf;
+       ioc.len = buflen;
+       ioc.set = TRUE;
+
+       ret = dhd_wl_ioctl(&dhd->pub, ifidx, &ioc, ioc.buf, ioc.len);
+       if (ret < 0) {
+               DHD_ERROR(("%s: set allmulti %d failed\n",
+                          dhd_ifname(&dhd->pub, ifidx), ltoh32(allmulti)));
+       }
+
+       MFREE(dhd->pub.osh, buf, buflen);
+
+       /* Finally, pick up the PROMISC flag as well, like the NIC driver does */
+
+       allmulti = (dev->flags & IFF_PROMISC) ? TRUE : FALSE;
+
+       allmulti = htol32(allmulti);
+
+       memset(&ioc, 0, sizeof(ioc));
+       ioc.cmd = WLC_SET_PROMISC;
+       ioc.buf = &allmulti;
+       ioc.len = sizeof(allmulti);
+       ioc.set = TRUE;
+
+       ret = dhd_wl_ioctl(&dhd->pub, ifidx, &ioc, ioc.buf, ioc.len);
+       if (ret < 0) {
+               DHD_ERROR(("%s: set promisc %d failed\n",
+                          dhd_ifname(&dhd->pub, ifidx), ltoh32(allmulti)));
+       }
+}
+
+int
+_dhd_set_mac_address(dhd_info_t *dhd, int ifidx, uint8 *addr)
+{
+       char buf[32];
+       wl_ioctl_t ioc;
+       int ret;
+
+       if (!bcm_mkiovar("cur_etheraddr", (char*)addr, ETHER_ADDR_LEN, buf, 32)) {
+               DHD_ERROR(("%s: mkiovar failed for cur_etheraddr\n", dhd_ifname(&dhd->pub, ifidx)));
+               return -1;
+       }
+       memset(&ioc, 0, sizeof(ioc));
+       ioc.cmd = WLC_SET_VAR;
+       ioc.buf = buf;
+       ioc.len = 32;
+       ioc.set = TRUE;
+
+       ret = dhd_wl_ioctl(&dhd->pub, ifidx, &ioc, ioc.buf, ioc.len);
+       if (ret < 0) {
+               DHD_ERROR(("%s: set cur_etheraddr failed\n", dhd_ifname(&dhd->pub, ifidx)));
+       } else {
+               memcpy(dhd->iflist[ifidx]->net->dev_addr, addr, ETHER_ADDR_LEN);
+               if (ifidx == 0)
+                       memcpy(dhd->pub.mac.octet, addr, ETHER_ADDR_LEN);
+       }
+
+       return ret;
+}
+
+#ifdef SOFTAP
+extern struct net_device *ap_net_dev;
+extern tsk_ctl_t ap_eth_ctl; /* ap netdev heper thread ctl */
+#endif
+
+#ifdef DHD_PSTA
+/* Get psta/psr configuration configuration */
+int dhd_get_psta_mode(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd = dhdp->info;
+       return (int)dhd->psta_mode;
+}
+/* Set psta/psr configuration configuration */
+int dhd_set_psta_mode(dhd_pub_t *dhdp, uint32 val)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd->psta_mode = val;
+       return 0;
+}
+#endif /* DHD_PSTA */
+
+static void
+dhd_ifadd_event_handler(void *handle, void *event_info, u8 event)
+{
+       dhd_info_t *dhd = handle;
+       dhd_if_event_t *if_event = event_info;
+       struct net_device *ndev;
+       int ifidx, bssidx;
+       int ret;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 0))
+       struct wireless_dev *vwdev, *primary_wdev;
+       struct net_device *primary_ndev;
+#endif /* OEM_ANDROID && (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 0)) */
+
+       if (event != DHD_WQ_WORK_IF_ADD) {
+               DHD_ERROR(("%s: unexpected event \n", __FUNCTION__));
+               return;
+       }
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd info not available \n", __FUNCTION__));
+               return;
+       }
+
+       if (!if_event) {
+               DHD_ERROR(("%s: event data is null \n", __FUNCTION__));
+               return;
+       }
+
+       dhd_net_if_lock_local(dhd);
+       DHD_OS_WAKE_LOCK(&dhd->pub);
+       DHD_PERIM_LOCK(&dhd->pub);
+
+       ifidx = if_event->event.ifidx;
+       bssidx = if_event->event.bssidx;
+       DHD_TRACE(("%s: registering if with ifidx %d\n", __FUNCTION__, ifidx));
+
+       /* This path is for non-android case */
+       /* The interface name in host and in event msg are same */
+       /* if name in event msg is used to create dongle if list on host */
+       ndev = dhd_allocate_if(&dhd->pub, ifidx, if_event->name,
+               if_event->mac, bssidx, TRUE, if_event->name);
+       if (!ndev) {
+               DHD_ERROR(("%s: net device alloc failed  \n", __FUNCTION__));
+               goto done;
+       }
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 0))
+       vwdev = kzalloc(sizeof(*vwdev), GFP_KERNEL);
+       if (unlikely(!vwdev)) {
+               DHD_ERROR(("Could not allocate wireless device\n"));
+               goto done;
+       }
+       primary_ndev = dhd->pub.info->iflist[0]->net;
+       primary_wdev = ndev_to_wdev(primary_ndev);
+       vwdev->wiphy = primary_wdev->wiphy;
+       vwdev->iftype = if_event->event.role;
+       vwdev->netdev = ndev;
+       ndev->ieee80211_ptr = vwdev;
+       SET_NETDEV_DEV(ndev, wiphy_dev(vwdev->wiphy));
+       DHD_ERROR(("virtual interface(%s) is created\n", if_event->name));
+#endif /* OEM_ANDROID && (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 0)) */
+
+       DHD_PERIM_UNLOCK(&dhd->pub);
+       ret = dhd_register_if(&dhd->pub, ifidx, TRUE);
+       DHD_PERIM_LOCK(&dhd->pub);
+       if (ret != BCME_OK) {
+               DHD_ERROR(("%s: dhd_register_if failed\n", __FUNCTION__));
+               dhd_remove_if(&dhd->pub, ifidx, TRUE);
+               goto done;
+       }
+#ifdef PCIE_FULL_DONGLE
+       /* Turn on AP isolation in the firmware for interfaces operating in AP mode */
+       if (FW_SUPPORTED((&dhd->pub), ap) && (if_event->event.role != WLC_E_IF_ROLE_STA)) {
+               char iovbuf[WLC_IOCTL_SMLEN];
+               uint32 var_int =  1;
+
+               memset(iovbuf, 0, sizeof(iovbuf));
+               bcm_mkiovar("ap_isolate", (char *)&var_int, 4, iovbuf, sizeof(iovbuf));
+               ret = dhd_wl_ioctl_cmd(&dhd->pub, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, ifidx);
+
+               if (ret != BCME_OK) {
+                       DHD_ERROR(("%s: Failed to set ap_isolate to dongle\n", __FUNCTION__));
+                       dhd_remove_if(&dhd->pub, ifidx, TRUE);
+               }
+       }
+#endif /* PCIE_FULL_DONGLE */
+
+done:
+       MFREE(dhd->pub.osh, if_event, sizeof(dhd_if_event_t));
+
+       DHD_PERIM_UNLOCK(&dhd->pub);
+       DHD_OS_WAKE_UNLOCK(&dhd->pub);
+       dhd_net_if_unlock_local(dhd);
+}
+
+static void
+dhd_ifdel_event_handler(void *handle, void *event_info, u8 event)
+{
+       dhd_info_t *dhd = handle;
+       int ifidx;
+       dhd_if_event_t *if_event = event_info;
+
+
+       if (event != DHD_WQ_WORK_IF_DEL) {
+               DHD_ERROR(("%s: unexpected event \n", __FUNCTION__));
+               return;
+       }
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd info not available \n", __FUNCTION__));
+               return;
+       }
+
+       if (!if_event) {
+               DHD_ERROR(("%s: event data is null \n", __FUNCTION__));
+               return;
+       }
+
+       dhd_net_if_lock_local(dhd);
+       DHD_OS_WAKE_LOCK(&dhd->pub);
+       DHD_PERIM_LOCK(&dhd->pub);
+
+       ifidx = if_event->event.ifidx;
+       DHD_TRACE(("Removing interface with idx %d\n", ifidx));
+
+       DHD_PERIM_UNLOCK(&dhd->pub);
+       dhd_remove_if(&dhd->pub, ifidx, TRUE);
+       DHD_PERIM_LOCK(&dhd->pub);
+
+       MFREE(dhd->pub.osh, if_event, sizeof(dhd_if_event_t));
+
+       DHD_PERIM_UNLOCK(&dhd->pub);
+       DHD_OS_WAKE_UNLOCK(&dhd->pub);
+       dhd_net_if_unlock_local(dhd);
+}
+
+static void
+dhd_set_mac_addr_handler(void *handle, void *event_info, u8 event)
+{
+       dhd_info_t *dhd = handle;
+       dhd_if_t *ifp = NULL;
+       int ifidx = (int)((long int)event_info);
+
+       if (event != DHD_WQ_WORK_SET_MAC) {
+               DHD_ERROR(("%s: unexpected event \n", __FUNCTION__));
+       }
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd info not available \n", __FUNCTION__));
+               return;
+       }
+
+       dhd_net_if_lock_local(dhd);
+       DHD_OS_WAKE_LOCK(&dhd->pub);
+       DHD_PERIM_LOCK(&dhd->pub);
+
+       ifp = dhd->iflist[ifidx];
+       if (ifp == NULL || !dhd->pub.up) {
+               DHD_ERROR(("%s: interface info not available/down \n", __FUNCTION__));
+               goto done;
+       }
+
+#if defined(SOFTAP) && defined(USE_IW)
+       {
+               unsigned long flags;
+               DHD_GENERAL_LOCK(&dhd->pub, flags);
+               if (ap_net_dev != NULL) {
+                       DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+                       DHD_ERROR(("attempt to set MAC for %s in AP Mode, blocked. \n",
+                                  ifp->net->name));
+                       goto done;
+               }
+               DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+       }
+#endif /* SOFTAP  && USE_IW */
+       DHD_ERROR(("%s: MACID is overwritten\n", __FUNCTION__));
+       ifp->set_macaddress = FALSE;
+       if (_dhd_set_mac_address(dhd, ifp->idx, ifp->mac_addr) == 0)
+               DHD_INFO(("%s: MACID is overwritten\n", __FUNCTION__));
+       else
+               DHD_ERROR(("%s: _dhd_set_mac_address() failed\n", __FUNCTION__));
+
+done:
+       DHD_PERIM_UNLOCK(&dhd->pub);
+       DHD_OS_WAKE_UNLOCK(&dhd->pub);
+       dhd_net_if_unlock_local(dhd);
+}
+
+static void
+dhd_set_mcast_list_handler(void *handle, void *event_info, u8 event)
+{
+       dhd_info_t *dhd = handle;
+       dhd_if_t *ifp = NULL;
+       int ifidx = (int)((long int)event_info);
+
+       if (event != DHD_WQ_WORK_SET_MCAST_LIST) {
+               DHD_ERROR(("%s: unexpected event \n", __FUNCTION__));
+               return;
+       }
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd info not available \n", __FUNCTION__));
+               return;
+       }
+
+       dhd_net_if_lock_local(dhd);
+       DHD_OS_WAKE_LOCK(&dhd->pub);
+       DHD_PERIM_LOCK(&dhd->pub);
+
+       ifp = dhd->iflist[ifidx];
+
+       if (ifp == NULL || !dhd->pub.up) {
+               DHD_ERROR(("%s: interface info not available/down \n", __FUNCTION__));
+               goto done;
+       }
+
+#if defined(SOFTAP) && defined(USE_IW)
+       {
+               unsigned long flags;
+               DHD_GENERAL_LOCK(&dhd->pub, flags);
+               if (ap_net_dev != NULL) {
+                       DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+                       DHD_ERROR(("set MULTICAST list for %s in AP Mode, blocked. \n",
+                                  ifp->net->name));
+                       ifp->set_multicast = FALSE;
+                       goto done;
+               }
+               DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+       }
+#endif /* SOFTAP && USE_IW */
+
+
+       _dhd_set_multicast_list(dhd, ifidx);
+       DHD_INFO(("%s: set multicast list for if %d\n", __FUNCTION__, ifidx));
+
+done:
+       DHD_PERIM_UNLOCK(&dhd->pub);
+       DHD_OS_WAKE_UNLOCK(&dhd->pub);
+       dhd_net_if_unlock_local(dhd);
+}
+
+static int
+dhd_set_mac_address(struct net_device *dev, void *addr)
+{
+       int ret = 0;
+
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       struct sockaddr *sa = (struct sockaddr *)addr;
+       int ifidx;
+       dhd_if_t *dhdif;
+
+       ifidx = dhd_net2idx(dhd, dev);
+       if (ifidx == DHD_BAD_IF)
+               return -1;
+
+       dhdif = dhd->iflist[ifidx];
+
+       dhd_net_if_lock_local(dhd);
+       memcpy(dhdif->mac_addr, sa->sa_data, ETHER_ADDR_LEN);
+       dhdif->set_macaddress = TRUE;
+       dhd_net_if_unlock_local(dhd);
+       dhd_deferred_schedule_work(dhd->dhd_deferred_wq, (void *)((long int)ifidx),
+               DHD_WQ_WORK_SET_MAC, dhd_set_mac_addr_handler, DHD_WORK_PRIORITY_LOW);
+       return ret;
+}
+
+static void
+dhd_set_multicast_list(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       int ifidx;
+
+       ifidx = dhd_net2idx(dhd, dev);
+       if (ifidx == DHD_BAD_IF)
+               return;
+
+       dhd->iflist[ifidx]->set_multicast = TRUE;
+       dhd_deferred_schedule_work(dhd->dhd_deferred_wq, (void *)((long int)ifidx),
+               DHD_WQ_WORK_SET_MCAST_LIST, dhd_set_mcast_list_handler, DHD_WORK_PRIORITY_LOW);
+}
+
+#ifdef PROP_TXSTATUS
+int
+dhd_os_wlfc_block(dhd_pub_t *pub)
+{
+       dhd_info_t *di = (dhd_info_t *)(pub->info);
+       ASSERT(di != NULL);
+       spin_lock_bh(&di->wlfc_spinlock);
+       return 1;
+}
+
+int
+dhd_os_wlfc_unblock(dhd_pub_t *pub)
+{
+       dhd_info_t *di = (dhd_info_t *)(pub->info);
+
+       ASSERT(di != NULL);
+       spin_unlock_bh(&di->wlfc_spinlock);
+       return 1;
+}
+
+#endif /* PROP_TXSTATUS */
+
+#if defined(DHD_8021X_DUMP)
+void
+dhd_tx_dump(struct net_device *ndev, osl_t *osh, void *pkt)
+{
+       uint8 *dump_data;
+       uint16 protocol;
+       char *ifname;
+
+       dump_data = PKTDATA(osh, pkt);
+       protocol = (dump_data[12] << 8) | dump_data[13];
+       ifname = ndev ? ndev->name : "N/A";
+
+       if (protocol == ETHER_TYPE_802_1X) {
+               dhd_dump_eapol_4way_message(ifname, dump_data, TRUE);
+       }
+}
+#endif /* DHD_8021X_DUMP */
+
+/*  This routine do not support Packet chain feature, Currently tested for
+ *  proxy arp feature
+ */
+int dhd_sendup(dhd_pub_t *dhdp, int ifidx, void *p)
+{
+       struct sk_buff *skb;
+       void *skbhead = NULL;
+       void *skbprev = NULL;
+       dhd_if_t *ifp;
+       ASSERT(!PKTISCHAINED(p));
+       skb = PKTTONATIVE(dhdp->osh, p);
+
+       ifp = dhdp->info->iflist[ifidx];
+       skb->dev = ifp->net;
+#if defined(BCM_GMAC3)
+       /* Forwarder capable interfaces use WOFA based forwarding */
+       if (ifp->fwdh) {
+               struct ether_header *eh = (struct ether_header *)PKTDATA(dhdp->osh, p);
+               uint16 * da = (uint16 *)(eh->ether_dhost);
+               wofa_t wofa;
+               ASSERT(ISALIGNED(da, 2));
+
+               wofa = fwder_lookup(ifp->fwdh->mate, da, ifp->idx);
+               if (wofa == FWDER_WOFA_INVALID) { /* Unknown MAC address */
+                       if (fwder_transmit(ifp->fwdh, skb, 1, skb->dev) == FWDER_SUCCESS) {
+                               return BCME_OK;
+                       }
+               }
+               PKTFRMNATIVE(dhdp->osh, p);
+               PKTFREE(dhdp->osh, p, FALSE);
+               return BCME_OK;
+       }
+#endif /* BCM_GMAC3 */
+
+       skb->protocol = eth_type_trans(skb, skb->dev);
+
+       if (in_interrupt()) {
+               bcm_object_trace_opr(skb, BCM_OBJDBG_REMOVE,
+                       __FUNCTION__, __LINE__);
+               netif_rx(skb);
+       } else {
+               if (dhdp->info->rxthread_enabled) {
+                       if (!skbhead) {
+                               skbhead = skb;
+                       } else {
+                               PKTSETNEXT(dhdp->osh, skbprev, skb);
+                       }
+                       skbprev = skb;
+               } else {
+                       /* If the receive is not processed inside an ISR,
+                        * the softirqd must be woken explicitly to service
+                        * the NET_RX_SOFTIRQ.  In 2.6 kernels, this is handled
+                        * by netif_rx_ni(), but in earlier kernels, we need
+                        * to do it manually.
+                        */
+                       bcm_object_trace_opr(skb, BCM_OBJDBG_REMOVE,
+                               __FUNCTION__, __LINE__);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)
+                       netif_rx_ni(skb);
+#else
+                       ulong flags;
+                       netif_rx(skb);
+                       local_irq_save(flags);
+                       RAISE_RX_SOFTIRQ();
+                       local_irq_restore(flags);
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0) */
+               }
+       }
+
+       if (dhdp->info->rxthread_enabled && skbhead)
+               dhd_sched_rxf(dhdp, skbhead);
+
+       return BCME_OK;
+}
+
+int BCMFASTPATH
+__dhd_sendpkt(dhd_pub_t *dhdp, int ifidx, void *pktbuf)
+{
+       int ret = BCME_OK;
+       dhd_info_t *dhd = (dhd_info_t *)(dhdp->info);
+       struct ether_header *eh = NULL;
+#ifdef DHD_L2_FILTER
+       dhd_if_t *ifp = dhd_get_ifp(dhdp, ifidx);
+#endif
+#ifdef DHD_8021X_DUMP
+       struct net_device *ndev;
+#endif /* DHD_8021X_DUMP */
+
+       /* Reject if down */
+       if (!dhdp->up || (dhdp->busstate == DHD_BUS_DOWN)) {
+               /* free the packet here since the caller won't */
+               PKTCFREE(dhdp->osh, pktbuf, TRUE);
+               return -ENODEV;
+       }
+
+#ifdef PCIE_FULL_DONGLE
+       if (dhdp->busstate == DHD_BUS_SUSPEND) {
+               DHD_ERROR(("%s : pcie is still in suspend state!!\n", __FUNCTION__));
+               PKTFREE(dhdp->osh, pktbuf, TRUE);
+               return -EBUSY;
+       }
+#endif /* PCIE_FULL_DONGLE */
+
+#ifdef DHD_L2_FILTER
+       /* if dhcp_unicast is enabled, we need to convert the */
+       /* broadcast DHCP ACK/REPLY packets to Unicast. */
+       if (ifp->dhcp_unicast) {
+           uint8* mac_addr;
+           uint8* ehptr = NULL;
+           int ret;
+           ret = bcm_l2_filter_get_mac_addr_dhcp_pkt(dhdp->osh, pktbuf, ifidx, &mac_addr);
+           if (ret == BCME_OK) {
+               /*  if given mac address having valid entry in sta list
+                *  copy the given mac address, and return with BCME_OK
+               */
+               if (dhd_find_sta(dhdp, ifidx, mac_addr)) {
+                   ehptr = PKTDATA(dhdp->osh, pktbuf);
+                   bcopy(mac_addr, ehptr + ETHER_DEST_OFFSET, ETHER_ADDR_LEN);
+               }
+           }
+       }
+
+       if (ifp->grat_arp && DHD_IF_ROLE_AP(dhdp, ifidx)) {
+           if (bcm_l2_filter_gratuitous_arp(dhdp->osh, pktbuf) == BCME_OK) {
+                       PKTCFREE(dhdp->osh, pktbuf, TRUE);
+                       return BCME_ERROR;
+           }
+       }
+
+       if (ifp->parp_enable && DHD_IF_ROLE_AP(dhdp, ifidx)) {
+               ret = dhd_l2_filter_pkt_handle(dhdp, ifidx, pktbuf, TRUE);
+
+               /* Drop the packets if l2 filter has processed it already
+                * otherwise continue with the normal path
+                */
+               if (ret == BCME_OK) {
+                       PKTCFREE(dhdp->osh, pktbuf, TRUE);
+                       return BCME_ERROR;
+               }
+       }
+#endif /* DHD_L2_FILTER */
+       /* Update multicast statistic */
+       if (PKTLEN(dhdp->osh, pktbuf) >= ETHER_HDR_LEN) {
+               uint8 *pktdata = (uint8 *)PKTDATA(dhdp->osh, pktbuf);
+               eh = (struct ether_header *)pktdata;
+
+               if (ETHER_ISMULTI(eh->ether_dhost))
+                       dhdp->tx_multicast++;
+               if (ntoh16(eh->ether_type) == ETHER_TYPE_802_1X) {
+#ifdef DHD_LOSSLESS_ROAMING
+                       uint8 prio = (uint8)PKTPRIO(pktbuf);
+
+                       /* back up 802.1x's priority */
+                       dhdp->prio_8021x = prio;
+#endif /* DHD_LOSSLESS_ROAMING */
+                       atomic_inc(&dhd->pend_8021x_cnt);
+               }
+#ifdef DHD_DHCP_DUMP
+               if (ntoh16(eh->ether_type) == ETHER_TYPE_IP) {
+                       uint16 dump_hex;
+                       uint16 source_port;
+                       uint16 dest_port;
+                       uint16 udp_port_pos;
+                       uint8 *ptr8 = (uint8 *)&pktdata[ETHER_HDR_LEN];
+                       uint8 ip_header_len = (*ptr8 & 0x0f)<<2;
+                       struct net_device *net;
+                       char *ifname;
+
+                       net = dhd_idx2net(dhdp, ifidx);
+                       ifname = net ? net->name : "N/A";
+                       udp_port_pos = ETHER_HDR_LEN + ip_header_len;
+                       source_port = (pktdata[udp_port_pos] << 8) | pktdata[udp_port_pos+1];
+                       dest_port = (pktdata[udp_port_pos+2] << 8) | pktdata[udp_port_pos+3];
+                       if (source_port == 0x0044 || dest_port == 0x0044) {
+                               dump_hex = (pktdata[udp_port_pos+249] << 8) |
+                                       pktdata[udp_port_pos+250];
+                               if (dump_hex == 0x0101) {
+                                       DHD_ERROR(("DHCP[%s] - DISCOVER [TX]", ifname));
+                               } else if (dump_hex == 0x0102) {
+                                       DHD_ERROR(("DHCP[%s] - OFFER [TX]", ifname));
+                               } else if (dump_hex == 0x0103) {
+                                       DHD_ERROR(("DHCP[%s] - REQUEST [TX]", ifname));
+                               } else if (dump_hex == 0x0105) {
+                                       DHD_ERROR(("DHCP[%s] - ACK [TX]", ifname));
+                               } else {
+                                       DHD_ERROR(("DHCP[%s] - 0x%X [TX]", ifname, dump_hex));
+                               }
+#ifdef DHD_LOSSLESS_ROAMING
+                               if (dhdp->dequeue_prec_map != (uint8)ALLPRIO) {
+                                       DHD_ERROR(("/%d", dhdp->dequeue_prec_map));
+                               }
+#endif /* DHD_LOSSLESS_ROAMING */
+                               DHD_ERROR(("\n"));
+                       } else if (source_port == 0x0043 || dest_port == 0x0043) {
+                               DHD_ERROR(("DHCP[%s] - BOOTP [RX]\n", ifname));
+                       }
+               }
+#endif /* DHD_DHCP_DUMP */
+       } else {
+                       PKTCFREE(dhdp->osh, pktbuf, TRUE);
+                       return BCME_ERROR;
+       }
+
+       /* Look into the packet and update the packet priority */
+#ifndef PKTPRIO_OVERRIDE
+       if (PKTPRIO(pktbuf) == 0)
+#endif /* !PKTPRIO_OVERRIDE */
+       {
+#ifdef QOS_MAP_SET
+               pktsetprio_qms(pktbuf, wl_get_up_table(DHD_GET_CFG80211_PRIV(dhdp)), FALSE);
+#else
+               pktsetprio(pktbuf, FALSE);
+#endif /* QOS_MAP_SET */
+       }
+
+
+#ifdef PCIE_FULL_DONGLE
+       /*
+        * Lkup the per interface hash table, for a matching flowring. If one is not
+        * available, allocate a unique flowid and add a flowring entry.
+        * The found or newly created flowid is placed into the pktbuf's tag.
+        */
+       ret = dhd_flowid_update(dhdp, ifidx, dhdp->flow_prio_map[(PKTPRIO(pktbuf))], pktbuf);
+       if (ret != BCME_OK) {
+               PKTCFREE(dhd->pub.osh, pktbuf, TRUE);
+               return ret;
+       }
+#endif
+
+#ifdef PROP_TXSTATUS
+       if (dhd_wlfc_is_supported(dhdp)) {
+               /* store the interface ID */
+               DHD_PKTTAG_SETIF(PKTTAG(pktbuf), ifidx);
+
+               /* store destination MAC in the tag as well */
+               DHD_PKTTAG_SETDSTN(PKTTAG(pktbuf), eh->ether_dhost);
+
+               /* decide which FIFO this packet belongs to */
+               if (ETHER_ISMULTI(eh->ether_dhost))
+                       /* one additional queue index (highest AC + 1) is used for bc/mc queue */
+                       DHD_PKTTAG_SETFIFO(PKTTAG(pktbuf), AC_COUNT);
+               else
+                       DHD_PKTTAG_SETFIFO(PKTTAG(pktbuf), WME_PRIO2AC(PKTPRIO(pktbuf)));
+       } else
+#endif /* PROP_TXSTATUS */
+       {
+               /* If the protocol uses a data header, apply it */
+               dhd_prot_hdrpush(dhdp, ifidx, pktbuf);
+       }
+
+       /* Use bus module to send data frame */
+#ifdef WLMEDIA_HTSF
+       dhd_htsf_addtxts(dhdp, pktbuf);
+#endif
+#if defined(DHD_8021X_DUMP)
+       ndev = dhd_idx2net(dhdp, ifidx);
+       dhd_tx_dump(ndev, dhdp->osh, pktbuf);
+#endif
+#ifdef PROP_TXSTATUS
+       {
+               if (dhd_wlfc_commit_packets(dhdp, (f_commitpkt_t)dhd_bus_txdata,
+                       dhdp->bus, pktbuf, TRUE) == WLFC_UNSUPPORTED) {
+                       /* non-proptxstatus way */
+#ifdef BCMPCIE
+                       ret = dhd_bus_txdata(dhdp->bus, pktbuf, (uint8)ifidx);
+#else
+                       ret = dhd_bus_txdata(dhdp->bus, pktbuf);
+#endif /* BCMPCIE */
+               }
+       }
+#else
+#ifdef BCMPCIE
+       ret = dhd_bus_txdata(dhdp->bus, pktbuf, (uint8)ifidx);
+#else
+       ret = dhd_bus_txdata(dhdp->bus, pktbuf);
+#endif /* BCMPCIE */
+#endif /* PROP_TXSTATUS */
+
+       return ret;
+}
+
+int BCMFASTPATH
+dhd_sendpkt(dhd_pub_t *dhdp, int ifidx, void *pktbuf)
+{
+       int ret = 0;
+       unsigned long flags;
+
+       DHD_GENERAL_LOCK(dhdp, flags);
+       if (dhdp->busstate == DHD_BUS_DOWN ||
+                       dhdp->busstate == DHD_BUS_DOWN_IN_PROGRESS) {
+               DHD_ERROR(("%s: returning as busstate=%d\n",
+                       __FUNCTION__, dhdp->busstate));
+               DHD_GENERAL_UNLOCK(dhdp, flags);
+               PKTCFREE(dhdp->osh, pktbuf, TRUE);
+               return -ENODEV;
+       }
+       dhdp->dhd_bus_busy_state |= DHD_BUS_BUSY_IN_SEND_PKT;
+       DHD_GENERAL_UNLOCK(dhdp, flags);
+
+#ifdef DHD_PCIE_RUNTIMEPM
+       if (dhdpcie_runtime_bus_wake(dhdp, FALSE, __builtin_return_address(0))) {
+               DHD_ERROR(("%s : pcie is still in suspend state!!\n", __FUNCTION__));
+               PKTCFREE(dhdp->osh, pktbuf, TRUE);
+               ret = -EBUSY;
+               goto exit;
+       }
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+       ret = __dhd_sendpkt(dhdp, ifidx, pktbuf);
+
+#ifdef DHD_PCIE_RUNTIMEPM
+exit:
+#endif
+       DHD_GENERAL_LOCK(dhdp, flags);
+       dhdp->dhd_bus_busy_state &= ~DHD_BUS_BUSY_IN_SEND_PKT;
+       DHD_GENERAL_UNLOCK(dhdp, flags);
+       return ret;
+}
+
+int BCMFASTPATH
+dhd_start_xmit(struct sk_buff *skb, struct net_device *net)
+{
+       int ret;
+       uint datalen;
+       void *pktbuf;
+       dhd_info_t *dhd = DHD_DEV_INFO(net);
+       dhd_if_t *ifp = NULL;
+       int ifidx;
+       unsigned long flags;
+#ifdef WLMEDIA_HTSF
+       uint8 htsfdlystat_sz = dhd->pub.htsfdlystat_sz;
+#else
+       uint8 htsfdlystat_sz = 0;
+#endif 
+#ifdef DHD_WMF
+       struct ether_header *eh;
+       uint8 *iph;
+#endif /* DHD_WMF */
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (dhd_query_bus_erros(&dhd->pub)) {
+               return -ENODEV;
+       }
+
+#ifdef PCIE_FULL_DONGLE
+       DHD_GENERAL_LOCK(&dhd->pub, flags);
+       dhd->pub.dhd_bus_busy_state |= DHD_BUS_BUSY_IN_TX;
+       DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+#endif /* PCIE_FULL_DONGLE */
+
+#ifdef DHD_PCIE_RUNTIMEPM
+       if (dhdpcie_runtime_bus_wake(&dhd->pub, FALSE, dhd_start_xmit)) {
+               /* In order to avoid pkt loss. Return NETDEV_TX_BUSY until run-time resumed. */
+               /* stop the network queue temporarily until resume done */
+               DHD_GENERAL_LOCK(&dhd->pub, flags);
+               if (!dhdpcie_is_resume_done(&dhd->pub)) {
+                       dhd_bus_stop_queue(dhd->pub.bus);
+               }
+               dhd->pub.dhd_bus_busy_state &= ~DHD_BUS_BUSY_IN_TX;
+               dhd_os_busbusy_wake(&dhd->pub);
+               DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 20))
+               return -ENODEV;
+#else
+               return NETDEV_TX_BUSY;
+#endif
+       }
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+       DHD_GENERAL_LOCK(&dhd->pub, flags);
+#ifdef PCIE_FULL_DONGLE
+       if (dhd->pub.busstate == DHD_BUS_SUSPEND) {
+               dhd->pub.dhd_bus_busy_state &= ~DHD_BUS_BUSY_IN_TX;
+               dhd_os_busbusy_wake(&dhd->pub);
+               DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 20))
+               return -ENODEV;
+#else
+               return NETDEV_TX_BUSY;
+#endif
+       }
+#endif /* PCIE_FULL_DONGLE */
+
+       DHD_OS_WAKE_LOCK(&dhd->pub);
+       DHD_PERIM_LOCK_TRY(DHD_FWDER_UNIT(dhd), lock_taken);
+
+       /* Reject if down */
+       if (dhd->pub.hang_was_sent || dhd->pub.busstate == DHD_BUS_DOWN ||
+               dhd->pub.busstate == DHD_BUS_DOWN_IN_PROGRESS) {
+               DHD_ERROR(("%s: xmit rejected pub.up=%d busstate=%d \n",
+                       __FUNCTION__, dhd->pub.up, dhd->pub.busstate));
+               netif_stop_queue(net);
+               /* Send Event when bus down detected during data session */
+               if (dhd->pub.up && !dhd->pub.hang_was_sent) {
+                       DHD_ERROR(("%s: Event HANG sent up\n", __FUNCTION__));
+                       dhd->pub.hang_reason = HANG_REASON_BUS_DOWN;
+                       net_os_send_hang_message(net);
+               }
+#ifdef PCIE_FULL_DONGLE
+               dhd->pub.dhd_bus_busy_state &= ~DHD_BUS_BUSY_IN_TX;
+               dhd_os_busbusy_wake(&dhd->pub);
+               DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+#endif /* PCIE_FULL_DONGLE */
+               DHD_PERIM_UNLOCK_TRY(DHD_FWDER_UNIT(dhd), lock_taken);
+               DHD_OS_WAKE_UNLOCK(&dhd->pub);
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 20))
+               return -ENODEV;
+#else
+               return NETDEV_TX_BUSY;
+#endif
+       }
+
+       ifp = DHD_DEV_IFP(net);
+       ifidx = DHD_DEV_IFIDX(net);
+       BUZZZ_LOG(START_XMIT_BGN, 2, (uint32)ifidx, (uintptr)skb);
+
+       if (ifidx == DHD_BAD_IF) {
+               DHD_ERROR(("%s: bad ifidx %d\n", __FUNCTION__, ifidx));
+               netif_stop_queue(net);
+#ifdef PCIE_FULL_DONGLE
+               dhd->pub.dhd_bus_busy_state &= ~DHD_BUS_BUSY_IN_TX;
+               dhd_os_busbusy_wake(&dhd->pub);
+               DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+#endif /* PCIE_FULL_DONGLE */
+               DHD_PERIM_UNLOCK_TRY(DHD_FWDER_UNIT(dhd), lock_taken);
+               DHD_OS_WAKE_UNLOCK(&dhd->pub);
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 20))
+               return -ENODEV;
+#else
+               return NETDEV_TX_BUSY;
+#endif
+       }
+       DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+
+       ASSERT(ifidx == dhd_net2idx(dhd, net));
+       ASSERT((ifp != NULL) && ((ifidx < DHD_MAX_IFS) && (ifp == dhd->iflist[ifidx])));
+
+       bcm_object_trace_opr(skb, BCM_OBJDBG_ADD_PKT, __FUNCTION__, __LINE__);
+
+       /* re-align socket buffer if "skb->data" is odd address */
+       if (((unsigned long)(skb->data)) & 0x1) {
+               unsigned char *data = skb->data;
+               uint32 length = skb->len;
+               PKTPUSH(dhd->pub.osh, skb, 1);
+               memmove(skb->data, data, length);
+               PKTSETLEN(dhd->pub.osh, skb, length);
+       }
+
+       datalen  = PKTLEN(dhd->pub.osh, skb);
+
+       /* Make sure there's enough room for any header */
+       if (skb_headroom(skb) < dhd->pub.hdrlen + htsfdlystat_sz) {
+               struct sk_buff *skb2;
+
+               DHD_INFO(("%s: insufficient headroom\n",
+                         dhd_ifname(&dhd->pub, ifidx)));
+               dhd->pub.tx_realloc++;
+
+               bcm_object_trace_opr(skb, BCM_OBJDBG_REMOVE, __FUNCTION__, __LINE__);
+               skb2 = skb_realloc_headroom(skb, dhd->pub.hdrlen + htsfdlystat_sz);
+
+               dev_kfree_skb(skb);
+               if ((skb = skb2) == NULL) {
+                       DHD_ERROR(("%s: skb_realloc_headroom failed\n",
+                                  dhd_ifname(&dhd->pub, ifidx)));
+                       ret = -ENOMEM;
+                       goto done;
+               }
+               bcm_object_trace_opr(skb, BCM_OBJDBG_ADD_PKT, __FUNCTION__, __LINE__);
+       }
+
+       /* Convert to packet */
+       if (!(pktbuf = PKTFRMNATIVE(dhd->pub.osh, skb))) {
+               DHD_ERROR(("%s: PKTFRMNATIVE failed\n",
+                          dhd_ifname(&dhd->pub, ifidx)));
+               bcm_object_trace_opr(skb, BCM_OBJDBG_REMOVE, __FUNCTION__, __LINE__);
+               dev_kfree_skb_any(skb);
+               ret = -ENOMEM;
+               goto done;
+       }
+
+#if defined(WLMEDIA_HTSF)
+       if (htsfdlystat_sz && PKTLEN(dhd->pub.osh, pktbuf) >= ETHER_ADDR_LEN) {
+               uint8 *pktdata = (uint8 *)PKTDATA(dhd->pub.osh, pktbuf);
+               struct ether_header *eh = (struct ether_header *)pktdata;
+
+               if (!ETHER_ISMULTI(eh->ether_dhost) &&
+                       (ntoh16(eh->ether_type) == ETHER_TYPE_IP)) {
+                       eh->ether_type = hton16(ETHER_TYPE_BRCM_PKTDLYSTATS);
+               }
+       }
+#endif 
+
+#ifdef DHD_WMF
+       eh = (struct ether_header *)PKTDATA(dhd->pub.osh, pktbuf);
+       iph = (uint8 *)eh + ETHER_HDR_LEN;
+
+       /* WMF processing for multicast packets
+        * Only IPv4 packets are handled
+        */
+       if (ifp->wmf.wmf_enable && (ntoh16(eh->ether_type) == ETHER_TYPE_IP) &&
+               (IP_VER(iph) == IP_VER_4) && (ETHER_ISMULTI(eh->ether_dhost) ||
+               ((IPV4_PROT(iph) == IP_PROT_IGMP) && dhd->pub.wmf_ucast_igmp))) {
+#if defined(DHD_IGMP_UCQUERY) || defined(DHD_UCAST_UPNP)
+               void *sdu_clone;
+               bool ucast_convert = FALSE;
+#ifdef DHD_UCAST_UPNP
+               uint32 dest_ip;
+
+               dest_ip = ntoh32(*((uint32 *)(iph + IPV4_DEST_IP_OFFSET)));
+               ucast_convert = dhd->pub.wmf_ucast_upnp && MCAST_ADDR_UPNP_SSDP(dest_ip);
+#endif /* DHD_UCAST_UPNP */
+#ifdef DHD_IGMP_UCQUERY
+               ucast_convert |= dhd->pub.wmf_ucast_igmp_query &&
+                       (IPV4_PROT(iph) == IP_PROT_IGMP) &&
+                       (*(iph + IPV4_HLEN(iph)) == IGMPV2_HOST_MEMBERSHIP_QUERY);
+#endif /* DHD_IGMP_UCQUERY */
+               if (ucast_convert) {
+                       dhd_sta_t *sta;
+#ifdef PCIE_FULL_DONGLE
+                       unsigned long flags;
+#endif
+                       struct list_head snapshot_list;
+                       struct list_head *wmf_ucforward_list;
+
+                       ret = NETDEV_TX_OK;
+
+                       /* For non BCM_GMAC3 platform we need a snapshot sta_list to
+                        * resolve double DHD_IF_STA_LIST_LOCK call deadlock issue.
+                        */
+                       wmf_ucforward_list = DHD_IF_WMF_UCFORWARD_LOCK(dhd, ifp, &snapshot_list);
+
+                       /* Convert upnp/igmp query to unicast for each assoc STA */
+                       list_for_each_entry(sta, wmf_ucforward_list, list) {
+                               if ((sdu_clone = PKTDUP(dhd->pub.osh, pktbuf)) == NULL) {
+                                       ret = WMF_NOP;
+                                       break;
+                               }
+                               dhd_wmf_forward(ifp->wmf.wmfh, sdu_clone, 0, sta, 1);
+                       }
+                       DHD_IF_WMF_UCFORWARD_UNLOCK(dhd, wmf_ucforward_list);
+
+#ifdef PCIE_FULL_DONGLE
+                       DHD_GENERAL_LOCK(&dhd->pub, flags);
+                       dhd->pub.dhd_bus_busy_state &= ~DHD_BUS_BUSY_IN_TX;
+                       dhd_os_busbusy_wake(&dhd->pub);
+                       DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+#endif /* PCIE_FULL_DONGLE */
+                       DHD_PERIM_UNLOCK_TRY(DHD_FWDER_UNIT(dhd), lock_taken);
+                       DHD_OS_WAKE_UNLOCK(&dhd->pub);
+
+                       if (ret == NETDEV_TX_OK)
+                               PKTFREE(dhd->pub.osh, pktbuf, TRUE);
+
+                       return ret;
+               } else
+#endif /* defined(DHD_IGMP_UCQUERY) || defined(DHD_UCAST_UPNP) */
+               {
+                       /* There will be no STA info if the packet is coming from LAN host
+                        * Pass as NULL
+                        */
+                       ret = dhd_wmf_packets_handle(&dhd->pub, pktbuf, NULL, ifidx, 0);
+                       switch (ret) {
+                       case WMF_TAKEN:
+                       case WMF_DROP:
+                               /* Either taken by WMF or we should drop it.
+                                * Exiting send path
+                                */
+#ifdef PCIE_FULL_DONGLE
+                               DHD_GENERAL_LOCK(&dhd->pub, flags);
+                               dhd->pub.dhd_bus_busy_state &= ~DHD_BUS_BUSY_IN_TX;
+                               dhd_os_busbusy_wake(&dhd->pub);
+                               DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+#endif /* PCIE_FULL_DONGLE */
+                               DHD_PERIM_UNLOCK_TRY(DHD_FWDER_UNIT(dhd), lock_taken);
+                               DHD_OS_WAKE_UNLOCK(&dhd->pub);
+                               return NETDEV_TX_OK;
+                       default:
+                               /* Continue the transmit path */
+                               break;
+                       }
+               }
+       }
+#endif /* DHD_WMF */
+#ifdef DHD_PSTA
+       /* PSR related packet proto manipulation should be done in DHD
+        * since dongle doesn't have complete payload
+        */
+       if (PSR_ENABLED(&dhd->pub) && (dhd_psta_proc(&dhd->pub,
+               ifidx, &pktbuf, TRUE) < 0)) {
+                       DHD_ERROR(("%s:%s: psta send proc failed\n", __FUNCTION__,
+                               dhd_ifname(&dhd->pub, ifidx)));
+       }
+#endif /* DHD_PSTA */
+
+#ifdef DHDTCPACK_SUPPRESS
+       if (dhd->pub.tcpack_sup_mode == TCPACK_SUP_HOLD) {
+               /* If this packet has been hold or got freed, just return */
+               if (dhd_tcpack_hold(&dhd->pub, pktbuf, ifidx)) {
+                       ret = 0;
+                       goto done;
+               }
+       } else {
+               /* If this packet has replaced another packet and got freed, just return */
+               if (dhd_tcpack_suppress(&dhd->pub, pktbuf)) {
+                       ret = 0;
+                       goto done;
+               }
+       }
+#endif /* DHDTCPACK_SUPPRESS */
+
+       ret = __dhd_sendpkt(&dhd->pub, ifidx, pktbuf);
+
+done:
+       if (ret) {
+               ifp->stats.tx_dropped++;
+               dhd->pub.tx_dropped++;
+       } else {
+
+#ifdef PROP_TXSTATUS
+               /* tx_packets counter can counted only when wlfc is disabled */
+               if (!dhd_wlfc_is_supported(&dhd->pub))
+#endif
+               {
+                       dhd->pub.tx_packets++;
+                       ifp->stats.tx_packets++;
+                       ifp->stats.tx_bytes += datalen;
+               }
+       }
+
+#ifdef PCIE_FULL_DONGLE
+       DHD_GENERAL_LOCK(&dhd->pub, flags);
+       dhd->pub.dhd_bus_busy_state &= ~DHD_BUS_BUSY_IN_TX;
+       dhd_os_busbusy_wake(&dhd->pub);
+       DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+#endif /* PCIE_FULL_DONGLE */
+
+       DHD_PERIM_UNLOCK_TRY(DHD_FWDER_UNIT(dhd), lock_taken);
+       DHD_OS_WAKE_UNLOCK(&dhd->pub);
+       BUZZZ_LOG(START_XMIT_END, 0);
+
+       /* Return ok: we always eat the packet */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 20))
+       return 0;
+#else
+       return NETDEV_TX_OK;
+#endif
+}
+
+
+void
+dhd_txflowcontrol(dhd_pub_t *dhdp, int ifidx, bool state)
+{
+       struct net_device *net;
+       dhd_info_t *dhd = dhdp->info;
+       int i;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       ASSERT(dhd);
+
+#ifdef DHD_LOSSLESS_ROAMING
+       /* block flowcontrol during roaming */
+       if ((dhdp->dequeue_prec_map == 1 << PRIO_8021D_NC) && state == ON) {
+               return;
+       }
+#endif
+
+       if (ifidx == ALL_INTERFACES) {
+               /* Flow control on all active interfaces */
+               dhdp->txoff = state;
+               for (i = 0; i < DHD_MAX_IFS; i++) {
+                       if (dhd->iflist[i]) {
+                               net = dhd->iflist[i]->net;
+                               if (state == ON)
+                                       netif_stop_queue(net);
+                               else
+                                       netif_wake_queue(net);
+                       }
+               }
+       } else {
+               if (dhd->iflist[ifidx]) {
+                       net = dhd->iflist[ifidx]->net;
+                       if (state == ON)
+                               netif_stop_queue(net);
+                       else
+                               netif_wake_queue(net);
+               }
+       }
+}
+
+#ifdef DHD_RX_DUMP
+typedef struct {
+       uint16 type;
+       const char *str;
+} PKTTYPE_INFO;
+
+static const PKTTYPE_INFO packet_type_info[] =
+{
+       { ETHER_TYPE_IP, "IP" },
+       { ETHER_TYPE_ARP, "ARP" },
+       { ETHER_TYPE_BRCM, "BRCM" },
+       { ETHER_TYPE_802_1X, "802.1X" },
+#ifdef BCMWAPI_WAI
+       { ETHER_TYPE_WAI, "WAPI" },
+#endif /* BCMWAPI_WAI */
+       { 0, ""}
+};
+
+static const char *_get_packet_type_str(uint16 type)
+{
+       int i;
+       int n = sizeof(packet_type_info)/sizeof(packet_type_info[1]) - 1;
+
+       for (i = 0; i < n; i++) {
+               if (packet_type_info[i].type == type)
+                       return packet_type_info[i].str;
+       }
+
+       return packet_type_info[n].str;
+}
+#endif /* DHD_RX_DUMP */
+
+
+#ifdef DHD_WMF
+bool
+dhd_is_rxthread_enabled(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd = dhdp->info;
+
+       return dhd->rxthread_enabled;
+}
+#endif /* DHD_WMF */
+
+/** Called when a frame is received by the dongle on interface 'ifidx' */
+void
+dhd_rx_frame(dhd_pub_t *dhdp, int ifidx, void *pktbuf, int numpkt, uint8 chan)
+{
+       dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+       struct sk_buff *skb;
+       uchar *eth;
+       uint len;
+       void *data, *pnext = NULL;
+       int i;
+       dhd_if_t *ifp;
+       wl_event_msg_t event;
+       int tout_rx = 0;
+       int tout_ctrl = 0;
+       void *skbhead = NULL;
+       void *skbprev = NULL;
+#if defined(DHD_RX_DUMP) || defined(DHD_8021X_DUMP) || defined(DHD_DHCP_DUMP)
+       char *dump_data;
+       uint16 protocol;
+       char *ifname;
+#endif /* DHD_RX_DUMP || DHD_8021X_DUMP || DHD_DHCP_DUMP */
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       for (i = 0; pktbuf && i < numpkt; i++, pktbuf = pnext) {
+               struct ether_header *eh;
+
+               pnext = PKTNEXT(dhdp->osh, pktbuf);
+               PKTSETNEXT(dhdp->osh, pktbuf, NULL);
+
+               ifp = dhd->iflist[ifidx];
+               if (ifp == NULL) {
+                       DHD_ERROR(("%s: ifp is NULL. drop packet\n",
+                               __FUNCTION__));
+                       PKTCFREE(dhdp->osh, pktbuf, FALSE);
+                       continue;
+               }
+
+               eh = (struct ether_header *)PKTDATA(dhdp->osh, pktbuf);
+
+               /* Dropping only data packets before registering net device to avoid kernel panic */
+#ifndef PROP_TXSTATUS_VSDB
+               if ((!ifp->net || ifp->net->reg_state != NETREG_REGISTERED) &&
+                       (ntoh16(eh->ether_type) != ETHER_TYPE_BRCM)) {
+#else
+               if ((!ifp->net || ifp->net->reg_state != NETREG_REGISTERED || !dhd->pub.up) &&
+                       (ntoh16(eh->ether_type) != ETHER_TYPE_BRCM)) {
+#endif /* PROP_TXSTATUS_VSDB */
+                       DHD_ERROR(("%s: net device is NOT registered yet. drop packet\n",
+                       __FUNCTION__));
+                       PKTCFREE(dhdp->osh, pktbuf, FALSE);
+                       continue;
+               }
+
+
+#ifdef PROP_TXSTATUS
+               if (dhd_wlfc_is_header_only_pkt(dhdp, pktbuf)) {
+                       /* WLFC may send header only packet when
+                       there is an urgent message but no packet to
+                       piggy-back on
+                       */
+                       PKTCFREE(dhdp->osh, pktbuf, FALSE);
+                       continue;
+               }
+#endif
+#ifdef DHD_L2_FILTER
+               /* If block_ping is enabled drop the ping packet */
+               if (ifp->block_ping) {
+                       if (bcm_l2_filter_block_ping(dhdp->osh, pktbuf) == BCME_OK) {
+                               PKTCFREE(dhdp->osh, pktbuf, FALSE);
+                               continue;
+                       }
+               }
+               if (ifp->grat_arp && DHD_IF_ROLE_STA(dhdp, ifidx)) {
+                   if (bcm_l2_filter_gratuitous_arp(dhdp->osh, pktbuf) == BCME_OK) {
+                               PKTCFREE(dhdp->osh, pktbuf, FALSE);
+                               continue;
+                   }
+               }
+               if (ifp->parp_enable && DHD_IF_ROLE_AP(dhdp, ifidx)) {
+                       int ret = dhd_l2_filter_pkt_handle(dhdp, ifidx, pktbuf, FALSE);
+
+                       /* Drop the packets if l2 filter has processed it already
+                        * otherwise continue with the normal path
+                        */
+                       if (ret == BCME_OK) {
+                               PKTCFREE(dhdp->osh, pktbuf, TRUE);
+                               continue;
+                       }
+               }
+#endif /* DHD_L2_FILTER */
+#ifdef DHD_WMF
+               /* WMF processing for multicast packets */
+               if (ifp->wmf.wmf_enable && (ETHER_ISMULTI(eh->ether_dhost))) {
+                       dhd_sta_t *sta;
+                       int ret;
+
+                       sta = dhd_find_sta(dhdp, ifidx, (void *)eh->ether_shost);
+                       ret = dhd_wmf_packets_handle(dhdp, pktbuf, sta, ifidx, 1);
+                       switch (ret) {
+                               case WMF_TAKEN:
+                                       /* The packet is taken by WMF. Continue to next iteration */
+                                       continue;
+                               case WMF_DROP:
+                                       /* Packet DROP decision by WMF. Toss it */
+                                       DHD_ERROR(("%s: WMF decides to drop packet\n",
+                                               __FUNCTION__));
+                                       PKTCFREE(dhdp->osh, pktbuf, FALSE);
+                                       continue;
+                               default:
+                                       /* Continue the transmit path */
+                                       break;
+                       }
+               }
+#endif /* DHD_WMF */
+
+#ifdef DHDTCPACK_SUPPRESS
+               dhd_tcpdata_info_get(dhdp, pktbuf);
+#endif
+               skb = PKTTONATIVE(dhdp->osh, pktbuf);
+
+               ASSERT(ifp);
+               skb->dev = ifp->net;
+
+#ifdef DHD_PSTA
+               if (PSR_ENABLED(dhdp) && (dhd_psta_proc(dhdp, ifidx, &pktbuf, FALSE) < 0)) {
+                               DHD_ERROR(("%s:%s: psta recv proc failed\n", __FUNCTION__,
+                                       dhd_ifname(dhdp, ifidx)));
+               }
+#endif /* DHD_PSTA */
+
+#ifdef PCIE_FULL_DONGLE
+               if ((DHD_IF_ROLE_AP(dhdp, ifidx) || DHD_IF_ROLE_P2PGO(dhdp, ifidx)) &&
+                       (!ifp->ap_isolate)) {
+                       eh = (struct ether_header *)PKTDATA(dhdp->osh, pktbuf);
+                       if (ETHER_ISUCAST(eh->ether_dhost)) {
+                               if (dhd_find_sta(dhdp, ifidx, (void *)eh->ether_dhost)) {
+                                       dhd_sendpkt(dhdp, ifidx, pktbuf);
+                                       continue;
+                               }
+                       } else {
+                               void *npktbuf = PKTDUP(dhdp->osh, pktbuf);
+                               if (npktbuf)
+                                       dhd_sendpkt(dhdp, ifidx, npktbuf);
+                       }
+               }
+#endif /* PCIE_FULL_DONGLE */
+
+               /* Get the protocol, maintain skb around eth_type_trans()
+                * The main reason for this hack is for the limitation of
+                * Linux 2.4 where 'eth_type_trans' uses the 'net->hard_header_len'
+                * to perform skb_pull inside vs ETH_HLEN. Since to avoid
+                * coping of the packet coming from the network stack to add
+                * BDC, Hardware header etc, during network interface registration
+                * we set the 'net->hard_header_len' to ETH_HLEN + extra space required
+                * for BDC, Hardware header etc. and not just the ETH_HLEN
+                */
+               eth = skb->data;
+               len = skb->len;
+
+#if defined(DHD_RX_DUMP) || defined(DHD_8021X_DUMP) || defined(DHD_DHCP_DUMP)
+               dump_data = skb->data;
+               protocol = (dump_data[12] << 8) | dump_data[13];
+               ifname = skb->dev ? skb->dev->name : "N/A";
+#endif /* DHD_RX_DUMP || DHD_8021X_DUMP || DHD_DHCP_DUMP */
+#ifdef DHD_8021X_DUMP
+               if (protocol == ETHER_TYPE_802_1X) {
+                       dhd_dump_eapol_4way_message(ifname, dump_data, FALSE);
+               }
+#endif /* DHD_8021X_DUMP */
+#ifdef DHD_DHCP_DUMP
+               if (protocol != ETHER_TYPE_BRCM && protocol == ETHER_TYPE_IP) {
+                       uint16 dump_hex;
+                       uint16 source_port;
+                       uint16 dest_port;
+                       uint16 udp_port_pos;
+                       uint8 *ptr8 = (uint8 *)&dump_data[ETHER_HDR_LEN];
+                       uint8 ip_header_len = (*ptr8 & 0x0f)<<2;
+
+                       udp_port_pos = ETHER_HDR_LEN + ip_header_len;
+                       source_port = (dump_data[udp_port_pos] << 8) | dump_data[udp_port_pos+1];
+                       dest_port = (dump_data[udp_port_pos+2] << 8) | dump_data[udp_port_pos+3];
+                       if (source_port == 0x0044 || dest_port == 0x0044) {
+                               dump_hex = (dump_data[udp_port_pos+249] << 8) |
+                                       dump_data[udp_port_pos+250];
+                               if (dump_hex == 0x0101) {
+                                       DHD_ERROR(("DHCP[%s] - DISCOVER [RX]\n", ifname));
+                               } else if (dump_hex == 0x0102) {
+                                       DHD_ERROR(("DHCP[%s] - OFFER [RX]\n", ifname));
+                               } else if (dump_hex == 0x0103) {
+                                       DHD_ERROR(("DHCP[%s] - REQUEST [RX]\n", ifname));
+                               } else if (dump_hex == 0x0105) {
+                                       DHD_ERROR(("DHCP[%s] - ACK [RX]\n", ifname));
+                               } else {
+                                       DHD_ERROR(("DHCP[%s] - 0x%X [RX]\n", ifname, dump_hex));
+                               }
+                       } else if (source_port == 0x0043 || dest_port == 0x0043) {
+                               DHD_ERROR(("DHCP[%s] - BOOTP [RX]\n", ifname));
+                       }
+               }
+#endif /* DHD_DHCP_DUMP */
+#if defined(DHD_RX_DUMP)
+               DHD_ERROR(("RX DUMP[%s] - %s\n", ifname, _get_packet_type_str(protocol)));
+               if (protocol != ETHER_TYPE_BRCM) {
+                       if (dump_data[0] == 0xFF) {
+                               DHD_ERROR(("%s: BROADCAST\n", __FUNCTION__));
+
+                               if ((dump_data[12] == 8) &&
+                                       (dump_data[13] == 6)) {
+                                       DHD_ERROR(("%s: ARP %d\n",
+                                               __FUNCTION__, dump_data[0x15]));
+                               }
+                       } else if (dump_data[0] & 1) {
+                               DHD_ERROR(("%s: MULTICAST: " MACDBG "\n",
+                                       __FUNCTION__, MAC2STRDBG(dump_data)));
+                       }
+#ifdef DHD_RX_FULL_DUMP
+                       {
+                               int k;
+                               for (k = 0; k < skb->len; k++) {
+                                       DHD_ERROR(("%02X ", dump_data[k]));
+                                       if ((k & 15) == 15)
+                                               DHD_ERROR(("\n"));
+                               }
+                               DHD_ERROR(("\n"));
+                       }
+#endif /* DHD_RX_FULL_DUMP */
+               }
+#endif /* DHD_RX_DUMP */
+
+               skb->protocol = eth_type_trans(skb, skb->dev);
+
+               if (skb->pkt_type == PACKET_MULTICAST) {
+                       dhd->pub.rx_multicast++;
+                       ifp->stats.multicast++;
+               }
+
+               skb->data = eth;
+               skb->len = len;
+
+#ifdef WLMEDIA_HTSF
+               dhd_htsf_addrxts(dhdp, pktbuf);
+#endif
+               /* Strip header, count, deliver upward */
+               skb_pull(skb, ETH_HLEN);
+
+               /* Process special event packets and then discard them */
+               memset(&event, 0, sizeof(event));
+               if (ntoh16(skb->protocol) == ETHER_TYPE_BRCM) {
+                       dhd_wl_host_event(dhd, &ifidx,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 22)
+                       skb_mac_header(skb),
+#else
+                       skb->mac.raw,
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 22) */
+                       len > ETHER_TYPE_LEN ? len - ETHER_TYPE_LEN : 0,
+                       &event,
+                       &data);
+
+                       wl_event_to_host_order(&event);
+                       if (!tout_ctrl)
+                               tout_ctrl = DHD_PACKET_TIMEOUT_MS;
+
+#if defined(PNO_SUPPORT)
+                       if (event.event_type == WLC_E_PFN_NET_FOUND) {
+                               /* enforce custom wake lock to garantee that Kernel not suspended */
+                               tout_ctrl = CUSTOM_PNO_EVENT_LOCK_xTIME * DHD_PACKET_TIMEOUT_MS;
+                       }
+#endif /* PNO_SUPPORT */
+
+#ifdef DHD_DONOT_FORWARD_BCMEVENT_AS_NETWORK_PKT
+#ifdef DHD_USE_STATIC_CTRLBUF
+                       PKTFREE_STATIC(dhdp->osh, pktbuf, FALSE);
+#else
+                       PKTFREE(dhdp->osh, pktbuf, FALSE);
+#endif /* DHD_USE_STATIC_CTRLBUF */
+                       continue;
+#endif /* DHD_DONOT_FORWARD_BCMEVENT_AS_NETWORK_PKT */
+               } else {
+                       tout_rx = DHD_PACKET_TIMEOUT_MS;
+
+#ifdef PROP_TXSTATUS
+                       dhd_wlfc_save_rxpath_ac_time(dhdp, (uint8)PKTPRIO(skb));
+#endif /* PROP_TXSTATUS */
+               }
+
+               ASSERT(ifidx < DHD_MAX_IFS && dhd->iflist[ifidx]);
+               ifp = dhd->iflist[ifidx];
+
+               if (ifp->net)
+                       ifp->net->last_rx = jiffies;
+
+               if (ntoh16(skb->protocol) != ETHER_TYPE_BRCM) {
+                       dhdp->dstats.rx_bytes += skb->len;
+                       dhdp->rx_packets++; /* Local count */
+                       ifp->stats.rx_bytes += skb->len;
+                       ifp->stats.rx_packets++;
+               }
+
+               if (in_interrupt()) {
+                       bcm_object_trace_opr(skb, BCM_OBJDBG_REMOVE,
+                               __FUNCTION__, __LINE__);
+                       DHD_PERIM_UNLOCK_ALL((dhd->fwder_unit % FWDER_MAX_UNIT));
+#if defined(DHD_LB) && defined(DHD_LB_RXP)
+                       netif_receive_skb(skb);
+#else
+                       netif_rx(skb);
+#endif /* !defined(DHD_LB) && !defined(DHD_LB_RXP) */
+                       DHD_PERIM_LOCK_ALL((dhd->fwder_unit % FWDER_MAX_UNIT));
+               } else {
+                       if (dhd->rxthread_enabled) {
+                               if (!skbhead)
+                                       skbhead = skb;
+                               else
+                                       PKTSETNEXT(dhdp->osh, skbprev, skb);
+                               skbprev = skb;
+                       } else {
+
+                               /* If the receive is not processed inside an ISR,
+                                * the softirqd must be woken explicitly to service
+                                * the NET_RX_SOFTIRQ.  In 2.6 kernels, this is handled
+                                * by netif_rx_ni(), but in earlier kernels, we need
+                                * to do it manually.
+                                */
+                               bcm_object_trace_opr(skb, BCM_OBJDBG_REMOVE,
+                                       __FUNCTION__, __LINE__);
+
+#if defined(DHD_LB) && defined(DHD_LB_RXP)
+                               DHD_PERIM_UNLOCK_ALL((dhd->fwder_unit % FWDER_MAX_UNIT));
+                               netif_receive_skb(skb);
+                               DHD_PERIM_LOCK_ALL((dhd->fwder_unit % FWDER_MAX_UNIT));
+#else
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)
+                               DHD_PERIM_UNLOCK_ALL((dhd->fwder_unit % FWDER_MAX_UNIT));
+                               netif_rx_ni(skb);
+                               DHD_PERIM_LOCK_ALL((dhd->fwder_unit % FWDER_MAX_UNIT));
+#else
+                               ulong flags;
+                               DHD_PERIM_UNLOCK_ALL((dhd->fwder_unit % FWDER_MAX_UNIT));
+                               netif_rx(skb);
+                               DHD_PERIM_LOCK_ALL((dhd->fwder_unit % FWDER_MAX_UNIT));
+                               local_irq_save(flags);
+                               RAISE_RX_SOFTIRQ();
+                               local_irq_restore(flags);
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0) */
+#endif /* !defined(DHD_LB) && !defined(DHD_LB_RXP) */
+                       }
+               }
+       }
+
+       if (dhd->rxthread_enabled && skbhead)
+               dhd_sched_rxf(dhdp, skbhead);
+
+       DHD_OS_WAKE_LOCK_RX_TIMEOUT_ENABLE(dhdp, tout_rx);
+       DHD_OS_WAKE_LOCK_CTRL_TIMEOUT_ENABLE(dhdp, tout_ctrl);
+       DHD_OS_WAKE_LOCK_TIMEOUT(dhdp);
+}
+
+void
+dhd_event(struct dhd_info *dhd, char *evpkt, uint evlen, int ifidx)
+{
+       /* Linux version has nothing to do */
+       return;
+}
+
+void
+dhd_txcomplete(dhd_pub_t *dhdp, void *txp, bool success)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(dhdp->info);
+       struct ether_header *eh;
+       uint16 type;
+
+       dhd_prot_hdrpull(dhdp, NULL, txp, NULL, NULL);
+
+       eh = (struct ether_header *)PKTDATA(dhdp->osh, txp);
+       type  = ntoh16(eh->ether_type);
+
+       if ((type == ETHER_TYPE_802_1X) && (dhd_get_pend_8021x_cnt(dhd) > 0))
+               atomic_dec(&dhd->pend_8021x_cnt);
+
+#ifdef PROP_TXSTATUS
+       if (dhdp->wlfc_state && (dhdp->proptxstatus_mode != WLFC_FCMODE_NONE)) {
+               dhd_if_t *ifp = dhd->iflist[DHD_PKTTAG_IF(PKTTAG(txp))];
+               uint datalen  = PKTLEN(dhd->pub.osh, txp);
+               if (ifp != NULL) {
+                       if (success) {
+                               dhd->pub.tx_packets++;
+                               ifp->stats.tx_packets++;
+                               ifp->stats.tx_bytes += datalen;
+                       } else {
+                               ifp->stats.tx_dropped++;
+                       }
+               }
+       }
+#endif
+}
+
+static struct net_device_stats *
+dhd_get_stats(struct net_device *net)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(net);
+       dhd_if_t *ifp;
+       int ifidx;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       ifidx = dhd_net2idx(dhd, net);
+       if (ifidx == DHD_BAD_IF) {
+               DHD_ERROR(("%s: BAD_IF\n", __FUNCTION__));
+
+               memset(&net->stats, 0, sizeof(net->stats));
+               return &net->stats;
+       }
+
+       ifp = dhd->iflist[ifidx];
+       ASSERT(dhd && ifp);
+
+       if (dhd->pub.up) {
+               /* Use the protocol to get dongle stats */
+               dhd_prot_dstats(&dhd->pub);
+       }
+       return &ifp->stats;
+}
+
+static int
+dhd_watchdog_thread(void *data)
+{
+       tsk_ctl_t *tsk = (tsk_ctl_t *)data;
+       dhd_info_t *dhd = (dhd_info_t *)tsk->parent;
+       /* This thread doesn't need any user-level access,
+        * so get rid of all our resources
+        */
+       if (dhd_watchdog_prio > 0) {
+               struct sched_param param;
+               param.sched_priority = (dhd_watchdog_prio < MAX_RT_PRIO)?
+                       dhd_watchdog_prio:(MAX_RT_PRIO-1);
+               setScheduler(current, SCHED_FIFO, &param);
+       }
+
+       while (1) {
+               if (down_interruptible (&tsk->sema) == 0) {
+                       unsigned long flags;
+                       unsigned long jiffies_at_start = jiffies;
+                       unsigned long time_lapse;
+
+                       DHD_OS_WD_WAKE_LOCK(&dhd->pub);
+                       SMP_RD_BARRIER_DEPENDS();
+                       if (tsk->terminated) {
+                               DHD_OS_WD_WAKE_UNLOCK(&dhd->pub);
+                               break;
+                       }
+
+                       if (dhd->pub.dongle_reset == FALSE) {
+                               DHD_TIMER(("%s:\n", __FUNCTION__));
+                               dhd_bus_watchdog(&dhd->pub);
+
+                               DHD_GENERAL_LOCK(&dhd->pub, flags);
+                               /* Count the tick for reference */
+                               dhd->pub.tickcnt++;
+#ifdef DHD_L2_FILTER
+                               dhd_l2_filter_watchdog(&dhd->pub);
+#endif /* DHD_L2_FILTER */
+                               time_lapse = jiffies - jiffies_at_start;
+
+                               /* Reschedule the watchdog */
+                               if (dhd->wd_timer_valid) {
+                                       mod_timer(&dhd->timer,
+                                           jiffies +
+                                           msecs_to_jiffies(dhd_watchdog_ms) -
+                                           min(msecs_to_jiffies(dhd_watchdog_ms), time_lapse));
+                               }
+                               DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+                       }
+                       DHD_OS_WD_WAKE_UNLOCK(&dhd->pub);
+               } else {
+                       break;
+               }
+       }
+
+       complete_and_exit(&tsk->completed, 0);
+}
+
+static void dhd_watchdog(ulong data)
+{
+       dhd_info_t *dhd = (dhd_info_t *)data;
+       unsigned long flags;
+
+       if (dhd->pub.dongle_reset) {
+               return;
+       }
+
+       if (dhd->pub.busstate == DHD_BUS_SUSPEND) {
+               DHD_ERROR(("%s wd while suspend in progress \n", __FUNCTION__));
+               return;
+       }
+
+       if (dhd->thr_wdt_ctl.thr_pid >= 0) {
+               up(&dhd->thr_wdt_ctl.sema);
+               return;
+       }
+
+       DHD_OS_WD_WAKE_LOCK(&dhd->pub);
+       /* Call the bus module watchdog */
+       dhd_bus_watchdog(&dhd->pub);
+       DHD_GENERAL_LOCK(&dhd->pub, flags);
+       /* Count the tick for reference */
+       dhd->pub.tickcnt++;
+
+#ifdef DHD_L2_FILTER
+       dhd_l2_filter_watchdog(&dhd->pub);
+#endif /* DHD_L2_FILTER */
+       /* Reschedule the watchdog */
+       if (dhd->wd_timer_valid)
+               mod_timer(&dhd->timer, jiffies + msecs_to_jiffies(dhd_watchdog_ms));
+       DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+       DHD_OS_WD_WAKE_UNLOCK(&dhd->pub);
+}
+
+#ifdef DHD_PCIE_RUNTIMEPM
+static int
+dhd_rpm_state_thread(void *data)
+{
+       tsk_ctl_t *tsk = (tsk_ctl_t *)data;
+       dhd_info_t *dhd = (dhd_info_t *)tsk->parent;
+
+       while (1) {
+               if (down_interruptible (&tsk->sema) == 0) {
+                       unsigned long flags;
+                       unsigned long jiffies_at_start = jiffies;
+                       unsigned long time_lapse;
+
+                       SMP_RD_BARRIER_DEPENDS();
+                       if (tsk->terminated) {
+                               break;
+                       }
+
+                       if (dhd->pub.dongle_reset == FALSE) {
+                               DHD_TIMER(("%s:\n", __FUNCTION__));
+                               if (dhd->pub.up) {
+                                       dhd_runtimepm_state(&dhd->pub);
+                               }
+
+                               DHD_GENERAL_LOCK(&dhd->pub, flags);
+                               time_lapse = jiffies - jiffies_at_start;
+
+                               /* Reschedule the watchdog */
+                               if (dhd->rpm_timer_valid) {
+                                       mod_timer(&dhd->rpm_timer,
+                                               jiffies +
+                                               msecs_to_jiffies(dhd_runtimepm_ms) -
+                                               min(msecs_to_jiffies(dhd_runtimepm_ms),
+                                                       time_lapse));
+                               }
+                               DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+                       }
+               } else {
+                       break;
+               }
+       }
+
+       complete_and_exit(&tsk->completed, 0);
+}
+
+static void dhd_runtimepm(ulong data)
+{
+       dhd_info_t *dhd = (dhd_info_t *)data;
+
+       if (dhd->pub.dongle_reset) {
+               return;
+       }
+
+       if (dhd->thr_rpm_ctl.thr_pid >= 0) {
+               up(&dhd->thr_rpm_ctl.sema);
+               return;
+       }
+}
+
+void dhd_runtime_pm_disable(dhd_pub_t *dhdp)
+{
+       dhd_os_runtimepm_timer(dhdp, 0);
+       dhdpcie_runtime_bus_wake(dhdp, TRUE, __builtin_return_address(0));
+       DHD_ERROR(("DHD Runtime PM Disabled \n"));
+}
+
+void dhd_runtime_pm_enable(dhd_pub_t *dhdp)
+{
+       dhd_os_runtimepm_timer(dhdp, dhd_runtimepm_ms);
+       DHD_ERROR(("DHD Runtime PM Enabled \n"));
+}
+
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+
+#ifdef ENABLE_ADAPTIVE_SCHED
+static void
+dhd_sched_policy(int prio)
+{
+       struct sched_param param;
+       if (cpufreq_quick_get(0) <= CUSTOM_CPUFREQ_THRESH) {
+               param.sched_priority = 0;
+               setScheduler(current, SCHED_NORMAL, &param);
+       } else {
+               if (get_scheduler_policy(current) != SCHED_FIFO) {
+                       param.sched_priority = (prio < MAX_RT_PRIO)? prio : (MAX_RT_PRIO-1);
+                       setScheduler(current, SCHED_FIFO, &param);
+               }
+       }
+}
+#endif /* ENABLE_ADAPTIVE_SCHED */
+#ifdef DEBUG_CPU_FREQ
+static int dhd_cpufreq_notifier(struct notifier_block *nb, unsigned long val, void *data)
+{
+       dhd_info_t *dhd = container_of(nb, struct dhd_info, freq_trans);
+       struct cpufreq_freqs *freq = data;
+       if (dhd) {
+               if (!dhd->new_freq)
+                       goto exit;
+               if (val == CPUFREQ_POSTCHANGE) {
+                       DHD_ERROR(("cpu freq is changed to %u kHZ on CPU %d\n",
+                               freq->new, freq->cpu));
+                       *per_cpu_ptr(dhd->new_freq, freq->cpu) = freq->new;
+               }
+       }
+exit:
+       return 0;
+}
+#endif /* DEBUG_CPU_FREQ */
+static int
+dhd_dpc_thread(void *data)
+{
+       tsk_ctl_t *tsk = (tsk_ctl_t *)data;
+       dhd_info_t *dhd = (dhd_info_t *)tsk->parent;
+
+       /* This thread doesn't need any user-level access,
+        * so get rid of all our resources
+        */
+       if (dhd_dpc_prio > 0)
+       {
+               struct sched_param param;
+               param.sched_priority = (dhd_dpc_prio < MAX_RT_PRIO)?dhd_dpc_prio:(MAX_RT_PRIO-1);
+               setScheduler(current, SCHED_FIFO, &param);
+       }
+
+#ifdef CUSTOM_DPC_CPUCORE
+       set_cpus_allowed_ptr(current, cpumask_of(CUSTOM_DPC_CPUCORE));
+#endif
+#ifdef CUSTOM_SET_CPUCORE
+       dhd->pub.current_dpc = current;
+#endif /* CUSTOM_SET_CPUCORE */
+       /* Run until signal received */
+       while (1) {
+               if (!binary_sema_down(tsk)) {
+#ifdef ENABLE_ADAPTIVE_SCHED
+                       dhd_sched_policy(dhd_dpc_prio);
+#endif /* ENABLE_ADAPTIVE_SCHED */
+                       SMP_RD_BARRIER_DEPENDS();
+                       if (tsk->terminated) {
+                               break;
+                       }
+
+                       /* Call bus dpc unless it indicated down (then clean stop) */
+                       if (dhd->pub.busstate != DHD_BUS_DOWN) {
+#ifdef DEBUG_DPC_THREAD_WATCHDOG
+                               int resched_cnt = 0;
+#endif /* DEBUG_DPC_THREAD_WATCHDOG */
+                               dhd_os_wd_timer_extend(&dhd->pub, TRUE);
+                               while (dhd_bus_dpc(dhd->pub.bus)) {
+                                       /* process all data */
+#ifdef DEBUG_DPC_THREAD_WATCHDOG
+                                       resched_cnt++;
+                                       if (resched_cnt > MAX_RESCHED_CNT) {
+                                               DHD_INFO(("%s Calling msleep to"
+                                                       "let other processes run. \n",
+                                                       __FUNCTION__));
+                                               dhd->pub.dhd_bug_on = true;
+                                               resched_cnt = 0;
+                                               OSL_SLEEP(1);
+                                       }
+#endif /* DEBUG_DPC_THREAD_WATCHDOG */
+                               }
+                               dhd_os_wd_timer_extend(&dhd->pub, FALSE);
+                               DHD_OS_WAKE_UNLOCK(&dhd->pub);
+                       } else {
+                               if (dhd->pub.up)
+                                       dhd_bus_stop(dhd->pub.bus, TRUE);
+                               DHD_OS_WAKE_UNLOCK(&dhd->pub);
+                       }
+               } else {
+                       break;
+               }
+       }
+       complete_and_exit(&tsk->completed, 0);
+}
+
+static int
+dhd_rxf_thread(void *data)
+{
+       tsk_ctl_t *tsk = (tsk_ctl_t *)data;
+       dhd_info_t *dhd = (dhd_info_t *)tsk->parent;
+#if defined(WAIT_DEQUEUE)
+#define RXF_WATCHDOG_TIME 250 /* BARK_TIME(1000) /  */
+       ulong watchdogTime = OSL_SYSUPTIME(); /* msec */
+#endif
+       dhd_pub_t *pub = &dhd->pub;
+
+       /* This thread doesn't need any user-level access,
+        * so get rid of all our resources
+        */
+       if (dhd_rxf_prio > 0)
+       {
+               struct sched_param param;
+               param.sched_priority = (dhd_rxf_prio < MAX_RT_PRIO)?dhd_rxf_prio:(MAX_RT_PRIO-1);
+               setScheduler(current, SCHED_FIFO, &param);
+       }
+
+       DAEMONIZE("dhd_rxf");
+       /* DHD_OS_WAKE_LOCK is called in dhd_sched_dpc[dhd_linux.c] down below  */
+
+       /*  signal: thread has started */
+       complete(&tsk->completed);
+#ifdef CUSTOM_SET_CPUCORE
+       dhd->pub.current_rxf = current;
+#endif /* CUSTOM_SET_CPUCORE */
+       /* Run until signal received */
+       while (1) {
+               if (down_interruptible(&tsk->sema) == 0) {
+                       void *skb;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0)
+                       ulong flags;
+#endif
+#ifdef ENABLE_ADAPTIVE_SCHED
+                       dhd_sched_policy(dhd_rxf_prio);
+#endif /* ENABLE_ADAPTIVE_SCHED */
+
+                       SMP_RD_BARRIER_DEPENDS();
+
+                       if (tsk->terminated) {
+                               break;
+                       }
+                       skb = dhd_rxf_dequeue(pub);
+
+                       if (skb == NULL) {
+                               continue;
+                       }
+                       while (skb) {
+                               void *skbnext = PKTNEXT(pub->osh, skb);
+                               PKTSETNEXT(pub->osh, skb, NULL);
+                               bcm_object_trace_opr(skb, BCM_OBJDBG_REMOVE,
+                                       __FUNCTION__, __LINE__);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)
+                               netif_rx_ni(skb);
+#else
+                               netif_rx(skb);
+                               local_irq_save(flags);
+                               RAISE_RX_SOFTIRQ();
+                               local_irq_restore(flags);
+
+#endif
+                               skb = skbnext;
+                       }
+#if defined(WAIT_DEQUEUE)
+                       if (OSL_SYSUPTIME() - watchdogTime > RXF_WATCHDOG_TIME) {
+                               OSL_SLEEP(1);
+                               watchdogTime = OSL_SYSUPTIME();
+                       }
+#endif
+
+                       DHD_OS_WAKE_UNLOCK(pub);
+               } else {
+                       break;
+               }
+       }
+       complete_and_exit(&tsk->completed, 0);
+}
+
+#ifdef BCMPCIE
+void dhd_dpc_enable(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd;
+
+       if (!dhdp || !dhdp->info)
+               return;
+       dhd = dhdp->info;
+
+#ifdef DHD_LB
+#ifdef DHD_LB_RXP
+       __skb_queue_head_init(&dhd->rx_pend_queue);
+#endif /* DHD_LB_RXP */
+#ifdef DHD_LB_TXC
+       if (atomic_read(&dhd->tx_compl_tasklet.count) == 1)
+               tasklet_enable(&dhd->tx_compl_tasklet);
+#endif /* DHD_LB_TXC */
+#ifdef DHD_LB_RXC
+       if (atomic_read(&dhd->rx_compl_tasklet.count) == 1)
+               tasklet_enable(&dhd->rx_compl_tasklet);
+#endif /* DHD_LB_RXC */
+#endif /* DHD_LB */
+       if (atomic_read(&dhd->tasklet.count) ==  1)
+               tasklet_enable(&dhd->tasklet);
+}
+#endif /* BCMPCIE */
+
+
+#ifdef BCMPCIE
+void
+dhd_dpc_kill(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd;
+
+       if (!dhdp) {
+               return;
+       }
+
+       dhd = dhdp->info;
+
+       if (!dhd) {
+               return;
+       }
+
+       if (dhd->thr_dpc_ctl.thr_pid < 0) {
+               tasklet_disable(&dhd->tasklet);
+               tasklet_kill(&dhd->tasklet);
+               DHD_ERROR(("%s: tasklet disabled\n", __FUNCTION__));
+       }
+#if defined(DHD_LB)
+#ifdef DHD_LB_RXP
+       __skb_queue_purge(&dhd->rx_pend_queue);
+#endif /* DHD_LB_RXP */
+       /* Kill the Load Balancing Tasklets */
+#if defined(DHD_LB_TXC)
+       tasklet_disable(&dhd->tx_compl_tasklet);
+       tasklet_kill(&dhd->tx_compl_tasklet);
+#endif /* DHD_LB_TXC */
+#if defined(DHD_LB_RXC)
+       tasklet_disable(&dhd->rx_compl_tasklet);
+       tasklet_kill(&dhd->rx_compl_tasklet);
+#endif /* DHD_LB_RXC */
+#endif /* DHD_LB */
+}
+
+void
+dhd_dpc_tasklet_kill(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd;
+
+       if (!dhdp) {
+               return;
+       }
+
+       dhd = dhdp->info;
+
+       if (!dhd) {
+               return;
+       }
+
+       if (dhd->thr_dpc_ctl.thr_pid < 0) {
+               tasklet_kill(&dhd->tasklet);
+       }
+}
+#endif /* BCMPCIE */
+
+static void
+dhd_dpc(ulong data)
+{
+       dhd_info_t *dhd;
+
+       dhd = (dhd_info_t *)data;
+
+       /* this (tasklet) can be scheduled in dhd_sched_dpc[dhd_linux.c]
+        * down below , wake lock is set,
+        * the tasklet is initialized in dhd_attach()
+        */
+       /* Call bus dpc unless it indicated down (then clean stop) */
+       if (dhd->pub.busstate != DHD_BUS_DOWN) {
+               if (dhd_bus_dpc(dhd->pub.bus)) {
+                       DHD_LB_STATS_INCR(dhd->dhd_dpc_cnt);
+                       tasklet_schedule(&dhd->tasklet);
+               }
+       } else {
+               dhd_bus_stop(dhd->pub.bus, TRUE);
+       }
+}
+
+void
+dhd_sched_dpc(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+
+       if (dhd->thr_dpc_ctl.thr_pid >= 0) {
+               DHD_OS_WAKE_LOCK(dhdp);
+               /* If the semaphore does not get up,
+               * wake unlock should be done here
+               */
+               if (!binary_sema_up(&dhd->thr_dpc_ctl)) {
+                       DHD_OS_WAKE_UNLOCK(dhdp);
+               }
+               return;
+       } else {
+               tasklet_schedule(&dhd->tasklet);
+       }
+}
+
+static void
+dhd_sched_rxf(dhd_pub_t *dhdp, void *skb)
+{
+       dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+#ifdef RXF_DEQUEUE_ON_BUSY
+       int ret = BCME_OK;
+       int retry = 2;
+#endif /* RXF_DEQUEUE_ON_BUSY */
+
+       DHD_OS_WAKE_LOCK(dhdp);
+
+       DHD_TRACE(("dhd_sched_rxf: Enter\n"));
+#ifdef RXF_DEQUEUE_ON_BUSY
+       do {
+               ret = dhd_rxf_enqueue(dhdp, skb);
+               if (ret == BCME_OK || ret == BCME_ERROR)
+                       break;
+               else
+                       OSL_SLEEP(50); /* waiting for dequeueing */
+       } while (retry-- > 0);
+
+       if (retry <= 0 && ret == BCME_BUSY) {
+               void *skbp = skb;
+
+               while (skbp) {
+                       void *skbnext = PKTNEXT(dhdp->osh, skbp);
+                       PKTSETNEXT(dhdp->osh, skbp, NULL);
+                       bcm_object_trace_opr(skb, BCM_OBJDBG_REMOVE,
+                               __FUNCTION__, __LINE__);
+                       netif_rx_ni(skbp);
+                       skbp = skbnext;
+               }
+               DHD_ERROR(("send skb to kernel backlog without rxf_thread\n"));
+       } else {
+               if (dhd->thr_rxf_ctl.thr_pid >= 0) {
+                       up(&dhd->thr_rxf_ctl.sema);
+               }
+       }
+#else /* RXF_DEQUEUE_ON_BUSY */
+       do {
+               if (dhd_rxf_enqueue(dhdp, skb) == BCME_OK)
+                       break;
+       } while (1);
+       if (dhd->thr_rxf_ctl.thr_pid >= 0) {
+               up(&dhd->thr_rxf_ctl.sema);
+       }
+       return;
+#endif /* RXF_DEQUEUE_ON_BUSY */
+}
+
+#if defined(BCM_DNGL_EMBEDIMAGE) || defined(BCM_REQUEST_FW)
+#endif /* defined(BCM_DNGL_EMBEDIMAGE) || defined(BCM_REQUEST_FW) */
+
+#ifdef TOE
+/* Retrieve current toe component enables, which are kept as a bitmap in toe_ol iovar */
+static int
+dhd_toe_get(dhd_info_t *dhd, int ifidx, uint32 *toe_ol)
+{
+       wl_ioctl_t ioc;
+       char buf[32];
+       int ret;
+
+       memset(&ioc, 0, sizeof(ioc));
+
+       ioc.cmd = WLC_GET_VAR;
+       ioc.buf = buf;
+       ioc.len = (uint)sizeof(buf);
+       ioc.set = FALSE;
+
+       strncpy(buf, "toe_ol", sizeof(buf) - 1);
+       buf[sizeof(buf) - 1] = '\0';
+       if ((ret = dhd_wl_ioctl(&dhd->pub, ifidx, &ioc, ioc.buf, ioc.len)) < 0) {
+               /* Check for older dongle image that doesn't support toe_ol */
+               if (ret == -EIO) {
+                       DHD_ERROR(("%s: toe not supported by device\n",
+                               dhd_ifname(&dhd->pub, ifidx)));
+                       return -EOPNOTSUPP;
+               }
+
+               DHD_INFO(("%s: could not get toe_ol: ret=%d\n", dhd_ifname(&dhd->pub, ifidx), ret));
+               return ret;
+       }
+
+       memcpy(toe_ol, buf, sizeof(uint32));
+       return 0;
+}
+
+/* Set current toe component enables in toe_ol iovar, and set toe global enable iovar */
+static int
+dhd_toe_set(dhd_info_t *dhd, int ifidx, uint32 toe_ol)
+{
+       wl_ioctl_t ioc;
+       char buf[32];
+       int toe, ret;
+
+       memset(&ioc, 0, sizeof(ioc));
+
+       ioc.cmd = WLC_SET_VAR;
+       ioc.buf = buf;
+       ioc.len = (uint)sizeof(buf);
+       ioc.set = TRUE;
+
+       /* Set toe_ol as requested */
+
+       strncpy(buf, "toe_ol", sizeof(buf) - 1);
+       buf[sizeof(buf) - 1] = '\0';
+       memcpy(&buf[sizeof("toe_ol")], &toe_ol, sizeof(uint32));
+
+       if ((ret = dhd_wl_ioctl(&dhd->pub, ifidx, &ioc, ioc.buf, ioc.len)) < 0) {
+               DHD_ERROR(("%s: could not set toe_ol: ret=%d\n",
+                       dhd_ifname(&dhd->pub, ifidx), ret));
+               return ret;
+       }
+
+       /* Enable toe globally only if any components are enabled. */
+
+       toe = (toe_ol != 0);
+
+       strcpy(buf, "toe");
+       memcpy(&buf[sizeof("toe")], &toe, sizeof(uint32));
+
+       if ((ret = dhd_wl_ioctl(&dhd->pub, ifidx, &ioc, ioc.buf, ioc.len)) < 0) {
+               DHD_ERROR(("%s: could not set toe: ret=%d\n", dhd_ifname(&dhd->pub, ifidx), ret));
+               return ret;
+       }
+
+       return 0;
+}
+#endif /* TOE */
+
+#if defined(WL_CFG80211) && defined(NUM_SCB_MAX_PROBE)
+void dhd_set_scb_probe(dhd_pub_t *dhd)
+{
+       int ret = 0;
+       wl_scb_probe_t scb_probe;
+       char iovbuf[WL_EVENTING_MASK_LEN + sizeof(wl_scb_probe_t)];
+
+       memset(&scb_probe, 0, sizeof(wl_scb_probe_t));
+
+       if (dhd->op_mode & DHD_FLAG_HOSTAP_MODE) {
+               return;
+       }
+
+       bcm_mkiovar("scb_probe", NULL, 0, iovbuf, sizeof(iovbuf));
+
+       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, iovbuf, sizeof(iovbuf), FALSE, 0)) < 0) {
+               DHD_ERROR(("%s: GET max_scb_probe failed\n", __FUNCTION__));
+       }
+
+       memcpy(&scb_probe, iovbuf, sizeof(wl_scb_probe_t));
+
+       scb_probe.scb_max_probe = NUM_SCB_MAX_PROBE;
+
+       bcm_mkiovar("scb_probe", (char *)&scb_probe,
+               sizeof(wl_scb_probe_t), iovbuf, sizeof(iovbuf));
+       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0) {
+               DHD_ERROR(("%s: max_scb_probe setting failed\n", __FUNCTION__));
+               return;
+       }
+}
+#endif /* WL_CFG80211 && NUM_SCB_MAX_PROBE */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24)
+static void
+dhd_ethtool_get_drvinfo(struct net_device *net, struct ethtool_drvinfo *info)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(net);
+
+       snprintf(info->driver, sizeof(info->driver), "wl");
+       snprintf(info->version, sizeof(info->version), "%lu", dhd->pub.drv_version);
+}
+
+struct ethtool_ops dhd_ethtool_ops = {
+       .get_drvinfo = dhd_ethtool_get_drvinfo
+};
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24) */
+
+
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 4, 2)
+static int
+dhd_ethtool(dhd_info_t *dhd, void *uaddr)
+{
+       struct ethtool_drvinfo info;
+       char drvname[sizeof(info.driver)];
+       uint32 cmd;
+#ifdef TOE
+       struct ethtool_value edata;
+       uint32 toe_cmpnt, csum_dir;
+       int ret;
+#endif
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       /* all ethtool calls start with a cmd word */
+       if (copy_from_user(&cmd, uaddr, sizeof (uint32)))
+               return -EFAULT;
+
+       switch (cmd) {
+       case ETHTOOL_GDRVINFO:
+               /* Copy out any request driver name */
+               if (copy_from_user(&info, uaddr, sizeof(info)))
+                       return -EFAULT;
+               strncpy(drvname, info.driver, sizeof(info.driver));
+               drvname[sizeof(info.driver)-1] = '\0';
+
+               /* clear struct for return */
+               memset(&info, 0, sizeof(info));
+               info.cmd = cmd;
+
+               /* if dhd requested, identify ourselves */
+               if (strcmp(drvname, "?dhd") == 0) {
+                       snprintf(info.driver, sizeof(info.driver), "dhd");
+                       strncpy(info.version, EPI_VERSION_STR, sizeof(info.version) - 1);
+                       info.version[sizeof(info.version) - 1] = '\0';
+               }
+
+               /* otherwise, require dongle to be up */
+               else if (!dhd->pub.up) {
+                       DHD_ERROR(("%s: dongle is not up\n", __FUNCTION__));
+                       return -ENODEV;
+               }
+
+               /* finally, report dongle driver type */
+               else if (dhd->pub.iswl)
+                       snprintf(info.driver, sizeof(info.driver), "wl");
+               else
+                       snprintf(info.driver, sizeof(info.driver), "xx");
+
+               snprintf(info.version, sizeof(info.version), "%lu", dhd->pub.drv_version);
+               if (copy_to_user(uaddr, &info, sizeof(info)))
+                       return -EFAULT;
+               DHD_CTL(("%s: given %*s, returning %s\n", __FUNCTION__,
+                        (int)sizeof(drvname), drvname, info.driver));
+               break;
+
+#ifdef TOE
+       /* Get toe offload components from dongle */
+       case ETHTOOL_GRXCSUM:
+       case ETHTOOL_GTXCSUM:
+               if ((ret = dhd_toe_get(dhd, 0, &toe_cmpnt)) < 0)
+                       return ret;
+
+               csum_dir = (cmd == ETHTOOL_GTXCSUM) ? TOE_TX_CSUM_OL : TOE_RX_CSUM_OL;
+
+               edata.cmd = cmd;
+               edata.data = (toe_cmpnt & csum_dir) ? 1 : 0;
+
+               if (copy_to_user(uaddr, &edata, sizeof(edata)))
+                       return -EFAULT;
+               break;
+
+       /* Set toe offload components in dongle */
+       case ETHTOOL_SRXCSUM:
+       case ETHTOOL_STXCSUM:
+               if (copy_from_user(&edata, uaddr, sizeof(edata)))
+                       return -EFAULT;
+
+               /* Read the current settings, update and write back */
+               if ((ret = dhd_toe_get(dhd, 0, &toe_cmpnt)) < 0)
+                       return ret;
+
+               csum_dir = (cmd == ETHTOOL_STXCSUM) ? TOE_TX_CSUM_OL : TOE_RX_CSUM_OL;
+
+               if (edata.data != 0)
+                       toe_cmpnt |= csum_dir;
+               else
+                       toe_cmpnt &= ~csum_dir;
+
+               if ((ret = dhd_toe_set(dhd, 0, toe_cmpnt)) < 0)
+                       return ret;
+
+               /* If setting TX checksum mode, tell Linux the new mode */
+               if (cmd == ETHTOOL_STXCSUM) {
+                       if (edata.data)
+                               dhd->iflist[0]->net->features |= NETIF_F_IP_CSUM;
+                       else
+                               dhd->iflist[0]->net->features &= ~NETIF_F_IP_CSUM;
+               }
+
+               break;
+#endif /* TOE */
+
+       default:
+               return -EOPNOTSUPP;
+       }
+
+       return 0;
+}
+#endif /* LINUX_VERSION_CODE > KERNEL_VERSION(2, 4, 2) */
+
+static bool dhd_check_hang(struct net_device *net, dhd_pub_t *dhdp, int error)
+{
+
+       if (!dhdp) {
+               DHD_ERROR(("%s: dhdp is NULL\n", __FUNCTION__));
+               return FALSE;
+       }
+
+       if (!dhdp->up)
+               return FALSE;
+
+#if !defined(BCMPCIE)
+       if (dhdp->info->thr_dpc_ctl.thr_pid < 0) {
+               DHD_ERROR(("%s : skipped due to negative pid - unloading?\n", __FUNCTION__));
+               return FALSE;
+       }
+#endif 
+
+       if ((error == -ETIMEDOUT) || (error == -EREMOTEIO) ||
+               ((dhdp->busstate == DHD_BUS_DOWN) && (!dhdp->dongle_reset))) {
+#ifdef BCMPCIE
+               DHD_ERROR(("%s: Event HANG send up due to  re=%d te=%d d3acke=%d e=%d s=%d\n",
+                       __FUNCTION__, dhdp->rxcnt_timeout, dhdp->txcnt_timeout,
+                       dhdp->d3ackcnt_timeout, error, dhdp->busstate));
+#else
+               DHD_ERROR(("%s: Event HANG send up due to  re=%d te=%d e=%d s=%d\n", __FUNCTION__,
+                       dhdp->rxcnt_timeout, dhdp->txcnt_timeout, error, dhdp->busstate));
+#endif /* BCMPCIE */
+               if (dhdp->hang_reason == 0) {
+                       if (dhdp->dongle_trap_occured) {
+                               dhdp->hang_reason = HANG_REASON_DONGLE_TRAP;
+#ifdef BCMPCIE
+                       } else if (dhdp->d3ackcnt_timeout) {
+                               dhdp->hang_reason = HANG_REASON_D3_ACK_TIMEOUT;
+#endif /* BCMPCIE */
+                       } else {
+                               dhdp->hang_reason = HANG_REASON_IOCTL_RESP_TIMEOUT;
+                       }
+               }
+               net_os_send_hang_message(net);
+               return TRUE;
+       }
+       return FALSE;
+}
+
+int dhd_ioctl_process(dhd_pub_t *pub, int ifidx, dhd_ioctl_t *ioc, void *data_buf)
+{
+       int bcmerror = BCME_OK;
+       int buflen = 0;
+       struct net_device *net;
+
+       net = dhd_idx2net(pub, ifidx);
+       if (!net) {
+               bcmerror = BCME_BADARG;
+               goto done;
+       }
+
+       if (data_buf)
+               buflen = MIN(ioc->len, DHD_IOCTL_MAXLEN);
+
+       /* check for local dhd ioctl and handle it */
+       if (ioc->driver == DHD_IOCTL_MAGIC) {
+               bcmerror = dhd_ioctl((void *)pub, ioc, data_buf, buflen);
+               if (bcmerror)
+                       pub->bcmerror = bcmerror;
+               goto done;
+       }
+
+       /* send to dongle (must be up, and wl). */
+       if (pub->busstate == DHD_BUS_DOWN || pub->busstate == DHD_BUS_LOAD) {
+               if (allow_delay_fwdl) {
+                       int ret = dhd_bus_start(pub);
+                       if (ret != 0) {
+                               DHD_ERROR(("%s: failed with code %d\n", __FUNCTION__, ret));
+                               bcmerror = BCME_DONGLE_DOWN;
+                               goto done;
+                       }
+               } else {
+                       bcmerror = BCME_DONGLE_DOWN;
+                       goto done;
+               }
+       }
+
+       if (!pub->iswl) {
+               bcmerror = BCME_DONGLE_DOWN;
+               goto done;
+       }
+
+       /*
+        * Flush the TX queue if required for proper message serialization:
+        * Intercept WLC_SET_KEY IOCTL - serialize M4 send and set key IOCTL to
+        * prevent M4 encryption and
+        * intercept WLC_DISASSOC IOCTL - serialize WPS-DONE and WLC_DISASSOC IOCTL to
+        * prevent disassoc frame being sent before WPS-DONE frame.
+        */
+       if (ioc->cmd == WLC_SET_KEY ||
+           (ioc->cmd == WLC_SET_VAR && data_buf != NULL &&
+            strncmp("wsec_key", data_buf, 9) == 0) ||
+           (ioc->cmd == WLC_SET_VAR && data_buf != NULL &&
+            strncmp("bsscfg:wsec_key", data_buf, 15) == 0) ||
+           ioc->cmd == WLC_DISASSOC)
+               dhd_wait_pend8021x(net);
+
+#ifdef WLMEDIA_HTSF
+       if (data_buf) {
+               /*  short cut wl ioctl calls here  */
+               if (strcmp("htsf", data_buf) == 0) {
+                       dhd_ioctl_htsf_get(dhd, 0);
+                       return BCME_OK;
+               }
+
+               if (strcmp("htsflate", data_buf) == 0) {
+                       if (ioc->set) {
+                               memset(ts, 0, sizeof(tstamp_t)*TSMAX);
+                               memset(&maxdelayts, 0, sizeof(tstamp_t));
+                               maxdelay = 0;
+                               tspktcnt = 0;
+                               maxdelaypktno = 0;
+                               memset(&vi_d1.bin, 0, sizeof(uint32)*NUMBIN);
+                               memset(&vi_d2.bin, 0, sizeof(uint32)*NUMBIN);
+                               memset(&vi_d3.bin, 0, sizeof(uint32)*NUMBIN);
+                               memset(&vi_d4.bin, 0, sizeof(uint32)*NUMBIN);
+                       } else {
+                               dhd_dump_latency();
+                       }
+                       return BCME_OK;
+               }
+               if (strcmp("htsfclear", data_buf) == 0) {
+                       memset(&vi_d1.bin, 0, sizeof(uint32)*NUMBIN);
+                       memset(&vi_d2.bin, 0, sizeof(uint32)*NUMBIN);
+                       memset(&vi_d3.bin, 0, sizeof(uint32)*NUMBIN);
+                       memset(&vi_d4.bin, 0, sizeof(uint32)*NUMBIN);
+                       htsf_seqnum = 0;
+                       return BCME_OK;
+               }
+               if (strcmp("htsfhis", data_buf) == 0) {
+                       dhd_dump_htsfhisto(&vi_d1, "H to D");
+                       dhd_dump_htsfhisto(&vi_d2, "D to D");
+                       dhd_dump_htsfhisto(&vi_d3, "D to H");
+                       dhd_dump_htsfhisto(&vi_d4, "H to H");
+                       return BCME_OK;
+               }
+               if (strcmp("tsport", data_buf) == 0) {
+                       if (ioc->set) {
+                               memcpy(&tsport, data_buf + 7, 4);
+                       } else {
+                               DHD_ERROR(("current timestamp port: %d \n", tsport));
+                       }
+                       return BCME_OK;
+               }
+       }
+#endif /* WLMEDIA_HTSF */
+
+       if ((ioc->cmd == WLC_SET_VAR || ioc->cmd == WLC_GET_VAR) &&
+               data_buf != NULL && strncmp("rpc_", data_buf, 4) == 0) {
+#ifdef BCM_FD_AGGR
+               bcmerror = dhd_fdaggr_ioctl(pub, ifidx, (wl_ioctl_t *)ioc, data_buf, buflen);
+#else
+               bcmerror = BCME_UNSUPPORTED;
+#endif
+               goto done;
+       }
+
+#ifdef DHD_DEBUG
+       if (ioc->cmd != WLC_GET_MAGIC && ioc->cmd != WLC_GET_VERSION) {
+               if (ioc->cmd == WLC_SET_VAR || ioc->cmd == WLC_GET_VAR) {
+                       /* Print  IOVAR Information */
+                       DHD_IOV_INFO(("%s: IOVAR_INFO name = %s set = %d\n",
+                               __FUNCTION__, (char *)data_buf, ioc->set));
+                       if ((dhd_msg_level & DHD_IOV_INFO_VAL) && ioc->set && data_buf) {
+                               prhex(NULL, data_buf + strlen(data_buf) + 1,
+                                       buflen - strlen(data_buf) - 1);
+                       }
+               } else {
+                       /* Print  IOCTL Information */
+                       DHD_IOV_INFO(("%s: IOCTL_INFO cmd = %d set = %d\n",
+                               __FUNCTION__, ioc->cmd, ioc->set));
+                       if ((dhd_msg_level & DHD_IOV_INFO_VAL) && ioc->set && data_buf) {
+                               prhex(NULL, data_buf, buflen);
+                       }
+               }
+       }
+#endif /* DHD_DEBUG */
+
+       bcmerror = dhd_wl_ioctl(pub, ifidx, (wl_ioctl_t *)ioc, data_buf, buflen);
+
+done:
+       dhd_check_hang(net, pub, bcmerror);
+
+       return bcmerror;
+}
+
+static int
+dhd_ioctl_entry(struct net_device *net, struct ifreq *ifr, int cmd)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(net);
+       dhd_ioctl_t ioc;
+       int ifidx;
+       int ret;
+       void *local_buf = NULL;
+       u16 buflen = 0;
+#ifdef ENABLE_INSMOD_NO_FW_LOAD
+       allow_delay_fwdl = 1;
+#endif
+
+       DHD_OS_WAKE_LOCK(&dhd->pub);
+       DHD_PERIM_LOCK(&dhd->pub);
+
+#ifndef ENABLE_INSMOD_NO_FW_LOAD
+       /* Interface up check for built-in type */
+       if (!dhd_download_fw_on_driverload && dhd->pub.up == FALSE) {
+               DHD_TRACE(("%s: Interface is down \n", __FUNCTION__));
+               ret = BCME_NOTUP;
+               goto exit;
+       }
+#endif
+
+       /* send to dongle only if we are not waiting for reload already */
+       if (dhd->pub.hang_was_sent) {
+               DHD_TRACE(("%s: HANG was sent up earlier\n", __FUNCTION__));
+               DHD_OS_WAKE_LOCK_CTRL_TIMEOUT_ENABLE(&dhd->pub, DHD_EVENT_TIMEOUT_MS);
+               ret = BCME_DONGLE_DOWN;
+               goto exit;
+       }
+
+       ifidx = dhd_net2idx(dhd, net);
+       DHD_TRACE(("%s: ifidx %d, cmd 0x%04x\n", __FUNCTION__, ifidx, cmd));
+
+       if (ifidx == DHD_BAD_IF) {
+               DHD_ERROR(("%s: BAD IF\n", __FUNCTION__));
+               ret = -1;
+               goto exit;
+       }
+
+#if defined(WL_WIRELESS_EXT)
+       /* linux wireless extensions */
+       if ((cmd >= SIOCIWFIRST) && (cmd <= SIOCIWLAST)) {
+               /* may recurse, do NOT lock */
+               ret = wl_iw_ioctl(net, ifr, cmd);
+               goto exit;
+       }
+#endif /* defined(WL_WIRELESS_EXT) */
+
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 4, 2)
+       if (cmd == SIOCETHTOOL) {
+               ret = dhd_ethtool(dhd, (void*)ifr->ifr_data);
+               goto exit;
+       }
+#endif /* LINUX_VERSION_CODE > KERNEL_VERSION(2, 4, 2) */
+
+       if (cmd == SIOCDEVPRIVATE+1) {
+               ret = wl_android_priv_cmd(net, ifr, cmd);
+               dhd_check_hang(net, &dhd->pub, ret);
+               goto exit;
+       }
+
+       if (cmd != SIOCDEVPRIVATE) {
+               ret = -EOPNOTSUPP;
+               goto exit;
+       }
+
+       memset(&ioc, 0, sizeof(ioc));
+
+#ifdef CONFIG_COMPAT
+#if ((LINUX_VERSION_CODE < KERNEL_VERSION(4, 6, 0)) || ((LINUX_VERSION_CODE >= \
+       KERNEL_VERSION(4, 6, 0)) && !defined(__X86)))
+       if (is_compat_task()) {
+               compat_wl_ioctl_t compat_ioc;
+               if (copy_from_user(&compat_ioc, ifr->ifr_data, sizeof(compat_wl_ioctl_t))) {
+                       ret = BCME_BADADDR;
+                       goto done;
+               }
+               ioc.cmd = compat_ioc.cmd;
+               ioc.buf = compat_ptr(compat_ioc.buf);
+               ioc.len = compat_ioc.len;
+               ioc.set = compat_ioc.set;
+               ioc.used = compat_ioc.used;
+               ioc.needed = compat_ioc.needed;
+               /* To differentiate between wl and dhd read 4 more byes */
+               if ((copy_from_user(&ioc.driver, (char *)ifr->ifr_data + sizeof(compat_wl_ioctl_t),
+                       sizeof(uint)) != 0)) {
+                       ret = BCME_BADADDR;
+                       goto done;
+               }
+       } else
+#endif /* LINUX_VER < 4.6 || (LINUX_VER >= 4.6 && !defined(__X86)) */
+#endif /* CONFIG_COMPAT */
+       {
+               /* Copy the ioc control structure part of ioctl request */
+               if (copy_from_user(&ioc, ifr->ifr_data, sizeof(wl_ioctl_t))) {
+                       ret = BCME_BADADDR;
+                       goto done;
+               }
+
+               /* To differentiate between wl and dhd read 4 more byes */
+               if ((copy_from_user(&ioc.driver, (char *)ifr->ifr_data + sizeof(wl_ioctl_t),
+                       sizeof(uint)) != 0)) {
+                       ret = BCME_BADADDR;
+                       goto done;
+               }
+       }
+
+       if (!capable(CAP_NET_ADMIN)) {
+               ret = BCME_EPERM;
+               goto done;
+       }
+
+       if (ioc.len > 0) {
+               buflen = MIN(ioc.len, DHD_IOCTL_MAXLEN);
+               if (!(local_buf = MALLOC(dhd->pub.osh, buflen+1))) {
+                       ret = BCME_NOMEM;
+                       goto done;
+               }
+
+               DHD_PERIM_UNLOCK(&dhd->pub);
+               if (copy_from_user(local_buf, ioc.buf, buflen)) {
+                       DHD_PERIM_LOCK(&dhd->pub);
+                       ret = BCME_BADADDR;
+                       goto done;
+               }
+               DHD_PERIM_LOCK(&dhd->pub);
+
+               *(char *)(local_buf + buflen) = '\0';
+       }
+
+       ret = dhd_ioctl_process(&dhd->pub, ifidx, &ioc, local_buf);
+
+       if (!ret && buflen && local_buf && ioc.buf) {
+               DHD_PERIM_UNLOCK(&dhd->pub);
+               if (copy_to_user(ioc.buf, local_buf, buflen))
+                       ret = -EFAULT;
+               DHD_PERIM_LOCK(&dhd->pub);
+       }
+
+done:
+       if (local_buf)
+               MFREE(dhd->pub.osh, local_buf, buflen+1);
+
+exit:
+       DHD_PERIM_UNLOCK(&dhd->pub);
+       DHD_OS_WAKE_UNLOCK(&dhd->pub);
+
+       return OSL_ERROR(ret);
+}
+
+
+#ifdef FIX_CPU_MIN_CLOCK
+static int dhd_init_cpufreq_fix(dhd_info_t *dhd)
+{
+       if (dhd) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+               mutex_init(&dhd->cpufreq_fix);
+#endif
+               dhd->cpufreq_fix_status = FALSE;
+       }
+       return 0;
+}
+
+static void dhd_fix_cpu_freq(dhd_info_t *dhd)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+       mutex_lock(&dhd->cpufreq_fix);
+#endif
+       if (dhd && !dhd->cpufreq_fix_status) {
+               pm_qos_add_request(&dhd->dhd_cpu_qos, PM_QOS_CPU_FREQ_MIN, 300000);
+#ifdef FIX_BUS_MIN_CLOCK
+               pm_qos_add_request(&dhd->dhd_bus_qos, PM_QOS_BUS_THROUGHPUT, 400000);
+#endif /* FIX_BUS_MIN_CLOCK */
+               DHD_ERROR(("pm_qos_add_requests called\n"));
+
+               dhd->cpufreq_fix_status = TRUE;
+       }
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+       mutex_unlock(&dhd->cpufreq_fix);
+#endif
+}
+
+static void dhd_rollback_cpu_freq(dhd_info_t *dhd)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+       mutex_lock(&dhd ->cpufreq_fix);
+#endif
+       if (dhd && dhd->cpufreq_fix_status != TRUE) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+               mutex_unlock(&dhd->cpufreq_fix);
+#endif
+               return;
+       }
+
+       pm_qos_remove_request(&dhd->dhd_cpu_qos);
+#ifdef FIX_BUS_MIN_CLOCK
+       pm_qos_remove_request(&dhd->dhd_bus_qos);
+#endif /* FIX_BUS_MIN_CLOCK */
+       DHD_ERROR(("pm_qos_add_requests called\n"));
+
+       dhd->cpufreq_fix_status = FALSE;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+       mutex_unlock(&dhd->cpufreq_fix);
+#endif
+}
+#endif /* FIX_CPU_MIN_CLOCK */
+
+static int
+dhd_stop(struct net_device *net)
+{
+       int ifidx = 0;
+       dhd_info_t *dhd = DHD_DEV_INFO(net);
+       DHD_OS_WAKE_LOCK(&dhd->pub);
+       DHD_PERIM_LOCK(&dhd->pub);
+       DHD_TRACE(("%s: Enter %p\n", __FUNCTION__, net));
+       dhd->pub.rxcnt_timeout = 0;
+       dhd->pub.txcnt_timeout = 0;
+
+#ifdef BCMPCIE
+       dhd->pub.d3ackcnt_timeout = 0;
+#endif /* BCMPCIE */
+
+       if (dhd->pub.up == 0) {
+               goto exit;
+       }
+
+       dhd_if_flush_sta(DHD_DEV_IFP(net));
+
+       /* Disable Runtime PM before interface down */
+       DHD_DISABLE_RUNTIME_PM(&dhd->pub);
+
+#ifdef FIX_CPU_MIN_CLOCK
+       if (dhd_get_fw_mode(dhd) == DHD_FLAG_HOSTAP_MODE)
+               dhd_rollback_cpu_freq(dhd);
+#endif /* FIX_CPU_MIN_CLOCK */
+
+       ifidx = dhd_net2idx(dhd, net);
+       BCM_REFERENCE(ifidx);
+
+       /* Set state and stop OS transmissions */
+       netif_stop_queue(net);
+       dhd->pub.up = 0;
+
+#ifdef WL_CFG80211
+       if (ifidx == 0) {
+               dhd_if_t *ifp;
+               wl_cfg80211_down(DHD_GET_CFG80211_PRIV(&dhd->pub));
+
+               ifp = dhd->iflist[0];
+               ASSERT(ifp && ifp->net);
+               /*
+                * For CFG80211: Clean up all the left over virtual interfaces
+                * when the primary Interface is brought down. [ifconfig wlan0 down]
+                */
+               if (!dhd_download_fw_on_driverload) {
+                       if ((dhd->dhd_state & DHD_ATTACH_STATE_ADD_IF) &&
+                               (dhd->dhd_state & DHD_ATTACH_STATE_CFG80211)) {
+                               int i;
+
+#ifdef WL_CFG80211_P2P_DEV_IF
+                               wl_cfg80211_del_p2p_wdev(DHD_GET_CFG80211_PRIV(&dhd->pub));
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+                               dhd_net_if_lock_local(dhd);
+                               for (i = 1; i < DHD_MAX_IFS; i++)
+                                       dhd_remove_if(&dhd->pub, i, FALSE);
+
+                               if (ifp && ifp->net) {
+                                       dhd_if_del_sta_list(ifp);
+                               }
+
+#ifdef ARP_OFFLOAD_SUPPORT
+                               if (dhd_inetaddr_notifier_registered) {
+                                       dhd_inetaddr_notifier_registered = FALSE;
+                                       unregister_inetaddr_notifier(&dhd_inetaddr_notifier);
+                               }
+#endif /* ARP_OFFLOAD_SUPPORT */
+#if defined(CONFIG_IPV6) && defined(IPV6_NDO_SUPPORT)
+                               if (dhd_inet6addr_notifier_registered) {
+                                       dhd_inet6addr_notifier_registered = FALSE;
+                                       unregister_inet6addr_notifier(&dhd_inet6addr_notifier);
+                               }
+#endif /* CONFIG_IPV6 && IPV6_NDO_SUPPORT */
+                               dhd_net_if_unlock_local(dhd);
+                       }
+                       cancel_work_sync(dhd->dhd_deferred_wq);
+#if defined(DHD_LB) && defined(DHD_LB_RXP)
+                       __skb_queue_purge(&dhd->rx_pend_queue);
+#endif /* DHD_LB && DHD_LB_RXP */
+               }
+
+#if defined(BCMPCIE) && defined(DHDTCPACK_SUPPRESS)
+               dhd_tcpack_suppress_set(&dhd->pub, TCPACK_SUP_OFF);
+#endif /* BCMPCIE && DHDTCPACK_SUPPRESS */
+#if defined(DHD_LB) && defined(DHD_LB_RXP)
+               if (ifp->net == dhd->rx_napi_netdev) {
+                       DHD_INFO(("%s napi<%p> disabled ifp->net<%p,%s>\n",
+                               __FUNCTION__, &dhd->rx_napi_struct, net, net->name));
+                       skb_queue_purge(&dhd->rx_napi_queue);
+                       napi_disable(&dhd->rx_napi_struct);
+                       netif_napi_del(&dhd->rx_napi_struct);
+                       dhd->rx_napi_netdev = NULL;
+               }
+#endif /* DHD_LB && DHD_LB_RXP */
+
+       }
+#endif /* WL_CFG80211 */
+
+#ifdef PROP_TXSTATUS
+       dhd_wlfc_cleanup(&dhd->pub, NULL, 0);
+#endif
+       /* Stop the protocol module */
+       dhd_prot_stop(&dhd->pub);
+
+       OLD_MOD_DEC_USE_COUNT;
+exit:
+#if defined(WL_CFG80211)
+       if (ifidx == 0 && !dhd_download_fw_on_driverload)
+                       wl_android_wifi_off(net, TRUE);
+#endif 
+       dhd->pub.hang_was_sent = 0;
+
+       /* Clear country spec for for built-in type driver */
+       if (!dhd_download_fw_on_driverload) {
+               dhd->pub.dhd_cspec.country_abbrev[0] = 0x00;
+               dhd->pub.dhd_cspec.rev = 0;
+               dhd->pub.dhd_cspec.ccode[0] = 0x00;
+       }
+
+#ifdef BCMDBGFS
+       dhd_dbg_remove();
+#endif
+
+       DHD_PERIM_UNLOCK(&dhd->pub);
+       DHD_OS_WAKE_UNLOCK(&dhd->pub);
+
+       /* Destroy wakelock */
+       if (!dhd_download_fw_on_driverload &&
+               (dhd->dhd_state & DHD_ATTACH_STATE_WAKELOCKS_INIT)) {
+               DHD_OS_WAKE_LOCK_DESTROY(dhd);
+               dhd->dhd_state &= ~DHD_ATTACH_STATE_WAKELOCKS_INIT;
+       }
+
+       return 0;
+}
+
+#if defined(WL_CFG80211) && defined(USE_INITIAL_SHORT_DWELL_TIME)
+extern bool g_first_broadcast_scan;
+#endif 
+
+#ifdef WL11U
+static int dhd_interworking_enable(dhd_pub_t *dhd)
+{
+       char iovbuf[WLC_IOCTL_SMLEN];
+       uint32 enable = true;
+       int ret = BCME_OK;
+
+       bcm_mkiovar("interworking", (char *)&enable, sizeof(enable), iovbuf, sizeof(iovbuf));
+       ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+       if (ret < 0) {
+               DHD_ERROR(("%s: enableing interworking failed, ret=%d\n", __FUNCTION__, ret));
+       }
+
+       if (ret == BCME_OK) {
+               /* basic capabilities for HS20 REL2 */
+               uint32 cap = WL_WNM_BSSTRANS | WL_WNM_NOTIF;
+               bcm_mkiovar("wnm", (char *)&cap, sizeof(cap), iovbuf, sizeof(iovbuf));
+               ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+               if (ret < 0) {
+                       DHD_ERROR(("%s: set wnm returned (%d)\n", __FUNCTION__, ret));
+               }
+       }
+
+       return ret;
+}
+#endif /* WL11u */
+
+static int
+dhd_open(struct net_device *net)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(net);
+#ifdef TOE
+       uint32 toe_ol;
+#endif
+#ifdef BCM_FD_AGGR
+       char iovbuf[WLC_IOCTL_SMLEN];
+       dbus_config_t config;
+       uint32 agglimit = 0;
+       uint32 rpc_agg = BCM_RPC_TP_DNGL_AGG_DPC; /* host aggr not enabled yet */
+#endif /* BCM_FD_AGGR */
+       int ifidx;
+       int32 ret = 0;
+
+       if (!dhd_download_fw_on_driverload && !dhd_driver_init_done) {
+               DHD_ERROR(("%s: WLAN driver is not initialized\n", __FUNCTION__));
+               return -1;
+       }
+
+       /* Init wakelock */
+       if (!dhd_download_fw_on_driverload &&
+               !(dhd->dhd_state & DHD_ATTACH_STATE_WAKELOCKS_INIT)) {
+               DHD_OS_WAKE_LOCK_INIT(dhd);
+               dhd->dhd_state |= DHD_ATTACH_STATE_WAKELOCKS_INIT;
+       }
+
+#ifdef PREVENT_REOPEN_DURING_HANG
+       /* WAR : to prevent calling dhd_open abnormally in quick succession after hang event */
+       if (dhd->pub.hang_was_sent == 1) {
+               DHD_ERROR(("%s: HANG was sent up earlier\n", __FUNCTION__));
+               /* Force to bring down WLAN interface in case dhd_stop() is not called
+                * from the upper layer when HANG event is triggered.
+                */
+               if (!dhd_download_fw_on_driverload && dhd->pub.up == 1) {
+                       DHD_ERROR(("%s: WLAN interface is not brought down\n", __FUNCTION__));
+                       dhd_stop(net);
+               } else {
+                       return -1;
+               }
+       }
+#endif /* PREVENT_REOPEN_DURING_HANG */
+
+
+       DHD_OS_WAKE_LOCK(&dhd->pub);
+       DHD_PERIM_LOCK(&dhd->pub);
+       dhd->pub.dongle_trap_occured = 0;
+       dhd->pub.hang_was_sent = 0;
+       dhd->pub.hang_reason = 0;
+       dhd->pub.iovar_timeout_occured = 0;
+#ifdef PCIE_FULL_DONGLE
+       dhd->pub.d3ack_timeout_occured = 0;
+#endif /* PCIE_FULL_DONGLE */
+
+#ifdef DHD_LOSSLESS_ROAMING
+       dhd->pub.dequeue_prec_map = ALLPRIO;
+#endif
+#if !defined(WL_CFG80211)
+       /*
+        * Force start if ifconfig_up gets called before START command
+        *  We keep WEXT's wl_control_wl_start to provide backward compatibility
+        *  This should be removed in the future
+        */
+       ret = wl_control_wl_start(net);
+       if (ret != 0) {
+               DHD_ERROR(("%s: failed with code %d\n", __FUNCTION__, ret));
+               ret = -1;
+               goto exit;
+       }
+
+#endif 
+
+       ifidx = dhd_net2idx(dhd, net);
+       DHD_TRACE(("%s: ifidx %d\n", __FUNCTION__, ifidx));
+
+       if (ifidx < 0) {
+               DHD_ERROR(("%s: Error: called with invalid IF\n", __FUNCTION__));
+               ret = -1;
+               goto exit;
+       }
+
+       if (!dhd->iflist[ifidx]) {
+               DHD_ERROR(("%s: Error: called when IF already deleted\n", __FUNCTION__));
+               ret = -1;
+               goto exit;
+       }
+
+       if (ifidx == 0) {
+               atomic_set(&dhd->pend_8021x_cnt, 0);
+#if defined(WL_CFG80211)
+               if (!dhd_download_fw_on_driverload) {
+                       DHD_ERROR(("\n%s\n", dhd_version));
+#if defined(USE_INITIAL_SHORT_DWELL_TIME)
+                       g_first_broadcast_scan = TRUE;
+#endif 
+                       ret = wl_android_wifi_on(net);
+                       if (ret != 0) {
+                               DHD_ERROR(("%s : wl_android_wifi_on failed (%d)\n",
+                                       __FUNCTION__, ret));
+                               ret = -1;
+                               goto exit;
+                       }
+               }
+#ifdef FIX_CPU_MIN_CLOCK
+               if (dhd_get_fw_mode(dhd) == DHD_FLAG_HOSTAP_MODE) {
+                       dhd_init_cpufreq_fix(dhd);
+                       dhd_fix_cpu_freq(dhd);
+               }
+#endif /* FIX_CPU_MIN_CLOCK */
+#endif 
+
+               if (dhd->pub.busstate != DHD_BUS_DATA) {
+
+                       /* try to bring up bus */
+                       DHD_PERIM_UNLOCK(&dhd->pub);
+                       ret = dhd_bus_start(&dhd->pub);
+                       DHD_PERIM_LOCK(&dhd->pub);
+                       if (ret) {
+                               DHD_ERROR(("%s: failed with code %d\n", __FUNCTION__, ret));
+                               ret = -1;
+                               goto exit;
+                       }
+
+               }
+
+#ifdef BCM_FD_AGGR
+               config.config_id = DBUS_CONFIG_ID_AGGR_LIMIT;
+
+
+               memset(iovbuf, 0, sizeof(iovbuf));
+               bcm_mkiovar("rpc_dngl_agglimit", (char *)&agglimit, 4,
+                       iovbuf, sizeof(iovbuf));
+
+               if (!dhd_wl_ioctl_cmd(&dhd->pub, WLC_GET_VAR, iovbuf, sizeof(iovbuf), FALSE, 0)) {
+                       agglimit = *(uint32 *)iovbuf;
+                       config.aggr_param.maxrxsf = agglimit >> BCM_RPC_TP_AGG_SF_SHIFT;
+                       config.aggr_param.maxrxsize = agglimit & BCM_RPC_TP_AGG_BYTES_MASK;
+                       DHD_ERROR(("rpc_dngl_agglimit %x : sf_limit %d bytes_limit %d\n",
+                               agglimit, config.aggr_param.maxrxsf, config.aggr_param.maxrxsize));
+                       if (bcm_rpc_tp_set_config(dhd->pub.info->rpc_th, &config)) {
+                               DHD_ERROR(("set tx/rx queue size and buffersize failed\n"));
+                       }
+               } else {
+                       DHD_ERROR(("get rpc_dngl_agglimit failed\n"));
+                       rpc_agg &= ~BCM_RPC_TP_DNGL_AGG_DPC;
+               }
+
+               /* Set aggregation for TX */
+               bcm_rpc_tp_agg_set(dhd->pub.info->rpc_th, BCM_RPC_TP_HOST_AGG_MASK,
+                       rpc_agg & BCM_RPC_TP_HOST_AGG_MASK);
+
+               /* Set aggregation for RX */
+               memset(iovbuf, 0, sizeof(iovbuf));
+               bcm_mkiovar("rpc_agg", (char *)&rpc_agg, sizeof(rpc_agg), iovbuf, sizeof(iovbuf));
+               if (!dhd_wl_ioctl_cmd(&dhd->pub, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) {
+                       dhd->pub.info->fdaggr = 0;
+                       if (rpc_agg & BCM_RPC_TP_HOST_AGG_MASK)
+                               dhd->pub.info->fdaggr |= BCM_FDAGGR_H2D_ENABLED;
+                       if (rpc_agg & BCM_RPC_TP_DNGL_AGG_MASK)
+                               dhd->pub.info->fdaggr |= BCM_FDAGGR_D2H_ENABLED;
+               } else {
+                       DHD_ERROR(("%s(): Setting RX aggregation failed %d\n", __FUNCTION__, ret));
+               }
+#endif /* BCM_FD_AGGR */
+
+               /* dhd_sync_with_dongle has been called in dhd_bus_start or wl_android_wifi_on */
+               memcpy(net->dev_addr, dhd->pub.mac.octet, ETHER_ADDR_LEN);
+
+#ifdef TOE
+               /* Get current TOE mode from dongle */
+               if (dhd_toe_get(dhd, ifidx, &toe_ol) >= 0 && (toe_ol & TOE_TX_CSUM_OL) != 0) {
+                       dhd->iflist[ifidx]->net->features |= NETIF_F_IP_CSUM;
+               } else {
+                       dhd->iflist[ifidx]->net->features &= ~NETIF_F_IP_CSUM;
+               }
+#endif /* TOE */
+
+#if defined(WL_CFG80211)
+               if (unlikely(wl_cfg80211_up(DHD_GET_CFG80211_PRIV(&dhd->pub)))) {
+                       DHD_ERROR(("%s: failed to bring up cfg80211\n", __FUNCTION__));
+                       ret = -1;
+                       goto exit;
+               }
+               if (!dhd_download_fw_on_driverload) {
+#ifdef ARP_OFFLOAD_SUPPORT
+                       dhd->pend_ipaddr = 0;
+                       if (!dhd_inetaddr_notifier_registered) {
+                               dhd_inetaddr_notifier_registered = TRUE;
+                               register_inetaddr_notifier(&dhd_inetaddr_notifier);
+                       }
+#endif /* ARP_OFFLOAD_SUPPORT */
+#if defined(CONFIG_IPV6) && defined(IPV6_NDO_SUPPORT)
+                       if (!dhd_inet6addr_notifier_registered) {
+                               dhd_inet6addr_notifier_registered = TRUE;
+                               register_inet6addr_notifier(&dhd_inet6addr_notifier);
+                       }
+#endif /* CONFIG_IPV6 && IPV6_NDO_SUPPORT */
+#ifdef DHD_LB
+                       DHD_LB_STATS_INIT(&dhd->pub);
+#ifdef DHD_LB_RXP
+                       __skb_queue_head_init(&dhd->rx_pend_queue);
+#endif /* DHD_LB_RXP */
+#endif /* DHD_LB */
+               }
+
+#if defined(BCMPCIE) && defined(DHDTCPACK_SUPPRESS)
+#if defined(SET_RPS_CPUS)
+               dhd_tcpack_suppress_set(&dhd->pub, TCPACK_SUP_OFF);
+#else
+               dhd_tcpack_suppress_set(&dhd->pub, TCPACK_SUP_HOLD);
+#endif 
+#endif /* BCMPCIE && DHDTCPACK_SUPPRESS */
+#if defined(DHD_LB) && defined(DHD_LB_RXP)
+               if (dhd->rx_napi_netdev == NULL) {
+                       dhd->rx_napi_netdev = dhd->iflist[ifidx]->net;
+                       memset(&dhd->rx_napi_struct, 0, sizeof(struct napi_struct));
+                       netif_napi_add(dhd->rx_napi_netdev, &dhd->rx_napi_struct,
+                                       dhd_napi_poll, dhd_napi_weight);
+                       DHD_INFO(("%s napi<%p> enabled ifp->net<%p,%s>\n",
+                                       __FUNCTION__, &dhd->rx_napi_struct, net, net->name));
+                       napi_enable(&dhd->rx_napi_struct);
+                       DHD_INFO(("%s load balance init rx_napi_struct\n", __FUNCTION__));
+                       skb_queue_head_init(&dhd->rx_napi_queue);
+               }
+#endif /* DHD_LB && DHD_LB_RXP */
+#if defined(NUM_SCB_MAX_PROBE)
+               dhd_set_scb_probe(&dhd->pub);
+#endif /* NUM_SCB_MAX_PROBE */
+#endif /* WL_CFG80211 */
+       }
+
+       /* Allow transmit calls */
+       netif_start_queue(net);
+       dhd->pub.up = 1;
+
+       OLD_MOD_INC_USE_COUNT;
+
+#ifdef BCMDBGFS
+       dhd_dbg_init(&dhd->pub);
+#endif
+
+exit:
+       if (ret) {
+               dhd_stop(net);
+       }
+
+       DHD_PERIM_UNLOCK(&dhd->pub);
+       DHD_OS_WAKE_UNLOCK(&dhd->pub);
+
+
+       return ret;
+}
+
+int dhd_do_driver_init(struct net_device *net)
+{
+       dhd_info_t *dhd = NULL;
+
+       if (!net) {
+               DHD_ERROR(("Primary Interface not initialized \n"));
+               return -EINVAL;
+       }
+
+
+       /*  && defined(OEM_ANDROID) && defined(BCMSDIO) */
+       dhd = DHD_DEV_INFO(net);
+
+       /* If driver is already initialized, do nothing
+        */
+       if (dhd->pub.busstate == DHD_BUS_DATA) {
+               DHD_TRACE(("Driver already Inititalized. Nothing to do"));
+               return 0;
+       }
+
+       if (dhd_open(net) < 0) {
+               DHD_ERROR(("Driver Init Failed \n"));
+               return -1;
+       }
+
+       return 0;
+}
+
+int
+dhd_event_ifadd(dhd_info_t *dhdinfo, wl_event_data_if_t *ifevent, char *name, uint8 *mac)
+{
+
+#ifdef WL_CFG80211
+       if (wl_cfg80211_notify_ifadd(DHD_GET_CFG80211_PRIV(&dhdinfo->pub),
+                       ifevent->ifidx, name, mac, ifevent->bssidx) == BCME_OK)
+               return BCME_OK;
+#endif
+
+       /* handle IF event caused by wl commands, SoftAP, WEXT and
+        * anything else. This has to be done asynchronously otherwise
+        * DPC will be blocked (and iovars will timeout as DPC has no chance
+        * to read the response back)
+        */
+       if (ifevent->ifidx > 0) {
+               dhd_if_event_t *if_event = MALLOC(dhdinfo->pub.osh, sizeof(dhd_if_event_t));
+               if (if_event == NULL) {
+                       DHD_ERROR(("dhd_event_ifadd: Failed MALLOC, malloced %d bytes",
+                               MALLOCED(dhdinfo->pub.osh)));
+                       return BCME_NOMEM;
+               }
+
+               memcpy(&if_event->event, ifevent, sizeof(if_event->event));
+               memcpy(if_event->mac, mac, ETHER_ADDR_LEN);
+               strncpy(if_event->name, name, IFNAMSIZ);
+               if_event->name[IFNAMSIZ - 1] = '\0';
+               dhd_deferred_schedule_work(dhdinfo->dhd_deferred_wq, (void *)if_event,
+                       DHD_WQ_WORK_IF_ADD, dhd_ifadd_event_handler, DHD_WORK_PRIORITY_LOW);
+       }
+
+       return BCME_OK;
+}
+
+int
+dhd_event_ifdel(dhd_info_t *dhdinfo, wl_event_data_if_t *ifevent, char *name, uint8 *mac)
+{
+       dhd_if_event_t *if_event;
+
+#ifdef WL_CFG80211
+       if (wl_cfg80211_notify_ifdel(DHD_GET_CFG80211_PRIV(&dhdinfo->pub),
+                       ifevent->ifidx, name, mac, ifevent->bssidx) == BCME_OK)
+               return BCME_OK;
+#endif /* WL_CFG80211 */
+
+       /* handle IF event caused by wl commands, SoftAP, WEXT and
+        * anything else
+        */
+       if_event = MALLOC(dhdinfo->pub.osh, sizeof(dhd_if_event_t));
+       if (if_event == NULL) {
+               DHD_ERROR(("dhd_event_ifdel: malloc failed for if_event, malloced %d bytes",
+                       MALLOCED(dhdinfo->pub.osh)));
+               return BCME_NOMEM;
+       }
+       memcpy(&if_event->event, ifevent, sizeof(if_event->event));
+       memcpy(if_event->mac, mac, ETHER_ADDR_LEN);
+       strncpy(if_event->name, name, IFNAMSIZ);
+       if_event->name[IFNAMSIZ - 1] = '\0';
+       dhd_deferred_schedule_work(dhdinfo->dhd_deferred_wq, (void *)if_event, DHD_WQ_WORK_IF_DEL,
+               dhd_ifdel_event_handler, DHD_WORK_PRIORITY_LOW);
+
+       return BCME_OK;
+}
+
+/* unregister and free the existing net_device interface (if any) in iflist and
+ * allocate a new one. the slot is reused. this function does NOT register the
+ * new interface to linux kernel. dhd_register_if does the job
+ */
+struct net_device*
+dhd_allocate_if(dhd_pub_t *dhdpub, int ifidx, char *name,
+       uint8 *mac, uint8 bssidx, bool need_rtnl_lock, char *dngl_name)
+{
+       dhd_info_t *dhdinfo = (dhd_info_t *)dhdpub->info;
+       dhd_if_t *ifp;
+
+       ASSERT(dhdinfo && (ifidx < DHD_MAX_IFS));
+       ifp = dhdinfo->iflist[ifidx];
+
+       if (ifp != NULL) {
+               if (ifp->net != NULL) {
+                       DHD_ERROR(("%s: free existing IF %s\n", __FUNCTION__, ifp->net->name));
+
+                       dhd_dev_priv_clear(ifp->net); /* clear net_device private */
+
+                       /* in unregister_netdev case, the interface gets freed by net->destructor
+                        * (which is set to free_netdev)
+                        */
+                       if (ifp->net->reg_state == NETREG_UNINITIALIZED) {
+                               free_netdev(ifp->net);
+                       } else {
+                               netif_stop_queue(ifp->net);
+                               if (need_rtnl_lock)
+                                       unregister_netdev(ifp->net);
+                               else
+                                       unregister_netdevice(ifp->net);
+                       }
+                       ifp->net = NULL;
+               }
+       } else {
+               ifp = MALLOC(dhdinfo->pub.osh, sizeof(dhd_if_t));
+               if (ifp == NULL) {
+                       DHD_ERROR(("%s: OOM - dhd_if_t(%zu)\n", __FUNCTION__, sizeof(dhd_if_t)));
+                       return NULL;
+               }
+       }
+
+       memset(ifp, 0, sizeof(dhd_if_t));
+       ifp->info = dhdinfo;
+       ifp->idx = ifidx;
+       ifp->bssidx = bssidx;
+       if (mac != NULL)
+               memcpy(&ifp->mac_addr, mac, ETHER_ADDR_LEN);
+
+       /* Allocate etherdev, including space for private structure */
+       ifp->net = alloc_etherdev(DHD_DEV_PRIV_SIZE);
+       if (ifp->net == NULL) {
+               DHD_ERROR(("%s: OOM - alloc_etherdev(%zu)\n", __FUNCTION__, sizeof(dhdinfo)));
+               goto fail;
+       }
+
+       /* Setup the dhd interface's netdevice private structure. */
+       dhd_dev_priv_save(ifp->net, dhdinfo, ifp, ifidx);
+
+       if (name && name[0]) {
+               strncpy(ifp->net->name, name, IFNAMSIZ);
+               ifp->net->name[IFNAMSIZ - 1] = '\0';
+       }
+
+#ifdef WL_CFG80211
+       if (ifidx == 0)
+               ifp->net->destructor = free_netdev;
+       else
+               ifp->net->destructor = dhd_netdev_free;
+#else
+       ifp->net->destructor = free_netdev;
+#endif /* WL_CFG80211 */
+       strncpy(ifp->name, ifp->net->name, IFNAMSIZ);
+       ifp->name[IFNAMSIZ - 1] = '\0';
+       dhdinfo->iflist[ifidx] = ifp;
+
+/* initialize the dongle provided if name */
+       if (dngl_name)
+               strncpy(ifp->dngl_name, dngl_name, IFNAMSIZ);
+       else
+               strncpy(ifp->dngl_name, name, IFNAMSIZ);
+
+#ifdef PCIE_FULL_DONGLE
+       /* Initialize STA info list */
+       INIT_LIST_HEAD(&ifp->sta_list);
+       DHD_IF_STA_LIST_LOCK_INIT(ifp);
+#endif /* PCIE_FULL_DONGLE */
+
+#ifdef DHD_L2_FILTER
+       ifp->phnd_arp_table = init_l2_filter_arp_table(dhdpub->osh);
+       ifp->parp_allnode = TRUE;
+#endif
+       return ifp->net;
+
+fail:
+
+       if (ifp != NULL) {
+               if (ifp->net != NULL) {
+                       dhd_dev_priv_clear(ifp->net);
+                       free_netdev(ifp->net);
+                       ifp->net = NULL;
+               }
+               MFREE(dhdinfo->pub.osh, ifp, sizeof(*ifp));
+               ifp = NULL;
+       }
+
+       dhdinfo->iflist[ifidx] = NULL;
+       return NULL;
+}
+
+/* unregister and free the the net_device interface associated with the indexed
+ * slot, also free the slot memory and set the slot pointer to NULL
+ */
+int
+dhd_remove_if(dhd_pub_t *dhdpub, int ifidx, bool need_rtnl_lock)
+{
+       dhd_info_t *dhdinfo = (dhd_info_t *)dhdpub->info;
+       dhd_if_t *ifp;
+
+       ifp = dhdinfo->iflist[ifidx];
+
+       if (ifp != NULL) {
+               if (ifp->net != NULL) {
+                       DHD_ERROR(("deleting interface '%s' idx %d\n", ifp->net->name, ifp->idx));
+
+                       /* in unregister_netdev case, the interface gets freed by net->destructor
+                        * (which is set to free_netdev)
+                        */
+                       if (ifp->net->reg_state == NETREG_UNINITIALIZED) {
+                               free_netdev(ifp->net);
+                       } else {
+                               netif_tx_disable(ifp->net);
+
+
+
+#if defined(SET_RPS_CPUS)
+                               custom_rps_map_clear(ifp->net->_rx);
+#endif /* SET_RPS_CPUS */
+#if defined(SET_RPS_CPUS)
+#if (defined(DHDTCPACK_SUPPRESS) && defined(BCMPCIE))
+                               dhd_tcpack_suppress_set(dhdpub, TCPACK_SUP_OFF);
+#endif /* DHDTCPACK_SUPPRESS && BCMPCIE */
+#endif 
+                               if (need_rtnl_lock)
+                                       unregister_netdev(ifp->net);
+                               else
+                                       unregister_netdevice(ifp->net);
+                       }
+                       ifp->net = NULL;
+                       dhdinfo->iflist[ifidx] = NULL;
+               }
+#ifdef DHD_WMF
+               dhd_wmf_cleanup(dhdpub, ifidx);
+#endif /* DHD_WMF */
+#ifdef DHD_L2_FILTER
+               bcm_l2_filter_arp_table_update(dhdpub->osh, ifp->phnd_arp_table, TRUE,
+                       NULL, FALSE, dhdpub->tickcnt);
+               deinit_l2_filter_arp_table(dhdpub->osh, ifp->phnd_arp_table);
+               ifp->phnd_arp_table = NULL;
+#endif /* DHD_L2_FILTER */
+
+               dhd_if_del_sta_list(ifp);
+
+               MFREE(dhdinfo->pub.osh, ifp, sizeof(*ifp));
+               ifp = NULL;
+       }
+
+       return BCME_OK;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 31))
+static struct net_device_ops dhd_ops_pri = {
+       .ndo_open = dhd_open,
+       .ndo_stop = dhd_stop,
+       .ndo_get_stats = dhd_get_stats,
+       .ndo_do_ioctl = dhd_ioctl_entry,
+       .ndo_start_xmit = dhd_start_xmit,
+       .ndo_set_mac_address = dhd_set_mac_address,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0))
+       .ndo_set_rx_mode = dhd_set_multicast_list,
+#else
+       .ndo_set_multicast_list = dhd_set_multicast_list,
+#endif
+};
+
+static struct net_device_ops dhd_ops_virt = {
+       .ndo_get_stats = dhd_get_stats,
+       .ndo_do_ioctl = dhd_ioctl_entry,
+       .ndo_start_xmit = dhd_start_xmit,
+       .ndo_set_mac_address = dhd_set_mac_address,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0))
+       .ndo_set_rx_mode = dhd_set_multicast_list,
+#else
+       .ndo_set_multicast_list = dhd_set_multicast_list,
+#endif
+};
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 31)) */
+
+#ifdef DEBUGGER
+extern void debugger_init(void *bus_handle);
+#endif
+
+
+#ifdef SHOW_LOGTRACE
+static char *logstrs_path = "/root/logstrs.bin";
+static char *st_str_file_path = "/root/rtecdc.bin";
+static char *map_file_path = "/root/rtecdc.map";
+static char *rom_st_str_file_path = "/root/roml.bin";
+static char *rom_map_file_path = "/root/roml.map";
+
+#define BYTES_AHEAD_NUM                11      /* address in map file is before these many bytes */
+#define READ_NUM_BYTES         1000 /* read map file each time this No. of bytes */
+#define GO_BACK_FILE_POS_NUM_BYTES     100 /* set file pos back to cur pos */
+static char *ramstart_str = "text_start"; /* string in mapfile has addr ramstart */
+static char *rodata_start_str = "rodata_start"; /* string in mapfile has addr rodata start */
+static char *rodata_end_str = "rodata_end"; /* string in mapfile has addr rodata end */
+static char *ram_file_str = "rtecdc";
+static char *rom_file_str = "roml";
+#define RAMSTART_BIT   0x01
+#define RDSTART_BIT            0x02
+#define RDEND_BIT              0x04
+#define ALL_MAP_VAL            (RAMSTART_BIT | RDSTART_BIT | RDEND_BIT)
+
+module_param(logstrs_path, charp, S_IRUGO);
+module_param(st_str_file_path, charp, S_IRUGO);
+module_param(map_file_path, charp, S_IRUGO);
+module_param(rom_st_str_file_path, charp, S_IRUGO);
+module_param(rom_map_file_path, charp, S_IRUGO);
+
+static void
+dhd_init_logstrs_array(dhd_event_log_t *temp)
+{
+       struct file *filep = NULL;
+       struct kstat stat;
+       mm_segment_t fs;
+       char *raw_fmts =  NULL;
+       int logstrs_size = 0;
+
+       logstr_header_t *hdr = NULL;
+       uint32 *lognums = NULL;
+       char *logstrs = NULL;
+       int ram_index = 0;
+       char **fmts;
+       int num_fmts = 0;
+       uint32 i = 0;
+       int error = 0;
+
+       fs = get_fs();
+       set_fs(KERNEL_DS);
+
+       filep = filp_open(logstrs_path, O_RDONLY, 0);
+
+       if (IS_ERR(filep)) {
+               DHD_ERROR(("%s: Failed to open the file %s \n", __FUNCTION__, logstrs_path));
+               goto fail;
+       }
+       error = vfs_stat(logstrs_path, &stat);
+       if (error) {
+               DHD_ERROR(("%s: Failed to stat file %s \n", __FUNCTION__, logstrs_path));
+               goto fail;
+       }
+       logstrs_size = (int) stat.size;
+
+       raw_fmts = kmalloc(logstrs_size, GFP_KERNEL);
+       if (raw_fmts == NULL) {
+               DHD_ERROR(("%s: Failed to allocate memory \n", __FUNCTION__));
+               goto fail;
+       }
+       if (vfs_read(filep, raw_fmts, logstrs_size, &filep->f_pos) !=   logstrs_size) {
+               DHD_ERROR(("%s: Failed to read file %s", __FUNCTION__, logstrs_path));
+               goto fail;
+       }
+
+       /* Remember header from the logstrs.bin file */
+       hdr = (logstr_header_t *) (raw_fmts + logstrs_size -
+               sizeof(logstr_header_t));
+
+       if (hdr->log_magic == LOGSTRS_MAGIC) {
+               /*
+               * logstrs.bin start with header.
+               */
+               num_fmts =      hdr->rom_logstrs_offset / sizeof(uint32);
+               ram_index = (hdr->ram_lognums_offset -
+                       hdr->rom_lognums_offset) / sizeof(uint32);
+               lognums = (uint32 *) &raw_fmts[hdr->rom_lognums_offset];
+               logstrs = (char *)       &raw_fmts[hdr->rom_logstrs_offset];
+       } else {
+               /*
+                * Legacy logstrs.bin format without header.
+                */
+               num_fmts = *((uint32 *) (raw_fmts)) / sizeof(uint32);
+               if (num_fmts == 0) {
+                       /* Legacy ROM/RAM logstrs.bin format:
+                         *  - ROM 'lognums' section
+                         *   - RAM 'lognums' section
+                         *   - ROM 'logstrs' section.
+                         *   - RAM 'logstrs' section.
+                         *
+                         * 'lognums' is an array of indexes for the strings in the
+                         * 'logstrs' section. The first uint32 is 0 (index of first
+                         * string in ROM 'logstrs' section).
+                         *
+                         * The 4324b5 is the only ROM that uses this legacy format. Use the
+                         * fixed number of ROM fmtnums to find the start of the RAM
+                         * 'lognums' section. Use the fixed first ROM string ("Con\n") to
+                         * find the ROM 'logstrs' section.
+                         */
+                       #define NUM_4324B5_ROM_FMTS     186
+                       #define FIRST_4324B5_ROM_LOGSTR "Con\n"
+                       ram_index = NUM_4324B5_ROM_FMTS;
+                       lognums = (uint32 *) raw_fmts;
+                       num_fmts =      ram_index;
+                       logstrs = (char *) &raw_fmts[num_fmts << 2];
+                       while (strncmp(FIRST_4324B5_ROM_LOGSTR, logstrs, 4)) {
+                               num_fmts++;
+                               logstrs = (char *) &raw_fmts[num_fmts << 2];
+                       }
+               } else {
+                               /* Legacy RAM-only logstrs.bin format:
+                                *        - RAM 'lognums' section
+                                *        - RAM 'logstrs' section.
+                                *
+                                * 'lognums' is an array of indexes for the strings in the
+                                * 'logstrs' section. The first uint32 is an index to the
+                                * start of 'logstrs'. Therefore, if this index is divided
+                                * by 'sizeof(uint32)' it provides the number of logstr
+                                *      entries.
+                                */
+                               ram_index = 0;
+                               lognums = (uint32 *) raw_fmts;
+                               logstrs = (char *)      &raw_fmts[num_fmts << 2];
+                       }
+       }
+       fmts = kmalloc(num_fmts  * sizeof(char *), GFP_KERNEL);
+       if (fmts == NULL) {
+               DHD_ERROR(("Failed to allocate fmts memory"));
+               goto fail;
+       }
+
+       for (i = 0; i < num_fmts; i++) {
+               /* ROM lognums index into logstrs using 'rom_logstrs_offset' as a base
+               * (they are 0-indexed relative to 'rom_logstrs_offset').
+               *
+               * RAM lognums are already indexed to point to the correct RAM logstrs (they
+               * are 0-indexed relative to the start of the logstrs.bin file).
+               */
+               if (i == ram_index) {
+                       logstrs = raw_fmts;
+               }
+               fmts[i] = &logstrs[lognums[i]];
+       }
+       temp->fmts = fmts;
+       temp->raw_fmts = raw_fmts;
+       temp->num_fmts = num_fmts;
+       filp_close(filep, NULL);
+       set_fs(fs);
+       return;
+fail:
+       if (raw_fmts) {
+               kfree(raw_fmts);
+               raw_fmts = NULL;
+       }
+       if (!IS_ERR(filep))
+               filp_close(filep, NULL);
+       set_fs(fs);
+       temp->fmts = NULL;
+       return;
+}
+
+static int
+dhd_read_map(char *fname, uint32 *ramstart, uint32 *rodata_start,
+       uint32 *rodata_end)
+{
+       struct file *filep = NULL;
+       mm_segment_t fs;
+       char *raw_fmts =  NULL;
+       uint32 read_size = READ_NUM_BYTES;
+       int error = 0;
+       char * cptr = NULL;
+       char c;
+       uint8 count = 0;
+
+       *ramstart = 0;
+       *rodata_start = 0;
+       *rodata_end = 0;
+
+       if (fname == NULL) {
+               DHD_ERROR(("%s: ERROR fname is NULL \n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       fs = get_fs();
+       set_fs(KERNEL_DS);
+
+       filep = filp_open(fname, O_RDONLY, 0);
+       if (IS_ERR(filep)) {
+               DHD_ERROR(("%s: Failed to open %s \n",  __FUNCTION__, fname));
+               goto fail;
+       }
+
+       /* Allocate 1 byte more than read_size to terminate it with NULL */
+       raw_fmts = kmalloc(read_size + 1, GFP_KERNEL);
+       if (raw_fmts == NULL) {
+               DHD_ERROR(("%s: Failed to allocate raw_fmts memory \n", __FUNCTION__));
+               goto fail;
+       }
+
+       /* read ram start, rodata_start and rodata_end values from map  file */
+
+       while (count != ALL_MAP_VAL)
+       {
+               error = vfs_read(filep, raw_fmts, read_size, (&filep->f_pos));
+               if (error < 0) {
+                       DHD_ERROR(("%s: read failed %s err:%d \n", __FUNCTION__,
+                               map_file_path, error));
+                       goto fail;
+               }
+
+               if (error < read_size) {
+                       /*
+                       * since we reset file pos back to earlier pos by
+                       * GO_BACK_FILE_POS_NUM_BYTES bytes we won't reach EOF.
+                       * So if ret value is less than read_size, reached EOF don't read further
+                       */
+                       break;
+               }
+               /* End raw_fmts with NULL as strstr expects NULL terminated strings */
+               raw_fmts[read_size] = '\0';
+
+               /* Get ramstart address */
+               if ((cptr = strstr(raw_fmts, ramstart_str))) {
+                       cptr = cptr - BYTES_AHEAD_NUM;
+                       sscanf(cptr, "%x %c text_start", ramstart, &c);
+                       count |= RAMSTART_BIT;
+               }
+
+               /* Get ram rodata start address */
+               if ((cptr = strstr(raw_fmts, rodata_start_str))) {
+                       cptr = cptr - BYTES_AHEAD_NUM;
+                       sscanf(cptr, "%x %c rodata_start", rodata_start, &c);
+                       count |= RDSTART_BIT;
+               }
+
+               /* Get ram rodata end address */
+               if ((cptr = strstr(raw_fmts, rodata_end_str))) {
+                       cptr = cptr - BYTES_AHEAD_NUM;
+                       sscanf(cptr, "%x %c rodata_end", rodata_end, &c);
+                       count |= RDEND_BIT;
+               }
+               memset(raw_fmts, 0, read_size);
+               /*
+               * go back to predefined NUM of bytes so that we won't miss
+               * the string and  addr even if it comes as splited in next read.
+               */
+               filep->f_pos = filep->f_pos - GO_BACK_FILE_POS_NUM_BYTES;
+       }
+
+       DHD_ERROR(("---ramstart: 0x%x, rodata_start: 0x%x, rodata_end:0x%x\n",
+               *ramstart, *rodata_start, *rodata_end));
+
+       DHD_ERROR(("readmap over \n"));
+
+fail:
+       if (raw_fmts) {
+               kfree(raw_fmts);
+               raw_fmts = NULL;
+       }
+       if (!IS_ERR(filep))
+               filp_close(filep, NULL);
+
+       set_fs(fs);
+       if (count == ALL_MAP_VAL) {
+               return BCME_OK;
+       }
+       DHD_ERROR(("readmap error 0X%x \n", count));
+       return BCME_ERROR;
+}
+
+static void
+dhd_init_static_strs_array(dhd_event_log_t *temp, char *str_file, char *map_file)
+{
+       struct file *filep = NULL;
+       mm_segment_t fs;
+       char *raw_fmts =  NULL;
+       uint32 logstrs_size = 0;
+
+       int error = 0;
+       uint32 ramstart = 0;
+       uint32 rodata_start = 0;
+       uint32 rodata_end = 0;
+       uint32 logfilebase = 0;
+
+       error = dhd_read_map(map_file, &ramstart, &rodata_start, &rodata_end);
+       if (error == BCME_ERROR) {
+               DHD_ERROR(("readmap Error!! \n"));
+               /* don't do event log parsing in actual case */
+               if (strstr(str_file, ram_file_str) != NULL) {
+                       temp->raw_sstr = NULL;
+               } else if (strstr(str_file, rom_file_str) != NULL) {
+                       temp->rom_raw_sstr = NULL;
+               }
+               return;
+       }
+       DHD_ERROR(("ramstart: 0x%x, rodata_start: 0x%x, rodata_end:0x%x\n",
+               ramstart, rodata_start, rodata_end));
+
+       fs = get_fs();
+       set_fs(KERNEL_DS);
+
+       filep = filp_open(str_file, O_RDONLY, 0);
+       if (IS_ERR(filep)) {
+               DHD_ERROR(("%s: Failed to open the file %s \n",  __FUNCTION__, str_file));
+               goto fail;
+       }
+
+       /* Full file size is huge. Just read required part */
+       logstrs_size = rodata_end - rodata_start;
+
+       raw_fmts = kmalloc(logstrs_size, GFP_KERNEL);
+       if (raw_fmts == NULL) {
+               DHD_ERROR(("%s: Failed to allocate raw_fmts memory \n", __FUNCTION__));
+               goto fail;
+       }
+
+       logfilebase = rodata_start - ramstart;
+
+       error = generic_file_llseek(filep, logfilebase, SEEK_SET);
+       if (error < 0) {
+               DHD_ERROR(("%s: %s llseek failed %d \n", __FUNCTION__, str_file, error));
+               goto fail;
+       }
+
+       error = vfs_read(filep, raw_fmts, logstrs_size, (&filep->f_pos));
+       if (error != logstrs_size) {
+               DHD_ERROR(("%s: %s read failed %d \n", __FUNCTION__, str_file, error));
+               goto fail;
+       }
+
+       if (strstr(str_file, ram_file_str) != NULL) {
+               temp->raw_sstr = raw_fmts;
+               temp->ramstart = ramstart;
+               temp->rodata_start = rodata_start;
+               temp->rodata_end = rodata_end;
+       } else if (strstr(str_file, rom_file_str) != NULL) {
+               temp->rom_raw_sstr = raw_fmts;
+               temp->rom_ramstart = ramstart;
+               temp->rom_rodata_start = rodata_start;
+               temp->rom_rodata_end = rodata_end;
+       }
+
+       filp_close(filep, NULL);
+       set_fs(fs);
+
+       return;
+fail:
+       if (raw_fmts) {
+               kfree(raw_fmts);
+               raw_fmts = NULL;
+       }
+       if (!IS_ERR(filep))
+               filp_close(filep, NULL);
+       set_fs(fs);
+       if (strstr(str_file, ram_file_str) != NULL) {
+               temp->raw_sstr = NULL;
+       } else if (strstr(str_file, rom_file_str) != NULL) {
+               temp->rom_raw_sstr = NULL;
+       }
+       return;
+}
+
+#endif /* SHOW_LOGTRACE */
+
+
+dhd_pub_t *
+dhd_attach(osl_t *osh, struct dhd_bus *bus, uint bus_hdrlen)
+{
+       dhd_info_t *dhd = NULL;
+       struct net_device *net = NULL;
+       char if_name[IFNAMSIZ] = {'\0'};
+       uint32 bus_type = -1;
+       uint32 bus_num = -1;
+       uint32 slot_num = -1;
+       wifi_adapter_info_t *adapter = NULL;
+
+       dhd_attach_states_t dhd_state = DHD_ATTACH_STATE_INIT;
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+#ifdef STBLINUX
+       DHD_ERROR(("%s\n", driver_target));
+#endif /* STBLINUX */
+       /* will implement get_ids for DBUS later */
+#if defined(BCMSDIO)
+       dhd_bus_get_ids(bus, &bus_type, &bus_num, &slot_num);
+#endif 
+       adapter = dhd_wifi_platform_get_adapter(bus_type, bus_num, slot_num);
+
+       /* Allocate primary dhd_info */
+       dhd = wifi_platform_prealloc(adapter, DHD_PREALLOC_DHD_INFO, sizeof(dhd_info_t));
+       if (dhd == NULL) {
+               dhd = MALLOC(osh, sizeof(dhd_info_t));
+               if (dhd == NULL) {
+                       DHD_ERROR(("%s: OOM - alloc dhd_info\n", __FUNCTION__));
+                       goto fail;
+               }
+       }
+       memset(dhd, 0, sizeof(dhd_info_t));
+       dhd_state |= DHD_ATTACH_STATE_DHD_ALLOC;
+
+       dhd->unit = dhd_found + instance_base; /* do not increment dhd_found, yet */
+
+       dhd->pub.osh = osh;
+       dhd->adapter = adapter;
+
+#ifdef OOB_PARAM
+       dhd->pub.oob_disable = adapter->oob_disable;
+#endif /* OOB_PARAM */
+
+#ifdef GET_CUSTOM_MAC_ENABLE
+       wifi_platform_get_mac_addr(dhd->adapter, dhd->pub.mac.octet);
+#endif /* GET_CUSTOM_MAC_ENABLE */
+#ifdef CUSTOM_FORCE_NODFS_FLAG
+       dhd->pub.dhd_cflags |= WLAN_PLAT_NODFS_FLAG;
+       dhd->pub.force_country_change = TRUE;
+#endif /* CUSTOM_FORCE_NODFS_FLAG */
+#ifdef CUSTOM_COUNTRY_CODE
+       get_customized_country_code(dhd->adapter,
+               dhd->pub.dhd_cspec.country_abbrev, &dhd->pub.dhd_cspec,
+               dhd->pub.dhd_cflags);
+#endif /* CUSTOM_COUNTRY_CODE */
+       dhd->thr_dpc_ctl.thr_pid = DHD_PID_KT_TL_INVALID;
+       dhd->thr_wdt_ctl.thr_pid = DHD_PID_KT_INVALID;
+
+       /* Initialize thread based operation and lock */
+       sema_init(&dhd->sdsem, 1);
+
+       /* Some DHD modules (e.g. cfg80211) configures operation mode based on firmware name.
+        * This is indeed a hack but we have to make it work properly before we have a better
+        * solution
+        */
+       dhd_update_fw_nv_path(dhd);
+
+       /* Link to info module */
+       dhd->pub.info = dhd;
+
+
+       /* Link to bus module */
+       dhd->pub.bus = bus;
+       dhd->pub.hdrlen = bus_hdrlen;
+
+       /* Set network interface name if it was provided as module parameter */
+       if (iface_name[0]) {
+               int len;
+               char ch;
+               strncpy(if_name, iface_name, IFNAMSIZ);
+               if_name[IFNAMSIZ - 1] = 0;
+               len = strlen(if_name);
+               ch = if_name[len - 1];
+               if ((ch > '9' || ch < '0') && (len < IFNAMSIZ - 2))
+                       strcat(if_name, "%d");
+       }
+
+       /* Passing NULL to dngl_name to ensure host gets if_name in dngl_name member */
+       net = dhd_allocate_if(&dhd->pub, 0, if_name, NULL, 0, TRUE, NULL);
+       if (net == NULL) {
+               goto fail;
+       }
+
+
+       dhd_state |= DHD_ATTACH_STATE_ADD_IF;
+#ifdef DHD_L2_FILTER
+       /* initialize the l2_filter_cnt */
+       dhd->pub.l2_filter_cnt = 0;
+#endif
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31))
+       net->open = NULL;
+#else
+       net->netdev_ops = NULL;
+#endif
+
+       mutex_init(&dhd->dhd_iovar_mutex);
+       sema_init(&dhd->proto_sem, 1);
+
+#ifdef PROP_TXSTATUS
+       spin_lock_init(&dhd->wlfc_spinlock);
+
+       dhd->pub.skip_fc = dhd_wlfc_skip_fc;
+       dhd->pub.plat_init = dhd_wlfc_plat_init;
+       dhd->pub.plat_deinit = dhd_wlfc_plat_deinit;
+
+#ifdef DHD_WLFC_THREAD
+       init_waitqueue_head(&dhd->pub.wlfc_wqhead);
+       dhd->pub.wlfc_thread = kthread_create(dhd_wlfc_transfer_packets, &dhd->pub, "wlfc-thread");
+       if (IS_ERR(dhd->pub.wlfc_thread)) {
+               DHD_ERROR(("create wlfc thread failed\n"));
+               goto fail;
+       } else {
+               wake_up_process(dhd->pub.wlfc_thread);
+       }
+#endif /* DHD_WLFC_THREAD */
+#endif /* PROP_TXSTATUS */
+
+       /* Initialize other structure content */
+       init_waitqueue_head(&dhd->ioctl_resp_wait);
+       init_waitqueue_head(&dhd->d3ack_wait);
+       init_waitqueue_head(&dhd->ctrl_wait);
+       init_waitqueue_head(&dhd->dhd_bus_busy_state_wait);
+       dhd->pub.dhd_bus_busy_state = 0;
+
+       /* Initialize the spinlocks */
+       spin_lock_init(&dhd->sdlock);
+       spin_lock_init(&dhd->txqlock);
+       spin_lock_init(&dhd->dhd_lock);
+       spin_lock_init(&dhd->rxf_lock);
+#if defined(RXFRAME_THREAD)
+       dhd->rxthread_enabled = TRUE;
+#endif /* defined(RXFRAME_THREAD) */
+
+#ifdef DHDTCPACK_SUPPRESS
+       spin_lock_init(&dhd->tcpack_lock);
+#endif /* DHDTCPACK_SUPPRESS */
+
+       /* Initialize Wakelock stuff */
+       spin_lock_init(&dhd->wakelock_spinlock);
+       spin_lock_init(&dhd->wakelock_evt_spinlock);
+       DHD_OS_WAKE_LOCK_INIT(dhd);
+       dhd->wakelock_wd_counter = 0;
+#ifdef CONFIG_HAS_WAKELOCK
+       wake_lock_init(&dhd->wl_wdwake, WAKE_LOCK_SUSPEND, "wlan_wd_wake");
+#endif /* CONFIG_HAS_WAKELOCK */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+       mutex_init(&dhd->dhd_net_if_mutex);
+       mutex_init(&dhd->dhd_suspend_mutex);
+#endif
+       dhd_state |= DHD_ATTACH_STATE_WAKELOCKS_INIT;
+
+       /* Attach and link in the protocol */
+       if (dhd_prot_attach(&dhd->pub) != 0) {
+               DHD_ERROR(("dhd_prot_attach failed\n"));
+               goto fail;
+       }
+       dhd_state |= DHD_ATTACH_STATE_PROT_ATTACH;
+
+#ifdef WL_CFG80211
+       /* Attach and link in the cfg80211 */
+       dhd->pub.cfg80211_priv = wl_cfg80211_attach(net, &dhd->pub);
+       if (dhd->pub.cfg80211_priv == NULL) {
+               DHD_ERROR(("wl_cfg80211_attach failed\n"));
+               goto fail;
+       }
+
+       dhd_monitor_init(&dhd->pub);
+       dhd_state |= DHD_ATTACH_STATE_CFG80211;
+#endif
+#ifdef DHD_LOG_DUMP
+       dhd_log_dump_init(&dhd->pub);
+#endif /* DHD_LOG_DUMP */
+#if defined(WL_WIRELESS_EXT)
+       /* Attach and link in the iw */
+       if (!(dhd_state &  DHD_ATTACH_STATE_CFG80211)) {
+               if (wl_iw_attach(net, (void *)&dhd->pub) != 0) {
+               DHD_ERROR(("wl_iw_attach failed\n"));
+               goto fail;
+       }
+       dhd_state |= DHD_ATTACH_STATE_WL_ATTACH;
+       }
+#endif /* defined(WL_WIRELESS_EXT) */
+
+#ifdef SHOW_LOGTRACE
+       dhd_init_logstrs_array(&dhd->event_data);
+       dhd_init_static_strs_array(&dhd->event_data, st_str_file_path, map_file_path);
+       dhd_init_static_strs_array(&dhd->event_data, rom_st_str_file_path, rom_map_file_path);
+#endif /* SHOW_LOGTRACE */
+
+       if (dhd_sta_pool_init(&dhd->pub, DHD_MAX_STA) != BCME_OK) {
+               DHD_ERROR(("%s: Initializing %u sta\n", __FUNCTION__, DHD_MAX_STA));
+               goto fail;
+       }
+
+
+
+       /* Set up the watchdog timer */
+       init_timer(&dhd->timer);
+       dhd->timer.data = (ulong)dhd;
+       dhd->timer.function = dhd_watchdog;
+       dhd->default_wd_interval = dhd_watchdog_ms;
+
+       if (dhd_watchdog_prio >= 0) {
+               /* Initialize watchdog thread */
+               PROC_START(dhd_watchdog_thread, dhd, &dhd->thr_wdt_ctl, 0, "dhd_watchdog_thread");
+               if (dhd->thr_wdt_ctl.thr_pid < 0) {
+                       goto fail;
+               }
+
+       } else {
+               dhd->thr_wdt_ctl.thr_pid = -1;
+       }
+
+#ifdef DHD_PCIE_RUNTIMEPM
+       /* Setup up the runtime PM Idlecount timer */
+       init_timer(&dhd->rpm_timer);
+       dhd->rpm_timer.data = (ulong)dhd;
+       dhd->rpm_timer.function = dhd_runtimepm;
+       dhd->rpm_timer_valid = FALSE;
+
+       dhd->thr_rpm_ctl.thr_pid = DHD_PID_KT_INVALID;
+       PROC_START(dhd_rpm_state_thread, dhd, &dhd->thr_rpm_ctl, 0, "dhd_rpm_state_thread");
+       if (dhd->thr_rpm_ctl.thr_pid < 0) {
+               goto fail;
+       }
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+#ifdef DEBUGGER
+       debugger_init((void *) bus);
+#endif
+
+       /* Set up the bottom half handler */
+       if (dhd_dpc_prio >= 0) {
+               /* Initialize DPC thread */
+               PROC_START(dhd_dpc_thread, dhd, &dhd->thr_dpc_ctl, 0, "dhd_dpc");
+               if (dhd->thr_dpc_ctl.thr_pid < 0) {
+                       goto fail;
+               }
+       } else {
+               /*  use tasklet for dpc */
+               tasklet_init(&dhd->tasklet, dhd_dpc, (ulong)dhd);
+               dhd->thr_dpc_ctl.thr_pid = -1;
+       }
+
+       if (dhd->rxthread_enabled) {
+               bzero(&dhd->pub.skbbuf[0], sizeof(void *) * MAXSKBPEND);
+               /* Initialize RXF thread */
+               PROC_START(dhd_rxf_thread, dhd, &dhd->thr_rxf_ctl, 0, "dhd_rxf");
+               if (dhd->thr_rxf_ctl.thr_pid < 0) {
+                       goto fail;
+               }
+       }
+
+       dhd_state |= DHD_ATTACH_STATE_THREADS_CREATED;
+
+#if defined(CONFIG_PM_SLEEP)
+       if (!dhd_pm_notifier_registered) {
+               dhd_pm_notifier_registered = TRUE;
+               dhd->pm_notifier.notifier_call = dhd_pm_callback;
+               dhd->pm_notifier.priority = 10;
+               register_pm_notifier(&dhd->pm_notifier);
+       }
+
+#endif /* CONFIG_PM_SLEEP */
+
+#if defined(CONFIG_HAS_EARLYSUSPEND) && defined(DHD_USE_EARLYSUSPEND)
+       dhd->early_suspend.level = EARLY_SUSPEND_LEVEL_BLANK_SCREEN + 20;
+       dhd->early_suspend.suspend = dhd_early_suspend;
+       dhd->early_suspend.resume = dhd_late_resume;
+       register_early_suspend(&dhd->early_suspend);
+       dhd_state |= DHD_ATTACH_STATE_EARLYSUSPEND_DONE;
+#endif /* CONFIG_HAS_EARLYSUSPEND && DHD_USE_EARLYSUSPEND */
+
+#ifdef ARP_OFFLOAD_SUPPORT
+       dhd->pend_ipaddr = 0;
+       if (!dhd_inetaddr_notifier_registered) {
+               dhd_inetaddr_notifier_registered = TRUE;
+               register_inetaddr_notifier(&dhd_inetaddr_notifier);
+       }
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+#if defined(CONFIG_IPV6) && defined(IPV6_NDO_SUPPORT)
+       if (!dhd_inet6addr_notifier_registered) {
+               dhd_inet6addr_notifier_registered = TRUE;
+               register_inet6addr_notifier(&dhd_inet6addr_notifier);
+       }
+#endif /* CONFIG_IPV6 && IPV6_NDO_SUPPORT */
+       dhd->dhd_deferred_wq = dhd_deferred_work_init((void *)dhd);
+#ifdef DEBUG_CPU_FREQ
+       dhd->new_freq = alloc_percpu(int);
+       dhd->freq_trans.notifier_call = dhd_cpufreq_notifier;
+       cpufreq_register_notifier(&dhd->freq_trans, CPUFREQ_TRANSITION_NOTIFIER);
+#endif
+#ifdef DHDTCPACK_SUPPRESS
+#ifdef BCMSDIO
+       dhd_tcpack_suppress_set(&dhd->pub, TCPACK_SUP_DELAYTX);
+#elif defined(BCMPCIE)
+       dhd_tcpack_suppress_set(&dhd->pub, TCPACK_SUP_HOLD);
+#else
+       dhd_tcpack_suppress_set(&dhd->pub, TCPACK_SUP_OFF);
+#endif /* BCMSDIO */
+#endif /* DHDTCPACK_SUPPRESS */
+
+#if defined(BCM_DNGL_EMBEDIMAGE) || defined(BCM_REQUEST_FW)
+#endif /* defined(BCM_DNGL_EMBEDIMAGE) || defined(BCM_REQUEST_FW) */
+
+       dhd_state |= DHD_ATTACH_STATE_DONE;
+       dhd->dhd_state = dhd_state;
+
+       dhd_found++;
+#ifdef DHD_DEBUG_PAGEALLOC
+       register_page_corrupt_cb(dhd_page_corrupt_cb, &dhd->pub);
+#endif /* DHD_DEBUG_PAGEALLOC */
+
+#if defined(DHD_LB)
+       DHD_ERROR(("DHD LOAD BALANCING Enabled\n"));
+
+       dhd_lb_set_default_cpus(dhd);
+
+       /* Initialize the CPU Masks */
+       if (dhd_cpumasks_init(dhd) ==  0) {
+
+               /* Now we have the current CPU maps, run through candidacy */
+               dhd_select_cpu_candidacy(dhd);
+
+               /*
+                * If we are able to initialize CPU masks, lets register to the
+                * CPU Hotplug framework to change the CPU for each job dynamically
+                * using candidacy algorithm.
+                */
+               dhd->cpu_notifier.notifier_call = dhd_cpu_callback;
+               register_cpu_notifier(&dhd->cpu_notifier); /* Register a callback */
+       } else {
+               /*
+                * We are unable to initialize CPU masks, so candidacy algorithm
+                * won't run, but still Load Balancing will be honoured based
+                * on the CPUs allocated for a given job statically during init
+                */
+               dhd->cpu_notifier.notifier_call = NULL;
+               DHD_ERROR(("%s(): dhd_cpumasks_init failed CPUs for JOB would be static\n",
+                       __FUNCTION__));
+       }
+
+
+       DHD_LB_STATS_INIT(&dhd->pub);
+
+       /* Initialize the Load Balancing Tasklets and Napi object */
+#if defined(DHD_LB_TXC)
+       tasklet_init(&dhd->tx_compl_tasklet,
+               dhd_lb_tx_compl_handler, (ulong)(&dhd->pub));
+       INIT_WORK(&dhd->tx_compl_dispatcher_work, dhd_tx_compl_dispatcher_fn);
+       DHD_INFO(("%s load balance init tx_compl_tasklet\n", __FUNCTION__));
+#endif /* DHD_LB_TXC */
+
+#if defined(DHD_LB_RXC)
+       tasklet_init(&dhd->rx_compl_tasklet,
+               dhd_lb_rx_compl_handler, (ulong)(&dhd->pub));
+       INIT_WORK(&dhd->rx_compl_dispatcher_work, dhd_rx_compl_dispatcher_fn);
+       DHD_INFO(("%s load balance init rx_compl_tasklet\n", __FUNCTION__));
+#endif /* DHD_LB_RXC */
+
+#if defined(DHD_LB_RXP)
+        __skb_queue_head_init(&dhd->rx_pend_queue);
+       skb_queue_head_init(&dhd->rx_napi_queue);
+
+       /* Initialize the work that dispatches NAPI job to a given core */
+       INIT_WORK(&dhd->rx_napi_dispatcher_work, dhd_rx_napi_dispatcher_fn);
+       DHD_INFO(("%s load balance init rx_napi_queue\n", __FUNCTION__));
+#endif /* DHD_LB_RXP */
+
+#endif /* DHD_LB */
+
+       INIT_DELAYED_WORK(&dhd->dhd_memdump_work, dhd_memdump_work_handler);
+
+       (void)dhd_sysfs_init(dhd);
+
+       return &dhd->pub;
+
+fail:
+       if (dhd_state >= DHD_ATTACH_STATE_DHD_ALLOC) {
+               DHD_TRACE(("%s: Calling dhd_detach dhd_state 0x%x &dhd->pub %p\n",
+                       __FUNCTION__, dhd_state, &dhd->pub));
+               dhd->dhd_state = dhd_state;
+               dhd_detach(&dhd->pub);
+               dhd_free(&dhd->pub);
+       }
+
+       return NULL;
+}
+
+#include <linux/delay.h>
+
+void dhd_memdump_work_schedule(dhd_pub_t *dhdp, unsigned long msecs)
+{
+       dhd_info_t *dhd = (dhd_info_t*)dhdp->info;
+
+       schedule_delayed_work(&dhd->dhd_memdump_work, msecs_to_jiffies(msecs));
+}
+
+int dhd_get_fw_mode(dhd_info_t *dhdinfo)
+{
+       if (strstr(dhdinfo->fw_path, "_apsta") != NULL)
+               return DHD_FLAG_HOSTAP_MODE;
+       if (strstr(dhdinfo->fw_path, "_p2p") != NULL)
+               return DHD_FLAG_P2P_MODE;
+       if (strstr(dhdinfo->fw_path, "_ibss") != NULL)
+               return DHD_FLAG_IBSS_MODE;
+       if (strstr(dhdinfo->fw_path, "_mfg") != NULL)
+               return DHD_FLAG_MFG_MODE;
+
+       return DHD_FLAG_STA_MODE;
+}
+
+bool dhd_update_fw_nv_path(dhd_info_t *dhdinfo)
+{
+       int fw_len;
+       int nv_len;
+       const char *fw = NULL;
+       const char *nv = NULL;
+       wifi_adapter_info_t *adapter = dhdinfo->adapter;
+
+
+       /* Update firmware and nvram path. The path may be from adapter info or module parameter
+        * The path from adapter info is used for initialization only (as it won't change).
+        *
+        * The firmware_path/nvram_path module parameter may be changed by the system at run
+        * time. When it changes we need to copy it to dhdinfo->fw_path. Also Android private
+        * command may change dhdinfo->fw_path. As such we need to clear the path info in
+        * module parameter after it is copied. We won't update the path until the module parameter
+        * is changed again (first character is not '\0')
+        */
+
+       /* set default firmware and nvram path for built-in type driver */
+       if (!dhd_download_fw_on_driverload) {
+#ifdef CONFIG_BCMDHD_FW_PATH
+               fw = CONFIG_BCMDHD_FW_PATH;
+#endif /* CONFIG_BCMDHD_FW_PATH */
+#ifdef CONFIG_BCMDHD_NVRAM_PATH
+               nv = CONFIG_BCMDHD_NVRAM_PATH;
+#endif /* CONFIG_BCMDHD_NVRAM_PATH */
+       }
+
+       /* check if we need to initialize the path */
+       if (dhdinfo->fw_path[0] == '\0') {
+               if (adapter && adapter->fw_path && adapter->fw_path[0] != '\0')
+                       fw = adapter->fw_path;
+
+       }
+       if (dhdinfo->nv_path[0] == '\0') {
+               if (adapter && adapter->nv_path && adapter->nv_path[0] != '\0')
+                       nv = adapter->nv_path;
+       }
+
+       /* Use module parameter if it is valid, EVEN IF the path has not been initialized
+        *
+        * TODO: need a solution for multi-chip, can't use the same firmware for all chips
+        */
+       if (firmware_path[0] != '\0')
+               fw = firmware_path;
+       if (nvram_path[0] != '\0')
+               nv = nvram_path;
+
+       if (fw && fw[0] != '\0') {
+               fw_len = strlen(fw);
+               if (fw_len >= sizeof(dhdinfo->fw_path)) {
+                       DHD_ERROR(("fw path len exceeds max len of dhdinfo->fw_path\n"));
+                       return FALSE;
+               }
+               strncpy(dhdinfo->fw_path, fw, sizeof(dhdinfo->fw_path));
+               if (dhdinfo->fw_path[fw_len-1] == '\n')
+                      dhdinfo->fw_path[fw_len-1] = '\0';
+       }
+       if (nv && nv[0] != '\0') {
+               nv_len = strlen(nv);
+               if (nv_len >= sizeof(dhdinfo->nv_path)) {
+                       DHD_ERROR(("nvram path len exceeds max len of dhdinfo->nv_path\n"));
+                       return FALSE;
+               }
+               strncpy(dhdinfo->nv_path, nv, sizeof(dhdinfo->nv_path));
+               if (dhdinfo->nv_path[nv_len-1] == '\n')
+                      dhdinfo->nv_path[nv_len-1] = '\0';
+       }
+
+       /* clear the path in module parameter */
+       if (dhd_download_fw_on_driverload) {
+               firmware_path[0] = '\0';
+               nvram_path[0] = '\0';
+       }
+#ifndef BCMEMBEDIMAGE
+       /* fw_path and nv_path are not mandatory for BCMEMBEDIMAGE */
+       if (dhdinfo->fw_path[0] == '\0') {
+               DHD_ERROR(("firmware path not found\n"));
+               return FALSE;
+       }
+       if (dhdinfo->nv_path[0] == '\0') {
+               DHD_ERROR(("nvram path not found\n"));
+               return FALSE;
+       }
+#endif /* BCMEMBEDIMAGE */
+
+       return TRUE;
+}
+
+#ifdef CUSTOMER_HW4_DEBUG
+bool dhd_validate_chipid(dhd_pub_t *dhdp)
+{
+       uint chipid = dhd_bus_chip_id(dhdp);
+       uint config_chipid;
+
+#ifdef BCM4359_CHIP
+       config_chipid = BCM4359_CHIP_ID;
+#elif defined(BCM4358_CHIP)
+       config_chipid = BCM4358_CHIP_ID;
+#elif defined(BCM4354_CHIP)
+       config_chipid = BCM4354_CHIP_ID;
+#elif defined(BCM4356_CHIP)
+       config_chipid = BCM4356_CHIP_ID;
+#elif defined(BCM4339_CHIP)
+       config_chipid = BCM4339_CHIP_ID;
+#elif defined(BCM43349_CHIP)
+       config_chipid = BCM43349_CHIP_ID;
+#elif defined(BCM4335_CHIP)
+       config_chipid = BCM4335_CHIP_ID;
+#elif defined(BCM43241_CHIP)
+       config_chipid = BCM4324_CHIP_ID;
+#elif defined(BCM4330_CHIP)
+       config_chipid = BCM4330_CHIP_ID;
+#elif defined(BCM43430_CHIP)
+       config_chipid = BCM43430_CHIP_ID;
+#elif defined(BCM4334W_CHIP)
+       config_chipid = BCM43342_CHIP_ID;
+#elif defined(BCM43455_CHIP)
+       config_chipid = BCM4345_CHIP_ID;
+#else
+       DHD_ERROR(("%s: Unknown chip id, if you use new chipset,"
+               " please add CONFIG_BCMXXXX into the Kernel and"
+               " BCMXXXX_CHIP definition into the DHD driver\n",
+               __FUNCTION__));
+       config_chipid = 0;
+
+       return FALSE;
+#endif /* BCM4354_CHIP */
+
+#if defined(BCM4359_CHIP)
+       if (chipid == BCM4355_CHIP_ID && config_chipid == BCM4359_CHIP_ID) {
+               return TRUE;
+       }
+#endif /* BCM4359_CHIP */
+
+       return config_chipid == chipid;
+}
+#endif /* CUSTOMER_HW4_DEBUG */
+
+int
+dhd_bus_start(dhd_pub_t *dhdp)
+{
+       int ret = -1;
+       dhd_info_t *dhd = (dhd_info_t*)dhdp->info;
+       unsigned long flags;
+
+       ASSERT(dhd);
+
+       DHD_TRACE(("Enter %s:\n", __FUNCTION__));
+
+       DHD_PERIM_LOCK(dhdp);
+
+       /* try to download image and nvram to the dongle */
+       if  (dhd->pub.busstate == DHD_BUS_DOWN && dhd_update_fw_nv_path(dhd)) {
+               /* Indicate FW Download has not yet done */
+               dhd->pub.is_fw_download_done = FALSE;
+               DHD_INFO(("%s download fw %s, nv %s\n", __FUNCTION__, dhd->fw_path, dhd->nv_path));
+               ret = dhd_bus_download_firmware(dhd->pub.bus, dhd->pub.osh,
+                                               dhd->fw_path, dhd->nv_path);
+               if (ret < 0) {
+                       DHD_ERROR(("%s: failed to download firmware %s\n",
+                                 __FUNCTION__, dhd->fw_path));
+                       DHD_PERIM_UNLOCK(dhdp);
+                       return ret;
+               }
+               /* Indicate FW Download has succeeded */
+               dhd->pub.is_fw_download_done = TRUE;
+       }
+       if (dhd->pub.busstate != DHD_BUS_LOAD) {
+               DHD_PERIM_UNLOCK(dhdp);
+               return -ENETDOWN;
+       }
+
+       dhd_os_sdlock(dhdp);
+
+       /* Start the watchdog timer */
+       dhd->pub.tickcnt = 0;
+       dhd_os_wd_timer(&dhd->pub, dhd_watchdog_ms);
+       DHD_ENABLE_RUNTIME_PM(&dhd->pub);
+
+       /* Bring up the bus */
+       if ((ret = dhd_bus_init(&dhd->pub, FALSE)) != 0) {
+
+               DHD_ERROR(("%s, dhd_bus_init failed %d\n", __FUNCTION__, ret));
+               dhd_os_sdunlock(dhdp);
+               DHD_PERIM_UNLOCK(dhdp);
+               return ret;
+       }
+#if defined(OOB_INTR_ONLY) || defined(BCMPCIE_OOB_HOST_WAKE)
+       OOB_PARAM_IF(!(dhd->pub.oob_disable)) {
+#if defined(BCMPCIE_OOB_HOST_WAKE)
+               dhd_os_sdunlock(dhdp);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+               /* Host registration for OOB interrupt */
+               if (dhd_bus_oob_intr_register(dhdp)) {
+                       /* deactivate timer and wait for the handler to finish */
+#if !defined(BCMPCIE_OOB_HOST_WAKE)
+                       DHD_GENERAL_LOCK(&dhd->pub, flags);
+                       dhd->wd_timer_valid = FALSE;
+                       DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+                       del_timer_sync(&dhd->timer);
+
+                       dhd_os_sdunlock(dhdp);
+#endif /* !BCMPCIE_OOB_HOST_WAKE */
+                       DHD_DISABLE_RUNTIME_PM(&dhd->pub);
+                       DHD_PERIM_UNLOCK(dhdp);
+                       DHD_OS_WD_WAKE_UNLOCK(&dhd->pub);
+                       DHD_ERROR(("%s Host failed to register for OOB\n", __FUNCTION__));
+                       return -ENODEV;
+               }
+
+#if defined(BCMPCIE_OOB_HOST_WAKE)
+               dhd_os_sdlock(dhdp);
+               dhd_bus_oob_intr_set(dhdp, TRUE);
+#else
+               /* Enable oob at firmware */
+               dhd_enable_oob_intr(dhd->pub.bus, TRUE);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+       }
+#endif 
+#ifdef PCIE_FULL_DONGLE
+       {
+               /* max_h2d_rings includes H2D common rings */
+               uint32 max_h2d_rings = dhd_bus_max_h2d_queues(dhd->pub.bus);
+
+               DHD_ERROR(("%s: Initializing %u h2drings\n", __FUNCTION__,
+                       max_h2d_rings));
+               if ((ret = dhd_flow_rings_init(&dhd->pub, max_h2d_rings)) != BCME_OK) {
+                       dhd_os_sdunlock(dhdp);
+                       DHD_PERIM_UNLOCK(dhdp);
+                       return ret;
+               }
+       }
+#endif /* PCIE_FULL_DONGLE */
+
+       /* Do protocol initialization necessary for IOCTL/IOVAR */
+#ifdef PCIE_FULL_DONGLE
+       dhd_os_sdunlock(dhdp);
+#endif /* PCIE_FULL_DONGLE */
+       ret = dhd_prot_init(&dhd->pub);
+       if (unlikely(ret) != BCME_OK) {
+               DHD_PERIM_UNLOCK(dhdp);
+               DHD_OS_WD_WAKE_UNLOCK(&dhd->pub);
+               return ret;
+       }
+#ifdef PCIE_FULL_DONGLE
+       dhd_os_sdlock(dhdp);
+#endif /* PCIE_FULL_DONGLE */
+
+       /* If bus is not ready, can't come up */
+       if (dhd->pub.busstate != DHD_BUS_DATA) {
+               DHD_GENERAL_LOCK(&dhd->pub, flags);
+               dhd->wd_timer_valid = FALSE;
+               DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+               del_timer_sync(&dhd->timer);
+               DHD_ERROR(("%s failed bus is not ready\n", __FUNCTION__));
+               DHD_DISABLE_RUNTIME_PM(&dhd->pub);
+               dhd_os_sdunlock(dhdp);
+               DHD_PERIM_UNLOCK(dhdp);
+               DHD_OS_WD_WAKE_UNLOCK(&dhd->pub);
+               return -ENODEV;
+       }
+
+       dhd_os_sdunlock(dhdp);
+
+       /* Bus is ready, query any dongle information */
+       if ((ret = dhd_sync_with_dongle(&dhd->pub)) < 0) {
+               DHD_GENERAL_LOCK(&dhd->pub, flags);
+               dhd->wd_timer_valid = FALSE;
+               DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+               del_timer_sync(&dhd->timer);
+               DHD_ERROR(("%s failed to sync with dongle\n", __FUNCTION__));
+               DHD_DISABLE_RUNTIME_PM(&dhd->pub);
+               DHD_OS_WD_WAKE_UNLOCK(&dhd->pub);
+               DHD_PERIM_UNLOCK(dhdp);
+               return ret;
+       }
+
+#ifdef ARP_OFFLOAD_SUPPORT
+       if (dhd->pend_ipaddr) {
+#ifdef AOE_IP_ALIAS_SUPPORT
+               aoe_update_host_ipv4_table(&dhd->pub, dhd->pend_ipaddr, TRUE, 0);
+#endif /* AOE_IP_ALIAS_SUPPORT */
+               dhd->pend_ipaddr = 0;
+       }
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+       DHD_PERIM_UNLOCK(dhdp);
+       return 0;
+}
+#ifdef WLTDLS
+int _dhd_tdls_enable(dhd_pub_t *dhd, bool tdls_on, bool auto_on, struct ether_addr *mac)
+{
+       char iovbuf[WLC_IOCTL_SMLEN];
+       uint32 tdls = tdls_on;
+       int ret = 0;
+       uint32 tdls_auto_op = 0;
+       uint32 tdls_idle_time = CUSTOM_TDLS_IDLE_MODE_SETTING;
+       int32 tdls_rssi_high = CUSTOM_TDLS_RSSI_THRESHOLD_HIGH;
+       int32 tdls_rssi_low = CUSTOM_TDLS_RSSI_THRESHOLD_LOW;
+       BCM_REFERENCE(mac);
+       if (!FW_SUPPORTED(dhd, tdls))
+               return BCME_ERROR;
+
+       if (dhd->tdls_enable == tdls_on)
+               goto auto_mode;
+       bcm_mkiovar("tdls_enable", (char *)&tdls, sizeof(tdls), iovbuf, sizeof(iovbuf));
+       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0) {
+               DHD_ERROR(("%s: tdls %d failed %d\n", __FUNCTION__, tdls, ret));
+               goto exit;
+       }
+       dhd->tdls_enable = tdls_on;
+auto_mode:
+
+       tdls_auto_op = auto_on;
+       bcm_mkiovar("tdls_auto_op", (char *)&tdls_auto_op, sizeof(tdls_auto_op),
+               iovbuf, sizeof(iovbuf));
+       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+               sizeof(iovbuf), TRUE, 0)) < 0) {
+               DHD_ERROR(("%s: tdls_auto_op failed %d\n", __FUNCTION__, ret));
+               goto exit;
+       }
+
+       if (tdls_auto_op) {
+               bcm_mkiovar("tdls_idle_time", (char *)&tdls_idle_time,
+                       sizeof(tdls_idle_time), iovbuf, sizeof(iovbuf));
+               if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+                       sizeof(iovbuf), TRUE, 0)) < 0) {
+                       DHD_ERROR(("%s: tdls_idle_time failed %d\n", __FUNCTION__, ret));
+                       goto exit;
+               }
+               bcm_mkiovar("tdls_rssi_high", (char *)&tdls_rssi_high, 4, iovbuf, sizeof(iovbuf));
+               if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+                       sizeof(iovbuf), TRUE, 0)) < 0) {
+                       DHD_ERROR(("%s: tdls_rssi_high failed %d\n", __FUNCTION__, ret));
+                       goto exit;
+               }
+               bcm_mkiovar("tdls_rssi_low", (char *)&tdls_rssi_low, 4, iovbuf, sizeof(iovbuf));
+               if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+                       sizeof(iovbuf), TRUE, 0)) < 0) {
+                       DHD_ERROR(("%s: tdls_rssi_low failed %d\n", __FUNCTION__, ret));
+                       goto exit;
+               }
+       }
+
+exit:
+       return ret;
+}
+int dhd_tdls_enable(struct net_device *dev, bool tdls_on, bool auto_on, struct ether_addr *mac)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       int ret = 0;
+       if (dhd)
+               ret = _dhd_tdls_enable(&dhd->pub, tdls_on, auto_on, mac);
+       else
+               ret = BCME_ERROR;
+       return ret;
+}
+int
+dhd_tdls_set_mode(dhd_pub_t *dhd, bool wfd_mode)
+{
+       char iovbuf[WLC_IOCTL_SMLEN];
+       int ret = 0;
+       bool auto_on = false;
+       uint32 mode =  wfd_mode;
+
+#ifdef ENABLE_TDLS_AUTO_MODE
+       if (wfd_mode) {
+               auto_on = false;
+       } else {
+               auto_on = true;
+       }
+#else
+       auto_on = false;
+#endif /* ENABLE_TDLS_AUTO_MODE */
+       ret = _dhd_tdls_enable(dhd, false, auto_on, NULL);
+       if (ret < 0) {
+               DHD_ERROR(("Disable tdls_auto_op failed. %d\n", ret));
+               return ret;
+       }
+
+
+       bcm_mkiovar("tdls_wfd_mode", (char *)&mode, sizeof(mode),
+                       iovbuf, sizeof(iovbuf));
+       if (((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+                       sizeof(iovbuf), TRUE, 0)) < 0) &&
+                       (ret != BCME_UNSUPPORTED)) {
+               DHD_ERROR(("%s: tdls_wfd_mode faile_wfd_mode %d\n", __FUNCTION__, ret));
+               return ret;
+       }
+
+       ret = _dhd_tdls_enable(dhd, true, auto_on, NULL);
+       if (ret < 0) {
+               DHD_ERROR(("enable tdls_auto_op failed. %d\n", ret));
+               return ret;
+       }
+
+       dhd->tdls_mode = mode;
+       return ret;
+}
+#ifdef PCIE_FULL_DONGLE
+void dhd_tdls_update_peer_info(struct net_device *dev, bool connect, uint8 *da)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       dhd_pub_t *dhdp =  (dhd_pub_t *)&dhd->pub;
+       tdls_peer_node_t *cur = dhdp->peer_tbl.node;
+       tdls_peer_node_t *new = NULL, *prev = NULL;
+       dhd_if_t *dhdif;
+       uint8 sa[ETHER_ADDR_LEN];
+       int ifidx = dhd_net2idx(dhd, dev);
+
+       if (ifidx == DHD_BAD_IF)
+               return;
+
+       dhdif = dhd->iflist[ifidx];
+       memcpy(sa, dhdif->mac_addr, ETHER_ADDR_LEN);
+
+       if (connect) {
+               while (cur != NULL) {
+                       if (!memcmp(da, cur->addr, ETHER_ADDR_LEN)) {
+                               DHD_ERROR(("%s: TDLS Peer exist already %d\n",
+                                       __FUNCTION__, __LINE__));
+                               return;
+                       }
+                       cur = cur->next;
+               }
+
+               new = MALLOC(dhdp->osh, sizeof(tdls_peer_node_t));
+               if (new == NULL) {
+                       DHD_ERROR(("%s: Failed to allocate memory\n", __FUNCTION__));
+                       return;
+               }
+               memcpy(new->addr, da, ETHER_ADDR_LEN);
+               new->next = dhdp->peer_tbl.node;
+               dhdp->peer_tbl.node = new;
+               dhdp->peer_tbl.tdls_peer_count++;
+
+       } else {
+               while (cur != NULL) {
+                       if (!memcmp(da, cur->addr, ETHER_ADDR_LEN)) {
+                               dhd_flow_rings_delete_for_peer(dhdp, ifidx, da);
+                               if (prev)
+                                       prev->next = cur->next;
+                               else
+                                       dhdp->peer_tbl.node = cur->next;
+                               MFREE(dhdp->osh, cur, sizeof(tdls_peer_node_t));
+                               dhdp->peer_tbl.tdls_peer_count--;
+                               return;
+                       }
+                       prev = cur;
+                       cur = cur->next;
+               }
+               DHD_ERROR(("%s: TDLS Peer Entry Not found\n", __FUNCTION__));
+       }
+}
+#endif /* PCIE_FULL_DONGLE */
+#endif 
+
+bool dhd_is_concurrent_mode(dhd_pub_t *dhd)
+{
+       if (!dhd)
+               return FALSE;
+
+       if (dhd->op_mode & DHD_FLAG_CONCURR_MULTI_CHAN_MODE)
+               return TRUE;
+       else if ((dhd->op_mode & DHD_FLAG_CONCURR_SINGLE_CHAN_MODE) ==
+               DHD_FLAG_CONCURR_SINGLE_CHAN_MODE)
+               return TRUE;
+       else
+               return FALSE;
+}
+#if !defined(AP) && defined(WLP2P)
+/* From Android JerryBean release, the concurrent mode is enabled by default and the firmware
+ * name would be fw_bcmdhd.bin. So we need to determine whether P2P is enabled in the STA
+ * firmware and accordingly enable concurrent mode (Apply P2P settings). SoftAP firmware
+ * would still be named as fw_bcmdhd_apsta.
+ */
+uint32
+dhd_get_concurrent_capabilites(dhd_pub_t *dhd)
+{
+       int32 ret = 0;
+       char buf[WLC_IOCTL_SMLEN];
+       bool mchan_supported = FALSE;
+       /* if dhd->op_mode is already set for HOSTAP and Manufacturing
+        * test mode, that means we only will use the mode as it is
+        */
+       if (dhd->op_mode & (DHD_FLAG_HOSTAP_MODE | DHD_FLAG_MFG_MODE))
+               return 0;
+       if (FW_SUPPORTED(dhd, vsdb)) {
+               mchan_supported = TRUE;
+       }
+       if (!FW_SUPPORTED(dhd, p2p)) {
+               DHD_TRACE(("Chip does not support p2p\n"));
+               return 0;
+       } else {
+               /* Chip supports p2p but ensure that p2p is really implemented in firmware or not */
+               memset(buf, 0, sizeof(buf));
+               bcm_mkiovar("p2p", 0, 0, buf, sizeof(buf));
+               if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, buf, sizeof(buf),
+                       FALSE, 0)) < 0) {
+                       DHD_ERROR(("%s: Get P2P failed (error=%d)\n", __FUNCTION__, ret));
+                       return 0;
+               } else {
+                       if (buf[0] == 1) {
+                               /* By default, chip supports single chan concurrency,
+                               * now lets check for mchan
+                               */
+                               ret = DHD_FLAG_CONCURR_SINGLE_CHAN_MODE;
+                               if (mchan_supported)
+                                       ret |= DHD_FLAG_CONCURR_MULTI_CHAN_MODE;
+                               if (FW_SUPPORTED(dhd, rsdb)) {
+                                       ret |= DHD_FLAG_RSDB_MODE;
+                                       ret |= DHD_FLAG_MP2P_MODE;
+                                       /* @TODO Need to refine the usage of this flag
+                                       *  based on firmware limitation of MP2P
+                                       */
+                               }
+                               if (FW_SUPPORTED(dhd, mp2p)) {
+                                       ret |= DHD_FLAG_MP2P_MODE;
+                               }
+#if defined(WL_ENABLE_P2P_IF) || defined(WL_CFG80211_P2P_DEV_IF)
+                               return ret;
+#else
+                               return 0;
+#endif /* WL_ENABLE_P2P_IF || WL_CFG80211_P2P_DEV_IF */
+                       }
+               }
+       }
+       return 0;
+}
+#endif 
+
+#ifdef SUPPORT_AP_POWERSAVE
+#define RXCHAIN_PWRSAVE_PPS                    10
+#define RXCHAIN_PWRSAVE_QUIET_TIME             10
+#define RXCHAIN_PWRSAVE_STAS_ASSOC_CHECK       0
+int dhd_set_ap_powersave(dhd_pub_t *dhdp, int ifidx, int enable)
+{
+       char iovbuf[128];
+       int32 pps = RXCHAIN_PWRSAVE_PPS;
+       int32 quiet_time = RXCHAIN_PWRSAVE_QUIET_TIME;
+       int32 stas_assoc_check = RXCHAIN_PWRSAVE_STAS_ASSOC_CHECK;
+
+       if (enable) {
+               bcm_mkiovar("rxchain_pwrsave_enable", (char *)&enable, 4, iovbuf, sizeof(iovbuf));
+               if (dhd_wl_ioctl_cmd(dhdp, WLC_SET_VAR,
+                   iovbuf, sizeof(iovbuf), TRUE, 0) != BCME_OK) {
+                       DHD_ERROR(("Failed to enable AP power save"));
+               }
+               bcm_mkiovar("rxchain_pwrsave_pps", (char *)&pps, 4, iovbuf, sizeof(iovbuf));
+               if (dhd_wl_ioctl_cmd(dhdp, WLC_SET_VAR,
+                   iovbuf, sizeof(iovbuf), TRUE, 0) != BCME_OK) {
+                       DHD_ERROR(("Failed to set pps"));
+               }
+               bcm_mkiovar("rxchain_pwrsave_quiet_time", (char *)&quiet_time,
+               4, iovbuf, sizeof(iovbuf));
+               if (dhd_wl_ioctl_cmd(dhdp, WLC_SET_VAR,
+                   iovbuf, sizeof(iovbuf), TRUE, 0) != BCME_OK) {
+                       DHD_ERROR(("Failed to set quiet time"));
+               }
+               bcm_mkiovar("rxchain_pwrsave_stas_assoc_check", (char *)&stas_assoc_check,
+               4, iovbuf, sizeof(iovbuf));
+               if (dhd_wl_ioctl_cmd(dhdp, WLC_SET_VAR,
+                   iovbuf, sizeof(iovbuf), TRUE, 0) != BCME_OK) {
+                       DHD_ERROR(("Failed to set stas assoc check"));
+               }
+       } else {
+               bcm_mkiovar("rxchain_pwrsave_enable", (char *)&enable, 4, iovbuf, sizeof(iovbuf));
+               if (dhd_wl_ioctl_cmd(dhdp, WLC_SET_VAR,
+                   iovbuf, sizeof(iovbuf), TRUE, 0) != BCME_OK) {
+                       DHD_ERROR(("Failed to disable AP power save"));
+               }
+       }
+
+       return 0;
+}
+#endif /* SUPPORT_AP_POWERSAVE */
+
+
+int
+dhd_preinit_ioctls(dhd_pub_t *dhd)
+{
+       int ret = 0;
+       char eventmask[WL_EVENTING_MASK_LEN];
+       char iovbuf[WL_EVENTING_MASK_LEN + 12]; /*  Room for "event_msgs" + '\0' + bitvec  */
+       uint32 buf_key_b4_m4 = 1;
+       uint8 msglen;
+       eventmsgs_ext_t *eventmask_msg = NULL;
+       char* iov_buf = NULL;
+       int ret2 = 0;
+#if defined(CUSTOM_AMPDU_BA_WSIZE)
+       uint32 ampdu_ba_wsize = 0;
+#endif 
+#if defined(CUSTOM_AMPDU_MPDU)
+       int32 ampdu_mpdu = 0;
+#endif
+#if defined(CUSTOM_AMPDU_RELEASE)
+       int32 ampdu_release = 0;
+#endif
+#if defined(CUSTOM_AMSDU_AGGSF)
+       int32 amsdu_aggsf = 0;
+#endif
+       shub_control_t shub_ctl;
+#if defined(BCMSDIO)
+#ifdef PROP_TXSTATUS
+       int wlfc_enable = TRUE;
+#ifndef DISABLE_11N
+       uint32 hostreorder = 1;
+#endif /* DISABLE_11N */
+#endif /* PROP_TXSTATUS */
+#endif 
+#ifdef PCIE_FULL_DONGLE
+       uint32 wl_ap_isolate;
+#endif /* PCIE_FULL_DONGLE */
+
+#if defined(BCMSDIO)
+       /* by default frame burst is enabled for PCIe and disabled for SDIO dongles */
+       uint32 frameburst = 0;
+#else
+       uint32 frameburst = 1;
+#endif /* BCMSDIO */
+
+#ifdef DHD_ENABLE_LPC
+       uint32 lpc = 1;
+#endif /* DHD_ENABLE_LPC */
+       uint power_mode = PM_FAST;
+#if defined(BCMSDIO)
+       uint32 dongle_align = DHD_SDALIGN;
+       uint32 glom = CUSTOM_GLOM_SETTING;
+#endif /* defined(BCMSDIO) */
+#if defined(CUSTOMER_HW2) && defined(USE_WL_CREDALL)
+       uint32 credall = 1;
+#endif
+#if defined(VSDB) || defined(ROAM_ENABLE)
+       uint bcn_timeout = CUSTOM_BCN_TIMEOUT;
+#else
+       uint bcn_timeout = 4;
+#endif /* VSDB || ROAM_ENABLE */
+#ifdef ENABLE_BCN_LI_BCN_WAKEUP
+       uint32 bcn_li_bcn = 1;
+#endif /* ENABLE_BCN_LI_BCN_WAKEUP */
+       uint retry_max = CUSTOM_ASSOC_RETRY_MAX;
+#if defined(ARP_OFFLOAD_SUPPORT)
+       int arpoe = 1;
+#endif
+       int scan_assoc_time = DHD_SCAN_ASSOC_ACTIVE_TIME;
+       int scan_unassoc_time = DHD_SCAN_UNASSOC_ACTIVE_TIME;
+       int scan_passive_time = DHD_SCAN_PASSIVE_TIME;
+       char buf[WLC_IOCTL_SMLEN];
+       char *ptr;
+       uint32 listen_interval = CUSTOM_LISTEN_INTERVAL; /* Default Listen Interval in Beacons */
+#ifdef ROAM_ENABLE
+       uint roamvar = 0;
+       int roam_trigger[2] = {CUSTOM_ROAM_TRIGGER_SETTING, WLC_BAND_ALL};
+       int roam_scan_period[2] = {10, WLC_BAND_ALL};
+       int roam_delta[2] = {CUSTOM_ROAM_DELTA_SETTING, WLC_BAND_ALL};
+#ifdef FULL_ROAMING_SCAN_PERIOD_60_SEC
+       int roam_fullscan_period = 60;
+#else /* FULL_ROAMING_SCAN_PERIOD_60_SEC */
+       int roam_fullscan_period = 120;
+#endif /* FULL_ROAMING_SCAN_PERIOD_60_SEC */
+#else
+#ifdef DISABLE_BUILTIN_ROAM
+       uint roamvar = 1;
+#endif /* DISABLE_BUILTIN_ROAM */
+#endif /* ROAM_ENABLE */
+
+#if defined(SOFTAP)
+       uint dtim = 1;
+#endif
+#if (defined(AP) && !defined(WLP2P)) || (!defined(AP) && defined(WL_CFG80211))
+       uint32 mpc = 0; /* Turn MPC off for AP/APSTA mode */
+       struct ether_addr p2p_ea;
+#endif
+#ifdef SOFTAP_UAPSD_OFF
+       uint32 wme_apsd = 0;
+#endif /* SOFTAP_UAPSD_OFF */
+#if (defined(AP) || defined(WLP2P)) && !defined(SOFTAP_AND_GC)
+       uint32 apsta = 1; /* Enable APSTA mode */
+#elif defined(SOFTAP_AND_GC)
+       uint32 apsta = 0;
+       int ap_mode = 1;
+#endif /* (defined(AP) || defined(WLP2P)) && !defined(SOFTAP_AND_GC) */
+#ifdef GET_CUSTOM_MAC_ENABLE
+       struct ether_addr ea_addr;
+#endif /* GET_CUSTOM_MAC_ENABLE */
+
+#ifdef DISABLE_11N
+       uint32 nmode = 0;
+#endif /* DISABLE_11N */
+
+#ifdef USE_WL_TXBF
+       uint32 txbf = 1;
+#endif /* USE_WL_TXBF */
+#if defined(PROP_TXSTATUS)
+#ifdef USE_WFA_CERT_CONF
+       uint32 proptx = 0;
+#endif /* USE_WFA_CERT_CONF */
+#endif /* PROP_TXSTATUS */
+#ifdef CUSTOM_PSPRETEND_THR
+       uint32 pspretend_thr = CUSTOM_PSPRETEND_THR;
+#endif
+       uint32 rsdb_mode = 0;
+
+#ifdef ENABLE_TEMP_THROTTLING
+       wl_temp_control_t temp_control;
+#endif /* ENABLE_TEMP_THROTTLING */
+#ifdef DISABLE_PRUNED_SCAN
+       uint32 scan_features = 0;
+#endif /* DISABLE_PRUNED_SCAN */
+#ifdef CUSTOM_EVENT_PM_WAKE
+       uint32 pm_awake_thresh = CUSTOM_EVENT_PM_WAKE;
+#endif /* CUSTOM_EVENT_PM_WAKE */
+#ifdef PKT_FILTER_SUPPORT
+       dhd_pkt_filter_enable = TRUE;
+#endif /* PKT_FILTER_SUPPORT */
+#ifdef WLTDLS
+       dhd->tdls_enable = FALSE;
+       dhd_tdls_set_mode(dhd, false);
+#endif /* WLTDLS */
+       dhd->suspend_bcn_li_dtim = CUSTOM_SUSPEND_BCN_LI_DTIM;
+#ifdef ENABLE_MAX_DTIM_IN_SUSPEND
+       dhd->max_dtim_enable = TRUE;
+#else
+       dhd->max_dtim_enable = FALSE;
+#endif /* ENABLE_MAX_DTIM_IN_SUSPEND */
+       DHD_TRACE(("Enter %s\n", __FUNCTION__));
+       dhd->op_mode = 0;
+#ifdef CUSTOMER_HW4_DEBUG
+       if (!dhd_validate_chipid(dhd)) {
+               DHD_ERROR(("%s: CONFIG_BCMXXX and CHIP ID(%x) is mismatched\n",
+                       __FUNCTION__, dhd_bus_chip_id(dhd)));
+#ifndef SUPPORT_MULTIPLE_CHIPS
+               ret = BCME_BADARG;
+               goto done;
+#endif /* !SUPPORT_MULTIPLE_CHIPS */
+       }
+#endif /* CUSTOMER_HW4_DEBUG */
+       if ((!op_mode && dhd_get_fw_mode(dhd->info) == DHD_FLAG_MFG_MODE) ||
+               (op_mode == DHD_FLAG_MFG_MODE)) {
+#ifdef DHD_PCIE_RUNTIMEPM
+               /* Disable RuntimePM in mfg mode */
+               DHD_DISABLE_RUNTIME_PM(dhd);
+               DHD_ERROR(("%s : Disable RuntimePM in Manufactring Firmware\n", __FUNCTION__));
+#endif /* DHD_PCIE_RUNTIME_PM */
+               /* Check and adjust IOCTL response timeout for Manufactring firmware */
+               dhd_os_set_ioctl_resp_timeout(MFG_IOCTL_RESP_TIMEOUT);
+               DHD_ERROR(("%s : Set IOCTL response time for Manufactring Firmware\n",
+                       __FUNCTION__));
+       } else {
+               dhd_os_set_ioctl_resp_timeout(IOCTL_RESP_TIMEOUT);
+               DHD_INFO(("%s : Set IOCTL response time.\n", __FUNCTION__));
+       }
+#ifdef GET_CUSTOM_MAC_ENABLE
+       ret = wifi_platform_get_mac_addr(dhd->info->adapter, ea_addr.octet);
+       if (!ret) {
+               memset(buf, 0, sizeof(buf));
+               bcm_mkiovar("cur_etheraddr", (void *)&ea_addr, ETHER_ADDR_LEN, buf, sizeof(buf));
+               ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, buf, sizeof(buf), TRUE, 0);
+               if (ret < 0) {
+                       DHD_ERROR(("%s: can't set MAC address , error=%d\n", __FUNCTION__, ret));
+                       ret = BCME_NOTUP;
+                       goto done;
+               }
+               memcpy(dhd->mac.octet, ea_addr.octet, ETHER_ADDR_LEN);
+       } else {
+#endif /* GET_CUSTOM_MAC_ENABLE */
+               /* Get the default device MAC address directly from firmware */
+               memset(buf, 0, sizeof(buf));
+               bcm_mkiovar("cur_etheraddr", 0, 0, buf, sizeof(buf));
+               if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, buf, sizeof(buf),
+                       FALSE, 0)) < 0) {
+                       DHD_ERROR(("%s: can't get MAC address , error=%d\n", __FUNCTION__, ret));
+                       ret = BCME_NOTUP;
+                       goto done;
+               }
+               /* Update public MAC address after reading from Firmware */
+               memcpy(dhd->mac.octet, buf, ETHER_ADDR_LEN);
+
+#ifdef GET_CUSTOM_MAC_ENABLE
+       }
+#endif /* GET_CUSTOM_MAC_ENABLE */
+
+#ifdef DHD_USE_CLMINFO_PARSER
+       if ((ret = dhd_get_clminfo(dhd, clm_path)) < 0) {
+               DHD_ERROR(("%s: CLM Information load failed. Abort initialization.\n",
+                       __FUNCTION__));
+               goto done;
+       }
+#endif /* DHD_USE_CLMINFO_PARSER */
+       if ((ret = dhd_apply_default_clm(dhd, clm_path)) < 0) {
+               DHD_ERROR(("%s: CLM set failed. Abort initialization.\n", __FUNCTION__));
+               goto done;
+       }
+
+       /* get a capabilities from firmware */
+       {
+               uint32 cap_buf_size = sizeof(dhd->fw_capabilities);
+               memset(dhd->fw_capabilities, 0, cap_buf_size);
+               bcm_mkiovar("cap", 0, 0, dhd->fw_capabilities, cap_buf_size - 1);
+               if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, dhd->fw_capabilities,
+                       (cap_buf_size - 1), FALSE, 0)) < 0)
+               {
+                       DHD_ERROR(("%s: Get Capability failed (error=%d)\n",
+                               __FUNCTION__, ret));
+                       return 0;
+               }
+
+               memmove(&dhd->fw_capabilities[1], dhd->fw_capabilities, (cap_buf_size - 1));
+               dhd->fw_capabilities[0] = ' ';
+               dhd->fw_capabilities[cap_buf_size - 2] = ' ';
+               dhd->fw_capabilities[cap_buf_size - 1] = '\0';
+       }
+
+       if ((!op_mode && dhd_get_fw_mode(dhd->info) == DHD_FLAG_HOSTAP_MODE) ||
+               (op_mode == DHD_FLAG_HOSTAP_MODE)) {
+#ifdef SET_RANDOM_MAC_SOFTAP
+               uint rand_mac;
+#endif /* SET_RANDOM_MAC_SOFTAP */
+               dhd->op_mode = DHD_FLAG_HOSTAP_MODE;
+#if defined(ARP_OFFLOAD_SUPPORT)
+                       arpoe = 0;
+#endif
+#ifdef PKT_FILTER_SUPPORT
+                       dhd_pkt_filter_enable = FALSE;
+#endif
+#ifdef SET_RANDOM_MAC_SOFTAP
+               SRANDOM32((uint)jiffies);
+               rand_mac = RANDOM32();
+               iovbuf[0] = (unsigned char)(vendor_oui >> 16) | 0x02;   /* local admin bit */
+               iovbuf[1] = (unsigned char)(vendor_oui >> 8);
+               iovbuf[2] = (unsigned char)vendor_oui;
+               iovbuf[3] = (unsigned char)(rand_mac & 0x0F) | 0xF0;
+               iovbuf[4] = (unsigned char)(rand_mac >> 8);
+               iovbuf[5] = (unsigned char)(rand_mac >> 16);
+
+               bcm_mkiovar("cur_etheraddr", (void *)iovbuf, ETHER_ADDR_LEN, buf, sizeof(buf));
+               ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, buf, sizeof(buf), TRUE, 0);
+               if (ret < 0) {
+                       DHD_ERROR(("%s: can't set MAC address , error=%d\n", __FUNCTION__, ret));
+               } else
+                       memcpy(dhd->mac.octet, iovbuf, ETHER_ADDR_LEN);
+#endif /* SET_RANDOM_MAC_SOFTAP */
+#if !defined(AP) && defined(WL_CFG80211)
+               /* Turn off MPC in AP mode */
+               bcm_mkiovar("mpc", (char *)&mpc, 4, iovbuf, sizeof(iovbuf));
+               if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+                       sizeof(iovbuf), TRUE, 0)) < 0) {
+                       DHD_ERROR(("%s mpc for HostAPD failed  %d\n", __FUNCTION__, ret));
+               }
+#endif
+#ifdef USE_DYNAMIC_F2_BLKSIZE
+               dhdsdio_func_blocksize(dhd, 2, DYNAMIC_F2_BLKSIZE_FOR_NONLEGACY);
+#endif /* USE_DYNAMIC_F2_BLKSIZE */
+#ifdef SUPPORT_AP_POWERSAVE
+               dhd_set_ap_powersave(dhd, 0, TRUE);
+#endif /* SUPPORT_AP_POWERSAVE */
+#ifdef SOFTAP_UAPSD_OFF
+               bcm_mkiovar("wme_apsd", (char *)&wme_apsd, 4, iovbuf, sizeof(iovbuf));
+               if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+                       sizeof(iovbuf), TRUE, 0)) < 0) {
+                       DHD_ERROR(("%s: set wme_apsd 0 fail (error=%d)\n",
+                               __FUNCTION__, ret));
+               }
+#endif /* SOFTAP_UAPSD_OFF */
+       } else if ((!op_mode && dhd_get_fw_mode(dhd->info) == DHD_FLAG_MFG_MODE) ||
+               (op_mode == DHD_FLAG_MFG_MODE)) {
+#if defined(ARP_OFFLOAD_SUPPORT)
+               arpoe = 0;
+#endif /* ARP_OFFLOAD_SUPPORT */
+#ifdef PKT_FILTER_SUPPORT
+               dhd_pkt_filter_enable = FALSE;
+#endif /* PKT_FILTER_SUPPORT */
+               dhd->op_mode = DHD_FLAG_MFG_MODE;
+#ifdef USE_DYNAMIC_F2_BLKSIZE
+               dhdsdio_func_blocksize(dhd, 2, DYNAMIC_F2_BLKSIZE_FOR_NONLEGACY);
+#endif /* USE_DYNAMIC_F2_BLKSIZE */
+               if (FW_SUPPORTED(dhd, rsdb)) {
+                       rsdb_mode = 0;
+                       bcm_mkiovar("rsdb_mode", (char *)&rsdb_mode, 4, iovbuf, sizeof(iovbuf));
+                       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR,
+                               iovbuf, sizeof(iovbuf), TRUE, 0)) < 0) {
+                               DHD_ERROR(("%s Disable rsdb_mode is failed ret= %d\n",
+                                       __FUNCTION__, ret));
+                       }
+               }
+       } else {
+               uint32 concurrent_mode = 0;
+               if ((!op_mode && dhd_get_fw_mode(dhd->info) == DHD_FLAG_P2P_MODE) ||
+                       (op_mode == DHD_FLAG_P2P_MODE)) {
+#if defined(ARP_OFFLOAD_SUPPORT)
+                       arpoe = 0;
+#endif
+#ifdef PKT_FILTER_SUPPORT
+                       dhd_pkt_filter_enable = FALSE;
+#endif
+                       dhd->op_mode = DHD_FLAG_P2P_MODE;
+               } else if ((!op_mode && dhd_get_fw_mode(dhd->info) == DHD_FLAG_IBSS_MODE) ||
+                       (op_mode == DHD_FLAG_IBSS_MODE)) {
+                       dhd->op_mode = DHD_FLAG_IBSS_MODE;
+               } else
+                       dhd->op_mode = DHD_FLAG_STA_MODE;
+#if !defined(AP) && defined(WLP2P)
+               if (dhd->op_mode != DHD_FLAG_IBSS_MODE &&
+                       (concurrent_mode = dhd_get_concurrent_capabilites(dhd))) {
+#if defined(ARP_OFFLOAD_SUPPORT)
+                       arpoe = 1;
+#endif
+                       dhd->op_mode |= concurrent_mode;
+               }
+
+               /* Check if we are enabling p2p */
+               if (dhd->op_mode & DHD_FLAG_P2P_MODE) {
+                       bcm_mkiovar("apsta", (char *)&apsta, 4, iovbuf, sizeof(iovbuf));
+                       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR,
+                               iovbuf, sizeof(iovbuf), TRUE, 0)) < 0) {
+                               DHD_ERROR(("%s APSTA for P2P failed ret= %d\n", __FUNCTION__, ret));
+                       }
+
+#if defined(SOFTAP_AND_GC)
+               if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_AP,
+                       (char *)&ap_mode, sizeof(ap_mode), TRUE, 0)) < 0) {
+                               DHD_ERROR(("%s WLC_SET_AP failed %d\n", __FUNCTION__, ret));
+               }
+#endif
+                       memcpy(&p2p_ea, &dhd->mac, ETHER_ADDR_LEN);
+                       ETHER_SET_LOCALADDR(&p2p_ea);
+                       bcm_mkiovar("p2p_da_override", (char *)&p2p_ea,
+                               ETHER_ADDR_LEN, iovbuf, sizeof(iovbuf));
+                       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR,
+                               iovbuf, sizeof(iovbuf), TRUE, 0)) < 0) {
+                               DHD_ERROR(("%s p2p_da_override ret= %d\n", __FUNCTION__, ret));
+                       } else {
+                               DHD_INFO(("dhd_preinit_ioctls: p2p_da_override succeeded\n"));
+                       }
+               }
+#else
+       (void)concurrent_mode;
+#endif 
+       }
+
+#if defined(RSDB_MODE_FROM_FILE)
+       (void)dhd_rsdb_mode_from_file(dhd);
+#endif 
+
+#ifdef DISABLE_PRUNED_SCAN
+       if (FW_SUPPORTED(dhd, rsdb)) {
+               memset(iovbuf, 0, sizeof(iovbuf));
+               bcm_mkiovar("scan_features", (char *)&scan_features,
+                       4, iovbuf, sizeof(iovbuf));
+               if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR,
+                       iovbuf, sizeof(iovbuf), FALSE, 0)) < 0) {
+                       DHD_ERROR(("%s get scan_features is failed ret=%d\n",
+                               __FUNCTION__, ret));
+               } else {
+                       memcpy(&scan_features, iovbuf, 4);
+                       scan_features &= ~RSDB_SCAN_DOWNGRADED_CH_PRUNE_ROAM;
+                       memset(iovbuf, 0, sizeof(iovbuf));
+                       bcm_mkiovar("scan_features", (char *)&scan_features,
+                               4, iovbuf, sizeof(iovbuf));
+                       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR,
+                               iovbuf, sizeof(iovbuf), TRUE, 0)) < 0) {
+                               DHD_ERROR(("%s set scan_features is failed ret=%d\n",
+                                       __FUNCTION__, ret));
+                       }
+               }
+       }
+#endif /* DISABLE_PRUNED_SCAN */
+
+       DHD_ERROR(("Firmware up: op_mode=0x%04x, MAC="MACDBG"\n",
+               dhd->op_mode, MAC2STRDBG(dhd->mac.octet)));
+       #if defined(RXFRAME_THREAD) && defined(RXTHREAD_ONLYSTA)
+       if (dhd->op_mode == DHD_FLAG_HOSTAP_MODE)
+               dhd->info->rxthread_enabled = FALSE;
+       else
+               dhd->info->rxthread_enabled = TRUE;
+       #endif
+       /* Set Country code  */
+       if (dhd->dhd_cspec.ccode[0] != 0) {
+               bcm_mkiovar("country", (char *)&dhd->dhd_cspec,
+                       sizeof(wl_country_t), iovbuf, sizeof(iovbuf));
+               if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0)
+                       DHD_ERROR(("%s: country code setting failed\n", __FUNCTION__));
+       }
+
+
+       /* Set Listen Interval */
+       bcm_mkiovar("assoc_listen", (char *)&listen_interval, 4, iovbuf, sizeof(iovbuf));
+       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0)
+               DHD_ERROR(("%s assoc_listen failed %d\n", __FUNCTION__, ret));
+
+#if defined(ROAM_ENABLE) || defined(DISABLE_BUILTIN_ROAM)
+#ifdef USE_WFA_CERT_CONF
+       if (sec_get_param_wfa_cert(dhd, SET_PARAM_ROAMOFF, &roamvar) == BCME_OK) {
+               DHD_ERROR(("%s: read roam_off param =%d\n", __FUNCTION__, roamvar));
+       }
+#endif /* USE_WFA_CERT_CONF */
+       /* Disable built-in roaming to allowed ext supplicant to take care of roaming */
+       bcm_mkiovar("roam_off", (char *)&roamvar, 4, iovbuf, sizeof(iovbuf));
+       dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+#endif /* ROAM_ENABLE || DISABLE_BUILTIN_ROAM */
+#if defined(ROAM_ENABLE)
+       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_ROAM_TRIGGER, roam_trigger,
+               sizeof(roam_trigger), TRUE, 0)) < 0)
+               DHD_ERROR(("%s: roam trigger set failed %d\n", __FUNCTION__, ret));
+       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_ROAM_SCAN_PERIOD, roam_scan_period,
+               sizeof(roam_scan_period), TRUE, 0)) < 0)
+               DHD_ERROR(("%s: roam scan period set failed %d\n", __FUNCTION__, ret));
+       if ((dhd_wl_ioctl_cmd(dhd, WLC_SET_ROAM_DELTA, roam_delta,
+               sizeof(roam_delta), TRUE, 0)) < 0)
+               DHD_ERROR(("%s: roam delta set failed %d\n", __FUNCTION__, ret));
+       bcm_mkiovar("fullroamperiod", (char *)&roam_fullscan_period, 4, iovbuf, sizeof(iovbuf));
+       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0)
+               DHD_ERROR(("%s: roam fullscan period set failed %d\n", __FUNCTION__, ret));
+#endif /* ROAM_ENABLE */
+
+#ifdef CUSTOM_EVENT_PM_WAKE
+       bcm_mkiovar("const_awake_thresh", (char *)&pm_awake_thresh, 4, iovbuf, sizeof(iovbuf));
+       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0) {
+               DHD_ERROR(("%s set const_awake_thresh failed %d\n", __FUNCTION__, ret));
+       }
+#endif /* CUSTOM_EVENT_PM_WAKE */
+#ifdef WLTDLS
+#ifdef ENABLE_TDLS_AUTO_MODE
+       /* by default TDLS on and auto mode on */
+       _dhd_tdls_enable(dhd, true, true, NULL);
+#else
+       /* by default TDLS on and auto mode off */
+       _dhd_tdls_enable(dhd, true, false, NULL);
+#endif /* ENABLE_TDLS_AUTO_MODE */
+#endif /* WLTDLS */
+
+#ifdef DHD_ENABLE_LPC
+       /* Set lpc 1 */
+       bcm_mkiovar("lpc", (char *)&lpc, 4, iovbuf, sizeof(iovbuf));
+       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+               sizeof(iovbuf), TRUE, 0)) < 0) {
+               DHD_ERROR(("%s Set lpc failed  %d\n", __FUNCTION__, ret));
+
+               if (ret == BCME_NOTDOWN) {
+                       uint wl_down = 1;
+                       ret = dhd_wl_ioctl_cmd(dhd, WLC_DOWN,
+                               (char *)&wl_down, sizeof(wl_down), TRUE, 0);
+                       DHD_ERROR(("%s lpc fail WL_DOWN : %d, lpc = %d\n", __FUNCTION__, ret, lpc));
+
+                       bcm_mkiovar("lpc", (char *)&lpc, 4, iovbuf, sizeof(iovbuf));
+                       ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+                       DHD_ERROR(("%s Set lpc ret --> %d\n", __FUNCTION__, ret));
+               }
+       }
+#endif /* DHD_ENABLE_LPC */
+
+       /* Set PowerSave mode */
+       dhd_wl_ioctl_cmd(dhd, WLC_SET_PM, (char *)&power_mode, sizeof(power_mode), TRUE, 0);
+
+#if defined(BCMSDIO)
+       /* Match Host and Dongle rx alignment */
+       bcm_mkiovar("bus:txglomalign", (char *)&dongle_align, 4, iovbuf, sizeof(iovbuf));
+       dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+
+#if defined(CUSTOMER_HW2) && defined(USE_WL_CREDALL)
+       /* enable credall to reduce the chance of no bus credit happened. */
+       bcm_mkiovar("bus:credall", (char *)&credall, 4, iovbuf, sizeof(iovbuf));
+       dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+#endif
+
+#ifdef USE_WFA_CERT_CONF
+       if (sec_get_param_wfa_cert(dhd, SET_PARAM_BUS_TXGLOM_MODE, &glom) == BCME_OK) {
+               DHD_ERROR(("%s, read txglom param =%d\n", __FUNCTION__, glom));
+       }
+#endif /* USE_WFA_CERT_CONF */
+       if (glom != DEFAULT_GLOM_VALUE) {
+               DHD_INFO(("%s set glom=0x%X\n", __FUNCTION__, glom));
+               bcm_mkiovar("bus:txglom", (char *)&glom, 4, iovbuf, sizeof(iovbuf));
+               dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+       }
+#endif /* defined(BCMSDIO) */
+
+       /* Setup timeout if Beacons are lost and roam is off to report link down */
+       bcm_mkiovar("bcn_timeout", (char *)&bcn_timeout, 4, iovbuf, sizeof(iovbuf));
+       dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+       /* Setup assoc_retry_max count to reconnect target AP in dongle */
+       bcm_mkiovar("assoc_retry_max", (char *)&retry_max, 4, iovbuf, sizeof(iovbuf));
+       dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+#if defined(AP) && !defined(WLP2P)
+       /* Turn off MPC in AP mode */
+       bcm_mkiovar("mpc", (char *)&mpc, 4, iovbuf, sizeof(iovbuf));
+       dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+       bcm_mkiovar("apsta", (char *)&apsta, 4, iovbuf, sizeof(iovbuf));
+       dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+#endif /* defined(AP) && !defined(WLP2P) */
+
+#ifdef MIMO_ANT_SETTING
+       dhd_sel_ant_from_file(dhd);
+#endif /* MIMO_ANT_SETTING */
+
+#if defined(SOFTAP)
+       if (ap_fw_loaded == TRUE) {
+               dhd_wl_ioctl_cmd(dhd, WLC_SET_DTIMPRD, (char *)&dtim, sizeof(dtim), TRUE, 0);
+       }
+#endif 
+
+#if defined(KEEP_ALIVE)
+       {
+       /* Set Keep Alive : be sure to use FW with -keepalive */
+       int res;
+
+#if defined(SOFTAP)
+       if (ap_fw_loaded == FALSE)
+#endif 
+               if (!(dhd->op_mode &
+                       (DHD_FLAG_HOSTAP_MODE | DHD_FLAG_MFG_MODE))) {
+                       if ((res = dhd_keep_alive_onoff(dhd)) < 0)
+                               DHD_ERROR(("%s set keeplive failed %d\n",
+                               __FUNCTION__, res));
+               }
+       }
+#endif /* defined(KEEP_ALIVE) */
+
+#ifdef USE_WL_TXBF
+       bcm_mkiovar("txbf", (char *)&txbf, 4, iovbuf, sizeof(iovbuf));
+       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+               sizeof(iovbuf), TRUE, 0)) < 0) {
+               DHD_ERROR(("%s Set txbf returned (%d)\n", __FUNCTION__, ret));
+       }
+#endif /* USE_WL_TXBF */
+
+#ifdef USE_WFA_CERT_CONF
+#ifdef USE_WL_FRAMEBURST
+        if (sec_get_param_wfa_cert(dhd, SET_PARAM_FRAMEBURST, &frameburst) == BCME_OK) {
+               DHD_ERROR(("%s, read frameburst param=%d\n", __FUNCTION__, frameburst));
+        }
+#endif /* USE_WL_FRAMEBURST */
+#ifdef DISABLE_FRAMEBURST_VSDB
+       g_frameburst = frameburst;
+#endif /* DISABLE_FRAMEBURST_VSDB */
+#endif /* USE_WFA_CERT_CONF */
+#ifdef DISABLE_WL_FRAMEBURST_SOFTAP
+       /* Disable Framebursting for SofAP */
+       if (dhd->op_mode & DHD_FLAG_HOSTAP_MODE) {
+               frameburst = 0;
+       }
+#endif /* DISABLE_WL_FRAMEBURST_SOFTAP */
+       /* Set frameburst to value */
+       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_FAKEFRAG, (char *)&frameburst,
+               sizeof(frameburst), TRUE, 0)) < 0) {
+               DHD_INFO(("%s frameburst not supported  %d\n", __FUNCTION__, ret));
+       }
+#if defined(CUSTOM_AMPDU_BA_WSIZE)
+       /* Set ampdu ba wsize to 64 or 16 */
+#ifdef CUSTOM_AMPDU_BA_WSIZE
+       ampdu_ba_wsize = CUSTOM_AMPDU_BA_WSIZE;
+#endif
+       if (ampdu_ba_wsize != 0) {
+               bcm_mkiovar("ampdu_ba_wsize", (char *)&ampdu_ba_wsize, 4, iovbuf, sizeof(iovbuf));
+               if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+                       sizeof(iovbuf), TRUE, 0)) < 0) {
+                       DHD_ERROR(("%s Set ampdu_ba_wsize to %d failed  %d\n",
+                               __FUNCTION__, ampdu_ba_wsize, ret));
+               }
+       }
+#endif 
+
+       iov_buf = (char*)kmalloc(WLC_IOCTL_SMLEN, GFP_KERNEL);
+       if (iov_buf == NULL) {
+               DHD_ERROR(("failed to allocate %d bytes for iov_buf\n", WLC_IOCTL_SMLEN));
+               ret = BCME_NOMEM;
+               goto done;
+       }
+#ifdef ENABLE_TEMP_THROTTLING
+       if (dhd->op_mode & DHD_FLAG_STA_MODE) {
+               memset(&temp_control, 0, sizeof(temp_control));
+               temp_control.enable = 1;
+               temp_control.control_bit = TEMP_THROTTLE_CONTROL_BIT;
+               bcm_mkiovar("temp_throttle_control", (char *)&temp_control,
+                               sizeof(wl_temp_control_t), iov_buf, WLC_IOCTL_SMLEN);
+               ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iov_buf, WLC_IOCTL_SMLEN, TRUE, 0);
+               if (ret < 0) {
+                       DHD_ERROR(("%s Set temp_throttle_control to %d failed \n",
+                               __FUNCTION__, ret));
+               }
+       }
+#endif /* ENABLE_TEMP_THROTTLING */
+#if defined(CUSTOM_AMPDU_MPDU)
+       ampdu_mpdu = CUSTOM_AMPDU_MPDU;
+       if (ampdu_mpdu != 0 && (ampdu_mpdu <= ampdu_ba_wsize)) {
+               bcm_mkiovar("ampdu_mpdu", (char *)&ampdu_mpdu, 4, iovbuf, sizeof(iovbuf));
+               if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+                       sizeof(iovbuf), TRUE, 0)) < 0) {
+                       DHD_ERROR(("%s Set ampdu_mpdu to %d failed  %d\n",
+                               __FUNCTION__, CUSTOM_AMPDU_MPDU, ret));
+               }
+       }
+#endif /* CUSTOM_AMPDU_MPDU */
+
+#if defined(CUSTOM_AMPDU_RELEASE)
+       ampdu_release = CUSTOM_AMPDU_RELEASE;
+       if (ampdu_release != 0 && (ampdu_release <= ampdu_ba_wsize)) {
+               bcm_mkiovar("ampdu_release", (char *)&ampdu_release, 4, iovbuf, sizeof(iovbuf));
+               if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+                       sizeof(iovbuf), TRUE, 0)) < 0) {
+                       DHD_ERROR(("%s Set ampdu_release to %d failed  %d\n",
+                               __FUNCTION__, CUSTOM_AMPDU_RELEASE, ret));
+               }
+       }
+#endif /* CUSTOM_AMPDU_RELEASE */
+
+#if defined(CUSTOM_AMSDU_AGGSF)
+       amsdu_aggsf = CUSTOM_AMSDU_AGGSF;
+       if (amsdu_aggsf != 0) {
+               bcm_mkiovar("amsdu_aggsf", (char *)&amsdu_aggsf, 4, iovbuf, sizeof(iovbuf));
+               ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+               if (ret < 0) {
+                       DHD_ERROR(("%s Set amsdu_aggsf to %d failed %d\n",
+                               __FUNCTION__, CUSTOM_AMSDU_AGGSF, ret));
+               }
+       }
+#endif /* CUSTOM_AMSDU_AGGSF */
+
+#ifdef CUSTOM_PSPRETEND_THR
+       /* Turn off MPC in AP mode */
+       bcm_mkiovar("pspretend_threshold", (char *)&pspretend_thr, 4,
+               iovbuf, sizeof(iovbuf));
+       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+               sizeof(iovbuf), TRUE, 0)) < 0) {
+               DHD_ERROR(("%s pspretend_threshold for HostAPD failed  %d\n",
+                       __FUNCTION__, ret));
+       }
+#endif
+
+       bcm_mkiovar("buf_key_b4_m4", (char *)&buf_key_b4_m4, 4, iovbuf, sizeof(iovbuf));
+       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+               sizeof(iovbuf), TRUE, 0)) < 0) {
+               DHD_ERROR(("%s buf_key_b4_m4 set failed %d\n", __FUNCTION__, ret));
+       }
+
+       /* Read event_msgs mask */
+       bcm_mkiovar("event_msgs", eventmask, WL_EVENTING_MASK_LEN, iovbuf, sizeof(iovbuf));
+       if ((ret  = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, iovbuf, sizeof(iovbuf), FALSE, 0)) < 0) {
+               DHD_ERROR(("%s read Event mask failed %d\n", __FUNCTION__, ret));
+               goto done;
+       }
+       bcopy(iovbuf, eventmask, WL_EVENTING_MASK_LEN);
+
+       /* Setup event_msgs */
+       setbit(eventmask, WLC_E_SET_SSID);
+       setbit(eventmask, WLC_E_PRUNE);
+       setbit(eventmask, WLC_E_AUTH);
+       setbit(eventmask, WLC_E_AUTH_IND);
+       setbit(eventmask, WLC_E_ASSOC);
+       setbit(eventmask, WLC_E_REASSOC);
+       setbit(eventmask, WLC_E_REASSOC_IND);
+       if (!(dhd->op_mode & DHD_FLAG_IBSS_MODE))
+               setbit(eventmask, WLC_E_DEAUTH);
+       setbit(eventmask, WLC_E_DEAUTH_IND);
+       setbit(eventmask, WLC_E_DISASSOC_IND);
+       setbit(eventmask, WLC_E_DISASSOC);
+       setbit(eventmask, WLC_E_JOIN);
+       setbit(eventmask, WLC_E_START);
+       setbit(eventmask, WLC_E_ASSOC_IND);
+       setbit(eventmask, WLC_E_PSK_SUP);
+       setbit(eventmask, WLC_E_LINK);
+       setbit(eventmask, WLC_E_MIC_ERROR);
+       setbit(eventmask, WLC_E_ASSOC_REQ_IE);
+       setbit(eventmask, WLC_E_ASSOC_RESP_IE);
+#ifndef WL_CFG80211
+       setbit(eventmask, WLC_E_PMKID_CACHE);
+       setbit(eventmask, WLC_E_TXFAIL);
+#endif
+       setbit(eventmask, WLC_E_JOIN_START);
+       setbit(eventmask, WLC_E_SCAN_COMPLETE);
+#ifdef DHD_DEBUG
+       setbit(eventmask, WLC_E_SCAN_CONFIRM_IND);
+#endif
+#ifdef WLMEDIA_HTSF
+       setbit(eventmask, WLC_E_HTSFSYNC);
+#endif /* WLMEDIA_HTSF */
+#ifdef PNO_SUPPORT
+       setbit(eventmask, WLC_E_PFN_NET_FOUND);
+       setbit(eventmask, WLC_E_PFN_BEST_BATCHING);
+       setbit(eventmask, WLC_E_PFN_BSSID_NET_FOUND);
+       setbit(eventmask, WLC_E_PFN_BSSID_NET_LOST);
+#endif /* PNO_SUPPORT */
+       /* enable dongle roaming event */
+       setbit(eventmask, WLC_E_ROAM);
+       setbit(eventmask, WLC_E_BSSID);
+#ifdef WLTDLS
+       setbit(eventmask, WLC_E_TDLS_PEER_EVENT);
+#endif /* WLTDLS */
+#ifdef WL_CFG80211
+       setbit(eventmask, WLC_E_ESCAN_RESULT);
+       setbit(eventmask, WLC_E_AP_STARTED);
+       if (dhd->op_mode & DHD_FLAG_P2P_MODE) {
+               setbit(eventmask, WLC_E_ACTION_FRAME_RX);
+               setbit(eventmask, WLC_E_P2P_DISC_LISTEN_COMPLETE);
+       }
+#endif /* WL_CFG80211 */
+
+#if defined(SHOW_LOGTRACE) && defined(LOGTRACE_FROM_FILE)
+       if (dhd_logtrace_from_file(dhd)) {
+               setbit(eventmask, WLC_E_TRACE);
+       } else {
+               clrbit(eventmask, WLC_E_TRACE);
+       }
+#elif defined(SHOW_LOGTRACE)
+       setbit(eventmask, WLC_E_TRACE);
+#else
+       clrbit(eventmask, WLC_E_TRACE);
+#endif /* defined(SHOW_LOGTRACE) && defined(LOGTRACE_FROM_FILE) */
+
+       setbit(eventmask, WLC_E_CSA_COMPLETE_IND);
+#ifdef DHD_LOSSLESS_ROAMING
+       setbit(eventmask, WLC_E_ROAM_PREP);
+#endif
+#ifdef CUSTOM_EVENT_PM_WAKE
+       setbit(eventmask, WLC_E_EXCESS_PM_WAKE_EVENT);
+#endif /* CUSTOM_EVENT_PM_WAKE */
+#if defined(PCIE_FULL_DONGLE) && defined(DHD_LOSSLESS_ROAMING)
+       dhd_update_flow_prio_map(dhd, DHD_FLOW_PRIO_LLR_MAP);
+#endif /* defined(PCIE_FULL_DONGLE) && defined(DHD_LOSSLESS_ROAMING) */
+
+       /* Write updated Event mask */
+       bcm_mkiovar("event_msgs", eventmask, WL_EVENTING_MASK_LEN, iovbuf, sizeof(iovbuf));
+       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0) {
+               DHD_ERROR(("%s Set Event mask failed %d\n", __FUNCTION__, ret));
+               goto done;
+       }
+
+       /* make up event mask ext message iovar for event larger than 128 */
+       msglen = ROUNDUP(WLC_E_LAST, NBBY)/NBBY + EVENTMSGS_EXT_STRUCT_SIZE;
+       eventmask_msg = (eventmsgs_ext_t*)kmalloc(msglen, GFP_KERNEL);
+       if (eventmask_msg == NULL) {
+               DHD_ERROR(("failed to allocate %d bytes for event_msg_ext\n", msglen));
+               ret = BCME_NOMEM;
+               goto done;
+       }
+       bzero(eventmask_msg, msglen);
+       eventmask_msg->ver = EVENTMSGS_VER;
+       eventmask_msg->len = ROUNDUP(WLC_E_LAST, NBBY)/NBBY;
+
+       /* Read event_msgs_ext mask */
+       bcm_mkiovar("event_msgs_ext", (char *)eventmask_msg, msglen, iov_buf, WLC_IOCTL_SMLEN);
+       ret2  = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, iov_buf, WLC_IOCTL_SMLEN, FALSE, 0);
+       if (ret2 == 0) { /* event_msgs_ext must be supported */
+               bcopy(iov_buf, eventmask_msg, msglen);
+#ifdef GSCAN_SUPPORT
+               setbit(eventmask_msg->mask, WLC_E_PFN_GSCAN_FULL_RESULT);
+               setbit(eventmask_msg->mask, WLC_E_PFN_SCAN_COMPLETE);
+               setbit(eventmask_msg->mask, WLC_E_PFN_SWC);
+#endif /* GSCAN_SUPPORT */
+#ifdef BT_WIFI_HANDOVER
+               setbit(eventmask_msg->mask, WLC_E_BT_WIFI_HANDOVER_REQ);
+#endif /* BT_WIFI_HANDOVER */
+               setbit(eventmask_msg->mask, WLC_E_SDB_TRANSITION);
+#ifdef ENABLE_TEMP_THROTTLING
+               setbit(eventmask_msg->mask, WLC_E_TEMP_THROTTLE);
+#endif /* ENABLE_TEMP_THROTTLING */
+
+               /* Write updated Event mask */
+               eventmask_msg->ver = EVENTMSGS_VER;
+               eventmask_msg->command = EVENTMSGS_SET_MASK;
+               eventmask_msg->len = ROUNDUP(WLC_E_LAST, NBBY)/NBBY;
+               bcm_mkiovar("event_msgs_ext", (char *)eventmask_msg,
+                       msglen, iov_buf, WLC_IOCTL_SMLEN);
+               if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR,
+                       iov_buf, WLC_IOCTL_SMLEN, TRUE, 0)) < 0) {
+                       DHD_ERROR(("%s write event mask ext failed %d\n", __FUNCTION__, ret));
+                       goto done;
+               }
+       } else if (ret2 == BCME_UNSUPPORTED || ret2 == BCME_VERSION) {
+               /* Skip for BCME_UNSUPPORTED or BCME_VERSION */
+               DHD_ERROR(("%s event_msgs_ext not support or version mismatch %d\n",
+                       __FUNCTION__, ret2));
+       } else {
+               DHD_ERROR(("%s read event mask ext failed %d\n", __FUNCTION__, ret2));
+               ret = ret2;
+               goto done;
+       }
+
+       dhd_wl_ioctl_cmd(dhd, WLC_SET_SCAN_CHANNEL_TIME, (char *)&scan_assoc_time,
+               sizeof(scan_assoc_time), TRUE, 0);
+       dhd_wl_ioctl_cmd(dhd, WLC_SET_SCAN_UNASSOC_TIME, (char *)&scan_unassoc_time,
+               sizeof(scan_unassoc_time), TRUE, 0);
+       dhd_wl_ioctl_cmd(dhd, WLC_SET_SCAN_PASSIVE_TIME, (char *)&scan_passive_time,
+               sizeof(scan_passive_time), TRUE, 0);
+
+#ifdef ARP_OFFLOAD_SUPPORT
+       /* Set and enable ARP offload feature for STA only  */
+#if defined(SOFTAP)
+       if (arpoe && !ap_fw_loaded) {
+#else
+       if (arpoe) {
+#endif 
+               dhd_arp_offload_enable(dhd, TRUE);
+               dhd_arp_offload_set(dhd, dhd_arp_mode);
+       } else {
+               dhd_arp_offload_enable(dhd, FALSE);
+               dhd_arp_offload_set(dhd, 0);
+       }
+       dhd_arp_enable = arpoe;
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+#ifdef PKT_FILTER_SUPPORT
+       /* Setup default defintions for pktfilter , enable in suspend */
+       dhd->pktfilter_count = 6;
+       dhd->pktfilter[DHD_BROADCAST_FILTER_NUM] = NULL;
+       if (!FW_SUPPORTED(dhd, pf6)) {
+               dhd->pktfilter[DHD_MULTICAST4_FILTER_NUM] = NULL;
+               dhd->pktfilter[DHD_MULTICAST6_FILTER_NUM] = NULL;
+       } else {
+               /* Immediately pkt filter TYPE 6 Discard IPv4/IPv6 Multicast Packet */
+               dhd->pktfilter[DHD_MULTICAST4_FILTER_NUM] = DISCARD_IPV4_MCAST;
+               dhd->pktfilter[DHD_MULTICAST6_FILTER_NUM] = DISCARD_IPV6_MCAST;
+       }
+       /* apply APP pktfilter */
+       dhd->pktfilter[DHD_ARP_FILTER_NUM] = "105 0 0 12 0xFFFF 0x0806";
+
+       /* Setup filter to allow only unicast */
+       dhd->pktfilter[DHD_UNICAST_FILTER_NUM] = "100 0 0 0 0x01 0x00";
+
+       /* Add filter to pass multicastDNS packet and NOT filter out as Broadcast */
+       dhd->pktfilter[DHD_MDNS_FILTER_NUM] = NULL;
+       if (FW_SUPPORTED(dhd, pf6)) {
+               /* Immediately pkt filter TYPE 6 Dicard Broadcast IP packet */
+               dhd->pktfilter[DHD_IP4BCAST_DROP_FILTER_NUM] =
+                       "107 1 6 IP4_H:16 0xf0 !0xe0 IP4_H:19 0xff 0xff";
+               dhd->pktfilter_count = 8;
+       }
+
+#ifdef GAN_LITE_NAT_KEEPALIVE_FILTER
+       dhd->pktfilter_count = 4;
+       /* Setup filter to block broadcast and NAT Keepalive packets */
+       /* discard all broadcast packets */
+       dhd->pktfilter[DHD_UNICAST_FILTER_NUM] = "100 0 0 0 0xffffff 0xffffff";
+       /* discard NAT Keepalive packets */
+       dhd->pktfilter[DHD_BROADCAST_FILTER_NUM] = "102 0 0 36 0xffffffff 0x11940009";
+       /* discard NAT Keepalive packets */
+       dhd->pktfilter[DHD_MULTICAST4_FILTER_NUM] = "104 0 0 38 0xffffffff 0x11940009";
+       dhd->pktfilter[DHD_MULTICAST6_FILTER_NUM] = NULL;
+#endif /* GAN_LITE_NAT_KEEPALIVE_FILTER */
+
+#if defined(SOFTAP)
+       if (ap_fw_loaded) {
+               dhd_enable_packet_filter(0, dhd);
+       }
+#endif /* defined(SOFTAP) */
+       dhd_set_packet_filter(dhd);
+#endif /* PKT_FILTER_SUPPORT */
+#ifdef DISABLE_11N
+       bcm_mkiovar("nmode", (char *)&nmode, 4, iovbuf, sizeof(iovbuf));
+       if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0)
+               DHD_ERROR(("%s wl nmode 0 failed %d\n", __FUNCTION__, ret));
+#endif /* DISABLE_11N */
+
+#ifdef ENABLE_BCN_LI_BCN_WAKEUP
+       bcm_mkiovar("bcn_li_bcn", (char *)&bcn_li_bcn, 4, iovbuf, sizeof(iovbuf));
+       dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+#endif /* ENABLE_BCN_LI_BCN_WAKEUP */
+       /* query for 'clmver' to get clm version info from firmware */
+       memset(buf, 0, sizeof(buf));
+       bcm_mkiovar("clmver", (char *)&buf, 4, buf, sizeof(buf));
+       if ((ret  = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, buf, sizeof(buf), FALSE, 0)) < 0)
+               DHD_ERROR(("%s failed %d\n", __FUNCTION__, ret));
+       else {
+               char *clmver_temp_buf = NULL;
+
+               if ((clmver_temp_buf = bcmstrstr(buf, "Data:")) == NULL) {
+                       DHD_ERROR(("Couldn't find \"Data:\"\n"));
+               } else {
+                       ptr = (clmver_temp_buf + strlen("Data:"));
+                       if ((clmver_temp_buf = bcmstrtok(&ptr, "\n", 0)) == NULL) {
+                               DHD_ERROR(("Couldn't find New line character\n"));
+                       } else {
+                               memset(clm_version, 0, CLM_VER_STR_LEN);
+                               strncpy(clm_version, clmver_temp_buf,
+                                       MIN(strlen(clmver_temp_buf), CLM_VER_STR_LEN - 1));
+                               DHD_ERROR(("clm version = %s\n", clm_version));
+                       }
+               }
+       }
+
+       /* query for 'ver' to get version info from firmware */
+       memset(buf, 0, sizeof(buf));
+       ptr = buf;
+       bcm_mkiovar("ver", (char *)&buf, 4, buf, sizeof(buf));
+       if ((ret  = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, buf, sizeof(buf), FALSE, 0)) < 0)
+               DHD_ERROR(("%s failed %d\n", __FUNCTION__, ret));
+       else {
+               bcmstrtok(&ptr, "\n", 0);
+               /* Print fw version info */
+               DHD_ERROR(("Firmware version = %s\n", buf));
+               strncpy(fw_version, buf, FW_VER_STR_LEN);
+               fw_version[FW_VER_STR_LEN-1] = '\0';
+#if defined(BCMSDIO)
+               dhd_set_version_info(dhd, buf);
+#endif /* defined(BCMSDIO) */
+#ifdef WRITE_WLANINFO
+               sec_save_wlinfo(buf, EPI_VERSION_STR, dhd->info->nv_path, clm_version);
+#endif /* WRITE_WLANINFO */
+       }
+
+#if defined(BCMSDIO)
+       dhd_txglom_enable(dhd, TRUE);
+#endif /* defined(BCMSDIO) */
+
+#if defined(BCMSDIO)
+#ifdef PROP_TXSTATUS
+       if (disable_proptx ||
+#ifdef PROP_TXSTATUS_VSDB
+               /* enable WLFC only if the firmware is VSDB when it is in STA mode */
+               (dhd->op_mode != DHD_FLAG_HOSTAP_MODE &&
+                dhd->op_mode != DHD_FLAG_IBSS_MODE) ||
+#endif /* PROP_TXSTATUS_VSDB */
+               FALSE) {
+               wlfc_enable = FALSE;
+       }
+
+#ifdef USE_WFA_CERT_CONF
+       if (sec_get_param_wfa_cert(dhd, SET_PARAM_PROPTX, &proptx) == BCME_OK) {
+               DHD_ERROR(("%s , read proptx param=%d\n", __FUNCTION__, proptx));
+               wlfc_enable = proptx;
+       }
+#endif /* USE_WFA_CERT_CONF */
+
+#ifndef DISABLE_11N
+       bcm_mkiovar("ampdu_hostreorder", (char *)&hostreorder, 4, iovbuf, sizeof(iovbuf));
+       if ((ret2 = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0) {
+               DHD_ERROR(("%s wl ampdu_hostreorder failed %d\n", __FUNCTION__, ret2));
+               if (ret2 != BCME_UNSUPPORTED)
+                       ret = ret2;
+
+               if (ret == BCME_NOTDOWN) {
+                       uint wl_down = 1;
+                       ret2 = dhd_wl_ioctl_cmd(dhd, WLC_DOWN, (char *)&wl_down,
+                               sizeof(wl_down), TRUE, 0);
+                       DHD_ERROR(("%s ampdu_hostreorder fail WL_DOWN : %d, hostreorder :%d\n",
+                               __FUNCTION__, ret2, hostreorder));
+
+                       bcm_mkiovar("ampdu_hostreorder", (char *)&hostreorder, 4,
+                               iovbuf, sizeof(iovbuf));
+                       ret2 = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+                       DHD_ERROR(("%s wl ampdu_hostreorder. ret --> %d\n", __FUNCTION__, ret2));
+                       if (ret2 != BCME_UNSUPPORTED)
+                                       ret = ret2;
+               }
+               if (ret2 != BCME_OK)
+                       hostreorder = 0;
+       }
+#endif /* DISABLE_11N */
+
+
+       if (wlfc_enable)
+               dhd_wlfc_init(dhd);
+#ifndef DISABLE_11N
+       else if (hostreorder)
+               dhd_wlfc_hostreorder_init(dhd);
+#endif /* DISABLE_11N */
+
+#endif /* PROP_TXSTATUS */
+#endif /* BCMSDIO || BCMBUS */
+#ifdef PCIE_FULL_DONGLE
+       /* For FD we need all the packets at DHD to handle intra-BSS forwarding */
+       if (FW_SUPPORTED(dhd, ap)) {
+               wl_ap_isolate = AP_ISOLATE_SENDUP_ALL;
+               bcm_mkiovar("ap_isolate", (char *)&wl_ap_isolate, 4, iovbuf, sizeof(iovbuf));
+               if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0)
+                       DHD_ERROR(("%s failed %d\n", __FUNCTION__, ret));
+       }
+#endif /* PCIE_FULL_DONGLE */
+#ifdef PNO_SUPPORT
+       if (!dhd->pno_state) {
+               dhd_pno_init(dhd);
+       }
+#endif
+#ifdef WL11U
+       dhd_interworking_enable(dhd);
+#endif /* WL11U */
+
+#ifdef SUPPORT_SENSORHUB
+       bcm_mkiovar("shub", (char *)&(shub_ctl.enable), 4, iovbuf, sizeof(iovbuf));
+       if ((ret2 = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, iovbuf, sizeof(iovbuf),
+               FALSE, 0)) < 0) {
+               DHD_ERROR(("%s failed to get shub hub enable information %d\n",
+                       __FUNCTION__, ret2));
+               dhd->info->shub_enable = 0;
+       } else {
+               memcpy(&shub_ctl, iovbuf, sizeof(shub_ctl));
+               dhd->info->shub_enable = shub_ctl.enable;
+               DHD_ERROR(("%s: checking sensorhub enable %d\n",
+                       __FUNCTION__, dhd->info->shub_enable));
+       }
+#else
+       dhd->info->shub_enable = FALSE;
+       shub_ctl.enable = FALSE;
+       bcm_mkiovar("shub", (char *)&shub_ctl, sizeof(shub_ctl),
+               iovbuf, sizeof(iovbuf));
+       if ((dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf),
+               FALSE, 0)) < 0) {
+               DHD_ERROR(("%s failed to set ShubHub disable\n",
+                       __FUNCTION__));
+       }
+#endif /* SUPPORT_SENSORHUB */
+done:
+
+       if (eventmask_msg)
+               kfree(eventmask_msg);
+       if (iov_buf)
+               kfree(iov_buf);
+
+       return ret;
+}
+
+
+int
+dhd_iovar(dhd_pub_t *pub, int ifidx, char *name, char *cmd_buf, uint cmd_len, int set)
+{
+       char buf[strlen(name) + 1 + cmd_len];
+       int len = sizeof(buf);
+       wl_ioctl_t ioc;
+       int ret;
+
+       len = bcm_mkiovar(name, cmd_buf, cmd_len, buf, len);
+
+       memset(&ioc, 0, sizeof(ioc));
+
+       ioc.cmd = set? WLC_SET_VAR : WLC_GET_VAR;
+       ioc.buf = buf;
+       ioc.len = len;
+       ioc.set = set;
+
+       ret = dhd_wl_ioctl(pub, ifidx, &ioc, ioc.buf, ioc.len);
+       if (!set && ret >= 0)
+               memcpy(cmd_buf, buf, cmd_len);
+
+       return ret;
+}
+
+int dhd_change_mtu(dhd_pub_t *dhdp, int new_mtu, int ifidx)
+{
+       struct dhd_info *dhd = dhdp->info;
+       struct net_device *dev = NULL;
+
+       ASSERT(dhd && dhd->iflist[ifidx]);
+       dev = dhd->iflist[ifidx]->net;
+       ASSERT(dev);
+
+       if (netif_running(dev)) {
+               DHD_ERROR(("%s: Must be down to change its MTU", dev->name));
+               return BCME_NOTDOWN;
+       }
+
+#define DHD_MIN_MTU 1500
+#define DHD_MAX_MTU 1752
+
+       if ((new_mtu < DHD_MIN_MTU) || (new_mtu > DHD_MAX_MTU)) {
+               DHD_ERROR(("%s: MTU size %d is invalid.\n", __FUNCTION__, new_mtu));
+               return BCME_BADARG;
+       }
+
+       dev->mtu = new_mtu;
+       return 0;
+}
+
+#ifdef ARP_OFFLOAD_SUPPORT
+/* add or remove AOE host ip(s) (up to 8 IPs on the interface)  */
+void
+aoe_update_host_ipv4_table(dhd_pub_t *dhd_pub, u32 ipa, bool add, int idx)
+{
+       u32 ipv4_buf[MAX_IPV4_ENTRIES]; /* temp save for AOE host_ip table */
+       int i;
+       int ret;
+
+       bzero(ipv4_buf, sizeof(ipv4_buf));
+
+       /* display what we've got */
+       ret = dhd_arp_get_arp_hostip_table(dhd_pub, ipv4_buf, sizeof(ipv4_buf), idx);
+       DHD_ARPOE(("%s: hostip table read from Dongle:\n", __FUNCTION__));
+#ifdef AOE_DBG
+       dhd_print_buf(ipv4_buf, 32, 4); /* max 8 IPs 4b each */
+#endif
+       /* now we saved hoste_ip table, clr it in the dongle AOE */
+       dhd_aoe_hostip_clr(dhd_pub, idx);
+
+       if (ret) {
+               DHD_ERROR(("%s failed\n", __FUNCTION__));
+               return;
+       }
+
+       for (i = 0; i < MAX_IPV4_ENTRIES; i++) {
+               if (add && (ipv4_buf[i] == 0)) {
+                               ipv4_buf[i] = ipa;
+                               add = FALSE; /* added ipa to local table  */
+                               DHD_ARPOE(("%s: Saved new IP in temp arp_hostip[%d]\n",
+                               __FUNCTION__, i));
+               } else if (ipv4_buf[i] == ipa) {
+                       ipv4_buf[i]     = 0;
+                       DHD_ARPOE(("%s: removed IP:%x from temp table %d\n",
+                               __FUNCTION__, ipa, i));
+               }
+
+               if (ipv4_buf[i] != 0) {
+                       /* add back host_ip entries from our local cache */
+                       dhd_arp_offload_add_ip(dhd_pub, ipv4_buf[i], idx);
+                       DHD_ARPOE(("%s: added IP:%x to dongle arp_hostip[%d]\n\n",
+                               __FUNCTION__, ipv4_buf[i], i));
+               }
+       }
+#ifdef AOE_DBG
+       /* see the resulting hostip table */
+       dhd_arp_get_arp_hostip_table(dhd_pub, ipv4_buf, sizeof(ipv4_buf), idx);
+       DHD_ARPOE(("%s: read back arp_hostip table:\n", __FUNCTION__));
+       dhd_print_buf(ipv4_buf, 32, 4); /* max 8 IPs 4b each */
+#endif
+}
+
+/*
+ * Notification mechanism from kernel to our driver. This function is called by the Linux kernel
+ * whenever there is an event related to an IP address.
+ * ptr : kernel provided pointer to IP address that has changed
+ */
+static int dhd_inetaddr_notifier_call(struct notifier_block *this,
+       unsigned long event,
+       void *ptr)
+{
+       struct in_ifaddr *ifa = (struct in_ifaddr *)ptr;
+
+       dhd_info_t *dhd;
+       dhd_pub_t *dhd_pub;
+       int idx;
+
+       if (!dhd_arp_enable)
+               return NOTIFY_DONE;
+       if (!ifa || !(ifa->ifa_dev->dev))
+               return NOTIFY_DONE;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 31))
+       /* Filter notifications meant for non Broadcom devices */
+       if ((ifa->ifa_dev->dev->netdev_ops != &dhd_ops_pri) &&
+           (ifa->ifa_dev->dev->netdev_ops != &dhd_ops_virt)) {
+#if defined(WL_ENABLE_P2P_IF)
+               if (!wl_cfgp2p_is_ifops(ifa->ifa_dev->dev->netdev_ops))
+#endif /* WL_ENABLE_P2P_IF */
+                       return NOTIFY_DONE;
+       }
+#endif /* LINUX_VERSION_CODE */
+
+       dhd = DHD_DEV_INFO(ifa->ifa_dev->dev);
+       if (!dhd)
+               return NOTIFY_DONE;
+
+       dhd_pub = &dhd->pub;
+
+       if (dhd_pub->arp_version == 1) {
+               idx = 0;
+       } else {
+               for (idx = 0; idx < DHD_MAX_IFS; idx++) {
+                       if (dhd->iflist[idx] && dhd->iflist[idx]->net == ifa->ifa_dev->dev)
+                       break;
+               }
+               if (idx < DHD_MAX_IFS) {
+                       DHD_TRACE(("ifidx : %p %s %d\n", dhd->iflist[idx]->net,
+                               dhd->iflist[idx]->name, dhd->iflist[idx]->idx));
+               } else {
+                       DHD_ERROR(("Cannot find ifidx for(%s) set to 0\n", ifa->ifa_label));
+                       idx = 0;
+               }
+       }
+
+       switch (event) {
+               case NETDEV_UP:
+                       DHD_ARPOE(("%s: [%s] Up IP: 0x%x\n",
+                               __FUNCTION__, ifa->ifa_label, ifa->ifa_address));
+
+                       if (dhd->pub.busstate != DHD_BUS_DATA) {
+                               DHD_ERROR(("%s: bus not ready, exit\n", __FUNCTION__));
+                               if (dhd->pend_ipaddr) {
+                                       DHD_ERROR(("%s: overwrite pending ipaddr: 0x%x\n",
+                                               __FUNCTION__, dhd->pend_ipaddr));
+                               }
+                               dhd->pend_ipaddr = ifa->ifa_address;
+                               break;
+                       }
+
+#ifdef AOE_IP_ALIAS_SUPPORT
+                       DHD_ARPOE(("%s:add aliased IP to AOE hostip cache\n",
+                               __FUNCTION__));
+                       aoe_update_host_ipv4_table(dhd_pub, ifa->ifa_address, TRUE, idx);
+#endif /* AOE_IP_ALIAS_SUPPORT */
+                       break;
+
+               case NETDEV_DOWN:
+                       DHD_ARPOE(("%s: [%s] Down IP: 0x%x\n",
+                               __FUNCTION__, ifa->ifa_label, ifa->ifa_address));
+                       dhd->pend_ipaddr = 0;
+#ifdef AOE_IP_ALIAS_SUPPORT
+                       DHD_ARPOE(("%s:interface is down, AOE clr all for this if\n",
+                               __FUNCTION__));
+                       aoe_update_host_ipv4_table(dhd_pub, ifa->ifa_address, FALSE, idx);
+#else
+                       dhd_aoe_hostip_clr(&dhd->pub, idx);
+                       dhd_aoe_arp_clr(&dhd->pub, idx);
+#endif /* AOE_IP_ALIAS_SUPPORT */
+                       break;
+
+               default:
+                       DHD_ARPOE(("%s: do noting for [%s] Event: %lu\n",
+                               __func__, ifa->ifa_label, event));
+                       break;
+       }
+       return NOTIFY_DONE;
+}
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+#if defined(CONFIG_IPV6) && defined(IPV6_NDO_SUPPORT)
+/* Neighbor Discovery Offload: defered handler */
+static void
+dhd_inet6_work_handler(void *dhd_info, void *event_data, u8 event)
+{
+       struct ipv6_work_info_t *ndo_work = (struct ipv6_work_info_t *)event_data;
+       dhd_pub_t       *pub = &((dhd_info_t *)dhd_info)->pub;
+       int             ret;
+
+       if (event != DHD_WQ_WORK_IPV6_NDO) {
+               DHD_ERROR(("%s: unexpected event \n", __FUNCTION__));
+               return;
+       }
+
+       if (!ndo_work) {
+               DHD_ERROR(("%s: ipv6 work info is not initialized \n", __FUNCTION__));
+               return;
+       }
+
+       if (!pub) {
+               DHD_ERROR(("%s: dhd pub is not initialized \n", __FUNCTION__));
+               return;
+       }
+
+       if (ndo_work->if_idx) {
+               DHD_ERROR(("%s: idx %d \n", __FUNCTION__, ndo_work->if_idx));
+               return;
+       }
+
+       switch (ndo_work->event) {
+               case NETDEV_UP:
+                       DHD_TRACE(("%s: Enable NDO and add ipv6 into table \n ", __FUNCTION__));
+                       ret = dhd_ndo_enable(pub, TRUE);
+                       if (ret < 0) {
+                               DHD_ERROR(("%s: Enabling NDO Failed %d\n", __FUNCTION__, ret));
+                       }
+
+                       ret = dhd_ndo_add_ip(pub, &ndo_work->ipv6_addr[0], ndo_work->if_idx);
+                       if (ret < 0) {
+                               DHD_ERROR(("%s: Adding host ip for NDO failed %d\n",
+                                       __FUNCTION__, ret));
+                       }
+                       break;
+               case NETDEV_DOWN:
+                       DHD_TRACE(("%s: clear ipv6 table \n", __FUNCTION__));
+                       ret = dhd_ndo_remove_ip(pub, ndo_work->if_idx);
+                       if (ret < 0) {
+                               DHD_ERROR(("%s: Removing host ip for NDO failed %d\n",
+                                       __FUNCTION__, ret));
+                               goto done;
+                       }
+
+                       ret = dhd_ndo_enable(pub, FALSE);
+                       if (ret < 0) {
+                               DHD_ERROR(("%s: disabling NDO Failed %d\n", __FUNCTION__, ret));
+                               goto done;
+                       }
+                       break;
+               default:
+                       DHD_ERROR(("%s: unknown notifier event \n", __FUNCTION__));
+                       break;
+       }
+done:
+       /* free ndo_work. alloced while scheduling the work */
+       kfree(ndo_work);
+
+       return;
+}
+
+/*
+ * Neighbor Discovery Offload: Called when an interface
+ * is assigned with ipv6 address.
+ * Handles only primary interface
+ */
+static int dhd_inet6addr_notifier_call(struct notifier_block *this,
+       unsigned long event,
+       void *ptr)
+{
+       dhd_info_t *dhd;
+       dhd_pub_t *dhd_pub;
+       struct inet6_ifaddr *inet6_ifa = ptr;
+       struct in6_addr *ipv6_addr = &inet6_ifa->addr;
+       struct ipv6_work_info_t *ndo_info;
+       int idx = 0; /* REVISIT */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 31))
+       /* Filter notifications meant for non Broadcom devices */
+       if (inet6_ifa->idev->dev->netdev_ops != &dhd_ops_pri) {
+                       return NOTIFY_DONE;
+       }
+#endif /* LINUX_VERSION_CODE */
+
+       dhd = DHD_DEV_INFO(inet6_ifa->idev->dev);
+       if (!dhd)
+               return NOTIFY_DONE;
+
+       if (dhd->iflist[idx] && dhd->iflist[idx]->net != inet6_ifa->idev->dev)
+               return NOTIFY_DONE;
+       dhd_pub = &dhd->pub;
+
+       if (!FW_SUPPORTED(dhd_pub, ndoe))
+               return NOTIFY_DONE;
+
+       ndo_info = (struct ipv6_work_info_t *)kzalloc(sizeof(struct ipv6_work_info_t), GFP_ATOMIC);
+       if (!ndo_info) {
+               DHD_ERROR(("%s: ipv6 work alloc failed\n", __FUNCTION__));
+               return NOTIFY_DONE;
+       }
+
+       ndo_info->event = event;
+       ndo_info->if_idx = idx;
+       memcpy(&ndo_info->ipv6_addr[0], ipv6_addr, IPV6_ADDR_LEN);
+
+       /* defer the work to thread as it may block kernel */
+       dhd_deferred_schedule_work(dhd->dhd_deferred_wq, (void *)ndo_info, DHD_WQ_WORK_IPV6_NDO,
+               dhd_inet6_work_handler, DHD_WORK_PRIORITY_LOW);
+       return NOTIFY_DONE;
+}
+#endif /* CONFIG_IPV6 && IPV6_NDO_SUPPORT */
+
+int
+dhd_register_if(dhd_pub_t *dhdp, int ifidx, bool need_rtnl_lock)
+{
+       dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+       dhd_if_t *ifp;
+       struct net_device *net = NULL;
+       int err = 0;
+       uint8 temp_addr[ETHER_ADDR_LEN] = { 0x00, 0x90, 0x4c, 0x11, 0x22, 0x33 };
+
+       DHD_TRACE(("%s: ifidx %d\n", __FUNCTION__, ifidx));
+
+       ASSERT(dhd && dhd->iflist[ifidx]);
+       ifp = dhd->iflist[ifidx];
+       net = ifp->net;
+       ASSERT(net && (ifp->idx == ifidx));
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31))
+       ASSERT(!net->open);
+       net->get_stats = dhd_get_stats;
+       net->do_ioctl = dhd_ioctl_entry;
+       net->hard_start_xmit = dhd_start_xmit;
+       net->set_mac_address = dhd_set_mac_address;
+       net->set_multicast_list = dhd_set_multicast_list;
+       net->open = net->stop = NULL;
+#else
+       ASSERT(!net->netdev_ops);
+       net->netdev_ops = &dhd_ops_virt;
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31) */
+
+       /* Ok, link into the network layer... */
+       if (ifidx == 0) {
+               /*
+                * device functions for the primary interface only
+                */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31))
+               net->open = dhd_open;
+               net->stop = dhd_stop;
+#else
+               net->netdev_ops = &dhd_ops_pri;
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31) */
+               if (!ETHER_ISNULLADDR(dhd->pub.mac.octet))
+                       memcpy(temp_addr, dhd->pub.mac.octet, ETHER_ADDR_LEN);
+       } else {
+               /*
+                * We have to use the primary MAC for virtual interfaces
+                */
+               memcpy(temp_addr, ifp->mac_addr, ETHER_ADDR_LEN);
+               /*
+                * Android sets the locally administered bit to indicate that this is a
+                * portable hotspot.  This will not work in simultaneous AP/STA mode,
+                * nor with P2P.  Need to set the Donlge's MAC address, and then use that.
+                */
+               if (!memcmp(temp_addr, dhd->iflist[0]->mac_addr,
+                       ETHER_ADDR_LEN)) {
+                       DHD_ERROR(("%s interface [%s]: set locally administered bit in MAC\n",
+                       __func__, net->name));
+                       temp_addr[0] |= 0x02;
+               }
+       }
+
+       net->hard_header_len = ETH_HLEN + dhd->pub.hdrlen;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24)
+       net->ethtool_ops = &dhd_ethtool_ops;
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24) */
+
+#if defined(WL_WIRELESS_EXT)
+#if WIRELESS_EXT < 19
+       net->get_wireless_stats = dhd_get_wireless_stats;
+#endif /* WIRELESS_EXT < 19 */
+#if WIRELESS_EXT > 12
+       net->wireless_handlers = (struct iw_handler_def *)&wl_iw_handler_def;
+#endif /* WIRELESS_EXT > 12 */
+#endif /* defined(WL_WIRELESS_EXT) */
+
+       dhd->pub.rxsz = DBUS_RX_BUFFER_SIZE_DHD(net);
+
+       memcpy(net->dev_addr, temp_addr, ETHER_ADDR_LEN);
+
+       if (ifidx == 0)
+               printf("%s\n", dhd_version);
+
+       if (need_rtnl_lock)
+               err = register_netdev(net);
+       else
+               err = register_netdevice(net);
+
+       if (err != 0) {
+               DHD_ERROR(("couldn't register the net device [%s], err %d\n", net->name, err));
+               goto fail;
+       }
+
+
+
+       printf("Register interface [%s]  MAC: "MACDBG"\n\n", net->name,
+#if defined(CUSTOMER_HW4_DEBUG)
+               MAC2STRDBG(dhd->pub.mac.octet));
+#else
+               MAC2STRDBG(net->dev_addr));
+#endif /* CUSTOMER_HW4_DEBUG */
+
+#if defined(SOFTAP) && defined(WL_WIRELESS_EXT) && !defined(WL_CFG80211)
+               wl_iw_iscan_set_scan_broadcast_prep(net, 1);
+#endif
+
+#if (defined(BCMPCIE) || (defined(BCMLXSDMMC) && (LINUX_VERSION_CODE >= \
+       KERNEL_VERSION(2, 6, 27))))
+       if (ifidx == 0) {
+#ifdef BCMLXSDMMC
+               up(&dhd_registration_sem);
+#endif /* BCMLXSDMMC */
+#ifndef ENABLE_INSMOD_NO_FW_LOAD
+               if (!dhd_download_fw_on_driverload) {
+#ifdef WL_CFG80211
+                       wl_terminate_event_handler(DHD_GET_CFG80211_PRIV(dhdp));
+#endif /* WL_CFG80211 */
+#if defined(DHD_LB) && defined(DHD_LB_RXP)
+                       __skb_queue_purge(&dhd->rx_pend_queue);
+#endif /* DHD_LB && DHD_LB_RXP */
+#if defined(BCMPCIE) && defined(DHDTCPACK_SUPPRESS)
+                       dhd_tcpack_suppress_set(dhdp, TCPACK_SUP_OFF);
+#endif /* BCMPCIE && DHDTCPACK_SUPPRESS */
+                       dhd_net_bus_devreset(net, TRUE);
+#ifdef BCMLXSDMMC
+                       dhd_net_bus_suspend(net);
+#endif /* BCMLXSDMMC */
+                       wifi_platform_set_power(dhdp->info->adapter, FALSE, WIFI_TURNOFF_DELAY);
+               }
+#endif /* ENABLE_INSMOD_NO_FW_LOAD */
+       }
+#endif /* OEM_ANDROID && (BCMPCIE || (BCMLXSDMMC && KERNEL_VERSION >= 2.6.27)) */
+       return 0;
+
+fail:
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31)
+       net->open = NULL;
+#else
+       net->netdev_ops = NULL;
+#endif
+       return err;
+}
+
+void
+dhd_bus_detach(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (dhdp) {
+               dhd = (dhd_info_t *)dhdp->info;
+               if (dhd) {
+
+                       /*
+                        * In case of Android cfg80211 driver, the bus is down in dhd_stop,
+                        *  calling stop again will cuase SD read/write errors.
+                        */
+                       if (dhd->pub.busstate != DHD_BUS_DOWN) {
+                               /* Stop the protocol module */
+                               dhd_prot_stop(&dhd->pub);
+
+                               /* Stop the bus module */
+                               dhd_bus_stop(dhd->pub.bus, TRUE);
+                       }
+
+#if defined(OOB_INTR_ONLY) || defined(BCMPCIE_OOB_HOST_WAKE)
+                       OOB_PARAM_IF(!(dhdp->oob_disable)) {
+                               dhd_bus_oob_intr_unregister(dhdp);
+                       }
+#endif 
+               }
+       }
+}
+
+
+void dhd_detach(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd;
+       unsigned long flags;
+       int timer_valid = FALSE;
+       struct net_device *dev;
+
+       if (!dhdp)
+               return;
+
+       dhd = (dhd_info_t *)dhdp->info;
+       if (!dhd)
+               return;
+
+       dev = dhd->iflist[0]->net;
+
+       if (dev) {
+               rtnl_lock();
+               if (dev->flags & IFF_UP) {
+                       /* If IFF_UP is still up, it indicates that
+                        * "ifconfig wlan0 down" hasn't been called.
+                        * So invoke dev_close explicitly here to
+                        * bring down the interface.
+                        */
+                       DHD_TRACE(("IFF_UP flag is up. Enforcing dev_close from detach \n"));
+                       dev_close(dev);
+               }
+               rtnl_unlock();
+       }
+
+       DHD_TRACE(("%s: Enter state 0x%x\n", __FUNCTION__, dhd->dhd_state));
+
+       dhd->pub.up = 0;
+       if (!(dhd->dhd_state & DHD_ATTACH_STATE_DONE)) {
+               /* Give sufficient time for threads to start running in case
+                * dhd_attach() has failed
+                */
+               OSL_SLEEP(100);
+       }
+
+#if defined(BCM_DNGL_EMBEDIMAGE) || defined(BCM_REQUEST_FW)
+#endif /* defined(BCM_DNGL_EMBEDIMAGE) || defined(BCM_REQUEST_FW) */
+
+#ifdef PROP_TXSTATUS
+#ifdef DHD_WLFC_THREAD
+       if (dhd->pub.wlfc_thread) {
+               kthread_stop(dhd->pub.wlfc_thread);
+               dhdp->wlfc_thread_go = TRUE;
+               wake_up_interruptible(&dhdp->wlfc_wqhead);
+       }
+       dhd->pub.wlfc_thread = NULL;
+#endif /* DHD_WLFC_THREAD */
+#endif /* PROP_TXSTATUS */
+
+       if (dhd->dhd_state & DHD_ATTACH_STATE_PROT_ATTACH) {
+
+               dhd_bus_detach(dhdp);
+#ifdef BCMPCIE
+               if (is_reboot == SYS_RESTART) {
+                       extern bcmdhd_wifi_platdata_t *dhd_wifi_platdata;
+                       if (dhd_wifi_platdata && !dhdp->dongle_reset) {
+                               dhdpcie_bus_clock_stop(dhdp->bus);
+                               wifi_platform_set_power(dhd_wifi_platdata->adapters,
+                                       FALSE, WIFI_TURNOFF_DELAY);
+                       }
+               }
+#endif /* BCMPCIE */
+#ifndef PCIE_FULL_DONGLE
+               if (dhdp->prot)
+                       dhd_prot_detach(dhdp);
+#endif
+       }
+
+#ifdef ARP_OFFLOAD_SUPPORT
+       if (dhd_inetaddr_notifier_registered) {
+               dhd_inetaddr_notifier_registered = FALSE;
+               unregister_inetaddr_notifier(&dhd_inetaddr_notifier);
+       }
+#endif /* ARP_OFFLOAD_SUPPORT */
+#if defined(CONFIG_IPV6) && defined(IPV6_NDO_SUPPORT)
+       if (dhd_inet6addr_notifier_registered) {
+               dhd_inet6addr_notifier_registered = FALSE;
+               unregister_inet6addr_notifier(&dhd_inet6addr_notifier);
+       }
+#endif /* CONFIG_IPV6 && IPV6_NDO_SUPPORT */
+#if defined(CONFIG_HAS_EARLYSUSPEND) && defined(DHD_USE_EARLYSUSPEND)
+       if (dhd->dhd_state & DHD_ATTACH_STATE_EARLYSUSPEND_DONE) {
+               if (dhd->early_suspend.suspend)
+                       unregister_early_suspend(&dhd->early_suspend);
+       }
+#endif /* CONFIG_HAS_EARLYSUSPEND && DHD_USE_EARLYSUSPEND */
+
+#if defined(WL_WIRELESS_EXT)
+       if (dhd->dhd_state & DHD_ATTACH_STATE_WL_ATTACH) {
+               /* Detatch and unlink in the iw */
+               wl_iw_detach();
+       }
+#endif /* defined(WL_WIRELESS_EXT) */
+
+       /* delete all interfaces, start with virtual  */
+       if (dhd->dhd_state & DHD_ATTACH_STATE_ADD_IF) {
+               int i = 1;
+               dhd_if_t *ifp;
+
+               /* Cleanup virtual interfaces */
+               dhd_net_if_lock_local(dhd);
+               for (i = 1; i < DHD_MAX_IFS; i++) {
+                       if (dhd->iflist[i])
+                               dhd_remove_if(&dhd->pub, i, TRUE);
+               }
+
+               /*  delete primary interface 0 */
+               ifp = dhd->iflist[0];
+               ASSERT(ifp);
+               ASSERT(ifp->net);
+               if (ifp && ifp->net) {
+
+
+
+                       /* in unregister_netdev case, the interface gets freed by net->destructor
+                        * (which is set to free_netdev)
+                        */
+                       if (ifp->net->reg_state == NETREG_UNINITIALIZED) {
+                               free_netdev(ifp->net);
+                       } else {
+#ifdef SET_RPS_CPUS
+                               custom_rps_map_clear(ifp->net->_rx);
+#endif /* SET_RPS_CPUS */
+                               netif_tx_disable(ifp->net);
+                               unregister_netdev(ifp->net);
+                       }
+                       ifp->net = NULL;
+#ifdef DHD_WMF
+                       dhd_wmf_cleanup(dhdp, 0);
+#endif /* DHD_WMF */
+#ifdef DHD_L2_FILTER
+                       bcm_l2_filter_arp_table_update(dhdp->osh, ifp->phnd_arp_table, TRUE,
+                               NULL, FALSE, dhdp->tickcnt);
+                       deinit_l2_filter_arp_table(dhdp->osh, ifp->phnd_arp_table);
+                       ifp->phnd_arp_table = NULL;
+#endif /* DHD_L2_FILTER */
+
+                       dhd_if_del_sta_list(ifp);
+
+                       MFREE(dhd->pub.osh, ifp, sizeof(*ifp));
+                       dhd->iflist[0] = NULL;
+               }
+               dhd_net_if_unlock_local(dhd);
+       }
+
+       /* Clear the watchdog timer */
+       DHD_GENERAL_LOCK(&dhd->pub, flags);
+       timer_valid = dhd->wd_timer_valid;
+       dhd->wd_timer_valid = FALSE;
+       DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+       if (timer_valid)
+               del_timer_sync(&dhd->timer);
+       DHD_DISABLE_RUNTIME_PM(&dhd->pub);
+
+       if (dhd->dhd_state & DHD_ATTACH_STATE_THREADS_CREATED) {
+#ifdef DHD_PCIE_RUNTIMEPM
+               if (dhd->thr_rpm_ctl.thr_pid >= 0) {
+                       PROC_STOP(&dhd->thr_rpm_ctl);
+               }
+#endif /* DHD_PCIE_RUNTIMEPM */
+               if (dhd->thr_wdt_ctl.thr_pid >= 0) {
+                       PROC_STOP(&dhd->thr_wdt_ctl);
+               }
+
+               if (dhd->rxthread_enabled && dhd->thr_rxf_ctl.thr_pid >= 0) {
+                       PROC_STOP(&dhd->thr_rxf_ctl);
+               }
+
+               if (dhd->thr_dpc_ctl.thr_pid >= 0) {
+                       PROC_STOP(&dhd->thr_dpc_ctl);
+               } else {
+                       tasklet_kill(&dhd->tasklet);
+#ifdef DHD_LB_RXP
+                       __skb_queue_purge(&dhd->rx_pend_queue);
+#endif /* DHD_LB_RXP */
+               }
+       }
+
+#if defined(DHD_LB)
+       /* Kill the Load Balancing Tasklets */
+#if defined(DHD_LB_TXC)
+       tasklet_disable(&dhd->tx_compl_tasklet);
+       tasklet_kill(&dhd->tx_compl_tasklet);
+#endif /* DHD_LB_TXC */
+#if defined(DHD_LB_RXC)
+       tasklet_disable(&dhd->rx_compl_tasklet);
+       tasklet_kill(&dhd->rx_compl_tasklet);
+#endif /* DHD_LB_RXC */
+       if (dhd->cpu_notifier.notifier_call != NULL)
+               unregister_cpu_notifier(&dhd->cpu_notifier);
+       dhd_cpumasks_deinit(dhd);
+#endif /* DHD_LB */
+
+#ifdef DHD_LOG_DUMP
+       dhd_log_dump_deinit(&dhd->pub);
+#endif /* DHD_LOG_DUMP */
+#ifdef WL_CFG80211
+       if (dhd->dhd_state & DHD_ATTACH_STATE_CFG80211) {
+               wl_cfg80211_detach(DHD_GET_CFG80211_PRIV(dhdp));
+               dhdp->cfg80211_priv = NULL;
+               dhd_monitor_uninit();
+       }
+#endif
+       /* free deferred work queue */
+       dhd_deferred_work_deinit(dhd->dhd_deferred_wq);
+       dhd->dhd_deferred_wq = NULL;
+
+#ifdef SHOW_LOGTRACE
+       if (dhd->event_data.fmts)
+               kfree(dhd->event_data.fmts);
+       if (dhd->event_data.raw_fmts)
+               kfree(dhd->event_data.raw_fmts);
+       if (dhd->event_data.raw_sstr)
+               kfree(dhd->event_data.raw_sstr);
+#endif /* SHOW_LOGTRACE */
+
+#ifdef PNO_SUPPORT
+       if (dhdp->pno_state)
+               dhd_pno_deinit(dhdp);
+#endif
+#if defined(CONFIG_PM_SLEEP)
+       if (dhd_pm_notifier_registered) {
+               unregister_pm_notifier(&dhd->pm_notifier);
+               dhd_pm_notifier_registered = FALSE;
+       }
+#endif /* CONFIG_PM_SLEEP */
+
+#ifdef DEBUG_CPU_FREQ
+               if (dhd->new_freq)
+                       free_percpu(dhd->new_freq);
+               dhd->new_freq = NULL;
+               cpufreq_unregister_notifier(&dhd->freq_trans, CPUFREQ_TRANSITION_NOTIFIER);
+#endif
+       if (dhd->dhd_state & DHD_ATTACH_STATE_WAKELOCKS_INIT) {
+               DHD_TRACE(("wd wakelock count:%d\n", dhd->wakelock_wd_counter));
+#ifdef CONFIG_HAS_WAKELOCK
+               dhd->wakelock_wd_counter = 0;
+               wake_lock_destroy(&dhd->wl_wdwake);
+#endif /* CONFIG_HAS_WAKELOCK */
+               DHD_OS_WAKE_LOCK_DESTROY(dhd);
+       }
+
+
+
+#ifdef DHDTCPACK_SUPPRESS
+       /* This will free all MEM allocated for TCPACK SUPPRESS */
+       dhd_tcpack_suppress_set(&dhd->pub, TCPACK_SUP_OFF);
+#endif /* DHDTCPACK_SUPPRESS */
+
+#ifdef PCIE_FULL_DONGLE
+               dhd_flow_rings_deinit(dhdp);
+               if (dhdp->prot)
+                       dhd_prot_detach(dhdp);
+#endif
+
+
+       dhd_sysfs_exit(dhd);
+       dhd->pub.is_fw_download_done = FALSE;
+}
+
+
+void
+dhd_free(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd;
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (dhdp) {
+               int i;
+               for (i = 0; i < ARRAYSIZE(dhdp->reorder_bufs); i++) {
+                       if (dhdp->reorder_bufs[i]) {
+                               reorder_info_t *ptr;
+                               uint32 buf_size = sizeof(struct reorder_info);
+
+                               ptr = dhdp->reorder_bufs[i];
+
+                               buf_size += ((ptr->max_idx + 1) * sizeof(void*));
+                               DHD_REORDER(("free flow id buf %d, maxidx is %d, buf_size %d\n",
+                                       i, ptr->max_idx, buf_size));
+
+                               MFREE(dhdp->osh, dhdp->reorder_bufs[i], buf_size);
+                               dhdp->reorder_bufs[i] = NULL;
+                       }
+               }
+
+               dhd_sta_pool_fini(dhdp, DHD_MAX_STA);
+
+               dhd = (dhd_info_t *)dhdp->info;
+               if (dhdp->soc_ram) {
+#if defined(CONFIG_DHD_USE_STATIC_BUF) && defined(DHD_USE_STATIC_MEMDUMP)
+                       DHD_OS_PREFREE(dhdp, dhdp->soc_ram, dhdp->soc_ram_length);
+#else
+                       MFREE(dhdp->osh, dhdp->soc_ram, dhdp->soc_ram_length);
+#endif /* CONFIG_DHD_USE_STATIC_BUF && DHD_USE_STATIC_MEMDUMP */
+                       dhdp->soc_ram = NULL;
+               }
+#ifdef CACHE_FW_IMAGES
+               if (dhdp->cached_fw) {
+                       MFREE(dhdp->osh, dhdp->cached_fw, dhdp->bus->ramsize);
+                       dhdp->cached_fw = NULL;
+               }
+
+               if (dhdp->cached_nvram) {
+                       MFREE(dhdp->osh, dhdp->cached_nvram, MAX_NVRAMBUF_SIZE);
+                       dhdp->cached_nvram = NULL;
+               }
+#endif
+               /* If pointer is allocated by dhd_os_prealloc then avoid MFREE */
+               if (dhd &&
+                       dhd != (dhd_info_t *)dhd_os_prealloc(dhdp, DHD_PREALLOC_DHD_INFO, 0, FALSE))
+                       MFREE(dhd->pub.osh, dhd, sizeof(*dhd));
+               dhd = NULL;
+       }
+}
+
+void
+dhd_clear(dhd_pub_t *dhdp)
+{
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (dhdp) {
+               int i;
+#ifdef DHDTCPACK_SUPPRESS
+               /* Clean up timer/data structure for any remaining/pending packet or timer. */
+               dhd_tcpack_info_tbl_clean(dhdp);
+#endif /* DHDTCPACK_SUPPRESS */
+               for (i = 0; i < ARRAYSIZE(dhdp->reorder_bufs); i++) {
+                       if (dhdp->reorder_bufs[i]) {
+                               reorder_info_t *ptr;
+                               uint32 buf_size = sizeof(struct reorder_info);
+
+                               ptr = dhdp->reorder_bufs[i];
+
+                               buf_size += ((ptr->max_idx + 1) * sizeof(void*));
+                               DHD_REORDER(("free flow id buf %d, maxidx is %d, buf_size %d\n",
+                                       i, ptr->max_idx, buf_size));
+
+                               MFREE(dhdp->osh, dhdp->reorder_bufs[i], buf_size);
+                               dhdp->reorder_bufs[i] = NULL;
+                       }
+               }
+
+               dhd_sta_pool_clear(dhdp, DHD_MAX_STA);
+
+               if (dhdp->soc_ram) {
+#if defined(CONFIG_DHD_USE_STATIC_BUF) && defined(DHD_USE_STATIC_MEMDUMP)
+                       DHD_OS_PREFREE(dhdp, dhdp->soc_ram, dhdp->soc_ram_length);
+#else
+                       MFREE(dhdp->osh, dhdp->soc_ram, dhdp->soc_ram_length);
+#endif /* CONFIG_DHD_USE_STATIC_BUF && DHD_USE_STATIC_MEMDUMP */
+                       dhdp->soc_ram = NULL;
+               }
+       }
+}
+
+static void
+dhd_module_cleanup(void)
+{
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       dhd_bus_unregister();
+
+       wl_android_exit();
+
+       dhd_wifi_platform_unregister_drv();
+}
+
+static void __exit
+dhd_module_exit(void)
+{
+       dhd_buzzz_detach();
+       dhd_module_cleanup();
+       unregister_reboot_notifier(&dhd_reboot_notifier);
+}
+
+static int __init
+dhd_module_init(void)
+{
+       int err;
+       int retry = POWERUP_MAX_RETRY;
+
+       DHD_ERROR(("%s in\n", __FUNCTION__));
+
+       dhd_buzzz_attach();
+
+       DHD_PERIM_RADIO_INIT();
+
+
+       if (firmware_path[0] != '\0') {
+               strncpy(fw_bak_path, firmware_path, MOD_PARAM_PATHLEN);
+               fw_bak_path[MOD_PARAM_PATHLEN-1] = '\0';
+       }
+
+       if (nvram_path[0] != '\0') {
+               strncpy(nv_bak_path, nvram_path, MOD_PARAM_PATHLEN);
+               nv_bak_path[MOD_PARAM_PATHLEN-1] = '\0';
+       }
+
+       do {
+               err = dhd_wifi_platform_register_drv();
+               if (!err) {
+                       register_reboot_notifier(&dhd_reboot_notifier);
+                       break;
+               }
+               else {
+                       DHD_ERROR(("%s: Failed to load the driver, try cnt %d\n",
+                               __FUNCTION__, retry));
+                       strncpy(firmware_path, fw_bak_path, MOD_PARAM_PATHLEN);
+                       firmware_path[MOD_PARAM_PATHLEN-1] = '\0';
+                       strncpy(nvram_path, nv_bak_path, MOD_PARAM_PATHLEN);
+                       nvram_path[MOD_PARAM_PATHLEN-1] = '\0';
+               }
+       } while (retry--);
+
+       if (err) {
+               DHD_ERROR(("%s: Failed to load driver max retry reached**\n", __FUNCTION__));
+       } else {
+               if (!dhd_download_fw_on_driverload) {
+                       dhd_driver_init_done = TRUE;
+               }
+       }
+
+       DHD_ERROR(("%s out\n", __FUNCTION__));
+
+       return err;
+}
+
+static int
+dhd_reboot_callback(struct notifier_block *this, unsigned long code, void *unused)
+{
+       DHD_TRACE(("%s: code = %ld\n", __FUNCTION__, code));
+       if (code == SYS_RESTART) {
+#ifdef BCMPCIE
+               is_reboot = code;
+#endif /* BCMPCIE */
+       }
+       return NOTIFY_DONE;
+}
+
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)
+#if defined(CONFIG_DEFERRED_INITCALLS)
+#if defined(CONFIG_MACH_UNIVERSAL7420) || defined(CONFIG_SOC_EXYNOS8890) || \
+       defined(CONFIG_ARCH_MSM8996)
+deferred_module_init_sync(dhd_module_init);
+#else
+deferred_module_init(dhd_module_init);
+#endif /* CONFIG_MACH_UNIVERSAL7420 || CONFIG_SOC_EXYNOS8890 ||
+       * CONFIG_ARCH_MSM8996
+       */
+#elif defined(USE_LATE_INITCALL_SYNC)
+late_initcall_sync(dhd_module_init);
+#else
+late_initcall(dhd_module_init);
+#endif /* USE_LATE_INITCALL_SYNC */
+#else
+module_init(dhd_module_init);
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0) */
+
+module_exit(dhd_module_exit);
+
+/*
+ * OS specific functions required to implement DHD driver in OS independent way
+ */
+int
+dhd_os_proto_block(dhd_pub_t *pub)
+{
+       dhd_info_t * dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               DHD_PERIM_UNLOCK(pub);
+
+               down(&dhd->proto_sem);
+
+               DHD_PERIM_LOCK(pub);
+               return 1;
+       }
+
+       return 0;
+}
+
+int
+dhd_os_proto_unblock(dhd_pub_t *pub)
+{
+       dhd_info_t * dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               up(&dhd->proto_sem);
+               return 1;
+       }
+
+       return 0;
+}
+
+void
+dhd_os_dhdiovar_lock(dhd_pub_t *pub)
+{
+       dhd_info_t * dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               mutex_lock(&dhd->dhd_iovar_mutex);
+       }
+}
+
+void
+dhd_os_dhdiovar_unlock(dhd_pub_t *pub)
+{
+       dhd_info_t * dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               mutex_unlock(&dhd->dhd_iovar_mutex);
+       }
+}
+
+unsigned int
+dhd_os_get_ioctl_resp_timeout(void)
+{
+       return ((unsigned int)dhd_ioctl_timeout_msec);
+}
+
+void
+dhd_os_set_ioctl_resp_timeout(unsigned int timeout_msec)
+{
+       dhd_ioctl_timeout_msec = (int)timeout_msec;
+}
+
+int
+dhd_os_ioctl_resp_wait(dhd_pub_t *pub, uint *condition)
+{
+       dhd_info_t * dhd = (dhd_info_t *)(pub->info);
+       int timeout;
+
+       /* Convert timeout in millsecond to jiffies */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+       timeout = msecs_to_jiffies(dhd_ioctl_timeout_msec);
+#else
+       timeout = dhd_ioctl_timeout_msec * HZ / 1000;
+#endif
+
+       DHD_PERIM_UNLOCK(pub);
+
+       timeout = wait_event_timeout(dhd->ioctl_resp_wait, (*condition), timeout);
+
+       DHD_PERIM_LOCK(pub);
+
+       return timeout;
+}
+
+int
+dhd_os_ioctl_resp_wake(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       wake_up(&dhd->ioctl_resp_wait);
+       return 0;
+}
+
+int
+dhd_os_d3ack_wait(dhd_pub_t *pub, uint *condition)
+{
+       dhd_info_t * dhd = (dhd_info_t *)(pub->info);
+       int timeout;
+
+       /* Convert timeout in millsecond to jiffies */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+       timeout = msecs_to_jiffies(dhd_ioctl_timeout_msec);
+#else
+       timeout = dhd_ioctl_timeout_msec * HZ / 1000;
+#endif
+
+       DHD_PERIM_UNLOCK(pub);
+
+       timeout = wait_event_timeout(dhd->d3ack_wait, (*condition), timeout);
+
+       DHD_PERIM_LOCK(pub);
+
+       return timeout;
+}
+
+int
+dhd_os_d3ack_wake(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       wake_up(&dhd->d3ack_wait);
+       return 0;
+}
+
+int
+dhd_os_busbusy_wait_negation(dhd_pub_t *pub, uint *condition)
+{
+       dhd_info_t * dhd = (dhd_info_t *)(pub->info);
+       int timeout;
+
+       /* Wait for bus usage contexts to gracefully exit within some timeout value
+        * Set time out to little higher than dhd_ioctl_timeout_msec,
+        * so that IOCTL timeout should not get affected.
+        */
+       /* Convert timeout in millsecond to jiffies */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+       timeout = msecs_to_jiffies(DHD_BUS_BUSY_TIMEOUT);
+#else
+       timeout = DHD_BUS_BUSY_TIMEOUT * HZ / 1000;
+#endif
+
+       timeout = wait_event_timeout(dhd->dhd_bus_busy_state_wait, !(*condition), timeout);
+
+       return timeout;
+}
+
+int INLINE
+dhd_os_busbusy_wake(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       /* Call wmb() to make sure before waking up the other event value gets updated */
+       OSL_SMP_WMB();
+       wake_up(&dhd->dhd_bus_busy_state_wait);
+       return 0;
+}
+
+void
+dhd_os_wd_timer_extend(void *bus, bool extend)
+{
+       dhd_pub_t *pub = bus;
+       dhd_info_t *dhd = (dhd_info_t *)pub->info;
+
+       if (extend)
+               dhd_os_wd_timer(bus, WATCHDOG_EXTEND_INTERVAL);
+       else
+               dhd_os_wd_timer(bus, dhd->default_wd_interval);
+}
+
+
+void
+dhd_os_wd_timer(void *bus, uint wdtick)
+{
+       dhd_pub_t *pub = bus;
+       dhd_info_t *dhd = (dhd_info_t *)pub->info;
+       unsigned long flags;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd NULL\n", __FUNCTION__));
+               return;
+       }
+
+#if !defined(DHD_USE_IDLECOUNT) && defined(BCMPCIE)
+       DHD_OS_WD_WAKE_LOCK(pub);
+#endif /* !DHD_USE_IDLECOUNT && BCMPCIE */
+       DHD_GENERAL_LOCK(pub, flags);
+
+       /* don't start the wd until fw is loaded */
+       if (pub->busstate == DHD_BUS_DOWN) {
+               DHD_GENERAL_UNLOCK(pub, flags);
+#if !defined(DHD_USE_IDLECOUNT) && defined(BCMPCIE)
+                       DHD_OS_WD_WAKE_UNLOCK(pub);
+#endif /* !DHD_USE_IDLECOUNT && BCMPCIE */
+               return;
+       }
+
+       /* Totally stop the timer */
+       if (!wdtick && dhd->wd_timer_valid == TRUE) {
+               dhd->wd_timer_valid = FALSE;
+               DHD_GENERAL_UNLOCK(pub, flags);
+               del_timer_sync(&dhd->timer);
+               DHD_OS_WD_WAKE_UNLOCK(pub);
+               return;
+       }
+
+       if (wdtick) {
+               DHD_OS_WD_WAKE_LOCK(pub);
+               dhd_watchdog_ms = (uint)wdtick;
+               /* Re arm the timer, at last watchdog period */
+               mod_timer(&dhd->timer, jiffies + msecs_to_jiffies(dhd_watchdog_ms));
+               dhd->wd_timer_valid = TRUE;
+       }
+       DHD_GENERAL_UNLOCK(pub, flags);
+#if !defined(DHD_USE_IDLECOUNT) && defined(BCMPCIE)
+       DHD_OS_WD_WAKE_UNLOCK(pub);
+#endif /* !DHD_USE_IDLECOUNT && BCMPCIE */
+}
+
+#ifdef DHD_PCIE_RUNTIMEPM
+void
+dhd_os_runtimepm_timer(void *bus, uint tick)
+{
+       dhd_pub_t *pub = bus;
+       dhd_info_t *dhd = (dhd_info_t *)pub->info;
+       unsigned long flags;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_GENERAL_LOCK(pub, flags);
+
+       /* don't start the RPM until fw is loaded */
+       if (pub->busstate == DHD_BUS_DOWN ||
+                       pub->busstate == DHD_BUS_DOWN_IN_PROGRESS) {
+               DHD_GENERAL_UNLOCK(pub, flags);
+               return;
+       }
+
+       /* If tick is non-zero, the request is to start the timer */
+       if (tick) {
+               /* Start the timer only if its not already running */
+               if (dhd->rpm_timer_valid == FALSE) {
+                       mod_timer(&dhd->rpm_timer, jiffies + msecs_to_jiffies(dhd_runtimepm_ms));
+                       dhd->rpm_timer_valid = TRUE;
+               }
+       } else {
+               /* tick is zero, we have to stop the timer */
+               /* Stop the timer only if its running, otherwise we don't have to do anything */
+               if (dhd->rpm_timer_valid == TRUE) {
+                       dhd->rpm_timer_valid = FALSE;
+                       DHD_GENERAL_UNLOCK(pub, flags);
+                       del_timer_sync(&dhd->rpm_timer);
+                       /* we have already released the lock, so just go to exit */
+                       goto exit;
+               }
+       }
+
+       DHD_GENERAL_UNLOCK(pub, flags);
+exit:
+       return;
+
+}
+
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+void *
+dhd_os_open_image(char *filename)
+{
+       struct file *fp;
+       int size;
+
+       fp = filp_open(filename, O_RDONLY, 0);
+       /*
+        * 2.6.11 (FC4) supports filp_open() but later revs don't?
+        * Alternative:
+        * fp = open_namei(AT_FDCWD, filename, O_RD, 0);
+        * ???
+        */
+        if (IS_ERR(fp)) {
+                fp = NULL;
+                goto err;
+        }
+
+        if (!S_ISREG(file_inode(fp)->i_mode)) {
+                DHD_ERROR(("%s: %s is not regular file\n", __FUNCTION__, filename));
+                fp = NULL;
+                goto err;
+        }
+
+        size = i_size_read(file_inode(fp));
+        if (size <= 0) {
+                DHD_ERROR(("%s: %s file size invalid %d\n", __FUNCTION__, filename, size));
+                fp = NULL;
+                goto err;
+        }
+
+        DHD_ERROR(("%s: %s (%d bytes) open success\n", __FUNCTION__, filename, size));
+
+err:
+        return fp;
+}
+
+int
+dhd_os_get_image_block(char *buf, int len, void *image)
+{
+       struct file *fp = (struct file *)image;
+       int rdlen;
+       int size;
+
+       if (!image)
+               return 0;
+
+       size = i_size_read(file_inode(fp));
+       rdlen = kernel_read(fp, fp->f_pos, buf, MIN(len, size));
+
+       if (len >= size && size != rdlen) {
+               return -EIO;
+       }
+
+       if (rdlen > 0)
+               fp->f_pos += rdlen;
+
+       return rdlen;
+}
+
+void
+dhd_os_close_image(void *image)
+{
+       if (image)
+               filp_close((struct file *)image, NULL);
+}
+
+int dhd_os_file_size(char *filename)
+{
+       struct file *fp = NULL;
+       int size = 0;
+       fp = filp_open(filename, O_RDONLY, 0);
+       if (IS_ERR(fp)) {
+               DHD_ERROR(("%s: File %s doesn't exist\n", __FUNCTION__, filename));
+               return BCME_ERROR;
+       }
+       size = i_size_read(file_inode(fp));
+       if (size <= 0) {
+                DHD_ERROR(("%s: %s file size invalid %d\n", __FUNCTION__, filename, size));
+       }
+       if (fp)
+               filp_close(fp, NULL);
+
+       return size;
+}
+
+void
+dhd_os_sdlock(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd;
+
+       dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd_dpc_prio >= 0)
+               down(&dhd->sdsem);
+       else
+               spin_lock_bh(&dhd->sdlock);
+}
+
+void
+dhd_os_sdunlock(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd;
+
+       dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd_dpc_prio >= 0)
+               up(&dhd->sdsem);
+       else
+               spin_unlock_bh(&dhd->sdlock);
+}
+
+void
+dhd_os_sdlock_txq(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd;
+
+       dhd = (dhd_info_t *)(pub->info);
+       spin_lock_bh(&dhd->txqlock);
+}
+
+void
+dhd_os_sdunlock_txq(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd;
+
+       dhd = (dhd_info_t *)(pub->info);
+       spin_unlock_bh(&dhd->txqlock);
+}
+
+void
+dhd_os_sdlock_rxq(dhd_pub_t *pub)
+{
+}
+
+void
+dhd_os_sdunlock_rxq(dhd_pub_t *pub)
+{
+}
+
+static void
+dhd_os_rxflock(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd;
+
+       dhd = (dhd_info_t *)(pub->info);
+       spin_lock_bh(&dhd->rxf_lock);
+
+}
+
+static void
+dhd_os_rxfunlock(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd;
+
+       dhd = (dhd_info_t *)(pub->info);
+       spin_unlock_bh(&dhd->rxf_lock);
+}
+
+#ifdef DHDTCPACK_SUPPRESS
+unsigned long
+dhd_os_tcpacklock(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd;
+       unsigned long flags = 0;
+
+       dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+#ifdef BCMSDIO
+               spin_lock_bh(&dhd->tcpack_lock);
+#else
+               spin_lock_irqsave(&dhd->tcpack_lock, flags);
+#endif /* BCMSDIO */
+       }
+
+       return flags;
+}
+
+void
+dhd_os_tcpackunlock(dhd_pub_t *pub, unsigned long flags)
+{
+       dhd_info_t *dhd;
+
+#ifdef BCMSDIO
+       BCM_REFERENCE(flags);
+#endif /* BCMSDIO */
+
+       dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+#ifdef BCMSDIO
+               spin_unlock_bh(&dhd->tcpack_lock);
+#else
+               spin_unlock_irqrestore(&dhd->tcpack_lock, flags);
+#endif /* BCMSDIO */
+       }
+}
+#endif /* DHDTCPACK_SUPPRESS */
+
+uint8* dhd_os_prealloc(dhd_pub_t *dhdpub, int section, uint size, bool kmalloc_if_fail)
+{
+       uint8* buf;
+       gfp_t flags = CAN_SLEEP() ? GFP_KERNEL: GFP_ATOMIC;
+
+       buf = (uint8*)wifi_platform_prealloc(dhdpub->info->adapter, section, size);
+       if (buf == NULL && kmalloc_if_fail)
+               buf = kmalloc(size, flags);
+
+       return buf;
+}
+
+void dhd_os_prefree(dhd_pub_t *dhdpub, void *addr, uint size)
+{
+}
+
+#if defined(WL_WIRELESS_EXT)
+struct iw_statistics *
+dhd_get_wireless_stats(struct net_device *dev)
+{
+       int res = 0;
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+       if (!dhd->pub.up) {
+               return NULL;
+       }
+
+       res = wl_iw_get_wireless_stats(dev, &dhd->iw.wstats);
+
+       if (res == 0)
+               return &dhd->iw.wstats;
+       else
+               return NULL;
+}
+#endif /* defined(WL_WIRELESS_EXT) */
+
+static int
+dhd_wl_host_event(dhd_info_t *dhd, int *ifidx, void *pktdata, size_t pktlen,
+       wl_event_msg_t *event, void **data)
+{
+       int bcmerror = 0;
+       ASSERT(dhd != NULL);
+
+#ifdef SHOW_LOGTRACE
+       bcmerror = wl_host_event(&dhd->pub, ifidx, pktdata, pktlen, event, data,
+               &dhd->event_data);
+#else
+       bcmerror = wl_host_event(&dhd->pub, ifidx, pktdata, pktlen, event, data,
+               NULL);
+#endif /* SHOW_LOGTRACE */
+
+       if (bcmerror != BCME_OK)
+               return (bcmerror);
+
+#if defined(WL_WIRELESS_EXT)
+       if (event->bsscfgidx == 0) {
+               /*
+                * Wireless ext is on primary interface only
+                */
+
+       ASSERT(dhd->iflist[*ifidx] != NULL);
+       ASSERT(dhd->iflist[*ifidx]->net != NULL);
+
+               if (dhd->iflist[*ifidx]->net) {
+               wl_iw_event(dhd->iflist[*ifidx]->net, event, *data);
+               }
+       }
+#endif /* defined(WL_WIRELESS_EXT)  */
+
+#ifdef WL_CFG80211
+       ASSERT(dhd->iflist[*ifidx] != NULL);
+       ASSERT(dhd->iflist[*ifidx]->net != NULL);
+       if (dhd->iflist[*ifidx]->net)
+               wl_cfg80211_event(dhd->iflist[*ifidx]->net, event, *data);
+#endif /* defined(WL_CFG80211) */
+
+       return (bcmerror);
+}
+
+/* send up locally generated event */
+void
+dhd_sendup_event(dhd_pub_t *dhdp, wl_event_msg_t *event, void *data)
+{
+       switch (ntoh32(event->event_type)) {
+
+       default:
+               break;
+       }
+}
+
+#ifdef LOG_INTO_TCPDUMP
+void
+dhd_sendup_log(dhd_pub_t *dhdp, void *data, int data_len)
+{
+       struct sk_buff *p, *skb;
+       uint32 pktlen;
+       int len;
+       dhd_if_t *ifp;
+       dhd_info_t *dhd;
+       uchar *skb_data;
+       int ifidx = 0;
+       struct ether_header eth;
+
+       pktlen = sizeof(eth) + data_len;
+       dhd = dhdp->info;
+
+       if ((p = PKTGET(dhdp->osh, pktlen, FALSE))) {
+               ASSERT(ISALIGNED((uintptr)PKTDATA(dhdp->osh, p), sizeof(uint32)));
+
+               bcopy(&dhdp->mac, &eth.ether_dhost, ETHER_ADDR_LEN);
+               bcopy(&dhdp->mac, &eth.ether_shost, ETHER_ADDR_LEN);
+               ETHER_TOGGLE_LOCALADDR(&eth.ether_shost);
+               eth.ether_type = hton16(ETHER_TYPE_BRCM);
+
+               bcopy((void *)&eth, PKTDATA(dhdp->osh, p), sizeof(eth));
+               bcopy(data, PKTDATA(dhdp->osh, p) + sizeof(eth), data_len);
+               skb = PKTTONATIVE(dhdp->osh, p);
+               skb_data = skb->data;
+               len = skb->len;
+
+               ifidx = dhd_ifname2idx(dhd, "wlan0");
+               ifp = dhd->iflist[ifidx];
+               if (ifp == NULL)
+                        ifp = dhd->iflist[0];
+
+               ASSERT(ifp);
+               skb->dev = ifp->net;
+               skb->protocol = eth_type_trans(skb, skb->dev);
+               skb->data = skb_data;
+               skb->len = len;
+
+               /* Strip header, count, deliver upward */
+               skb_pull(skb, ETH_HLEN);
+
+               bcm_object_trace_opr(skb, BCM_OBJDBG_REMOVE,
+                       __FUNCTION__, __LINE__);
+               /* Send the packet */
+               if (in_interrupt()) {
+                       netif_rx(skb);
+               } else {
+                       netif_rx_ni(skb);
+               }
+       }
+       else {
+               /* Could not allocate a sk_buf */
+               DHD_ERROR(("%s: unable to alloc sk_buf", __FUNCTION__));
+       }
+}
+#endif /* LOG_INTO_TCPDUMP */
+
+void dhd_wait_for_event(dhd_pub_t *dhd, bool *lockvar)
+{
+#if defined(BCMSDIO) && (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+       struct dhd_info *dhdinfo =  dhd->info;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+       int timeout = msecs_to_jiffies(IOCTL_RESP_TIMEOUT);
+#else
+       int timeout = (IOCTL_RESP_TIMEOUT / 1000) * HZ;
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) */
+
+       dhd_os_sdunlock(dhd);
+       wait_event_timeout(dhdinfo->ctrl_wait, (*lockvar == FALSE), timeout);
+       dhd_os_sdlock(dhd);
+#endif /* defined(BCMSDIO) && (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)) */
+       return;
+}
+
+void dhd_wait_event_wakeup(dhd_pub_t *dhd)
+{
+#if defined(BCMSDIO) && (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+       struct dhd_info *dhdinfo =  dhd->info;
+       if (waitqueue_active(&dhdinfo->ctrl_wait))
+               wake_up(&dhdinfo->ctrl_wait);
+#endif
+       return;
+}
+
+#if defined(BCMSDIO) || defined(BCMPCIE)
+int
+dhd_net_bus_devreset(struct net_device *dev, uint8 flag)
+{
+       int ret;
+
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+       if (flag == TRUE) {
+               /* Issue wl down command before resetting the chip */
+               if (dhd_wl_ioctl_cmd(&dhd->pub, WLC_DOWN, NULL, 0, TRUE, 0) < 0) {
+                       DHD_TRACE(("%s: wl down failed\n", __FUNCTION__));
+               }
+#ifdef PROP_TXSTATUS
+               if (dhd->pub.wlfc_enabled)
+                       dhd_wlfc_deinit(&dhd->pub);
+#endif /* PROP_TXSTATUS */
+#ifdef PNO_SUPPORT
+       if (dhd->pub.pno_state)
+               dhd_pno_deinit(&dhd->pub);
+#endif
+       }
+
+#ifdef BCMSDIO
+       if (!flag) {
+               dhd_update_fw_nv_path(dhd);
+               /* update firmware and nvram path to sdio bus */
+               dhd_bus_update_fw_nv_path(dhd->pub.bus,
+                       dhd->fw_path, dhd->nv_path);
+       }
+#endif /* BCMSDIO */
+
+       ret = dhd_bus_devreset(&dhd->pub, flag);
+       if (ret) {
+               DHD_ERROR(("%s: dhd_bus_devreset: %d\n", __FUNCTION__, ret));
+               return ret;
+       }
+
+       return ret;
+}
+
+#ifdef BCMSDIO
+int
+dhd_net_bus_suspend(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       return dhd_bus_suspend(&dhd->pub);
+}
+
+int
+dhd_net_bus_resume(struct net_device *dev, uint8 stage)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       return dhd_bus_resume(&dhd->pub, stage);
+}
+
+#endif /* BCMSDIO */
+#endif /* BCMSDIO || BCMPCIE */
+
+int net_os_set_suspend_disable(struct net_device *dev, int val)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       int ret = 0;
+
+       if (dhd) {
+               ret = dhd->pub.suspend_disable_flag;
+               dhd->pub.suspend_disable_flag = val;
+       }
+       return ret;
+}
+
+int net_os_set_suspend(struct net_device *dev, int val, int force)
+{
+       int ret = 0;
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+       if (dhd) {
+#ifdef CONFIG_MACH_UNIVERSAL7420
+#endif /* CONFIG_MACH_UNIVERSAL7420 */
+#if defined(CONFIG_HAS_EARLYSUSPEND) && defined(DHD_USE_EARLYSUSPEND)
+               ret = dhd_set_suspend(val, &dhd->pub);
+#else
+               ret = dhd_suspend_resume_helper(dhd, val, force);
+#endif
+#ifdef WL_CFG80211
+               wl_cfg80211_update_power_mode(dev);
+#endif
+       }
+       return ret;
+}
+
+int net_os_set_suspend_bcn_li_dtim(struct net_device *dev, int val)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+       if (dhd)
+               dhd->pub.suspend_bcn_li_dtim = val;
+
+       return 0;
+}
+
+int net_os_set_max_dtim_enable(struct net_device *dev, int val)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+       if (dhd) {
+#ifdef ENABLE_MAX_DTIM_IN_SUSPEND
+               DHD_ERROR(("%s: use MAX bcn_li_dtim in suspend %s\n",
+                       __FUNCTION__, (val ? "Enable" : "Disable")));
+               if (val) {
+                       dhd->pub.max_dtim_enable = TRUE;
+               } else {
+                       dhd->pub.max_dtim_enable = FALSE;
+               }
+#else /* ENABLE_MAX_DTIM_IN_SUSPEND */
+               DHD_ERROR(("%s: max_dtim_enable always FALSE\n", __FUNCTION__));
+               dhd->pub.max_dtim_enable = FALSE;
+#endif /* ENABLE_MAX_DTIM_IN_SUSPEND */
+       } else {
+               return -1;
+       }
+
+       return 0;
+}
+
+#ifdef PKT_FILTER_SUPPORT
+int net_os_rxfilter_add_remove(struct net_device *dev, int add_remove, int num)
+{
+       int ret = 0;
+
+#ifndef GAN_LITE_NAT_KEEPALIVE_FILTER
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+       DHD_ERROR(("%s: add_remove = %d, num = %d\n", __FUNCTION__, add_remove, num));
+       if (!dhd || (num == DHD_UNICAST_FILTER_NUM)) {
+               return 0;
+       }
+
+
+       if (num >= dhd->pub.pktfilter_count) {
+               return -EINVAL;
+       }
+
+       ret = dhd_packet_filter_add_remove(&dhd->pub, add_remove, num);
+#endif /* !GAN_LITE_NAT_KEEPALIVE_FILTER */
+
+       return ret;
+}
+
+int dhd_os_enable_packet_filter(dhd_pub_t *dhdp, int val)
+
+{
+       int ret = 0;
+
+       /* Packet filtering is set only if we still in early-suspend and
+        * we need either to turn it ON or turn it OFF
+        * We can always turn it OFF in case of early-suspend, but we turn it
+        * back ON only if suspend_disable_flag was not set
+       */
+       if (dhdp && dhdp->up) {
+               if (dhdp->in_suspend) {
+                       if (!val || (val && !dhdp->suspend_disable_flag))
+                               dhd_enable_packet_filter(val, dhdp);
+               }
+       }
+       return ret;
+}
+
+/* function to enable/disable packet for Network device */
+int net_os_enable_packet_filter(struct net_device *dev, int val)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+       DHD_ERROR(("%s: val = %d\n", __FUNCTION__, val));
+       return dhd_os_enable_packet_filter(&dhd->pub, val);
+}
+#endif /* PKT_FILTER_SUPPORT */
+
+int
+dhd_dev_init_ioctl(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       int ret;
+
+       if ((ret = dhd_sync_with_dongle(&dhd->pub)) < 0)
+               goto done;
+
+done:
+       return ret;
+}
+
+int
+dhd_dev_get_feature_set(struct net_device *dev)
+{
+       dhd_info_t *ptr = *(dhd_info_t **)netdev_priv(dev);
+       dhd_pub_t *dhd = (&ptr->pub);
+       int feature_set = 0;
+
+#ifdef DYNAMIC_SWOOB_DURATION
+#ifndef CUSTOM_INTR_WIDTH
+#define CUSTOM_INTR_WIDTH 100
+       int intr_width = 0;
+#endif /* CUSTOM_INTR_WIDTH */
+#endif /* DYNAMIC_SWOOB_DURATION */
+#if defined(CONFIG_WLAN_GRACE) || defined(CONFIG_SEC_GRACEQLTE_PROJECT)
+       DHD_ERROR(("%s: return feature_set = %d\n", __FUNCTION__, feature_set));
+       return feature_set;
+#endif /* CONFIG_WLAN_GRACE || CONFIG_SEC_GRACEQLTE_PROJECT */
+       if (!dhd)
+               return feature_set;
+
+       if (FW_SUPPORTED(dhd, sta))
+               feature_set |= WIFI_FEATURE_INFRA;
+       if (FW_SUPPORTED(dhd, dualband))
+               feature_set |= WIFI_FEATURE_INFRA_5G;
+       if (FW_SUPPORTED(dhd, p2p))
+               feature_set |= WIFI_FEATURE_P2P;
+       if (dhd->op_mode & DHD_FLAG_HOSTAP_MODE)
+               feature_set |= WIFI_FEATURE_SOFT_AP;
+       if (FW_SUPPORTED(dhd, tdls))
+               feature_set |= WIFI_FEATURE_TDLS;
+       if (FW_SUPPORTED(dhd, vsdb))
+               feature_set |= WIFI_FEATURE_TDLS_OFFCHANNEL;
+       if (FW_SUPPORTED(dhd, nan)) {
+               feature_set |= WIFI_FEATURE_NAN;
+               /* NAN is essentail for d2d rtt */
+               if (FW_SUPPORTED(dhd, rttd2d))
+                       feature_set |= WIFI_FEATURE_D2D_RTT;
+       }
+#ifdef RTT_SUPPORT
+       feature_set |= WIFI_FEATURE_D2AP_RTT;
+#endif /* RTT_SUPPORT */
+#ifdef LINKSTAT_SUPPORT
+       feature_set |= WIFI_FEATURE_LINKSTAT;
+#endif /* LINKSTAT_SUPPORT */
+       /* Supports STA + STA always */
+       feature_set |= WIFI_FEATURE_ADDITIONAL_STA;
+#ifdef PNO_SUPPORT
+       if (dhd_is_pno_supported(dhd)) {
+               feature_set |= WIFI_FEATURE_PNO;
+               feature_set |= WIFI_FEATURE_BATCH_SCAN;
+#ifdef GSCAN_SUPPORT
+               feature_set |= WIFI_FEATURE_GSCAN;
+#endif /* GSCAN_SUPPORT */
+       }
+#endif /* PNO_SUPPORT */
+#ifdef WL11U
+       feature_set |= WIFI_FEATURE_HOTSPOT;
+#endif /* WL11U */
+       return feature_set;
+}
+
+
+int *dhd_dev_get_feature_set_matrix(struct net_device *dev, int *num)
+{
+       int feature_set_full, mem_needed;
+       int *ret;
+
+       *num = 0;
+       mem_needed = sizeof(int) * MAX_FEATURE_SET_CONCURRRENT_GROUPS;
+       ret = (int *) kmalloc(mem_needed, GFP_KERNEL);
+       if (!ret) {
+               DHD_ERROR(("%s: failed to allocate %d bytes\n", __FUNCTION__,
+                       mem_needed));
+               return ret;
+       }
+
+       feature_set_full = dhd_dev_get_feature_set(dev);
+
+       ret[0] = (feature_set_full & WIFI_FEATURE_INFRA) |
+                (feature_set_full & WIFI_FEATURE_INFRA_5G) |
+                (feature_set_full & WIFI_FEATURE_NAN) |
+                (feature_set_full & WIFI_FEATURE_D2D_RTT) |
+                (feature_set_full & WIFI_FEATURE_D2AP_RTT) |
+                (feature_set_full & WIFI_FEATURE_PNO) |
+                (feature_set_full & WIFI_FEATURE_BATCH_SCAN) |
+                (feature_set_full & WIFI_FEATURE_GSCAN) |
+                (feature_set_full & WIFI_FEATURE_HOTSPOT) |
+                (feature_set_full & WIFI_FEATURE_ADDITIONAL_STA) |
+                (feature_set_full & WIFI_FEATURE_EPR);
+
+       ret[1] = (feature_set_full & WIFI_FEATURE_INFRA) |
+                (feature_set_full & WIFI_FEATURE_INFRA_5G) |
+                /* Not yet verified NAN with P2P */
+                /* (feature_set_full & WIFI_FEATURE_NAN) | */
+                (feature_set_full & WIFI_FEATURE_P2P) |
+                (feature_set_full & WIFI_FEATURE_D2AP_RTT) |
+                (feature_set_full & WIFI_FEATURE_D2D_RTT) |
+                (feature_set_full & WIFI_FEATURE_EPR);
+
+       ret[2] = (feature_set_full & WIFI_FEATURE_INFRA) |
+                (feature_set_full & WIFI_FEATURE_INFRA_5G) |
+                (feature_set_full & WIFI_FEATURE_NAN) |
+                (feature_set_full & WIFI_FEATURE_D2D_RTT) |
+                (feature_set_full & WIFI_FEATURE_D2AP_RTT) |
+                (feature_set_full & WIFI_FEATURE_TDLS) |
+                (feature_set_full & WIFI_FEATURE_TDLS_OFFCHANNEL) |
+                (feature_set_full & WIFI_FEATURE_EPR);
+       *num = MAX_FEATURE_SET_CONCURRRENT_GROUPS;
+
+       return ret;
+}
+#ifdef CUSTOM_FORCE_NODFS_FLAG
+int
+dhd_dev_set_nodfs(struct net_device *dev, u32 nodfs)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+       if (nodfs)
+               dhd->pub.dhd_cflags |= WLAN_PLAT_NODFS_FLAG;
+       else
+               dhd->pub.dhd_cflags &= ~WLAN_PLAT_NODFS_FLAG;
+       dhd->pub.force_country_change = TRUE;
+       return 0;
+}
+#endif /* CUSTOM_FORCE_NODFS_FLAG */
+#ifdef PNO_SUPPORT
+/* Linux wrapper to call common dhd_pno_stop_for_ssid */
+int
+dhd_dev_pno_stop_for_ssid(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+       return (dhd_pno_stop_for_ssid(&dhd->pub));
+}
+/* Linux wrapper to call common dhd_pno_set_for_ssid */
+int
+dhd_dev_pno_set_for_ssid(struct net_device *dev, wlc_ssid_ext_t* ssids_local, int nssid,
+       uint16  scan_fr, int pno_repeat, int pno_freq_expo_max, uint16 *channel_list, int nchan)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+       return (dhd_pno_set_for_ssid(&dhd->pub, ssids_local, nssid, scan_fr,
+               pno_repeat, pno_freq_expo_max, channel_list, nchan));
+}
+
+/* Linux wrapper to call common dhd_pno_enable */
+int
+dhd_dev_pno_enable(struct net_device *dev, int enable)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+       return (dhd_pno_enable(&dhd->pub, enable));
+}
+
+/* Linux wrapper to call common dhd_pno_set_for_hotlist */
+int
+dhd_dev_pno_set_for_hotlist(struct net_device *dev, wl_pfn_bssid_t *p_pfn_bssid,
+       struct dhd_pno_hotlist_params *hotlist_params)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       return (dhd_pno_set_for_hotlist(&dhd->pub, p_pfn_bssid, hotlist_params));
+}
+/* Linux wrapper to call common dhd_dev_pno_stop_for_batch */
+int
+dhd_dev_pno_stop_for_batch(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       return (dhd_pno_stop_for_batch(&dhd->pub));
+}
+/* Linux wrapper to call common dhd_dev_pno_set_for_batch */
+int
+dhd_dev_pno_set_for_batch(struct net_device *dev, struct dhd_pno_batch_params *batch_params)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       return (dhd_pno_set_for_batch(&dhd->pub, batch_params));
+}
+/* Linux wrapper to call common dhd_dev_pno_get_for_batch */
+int
+dhd_dev_pno_get_for_batch(struct net_device *dev, char *buf, int bufsize)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       return (dhd_pno_get_for_batch(&dhd->pub, buf, bufsize, PNO_STATUS_NORMAL));
+}
+/* Linux wrapper to call common dhd_pno_set_mac_oui */
+int
+dhd_dev_pno_set_mac_oui(struct net_device *dev, uint8 *oui)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       return (dhd_pno_set_mac_oui(&dhd->pub, oui));
+}
+#endif /* PNO_SUPPORT */
+
+#if defined(PNO_SUPPORT)
+#ifdef GSCAN_SUPPORT
+/* Linux wrapper to call common dhd_pno_set_cfg_gscan */
+int
+dhd_dev_pno_set_cfg_gscan(struct net_device *dev, dhd_pno_gscan_cmd_cfg_t type,
+ void *buf, uint8 flush)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_pno_set_cfg_gscan(&dhd->pub, type, buf, flush));
+}
+
+/* Linux wrapper to call common dhd_pno_get_gscan */
+void *
+dhd_dev_pno_get_gscan(struct net_device *dev, dhd_pno_gscan_cmd_cfg_t type,
+                      void *info, uint32 *len)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_pno_get_gscan(&dhd->pub, type, info, len));
+}
+
+/* Linux wrapper to call common dhd_wait_batch_results_complete */
+void
+dhd_dev_wait_batch_results_complete(struct net_device *dev)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_wait_batch_results_complete(&dhd->pub));
+}
+
+/* Linux wrapper to call common dhd_pno_lock_batch_results */
+void
+dhd_dev_pno_lock_access_batch_results(struct net_device *dev)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_pno_lock_batch_results(&dhd->pub));
+}
+/* Linux wrapper to call common dhd_pno_unlock_batch_results */
+void
+dhd_dev_pno_unlock_access_batch_results(struct net_device *dev)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_pno_unlock_batch_results(&dhd->pub));
+}
+
+/* Linux wrapper to call common dhd_pno_initiate_gscan_request */
+int
+dhd_dev_pno_run_gscan(struct net_device *dev, bool run, bool flush)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_pno_initiate_gscan_request(&dhd->pub, run, flush));
+}
+
+/* Linux wrapper to call common dhd_pno_enable_full_scan_result */
+int
+dhd_dev_pno_enable_full_scan_result(struct net_device *dev, bool real_time_flag)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_pno_enable_full_scan_result(&dhd->pub, real_time_flag));
+}
+
+/* Linux wrapper to call common dhd_handle_swc_evt */
+void *
+dhd_dev_swc_scan_event(struct net_device *dev, const void  *data, int *send_evt_bytes)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_handle_swc_evt(&dhd->pub, data, send_evt_bytes));
+}
+
+/* Linux wrapper to call common dhd_handle_hotlist_scan_evt */
+void *
+dhd_dev_hotlist_scan_event(struct net_device *dev,
+      const void  *data, int *send_evt_bytes, hotlist_type_t type)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_handle_hotlist_scan_evt(&dhd->pub, data, send_evt_bytes, type));
+}
+
+/* Linux wrapper to call common dhd_process_full_gscan_result */
+void *
+dhd_dev_process_full_gscan_result(struct net_device *dev,
+const void  *data, int *send_evt_bytes)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_process_full_gscan_result(&dhd->pub, data, send_evt_bytes));
+}
+
+void
+dhd_dev_gscan_hotlist_cache_cleanup(struct net_device *dev, hotlist_type_t type)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       dhd_gscan_hotlist_cache_cleanup(&dhd->pub, type);
+
+       return;
+}
+
+int
+dhd_dev_gscan_batch_cache_cleanup(struct net_device *dev)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_gscan_batch_cache_cleanup(&dhd->pub));
+}
+
+/* Linux wrapper to call common dhd_retreive_batch_scan_results */
+int
+dhd_dev_retrieve_batch_scan(struct net_device *dev)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_retreive_batch_scan_results(&dhd->pub));
+}
+#endif /* GSCAN_SUPPORT */
+#endif 
+#ifdef RTT_SUPPORT
+/* Linux wrapper to call common dhd_pno_set_cfg_gscan */
+int
+dhd_dev_rtt_set_cfg(struct net_device *dev, void *buf)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_rtt_set_cfg(&dhd->pub, buf));
+}
+int
+dhd_dev_rtt_cancel_cfg(struct net_device *dev, struct ether_addr *mac_list, int mac_cnt)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_rtt_stop(&dhd->pub, mac_list, mac_cnt));
+}
+int
+dhd_dev_rtt_register_noti_callback(struct net_device *dev, void *ctx, dhd_rtt_compl_noti_fn noti_fn)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_rtt_register_noti_callback(&dhd->pub, ctx, noti_fn));
+}
+int
+dhd_dev_rtt_unregister_noti_callback(struct net_device *dev, dhd_rtt_compl_noti_fn noti_fn)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_rtt_unregister_noti_callback(&dhd->pub, noti_fn));
+}
+
+int
+dhd_dev_rtt_capability(struct net_device *dev, rtt_capabilities_t *capa)
+{
+       dhd_info_t *dhd = *(dhd_info_t **)netdev_priv(dev);
+
+       return (dhd_rtt_capability(&dhd->pub, capa));
+}
+
+#endif /* RTT_SUPPORT */
+
+#if defined(KEEP_ALIVE)
+#define TEMP_BUF_SIZE 512
+#define TEMP_FRAME_SIZE 300
+int
+dhd_dev_start_mkeep_alive(dhd_pub_t *dhd_pub, u8 mkeep_alive_id, u8 *ip_pkt, u16 ip_pkt_len,
+       u8* src_mac, u8* dst_mac, u32 period_msec)
+{
+       char *pbuf;
+       const char *str;
+       wl_mkeep_alive_pkt_t mkeep_alive_pkt = {0};
+       wl_mkeep_alive_pkt_t *mkeep_alive_pktp;
+       int buf_len;
+       int str_len;
+       int res = BCME_ERROR;
+       int len_bytes = 0;
+       int i;
+
+       /* ether frame to have both max IP pkt (256 bytes) and ether header */
+       char            *pmac_frame;
+
+       /*
+        * The mkeep_alive packet is for STA interface only; if the bss is configured as AP,
+        * dongle shall reject a mkeep_alive request.
+        */
+       if (!dhd_support_sta_mode(dhd_pub))
+               return res;
+
+       DHD_TRACE(("%s execution\n", __FUNCTION__));
+
+       if ((pbuf = kzalloc(TEMP_BUF_SIZE, GFP_KERNEL)) == NULL) {
+               DHD_ERROR(("failed to allocate buf with size %d\n", TEMP_BUF_SIZE));
+               res = BCME_NOMEM;
+               return res;
+       }
+
+       if ((pmac_frame = kzalloc(TEMP_FRAME_SIZE, GFP_KERNEL)) == NULL) {
+               DHD_ERROR(("failed to allocate mac_frame with size %d\n", TEMP_FRAME_SIZE));
+               res = BCME_NOMEM;
+               goto exit;
+       }
+
+       /*
+        * Get current mkeep-alive status.
+        */
+       bcm_mkiovar("mkeep_alive", &mkeep_alive_id, sizeof(mkeep_alive_id),
+               pbuf, TEMP_BUF_SIZE);
+
+       if ((res = dhd_wl_ioctl_cmd(dhd_pub, WLC_GET_VAR, pbuf, TEMP_BUF_SIZE,
+               FALSE, 0)) < 0) {
+               DHD_ERROR(("%s: Get mkeep_alive failed (error=%d)\n", __FUNCTION__, res));
+               goto exit;
+       } else {
+               /* Check available ID whether it is occupied */
+               mkeep_alive_pktp = (wl_mkeep_alive_pkt_t *) pbuf;
+               if (dtoh32(mkeep_alive_pktp->period_msec != 0)) {
+                       DHD_ERROR(("%s: Get mkeep_alive failed, ID %u is in use.\n",
+                               __FUNCTION__, mkeep_alive_id));
+
+                       /* Current occupied ID info */
+                       DHD_ERROR(("%s: mkeep_alive\n", __FUNCTION__));
+                       DHD_ERROR(("   Id    : %d\n"
+                               "   Period: %d msec\n"
+                               "   Length: %d\n"
+                               "   Packet: 0x",
+                               mkeep_alive_pktp->keep_alive_id,
+                               dtoh32(mkeep_alive_pktp->period_msec),
+                               dtoh16(mkeep_alive_pktp->len_bytes)));
+
+                       for (i = 0; i < mkeep_alive_pktp->len_bytes; i++) {
+                               DHD_ERROR(("%02x", mkeep_alive_pktp->data[i]));
+                       }
+                       DHD_ERROR(("\n"));
+
+                       res = BCME_NOTFOUND;
+                       goto exit;
+               }
+       }
+
+       /* Request the specified ID */
+       memset(&mkeep_alive_pkt, 0, sizeof(wl_mkeep_alive_pkt_t));
+       memset(pbuf, 0, TEMP_BUF_SIZE);
+       str = "mkeep_alive";
+       str_len = strlen(str);
+       strncpy(pbuf, str, str_len);
+       pbuf[str_len] = '\0';
+
+       mkeep_alive_pktp = (wl_mkeep_alive_pkt_t *) (pbuf + str_len + 1);
+       mkeep_alive_pkt.period_msec = htod32(period_msec);
+       buf_len = str_len + 1;
+       mkeep_alive_pkt.version = htod16(WL_MKEEP_ALIVE_VERSION);
+       mkeep_alive_pkt.length = htod16(WL_MKEEP_ALIVE_FIXED_LEN);
+
+       /* ID assigned */
+       mkeep_alive_pkt.keep_alive_id = mkeep_alive_id;
+
+       buf_len += WL_MKEEP_ALIVE_FIXED_LEN;
+
+       /*
+        * Build up Ethernet Frame
+        */
+
+       /* Mapping dest mac addr */
+       memcpy(pmac_frame, dst_mac, ETHER_ADDR_LEN);
+       pmac_frame += ETHER_ADDR_LEN;
+
+       /* Mapping src mac addr */
+       memcpy(pmac_frame, src_mac, ETHER_ADDR_LEN);
+       pmac_frame += ETHER_ADDR_LEN;
+
+       /* Mapping Ethernet type (ETHERTYPE_IP: 0x0800) */
+       *(pmac_frame++) = 0x08;
+       *(pmac_frame++) = 0x00;
+
+       /* Mapping IP pkt */
+       memcpy(pmac_frame, ip_pkt, ip_pkt_len);
+       pmac_frame += ip_pkt_len;
+
+       /*
+        * Length of ether frame (assume to be all hexa bytes)
+        *     = src mac + dst mac + ether type + ip pkt len
+        */
+       len_bytes = ETHER_ADDR_LEN*2 + ETHER_TYPE_LEN + ip_pkt_len;
+       /* Get back to the beginning. */
+       pmac_frame -= len_bytes;
+       memcpy(mkeep_alive_pktp->data, pmac_frame, len_bytes);
+       buf_len += len_bytes;
+       mkeep_alive_pkt.len_bytes = htod16(len_bytes);
+
+       /*
+        * Keep-alive attributes are set in local variable (mkeep_alive_pkt), and
+        * then memcpy'ed into buffer (mkeep_alive_pktp) since there is no
+        * guarantee that the buffer is properly aligned.
+        */
+       memcpy((char *)mkeep_alive_pktp, &mkeep_alive_pkt, WL_MKEEP_ALIVE_FIXED_LEN);
+
+       res = dhd_wl_ioctl_cmd(dhd_pub, WLC_SET_VAR, pbuf, buf_len, TRUE, 0);
+exit:
+       kfree(pmac_frame);
+       kfree(pbuf);
+       return res;
+}
+
+int
+dhd_dev_stop_mkeep_alive(dhd_pub_t *dhd_pub, u8 mkeep_alive_id)
+{
+       char                    *pbuf;
+       const char              *str;
+       wl_mkeep_alive_pkt_t    mkeep_alive_pkt;
+       wl_mkeep_alive_pkt_t    *mkeep_alive_pktp;
+       int                     buf_len;
+       int                     str_len;
+       int                     res = BCME_ERROR;
+       int                     i;
+
+       /*
+        * The mkeep_alive packet is for STA interface only; if the bss is configured as AP,
+        * dongle shall reject a mkeep_alive request.
+        */
+       if (!dhd_support_sta_mode(dhd_pub)) {
+               DHD_ERROR(("sta mode not supported \n"));
+               return res;
+       }
+
+       DHD_TRACE(("%s execution\n", __FUNCTION__));
+
+       /*
+        * Get current mkeep-alive status. Skip ID 0 which is being used for NULL pkt.
+        */
+       if ((pbuf = kzalloc(TEMP_BUF_SIZE, GFP_KERNEL)) == NULL) {
+               DHD_ERROR(("failed to allocate buf with size %d\n", TEMP_BUF_SIZE));
+               return res;
+       }
+
+       bcm_mkiovar("mkeep_alive", &mkeep_alive_id, sizeof(mkeep_alive_id), pbuf, TEMP_BUF_SIZE);
+
+       if ((res = dhd_wl_ioctl_cmd(dhd_pub, WLC_GET_VAR, pbuf, TEMP_BUF_SIZE, FALSE, 0)) < 0) {
+               DHD_ERROR(("%s: Get mkeep_alive failed (error=%d)\n", __FUNCTION__, res));
+               goto exit;
+       } else {
+               /* Check occupied ID */
+               mkeep_alive_pktp = (wl_mkeep_alive_pkt_t *) pbuf;
+               DHD_INFO(("%s: mkeep_alive\n", __FUNCTION__));
+               DHD_INFO(("   Id    : %d\n"
+                       "   Period: %d msec\n"
+                       "   Length: %d\n"
+                       "   Packet: 0x",
+                       mkeep_alive_pktp->keep_alive_id,
+                       dtoh32(mkeep_alive_pktp->period_msec),
+                       dtoh16(mkeep_alive_pktp->len_bytes)));
+
+               for (i = 0; i < mkeep_alive_pktp->len_bytes; i++) {
+                       DHD_INFO(("%02x", mkeep_alive_pktp->data[i]));
+               }
+               DHD_INFO(("\n"));
+       }
+
+       /* Make it stop if available */
+       if (dtoh32(mkeep_alive_pktp->period_msec != 0)) {
+               DHD_INFO(("stop mkeep_alive on ID %d\n", mkeep_alive_id));
+               memset(&mkeep_alive_pkt, 0, sizeof(wl_mkeep_alive_pkt_t));
+               memset(pbuf, 0, TEMP_BUF_SIZE);
+               str = "mkeep_alive";
+               str_len = strlen(str);
+               strncpy(pbuf, str, str_len);
+               pbuf[str_len] = '\0';
+
+               mkeep_alive_pktp = (wl_mkeep_alive_pkt_t *) (pbuf + str_len + 1);
+
+               mkeep_alive_pkt.period_msec = 0;
+               buf_len = str_len + 1;
+               mkeep_alive_pkt.version = htod16(WL_MKEEP_ALIVE_VERSION);
+               mkeep_alive_pkt.length = htod16(WL_MKEEP_ALIVE_FIXED_LEN);
+               mkeep_alive_pkt.keep_alive_id = mkeep_alive_id;
+               buf_len += WL_MKEEP_ALIVE_FIXED_LEN;
+
+               /*
+                * Keep-alive attributes are set in local variable (mkeep_alive_pkt), and
+                * then memcpy'ed into buffer (mkeep_alive_pktp) since there is no
+                * guarantee that the buffer is properly aligned.
+                */
+               memcpy((char *)mkeep_alive_pktp, &mkeep_alive_pkt, WL_MKEEP_ALIVE_FIXED_LEN);
+
+               res = dhd_wl_ioctl_cmd(dhd_pub, WLC_SET_VAR, pbuf, buf_len, TRUE, 0);
+       } else {
+               DHD_ERROR(("%s: ID %u does not exist.\n", __FUNCTION__, mkeep_alive_id));
+               res = BCME_NOTFOUND;
+       }
+exit:
+       kfree(pbuf);
+       return res;
+}
+#endif /* defined(KEEP_ALIVE) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+static void dhd_hang_process(void *dhd_info, void *event_info, u8 event)
+{
+       dhd_info_t *dhd;
+       struct net_device *dev;
+
+       dhd = (dhd_info_t *)dhd_info;
+       dev = dhd->iflist[0]->net;
+
+       if (dev) {
+#if defined(WL_WIRELESS_EXT)
+               wl_iw_send_priv_event(dev, "HANG");
+#endif
+#if defined(WL_CFG80211)
+               wl_cfg80211_hang(dev, WLAN_REASON_UNSPECIFIED);
+#endif
+       }
+}
+
+#ifdef EXYNOS_PCIE_LINKDOWN_RECOVERY
+extern dhd_pub_t *link_recovery;
+void dhd_host_recover_link(void)
+{
+       DHD_ERROR(("****** %s ******\n", __FUNCTION__));
+       link_recovery->hang_reason = HANG_REASON_PCIE_LINK_DOWN;
+       dhd_bus_set_linkdown(link_recovery, TRUE);
+       dhd_os_send_hang_message(link_recovery);
+}
+EXPORT_SYMBOL(dhd_host_recover_link);
+#endif /* EXYNOS_PCIE_LINKDOWN_RECOVERY */
+
+int dhd_os_send_hang_message(dhd_pub_t *dhdp)
+{
+       int ret = 0;
+       if (dhdp) {
+               if (!dhdp->hang_was_sent) {
+#ifdef DHD_DEBUG_UART
+                       /* If PCIe lane has broken, execute the debug uart application
+                        * to gether a ramdump data from dongle via uart
+                        */
+#ifdef DHD_FW_COREDUMP
+                       if (dhdp->memdump_enabled == DUMP_MEMFILE_BUGON)
+#endif
+                       {
+                               if (dhdp->hang_reason == HANG_REASON_PCIE_LINK_DOWN ||
+#ifdef DHD_FW_COREDUMP
+                                       dhdp->memdump_success == FALSE ||
+#endif
+                                       FALSE) {
+                                       dhd_debug_uart_exec("rd");
+#ifdef DHD_LOG_DUMP
+                                       if (dhdp->memdump_type != DUMP_TYPE_BY_SYSDUMP)
+#endif
+                                       {
+                                               BUG_ON(1);
+                                       }
+                               }
+                       }
+#endif /* DHD_DEBUG_UART */
+                       dhdp->hang_was_sent = 1;
+                       dhd_deferred_schedule_work(dhdp->info->dhd_deferred_wq, (void *)dhdp,
+                               DHD_WQ_WORK_HANG_MSG, dhd_hang_process, DHD_WORK_PRIORITY_HIGH);
+               }
+       }
+       return ret;
+}
+
+int net_os_send_hang_message(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       int ret = 0;
+
+       if (dhd) {
+               /* Report FW problem when enabled */
+               if (dhd->pub.hang_report) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+                       ret = dhd_os_send_hang_message(&dhd->pub);
+#else
+                       ret = wl_cfg80211_hang(dev, WLAN_REASON_UNSPECIFIED);
+#endif
+               } else {
+                       DHD_ERROR(("%s: FW HANG ignored (for testing purpose) and not sent up\n",
+                               __FUNCTION__));
+               }
+       }
+       return ret;
+}
+
+int net_os_send_hang_message_reason(struct net_device *dev, const char *string_num)
+{
+       dhd_info_t *dhd = NULL;
+       dhd_pub_t *dhdp = NULL;
+       int reason;
+
+       dhd = DHD_DEV_INFO(dev);
+       if (dhd) {
+               dhdp = &dhd->pub;
+       }
+
+       if (!dhd || !dhdp) {
+               return 0;
+       }
+
+       reason = bcm_strtoul(string_num, NULL, 0);
+       DHD_INFO(("%s: Enter, reason=0x%x\n", __FUNCTION__, reason));
+
+       if ((reason <= HANG_REASON_MASK) || (reason >= HANG_REASON_MAX)) {
+               reason = 0;
+       }
+
+       dhdp->hang_reason = reason;
+
+       return net_os_send_hang_message(dev);
+}
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27) && OEM_ANDROID */
+
+
+int dhd_net_wifi_platform_set_power(struct net_device *dev, bool on, unsigned long delay_msec)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       return wifi_platform_set_power(dhd->adapter, on, delay_msec);
+}
+
+bool dhd_force_country_change(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+       if (dhd && dhd->pub.up)
+               return dhd->pub.force_country_change;
+       return FALSE;
+}
+void dhd_get_customized_country_code(struct net_device *dev, char *country_iso_code,
+       wl_country_t *cspec)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+#ifdef CUSTOM_COUNTRY_CODE
+       get_customized_country_code(dhd->adapter, country_iso_code, cspec,
+                       dhd->pub.dhd_cflags);
+#else
+       get_customized_country_code(dhd->adapter, country_iso_code, cspec);
+#endif /* CUSTOM_COUNTRY_CODE */
+
+
+}
+void dhd_bus_country_set(struct net_device *dev, wl_country_t *cspec, bool notify)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       if (dhd && dhd->pub.up) {
+               memcpy(&dhd->pub.dhd_cspec, cspec, sizeof(wl_country_t));
+#ifdef WL_CFG80211
+               wl_update_wiphybands(DHD_GET_CFG80211_PRIV(&dhd->pub), notify, true);
+#endif
+       }
+}
+
+void dhd_bus_band_set(struct net_device *dev, uint band)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       if (dhd && dhd->pub.up) {
+#ifdef WL_CFG80211
+               wl_update_wiphybands(DHD_GET_CFG80211_PRIV(&dhd->pub), true, true);
+#endif
+       }
+}
+
+int dhd_net_set_fw_path(struct net_device *dev, char *fw)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+       if (!fw || fw[0] == '\0')
+               return -EINVAL;
+
+       strncpy(dhd->fw_path, fw, sizeof(dhd->fw_path) - 1);
+       dhd->fw_path[sizeof(dhd->fw_path)-1] = '\0';
+
+#if defined(SOFTAP)
+       if (strstr(fw, "apsta") != NULL) {
+               DHD_INFO(("GOT APSTA FIRMWARE\n"));
+               ap_fw_loaded = TRUE;
+       } else {
+               DHD_INFO(("GOT STA FIRMWARE\n"));
+               ap_fw_loaded = FALSE;
+       }
+#endif 
+       return 0;
+}
+
+void dhd_net_if_lock(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       dhd_net_if_lock_local(dhd);
+}
+
+void dhd_net_if_unlock(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       dhd_net_if_unlock_local(dhd);
+}
+
+static void dhd_net_if_lock_local(dhd_info_t *dhd)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+       if (dhd)
+               mutex_lock(&dhd->dhd_net_if_mutex);
+#endif
+}
+
+static void dhd_net_if_unlock_local(dhd_info_t *dhd)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+       if (dhd)
+               mutex_unlock(&dhd->dhd_net_if_mutex);
+#endif
+}
+
+static void dhd_suspend_lock(dhd_pub_t *pub)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       if (dhd)
+               mutex_lock(&dhd->dhd_suspend_mutex);
+#endif
+}
+
+static void dhd_suspend_unlock(dhd_pub_t *pub)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       if (dhd)
+               mutex_unlock(&dhd->dhd_suspend_mutex);
+#endif
+}
+
+unsigned long dhd_os_general_spin_lock(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       unsigned long flags = 0;
+
+       if (dhd)
+               spin_lock_irqsave(&dhd->dhd_lock, flags);
+
+       return flags;
+}
+
+void dhd_os_general_spin_unlock(dhd_pub_t *pub, unsigned long flags)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd)
+               spin_unlock_irqrestore(&dhd->dhd_lock, flags);
+}
+
+/* Linux specific multipurpose spinlock API */
+void *
+dhd_os_spin_lock_init(osl_t *osh)
+{
+       /* Adding 4 bytes since the sizeof(spinlock_t) could be 0 */
+       /* if CONFIG_SMP and CONFIG_DEBUG_SPINLOCK are not defined */
+       /* and this results in kernel asserts in internal builds */
+       spinlock_t * lock = MALLOC(osh, sizeof(spinlock_t) + 4);
+       if (lock)
+               spin_lock_init(lock);
+       return ((void *)lock);
+}
+void
+dhd_os_spin_lock_deinit(osl_t *osh, void *lock)
+{
+       if (lock)
+               MFREE(osh, lock, sizeof(spinlock_t) + 4);
+}
+unsigned long
+dhd_os_spin_lock(void *lock)
+{
+       unsigned long flags = 0;
+
+       if (lock)
+               spin_lock_irqsave((spinlock_t *)lock, flags);
+
+       return flags;
+}
+void
+dhd_os_spin_unlock(void *lock, unsigned long flags)
+{
+       if (lock)
+               spin_unlock_irqrestore((spinlock_t *)lock, flags);
+}
+
+static int
+dhd_get_pend_8021x_cnt(dhd_info_t *dhd)
+{
+       return (atomic_read(&dhd->pend_8021x_cnt));
+}
+
+#define MAX_WAIT_FOR_8021X_TX  100
+
+int
+dhd_wait_pend8021x(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       int timeout = msecs_to_jiffies(10);
+       int ntimes = MAX_WAIT_FOR_8021X_TX;
+       int pend = dhd_get_pend_8021x_cnt(dhd);
+
+       while (ntimes && pend) {
+               if (pend) {
+                       set_current_state(TASK_INTERRUPTIBLE);
+                       DHD_PERIM_UNLOCK(&dhd->pub);
+                       schedule_timeout(timeout);
+                       DHD_PERIM_LOCK(&dhd->pub);
+                       set_current_state(TASK_RUNNING);
+                       ntimes--;
+               }
+               pend = dhd_get_pend_8021x_cnt(dhd);
+       }
+       if (ntimes == 0)
+       {
+               atomic_set(&dhd->pend_8021x_cnt, 0);
+               DHD_ERROR(("%s: TIMEOUT\n", __FUNCTION__));
+       }
+       return pend;
+}
+
+#ifdef DHD_DEBUG
+static void
+dhd_convert_memdump_type_to_str(uint32 type, char *buf)
+{
+       char *type_str = NULL;
+
+       switch (type) {
+               case DUMP_TYPE_RESUMED_ON_TIMEOUT:
+                       type_str = "resumed_on_timeout";
+                       break;
+               case DUMP_TYPE_D3_ACK_TIMEOUT:
+                       type_str = "D3_ACK_timeout";
+                       break;
+               case DUMP_TYPE_DONGLE_TRAP:
+                       type_str = "Dongle_Trap";
+                       break;
+               case DUMP_TYPE_MEMORY_CORRUPTION:
+                       type_str = "Memory_Corruption";
+                       break;
+               case DUMP_TYPE_PKTID_AUDIT_FAILURE:
+                       type_str = "PKTID_AUDIT_Fail";
+                       break;
+               case DUMP_TYPE_SCAN_TIMEOUT:
+                       type_str = "SCAN_timeout";
+                       break;
+               case DUMP_TYPE_SCAN_BUSY:
+                       type_str = "SCAN_Busy";
+                       break;
+               case DUMP_TYPE_BY_SYSDUMP:
+                       type_str = "BY_SYSDUMP";
+                       break;
+               case DUMP_TYPE_BY_LIVELOCK:
+                       type_str = "BY_LIVELOCK";
+                       break;
+               case DUMP_TYPE_AP_LINKUP_FAILURE:
+                       type_str = "BY_AP_LINK_FAILURE";
+                       break;
+               case DUMP_TYPE_AP_ABNORMAL_ACCESS:
+                       type_str = "INVALID_ACCESS";
+                       break;
+               default:
+                       type_str = "Unknown_type";
+                       break;
+       }
+
+       strncpy(buf, type_str, strlen(type_str));
+       buf[strlen(type_str)] = 0;
+}
+
+int
+write_to_file(dhd_pub_t *dhd, uint8 *buf, int size)
+{
+       int ret = 0;
+       struct file *fp = NULL;
+       mm_segment_t old_fs;
+       loff_t pos = 0;
+       char memdump_path[128];
+       char memdump_type[32];
+       struct timeval curtime;
+       uint32 file_mode;
+
+       /* change to KERNEL_DS address limit */
+       old_fs = get_fs();
+       set_fs(KERNEL_DS);
+
+       /* Init file name */
+       memset(memdump_path, 0, sizeof(memdump_path));
+       memset(memdump_type, 0, sizeof(memdump_type));
+       do_gettimeofday(&curtime);
+       dhd_convert_memdump_type_to_str(dhd->memdump_type, memdump_type);
+#ifdef CUSTOMER_HW4_DEBUG
+       snprintf(memdump_path, sizeof(memdump_path), "%s_%s_%ld.%ld",
+               DHD_COMMON_DUMP_PATH "mem_dump", memdump_type,
+               (unsigned long)curtime.tv_sec, (unsigned long)curtime.tv_usec);
+       file_mode = O_CREAT | O_WRONLY | O_SYNC;
+#elif defined(CUSTOMER_HW2)
+       snprintf(memdump_path, sizeof(memdump_path), "%s_%s_%ld.%ld",
+               "/data/misc/wifi/mem_dump", memdump_type,
+               (unsigned long)curtime.tv_sec, (unsigned long)curtime.tv_usec);
+       file_mode = O_CREAT | O_WRONLY | O_SYNC;
+#else
+       snprintf(memdump_path, sizeof(memdump_path), "%s_%s_%ld.%ld",
+               "/installmedia/mem_dump", memdump_type,
+               (unsigned long)curtime.tv_sec, (unsigned long)curtime.tv_usec);
+       /* Extra flags O_DIRECT and O_SYNC are required for Brix Android, as we are
+        * calling BUG_ON immediately after collecting the socram dump.
+        * So the file write operation should directly write the contents into the
+        * file instead of caching it. O_TRUNC flag ensures that file will be re-written
+        * instead of appending.
+        */
+       file_mode = O_CREAT | O_WRONLY | O_DIRECT | O_SYNC | O_TRUNC;
+#endif /* CUSTOMER_HW4_DEBUG */
+
+       /* print SOCRAM dump file path */
+       DHD_ERROR(("%s: memdump_path = %s\n", __FUNCTION__, memdump_path));
+
+       /* open file to write */
+       fp = filp_open(memdump_path, file_mode, 0644);
+       if (IS_ERR(fp)) {
+               ret = PTR_ERR(fp);
+               printf("%s: open file error, err = %d\n", __FUNCTION__, ret);
+               goto exit;
+       }
+
+       /* Write buf to file */
+       fp->f_op->write(fp, buf, size, &pos);
+
+exit:
+       /* close file before return */
+       if (!ret)
+               filp_close(fp, current->files);
+
+       /* restore previous address limit */
+       set_fs(old_fs);
+
+       /* free buf before return */
+#if defined(CONFIG_DHD_USE_STATIC_BUF) && defined(DHD_USE_STATIC_MEMDUMP)
+       DHD_OS_PREFREE(dhd, buf, size);
+#else
+       MFREE(dhd->osh, buf, size);
+#endif /* CONFIG_DHD_USE_STATIC_BUF && DHD_USE_STATIC_MEMDUMP */
+
+       return ret;
+}
+#endif /* DHD_DEBUG */
+
+int dhd_os_wake_lock_timeout(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       unsigned long flags;
+       int ret = 0;
+
+       if (dhd) {
+               spin_lock_irqsave(&dhd->wakelock_spinlock, flags);
+               ret = dhd->wakelock_rx_timeout_enable > dhd->wakelock_ctrl_timeout_enable ?
+                       dhd->wakelock_rx_timeout_enable : dhd->wakelock_ctrl_timeout_enable;
+#ifdef CONFIG_HAS_WAKELOCK
+               if (dhd->wakelock_rx_timeout_enable)
+                       wake_lock_timeout(&dhd->wl_rxwake,
+                               msecs_to_jiffies(dhd->wakelock_rx_timeout_enable));
+               if (dhd->wakelock_ctrl_timeout_enable)
+                       wake_lock_timeout(&dhd->wl_ctrlwake,
+                               msecs_to_jiffies(dhd->wakelock_ctrl_timeout_enable));
+#endif
+               dhd->wakelock_rx_timeout_enable = 0;
+               dhd->wakelock_ctrl_timeout_enable = 0;
+               spin_unlock_irqrestore(&dhd->wakelock_spinlock, flags);
+       }
+       return ret;
+}
+
+int net_os_wake_lock_timeout(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       int ret = 0;
+
+       if (dhd)
+               ret = dhd_os_wake_lock_timeout(&dhd->pub);
+       return ret;
+}
+
+int dhd_os_wake_lock_rx_timeout_enable(dhd_pub_t *pub, int val)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       unsigned long flags;
+
+       if (dhd) {
+               spin_lock_irqsave(&dhd->wakelock_spinlock, flags);
+               if (val > dhd->wakelock_rx_timeout_enable)
+                       dhd->wakelock_rx_timeout_enable = val;
+               spin_unlock_irqrestore(&dhd->wakelock_spinlock, flags);
+       }
+       return 0;
+}
+
+int dhd_os_wake_lock_ctrl_timeout_enable(dhd_pub_t *pub, int val)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       unsigned long flags;
+
+       if (dhd) {
+               spin_lock_irqsave(&dhd->wakelock_spinlock, flags);
+               if (val > dhd->wakelock_ctrl_timeout_enable)
+                       dhd->wakelock_ctrl_timeout_enable = val;
+               spin_unlock_irqrestore(&dhd->wakelock_spinlock, flags);
+       }
+       return 0;
+}
+
+int dhd_os_wake_lock_ctrl_timeout_cancel(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       unsigned long flags;
+
+       if (dhd) {
+               spin_lock_irqsave(&dhd->wakelock_spinlock, flags);
+               dhd->wakelock_ctrl_timeout_enable = 0;
+#ifdef CONFIG_HAS_WAKELOCK
+               if (wake_lock_active(&dhd->wl_ctrlwake))
+                       wake_unlock(&dhd->wl_ctrlwake);
+#endif
+               spin_unlock_irqrestore(&dhd->wakelock_spinlock, flags);
+       }
+       return 0;
+}
+
+int net_os_wake_lock_rx_timeout_enable(struct net_device *dev, int val)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       int ret = 0;
+
+       if (dhd)
+               ret = dhd_os_wake_lock_rx_timeout_enable(&dhd->pub, val);
+       return ret;
+}
+
+int net_os_wake_lock_ctrl_timeout_enable(struct net_device *dev, int val)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       int ret = 0;
+
+       if (dhd)
+               ret = dhd_os_wake_lock_ctrl_timeout_enable(&dhd->pub, val);
+       return ret;
+}
+
+
+#if defined(DHD_TRACE_WAKE_LOCK)
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0))
+#include <linux/hashtable.h>
+#else
+#include <linux/hash.h>
+#endif /* KERNEL_VER >= KERNEL_VERSION(3, 7, 0) */
+
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0))
+/* Define 2^5 = 32 bucket size hash table */
+DEFINE_HASHTABLE(wklock_history, 5);
+#else
+/* Define 2^5 = 32 bucket size hash table */
+struct hlist_head wklock_history[32] = { [0 ... 31] = HLIST_HEAD_INIT };
+#endif /* KERNEL_VER >= KERNEL_VERSION(3, 7, 0) */
+
+int trace_wklock_onoff = 1;
+
+typedef enum dhd_wklock_type {
+       DHD_WAKE_LOCK,
+       DHD_WAKE_UNLOCK,
+       DHD_WAIVE_LOCK,
+       DHD_RESTORE_LOCK
+} dhd_wklock_t;
+
+struct wk_trace_record {
+       unsigned long addr;                 /* Address of the instruction */
+       dhd_wklock_t lock_type;         /* lock_type */
+       unsigned long long counter;             /* counter information */
+       struct hlist_node wklock_node;  /* hash node */
+};
+
+
+static struct wk_trace_record *find_wklock_entry(unsigned long addr)
+{
+       struct wk_trace_record *wklock_info;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0))
+       hash_for_each_possible(wklock_history, wklock_info, wklock_node, addr)
+#else
+       struct hlist_node *entry;
+       int index = hash_long(addr, ilog2(ARRAY_SIZE(wklock_history)));
+       hlist_for_each_entry(wklock_info, entry, &wklock_history[index], wklock_node)
+#endif /* KERNEL_VER >= KERNEL_VERSION(3, 7, 0) */
+       {
+               if (wklock_info->addr == addr) {
+                       return wklock_info;
+               }
+       }
+       return NULL;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0))
+#define HASH_ADD(hashtable, node, key) \
+       do { \
+               hash_add(hashtable, node, key); \
+       } while (0);
+#else
+#define HASH_ADD(hashtable, node, key) \
+       do { \
+               int index = hash_long(key, ilog2(ARRAY_SIZE(hashtable))); \
+               hlist_add_head(node, &hashtable[index]); \
+       } while (0);
+#endif /* KERNEL_VER < KERNEL_VERSION(3, 7, 0) */
+
+#define STORE_WKLOCK_RECORD(wklock_type) \
+       do { \
+               struct wk_trace_record *wklock_info = NULL; \
+               unsigned long func_addr = (unsigned long)__builtin_return_address(0); \
+               wklock_info = find_wklock_entry(func_addr); \
+               if (wklock_info) { \
+                       if (wklock_type == DHD_WAIVE_LOCK || wklock_type == DHD_RESTORE_LOCK) { \
+                               wklock_info->counter = dhd->wakelock_counter; \
+                       } else { \
+                               wklock_info->counter++; \
+                       } \
+               } else { \
+                       wklock_info = kzalloc(sizeof(*wklock_info), GFP_ATOMIC); \
+                       if (!wklock_info) {\
+                               printk("Can't allocate wk_trace_record \n"); \
+                       } else { \
+                               wklock_info->addr = func_addr; \
+                               wklock_info->lock_type = wklock_type; \
+                               if (wklock_type == DHD_WAIVE_LOCK || \
+                                               wklock_type == DHD_RESTORE_LOCK) { \
+                                       wklock_info->counter = dhd->wakelock_counter; \
+                               } else { \
+                                       wklock_info->counter++; \
+                               } \
+                               HASH_ADD(wklock_history, &wklock_info->wklock_node, func_addr); \
+                       } \
+               } \
+       } while (0);
+
+static inline void dhd_wk_lock_rec_dump(void)
+{
+       int bkt;
+       struct wk_trace_record *wklock_info;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0))
+       hash_for_each(wklock_history, bkt, wklock_info, wklock_node)
+#else
+       struct hlist_node *entry = NULL;
+       int max_index = ARRAY_SIZE(wklock_history);
+       for (bkt = 0; bkt < max_index; bkt++)
+               hlist_for_each_entry(wklock_info, entry, &wklock_history[bkt], wklock_node)
+#endif /* KERNEL_VER >= KERNEL_VERSION(3, 7, 0) */
+               {
+                       switch (wklock_info->lock_type) {
+                               case DHD_WAKE_LOCK:
+                                       DHD_ERROR(("wakelock lock : %pS  lock_counter : %llu\n",
+                                               (void *)wklock_info->addr, wklock_info->counter));
+                                       break;
+                               case DHD_WAKE_UNLOCK:
+                                       DHD_ERROR(("wakelock unlock : %pS, unlock_counter : %llu\n",
+                                               (void *)wklock_info->addr, wklock_info->counter));
+                                       break;
+                               case DHD_WAIVE_LOCK:
+                                       DHD_ERROR(("wakelock waive : %pS  before_waive : %llu\n",
+                                               (void *)wklock_info->addr, wklock_info->counter));
+                                       break;
+                               case DHD_RESTORE_LOCK:
+                                       DHD_ERROR(("wakelock restore : %pS, after_waive : %llu\n",
+                                               (void *)wklock_info->addr, wklock_info->counter));
+                                       break;
+                       }
+               }
+}
+
+static void dhd_wk_lock_trace_init(struct dhd_info *dhd)
+{
+       unsigned long flags;
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 7, 0))
+       int i;
+#endif /* KERNEL_VER >= KERNEL_VERSION(3, 7, 0) */
+
+       spin_lock_irqsave(&dhd->wakelock_spinlock, flags);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0))
+       hash_init(wklock_history);
+#else
+       for (i = 0; i < ARRAY_SIZE(wklock_history); i++)
+               INIT_HLIST_HEAD(&wklock_history[i]);
+#endif /* KERNEL_VER >= KERNEL_VERSION(3, 7, 0) */
+       spin_unlock_irqrestore(&dhd->wakelock_spinlock, flags);
+}
+
+static void dhd_wk_lock_trace_deinit(struct dhd_info *dhd)
+{
+       int bkt;
+       struct wk_trace_record *wklock_info;
+       struct hlist_node *tmp;
+       unsigned long flags;
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 7, 0))
+       struct hlist_node *entry = NULL;
+       int max_index = ARRAY_SIZE(wklock_history);
+#endif /* KERNEL_VER >= KERNEL_VERSION(3, 7, 0) */
+
+       spin_lock_irqsave(&dhd->wakelock_spinlock, flags);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0))
+       hash_for_each_safe(wklock_history, bkt, tmp, wklock_info, wklock_node)
+#else
+       for (bkt = 0; bkt < max_index; bkt++)
+               hlist_for_each_entry_safe(wklock_info, entry, tmp,
+                       &wklock_history[bkt], wklock_node)
+#endif /* KERNEL_VER >= KERNEL_VERSION(3, 7, 0)) */
+               {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0))
+                       hash_del(&wklock_info->wklock_node);
+#else
+                       hlist_del_init(&wklock_info->wklock_node);
+#endif /* KERNEL_VER >= KERNEL_VERSION(3, 7, 0)) */
+                       kfree(wklock_info);
+               }
+       spin_unlock_irqrestore(&dhd->wakelock_spinlock, flags);
+}
+
+void dhd_wk_lock_stats_dump(dhd_pub_t *dhdp)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(dhdp->info);
+       unsigned long flags;
+
+       DHD_ERROR((KERN_ERR"DHD Printing wl_wake Lock/Unlock Record \r\n"));
+       spin_lock_irqsave(&dhd->wakelock_spinlock, flags);
+       dhd_wk_lock_rec_dump();
+       spin_unlock_irqrestore(&dhd->wakelock_spinlock, flags);
+}
+#else
+#define STORE_WKLOCK_RECORD(wklock_type)
+#endif /* ! DHD_TRACE_WAKE_LOCK */
+
+int dhd_os_wake_lock(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       unsigned long flags;
+       int ret = 0;
+
+       if (dhd) {
+               spin_lock_irqsave(&dhd->wakelock_spinlock, flags);
+               if (dhd->wakelock_counter == 0 && !dhd->waive_wakelock) {
+#ifdef CONFIG_HAS_WAKELOCK
+                       wake_lock(&dhd->wl_wifi);
+#elif defined(BCMSDIO) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36))
+                       dhd_bus_dev_pm_stay_awake(pub);
+#endif
+               }
+#ifdef DHD_TRACE_WAKE_LOCK
+               if (trace_wklock_onoff) {
+                       STORE_WKLOCK_RECORD(DHD_WAKE_LOCK);
+               }
+#endif /* DHD_TRACE_WAKE_LOCK */
+               dhd->wakelock_counter++;
+               ret = dhd->wakelock_counter;
+               spin_unlock_irqrestore(&dhd->wakelock_spinlock, flags);
+       }
+
+       return ret;
+}
+
+void dhd_event_wake_lock(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+#ifdef CONFIG_HAS_WAKELOCK
+               wake_lock(&dhd->wl_evtwake);
+#elif defined(BCMSDIO) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36))
+               dhd_bus_dev_pm_stay_awake(pub);
+#endif
+       }
+}
+
+void
+dhd_pm_wake_lock_timeout(dhd_pub_t *pub, int val)
+{
+#ifdef CONFIG_HAS_WAKELOCK
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               wake_lock_timeout(&dhd->wl_pmwake, msecs_to_jiffies(val));
+       }
+#endif /* CONFIG_HAS_WAKE_LOCK */
+}
+
+void
+dhd_txfl_wake_lock(dhd_pub_t *pub)
+{
+#ifdef CONFIG_HAS_WAKELOCK
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               wake_lock(&dhd->wl_txflwake);
+       }
+#endif /* CONFIG_HAS_WAKE_LOCK */
+}
+
+int net_os_wake_lock(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       int ret = 0;
+
+       if (dhd)
+               ret = dhd_os_wake_lock(&dhd->pub);
+       return ret;
+}
+
+int dhd_os_wake_unlock(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       unsigned long flags;
+       int ret = 0;
+
+       dhd_os_wake_lock_timeout(pub);
+       if (dhd) {
+               spin_lock_irqsave(&dhd->wakelock_spinlock, flags);
+
+               if (dhd->wakelock_counter > 0) {
+                       dhd->wakelock_counter--;
+#ifdef DHD_TRACE_WAKE_LOCK
+                       if (trace_wklock_onoff) {
+                               STORE_WKLOCK_RECORD(DHD_WAKE_UNLOCK);
+                       }
+#endif /* DHD_TRACE_WAKE_LOCK */
+                       if (dhd->wakelock_counter == 0 && !dhd->waive_wakelock) {
+#ifdef CONFIG_HAS_WAKELOCK
+                               wake_unlock(&dhd->wl_wifi);
+#elif defined(BCMSDIO) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36))
+                               dhd_bus_dev_pm_relax(pub);
+#endif
+                       }
+                       ret = dhd->wakelock_counter;
+               }
+               spin_unlock_irqrestore(&dhd->wakelock_spinlock, flags);
+       }
+       return ret;
+}
+
+void dhd_event_wake_unlock(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+#ifdef CONFIG_HAS_WAKELOCK
+               wake_unlock(&dhd->wl_evtwake);
+#elif defined(BCMSDIO) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36))
+               dhd_bus_dev_pm_relax(pub);
+#endif
+       }
+}
+
+void dhd_pm_wake_unlock(dhd_pub_t *pub)
+{
+#ifdef CONFIG_HAS_WAKELOCK
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               /* if wl_pmwake is active, unlock it */
+               if (wake_lock_active(&dhd->wl_pmwake)) {
+                       wake_unlock(&dhd->wl_pmwake);
+               }
+       }
+#endif /* CONFIG_HAS_WAKELOCK */
+}
+
+void dhd_txfl_wake_unlock(dhd_pub_t *pub)
+{
+#ifdef CONFIG_HAS_WAKELOCK
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               /* if wl_txflwake is active, unlock it */
+               if (wake_lock_active(&dhd->wl_txflwake)) {
+                       wake_unlock(&dhd->wl_txflwake);
+               }
+       }
+#endif /* CONFIG_HAS_WAKELOCK */
+}
+
+int dhd_os_check_wakelock(dhd_pub_t *pub)
+{
+#if defined(CONFIG_HAS_WAKELOCK) || (defined(BCMSDIO) && (LINUX_VERSION_CODE > \
+       KERNEL_VERSION(2, 6, 36)))
+       dhd_info_t *dhd;
+
+       if (!pub)
+               return 0;
+       dhd = (dhd_info_t *)(pub->info);
+#endif /* CONFIG_HAS_WAKELOCK || BCMSDIO */
+
+#ifdef CONFIG_HAS_WAKELOCK
+       /* Indicate to the SD Host to avoid going to suspend if internal locks are up */
+       if (dhd && (wake_lock_active(&dhd->wl_wifi) ||
+               (wake_lock_active(&dhd->wl_wdwake))))
+               return 1;
+#elif defined(BCMSDIO) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36))
+       if (dhd && (dhd->wakelock_counter > 0) && dhd_bus_dev_pm_enabled(pub))
+               return 1;
+#endif
+       return 0;
+}
+
+int
+dhd_os_check_wakelock_all(dhd_pub_t *pub)
+{
+#ifdef CONFIG_HAS_WAKELOCK
+       int l1, l2, l3, l4, l7, l8, l9;
+       int l5 = 0, l6 = 0;
+       int c, lock_active;
+#endif /* CONFIG_HAS_WAKELOCK */
+#if defined(CONFIG_HAS_WAKELOCK) || (defined(BCMSDIO) && (LINUX_VERSION_CODE > \
+       KERNEL_VERSION(2, 6, 36)))
+       dhd_info_t *dhd;
+
+       if (!pub) {
+               return 0;
+       }
+       dhd = (dhd_info_t *)(pub->info);
+       if (!dhd) {
+               return 0;
+       }
+#endif /* CONFIG_HAS_WAKELOCK || BCMSDIO */
+
+#ifdef CONFIG_HAS_WAKELOCK
+       c = dhd->wakelock_counter;
+       l1 = wake_lock_active(&dhd->wl_wifi);
+       l2 = wake_lock_active(&dhd->wl_wdwake);
+       l3 = wake_lock_active(&dhd->wl_rxwake);
+       l4 = wake_lock_active(&dhd->wl_ctrlwake);
+#ifdef BCMPCIE_OOB_HOST_WAKE
+       l5 = wake_lock_active(&dhd->wl_intrwake);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+#ifdef DHD_USE_SCAN_WAKELOCK
+       l6 = wake_lock_active(&dhd->wl_scanwake);
+#endif /* DHD_USE_SCAN_WAKELOCK */
+       l7 = wake_lock_active(&dhd->wl_evtwake);
+       l8 = wake_lock_active(&dhd->wl_pmwake);
+       l9 = wake_lock_active(&dhd->wl_txflwake);
+       lock_active = (l1 || l2 || l3 || l4 || l5 || l6 || l7 || l8 || l9);
+
+       /* Indicate to the Host to avoid going to suspend if internal locks are up */
+       if (dhd && lock_active) {
+               DHD_ERROR(("%s wakelock c-%d wl-%d wd-%d rx-%d "
+                       "ctl-%d intr-%d scan-%d evt-%d, pm-%d, txfl-%d\n",
+                       __FUNCTION__, c, l1, l2, l3, l4, l5, l6, l7, l8, l9));
+               return 1;
+       }
+#elif defined(BCMSDIO) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36))
+       if (dhd && (dhd->wakelock_counter > 0) && dhd_bus_dev_pm_enabled(pub)) {
+               return 1;
+       }
+#endif /* CONFIG_HAS_WAKELOCK */
+       return 0;
+}
+
+int net_os_wake_unlock(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       int ret = 0;
+
+       if (dhd)
+               ret = dhd_os_wake_unlock(&dhd->pub);
+       return ret;
+}
+
+int dhd_os_wd_wake_lock(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       unsigned long flags;
+       int ret = 0;
+
+       if (dhd) {
+               spin_lock_irqsave(&dhd->wakelock_spinlock, flags);
+#ifdef CONFIG_HAS_WAKELOCK
+               /* if wakelock_wd_counter was never used : lock it at once */
+               if (!dhd->wakelock_wd_counter)
+                       wake_lock(&dhd->wl_wdwake);
+#endif
+               dhd->wakelock_wd_counter++;
+               ret = dhd->wakelock_wd_counter;
+               spin_unlock_irqrestore(&dhd->wakelock_spinlock, flags);
+       }
+       return ret;
+}
+
+int dhd_os_wd_wake_unlock(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       unsigned long flags;
+       int ret = 0;
+
+       if (dhd) {
+               spin_lock_irqsave(&dhd->wakelock_spinlock, flags);
+               if (dhd->wakelock_wd_counter) {
+                       dhd->wakelock_wd_counter = 0;
+#ifdef CONFIG_HAS_WAKELOCK
+                       wake_unlock(&dhd->wl_wdwake);
+#endif
+               }
+               spin_unlock_irqrestore(&dhd->wakelock_spinlock, flags);
+       }
+       return ret;
+}
+
+#ifdef BCMPCIE_OOB_HOST_WAKE
+void
+dhd_os_oob_irq_wake_lock_timeout(dhd_pub_t *pub, int val)
+{
+#ifdef CONFIG_HAS_WAKELOCK
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               wake_lock_timeout(&dhd->wl_intrwake, msecs_to_jiffies(val));
+       }
+#endif /* CONFIG_HAS_WAKELOCK */
+}
+
+void
+dhd_os_oob_irq_wake_unlock(dhd_pub_t *pub)
+{
+#ifdef CONFIG_HAS_WAKELOCK
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               /* if wl_intrwake is active, unlock it */
+               if (wake_lock_active(&dhd->wl_intrwake)) {
+                       wake_unlock(&dhd->wl_intrwake);
+               }
+       }
+#endif /* CONFIG_HAS_WAKELOCK */
+}
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+
+#ifdef DHD_USE_SCAN_WAKELOCK
+void
+dhd_os_scan_wake_lock_timeout(dhd_pub_t *pub, int val)
+{
+#ifdef CONFIG_HAS_WAKELOCK
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               wake_lock_timeout(&dhd->wl_scanwake, msecs_to_jiffies(val));
+       }
+#endif /* CONFIG_HAS_WAKELOCK */
+}
+
+void
+dhd_os_scan_wake_unlock(dhd_pub_t *pub)
+{
+#ifdef CONFIG_HAS_WAKELOCK
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+       if (dhd) {
+               /* if wl_scanwake is active, unlock it */
+               if (wake_lock_active(&dhd->wl_scanwake)) {
+                       wake_unlock(&dhd->wl_scanwake);
+               }
+       }
+#endif /* CONFIG_HAS_WAKELOCK */
+}
+#endif /* DHD_USE_SCAN_WAKELOCK */
+
+/* waive wakelocks for operations such as IOVARs in suspend function, must be closed
+ * by a paired function call to dhd_wakelock_restore. returns current wakelock counter
+ */
+int dhd_os_wake_lock_waive(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       unsigned long flags;
+       int ret = 0;
+
+       if (dhd) {
+               spin_lock_irqsave(&dhd->wakelock_spinlock, flags);
+
+               /* dhd_wakelock_waive/dhd_wakelock_restore must be paired */
+               if (dhd->waive_wakelock == FALSE) {
+#ifdef DHD_TRACE_WAKE_LOCK
+                       if (trace_wklock_onoff) {
+                               STORE_WKLOCK_RECORD(DHD_WAIVE_LOCK);
+                       }
+#endif /* DHD_TRACE_WAKE_LOCK */
+                       /* record current lock status */
+                       dhd->wakelock_before_waive = dhd->wakelock_counter;
+                       dhd->waive_wakelock = TRUE;
+               }
+               ret = dhd->wakelock_wd_counter;
+               spin_unlock_irqrestore(&dhd->wakelock_spinlock, flags);
+       }
+       return ret;
+}
+
+int dhd_os_wake_lock_restore(dhd_pub_t *pub)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+       unsigned long flags;
+       int ret = 0;
+
+       if (!dhd)
+               return 0;
+
+       spin_lock_irqsave(&dhd->wakelock_spinlock, flags);
+
+       /* dhd_wakelock_waive/dhd_wakelock_restore must be paired */
+       if (!dhd->waive_wakelock)
+               goto exit;
+
+       dhd->waive_wakelock = FALSE;
+       /* if somebody else acquires wakelock between dhd_wakelock_waive/dhd_wakelock_restore,
+        * we need to make it up by calling wake_lock or pm_stay_awake. or if somebody releases
+        * the lock in between, do the same by calling wake_unlock or pm_relax
+        */
+#ifdef DHD_TRACE_WAKE_LOCK
+       if (trace_wklock_onoff) {
+               STORE_WKLOCK_RECORD(DHD_RESTORE_LOCK);
+       }
+#endif /* DHD_TRACE_WAKE_LOCK */
+
+       if (dhd->wakelock_before_waive == 0 && dhd->wakelock_counter > 0) {
+#ifdef CONFIG_HAS_WAKELOCK
+               wake_lock(&dhd->wl_wifi);
+#elif defined(BCMSDIO) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36))
+               dhd_bus_dev_pm_stay_awake(&dhd->pub);
+#endif
+       } else if (dhd->wakelock_before_waive > 0 && dhd->wakelock_counter == 0) {
+#ifdef CONFIG_HAS_WAKELOCK
+               wake_unlock(&dhd->wl_wifi);
+#elif defined(BCMSDIO) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36))
+               dhd_bus_dev_pm_relax(&dhd->pub);
+#endif
+       }
+       dhd->wakelock_before_waive = 0;
+exit:
+       ret = dhd->wakelock_wd_counter;
+       spin_unlock_irqrestore(&dhd->wakelock_spinlock, flags);
+       return ret;
+}
+
+void dhd_os_wake_lock_init(struct dhd_info *dhd)
+{
+       DHD_TRACE(("%s: initialize wake_lock_counters\n", __FUNCTION__));
+       dhd->wakelock_counter = 0;
+       dhd->wakelock_rx_timeout_enable = 0;
+       dhd->wakelock_ctrl_timeout_enable = 0;
+#ifdef CONFIG_HAS_WAKELOCK
+       wake_lock_init(&dhd->wl_wifi, WAKE_LOCK_SUSPEND, "wlan_wake");
+       wake_lock_init(&dhd->wl_rxwake, WAKE_LOCK_SUSPEND, "wlan_rx_wake");
+       wake_lock_init(&dhd->wl_ctrlwake, WAKE_LOCK_SUSPEND, "wlan_ctrl_wake");
+       wake_lock_init(&dhd->wl_evtwake, WAKE_LOCK_SUSPEND, "wlan_evt_wake");
+       wake_lock_init(&dhd->wl_pmwake, WAKE_LOCK_SUSPEND, "wlan_pm_wake");
+       wake_lock_init(&dhd->wl_txflwake, WAKE_LOCK_SUSPEND, "wlan_txfl_wake");
+#ifdef BCMPCIE_OOB_HOST_WAKE
+       wake_lock_init(&dhd->wl_intrwake, WAKE_LOCK_SUSPEND, "wlan_oob_irq_wake");
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+#ifdef DHD_USE_SCAN_WAKELOCK
+       wake_lock_init(&dhd->wl_scanwake, WAKE_LOCK_SUSPEND, "wlan_scan_wake");
+#endif /* DHD_USE_SCAN_WAKELOCK */
+#endif /* CONFIG_HAS_WAKELOCK */
+#ifdef DHD_TRACE_WAKE_LOCK
+       dhd_wk_lock_trace_init(dhd);
+#endif /* DHD_TRACE_WAKE_LOCK */
+}
+
+void dhd_os_wake_lock_destroy(struct dhd_info *dhd)
+{
+       DHD_TRACE(("%s: deinit wake_lock_counters\n", __FUNCTION__));
+#ifdef CONFIG_HAS_WAKELOCK
+       dhd->wakelock_counter = 0;
+       dhd->wakelock_rx_timeout_enable = 0;
+       dhd->wakelock_ctrl_timeout_enable = 0;
+       wake_lock_destroy(&dhd->wl_wifi);
+       wake_lock_destroy(&dhd->wl_rxwake);
+       wake_lock_destroy(&dhd->wl_ctrlwake);
+       wake_lock_destroy(&dhd->wl_evtwake);
+       wake_lock_destroy(&dhd->wl_pmwake);
+       wake_lock_destroy(&dhd->wl_txflwake);
+#ifdef BCMPCIE_OOB_HOST_WAKE
+       wake_lock_destroy(&dhd->wl_intrwake);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+#ifdef DHD_USE_SCAN_WAKELOCK
+       wake_lock_destroy(&dhd->wl_scanwake);
+#endif /* DHD_USE_SCAN_WAKELOCK */
+#ifdef DHD_TRACE_WAKE_LOCK
+       dhd_wk_lock_trace_deinit(dhd);
+#endif /* DHD_TRACE_WAKE_LOCK */
+#endif /* CONFIG_HAS_WAKELOCK */
+}
+
+bool dhd_os_check_if_up(dhd_pub_t *pub)
+{
+       if (!pub)
+               return FALSE;
+       return pub->up;
+}
+
+#if defined(BCMSDIO)
+/* function to collect firmware, chip id and chip version info */
+void dhd_set_version_info(dhd_pub_t *dhdp, char *fw)
+{
+       int i;
+
+       i = snprintf(info_string, sizeof(info_string),
+               "  Driver: %s\n  Firmware: %s ", EPI_VERSION_STR, fw);
+
+       if (!dhdp)
+               return;
+
+       i = snprintf(&info_string[i], sizeof(info_string) - i,
+               "\n  Chip: %x Rev %x Pkg %x", dhd_bus_chip_id(dhdp),
+               dhd_bus_chiprev_id(dhdp), dhd_bus_chippkg_id(dhdp));
+}
+#endif /* defined(BCMSDIO) */
+int dhd_ioctl_entry_local(struct net_device *net, wl_ioctl_t *ioc, int cmd)
+{
+       int ifidx;
+       int ret = 0;
+       dhd_info_t *dhd = NULL;
+
+       if (!net || !DEV_PRIV(net)) {
+               DHD_ERROR(("%s invalid parameter\n", __FUNCTION__));
+               return -EINVAL;
+       }
+
+       dhd = DHD_DEV_INFO(net);
+       if (!dhd)
+               return -EINVAL;
+
+       ifidx = dhd_net2idx(dhd, net);
+       if (ifidx == DHD_BAD_IF) {
+               DHD_ERROR(("%s bad ifidx\n", __FUNCTION__));
+               return -ENODEV;
+       }
+
+       DHD_OS_WAKE_LOCK(&dhd->pub);
+       DHD_PERIM_LOCK(&dhd->pub);
+
+       ret = dhd_wl_ioctl(&dhd->pub, ifidx, ioc, ioc->buf, ioc->len);
+       dhd_check_hang(net, &dhd->pub, ret);
+
+       DHD_PERIM_UNLOCK(&dhd->pub);
+       DHD_OS_WAKE_UNLOCK(&dhd->pub);
+
+       return ret;
+}
+
+bool dhd_os_check_hang(dhd_pub_t *dhdp, int ifidx, int ret)
+{
+       struct net_device *net;
+
+       net = dhd_idx2net(dhdp, ifidx);
+       if (!net) {
+               DHD_ERROR(("%s : Invalid index : %d\n", __FUNCTION__, ifidx));
+               return -EINVAL;
+       }
+
+       return dhd_check_hang(net, dhdp, ret);
+}
+
+/* Return instance */
+int dhd_get_instance(dhd_pub_t *dhdp)
+{
+       return dhdp->info->unit;
+}
+
+
+#ifdef PROP_TXSTATUS
+
+void dhd_wlfc_plat_init(void *dhd)
+{
+#ifdef USE_DYNAMIC_F2_BLKSIZE
+       dhdsdio_func_blocksize((dhd_pub_t *)dhd, 2, DYNAMIC_F2_BLKSIZE_FOR_NONLEGACY);
+#endif /* USE_DYNAMIC_F2_BLKSIZE */
+       return;
+}
+
+void dhd_wlfc_plat_deinit(void *dhd)
+{
+#ifdef USE_DYNAMIC_F2_BLKSIZE
+       dhdsdio_func_blocksize((dhd_pub_t *)dhd, 2, sd_f2_blocksize);
+#endif /* USE_DYNAMIC_F2_BLKSIZE */
+       return;
+}
+
+bool dhd_wlfc_skip_fc(void *dhd)
+{
+#ifdef SKIP_WLFC_ON_CONCURRENT
+#ifdef WL_CFG80211
+       dhd_pub_t *dhdp = (dhd_pub_t *)dhd;
+
+       /* enable flow control in vsdb mode */
+       return !(wl_cfg80211_is_concurrent_mode(DHD_GET_CFG80211_PRIV(dhdp)));
+#else
+       return TRUE; /* skip flow control */
+#endif /* WL_CFG80211 */
+
+#else
+       return FALSE;
+#endif /* SKIP_WLFC_ON_CONCURRENT */
+}
+#endif /* PROP_TXSTATUS */
+
+#ifdef BCMDBGFS
+#include <linux/debugfs.h>
+
+typedef struct dhd_dbgfs {
+       struct dentry   *debugfs_dir;
+       struct dentry   *debugfs_mem;
+       dhd_pub_t       *dhdp;
+       uint32          size;
+} dhd_dbgfs_t;
+
+dhd_dbgfs_t g_dbgfs;
+
+extern uint32 dhd_readregl(void *bp, uint32 addr);
+extern uint32 dhd_writeregl(void *bp, uint32 addr, uint32 data);
+
+static int
+dhd_dbg_state_open(struct inode *inode, struct file *file)
+{
+       file->private_data = inode->i_private;
+       return 0;
+}
+
+static ssize_t
+dhd_dbg_state_read(struct file *file, char __user *ubuf,
+                       size_t count, loff_t *ppos)
+{
+       ssize_t rval;
+       uint32 tmp;
+       loff_t pos = *ppos;
+       size_t ret;
+
+       if (pos < 0)
+               return -EINVAL;
+       if (pos >= g_dbgfs.size || !count)
+               return 0;
+       if (count > g_dbgfs.size - pos)
+               count = g_dbgfs.size - pos;
+
+       /* Basically enforce aligned 4 byte reads. It's up to the user to work out the details */
+       tmp = dhd_readregl(g_dbgfs.dhdp->bus, file->f_pos & (~3));
+
+       ret = copy_to_user(ubuf, &tmp, 4);
+       if (ret == count)
+               return -EFAULT;
+
+       count -= ret;
+       *ppos = pos + count;
+       rval = count;
+
+       return rval;
+}
+
+
+static ssize_t
+dhd_debugfs_write(struct file *file, const char __user *ubuf, size_t count, loff_t *ppos)
+{
+       loff_t pos = *ppos;
+       size_t ret;
+       uint32 buf;
+
+       if (pos < 0)
+               return -EINVAL;
+       if (pos >= g_dbgfs.size || !count)
+               return 0;
+       if (count > g_dbgfs.size - pos)
+               count = g_dbgfs.size - pos;
+
+       ret = copy_from_user(&buf, ubuf, sizeof(uint32));
+       if (ret == count)
+               return -EFAULT;
+
+       /* Basically enforce aligned 4 byte writes. It's up to the user to work out the details */
+       dhd_writeregl(g_dbgfs.dhdp->bus, file->f_pos & (~3), buf);
+
+       return count;
+}
+
+
+loff_t
+dhd_debugfs_lseek(struct file *file, loff_t off, int whence)
+{
+       loff_t pos = -1;
+
+       switch (whence) {
+               case 0:
+                       pos = off;
+                       break;
+               case 1:
+                       pos = file->f_pos + off;
+                       break;
+               case 2:
+                       pos = g_dbgfs.size - off;
+       }
+       return (pos < 0 || pos > g_dbgfs.size) ? -EINVAL : (file->f_pos = pos);
+}
+
+static const struct file_operations dhd_dbg_state_ops = {
+       .read   = dhd_dbg_state_read,
+       .write  = dhd_debugfs_write,
+       .open   = dhd_dbg_state_open,
+       .llseek = dhd_debugfs_lseek
+};
+
+static void dhd_dbg_create(void)
+{
+       if (g_dbgfs.debugfs_dir) {
+               g_dbgfs.debugfs_mem = debugfs_create_file("mem", 0644, g_dbgfs.debugfs_dir,
+                       NULL, &dhd_dbg_state_ops);
+       }
+}
+
+void dhd_dbg_init(dhd_pub_t *dhdp)
+{
+       g_dbgfs.dhdp = dhdp;
+       g_dbgfs.size = 0x20000000; /* Allow access to various cores regs */
+
+       g_dbgfs.debugfs_dir = debugfs_create_dir("dhd", 0);
+       if (IS_ERR(g_dbgfs.debugfs_dir)) {
+               g_dbgfs.debugfs_dir = NULL;
+               return;
+       }
+
+       dhd_dbg_create();
+
+       return;
+}
+
+void dhd_dbg_remove(void)
+{
+       debugfs_remove(g_dbgfs.debugfs_mem);
+       debugfs_remove(g_dbgfs.debugfs_dir);
+
+       bzero((unsigned char *) &g_dbgfs, sizeof(g_dbgfs));
+}
+#endif /* BCMDBGFS */
+
+#ifdef WLMEDIA_HTSF
+
+static
+void dhd_htsf_addtxts(dhd_pub_t *dhdp, void *pktbuf)
+{
+       dhd_info_t *dhd = (dhd_info_t *)(dhdp->info);
+       struct sk_buff *skb;
+       uint32 htsf = 0;
+       uint16 dport = 0, oldmagic = 0xACAC;
+       char *p1;
+       htsfts_t ts;
+
+       /*  timestamp packet  */
+
+       p1 = (char*) PKTDATA(dhdp->osh, pktbuf);
+
+       if (PKTLEN(dhdp->osh, pktbuf) > HTSF_MINLEN) {
+/*             memcpy(&proto, p1+26, 4);       */
+               memcpy(&dport, p1+40, 2);
+/*     proto = ((ntoh32(proto))>> 16) & 0xFF;  */
+               dport = ntoh16(dport);
+       }
+
+       /* timestamp only if  icmp or udb iperf with port 5555 */
+/*     if (proto == 17 && dport == tsport) { */
+       if (dport >= tsport && dport <= tsport + 20) {
+
+               skb = (struct sk_buff *) pktbuf;
+
+               htsf = dhd_get_htsf(dhd, 0);
+               memset(skb->data + 44, 0, 2); /* clear checksum */
+               memcpy(skb->data+82, &oldmagic, 2);
+               memcpy(skb->data+84, &htsf, 4);
+
+               memset(&ts, 0, sizeof(htsfts_t));
+               ts.magic  = HTSFMAGIC;
+               ts.prio   = PKTPRIO(pktbuf);
+               ts.seqnum = htsf_seqnum++;
+               ts.c10    = get_cycles();
+               ts.t10    = htsf;
+               ts.endmagic = HTSFENDMAGIC;
+
+               memcpy(skb->data + HTSF_HOSTOFFSET, &ts, sizeof(ts));
+       }
+}
+
+static void dhd_dump_htsfhisto(histo_t *his, char *s)
+{
+       int pktcnt = 0, curval = 0, i;
+       for (i = 0; i < (NUMBIN-2); i++) {
+               curval += 500;
+               printf("%d ",  his->bin[i]);
+               pktcnt += his->bin[i];
+       }
+       printf(" max: %d TotPkt: %d neg: %d [%s]\n", his->bin[NUMBIN-2], pktcnt,
+               his->bin[NUMBIN-1], s);
+}
+
+static
+void sorttobin(int value, histo_t *histo)
+{
+       int i, binval = 0;
+
+       if (value < 0) {
+               histo->bin[NUMBIN-1]++;
+               return;
+       }
+       if (value > histo->bin[NUMBIN-2])  /* store the max value  */
+               histo->bin[NUMBIN-2] = value;
+
+       for (i = 0; i < (NUMBIN-2); i++) {
+               binval += 500; /* 500m s bins */
+               if (value <= binval) {
+                       histo->bin[i]++;
+                       return;
+               }
+       }
+       histo->bin[NUMBIN-3]++;
+}
+
+static
+void dhd_htsf_addrxts(dhd_pub_t *dhdp, void *pktbuf)
+{
+       dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+       struct sk_buff *skb;
+       char *p1;
+       uint16 old_magic;
+       int d1, d2, d3, end2end;
+       htsfts_t *htsf_ts;
+       uint32 htsf;
+
+       skb = PKTTONATIVE(dhdp->osh, pktbuf);
+       p1 = (char*)PKTDATA(dhdp->osh, pktbuf);
+
+       if (PKTLEN(osh, pktbuf) > HTSF_MINLEN) {
+               memcpy(&old_magic, p1+78, 2);
+               htsf_ts = (htsfts_t*) (p1 + HTSF_HOSTOFFSET - 4);
+       } else {
+               return;
+       }
+       if (htsf_ts->magic == HTSFMAGIC) {
+               htsf_ts->tE0 = dhd_get_htsf(dhd, 0);
+               htsf_ts->cE0 = get_cycles();
+       }
+
+       if (old_magic == 0xACAC) {
+
+               tspktcnt++;
+               htsf = dhd_get_htsf(dhd, 0);
+               memcpy(skb->data+92, &htsf, sizeof(uint32));
+
+               memcpy(&ts[tsidx].t1, skb->data+80, 16);
+
+               d1 = ts[tsidx].t2 - ts[tsidx].t1;
+               d2 = ts[tsidx].t3 - ts[tsidx].t2;
+               d3 = ts[tsidx].t4 - ts[tsidx].t3;
+               end2end = ts[tsidx].t4 - ts[tsidx].t1;
+
+               sorttobin(d1, &vi_d1);
+               sorttobin(d2, &vi_d2);
+               sorttobin(d3, &vi_d3);
+               sorttobin(end2end, &vi_d4);
+
+               if (end2end > 0 && end2end >  maxdelay) {
+                       maxdelay = end2end;
+                       maxdelaypktno = tspktcnt;
+                       memcpy(&maxdelayts, &ts[tsidx], 16);
+               }
+               if (++tsidx >= TSMAX)
+                       tsidx = 0;
+       }
+}
+
+uint32 dhd_get_htsf(dhd_info_t *dhd, int ifidx)
+{
+       uint32 htsf = 0, cur_cycle, delta, delta_us;
+       uint32    factor, baseval, baseval2;
+       cycles_t t;
+
+       t = get_cycles();
+       cur_cycle = t;
+
+       if (cur_cycle >  dhd->htsf.last_cycle) {
+               delta = cur_cycle -  dhd->htsf.last_cycle;
+       } else {
+               delta = cur_cycle + (0xFFFFFFFF -  dhd->htsf.last_cycle);
+       }
+
+       delta = delta >> 4;
+
+       if (dhd->htsf.coef) {
+               /* times ten to get the first digit */
+               factor = (dhd->htsf.coef*10 + dhd->htsf.coefdec1);
+               baseval  = (delta*10)/factor;
+               baseval2 = (delta*10)/(factor+1);
+               delta_us  = (baseval -  (((baseval - baseval2) * dhd->htsf.coefdec2)) / 10);
+               htsf = (delta_us << 4) +  dhd->htsf.last_tsf + HTSF_BUS_DELAY;
+       } else {
+               DHD_ERROR(("-------dhd->htsf.coef = 0 -------\n"));
+       }
+
+       return htsf;
+}
+
+static void dhd_dump_latency(void)
+{
+       int i, max = 0;
+       int d1, d2, d3, d4, d5;
+
+       printf("T1       T2       T3       T4           d1  d2   t4-t1     i    \n");
+       for (i = 0; i < TSMAX; i++) {
+               d1 = ts[i].t2 - ts[i].t1;
+               d2 = ts[i].t3 - ts[i].t2;
+               d3 = ts[i].t4 - ts[i].t3;
+               d4 = ts[i].t4 - ts[i].t1;
+               d5 = ts[max].t4-ts[max].t1;
+               if (d4 > d5 && d4 > 0)  {
+                       max = i;
+               }
+               printf("%08X %08X %08X %08X \t%d %d %d   %d i=%d\n",
+                       ts[i].t1, ts[i].t2, ts[i].t3, ts[i].t4,
+                       d1, d2, d3, d4, i);
+       }
+
+       printf("current idx = %d \n", tsidx);
+
+       printf("Highest latency %d pkt no.%d total=%d\n", maxdelay, maxdelaypktno, tspktcnt);
+       printf("%08X %08X %08X %08X \t%d %d %d   %d\n",
+       maxdelayts.t1, maxdelayts.t2, maxdelayts.t3, maxdelayts.t4,
+       maxdelayts.t2 - maxdelayts.t1,
+       maxdelayts.t3 - maxdelayts.t2,
+       maxdelayts.t4 - maxdelayts.t3,
+       maxdelayts.t4 - maxdelayts.t1);
+}
+
+
+static int
+dhd_ioctl_htsf_get(dhd_info_t *dhd, int ifidx)
+{
+       wl_ioctl_t ioc;
+       char buf[32];
+       int ret;
+       uint32 s1, s2;
+
+       struct tsf {
+               uint32 low;
+               uint32 high;
+       } tsf_buf;
+
+       memset(&ioc, 0, sizeof(ioc));
+       memset(&tsf_buf, 0, sizeof(tsf_buf));
+
+       ioc.cmd = WLC_GET_VAR;
+       ioc.buf = buf;
+       ioc.len = (uint)sizeof(buf);
+       ioc.set = FALSE;
+
+       strncpy(buf, "tsf", sizeof(buf) - 1);
+       buf[sizeof(buf) - 1] = '\0';
+       s1 = dhd_get_htsf(dhd, 0);
+       if ((ret = dhd_wl_ioctl(&dhd->pub, ifidx, &ioc, ioc.buf, ioc.len)) < 0) {
+               if (ret == -EIO) {
+                       DHD_ERROR(("%s: tsf is not supported by device\n",
+                               dhd_ifname(&dhd->pub, ifidx)));
+                       return -EOPNOTSUPP;
+               }
+               return ret;
+       }
+       s2 = dhd_get_htsf(dhd, 0);
+
+       memcpy(&tsf_buf, buf, sizeof(tsf_buf));
+       printf(" TSF_h=%04X lo=%08X Calc:htsf=%08X, coef=%d.%d%d delta=%d ",
+               tsf_buf.high, tsf_buf.low, s2, dhd->htsf.coef, dhd->htsf.coefdec1,
+               dhd->htsf.coefdec2, s2-tsf_buf.low);
+       printf("lasttsf=%08X lastcycle=%08X\n", dhd->htsf.last_tsf, dhd->htsf.last_cycle);
+       return 0;
+}
+
+void htsf_update(dhd_info_t *dhd, void *data)
+{
+       static ulong  cur_cycle = 0, prev_cycle = 0;
+       uint32 htsf, tsf_delta = 0;
+       uint32 hfactor = 0, cyc_delta, dec1 = 0, dec2, dec3, tmp;
+       ulong b, a;
+       cycles_t t;
+
+       /* cycles_t in inlcude/mips/timex.h */
+
+       t = get_cycles();
+
+       prev_cycle = cur_cycle;
+       cur_cycle = t;
+
+       if (cur_cycle > prev_cycle)
+               cyc_delta = cur_cycle - prev_cycle;
+       else {
+               b = cur_cycle;
+               a = prev_cycle;
+               cyc_delta = cur_cycle + (0xFFFFFFFF - prev_cycle);
+       }
+
+       if (data == NULL)
+               printf(" tsf update ata point er is null \n");
+
+       memcpy(&prev_tsf, &cur_tsf, sizeof(tsf_t));
+       memcpy(&cur_tsf, data, sizeof(tsf_t));
+
+       if (cur_tsf.low == 0) {
+               DHD_INFO((" ---- 0 TSF, do not update, return\n"));
+               return;
+       }
+
+       if (cur_tsf.low > prev_tsf.low)
+               tsf_delta = (cur_tsf.low - prev_tsf.low);
+       else {
+               DHD_INFO((" ---- tsf low is smaller cur_tsf= %08X, prev_tsf=%08X, \n",
+                cur_tsf.low, prev_tsf.low));
+               if (cur_tsf.high > prev_tsf.high) {
+                       tsf_delta = cur_tsf.low + (0xFFFFFFFF - prev_tsf.low);
+                       DHD_INFO((" ---- Wrap around tsf coutner  adjusted TSF=%08X\n", tsf_delta));
+               } else {
+                       return; /* do not update */
+               }
+       }
+
+       if (tsf_delta)  {
+               hfactor = cyc_delta / tsf_delta;
+               tmp  =  (cyc_delta - (hfactor * tsf_delta))*10;
+               dec1 =  tmp/tsf_delta;
+               dec2 =  ((tmp - dec1*tsf_delta)*10) / tsf_delta;
+               tmp  =  (tmp   - (dec1*tsf_delta))*10;
+               dec3 =  ((tmp - dec2*tsf_delta)*10) / tsf_delta;
+
+               if (dec3 > 4) {
+                       if (dec2 == 9) {
+                               dec2 = 0;
+                               if (dec1 == 9) {
+                                       dec1 = 0;
+                                       hfactor++;
+                               } else {
+                                       dec1++;
+                               }
+                       } else {
+                               dec2++;
+                       }
+               }
+       }
+
+       if (hfactor) {
+               htsf = ((cyc_delta * 10)  / (hfactor*10+dec1)) + prev_tsf.low;
+               dhd->htsf.coef = hfactor;
+               dhd->htsf.last_cycle = cur_cycle;
+               dhd->htsf.last_tsf = cur_tsf.low;
+               dhd->htsf.coefdec1 = dec1;
+               dhd->htsf.coefdec2 = dec2;
+       } else {
+               htsf = prev_tsf.low;
+       }
+}
+
+#endif /* WLMEDIA_HTSF */
+
+#ifdef CUSTOM_SET_CPUCORE
+void dhd_set_cpucore(dhd_pub_t *dhd, int set)
+{
+       int e_dpc = 0, e_rxf = 0, retry_set = 0;
+
+       if (!(dhd->chan_isvht80)) {
+               DHD_ERROR(("%s: chan_status(%d) cpucore!!!\n", __FUNCTION__, dhd->chan_isvht80));
+               return;
+       }
+
+       if (DPC_CPUCORE) {
+               do {
+                       if (set == TRUE) {
+                               e_dpc = set_cpus_allowed_ptr(dhd->current_dpc,
+                                       cpumask_of(DPC_CPUCORE));
+                       } else {
+                               e_dpc = set_cpus_allowed_ptr(dhd->current_dpc,
+                                       cpumask_of(PRIMARY_CPUCORE));
+                       }
+                       if (retry_set++ > MAX_RETRY_SET_CPUCORE) {
+                               DHD_ERROR(("%s: dpc(%d) invalid cpu!\n", __FUNCTION__, e_dpc));
+                               return;
+                       }
+                       if (e_dpc < 0)
+                               OSL_SLEEP(1);
+               } while (e_dpc < 0);
+       }
+       if (RXF_CPUCORE) {
+               do {
+                       if (set == TRUE) {
+                               e_rxf = set_cpus_allowed_ptr(dhd->current_rxf,
+                                       cpumask_of(RXF_CPUCORE));
+                       } else {
+                               e_rxf = set_cpus_allowed_ptr(dhd->current_rxf,
+                                       cpumask_of(PRIMARY_CPUCORE));
+                       }
+                       if (retry_set++ > MAX_RETRY_SET_CPUCORE) {
+                               DHD_ERROR(("%s: rxf(%d) invalid cpu!\n", __FUNCTION__, e_rxf));
+                               return;
+                       }
+                       if (e_rxf < 0)
+                               OSL_SLEEP(1);
+               } while (e_rxf < 0);
+       }
+#ifdef DHD_OF_SUPPORT
+       interrupt_set_cpucore(set);
+#endif /* DHD_OF_SUPPORT */
+       DHD_TRACE(("%s: set(%d) cpucore success!\n", __FUNCTION__, set));
+
+       return;
+}
+#endif /* CUSTOM_SET_CPUCORE */
+
+/* Get interface specific ap_isolate configuration */
+int dhd_get_ap_isolate(dhd_pub_t *dhdp, uint32 idx)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+
+       ASSERT(idx < DHD_MAX_IFS);
+
+       ifp = dhd->iflist[idx];
+
+       return ifp->ap_isolate;
+}
+
+/* Set interface specific ap_isolate configuration */
+int dhd_set_ap_isolate(dhd_pub_t *dhdp, uint32 idx, int val)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+
+       ASSERT(idx < DHD_MAX_IFS);
+
+       ifp = dhd->iflist[idx];
+
+       ifp->ap_isolate = val;
+
+       return 0;
+}
+
+int dhd_android_ap_isolate_getval(struct net_device *dev)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       int ifidx, val;
+
+       ifidx = dhd_net2idx(dhd, dev);
+       val = dhd_get_ap_isolate(&dhd->pub, ifidx);
+       return val;
+}
+void dhd_android_ap_isolate_setval(struct net_device *dev, int val)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(dev);
+       int ifidx;
+
+       ifidx = dhd_net2idx(dhd, dev);
+       dhd_set_ap_isolate(&dhd->pub, ifidx, val);
+}
+#ifdef DHD_FW_COREDUMP
+
+
+#ifdef CUSTOMER_HW4_DEBUG
+#ifdef PLATFORM_SLP
+#define MEMDUMPINFO "/opt/etc/.memdump.info"
+#else
+#define MEMDUMPINFO "/data/.memdump.info"
+#endif /* PLATFORM_SLP */
+#elif defined(CUSTOMER_HW2)
+#define MEMDUMPINFO "/data/misc/wifi/.memdump.info"
+#else
+#define MEMDUMPINFO "/installmedia/.memdump.info"
+#endif /* CUSTOMER_HW4_DEBUG */
+
+void dhd_get_memdump_info(dhd_pub_t *dhd)
+{
+       struct file *fp = NULL;
+       uint32 mem_val = DUMP_MEMFILE_MAX;
+       int ret = 0;
+       char *filepath = MEMDUMPINFO;
+
+       /* Read memdump info from the file */
+       fp = filp_open(filepath, O_RDONLY, 0);
+       if (IS_ERR(fp)) {
+               DHD_ERROR(("%s: File [%s] doesn't exist\n", __FUNCTION__, filepath));
+               goto done;
+       } else {
+               ret = kernel_read(fp, 0, (char *)&mem_val, 4);
+               if (ret < 0) {
+                       DHD_ERROR(("%s: File read error, ret=%d\n", __FUNCTION__, ret));
+                       filp_close(fp, NULL);
+                       goto done;
+               }
+
+               mem_val = bcm_atoi((char *)&mem_val);
+
+               DHD_ERROR(("%s: MEMDUMP ENABLED = %d\n", __FUNCTION__, mem_val));
+               filp_close(fp, NULL);
+       }
+
+done:
+#ifdef CUSTOMER_HW4_DEBUG
+       dhd->memdump_enabled = (mem_val < DUMP_MEMFILE_MAX) ? mem_val : DUMP_DISABLED;
+#else
+       dhd->memdump_enabled = (mem_val < DUMP_MEMFILE_MAX) ? mem_val : DUMP_MEMFILE_BUGON;
+#endif /* CUSTOMER_HW4_DEBUG */
+}
+
+
+void dhd_schedule_memdump(dhd_pub_t *dhdp, uint8 *buf, uint32 size)
+{
+       dhd_dump_t *dump = NULL;
+       dump = (dhd_dump_t *)MALLOC(dhdp->osh, sizeof(dhd_dump_t));
+       if (dump == NULL) {
+               DHD_ERROR(("%s: dhd dump memory allocation failed\n", __FUNCTION__));
+               return;
+       }
+       dump->buf = buf;
+       dump->bufsize = size;
+
+#if defined(CONFIG_ARM64)
+       DHD_ERROR(("%s: buf(va)=%llx, buf(pa)=%llx, bufsize=%d\n", __FUNCTION__,
+               (uint64)buf, (uint64)__virt_to_phys((ulong)buf), size));
+#elif defined(__ARM_ARCH_7A__)
+       DHD_ERROR(("%s: buf(va)=%x, buf(pa)=%x, bufsize=%d\n", __FUNCTION__,
+               (uint32)buf, (uint32)__virt_to_phys((ulong)buf), size));
+#endif /* __ARM_ARCH_7A__ */
+       if (dhdp->memdump_enabled == DUMP_MEMONLY) {
+               BUG_ON(1);
+       }
+
+#ifdef DHD_LOG_DUMP
+       if (dhdp->memdump_type != DUMP_TYPE_BY_SYSDUMP) {
+               dhd_schedule_log_dump(dhdp);
+       }
+#endif /* DHD_LOG_DUMP */
+       dhd_deferred_schedule_work(dhdp->info->dhd_deferred_wq, (void *)dump,
+               DHD_WQ_WORK_SOC_RAM_DUMP, dhd_mem_dump, DHD_WORK_PRIORITY_HIGH);
+}
+static void
+dhd_mem_dump(void *handle, void *event_info, u8 event)
+{
+       dhd_info_t *dhd = handle;
+       dhd_dump_t *dump = event_info;
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       if (!dump) {
+               DHD_ERROR(("%s: dump is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       if (write_to_file(&dhd->pub, dump->buf, dump->bufsize)) {
+               DHD_ERROR(("%s: writing SoC_RAM dump to the file failed\n", __FUNCTION__));
+               dhd->pub.memdump_success = FALSE;
+       }
+
+       if (dhd->pub.memdump_enabled == DUMP_MEMFILE_BUGON &&
+#ifdef DHD_LOG_DUMP
+               dhd->pub.memdump_type != DUMP_TYPE_BY_SYSDUMP &&
+#endif
+#ifdef DHD_DEBUG_UART
+               dhd->pub.memdump_success == TRUE &&
+#endif
+               TRUE) {
+               BUG_ON(1);
+       }
+       MFREE(dhd->pub.osh, dump, sizeof(dhd_dump_t));
+}
+#endif /* DHD_FW_COREDUMP */
+
+#ifdef DHD_LOG_DUMP
+static void
+dhd_log_dump(void *handle, void *event_info, u8 event)
+{
+       dhd_info_t *dhd = handle;
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       if (do_dhd_log_dump(&dhd->pub)) {
+               DHD_ERROR(("%s: writing debug dump to the file failed\n", __FUNCTION__));
+               return;
+       }
+}
+
+void dhd_schedule_log_dump(dhd_pub_t *dhdp)
+{
+       dhd_deferred_schedule_work(dhdp->info->dhd_deferred_wq,
+               (void*)NULL, DHD_WQ_WORK_DHD_LOG_DUMP,
+               dhd_log_dump, DHD_WORK_PRIORITY_HIGH);
+}
+
+static int
+do_dhd_log_dump(dhd_pub_t *dhdp)
+{
+       int ret = 0;
+       struct file *fp = NULL;
+       mm_segment_t old_fs;
+       loff_t pos = 0;
+       char dump_path[128];
+       char common_info[1024];
+       struct timeval curtime;
+       uint32 file_mode;
+       unsigned long flags = 0;
+
+       if (!dhdp) {
+               return -1;
+       }
+
+       /* Building the additional information like DHD, F/W version */
+       memset(common_info, 0, sizeof(common_info));
+       snprintf(common_info, sizeof(common_info),
+               "---------- Common information ----------\n"
+               "DHD version: %s\n"
+               "F/W version: %s\n"
+               "----------------------------------------\n",
+               dhd_version, fw_version);
+
+       /* change to KERNEL_DS address limit */
+       old_fs = get_fs();
+       set_fs(KERNEL_DS);
+
+       /* Init file name */
+       memset(dump_path, 0, sizeof(dump_path));
+       do_gettimeofday(&curtime);
+       snprintf(dump_path, sizeof(dump_path), "%s_%ld.%ld",
+               DHD_COMMON_DUMP_PATH "debug_dump",
+               (unsigned long)curtime.tv_sec, (unsigned long)curtime.tv_usec);
+       file_mode = O_CREAT | O_WRONLY | O_SYNC;
+
+       DHD_ERROR(("debug_dump_path = %s\n", dump_path));
+       fp = filp_open(dump_path, file_mode, 0644);
+       if (IS_ERR(fp)) {
+               ret = PTR_ERR(fp);
+               DHD_ERROR(("open file error, err = %d\n", ret));
+               ret = -1;
+               goto exit;
+       }
+
+       fp->f_op->write(fp, common_info, strlen(common_info), &pos);
+       if (dhdp->dld_buf.wraparound) {
+               fp->f_op->write(fp, dhdp->dld_buf.buffer, DHD_LOG_DUMP_BUFFER_SIZE, &pos);
+       } else {
+               fp->f_op->write(fp, dhdp->dld_buf.buffer,
+                       (int)(dhdp->dld_buf.present - dhdp->dld_buf.front), &pos);
+       }
+
+       /* re-init dhd_log_dump_buf structure */
+       spin_lock_irqsave(&dhdp->dld_buf.lock, flags);
+       dhdp->dld_buf.wraparound = 0;
+       dhdp->dld_buf.present = dhdp->dld_buf.front;
+       dhdp->dld_buf.remain = DHD_LOG_DUMP_BUFFER_SIZE;
+       bzero(dhdp->dld_buf.buffer, DHD_LOG_DUMP_BUFFER_SIZE);
+       spin_unlock_irqrestore(&dhdp->dld_buf.lock, flags);
+exit:
+       if (!ret) {
+               filp_close(fp, NULL);
+       }
+       set_fs(old_fs);
+
+       return ret;
+}
+#endif /* DHD_LOG_DUMP */
+
+#ifdef BCMASSERT_LOG
+#ifdef CUSTOMER_HW4_DEBUG
+#ifdef PLATFORM_SLP
+#define ASSERTINFO "/opt/etc/.assert.info"
+#else
+#define ASSERTINFO "/data/.assert.info"
+#endif /* PLATFORM_SLP */
+#elif defined(CUSTOMER_HW2)
+#define ASSERTINFO "/data/misc/wifi/.assert.info"
+#else
+#define ASSERTINFO "/installmedia/.assert.info"
+#endif /* CUSTOMER_HW4_DEBUG */
+void dhd_get_assert_info(dhd_pub_t *dhd)
+{
+       struct file *fp = NULL;
+       char *filepath = ASSERTINFO;
+
+       /*
+        * Read assert info from the file
+        * 0: Trigger Kernel crash by panic()
+        * 1: Print out the logs and don't trigger Kernel panic. (default)
+        * 2: Trigger Kernel crash by BUG()
+        * File doesn't exist: Keep default value (1).
+        */
+       fp = filp_open(filepath, O_RDONLY, 0);
+       if (IS_ERR(fp)) {
+               DHD_ERROR(("%s: File [%s] doesn't exist\n", __FUNCTION__, filepath));
+       } else {
+               int mem_val = 0;
+               int ret = kernel_read(fp, 0, (char *)&mem_val, 4);
+               if (ret < 0) {
+                       DHD_ERROR(("%s: File read error, ret=%d\n", __FUNCTION__, ret));
+               } else {
+                       mem_val = bcm_atoi((char *)&mem_val);
+                       DHD_ERROR(("%s: ASSERT ENABLED = %d\n", __FUNCTION__, mem_val));
+                       g_assert_type = mem_val;
+               }
+               filp_close(fp, NULL);
+       }
+}
+#endif /* BCMASSERT_LOG */
+
+
+#ifdef DHD_WMF
+/* Returns interface specific WMF configuration */
+dhd_wmf_t* dhd_wmf_conf(dhd_pub_t *dhdp, uint32 idx)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+
+       ASSERT(idx < DHD_MAX_IFS);
+
+       ifp = dhd->iflist[idx];
+       return &ifp->wmf;
+}
+#endif /* DHD_WMF */
+
+
+#if defined(DHD_L2_FILTER)
+bool dhd_sta_associated(dhd_pub_t *dhdp, uint32 bssidx, uint8 *mac)
+{
+       return dhd_find_sta(dhdp, bssidx, mac) ? TRUE : FALSE;
+}
+#endif 
+
+#ifdef DHD_L2_FILTER
+arp_table_t*
+dhd_get_ifp_arp_table_handle(dhd_pub_t *dhdp, uint32 bssidx)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+
+       ASSERT(bssidx < DHD_MAX_IFS);
+
+       ifp = dhd->iflist[bssidx];
+       return ifp->phnd_arp_table;
+}
+
+int dhd_get_parp_status(dhd_pub_t *dhdp, uint32 idx)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+
+       ASSERT(idx < DHD_MAX_IFS);
+
+       ifp = dhd->iflist[idx];
+
+       if (ifp)
+               return ifp->parp_enable;
+       else
+               return FALSE;
+}
+
+/* Set interface specific proxy arp configuration */
+int dhd_set_parp_status(dhd_pub_t *dhdp, uint32 idx, int val)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+       ASSERT(idx < DHD_MAX_IFS);
+       ifp = dhd->iflist[idx];
+
+       if (!ifp)
+           return BCME_ERROR;
+
+       /* At present all 3 variables are being
+        * handled at once
+        */
+       ifp->parp_enable = val;
+       ifp->parp_discard = val;
+       ifp->parp_allnode = !val;
+
+       /* Flush ARP entries when disabled */
+       if (val == FALSE) {
+               bcm_l2_filter_arp_table_update(dhdp->osh, ifp->phnd_arp_table, TRUE, NULL,
+                       FALSE, dhdp->tickcnt);
+       }
+       return BCME_OK;
+}
+
+bool dhd_parp_discard_is_enabled(dhd_pub_t *dhdp, uint32 idx)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+
+       ASSERT(idx < DHD_MAX_IFS);
+
+       ifp = dhd->iflist[idx];
+
+       ASSERT(ifp);
+       return ifp->parp_discard;
+}
+
+bool
+dhd_parp_allnode_is_enabled(dhd_pub_t *dhdp, uint32 idx)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+
+       ASSERT(idx < DHD_MAX_IFS);
+
+       ifp = dhd->iflist[idx];
+
+       ASSERT(ifp);
+
+       return ifp->parp_allnode;
+}
+
+int dhd_get_dhcp_unicast_status(dhd_pub_t *dhdp, uint32 idx)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+
+       ASSERT(idx < DHD_MAX_IFS);
+
+       ifp = dhd->iflist[idx];
+
+       ASSERT(ifp);
+
+       return ifp->dhcp_unicast;
+}
+
+int dhd_set_dhcp_unicast_status(dhd_pub_t *dhdp, uint32 idx, int val)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+       ASSERT(idx < DHD_MAX_IFS);
+       ifp = dhd->iflist[idx];
+
+       ASSERT(ifp);
+
+       ifp->dhcp_unicast = val;
+       return BCME_OK;
+}
+
+int dhd_get_block_ping_status(dhd_pub_t *dhdp, uint32 idx)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+
+       ASSERT(idx < DHD_MAX_IFS);
+
+       ifp = dhd->iflist[idx];
+
+       ASSERT(ifp);
+
+       return ifp->block_ping;
+}
+
+int dhd_set_block_ping_status(dhd_pub_t *dhdp, uint32 idx, int val)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+       ASSERT(idx < DHD_MAX_IFS);
+       ifp = dhd->iflist[idx];
+
+       ASSERT(ifp);
+
+       ifp->block_ping = val;
+
+       return BCME_OK;
+}
+
+int dhd_get_grat_arp_status(dhd_pub_t *dhdp, uint32 idx)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+
+       ASSERT(idx < DHD_MAX_IFS);
+
+       ifp = dhd->iflist[idx];
+
+       ASSERT(ifp);
+
+       return ifp->grat_arp;
+}
+
+int dhd_set_grat_arp_status(dhd_pub_t *dhdp, uint32 idx, int val)
+{
+       dhd_info_t *dhd = dhdp->info;
+       dhd_if_t *ifp;
+       ASSERT(idx < DHD_MAX_IFS);
+       ifp = dhd->iflist[idx];
+
+       ASSERT(ifp);
+
+       ifp->grat_arp = val;
+
+       return BCME_OK;
+}
+#endif /* DHD_L2_FILTER */
+
+
+#if defined(SET_RPS_CPUS)
+int dhd_rps_cpus_enable(struct net_device *net, int enable)
+{
+       dhd_info_t *dhd = DHD_DEV_INFO(net);
+       dhd_if_t *ifp;
+       int ifidx;
+       char * RPS_CPU_SETBUF;
+
+       ifidx = dhd_net2idx(dhd, net);
+       if (ifidx == DHD_BAD_IF) {
+               DHD_ERROR(("%s bad ifidx\n", __FUNCTION__));
+               return -ENODEV;
+       }
+
+       if (ifidx == PRIMARY_INF) {
+               if (dhd->pub.op_mode == DHD_FLAG_IBSS_MODE) {
+                       DHD_INFO(("%s : set for IBSS.\n", __FUNCTION__));
+                       RPS_CPU_SETBUF = RPS_CPUS_MASK_IBSS;
+               } else {
+                       DHD_INFO(("%s : set for BSS.\n", __FUNCTION__));
+                       RPS_CPU_SETBUF = RPS_CPUS_MASK;
+               }
+       } else if (ifidx == VIRTUAL_INF) {
+               DHD_INFO(("%s : set for P2P.\n", __FUNCTION__));
+               RPS_CPU_SETBUF = RPS_CPUS_MASK_P2P;
+       } else {
+               DHD_ERROR(("%s : Invalid index : %d.\n", __FUNCTION__, ifidx));
+               return -EINVAL;
+       }
+
+       ifp = dhd->iflist[ifidx];
+       if (ifp) {
+               if (enable) {
+                       DHD_INFO(("%s : set rps_cpus as [%s]\n", __FUNCTION__, RPS_CPU_SETBUF));
+                       custom_rps_map_set(ifp->net->_rx, RPS_CPU_SETBUF, strlen(RPS_CPU_SETBUF));
+               } else {
+                       custom_rps_map_clear(ifp->net->_rx);
+               }
+       } else {
+               DHD_ERROR(("%s : ifp is NULL!!\n", __FUNCTION__));
+               return -ENODEV;
+       }
+       return BCME_OK;
+}
+
+int custom_rps_map_set(struct netdev_rx_queue *queue, char *buf, size_t len)
+{
+       struct rps_map *old_map, *map;
+       cpumask_var_t mask;
+       int err, cpu, i;
+       static DEFINE_SPINLOCK(rps_map_lock);
+
+       DHD_INFO(("%s : Entered.\n", __FUNCTION__));
+
+       if (!alloc_cpumask_var(&mask, GFP_KERNEL)) {
+               DHD_ERROR(("%s : alloc_cpumask_var fail.\n", __FUNCTION__));
+               return -ENOMEM;
+       }
+
+       err = bitmap_parse(buf, len, cpumask_bits(mask), nr_cpumask_bits);
+       if (err) {
+               free_cpumask_var(mask);
+               DHD_ERROR(("%s : bitmap_parse fail.\n", __FUNCTION__));
+               return err;
+       }
+
+       map = kzalloc(max_t(unsigned int,
+               RPS_MAP_SIZE(cpumask_weight(mask)), L1_CACHE_BYTES),
+               GFP_KERNEL);
+       if (!map) {
+               free_cpumask_var(mask);
+               DHD_ERROR(("%s : map malloc fail.\n", __FUNCTION__));
+               return -ENOMEM;
+       }
+
+       i = 0;
+       for_each_cpu(cpu, mask) {
+               map->cpus[i++] = cpu;
+       }
+
+       if (i) {
+               map->len = i;
+       } else {
+               kfree(map);
+               map = NULL;
+               free_cpumask_var(mask);
+               DHD_ERROR(("%s : mapping cpu fail.\n", __FUNCTION__));
+               return -1;
+       }
+
+       spin_lock(&rps_map_lock);
+       old_map = rcu_dereference_protected(queue->rps_map,
+               lockdep_is_held(&rps_map_lock));
+       rcu_assign_pointer(queue->rps_map, map);
+       spin_unlock(&rps_map_lock);
+
+       if (map) {
+               static_key_slow_inc(&rps_needed);
+       }
+       if (old_map) {
+               kfree_rcu(old_map, rcu);
+               static_key_slow_dec(&rps_needed);
+       }
+       free_cpumask_var(mask);
+
+       DHD_INFO(("%s : Done. mapping cpu nummber : %d\n", __FUNCTION__, map->len));
+       return map->len;
+}
+
+void custom_rps_map_clear(struct netdev_rx_queue *queue)
+{
+       struct rps_map *map;
+
+       DHD_INFO(("%s : Entered.\n", __FUNCTION__));
+
+       map = rcu_dereference_protected(queue->rps_map, 1);
+       if (map) {
+               RCU_INIT_POINTER(queue->rps_map, NULL);
+               kfree_rcu(map, rcu);
+               DHD_INFO(("%s : rps_cpus map clear.\n", __FUNCTION__));
+       }
+}
+#endif 
+
+
+
+#ifdef DHD_DEBUG_PAGEALLOC
+
+void
+dhd_page_corrupt_cb(void *handle, void *addr_corrupt, size_t len)
+{
+       dhd_pub_t *dhdp = (dhd_pub_t *)handle;
+
+       DHD_ERROR(("%s: Got dhd_page_corrupt_cb 0x%p %d\n",
+               __FUNCTION__, addr_corrupt, (uint32)len));
+
+       DHD_OS_WAKE_LOCK(dhdp);
+       prhex("Page Corruption:", addr_corrupt, len);
+       dhd_dump_to_kernelog(dhdp);
+#if defined(BCMPCIE) && defined(DHD_FW_COREDUMP)
+       /* Load the dongle side dump to host memory and then BUG_ON() */
+       dhdp->memdump_enabled = DUMP_MEMONLY;
+       dhdp->memdump_type = DUMP_TYPE_MEMORY_CORRUPTION;
+       dhd_bus_mem_dump(dhdp);
+#endif /* BCMPCIE && DHD_FW_COREDUMP */
+       DHD_OS_WAKE_UNLOCK(dhdp);
+}
+EXPORT_SYMBOL(dhd_page_corrupt_cb);
+#endif /* DHD_DEBUG_PAGEALLOC */
+
+#ifdef DHD_PKTID_AUDIT_ENABLED
+void
+dhd_pktid_audit_fail_cb(dhd_pub_t *dhdp)
+{
+       DHD_ERROR(("%s: Got Pkt Id Audit failure \n", __FUNCTION__));
+       DHD_OS_WAKE_LOCK(dhdp);
+       dhd_dump_to_kernelog(dhdp);
+#if defined(BCMPCIE) && defined(DHD_FW_COREDUMP)
+       /* Load the dongle side dump to host memory and then BUG_ON() */
+       dhdp->memdump_enabled = DUMP_MEMFILE_BUGON;
+       dhdp->memdump_type = DUMP_TYPE_PKTID_AUDIT_FAILURE;
+       dhd_bus_mem_dump(dhdp);
+#endif /* BCMPCIE && DHD_FW_COREDUMP */
+       DHD_OS_WAKE_UNLOCK(dhdp);
+}
+#endif /* DHD_PKTID_AUDIT_ENABLED */
+
+/* ----------------------------------------------------------------------------
+ * Infrastructure code for sysfs interface support for DHD
+ *
+ * What is sysfs interface?
+ * https://www.kernel.org/doc/Documentation/filesystems/sysfs.txt
+ *
+ * Why sysfs interface?
+ * This is the Linux standard way of changing/configuring Run Time parameters
+ * for a driver. We can use this interface to control "linux" specific driver
+ * parameters.
+ *
+ * -----------------------------------------------------------------------------
+ */
+
+#include <linux/sysfs.h>
+#include <linux/kobject.h>
+
+#if defined(DHD_TRACE_WAKE_LOCK)
+
+/* Function to show the history buffer */
+static ssize_t
+show_wklock_trace(struct dhd_info *dev, char *buf)
+{
+       ssize_t ret = 0;
+       dhd_info_t *dhd = (dhd_info_t *)dev;
+
+       buf[ret] = '\n';
+       buf[ret+1] = 0;
+
+       dhd_wk_lock_stats_dump(&dhd->pub);
+       return ret+1;
+}
+
+/* Function to enable/disable wakelock trace */
+static ssize_t
+wklock_trace_onoff(struct dhd_info *dev, const char *buf, size_t count)
+{
+       unsigned long onoff;
+       unsigned long flags;
+       dhd_info_t *dhd = (dhd_info_t *)dev;
+
+       onoff = bcm_strtoul(buf, NULL, 10);
+       if (onoff != 0 && onoff != 1) {
+               return -EINVAL;
+       }
+
+       spin_lock_irqsave(&dhd->wakelock_spinlock, flags);
+       trace_wklock_onoff = onoff;
+       spin_unlock_irqrestore(&dhd->wakelock_spinlock, flags);
+       if (trace_wklock_onoff) {
+               printk("ENABLE WAKLOCK TRACE\n");
+       } else {
+               printk("DISABLE WAKELOCK TRACE\n");
+       }
+
+       return (ssize_t)(onoff+1);
+}
+#endif /* DHD_TRACE_WAKE_LOCK */
+
+/*
+ * Generic Attribute Structure for DHD.
+ * If we have to add a new sysfs entry under /sys/bcm-dhd/, we have
+ * to instantiate an object of type dhd_attr,  populate it with
+ * the required show/store functions (ex:- dhd_attr_cpumask_primary)
+ * and add the object to default_attrs[] array, that gets registered
+ * to the kobject of dhd (named bcm-dhd).
+ */
+
+struct dhd_attr {
+       struct attribute attr;
+       ssize_t(*show)(struct dhd_info *, char *);
+       ssize_t(*store)(struct dhd_info *, const char *, size_t count);
+};
+
+#if defined(DHD_TRACE_WAKE_LOCK)
+static struct dhd_attr dhd_attr_wklock =
+       __ATTR(wklock_trace, 0660, show_wklock_trace, wklock_trace_onoff);
+#endif /* defined(DHD_TRACE_WAKE_LOCK */
+
+/* Attribute object that gets registered with "bcm-dhd" kobject tree */
+static struct attribute *default_attrs[] = {
+#if defined(DHD_TRACE_WAKE_LOCK)
+       &dhd_attr_wklock.attr,
+#endif
+       NULL
+};
+
+#define to_dhd(k) container_of(k, struct dhd_info, dhd_kobj)
+#define to_attr(a) container_of(a, struct dhd_attr, attr)
+
+/*
+ * bcm-dhd kobject show function, the "attr" attribute specifices to which
+ * node under "bcm-dhd" the show function is called.
+ */
+static ssize_t dhd_show(struct kobject *kobj, struct attribute *attr, char *buf)
+{
+       dhd_info_t *dhd = to_dhd(kobj);
+       struct dhd_attr *d_attr = to_attr(attr);
+       int ret;
+
+       if (d_attr->show)
+               ret = d_attr->show(dhd, buf);
+       else
+               ret = -EIO;
+
+       return ret;
+}
+
+
+/*
+ * bcm-dhd kobject show function, the "attr" attribute specifices to which
+ * node under "bcm-dhd" the store function is called.
+ */
+static ssize_t dhd_store(struct kobject *kobj, struct attribute *attr,
+       const char *buf, size_t count)
+{
+       dhd_info_t *dhd = to_dhd(kobj);
+       struct dhd_attr *d_attr = to_attr(attr);
+       int ret;
+
+       if (d_attr->store)
+               ret = d_attr->store(dhd, buf, count);
+       else
+               ret = -EIO;
+
+       return ret;
+
+}
+
+static struct sysfs_ops dhd_sysfs_ops = {
+       .show = dhd_show,
+       .store = dhd_store,
+};
+
+static struct kobj_type dhd_ktype = {
+       .sysfs_ops = &dhd_sysfs_ops,
+       .default_attrs = default_attrs,
+};
+
+/* Create a kobject and attach to sysfs interface */
+static int dhd_sysfs_init(dhd_info_t *dhd)
+{
+       int ret = -1;
+
+       if (dhd == NULL) {
+               DHD_ERROR(("%s(): dhd is NULL \r\n", __FUNCTION__));
+               return ret;
+       }
+
+       /* Initialize the kobject */
+       ret = kobject_init_and_add(&dhd->dhd_kobj, &dhd_ktype, NULL, "bcm-dhd");
+       if (ret) {
+               kobject_put(&dhd->dhd_kobj);
+               DHD_ERROR(("%s(): Unable to allocate kobject \r\n", __FUNCTION__));
+               return ret;
+       }
+
+       /*
+        * We are always responsible for sending the uevent that the kobject
+        * was added to the system.
+        */
+       kobject_uevent(&dhd->dhd_kobj, KOBJ_ADD);
+
+       return ret;
+}
+
+/* Done with the kobject and detach the sysfs interface */
+static void dhd_sysfs_exit(dhd_info_t *dhd)
+{
+       if (dhd == NULL) {
+               DHD_ERROR(("%s(): dhd is NULL \r\n", __FUNCTION__));
+               return;
+       }
+
+       /* Releae the kobject */
+       kobject_put(&dhd->dhd_kobj);
+}
+/* ---------------------------- End of sysfs implementation ------------------------------------- */
+
+#ifdef DHD_LOG_DUMP
+void
+dhd_log_dump_init(dhd_pub_t *dhd)
+{
+       spin_lock_init(&dhd->dld_buf.lock);
+#if defined(CONFIG_DHD_USE_STATIC_BUF) && defined(DHD_USE_STATIC_MEMDUMP)
+       dhd->dld_buf.buffer = DHD_OS_PREALLOC(dhd,
+               DHD_PREALLOC_DHD_LOG_DUMP_BUF, DHD_LOG_DUMP_BUFFER_SIZE);
+#else
+       dhd->dld_buf.buffer = kmalloc(DHD_LOG_DUMP_BUFFER_SIZE, GFP_KERNEL);
+#endif /* CONFIG_DHD_USE_STATIC_BUF && DHD_USE_STATIC_MEMDUMP */
+
+       if (!dhd->dld_buf.buffer) {
+               dhd->dld_buf.buffer = kmalloc(DHD_LOG_DUMP_BUFFER_SIZE, GFP_KERNEL);
+               DHD_ERROR(("Try to allocate memory using kmalloc().\n"));
+
+               if (!dhd->dld_buf.buffer) {
+                       DHD_ERROR(("Failed to allocate memory for dld_buf.\n"));
+                       return;
+               }
+       }
+
+       dhd->dld_buf.wraparound = 0;
+       dhd->dld_buf.max = (unsigned long)dhd->dld_buf.buffer + DHD_LOG_DUMP_BUFFER_SIZE;
+       dhd->dld_buf.present = dhd->dld_buf.buffer;
+       dhd->dld_buf.front = dhd->dld_buf.buffer;
+       dhd->dld_buf.remain = DHD_LOG_DUMP_BUFFER_SIZE;
+       dhd->dld_enable = 1;
+}
+
+void
+dhd_log_dump_deinit(dhd_pub_t *dhd)
+{
+       dhd->dld_enable = 0;
+#if defined(CONFIG_DHD_USE_STATIC_BUF) && defined(DHD_USE_STATIC_MEMDUMP)
+       DHD_OS_PREFREE(dhd,
+               dhd->dld_buf.buffer, DHD_LOG_DUMP_BUFFER_SIZE);
+#else
+       kfree(dhd->dld_buf.buffer);
+#endif /* CONFIG_DHD_USE_STATIC_BUF && DHD_USE_STATIC_MEMDUMP */
+}
+
+void
+dhd_log_dump_print(const char *fmt, ...)
+{
+       int len = 0;
+       char tmp_buf[DHD_LOG_DUMP_MAX_TEMP_BUFFER_SIZE] = {0, };
+       va_list args;
+       dhd_pub_t *dhd = NULL;
+       unsigned long flags = 0;
+
+       if (wl_get_bcm_cfg80211_ptr()) {
+               dhd = (dhd_pub_t*)(wl_get_bcm_cfg80211_ptr()->pub);
+       }
+
+       if (!dhd || dhd->dld_enable != 1) {
+               return;
+       }
+
+       va_start(args, fmt);
+
+       len = vsnprintf(tmp_buf, DHD_LOG_DUMP_MAX_TEMP_BUFFER_SIZE, fmt, args);
+       if (len < 0) {
+               return;
+       }
+
+       /* make a critical section to eliminate race conditions */
+       spin_lock_irqsave(&dhd->dld_buf.lock, flags);
+       if (dhd->dld_buf.remain < len) {
+               dhd->dld_buf.wraparound = 1;
+               dhd->dld_buf.present = dhd->dld_buf.front;
+               dhd->dld_buf.remain = DHD_LOG_DUMP_BUFFER_SIZE;
+       }
+
+       strncpy(dhd->dld_buf.present, tmp_buf, len);
+       dhd->dld_buf.remain -= len;
+       dhd->dld_buf.present += len;
+       spin_unlock_irqrestore(&dhd->dld_buf.lock, flags);
+
+       /* double check invalid memory operation */
+       ASSERT((unsigned long)dhd->dld_buf.present <= dhd->dld_buf.max);
+       va_end(args);
+}
+
+char*
+dhd_log_dump_get_timestamp(void)
+{
+       static char buf[16];
+       u64 ts_nsec;
+       unsigned long rem_nsec;
+
+       ts_nsec = local_clock();
+       rem_nsec = do_div(ts_nsec, 1000000000);
+       snprintf(buf, sizeof(buf), "%5lu.%06lu",
+               (unsigned long)ts_nsec, rem_nsec / 1000);
+
+       return buf;
+}
+
+#endif /* DHD_LOG_DUMP */
+
+#ifdef DHD_DEBUG_UART
+static void
+dhd_debug_uart_exec(char *cmd)
+{
+       int ret;
+
+       char *argv[] = {DHD_DEBUG_UART_EXEC_PATH, cmd, NULL};
+       char *envp[] = {"HOME=/", "TERM=linux", "PATH=/sbin:/system/bin", NULL};
+
+       ret = call_usermodehelper(argv[0], argv, envp, UMH_WAIT_PROC);
+
+       DHD_ERROR(("DHD: %s - run %s %s ret = %d\n",
+               __FUNCTION__, DHD_DEBUG_UART_EXEC_PATH, cmd, ret));
+}
+#endif
+
+int
+dhd_write_file(const char *filepath, char *buf, int buf_len)
+{
+       struct file *fp = NULL;
+       mm_segment_t old_fs;
+       int ret = 0;
+
+       /* change to KERNEL_DS address limit */
+       old_fs = get_fs();
+       set_fs(KERNEL_DS);
+
+       /* File is always created. */
+       fp = filp_open(filepath, O_RDWR | O_CREAT, 0666);
+       if (IS_ERR(fp)) {
+               DHD_ERROR(("%s: Couldn't open file '%s'\n",
+                       __FUNCTION__, filepath));
+               return BCME_ERROR;
+       } else {
+               if (fp->f_mode & FMODE_WRITE) {
+                       ret = fp->f_op->write(fp, buf, buf_len, &fp->f_pos);
+                       if (ret < 0) {
+                               DHD_ERROR(("%s: Couldn't write file '%s'\n",
+                                       __FUNCTION__, filepath));
+                               ret = BCME_ERROR;
+                       }
+               }
+       }
+       filp_close(fp, NULL);
+
+       /* restore previous address limit */
+       set_fs(old_fs);
+
+       return ret;
+}
+
+int
+dhd_read_file(const char *filepath, char *buf, int buf_len)
+{
+       struct file *fp = NULL;
+       mm_segment_t old_fs;
+       int ret;
+
+       /* change to KERNEL_DS address limit */
+       old_fs = get_fs();
+       set_fs(KERNEL_DS);
+
+       fp = filp_open(filepath, O_RDONLY, 0);
+       if (IS_ERR(fp)) {
+               DHD_ERROR(("%s: File %s doesn't exist\n", __FUNCTION__, filepath));
+               return BCME_ERROR;
+       }
+
+       ret = kernel_read(fp, 0, buf, buf_len);
+       filp_close(fp, NULL);
+
+       /* restore previous address limit */
+       set_fs(old_fs);
+
+       /* Return the number of bytes read */
+       if (ret > 0) {
+               /* Success to read */
+               ret = 0;
+       } else {
+               DHD_ERROR(("%s: Couldn't read the file %s, ret=%d\n",
+                       __FUNCTION__, filepath, ret));
+               ret = BCME_ERROR;
+       }
+
+       return ret;
+}
+
+int
+dhd_write_file_and_check(const char *filepath, char *buf, int buf_len)
+{
+       int ret;
+
+       ret = dhd_write_file(filepath, buf, buf_len);
+       if (ret < 0) {
+               return ret;
+       }
+
+       /* Read the file again and check if the file size is not zero */
+       memset(buf, 0, buf_len);
+       ret = dhd_read_file(filepath, buf, buf_len);
+
+       return ret;
+}
+
+#ifdef DHD_BANDSTEER
+/*
+ * Function return true only if there exactly two GO interfaces
+ * TODO: Make it flexible to have AP + AP
+ */
+s32
+dhd_bandsteer_get_ifaces(void *pub, void *ifaces)
+{
+       dhd_if_t    *iflist;  /* For supporting multiple interfaces */
+       uint8 idx;
+       uint8 ap_idx_count = 0;
+       dhd_pub_t *dhd = (dhd_pub_t *) pub;
+       dhd_bandsteer_iface_info_t *bsd_ifp = (dhd_bandsteer_iface_info_t *)ifaces;
+
+       DHD_INFO(("%s: entered\n", __FUNCTION__));
+       for (idx = 0; idx < DHD_MAX_IFS; idx++) {
+               iflist =  dhd->info->iflist[idx];
+               if (iflist == NULL) {
+                       continue;
+               }
+
+               if (iflist->net != NULL) {
+                       if (iflist->net->ieee80211_ptr != NULL) {
+                               if (iflist->net->ieee80211_ptr->iftype  == NL80211_IFTYPE_P2P_GO) {
+                                       ap_idx_count++;
+                                       if (ap_idx_count > 2) {
+                                               continue;
+                                       }
+                                       bsd_ifp->ndev = iflist->net;
+                                       bsd_ifp->bssidx = iflist->bssidx;
+                                       bsd_ifp++;
+                               }
+                       }
+               }
+       }
+       if (ap_idx_count == 2) {
+               return BCME_OK;
+       } else {
+               return BCME_ERROR;
+       }
+}
+
+void
+dhd_bandsteer_schedule_work_on_timeout(dhd_bandsteer_mac_entry_t *dhd_bandsteer_mac)
+{
+       dhd_bandsteer_context_t *dhd_bandsteer_cntx = dhd_bandsteer_mac->dhd_bandsteer_cntx;
+       dhd_pub_t *dhd = (dhd_pub_t *) dhd_bandsteer_cntx->dhd_pub;
+
+       dhd_deferred_schedule_work(dhd->info->dhd_deferred_wq,
+               (void *)dhd_bandsteer_mac, DHD_WQ_WORK_BANDSTEER_STEP_MOVE,
+               dhd_bandsteer_workqueue_wrapper, DHD_WORK_PRIORITY_LOW);
+}
+#endif /* DHD_BANDSTEER */
+
+#ifdef BCM_AUTO_FWCRC
+/*
+ *  extracts CRC field from the firmware binary
+ */
+int dhd_extract_crc(char *filename)
+{
+       struct file *fp = NULL;
+       char crcchk[9] = {0};
+       int crc = 0;
+       int ret = 0;
+
+       fp = filp_open(filename, O_RDONLY, 0);
+       if (IS_ERR(fp)) {
+               DHD_ERROR(("%s: File %s doesn't exist\n", __FUNCTION__, filename));
+               return BCME_ERROR;
+       }
+
+       ret = generic_file_llseek(fp, -(8), SEEK_END);
+       if ((ret < 0) || (ret < 8)) {
+               DHD_ERROR(("%s: file seek failed:%d\n", __FUNCTION__, ret));
+               crc = ret;
+               goto err;
+       }
+
+       ret = kernel_read(fp, ret, crcchk, 8);
+       if (ret < 0) {
+               DHD_ERROR(("read failed\n"));
+               crc = ret;
+               goto err;
+       }
+
+       if (!bcm_atoicrc(crcchk, &crc)) {
+               DHD_INFO(("%s crc:%x\n", __FUNCTION__, crc));
+       } else {
+               DHD_ERROR(("%s crc_int failed\n", __FUNCTION__));
+               crc = BCME_ERROR;
+               goto err;
+       }
+
+       if (!crc || crc == CRC32_INIT_VALUE) {
+               DHD_ERROR(("%s invalid crc\n", __FUNCTION__));
+               crc = BCME_ERROR;
+       }
+
+err:   if (fp)
+               filp_close(fp, NULL);
+
+       return crc;
+}
+#define IS_SIZE_VALID(size) (size >= MEMBLOCK ? TRUE:FALSE)
+
+/*
+ * validates firmware image crc
+ */
+int dhd_check_firmware_image(char *memptr, char *filename)
+{
+       char *imgbuf = NULL;
+       int crcval = CRC32_INIT_VALUE;
+       int len = 0;
+       int totlen = 0;
+       int size = 0;
+       int crcchk;
+       int ret = 0;
+
+       if (filename == NULL)
+               return BCME_ERROR;
+
+       size = dhd_os_file_size(filename);
+       if (!IS_SIZE_VALID(size)) {
+               DHD_ERROR(("Invalid file size %s\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       crcchk = dhd_extract_crc(filename);
+       if (crcchk == BCME_ERROR) {
+               ret = BCME_ERROR;
+               goto err;
+       }
+       DHD_INFO(("crcval:%x\n", crcchk));
+
+       if (!memptr) {
+               DHD_ERROR(("%s memory alloc failed\n", __FUNCTION__));
+               ret = BCME_ERROR;
+               goto err;
+       }
+
+       imgbuf = dhd_os_open_image(filename);
+       if (imgbuf == NULL) {
+               DHD_ERROR(("%s file is not proper\n", __FUNCTION__));
+               ret = BCME_ERROR;
+               goto err;
+       }
+
+       while ((len = dhd_os_get_image_block((char*)memptr, MEMBLOCK, imgbuf))) {
+               if (len < 0) {
+                       DHD_ERROR(("%s: dhd_os_get_image_block failed (%d)\n", __FUNCTION__, len));
+                       break;
+               }
+               wipedates(memptr, MEMBLOCK);
+               totlen += len;
+               if (size == totlen) {
+                       len -= 20;
+                       totlen -= 20;
+               }
+               crcval = hndcrc32(memptr, len, crcval);
+       }
+
+       DHD_INFO(("%s crcval:%X totlen:%d\n", __FUNCTION__, crcval, totlen));
+
+       if (crcchk == crcval) {
+               DHD_INFO(("%scrc match\n", __FUNCTION__));
+               ret = 0;
+       } else {
+               DHD_ERROR(("%scrc match failure crcchk:%x crcval:%x\n",
+                       __FUNCTION__, crcchk, crcval));
+               ret = BCME_ERROR;
+       }
+
+err:   if (imgbuf)
+               dhd_os_close_image(imgbuf);
+
+       return ret;
+}
+#endif /* BCM_AUTO_FWCRC */
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_linux.h b/drivers/net/wireless/bcmdhd_1363/dhd_linux.h
new file mode 100644 (file)
index 0000000..1a0ae0e
--- /dev/null
@@ -0,0 +1,130 @@
+/*
+ * DHD Linux header file (dhd_linux exports for cfg80211 and other components)
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_linux.h 662542 2016-10-28 03:26:10Z $
+ */
+
+/* wifi platform functions for power, interrupt and pre-alloc, either
+ * from Android-like platform device data, or Broadcom wifi platform
+ * device data.
+ *
+ */
+#ifndef __DHD_LINUX_H__
+#define __DHD_LINUX_H__
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/fs.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#ifdef DHD_WMF
+#include <dhd_wmf_linux.h>
+#endif
+/* Linux wireless extension support */
+#if defined(WL_WIRELESS_EXT)
+#include <wl_iw.h>
+#endif /* defined(WL_WIRELESS_EXT) */
+#if defined(CONFIG_HAS_EARLYSUSPEND) && defined(DHD_USE_EARLYSUSPEND)
+#include <linux/earlysuspend.h>
+#endif /* defined(CONFIG_HAS_EARLYSUSPEND) && defined(DHD_USE_EARLYSUSPEND) */
+
+#if defined(CONFIG_WIFI_CONTROL_FUNC)
+#include <linux/wlan_plat.h>
+#endif
+
+#if !defined(CONFIG_WIFI_CONTROL_FUNC)
+#define WLAN_PLAT_NODFS_FLAG    0x01
+struct wifi_platform_data {
+       int (*set_power)(int val);
+       int (*set_reset)(int val);
+       int (*set_carddetect)(int val);
+       void *(*mem_prealloc)(int section, unsigned long size);
+       int (*get_mac_addr)(unsigned char *buf);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 10, 58)) || defined(CUSTOM_COUNTRY_CODE)
+       void *(*get_country_code)(char *ccode, u32 flags);
+#else /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 10, 58)) || defined (CUSTOM_COUNTRY_CODE) */
+       void *(*get_country_code)(char *ccode);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 10, 58)) */
+ };
+#endif /* CONFIG_WIFI_CONTROL_FUNC */
+#define DHD_REGISTRATION_TIMEOUT  12000  /* msec : allowed time to finished dhd registration */
+
+typedef struct wifi_adapter_info {
+       const char      *name;
+       uint            irq_num;
+       uint            intr_flags;
+       const char      *fw_path;
+       const char      *nv_path;
+       void            *wifi_plat_data;        /* wifi ctrl func, for backward compatibility */
+       uint            bus_type;
+       uint            bus_num;
+       uint            slot_num;
+#ifdef OOB_PARAM
+       uint            oob_disable;
+#endif /* OOB_PARAM */
+} wifi_adapter_info_t;
+
+typedef struct bcmdhd_wifi_platdata {
+       uint                            num_adapters;
+       wifi_adapter_info_t     *adapters;
+} bcmdhd_wifi_platdata_t;
+
+/** Per STA params. A list of dhd_sta objects are managed in dhd_if */
+typedef struct dhd_sta {
+       cumm_ctr_t cumm_ctr;    /* cummulative queue length of child flowrings */
+       uint16 flowid[NUMPRIO]; /* allocated flow ring ids (by priority) */
+       void * ifp;             /* associated dhd_if */
+       struct ether_addr ea;   /* stations ethernet mac address */
+       struct list_head list;  /* link into dhd_if::sta_list */
+       int idx;                /* index of self in dhd_pub::sta_pool[] */
+       int ifidx;              /* index of interface in dhd */
+} dhd_sta_t;
+typedef dhd_sta_t dhd_sta_pool_t;
+
+int dhd_wifi_platform_register_drv(void);
+void dhd_wifi_platform_unregister_drv(void);
+wifi_adapter_info_t* dhd_wifi_platform_get_adapter(uint32 bus_type, uint32 bus_num,
+       uint32 slot_num);
+int wifi_platform_set_power(wifi_adapter_info_t *adapter, bool on, unsigned long msec);
+int wifi_platform_bus_enumerate(wifi_adapter_info_t *adapter, bool device_present);
+int wifi_platform_get_irq_number(wifi_adapter_info_t *adapter, unsigned long *irq_flags_ptr);
+int wifi_platform_get_mac_addr(wifi_adapter_info_t *adapter, unsigned char *buf);
+#ifdef CUSTOM_COUNTRY_CODE
+void *wifi_platform_get_country_code(wifi_adapter_info_t *adapter, char *ccode,
+   u32 flags);
+#else
+void *wifi_platform_get_country_code(wifi_adapter_info_t *adapter, char *ccode);
+#endif /* CUSTOM_COUNTRY_CODE */
+void* wifi_platform_prealloc(wifi_adapter_info_t *adapter, int section, unsigned long size);
+void* wifi_platform_get_prealloc_func_ptr(wifi_adapter_info_t *adapter);
+
+int dhd_get_fw_mode(struct dhd_info *dhdinfo);
+bool dhd_update_fw_nv_path(struct dhd_info *dhdinfo);
+
+#ifdef DHD_WMF
+dhd_wmf_t* dhd_wmf_conf(dhd_pub_t *dhdp, uint32 idx);
+#endif /* DHD_WMF */
+#endif /* __DHD_LINUX_H__ */
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_linux_platdev.c b/drivers/net/wireless/bcmdhd_1363/dhd_linux_platdev.c
new file mode 100644 (file)
index 0000000..92d6de1
--- /dev/null
@@ -0,0 +1,890 @@
+/*
+ * Linux platform device for DHD WLAN adapter
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_linux_platdev.c 662542 2016-10-28 03:26:10Z $
+ */
+#include <typedefs.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <bcmutils.h>
+#include <linux_osl.h>
+#include <dhd_dbg.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_bus.h>
+#include <dhd_linux.h>
+#include <wl_android.h>
+#if defined(CONFIG_WIFI_CONTROL_FUNC)
+#include <linux/wlan_plat.h>
+#endif
+#ifdef CONFIG_DTS
+#include<linux/regulator/consumer.h>
+#include<linux/of_gpio.h>
+#endif /* CONFIG_DTS */
+
+
+#define WIFI_PLAT_NAME         "bcmdhd_wlan"
+#define WIFI_PLAT_NAME2                "bcm4329_wlan"
+#define WIFI_PLAT_EXT          "bcmdhd_wifi_platform"
+
+#ifdef CONFIG_DTS
+struct regulator *wifi_regulator = NULL;
+#endif /* CONFIG_DTS */
+
+bool cfg_multichip = FALSE;
+bcmdhd_wifi_platdata_t *dhd_wifi_platdata = NULL;
+static int wifi_plat_dev_probe_ret = 0;
+static bool is_power_on = FALSE;
+#if !defined(CONFIG_DTS)
+#if defined(DHD_OF_SUPPORT)
+static bool dts_enabled = TRUE;
+extern struct resource dhd_wlan_resources;
+extern struct wifi_platform_data dhd_wlan_control;
+#else
+static bool dts_enabled = FALSE;
+struct resource dhd_wlan_resources = {0};
+struct wifi_platform_data dhd_wlan_control = {0};
+#endif /* CONFIG_OF && !defined(CONFIG_ARCH_MSM) */
+#endif /* !defind(CONFIG_DTS) */
+
+static int dhd_wifi_platform_load(void);
+
+extern void* wl_cfg80211_get_dhdp(void);
+
+#ifdef ENABLE_4335BT_WAR
+extern int bcm_bt_lock(int cookie);
+extern void bcm_bt_unlock(int cookie);
+static int lock_cookie_wifi = 'W' | 'i'<<8 | 'F'<<16 | 'i'<<24;        /* cookie is "WiFi" */
+#endif /* ENABLE_4335BT_WAR */
+
+wifi_adapter_info_t* dhd_wifi_platform_get_adapter(uint32 bus_type, uint32 bus_num, uint32 slot_num)
+{
+       int i;
+
+       if (dhd_wifi_platdata == NULL)
+               return NULL;
+
+       for (i = 0; i < dhd_wifi_platdata->num_adapters; i++) {
+               wifi_adapter_info_t *adapter = &dhd_wifi_platdata->adapters[i];
+               if ((adapter->bus_type == -1 || adapter->bus_type == bus_type) &&
+                       (adapter->bus_num == -1 || adapter->bus_num == bus_num) &&
+                       (adapter->slot_num == -1 || adapter->slot_num == slot_num)) {
+                       DHD_TRACE(("found adapter info '%s'\n", adapter->name));
+                       return adapter;
+               }
+       }
+       return NULL;
+}
+
+void* wifi_platform_prealloc(wifi_adapter_info_t *adapter, int section, unsigned long size)
+{
+       void *alloc_ptr = NULL;
+       struct wifi_platform_data *plat_data;
+
+       if (!adapter || !adapter->wifi_plat_data)
+               return NULL;
+       plat_data = adapter->wifi_plat_data;
+       if (plat_data->mem_prealloc) {
+               alloc_ptr = plat_data->mem_prealloc(section, size);
+               if (alloc_ptr) {
+                       DHD_INFO(("success alloc section %d\n", section));
+                       if (size != 0L)
+                               bzero(alloc_ptr, size);
+                       return alloc_ptr;
+               }
+       }
+
+       DHD_ERROR(("%s: failed to alloc static mem section %d\n", __FUNCTION__, section));
+       return NULL;
+}
+
+void* wifi_platform_get_prealloc_func_ptr(wifi_adapter_info_t *adapter)
+{
+       struct wifi_platform_data *plat_data;
+
+       if (!adapter || !adapter->wifi_plat_data)
+               return NULL;
+       plat_data = adapter->wifi_plat_data;
+       return plat_data->mem_prealloc;
+}
+
+int wifi_platform_get_irq_number(wifi_adapter_info_t *adapter, unsigned long *irq_flags_ptr)
+{
+       if (adapter == NULL)
+               return -1;
+       if (irq_flags_ptr)
+               *irq_flags_ptr = adapter->intr_flags;
+       return adapter->irq_num;
+}
+
+int wifi_platform_set_power(wifi_adapter_info_t *adapter, bool on, unsigned long msec)
+{
+       int err = 0;
+#ifdef CONFIG_DTS
+       if (on) {
+               err = regulator_enable(wifi_regulator);
+               is_power_on = TRUE;
+       }
+       else {
+               err = regulator_disable(wifi_regulator);
+               is_power_on = FALSE;
+       }
+       if (err < 0)
+               DHD_ERROR(("%s: regulator enable/disable failed", __FUNCTION__));
+#else
+       struct wifi_platform_data *plat_data;
+
+       if (!adapter || !adapter->wifi_plat_data)
+               return -EINVAL;
+       plat_data = adapter->wifi_plat_data;
+
+       DHD_ERROR(("%s = %d\n", __FUNCTION__, on));
+       if (plat_data->set_power) {
+#ifdef ENABLE_4335BT_WAR
+               if (on) {
+                       printk("WiFi: trying to acquire BT lock\n");
+                       if (bcm_bt_lock(lock_cookie_wifi) != 0)
+                               printk("** WiFi: timeout in acquiring bt lock**\n");
+                       printk("%s: btlock acquired\n", __FUNCTION__);
+               }
+               else {
+                       /* For a exceptional case, release btlock */
+                       bcm_bt_unlock(lock_cookie_wifi);
+               }
+#endif /* ENABLE_4335BT_WAR */
+
+               err = plat_data->set_power(on);
+       }
+
+       if (msec && !err)
+               OSL_SLEEP(msec);
+
+       if (on && !err)
+               is_power_on = TRUE;
+       else
+               is_power_on = FALSE;
+
+#endif /* CONFIG_DTS */
+
+       return err;
+}
+#if defined(CUSTOMER_IMX)
+
+extern void wifi_card_detect(bool);
+int wifi_platform_bus_enumerate(wifi_adapter_info_t *adapter, bool device_present)
+{
+       int err = 0;
+       struct wifi_platform_data *plat_data;
+
+       if (!adapter) {
+               pr_err("!!!! %s: failed!  adapter variable is NULL!!!!!\n", __FUNCTION__);
+               return -EINVAL;
+       }
+
+       DHD_ERROR(("%s device present %d\n", __FUNCTION__, device_present));
+
+       if (!adapter->wifi_plat_data) {
+               wifi_card_detect(device_present); /* hook for card_detect */
+       } else {
+               plat_data = adapter->wifi_plat_data;
+               if (plat_data->set_carddetect) {
+                       err = plat_data->set_carddetect(device_present);
+                       BCM_REFERENCE(err);
+               }
+       }
+
+       return 0; /* force success status returned */
+}
+
+#else
+int wifi_platform_bus_enumerate(wifi_adapter_info_t *adapter, bool device_present)
+{
+       int err = 0;
+       struct wifi_platform_data *plat_data;
+
+       if (!adapter || !adapter->wifi_plat_data)
+               return -EINVAL;
+       plat_data = adapter->wifi_plat_data;
+
+       DHD_ERROR(("%s device present %d\n", __FUNCTION__, device_present));
+       if (plat_data->set_carddetect) {
+               err = plat_data->set_carddetect(device_present);
+       }
+       return err;
+
+}
+#endif /* CUSTOMER_IMX */
+int wifi_platform_get_mac_addr(wifi_adapter_info_t *adapter, unsigned char *buf)
+{
+       struct wifi_platform_data *plat_data;
+
+       DHD_ERROR(("%s\n", __FUNCTION__));
+       if (!buf || !adapter || !adapter->wifi_plat_data)
+               return -EINVAL;
+       plat_data = adapter->wifi_plat_data;
+       if (plat_data->get_mac_addr) {
+               return plat_data->get_mac_addr(buf);
+       }
+       return -EOPNOTSUPP;
+}
+#ifdef CUSTOM_COUNTRY_CODE
+void *wifi_platform_get_country_code(wifi_adapter_info_t *adapter, char *ccode, u32 flags)
+#else
+void *wifi_platform_get_country_code(wifi_adapter_info_t *adapter, char *ccode)
+#endif /* CUSTOM_COUNTRY_CODE */
+{
+       /* get_country_code was added after 2.6.39 */
+#if    (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39))
+       struct wifi_platform_data *plat_data;
+
+       if (!ccode || !adapter || !adapter->wifi_plat_data)
+               return NULL;
+       plat_data = adapter->wifi_plat_data;
+
+       DHD_TRACE(("%s\n", __FUNCTION__));
+       if (plat_data->get_country_code) {
+#if     (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 10, 58))
+               return plat_data->get_country_code(ccode, WLAN_PLAT_NODFS_FLAG);
+#else
+#ifdef CUSTOM_COUNTRY_CODE
+               return plat_data->get_country_code(ccode, flags);
+#else
+               return plat_data->get_country_code(ccode);
+#endif /* CUSTOM_COUNTRY_CODE */
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 10, 58)) */
+       }
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)) */
+
+       return NULL;
+}
+
+static int wifi_plat_dev_drv_probe(struct platform_device *pdev)
+{
+       struct resource *resource;
+       wifi_adapter_info_t *adapter;
+#ifdef CONFIG_DTS
+#if defined(OOB_INTR_ONLY)
+       int irq, gpio;
+#endif /* defined(OOB_INTR_ONLY) */
+#endif /* CONFIG_DTS */
+
+       /* Android style wifi platform data device ("bcmdhd_wlan" or "bcm4329_wlan")
+        * is kept for backward compatibility and supports only 1 adapter
+        */
+       ASSERT(dhd_wifi_platdata != NULL);
+       ASSERT(dhd_wifi_platdata->num_adapters == 1);
+       adapter = &dhd_wifi_platdata->adapters[0];
+       adapter->wifi_plat_data = (struct wifi_platform_data *)(pdev->dev.platform_data);
+
+       resource = platform_get_resource_byname(pdev, IORESOURCE_IRQ, "bcmdhd_wlan_irq");
+       if (resource == NULL)
+               resource = platform_get_resource_byname(pdev, IORESOURCE_IRQ, "bcm4329_wlan_irq");
+       if (resource) {
+               adapter->irq_num = resource->start;
+               adapter->intr_flags = resource->flags & IRQF_TRIGGER_MASK;
+       }
+
+#ifdef OOB_PARAM
+       adapter->oob_disable = FALSE;
+#endif /* OOB_PARAM */
+
+#ifdef CONFIG_DTS
+       wifi_regulator = regulator_get(&pdev->dev, "wlreg_on");
+       if (wifi_regulator == NULL) {
+               DHD_ERROR(("%s regulator is null\n", __FUNCTION__));
+               return -1;
+       }
+#if defined(OOB_INTR_ONLY)
+       OOB_PARAM_IF(!(adapter->oob_disable)) {
+               /* This is to get the irq for the OOB */
+               gpio = of_get_gpio(pdev->dev.of_node, 0);
+
+               if (gpio < 0) {
+                       DHD_ERROR(("%s no GPIO for OOB in device tree.\n", __FUNCTION__));
+#if defined(OOB_PARAM)
+                       DHD_ERROR(("%s continue with non-OOB mode.\n", __FUNCTION__));
+                       adapter->oob_disable = TRUE;
+                       goto out;
+#else
+                       return -1;
+#endif /* defined(OOB_PARAM) */
+               }
+
+               irq = gpio_to_irq(gpio);
+               if (irq < 0) {
+                       DHD_ERROR(("%s irq information is incorrect\n", __FUNCTION__));
+                       return -1;
+               }
+               adapter->irq_num = irq;
+
+               /* need to change the flags according to our requirement */
+#if defined(HW_OOB)
+               adapter->intr_flags = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHLEVEL |
+                       IORESOURCE_IRQ_SHAREABLE;
+#else
+               adapter->intr_flags = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHEDGE |
+                       IORESOURCE_IRQ_SHAREABLE;
+#endif /* defined(HW_OOB) */
+       }
+
+#if defined(OOB_PARAM)
+out:
+#endif /* defined(OOB_PARAM) */
+#endif /* defined(OOB_INTR_ONLY) */
+#endif /* CONFIG_DTS */
+
+       wifi_plat_dev_probe_ret = dhd_wifi_platform_load();
+       return wifi_plat_dev_probe_ret;
+}
+
+static int wifi_plat_dev_drv_remove(struct platform_device *pdev)
+{
+       wifi_adapter_info_t *adapter;
+
+       /* Android style wifi platform data device ("bcmdhd_wlan" or "bcm4329_wlan")
+        * is kept for backward compatibility and supports only 1 adapter
+        */
+       ASSERT(dhd_wifi_platdata != NULL);
+       ASSERT(dhd_wifi_platdata->num_adapters == 1);
+       adapter = &dhd_wifi_platdata->adapters[0];
+       if (is_power_on) {
+#ifdef BCMPCIE
+               wifi_platform_bus_enumerate(adapter, FALSE);
+               wifi_platform_set_power(adapter, FALSE, WIFI_TURNOFF_DELAY);
+#else
+               wifi_platform_set_power(adapter, FALSE, WIFI_TURNOFF_DELAY);
+               wifi_platform_bus_enumerate(adapter, FALSE);
+#endif /* BCMPCIE */
+       }
+
+#ifdef CONFIG_DTS
+       regulator_put(wifi_regulator);
+#endif /* CONFIG_DTS */
+       return 0;
+}
+
+static int wifi_plat_dev_drv_suspend(struct platform_device *pdev, pm_message_t state)
+{
+#ifdef OOB_PARAM
+       wifi_adapter_info_t *adapter;
+       adapter = &dhd_wifi_platdata->adapters[0];
+#endif /* OOB_PARAM */
+
+       DHD_TRACE(("##> %s\n", __FUNCTION__));
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 39)) && defined(OOB_INTR_ONLY) && \
+       defined(BCMSDIO)
+       OOB_PARAM_IF(!(adapter->oob_disable)) {
+               bcmsdh_oob_intr_set(0);
+       }
+#endif /* (OOB_INTR_ONLY) */
+       return 0;
+}
+
+static int wifi_plat_dev_drv_resume(struct platform_device *pdev)
+{
+#ifdef OOB_PARAM
+       wifi_adapter_info_t *adapter;
+       adapter = &dhd_wifi_platdata->adapters[0];
+#endif /* OOB_PARAM */
+
+       DHD_TRACE(("##> %s\n", __FUNCTION__));
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 39)) && defined(OOB_INTR_ONLY) && \
+       defined(BCMSDIO)
+       OOB_PARAM_IF(!(adapter->oob_disable)) {
+               if (dhd_os_check_if_up(wl_cfg80211_get_dhdp(NULL)))
+                       bcmsdh_oob_intr_set(1);
+       }
+#endif /* (OOB_INTR_ONLY) */
+       return 0;
+}
+
+#ifdef CONFIG_DTS
+static const struct of_device_id wifi_device_dt_match[] = {
+       { .compatible = "android,bcmdhd_wlan", },
+       {},
+};
+#endif /* CONFIG_DTS */
+static struct platform_driver wifi_platform_dev_driver = {
+       .probe          = wifi_plat_dev_drv_probe,
+       .remove         = wifi_plat_dev_drv_remove,
+       .suspend        = wifi_plat_dev_drv_suspend,
+       .resume         = wifi_plat_dev_drv_resume,
+       .driver         = {
+       .name   = WIFI_PLAT_NAME,
+#ifdef CONFIG_DTS
+       .of_match_table = wifi_device_dt_match,
+#endif /* CONFIG_DTS */
+       }
+};
+
+static struct platform_driver wifi_platform_dev_driver_legacy = {
+       .probe          = wifi_plat_dev_drv_probe,
+       .remove         = wifi_plat_dev_drv_remove,
+       .suspend        = wifi_plat_dev_drv_suspend,
+       .resume         = wifi_plat_dev_drv_resume,
+       .driver         = {
+       .name   = WIFI_PLAT_NAME2,
+       }
+};
+
+static int wifi_platdev_match(struct device *dev, void *data)
+{
+       char *name = (char*)data;
+       struct platform_device *pdev = to_platform_device(dev);
+
+       if (strcmp(pdev->name, name) == 0) {
+               DHD_ERROR(("found wifi platform device %s\n", name));
+               return TRUE;
+       }
+
+       return FALSE;
+}
+
+static int wifi_ctrlfunc_register_drv(void)
+{
+       int err = 0;
+       struct device *dev1, *dev2;
+       wifi_adapter_info_t *adapter;
+
+       dev1 = bus_find_device(&platform_bus_type, NULL, WIFI_PLAT_NAME, wifi_platdev_match);
+       dev2 = bus_find_device(&platform_bus_type, NULL, WIFI_PLAT_NAME2, wifi_platdev_match);
+
+#if !defined(CONFIG_DTS)
+       if (!dts_enabled) {
+               if (dev1 == NULL && dev2 == NULL) {
+                       DHD_ERROR(("no wifi platform data, skip\n"));
+                       return -ENXIO;
+               }
+       }
+#endif /* !defined(CONFIG_DTS) */
+
+       /* multi-chip support not enabled, build one adapter information for
+        * DHD (either SDIO, USB or PCIe)
+        */
+       adapter = kzalloc(sizeof(wifi_adapter_info_t), GFP_KERNEL);
+       if (adapter == NULL) {
+               DHD_ERROR(("%s:adapter alloc failed", __FUNCTION__));
+               return ENOMEM;
+       }
+       adapter->name = "DHD generic adapter";
+       adapter->bus_type = -1;
+       adapter->bus_num = -1;
+       adapter->slot_num = -1;
+       adapter->irq_num = -1;
+       is_power_on = FALSE;
+       wifi_plat_dev_probe_ret = 0;
+       dhd_wifi_platdata = kzalloc(sizeof(bcmdhd_wifi_platdata_t), GFP_KERNEL);
+       dhd_wifi_platdata->num_adapters = 1;
+       dhd_wifi_platdata->adapters = adapter;
+
+       if (dev1) {
+               err = platform_driver_register(&wifi_platform_dev_driver);
+               if (err) {
+                       DHD_ERROR(("%s: failed to register wifi ctrl func driver\n",
+                               __FUNCTION__));
+                       return err;
+               }
+       }
+       if (dev2) {
+               err = platform_driver_register(&wifi_platform_dev_driver_legacy);
+               if (err) {
+                       DHD_ERROR(("%s: failed to register wifi ctrl func legacy driver\n",
+                               __FUNCTION__));
+                       return err;
+               }
+       }
+
+#if !defined(CONFIG_DTS)
+       if (dts_enabled) {
+               struct resource *resource;
+               adapter->wifi_plat_data = (void *)&dhd_wlan_control;
+               resource = &dhd_wlan_resources;
+               adapter->irq_num = resource->start;
+               adapter->intr_flags = resource->flags & IRQF_TRIGGER_MASK;
+               wifi_plat_dev_probe_ret = dhd_wifi_platform_load();
+       }
+#endif /* !defined(CONFIG_DTS) */
+
+
+#ifdef CONFIG_DTS
+       wifi_plat_dev_probe_ret = platform_driver_register(&wifi_platform_dev_driver);
+#endif /* CONFIG_DTS */
+
+       /* return probe function's return value if registeration succeeded */
+       return wifi_plat_dev_probe_ret;
+}
+
+void wifi_ctrlfunc_unregister_drv(void)
+{
+
+#ifdef CONFIG_DTS
+       DHD_ERROR(("unregister wifi platform drivers\n"));
+       platform_driver_unregister(&wifi_platform_dev_driver);
+#else
+       struct device *dev1, *dev2;
+       dev1 = bus_find_device(&platform_bus_type, NULL, WIFI_PLAT_NAME, wifi_platdev_match);
+       dev2 = bus_find_device(&platform_bus_type, NULL, WIFI_PLAT_NAME2, wifi_platdev_match);
+       if (!dts_enabled)
+               if (dev1 == NULL && dev2 == NULL)
+                       return;
+
+       DHD_ERROR(("unregister wifi platform drivers\n"));
+       if (dev1)
+               platform_driver_unregister(&wifi_platform_dev_driver);
+       if (dev2)
+               platform_driver_unregister(&wifi_platform_dev_driver_legacy);
+       if (dts_enabled) {
+               wifi_adapter_info_t *adapter;
+               adapter = &dhd_wifi_platdata->adapters[0];
+               if (is_power_on) {
+                       wifi_platform_set_power(adapter, FALSE, WIFI_TURNOFF_DELAY);
+                       wifi_platform_bus_enumerate(adapter, FALSE);
+               }
+       }
+#endif /* !defined(CONFIG_DTS) */
+
+       kfree(dhd_wifi_platdata->adapters);
+       dhd_wifi_platdata->adapters = NULL;
+       dhd_wifi_platdata->num_adapters = 0;
+       kfree(dhd_wifi_platdata);
+       dhd_wifi_platdata = NULL;
+}
+
+static int bcmdhd_wifi_plat_dev_drv_probe(struct platform_device *pdev)
+{
+       dhd_wifi_platdata = (bcmdhd_wifi_platdata_t *)(pdev->dev.platform_data);
+
+       return dhd_wifi_platform_load();
+}
+
+static int bcmdhd_wifi_plat_dev_drv_remove(struct platform_device *pdev)
+{
+       int i;
+       wifi_adapter_info_t *adapter;
+       ASSERT(dhd_wifi_platdata != NULL);
+
+       /* power down all adapters */
+       for (i = 0; i < dhd_wifi_platdata->num_adapters; i++) {
+               adapter = &dhd_wifi_platdata->adapters[i];
+               wifi_platform_set_power(adapter, FALSE, WIFI_TURNOFF_DELAY);
+               wifi_platform_bus_enumerate(adapter, FALSE);
+       }
+       return 0;
+}
+
+static struct platform_driver dhd_wifi_platform_dev_driver = {
+       .probe          = bcmdhd_wifi_plat_dev_drv_probe,
+       .remove         = bcmdhd_wifi_plat_dev_drv_remove,
+       .driver         = {
+       .name   = WIFI_PLAT_EXT,
+       }
+};
+
+int dhd_wifi_platform_register_drv(void)
+{
+       int err = 0;
+       struct device *dev;
+
+       /* register Broadcom wifi platform data driver if multi-chip is enabled,
+        * otherwise use Android style wifi platform data (aka wifi control function)
+        * if it exists
+        *
+        * to support multi-chip DHD, Broadcom wifi platform data device must
+        * be added in kernel early boot (e.g. board config file).
+        */
+       if (cfg_multichip) {
+               dev = bus_find_device(&platform_bus_type, NULL, WIFI_PLAT_EXT, wifi_platdev_match);
+               if (dev == NULL) {
+                       DHD_ERROR(("bcmdhd wifi platform data device not found!!\n"));
+                       return -ENXIO;
+               }
+               err = platform_driver_register(&dhd_wifi_platform_dev_driver);
+       } else {
+               err = wifi_ctrlfunc_register_drv();
+
+               /* no wifi ctrl func either, load bus directly and ignore this error */
+               if (err) {
+                       if (err == -ENXIO) {
+                               /* wifi ctrl function does not exist */
+                               err = dhd_wifi_platform_load();
+                       } else {
+                               /* unregister driver due to initialization failure */
+                               wifi_ctrlfunc_unregister_drv();
+                       }
+               }
+       }
+
+       return err;
+}
+
+#ifdef BCMPCIE
+static int dhd_wifi_platform_load_pcie(void)
+{
+       int err = 0;
+       int i;
+       wifi_adapter_info_t *adapter;
+
+       BCM_REFERENCE(i);
+       BCM_REFERENCE(adapter);
+
+       if (dhd_wifi_platdata == NULL) {
+               err = dhd_bus_register();
+       } else {
+               if (dhd_download_fw_on_driverload) {
+                       /* power up all adapters */
+                       for (i = 0; i < dhd_wifi_platdata->num_adapters; i++) {
+                               int retry = POWERUP_MAX_RETRY;
+                               adapter = &dhd_wifi_platdata->adapters[i];
+
+                               DHD_ERROR(("Power-up adapter '%s'\n", adapter->name));
+                               DHD_INFO((" - irq %d [flags %d], firmware: %s, nvram: %s\n",
+                                       adapter->irq_num, adapter->intr_flags, adapter->fw_path,
+                                       adapter->nv_path));
+                               DHD_INFO((" - bus type %d, bus num %d, slot num %d\n\n",
+                                       adapter->bus_type, adapter->bus_num, adapter->slot_num));
+
+                               do {
+                                       err = wifi_platform_set_power(adapter,
+                                               TRUE, WIFI_TURNON_DELAY);
+                                       if (err) {
+                                               DHD_ERROR(("failed to power up %s,"
+                                                       " %d retry left\n",
+                                                       adapter->name, retry));
+                                               /* WL_REG_ON state unknown, Power off forcely */
+                                               wifi_platform_set_power(adapter,
+                                                       FALSE, WIFI_TURNOFF_DELAY);
+                                               continue;
+                                       } else {
+                                               err = wifi_platform_bus_enumerate(adapter, TRUE);
+                                               if (err) {
+                                                       DHD_ERROR(("failed to enumerate bus %s, "
+                                                               "%d retry left\n",
+                                                               adapter->name, retry));
+                                                       wifi_platform_set_power(adapter, FALSE,
+                                                               WIFI_TURNOFF_DELAY);
+                                               } else {
+                                                       break;
+                                               }
+                                       }
+                               } while (retry--);
+
+                               if (!retry) {
+                                       DHD_ERROR(("failed to power up %s, max retry reached**\n",
+                                               adapter->name));
+                                       return -ENODEV;
+                               }
+                       }
+               }
+
+               err = dhd_bus_register();
+
+               if (err) {
+                       DHD_ERROR(("%s: pcie_register_driver failed\n", __FUNCTION__));
+                       if (dhd_download_fw_on_driverload) {
+                               /* power down all adapters */
+                               for (i = 0; i < dhd_wifi_platdata->num_adapters; i++) {
+                                       adapter = &dhd_wifi_platdata->adapters[i];
+                                       wifi_platform_bus_enumerate(adapter, FALSE);
+                                       wifi_platform_set_power(adapter,
+                                               FALSE, WIFI_TURNOFF_DELAY);
+                               }
+                       }
+               }
+       }
+
+       return err;
+}
+#else
+static int dhd_wifi_platform_load_pcie(void)
+{
+       return 0;
+}
+#endif /* BCMPCIE  */
+
+
+void dhd_wifi_platform_unregister_drv(void)
+{
+       if (cfg_multichip)
+               platform_driver_unregister(&dhd_wifi_platform_dev_driver);
+       else
+               wifi_ctrlfunc_unregister_drv();
+}
+
+extern int dhd_watchdog_prio;
+extern int dhd_dpc_prio;
+extern uint dhd_deferred_tx;
+#if defined(BCMLXSDMMC)
+extern struct semaphore dhd_registration_sem;
+#endif 
+
+#ifdef BCMSDIO
+static int dhd_wifi_platform_load_sdio(void)
+{
+       int i;
+       int err = 0;
+       wifi_adapter_info_t *adapter;
+
+       BCM_REFERENCE(i);
+       BCM_REFERENCE(adapter);
+       /* Sanity check on the module parameters
+        * - Both watchdog and DPC as tasklets are ok
+        * - If both watchdog and DPC are threads, TX must be deferred
+        */
+       if (!(dhd_watchdog_prio < 0 && dhd_dpc_prio < 0) &&
+               !(dhd_watchdog_prio >= 0 && dhd_dpc_prio >= 0 && dhd_deferred_tx))
+               return -EINVAL;
+
+#if defined(BCMLXSDMMC)
+       if (dhd_wifi_platdata == NULL) {
+               DHD_ERROR(("DHD wifi platform data is required for Android build\n"));
+               return -EINVAL;
+       }
+
+       sema_init(&dhd_registration_sem, 0);
+       /* power up all adapters */
+       for (i = 0; i < dhd_wifi_platdata->num_adapters; i++) {
+               bool chip_up = FALSE;
+               int retry = POWERUP_MAX_RETRY;
+               struct semaphore dhd_chipup_sem;
+
+               adapter = &dhd_wifi_platdata->adapters[i];
+
+               DHD_ERROR(("Power-up adapter '%s'\n", adapter->name));
+               DHD_INFO((" - irq %d [flags %d], firmware: %s, nvram: %s\n",
+                       adapter->irq_num, adapter->intr_flags, adapter->fw_path, adapter->nv_path));
+               DHD_INFO((" - bus type %d, bus num %d, slot num %d\n\n",
+                       adapter->bus_type, adapter->bus_num, adapter->slot_num));
+
+               do {
+                       sema_init(&dhd_chipup_sem, 0);
+                       err = dhd_bus_reg_sdio_notify(&dhd_chipup_sem);
+                       if (err) {
+                               DHD_ERROR(("%s dhd_bus_reg_sdio_notify fail(%d)\n\n",
+                                       __FUNCTION__, err));
+                               return err;
+                       }
+                       err = wifi_platform_set_power(adapter, TRUE, WIFI_TURNON_DELAY);
+                       if (err) {
+                               /* WL_REG_ON state unknown, Power off forcely */
+                               wifi_platform_set_power(adapter, FALSE, WIFI_TURNOFF_DELAY);
+                               continue;
+                       } else {
+                               wifi_platform_bus_enumerate(adapter, TRUE);
+                               err = 0;
+                       }
+
+                       if (down_timeout(&dhd_chipup_sem, msecs_to_jiffies(POWERUP_WAIT_MS)) == 0) {
+                               dhd_bus_unreg_sdio_notify();
+                               chip_up = TRUE;
+                               break;
+                       }
+
+                       DHD_ERROR(("failed to power up %s, %d retry left\n", adapter->name, retry));
+                       dhd_bus_unreg_sdio_notify();
+                       wifi_platform_set_power(adapter, FALSE, WIFI_TURNOFF_DELAY);
+                       wifi_platform_bus_enumerate(adapter, FALSE);
+               } while (retry--);
+
+               if (!chip_up) {
+                       DHD_ERROR(("failed to power up %s, max retry reached**\n", adapter->name));
+                       return -ENODEV;
+               }
+
+       }
+
+       err = dhd_bus_register();
+
+       if (err) {
+               DHD_ERROR(("%s: sdio_register_driver failed\n", __FUNCTION__));
+               goto fail;
+       }
+
+
+       /*
+        * Wait till MMC sdio_register_driver callback called and made driver attach.
+        * It's needed to make sync up exit from dhd insmod  and
+        * Kernel MMC sdio device callback registration
+        */
+       err = down_timeout(&dhd_registration_sem, msecs_to_jiffies(DHD_REGISTRATION_TIMEOUT));
+       if (err) {
+               DHD_ERROR(("%s: sdio_register_driver timeout or error \n", __FUNCTION__));
+               dhd_bus_unregister();
+               goto fail;
+       }
+
+       return err;
+
+fail:
+       /* power down all adapters */
+       for (i = 0; i < dhd_wifi_platdata->num_adapters; i++) {
+               adapter = &dhd_wifi_platdata->adapters[i];
+               wifi_platform_set_power(adapter, FALSE, WIFI_TURNOFF_DELAY);
+               wifi_platform_bus_enumerate(adapter, FALSE);
+       }
+#else
+
+       /* x86 bring-up PC needs no power-up operations */
+       err = dhd_bus_register();
+
+#endif 
+
+       return err;
+}
+#else /* BCMSDIO */
+static int dhd_wifi_platform_load_sdio(void)
+{
+       return 0;
+}
+#endif /* BCMSDIO */
+
+static int dhd_wifi_platform_load_usb(void)
+{
+       return 0;
+}
+
+static int dhd_wifi_platform_load()
+{
+       int err = 0;
+
+               wl_android_init();
+
+       if ((err = dhd_wifi_platform_load_usb()))
+               goto end;
+       else if ((err = dhd_wifi_platform_load_sdio()))
+               goto end;
+       else
+               err = dhd_wifi_platform_load_pcie();
+
+end:
+       if (err)
+               wl_android_exit();
+       else
+               wl_android_post_init();
+
+       return err;
+}
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_linux_sched.c b/drivers/net/wireless/bcmdhd_1363/dhd_linux_sched.c
new file mode 100644 (file)
index 0000000..88c0cce
--- /dev/null
@@ -0,0 +1,51 @@
+/*
+ * Expose some of the kernel scheduler routines
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_linux_sched.c 514727 2014-11-12 03:02:48Z $
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/sched.h>
+#include <typedefs.h>
+#include <linuxver.h>
+
+int setScheduler(struct task_struct *p, int policy, struct sched_param *param)
+{
+       int rc = 0;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+       rc = sched_setscheduler(p, policy, param);
+#endif /* LinuxVer */
+       return rc;
+}
+
+int get_scheduler_policy(struct task_struct *p)
+{
+       int rc = SCHED_NORMAL;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+       rc = p->policy;
+#endif /* LinuxVer */
+       return rc;
+}
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_linux_wq.c b/drivers/net/wireless/bcmdhd_1363/dhd_linux_wq.c
new file mode 100644 (file)
index 0000000..abbfe48
--- /dev/null
@@ -0,0 +1,320 @@
+/*
+ * Broadcom Dongle Host Driver (DHD), Generic work queue framework
+ * Generic interface to handle dhd deferred work events
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_linux_wq.c 514727 2014-11-12 03:02:48Z $
+ */
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/spinlock.h>
+#include <linux/fcntl.h>
+#include <linux/fs.h>
+#include <linux/ip.h>
+#include <linux/kfifo.h>
+
+#include <linuxver.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <bcmdevs.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_dbg.h>
+#include <dhd_linux_wq.h>
+
+struct dhd_deferred_event_t {
+       u8      event; /* holds the event */
+       void    *event_data; /* Holds event specific data */
+       event_handler_t event_handler;
+};
+#define DEFRD_EVT_SIZE sizeof(struct dhd_deferred_event_t)
+
+struct dhd_deferred_wq {
+       struct work_struct      deferred_work; /* should be the first member */
+
+       /*
+        * work events may occur simultaneously.
+        * Can hold upto 64 low priority events and 4 high priority events
+        */
+#define DHD_PRIO_WORK_FIFO_SIZE        (4 * sizeof(struct dhd_deferred_event_t))
+#define DHD_WORK_FIFO_SIZE     (64 * sizeof(struct dhd_deferred_event_t))
+       struct kfifo                    *prio_fifo;
+       struct kfifo                    *work_fifo;
+       u8                              *prio_fifo_buf;
+       u8                              *work_fifo_buf;
+       spinlock_t                      work_lock;
+       void                            *dhd_info; /* review: does it require */
+};
+
+static inline struct kfifo*
+dhd_kfifo_init(u8 *buf, int size, spinlock_t *lock)
+{
+       struct kfifo *fifo;
+       gfp_t flags = CAN_SLEEP()? GFP_KERNEL : GFP_ATOMIC;
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 33))
+       fifo = kfifo_init(buf, size, flags, lock);
+#else
+       fifo = (struct kfifo *)kzalloc(sizeof(struct kfifo), flags);
+       if (!fifo) {
+               return NULL;
+       }
+       kfifo_init(fifo, buf, size);
+#endif /* (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 33)) */
+       return fifo;
+}
+
+static inline void
+dhd_kfifo_free(struct kfifo *fifo)
+{
+       kfifo_free(fifo);
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 31))
+       /* FC11 releases the fifo memory */
+       kfree(fifo);
+#endif
+}
+
+/* deferred work functions */
+static void dhd_deferred_work_handler(struct work_struct *data);
+
+void*
+dhd_deferred_work_init(void *dhd_info)
+{
+       struct dhd_deferred_wq  *work = NULL;
+       u8*     buf;
+       unsigned long   fifo_size = 0;
+       gfp_t   flags = CAN_SLEEP()? GFP_KERNEL : GFP_ATOMIC;
+
+       if (!dhd_info) {
+               DHD_ERROR(("%s: dhd info not initialized\n", __FUNCTION__));
+               goto return_null;
+       }
+
+       work = (struct dhd_deferred_wq *)kzalloc(sizeof(struct dhd_deferred_wq),
+               flags);
+
+       if (!work) {
+               DHD_ERROR(("%s: work queue creation failed \n", __FUNCTION__));
+               goto return_null;
+       }
+
+       INIT_WORK((struct work_struct *)work, dhd_deferred_work_handler);
+
+       /* initialize event fifo */
+       spin_lock_init(&work->work_lock);
+
+       /* allocate buffer to hold prio events */
+       fifo_size = DHD_PRIO_WORK_FIFO_SIZE;
+       fifo_size = is_power_of_2(fifo_size)? fifo_size : roundup_pow_of_two(fifo_size);
+       buf = (u8*)kzalloc(fifo_size, flags);
+       if (!buf) {
+               DHD_ERROR(("%s: prio work fifo allocation failed \n", __FUNCTION__));
+               goto return_null;
+       }
+
+       /* Initialize prio event fifo */
+       work->prio_fifo = dhd_kfifo_init(buf, fifo_size, &work->work_lock);
+       if (!work->prio_fifo) {
+               kfree(buf);
+               goto return_null;
+       }
+
+       /* allocate buffer to hold work events */
+       fifo_size = DHD_WORK_FIFO_SIZE;
+       fifo_size = is_power_of_2(fifo_size)? fifo_size : roundup_pow_of_two(fifo_size);
+       buf = (u8*)kzalloc(fifo_size, flags);
+       if (!buf) {
+               DHD_ERROR(("%s: work fifo allocation failed \n", __FUNCTION__));
+               goto return_null;
+       }
+
+       /* Initialize event fifo */
+       work->work_fifo = dhd_kfifo_init(buf, fifo_size, &work->work_lock);
+       if (!work->work_fifo) {
+               kfree(buf);
+               goto return_null;
+       }
+
+       work->dhd_info = dhd_info;
+       DHD_ERROR(("%s: work queue initialized \n", __FUNCTION__));
+       return work;
+
+return_null:
+
+       if (work)
+               dhd_deferred_work_deinit(work);
+
+       return NULL;
+}
+
+void
+dhd_deferred_work_deinit(void *work)
+{
+       struct dhd_deferred_wq *deferred_work = work;
+
+
+       if (!deferred_work) {
+               DHD_ERROR(("%s: deferred work has been freed alread \n", __FUNCTION__));
+               return;
+       }
+
+       /* cancel the deferred work handling */
+       cancel_work_sync((struct work_struct *)deferred_work);
+
+       /*
+        * free work event fifo.
+        * kfifo_free frees locally allocated fifo buffer
+        */
+       if (deferred_work->prio_fifo)
+               dhd_kfifo_free(deferred_work->prio_fifo);
+
+       if (deferred_work->work_fifo)
+               dhd_kfifo_free(deferred_work->work_fifo);
+
+       kfree(deferred_work);
+}
+
+/*
+ *     Prepares event to be queued
+ *     Schedules the event
+ */
+int
+dhd_deferred_schedule_work(void *workq, void *event_data, u8 event,
+       event_handler_t event_handler, u8 priority)
+{
+       struct dhd_deferred_wq *deferred_wq = (struct dhd_deferred_wq *) workq;
+       struct  dhd_deferred_event_t    deferred_event;
+       int     status;
+
+       if (!deferred_wq) {
+               DHD_ERROR(("%s: work queue not initialized \n", __FUNCTION__));
+               ASSERT(0);
+               return DHD_WQ_STS_UNINITIALIZED;
+       }
+
+       if (!event || (event >= DHD_MAX_WQ_EVENTS)) {
+               DHD_ERROR(("%s: Unknown event \n", __FUNCTION__));
+               return DHD_WQ_STS_UNKNOWN_EVENT;
+       }
+
+       /*
+        * default element size is 1, which can be changed
+        * using kfifo_esize(). Older kernel(FC11) doesn't support
+        * changing element size. For compatibility changing
+        * element size is not prefered
+        */
+       ASSERT(kfifo_esize(deferred_wq->prio_fifo) == 1);
+       ASSERT(kfifo_esize(deferred_wq->work_fifo) == 1);
+
+       deferred_event.event = event;
+       deferred_event.event_data = event_data;
+       deferred_event.event_handler = event_handler;
+
+       if (priority == DHD_WORK_PRIORITY_HIGH) {
+               status = kfifo_in_spinlocked(deferred_wq->prio_fifo, &deferred_event,
+                       DEFRD_EVT_SIZE, &deferred_wq->work_lock);
+       } else {
+               status = kfifo_in_spinlocked(deferred_wq->work_fifo, &deferred_event,
+                       DEFRD_EVT_SIZE, &deferred_wq->work_lock);
+       }
+
+       if (!status) {
+               return DHD_WQ_STS_SCHED_FAILED;
+       }
+       schedule_work((struct work_struct *)deferred_wq);
+       return DHD_WQ_STS_OK;
+}
+
+static int
+dhd_get_scheduled_work(struct dhd_deferred_wq *deferred_wq, struct dhd_deferred_event_t *event)
+{
+       int     status = 0;
+
+       if (!deferred_wq) {
+               DHD_ERROR(("%s: work queue not initialized \n", __FUNCTION__));
+               return DHD_WQ_STS_UNINITIALIZED;
+       }
+
+       /*
+        * default element size is 1 byte, which can be changed
+        * using kfifo_esize(). Older kernel(FC11) doesn't support
+        * changing element size. For compatibility changing
+        * element size is not prefered
+        */
+       ASSERT(kfifo_esize(deferred_wq->prio_fifo) == 1);
+       ASSERT(kfifo_esize(deferred_wq->work_fifo) == 1);
+
+       /* first read  priorit event fifo */
+       status = kfifo_out_spinlocked(deferred_wq->prio_fifo, event,
+               DEFRD_EVT_SIZE, &deferred_wq->work_lock);
+
+       if (!status) {
+               /* priority fifo is empty. Now read low prio work fifo */
+               status = kfifo_out_spinlocked(deferred_wq->work_fifo, event,
+                       DEFRD_EVT_SIZE, &deferred_wq->work_lock);
+       }
+
+       return status;
+}
+
+/*
+ *     Called when work is scheduled
+ */
+static void
+dhd_deferred_work_handler(struct work_struct *work)
+{
+       struct dhd_deferred_wq          *deferred_work = (struct dhd_deferred_wq *)work;
+       struct dhd_deferred_event_t     work_event;
+       int                             status;
+
+       if (!deferred_work) {
+               DHD_ERROR(("%s: work queue not initialized\n", __FUNCTION__));
+               return;
+       }
+
+       do {
+               status = dhd_get_scheduled_work(deferred_work, &work_event);
+               DHD_TRACE(("%s: event to handle %d \n", __FUNCTION__, status));
+               if (!status) {
+                       DHD_TRACE(("%s: No event to handle %d \n", __FUNCTION__, status));
+                       break;
+               }
+
+               if (work_event.event > DHD_MAX_WQ_EVENTS) {
+                       DHD_TRACE(("%s: Unknown event %d \n", __FUNCTION__, work_event.event));
+                       break;
+               }
+
+               if (work_event.event_handler) {
+                       work_event.event_handler(deferred_work->dhd_info,
+                               work_event.event_data, work_event.event);
+               } else {
+                       DHD_ERROR(("%s: event not defined %d\n", __FUNCTION__, work_event.event));
+               }
+       } while (1);
+       return;
+}
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_linux_wq.h b/drivers/net/wireless/bcmdhd_1363/dhd_linux_wq.h
new file mode 100644 (file)
index 0000000..194256e
--- /dev/null
@@ -0,0 +1,70 @@
+/*
+ * Broadcom Dongle Host Driver (DHD), Generic work queue framework
+ * Generic interface to handle dhd deferred work events
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_linux_wq.h 653928 2016-08-10 10:32:42Z $
+ */
+#ifndef _dhd_linux_wq_h_
+#define _dhd_linux_wq_h_
+/*
+ *     Work event definitions
+ */
+enum _wq_event {
+       DHD_WQ_WORK_IF_ADD = 1,
+       DHD_WQ_WORK_IF_DEL,
+       DHD_WQ_WORK_SET_MAC,
+       DHD_WQ_WORK_SET_MCAST_LIST,
+       DHD_WQ_WORK_IPV6_NDO,
+       DHD_WQ_WORK_HANG_MSG,
+       DHD_WQ_WORK_SOC_RAM_DUMP,
+       DHD_WQ_WORK_DHD_LOG_DUMP,
+       DHD_WQ_WORK_BANDSTEER_STEP_MOVE,
+
+       DHD_MAX_WQ_EVENTS
+};
+
+/*
+ *     Work event priority
+ */
+#define DHD_WORK_PRIORITY_LOW  0
+#define DHD_WORK_PRIORITY_HIGH 1
+
+/*
+ *     Error definitions
+ */
+#define DHD_WQ_STS_OK                   0
+#define DHD_WQ_STS_FAILED              -1      /* General failure */
+#define DHD_WQ_STS_UNINITIALIZED       -2
+#define DHD_WQ_STS_SCHED_FAILED                -3
+#define DHD_WQ_STS_UNKNOWN_EVENT       -4
+
+typedef void (*event_handler_t)(void *handle, void *event_data, u8 event);
+
+void *dhd_deferred_work_init(void *dhd);
+void dhd_deferred_work_deinit(void *workq);
+int dhd_deferred_schedule_work(void *workq, void *event_data, u8 event,
+       event_handler_t evt_handler, u8 priority);
+#endif /* _dhd_linux_wq_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_msgbuf.c b/drivers/net/wireless/bcmdhd_1363/dhd_msgbuf.c
new file mode 100644 (file)
index 0000000..354c9c8
--- /dev/null
@@ -0,0 +1,6427 @@
+/**
+ * @file definition of host message ring functionality
+ * Provides type definitions and function prototypes used to link the
+ * DHD OS, bus, and protocol modules.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_msgbuf.c 664367 2017-03-23 09:23:22Z $
+ */
+
+
+#include <typedefs.h>
+#include <osl.h>
+
+#include <bcmutils.h>
+#include <bcmmsgbuf.h>
+#include <bcmendian.h>
+
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_proto.h>
+
+#include <dhd_bus.h>
+
+#include <dhd_dbg.h>
+#include <siutils.h>
+
+
+#include <dhd_flowring.h>
+
+#include <pcie_core.h>
+#include <bcmpcie.h>
+#include <dhd_pcie.h>
+
+#if defined(DHD_LB)
+#include <linux/cpu.h>
+#include <bcm_ring.h>
+#define DHD_LB_WORKQ_SZ                            (8192)
+#define DHD_LB_WORKQ_SYNC           (16)
+#define DHD_LB_WORK_SCHED           (DHD_LB_WORKQ_SYNC * 2)
+#endif /* DHD_LB */
+
+
+/**
+ * Host configures a soft doorbell for d2h rings, by specifying a 32bit host
+ * address where a value must be written. Host may also interrupt coalescing
+ * on this soft doorbell.
+ * Use Case: Hosts with network processors, may register with the dongle the
+ * network processor's thread wakeup register and a value corresponding to the
+ * core/thread context. Dongle will issue a write transaction <address,value>
+ * to the PCIE RC which will need to be routed to the mapped register space, by
+ * the host.
+ */
+/* #define DHD_D2H_SOFT_DOORBELL_SUPPORT */
+
+/* Dependency Check */
+#if defined(IOCTLRESP_USE_CONSTMEM) && defined(DHD_USE_STATIC_CTRLBUF)
+#error "DHD_USE_STATIC_CTRLBUF is NOT working with DHD_USE_OSLPKT_FOR_RESPBUF"
+#endif /* IOCTLRESP_USE_CONSTMEM && DHD_USE_STATIC_CTRLBUF */
+
+#define RETRIES 2              /* # of retries to retrieve matching ioctl response */
+
+#define DEFAULT_RX_BUFFERS_TO_POST     256
+#define RXBUFPOST_THRESHOLD                    32
+#define RX_BUF_BURST                           32 /* Rx buffers for MSDU Data */
+
+#define DHD_STOP_QUEUE_THRESHOLD       200
+#define DHD_START_QUEUE_THRESHOLD      100
+
+#define RX_DMA_OFFSET          8 /* Mem2mem DMA inserts an extra 8 */
+#define IOCT_RETBUF_SIZE       (RX_DMA_OFFSET + WLC_IOCTL_MAXLEN)
+#define FLOWRING_SIZE          (H2DRING_TXPOST_MAX_ITEM * H2DRING_TXPOST_ITEMSIZE)
+
+/* flags for ioctl pending status */
+#define MSGBUF_IOCTL_ACK_PENDING       (1<<0)
+#define MSGBUF_IOCTL_RESP_PENDING      (1<<1)
+
+#define DMA_ALIGN_LEN          4
+
+#define DMA_D2H_SCRATCH_BUF_LEN        8
+#define DMA_XFER_LEN_LIMIT     0x400000
+
+#define DHD_FLOWRING_IOCTL_BUFPOST_PKTSZ               8192
+
+#define DHD_FLOWRING_MAX_EVENTBUF_POST                 8
+#define DHD_FLOWRING_MAX_IOCTLRESPBUF_POST             8
+
+#define DHD_PROT_FUNCS 37
+
+/* Length of buffer in host for bus throughput measurement */
+#define DHD_BUS_TPUT_BUF_LEN 2048
+
+#define TXP_FLUSH_NITEMS
+
+/* optimization to write "n" tx items at a time to ring */
+#define TXP_FLUSH_MAX_ITEMS_FLUSH_CNT  48
+
+#define RING_NAME_MAX_LENGTH           24
+
+
+struct msgbuf_ring; /* ring context for common and flow rings */
+
+/**
+ * PCIE D2H DMA Complete Sync Modes
+ *
+ * Firmware may interrupt the host, prior to the D2H Mem2Mem DMA completes into
+ * Host system memory. A WAR using one of 3 approaches is needed:
+ * 1. Dongle places a modulo-253 seqnum in last word of each D2H message
+ * 2. XOR Checksum, with epoch# in each work item. Dongle builds an XOR checksum
+ *    writes in the last word of each work item. Each work item has a seqnum
+ *    number = sequence num % 253.
+ *
+ * 3. Read Barrier: Dongle does a host memory read access prior to posting an
+ *    interrupt, ensuring that D2H data transfer indeed completed.
+ * 4. Dongle DMA's all indices after producing items in the D2H ring, flushing
+ *    ring contents before the indices.
+ *
+ * Host does not sync for DMA to complete with option #3 or #4, and a noop sync
+ * callback (see dhd_prot_d2h_sync_none) may be bound.
+ *
+ * Dongle advertizes host side sync mechanism requirements.
+ */
+#define PCIE_D2H_SYNC
+
+#if defined(PCIE_D2H_SYNC)
+#define PCIE_D2H_SYNC_WAIT_TRIES    (512UL)
+#define PCIE_D2H_SYNC_NUM_OF_STEPS     (3UL)
+#define PCIE_D2H_SYNC_DELAY                    (50UL)  /* in terms of usecs */
+
+/**
+ * Custom callback attached based upon D2H DMA Sync mode advertized by dongle.
+ *
+ * On success: return cmn_msg_hdr_t::msg_type
+ * On failure: return 0 (invalid msg_type)
+ */
+typedef uint8 (* d2h_sync_cb_t)(dhd_pub_t *dhd, struct msgbuf_ring *ring,
+                                volatile cmn_msg_hdr_t *msg, int msglen);
+#endif /* PCIE_D2H_SYNC */
+
+
+/*
+ * +----------------------------------------------------------------------------
+ *
+ * RingIds and FlowId are not equivalent as ringids include D2H rings whereas
+ * flowids do not.
+ *
+ * Dongle advertizes the max H2D rings, as max_sub_queues = 'N' which includes
+ * the H2D common rings as well as the (N-BCMPCIE_H2D_COMMON_MSGRINGS) flowrings
+ *
+ * Here is a sample mapping for (based on PCIE Full Dongle Rev5) where,
+ *  BCMPCIE_H2D_COMMON_MSGRINGS = 2, i.e. 2 H2D common rings,
+ *  BCMPCIE_COMMON_MSGRINGS     = 5, i.e. include 3 D2H common rings.
+ *
+ *  H2D Control  Submit   RingId = 0        FlowId = 0 reserved never allocated
+ *  H2D RxPost   Submit   RingId = 1        FlowId = 1 reserved never allocated
+ *
+ *  D2H Control  Complete RingId = 2
+ *  D2H Transmit Complete RingId = 3
+ *  D2H Receive  Complete RingId = 4
+ *
+ *  H2D TxPost   FLOWRING RingId = 5         FlowId = 2     (1st flowring)
+ *  H2D TxPost   FLOWRING RingId = 6         FlowId = 3     (2nd flowring)
+ *  H2D TxPost   FLOWRING RingId = 5 + (N-1) FlowId = (N-1) (Nth flowring)
+ *
+ * When TxPost FlowId(s) are allocated, the FlowIds [0..FLOWID_RESERVED) are
+ * unused, where FLOWID_RESERVED is BCMPCIE_H2D_COMMON_MSGRINGS.
+ *
+ * Example: when a system supports 4 bc/mc and 128 uc flowrings, with
+ * BCMPCIE_H2D_COMMON_MSGRINGS = 2, and BCMPCIE_H2D_COMMON_MSGRINGS = 5, and the
+ * FlowId values would be in the range [2..133] and the corresponding
+ * RingId values would be in the range [5..136].
+ *
+ * The flowId allocator, may chose to, allocate Flowids:
+ *   bc/mc (per virtual interface) in one consecutive range [2..(2+VIFS))
+ *   X# of uc flowids in consecutive ranges (per station Id), where X is the
+ *   packet's access category (e.g. 4 uc flowids per station).
+ *
+ * CAUTION:
+ * When DMA indices array feature is used, RingId=5, corresponding to the 0th
+ * FLOWRING, will actually use the FlowId as index into the H2D DMA index,
+ * since the FlowId truly represents the index in the H2D DMA indices array.
+ *
+ * Likewise, in the D2H direction, the RingId - BCMPCIE_H2D_COMMON_MSGRINGS,
+ * will represent the index in the D2H DMA indices array.
+ *
+ * +----------------------------------------------------------------------------
+ */
+
+/* First TxPost Flowring Id */
+#define DHD_FLOWRING_START_FLOWID   BCMPCIE_H2D_COMMON_MSGRINGS
+
+/* Determine whether a ringid belongs to a TxPost flowring */
+#define DHD_IS_FLOWRING(ringid) \
+       ((ringid) >= BCMPCIE_COMMON_MSGRINGS)
+
+/* Convert a H2D TxPost FlowId to a MsgBuf RingId */
+#define DHD_FLOWID_TO_RINGID(flowid) \
+       (BCMPCIE_COMMON_MSGRINGS + ((flowid) - BCMPCIE_H2D_COMMON_MSGRINGS))
+
+/* Convert a MsgBuf RingId to a H2D TxPost FlowId */
+#define DHD_RINGID_TO_FLOWID(ringid) \
+       (BCMPCIE_H2D_COMMON_MSGRINGS + ((ringid) - BCMPCIE_COMMON_MSGRINGS))
+
+/* Convert a H2D MsgBuf RingId to an offset index into the H2D DMA indices array
+ * This may be used for the H2D DMA WR index array or H2D DMA RD index array or
+ * any array of H2D rings.
+ */
+#define DHD_H2D_RING_OFFSET(ringid) \
+       ((DHD_IS_FLOWRING(ringid)) ? DHD_RINGID_TO_FLOWID(ringid) : (ringid))
+
+/* Convert a D2H MsgBuf RingId to an offset index into the D2H DMA indices array
+ * This may be used for the D2H DMA WR index array or D2H DMA RD index array or
+ * any array of D2H rings.
+ */
+#define DHD_D2H_RING_OFFSET(ringid) \
+       ((ringid) - BCMPCIE_H2D_COMMON_MSGRINGS)
+
+/* Convert a D2H DMA Indices Offset to a RingId */
+#define DHD_D2H_RINGID(offset) \
+       ((offset) + BCMPCIE_H2D_COMMON_MSGRINGS)
+
+
+#define DHD_DMAH_NULL      ((void*)NULL)
+
+/*
+ * Pad a DMA-able buffer by an additional cachline. If the end of the DMA-able
+ * buffer does not occupy the entire cacheline, and another object is placed
+ * following the DMA-able buffer, data corruption may occur if the DMA-able
+ * buffer is used to DMAing into (e.g. D2H direction), when HW cache coherency
+ * is not available.
+ */
+#if defined(L1_CACHE_BYTES)
+#define DHD_DMA_PAD        (L1_CACHE_BYTES)
+#else
+#define DHD_DMA_PAD        (128)
+#endif
+
+/* Used in loopback tests */
+typedef struct dhd_dmaxfer {
+       dhd_dma_buf_t srcmem;
+       dhd_dma_buf_t dstmem;
+       uint32        srcdelay;
+       uint32        destdelay;
+       uint32        len;
+       bool          in_progress;
+} dhd_dmaxfer_t;
+
+/**
+ * msgbuf_ring : This object manages the host side ring that includes a DMA-able
+ * buffer, the WR and RD indices, ring parameters such as max number of items
+ * an length of each items, and other miscellaneous runtime state.
+ * A msgbuf_ring may be used to represent a H2D or D2H common ring or a
+ * H2D TxPost ring as specified in the PCIE FullDongle Spec.
+ * Ring parameters are conveyed to the dongle, which maintains its own peer end
+ * ring state. Depending on whether the DMA Indices feature is supported, the
+ * host will update the WR/RD index in the DMA indices array in host memory or
+ * directly in dongle memory.
+ */
+typedef struct msgbuf_ring {
+       bool           inited;
+       uint16         idx;       /* ring id */
+       uint16         rd;        /* read index */
+       uint16         curr_rd;   /* read index for debug */
+       uint16         wr;        /* write index */
+       uint16         max_items; /* maximum number of items in ring */
+       uint16         item_len;  /* length of each item in the ring */
+       sh_addr_t      base_addr; /* LITTLE ENDIAN formatted: base address */
+       dhd_dma_buf_t  dma_buf;   /* DMA-able buffer: pa, va, len, dmah, secdma */
+       uint32         seqnum;    /* next expected item's sequence number */
+#ifdef TXP_FLUSH_NITEMS
+       void           *start_addr;
+       /* # of messages on ring not yet announced to dongle */
+       uint16         pend_items_count;
+#endif /* TXP_FLUSH_NITEMS */
+       uchar           name[RING_NAME_MAX_LENGTH];
+} msgbuf_ring_t;
+
+#define DHD_RING_BGN_VA(ring)           ((ring)->dma_buf.va)
+#define DHD_RING_END_VA(ring) \
+       ((uint8 *)(DHD_RING_BGN_VA((ring))) + \
+        (((ring)->max_items - 1) * (ring)->item_len))
+
+
+
+/** DHD protocol handle. Is an opaque type to other DHD software layers. */
+typedef struct dhd_prot {
+       osl_t *osh;             /* OSL handle */
+       uint16 rxbufpost;
+       uint16 max_rxbufpost;
+       uint16 max_eventbufpost;
+       uint16 max_ioctlrespbufpost;
+       uint16 cur_event_bufs_posted;
+       uint16 cur_ioctlresp_bufs_posted;
+
+       /* Flow control mechanism based on active transmits pending */
+       uint16 active_tx_count; /* increments on every packet tx, and decrements on tx_status */
+       uint16 max_tx_count;
+       uint16 txp_threshold;  /* optimization to write "n" tx items at a time to ring */
+
+       /* MsgBuf Ring info: has a dhd_dma_buf that is dynamically allocated */
+       msgbuf_ring_t h2dring_ctrl_subn; /* H2D ctrl message submission ring */
+       msgbuf_ring_t h2dring_rxp_subn; /* H2D RxBuf post ring */
+       msgbuf_ring_t d2hring_ctrl_cpln; /* D2H ctrl completion ring */
+       msgbuf_ring_t d2hring_tx_cpln; /* D2H Tx complete message ring */
+       msgbuf_ring_t d2hring_rx_cpln; /* D2H Rx complete message ring */
+
+       msgbuf_ring_t *h2d_flowrings_pool; /* Pool of preallocated flowings */
+       dhd_dma_buf_t flowrings_dma_buf; /* Contiguous DMA buffer for flowrings */
+       uint16        h2d_rings_total; /* total H2D (common rings + flowrings) */
+
+       uint32          rx_dataoffset;
+
+       dhd_mb_ring_t   mb_ring_fn;     /* called when dongle needs to be notified of new msg */
+
+       /* ioctl related resources */
+       uint8 ioctl_state;
+       int16 ioctl_status;             /* status returned from dongle */
+       uint16 ioctl_resplen;
+       dhd_ioctl_recieved_status_t ioctl_received;
+       uint curr_ioctl_cmd;
+       dhd_dma_buf_t   retbuf;         /* For holding ioctl response */
+       dhd_dma_buf_t   ioctbuf;        /* For holding ioctl request */
+
+       dhd_dma_buf_t   d2h_dma_scratch_buf;    /* For holding d2h scratch */
+
+       /* DMA-able arrays for holding WR and RD indices */
+       uint32          rw_index_sz; /* Size of a RD or WR index in dongle */
+       dhd_dma_buf_t   h2d_dma_indx_wr_buf;    /* Array of H2D WR indices */
+       dhd_dma_buf_t   h2d_dma_indx_rd_buf;    /* Array of H2D RD indices */
+       dhd_dma_buf_t   d2h_dma_indx_wr_buf;    /* Array of D2H WR indices */
+       dhd_dma_buf_t   d2h_dma_indx_rd_buf;    /* Array of D2H RD indices */
+
+       dhd_dma_buf_t   host_bus_throughput_buf; /* bus throughput measure buffer */
+
+       dhd_dma_buf_t   *flowring_buf;    /* pool of flow ring buf */
+       uint32                  flowring_num;
+
+#if defined(PCIE_D2H_SYNC)
+       d2h_sync_cb_t d2h_sync_cb; /* Sync on D2H DMA done: SEQNUM or XORCSUM */
+       ulong d2h_sync_wait_max; /* max number of wait loops to receive one msg */
+       ulong d2h_sync_wait_tot; /* total wait loops */
+#endif  /* PCIE_D2H_SYNC */
+
+       dhd_dmaxfer_t   dmaxfer; /* for test/DMA loopback */
+
+       uint16          ioctl_seq_no;
+       uint16          data_seq_no;
+       uint16          ioctl_trans_id;
+       void            *pktid_map_handle; /* a pktid maps to a packet and its metadata */
+       bool            metadata_dbg;
+       void            *pktid_map_handle_ioctl;
+
+       /* Applications/utilities can read tx and rx metadata using IOVARs */
+       uint16          rx_metadata_offset;
+       uint16          tx_metadata_offset;
+
+
+#if defined(DHD_D2H_SOFT_DOORBELL_SUPPORT)
+       /* Host's soft doorbell configuration */
+       bcmpcie_soft_doorbell_t soft_doorbell[BCMPCIE_D2H_COMMON_MSGRINGS];
+#endif /* DHD_D2H_SOFT_DOORBELL_SUPPORT */
+#if defined(DHD_LB)
+       /* Work Queues to be used by the producer and the consumer, and threshold
+        * when the WRITE index must be synced to consumer's workq
+        */
+#if defined(DHD_LB_TXC)
+       uint32 tx_compl_prod_sync ____cacheline_aligned;
+       bcm_workq_t tx_compl_prod, tx_compl_cons;
+#endif /* DHD_LB_TXC */
+#if defined(DHD_LB_RXC)
+       uint32 rx_compl_prod_sync ____cacheline_aligned;
+       bcm_workq_t rx_compl_prod, rx_compl_cons;
+#endif /* DHD_LB_RXC */
+#endif /* DHD_LB */
+} dhd_prot_t;
+
+/* Convert a dmaaddr_t to a base_addr with htol operations */
+static INLINE void dhd_base_addr_htolpa(sh_addr_t *base_addr, dmaaddr_t pa);
+
+/* APIs for managing a DMA-able buffer */
+static int  dhd_dma_buf_audit(dhd_pub_t *dhd, dhd_dma_buf_t *dma_buf);
+static int  dhd_dma_buf_alloc(dhd_pub_t *dhd, dhd_dma_buf_t *dma_buf, uint32 buf_len);
+static void dhd_dma_buf_reset(dhd_pub_t *dhd, dhd_dma_buf_t *dma_buf);
+static void dhd_dma_buf_free(dhd_pub_t *dhd, dhd_dma_buf_t *dma_buf);
+
+/* msgbuf ring management */
+static int dhd_prot_ring_attach(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+       const char *name, uint16 max_items, uint16 len_item, uint16 ringid);
+static void dhd_prot_ring_init(dhd_pub_t *dhd, msgbuf_ring_t *ring);
+static void dhd_prot_ring_reset(dhd_pub_t *dhd, msgbuf_ring_t *ring);
+static void dhd_prot_ring_detach(dhd_pub_t *dhd, msgbuf_ring_t *ring);
+
+/* Pool of pre-allocated msgbuf_ring_t with DMA-able buffers for Flowrings */
+static int  dhd_prot_flowrings_pool_attach(dhd_pub_t *dhd);
+static void dhd_prot_flowrings_pool_reset(dhd_pub_t *dhd);
+static void dhd_prot_flowrings_pool_detach(dhd_pub_t *dhd);
+
+/* Fetch and Release a flowring msgbuf_ring from flowring  pool */
+static msgbuf_ring_t *dhd_prot_flowrings_pool_fetch(dhd_pub_t *dhd,
+       uint16 flowid);
+/* see also dhd_prot_flowrings_pool_release() in dhd_prot.h */
+
+/* Producer: Allocate space in a msgbuf ring */
+static void* dhd_prot_alloc_ring_space(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+       uint16 nitems, uint16 *alloced, bool exactly_nitems);
+static void* dhd_prot_get_ring_space(msgbuf_ring_t *ring, uint16 nitems,
+       uint16 *alloced, bool exactly_nitems);
+
+/* Consumer: Determine the location where the next message may be consumed */
+static uint8* dhd_prot_get_read_addr(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+       uint32 *available_len);
+
+/* Producer (WR index update) or Consumer (RD index update) indication */
+static void dhd_prot_ring_write_complete(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+       void *p, uint16 len);
+static void dhd_prot_upd_read_idx(dhd_pub_t *dhd, msgbuf_ring_t *ring);
+
+/* Allocate DMA-able memory for saving H2D/D2H WR/RD indices */
+static INLINE int dhd_prot_dma_indx_alloc(dhd_pub_t *dhd, uint8 type,
+       dhd_dma_buf_t *dma_buf, uint32 bufsz);
+
+/* Set/Get a RD or WR index in the array of indices */
+/* See also: dhd_prot_dma_indx_init() */
+static void dhd_prot_dma_indx_set(dhd_pub_t *dhd, uint16 new_index, uint8 type,
+       uint16 ringid);
+static uint16 dhd_prot_dma_indx_get(dhd_pub_t *dhd, uint8 type, uint16 ringid);
+
+/* Locate a packet given a pktid */
+static INLINE void *dhd_prot_packet_get(dhd_pub_t *dhd, uint32 pktid, uint8 pkttype,
+       bool free_pktid);
+/* Locate a packet given a PktId and free it. */
+static INLINE void dhd_prot_packet_free(dhd_pub_t *dhd, void *pkt, uint8 pkttype, bool send);
+
+static int dhd_msgbuf_query_ioctl(dhd_pub_t *dhd, int ifidx, uint cmd,
+       void *buf, uint len, uint8 action);
+static int dhd_msgbuf_set_ioctl(dhd_pub_t *dhd, int ifidx, uint cmd,
+       void *buf, uint len, uint8 action);
+static int dhd_msgbuf_wait_ioctl_cmplt(dhd_pub_t *dhd, uint32 len, void *buf);
+static int dhd_fillup_ioct_reqst(dhd_pub_t *dhd, uint16 len, uint cmd,
+       void *buf, int ifidx);
+
+/* Post buffers for Rx, control ioctl response and events */
+static uint16 dhd_msgbuf_rxbuf_post_ctrlpath(dhd_pub_t *dhd, bool event_buf, uint32 max_to_post);
+static void dhd_msgbuf_rxbuf_post_ioctlresp_bufs(dhd_pub_t *pub);
+static void dhd_msgbuf_rxbuf_post_event_bufs(dhd_pub_t *pub);
+static void dhd_msgbuf_rxbuf_post(dhd_pub_t *dhd, bool use_rsv_pktid);
+static int dhd_prot_rxbuf_post(dhd_pub_t *dhd, uint16 count, bool use_rsv_pktid);
+
+static void dhd_prot_return_rxbuf(dhd_pub_t *dhd, uint32 pktid, uint32 rxcnt);
+
+/* D2H Message handling */
+static int dhd_prot_process_msgtype(dhd_pub_t *dhd, msgbuf_ring_t *ring, uint8 *buf, uint32 len);
+
+/* D2H Message handlers */
+static void dhd_prot_noop(dhd_pub_t *dhd, void *msg);
+static void dhd_prot_txstatus_process(dhd_pub_t *dhd, void *msg);
+static void dhd_prot_ioctcmplt_process(dhd_pub_t *dhd, void *msg);
+static void dhd_prot_ioctack_process(dhd_pub_t *dhd, void *msg);
+static void dhd_prot_ringstatus_process(dhd_pub_t *dhd, void *msg);
+static void dhd_prot_genstatus_process(dhd_pub_t *dhd, void *msg);
+static void dhd_prot_rxcmplt_process(dhd_pub_t *dhd, void *msg);
+static void dhd_prot_event_process(dhd_pub_t *dhd, void *msg);
+
+/* Loopback test with dongle */
+static void dmaxfer_free_dmaaddr(dhd_pub_t *dhd, dhd_dmaxfer_t *dma);
+static int dmaxfer_prepare_dmaaddr(dhd_pub_t *dhd, uint len, uint srcdelay,
+       uint destdelay, dhd_dmaxfer_t *dma);
+static void dhd_msgbuf_dmaxfer_process(dhd_pub_t *dhd, void *msg);
+
+/* Flowring management communication with dongle */
+static void dhd_prot_flow_ring_create_response_process(dhd_pub_t *dhd, void *msg);
+static void dhd_prot_flow_ring_delete_response_process(dhd_pub_t *dhd, void *msg);
+static void dhd_prot_flow_ring_flush_response_process(dhd_pub_t *dhd, void *msg);
+
+/* Configure a soft doorbell per D2H ring */
+static void dhd_msgbuf_ring_config_d2h_soft_doorbell(dhd_pub_t *dhd);
+static void dhd_prot_d2h_ring_config_cmplt_process(dhd_pub_t *dhd, void *msg);
+
+typedef void (*dhd_msgbuf_func_t)(dhd_pub_t *dhd, void *msg);
+
+/** callback functions for messages generated by the dongle */
+#define MSG_TYPE_INVALID 0
+
+static dhd_msgbuf_func_t table_lookup[DHD_PROT_FUNCS] = {
+       dhd_prot_noop, /* 0 is MSG_TYPE_INVALID */
+       dhd_prot_genstatus_process, /* MSG_TYPE_GEN_STATUS */
+       dhd_prot_ringstatus_process, /* MSG_TYPE_RING_STATUS */
+       NULL,
+       dhd_prot_flow_ring_create_response_process, /* MSG_TYPE_FLOW_RING_CREATE_CMPLT */
+       NULL,
+       dhd_prot_flow_ring_delete_response_process, /* MSG_TYPE_FLOW_RING_DELETE_CMPLT */
+       NULL,
+       dhd_prot_flow_ring_flush_response_process, /* MSG_TYPE_FLOW_RING_FLUSH_CMPLT */
+       NULL,
+       dhd_prot_ioctack_process, /* MSG_TYPE_IOCTLPTR_REQ_ACK */
+       NULL,
+       dhd_prot_ioctcmplt_process, /* MSG_TYPE_IOCTL_CMPLT */
+       NULL,
+       dhd_prot_event_process, /* MSG_TYPE_WL_EVENT */
+       NULL,
+       dhd_prot_txstatus_process, /* MSG_TYPE_TX_STATUS */
+       NULL,
+       dhd_prot_rxcmplt_process, /* MSG_TYPE_RX_CMPLT */
+       NULL,
+       dhd_msgbuf_dmaxfer_process, /* MSG_TYPE_LPBK_DMAXFER_CMPLT */
+       NULL, /* MSG_TYPE_FLOW_RING_RESUME */
+       NULL, /* MSG_TYPE_FLOW_RING_RESUME_CMPLT */
+       NULL, /* MSG_TYPE_FLOW_RING_SUSPEND */
+       NULL, /* MSG_TYPE_FLOW_RING_SUSPEND_CMPLT */
+       NULL, /* MSG_TYPE_INFO_BUF_POST */
+       NULL, /* MSG_TYPE_INFO_BUF_CMPLT */
+       NULL, /* MSG_TYPE_H2D_RING_CREATE */
+       NULL, /* MSG_TYPE_D2H_RING_CREATE */
+       NULL, /* MSG_TYPE_H2D_RING_CREATE_CMPLT */
+       NULL, /* MSG_TYPE_D2H_RING_CREATE_CMPLT */
+       NULL, /* MSG_TYPE_H2D_RING_CONFIG */
+       NULL, /* MSG_TYPE_D2H_RING_CONFIG */
+       NULL, /* MSG_TYPE_H2D_RING_CONFIG_CMPLT */
+       dhd_prot_d2h_ring_config_cmplt_process, /* MSG_TYPE_D2H_RING_CONFIG_CMPLT */
+       NULL, /* MSG_TYPE_H2D_MAILBOX_DATA */
+       NULL, /* MSG_TYPE_D2H_MAILBOX_DATA */
+};
+
+
+#ifdef DHD_RX_CHAINING
+
+#define PKT_CTF_CHAINABLE(dhd, ifidx, evh, prio, h_sa, h_da, h_prio) \
+       (!ETHER_ISNULLDEST(((struct ether_header *)(evh))->ether_dhost) && \
+        !ETHER_ISMULTI(((struct ether_header *)(evh))->ether_dhost) && \
+        !eacmp((h_da), ((struct ether_header *)(evh))->ether_dhost) && \
+        !eacmp((h_sa), ((struct ether_header *)(evh))->ether_shost) && \
+        ((h_prio) == (prio)) && (dhd_ctf_hotbrc_check((dhd), (evh), (ifidx))) && \
+        ((((struct ether_header *)(evh))->ether_type == HTON16(ETHER_TYPE_IP)) || \
+        (((struct ether_header *)(evh))->ether_type == HTON16(ETHER_TYPE_IPV6))) && \
+        dhd_l2_filter_chainable((dhd), (evh), (ifidx)))
+
+static INLINE void BCMFASTPATH dhd_rxchain_reset(rxchain_info_t *rxchain);
+static void BCMFASTPATH dhd_rxchain_frame(dhd_pub_t *dhd, void *pkt, uint ifidx);
+static void BCMFASTPATH dhd_rxchain_commit(dhd_pub_t *dhd);
+
+#define DHD_PKT_CTF_MAX_CHAIN_LEN      64
+
+#endif /* DHD_RX_CHAINING */
+
+static void dhd_prot_h2d_sync_init(dhd_pub_t *dhd);
+
+#if defined(PCIE_D2H_SYNC) /* avoids problems related to host CPU cache */
+
+/**
+ * D2H DMA to completion callback handlers. Based on the mode advertised by the
+ * dongle through the PCIE shared region, the appropriate callback will be
+ * registered in the proto layer to be invoked prior to precessing any message
+ * from a D2H DMA ring. If the dongle uses a read barrier or another mode that
+ * does not require host participation, then a noop callback handler will be
+ * bound that simply returns the msg_type.
+ */
+static void dhd_prot_d2h_sync_livelock(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+                                       uint32 tries, uchar *msg, int msglen);
+static uint8 dhd_prot_d2h_sync_seqnum(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+                                      volatile cmn_msg_hdr_t *msg, int msglen);
+static uint8 dhd_prot_d2h_sync_xorcsum(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+                                       volatile cmn_msg_hdr_t *msg, int msglen);
+static uint8 dhd_prot_d2h_sync_none(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+                                    volatile cmn_msg_hdr_t *msg, int msglen);
+static void dhd_prot_d2h_sync_init(dhd_pub_t *dhd);
+
+void dhd_prot_collect_memdump(dhd_pub_t *dhd)
+{
+       DHD_ERROR(("%s(): Collecting mem dump now \r\n", __FUNCTION__));
+#ifdef DHD_FW_COREDUMP
+       if (dhd->memdump_enabled) {
+               /* collect core dump */
+               dhd->memdump_type = DUMP_TYPE_BY_LIVELOCK;
+               dhd_bus_mem_dump(dhd);
+       }
+#endif /* DHD_FW_COREDUMP */
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#ifdef CONFIG_ARCH_MSM
+       dhd->bus->no_cfg_restore = 1;
+#endif /* CONFIG_ARCH_MSM */
+       dhd->hang_reason = HANG_REASON_MSGBUF_LIVELOCK;
+       dhd_os_send_hang_message(dhd);
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+}
+
+/**
+ * dhd_prot_d2h_sync_livelock - when the host determines that a DMA transfer has
+ * not completed, a livelock condition occurs. Host will avert this livelock by
+ * dropping this message and moving to the next. This dropped message can lead
+ * to a packet leak, or even something disastrous in the case the dropped
+ * message happens to be a control response.
+ * Here we will log this condition. One may choose to reboot the dongle.
+ *
+ */
+static void
+dhd_prot_d2h_sync_livelock(dhd_pub_t *dhd, msgbuf_ring_t *ring, uint32 tries,
+                           uchar *msg, int msglen)
+{
+       uint32 seqnum = ring->seqnum;
+
+       DHD_ERROR(("LIVELOCK DHD<%p> name<%s> seqnum<%u:%u> tries<%u> max<%lu> tot<%lu>"
+               "dma_buf va<%p> msg<%p> curr_rd<%d>\n",
+               dhd, ring->name, seqnum, seqnum% D2H_EPOCH_MODULO, tries,
+               dhd->prot->d2h_sync_wait_max, dhd->prot->d2h_sync_wait_tot,
+               ring->dma_buf.va, msg, ring->curr_rd));
+       prhex("D2H MsgBuf Failure", (uchar *)msg, msglen);
+       dhd_dump_to_kernelog(dhd);
+
+#ifdef DHD_FW_COREDUMP
+       if (dhd->memdump_enabled) {
+               /* collect core dump */
+               dhd->memdump_type = DUMP_TYPE_BY_LIVELOCK;
+               dhd_bus_mem_dump(dhd);
+       }
+#endif /* DHD_FW_COREDUMP */
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#ifdef CONFIG_ARCH_MSM
+       dhd->bus->no_cfg_restore = 1;
+#endif /* CONFIG_ARCH_MSM */
+       dhd->hang_reason = HANG_REASON_MSGBUF_LIVELOCK;
+       dhd_os_send_hang_message(dhd);
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+}
+
+/**
+ * dhd_prot_d2h_sync_seqnum - Sync on a D2H DMA completion using the SEQNUM
+ * mode. Sequence number is always in the last word of a message.
+ */
+static uint8 BCMFASTPATH
+dhd_prot_d2h_sync_seqnum(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+                         volatile cmn_msg_hdr_t *msg, int msglen)
+{
+       uint32 tries;
+       uint32 ring_seqnum = ring->seqnum % D2H_EPOCH_MODULO;
+       int num_words = msglen / sizeof(uint32); /* num of 32bit words */
+       volatile uint32 *marker = (uint32 *)msg + (num_words - 1); /* last word */
+       dhd_prot_t *prot = dhd->prot;
+       uint32 step = 0;
+       uint32 delay = PCIE_D2H_SYNC_DELAY;
+       uint32 total_tries = 0;
+
+       ASSERT(msglen == ring->item_len);
+
+       BCM_REFERENCE(delay);
+       /*
+        * For retries we have to make some sort of stepper algorithm.
+        * We see that every time when the Dongle comes out of the D3
+        * Cold state, the first D2H mem2mem DMA takes more time to
+        * complete, leading to livelock issues.
+        *
+        * Case 1 - Apart from Host CPU some other bus master is
+        * accessing the DDR port, probably page close to the ring
+        * so, PCIE does not get a change to update the memory.
+        * Solution - Increase the number of tries.
+        *
+        * Case 2 - The 50usec delay given by the Host CPU is not
+        * sufficient for the PCIe RC to start its work.
+        * In this case the breathing time of 50usec given by
+        * the Host CPU is not sufficient.
+        * Solution: Increase the delay in a stepper fashion.
+        * This is done to ensure that there are no
+        * unwanted extra delay introdcued in normal conditions.
+        */
+       for (step = 1; step <= PCIE_D2H_SYNC_NUM_OF_STEPS; step++) {
+               for (tries = 1; tries <= PCIE_D2H_SYNC_WAIT_TRIES; tries++) {
+                       uint32 msg_seqnum = *marker;
+                       if (ltoh32(msg_seqnum) == ring_seqnum) { /* dma upto last word done */
+                               ring->seqnum++; /* next expected sequence number */
+                               goto dma_completed;
+                       }
+
+                       total_tries = ((step-1) * PCIE_D2H_SYNC_WAIT_TRIES) + tries;
+
+                       if (total_tries > prot->d2h_sync_wait_max)
+                               prot->d2h_sync_wait_max = total_tries;
+
+                       OSL_CACHE_INV(msg, msglen); /* invalidate and try again */
+                       OSL_CPU_RELAX(); /* CPU relax for msg_seqnum  value to update */
+#if defined(CONFIG_ARCH_MSM8996) || defined(CONFIG_SOC_EXYNOS8890)
+                       /* For ARM there is no pause in cpu_relax, so add extra delay */
+                       OSL_DELAY(delay * step);
+#endif /* defined(CONFIG_ARCH_MSM8996) || defined(CONFIG_SOC_EXYNOS8890) */
+               } /* for PCIE_D2H_SYNC_WAIT_TRIES */
+       } /* for number of steps */
+
+       dhd_prot_d2h_sync_livelock(dhd, ring, total_tries, (uchar *)msg, msglen);
+
+       ring->seqnum++; /* skip this message ... leak of a pktid */
+       return MSG_TYPE_INVALID; /* invalid msg_type 0 -> noop callback */
+
+dma_completed:
+
+       prot->d2h_sync_wait_tot += total_tries;
+       return msg->msg_type;
+}
+
+/**
+ * dhd_prot_d2h_sync_xorcsum - Sync on a D2H DMA completion using the XORCSUM
+ * mode. The xorcsum is placed in the last word of a message. Dongle will also
+ * place a seqnum in the epoch field of the cmn_msg_hdr.
+ */
+static uint8 BCMFASTPATH
+dhd_prot_d2h_sync_xorcsum(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+                          volatile cmn_msg_hdr_t *msg, int msglen)
+{
+       uint32 tries;
+       uint32 prot_checksum = 0; /* computed checksum */
+       int num_words = msglen / sizeof(uint32); /* num of 32bit words */
+       uint8 ring_seqnum = ring->seqnum % D2H_EPOCH_MODULO;
+       dhd_prot_t *prot = dhd->prot;
+       uint32 step = 0;
+       uint32 delay = PCIE_D2H_SYNC_DELAY;
+       uint32 total_tries = 0;
+
+       ASSERT(msglen == ring->item_len);
+
+       BCM_REFERENCE(delay);
+
+       /*
+        * For retries we have to make some sort of stepper algorithm.
+        * We see that every time when the Dongle comes out of the D3
+        * Cold state, the first D2H mem2mem DMA takes more time to
+        * complete, leading to livelock issues.
+        *
+        * Case 1 - Apart from Host CPU some other bus master is
+        * accessing the DDR port, probably page close to the ring
+        * so, PCIE does not get a change to update the memory.
+        * Solution - Increase the number of tries.
+        *
+        * Case 2 - The 50usec delay given by the Host CPU is not
+        * sufficient for the PCIe RC to start its work.
+        * In this case the breathing time of 50usec given by
+        * the Host CPU is not sufficient.
+        * Solution: Increase the delay in a stepper fashion.
+        * This is done to ensure that there are no
+        * unwanted extra delay introdcued in normal conditions.
+        */
+       for (step = 1; step <= PCIE_D2H_SYNC_NUM_OF_STEPS; step++) {
+               for (tries = 1; tries <= PCIE_D2H_SYNC_WAIT_TRIES; tries++) {
+                       prot_checksum = bcm_compute_xor32((volatile uint32 *)msg, num_words);
+                       if (prot_checksum == 0U) { /* checksum is OK */
+                               if (msg->epoch == ring_seqnum) {
+                                       ring->seqnum++; /* next expected sequence number */
+                                       goto dma_completed;
+                               }
+                       }
+
+                       total_tries = ((step-1) * PCIE_D2H_SYNC_WAIT_TRIES) + tries;
+
+                       if (total_tries > prot->d2h_sync_wait_max)
+                               prot->d2h_sync_wait_max = total_tries;
+
+                       OSL_CACHE_INV(msg, msglen); /* invalidate and try again */
+                       OSL_CPU_RELAX(); /* CPU relax for msg_seqnum  value to update */
+#if defined(CONFIG_ARCH_MSM8996) || defined(CONFIG_SOC_EXYNOS8890)
+                       /* For ARM there is no pause in cpu_relax, so add extra delay */
+                       OSL_DELAY(delay * step);
+#endif /* defined(CONFIG_ARCH_MSM8996) || defined(CONFIG_SOC_EXYNOS8890) */
+
+               } /* for PCIE_D2H_SYNC_WAIT_TRIES */
+       } /* for number of steps */
+
+       dhd_prot_d2h_sync_livelock(dhd, ring, total_tries, (uchar *)msg, msglen);
+
+       ring->seqnum++; /* skip this message ... leak of a pktid */
+       return MSG_TYPE_INVALID; /* invalid msg_type 0 -> noop callback */
+
+dma_completed:
+
+       prot->d2h_sync_wait_tot += total_tries;
+       return msg->msg_type;
+}
+
+/**
+ * dhd_prot_d2h_sync_none - Dongle ensure that the DMA will complete and host
+ * need to try to sync. This noop sync handler will be bound when the dongle
+ * advertises that neither the SEQNUM nor XORCSUM mode of DMA sync is required.
+ */
+static uint8 BCMFASTPATH
+dhd_prot_d2h_sync_none(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+                       volatile cmn_msg_hdr_t *msg, int msglen)
+{
+       return msg->msg_type;
+}
+
+/**
+ * dhd_prot_d2h_sync_init - Setup the host side DMA sync mode based on what
+ * dongle advertizes.
+ */
+static void
+dhd_prot_d2h_sync_init(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot = dhd->prot;
+       prot->d2h_sync_wait_max = 0UL;
+       prot->d2h_sync_wait_tot = 0UL;
+
+       prot->d2hring_ctrl_cpln.seqnum = D2H_EPOCH_INIT_VAL;
+       prot->d2hring_tx_cpln.seqnum = D2H_EPOCH_INIT_VAL;
+       prot->d2hring_rx_cpln.seqnum = D2H_EPOCH_INIT_VAL;
+
+       if (dhd->d2h_sync_mode & PCIE_SHARED_D2H_SYNC_SEQNUM) {
+               prot->d2h_sync_cb = dhd_prot_d2h_sync_seqnum;
+       } else if (dhd->d2h_sync_mode & PCIE_SHARED_D2H_SYNC_XORCSUM) {
+               prot->d2h_sync_cb = dhd_prot_d2h_sync_xorcsum;
+       } else {
+               prot->d2h_sync_cb = dhd_prot_d2h_sync_none;
+       }
+}
+
+#endif /* PCIE_D2H_SYNC */
+
+int INLINE
+dhd_wakeup_ioctl_event(dhd_pub_t *dhd, dhd_ioctl_recieved_status_t reason)
+{
+       /* To synchronize with the previous memory operations call wmb() */
+       OSL_SMP_WMB();
+       dhd->prot->ioctl_received = reason;
+       /* Call another wmb() to make sure before waking up the other event value gets updated */
+       OSL_SMP_WMB();
+       dhd_os_ioctl_resp_wake(dhd);
+       return 0;
+}
+
+/**
+ * dhd_prot_h2d_sync_init - Per H2D common ring, setup the msgbuf ring seqnum
+ */
+static void
+dhd_prot_h2d_sync_init(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot = dhd->prot;
+       prot->h2dring_rxp_subn.seqnum = H2D_EPOCH_INIT_VAL;
+       prot->h2dring_ctrl_subn.seqnum = H2D_EPOCH_INIT_VAL;
+}
+
+/* +-----------------  End of PCIE DHD H2D DMA SYNC ------------------------+ */
+
+
+/*
+ * +---------------------------------------------------------------------------+
+ * PCIE DMA-able buffer. Sets up a dhd_dma_buf_t object, which includes the
+ * virtual and physical address, the buffer lenght and the DMA handler.
+ * A secdma handler is also included in the dhd_dma_buf object.
+ * +---------------------------------------------------------------------------+
+ */
+
+static INLINE void
+dhd_base_addr_htolpa(sh_addr_t *base_addr, dmaaddr_t pa)
+{
+       base_addr->low_addr = htol32(PHYSADDRLO(pa));
+       base_addr->high_addr = htol32(PHYSADDRHI(pa));
+}
+
+
+/**
+ * dhd_dma_buf_audit - Any audits on a DHD DMA Buffer.
+ */
+static int
+dhd_dma_buf_audit(dhd_pub_t *dhd, dhd_dma_buf_t *dma_buf)
+{
+       uint32 base, end; /* dongle uses 32bit ptr arithmetic */
+
+       ASSERT(dma_buf);
+       base = PHYSADDRLO(dma_buf->pa);
+       ASSERT(base);
+       ASSERT(ISALIGNED(base, DMA_ALIGN_LEN));
+       ASSERT(dma_buf->len != 0);
+
+       /* test 32bit offset arithmetic over dma buffer for loss of carry-over */
+       end = (base + dma_buf->len); /* end address */
+
+       if ((end & 0xFFFFFFFF) < (base & 0xFFFFFFFF)) { /* exclude carryover */
+               DHD_ERROR(("%s: dma_buf %x len %d spans dongle 32bit ptr arithmetic\n",
+                       __FUNCTION__, base, dma_buf->len));
+               return BCME_ERROR;
+       }
+
+       return BCME_OK;
+}
+
+/**
+ * dhd_dma_buf_alloc - Allocate a cache coherent DMA-able buffer.
+ * returns BCME_OK=0 on success
+ * returns non-zero negative error value on failure.
+ */
+static int
+dhd_dma_buf_alloc(dhd_pub_t *dhd, dhd_dma_buf_t *dma_buf, uint32 buf_len)
+{
+       uint32 dma_pad = 0;
+       osl_t *osh = dhd->osh;
+
+       ASSERT(dma_buf != NULL);
+       ASSERT(dma_buf->va == NULL);
+       ASSERT(dma_buf->len == 0);
+
+       /* Pad the buffer length by one extra cacheline size.
+        * Required for D2H direction.
+        */
+       dma_pad = (buf_len % DHD_DMA_PAD) ? DHD_DMA_PAD : 0;
+       dma_buf->va = DMA_ALLOC_CONSISTENT(osh, buf_len + dma_pad,
+               DMA_ALIGN_LEN, &dma_buf->_alloced, &dma_buf->pa, &dma_buf->dmah);
+
+       if (dma_buf->va == NULL) {
+               DHD_ERROR(("%s: buf_len %d, no memory available\n",
+                       __FUNCTION__, buf_len));
+               return BCME_NOMEM;
+       }
+
+       dma_buf->len = buf_len; /* not including padded len */
+
+       if (dhd_dma_buf_audit(dhd, dma_buf) != BCME_OK) { /* audit dma buf */
+               dhd_dma_buf_free(dhd, dma_buf);
+               return BCME_ERROR;
+       }
+
+       dhd_dma_buf_reset(dhd, dma_buf); /* zero out and cache flush */
+
+       return BCME_OK;
+}
+
+/**
+ * dhd_dma_buf_reset - Reset a cache coherent DMA-able buffer.
+ */
+static void
+dhd_dma_buf_reset(dhd_pub_t *dhd, dhd_dma_buf_t *dma_buf)
+{
+       if ((dma_buf == NULL) || (dma_buf->va == NULL)) {
+               return;
+       }
+
+       (void)dhd_dma_buf_audit(dhd, dma_buf);
+
+       /* Zero out the entire buffer and cache flush */
+       memset((void*)dma_buf->va, 0, dma_buf->len);
+       OSL_CACHE_FLUSH((void *)dma_buf->va, dma_buf->len);
+}
+
+/**
+ * dhd_dma_buf_free - Free a DMA-able buffer that was previously allocated using
+ * dhd_dma_buf_alloc().
+ */
+static void
+dhd_dma_buf_free(dhd_pub_t *dhd, dhd_dma_buf_t *dma_buf)
+{
+       osl_t *osh = dhd->osh;
+
+       ASSERT(dma_buf);
+
+       if (dma_buf->va == NULL) {
+               return; /* Allow for free invocation, when alloc failed */
+       }
+
+       /* DEBUG: dhd_dma_buf_reset(dhd, dma_buf) */
+       (void)dhd_dma_buf_audit(dhd, dma_buf);
+
+       /* dma buffer may have been padded at allocation */
+       DMA_FREE_CONSISTENT(osh, dma_buf->va, dma_buf->_alloced,
+               dma_buf->pa, dma_buf->dmah);
+
+       memset(dma_buf, 0, sizeof(dhd_dma_buf_t));
+}
+
+/**
+ * dhd_dma_buf_init - Initialize a dhd_dma_buf with speicifed values.
+ * Do not use dhd_dma_buf_init to zero out a dhd_dma_buf_t object. Use memset 0.
+ */
+void
+dhd_dma_buf_init(dhd_pub_t *dhd, void *dhd_dma_buf,
+       void *va, uint32 len, dmaaddr_t pa, void *dmah, void *secdma)
+{
+       dhd_dma_buf_t *dma_buf;
+       ASSERT(dhd_dma_buf);
+       dma_buf = (dhd_dma_buf_t *)dhd_dma_buf;
+       dma_buf->va = va;
+       dma_buf->len = len;
+       dma_buf->pa = pa;
+       dma_buf->dmah = dmah;
+       dma_buf->secdma = secdma;
+
+       /* Audit user defined configuration */
+       (void)dhd_dma_buf_audit(dhd, dma_buf);
+}
+
+/* +------------------  End of PCIE DHD DMA BUF ADT ------------------------+ */
+
+/*
+ * +---------------------------------------------------------------------------+
+ * PktId Map: Provides a native packet pointer to unique 32bit PktId mapping.
+ * Main purpose is to save memory on the dongle, has other purposes as well.
+ * The packet id map, also includes storage for some packet parameters that
+ * may be saved. A native packet pointer along with the parameters may be saved
+ * and a unique 32bit pkt id will be returned. Later, the saved packet pointer
+ * and the metadata may be retrieved using the previously allocated packet id.
+ * +---------------------------------------------------------------------------+
+ */
+#define DHD_PCIE_PKTID
+#define MAX_PKTID_ITEMS     (3072) /* Maximum number of pktids supported */
+
+/* On Router, the pktptr serves as a pktid. */
+
+
+#if defined(PROP_TXSTATUS) && !defined(DHD_PCIE_PKTID)
+#error "PKTIDMAP must be supported with PROP_TXSTATUS/WLFC"
+#endif
+
+/* Enum for marking the buffer color based on usage */
+typedef enum dhd_pkttype {
+       PKTTYPE_DATA_TX = 0,
+       PKTTYPE_DATA_RX,
+       PKTTYPE_IOCTL_RX,
+       PKTTYPE_EVENT_RX,
+       /* dhd_prot_pkt_free no check, if pktid reserved and no space avail case */
+       PKTTYPE_NO_CHECK
+} dhd_pkttype_t;
+
+#define DHD_PKTID_INVALID               (0U)
+#define DHD_IOCTL_REQ_PKTID             (0xFFFE)
+#define DHD_FAKE_PKTID                  (0xFACE)
+
+#define DHD_PKTID_FREE_LOCKER           (FALSE)
+#define DHD_PKTID_RSV_LOCKER            (TRUE)
+
+typedef void * dhd_pktid_map_handle_t; /* opaque handle to a pktid map */
+
+/* Construct a packet id mapping table, returning an opaque map handle */
+static dhd_pktid_map_handle_t *dhd_pktid_map_init(dhd_pub_t *dhd, uint32 num_items, uint32 index);
+
+/* Destroy a packet id mapping table, freeing all packets active in the table */
+static void dhd_pktid_map_fini(dhd_pub_t *dhd, dhd_pktid_map_handle_t *map);
+
+#define PKTID_MAP_HANDLE       (0)
+#define PKTID_MAP_HANDLE_IOCTL (1)
+
+#define DHD_NATIVE_TO_PKTID_INIT(dhd, items, index) dhd_pktid_map_init((dhd), (items), (index))
+#define DHD_NATIVE_TO_PKTID_FINI(dhd, map)   dhd_pktid_map_fini((dhd), (map))
+
+#if defined(DHD_PCIE_PKTID)
+
+
+/* Determine number of pktids that are available */
+static INLINE uint32 dhd_pktid_map_avail_cnt(dhd_pktid_map_handle_t *handle);
+
+/* Allocate a unique pktid against which a pkt and some metadata is saved */
+static INLINE uint32 dhd_pktid_map_reserve(dhd_pub_t *dhd, dhd_pktid_map_handle_t *handle,
+       void *pkt);
+static INLINE void dhd_pktid_map_save(dhd_pub_t *dhd, dhd_pktid_map_handle_t *handle,
+       void *pkt, uint32 nkey, dmaaddr_t pa, uint32 len, uint8 dma,
+       void *dmah, void *secdma, dhd_pkttype_t pkttype);
+static uint32 dhd_pktid_map_alloc(dhd_pub_t *dhd, dhd_pktid_map_handle_t *map,
+       void *pkt, dmaaddr_t pa, uint32 len, uint8 dma,
+       void *dmah, void *secdma, dhd_pkttype_t pkttype);
+
+/* Return an allocated pktid, retrieving previously saved pkt and metadata */
+static void *dhd_pktid_map_free(dhd_pub_t *dhd, dhd_pktid_map_handle_t *map,
+       uint32 id, dmaaddr_t *pa, uint32 *len, void **dmah,
+       void **secdma, dhd_pkttype_t pkttype, bool rsv_locker);
+
+/*
+ * DHD_PKTID_AUDIT_ENABLED: Audit of PktIds in DHD for duplicate alloc and frees
+ *
+ * DHD_PKTID_AUDIT_MAP: Audit the LIFO or FIFO PktIdMap allocator
+ * DHD_PKTID_AUDIT_RING: Audit the pktid during producer/consumer ring operation
+ *
+ * CAUTION: When DHD_PKTID_AUDIT_ENABLED is defined,
+ *    either DHD_PKTID_AUDIT_MAP or DHD_PKTID_AUDIT_RING may be selected.
+ */
+#if defined(DHD_PKTID_AUDIT_ENABLED)
+#define USE_DHD_PKTID_AUDIT_LOCK 1
+/* Audit the pktidmap allocator */
+/* #define DHD_PKTID_AUDIT_MAP */
+
+/* Audit the pktid during production/consumption of workitems */
+#define DHD_PKTID_AUDIT_RING
+
+#if defined(DHD_PKTID_AUDIT_MAP) && defined(DHD_PKTID_AUDIT_RING)
+#error "May only enabled audit of MAP or RING, at a time."
+#endif /* DHD_PKTID_AUDIT_MAP && DHD_PKTID_AUDIT_RING */
+
+#define DHD_DUPLICATE_ALLOC     1
+#define DHD_DUPLICATE_FREE      2
+#define DHD_TEST_IS_ALLOC       3
+#define DHD_TEST_IS_FREE        4
+
+#ifdef USE_DHD_PKTID_AUDIT_LOCK
+#define DHD_PKTID_AUDIT_LOCK_INIT(osh)          dhd_os_spin_lock_init(osh)
+#define DHD_PKTID_AUDIT_LOCK_DEINIT(osh, lock)  dhd_os_spin_lock_deinit(osh, lock)
+#define DHD_PKTID_AUDIT_LOCK(lock)              dhd_os_spin_lock(lock)
+#define DHD_PKTID_AUDIT_UNLOCK(lock, flags)     dhd_os_spin_unlock(lock, flags)
+#else
+#define DHD_PKTID_AUDIT_LOCK_INIT(osh)          (void *)(1)
+#define DHD_PKTID_AUDIT_LOCK_DEINIT(osh, lock)  do { /* noop */ } while (0)
+#define DHD_PKTID_AUDIT_LOCK(lock)              0
+#define DHD_PKTID_AUDIT_UNLOCK(lock, flags)     do { /* noop */ } while (0)
+#endif /* !USE_DHD_PKTID_AUDIT_LOCK */
+
+#endif /* DHD_PKTID_AUDIT_ENABLED */
+
+/* #define USE_DHD_PKTID_LOCK   1 */
+
+#ifdef USE_DHD_PKTID_LOCK
+#define DHD_PKTID_LOCK_INIT(osh)                dhd_os_spin_lock_init(osh)
+#define DHD_PKTID_LOCK_DEINIT(osh, lock)        dhd_os_spin_lock_deinit(osh, lock)
+#define DHD_PKTID_LOCK(lock)                    dhd_os_spin_lock(lock)
+#define DHD_PKTID_UNLOCK(lock, flags)           dhd_os_spin_unlock(lock, flags)
+#else
+#define DHD_PKTID_LOCK_INIT(osh)                (void *)(1)
+#define DHD_PKTID_LOCK_DEINIT(osh, lock)       \
+       do { \
+               BCM_REFERENCE(osh); \
+               BCM_REFERENCE(lock); \
+       } while (0)
+#define DHD_PKTID_LOCK(lock)                    0
+#define DHD_PKTID_UNLOCK(lock, flags)           \
+       do { \
+               BCM_REFERENCE(lock); \
+               BCM_REFERENCE(flags); \
+       } while (0)
+#endif /* !USE_DHD_PKTID_LOCK */
+
+/* Packet metadata saved in packet id mapper */
+
+/* The Locker can be 3 states
+ * LOCKER_IS_FREE - Locker is free and can be allocated
+ * LOCKER_IS_BUSY - Locker is assigned and is being used, values in the
+ *                  locker (buffer address, len, phy addr etc) are populated
+ *                 with valid values
+ * LOCKER_IS_RSVD - The locker is reserved for future use, but the values
+ *                  in the locker are not valid. Especially pkt should be
+ *                  NULL in this state. When the user wants to re-use the
+ *                  locker dhd_pktid_map_free can be called with a flag
+ *                  to reserve the pktid for future use, which will clear
+ *                  the contents of the locker. When the user calls
+ *                  dhd_pktid_map_save the locker would move to LOCKER_IS_BUSY
+ */
+typedef enum dhd_locker_state {
+       LOCKER_IS_FREE,
+       LOCKER_IS_BUSY,
+       LOCKER_IS_RSVD
+} dhd_locker_state_t;
+
+typedef struct dhd_pktid_item {
+       dhd_locker_state_t state;  /* tag a locker to be free, busy or reserved */
+       uint8         dir;      /* dma map direction (Tx=flush or Rx=invalidate) */
+       dhd_pkttype_t pkttype;  /* pktlists are maintained based on pkttype */
+       uint16        len;      /* length of mapped packet's buffer */
+       void          *pkt;     /* opaque native pointer to a packet */
+       dmaaddr_t     pa;       /* physical address of mapped packet's buffer */
+       void          *dmah;    /* handle to OS specific DMA map */
+       void          *secdma;
+} dhd_pktid_item_t;
+
+typedef struct dhd_pktid_map {
+       uint32      items;    /* total items in map */
+       uint32      avail;    /* total available items */
+       int         failures; /* lockers unavailable count */
+       /* Spinlock to protect dhd_pktid_map in process/tasklet context */
+       void        *pktid_lock; /* Used when USE_DHD_PKTID_LOCK is defined */
+
+#if defined(DHD_PKTID_AUDIT_ENABLED)
+       void        *pktid_audit_lock;
+       struct bcm_mwbmap *pktid_audit; /* multi word bitmap based audit */
+#endif /* DHD_PKTID_AUDIT_ENABLED */
+
+       uint32      keys[MAX_PKTID_ITEMS + 1]; /* stack of unique pkt ids */
+       dhd_pktid_item_t lockers[0];           /* metadata storage */
+} dhd_pktid_map_t;
+
+/*
+ * PktId (Locker) #0 is never allocated and is considered invalid.
+ *
+ * On request for a pktid, a value DHD_PKTID_INVALID must be treated as a
+ * depleted pktid pool and must not be used by the caller.
+ *
+ * Likewise, a caller must never free a pktid of value DHD_PKTID_INVALID.
+ */
+
+#define DHD_PKTID_ITEM_SZ               (sizeof(dhd_pktid_item_t))
+#define DHD_PKIDMAP_ITEMS(items)        (items)
+#define DHD_PKTID_MAP_SZ(items)         (sizeof(dhd_pktid_map_t) + \
+                                       (DHD_PKTID_ITEM_SZ * ((items) + 1)))
+
+#define DHD_NATIVE_TO_PKTID_FINI_IOCTL(dhd, map)  dhd_pktid_map_fini_ioctl((dhd), (map))
+
+/* Convert a packet to a pktid, and save pkt pointer in busy locker */
+#define DHD_NATIVE_TO_PKTID_RSV(dhd, map, pkt)    dhd_pktid_map_reserve((dhd), (map), (pkt))
+
+/* Reuse a previously reserved locker to save packet params */
+#define DHD_NATIVE_TO_PKTID_SAVE(dhd, map, pkt, nkey, pa, len, dir, dmah, secdma, pkttype) \
+       dhd_pktid_map_save((dhd), (map), (void *)(pkt), (nkey), (pa), (uint32)(len), \
+                          (uint8)(dir), (void *)(dmah), (void *)(secdma), \
+                          (dhd_pkttype_t)(pkttype))
+
+/* Convert a packet to a pktid, and save packet params in locker */
+#define DHD_NATIVE_TO_PKTID(dhd, map, pkt, pa, len, dir, dmah, secdma, pkttype) \
+       dhd_pktid_map_alloc((dhd), (map), (void *)(pkt), (pa), (uint32)(len), \
+                           (uint8)(dir), (void *)(dmah), (void *)(secdma), \
+                           (dhd_pkttype_t)(pkttype))
+
+/* Convert pktid to a packet, and free the locker */
+#define DHD_PKTID_TO_NATIVE(dhd, map, pktid, pa, len, dmah, secdma, pkttype) \
+       dhd_pktid_map_free((dhd), (map), (uint32)(pktid), \
+       (dmaaddr_t *)&(pa), (uint32 *)&(len), (void **)&(dmah), \
+       (void **) &secdma, (dhd_pkttype_t)(pkttype), DHD_PKTID_FREE_LOCKER)
+
+/* Convert the pktid to a packet, empty locker, but keep it reserved */
+#define DHD_PKTID_TO_NATIVE_RSV(dhd, map, pktid, pa, len, dmah, secdma, pkttype) \
+       dhd_pktid_map_free((dhd), (map), (uint32)(pktid), \
+       (dmaaddr_t *)&(pa), (uint32 *)&(len), (void **)&(dmah), \
+       (void **) &secdma, (dhd_pkttype_t)(pkttype), DHD_PKTID_RSV_LOCKER)
+
+#define DHD_PKTID_AVAIL(map)                 dhd_pktid_map_avail_cnt(map)
+
+#if defined(DHD_PKTID_AUDIT_ENABLED)
+
+static int dhd_pktid_audit(dhd_pub_t *dhd, dhd_pktid_map_t *pktid_map, uint32 pktid,
+       const int test_for, const char *errmsg);
+
+/**
+* dhd_pktid_audit - Use the mwbmap to audit validity of a pktid.
+*/
+static int
+dhd_pktid_audit(dhd_pub_t *dhd, dhd_pktid_map_t *pktid_map, uint32 pktid,
+       const int test_for, const char *errmsg)
+{
+#define DHD_PKT_AUDIT_STR "ERROR: %16s Host PktId Audit: "
+
+       const uint32 max_pktid_items = (MAX_PKTID_ITEMS);
+       struct bcm_mwbmap *handle;
+       uint32  flags;
+       bool ignore_audit;
+
+       if (pktid_map == (dhd_pktid_map_t *)NULL) {
+               DHD_ERROR((DHD_PKT_AUDIT_STR "Pkt id map NULL\n", errmsg));
+               return BCME_OK;
+       }
+
+       flags = DHD_PKTID_AUDIT_LOCK(pktid_map->pktid_audit_lock);
+
+       handle = pktid_map->pktid_audit;
+       if (handle == (struct bcm_mwbmap *)NULL) {
+               DHD_ERROR((DHD_PKT_AUDIT_STR "Handle NULL\n", errmsg));
+               DHD_PKTID_AUDIT_UNLOCK(pktid_map->pktid_audit_lock, flags);
+               return BCME_OK;
+       }
+
+       /* Exclude special pktids from audit */
+       ignore_audit = (pktid == DHD_IOCTL_REQ_PKTID) | (pktid == DHD_FAKE_PKTID);
+       if (ignore_audit) {
+               DHD_PKTID_AUDIT_UNLOCK(pktid_map->pktid_audit_lock, flags);
+               return BCME_OK;
+       }
+
+       if ((pktid == DHD_PKTID_INVALID) || (pktid > max_pktid_items)) {
+               DHD_ERROR((DHD_PKT_AUDIT_STR "PktId<%d> invalid\n", errmsg, pktid));
+               /* lock is released in "error" */
+               goto error;
+       }
+
+       /* Perform audit */
+       switch (test_for) {
+               case DHD_DUPLICATE_ALLOC:
+                       if (!bcm_mwbmap_isfree(handle, pktid)) {
+                               DHD_ERROR((DHD_PKT_AUDIT_STR "PktId<%d> alloc duplicate\n",
+                                          errmsg, pktid));
+                               goto error;
+                       }
+                       bcm_mwbmap_force(handle, pktid);
+                       break;
+
+               case DHD_DUPLICATE_FREE:
+                       if (bcm_mwbmap_isfree(handle, pktid)) {
+                               DHD_ERROR((DHD_PKT_AUDIT_STR "PktId<%d> free duplicate\n",
+                                          errmsg, pktid));
+                               goto error;
+                       }
+                       bcm_mwbmap_free(handle, pktid);
+                       break;
+
+               case DHD_TEST_IS_ALLOC:
+                       if (bcm_mwbmap_isfree(handle, pktid)) {
+                               DHD_ERROR((DHD_PKT_AUDIT_STR "PktId<%d> is not allocated\n",
+                                          errmsg, pktid));
+                               goto error;
+                       }
+                       break;
+
+               case DHD_TEST_IS_FREE:
+                       if (!bcm_mwbmap_isfree(handle, pktid)) {
+                               DHD_ERROR((DHD_PKT_AUDIT_STR "PktId<%d> is not free",
+                                          errmsg, pktid));
+                               goto error;
+                       }
+                       break;
+
+               default:
+                       goto error;
+       }
+
+       DHD_PKTID_AUDIT_UNLOCK(pktid_map->pktid_audit_lock, flags);
+       return BCME_OK;
+
+error:
+
+       DHD_PKTID_AUDIT_UNLOCK(pktid_map->pktid_audit_lock, flags);
+       /* May insert any trap mechanism here ! */
+       dhd_pktid_audit_fail_cb(dhd);
+
+       return BCME_ERROR;
+}
+
+#define DHD_PKTID_AUDIT(dhdp, map, pktid, test_for) \
+       dhd_pktid_audit((dhdp), (dhd_pktid_map_t *)(map), (pktid), (test_for), __FUNCTION__)
+
+#endif /* DHD_PKTID_AUDIT_ENABLED */
+
+/* +------------------  End of PCIE DHD PKTID AUDIT ------------------------+ */
+
+
+/**
+ * +---------------------------------------------------------------------------+
+ * Packet to Packet Id mapper using a <numbered_key, locker> paradigm.
+ *
+ * dhd_pktid_map manages a set of unique Packet Ids range[1..MAX_PKTID_ITEMS].
+ *
+ * dhd_pktid_map_alloc() may be used to save some packet metadata, and a unique
+ * packet id is returned. This unique packet id may be used to retrieve the
+ * previously saved packet metadata, using dhd_pktid_map_free(). On invocation
+ * of dhd_pktid_map_free(), the unique packet id is essentially freed. A
+ * subsequent call to dhd_pktid_map_alloc() may reuse this packet id.
+ *
+ * Implementation Note:
+ * Convert this into a <key,locker> abstraction and place into bcmutils !
+ * Locker abstraction should treat contents as opaque storage, and a
+ * callback should be registered to handle busy lockers on destructor.
+ *
+ * +---------------------------------------------------------------------------+
+ */
+
+/** Allocate and initialize a mapper of num_items <numbered_key, locker> */
+
+static dhd_pktid_map_handle_t *
+dhd_pktid_map_init(dhd_pub_t *dhd, uint32 num_items, uint32 index)
+{
+       void *osh;
+       uint32 nkey;
+       dhd_pktid_map_t *map;
+       uint32 dhd_pktid_map_sz;
+       uint32 map_items;
+#ifdef DHD_USE_STATIC_PKTIDMAP
+       uint32 section;
+#endif /* DHD_USE_STATIC_PKTIDMAP */
+       osh = dhd->osh;
+
+       ASSERT((num_items >= 1) && (num_items <= MAX_PKTID_ITEMS));
+       dhd_pktid_map_sz = DHD_PKTID_MAP_SZ(num_items);
+
+#ifdef DHD_USE_STATIC_PKTIDMAP
+       if (index == PKTID_MAP_HANDLE) {
+               section = DHD_PREALLOC_PKTID_MAP;
+       } else {
+               section = DHD_PREALLOC_PKTID_MAP_IOCTL;
+       }
+
+       map = (dhd_pktid_map_t *)DHD_OS_PREALLOC(dhd, section, dhd_pktid_map_sz);
+#else
+       map = (dhd_pktid_map_t *)MALLOC(osh, dhd_pktid_map_sz);
+#endif /* DHD_USE_STATIC_PKTIDMAP */
+
+       if (map == NULL) {
+               DHD_ERROR(("%s:%d: MALLOC failed for size %d\n",
+                       __FUNCTION__, __LINE__, dhd_pktid_map_sz));
+               goto error;
+       }
+
+       bzero(map, dhd_pktid_map_sz);
+
+       /* Initialize the lock that protects this structure */
+       map->pktid_lock = DHD_PKTID_LOCK_INIT(osh);
+       if (map->pktid_lock == NULL) {
+               DHD_ERROR(("%s:%d: Lock init failed \r\n", __FUNCTION__, __LINE__));
+               goto error;
+       }
+
+       map->items = num_items;
+       map->avail = num_items;
+
+       map_items = DHD_PKIDMAP_ITEMS(map->items);
+
+#if defined(DHD_PKTID_AUDIT_ENABLED)
+       /* Incarnate a hierarchical multiword bitmap for auditing pktid allocator */
+       map->pktid_audit = bcm_mwbmap_init(osh, map_items + 1);
+       if (map->pktid_audit == (struct bcm_mwbmap *)NULL) {
+               DHD_ERROR(("%s:%d: pktid_audit init failed\r\n", __FUNCTION__, __LINE__));
+               goto error;
+       } else {
+               DHD_ERROR(("%s:%d: pktid_audit init succeeded %d\n",
+                       __FUNCTION__, __LINE__, map_items + 1));
+       }
+
+       map->pktid_audit_lock = DHD_PKTID_AUDIT_LOCK_INIT(osh);
+
+#endif /* DHD_PKTID_AUDIT_ENABLED */
+
+       for (nkey = 1; nkey <= map_items; nkey++) { /* locker #0 is reserved */
+               map->keys[nkey] = nkey; /* populate with unique keys */
+               map->lockers[nkey].state = LOCKER_IS_FREE;
+               map->lockers[nkey].pkt   = NULL; /* bzero: redundant */
+               map->lockers[nkey].len   = 0;
+       }
+
+       /* Reserve pktid #0, i.e. DHD_PKTID_INVALID to be busy */
+       map->lockers[DHD_PKTID_INVALID].state = LOCKER_IS_BUSY;
+       map->lockers[DHD_PKTID_INVALID].pkt   = NULL; /* bzero: redundant */
+       map->lockers[DHD_PKTID_INVALID].len   = 0;
+
+#if defined(DHD_PKTID_AUDIT_ENABLED)
+       /* do not use dhd_pktid_audit() here, use bcm_mwbmap_force directly */
+       bcm_mwbmap_force(map->pktid_audit, DHD_PKTID_INVALID);
+#endif /* DHD_PKTID_AUDIT_ENABLED */
+
+       return (dhd_pktid_map_handle_t *)map; /* opaque handle */
+
+error:
+
+       if (map) {
+
+#if defined(DHD_PKTID_AUDIT_ENABLED)
+               if (map->pktid_audit != (struct bcm_mwbmap *)NULL) {
+                       bcm_mwbmap_fini(osh, map->pktid_audit); /* Destruct pktid_audit */
+                       map->pktid_audit = (struct bcm_mwbmap *)NULL;
+                       if (map->pktid_audit_lock)
+                               DHD_PKTID_AUDIT_LOCK_DEINIT(osh, map->pktid_audit_lock);
+               }
+#endif /* DHD_PKTID_AUDIT_ENABLED */
+
+               if (map->pktid_lock)
+                       DHD_PKTID_LOCK_DEINIT(osh, map->pktid_lock);
+
+               MFREE(osh, map, dhd_pktid_map_sz);
+       }
+
+       return (dhd_pktid_map_handle_t *)NULL;
+}
+
+/**
+ * Retrieve all allocated keys and free all <numbered_key, locker>.
+ * Freeing implies: unmapping the buffers and freeing the native packet
+ * This could have been a callback registered with the pktid mapper.
+ */
+
+static void
+dhd_pktid_map_fini(dhd_pub_t *dhd, dhd_pktid_map_handle_t *handle)
+{
+       void *osh;
+       uint32 nkey;
+       dhd_pktid_map_t *map;
+       uint32 dhd_pktid_map_sz;
+       dhd_pktid_item_t *locker;
+       uint32 map_items;
+       uint32 flags;
+
+       if (handle == NULL) {
+               return;
+       }
+
+       map = (dhd_pktid_map_t *)handle;
+       flags =  DHD_PKTID_LOCK(map->pktid_lock);
+       osh = dhd->osh;
+
+       dhd_pktid_map_sz = DHD_PKTID_MAP_SZ(map->items);
+
+       nkey = 1; /* skip reserved KEY #0, and start from 1 */
+       locker = &map->lockers[nkey];
+
+       map_items = DHD_PKIDMAP_ITEMS(map->items);
+
+       for (; nkey <= map_items; nkey++, locker++) {
+
+               if (locker->state == LOCKER_IS_BUSY) { /* numbered key still in use */
+
+                       locker->state = LOCKER_IS_FREE; /* force open the locker */
+
+#if defined(DHD_PKTID_AUDIT_ENABLED)
+                       DHD_PKTID_AUDIT(dhd, map, nkey, DHD_DUPLICATE_FREE); /* duplicate frees */
+#endif /* DHD_PKTID_AUDIT_ENABLED */
+
+                       {   /* This could be a callback registered with dhd_pktid_map */
+                               DMA_UNMAP(osh, locker->pa, locker->len,
+                                       locker->dir, 0, DHD_DMAH_NULL);
+                               dhd_prot_packet_free(dhd, (ulong*)locker->pkt,
+                                       locker->pkttype, TRUE);
+                       }
+               }
+#if defined(DHD_PKTID_AUDIT_ENABLED)
+               else {
+                       DHD_PKTID_AUDIT(dhd, map, nkey, DHD_TEST_IS_FREE);
+               }
+#endif /* DHD_PKTID_AUDIT_ENABLED */
+
+               locker->pkt = NULL; /* clear saved pkt */
+               locker->len = 0;
+       }
+
+#if defined(DHD_PKTID_AUDIT_ENABLED)
+       if (map->pktid_audit != (struct bcm_mwbmap *)NULL) {
+               bcm_mwbmap_fini(osh, map->pktid_audit); /* Destruct pktid_audit */
+               map->pktid_audit = (struct bcm_mwbmap *)NULL;
+               if (map->pktid_audit_lock) {
+                       DHD_PKTID_AUDIT_LOCK_DEINIT(osh, map->pktid_audit_lock);
+               }
+       }
+#endif /* DHD_PKTID_AUDIT_ENABLED */
+
+       DHD_PKTID_UNLOCK(map->pktid_lock, flags);
+       DHD_PKTID_LOCK_DEINIT(osh, map->pktid_lock);
+
+#ifdef DHD_USE_STATIC_PKTIDMAP
+       DHD_OS_PREFREE(dhd, handle, dhd_pktid_map_sz);
+#else
+       MFREE(osh, handle, dhd_pktid_map_sz);
+#endif /* DHD_USE_STATIC_PKTIDMAP */
+}
+
+#ifdef IOCTLRESP_USE_CONSTMEM
+/** Called in detach scenario. Releasing IOCTL buffers. */
+static void
+dhd_pktid_map_fini_ioctl(dhd_pub_t *dhd, dhd_pktid_map_handle_t *handle)
+{
+       uint32 nkey;
+       dhd_pktid_map_t *map;
+       uint32 dhd_pktid_map_sz;
+       dhd_pktid_item_t *locker;
+       uint32 map_items;
+       uint32 flags;
+       osl_t *osh = dhd->osh;
+
+       if (handle == NULL) {
+               return;
+       }
+
+       map = (dhd_pktid_map_t *)handle;
+       flags = DHD_PKTID_LOCK(map->pktid_lock);
+
+       dhd_pktid_map_sz = DHD_PKTID_MAP_SZ(map->items);
+
+       nkey = 1; /* skip reserved KEY #0, and start from 1 */
+       locker = &map->lockers[nkey];
+
+       map_items = DHD_PKIDMAP_ITEMS(map->items);
+
+       for (; nkey <= map_items; nkey++, locker++) {
+
+               if (locker->state == LOCKER_IS_BUSY) { /* numbered key still in use */
+
+                       locker->state = LOCKER_IS_FREE; /* force open the locker */
+
+#if defined(DHD_PKTID_AUDIT_ENABLED)
+                       DHD_PKTID_AUDIT(dhd, map, nkey, DHD_DUPLICATE_FREE); /* duplicate frees */
+#endif /* DHD_PKTID_AUDIT_ENABLED */
+
+                       {
+                               dhd_dma_buf_t retbuf;
+                               retbuf.va = locker->pkt;
+                               retbuf.len = locker->len;
+                               retbuf.pa = locker->pa;
+                               retbuf.dmah = locker->dmah;
+                               retbuf.secdma = locker->secdma;
+
+                               /* This could be a callback registered with dhd_pktid_map */
+                               DHD_PKTID_UNLOCK(map->pktid_lock, flags);
+                               free_ioctl_return_buffer(dhd, &retbuf);
+                               flags = DHD_PKTID_LOCK(map->pktid_lock);
+                       }
+               }
+#if defined(DHD_PKTID_AUDIT_ENABLED)
+               else {
+                       DHD_PKTID_AUDIT(dhd, map, nkey, DHD_TEST_IS_FREE);
+               }
+#endif /* DHD_PKTID_AUDIT_ENABLED */
+
+               locker->pkt = NULL; /* clear saved pkt */
+               locker->len = 0;
+       }
+
+#if defined(DHD_PKTID_AUDIT_ENABLED)
+       if (map->pktid_audit != (struct bcm_mwbmap *)NULL) {
+               bcm_mwbmap_fini(osh, map->pktid_audit); /* Destruct pktid_audit */
+               map->pktid_audit = (struct bcm_mwbmap *)NULL;
+               if (map->pktid_audit_lock) {
+                       DHD_PKTID_AUDIT_LOCK_DEINIT(osh, map->pktid_audit_lock);
+               }
+       }
+#endif /* DHD_PKTID_AUDIT_ENABLED */
+
+       DHD_PKTID_UNLOCK(map->pktid_lock, flags);
+       DHD_PKTID_LOCK_DEINIT(osh, map->pktid_lock);
+
+#ifdef DHD_USE_STATIC_PKTIDMAP
+       DHD_OS_PREFREE(dhd, handle, dhd_pktid_map_sz);
+#else
+       MFREE(osh, handle, dhd_pktid_map_sz);
+#endif /* DHD_USE_STATIC_PKTIDMAP */
+}
+#endif /* IOCTLRESP_USE_CONSTMEM */
+
+/** Get the pktid free count */
+static INLINE uint32 BCMFASTPATH
+dhd_pktid_map_avail_cnt(dhd_pktid_map_handle_t *handle)
+{
+       dhd_pktid_map_t *map;
+       uint32  flags;
+       uint32  avail;
+
+       ASSERT(handle != NULL);
+       map = (dhd_pktid_map_t *)handle;
+
+       flags = DHD_PKTID_LOCK(map->pktid_lock);
+       avail = map->avail;
+       DHD_PKTID_UNLOCK(map->pktid_lock, flags);
+
+       return avail;
+}
+
+/**
+ * Allocate locker, save pkt contents, and return the locker's numbered key.
+ * dhd_pktid_map_alloc() is not reentrant, and is the caller's responsibility.
+ * Caller must treat a returned value DHD_PKTID_INVALID as a failure case,
+ * implying a depleted pool of pktids.
+ */
+
+static INLINE uint32
+__dhd_pktid_map_reserve(dhd_pub_t *dhd, dhd_pktid_map_handle_t *handle, void *pkt)
+{
+       uint32 nkey;
+       dhd_pktid_map_t *map;
+       dhd_pktid_item_t *locker;
+
+       ASSERT(handle != NULL);
+       map = (dhd_pktid_map_t *)handle;
+
+       if (map->avail <= 0) { /* no more pktids to allocate */
+               map->failures++;
+               DHD_INFO(("%s:%d: failed, no free keys\n", __FUNCTION__, __LINE__));
+               return DHD_PKTID_INVALID; /* failed alloc request */
+       }
+
+       ASSERT(map->avail <= map->items);
+       nkey = map->keys[map->avail]; /* fetch a free locker, pop stack */
+       locker = &map->lockers[nkey]; /* save packet metadata in locker */
+       map->avail--;
+       locker->pkt = pkt; /* pkt is saved, other params not yet saved. */
+       locker->len = 0;
+       locker->state = LOCKER_IS_BUSY; /* reserve this locker */
+
+#if defined(DHD_PKTID_AUDIT_MAP)
+       DHD_PKTID_AUDIT(dhd, map, nkey, DHD_DUPLICATE_ALLOC); /* Audit duplicate alloc */
+#endif /* DHD_PKTID_AUDIT_MAP */
+
+       ASSERT(nkey != DHD_PKTID_INVALID);
+       return nkey; /* return locker's numbered key */
+}
+
+
+/**
+ * dhd_pktid_map_reserve - reserve a unique numbered key. Reserved locker is not
+ * yet populated. Invoke the pktid save api to populate the packet parameters
+ * into the locker.
+ * Wrapper that takes the required lock when called directly.
+ */
+static INLINE uint32
+dhd_pktid_map_reserve(dhd_pub_t *dhd, dhd_pktid_map_handle_t *handle, void *pkt)
+{
+       dhd_pktid_map_t *map;
+       uint32 flags;
+       uint32 ret;
+
+       ASSERT(handle != NULL);
+       map = (dhd_pktid_map_t *)handle;
+       flags = DHD_PKTID_LOCK(map->pktid_lock);
+       ret = __dhd_pktid_map_reserve(dhd, handle, pkt);
+       DHD_PKTID_UNLOCK(map->pktid_lock, flags);
+
+       return ret;
+}
+
+static INLINE void
+__dhd_pktid_map_save(dhd_pub_t *dhd, dhd_pktid_map_handle_t *handle, void *pkt,
+       uint32 nkey, dmaaddr_t pa, uint32 len, uint8 dir, void *dmah, void *secdma,
+       dhd_pkttype_t pkttype)
+{
+       dhd_pktid_map_t *map;
+       dhd_pktid_item_t *locker;
+
+       ASSERT(handle != NULL);
+       map = (dhd_pktid_map_t *)handle;
+
+       ASSERT((nkey != DHD_PKTID_INVALID) && (nkey <= DHD_PKIDMAP_ITEMS(map->items)));
+
+       locker = &map->lockers[nkey];
+
+       ASSERT(((locker->state == LOCKER_IS_BUSY) && (locker->pkt == pkt)) ||
+               ((locker->state == LOCKER_IS_RSVD) && (locker->pkt == NULL)));
+
+#if defined(DHD_PKTID_AUDIT_MAP)
+       DHD_PKTID_AUDIT(dhd, map, nkey, DHD_TEST_IS_ALLOC); /* apriori, reservation */
+#endif /* DHD_PKTID_AUDIT_MAP */
+
+       /* store contents in locker */
+       locker->dir = dir;
+       locker->pa = pa;
+       locker->len = (uint16)len; /* 16bit len */
+       locker->dmah = dmah; /* 16bit len */
+       locker->secdma = secdma;
+       locker->pkttype = pkttype;
+       locker->pkt = pkt;
+       locker->state = LOCKER_IS_BUSY; /* make this locker busy */
+}
+
+/**
+ * dhd_pktid_map_save - Save a packet's parameters into a locker corresponding
+ * to a previously reserved unique numbered key.
+ * Wrapper that takes the required lock when called directly.
+ */
+static INLINE void
+dhd_pktid_map_save(dhd_pub_t *dhd, dhd_pktid_map_handle_t *handle, void *pkt,
+       uint32 nkey, dmaaddr_t pa, uint32 len, uint8 dir, void *dmah, void *secdma,
+       dhd_pkttype_t pkttype)
+{
+       dhd_pktid_map_t *map;
+       uint32 flags;
+
+       ASSERT(handle != NULL);
+       map = (dhd_pktid_map_t *)handle;
+       flags = DHD_PKTID_LOCK(map->pktid_lock);
+       __dhd_pktid_map_save(dhd, handle, pkt, nkey, pa, len,
+               dir, dmah, secdma, pkttype);
+       DHD_PKTID_UNLOCK(map->pktid_lock, flags);
+}
+
+/**
+ * dhd_pktid_map_alloc - Allocate a unique numbered key and save the packet
+ * contents into the corresponding locker. Return the numbered key.
+ */
+static uint32 BCMFASTPATH
+dhd_pktid_map_alloc(dhd_pub_t *dhd, dhd_pktid_map_handle_t *handle, void *pkt,
+       dmaaddr_t pa, uint32 len, uint8 dir, void *dmah, void *secdma,
+       dhd_pkttype_t pkttype)
+{
+       uint32 nkey;
+       uint32 flags;
+       dhd_pktid_map_t *map;
+
+       ASSERT(handle != NULL);
+       map = (dhd_pktid_map_t *)handle;
+
+       flags = DHD_PKTID_LOCK(map->pktid_lock);
+
+       nkey = __dhd_pktid_map_reserve(dhd, handle, pkt);
+       if (nkey != DHD_PKTID_INVALID) {
+               __dhd_pktid_map_save(dhd, handle, pkt, nkey, pa,
+                       len, dir, dmah, secdma, pkttype);
+#if defined(DHD_PKTID_AUDIT_MAP)
+               DHD_PKTID_AUDIT(dhd, map, nkey, DHD_TEST_IS_ALLOC); /* apriori, reservation */
+#endif /* DHD_PKTID_AUDIT_MAP */
+       }
+
+       DHD_PKTID_UNLOCK(map->pktid_lock, flags);
+
+       return nkey;
+}
+
+/**
+ * dhd_pktid_map_free - Given a numbered key, return the locker contents.
+ * dhd_pktid_map_free() is not reentrant, and is the caller's responsibility.
+ * Caller may not free a pktid value DHD_PKTID_INVALID or an arbitrary pktid
+ * value. Only a previously allocated pktid may be freed.
+ */
+static void * BCMFASTPATH
+dhd_pktid_map_free(dhd_pub_t *dhd, dhd_pktid_map_handle_t *handle, uint32 nkey,
+       dmaaddr_t *pa, uint32 *len, void **dmah, void **secdma,
+       dhd_pkttype_t pkttype, bool rsv_locker)
+{
+       dhd_pktid_map_t *map;
+       dhd_pktid_item_t *locker;
+       void * pkt;
+       uint32 flags;
+       unsigned long locker_addr;
+
+       ASSERT(handle != NULL);
+
+       map = (dhd_pktid_map_t *)handle;
+
+       flags = DHD_PKTID_LOCK(map->pktid_lock);
+
+       ASSERT((nkey != DHD_PKTID_INVALID) && (nkey <= DHD_PKIDMAP_ITEMS(map->items)));
+
+       locker = &map->lockers[nkey];
+
+#if defined(DHD_PKTID_AUDIT_MAP)
+       DHD_PKTID_AUDIT(dhd, map, nkey, DHD_DUPLICATE_FREE); /* Audit duplicate FREE */
+#endif /* DHD_PKTID_AUDIT_MAP */
+
+       if (locker->state == LOCKER_IS_FREE) { /* Debug check for cloned numbered key */
+               DHD_ERROR(("%s:%d: Error! freeing invalid pktid<%u>\n",
+                       __FUNCTION__, __LINE__, nkey));
+               ASSERT(locker->state != LOCKER_IS_FREE);
+
+               DHD_PKTID_UNLOCK(map->pktid_lock, flags);
+               return NULL;
+       }
+
+       /* Check for the colour of the buffer i.e The buffer posted for TX,
+        * should be freed for TX completion. Similarly the buffer posted for
+        * IOCTL should be freed for IOCT completion etc.
+        */
+       if ((pkttype != PKTTYPE_NO_CHECK) && (locker->pkttype != pkttype)) {
+
+               DHD_PKTID_UNLOCK(map->pktid_lock, flags);
+
+               DHD_ERROR(("%s:%d: Error! Invalid Buffer Free for pktid<%u> \n",
+                       __FUNCTION__, __LINE__, nkey));
+#ifdef BCMDMA64OSL
+               PHYSADDRTOULONG(locker->pa, locker_addr);
+#else
+               locker_addr = PHYSADDRLO(locker->pa);
+#endif /* BCMDMA64OSL */
+               DHD_ERROR(("%s:%d: locker->state <%d>, locker->pkttype <%d>,"
+                       "pkttype <%d> locker->pa <0x%lx> \n",
+                       __FUNCTION__, __LINE__, locker->state, locker->pkttype,
+                       pkttype, locker_addr));
+
+               ASSERT(locker->pkttype == pkttype);
+
+               return NULL;
+       }
+
+       if (rsv_locker == DHD_PKTID_FREE_LOCKER) {
+               map->avail++;
+               map->keys[map->avail] = nkey; /* make this numbered key available */
+               locker->state = LOCKER_IS_FREE; /* open and free Locker */
+       } else {
+               /* pktid will be reused, but the locker does not have a valid pkt */
+               locker->state = LOCKER_IS_RSVD;
+       }
+
+#if defined(DHD_PKTID_AUDIT_MAP)
+       DHD_PKTID_AUDIT(dhd, map, nkey, DHD_TEST_IS_FREE);
+#endif /* DHD_PKTID_AUDIT_MAP */
+
+       *pa = locker->pa; /* return contents of locker */
+       *len = (uint32)locker->len;
+       *dmah = locker->dmah;
+       *secdma = locker->secdma;
+
+       pkt = locker->pkt;
+       locker->pkt = NULL; /* Clear pkt */
+       locker->len = 0;
+
+       DHD_PKTID_UNLOCK(map->pktid_lock, flags);
+       return pkt;
+}
+
+#else /* ! DHD_PCIE_PKTID */
+
+
+typedef struct pktlist {
+       PKT_LIST *tx_pkt_list;          /* list for tx packets */
+       PKT_LIST *rx_pkt_list;          /* list for rx packets */
+       PKT_LIST *ctrl_pkt_list;        /* list for ioctl/event buf post */
+} pktlists_t;
+
+/*
+ * Given that each workitem only uses a 32bit pktid, only 32bit hosts may avail
+ * of a one to one mapping 32bit pktptr and a 32bit pktid.
+ *
+ * - When PKTIDMAP is not used, DHD_NATIVE_TO_PKTID variants will never fail.
+ * - Neither DHD_NATIVE_TO_PKTID nor DHD_PKTID_TO_NATIVE need to be protected by
+ *   a lock.
+ * - Hence DHD_PKTID_INVALID is not defined when DHD_PCIE_PKTID is undefined.
+ */
+#define DHD_PKTID32(pktptr32)  ((uint32)(pktptr32))
+#define DHD_PKTPTR32(pktid32)  ((void *)(pktid32))
+
+
+static INLINE uint32 dhd_native_to_pktid(dhd_pktid_map_handle_t *map, void *pktptr32,
+       dmaaddr_t pa, uint32 dma_len, void *dmah, void *secdma,
+       dhd_pkttype_t pkttype);
+static INLINE void * dhd_pktid_to_native(dhd_pktid_map_handle_t *map, uint32 pktid32,
+       dmaaddr_t *pa, uint32 *dma_len, void **dmah, void **secdma,
+       dhd_pkttype_t pkttype);
+
+static dhd_pktid_map_handle_t *
+dhd_pktid_map_init(dhd_pub_t *dhd, uint32 num_items, uint32 index)
+{
+       osl_t *osh = dhd->osh;
+       pktlists_t *handle = NULL;
+
+       if ((handle = (pktlists_t *) MALLOCZ(osh, sizeof(pktlists_t))) == NULL) {
+               DHD_ERROR(("%s:%d: MALLOC failed for lists allocation, size=%d\n",
+                          __FUNCTION__, __LINE__, sizeof(pktlists_t)));
+               goto error_done;
+       }
+
+       if ((handle->tx_pkt_list = (PKT_LIST *) MALLOC(osh, sizeof(PKT_LIST))) == NULL) {
+               DHD_ERROR(("%s:%d: MALLOC failed for list allocation, size=%d\n",
+                          __FUNCTION__, __LINE__, sizeof(PKT_LIST)));
+               goto error;
+       }
+
+       if ((handle->rx_pkt_list = (PKT_LIST *) MALLOC(osh, sizeof(PKT_LIST))) == NULL) {
+               DHD_ERROR(("%s:%d: MALLOC failed for list allocation, size=%d\n",
+                          __FUNCTION__, __LINE__, sizeof(PKT_LIST)));
+               goto error;
+       }
+
+       if ((handle->ctrl_pkt_list = (PKT_LIST *) MALLOC(osh, sizeof(PKT_LIST))) == NULL) {
+               DHD_ERROR(("%s:%d: MALLOC failed for list allocation, size=%d\n",
+                          __FUNCTION__, __LINE__, sizeof(PKT_LIST)));
+               goto error;
+       }
+
+       PKTLIST_INIT(handle->tx_pkt_list);
+       PKTLIST_INIT(handle->rx_pkt_list);
+       PKTLIST_INIT(handle->ctrl_pkt_list);
+
+       return (dhd_pktid_map_handle_t *) handle;
+
+error:
+       if (handle->ctrl_pkt_list) {
+               MFREE(osh, handle->ctrl_pkt_list, sizeof(PKT_LIST));
+       }
+
+       if (handle->rx_pkt_list) {
+               MFREE(osh, handle->rx_pkt_list, sizeof(PKT_LIST));
+       }
+
+       if (handle->tx_pkt_list) {
+               MFREE(osh, handle->tx_pkt_list, sizeof(PKT_LIST));
+       }
+
+       if (handle) {
+               MFREE(osh, handle, sizeof(pktlists_t));
+       }
+
+error_done:
+       return (dhd_pktid_map_handle_t *)NULL;
+}
+
+static void
+dhd_pktid_map_fini(dhd_pub_t *dhd, dhd_pktid_map_handle_t *map)
+{
+       osl_t *osh = dhd->osh;
+       pktlists_t *handle = (pktlists_t *) map;
+
+       ASSERT(handle != NULL);
+       if (handle == (pktlists_t *)NULL) {
+               return;
+       }
+
+       if (handle->ctrl_pkt_list) {
+               PKTLIST_FINI(handle->ctrl_pkt_list);
+               MFREE(osh, handle->ctrl_pkt_list, sizeof(PKT_LIST));
+       }
+
+       if (handle->rx_pkt_list) {
+               PKTLIST_FINI(handle->rx_pkt_list);
+               MFREE(osh, handle->rx_pkt_list, sizeof(PKT_LIST));
+       }
+
+       if (handle->tx_pkt_list) {
+               PKTLIST_FINI(handle->tx_pkt_list);
+               MFREE(osh, handle->tx_pkt_list, sizeof(PKT_LIST));
+       }
+
+       if (handle) {
+               MFREE(osh, handle, sizeof(pktlists_t));
+       }
+}
+
+/** Save dma parameters into the packet's pkttag and convert a pktptr to pktid */
+static INLINE uint32
+dhd_native_to_pktid(dhd_pktid_map_handle_t *map, void *pktptr32,
+       dmaaddr_t pa, uint32 dma_len, void *dmah, void *secdma,
+       dhd_pkttype_t pkttype)
+{
+       pktlists_t *handle = (pktlists_t *) map;
+       ASSERT(pktptr32 != NULL);
+       DHD_PKT_SET_DMA_LEN(pktptr32, dma_len);
+       DHD_PKT_SET_DMAH(pktptr32, dmah);
+       DHD_PKT_SET_PA(pktptr32, pa);
+       DHD_PKT_SET_SECDMA(pktptr32, secdma);
+
+       if (pkttype == PKTTYPE_DATA_TX) {
+               PKTLIST_ENQ(handle->tx_pkt_list,  pktptr32);
+       } else if (pkttype == PKTTYPE_DATA_RX) {
+               PKTLIST_ENQ(handle->rx_pkt_list,  pktptr32);
+       } else {
+               PKTLIST_ENQ(handle->ctrl_pkt_list,  pktptr32);
+       }
+
+       return DHD_PKTID32(pktptr32);
+}
+
+/** Convert a pktid to pktptr and retrieve saved dma parameters from packet */
+static INLINE void *
+dhd_pktid_to_native(dhd_pktid_map_handle_t *map, uint32 pktid32,
+       dmaaddr_t *pa, uint32 *dma_len, void **dmah, void **secdma,
+       dhd_pkttype_t pkttype)
+{
+       pktlists_t *handle = (pktlists_t *) map;
+       void *pktptr32;
+
+       ASSERT(pktid32 != 0U);
+       pktptr32 = DHD_PKTPTR32(pktid32);
+       *dma_len = DHD_PKT_GET_DMA_LEN(pktptr32);
+       *dmah = DHD_PKT_GET_DMAH(pktptr32);
+       *pa = DHD_PKT_GET_PA(pktptr32);
+       *secdma = DHD_PKT_GET_SECDMA(pktptr32);
+
+       if (pkttype == PKTTYPE_DATA_TX) {
+               PKTLIST_UNLINK(handle->tx_pkt_list,  pktptr32);
+       } else if (pkttype == PKTTYPE_DATA_RX) {
+               PKTLIST_UNLINK(handle->rx_pkt_list,  pktptr32);
+       } else {
+               PKTLIST_UNLINK(handle->ctrl_pkt_list,  pktptr32);
+       }
+
+       return pktptr32;
+}
+
+#define DHD_NATIVE_TO_PKTID_RSV(dhd, map, pkt)  DHD_PKTID32(pkt)
+
+#define DHD_NATIVE_TO_PKTID_SAVE(dhd, map, pkt, nkey, pa, len, dma_dir, dmah, secdma, pkttype) \
+       ({ BCM_REFERENCE(dhd); BCM_REFERENCE(nkey); BCM_REFERENCE(dma_dir); \
+          dhd_native_to_pktid((dhd_pktid_map_handle_t *) map, (pkt), (pa), (len), \
+                          (dmah), (secdma), (dhd_pkttype_t)(pkttype)); \
+       })
+
+#define DHD_NATIVE_TO_PKTID(dhd, map, pkt, pa, len, dma_dir, dmah, secdma, pkttype) \
+       ({ BCM_REFERENCE(dhd); BCM_REFERENCE(dma_dir); \
+          dhd_native_to_pktid((dhd_pktid_map_handle_t *) map, (pkt), (pa), (len), \
+                          (dmah), (secdma), (dhd_pkttype_t)(pkttype)); \
+       })
+
+#define DHD_PKTID_TO_NATIVE(dhd, map, pktid, pa, len, dmah, secdma, pkttype) \
+       ({ BCM_REFERENCE(dhd); BCM_REFERENCE(pkttype);  \
+               dhd_pktid_to_native((dhd_pktid_map_handle_t *) map, (uint32)(pktid), \
+                               (dmaaddr_t *)&(pa), (uint32 *)&(len), (void **)&(dmah), \
+                               (void **)&secdma, (dhd_pkttype_t)(pkttype)); \
+       })
+
+#define DHD_PKTID_AVAIL(map)  (~0)
+
+#endif /* ! DHD_PCIE_PKTID */
+
+/* +------------------ End of PCIE DHD PKTID MAPPER  -----------------------+ */
+
+
+/**
+ * The PCIE FD protocol layer is constructed in two phases:
+ *    Phase 1. dhd_prot_attach()
+ *    Phase 2. dhd_prot_init()
+ *
+ * dhd_prot_attach() - Allocates a dhd_prot_t object and resets all its fields.
+ * All Common rings are allose attached (msgbuf_ring_t objects are allocated
+ * with DMA-able buffers).
+ * All dhd_dma_buf_t objects are also allocated here.
+ *
+ * As dhd_prot_attach is invoked prior to the pcie_shared object is read, any
+ * initialization of objects that requires information advertized by the dongle
+ * may not be performed here.
+ * E.g. the number of TxPost flowrings is not know at this point, neither do
+ * we know shich form of D2H DMA sync mechanism is advertized by the dongle, or
+ * whether the dongle supports DMA-ing of WR/RD indices for the H2D and/or D2H
+ * rings (common + flow).
+ *
+ * dhd_prot_init() is invoked after the bus layer has fetched the information
+ * advertized by the dongle in the pcie_shared_t.
+ */
+int
+dhd_prot_attach(dhd_pub_t *dhd)
+{
+       osl_t *osh = dhd->osh;
+       dhd_prot_t *prot;
+
+       /* Allocate prot structure */
+       if (!(prot = (dhd_prot_t *)DHD_OS_PREALLOC(dhd, DHD_PREALLOC_PROT,
+               sizeof(dhd_prot_t)))) {
+               DHD_ERROR(("%s: kmalloc failed\n", __FUNCTION__));
+               goto fail;
+       }
+       memset(prot, 0, sizeof(*prot));
+
+       prot->osh = osh;
+       dhd->prot = prot;
+
+       /* DMAing ring completes supported? FALSE by default  */
+       dhd->dma_d2h_ring_upd_support = FALSE;
+       dhd->dma_h2d_ring_upd_support = FALSE;
+
+       /* Common Ring Allocations */
+
+       /* Ring  0: H2D Control Submission */
+       if (dhd_prot_ring_attach(dhd, &prot->h2dring_ctrl_subn, "h2dctrl",
+               H2DRING_CTRL_SUB_MAX_ITEM, H2DRING_CTRL_SUB_ITEMSIZE,
+               BCMPCIE_H2D_MSGRING_CONTROL_SUBMIT) != BCME_OK) {
+               DHD_ERROR(("%s: dhd_prot_ring_attach H2D Ctrl Submission failed\n",
+                       __FUNCTION__));
+               goto fail;
+       }
+
+       /* Ring  1: H2D Receive Buffer Post */
+       if (dhd_prot_ring_attach(dhd, &prot->h2dring_rxp_subn, "h2drxp",
+               H2DRING_RXPOST_MAX_ITEM, H2DRING_RXPOST_ITEMSIZE,
+               BCMPCIE_H2D_MSGRING_RXPOST_SUBMIT) != BCME_OK) {
+               DHD_ERROR(("%s: dhd_prot_ring_attach H2D RxPost failed\n",
+                       __FUNCTION__));
+               goto fail;
+       }
+
+       /* Ring  2: D2H Control Completion */
+       if (dhd_prot_ring_attach(dhd, &prot->d2hring_ctrl_cpln, "d2hctrl",
+               D2HRING_CTRL_CMPLT_MAX_ITEM, D2HRING_CTRL_CMPLT_ITEMSIZE,
+               BCMPCIE_D2H_MSGRING_CONTROL_COMPLETE) != BCME_OK) {
+               DHD_ERROR(("%s: dhd_prot_ring_attach D2H Ctrl Completion failed\n",
+                       __FUNCTION__));
+               goto fail;
+       }
+
+       /* Ring  3: D2H Transmit Complete */
+       if (dhd_prot_ring_attach(dhd, &prot->d2hring_tx_cpln, "d2htxcpl",
+               D2HRING_TXCMPLT_MAX_ITEM, D2HRING_TXCMPLT_ITEMSIZE,
+               BCMPCIE_D2H_MSGRING_TX_COMPLETE) != BCME_OK) {
+               DHD_ERROR(("%s: dhd_prot_ring_attach D2H Tx Completion failed\n",
+                       __FUNCTION__));
+               goto fail;
+
+       }
+
+       /* Ring  4: D2H Receive Complete */
+       if (dhd_prot_ring_attach(dhd, &prot->d2hring_rx_cpln, "d2hrxcpl",
+               D2HRING_RXCMPLT_MAX_ITEM, D2HRING_RXCMPLT_ITEMSIZE,
+               BCMPCIE_D2H_MSGRING_RX_COMPLETE) != BCME_OK) {
+               DHD_ERROR(("%s: dhd_prot_ring_attach D2H Rx Completion failed\n",
+                       __FUNCTION__));
+               goto fail;
+
+       }
+
+       /*
+        * Max number of flowrings is not yet known. msgbuf_ring_t with DMA-able
+        * buffers for flowrings will be instantiated, in dhd_prot_init() .
+        * See dhd_prot_flowrings_pool_attach()
+        */
+       /* ioctl response buffer */
+       if (dhd_dma_buf_alloc(dhd, &prot->retbuf, IOCT_RETBUF_SIZE)) {
+               goto fail;
+       }
+
+       /* IOCTL request buffer */
+       if (dhd_dma_buf_alloc(dhd, &prot->ioctbuf, IOCT_RETBUF_SIZE)) {
+               goto fail;
+       }
+
+       /* Scratch buffer for dma rx offset */
+       if (dhd_dma_buf_alloc(dhd, &prot->d2h_dma_scratch_buf, DMA_D2H_SCRATCH_BUF_LEN)) {
+               goto fail;
+       }
+
+       /* scratch buffer bus throughput measurement */
+       if (dhd_dma_buf_alloc(dhd, &prot->host_bus_throughput_buf, DHD_BUS_TPUT_BUF_LEN)) {
+               goto fail;
+       }
+
+#ifdef DHD_RX_CHAINING
+       dhd_rxchain_reset(&prot->rxchain);
+#endif
+
+#if defined(DHD_LB)
+
+          /* Initialize the work queues to be used by the Load Balancing logic */
+#if defined(DHD_LB_TXC)
+       {
+               void *buffer;
+               buffer = MALLOC(dhd->osh, sizeof(void*) * DHD_LB_WORKQ_SZ);
+               bcm_workq_init(&prot->tx_compl_prod, &prot->tx_compl_cons,
+                       buffer, DHD_LB_WORKQ_SZ);
+               prot->tx_compl_prod_sync = 0;
+               DHD_INFO(("%s: created tx_compl_workq <%p,%d>\n",
+                       __FUNCTION__, buffer, DHD_LB_WORKQ_SZ));
+       }
+#endif /* DHD_LB_TXC */
+
+#if defined(DHD_LB_RXC)
+       {
+               void *buffer;
+               buffer = MALLOC(dhd->osh, sizeof(uint32) * DHD_LB_WORKQ_SZ);
+               bcm_workq_init(&prot->rx_compl_prod, &prot->rx_compl_cons,
+                       buffer, DHD_LB_WORKQ_SZ);
+               prot->rx_compl_prod_sync = 0;
+               DHD_INFO(("%s: created rx_compl_workq <%p,%d>\n",
+                       __FUNCTION__, buffer, DHD_LB_WORKQ_SZ));
+       }
+#endif /* DHD_LB_RXC */
+
+#endif /* DHD_LB */
+
+       return BCME_OK;
+
+fail:
+
+#ifndef CONFIG_DHD_USE_STATIC_BUF
+       if (prot != NULL) {
+               dhd_prot_detach(dhd);
+       }
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+
+       return BCME_NOMEM;
+} /* dhd_prot_attach */
+
+
+/**
+ * dhd_prot_init - second stage of dhd_prot_attach. Now that the dongle has
+ * completed it's initialization of the pcie_shared structure, we may now fetch
+ * the dongle advertized features and adjust the protocol layer accordingly.
+ *
+ * dhd_prot_init() may be invoked again after a dhd_prot_reset().
+ */
+int
+dhd_prot_init(dhd_pub_t *dhd)
+{
+       sh_addr_t base_addr;
+       dhd_prot_t *prot = dhd->prot;
+
+       /* PKTID handle INIT */
+       if (prot->pktid_map_handle != NULL) {
+               DHD_ERROR(("%s: pktid_map_handle already set!\n", __FUNCTION__));
+               ASSERT(0);
+               return BCME_ERROR;
+       }
+
+#ifdef IOCTLRESP_USE_CONSTMEM
+       if (prot->pktid_map_handle_ioctl != NULL) {
+               DHD_ERROR(("%s: pktid_map_handle_ioctl already set!\n", __FUNCTION__));
+               ASSERT(0);
+               return BCME_ERROR;
+       }
+#endif /* IOCTLRESP_USE_CONSTMEM */
+
+       prot->pktid_map_handle = DHD_NATIVE_TO_PKTID_INIT(dhd, MAX_PKTID_ITEMS, PKTID_MAP_HANDLE);
+       if (prot->pktid_map_handle == NULL) {
+               DHD_ERROR(("%s: Unable to map packet id's\n", __FUNCTION__));
+               ASSERT(0);
+               return BCME_NOMEM;
+       }
+
+#ifdef IOCTLRESP_USE_CONSTMEM
+       prot->pktid_map_handle_ioctl = DHD_NATIVE_TO_PKTID_INIT(dhd,
+               DHD_FLOWRING_MAX_IOCTLRESPBUF_POST, PKTID_MAP_HANDLE_IOCTL);
+       if (prot->pktid_map_handle_ioctl == NULL) {
+               DHD_ERROR(("%s: Unable to map ioctl response buffers\n", __FUNCTION__));
+               ASSERT(0);
+               return BCME_NOMEM;
+       }
+#endif /* IOCTLRESP_USE_CONSTMEM */
+
+       /* Max pkts in ring */
+       prot->max_tx_count = H2DRING_TXPOST_MAX_ITEM;
+
+       DHD_INFO(("%s:%d: MAX_TX_COUNT = %d\n", __FUNCTION__, __LINE__, prot->max_tx_count));
+
+       /* Read max rx packets supported by dongle */
+       dhd_bus_cmn_readshared(dhd->bus, &prot->max_rxbufpost, MAX_HOST_RXBUFS, 0);
+       if (prot->max_rxbufpost == 0) {
+               /* This would happen if the dongle firmware is not */
+               /* using the latest shared structure template */
+               prot->max_rxbufpost = DEFAULT_RX_BUFFERS_TO_POST;
+       }
+       DHD_INFO(("%s:%d: MAX_RXBUFPOST = %d\n", __FUNCTION__, __LINE__, prot->max_rxbufpost));
+
+       /* Initialize.  bzero() would blow away the dma pointers. */
+       prot->max_eventbufpost = DHD_FLOWRING_MAX_EVENTBUF_POST;
+       prot->max_ioctlrespbufpost = DHD_FLOWRING_MAX_IOCTLRESPBUF_POST;
+
+       prot->cur_ioctlresp_bufs_posted = 0;
+       prot->active_tx_count = 0;
+       prot->data_seq_no = 0;
+       prot->ioctl_seq_no = 0;
+       prot->rxbufpost = 0;
+       prot->cur_event_bufs_posted = 0;
+       prot->ioctl_state = 0;
+       prot->curr_ioctl_cmd = 0;
+       prot->ioctl_received = IOCTL_WAIT;
+
+       prot->dmaxfer.srcmem.va = NULL;
+       prot->dmaxfer.dstmem.va = NULL;
+       prot->dmaxfer.in_progress = FALSE;
+
+       prot->metadata_dbg = FALSE;
+       prot->rx_metadata_offset = 0;
+       prot->tx_metadata_offset = 0;
+       prot->txp_threshold = TXP_FLUSH_MAX_ITEMS_FLUSH_CNT;
+
+       prot->ioctl_trans_id = 0;
+
+       /* Register the interrupt function upfront */
+       /* remove corerev checks in data path */
+       prot->mb_ring_fn = dhd_bus_get_mbintr_fn(dhd->bus);
+
+       /* Initialize Common MsgBuf Rings */
+
+       dhd_prot_ring_init(dhd, &prot->h2dring_ctrl_subn);
+       dhd_prot_ring_init(dhd, &prot->h2dring_rxp_subn);
+       dhd_prot_ring_init(dhd, &prot->d2hring_ctrl_cpln);
+       dhd_prot_ring_init(dhd, &prot->d2hring_tx_cpln);
+       dhd_prot_ring_init(dhd, &prot->d2hring_rx_cpln);
+
+#if defined(PCIE_D2H_SYNC)
+       dhd_prot_d2h_sync_init(dhd);
+#endif /* PCIE_D2H_SYNC */
+
+       dhd_prot_h2d_sync_init(dhd);
+
+       /* init the scratch buffer */
+       dhd_base_addr_htolpa(&base_addr, prot->d2h_dma_scratch_buf.pa);
+       dhd_bus_cmn_writeshared(dhd->bus, &base_addr, sizeof(base_addr),
+               D2H_DMA_SCRATCH_BUF, 0);
+       dhd_bus_cmn_writeshared(dhd->bus, &prot->d2h_dma_scratch_buf.len,
+               sizeof(prot->d2h_dma_scratch_buf.len), D2H_DMA_SCRATCH_BUF_LEN, 0);
+
+       /* If supported by the host, indicate the memory block
+        * for completion writes / submission reads to shared space
+        */
+       if (DMA_INDX_ENAB(dhd->dma_d2h_ring_upd_support)) {
+               dhd_base_addr_htolpa(&base_addr, prot->d2h_dma_indx_wr_buf.pa);
+               dhd_bus_cmn_writeshared(dhd->bus, &base_addr, sizeof(base_addr),
+                       D2H_DMA_INDX_WR_BUF, 0);
+               dhd_base_addr_htolpa(&base_addr, prot->h2d_dma_indx_rd_buf.pa);
+               dhd_bus_cmn_writeshared(dhd->bus, &base_addr, sizeof(base_addr),
+                       H2D_DMA_INDX_RD_BUF, 0);
+       }
+
+       if (DMA_INDX_ENAB(dhd->dma_h2d_ring_upd_support)) {
+               dhd_base_addr_htolpa(&base_addr, prot->h2d_dma_indx_wr_buf.pa);
+               dhd_bus_cmn_writeshared(dhd->bus, &base_addr, sizeof(base_addr),
+                       H2D_DMA_INDX_WR_BUF, 0);
+               dhd_base_addr_htolpa(&base_addr, prot->d2h_dma_indx_rd_buf.pa);
+               dhd_bus_cmn_writeshared(dhd->bus, &base_addr, sizeof(base_addr),
+                       D2H_DMA_INDX_RD_BUF, 0);
+       }
+
+       /*
+        * If the DMA-able buffers for flowring needs to come from a specific
+        * contiguous memory region, then setup prot->flowrings_dma_buf here.
+        * dhd_prot_flowrings_pool_attach() will carve out DMA-able buffers from
+        * this contiguous memory region, for each of the flowrings.
+        */
+
+       /* Pre-allocate pool of msgbuf_ring for flowrings */
+       if (dhd_prot_flowrings_pool_attach(dhd) != BCME_OK) {
+               return BCME_ERROR;
+       }
+
+       /* Host should configure soft doorbells if needed ... here */
+
+       /* Post to dongle host configured soft doorbells */
+       dhd_msgbuf_ring_config_d2h_soft_doorbell(dhd);
+
+       /* Post buffers for packet reception and ioctl/event responses */
+       dhd_msgbuf_rxbuf_post(dhd, FALSE); /* alloc pkt ids */
+       dhd_msgbuf_rxbuf_post_ioctlresp_bufs(dhd);
+       dhd_msgbuf_rxbuf_post_event_bufs(dhd);
+
+       return BCME_OK;
+} /* dhd_prot_init */
+
+
+/**
+ * dhd_prot_detach - PCIE FD protocol layer destructor.
+ * Unlink, frees allocated protocol memory (including dhd_prot)
+ */
+void
+dhd_prot_detach(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot = dhd->prot;
+
+       /* Stop the protocol module */
+       if (prot) {
+
+               /* free up all DMA-able buffers allocated during prot attach/init */
+
+               dhd_dma_buf_free(dhd, &prot->d2h_dma_scratch_buf);
+               dhd_dma_buf_free(dhd, &prot->retbuf); /* ioctl return buffer */
+               dhd_dma_buf_free(dhd, &prot->ioctbuf);
+               dhd_dma_buf_free(dhd, &prot->host_bus_throughput_buf);
+
+               /* DMA-able buffers for DMAing H2D/D2H WR/RD indices */
+               dhd_dma_buf_free(dhd, &prot->h2d_dma_indx_wr_buf);
+               dhd_dma_buf_free(dhd, &prot->h2d_dma_indx_rd_buf);
+               dhd_dma_buf_free(dhd, &prot->d2h_dma_indx_wr_buf);
+               dhd_dma_buf_free(dhd, &prot->d2h_dma_indx_rd_buf);
+
+               /* Common MsgBuf Rings */
+               dhd_prot_ring_detach(dhd, &prot->h2dring_ctrl_subn);
+               dhd_prot_ring_detach(dhd, &prot->h2dring_rxp_subn);
+               dhd_prot_ring_detach(dhd, &prot->d2hring_ctrl_cpln);
+               dhd_prot_ring_detach(dhd, &prot->d2hring_tx_cpln);
+               dhd_prot_ring_detach(dhd, &prot->d2hring_rx_cpln);
+
+               /* Detach each DMA-able buffer and free the pool of msgbuf_ring_t */
+               dhd_prot_flowrings_pool_detach(dhd);
+
+               DHD_NATIVE_TO_PKTID_FINI(dhd, dhd->prot->pktid_map_handle);
+
+#ifndef CONFIG_DHD_USE_STATIC_BUF
+               MFREE(dhd->osh, dhd->prot, sizeof(dhd_prot_t));
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+
+#if defined(DHD_LB)
+#if defined(DHD_LB_TXC)
+               if (prot->tx_compl_prod.buffer) {
+                       MFREE(dhd->osh, prot->tx_compl_prod.buffer,
+                               sizeof(void*) * DHD_LB_WORKQ_SZ);
+               }
+#endif /* DHD_LB_TXC */
+#if defined(DHD_LB_RXC)
+               if (prot->rx_compl_prod.buffer) {
+                       MFREE(dhd->osh, prot->rx_compl_prod.buffer,
+                               sizeof(void*) * DHD_LB_WORKQ_SZ);
+               }
+#endif /* DHD_LB_RXC */
+#endif /* DHD_LB */
+
+               dhd->prot = NULL;
+       }
+} /* dhd_prot_detach */
+
+
+/**
+ * dhd_prot_reset - Reset the protocol layer without freeing any objects. This
+ * may be invoked to soft reboot the dongle, without having to detach and attach
+ * the entire protocol layer.
+ *
+ * After dhd_prot_reset(), dhd_prot_init() may be invoked without going through
+ * a dhd_prot_attach() phase.
+ */
+void
+dhd_prot_reset(dhd_pub_t *dhd)
+{
+       struct dhd_prot *prot = dhd->prot;
+
+       DHD_TRACE(("%s\n", __FUNCTION__));
+
+       if (prot == NULL) {
+               return;
+       }
+
+       dhd_prot_flowrings_pool_reset(dhd);
+
+       dhd_prot_ring_reset(dhd, &prot->h2dring_ctrl_subn);
+       dhd_prot_ring_reset(dhd, &prot->h2dring_rxp_subn);
+       dhd_prot_ring_reset(dhd, &prot->d2hring_ctrl_cpln);
+       dhd_prot_ring_reset(dhd, &prot->d2hring_tx_cpln);
+       dhd_prot_ring_reset(dhd, &prot->d2hring_rx_cpln);
+
+       dhd_dma_buf_reset(dhd, &prot->retbuf);
+       dhd_dma_buf_reset(dhd, &prot->ioctbuf);
+       dhd_dma_buf_reset(dhd, &prot->d2h_dma_scratch_buf);
+       dhd_dma_buf_reset(dhd, &prot->h2d_dma_indx_rd_buf);
+       dhd_dma_buf_reset(dhd, &prot->h2d_dma_indx_wr_buf);
+       dhd_dma_buf_reset(dhd, &prot->d2h_dma_indx_rd_buf);
+       dhd_dma_buf_reset(dhd, &prot->d2h_dma_indx_wr_buf);
+
+
+       prot->rx_metadata_offset = 0;
+       prot->tx_metadata_offset = 0;
+
+       prot->rxbufpost = 0;
+       prot->cur_event_bufs_posted = 0;
+       prot->cur_ioctlresp_bufs_posted = 0;
+
+       prot->active_tx_count = 0;
+       prot->data_seq_no = 0;
+       prot->ioctl_seq_no = 0;
+       prot->ioctl_state = 0;
+       prot->curr_ioctl_cmd = 0;
+       prot->ioctl_received = IOCTL_WAIT;
+       prot->ioctl_trans_id = 0;
+
+       /* dhd_flow_rings_init is located at dhd_bus_start,
+        * so when stopping bus, flowrings shall be deleted
+        */
+       if (dhd->flow_rings_inited) {
+               dhd_flow_rings_deinit(dhd);
+       }
+
+       if (prot->pktid_map_handle) {
+               DHD_NATIVE_TO_PKTID_FINI(dhd, prot->pktid_map_handle);
+               prot->pktid_map_handle = NULL;
+       }
+
+#ifdef IOCTLRESP_USE_CONSTMEM
+       if (prot->pktid_map_handle_ioctl) {
+               DHD_NATIVE_TO_PKTID_FINI_IOCTL(dhd, prot->pktid_map_handle_ioctl);
+               prot->pktid_map_handle_ioctl = NULL;
+       }
+#endif /* IOCTLRESP_USE_CONSTMEM */
+} /* dhd_prot_reset */
+
+
+void
+dhd_prot_rx_dataoffset(dhd_pub_t *dhd, uint32 rx_offset)
+{
+       dhd_prot_t *prot = dhd->prot;
+       prot->rx_dataoffset = rx_offset;
+}
+
+/**
+ * Initialize protocol: sync w/dongle state.
+ * Sets dongle media info (iswl, drv_version, mac address).
+ */
+int
+dhd_sync_with_dongle(dhd_pub_t *dhd)
+{
+       int ret = 0;
+       wlc_rev_info_t revinfo;
+
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       dhd_os_set_ioctl_resp_timeout(IOCTL_RESP_TIMEOUT);
+
+
+
+#ifdef DHD_FW_COREDUMP
+       /* Check the memdump capability */
+       dhd_get_memdump_info(dhd);
+#endif /* DHD_FW_COREDUMP */
+#ifdef BCMASSERT_LOG
+       dhd_get_assert_info(dhd);
+#endif /* BCMASSERT_LOG */
+
+       /* Get the device rev info */
+       memset(&revinfo, 0, sizeof(revinfo));
+       ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_REVINFO, &revinfo, sizeof(revinfo), FALSE, 0);
+       if (ret < 0) {
+               DHD_ERROR(("%s: GET revinfo FAILED\n", __FUNCTION__));
+               goto done;
+       }
+       DHD_ERROR(("%s: GET_REVINFO device 0x%x, vendor 0x%x, chipnum 0x%x\n", __FUNCTION__,
+               revinfo.deviceid, revinfo.vendorid, revinfo.chipnum));
+
+       dhd_process_cid_mac(dhd, TRUE);
+       ret = dhd_preinit_ioctls(dhd);
+       dhd_process_cid_mac(dhd, FALSE);
+
+       /* Always assumes wl for now */
+       dhd->iswl = TRUE;
+done:
+       return ret;
+} /* dhd_sync_with_dongle */
+
+#if defined(DHD_LB)
+
+/* DHD load balancing: deferral of work to another online CPU */
+
+/* DHD_LB_TXC DHD_LB_RXC DHD_LB_RXP dispatchers, in dhd_linux.c */
+extern void dhd_lb_tx_compl_dispatch(dhd_pub_t *dhdp);
+extern void dhd_lb_rx_compl_dispatch(dhd_pub_t *dhdp);
+extern void dhd_lb_rx_napi_dispatch(dhd_pub_t *dhdp);
+
+extern void dhd_lb_rx_pkt_enqueue(dhd_pub_t *dhdp, void *pkt, int ifidx);
+
+/**
+ * dhd_lb_dispatch - load balance by dispatch work to other CPU cores
+ * Note: rx_compl_tasklet is dispatched explicitly.
+ */
+static INLINE void
+dhd_lb_dispatch(dhd_pub_t *dhdp, uint16 ring_idx)
+{
+       switch (ring_idx) {
+
+#if defined(DHD_LB_TXC)
+               case BCMPCIE_D2H_MSGRING_TX_COMPLETE:
+                       bcm_workq_prod_sync(&dhdp->prot->tx_compl_prod); /* flush WR index */
+                       dhd_lb_tx_compl_dispatch(dhdp); /* dispatch tx_compl_tasklet */
+                       break;
+#endif /* DHD_LB_TXC */
+
+               case BCMPCIE_D2H_MSGRING_RX_COMPLETE:
+               {
+#if defined(DHD_LB_RXC)
+                       dhd_prot_t *prot = dhdp->prot;
+                       /* Schedule the takslet only if we have to */
+                       if (prot->rxbufpost <= (prot->max_rxbufpost - RXBUFPOST_THRESHOLD)) {
+                               /* flush WR index */
+                               bcm_workq_prod_sync(&dhdp->prot->rx_compl_prod);
+                               dhd_lb_rx_compl_dispatch(dhdp); /* dispatch rx_compl_tasklet */
+                       }
+#endif /* DHD_LB_RXC */
+#if defined(DHD_LB_RXP)
+                       dhd_lb_rx_napi_dispatch(dhdp); /* dispatch rx_process_napi */
+#endif /* DHD_LB_RXP */
+                       break;
+               }
+               default:
+                       break;
+       }
+}
+
+
+#if defined(DHD_LB_TXC)
+/**
+ * DHD load balanced tx completion tasklet handler, that will perform the
+ * freeing of packets on the selected CPU. Packet pointers are delivered to
+ * this tasklet via the tx complete workq.
+ */
+void
+dhd_lb_tx_compl_handler(unsigned long data)
+{
+       int elem_ix;
+       void *pkt, **elem;
+       dmaaddr_t pa;
+       uint32 pa_len;
+       dhd_pub_t *dhd = (dhd_pub_t *)data;
+       dhd_prot_t *prot = dhd->prot;
+       bcm_workq_t *workq = &prot->tx_compl_cons;
+       uint32 count = 0;
+
+       DHD_LB_STATS_TXC_PERCPU_CNT_INCR(dhd);
+
+       while (1) {
+               elem_ix = bcm_ring_cons(WORKQ_RING(workq), DHD_LB_WORKQ_SZ);
+
+               if (elem_ix == BCM_RING_EMPTY) {
+                       break;
+               }
+
+               elem = WORKQ_ELEMENT(void *, workq, elem_ix);
+               pkt = *elem;
+
+               DHD_INFO(("%s: tx_compl_cons pkt<%p>\n", __FUNCTION__, pkt));
+
+               OSL_PREFETCH(PKTTAG(pkt));
+               OSL_PREFETCH(pkt);
+
+               pa = DHD_PKTTAG_PA((dhd_pkttag_fr_t *)PKTTAG(pkt));
+               pa_len = DHD_PKTTAG_PA_LEN((dhd_pkttag_fr_t *)PKTTAG(pkt));
+
+               DMA_UNMAP(dhd->osh, pa, pa_len, DMA_RX, 0, 0);
+
+#if defined(BCMPCIE)
+               dhd_txcomplete(dhd, pkt, true);
+#endif 
+
+               PKTFREE(dhd->osh, pkt, TRUE);
+               count++;
+       }
+
+       /* smp_wmb(); */
+       bcm_workq_cons_sync(workq);
+       DHD_LB_STATS_UPDATE_TXC_HISTO(dhd, count);
+}
+#endif /* DHD_LB_TXC */
+
+#if defined(DHD_LB_RXC)
+void
+dhd_lb_rx_compl_handler(unsigned long data)
+{
+       dhd_pub_t *dhd = (dhd_pub_t *)data;
+       bcm_workq_t *workq = &dhd->prot->rx_compl_cons;
+
+       DHD_LB_STATS_RXC_PERCPU_CNT_INCR(dhd);
+
+       dhd_msgbuf_rxbuf_post(dhd, TRUE); /* re-use pktids */
+       bcm_workq_cons_sync(workq);
+}
+#endif /* DHD_LB_RXC */
+
+#endif /* DHD_LB */
+
+#define DHD_DBG_SHOW_METADATA  0
+
+#if DHD_DBG_SHOW_METADATA
+static void BCMFASTPATH
+dhd_prot_print_metadata(dhd_pub_t *dhd, void *ptr, int len)
+{
+       uint8 tlv_t;
+       uint8 tlv_l;
+       uint8 *tlv_v = (uint8 *)ptr;
+
+       if (len <= BCMPCIE_D2H_METADATA_HDRLEN)
+               return;
+
+       len -= BCMPCIE_D2H_METADATA_HDRLEN;
+       tlv_v += BCMPCIE_D2H_METADATA_HDRLEN;
+
+       while (len > TLV_HDR_LEN) {
+               tlv_t = tlv_v[TLV_TAG_OFF];
+               tlv_l = tlv_v[TLV_LEN_OFF];
+
+               len -= TLV_HDR_LEN;
+               tlv_v += TLV_HDR_LEN;
+               if (len < tlv_l)
+                       break;
+               if ((tlv_t == 0) || (tlv_t == WLFC_CTL_TYPE_FILLER))
+                       break;
+
+               switch (tlv_t) {
+               case WLFC_CTL_TYPE_TXSTATUS: {
+                       uint32 txs;
+                       memcpy(&txs, tlv_v, sizeof(uint32));
+                       if (tlv_l < (sizeof(wl_txstatus_additional_info_t) + sizeof(uint32))) {
+                               printf("METADATA TX_STATUS: %08x\n", txs);
+                       } else {
+                               wl_txstatus_additional_info_t tx_add_info;
+                               memcpy(&tx_add_info, tlv_v + sizeof(uint32),
+                                       sizeof(wl_txstatus_additional_info_t));
+                               printf("METADATA TX_STATUS: %08x WLFCTS[%04x | %08x - %08x - %08x]"
+                                       " rate = %08x tries = %d - %d\n", txs,
+                                       tx_add_info.seq, tx_add_info.entry_ts,
+                                       tx_add_info.enq_ts, tx_add_info.last_ts,
+                                       tx_add_info.rspec, tx_add_info.rts_cnt,
+                                       tx_add_info.tx_cnt);
+                       }
+                       } break;
+
+               case WLFC_CTL_TYPE_RSSI: {
+                       if (tlv_l == 1)
+                               printf("METADATA RX_RSSI: rssi = %d\n", *tlv_v);
+                       else
+                               printf("METADATA RX_RSSI[%04x]: rssi = %d snr = %d\n",
+                                       (*(tlv_v + 3) << 8) | *(tlv_v + 2),
+                                       (int8)(*tlv_v), *(tlv_v + 1));
+                       } break;
+
+               case WLFC_CTL_TYPE_FIFO_CREDITBACK:
+                       bcm_print_bytes("METADATA FIFO_CREDITBACK", tlv_v, tlv_l);
+                       break;
+
+               case WLFC_CTL_TYPE_TX_ENTRY_STAMP:
+                       bcm_print_bytes("METADATA TX_ENTRY", tlv_v, tlv_l);
+                       break;
+
+               case WLFC_CTL_TYPE_RX_STAMP: {
+                       struct {
+                               uint32 rspec;
+                               uint32 bus_time;
+                               uint32 wlan_time;
+                       } rx_tmstamp;
+                       memcpy(&rx_tmstamp, tlv_v, sizeof(rx_tmstamp));
+                       printf("METADATA RX TIMESTMAP: WLFCTS[%08x - %08x] rate = %08x\n",
+                               rx_tmstamp.wlan_time, rx_tmstamp.bus_time, rx_tmstamp.rspec);
+                       } break;
+
+               case WLFC_CTL_TYPE_TRANS_ID:
+                       bcm_print_bytes("METADATA TRANS_ID", tlv_v, tlv_l);
+                       break;
+
+               case WLFC_CTL_TYPE_COMP_TXSTATUS:
+                       bcm_print_bytes("METADATA COMP_TXSTATUS", tlv_v, tlv_l);
+                       break;
+
+               default:
+                       bcm_print_bytes("METADATA UNKNOWN", tlv_v, tlv_l);
+                       break;
+               }
+
+               len -= tlv_l;
+               tlv_v += tlv_l;
+       }
+}
+#endif /* DHD_DBG_SHOW_METADATA */
+
+static INLINE void BCMFASTPATH
+dhd_prot_packet_free(dhd_pub_t *dhd, void *pkt, uint8 pkttype, bool send)
+{
+       if (pkt) {
+               if (pkttype == PKTTYPE_IOCTL_RX ||
+                       pkttype == PKTTYPE_EVENT_RX) {
+#ifdef DHD_USE_STATIC_CTRLBUF
+                       PKTFREE_STATIC(dhd->osh, pkt, send);
+#else
+                       PKTFREE(dhd->osh, pkt, send);
+#endif /* DHD_USE_STATIC_CTRLBUF */
+               } else {
+                       PKTFREE(dhd->osh, pkt, send);
+               }
+       }
+}
+
+static INLINE void * BCMFASTPATH
+dhd_prot_packet_get(dhd_pub_t *dhd, uint32 pktid, uint8 pkttype, bool free_pktid)
+{
+       void *PKTBUF;
+       dmaaddr_t pa;
+       uint32 len;
+       void *dmah;
+       void *secdma;
+
+#ifdef DHD_PCIE_PKTID
+       if (free_pktid) {
+               PKTBUF = DHD_PKTID_TO_NATIVE(dhd, dhd->prot->pktid_map_handle,
+                       pktid, pa, len, dmah, secdma, pkttype);
+       } else {
+               PKTBUF = DHD_PKTID_TO_NATIVE_RSV(dhd, dhd->prot->pktid_map_handle,
+                       pktid, pa, len, dmah, secdma, pkttype);
+       }
+#else
+       PKTBUF = DHD_PKTID_TO_NATIVE(dhd, dhd->prot->pktid_map_handle, pktid, pa,
+               len, dmah, secdma, pkttype);
+#endif /* DHD_PCIE_PKTID */
+
+       if (PKTBUF) {
+               {
+                       if (SECURE_DMA_ENAB(dhd->osh)) {
+                               SECURE_DMA_UNMAP(dhd->osh, pa, (uint) len, DMA_RX, 0, dmah,
+                                       secdma, 0);
+                       } else {
+                               DMA_UNMAP(dhd->osh, pa, (uint) len, DMA_RX, 0, dmah);
+                       }
+               }
+       }
+
+       return PKTBUF;
+}
+
+#ifdef IOCTLRESP_USE_CONSTMEM
+static INLINE void BCMFASTPATH
+dhd_prot_ioctl_ret_buffer_get(dhd_pub_t *dhd, uint32 pktid, dhd_dma_buf_t *retbuf)
+{
+       memset(retbuf, 0, sizeof(dhd_dma_buf_t));
+       retbuf->va = DHD_PKTID_TO_NATIVE(dhd, dhd->prot->pktid_map_handle_ioctl, pktid,
+               retbuf->pa, retbuf->len, retbuf->dmah, retbuf->secdma, PKTTYPE_IOCTL_RX);
+
+       return;
+}
+#endif /* IOCTLRESP_USE_CONSTMEM */
+
+static void BCMFASTPATH
+dhd_msgbuf_rxbuf_post(dhd_pub_t *dhd, bool use_rsv_pktid)
+{
+       dhd_prot_t *prot = dhd->prot;
+       int16 fillbufs;
+       uint16 cnt = 256;
+       int retcount = 0;
+
+       fillbufs = prot->max_rxbufpost - prot->rxbufpost;
+       while (fillbufs >= RX_BUF_BURST) {
+               cnt--;
+               if (cnt == 0) {
+                       /* find a better way to reschedule rx buf post if space not available */
+                       DHD_ERROR(("h2d rx post ring not available to post host buffers \n"));
+                       DHD_ERROR(("Current posted host buf count %d \n", prot->rxbufpost));
+                       break;
+               }
+
+               /* Post in a burst of 32 buffers at a time */
+               fillbufs = MIN(fillbufs, RX_BUF_BURST);
+
+               /* Post buffers */
+               retcount = dhd_prot_rxbuf_post(dhd, fillbufs, use_rsv_pktid);
+
+               if (retcount >= 0) {
+                       prot->rxbufpost += (uint16)retcount;
+#ifdef DHD_LB_RXC
+                       /* dhd_prot_rxbuf_post returns the number of buffers posted */
+                       DHD_LB_STATS_UPDATE_RXC_HISTO(dhd, retcount);
+#endif /* DHD_LB_RXC */
+                       /* how many more to post */
+                       fillbufs = prot->max_rxbufpost - prot->rxbufpost;
+               } else {
+                       /* Make sure we don't run loop any further */
+                       fillbufs = 0;
+               }
+       }
+}
+
+/** Post 'count' no of rx buffers to dongle */
+static int BCMFASTPATH
+dhd_prot_rxbuf_post(dhd_pub_t *dhd, uint16 count, bool use_rsv_pktid)
+{
+       void *p;
+       uint16 pktsz = DHD_FLOWRING_RX_BUFPOST_PKTSZ;
+       uint8 *rxbuf_post_tmp;
+       host_rxbuf_post_t *rxbuf_post;
+       void *msg_start;
+       dmaaddr_t pa;
+       uint32 pktlen;
+       uint8 i = 0;
+       uint16 alloced = 0;
+       unsigned long flags;
+       uint32 pktid;
+       dhd_prot_t *prot = dhd->prot;
+       msgbuf_ring_t *ring = &prot->h2dring_rxp_subn;
+
+       DHD_GENERAL_LOCK(dhd, flags);
+
+       /* Claim space for exactly 'count' no of messages, for mitigation purpose */
+       msg_start = (void *)
+               dhd_prot_alloc_ring_space(dhd, ring, count, &alloced, TRUE);
+
+       DHD_GENERAL_UNLOCK(dhd, flags);
+
+       if (msg_start == NULL) {
+               DHD_INFO(("%s:%d: Rxbufpost Msgbuf Not available\n", __FUNCTION__, __LINE__));
+               return -1;
+       }
+       /* if msg_start !=  NULL, we should have alloced space for atleast 1 item */
+       ASSERT(alloced > 0);
+
+       rxbuf_post_tmp = (uint8*)msg_start;
+
+       /* loop through each allocated message in the rxbuf post msgbuf_ring */
+       for (i = 0; i < alloced; i++) {
+               rxbuf_post = (host_rxbuf_post_t *)rxbuf_post_tmp;
+               /* Create a rx buffer */
+               if ((p = PKTGET(dhd->osh, pktsz, FALSE)) == NULL) {
+                       DHD_ERROR(("%s:%d: PKTGET for rxbuf failed\n", __FUNCTION__, __LINE__));
+                       dhd->rx_pktgetfail++;
+                       break;
+               }
+
+               pktlen = PKTLEN(dhd->osh, p);
+               if (SECURE_DMA_ENAB(dhd->osh)) {
+                       DHD_GENERAL_LOCK(dhd, flags);
+                       pa = SECURE_DMA_MAP(dhd->osh, PKTDATA(dhd->osh, p), pktlen,
+                               DMA_RX, p, 0, ring->dma_buf.secdma, 0);
+                       DHD_GENERAL_UNLOCK(dhd, flags);
+               } else {
+                       pa = DMA_MAP(dhd->osh, PKTDATA(dhd->osh, p), pktlen, DMA_RX, p, 0);
+               }
+
+               if (PHYSADDRISZERO(pa)) {
+                       PKTFREE(dhd->osh, p, FALSE);
+                       DHD_ERROR(("Invalid phyaddr 0\n"));
+                       ASSERT(0);
+                       break;
+               }
+
+               PKTPULL(dhd->osh, p, prot->rx_metadata_offset);
+               pktlen = PKTLEN(dhd->osh, p);
+
+               /* Common msg header */
+               rxbuf_post->cmn_hdr.msg_type = MSG_TYPE_RXBUF_POST;
+               rxbuf_post->cmn_hdr.if_id = 0;
+               rxbuf_post->cmn_hdr.epoch = ring->seqnum % H2D_EPOCH_MODULO;
+               ring->seqnum++;
+
+#if defined(DHD_LB_RXC)
+               if (use_rsv_pktid == TRUE) {
+                       bcm_workq_t *workq = &prot->rx_compl_cons;
+                       int elem_ix = bcm_ring_cons(WORKQ_RING(workq), DHD_LB_WORKQ_SZ);
+                       if (elem_ix == BCM_RING_EMPTY) {
+                               DHD_ERROR(("%s rx_compl_cons ring is empty\n", __FUNCTION__));
+                               pktid = DHD_PKTID_INVALID;
+                               goto alloc_pkt_id;
+                       } else {
+                               uint32 *elem = WORKQ_ELEMENT(uint32, workq, elem_ix);
+                               pktid = *elem;
+                       }
+
+                       /* Now populate the previous locker with valid information */
+                       if (pktid != DHD_PKTID_INVALID) {
+                               rxbuf_post->cmn_hdr.request_id = htol32(pktid);
+                               DHD_NATIVE_TO_PKTID_SAVE(dhd, dhd->prot->pktid_map_handle, p, pktid,
+                                       pa, pktlen, DMA_RX, NULL, ring->dma_buf.secdma,
+                                       PKTTYPE_DATA_RX);
+                       }
+               } else
+#endif /* DHD_LB_RXC */
+               {
+#if defined(DHD_LB_RXC)
+alloc_pkt_id:
+#endif
+#if defined(DHD_PCIE_PKTID)
+               /* get the lock before calling DHD_NATIVE_TO_PKTID */
+               DHD_GENERAL_LOCK(dhd, flags);
+#endif
+               pktid = DHD_NATIVE_TO_PKTID(dhd, dhd->prot->pktid_map_handle, p, pa,
+                       pktlen, DMA_RX, NULL, ring->dma_buf.secdma, PKTTYPE_DATA_RX);
+
+#if defined(DHD_PCIE_PKTID)
+               /* free lock */
+               DHD_GENERAL_UNLOCK(dhd, flags);
+
+               if (pktid == DHD_PKTID_INVALID) {
+
+                       if (SECURE_DMA_ENAB(dhd->osh)) {
+                               DHD_GENERAL_LOCK(dhd, flags);
+                               SECURE_DMA_UNMAP(dhd->osh, pa, pktlen, DMA_RX, 0, DHD_DMAH_NULL,
+                                   ring->dma_buf.secdma, 0);
+                               DHD_GENERAL_UNLOCK(dhd, flags);
+                       } else {
+                               DMA_UNMAP(dhd->osh, pa, pktlen, DMA_RX, 0, DHD_DMAH_NULL);
+                       }
+
+                       PKTFREE(dhd->osh, p, FALSE);
+                       DHD_ERROR(("Pktid pool depleted.\n"));
+                       break;
+               }
+#endif /* DHD_PCIE_PKTID */
+               }
+
+               rxbuf_post->data_buf_len = htol16((uint16)pktlen);
+               rxbuf_post->data_buf_addr.high_addr = htol32(PHYSADDRHI(pa));
+               rxbuf_post->data_buf_addr.low_addr =
+                       htol32(PHYSADDRLO(pa) + prot->rx_metadata_offset);
+
+               if (prot->rx_metadata_offset) {
+                       rxbuf_post->metadata_buf_len = prot->rx_metadata_offset;
+                       rxbuf_post->metadata_buf_addr.high_addr = htol32(PHYSADDRHI(pa));
+                       rxbuf_post->metadata_buf_addr.low_addr  = htol32(PHYSADDRLO(pa));
+               } else {
+                       rxbuf_post->metadata_buf_len = 0;
+                       rxbuf_post->metadata_buf_addr.high_addr = 0;
+                       rxbuf_post->metadata_buf_addr.low_addr  = 0;
+               }
+
+#if defined(DHD_PKTID_AUDIT_RING)
+               DHD_PKTID_AUDIT(dhd, prot->pktid_map_handle, pktid, DHD_DUPLICATE_ALLOC);
+#endif /* DHD_PKTID_AUDIT_RING */
+
+               rxbuf_post->cmn_hdr.request_id = htol32(pktid);
+
+               /* Move rxbuf_post_tmp to next item */
+               rxbuf_post_tmp = rxbuf_post_tmp + ring->item_len;
+       }
+
+       if (i < alloced) {
+               if (ring->wr < (alloced - i)) {
+                       ring->wr = ring->max_items - (alloced - i);
+               } else {
+                       ring->wr -= (alloced - i);
+               }
+
+               alloced = i;
+       }
+
+       /* Update ring's WR index and ring doorbell to dongle */
+       if (alloced > 0) {
+               dhd_prot_ring_write_complete(dhd, ring, msg_start, alloced);
+       }
+
+       return alloced;
+} /* dhd_prot_rxbuf_post */
+
+#ifdef IOCTLRESP_USE_CONSTMEM
+static int
+alloc_ioctl_return_buffer(dhd_pub_t *dhd, dhd_dma_buf_t *retbuf)
+{
+       int err;
+       memset(retbuf, 0, sizeof(dhd_dma_buf_t));
+
+       if ((err = dhd_dma_buf_alloc(dhd, retbuf, IOCT_RETBUF_SIZE)) != BCME_OK) {
+               DHD_ERROR(("%s: dhd_dma_buf_alloc err %d\n", __FUNCTION__, err));
+               ASSERT(0);
+               return BCME_NOMEM;
+       }
+
+       return BCME_OK;
+}
+
+static void
+free_ioctl_return_buffer(dhd_pub_t *dhd, dhd_dma_buf_t *retbuf)
+{
+       /* retbuf (declared on stack) not fully populated ...  */
+       if (retbuf->va) {
+               uint32 dma_pad;
+               dma_pad = (IOCT_RETBUF_SIZE % DHD_DMA_PAD) ? DHD_DMA_PAD : 0;
+               retbuf->len = IOCT_RETBUF_SIZE;
+               retbuf->_alloced = retbuf->len + dma_pad;
+               /* JIRA:SWWLAN-70021 The pa value would be overwritten by the dongle.
+                * Need to reassign before free to pass the check in dhd_dma_buf_audit().
+                */
+               retbuf->pa = DMA_MAP(dhd->osh, retbuf->va, retbuf->len, DMA_RX, NULL, NULL);
+       }
+
+       dhd_dma_buf_free(dhd, retbuf);
+       return;
+}
+#endif /* IOCTLRESP_USE_CONSTMEM */
+
+static int
+dhd_prot_rxbufpost_ctrl(dhd_pub_t *dhd, bool event_buf)
+{
+       void *p;
+       uint16 pktsz;
+       ioctl_resp_evt_buf_post_msg_t *rxbuf_post;
+       dmaaddr_t pa;
+       uint32 pktlen;
+       dhd_prot_t *prot = dhd->prot;
+       uint16 alloced = 0;
+       unsigned long flags;
+       dhd_dma_buf_t retbuf;
+       void *dmah = NULL;
+       uint32 pktid;
+       void *map_handle;
+       msgbuf_ring_t *ring = &prot->h2dring_ctrl_subn;
+
+       if (dhd->busstate == DHD_BUS_DOWN) {
+               DHD_ERROR(("%s: bus is already down.\n", __FUNCTION__));
+               return -1;
+       }
+
+       memset(&retbuf, 0, sizeof(dhd_dma_buf_t));
+
+       if (event_buf) {
+               /* Allocate packet for event buffer post */
+               pktsz = DHD_FLOWRING_RX_BUFPOST_PKTSZ;
+       } else {
+               /* Allocate packet for ctrl/ioctl buffer post */
+               pktsz = DHD_FLOWRING_IOCTL_BUFPOST_PKTSZ;
+       }
+
+#ifdef IOCTLRESP_USE_CONSTMEM
+       if (!event_buf) {
+               if (alloc_ioctl_return_buffer(dhd, &retbuf) != BCME_OK) {
+                       DHD_ERROR(("Could not allocate IOCTL response buffer\n"));
+                       return -1;
+               }
+               ASSERT(retbuf.len == IOCT_RETBUF_SIZE);
+               p = retbuf.va;
+               pktlen = retbuf.len;
+               pa = retbuf.pa;
+               dmah = retbuf.dmah;
+       } else
+#endif /* IOCTLRESP_USE_CONSTMEM */
+       {
+#ifdef DHD_USE_STATIC_CTRLBUF
+               p = PKTGET_STATIC(dhd->osh, pktsz, FALSE);
+#else
+               p = PKTGET(dhd->osh, pktsz, FALSE);
+#endif /* DHD_USE_STATIC_CTRLBUF */
+               if (p == NULL) {
+                       DHD_ERROR(("%s:%d: PKTGET for %s buf failed\n",
+                               __FUNCTION__, __LINE__, event_buf ?
+                               "EVENT" : "IOCTL RESP"));
+                       dhd->rx_pktgetfail++;
+                       return -1;
+               }
+
+               pktlen = PKTLEN(dhd->osh, p);
+
+               if (SECURE_DMA_ENAB(dhd->osh)) {
+                       DHD_GENERAL_LOCK(dhd, flags);
+                       pa = SECURE_DMA_MAP(dhd->osh, PKTDATA(dhd->osh, p), pktlen,
+                               DMA_RX, p, 0, ring->dma_buf.secdma, 0);
+                       DHD_GENERAL_UNLOCK(dhd, flags);
+               } else {
+                       pa = DMA_MAP(dhd->osh, PKTDATA(dhd->osh, p), pktlen, DMA_RX, p, 0);
+               }
+
+               if (PHYSADDRISZERO(pa)) {
+                       DHD_ERROR(("Invalid physaddr 0\n"));
+                       ASSERT(0);
+                       goto free_pkt_return;
+               }
+       }
+
+       DHD_GENERAL_LOCK(dhd, flags);
+
+       rxbuf_post = (ioctl_resp_evt_buf_post_msg_t *)
+               dhd_prot_alloc_ring_space(dhd, ring, 1, &alloced, FALSE);
+
+       if (rxbuf_post == NULL) {
+               DHD_GENERAL_UNLOCK(dhd, flags);
+               DHD_ERROR(("%s:%d: Ctrl submit Msgbuf Not available to post buffer \n",
+                       __FUNCTION__, __LINE__));
+
+#ifdef IOCTLRESP_USE_CONSTMEM
+               if (event_buf)
+#endif /* IOCTLRESP_USE_CONSTMEM */
+               {
+                       if (SECURE_DMA_ENAB(dhd->osh)) {
+                               DHD_GENERAL_LOCK(dhd, flags);
+                               SECURE_DMA_UNMAP(dhd->osh, pa, pktlen, DMA_RX, 0, DHD_DMAH_NULL,
+                                       ring->dma_buf.secdma, 0);
+                               DHD_GENERAL_UNLOCK(dhd, flags);
+                       } else {
+                               DMA_UNMAP(dhd->osh, pa, pktlen, DMA_RX, 0, DHD_DMAH_NULL);
+                       }
+               }
+               goto free_pkt_return;
+       }
+
+       /* CMN msg header */
+       if (event_buf) {
+               rxbuf_post->cmn_hdr.msg_type = MSG_TYPE_EVENT_BUF_POST;
+       } else {
+               rxbuf_post->cmn_hdr.msg_type = MSG_TYPE_IOCTLRESP_BUF_POST;
+       }
+
+#ifdef IOCTLRESP_USE_CONSTMEM
+       if (!event_buf) {
+               map_handle = dhd->prot->pktid_map_handle_ioctl;
+               pktid = DHD_NATIVE_TO_PKTID(dhd, map_handle, p, pa, pktlen,
+                       DMA_RX, dmah, ring->dma_buf.secdma, PKTTYPE_IOCTL_RX);
+       } else
+#endif /* IOCTLRESP_USE_CONSTMEM */
+       {
+               map_handle = dhd->prot->pktid_map_handle;
+               pktid = DHD_NATIVE_TO_PKTID(dhd, map_handle,
+                       p, pa, pktlen, DMA_RX, dmah, ring->dma_buf.secdma,
+                       event_buf ? PKTTYPE_EVENT_RX : PKTTYPE_IOCTL_RX);
+       }
+
+       if (pktid == DHD_PKTID_INVALID) {
+               if (ring->wr == 0) {
+                       ring->wr = ring->max_items - 1;
+               } else {
+                       ring->wr--;
+               }
+               DHD_GENERAL_UNLOCK(dhd, flags);
+               DMA_UNMAP(dhd->osh, pa, pktlen, DMA_RX, 0, DHD_DMAH_NULL);
+               goto free_pkt_return;
+       }
+
+#if defined(DHD_PKTID_AUDIT_RING)
+       DHD_PKTID_AUDIT(dhd, map_handle, pktid, DHD_DUPLICATE_ALLOC);
+#endif /* DHD_PKTID_AUDIT_RING */
+
+       rxbuf_post->cmn_hdr.request_id = htol32(pktid);
+       rxbuf_post->cmn_hdr.if_id = 0;
+       rxbuf_post->cmn_hdr.epoch = ring->seqnum % H2D_EPOCH_MODULO;
+       ring->seqnum++;
+
+#if defined(DHD_PCIE_PKTID)
+       if (rxbuf_post->cmn_hdr.request_id == DHD_PKTID_INVALID) {
+               if (ring->wr == 0) {
+                       ring->wr = ring->max_items - 1;
+               } else {
+                       ring->wr--;
+               }
+               DHD_GENERAL_UNLOCK(dhd, flags);
+#ifdef IOCTLRESP_USE_CONSTMEM
+               if (event_buf)
+#endif /* IOCTLRESP_USE_CONSTMEM */
+               {
+                       if (SECURE_DMA_ENAB(dhd->osh)) {
+                               DHD_GENERAL_LOCK(dhd, flags);
+                               SECURE_DMA_UNMAP(dhd->osh, pa, pktlen, DMA_RX, 0, DHD_DMAH_NULL,
+                                       ring->dma_buf.secdma, 0);
+                               DHD_GENERAL_UNLOCK(dhd, flags);
+                       } else {
+                               DMA_UNMAP(dhd->osh, pa, pktlen, DMA_RX, 0, DHD_DMAH_NULL);
+                       }
+               }
+               goto free_pkt_return;
+       }
+#endif /* DHD_PCIE_PKTID */
+
+       rxbuf_post->cmn_hdr.flags = 0;
+#ifndef IOCTLRESP_USE_CONSTMEM
+       rxbuf_post->host_buf_len = htol16((uint16)PKTLEN(dhd->osh, p));
+#else
+       rxbuf_post->host_buf_len = htol16((uint16)pktlen);
+#endif /* IOCTLRESP_USE_CONSTMEM */
+       rxbuf_post->host_buf_addr.high_addr = htol32(PHYSADDRHI(pa));
+       rxbuf_post->host_buf_addr.low_addr  = htol32(PHYSADDRLO(pa));
+
+       /* update ring's WR index and ring doorbell to dongle */
+       dhd_prot_ring_write_complete(dhd, ring, rxbuf_post, 1);
+       DHD_GENERAL_UNLOCK(dhd, flags);
+
+       return 1;
+
+free_pkt_return:
+#ifdef IOCTLRESP_USE_CONSTMEM
+       if (!event_buf) {
+               free_ioctl_return_buffer(dhd, &retbuf);
+       } else
+#endif /* IOCTLRESP_USE_CONSTMEM */
+       {
+               dhd_prot_packet_free(dhd, p,
+                       event_buf ? PKTTYPE_EVENT_RX : PKTTYPE_IOCTL_RX,
+                       FALSE);
+       }
+
+       return -1;
+} /* dhd_prot_rxbufpost_ctrl */
+
+static uint16
+dhd_msgbuf_rxbuf_post_ctrlpath(dhd_pub_t *dhd, bool event_buf, uint32 max_to_post)
+{
+       uint32 i = 0;
+       int32 ret_val;
+
+       DHD_INFO(("max to post %d, event %d \n", max_to_post, event_buf));
+
+       if (dhd->busstate == DHD_BUS_DOWN) {
+               DHD_ERROR(("%s: bus is already down.\n", __FUNCTION__));
+               return 0;
+       }
+
+       while (i < max_to_post) {
+               ret_val  = dhd_prot_rxbufpost_ctrl(dhd, event_buf);
+               if (ret_val < 0) {
+                       break;
+               }
+               i++;
+       }
+       DHD_INFO(("posted %d buffers to event_pool/ioctl_resp_pool %d\n", i, event_buf));
+       return (uint16)i;
+}
+
+static void
+dhd_msgbuf_rxbuf_post_ioctlresp_bufs(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot = dhd->prot;
+       int max_to_post;
+
+       DHD_INFO(("ioctl resp buf post\n"));
+       max_to_post = prot->max_ioctlrespbufpost - prot->cur_ioctlresp_bufs_posted;
+       if (max_to_post <= 0) {
+               DHD_INFO(("%s: Cannot post more than max IOCTL resp buffers\n",
+                       __FUNCTION__));
+               return;
+       }
+       prot->cur_ioctlresp_bufs_posted += dhd_msgbuf_rxbuf_post_ctrlpath(dhd,
+               FALSE, max_to_post);
+}
+
+static void
+dhd_msgbuf_rxbuf_post_event_bufs(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot = dhd->prot;
+       int max_to_post;
+
+       max_to_post = prot->max_eventbufpost - prot->cur_event_bufs_posted;
+       if (max_to_post <= 0) {
+               DHD_INFO(("%s: Cannot post more than max event buffers\n",
+                       __FUNCTION__));
+               return;
+       }
+       prot->cur_event_bufs_posted += dhd_msgbuf_rxbuf_post_ctrlpath(dhd,
+               TRUE, max_to_post);
+}
+
+/** called when DHD needs to check for 'receive complete' messages from the dongle */
+bool BCMFASTPATH
+dhd_prot_process_msgbuf_rxcpl(dhd_pub_t *dhd, uint bound)
+{
+       bool more = TRUE;
+       uint n = 0;
+       msgbuf_ring_t *ring = &dhd->prot->d2hring_rx_cpln;
+
+       /* Process all the messages - DTOH direction */
+       while (!dhd_is_device_removed(dhd)) {
+               uint8 *msg_addr;
+               uint32 msg_len;
+
+               if (dhd->hang_was_sent) {
+                       more = FALSE;
+                       break;
+               }
+
+               /* Get the address of the next message to be read from ring */
+               msg_addr = dhd_prot_get_read_addr(dhd, ring, &msg_len);
+               if (msg_addr == NULL) {
+                       more = FALSE;
+                       break;
+               }
+
+               /* Prefetch data to populate the cache */
+               OSL_PREFETCH(msg_addr);
+
+               if (dhd_prot_process_msgtype(dhd, ring, msg_addr, msg_len) != BCME_OK) {
+                       DHD_ERROR(("%s: process %s msg addr %p len %d\n",
+                               __FUNCTION__, ring->name, msg_addr, msg_len));
+               }
+
+               /* Update read pointer */
+               dhd_prot_upd_read_idx(dhd, ring);
+
+               /* After batch processing, check RX bound */
+               n += msg_len / ring->item_len;
+               if (n >= bound) {
+                       break;
+               }
+       }
+
+       return more;
+}
+
+/**
+ * Hands transmit packets (with a caller provided flow_id) over to dongle territory (the flow ring)
+ */
+void
+dhd_prot_update_txflowring(dhd_pub_t *dhd, uint16 flowid, void *msgring)
+{
+       msgbuf_ring_t *ring = (msgbuf_ring_t *)msgring;
+
+       /* Update read pointer */
+       if (DMA_INDX_ENAB(dhd->dma_d2h_ring_upd_support)) {
+               ring->rd = dhd_prot_dma_indx_get(dhd, H2D_DMA_INDX_RD_UPD, ring->idx);
+       }
+
+       DHD_TRACE(("ringid %d flowid %d write %d read %d \n\n",
+               ring->idx, flowid, ring->wr, ring->rd));
+
+       /* Need more logic here, but for now use it directly */
+       dhd_bus_schedule_queue(dhd->bus, flowid, TRUE); /* from queue to flowring */
+}
+
+/** called when DHD needs to check for 'transmit complete' messages from the dongle */
+bool BCMFASTPATH
+dhd_prot_process_msgbuf_txcpl(dhd_pub_t *dhd, uint bound)
+{
+       bool more = TRUE;
+       uint n = 0;
+       msgbuf_ring_t *ring = &dhd->prot->d2hring_tx_cpln;
+
+       /* Process all the messages - DTOH direction */
+       while (!dhd_is_device_removed(dhd)) {
+               uint8 *msg_addr;
+               uint32 msg_len;
+
+               if (dhd->hang_was_sent) {
+                       more = FALSE;
+                       break;
+               }
+
+               /* Get the address of the next message to be read from ring */
+               msg_addr = dhd_prot_get_read_addr(dhd, ring, &msg_len);
+               if (msg_addr == NULL) {
+                       more = FALSE;
+                       break;
+               }
+
+               /* Prefetch data to populate the cache */
+               OSL_PREFETCH(msg_addr);
+
+               if (dhd_prot_process_msgtype(dhd, ring, msg_addr, msg_len) != BCME_OK) {
+                       DHD_ERROR(("%s: process %s msg addr %p len %d\n",
+                               __FUNCTION__, ring->name, msg_addr, msg_len));
+               }
+
+               /* Write to dngl rd ptr */
+               dhd_prot_upd_read_idx(dhd, ring);
+
+               /* After batch processing, check bound */
+               n += msg_len / ring->item_len;
+               if (n >= bound) {
+                       break;
+               }
+       }
+
+       return more;
+}
+
+/** called when DHD needs to check for 'ioctl complete' messages from the dongle */
+int BCMFASTPATH
+dhd_prot_process_ctrlbuf(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot = dhd->prot;
+       msgbuf_ring_t *ring = &prot->d2hring_ctrl_cpln;
+
+       /* Process all the messages - DTOH direction */
+       while (!dhd_is_device_removed(dhd)) {
+               uint8 *msg_addr;
+               uint32 msg_len;
+
+               if (dhd->hang_was_sent) {
+                       break;
+               }
+
+               /* Get the address of the next message to be read from ring */
+               msg_addr = dhd_prot_get_read_addr(dhd, ring, &msg_len);
+               if (msg_addr == NULL) {
+                       break;
+               }
+
+               /* Prefetch data to populate the cache */
+               OSL_PREFETCH(msg_addr);
+
+               if (dhd_prot_process_msgtype(dhd, ring, msg_addr, msg_len) != BCME_OK) {
+                       DHD_ERROR(("%s: process %s msg addr %p len %d\n",
+                               __FUNCTION__, ring->name, msg_addr, msg_len));
+               }
+
+               /* Write to dngl rd ptr */
+               dhd_prot_upd_read_idx(dhd, ring);
+       }
+
+       return 0;
+}
+
+/**
+ * Consume messages out of the D2H ring. Ensure that the message's DMA to host
+ * memory has completed, before invoking the message handler via a table lookup
+ * of the cmn_msg_hdr::msg_type.
+ */
+static int BCMFASTPATH
+dhd_prot_process_msgtype(dhd_pub_t *dhd, msgbuf_ring_t *ring, uint8 *buf, uint32 len)
+{
+       int buf_len = len;
+       uint16 item_len;
+       uint8 msg_type;
+       cmn_msg_hdr_t *msg = NULL;
+       int ret = BCME_OK;
+
+       ASSERT(ring);
+       item_len = ring->item_len;
+       if (item_len == 0) {
+               DHD_ERROR(("%s: ringidx %d item_len %d buf_len %d\n",
+                       __FUNCTION__, ring->idx, item_len, buf_len));
+               return BCME_ERROR;
+       }
+
+       while (buf_len > 0) {
+               if (dhd->hang_was_sent) {
+                       ret = BCME_ERROR;
+                       goto done;
+               }
+
+               msg = (cmn_msg_hdr_t *)buf;
+
+               /*
+                * Update the curr_rd to the current index in the ring, from where
+                * the work item is fetched. This way if the fetched work item
+                * fails in LIVELOCK, we can print the exact read index in the ring
+                * that shows up the corrupted work item.
+                */
+               if ((ring->curr_rd + 1) >= ring->max_items) {
+                       ring->curr_rd = 0;
+               } else {
+                       ring->curr_rd += 1;
+               }
+
+#if defined(PCIE_D2H_SYNC)
+               /* Wait until DMA completes, then fetch msg_type */
+               msg_type = dhd->prot->d2h_sync_cb(dhd, ring, msg, item_len);
+#else
+               msg_type = msg->msg_type;
+#endif /* !PCIE_D2H_SYNC */
+
+               /* Prefetch data to populate the cache */
+               OSL_PREFETCH(buf + item_len);
+
+               DHD_INFO(("msg_type %d item_len %d buf_len %d\n",
+                       msg_type, item_len, buf_len));
+
+               if (msg_type == MSG_TYPE_LOOPBACK) {
+                       bcm_print_bytes("LPBK RESP: ", (uint8 *)msg, item_len);
+                       DHD_ERROR((" MSG_TYPE_LOOPBACK, len %d\n", item_len));
+               }
+
+               ASSERT(msg_type < DHD_PROT_FUNCS);
+               if (msg_type >= DHD_PROT_FUNCS) {
+                       DHD_ERROR(("%s: msg_type %d item_len %d buf_len %d\n",
+                               __FUNCTION__, msg_type, item_len, buf_len));
+                       ret = BCME_ERROR;
+                       goto done;
+               }
+
+               if (table_lookup[msg_type]) {
+                       table_lookup[msg_type](dhd, buf);
+               }
+
+               if (buf_len < item_len) {
+                       ret = BCME_ERROR;
+                       goto done;
+               }
+               buf_len = buf_len - item_len;
+               buf = buf + item_len;
+       }
+
+done:
+
+#ifdef DHD_RX_CHAINING
+       dhd_rxchain_commit(dhd);
+#endif
+#if defined(DHD_LB)
+       dhd_lb_dispatch(dhd, ring->idx);
+#endif
+       return ret;
+} /* dhd_prot_process_msgtype */
+
+static void
+dhd_prot_noop(dhd_pub_t *dhd, void *msg)
+{
+       return;
+}
+
+/** called on MSG_TYPE_RING_STATUS message received from dongle */
+static void
+dhd_prot_ringstatus_process(dhd_pub_t *dhd, void *msg)
+{
+       pcie_ring_status_t *ring_status = (pcie_ring_status_t *)msg;
+       DHD_ERROR(("ring status: request_id %d, status 0x%04x, flow ring %d, write_idx %d \n",
+               ring_status->cmn_hdr.request_id, ring_status->compl_hdr.status,
+               ring_status->compl_hdr.flow_ring_id, ring_status->write_idx));
+       /* How do we track this to pair it with ??? */
+       return;
+}
+
+/** called on MSG_TYPE_GEN_STATUS ('general status') message received from dongle */
+static void
+dhd_prot_genstatus_process(dhd_pub_t *dhd, void *msg)
+{
+       pcie_gen_status_t *gen_status = (pcie_gen_status_t *)msg;
+       DHD_ERROR(("ERROR: gen status: request_id %d, STATUS 0x%04x, flow ring %d \n",
+               gen_status->cmn_hdr.request_id, gen_status->compl_hdr.status,
+               gen_status->compl_hdr.flow_ring_id));
+
+       /* How do we track this to pair it with ??? */
+       return;
+}
+
+/**
+ * Called on MSG_TYPE_IOCTLPTR_REQ_ACK ('ioctl ack') message received from dongle, meaning that the
+ * dongle received the ioctl message in dongle memory.
+ */
+static void
+dhd_prot_ioctack_process(dhd_pub_t *dhd, void *msg)
+{
+       uint32 pktid;
+       ioctl_req_ack_msg_t *ioct_ack = (ioctl_req_ack_msg_t *)msg;
+       unsigned long flags;
+
+       pktid = ltoh32(ioct_ack->cmn_hdr.request_id);
+
+#if defined(DHD_PKTID_AUDIT_RING)
+       /* Skip DHD_IOCTL_REQ_PKTID = 0xFFFE */
+       if (pktid != DHD_IOCTL_REQ_PKTID) {
+               if (DHD_PKTID_AUDIT(dhd, dhd->prot->pktid_map_handle, pktid,
+                       DHD_TEST_IS_ALLOC) == BCME_ERROR) {
+                       prhex("dhd_prot_ioctack_process:",
+                               (uchar *)msg, D2HRING_CTRL_CMPLT_ITEMSIZE);
+               }
+       }
+#endif /* DHD_PKTID_AUDIT_RING */
+
+       DHD_GENERAL_LOCK(dhd, flags);
+       if ((dhd->prot->ioctl_state & MSGBUF_IOCTL_ACK_PENDING) &&
+               (dhd->prot->ioctl_state & MSGBUF_IOCTL_RESP_PENDING)) {
+               dhd->prot->ioctl_state &= ~MSGBUF_IOCTL_ACK_PENDING;
+       } else {
+               DHD_ERROR(("%s: received ioctl ACK with state %02x trans_id = %d\n",
+                       __FUNCTION__, dhd->prot->ioctl_state, dhd->prot->ioctl_trans_id));
+               prhex("dhd_prot_ioctack_process:",
+                       (uchar *)msg, D2HRING_CTRL_CMPLT_ITEMSIZE);
+       }
+       DHD_GENERAL_UNLOCK(dhd, flags);
+
+       DHD_CTL(("ioctl req ack: request_id %d, status 0x%04x, flow ring %d \n",
+               ioct_ack->cmn_hdr.request_id, ioct_ack->compl_hdr.status,
+               ioct_ack->compl_hdr.flow_ring_id));
+       if (ioct_ack->compl_hdr.status != 0)  {
+               DHD_ERROR(("got an error status for the ioctl request...need to handle that\n"));
+       }
+}
+
+/** called on MSG_TYPE_IOCTL_CMPLT message received from dongle */
+static void
+dhd_prot_ioctcmplt_process(dhd_pub_t *dhd, void *msg)
+{
+       dhd_prot_t *prot = dhd->prot;
+       uint32 pkt_id, xt_id;
+       ioctl_comp_resp_msg_t *ioct_resp = (ioctl_comp_resp_msg_t *)msg;
+       void *pkt;
+       unsigned long flags;
+       dhd_dma_buf_t retbuf;
+
+       memset(&retbuf, 0, sizeof(dhd_dma_buf_t));
+
+       pkt_id = ltoh32(ioct_resp->cmn_hdr.request_id);
+
+#if defined(DHD_PKTID_AUDIT_RING)
+       {
+               int ret;
+#ifndef IOCTLRESP_USE_CONSTMEM
+               ret = DHD_PKTID_AUDIT(dhd, prot->pktid_map_handle, pkt_id,
+                       DHD_DUPLICATE_FREE);
+#else
+               ret = DHD_PKTID_AUDIT(dhd, prot->pktid_map_handle_ioctl, pkt_id,
+                       DHD_DUPLICATE_FREE);
+#endif /* !IOCTLRESP_USE_CONSTMEM */
+               if (ret == BCME_ERROR) {
+                       prhex("dhd_prot_ioctcmplt_process:",
+                               (uchar *)msg, D2HRING_CTRL_CMPLT_ITEMSIZE);
+               }
+       }
+#endif /* DHD_PKTID_AUDIT_RING */
+
+       DHD_GENERAL_LOCK(dhd, flags);
+       if ((prot->ioctl_state & MSGBUF_IOCTL_ACK_PENDING) ||
+               !(prot->ioctl_state & MSGBUF_IOCTL_RESP_PENDING)) {
+               DHD_ERROR(("%s: received ioctl response with state %02x trans_id = %d\n",
+                       __FUNCTION__, dhd->prot->ioctl_state, dhd->prot->ioctl_trans_id));
+               prhex("dhd_prot_ioctcmplt_process:",
+                               (uchar *)msg, D2HRING_CTRL_CMPLT_ITEMSIZE);
+               DHD_GENERAL_UNLOCK(dhd, flags);
+               return;
+       }
+#ifndef IOCTLRESP_USE_CONSTMEM
+       pkt = dhd_prot_packet_get(dhd, pkt_id, PKTTYPE_IOCTL_RX, TRUE);
+#else
+       dhd_prot_ioctl_ret_buffer_get(dhd, pkt_id, &retbuf);
+       pkt = retbuf.va;
+#endif /* !IOCTLRESP_USE_CONSTMEM */
+       if (!pkt) {
+               prot->ioctl_state = 0;
+               DHD_GENERAL_UNLOCK(dhd, flags);
+               DHD_ERROR(("%s: received ioctl response with NULL pkt\n", __FUNCTION__));
+               return;
+       }
+       DHD_GENERAL_UNLOCK(dhd, flags);
+
+       prot->ioctl_resplen = ltoh16(ioct_resp->resp_len);
+       prot->ioctl_status = ltoh16(ioct_resp->compl_hdr.status);
+       xt_id = ltoh16(ioct_resp->trans_id);
+       if (xt_id != prot->ioctl_trans_id) {
+               ASSERT(0);
+               goto exit;
+       }
+
+       DHD_CTL(("IOCTL_COMPLETE: req_id %x transid %d status %x resplen %d\n",
+               pkt_id, xt_id, prot->ioctl_status, prot->ioctl_resplen));
+
+       if (prot->ioctl_resplen > 0) {
+#ifndef IOCTLRESP_USE_CONSTMEM
+               bcopy(PKTDATA(dhd->osh, pkt), prot->retbuf.va, prot->ioctl_resplen);
+#else
+               bcopy(pkt, prot->retbuf.va, prot->ioctl_resplen);
+#endif /* !IOCTLRESP_USE_CONSTMEM */
+       }
+
+       /* wake up any dhd_os_ioctl_resp_wait() */
+       dhd_wakeup_ioctl_event(dhd, IOCTL_RETURN_ON_SUCCESS);
+
+exit:
+#ifndef IOCTLRESP_USE_CONSTMEM
+       dhd_prot_packet_free(dhd, pkt,
+               PKTTYPE_IOCTL_RX, FALSE);
+#else
+       free_ioctl_return_buffer(dhd, &retbuf);
+#endif /* !IOCTLRESP_USE_CONSTMEM */
+}
+
+/** called on MSG_TYPE_TX_STATUS message received from dongle */
+static void BCMFASTPATH
+dhd_prot_txstatus_process(dhd_pub_t *dhd, void *msg)
+{
+       dhd_prot_t *prot = dhd->prot;
+       host_txbuf_cmpl_t * txstatus;
+       unsigned long flags;
+       uint32 pktid;
+       void *pkt = NULL;
+       dmaaddr_t pa;
+       uint32 len;
+       void *dmah;
+       void *secdma;
+
+       /* locks required to protect circular buffer accesses */
+       DHD_GENERAL_LOCK(dhd, flags);
+
+       txstatus = (host_txbuf_cmpl_t *)msg;
+       pktid = ltoh32(txstatus->cmn_hdr.request_id);
+
+#if defined(DHD_PKTID_AUDIT_RING)
+       if (DHD_PKTID_AUDIT(dhd, dhd->prot->pktid_map_handle, pktid,
+               DHD_DUPLICATE_FREE) == BCME_ERROR) {
+                       prhex("dhd_prot_txstatus_process:",
+                               (uchar *)msg, D2HRING_TXCMPLT_ITEMSIZE);
+       }
+#endif /* DHD_PKTID_AUDIT_RING */
+
+       DHD_INFO(("txstatus for pktid 0x%04x\n", pktid));
+       if (prot->active_tx_count) {
+               prot->active_tx_count--;
+
+               /* Release the Lock when no more tx packets are pending */
+               if (prot->active_tx_count == 0)
+                        DHD_TXFL_WAKE_UNLOCK(dhd);
+
+       } else {
+               DHD_ERROR(("Extra packets are freed\n"));
+       }
+
+       ASSERT(pktid != 0);
+
+#if defined(DHD_LB_TXC) && !defined(BCM_SECURE_DMA)
+       {
+               int elem_ix;
+               void **elem;
+               bcm_workq_t *workq;
+
+               pkt = DHD_PKTID_TO_NATIVE(dhd, dhd->prot->pktid_map_handle,
+                       pktid, pa, len, dmah, secdma, PKTTYPE_DATA_TX);
+
+               workq = &prot->tx_compl_prod;
+               /*
+                * Produce the packet into the tx_compl workq for the tx compl tasklet
+                * to consume.
+                */
+               OSL_PREFETCH(PKTTAG(pkt));
+
+               /* fetch next available slot in workq */
+               elem_ix = bcm_ring_prod(WORKQ_RING(workq), DHD_LB_WORKQ_SZ);
+
+               DHD_PKTTAG_SET_PA((dhd_pkttag_fr_t *)PKTTAG(pkt), pa);
+               DHD_PKTTAG_SET_PA_LEN((dhd_pkttag_fr_t *)PKTTAG(pkt), len);
+
+               if (elem_ix == BCM_RING_FULL) {
+                       DHD_ERROR(("tx_compl_prod BCM_RING_FULL\n"));
+                       goto workq_ring_full;
+               }
+
+               elem = WORKQ_ELEMENT(void *, &prot->tx_compl_prod, elem_ix);
+               *elem = pkt;
+
+               smp_wmb();
+
+               /* Sync WR index to consumer if the SYNC threshold has been reached */
+               if (++prot->tx_compl_prod_sync >= DHD_LB_WORKQ_SYNC) {
+                       bcm_workq_prod_sync(workq);
+                       prot->tx_compl_prod_sync = 0;
+               }
+
+               DHD_INFO(("%s: tx_compl_prod pkt<%p> sync<%d>\n",
+               __FUNCTION__, pkt, prot->tx_compl_prod_sync));
+
+               DHD_GENERAL_UNLOCK(dhd, flags);
+               return;
+          }
+
+workq_ring_full:
+
+#endif /* !DHD_LB_TXC */
+
+       /*
+        * We can come here if no DHD_LB_TXC is enabled and in case where DHD_LB_TXC is
+        * defined but the tx_compl queue is full.
+        */
+       if (pkt == NULL) {
+               pkt = DHD_PKTID_TO_NATIVE(dhd, dhd->prot->pktid_map_handle,
+                       pktid, pa, len, dmah, secdma, PKTTYPE_DATA_TX);
+       }
+
+       if (pkt) {
+               if (SECURE_DMA_ENAB(dhd->osh)) {
+                       int offset = 0;
+                       BCM_REFERENCE(offset);
+
+                       if (dhd->prot->tx_metadata_offset)
+                               offset = dhd->prot->tx_metadata_offset + ETHER_HDR_LEN;
+                       SECURE_DMA_UNMAP(dhd->osh, (uint) pa,
+                               (uint) dhd->prot->tx_metadata_offset, DMA_RX, 0, dmah,
+                               secdma, offset);
+               } else {
+                       DMA_UNMAP(dhd->osh, pa, (uint) len, DMA_RX, 0, dmah);
+               }
+#if defined(BCMPCIE)
+               dhd_txcomplete(dhd, pkt, true);
+#endif 
+
+#if DHD_DBG_SHOW_METADATA
+               if (dhd->prot->metadata_dbg &&
+                   dhd->prot->tx_metadata_offset && txstatus->metadata_len) {
+                       uchar *ptr;
+                       /* The Ethernet header of TX frame was copied and removed.
+                        * Here, move the data pointer forward by Ethernet header size.
+                        */
+                       PKTPULL(dhd->osh, pkt, ETHER_HDR_LEN);
+                       ptr = PKTDATA(dhd->osh, pkt)  - (dhd->prot->tx_metadata_offset);
+                       bcm_print_bytes("txmetadata", ptr, txstatus->metadata_len);
+                       dhd_prot_print_metadata(dhd, ptr, txstatus->metadata_len);
+               }
+#endif /* DHD_DBG_SHOW_METADATA */
+               PKTFREE(dhd->osh, pkt, TRUE);
+               DHD_FLOWRING_TXSTATUS_CNT_UPDATE(dhd->bus, txstatus->compl_hdr.flow_ring_id,
+               txstatus->tx_status);
+       }
+
+       DHD_GENERAL_UNLOCK(dhd, flags);
+
+       return;
+} /* dhd_prot_txstatus_process */
+
+/** called on MSG_TYPE_WL_EVENT message received from dongle */
+static void
+dhd_prot_event_process(dhd_pub_t *dhd, void *msg)
+{
+       wlevent_req_msg_t *evnt;
+       uint32 bufid;
+       uint16 buflen;
+       int ifidx = 0;
+       void* pkt;
+       unsigned long flags;
+       dhd_prot_t *prot = dhd->prot;
+
+       /* Event complete header */
+       evnt = (wlevent_req_msg_t *)msg;
+       bufid = ltoh32(evnt->cmn_hdr.request_id);
+
+#if defined(DHD_PKTID_AUDIT_RING)
+       if (DHD_PKTID_AUDIT(dhd, dhd->prot->pktid_map_handle, bufid,
+               DHD_DUPLICATE_FREE) == BCME_ERROR) {
+                       prhex("dhd_prot_event_process:",
+                               (uchar *)msg, D2HRING_CTRL_CMPLT_ITEMSIZE);
+       }
+#endif /* DHD_PKTID_AUDIT_RING */
+
+       buflen = ltoh16(evnt->event_data_len);
+
+       ifidx = BCMMSGBUF_API_IFIDX(&evnt->cmn_hdr);
+
+       /* Post another rxbuf to the device */
+       if (prot->cur_event_bufs_posted) {
+               prot->cur_event_bufs_posted--;
+       }
+       dhd_msgbuf_rxbuf_post_event_bufs(dhd);
+
+       /* locks required to protect pktid_map */
+       DHD_GENERAL_LOCK(dhd, flags);
+       pkt = dhd_prot_packet_get(dhd, bufid, PKTTYPE_EVENT_RX, TRUE);
+       DHD_GENERAL_UNLOCK(dhd, flags);
+
+       if (!pkt) {
+               return;
+       }
+
+       /* DMA RX offset updated through shared area */
+       if (dhd->prot->rx_dataoffset) {
+               PKTPULL(dhd->osh, pkt, dhd->prot->rx_dataoffset);
+       }
+
+       PKTSETLEN(dhd->osh, pkt, buflen);
+
+       dhd_bus_rx_frame(dhd->bus, pkt, ifidx, 1);
+}
+
+/** called on MSG_TYPE_RX_CMPLT message received from dongle */
+static void BCMFASTPATH
+dhd_prot_rxcmplt_process(dhd_pub_t *dhd, void *msg)
+{
+       host_rxbuf_cmpl_t *rxcmplt_h;
+       uint16 data_offset;             /* offset at which data starts */
+       void *pkt;
+       unsigned long flags;
+       uint ifidx;
+       uint32 pktid;
+#if defined(DHD_LB_RXC)
+       const bool free_pktid = FALSE;
+#else
+       const bool free_pktid = TRUE;
+#endif /* DHD_LB_RXC */
+
+       /* RXCMPLT HDR */
+       rxcmplt_h = (host_rxbuf_cmpl_t *)msg;
+
+       /* offset from which data starts is populated in rxstatus0 */
+       data_offset = ltoh16(rxcmplt_h->data_offset);
+
+       pktid = ltoh32(rxcmplt_h->cmn_hdr.request_id);
+
+#if defined(DHD_PKTID_AUDIT_RING)
+       if (DHD_PKTID_AUDIT(dhd, dhd->prot->pktid_map_handle, pktid,
+               DHD_DUPLICATE_FREE) == BCME_ERROR) {
+                       prhex("dhd_prot_rxcmplt_process:",
+                               (uchar *)msg, D2HRING_RXCMPLT_ITEMSIZE);
+               }
+#endif /* DHD_PKTID_AUDIT_RING */
+
+       DHD_GENERAL_LOCK(dhd, flags);
+       pkt = dhd_prot_packet_get(dhd, pktid, PKTTYPE_DATA_RX, free_pktid);
+       DHD_GENERAL_UNLOCK(dhd, flags);
+
+       if (!pkt) {
+               return;
+       }
+
+       /* Post another set of rxbufs to the device */
+       dhd_prot_return_rxbuf(dhd, pktid, 1);
+
+       DHD_INFO(("id 0x%04x, offset %d, len %d, idx %d, phase 0x%02x, pktdata %p, metalen %d\n",
+               ltoh32(rxcmplt_h->cmn_hdr.request_id), data_offset, ltoh16(rxcmplt_h->data_len),
+               rxcmplt_h->cmn_hdr.if_id, rxcmplt_h->cmn_hdr.flags, PKTDATA(dhd->osh, pkt),
+               ltoh16(rxcmplt_h->metadata_len)));
+#if DHD_DBG_SHOW_METADATA
+       if (dhd->prot->metadata_dbg &&
+           dhd->prot->rx_metadata_offset && rxcmplt_h->metadata_len) {
+               uchar *ptr;
+               ptr = PKTDATA(dhd->osh, pkt) - (dhd->prot->rx_metadata_offset);
+               /* header followed by data */
+               bcm_print_bytes("rxmetadata", ptr, rxcmplt_h->metadata_len);
+               dhd_prot_print_metadata(dhd, ptr, rxcmplt_h->metadata_len);
+       }
+#endif /* DHD_DBG_SHOW_METADATA */
+
+       if (rxcmplt_h->flags & BCMPCIE_PKT_FLAGS_FRAME_802_11) {
+               DHD_INFO(("D11 frame rxed \n"));
+       }
+
+       /* data_offset from buf start */
+       if (data_offset) {
+               /* data offset given from dongle after split rx */
+               PKTPULL(dhd->osh, pkt, data_offset); /* data offset */
+       } else {
+               /* DMA RX offset updated through shared area */
+               if (dhd->prot->rx_dataoffset) {
+                       PKTPULL(dhd->osh, pkt, dhd->prot->rx_dataoffset);
+               }
+       }
+       /* Actual length of the packet */
+       PKTSETLEN(dhd->osh, pkt, ltoh16(rxcmplt_h->data_len));
+
+       ifidx = rxcmplt_h->cmn_hdr.if_id;
+
+#if defined(DHD_LB_RXP)
+       dhd_lb_rx_pkt_enqueue(dhd, pkt, ifidx);
+#else  /* ! DHD_LB_RXP */
+#ifdef DHD_RX_CHAINING
+       /* Chain the packets */
+       dhd_rxchain_frame(dhd, pkt, ifidx);
+#else /* ! DHD_RX_CHAINING */
+       /* offset from which data starts is populated in rxstatus0 */
+       dhd_bus_rx_frame(dhd->bus, pkt, ifidx, 1);
+#endif /* ! DHD_RX_CHAINING */
+#endif /* ! DHD_LB_RXP */
+} /* dhd_prot_rxcmplt_process */
+
+/** Stop protocol: sync w/dongle state. */
+void dhd_prot_stop(dhd_pub_t *dhd)
+{
+       ASSERT(dhd);
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+}
+
+/* Add any protocol-specific data header.
+ * Caller must reserve prot_hdrlen prepend space.
+ */
+void BCMFASTPATH
+dhd_prot_hdrpush(dhd_pub_t *dhd, int ifidx, void *PKTBUF)
+{
+       return;
+}
+
+uint
+dhd_prot_hdrlen(dhd_pub_t *dhd, void *PKTBUF)
+{
+       return 0;
+}
+
+
+#define PKTBUF pktbuf
+
+/**
+ * Called when a tx ethernet packet has been dequeued from a flow queue, and has to be inserted in
+ * the corresponding flow ring.
+ */
+int BCMFASTPATH
+dhd_prot_txdata(dhd_pub_t *dhd, void *PKTBUF, uint8 ifidx)
+{
+       unsigned long flags;
+       dhd_prot_t *prot = dhd->prot;
+       host_txbuf_post_t *txdesc = NULL;
+       dmaaddr_t pa, meta_pa;
+       uint8 *pktdata;
+       uint32 pktlen;
+       uint32 pktid;
+       uint8   prio;
+       uint16 flowid = 0;
+       uint16 alloced = 0;
+       uint16  headroom;
+       msgbuf_ring_t *ring;
+       flow_ring_table_t *flow_ring_table;
+       flow_ring_node_t *flow_ring_node;
+
+       if (dhd->flow_ring_table == NULL) {
+               return BCME_NORESOURCE;
+       }
+
+       flowid = DHD_PKT_GET_FLOWID(PKTBUF);
+
+       flow_ring_table = (flow_ring_table_t *)dhd->flow_ring_table;
+       flow_ring_node = (flow_ring_node_t *)&flow_ring_table[flowid];
+
+       ring = (msgbuf_ring_t *)flow_ring_node->prot_info;
+
+
+       DHD_GENERAL_LOCK(dhd, flags);
+
+       /* Create a unique 32-bit packet id */
+       pktid = DHD_NATIVE_TO_PKTID_RSV(dhd, dhd->prot->pktid_map_handle, PKTBUF);
+#if defined(DHD_PCIE_PKTID)
+       if (pktid == DHD_PKTID_INVALID) {
+               DHD_ERROR(("Pktid pool depleted.\n"));
+               /*
+                * If we return error here, the caller would queue the packet
+                * again. So we'll just free the skb allocated in DMA Zone.
+                * Since we have not freed the original SKB yet the caller would
+                * requeue the same.
+                */
+               goto err_no_res_pktfree;
+       }
+#endif /* DHD_PCIE_PKTID */
+
+       /* Reserve space in the circular buffer */
+       txdesc = (host_txbuf_post_t *)
+               dhd_prot_alloc_ring_space(dhd, ring, 1, &alloced, FALSE);
+       if (txdesc == NULL) {
+#if defined(DHD_PCIE_PKTID)
+               void *dmah;
+               void *secdma;
+               /* Free up the PKTID. physaddr and pktlen will be garbage. */
+               DHD_PKTID_TO_NATIVE(dhd, dhd->prot->pktid_map_handle, pktid,
+                       pa, pktlen, dmah, secdma, PKTTYPE_NO_CHECK);
+#endif /* DHD_PCIE_PKTID */
+               DHD_INFO(("%s:%d: HTOD Msgbuf Not available TxCount = %d\n",
+                       __FUNCTION__, __LINE__, prot->active_tx_count));
+               goto err_no_res_pktfree;
+       }
+
+       /* Extract the data pointer and length information */
+       pktdata = PKTDATA(dhd->osh, PKTBUF);
+       pktlen  = PKTLEN(dhd->osh, PKTBUF);
+
+       /* Ethernet header: Copy before we cache flush packet using DMA_MAP */
+       bcopy(pktdata, txdesc->txhdr, ETHER_HDR_LEN);
+
+       /* Extract the ethernet header and adjust the data pointer and length */
+       pktdata = PKTPULL(dhd->osh, PKTBUF, ETHER_HDR_LEN);
+       pktlen -= ETHER_HDR_LEN;
+
+       /* Map the data pointer to a DMA-able address */
+       if (SECURE_DMA_ENAB(dhd->osh)) {
+               int offset = 0;
+               BCM_REFERENCE(offset);
+
+               if (prot->tx_metadata_offset) {
+                       offset = prot->tx_metadata_offset + ETHER_HDR_LEN;
+               }
+
+               pa = SECURE_DMA_MAP(dhd->osh, PKTDATA(dhd->osh, PKTBUF), pktlen,
+                       DMA_TX, PKTBUF, 0, ring->dma_buf.secdma, offset);
+       } else {
+               pa = DMA_MAP(dhd->osh, PKTDATA(dhd->osh, PKTBUF), pktlen, DMA_TX, PKTBUF, 0);
+       }
+
+       if (PHYSADDRISZERO(pa)) {
+               DHD_ERROR(("Something really bad, unless 0 is a valid phyaddr\n"));
+               ASSERT(0);
+       }
+
+       /* No need to lock. Save the rest of the packet's metadata */
+       DHD_NATIVE_TO_PKTID_SAVE(dhd, dhd->prot->pktid_map_handle, PKTBUF, pktid,
+           pa, pktlen, DMA_TX, NULL, ring->dma_buf.secdma, PKTTYPE_DATA_TX);
+
+#ifdef TXP_FLUSH_NITEMS
+       if (ring->pend_items_count == 0) {
+               ring->start_addr = (void *)txdesc;
+       }
+       ring->pend_items_count++;
+#endif
+
+       /* Form the Tx descriptor message buffer */
+
+       /* Common message hdr */
+       txdesc->cmn_hdr.msg_type = MSG_TYPE_TX_POST;
+       txdesc->cmn_hdr.if_id = ifidx;
+
+       txdesc->flags = BCMPCIE_PKT_FLAGS_FRAME_802_3;
+       prio = (uint8)PKTPRIO(PKTBUF);
+
+
+       txdesc->flags |= (prio & 0x7) << BCMPCIE_PKT_FLAGS_PRIO_SHIFT;
+       txdesc->seg_cnt = 1;
+
+       txdesc->data_len = htol16((uint16) pktlen);
+       txdesc->data_buf_addr.high_addr = htol32(PHYSADDRHI(pa));
+       txdesc->data_buf_addr.low_addr  = htol32(PHYSADDRLO(pa));
+
+       /* Move data pointer to keep ether header in local PKTBUF for later reference */
+       PKTPUSH(dhd->osh, PKTBUF, ETHER_HDR_LEN);
+
+       /* Handle Tx metadata */
+       headroom = (uint16)PKTHEADROOM(dhd->osh, PKTBUF);
+       if (prot->tx_metadata_offset && (headroom < prot->tx_metadata_offset)) {
+               DHD_ERROR(("No headroom for Metadata tx %d %d\n",
+               prot->tx_metadata_offset, headroom));
+       }
+
+       if (prot->tx_metadata_offset && (headroom >= prot->tx_metadata_offset)) {
+               DHD_TRACE(("Metadata in tx %d\n", prot->tx_metadata_offset));
+
+               /* Adjust the data pointer to account for meta data in DMA_MAP */
+               PKTPUSH(dhd->osh, PKTBUF, prot->tx_metadata_offset);
+
+               if (SECURE_DMA_ENAB(dhd->osh)) {
+                       meta_pa = SECURE_DMA_MAP_TXMETA(dhd->osh, PKTDATA(dhd->osh, PKTBUF),
+                               prot->tx_metadata_offset + ETHER_HDR_LEN, DMA_RX, PKTBUF,
+                               0, ring->dma_buf.secdma);
+               } else {
+                       meta_pa = DMA_MAP(dhd->osh, PKTDATA(dhd->osh, PKTBUF),
+                               prot->tx_metadata_offset, DMA_RX, PKTBUF, 0);
+               }
+
+               if (PHYSADDRISZERO(meta_pa)) {
+                       DHD_ERROR(("Something really bad, unless 0 is a valid phyaddr\n"));
+                       ASSERT(0);
+               }
+
+               /* Adjust the data pointer back to original value */
+               PKTPULL(dhd->osh, PKTBUF, prot->tx_metadata_offset);
+
+               txdesc->metadata_buf_len = prot->tx_metadata_offset;
+               txdesc->metadata_buf_addr.high_addr = htol32(PHYSADDRHI(meta_pa));
+               txdesc->metadata_buf_addr.low_addr = htol32(PHYSADDRLO(meta_pa));
+       } else {
+               txdesc->metadata_buf_len = htol16(0);
+               txdesc->metadata_buf_addr.high_addr = 0;
+               txdesc->metadata_buf_addr.low_addr = 0;
+       }
+
+#if defined(DHD_PKTID_AUDIT_RING)
+       DHD_PKTID_AUDIT(dhd, prot->pktid_map_handle, pktid,
+               DHD_DUPLICATE_ALLOC);
+#endif /* DHD_PKTID_AUDIT_RING */
+
+       txdesc->cmn_hdr.request_id = htol32(pktid);
+
+       DHD_TRACE(("txpost: data_len %d, pktid 0x%04x\n", txdesc->data_len,
+               txdesc->cmn_hdr.request_id));
+
+       /* Update the write pointer in TCM & ring bell */
+#ifdef TXP_FLUSH_NITEMS
+       /* Flush if we have either hit the txp_threshold or if this msg is */
+       /* occupying the last slot in the flow_ring - before wrap around.  */
+       if ((ring->pend_items_count == prot->txp_threshold) ||
+               ((uint8 *) txdesc == (uint8 *) DHD_RING_END_VA(ring))) {
+               dhd_prot_txdata_write_flush(dhd, flowid, TRUE);
+       }
+#else
+       /* update ring's WR index and ring doorbell to dongle */
+       dhd_prot_ring_write_complete(dhd, ring, txdesc, 1);
+#endif
+
+       prot->active_tx_count++;
+
+       /*
+        * Take a wake lock, do not sleep if we have atleast one packet
+        * to finish.
+        */
+       if (prot->active_tx_count == 1)
+               DHD_TXFL_WAKE_LOCK(dhd);
+
+       DHD_GENERAL_UNLOCK(dhd, flags);
+
+       return BCME_OK;
+
+err_no_res_pktfree:
+
+
+
+       DHD_GENERAL_UNLOCK(dhd, flags);
+       return BCME_NORESOURCE;
+} /* dhd_prot_txdata */
+
+/* called with a lock */
+/** optimization to write "n" tx items at a time to ring */
+void BCMFASTPATH
+dhd_prot_txdata_write_flush(dhd_pub_t *dhd, uint16 flowid, bool in_lock)
+{
+#ifdef TXP_FLUSH_NITEMS
+       unsigned long flags = 0;
+       flow_ring_table_t *flow_ring_table;
+       flow_ring_node_t *flow_ring_node;
+       msgbuf_ring_t *ring;
+
+       if (dhd->flow_ring_table == NULL) {
+               return;
+       }
+
+       if (!in_lock) {
+               DHD_GENERAL_LOCK(dhd, flags);
+       }
+
+       flow_ring_table = (flow_ring_table_t *)dhd->flow_ring_table;
+       flow_ring_node = (flow_ring_node_t *)&flow_ring_table[flowid];
+       ring = (msgbuf_ring_t *)flow_ring_node->prot_info;
+
+       if (ring->pend_items_count) {
+               /* update ring's WR index and ring doorbell to dongle */
+               dhd_prot_ring_write_complete(dhd, ring, ring->start_addr,
+                       ring->pend_items_count);
+               ring->pend_items_count = 0;
+               ring->start_addr = NULL;
+       }
+
+       if (!in_lock) {
+               DHD_GENERAL_UNLOCK(dhd, flags);
+       }
+#endif /* TXP_FLUSH_NITEMS */
+}
+
+#undef PKTBUF  /* Only defined in the above routine */
+
+int BCMFASTPATH
+dhd_prot_hdrpull(dhd_pub_t *dhd, int *ifidx, void *pkt, uchar *buf, uint *len)
+{
+       return 0;
+}
+
+/** post a set of receive buffers to the dongle */
+static void BCMFASTPATH
+dhd_prot_return_rxbuf(dhd_pub_t *dhd, uint32 pktid, uint32 rxcnt)
+{
+       dhd_prot_t *prot = dhd->prot;
+#if defined(DHD_LB_RXC)
+       int elem_ix;
+       uint32 *elem;
+       bcm_workq_t *workq;
+
+       workq = &prot->rx_compl_prod;
+
+       /* Produce the work item */
+       elem_ix = bcm_ring_prod(WORKQ_RING(workq), DHD_LB_WORKQ_SZ);
+       if (elem_ix == BCM_RING_FULL) {
+               DHD_ERROR(("%s LB RxCompl workQ is full\n", __FUNCTION__));
+               ASSERT(0);
+               return;
+       }
+
+       elem = WORKQ_ELEMENT(uint32, workq, elem_ix);
+       *elem = pktid;
+
+       smp_wmb();
+
+       /* Sync WR index to consumer if the SYNC threshold has been reached */
+       if (++prot->rx_compl_prod_sync >= DHD_LB_WORKQ_SYNC) {
+               bcm_workq_prod_sync(workq);
+               prot->rx_compl_prod_sync = 0;
+       }
+
+       DHD_INFO(("%s: rx_compl_prod pktid<%u> sync<%d>\n",
+               __FUNCTION__, pktid, prot->rx_compl_prod_sync));
+
+#endif /* DHD_LB_RXC */
+
+
+       if (prot->rxbufpost >= rxcnt) {
+               prot->rxbufpost -= rxcnt;
+       } else {
+               /* ASSERT(0); */
+               prot->rxbufpost = 0;
+       }
+
+#if !defined(DHD_LB_RXC)
+       if (prot->rxbufpost <= (prot->max_rxbufpost - RXBUFPOST_THRESHOLD)) {
+               dhd_msgbuf_rxbuf_post(dhd, FALSE); /* alloc pkt ids */
+       }
+#endif /* !DHD_LB_RXC */
+}
+
+/* called before an ioctl is sent to the dongle */
+static void
+dhd_prot_wlioctl_intercept(dhd_pub_t *dhd, wl_ioctl_t * ioc, void * buf)
+{
+       dhd_prot_t *prot = dhd->prot;
+
+       if (ioc->cmd == WLC_SET_VAR && buf != NULL && !strcmp(buf, "pcie_bus_tput")) {
+               int slen = 0;
+               pcie_bus_tput_params_t *tput_params;
+
+               slen = strlen("pcie_bus_tput") + 1;
+               tput_params = (pcie_bus_tput_params_t*)((char *)buf + slen);
+               bcopy(&prot->host_bus_throughput_buf.pa, &tput_params->host_buf_addr,
+                       sizeof(tput_params->host_buf_addr));
+               tput_params->host_buf_len = DHD_BUS_TPUT_BUF_LEN;
+       }
+}
+
+
+/** Use protocol to issue ioctl to dongle. Only one ioctl may be in transit. */
+int dhd_prot_ioctl(dhd_pub_t *dhd, int ifidx, wl_ioctl_t * ioc, void * buf, int len)
+{
+       int ret = -1;
+       uint8 action;
+
+       if ((dhd->busstate == DHD_BUS_DOWN) || dhd->hang_was_sent) {
+               DHD_ERROR(("%s : bus is down. we have nothing to do\n", __FUNCTION__));
+               goto done;
+       }
+
+       if (dhd->busstate == DHD_BUS_SUSPEND) {
+               DHD_ERROR(("%s : bus is suspended\n", __FUNCTION__));
+               goto done;
+       }
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (ioc->cmd == WLC_SET_PM) {
+               DHD_TRACE_HW4(("%s: SET PM to %d\n", __FUNCTION__, *(char *)buf));
+       }
+
+       ASSERT(len <= WLC_IOCTL_MAXLEN);
+
+       if (len > WLC_IOCTL_MAXLEN) {
+               goto done;
+       }
+
+       action = ioc->set;
+
+       dhd_prot_wlioctl_intercept(dhd, ioc, buf);
+
+       if (action & WL_IOCTL_ACTION_SET) {
+               ret = dhd_msgbuf_set_ioctl(dhd, ifidx, ioc->cmd, buf, len, action);
+       } else {
+               ret = dhd_msgbuf_query_ioctl(dhd, ifidx, ioc->cmd, buf, len, action);
+               if (ret > 0) {
+                       ioc->used = ret;
+               }
+       }
+
+       /* Too many programs assume ioctl() returns 0 on success */
+       if (ret >= 0) {
+               ret = 0;
+       } else {
+               DHD_ERROR(("%s: status ret value is %d \n", __FUNCTION__, ret));
+               dhd->dongle_error = ret;
+       }
+
+       if (!ret && ioc->cmd == WLC_SET_VAR && buf != NULL) {
+               /* Intercept the wme_dp ioctl here */
+               if (!strcmp(buf, "wme_dp")) {
+                       int slen, val = 0;
+
+                       slen = strlen("wme_dp") + 1;
+                       if (len >= (int)(slen + sizeof(int))) {
+                               bcopy(((char *)buf + slen), &val, sizeof(int));
+                       }
+                       dhd->wme_dp = (uint8) ltoh32(val);
+               }
+
+       }
+
+done:
+       return ret;
+
+} /* dhd_prot_ioctl */
+
+/** test / loopback */
+
+int
+dhdmsgbuf_lpbk_req(dhd_pub_t *dhd, uint len)
+{
+       unsigned long flags;
+       dhd_prot_t *prot = dhd->prot;
+       uint16 alloced = 0;
+
+       ioct_reqst_hdr_t *ioct_rqst;
+
+       uint16 hdrlen = sizeof(ioct_reqst_hdr_t);
+       uint16 msglen = len + hdrlen;
+       msgbuf_ring_t *ring = &prot->h2dring_ctrl_subn;
+
+       msglen = ALIGN_SIZE(msglen, DMA_ALIGN_LEN);
+       msglen = LIMIT_TO_MAX(msglen, MSGBUF_MAX_MSG_SIZE);
+
+       DHD_GENERAL_LOCK(dhd, flags);
+
+       ioct_rqst = (ioct_reqst_hdr_t *)
+               dhd_prot_alloc_ring_space(dhd, ring, 1, &alloced, FALSE);
+
+       if (ioct_rqst == NULL) {
+               DHD_GENERAL_UNLOCK(dhd, flags);
+               return 0;
+       }
+
+       {
+               uint8 *ptr;
+               uint16 i;
+
+               ptr = (uint8 *)ioct_rqst;
+               for (i = 0; i < msglen; i++) {
+                       ptr[i] = i % 256;
+               }
+       }
+
+       /* Common msg buf hdr */
+       ioct_rqst->msg.epoch = ring->seqnum % H2D_EPOCH_MODULO;
+       ring->seqnum++;
+
+       ioct_rqst->msg.msg_type = MSG_TYPE_LOOPBACK;
+       ioct_rqst->msg.if_id = 0;
+
+       bcm_print_bytes("LPBK REQ: ", (uint8 *)ioct_rqst, msglen);
+
+       /* update ring's WR index and ring doorbell to dongle */
+       dhd_prot_ring_write_complete(dhd, ring, ioct_rqst, 1);
+       DHD_GENERAL_UNLOCK(dhd, flags);
+
+       return 0;
+}
+
+/** test / loopback */
+void dmaxfer_free_dmaaddr(dhd_pub_t *dhd, dhd_dmaxfer_t *dmaxfer)
+{
+       if (dmaxfer == NULL) {
+               return;
+       }
+
+       dhd_dma_buf_free(dhd, &dmaxfer->srcmem);
+       dhd_dma_buf_free(dhd, &dmaxfer->dstmem);
+}
+
+/** test / loopback */
+int dmaxfer_prepare_dmaaddr(dhd_pub_t *dhd, uint len,
+       uint srcdelay, uint destdelay, dhd_dmaxfer_t *dmaxfer)
+{
+       uint i;
+       if (!dmaxfer) {
+               return BCME_ERROR;
+       }
+
+       /* First free up existing buffers */
+       dmaxfer_free_dmaaddr(dhd, dmaxfer);
+
+       if (dhd_dma_buf_alloc(dhd, &dmaxfer->srcmem, len)) {
+               return BCME_NOMEM;
+       }
+
+       if (dhd_dma_buf_alloc(dhd, &dmaxfer->dstmem, len + 8)) {
+               dhd_dma_buf_free(dhd, &dmaxfer->srcmem);
+               return BCME_NOMEM;
+       }
+
+       dmaxfer->len = len;
+
+       /* Populate source with a pattern */
+       for (i = 0; i < dmaxfer->len; i++) {
+               ((uint8*)dmaxfer->srcmem.va)[i] = i % 256;
+       }
+       OSL_CACHE_FLUSH(dmaxfer->srcmem.va, dmaxfer->len);
+
+       dmaxfer->srcdelay = srcdelay;
+       dmaxfer->destdelay = destdelay;
+
+       return BCME_OK;
+} /* dmaxfer_prepare_dmaaddr */
+
+static void
+dhd_msgbuf_dmaxfer_process(dhd_pub_t *dhd, void *msg)
+{
+       dhd_prot_t *prot = dhd->prot;
+
+       OSL_CACHE_INV(prot->dmaxfer.dstmem.va, prot->dmaxfer.len);
+       if (prot->dmaxfer.srcmem.va && prot->dmaxfer.dstmem.va) {
+               if (memcmp(prot->dmaxfer.srcmem.va,
+                       prot->dmaxfer.dstmem.va, prot->dmaxfer.len)) {
+                       bcm_print_bytes("XFER SRC: ",
+                           prot->dmaxfer.srcmem.va, prot->dmaxfer.len);
+                       bcm_print_bytes("XFER DST: ",
+                           prot->dmaxfer.dstmem.va, prot->dmaxfer.len);
+               } else {
+                       DHD_INFO(("DMA successful\n"));
+               }
+       }
+       dmaxfer_free_dmaaddr(dhd, &prot->dmaxfer);
+       dhd->prot->dmaxfer.in_progress = FALSE;
+}
+
+/** Test functionality.
+ * Transfers bytes from host to dongle and to host again using DMA
+ * This function is not reentrant, as prot->dmaxfer.in_progress is not protected
+ * by a spinlock.
+ */
+int
+dhdmsgbuf_dmaxfer_req(dhd_pub_t *dhd, uint len, uint srcdelay, uint destdelay)
+{
+       unsigned long flags;
+       int ret = BCME_OK;
+       dhd_prot_t *prot = dhd->prot;
+       pcie_dma_xfer_params_t *dmap;
+       uint32 xferlen = LIMIT_TO_MAX(len, DMA_XFER_LEN_LIMIT);
+       uint16 alloced = 0;
+       msgbuf_ring_t *ring = &prot->h2dring_ctrl_subn;
+
+       if (prot->dmaxfer.in_progress) {
+               DHD_ERROR(("DMA is in progress...\n"));
+               return ret;
+       }
+
+       prot->dmaxfer.in_progress = TRUE;
+       if ((ret = dmaxfer_prepare_dmaaddr(dhd, xferlen, srcdelay, destdelay,
+               &prot->dmaxfer)) != BCME_OK) {
+               prot->dmaxfer.in_progress = FALSE;
+               return ret;
+       }
+
+       DHD_GENERAL_LOCK(dhd, flags);
+
+       dmap = (pcie_dma_xfer_params_t *)
+               dhd_prot_alloc_ring_space(dhd, ring, 1, &alloced, FALSE);
+
+       if (dmap == NULL) {
+               dmaxfer_free_dmaaddr(dhd, &prot->dmaxfer);
+               prot->dmaxfer.in_progress = FALSE;
+               DHD_GENERAL_UNLOCK(dhd, flags);
+               return BCME_NOMEM;
+       }
+
+       /* Common msg buf hdr */
+       dmap->cmn_hdr.msg_type = MSG_TYPE_LPBK_DMAXFER;
+       dmap->cmn_hdr.request_id = htol32(DHD_FAKE_PKTID);
+       dmap->cmn_hdr.epoch = ring->seqnum % H2D_EPOCH_MODULO;
+       ring->seqnum++;
+
+       dmap->host_input_buf_addr.high = htol32(PHYSADDRHI(prot->dmaxfer.srcmem.pa));
+       dmap->host_input_buf_addr.low = htol32(PHYSADDRLO(prot->dmaxfer.srcmem.pa));
+       dmap->host_ouput_buf_addr.high = htol32(PHYSADDRHI(prot->dmaxfer.dstmem.pa));
+       dmap->host_ouput_buf_addr.low = htol32(PHYSADDRLO(prot->dmaxfer.dstmem.pa));
+       dmap->xfer_len = htol32(prot->dmaxfer.len);
+       dmap->srcdelay = htol32(prot->dmaxfer.srcdelay);
+       dmap->destdelay = htol32(prot->dmaxfer.destdelay);
+
+       /* update ring's WR index and ring doorbell to dongle */
+       dhd_prot_ring_write_complete(dhd, ring, dmap, 1);
+       DHD_GENERAL_UNLOCK(dhd, flags);
+
+       DHD_ERROR(("DMA Started...\n"));
+
+       return BCME_OK;
+} /* dhdmsgbuf_dmaxfer_req */
+
+/** Called in the process of submitting an ioctl to the dongle */
+static int
+dhd_msgbuf_query_ioctl(dhd_pub_t *dhd, int ifidx, uint cmd, void *buf, uint len, uint8 action)
+{
+       int ret = 0;
+       uint copylen = 0;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (!len || !buf) {
+               DHD_ERROR(("%s(): Zero length bailing\n", __FUNCTION__));
+               ret = BCME_BADARG;
+               goto done;
+       }
+
+       /* Respond "bcmerror" and "bcmerrorstr" with local cache */
+       if (cmd == WLC_GET_VAR) {
+               if ((len >= strlen("bcmerrorstr")) && (!strcmp((char *)buf, "bcmerrorstr"))) {
+                       copylen = MIN(len, BCME_STRLEN);
+                       strncpy((char *)buf, bcmerrorstr(dhd->dongle_error), copylen);
+                       *(uint8 *)(buf + (copylen - 1)) = '\0';
+                       goto done;
+               } else if ((len >= strlen("bcmerror")) && !strcmp((char *)buf, "bcmerror")) {
+                       store32_ua(buf, dhd->dongle_error);
+                       *(uint8 *)(buf + (sizeof(uint32))) = '\0';
+                       goto done;
+               }
+       }
+
+       ret = dhd_fillup_ioct_reqst(dhd, (uint16)len, cmd, buf, ifidx);
+
+       DHD_CTL(("query_ioctl: ACTION %d ifdix %d cmd %d len %d \n",
+               action, ifidx, cmd, len));
+
+       /* wait for IOCTL completion message from dongle and get first fragment */
+       ret = dhd_msgbuf_wait_ioctl_cmplt(dhd, len, buf);
+
+done:
+       return ret;
+}
+
+/**
+ * Waits for IOCTL completion message from the dongle, copies this into caller
+ * provided parameter 'buf'.
+ */
+static int
+dhd_msgbuf_wait_ioctl_cmplt(dhd_pub_t *dhd, uint32 len, void *buf)
+{
+       dhd_prot_t *prot = dhd->prot;
+       int timeleft;
+       unsigned long flags;
+       int ret = 0;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (dhd_query_bus_erros(dhd)) {
+               ret = -EIO;
+               goto out;
+       }
+
+       if (prot->cur_ioctlresp_bufs_posted) {
+               prot->cur_ioctlresp_bufs_posted--;
+       }
+
+       dhd_msgbuf_rxbuf_post_ioctlresp_bufs(dhd);
+
+       timeleft = dhd_os_ioctl_resp_wait(dhd, &prot->ioctl_received);
+       if (timeleft == 0) {
+               dhd->rxcnt_timeout++;
+               dhd->rx_ctlerrs++;
+               dhd->iovar_timeout_occured = TRUE;
+               DHD_ERROR(("%s: resumed on timeout rxcnt_timeout %d ioctl_cmd %d "
+                       "trans_id %d state %d busstate=%d ioctl_received=%d\n",
+                       __FUNCTION__, dhd->rxcnt_timeout, prot->curr_ioctl_cmd,
+                       prot->ioctl_trans_id, prot->ioctl_state,
+                       dhd->busstate, prot->ioctl_received));
+
+               dhd_prot_debug_info_print(dhd);
+
+#ifdef DHD_FW_COREDUMP
+               /* Collect socram dump */
+               if (dhd->memdump_enabled) {
+                       /* collect core dump */
+                       dhd->memdump_type = DUMP_TYPE_RESUMED_ON_TIMEOUT;
+                       dhd_bus_mem_dump(dhd);
+               }
+#endif /* DHD_FW_COREDUMP */
+               if (dhd->rxcnt_timeout >= MAX_CNTL_RX_TIMEOUT) {
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#ifdef CONFIG_ARCH_MSM
+                       dhd->bus->no_cfg_restore = 1;
+#endif /* CONFIG_ARCH_MSM */
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+                       DHD_ERROR(("%s: timeout > MAX_CNTL_TX_TIMEOUT\n", __FUNCTION__));
+               }
+               ret = -ETIMEDOUT;
+               goto out;
+       } else {
+               if (prot->ioctl_received != IOCTL_RETURN_ON_SUCCESS) {
+                       DHD_ERROR(("%s: IOCTL failure due to ioctl_received = %d\n",
+                               __FUNCTION__, prot->ioctl_received));
+                       ret = -ECONNABORTED;
+                       goto out;
+               }
+               dhd->rxcnt_timeout = 0;
+               dhd->rx_ctlpkts++;
+               DHD_CTL(("%s: ioctl resp resumed, got %d\n",
+                       __FUNCTION__, prot->ioctl_resplen));
+       }
+
+       if (dhd->dongle_trap_occured) {
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#ifdef CONFIG_ARCH_MSM
+               dhd->bus->no_cfg_restore = 1;
+#endif /* CONFIG_ARCH_MSM */
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+               DHD_ERROR(("%s: TRAP occurred!!\n", __FUNCTION__));
+               ret = -EREMOTEIO;
+               goto out;
+       }
+
+       if (dhd->prot->ioctl_resplen > len) {
+               dhd->prot->ioctl_resplen = (uint16)len;
+       }
+       if (buf) {
+               bcopy(dhd->prot->retbuf.va, buf, dhd->prot->ioctl_resplen);
+       }
+
+       ret = (int)(dhd->prot->ioctl_status);
+out:
+       DHD_GENERAL_LOCK(dhd, flags);
+       dhd->prot->ioctl_state = 0;
+       dhd->prot->ioctl_resplen = 0;
+       dhd->prot->ioctl_received = IOCTL_WAIT;
+       dhd->prot->curr_ioctl_cmd = 0;
+       DHD_GENERAL_UNLOCK(dhd, flags);
+
+       return ret;
+} /* dhd_msgbuf_wait_ioctl_cmplt */
+
+static int
+dhd_msgbuf_set_ioctl(dhd_pub_t *dhd, int ifidx, uint cmd, void *buf, uint len, uint8 action)
+{
+       int ret = 0;
+
+       DHD_TRACE(("%s: Enter \n", __FUNCTION__));
+
+       if (dhd->busstate == DHD_BUS_DOWN) {
+               DHD_ERROR(("%s : bus is down. we have nothing to do\n", __FUNCTION__));
+               return -EIO;
+       }
+
+       /* don't talk to the dongle if fw is about to be reloaded */
+       if (dhd->hang_was_sent) {
+               DHD_ERROR(("%s: HANG was sent up earlier. Not talking to the chip\n",
+                       __FUNCTION__));
+               return -EIO;
+       }
+
+       /* Fill up msgbuf for ioctl req */
+       ret = dhd_fillup_ioct_reqst(dhd, (uint16)len, cmd, buf, ifidx);
+
+       DHD_CTL(("ACTION %d ifdix %d cmd %d len %d \n",
+               action, ifidx, cmd, len));
+
+       ret = dhd_msgbuf_wait_ioctl_cmplt(dhd, len, buf);
+
+       return ret;
+}
+
+/** Called by upper DHD layer. Handles a protocol control response asynchronously. */
+int dhd_prot_ctl_complete(dhd_pub_t *dhd)
+{
+       return 0;
+}
+
+/** Called by upper DHD layer. Check for and handle local prot-specific iovar commands */
+int dhd_prot_iovar_op(dhd_pub_t *dhd, const char *name,
+       void *params, int plen, void *arg, int len, bool set)
+{
+       return BCME_UNSUPPORTED;
+}
+
+/** Add prot dump output to a buffer */
+void dhd_prot_dump(dhd_pub_t *dhd, struct bcmstrbuf *b)
+{
+
+#if defined(PCIE_D2H_SYNC)
+       if (dhd->d2h_sync_mode & PCIE_SHARED_D2H_SYNC_SEQNUM)
+               bcm_bprintf(b, "\nd2h_sync: SEQNUM:");
+       else if (dhd->d2h_sync_mode & PCIE_SHARED_D2H_SYNC_XORCSUM)
+               bcm_bprintf(b, "\nd2h_sync: XORCSUM:");
+       else
+               bcm_bprintf(b, "\nd2h_sync: NONE:");
+       bcm_bprintf(b, " d2h_sync_wait max<%lu> tot<%lu>\n",
+               dhd->prot->d2h_sync_wait_max, dhd->prot->d2h_sync_wait_tot);
+#endif  /* PCIE_D2H_SYNC */
+
+       bcm_bprintf(b, "\nDongle DMA Indices: h2d %d  d2h %d index size %d bytes\n",
+               DMA_INDX_ENAB(dhd->dma_h2d_ring_upd_support),
+               DMA_INDX_ENAB(dhd->dma_d2h_ring_upd_support),
+               dhd->prot->rw_index_sz);
+}
+
+/* Update local copy of dongle statistics */
+void dhd_prot_dstats(dhd_pub_t *dhd)
+{
+       return;
+}
+
+/** Called by upper DHD layer */
+int dhd_process_pkt_reorder_info(dhd_pub_t *dhd, uchar *reorder_info_buf,
+       uint reorder_info_len, void **pkt, uint32 *free_buf_count)
+{
+       return 0;
+}
+
+/** Debug related, post a dummy message to interrupt dongle. Used to process cons commands. */
+int
+dhd_post_dummy_msg(dhd_pub_t *dhd)
+{
+       unsigned long flags;
+       hostevent_hdr_t *hevent = NULL;
+       uint16 alloced = 0;
+
+       dhd_prot_t *prot = dhd->prot;
+       msgbuf_ring_t *ring = &prot->h2dring_ctrl_subn;
+
+       DHD_GENERAL_LOCK(dhd, flags);
+
+       hevent = (hostevent_hdr_t *)
+               dhd_prot_alloc_ring_space(dhd, ring, 1, &alloced, FALSE);
+
+       if (hevent == NULL) {
+               DHD_GENERAL_UNLOCK(dhd, flags);
+               return -1;
+       }
+
+       /* CMN msg header */
+       hevent->msg.epoch = ring->seqnum % H2D_EPOCH_MODULO;
+       ring->seqnum++;
+       hevent->msg.msg_type = MSG_TYPE_HOST_EVNT;
+       hevent->msg.if_id = 0;
+
+       /* Event payload */
+       hevent->evnt_pyld = htol32(HOST_EVENT_CONS_CMD);
+
+       /* Since, we are filling the data directly into the bufptr obtained
+        * from the msgbuf, we can directly call the write_complete
+        */
+       dhd_prot_ring_write_complete(dhd, ring, hevent, 1);
+       DHD_GENERAL_UNLOCK(dhd, flags);
+
+       return 0;
+}
+
+/**
+ * If exactly_nitems is true, this function will allocate space for nitems or fail
+ * If exactly_nitems is false, this function will allocate space for nitems or less
+ */
+static void * BCMFASTPATH
+dhd_prot_alloc_ring_space(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+       uint16 nitems, uint16 * alloced, bool exactly_nitems)
+{
+       void * ret_buf;
+
+       /* Alloc space for nitems in the ring */
+       ret_buf = dhd_prot_get_ring_space(ring, nitems, alloced, exactly_nitems);
+
+       if (ret_buf == NULL) {
+               /* if alloc failed , invalidate cached read ptr */
+               if (DMA_INDX_ENAB(dhd->dma_d2h_ring_upd_support)) {
+                       ring->rd = dhd_prot_dma_indx_get(dhd, H2D_DMA_INDX_RD_UPD, ring->idx);
+               } else {
+                       dhd_bus_cmn_readshared(dhd->bus, &(ring->rd), RING_RD_UPD, ring->idx);
+               }
+
+               /* Try allocating once more */
+               ret_buf = dhd_prot_get_ring_space(ring, nitems, alloced, exactly_nitems);
+
+               if (ret_buf == NULL) {
+                       DHD_INFO(("%s: Ring space not available  \n", ring->name));
+                       return NULL;
+               }
+       }
+
+       /* Return alloced space */
+       return ret_buf;
+}
+
+/**
+ * Non inline ioct request.
+ * Form a ioctl request first as per ioctptr_reqst_hdr_t header in the circular buffer
+ * Form a separate request buffer where a 4 byte cmn header is added in the front
+ * buf contents from parent function is copied to remaining section of this buffer
+ */
+static int
+dhd_fillup_ioct_reqst(dhd_pub_t *dhd, uint16 len, uint cmd, void* buf, int ifidx)
+{
+       dhd_prot_t *prot = dhd->prot;
+       ioctl_req_msg_t *ioct_rqst;
+       void * ioct_buf;        /* For ioctl payload */
+       uint16  rqstlen, resplen;
+       unsigned long flags;
+       uint16 alloced = 0;
+       msgbuf_ring_t *ring = &prot->h2dring_ctrl_subn;
+
+       if (dhd_query_bus_erros(dhd)) {
+               return -EIO;
+       }
+
+       rqstlen = len;
+       resplen = len;
+
+       /* Limit ioct request to MSGBUF_MAX_MSG_SIZE bytes including hdrs */
+       /* 8K allocation of dongle buffer fails */
+       /* dhd doesnt give separate input & output buf lens */
+       /* so making the assumption that input length can never be more than 1.5k */
+       rqstlen = MIN(rqstlen, MSGBUF_MAX_MSG_SIZE);
+
+       DHD_GENERAL_LOCK(dhd, flags);
+
+       if (prot->ioctl_state) {
+               DHD_ERROR(("%s: pending ioctl %02x\n", __FUNCTION__, prot->ioctl_state));
+               DHD_GENERAL_UNLOCK(dhd, flags);
+               return BCME_BUSY;
+       } else {
+               prot->ioctl_state = MSGBUF_IOCTL_ACK_PENDING | MSGBUF_IOCTL_RESP_PENDING;
+       }
+
+       /* Request for cbuf space */
+       ioct_rqst = (ioctl_req_msg_t*)
+               dhd_prot_alloc_ring_space(dhd, ring, 1, &alloced, FALSE);
+       if (ioct_rqst == NULL) {
+               DHD_ERROR(("couldn't allocate space on msgring to send ioctl request\n"));
+               prot->ioctl_state = 0;
+               prot->curr_ioctl_cmd = 0;
+               prot->ioctl_received = IOCTL_WAIT;
+               DHD_GENERAL_UNLOCK(dhd, flags);
+               return -1;
+       }
+
+       /* Common msg buf hdr */
+       ioct_rqst->cmn_hdr.msg_type = MSG_TYPE_IOCTLPTR_REQ;
+       ioct_rqst->cmn_hdr.if_id = (uint8)ifidx;
+       ioct_rqst->cmn_hdr.flags = 0;
+       ioct_rqst->cmn_hdr.request_id = htol32(DHD_IOCTL_REQ_PKTID);
+       ioct_rqst->cmn_hdr.epoch = ring->seqnum % H2D_EPOCH_MODULO;
+       ring->seqnum++;
+
+       ioct_rqst->cmd = htol32(cmd);
+       prot->curr_ioctl_cmd = cmd;
+       ioct_rqst->output_buf_len = htol16(resplen);
+       prot->ioctl_trans_id++;
+       ioct_rqst->trans_id = prot->ioctl_trans_id;
+
+       /* populate ioctl buffer info */
+       ioct_rqst->input_buf_len = htol16(rqstlen);
+       ioct_rqst->host_input_buf_addr.high = htol32(PHYSADDRHI(prot->ioctbuf.pa));
+       ioct_rqst->host_input_buf_addr.low = htol32(PHYSADDRLO(prot->ioctbuf.pa));
+       /* copy ioct payload */
+       ioct_buf = (void *) prot->ioctbuf.va;
+
+       if (buf) {
+               memcpy(ioct_buf, buf, len);
+       }
+
+       OSL_CACHE_FLUSH((void *) prot->ioctbuf.va, len);
+
+       if (!ISALIGNED(ioct_buf, DMA_ALIGN_LEN)) {
+               DHD_ERROR(("host ioct address unaligned !!!!! \n"));
+       }
+
+       DHD_CTL(("submitted IOCTL request request_id %d, cmd %d, output_buf_len %d, tx_id %d\n",
+               ioct_rqst->cmn_hdr.request_id, cmd, ioct_rqst->output_buf_len,
+               ioct_rqst->trans_id));
+
+       /* update ring's WR index and ring doorbell to dongle */
+       dhd_prot_ring_write_complete(dhd, ring, ioct_rqst, 1);
+       DHD_GENERAL_UNLOCK(dhd, flags);
+
+       return 0;
+} /* dhd_fillup_ioct_reqst */
+
+
+/**
+ * dhd_prot_ring_attach - Initialize the msgbuf_ring object and attach a
+ * DMA-able buffer to it. The ring is NOT tagged as inited until all the ring
+ * information is posted to the dongle.
+ *
+ * Invoked in dhd_prot_attach for the common rings, and in dhd_prot_init for
+ * each flowring in pool of flowrings.
+ *
+ * returns BCME_OK=0 on success
+ * returns non-zero negative error value on failure.
+ */
+static int
+dhd_prot_ring_attach(dhd_pub_t *dhd, msgbuf_ring_t *ring, const char *name,
+       uint16 max_items, uint16 item_len, uint16 ringid)
+{
+       int dma_buf_alloced = BCME_NOMEM;
+       uint32 dma_buf_len = max_items * item_len;
+       dhd_prot_t *prot = dhd->prot;
+
+       ASSERT(ring);
+       ASSERT(name);
+       ASSERT((max_items < 0xFFFF) && (item_len < 0xFFFF) && (ringid < 0xFFFF));
+
+       /* Init name */
+       strncpy(ring->name, name, RING_NAME_MAX_LENGTH);
+       ring->name[RING_NAME_MAX_LENGTH - 1] = '\0';
+
+       ring->idx = ringid;
+
+       ring->max_items = max_items;
+       ring->item_len = item_len;
+
+       /* A contiguous space may be reserved for all flowrings */
+       if (DHD_IS_FLOWRING(ringid) && (prot->flowrings_dma_buf.va)) {
+               /* Carve out from the contiguous DMA-able flowring buffer */
+               uint16 flowid;
+               uint32 base_offset;
+
+               dhd_dma_buf_t *dma_buf = &ring->dma_buf;
+               dhd_dma_buf_t *rsv_buf = &prot->flowrings_dma_buf;
+
+               flowid = DHD_RINGID_TO_FLOWID(ringid);
+               base_offset = (flowid - BCMPCIE_H2D_COMMON_MSGRINGS) * dma_buf_len;
+
+               ASSERT(base_offset + dma_buf_len <= rsv_buf->len);
+
+               dma_buf->len = dma_buf_len;
+               dma_buf->va = (void *)((uintptr)rsv_buf->va + base_offset);
+               PHYSADDRHISET(dma_buf->pa, PHYSADDRHI(rsv_buf->pa));
+               PHYSADDRLOSET(dma_buf->pa, PHYSADDRLO(rsv_buf->pa) + base_offset);
+
+               /* On 64bit, contiguous space may not span across 0x00000000FFFFFFFF */
+               ASSERT(PHYSADDRLO(dma_buf->pa) >= PHYSADDRLO(rsv_buf->pa));
+
+               dma_buf->dmah   = rsv_buf->dmah;
+               dma_buf->secdma = rsv_buf->secdma;
+
+               (void)dhd_dma_buf_audit(dhd, &ring->dma_buf);
+       } else {
+               /* Allocate a dhd_dma_buf */
+               dma_buf_alloced = dhd_dma_buf_alloc(dhd, &ring->dma_buf, dma_buf_len);
+               if (dma_buf_alloced != BCME_OK) {
+                       return BCME_NOMEM;
+               }
+       }
+
+       /* CAUTION: Save ring::base_addr in little endian format! */
+       dhd_base_addr_htolpa(&ring->base_addr, ring->dma_buf.pa);
+
+#ifdef BCM_SECURE_DMA
+       if (SECURE_DMA_ENAB(prot->osh)) {
+               ring->dma_buf.secdma = MALLOCZ(prot->osh, sizeof(sec_cma_info_t));
+               if (ring->dma_buf.secdma == NULL) {
+                       goto free_dma_buf;
+               }
+       }
+#endif /* BCM_SECURE_DMA */
+
+       DHD_INFO(("RING_ATTACH : %s Max item %d len item %d total size %d "
+               "ring start %p buf phys addr  %x:%x \n",
+               ring->name, ring->max_items, ring->item_len,
+               dma_buf_len, ring->dma_buf.va, ltoh32(ring->base_addr.high_addr),
+               ltoh32(ring->base_addr.low_addr)));
+
+       return BCME_OK;
+
+#ifdef BCM_SECURE_DMA
+free_dma_buf:
+       if (dma_buf_alloced == BCME_OK) {
+               dhd_dma_buf_free(dhd, &ring->dma_buf);
+       }
+#endif /* BCM_SECURE_DMA */
+
+       return BCME_NOMEM;
+
+} /* dhd_prot_ring_attach */
+
+
+/**
+ * dhd_prot_ring_init - Post the common ring information to dongle.
+ *
+ * Used only for common rings.
+ *
+ * The flowrings information is passed via the create flowring control message
+ * (tx_flowring_create_request_t) sent over the H2D control submission common
+ * ring.
+ */
+static void
+dhd_prot_ring_init(dhd_pub_t *dhd, msgbuf_ring_t *ring)
+{
+       ring->wr = 0;
+       ring->rd = 0;
+       ring->curr_rd = 0;
+
+       /* CAUTION: ring::base_addr already in Little Endian */
+       dhd_bus_cmn_writeshared(dhd->bus, &ring->base_addr,
+               sizeof(sh_addr_t), RING_BUF_ADDR, ring->idx);
+       dhd_bus_cmn_writeshared(dhd->bus, &ring->max_items,
+               sizeof(uint16), RING_MAX_ITEMS, ring->idx);
+       dhd_bus_cmn_writeshared(dhd->bus, &ring->item_len,
+               sizeof(uint16), RING_ITEM_LEN, ring->idx);
+
+       dhd_bus_cmn_writeshared(dhd->bus, &(ring->wr),
+               sizeof(uint16), RING_WR_UPD, ring->idx);
+       dhd_bus_cmn_writeshared(dhd->bus, &(ring->rd),
+               sizeof(uint16), RING_RD_UPD, ring->idx);
+
+       /* ring inited */
+       ring->inited = TRUE;
+
+} /* dhd_prot_ring_init */
+
+
+/**
+ * dhd_prot_ring_reset - bzero a ring's DMA-ble buffer and cache flush
+ * Reset WR and RD indices to 0.
+ */
+static void
+dhd_prot_ring_reset(dhd_pub_t *dhd, msgbuf_ring_t *ring)
+{
+       DHD_TRACE(("%s\n", __FUNCTION__));
+
+       dhd_dma_buf_reset(dhd, &ring->dma_buf);
+
+       ring->rd = ring->wr = 0;
+       ring->curr_rd = 0;
+}
+
+
+/**
+ * dhd_prot_ring_detach - Detach the DMA-able buffer and any other objects
+ * hanging off the msgbuf_ring.
+ */
+static void
+dhd_prot_ring_detach(dhd_pub_t *dhd, msgbuf_ring_t *ring)
+{
+       dhd_prot_t *prot = dhd->prot;
+       ASSERT(ring);
+
+       ring->inited = FALSE;
+       /* rd = ~0, wr = ring->rd - 1, max_items = 0, len_item = ~0 */
+
+#ifdef BCM_SECURE_DMA
+       if (SECURE_DMA_ENAB(prot->osh)) {
+               SECURE_DMA_UNMAP_ALL(prot->osh, ring->dma_buf.secdma);
+               if (ring->dma_buf.secdma) {
+                       MFREE(prot->osh, ring->dma_buf.secdma, sizeof(sec_cma_info_t));
+               }
+               ring->dma_buf.secdma = NULL;
+       }
+#endif /* BCM_SECURE_DMA */
+
+       /* If the DMA-able buffer was carved out of a pre-reserved contiguous
+        * memory, then simply stop using it.
+        */
+       if (DHD_IS_FLOWRING(ring->idx) && (prot->flowrings_dma_buf.va)) {
+               (void)dhd_dma_buf_audit(dhd, &ring->dma_buf);
+               memset(&ring->dma_buf, 0, sizeof(dhd_dma_buf_t));
+       } else {
+               dhd_dma_buf_free(dhd, &ring->dma_buf);
+       }
+
+} /* dhd_prot_ring_detach */
+
+
+/*
+ * +----------------------------------------------------------------------------
+ * Flowring Pool
+ *
+ * Unlike common rings, which are attached very early on (dhd_prot_attach),
+ * flowrings are dynamically instantiated. Moreover, flowrings may require a
+ * larger DMA-able buffer. To avoid issues with fragmented cache coherent
+ * DMA-able memory, a pre-allocated pool of msgbuf_ring_t is allocated once.
+ * The DMA-able buffers are attached to these pre-allocated msgbuf_ring.
+ *
+ * Each DMA-able buffer may be allocated independently, or may be carved out
+ * of a single large contiguous region that is registered with the protocol
+ * layer into flowrings_dma_buf. On a 64bit platform, this contiguous region
+ * may not span 0x00000000FFFFFFFF (avoid dongle side 64bit ptr arithmetic).
+ *
+ * No flowring pool action is performed in dhd_prot_attach(), as the number
+ * of h2d rings is not yet known.
+ *
+ * In dhd_prot_init(), the dongle advertized number of h2d rings is used to
+ * determine the number of flowrings required, and a pool of msgbuf_rings are
+ * allocated and a DMA-able buffer (carved or allocated) is attached.
+ * See: dhd_prot_flowrings_pool_attach()
+ *
+ * A flowring msgbuf_ring object may be fetched from this pool during flowring
+ * creation, using the flowid. Likewise, flowrings may be freed back into the
+ * pool on flowring deletion.
+ * See: dhd_prot_flowrings_pool_fetch(), dhd_prot_flowrings_pool_release()
+ *
+ * In dhd_prot_detach(), the flowring pool is detached. The DMA-able buffers
+ * are detached (returned back to the carved region or freed), and the pool of
+ * msgbuf_ring and any objects allocated against it are freed.
+ * See: dhd_prot_flowrings_pool_detach()
+ *
+ * In dhd_prot_reset(), the flowring pool is simply reset by returning it to a
+ * state as-if upon an attach. All DMA-able buffers are retained.
+ * Following a dhd_prot_reset(), in a subsequent dhd_prot_init(), the flowring
+ * pool attach will notice that the pool persists and continue to use it. This
+ * will avoid the case of a fragmented DMA-able region.
+ *
+ * +----------------------------------------------------------------------------
+ */
+
+/* Fetch number of H2D flowrings given the total number of h2d rings */
+#define DHD_FLOWRINGS_POOL_TOTAL(h2d_rings_total) \
+       ((h2d_rings_total) - BCMPCIE_H2D_COMMON_MSGRINGS)
+
+/* Conversion of a flowid to a flowring pool index */
+#define DHD_FLOWRINGS_POOL_OFFSET(flowid) \
+       ((flowid) - BCMPCIE_H2D_COMMON_MSGRINGS)
+
+/* Fetch the msgbuf_ring_t from the flowring pool given a flowid */
+#define DHD_RING_IN_FLOWRINGS_POOL(prot, flowid) \
+       (msgbuf_ring_t*)((prot)->h2d_flowrings_pool) + DHD_FLOWRINGS_POOL_OFFSET(flowid)
+
+/* Traverse each flowring in the flowring pool, assigning ring and flowid */
+#define FOREACH_RING_IN_FLOWRINGS_POOL(prot, ring, flowid) \
+       for ((flowid) = DHD_FLOWRING_START_FLOWID, \
+                (ring) = DHD_RING_IN_FLOWRINGS_POOL(prot, flowid); \
+                (flowid) < (prot)->h2d_rings_total; \
+                (flowid)++, (ring)++)
+
+/**
+ * dhd_prot_flowrings_pool_attach - Initialize a pool of flowring msgbuf_ring_t.
+ *
+ * Allocate a pool of msgbuf_ring along with DMA-able buffers for flowrings.
+ * Dongle includes common rings when it advertizes the number of H2D rings.
+ * Allocates a pool of msgbuf_ring_t and invokes dhd_prot_ring_attach to
+ * allocate the DMA-able buffer and initialize each msgbuf_ring_t object.
+ *
+ * dhd_prot_ring_attach is invoked to perform the actual initialization and
+ * attaching the DMA-able buffer.
+ *
+ * Later dhd_prot_flowrings_pool_fetch() may be used to fetch a preallocated and
+ * initialized msgbuf_ring_t object.
+ *
+ * returns BCME_OK=0 on success
+ * returns non-zero negative error value on failure.
+ */
+static int
+dhd_prot_flowrings_pool_attach(dhd_pub_t *dhd)
+{
+       uint16 flowid;
+       msgbuf_ring_t *ring;
+       uint16 h2d_flowrings_total; /* exclude H2D common rings */
+       dhd_prot_t *prot = dhd->prot;
+       char ring_name[RING_NAME_MAX_LENGTH];
+
+       if (prot->h2d_flowrings_pool != NULL) {
+               return BCME_OK; /* dhd_prot_init rentry after a dhd_prot_reset */
+       }
+
+       ASSERT(prot->h2d_rings_total == 0);
+
+       /* h2d_rings_total includes H2D common rings: ctrl and rxbuf subn */
+       prot->h2d_rings_total = (uint16)dhd_bus_max_h2d_queues(dhd->bus);
+
+       if (prot->h2d_rings_total < BCMPCIE_H2D_COMMON_MSGRINGS) {
+               DHD_ERROR(("%s: h2d_rings_total advertized as %u\n",
+                       __FUNCTION__, prot->h2d_rings_total));
+               return BCME_ERROR;
+       }
+
+       /* Subtract number of H2D common rings, to determine number of flowrings */
+       h2d_flowrings_total = DHD_FLOWRINGS_POOL_TOTAL(prot->h2d_rings_total);
+
+       DHD_ERROR(("Attach flowrings pool for %d rings\n", h2d_flowrings_total));
+
+       /* Allocate pool of msgbuf_ring_t objects for all flowrings */
+       prot->h2d_flowrings_pool = (msgbuf_ring_t *)MALLOCZ(prot->osh,
+               (h2d_flowrings_total * sizeof(msgbuf_ring_t)));
+
+       if (prot->h2d_flowrings_pool == NULL) {
+               DHD_ERROR(("%s: flowrings pool for %d flowrings, alloc failure\n",
+                       __FUNCTION__, h2d_flowrings_total));
+               goto fail;
+       }
+
+       /* Setup & Attach a DMA-able buffer to each flowring in the flowring pool */
+       FOREACH_RING_IN_FLOWRINGS_POOL(prot, ring, flowid) {
+               snprintf(ring_name, sizeof(ring_name), "h2dflr_%03u", flowid);
+               ring_name[RING_NAME_MAX_LENGTH - 1] = '\0';
+               if (dhd_prot_ring_attach(dhd, ring, ring_name,
+                       H2DRING_TXPOST_MAX_ITEM, H2DRING_TXPOST_ITEMSIZE,
+                       DHD_FLOWID_TO_RINGID(flowid)) != BCME_OK) {
+                       goto attach_fail;
+               }
+       }
+
+       return BCME_OK;
+
+attach_fail:
+       dhd_prot_flowrings_pool_detach(dhd); /* Free entire pool of flowrings */
+
+fail:
+       prot->h2d_rings_total = 0;
+       return BCME_NOMEM;
+
+} /* dhd_prot_flowrings_pool_attach */
+
+
+/**
+ * dhd_prot_flowrings_pool_reset - Reset all msgbuf_ring_t objects in the pool.
+ * Invokes dhd_prot_ring_reset to perform the actual reset.
+ *
+ * The DMA-able buffer is not freed during reset and neither is the flowring
+ * pool freed.
+ *
+ * dhd_prot_flowrings_pool_reset will be invoked in dhd_prot_reset. Following
+ * the dhd_prot_reset, dhd_prot_init will be re-invoked, and the flowring pool
+ * from a previous flowring pool instantiation will be reused.
+ *
+ * This will avoid a fragmented DMA-able memory condition, if multiple
+ * dhd_prot_reset were invoked to reboot the dongle without a full detach/attach
+ * cycle.
+ */
+static void
+dhd_prot_flowrings_pool_reset(dhd_pub_t *dhd)
+{
+       uint16 flowid;
+       msgbuf_ring_t *ring;
+       dhd_prot_t *prot = dhd->prot;
+
+       if (prot->h2d_flowrings_pool == NULL) {
+               ASSERT(prot->h2d_rings_total == 0);
+               return;
+       }
+
+       /* Reset each flowring in the flowring pool */
+       FOREACH_RING_IN_FLOWRINGS_POOL(prot, ring, flowid) {
+               dhd_prot_ring_reset(dhd, ring);
+               ring->inited = FALSE;
+       }
+
+       /* Flowring pool state must be as-if dhd_prot_flowrings_pool_attach */
+}
+
+
+/**
+ * dhd_prot_flowrings_pool_detach - Free pool of msgbuf_ring along with
+ * DMA-able buffers for flowrings.
+ * dhd_prot_ring_detach is invoked to free the DMA-able buffer and perform any
+ * de-initialization of each msgbuf_ring_t.
+ */
+static void
+dhd_prot_flowrings_pool_detach(dhd_pub_t *dhd)
+{
+       int flowid;
+       msgbuf_ring_t *ring;
+       int h2d_flowrings_total; /* exclude H2D common rings */
+       dhd_prot_t *prot = dhd->prot;
+
+       if (prot->h2d_flowrings_pool == NULL) {
+               ASSERT(prot->h2d_rings_total == 0);
+               return;
+       }
+
+       /* Detach the DMA-able buffer for each flowring in the flowring pool */
+       FOREACH_RING_IN_FLOWRINGS_POOL(prot, ring, flowid) {
+               dhd_prot_ring_detach(dhd, ring);
+       }
+
+       h2d_flowrings_total = DHD_FLOWRINGS_POOL_TOTAL(prot->h2d_rings_total);
+
+       MFREE(prot->osh, prot->h2d_flowrings_pool,
+               (h2d_flowrings_total * sizeof(msgbuf_ring_t)));
+
+       prot->h2d_flowrings_pool = (msgbuf_ring_t*)NULL;
+       prot->h2d_rings_total = 0;
+
+} /* dhd_prot_flowrings_pool_detach */
+
+
+/**
+ * dhd_prot_flowrings_pool_fetch - Fetch a preallocated and initialized
+ * msgbuf_ring from the flowring pool, and assign it.
+ *
+ * Unlike common rings, which uses a dhd_prot_ring_init() to pass the common
+ * ring information to the dongle, a flowring's information is passed via a
+ * flowring create control message.
+ *
+ * Only the ring state (WR, RD) index are initialized.
+ */
+static msgbuf_ring_t *
+dhd_prot_flowrings_pool_fetch(dhd_pub_t *dhd, uint16 flowid)
+{
+       msgbuf_ring_t *ring;
+       dhd_prot_t *prot = dhd->prot;
+
+       ASSERT(flowid >= DHD_FLOWRING_START_FLOWID);
+       ASSERT(flowid < prot->h2d_rings_total);
+       ASSERT(prot->h2d_flowrings_pool != NULL);
+
+       ring = DHD_RING_IN_FLOWRINGS_POOL(prot, flowid);
+
+       /* ASSERT flow_ring->inited == FALSE */
+
+       ring->wr = 0;
+       ring->rd = 0;
+       ring->curr_rd = 0;
+       ring->inited = TRUE;
+
+       return ring;
+}
+
+
+/**
+ * dhd_prot_flowrings_pool_release - release a previously fetched flowring's
+ * msgbuf_ring back to the flow_ring pool.
+ */
+void
+dhd_prot_flowrings_pool_release(dhd_pub_t *dhd, uint16 flowid, void *flow_ring)
+{
+       msgbuf_ring_t *ring;
+       dhd_prot_t *prot = dhd->prot;
+
+       ASSERT(flowid >= DHD_FLOWRING_START_FLOWID);
+       ASSERT(flowid < prot->h2d_rings_total);
+       ASSERT(prot->h2d_flowrings_pool != NULL);
+
+       ring = DHD_RING_IN_FLOWRINGS_POOL(prot, flowid);
+
+       ASSERT(ring == (msgbuf_ring_t*)flow_ring);
+       /* ASSERT flow_ring->inited == TRUE */
+
+       (void)dhd_dma_buf_audit(dhd, &ring->dma_buf);
+
+       ring->wr = 0;
+       ring->rd = 0;
+       ring->inited = FALSE;
+
+       ring->curr_rd = 0;
+}
+
+
+/* Assumes only one index is updated at a time */
+/* If exactly_nitems is true, this function will allocate space for nitems or fail */
+/*    Exception: when wrap around is encountered, to prevent hangup (last nitems of ring buffer) */
+/* If exactly_nitems is false, this function will allocate space for nitems or less */
+static void *BCMFASTPATH
+dhd_prot_get_ring_space(msgbuf_ring_t *ring, uint16 nitems, uint16 * alloced,
+       bool exactly_nitems)
+{
+       void *ret_ptr = NULL;
+       uint16 ring_avail_cnt;
+
+       ASSERT(nitems <= ring->max_items);
+
+       ring_avail_cnt = CHECK_WRITE_SPACE(ring->rd, ring->wr, ring->max_items);
+
+       if ((ring_avail_cnt == 0) ||
+              (exactly_nitems && (ring_avail_cnt < nitems) &&
+              ((ring->max_items - ring->wr) >= nitems))) {
+               DHD_INFO(("Space not available: ring %s items %d write %d read %d\n",
+                       ring->name, nitems, ring->wr, ring->rd));
+               return NULL;
+       }
+       *alloced = MIN(nitems, ring_avail_cnt);
+
+       /* Return next available space */
+       ret_ptr = (char *)DHD_RING_BGN_VA(ring) + (ring->wr * ring->item_len);
+
+       /* Update write index */
+       if ((ring->wr + *alloced) == ring->max_items) {
+               ring->wr = 0;
+       } else if ((ring->wr + *alloced) < ring->max_items) {
+               ring->wr += *alloced;
+       } else {
+               /* Should never hit this */
+               ASSERT(0);
+               return NULL;
+       }
+
+       return ret_ptr;
+} /* dhd_prot_get_ring_space */
+
+
+/**
+ * dhd_prot_ring_write_complete - Host updates the new WR index on producing
+ * new messages in a H2D ring. The messages are flushed from cache prior to
+ * posting the new WR index. The new WR index will be updated in the DMA index
+ * array or directly in the dongle's ring state memory.
+ * A PCIE doorbell will be generated to wake up the dongle.
+ */
+static void BCMFASTPATH
+dhd_prot_ring_write_complete(dhd_pub_t *dhd, msgbuf_ring_t * ring, void* p,
+       uint16 nitems)
+{
+       dhd_prot_t *prot = dhd->prot;
+
+       /* cache flush */
+       OSL_CACHE_FLUSH(p, ring->item_len * nitems);
+
+       if (DMA_INDX_ENAB(dhd->dma_h2d_ring_upd_support)) {
+               dhd_prot_dma_indx_set(dhd, ring->wr,
+                       H2D_DMA_INDX_WR_UPD, ring->idx);
+       } else {
+               dhd_bus_cmn_writeshared(dhd->bus, &(ring->wr),
+                       sizeof(uint16), RING_WR_UPD, ring->idx);
+       }
+
+       /* raise h2d interrupt */
+       prot->mb_ring_fn(dhd->bus, ring->wr);
+}
+
+
+/**
+ * dhd_prot_upd_read_idx - Host updates the new RD index on consuming messages
+ * from a D2H ring. The new RD index will be updated in the DMA Index array or
+ * directly in dongle's ring state memory.
+ */
+static void
+dhd_prot_upd_read_idx(dhd_pub_t *dhd, msgbuf_ring_t * ring)
+{
+       /* update read index */
+       /* If dma'ing h2d indices supported
+        * update the r -indices in the
+        * host memory o/w in TCM
+        */
+       if (DMA_INDX_ENAB(dhd->dma_h2d_ring_upd_support)) {
+               dhd_prot_dma_indx_set(dhd, ring->rd,
+                       D2H_DMA_INDX_RD_UPD, ring->idx);
+       } else {
+               dhd_bus_cmn_writeshared(dhd->bus, &(ring->rd),
+                       sizeof(uint16), RING_RD_UPD, ring->idx);
+       }
+}
+
+
+/**
+ * dhd_prot_dma_indx_set - set a new WR or RD index in the DMA index array.
+ * Dongle will DMA the entire array (if DMA_INDX feature is enabled).
+ * See dhd_prot_dma_indx_init()
+ */
+static void
+dhd_prot_dma_indx_set(dhd_pub_t *dhd, uint16 new_index, uint8 type, uint16 ringid)
+{
+       uint8 *ptr;
+       uint16 offset;
+       dhd_prot_t *prot = dhd->prot;
+
+       switch (type) {
+               case H2D_DMA_INDX_WR_UPD:
+                       ptr = (uint8 *)(prot->h2d_dma_indx_wr_buf.va);
+                       offset = DHD_H2D_RING_OFFSET(ringid);
+                       break;
+
+               case D2H_DMA_INDX_RD_UPD:
+                       ptr = (uint8 *)(prot->d2h_dma_indx_rd_buf.va);
+                       offset = DHD_D2H_RING_OFFSET(ringid);
+                       break;
+
+               default:
+                       DHD_ERROR(("%s: Invalid option for DMAing read/write index\n",
+                               __FUNCTION__));
+                       return;
+       }
+
+       ASSERT(prot->rw_index_sz != 0);
+       ptr += offset * prot->rw_index_sz;
+
+       *(uint16*)ptr = htol16(new_index);
+
+       OSL_CACHE_FLUSH((void *)ptr, prot->rw_index_sz);
+
+       DHD_TRACE(("%s: data %d type %d ringid %d ptr 0x%p offset %d\n",
+               __FUNCTION__, new_index, type, ringid, ptr, offset));
+
+} /* dhd_prot_dma_indx_set */
+
+
+/**
+ * dhd_prot_dma_indx_get - Fetch a WR or RD index from the dongle DMA-ed index
+ * array.
+ * Dongle DMAes an entire array to host memory (if the feature is enabled).
+ * See dhd_prot_dma_indx_init()
+ */
+static uint16
+dhd_prot_dma_indx_get(dhd_pub_t *dhd, uint8 type, uint16 ringid)
+{
+       uint8 *ptr;
+       uint16 data;
+       uint16 offset;
+       dhd_prot_t *prot = dhd->prot;
+
+       switch (type) {
+               case H2D_DMA_INDX_WR_UPD:
+                       ptr = (uint8 *)(prot->h2d_dma_indx_wr_buf.va);
+                       offset = DHD_H2D_RING_OFFSET(ringid);
+                       break;
+
+               case H2D_DMA_INDX_RD_UPD:
+                       ptr = (uint8 *)(prot->h2d_dma_indx_rd_buf.va);
+                       offset = DHD_H2D_RING_OFFSET(ringid);
+                       break;
+
+               case D2H_DMA_INDX_WR_UPD:
+                       ptr = (uint8 *)(prot->d2h_dma_indx_wr_buf.va);
+                       offset = DHD_D2H_RING_OFFSET(ringid);
+                       break;
+
+               case D2H_DMA_INDX_RD_UPD:
+                       ptr = (uint8 *)(prot->d2h_dma_indx_rd_buf.va);
+                       offset = DHD_D2H_RING_OFFSET(ringid);
+                       break;
+
+               default:
+                       DHD_ERROR(("%s: Invalid option for DMAing read/write index\n",
+                               __FUNCTION__));
+                       return 0;
+       }
+
+       ASSERT(prot->rw_index_sz != 0);
+       ptr += offset * prot->rw_index_sz;
+
+       OSL_CACHE_INV((void *)ptr, prot->rw_index_sz);
+
+       data = LTOH16(*((uint16*)ptr));
+
+       DHD_TRACE(("%s: data %d type %d ringid %d ptr 0x%p offset %d\n",
+               __FUNCTION__, data, type, ringid, ptr, offset));
+
+       return (data);
+
+} /* dhd_prot_dma_indx_get */
+
+/**
+ * An array of DMA read/write indices, containing information about host rings, can be maintained
+ * either in host memory or in device memory, dependent on preprocessor options. This function is,
+ * dependent on these options, called during driver initialization. It reserves and initializes
+ * blocks of DMA'able host memory containing an array of DMA read or DMA write indices. The physical
+ * address of these host memory blocks are communicated to the dongle later on. By reading this host
+ * memory, the dongle learns about the state of the host rings.
+ */
+
+static INLINE int
+dhd_prot_dma_indx_alloc(dhd_pub_t *dhd, uint8 type,
+       dhd_dma_buf_t *dma_buf, uint32 bufsz)
+{
+       int rc;
+
+       if ((dma_buf->len == bufsz) || (dma_buf->va != NULL))
+               return BCME_OK;
+
+       rc = dhd_dma_buf_alloc(dhd, dma_buf, bufsz);
+
+       return rc;
+}
+
+int
+dhd_prot_dma_indx_init(dhd_pub_t *dhd, uint32 rw_index_sz, uint8 type, uint32 length)
+{
+       uint32 bufsz;
+       dhd_prot_t *prot = dhd->prot;
+       dhd_dma_buf_t *dma_buf;
+
+       if (prot == NULL) {
+               DHD_ERROR(("prot is not inited\n"));
+               return BCME_ERROR;
+       }
+
+       /* Dongle advertizes 2B or 4B RW index size */
+       ASSERT(rw_index_sz != 0);
+       prot->rw_index_sz = rw_index_sz;
+
+       bufsz = rw_index_sz * length;
+
+       switch (type) {
+               case H2D_DMA_INDX_WR_BUF:
+                       dma_buf = &prot->h2d_dma_indx_wr_buf;
+                       if (dhd_prot_dma_indx_alloc(dhd, type, dma_buf, bufsz)) {
+                               goto ret_no_mem;
+                       }
+                       DHD_ERROR(("H2D DMA WR INDX : array size %d = %d * %d\n",
+                               dma_buf->len, rw_index_sz, length));
+                       break;
+
+               case H2D_DMA_INDX_RD_BUF:
+                       dma_buf = &prot->h2d_dma_indx_rd_buf;
+                       if (dhd_prot_dma_indx_alloc(dhd, type, dma_buf, bufsz)) {
+                               goto ret_no_mem;
+                       }
+                       DHD_ERROR(("H2D DMA RD INDX : array size %d = %d * %d\n",
+                               dma_buf->len, rw_index_sz, length));
+                       break;
+
+               case D2H_DMA_INDX_WR_BUF:
+                       dma_buf = &prot->d2h_dma_indx_wr_buf;
+                       if (dhd_prot_dma_indx_alloc(dhd, type, dma_buf, bufsz)) {
+                               goto ret_no_mem;
+                       }
+                       DHD_ERROR(("D2H DMA WR INDX : array size %d = %d * %d\n",
+                               dma_buf->len, rw_index_sz, length));
+                       break;
+
+               case D2H_DMA_INDX_RD_BUF:
+                       dma_buf = &prot->d2h_dma_indx_rd_buf;
+                       if (dhd_prot_dma_indx_alloc(dhd, type, dma_buf, bufsz)) {
+                               goto ret_no_mem;
+                       }
+                       DHD_ERROR(("D2H DMA RD INDX : array size %d = %d * %d\n",
+                               dma_buf->len, rw_index_sz, length));
+                       break;
+
+               default:
+                       DHD_ERROR(("%s: Unexpected option\n", __FUNCTION__));
+                       return BCME_BADOPTION;
+       }
+
+       return BCME_OK;
+
+ret_no_mem:
+       DHD_ERROR(("%s: dhd_prot_dma_indx_alloc type %d buf_sz %d failure\n",
+               __FUNCTION__, type, bufsz));
+       return BCME_NOMEM;
+
+} /* dhd_prot_dma_indx_init */
+
+
+/**
+ * Called on checking for 'completion' messages from the dongle. Returns next host buffer to read
+ * from, or NULL if there are no more messages to read.
+ */
+static uint8*
+dhd_prot_get_read_addr(dhd_pub_t *dhd, msgbuf_ring_t *ring, uint32 *available_len)
+{
+       uint16 wr;
+       uint16 rd;
+       uint16 depth;
+       uint16 items;
+       void  *read_addr = NULL; /* address of next msg to be read in ring */
+       uint16 d2h_wr = 0;
+
+       DHD_TRACE(("%s: d2h_dma_indx_rd_buf %p, d2h_dma_indx_wr_buf %p\n",
+               __FUNCTION__, (uint32 *)(dhd->prot->d2h_dma_indx_rd_buf.va),
+               (uint32 *)(dhd->prot->d2h_dma_indx_wr_buf.va)));
+
+       /* Remember the read index in a variable.
+        * This is becuase ring->rd gets updated in the end of this function
+        * So if we have to print the exact read index from which the
+        * message is read its not possible.
+        */
+       ring->curr_rd = ring->rd;
+
+       /* update write pointer */
+       if (DMA_INDX_ENAB(dhd->dma_d2h_ring_upd_support)) {
+               /* DMAing write/read indices supported */
+               d2h_wr = dhd_prot_dma_indx_get(dhd, D2H_DMA_INDX_WR_UPD, ring->idx);
+               ring->wr = d2h_wr;
+       } else {
+               dhd_bus_cmn_readshared(dhd->bus, &(ring->wr), RING_WR_UPD, ring->idx);
+       }
+
+       wr = ring->wr;
+       rd = ring->rd;
+       depth = ring->max_items;
+
+       /* check for avail space, in number of ring items */
+       items = READ_AVAIL_SPACE(wr, rd, depth);
+       if (items == 0) {
+               return NULL;
+       }
+
+       ASSERT(items < ring->max_items);
+
+       /*
+        * Note that there are builds where Assert translates to just printk
+        * so, even if we had hit this condition we would never halt. Now
+        * dhd_prot_process_msgtype can get into an big loop if this
+        * happens.
+        */
+       if (items >= ring->max_items) {
+               DHD_ERROR(("\r\n======================= \r\n"));
+               DHD_ERROR(("%s(): ring %p, ring->name %s, ring->max_items %d, items %d \r\n",
+                       __FUNCTION__, ring, ring->name, ring->max_items, items));
+               DHD_ERROR(("wr: %d,  rd: %d,  depth: %d  \r\n", wr, rd, depth));
+               DHD_ERROR(("dhd->busstate %d bus->suspended %d bus->wait_for_d3_ack %d \r\n",
+                       dhd->busstate, dhd->bus->suspended, dhd->bus->wait_for_d3_ack));
+               DHD_ERROR(("\r\n======================= \r\n"));
+
+               *available_len = 0;
+               return NULL;
+       }
+
+       /* if space is available, calculate address to be read */
+       read_addr = (char*)ring->dma_buf.va + (rd * ring->item_len);
+
+       /* update read pointer */
+       if ((ring->rd + items) >= ring->max_items) {
+               ring->rd = 0;
+       } else {
+               ring->rd += items;
+       }
+
+       ASSERT(ring->rd < ring->max_items);
+
+       /* convert items to bytes : available_len must be 32bits */
+       *available_len = (uint32)(items * ring->item_len);
+
+       OSL_CACHE_INV(read_addr, *available_len);
+
+       /* return read address */
+       return read_addr;
+
+} /* dhd_prot_get_read_addr */
+
+/** Creates a flow ring and informs dongle of this event */
+int
+dhd_prot_flow_ring_create(dhd_pub_t *dhd, flow_ring_node_t *flow_ring_node)
+{
+       tx_flowring_create_request_t *flow_create_rqst;
+       msgbuf_ring_t *flow_ring;
+       dhd_prot_t *prot = dhd->prot;
+       unsigned long flags;
+       uint16 alloced = 0;
+       msgbuf_ring_t *ctrl_ring = &prot->h2dring_ctrl_subn;
+
+       /* Fetch a pre-initialized msgbuf_ring from the flowring pool */
+       flow_ring = dhd_prot_flowrings_pool_fetch(dhd, flow_ring_node->flowid);
+       if (flow_ring == NULL) {
+               DHD_ERROR(("%s: dhd_prot_flowrings_pool_fetch TX Flowid %d failed\n",
+                       __FUNCTION__, flow_ring_node->flowid));
+               return BCME_NOMEM;
+       }
+
+       DHD_GENERAL_LOCK(dhd, flags);
+
+       /* Request for ctrl_ring buffer space */
+       flow_create_rqst = (tx_flowring_create_request_t *)
+               dhd_prot_alloc_ring_space(dhd, ctrl_ring, 1, &alloced, FALSE);
+
+       if (flow_create_rqst == NULL) {
+               dhd_prot_flowrings_pool_release(dhd, flow_ring_node->flowid, flow_ring);
+               DHD_ERROR(("%s: Flow Create Req flowid %d - failure ring space\n",
+                       __FUNCTION__, flow_ring_node->flowid));
+               DHD_GENERAL_UNLOCK(dhd, flags);
+               return BCME_NOMEM;
+       }
+
+       flow_ring_node->prot_info = (void *)flow_ring;
+
+       /* Common msg buf hdr */
+       flow_create_rqst->msg.msg_type = MSG_TYPE_FLOW_RING_CREATE;
+       flow_create_rqst->msg.if_id = (uint8)flow_ring_node->flow_info.ifindex;
+       flow_create_rqst->msg.request_id = htol32(0); /* TBD */
+
+       flow_create_rqst->msg.epoch = ctrl_ring->seqnum % H2D_EPOCH_MODULO;
+       ctrl_ring->seqnum++;
+
+       /* Update flow create message */
+       flow_create_rqst->tid = flow_ring_node->flow_info.tid;
+       flow_create_rqst->flow_ring_id = htol16((uint16)flow_ring_node->flowid);
+       memcpy(flow_create_rqst->sa, flow_ring_node->flow_info.sa, sizeof(flow_create_rqst->sa));
+       memcpy(flow_create_rqst->da, flow_ring_node->flow_info.da, sizeof(flow_create_rqst->da));
+       /* CAUTION: ring::base_addr already in Little Endian */
+       flow_create_rqst->flow_ring_ptr.low_addr = flow_ring->base_addr.low_addr;
+       flow_create_rqst->flow_ring_ptr.high_addr = flow_ring->base_addr.high_addr;
+       flow_create_rqst->max_items = htol16(H2DRING_TXPOST_MAX_ITEM);
+       flow_create_rqst->len_item = htol16(H2DRING_TXPOST_ITEMSIZE);
+       DHD_ERROR(("%s: Send Flow Create Req flow ID %d for peer " MACDBG
+               " prio %d ifindex %d\n", __FUNCTION__, flow_ring_node->flowid,
+               MAC2STRDBG(flow_ring_node->flow_info.da), flow_ring_node->flow_info.tid,
+               flow_ring_node->flow_info.ifindex));
+
+       /* Update the flow_ring's WRITE index */
+       if (DMA_INDX_ENAB(dhd->dma_h2d_ring_upd_support)) {
+               dhd_prot_dma_indx_set(dhd, flow_ring->wr,
+                       H2D_DMA_INDX_WR_UPD, flow_ring->idx);
+       } else {
+               dhd_bus_cmn_writeshared(dhd->bus, &(flow_ring->wr),
+                       sizeof(uint16), RING_WR_UPD, flow_ring->idx);
+       }
+
+       /* update control subn ring's WR index and ring doorbell to dongle */
+       dhd_prot_ring_write_complete(dhd, ctrl_ring, flow_create_rqst, 1);
+
+       DHD_GENERAL_UNLOCK(dhd, flags);
+
+       return BCME_OK;
+} /* dhd_prot_flow_ring_create */
+
+/** called on receiving MSG_TYPE_FLOW_RING_CREATE_CMPLT message from dongle */
+static void
+dhd_prot_flow_ring_create_response_process(dhd_pub_t *dhd, void *msg)
+{
+       tx_flowring_create_response_t *flow_create_resp = (tx_flowring_create_response_t *)msg;
+
+       DHD_ERROR(("%s: Flow Create Response status = %d Flow %d\n", __FUNCTION__,
+               ltoh16(flow_create_resp->cmplt.status),
+               ltoh16(flow_create_resp->cmplt.flow_ring_id)));
+
+       dhd_bus_flow_ring_create_response(dhd->bus,
+               ltoh16(flow_create_resp->cmplt.flow_ring_id),
+               ltoh16(flow_create_resp->cmplt.status));
+}
+
+/** called on e.g. flow ring delete */
+void dhd_prot_clean_flow_ring(dhd_pub_t *dhd, void *msgbuf_flow_info)
+{
+       msgbuf_ring_t *flow_ring = (msgbuf_ring_t *)msgbuf_flow_info;
+       dhd_prot_ring_detach(dhd, flow_ring);
+       DHD_INFO(("%s Cleaning up Flow \n", __FUNCTION__));
+}
+
+void dhd_prot_print_flow_ring(dhd_pub_t *dhd, void *msgbuf_flow_info,
+       struct bcmstrbuf *strbuf, const char * fmt)
+{
+       const char *default_fmt = "RD %d WR %d BASE(VA) %p BASE(PA) %x:%x SIZE %d\n";
+       msgbuf_ring_t *flow_ring = (msgbuf_ring_t *)msgbuf_flow_info;
+       uint16 rd, wr;
+       uint32 dma_buf_len = flow_ring->max_items * flow_ring->item_len;
+
+       if (fmt == NULL) {
+               fmt = default_fmt;
+       }
+       dhd_bus_cmn_readshared(dhd->bus, &rd, RING_RD_UPD, flow_ring->idx);
+       dhd_bus_cmn_readshared(dhd->bus, &wr, RING_WR_UPD, flow_ring->idx);
+       bcm_bprintf(strbuf, fmt, rd, wr, flow_ring->dma_buf.va,
+               ltoh32(flow_ring->base_addr.high_addr),
+               ltoh32(flow_ring->base_addr.low_addr), dma_buf_len);
+}
+
+void dhd_prot_print_info(dhd_pub_t *dhd, struct bcmstrbuf *strbuf)
+{
+       dhd_prot_t *prot = dhd->prot;
+       bcm_bprintf(strbuf,
+               "%8s %4s %4s %5s %17s %17s %7s\n",
+               "Type", "RBP", "RD", "WR", "BASE(VA)", "BASE(PA)", "SIZE");
+       bcm_bprintf(strbuf, "%8s %4s", "CtrlPost", "NA");
+       dhd_prot_print_flow_ring(dhd, &prot->h2dring_ctrl_subn, strbuf,
+               "%5d %5d %17p %8x:%8x %7d\n");
+       bcm_bprintf(strbuf, "%8s %4s", "CtrlCpl", "NA");
+       dhd_prot_print_flow_ring(dhd, &prot->d2hring_ctrl_cpln, strbuf,
+               "%5d %5d %17p %8x:%8x %7d\n");
+       bcm_bprintf(strbuf, "%8s %4d", "RxPost", prot->rxbufpost);
+       dhd_prot_print_flow_ring(dhd, &prot->h2dring_rxp_subn, strbuf,
+                "%5d %5d %17p %8x:%8x %7d\n");
+       bcm_bprintf(strbuf, "%8s %4s", "RxCpl", "NA");
+       dhd_prot_print_flow_ring(dhd, &prot->d2hring_rx_cpln, strbuf,
+               "%5d %5d %17p %8x:%8x %7d\n");
+       bcm_bprintf(strbuf, "%8s %4s", "TxCpl", "NA");
+       dhd_prot_print_flow_ring(dhd, &prot->d2hring_tx_cpln, strbuf,
+               "%5d %5d %17p %8x:%8x %7d\n");
+       bcm_bprintf(strbuf, "active_tx_count %d  pktidmap_avail %d\n",
+               dhd->prot->active_tx_count,
+               DHD_PKTID_AVAIL(dhd->prot->pktid_map_handle));
+}
+
+int
+dhd_prot_flow_ring_delete(dhd_pub_t *dhd, flow_ring_node_t *flow_ring_node)
+{
+       tx_flowring_delete_request_t *flow_delete_rqst;
+       dhd_prot_t *prot = dhd->prot;
+       unsigned long flags;
+       uint16 alloced = 0;
+       msgbuf_ring_t *ring = &prot->h2dring_ctrl_subn;
+
+       DHD_GENERAL_LOCK(dhd, flags);
+
+       /* Request for ring buffer space */
+       flow_delete_rqst = (tx_flowring_delete_request_t *)
+               dhd_prot_alloc_ring_space(dhd, ring, 1, &alloced, FALSE);
+
+       if (flow_delete_rqst == NULL) {
+               DHD_GENERAL_UNLOCK(dhd, flags);
+               DHD_ERROR(("%s: Flow Delete Req - failure ring space\n", __FUNCTION__));
+               return BCME_NOMEM;
+       }
+
+       /* Common msg buf hdr */
+       flow_delete_rqst->msg.msg_type = MSG_TYPE_FLOW_RING_DELETE;
+       flow_delete_rqst->msg.if_id = (uint8)flow_ring_node->flow_info.ifindex;
+       flow_delete_rqst->msg.request_id = htol32(0); /* TBD */
+
+       flow_delete_rqst->msg.epoch = ring->seqnum % H2D_EPOCH_MODULO;
+       ring->seqnum++;
+
+       /* Update Delete info */
+       flow_delete_rqst->flow_ring_id = htol16((uint16)flow_ring_node->flowid);
+       flow_delete_rqst->reason = htol16(BCME_OK);
+
+       DHD_ERROR(("%s: Send Flow Delete Req RING ID %d for peer " MACDBG
+               " prio %d ifindex %d\n", __FUNCTION__, flow_ring_node->flowid,
+               MAC2STRDBG(flow_ring_node->flow_info.da), flow_ring_node->flow_info.tid,
+               flow_ring_node->flow_info.ifindex));
+
+       /* update ring's WR index and ring doorbell to dongle */
+       dhd_prot_ring_write_complete(dhd, ring, flow_delete_rqst, 1);
+       DHD_GENERAL_UNLOCK(dhd, flags);
+
+       return BCME_OK;
+}
+
+static void
+dhd_prot_flow_ring_delete_response_process(dhd_pub_t *dhd, void *msg)
+{
+       tx_flowring_delete_response_t *flow_delete_resp = (tx_flowring_delete_response_t *)msg;
+
+       DHD_ERROR(("%s: Flow Delete Response status = %d Flow %d\n", __FUNCTION__,
+               flow_delete_resp->cmplt.status, flow_delete_resp->cmplt.flow_ring_id));
+
+       dhd_bus_flow_ring_delete_response(dhd->bus, flow_delete_resp->cmplt.flow_ring_id,
+               flow_delete_resp->cmplt.status);
+}
+
+int
+dhd_prot_flow_ring_flush(dhd_pub_t *dhd, flow_ring_node_t *flow_ring_node)
+{
+       tx_flowring_flush_request_t *flow_flush_rqst;
+       dhd_prot_t *prot = dhd->prot;
+       unsigned long flags;
+       uint16 alloced = 0;
+       msgbuf_ring_t *ring = &prot->h2dring_ctrl_subn;
+
+       DHD_GENERAL_LOCK(dhd, flags);
+
+       /* Request for ring buffer space */
+       flow_flush_rqst = (tx_flowring_flush_request_t *)
+               dhd_prot_alloc_ring_space(dhd, ring, 1, &alloced, FALSE);
+       if (flow_flush_rqst == NULL) {
+               DHD_GENERAL_UNLOCK(dhd, flags);
+               DHD_ERROR(("%s: Flow Flush Req - failure ring space\n", __FUNCTION__));
+               return BCME_NOMEM;
+       }
+
+       /* Common msg buf hdr */
+       flow_flush_rqst->msg.msg_type = MSG_TYPE_FLOW_RING_FLUSH;
+       flow_flush_rqst->msg.if_id = (uint8)flow_ring_node->flow_info.ifindex;
+       flow_flush_rqst->msg.request_id = htol32(0); /* TBD */
+
+       flow_flush_rqst->msg.epoch = ring->seqnum % H2D_EPOCH_MODULO;
+       ring->seqnum++;
+
+       flow_flush_rqst->flow_ring_id = htol16((uint16)flow_ring_node->flowid);
+       flow_flush_rqst->reason = htol16(BCME_OK);
+
+       DHD_INFO(("%s: Send Flow Flush Req\n", __FUNCTION__));
+
+       /* update ring's WR index and ring doorbell to dongle */
+       dhd_prot_ring_write_complete(dhd, ring, flow_flush_rqst, 1);
+       DHD_GENERAL_UNLOCK(dhd, flags);
+
+       return BCME_OK;
+} /* dhd_prot_flow_ring_flush */
+
+static void
+dhd_prot_flow_ring_flush_response_process(dhd_pub_t *dhd, void *msg)
+{
+       tx_flowring_flush_response_t *flow_flush_resp = (tx_flowring_flush_response_t *)msg;
+
+       DHD_INFO(("%s: Flow Flush Response status = %d\n", __FUNCTION__,
+               flow_flush_resp->cmplt.status));
+
+       dhd_bus_flow_ring_flush_response(dhd->bus, flow_flush_resp->cmplt.flow_ring_id,
+               flow_flush_resp->cmplt.status);
+}
+
+/**
+ * Request dongle to configure soft doorbells for D2H rings. Host populated soft
+ * doorbell information is transferred to dongle via the d2h ring config control
+ * message.
+ */
+void
+dhd_msgbuf_ring_config_d2h_soft_doorbell(dhd_pub_t *dhd)
+{
+#if defined(DHD_D2H_SOFT_DOORBELL_SUPPORT)
+       uint16 ring_idx;
+       uint8 *msg_next;
+       void *msg_start;
+       uint16 alloced = 0;
+       unsigned long flags;
+       dhd_prot_t *prot = dhd->prot;
+       ring_config_req_t *ring_config_req;
+       bcmpcie_soft_doorbell_t *soft_doorbell;
+       msgbuf_ring_t *ctrl_ring = &prot->h2dring_ctrl_subn;
+       const uint16 d2h_rings = BCMPCIE_D2H_COMMON_MSGRINGS;
+
+       /* Claim space for d2h_ring number of d2h_ring_config_req_t messages */
+       DHD_GENERAL_LOCK(dhd, flags);
+       msg_start = dhd_prot_alloc_ring_space(dhd, ctrl_ring, d2h_rings, &alloced, TRUE);
+
+       if (msg_start == NULL) {
+               DHD_ERROR(("%s Msgbuf no space for %d D2H ring config soft doorbells\n",
+                       __FUNCTION__, d2h_rings));
+               DHD_GENERAL_UNLOCK(dhd, flags);
+               return;
+       }
+
+       msg_next = (uint8*)msg_start;
+
+       for (ring_idx = 0; ring_idx < d2h_rings; ring_idx++) {
+
+               /* position the ring_config_req into the ctrl subm ring */
+               ring_config_req = (ring_config_req_t *)msg_next;
+
+               /* Common msg header */
+               ring_config_req->msg.msg_type = MSG_TYPE_D2H_RING_CONFIG;
+               ring_config_req->msg.if_id = 0;
+               ring_config_req->msg.flags = 0;
+
+               ring_config_req->msg.epoch = ctrl_ring->seqnum % H2D_EPOCH_MODULO;
+               ctrl_ring->seqnum++;
+
+               ring_config_req->msg.request_id = htol32(DHD_FAKE_PKTID); /* unused */
+
+               /* Ring Config subtype and d2h ring_id */
+               ring_config_req->subtype = htol16(D2H_RING_CONFIG_SUBTYPE_SOFT_DOORBELL);
+               ring_config_req->ring_id = htol16(DHD_D2H_RINGID(ring_idx));
+
+               /* Host soft doorbell configuration */
+               soft_doorbell = &prot->soft_doorbell[ring_idx];
+
+               ring_config_req->soft_doorbell.value = htol32(soft_doorbell->value);
+               ring_config_req->soft_doorbell.haddr.high =
+                       htol32(soft_doorbell->haddr.high);
+               ring_config_req->soft_doorbell.haddr.low =
+                       htol32(soft_doorbell->haddr.low);
+               ring_config_req->soft_doorbell.items = htol16(soft_doorbell->items);
+               ring_config_req->soft_doorbell.msecs = htol16(soft_doorbell->msecs);
+
+               DHD_INFO(("%s: Soft doorbell haddr 0x%08x 0x%08x value 0x%08x\n",
+                       __FUNCTION__, ring_config_req->soft_doorbell.haddr.high,
+                       ring_config_req->soft_doorbell.haddr.low,
+                       ring_config_req->soft_doorbell.value));
+
+               msg_next = msg_next + ctrl_ring->item_len;
+       }
+
+       /* update control subn ring's WR index and ring doorbell to dongle */
+       dhd_prot_ring_write_complete(dhd, ctrl_ring, msg_start, d2h_rings);
+       DHD_GENERAL_UNLOCK(dhd, flags);
+#endif /* DHD_D2H_SOFT_DOORBELL_SUPPORT */
+}
+
+static void
+dhd_prot_d2h_ring_config_cmplt_process(dhd_pub_t *dhd, void *msg)
+{
+       DHD_INFO(("%s: Ring Config Response - status %d ringid %d\n",
+               __FUNCTION__, ltoh16(((ring_config_resp_t *)msg)->compl_hdr.status),
+               ltoh16(((ring_config_resp_t *)msg)->compl_hdr.flow_ring_id)));
+}
+
+int
+dhd_prot_debug_info_print(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot = dhd->prot;
+       msgbuf_ring_t *ring;
+       uint16 rd, wr;
+       uint32 intstatus = 0;
+       uint32 intmask = 0;
+       uint32 mbintstatus = 0;
+       uint32 d2h_mb_data = 0;
+       uint32 dma_buf_len;
+
+       DHD_ERROR(("\n ------- DUMPING IOCTL RING RD WR Pointers ------- \r\n"));
+
+       ring = &prot->h2dring_ctrl_subn;
+       dma_buf_len = ring->max_items * ring->item_len;
+       DHD_ERROR(("CtrlPost: Mem Info: BASE(VA) %p BASE(PA) %x:%x SIZE %d \r\n",
+               ring->dma_buf.va, ltoh32(ring->base_addr.high_addr),
+               ltoh32(ring->base_addr.low_addr), dma_buf_len));
+       DHD_ERROR(("CtrlPost: From Host mem: RD: %d WR %d \r\n", ring->rd, ring->wr));
+       dhd_bus_cmn_readshared(dhd->bus, &rd, RING_RD_UPD, ring->idx);
+       dhd_bus_cmn_readshared(dhd->bus, &wr, RING_WR_UPD, ring->idx);
+       DHD_ERROR(("CtrlPost: From Shared Mem: RD: %d WR %d \r\n", rd, wr));
+
+       ring = &prot->d2hring_ctrl_cpln;
+       dma_buf_len = ring->max_items * ring->item_len;
+       DHD_ERROR(("CtrlCpl: Mem Info: BASE(VA) %p BASE(PA) %x:%x SIZE %d \r\n",
+               ring->dma_buf.va, ltoh32(ring->base_addr.high_addr),
+               ltoh32(ring->base_addr.low_addr), dma_buf_len));
+       DHD_ERROR(("CtrlCpl: From Host mem: RD: %d WR %d \r\n", ring->rd, ring->wr));
+       dhd_bus_cmn_readshared(dhd->bus, &rd, RING_RD_UPD, ring->idx);
+       dhd_bus_cmn_readshared(dhd->bus, &wr, RING_WR_UPD, ring->idx);
+       DHD_ERROR(("CtrlCpl: From Shared Mem: RD: %d WR %d \r\n", rd, wr));
+       DHD_ERROR(("CtrlCpl: Expected seq num: %d \r\n", ring->seqnum));
+
+       intstatus = si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, PCIMailBoxInt, 0, 0);
+       intmask = si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, PCIMailBoxMask, 0, 0);
+       mbintstatus = si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, PCID2H_MailBox, 0, 0);
+       dhd_bus_cmn_readshared(dhd->bus, &d2h_mb_data, D2H_MB_DATA, 0);
+
+       DHD_ERROR(("\n ------- DUMPING INTR Status and Masks ------- \r\n"));
+       DHD_ERROR(("intstatus=0x%x intmask=0x%x mbintstatus=0x%x\n,",
+               intstatus, intmask, mbintstatus));
+       DHD_ERROR(("d2h_mb_data=0x%x def_intmask=0x%x \r\n", d2h_mb_data, dhd->bus->def_intmask));
+
+       return 0;
+}
+
+int
+dhd_prot_ringupd_dump(dhd_pub_t *dhd, struct bcmstrbuf *b)
+{
+       uint32 *ptr;
+       uint32 value;
+       uint32 i;
+       uint32 max_h2d_queues = dhd_bus_max_h2d_queues(dhd->bus);
+
+       OSL_CACHE_INV((void *)dhd->prot->d2h_dma_indx_wr_buf.va,
+               dhd->prot->d2h_dma_indx_wr_buf.len);
+
+       ptr = (uint32 *)(dhd->prot->d2h_dma_indx_wr_buf.va);
+
+       bcm_bprintf(b, "\n max_tx_queues %d\n", max_h2d_queues);
+
+       bcm_bprintf(b, "\nRPTR block H2D common rings, 0x%04x\n", ptr);
+       value = ltoh32(*ptr);
+       bcm_bprintf(b, "\tH2D CTRL: value 0x%04x\n", value);
+       ptr++;
+       value = ltoh32(*ptr);
+       bcm_bprintf(b, "\tH2D RXPOST: value 0x%04x\n", value);
+
+       ptr++;
+       bcm_bprintf(b, "RPTR block Flow rings , 0x%04x\n", ptr);
+       for (i = BCMPCIE_H2D_COMMON_MSGRINGS; i < max_h2d_queues; i++) {
+               value = ltoh32(*ptr);
+               bcm_bprintf(b, "\tflowring ID %d: value 0x%04x\n", i, value);
+               ptr++;
+       }
+
+       OSL_CACHE_INV((void *)dhd->prot->h2d_dma_indx_rd_buf.va,
+               dhd->prot->h2d_dma_indx_rd_buf.len);
+
+       ptr = (uint32 *)(dhd->prot->h2d_dma_indx_rd_buf.va);
+
+       bcm_bprintf(b, "\nWPTR block D2H common rings, 0x%04x\n", ptr);
+       value = ltoh32(*ptr);
+       bcm_bprintf(b, "\tD2H CTRLCPLT: value 0x%04x\n", value);
+       ptr++;
+       value = ltoh32(*ptr);
+       bcm_bprintf(b, "\tD2H TXCPLT: value 0x%04x\n", value);
+       ptr++;
+       value = ltoh32(*ptr);
+       bcm_bprintf(b, "\tD2H RXCPLT: value 0x%04x\n", value);
+
+       return 0;
+}
+
+uint32
+dhd_prot_metadata_dbg_set(dhd_pub_t *dhd, bool val)
+{
+       dhd_prot_t *prot = dhd->prot;
+#if DHD_DBG_SHOW_METADATA
+       prot->metadata_dbg = val;
+#endif
+       return (uint32)prot->metadata_dbg;
+}
+
+uint32
+dhd_prot_metadata_dbg_get(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot = dhd->prot;
+       return (uint32)prot->metadata_dbg;
+}
+
+uint32
+dhd_prot_metadatalen_set(dhd_pub_t *dhd, uint32 val, bool rx)
+{
+       dhd_prot_t *prot = dhd->prot;
+       if (rx)
+               prot->rx_metadata_offset = (uint16)val;
+       else
+               prot->tx_metadata_offset = (uint16)val;
+       return dhd_prot_metadatalen_get(dhd, rx);
+}
+
+uint32
+dhd_prot_metadatalen_get(dhd_pub_t *dhd, bool rx)
+{
+       dhd_prot_t *prot = dhd->prot;
+       if (rx)
+               return prot->rx_metadata_offset;
+       else
+               return prot->tx_metadata_offset;
+}
+
+/** optimization to write "n" tx items at a time to ring */
+uint32
+dhd_prot_txp_threshold(dhd_pub_t *dhd, bool set, uint32 val)
+{
+       dhd_prot_t *prot = dhd->prot;
+       if (set)
+               prot->txp_threshold = (uint16)val;
+       val = prot->txp_threshold;
+       return val;
+}
+
+#ifdef DHD_RX_CHAINING
+
+static INLINE void BCMFASTPATH
+dhd_rxchain_reset(rxchain_info_t *rxchain)
+{
+       rxchain->pkt_count = 0;
+}
+
+static void BCMFASTPATH
+dhd_rxchain_frame(dhd_pub_t *dhd, void *pkt, uint ifidx)
+{
+       uint8 *eh;
+       uint8 prio;
+       dhd_prot_t *prot = dhd->prot;
+       rxchain_info_t *rxchain = &prot->rxchain;
+
+       ASSERT(!PKTISCHAINED(pkt));
+       ASSERT(PKTCLINK(pkt) == NULL);
+       ASSERT(PKTCGETATTR(pkt) == 0);
+
+       eh = PKTDATA(dhd->osh, pkt);
+       prio = IP_TOS46(eh + ETHER_HDR_LEN) >> IPV4_TOS_PREC_SHIFT;
+
+       if (rxchain->pkt_count && !(PKT_CTF_CHAINABLE(dhd, ifidx, eh, prio, rxchain->h_sa,
+               rxchain->h_da, rxchain->h_prio))) {
+               /* Different flow - First release the existing chain */
+               dhd_rxchain_commit(dhd);
+       }
+
+       /* For routers, with HNDCTF, link the packets using PKTSETCLINK, */
+       /* so that the chain can be handed off to CTF bridge as is. */
+       if (rxchain->pkt_count == 0) {
+               /* First packet in chain */
+               rxchain->pkthead = rxchain->pkttail = pkt;
+
+               /* Keep a copy of ptr to ether_da, ether_sa and prio */
+               rxchain->h_da = ((struct ether_header *)eh)->ether_dhost;
+               rxchain->h_sa = ((struct ether_header *)eh)->ether_shost;
+               rxchain->h_prio = prio;
+               rxchain->ifidx = ifidx;
+               rxchain->pkt_count++;
+       } else {
+               /* Same flow - keep chaining */
+               PKTSETCLINK(rxchain->pkttail, pkt);
+               rxchain->pkttail = pkt;
+               rxchain->pkt_count++;
+       }
+
+       if ((!ETHER_ISMULTI(rxchain->h_da)) &&
+               ((((struct ether_header *)eh)->ether_type == HTON16(ETHER_TYPE_IP)) ||
+               (((struct ether_header *)eh)->ether_type == HTON16(ETHER_TYPE_IPV6)))) {
+               PKTSETCHAINED(dhd->osh, pkt);
+               PKTCINCRCNT(rxchain->pkthead);
+               PKTCADDLEN(rxchain->pkthead, PKTLEN(dhd->osh, pkt));
+       } else {
+               dhd_rxchain_commit(dhd);
+               return;
+       }
+
+       /* If we have hit the max chain length, dispatch the chain and reset */
+       if (rxchain->pkt_count >= DHD_PKT_CTF_MAX_CHAIN_LEN) {
+               dhd_rxchain_commit(dhd);
+       }
+}
+
+static void BCMFASTPATH
+dhd_rxchain_commit(dhd_pub_t *dhd)
+{
+       dhd_prot_t *prot = dhd->prot;
+       rxchain_info_t *rxchain = &prot->rxchain;
+
+       if (rxchain->pkt_count == 0)
+               return;
+
+       /* Release the packets to dhd_linux */
+       dhd_bus_rx_frame(dhd->bus, rxchain->pkthead, rxchain->ifidx, rxchain->pkt_count);
+
+       /* Reset the chain */
+       dhd_rxchain_reset(rxchain);
+}
+
+#endif /* DHD_RX_CHAINING */
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_pcie.c b/drivers/net/wireless/bcmdhd_1363/dhd_pcie.c
new file mode 100644 (file)
index 0000000..74926b0
--- /dev/null
@@ -0,0 +1,6139 @@
+/*
+ * DHD Bus Module for PCIE
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_pcie.c 665078 2017-05-18 08:51:32Z $
+ */
+
+
+/* include files */
+#include <typedefs.h>
+#include <bcmutils.h>
+#include <bcmdevs.h>
+#include <siutils.h>
+#include <hndsoc.h>
+#include <hndpmu.h>
+#include <sbchipc.h>
+#include <hnd_armtrap.h>
+#if defined(DHD_DEBUG)
+#include <hnd_cons.h>
+#endif /* defined(DHD_DEBUG) */
+#include <dngl_stats.h>
+#include <pcie_core.h>
+#include <dhd.h>
+#include <dhd_bus.h>
+#include <dhd_flowring.h>
+#include <dhd_proto.h>
+#include <dhd_dbg.h>
+#include <dhdioctl.h>
+#include <sdiovar.h>
+#include <bcmmsgbuf.h>
+#include <pcicfg.h>
+#include <dhd_pcie.h>
+#include <bcmpcie.h>
+#include <bcmendian.h>
+#ifdef DHDTCPACK_SUPPRESS
+#include <dhd_ip.h>
+#endif /* DHDTCPACK_SUPPRESS */
+
+#ifdef BCMEMBEDIMAGE
+#include BCMEMBEDIMAGE
+#endif /* BCMEMBEDIMAGE */
+
+#ifdef PCIE_OOB
+#include "ftdi_sio_external.h"
+#endif /* PCIE_OOB */
+
+#define CISTPL_BRCM_HNBU       0x80
+#define HNBU_CUSTOM1           0x82
+#define HNBU_CUSTOM2           0x83
+#define CISTPL_NULL                    0x00
+#define CISTPL_END                     0xff
+#define CISTPL_OFFSET          0xC0
+#ifdef CUSTOMER_HW2
+#define STARTBUSY_BIT_POLL_MAX_TIME 50
+#endif /* CUSTOMER_HW2 */
+
+#define MAX_WKLK_IDLE_CHECK    3       /* times wake_lock checked before deciding not to suspend */
+
+#define ARMCR4REG_BANKIDX      (0x40/sizeof(uint32))
+#define ARMCR4REG_BANKPDA      (0x4C/sizeof(uint32))
+/* Temporary war to fix precommit till sync issue between trunk & precommit branch is resolved */
+
+#if defined(SUPPORT_MULTIPLE_BOARD_REV)
+       extern unsigned int system_rev;
+#endif /* SUPPORT_MULTIPLE_BOARD_REV */
+
+/* DHD module parameter */
+extern uint32 hw_module_variant;
+
+int dhd_dongle_memsize;
+int dhd_dongle_ramsize;
+static int dhdpcie_checkdied(dhd_bus_t *bus, char *data, uint size);
+#ifdef DHD_DEBUG
+static int dhdpcie_bus_readconsole(dhd_bus_t *bus);
+#endif /* DHD_DEBUG */
+#if defined(DHD_FW_COREDUMP)
+struct dhd_bus *g_dhd_bus = NULL;
+static int dhdpcie_mem_dump(dhd_bus_t *bus);
+#endif /* DHD_FW_COREDUMP */
+
+static int dhdpcie_bus_membytes(dhd_bus_t *bus, bool write, ulong address, uint8 *data, uint size);
+static int dhdpcie_bus_doiovar(dhd_bus_t *bus, const bcm_iovar_t *vi, uint32 actionid,
+       const char *name, void *params,
+       int plen, void *arg, int len, int val_size);
+static int dhdpcie_bus_lpback_req(struct  dhd_bus *bus, uint32 intval);
+static int dhdpcie_bus_dmaxfer_req(struct  dhd_bus *bus,
+       uint32 len, uint32 srcdelay, uint32 destdelay);
+static int dhdpcie_bus_download_state(dhd_bus_t *bus, bool enter);
+static int _dhdpcie_download_firmware(struct dhd_bus *bus);
+static int dhdpcie_download_firmware(dhd_bus_t *bus, osl_t *osh);
+static int dhdpcie_bus_write_vars(dhd_bus_t *bus);
+static bool dhdpcie_bus_process_mailbox_intr(dhd_bus_t *bus, uint32 intstatus);
+static bool dhdpci_bus_read_frames(dhd_bus_t *bus);
+static int dhdpcie_readshared(dhd_bus_t *bus);
+static void dhdpcie_init_shared_addr(dhd_bus_t *bus);
+static bool dhdpcie_dongle_attach(dhd_bus_t *bus);
+static void dhdpcie_bus_dongle_setmemsize(dhd_bus_t *bus, int mem_size);
+static void dhdpcie_bus_release_dongle(dhd_bus_t *bus, osl_t *osh,
+       bool dongle_isolation, bool reset_flag);
+static void dhdpcie_bus_release_malloc(dhd_bus_t *bus, osl_t *osh);
+static int dhdpcie_downloadvars(dhd_bus_t *bus, void *arg, int len);
+static uint8 dhdpcie_bus_rtcm8(dhd_bus_t *bus, ulong offset);
+static void dhdpcie_bus_wtcm8(dhd_bus_t *bus, ulong offset, uint8 data);
+static void dhdpcie_bus_wtcm16(dhd_bus_t *bus, ulong offset, uint16 data);
+static uint16 dhdpcie_bus_rtcm16(dhd_bus_t *bus, ulong offset);
+static void dhdpcie_bus_wtcm32(dhd_bus_t *bus, ulong offset, uint32 data);
+static uint32 dhdpcie_bus_rtcm32(dhd_bus_t *bus, ulong offset);
+static void dhdpcie_bus_wtcm64(dhd_bus_t *bus, ulong offset, uint64 data);
+static uint64 dhdpcie_bus_rtcm64(dhd_bus_t *bus, ulong offset);
+static void dhdpcie_bus_cfg_set_bar0_win(dhd_bus_t *bus, uint32 data);
+static void dhdpcie_bus_reg_unmap(osl_t *osh, ulong addr, int size);
+static int dhdpcie_cc_nvmshadow(dhd_bus_t *bus, struct bcmstrbuf *b);
+static int dhdpcie_sromotp_customvar(dhd_bus_t *bus, uint32 *customvar1, uint32 *customvar2);
+static void dhdpcie_send_mb_data(dhd_bus_t *bus, uint32 h2d_mb_data);
+static void dhd_fillup_ring_sharedptr_info(dhd_bus_t *bus, ring_info_t *ring_info);
+extern void dhd_dpc_kill(dhd_pub_t *dhdp);
+
+#ifdef BCM_AUTO_FWCRC
+extern int dhd_check_firmware_image(char* memptr, char *pfw_path);
+#endif
+#ifdef BCMEMBEDIMAGE
+static int dhdpcie_download_code_array(dhd_bus_t *bus);
+#endif /* BCMEMBEDIMAGE */
+
+
+#ifdef EXYNOS_PCIE_DEBUG
+extern void exynos_pcie_register_dump(int ch_num);
+#endif /* EXYNOS_PCIE_DEBUG */
+
+#define     PCI_VENDOR_ID_BROADCOM          0x14e4
+
+static void dhd_bus_set_device_wake(struct dhd_bus *bus, bool val);
+extern void wl_nddbg_wpp_log(const char *format, ...);
+#ifdef PCIE_OOB
+static void dhd_bus_doorbell_timeout_reset(struct dhd_bus *bus);
+
+#define DHD_DEFAULT_DOORBELL_TIMEOUT 200       /* ms */
+static uint dhd_doorbell_timeout = DHD_DEFAULT_DOORBELL_TIMEOUT;
+
+#define HOST_WAKE 4   /* GPIO_0 (HOST_WAKE) - Output from WLAN */
+#define DEVICE_WAKE 5  /* GPIO_1 (DEVICE_WAKE) - Input to WLAN */
+#define BIT_WL_REG_ON 6
+#define BIT_BT_REG_ON 7
+
+int gpio_handle_val = 0;
+unsigned char gpio_port = 0;
+unsigned char gpio_direction = 0;
+#define OOB_PORT "ttyUSB0"
+#endif /* PCIE_OOB */
+static bool dhdpcie_check_firmware_compatible(uint32 f_api_version, uint32 h_api_version);
+
+/* IOVar table */
+enum {
+       IOV_INTR = 1,
+       IOV_MEMBYTES,
+       IOV_MEMSIZE,
+       IOV_SET_DOWNLOAD_STATE,
+       IOV_DEVRESET,
+       IOV_VARS,
+       IOV_MSI_SIM,
+       IOV_PCIE_LPBK,
+       IOV_CC_NVMSHADOW,
+       IOV_RAMSIZE,
+       IOV_RAMSTART,
+       IOV_SLEEP_ALLOWED,
+       IOV_PCIE_DMAXFER,
+       IOV_PCIE_SUSPEND,
+       IOV_PCIEREG,
+       IOV_PCIECFGREG,
+       IOV_PCIECOREREG,
+       IOV_PCIESERDESREG,
+       IOV_BAR0_SECWIN_REG,
+       IOV_SBREG,
+       IOV_DONGLEISOLATION,
+       IOV_LTRSLEEPON_UNLOOAD,
+       IOV_METADATA_DBG,
+       IOV_RX_METADATALEN,
+       IOV_TX_METADATALEN,
+       IOV_TXP_THRESHOLD,
+       IOV_BUZZZ_DUMP,
+       IOV_DUMP_RINGUPD_BLOCK,
+       IOV_DMA_RINGINDICES,
+       IOV_DB1_FOR_MB,
+       IOV_FLOW_PRIO_MAP,
+#ifdef DHD_PCIE_RUNTIMEPM
+       IOV_IDLETIME,
+#endif /* DHD_PCIE_RUNTIMEPM */
+       IOV_RXBOUND,
+       IOV_TXBOUND,
+       IOV_HANGREPORT,
+#ifdef PCIE_OOB
+       IOV_OOB_BT_REG_ON,
+       IOV_OOB_ENABLE
+#endif /* PCIE_OOB */
+};
+
+
+const bcm_iovar_t dhdpcie_iovars[] = {
+       {"intr",        IOV_INTR,       0,      IOVT_BOOL,      0 },
+       {"membytes",    IOV_MEMBYTES,   0,      IOVT_BUFFER,    2 * sizeof(int) },
+       {"memsize",     IOV_MEMSIZE,    0,      IOVT_UINT32,    0 },
+       {"dwnldstate",  IOV_SET_DOWNLOAD_STATE, 0,      IOVT_BOOL,      0 },
+       {"vars",        IOV_VARS,       0,      IOVT_BUFFER,    0 },
+       {"devreset",    IOV_DEVRESET,   0,      IOVT_BOOL,      0 },
+       {"pcie_lpbk",   IOV_PCIE_LPBK,  0,      IOVT_UINT32,    0 },
+       {"cc_nvmshadow", IOV_CC_NVMSHADOW, 0, IOVT_BUFFER, 0 },
+       {"ramsize",     IOV_RAMSIZE,    0,      IOVT_UINT32,    0 },
+       {"ramstart",    IOV_RAMSTART,   0,      IOVT_UINT32,    0 },
+       {"pciereg",     IOV_PCIEREG,    0,      IOVT_BUFFER,    2 * sizeof(int32) },
+       {"pciecfgreg",  IOV_PCIECFGREG, 0,      IOVT_BUFFER,    2 * sizeof(int32) },
+       {"pciecorereg", IOV_PCIECOREREG,        0,      IOVT_BUFFER,    2 * sizeof(int32) },
+       {"pcieserdesreg",       IOV_PCIESERDESREG,      0,      IOVT_BUFFER,    3 * sizeof(int32) },
+       {"bar0secwinreg",       IOV_BAR0_SECWIN_REG,    0,      IOVT_BUFFER,    sizeof(sdreg_t) },
+       {"sbreg",       IOV_SBREG,      0,      IOVT_BUFFER,    sizeof(sdreg_t) },
+       {"pcie_dmaxfer",        IOV_PCIE_DMAXFER,       0,      IOVT_BUFFER,    3 * sizeof(int32) },
+       {"pcie_suspend", IOV_PCIE_SUSPEND,      0,      IOVT_UINT32,    0 },
+#ifdef PCIE_OOB
+       {"oob_bt_reg_on", IOV_OOB_BT_REG_ON,    0,  IOVT_UINT32,    0 },
+       {"oob_enable",   IOV_OOB_ENABLE,    0,  IOVT_UINT32,    0 },
+#endif /* PCIE_OOB */
+       {"sleep_allowed",       IOV_SLEEP_ALLOWED,      0,      IOVT_BOOL,      0 },
+       {"dngl_isolation", IOV_DONGLEISOLATION, 0,      IOVT_UINT32,    0 },
+       {"ltrsleep_on_unload", IOV_LTRSLEEPON_UNLOOAD,  0,      IOVT_UINT32,    0 },
+       {"dump_ringupdblk", IOV_DUMP_RINGUPD_BLOCK,     0,      IOVT_BUFFER,    0 },
+       {"dma_ring_indices", IOV_DMA_RINGINDICES,       0,      IOVT_UINT32,    0},
+       {"metadata_dbg", IOV_METADATA_DBG,      0,      IOVT_BOOL,      0 },
+       {"rx_metadata_len", IOV_RX_METADATALEN, 0,      IOVT_UINT32,    0 },
+       {"tx_metadata_len", IOV_TX_METADATALEN, 0,      IOVT_UINT32,    0 },
+       {"db1_for_mb", IOV_DB1_FOR_MB,  0,      IOVT_UINT32,    0 },
+       {"txp_thresh", IOV_TXP_THRESHOLD,       0,      IOVT_UINT32,    0 },
+       {"buzzz_dump", IOV_BUZZZ_DUMP,          0,      IOVT_UINT32,    0 },
+       {"flow_prio_map", IOV_FLOW_PRIO_MAP,    0,      IOVT_UINT32,    0 },
+#ifdef DHD_PCIE_RUNTIMEPM
+       {"idletime",    IOV_IDLETIME,   0,      IOVT_INT32,     0 },
+#endif /* DHD_PCIE_RUNTIMEPM */
+       {"rxbound",     IOV_RXBOUND,    0,      IOVT_UINT32,    0 },
+       {"txbound",     IOV_TXBOUND,    0,      IOVT_UINT32,    0 },
+       {"fw_hang_report", IOV_HANGREPORT,      0,      IOVT_BOOL,      0 },
+       {NULL, 0, 0, 0, 0 }
+};
+
+
+#define MAX_READ_TIMEOUT       5 * 1000 * 1000
+
+#ifndef DHD_RXBOUND
+#define DHD_RXBOUND            64
+#endif
+#ifndef DHD_TXBOUND
+#define DHD_TXBOUND            64
+#endif
+uint dhd_rxbound = DHD_RXBOUND;
+uint dhd_txbound = DHD_TXBOUND;
+
+/* Register/Unregister functions are called by the main DHD entry
+ * point (e.g. module insertion) to link with the bus driver, in
+ * order to look for or await the device.
+ */
+
+int
+dhd_bus_register(void)
+{
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       return dhdpcie_bus_register();
+}
+
+void
+dhd_bus_unregister(void)
+{
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       dhdpcie_bus_unregister();
+       return;
+}
+
+
+/** returns a host virtual address */
+uint32 *
+dhdpcie_bus_reg_map(osl_t *osh, ulong addr, int size)
+{
+       return (uint32 *)REG_MAP(addr, size);
+}
+
+void
+dhdpcie_bus_reg_unmap(osl_t *osh, ulong addr, int size)
+{
+       REG_UNMAP((void*)(uintptr)addr);
+       return;
+}
+
+
+/**
+ * 'regs' is the host virtual address that maps to the start of the PCIe BAR0 window. The first 4096
+ * bytes in this window are mapped to the backplane address in the PCIEBAR0Window register. The
+ * precondition is that the PCIEBAR0Window register 'points' at the PCIe core.
+ *
+ * 'tcm' is the *host* virtual address at which tcm is mapped.
+ */
+dhd_bus_t* dhdpcie_bus_attach(osl_t *osh,
+       volatile char *regs, volatile char *tcm, void *pci_dev)
+{
+       dhd_bus_t *bus;
+       /* customvar1 and customvar2 are customer configurable CIS tuples in OTP.
+        * In dual chip (PCIE) scenario, customvar2 is used as a hint to detect
+        * the chip variants and load the right firmware and NVRAM
+        */
+       /* Below vars are set to 0x0 as OTPed value can not take 0x0 */
+       uint32 customvar1 = 0x0;
+       uint32 customvar2 = 0x0;
+       uint32 otp_hw_module_variant = 0x0;
+
+       DHD_TRACE(("%s: ENTER\n", __FUNCTION__));
+
+       do {
+               if (!(bus = MALLOCZ(osh, sizeof(dhd_bus_t)))) {
+                       DHD_ERROR(("%s: MALLOC of dhd_bus_t failed\n", __FUNCTION__));
+                       break;
+               }
+
+               bus->regs = regs;
+               bus->tcm = tcm;
+               bus->osh = osh;
+               /* Save pci_dev into dhd_bus, as it may be needed in dhd_attach */
+               bus->dev = (struct pci_dev *)pci_dev;
+
+               dll_init(&bus->const_flowring);
+
+               /* Attach pcie shared structure */
+               if (!(bus->pcie_sh = MALLOCZ(osh, sizeof(pciedev_shared_t)))) {
+                       DHD_ERROR(("%s: MALLOC of bus->pcie_sh failed\n", __FUNCTION__));
+                       break;
+               }
+
+               /* dhd_common_init(osh); */
+
+               if (dhdpcie_dongle_attach(bus)) {
+                       DHD_ERROR(("%s: dhdpcie_probe_attach failed\n", __FUNCTION__));
+                       break;
+               }
+
+               if (!hw_module_variant) {
+                       /* For single wifi module */
+                       goto enumerate_module;
+               }
+
+               /* read otp variables customvar1 and customvar2 */
+               if (dhdpcie_sromotp_customvar(bus, &customvar1, &customvar2)) {
+                       DHD_ERROR(("%s: dhdpcie_sromotp_customvar failed\n", __FUNCTION__));
+                       break;
+               }
+
+               if (!customvar2) {
+                       DHD_ERROR(("%s: customvar2 is not OTPed, hw_module_variant=0x%x\n",
+                                       __FUNCTION__, hw_module_variant));
+                       goto enumerate_module;
+               }
+
+               /* customvar2=0xKKLLMMNN, LL is module variant */
+               otp_hw_module_variant = (customvar2 >> 16) & 0x00FF;
+               if (hw_module_variant != otp_hw_module_variant) {
+                       DHD_ERROR(("%s: Not going to enumerate this module as "
+                               "hw_module_variant=0x%x and "
+                               "OTPed-module_variant=0x%x didn't match\n",
+                               __FUNCTION__, hw_module_variant, otp_hw_module_variant));
+                       break;
+               }
+
+               DHD_TRACE(("%s: Going to enumerate this module as "
+                       "hw_module_variant=0x%x and "
+                       "OTPed-module_variant=0x%x match\n",
+                       __FUNCTION__, hw_module_variant, otp_hw_module_variant));
+
+enumerate_module:
+               /* software resources */
+               if (!(bus->dhd = dhd_attach(osh, bus, PCMSGBUF_HDRLEN))) {
+                       DHD_ERROR(("%s: dhd_attach failed\n", __FUNCTION__));
+                       break;
+               }
+
+               bus->dhd->busstate = DHD_BUS_DOWN;
+               bus->db1_for_mb = TRUE;
+               bus->dhd->hang_report = TRUE;
+               bus->irq_registered = FALSE;
+
+               bus->d3_ack_war_cnt = 0;
+
+               DHD_TRACE(("%s: EXIT SUCCESS\n",
+                       __FUNCTION__));
+#ifdef DHD_FW_COREDUMP
+               g_dhd_bus = bus;
+#endif
+               return bus;
+       } while (0);
+
+       DHD_TRACE(("%s: EXIT FAILURE\n", __FUNCTION__));
+
+       if (bus && bus->pcie_sh) {
+               MFREE(osh, bus->pcie_sh, sizeof(pciedev_shared_t));
+       }
+
+       if (bus) {
+               MFREE(osh, bus, sizeof(dhd_bus_t));
+       }
+       return NULL;
+}
+
+uint
+dhd_bus_chip(struct dhd_bus *bus)
+{
+       ASSERT(bus->sih != NULL);
+       return bus->sih->chip;
+}
+
+uint
+dhd_bus_chiprev(struct dhd_bus *bus)
+{
+       ASSERT(bus);
+       ASSERT(bus->sih != NULL);
+       return bus->sih->chiprev;
+}
+
+void *
+dhd_bus_pub(struct dhd_bus *bus)
+{
+       return bus->dhd;
+}
+
+void *
+dhd_bus_sih(struct dhd_bus *bus)
+{
+       return (void *)bus->sih;
+}
+
+void *
+dhd_bus_txq(struct dhd_bus *bus)
+{
+       return &bus->txq;
+}
+
+/** Get Chip ID version */
+uint dhd_bus_chip_id(dhd_pub_t *dhdp)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       return  bus->sih->chip;
+}
+
+/** Get Chip Rev ID version */
+uint dhd_bus_chiprev_id(dhd_pub_t *dhdp)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       return bus->sih->chiprev;
+}
+
+/** Get Chip Pkg ID version */
+uint dhd_bus_chippkg_id(dhd_pub_t *dhdp)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       return bus->sih->chippkg;
+}
+
+/** Read and clear intstatus. This should be called with interupts disabled or inside isr */
+uint32
+dhdpcie_bus_intstatus(dhd_bus_t *bus)
+{
+       uint32 intstatus = 0;
+       uint32 intmask = 0;
+
+       if ((bus->sih->buscorerev == 6) || (bus->sih->buscorerev == 4) ||
+               (bus->sih->buscorerev == 2)) {
+               intstatus = dhdpcie_bus_cfg_read_dword(bus, PCIIntstatus, 4);
+               dhdpcie_bus_cfg_write_dword(bus, PCIIntstatus, 4, intstatus);
+               intstatus &= I_MB;
+       } else {
+               /* this is a PCIE core register..not a config register... */
+               intstatus = si_corereg(bus->sih, bus->sih->buscoreidx, PCIMailBoxInt, 0, 0);
+
+               /* this is a PCIE core register..not a config register... */
+               intmask = si_corereg(bus->sih, bus->sih->buscoreidx, PCIMailBoxMask, 0, 0);
+
+               /*
+                * The fourth argument to si_corereg is the "mask" fields of the register to update
+                * and the fifth field is the "value" to update. Now if we are interested in only
+                * few fields of the "mask" bit map, we should not be writing back what we read
+                * By doing so, we might clear/ack interrupts that are not handled yet.
+                */
+               si_corereg(bus->sih, bus->sih->buscoreidx, PCIMailBoxInt, bus->def_intmask,
+                       intstatus);
+
+               intstatus &= intmask;
+
+               /* Is device removed. intstatus & intmask read 0xffffffff */
+               if (intstatus == (uint32)-1) {
+                       DHD_ERROR(("%s: !!!!!!Device Removed or dead chip.\n", __FUNCTION__));
+                       intstatus = 0;
+#ifdef CUSTOMER_HW4_DEBUG
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+                       bus->dhd->hang_reason = HANG_REASON_PCIE_LINK_DOWN;
+                       dhd_os_send_hang_message(bus->dhd);
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27) && OEM_ANDROID */
+#endif /* CUSTOMER_HW4_DEBUG */
+               }
+
+               intstatus &= bus->def_intmask;
+       }
+
+       return intstatus;
+}
+
+/**
+ * Name:  dhdpcie_bus_isr
+ * Parameters:
+ * 1: IN int irq   -- interrupt vector
+ * 2: IN void *arg      -- handle to private data structure
+ * Return value:
+ * Status (TRUE or FALSE)
+ *
+ * Description:
+ * Interrupt Service routine checks for the status register,
+ * disable interrupt and queue DPC if mail box interrupts are raised.
+ */
+int32
+dhdpcie_bus_isr(dhd_bus_t *bus)
+{
+       uint32 intstatus = 0;
+
+       do {
+               DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+               /* verify argument */
+               if (!bus) {
+                       DHD_ERROR(("%s : bus is null pointer, exit \n", __FUNCTION__));
+                       break;
+               }
+
+               if (bus->dhd->dongle_reset) {
+                       break;
+               }
+
+               if (bus->dhd->busstate == DHD_BUS_DOWN) {
+                       DHD_ERROR(("%s: BUS is down, not processing the interrupt \r\n",
+                               __FUNCTION__));
+                       break;
+               }
+
+               intstatus = dhdpcie_bus_intstatus(bus);
+
+               /* Check if the interrupt is ours or not */
+               if (intstatus == 0) {
+                       break;
+               }
+
+               /* save the intstatus */
+               bus->intstatus = intstatus;
+
+               /*  Overall operation:
+                *    - Mask further interrupts
+                *    - Read/ack intstatus
+                *    - Take action based on bits and state
+                *    - Reenable interrupts (as per state)
+                */
+
+               /* Count the interrupt call */
+               bus->intrcount++;
+
+               /* read interrupt status register!! Status bits will be cleared in DPC !! */
+               bus->ipend = TRUE;
+               dhdpcie_bus_intr_disable(bus); /* Disable interrupt!! */
+               bus->intdis = TRUE;
+
+#if defined(PCIE_ISR_THREAD)
+
+               DHD_TRACE(("Calling dhd_bus_dpc() from %s\n", __FUNCTION__));
+               DHD_OS_WAKE_LOCK(bus->dhd);
+               while (dhd_bus_dpc(bus));
+               DHD_OS_WAKE_UNLOCK(bus->dhd);
+#else
+               bus->dpc_sched = TRUE;
+               dhd_sched_dpc(bus->dhd);     /* queue DPC now!! */
+#endif /* defined(SDIO_ISR_THREAD) */
+
+               DHD_TRACE(("%s: Exit Success DPC Queued\n", __FUNCTION__));
+               return TRUE;
+
+       } while (0);
+
+       DHD_TRACE(("%s: Exit Failure\n", __FUNCTION__));
+       return FALSE;
+}
+
+#ifdef EXYNOS_PCIE_LINKDOWN_RECOVERY
+dhd_pub_t *link_recovery = NULL;
+#endif /* EXYNOS_PCIE_LINKDOWN_RECOVERY */
+static bool
+dhdpcie_dongle_attach(dhd_bus_t *bus)
+{
+
+       osl_t *osh = bus->osh;
+       void *regsva = (void*)bus->regs;
+       uint16 devid = bus->cl_devid;
+       uint32 val;
+       sbpcieregs_t *sbpcieregs;
+
+       DHD_TRACE(("%s: ENTER\n", __FUNCTION__));
+
+#ifdef EXYNOS_PCIE_LINKDOWN_RECOVERY
+       link_recovery = bus->dhd;
+#endif /* EXYNOS_PCIE_LINKDOWN_RECOVERY */
+
+       bus->alp_only = TRUE;
+
+       if (bus->sih != NULL) {
+               DHD_INFO(("%s sih is not null\n", __FUNCTION__));
+               return 0;
+       }
+
+       /* Set bar0 window to si_enum_base */
+       dhdpcie_bus_cfg_set_bar0_win(bus, SI_ENUM_BASE);
+
+       /* Checking PCIe bus status with reading configuration space */
+       val = OSL_PCI_READ_CONFIG(osh, PCI_CFG_VID, sizeof(uint32));
+       if ((val & 0xFFFF) != VENDOR_BROADCOM) {
+               DHD_ERROR(("%s : failed to read PCI configuration space!\n", __FUNCTION__));
+               goto fail;
+       }
+
+       /* si_attach() will provide an SI handle and scan the backplane */
+       if (!(bus->sih = si_attach((uint)devid, osh, regsva, PCI_BUS, bus,
+                                  &bus->vars, &bus->varsz))) {
+               DHD_ERROR(("%s: si_attach failed!\n", __FUNCTION__));
+               goto fail;
+       }
+
+
+       si_setcore(bus->sih, PCIE2_CORE_ID, 0);
+       sbpcieregs = (sbpcieregs_t*)(bus->regs);
+
+       /* WAR where the BAR1 window may not be sized properly */
+       W_REG(osh, &sbpcieregs->configaddr, 0x4e0);
+       val = R_REG(osh, &sbpcieregs->configdata);
+       W_REG(osh, &sbpcieregs->configdata, val);
+
+       /* Get info on the ARM and SOCRAM cores... */
+       /* Should really be qualified by device id */
+       if ((si_setcore(bus->sih, ARM7S_CORE_ID, 0)) ||
+           (si_setcore(bus->sih, ARMCM3_CORE_ID, 0)) ||
+           (si_setcore(bus->sih, ARMCR4_CORE_ID, 0)) ||
+           (si_setcore(bus->sih, ARMCA7_CORE_ID, 0))) {
+               bus->armrev = si_corerev(bus->sih);
+       } else {
+               DHD_ERROR(("%s: failed to find ARM core!\n", __FUNCTION__));
+               goto fail;
+       }
+
+       if (si_setcore(bus->sih, SYSMEM_CORE_ID, 0)) {
+               if (!(bus->orig_ramsize = si_sysmem_size(bus->sih))) {
+                       DHD_ERROR(("%s: failed to find SYSMEM memory!\n", __FUNCTION__));
+                       goto fail;
+               }
+               /* also populate base address */
+               bus->dongle_ram_base = CA7_4365_RAM_BASE;
+       } else if (!si_setcore(bus->sih, ARMCR4_CORE_ID, 0)) {
+               if (!(bus->orig_ramsize = si_socram_size(bus->sih))) {
+                       DHD_ERROR(("%s: failed to find SOCRAM memory!\n", __FUNCTION__));
+                       goto fail;
+               }
+       } else {
+               /* cr4 has a different way to find the RAM size from TCM's */
+               if (!(bus->orig_ramsize = si_tcm_size(bus->sih))) {
+                       DHD_ERROR(("%s: failed to find CR4-TCM memory!\n", __FUNCTION__));
+                       goto fail;
+               }
+               /* also populate base address */
+               switch ((uint16)bus->sih->chip) {
+               case BCM4339_CHIP_ID:
+               case BCM4335_CHIP_ID:
+                       bus->dongle_ram_base = CR4_4335_RAM_BASE;
+                       break;
+               case BCM4358_CHIP_ID:
+               case BCM4356_CHIP_ID:
+               case BCM4354_CHIP_ID:
+               case BCM43567_CHIP_ID:
+               case BCM43569_CHIP_ID:
+               case BCM4350_CHIP_ID:
+               case BCM43570_CHIP_ID:
+                       bus->dongle_ram_base = CR4_4350_RAM_BASE;
+                       break;
+               case BCM4360_CHIP_ID:
+                       bus->dongle_ram_base = CR4_4360_RAM_BASE;
+                       break;
+               CASE_BCM4345_CHIP:
+                       bus->dongle_ram_base = (bus->sih->chiprev < 6)  /* changed at 4345C0 */
+                               ? CR4_4345_LT_C0_RAM_BASE : CR4_4345_GE_C0_RAM_BASE;
+                       break;
+               CASE_BCM43602_CHIP:
+                       bus->dongle_ram_base = CR4_43602_RAM_BASE;
+                       break;
+               case BCM4349_CHIP_GRPID:
+                       /* RAM base changed from 4349c0(revid=9) onwards */
+                       bus->dongle_ram_base = ((bus->sih->chiprev < 9) ?
+                       CR4_4349_RAM_BASE : CR4_4349_RAM_BASE_FROM_REV_9);
+                       break;
+               default:
+                       bus->dongle_ram_base = 0;
+                       DHD_ERROR(("%s: WARNING: Using default ram base at 0x%x\n",
+                                  __FUNCTION__, bus->dongle_ram_base));
+               }
+       }
+       bus->ramsize = bus->orig_ramsize;
+       if (dhd_dongle_memsize)
+               dhdpcie_bus_dongle_setmemsize(bus, dhd_dongle_memsize);
+
+       DHD_ERROR(("DHD: dongle ram size is set to %d(orig %d) at 0x%x\n",
+                  bus->ramsize, bus->orig_ramsize, bus->dongle_ram_base));
+
+       bus->srmemsize = si_socram_srmem_size(bus->sih);
+
+
+       bus->def_intmask = PCIE_MB_D2H_MB_MASK | PCIE_MB_TOPCIE_FN0_0 | PCIE_MB_TOPCIE_FN0_1;
+
+       /* Set the poll and/or interrupt flags */
+       bus->intr = (bool)dhd_intr;
+
+       bus->wait_for_d3_ack = 1;
+       bus->suspended = FALSE;
+
+#ifdef PCIE_OOB
+       gpio_handle_val = get_handle(OOB_PORT);
+       if (gpio_handle_val < 0)
+       {
+               DHD_ERROR(("%s: Could not get GPIO handle.\n", __FUNCTION__));
+               ASSERT(FALSE);
+       }
+
+       gpio_direction = 0;
+       ftdi_set_bitmode(gpio_handle_val, 0, BITMODE_BITBANG);
+
+       /* Note BT core is also enabled here */
+       gpio_port = 1 << BIT_WL_REG_ON | 1 << BIT_BT_REG_ON | 1 << DEVICE_WAKE;
+       gpio_write_port(gpio_handle_val, gpio_port);
+
+       gpio_direction = 1 << BIT_WL_REG_ON | 1 << BIT_BT_REG_ON | 1 << DEVICE_WAKE;
+       ftdi_set_bitmode(gpio_handle_val, gpio_direction, BITMODE_BITBANG);
+
+       bus->oob_enabled = TRUE;
+
+       /* drive the Device_Wake GPIO low on startup */
+       bus->device_wake_state = TRUE;
+       dhd_bus_set_device_wake(bus, FALSE);
+       dhd_bus_doorbell_timeout_reset(bus);
+#endif /* PCIE_OOB */
+
+       DHD_TRACE(("%s: EXIT: SUCCESS\n", __FUNCTION__));
+       return 0;
+
+fail:
+       if (bus->sih != NULL) {
+               si_detach(bus->sih);
+               bus->sih = NULL;
+       }
+       DHD_TRACE(("%s: EXIT: FAILURE\n", __FUNCTION__));
+       return -1;
+}
+
+int
+dhpcie_bus_unmask_interrupt(dhd_bus_t *bus)
+{
+       dhdpcie_bus_cfg_write_dword(bus, PCIIntmask, 4, I_MB);
+       return 0;
+}
+int
+dhpcie_bus_mask_interrupt(dhd_bus_t *bus)
+{
+       dhdpcie_bus_cfg_write_dword(bus, PCIIntmask, 4, 0x0);
+       return 0;
+}
+
+void
+dhdpcie_bus_intr_enable(dhd_bus_t *bus)
+{
+       DHD_TRACE(("enable interrupts\n"));
+       if (bus && bus->sih && !bus->is_linkdown) {
+               if ((bus->sih->buscorerev == 2) || (bus->sih->buscorerev == 6) ||
+                       (bus->sih->buscorerev == 4)) {
+                       dhpcie_bus_unmask_interrupt(bus);
+               } else {
+               si_corereg(bus->sih, bus->sih->buscoreidx, PCIMailBoxMask,
+                       bus->def_intmask, bus->def_intmask);
+               }
+       } else {
+               DHD_ERROR(("****** %s: failed ******\n", __FUNCTION__));
+               DHD_ERROR(("bus: %p sih: %p bus->is_linkdown %d\n",
+                               bus, bus ? bus->sih : NULL, bus ? bus->is_linkdown: -1));
+       }
+}
+
+void
+dhdpcie_bus_intr_disable(dhd_bus_t *bus)
+{
+
+       DHD_TRACE(("%s Enter\n", __FUNCTION__));
+
+       if (bus && bus->sih && !bus->is_linkdown) {
+               if ((bus->sih->buscorerev == 2) || (bus->sih->buscorerev == 6) ||
+                       (bus->sih->buscorerev == 4)) {
+                       dhpcie_bus_mask_interrupt(bus);
+               } else {
+                       si_corereg(bus->sih, bus->sih->buscoreidx, PCIMailBoxMask,
+                               bus->def_intmask, 0);
+               }
+       } else {
+               DHD_ERROR(("****** %s: failed ******\n", __FUNCTION__));
+               DHD_ERROR(("bus: %p sih: %p bus->is_linkdown %d\n",
+                               bus, bus ? bus->sih : NULL, bus ? bus->is_linkdown: -1));
+       }
+
+       DHD_TRACE(("%s Exit\n", __FUNCTION__));
+}
+
+/*
+ *  dhdpcie_advertise_bus_cleanup advertises that clean up is under progress
+ * to other bus user contexts like Tx, Rx, IOVAR, WD etc and it waits for other contexts
+ * to gracefully exit. All the bus usage contexts before marking busstate as busy, will check for
+ * whether the busstate is DHD_BUS_DOWN or DHD_BUS_DOWN_IN_PROGRESS, if so
+ * they will exit from there itself without marking dhd_bus_busy_state as BUSY.
+ */
+static void
+dhdpcie_advertise_bus_cleanup(dhd_pub_t         *dhdp)
+{
+       unsigned long flags;
+       int timeleft;
+
+       DHD_GENERAL_LOCK(dhdp, flags);
+       dhdp->busstate = DHD_BUS_DOWN_IN_PROGRESS;
+       DHD_GENERAL_UNLOCK(dhdp, flags);
+
+       timeleft = dhd_os_busbusy_wait_negation(dhdp, &dhdp->dhd_bus_busy_state);
+       if (timeleft == 0) {
+               DHD_ERROR(("%s : Timeout due to dhd_bus_busy_state=0x%x\n",
+                               __FUNCTION__, dhdp->dhd_bus_busy_state));
+               BUG_ON(1);
+       }
+
+       return;
+}
+
+static void
+dhdpcie_bus_remove_prep(dhd_bus_t *bus)
+{
+       unsigned long flags;
+       DHD_TRACE(("%s Enter\n", __FUNCTION__));
+
+       DHD_GENERAL_LOCK(bus->dhd, flags);
+       bus->dhd->busstate = DHD_BUS_DOWN;
+       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+
+       if (bus->sih == NULL) {
+               return;
+       }
+
+       dhd_os_sdlock(bus->dhd);
+
+       dhdpcie_bus_intr_disable(bus);
+       if (!bus->dhd->dongle_isolation) {
+               pcie_watchdog_reset(bus->osh, bus->sih, (sbpcieregs_t *)(bus->regs));
+       }
+
+       dhd_os_sdunlock(bus->dhd);
+
+       DHD_TRACE(("%s Exit\n", __FUNCTION__));
+}
+
+/** Detach and free everything */
+void
+dhdpcie_bus_release(dhd_bus_t *bus)
+{
+       bool dongle_isolation = FALSE;
+       osl_t *osh = NULL;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (bus) {
+
+               osh = bus->osh;
+               ASSERT(osh);
+
+               if (bus->dhd) {
+                       dhdpcie_advertise_bus_cleanup(bus->dhd);
+                       dongle_isolation = bus->dhd->dongle_isolation;
+                       dhdpcie_bus_remove_prep(bus);
+
+                       if (bus->intr) {
+                               dhdpcie_bus_intr_disable(bus);
+                               dhdpcie_free_irq(bus);
+                       }
+                       dhdpcie_bus_release_dongle(bus, osh, dongle_isolation, TRUE);
+                       dhd_detach(bus->dhd);
+                       dhd_free(bus->dhd);
+                       bus->dhd = NULL;
+               }
+
+               /* unmap the regs and tcm here!! */
+               if (bus->regs) {
+                       dhdpcie_bus_reg_unmap(osh, (ulong)bus->regs, DONGLE_REG_MAP_SIZE);
+                       bus->regs = NULL;
+               }
+               if (bus->tcm) {
+                       dhdpcie_bus_reg_unmap(osh, (ulong)bus->tcm, DONGLE_TCM_MAP_SIZE);
+                       bus->tcm = NULL;
+               }
+
+               dhdpcie_bus_release_malloc(bus, osh);
+               /* Detach pcie shared structure */
+               if (bus->pcie_sh) {
+                       MFREE(osh, bus->pcie_sh, sizeof(pciedev_shared_t));
+                       bus->pcie_sh = NULL;
+               }
+
+#ifdef DHD_DEBUG
+
+               if (bus->console.buf != NULL)
+                       MFREE(osh, bus->console.buf, bus->console.bufsize);
+#endif
+
+
+               /* Finally free bus info */
+               MFREE(osh, bus, sizeof(dhd_bus_t));
+
+       }
+
+       DHD_TRACE(("%s: Exit\n", __FUNCTION__));
+} /* dhdpcie_bus_release */
+
+
+void
+dhdpcie_bus_release_dongle(dhd_bus_t *bus, osl_t *osh, bool dongle_isolation, bool reset_flag)
+{
+       DHD_TRACE(("%s: Enter bus->dhd %p bus->dhd->dongle_reset %d \n", __FUNCTION__,
+               bus->dhd, bus->dhd->dongle_reset));
+
+       if ((bus->dhd && bus->dhd->dongle_reset) && reset_flag) {
+               DHD_TRACE(("%s Exit\n", __FUNCTION__));
+               return;
+       }
+
+       if (bus->sih) {
+
+               if (!dongle_isolation)
+                       pcie_watchdog_reset(bus->osh, bus->sih, (sbpcieregs_t *)(bus->regs));
+
+               if (bus->ltrsleep_on_unload) {
+                       si_corereg(bus->sih, bus->sih->buscoreidx,
+                               OFFSETOF(sbpcieregs_t, u.pcie2.ltr_state), ~0, 0);
+               }
+
+               if (bus->sih->buscorerev == 13)
+                        pcie_serdes_iddqdisable(bus->osh, bus->sih, (sbpcieregs_t *)(bus->regs));
+
+               if (bus->sih != NULL) {
+                       si_detach(bus->sih);
+                       bus->sih = NULL;
+               }
+               if (bus->vars && bus->varsz)
+                       MFREE(osh, bus->vars, bus->varsz);
+               bus->vars = NULL;
+       }
+
+       DHD_TRACE(("%s Exit\n", __FUNCTION__));
+}
+
+uint32
+dhdpcie_bus_cfg_read_dword(dhd_bus_t *bus, uint32 addr, uint32 size)
+{
+       uint32 data = OSL_PCI_READ_CONFIG(bus->osh, addr, size);
+       return data;
+}
+
+/** 32 bit config write */
+void
+dhdpcie_bus_cfg_write_dword(dhd_bus_t *bus, uint32 addr, uint32 size, uint32 data)
+{
+       OSL_PCI_WRITE_CONFIG(bus->osh, addr, size, data);
+}
+
+void
+dhdpcie_bus_cfg_set_bar0_win(dhd_bus_t *bus, uint32 data)
+{
+       OSL_PCI_WRITE_CONFIG(bus->osh, PCI_BAR0_WIN, 4, data);
+}
+
+void
+dhdpcie_bus_dongle_setmemsize(struct dhd_bus *bus, int mem_size)
+{
+       int32 min_size =  DONGLE_MIN_MEMSIZE;
+       /* Restrict the memsize to user specified limit */
+       DHD_ERROR(("user: Restrict the dongle ram size to %d, min accepted %d\n",
+               dhd_dongle_memsize, min_size));
+       if ((dhd_dongle_memsize > min_size) &&
+               (dhd_dongle_memsize < (int32)bus->orig_ramsize))
+               bus->ramsize = dhd_dongle_memsize;
+}
+
+void
+dhdpcie_bus_release_malloc(dhd_bus_t *bus, osl_t *osh)
+{
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (bus->dhd && bus->dhd->dongle_reset)
+               return;
+
+       if (bus->vars && bus->varsz) {
+               MFREE(osh, bus->vars, bus->varsz);
+               bus->vars = NULL;
+       }
+
+       DHD_TRACE(("%s: Exit\n", __FUNCTION__));
+       return;
+
+}
+
+/** Stop bus module: clear pending frames, disable data flow */
+void dhd_bus_stop(struct dhd_bus *bus, bool enforce_mutex)
+{
+       uint32 status;
+       unsigned long flags;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (!bus->dhd)
+               return;
+
+       if (bus->dhd->busstate == DHD_BUS_DOWN) {
+               DHD_ERROR(("%s: already down by net_dev_reset\n", __FUNCTION__));
+               goto done;
+       }
+
+       DHD_DISABLE_RUNTIME_PM(bus->dhd);
+
+       DHD_GENERAL_LOCK(bus->dhd, flags);
+       bus->dhd->busstate = DHD_BUS_DOWN;
+       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+
+       dhdpcie_bus_intr_disable(bus);
+       status =  dhdpcie_bus_cfg_read_dword(bus, PCIIntstatus, 4);
+       dhdpcie_bus_cfg_write_dword(bus, PCIIntstatus, 4, status);
+
+       if (!dhd_download_fw_on_driverload) {
+               dhd_dpc_kill(bus->dhd);
+       }
+
+       /* Clear rx control and wake any waiters */
+       dhd_os_set_ioctl_resp_timeout(IOCTL_DISABLE_TIMEOUT);
+       dhd_wakeup_ioctl_event(bus->dhd, IOCTL_RETURN_ON_BUS_STOP);
+
+done:
+       return;
+}
+
+/** Watchdog timer function */
+bool dhd_bus_watchdog(dhd_pub_t *dhd)
+{
+       unsigned long flags;
+#ifdef DHD_DEBUG
+       dhd_bus_t *bus;
+       bus = dhd->bus;
+
+       DHD_GENERAL_LOCK(dhd, flags);
+       if (dhd->busstate == DHD_BUS_DOWN ||
+                       dhd->busstate == DHD_BUS_DOWN_IN_PROGRESS) {
+               DHD_GENERAL_UNLOCK(dhd, flags);
+               return FALSE;
+       }
+       dhd->dhd_bus_busy_state |= DHD_BUS_BUSY_IN_WD;
+       DHD_GENERAL_UNLOCK(dhd, flags);
+
+#ifdef DHD_PCIE_RUNTIMEPM
+       dhdpcie_runtime_bus_wake(dhd, TRUE, __builtin_return_address(0));
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+
+
+       /* Poll for console output periodically */
+       if (dhd->busstate == DHD_BUS_DATA && dhd_console_ms != 0) {
+               bus->console.count += dhd_watchdog_ms;
+               if (bus->console.count >= dhd_console_ms) {
+                       bus->console.count -= dhd_console_ms;
+                       /* Make sure backplane clock is on */
+                       if (dhdpcie_bus_readconsole(bus) < 0)
+                               dhd_console_ms = 0;     /* On error, stop trying */
+               }
+       }
+#endif /* DHD_DEBUG */
+
+#ifdef PCIE_OOB
+       /* If haven't communicated with device for a while, deassert the Device_Wake GPIO */
+       if (dhd_doorbell_timeout != 0 && !(bus->dhd->busstate == DHD_BUS_SUSPEND) &&
+               dhd_timeout_expired(&bus->doorbell_timer)) {
+               dhd_bus_set_device_wake(bus, FALSE);
+       }
+#endif /* PCIE_OOB */
+
+       DHD_GENERAL_LOCK(dhd, flags);
+       dhd->dhd_bus_busy_state &= ~DHD_BUS_BUSY_IN_WD;
+       DHD_GENERAL_UNLOCK(dhd, flags);
+
+       return TRUE;
+} /* dhd_bus_watchdog */
+
+
+#define DEADBEEF_PATTERN 0xADDEADDE    // "DeadDead"
+#define MEMCHECKINFO "/data/.memcheck.info"
+
+static int
+dhd_get_memcheck_info(void)
+{
+       struct file *fp = NULL;
+       uint32 mem_val = 0;
+       int ret = 0;
+       char *filepath = MEMCHECKINFO;
+
+       fp = filp_open(filepath, O_RDONLY, 0);
+       if (IS_ERR(fp)) {
+               DHD_ERROR(("[WIFI_SEC] %s: File [%s] doesn't exist\n", __FUNCTION__, filepath));
+               goto done;
+       } else {
+               ret = kernel_read(fp, 0, (char *)&mem_val, 4);
+               if (ret < 0) {
+                       DHD_ERROR(("[WIFI_SEC] %s: File read error, ret=%d\n", __FUNCTION__, ret));
+                       filp_close(fp, NULL);
+                       goto done;
+               }
+
+               mem_val = bcm_atoi((char *)&mem_val);
+
+               DHD_ERROR(("[WIFI_SEC]%s: MEMCHECK ENABLED = %d\n", __FUNCTION__, mem_val));
+               filp_close(fp, NULL);
+       }
+done:
+       return mem_val;
+}
+
+static int
+dhdpcie_mem_check(struct dhd_bus *bus)
+{
+       int bcmerror = BCME_OK;
+       int offset = 0;
+       int len = 0;
+       uint8 *memblock = NULL, *memptr;
+       int size = bus->ramsize;
+       int i;
+       uint32 memcheck_enabled;
+
+       /* Read memcheck info from the file */
+       /* 0 : Disable */
+       /* 1 : "Dead Beef" pattern write */
+       /* 2 : "Dead Beef" pattern write and checking the pattern value */
+
+       memcheck_enabled = dhd_get_memcheck_info();
+
+       DHD_ERROR(("%s: memcheck_enabled: %d \n", __FUNCTION__, memcheck_enabled));
+
+       if (memcheck_enabled == 0) {
+               return bcmerror;
+       }
+
+       memptr = memblock = MALLOC(bus->dhd->osh, MEMBLOCK + DHD_SDALIGN);
+       if (memblock == NULL) {
+               DHD_ERROR(("%s: Failed to allocate memory %d bytes\n", __FUNCTION__, MEMBLOCK));
+               goto err;
+       }
+
+       if ((ulong)memblock % DHD_SDALIGN) {
+               memptr += (DHD_SDALIGN - ((ulong)memblock % DHD_SDALIGN));
+       }
+
+       for (i = 0; i < MEMBLOCK; i = i + 4) {
+               *(ulong*)(memptr + i) = DEADBEEF_PATTERN;
+       }
+
+       if (si_setcore(bus->sih, ARMCR4_CORE_ID, 0) ||
+                       si_setcore(bus->sih, ARMCA7_CORE_ID, 0)) {
+               if (offset == 0) {
+                       /* Add start of RAM address to the address given by user */
+                       offset += bus->dongle_ram_base;
+               }
+       }
+
+       /* Write  "DeadBeef" pattern with MEMBLOCK size */
+       while (size) {
+               len = MIN(MEMBLOCK, size);
+
+               bcmerror = dhdpcie_bus_membytes(bus, TRUE, offset, (uint8 *)memptr, len);
+               if (bcmerror) {
+                       DHD_ERROR(("%s: error %d on writing %d membytes at 0x%08x\n",
+                               __FUNCTION__, bcmerror, MEMBLOCK, offset));
+                       goto err;
+               }
+
+               if (memcheck_enabled == 2) {
+                       bcmerror = dhdpcie_bus_membytes(bus, FALSE, offset, (uint8 *)memptr, len);
+                       if (bcmerror) {
+                               DHD_ERROR(("%s: error %d on read %d membytes at 0x%08x\n",
+                                       __FUNCTION__, bcmerror, MEMBLOCK, offset));
+                               goto err;
+                       } else {
+                               for (i = 0; i < len; i = i+4) {
+                                       if ((*(uint32*)(memptr + i)) != DEADBEEF_PATTERN) {
+                                               DHD_ERROR(("%s: error on reading pattern at "
+                                                       "0x%08x\n", __FUNCTION__, (offset + i)));
+                                               bcmerror = BCME_ERROR;
+                                               goto err;
+                                       }
+                               }
+                       }
+               }
+               offset += MEMBLOCK;
+               size -= MEMBLOCK;
+       }
+
+       DHD_ERROR(("%s: Writing the Dead Beef pattern is Done \n", __FUNCTION__));
+
+err:
+       if (memblock) {
+               MFREE(bus->dhd->osh, memblock, MEMBLOCK + DHD_SDALIGN);
+       }
+
+       return bcmerror;
+}
+
+/* Download firmware image and nvram image */
+int
+dhd_bus_download_firmware(struct dhd_bus *bus, osl_t *osh,
+                          char *pfw_path, char *pnv_path)
+{
+       int ret;
+
+       bus->fw_path = pfw_path;
+       bus->nv_path = pnv_path;
+
+       DHD_ERROR(("%s: firmware path=%s, nvram path=%s\n",
+               __FUNCTION__, bus->fw_path, bus->nv_path));
+
+       dhdpcie_mem_check(bus);
+
+       ret = dhdpcie_download_firmware(bus, osh);
+
+       return ret;
+}
+
+static int
+dhdpcie_download_firmware(struct dhd_bus *bus, osl_t *osh)
+{
+       int ret = 0;
+#if defined(BCM_REQUEST_FW)
+       uint chipid = bus->sih->chip;
+       uint revid = bus->sih->chiprev;
+       char fw_path[64] = "/lib/firmware/brcm/bcm";    /* path to firmware image */
+       char nv_path[64];               /* path to nvram vars file */
+       bus->fw_path = fw_path;
+       bus->nv_path = nv_path;
+       switch (chipid) {
+       case BCM43570_CHIP_ID:
+               bcmstrncat(fw_path, "43570", 5);
+               switch (revid) {
+               case 0:
+                       bcmstrncat(fw_path, "a0", 2);
+                       break;
+               case 2:
+                       bcmstrncat(fw_path, "a2", 2);
+                       break;
+               default:
+                       DHD_ERROR(("%s: revid is not found %x\n", __FUNCTION__,
+                       revid));
+                       break;
+               }
+               break;
+       default:
+               DHD_ERROR(("%s: unsupported device %x\n", __FUNCTION__,
+               chipid));
+               return 0;
+       }
+       /* load board specific nvram file */
+       snprintf(bus->nv_path, sizeof(nv_path), "%s.nvm", fw_path);
+       /* load firmware */
+       snprintf(bus->fw_path, sizeof(fw_path), "%s-firmware.bin", fw_path);
+#endif /* BCM_REQUEST_FW */
+
+       DHD_OS_WAKE_LOCK(bus->dhd);
+
+       ret = _dhdpcie_download_firmware(bus);
+
+       DHD_OS_WAKE_UNLOCK(bus->dhd);
+       return ret;
+}
+
+static int
+dhdpcie_download_code_file(struct dhd_bus *bus, char *pfw_path)
+{
+       int bcmerror = BCME_ERROR;
+       int offset = 0;
+       int len = 0;
+       char *imgbuf = NULL;
+       uint8 *memblock = NULL, *memptr;
+
+       int offset_end = bus->ramsize;
+
+       DHD_ERROR(("%s: download firmware %s\n", __FUNCTION__, pfw_path));
+       memptr = memblock = MALLOC(bus->dhd->osh, MEMBLOCK + DHD_SDALIGN);
+       if (memblock == NULL) {
+               DHD_ERROR(("%s: Failed to allocate memory %d bytes\n", __FUNCTION__, MEMBLOCK));
+               goto err;
+       }
+
+#ifdef BCM_AUTO_FWCRC
+       /* Firmware binary crc validation before downloading */
+       if (dhd_check_firmware_image(memptr, pfw_path)) {
+               DHD_ERROR(("check image failed\n"));
+               goto err;
+       }
+#endif
+
+       /* Should succeed in opening image if it is actually given through registry
+        * entry or in module param.
+        */
+       imgbuf = dhd_os_open_image(pfw_path);
+       if (imgbuf == NULL)
+               goto err;
+
+       if ((uint32)(uintptr)memblock % DHD_SDALIGN)
+               memptr += (DHD_SDALIGN - ((uint32)(uintptr)memblock % DHD_SDALIGN));
+
+       DHD_INFO_HW4(("%s: dongle_ram_base: 0x%x ramsize: 0x%x tcm: %p\n",
+                       __FUNCTION__, bus->dongle_ram_base, bus->ramsize, bus->tcm));
+
+       /* Download image with MEMBLOCK size */
+       while ((len = dhd_os_get_image_block((char*)memptr, MEMBLOCK, imgbuf))) {
+               if (len < 0) {
+                       DHD_ERROR(("%s: dhd_os_get_image_block failed (%d)\n", __FUNCTION__, len));
+                       bcmerror = BCME_ERROR;
+                       goto err;
+               }
+               /* check if CR4/CA7 */
+               if (si_setcore(bus->sih, ARMCR4_CORE_ID, 0) ||
+                       si_setcore(bus->sih, ARMCA7_CORE_ID, 0)) {
+                       /* if address is 0, store the reset instruction to be written in 0 */
+                       if (offset == 0) {
+                               bus->resetinstr = *(((uint32*)memptr));
+                               /* Add start of RAM address to the address given by user */
+                               offset += bus->dongle_ram_base;
+                               offset_end += offset;
+                       }
+               }
+               bcmerror = dhdpcie_bus_membytes(bus, TRUE, offset, (uint8 *)memptr, len);
+               if (bcmerror) {
+                       DHD_ERROR(("%s: error %d on writing %d membytes at 0x%08x\n",
+                               __FUNCTION__, bcmerror, MEMBLOCK, offset));
+                       goto err;
+               }
+               offset += MEMBLOCK;
+
+               if (offset >= offset_end) {
+                       DHD_ERROR(("%s: invalid address access to %x (offset end: %x)\n",
+                               __FUNCTION__, offset, offset_end));
+                       bcmerror = BCME_ERROR;
+                       goto err;
+               }
+       }
+
+err:
+       if (memblock)
+               MFREE(bus->dhd->osh, memblock, MEMBLOCK + DHD_SDALIGN);
+
+       if (imgbuf)
+               dhd_os_close_image(imgbuf);
+
+       return bcmerror;
+} /* dhdpcie_download_code_file */
+
+#ifdef CUSTOMER_HW4_DEBUG
+#define MIN_NVRAMVARS_SIZE 128
+#endif /* CUSTOMER_HW4_DEBUG */
+
+static int
+dhdpcie_download_nvram(struct dhd_bus *bus)
+{
+       int bcmerror = BCME_ERROR;
+       uint len;
+       char * memblock = NULL;
+       char *bufp;
+       char *pnv_path;
+       bool nvram_file_exists;
+       bool nvram_uefi_exists = FALSE;
+       bool local_alloc = FALSE;
+       pnv_path = bus->nv_path;
+
+       nvram_file_exists = ((pnv_path != NULL) && (pnv_path[0] != '\0'));
+
+       /* First try UEFI */
+       len = MAX_NVRAMBUF_SIZE;
+       dhd_get_download_buffer(bus->dhd, NULL, NVRAM, &memblock, &len);
+
+       /* If UEFI empty, then read from file system */
+       if ((len == 0) || (memblock[0] == '\0')) {
+
+               if (nvram_file_exists) {
+                       len = MAX_NVRAMBUF_SIZE;
+                       dhd_get_download_buffer(bus->dhd, pnv_path, NVRAM, &memblock, &len);
+                       if ((len <= 0 || len > MAX_NVRAMBUF_SIZE)) {
+                               goto err;
+                       }
+               }
+               else {
+                       /* For SROM OTP no external file or UEFI required */
+                       bcmerror = BCME_OK;
+               }
+       } else {
+               nvram_uefi_exists = TRUE;
+       }
+
+       DHD_ERROR(("%s: dhd_get_download_buffer len %d\n", __FUNCTION__, len));
+
+       if (len > 0 && len <= MAX_NVRAMBUF_SIZE) {
+               bufp = (char *) memblock;
+
+#ifdef CACHE_FW_IMAGES
+               if (bus->processed_nvram_params_len) {
+                       len = bus->processed_nvram_params_len;
+               }
+
+               if (!bus->processed_nvram_params_len) {
+                       bufp[len] = 0;
+                       if (nvram_uefi_exists || nvram_file_exists) {
+                               len = process_nvram_vars(bufp, len);
+                               bus->processed_nvram_params_len = len;
+                       }
+               } else
+#else
+               {
+                       bufp[len] = 0;
+                       if (nvram_uefi_exists || nvram_file_exists) {
+                               len = process_nvram_vars(bufp, len);
+                       }
+               }
+#endif /* CACHE_FW_IMAGES */
+
+               DHD_ERROR(("%s: process_nvram_vars len %d\n", __FUNCTION__, len));
+#ifdef CUSTOMER_HW4_DEBUG
+               if (len < MIN_NVRAMVARS_SIZE) {
+                       DHD_ERROR(("%s: invalid nvram size in process_nvram_vars \n",
+                               __FUNCTION__));
+                       bcmerror = BCME_ERROR;
+                       goto err;
+               }
+#endif /* CUSTOMER_HW4_DEBUG */
+
+               if (len % 4) {
+                       len += 4 - (len % 4);
+               }
+               bufp += len;
+               *bufp++ = 0;
+               if (len)
+                       bcmerror = dhdpcie_downloadvars(bus, memblock, len + 1);
+               if (bcmerror) {
+                       DHD_ERROR(("%s: error downloading vars: %d\n",
+                               __FUNCTION__, bcmerror));
+               }
+       }
+
+
+err:
+       if (memblock) {
+               if (local_alloc) {
+                       MFREE(bus->dhd->osh, memblock, MAX_NVRAMBUF_SIZE);
+               } else {
+                       dhd_free_download_buffer(bus->dhd, memblock, MAX_NVRAMBUF_SIZE);
+               }
+       }
+
+       return bcmerror;
+}
+
+
+#ifdef BCMEMBEDIMAGE
+int
+dhdpcie_download_code_array(struct dhd_bus *bus)
+{
+       int bcmerror = -1;
+       int offset = 0;
+       unsigned char *p_dlarray  = NULL;
+       unsigned int dlarray_size = 0;
+       unsigned int downloded_len, remaining_len, len;
+       char *p_dlimagename, *p_dlimagever, *p_dlimagedate;
+       uint8 *memblock = NULL, *memptr;
+
+       downloded_len = 0;
+       remaining_len = 0;
+       len = 0;
+
+       p_dlarray = dlarray;
+       dlarray_size = sizeof(dlarray);
+       p_dlimagename = dlimagename;
+       p_dlimagever  = dlimagever;
+       p_dlimagedate = dlimagedate;
+
+       if ((p_dlarray == 0) || (dlarray_size == 0) ||(dlarray_size > bus->ramsize) ||
+               (p_dlimagename == 0) || (p_dlimagever  == 0) || (p_dlimagedate == 0))
+               goto err;
+
+       memptr = memblock = MALLOC(bus->dhd->osh, MEMBLOCK + DHD_SDALIGN);
+       if (memblock == NULL) {
+               DHD_ERROR(("%s: Failed to allocate memory %d bytes\n", __FUNCTION__, MEMBLOCK));
+               goto err;
+       }
+       if ((uint32)(uintptr)memblock % DHD_SDALIGN)
+               memptr += (DHD_SDALIGN - ((uint32)(uintptr)memblock % DHD_SDALIGN));
+
+       while (downloded_len  < dlarray_size) {
+               remaining_len = dlarray_size - downloded_len;
+               if (remaining_len >= MEMBLOCK)
+                       len = MEMBLOCK;
+               else
+                       len = remaining_len;
+
+               memcpy(memptr, (p_dlarray + downloded_len), len);
+               /* check if CR4/CA7 */
+               if (si_setcore(bus->sih, ARMCR4_CORE_ID, 0) ||
+                       si_setcore(bus->sih, SYSMEM_CORE_ID, 0)) {
+                       /* if address is 0, store the reset instruction to be written in 0 */
+                       if (offset == 0) {
+                               bus->resetinstr = *(((uint32*)memptr));
+                               /* Add start of RAM address to the address given by user */
+                               offset += bus->dongle_ram_base;
+                       }
+               }
+               bcmerror = dhdpcie_bus_membytes(bus, TRUE, offset, (uint8 *)memptr, len);
+               downloded_len += len;
+               if (bcmerror) {
+                       DHD_ERROR(("%s: error %d on writing %d membytes at 0x%08x\n",
+                               __FUNCTION__, bcmerror, MEMBLOCK, offset));
+                       goto err;
+               }
+               offset += MEMBLOCK;
+       }
+
+#ifdef DHD_DEBUG
+       /* Upload and compare the downloaded code */
+       {
+               unsigned char *ularray = NULL;
+               unsigned int uploded_len;
+               uploded_len = 0;
+               bcmerror = -1;
+               ularray = MALLOC(bus->dhd->osh, dlarray_size);
+               if (ularray == NULL)
+                       goto upload_err;
+               /* Upload image to verify downloaded contents. */
+               offset = bus->dongle_ram_base;
+               memset(ularray, 0xaa, dlarray_size);
+               while (uploded_len  < dlarray_size) {
+                       remaining_len = dlarray_size - uploded_len;
+                       if (remaining_len >= MEMBLOCK)
+                               len = MEMBLOCK;
+                       else
+                               len = remaining_len;
+                       bcmerror = dhdpcie_bus_membytes(bus, FALSE, offset,
+                               (uint8 *)(ularray + uploded_len), len);
+                       if (bcmerror) {
+                               DHD_ERROR(("%s: error %d on reading %d membytes at 0x%08x\n",
+                                       __FUNCTION__, bcmerror, MEMBLOCK, offset));
+                               goto upload_err;
+                       }
+
+                       uploded_len += len;
+                       offset += MEMBLOCK;
+               }
+
+               if (memcmp(p_dlarray, ularray, dlarray_size)) {
+                       DHD_ERROR(("%s: Downloaded image is corrupted (%s, %s, %s).\n",
+                               __FUNCTION__, p_dlimagename, p_dlimagever, p_dlimagedate));
+                       goto upload_err;
+
+               } else
+                       DHD_ERROR(("%s: Download, Upload and compare succeeded (%s, %s, %s).\n",
+                               __FUNCTION__, p_dlimagename, p_dlimagever, p_dlimagedate));
+upload_err:
+               if (ularray)
+                       MFREE(bus->dhd->osh, ularray, dlarray_size);
+       }
+#endif /* DHD_DEBUG */
+err:
+
+       if (memblock)
+               MFREE(bus->dhd->osh, memblock, MEMBLOCK + DHD_SDALIGN);
+
+       return bcmerror;
+} /* dhdpcie_download_code_array */
+#endif /* BCMEMBEDIMAGE */
+
+
+static int
+_dhdpcie_download_firmware(struct dhd_bus *bus)
+{
+       int bcmerror = -1;
+
+       bool embed = FALSE;     /* download embedded firmware */
+       bool dlok = FALSE;      /* download firmware succeeded */
+
+       /* Out immediately if no image to download */
+       if ((bus->fw_path == NULL) || (bus->fw_path[0] == '\0')) {
+#ifdef BCMEMBEDIMAGE
+               embed = TRUE;
+#else
+               DHD_ERROR(("%s: no fimrware file\n", __FUNCTION__));
+               return 0;
+#endif
+       }
+
+       /* Keep arm in reset */
+       if (dhdpcie_bus_download_state(bus, TRUE)) {
+               DHD_ERROR(("%s: error placing ARM core in reset\n", __FUNCTION__));
+               goto err;
+       }
+
+       /* External image takes precedence if specified */
+       if ((bus->fw_path != NULL) && (bus->fw_path[0] != '\0')) {
+               if (dhdpcie_download_code_file(bus, bus->fw_path)) {
+                       DHD_ERROR(("%s: dongle image file download failed\n", __FUNCTION__));
+#ifdef BCMEMBEDIMAGE
+                       embed = TRUE;
+#else
+                       goto err;
+#endif
+               } else {
+                       embed = FALSE;
+                       dlok = TRUE;
+               }
+       }
+
+#ifdef BCMEMBEDIMAGE
+       if (embed) {
+               if (dhdpcie_download_code_array(bus)) {
+                       DHD_ERROR(("%s: dongle image array download failed\n", __FUNCTION__));
+                       goto err;
+               } else {
+                       dlok = TRUE;
+               }
+       }
+#else
+       BCM_REFERENCE(embed);
+#endif
+       if (!dlok) {
+               DHD_ERROR(("%s: dongle image download failed\n", __FUNCTION__));
+               goto err;
+       }
+
+       /* EXAMPLE: nvram_array */
+       /* If a valid nvram_arry is specified as above, it can be passed down to dongle */
+       /* dhd_bus_set_nvram_params(bus, (char *)&nvram_array); */
+
+
+       /* External nvram takes precedence if specified */
+       if (dhdpcie_download_nvram(bus)) {
+               DHD_ERROR(("%s: dongle nvram file download failed\n", __FUNCTION__));
+               goto err;
+       }
+
+       /* Take arm out of reset */
+       if (dhdpcie_bus_download_state(bus, FALSE)) {
+               DHD_ERROR(("%s: error getting out of ARM core reset\n", __FUNCTION__));
+               goto err;
+       }
+
+       bcmerror = 0;
+
+err:
+       return bcmerror;
+} /* _dhdpcie_download_firmware */
+
+#define CONSOLE_LINE_MAX       192
+
+#ifdef DHD_DEBUG
+static int
+dhdpcie_bus_readconsole(dhd_bus_t *bus)
+{
+       dhd_console_t *c = &bus->console;
+       uint8 line[CONSOLE_LINE_MAX], ch;
+       uint32 n, idx, addr;
+       int rv;
+
+       /* Don't do anything until FWREADY updates console address */
+       if (bus->console_addr == 0)
+               return -1;
+
+       /* Read console log struct */
+       addr = bus->console_addr + OFFSETOF(hnd_cons_t, log);
+
+       if ((rv = dhdpcie_bus_membytes(bus, FALSE, addr, (uint8 *)&c->log, sizeof(c->log))) < 0)
+               return rv;
+
+       /* Allocate console buffer (one time only) */
+       if (c->buf == NULL) {
+               c->bufsize = ltoh32(c->log.buf_size);
+               if ((c->buf = MALLOC(bus->dhd->osh, c->bufsize)) == NULL)
+                       return BCME_NOMEM;
+       }
+       idx = ltoh32(c->log.idx);
+
+       /* Protect against corrupt value */
+       if (idx > c->bufsize)
+               return BCME_ERROR;
+
+       /* Skip reading the console buffer if the index pointer has not moved */
+       if (idx == c->last)
+               return BCME_OK;
+
+       /* Read the console buffer */
+       addr = ltoh32(c->log.buf);
+       if ((rv = dhdpcie_bus_membytes(bus, FALSE, addr, c->buf, c->bufsize)) < 0)
+               return rv;
+
+       while (c->last != idx) {
+               for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
+                       if (c->last == idx) {
+                               /* This would output a partial line.  Instead, back up
+                                * the buffer pointer and output this line next time around.
+                                */
+                               if (c->last >= n)
+                                       c->last -= n;
+                               else
+                                       c->last = c->bufsize - n;
+                               goto break2;
+                       }
+                       ch = c->buf[c->last];
+                       c->last = (c->last + 1) % c->bufsize;
+                       if (ch == '\n')
+                               break;
+                       line[n] = ch;
+               }
+
+               if (n > 0) {
+                       if (line[n - 1] == '\r')
+                               n--;
+                       line[n] = 0;
+                       printf("CONSOLE: %s\n", line);
+
+               }
+       }
+break2:
+
+       return BCME_OK;
+} /* dhdpcie_bus_readconsole */
+#endif /* DHD_DEBUG */
+
+static int
+dhdpcie_checkdied(dhd_bus_t *bus, char *data, uint size)
+{
+       int bcmerror = 0;
+       uint msize = 512;
+       char *mbuffer = NULL;
+       char *console_buffer = NULL;
+       uint maxstrlen = 256;
+       char *str = NULL;
+       trap_t tr;
+       pciedev_shared_t *pciedev_shared = bus->pcie_sh;
+       struct bcmstrbuf strbuf;
+       uint32 console_ptr, console_size, console_index;
+       uint8 line[CONSOLE_LINE_MAX], ch;
+       uint32 n, i, addr;
+       int rv;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (DHD_NOCHECKDIED_ON()) {
+               return 0;
+       }
+
+       if (data == NULL) {
+               /*
+                * Called after a rx ctrl timeout. "data" is NULL.
+                * allocate memory to trace the trap or assert.
+                */
+               size = msize;
+               mbuffer = data = MALLOC(bus->dhd->osh, msize);
+
+               if (mbuffer == NULL) {
+                       DHD_ERROR(("%s: MALLOC(%d) failed \n", __FUNCTION__, msize));
+                       bcmerror = BCME_NOMEM;
+                       goto done;
+               }
+       }
+
+       if ((str = MALLOC(bus->dhd->osh, maxstrlen)) == NULL) {
+               DHD_ERROR(("%s: MALLOC(%d) failed \n", __FUNCTION__, maxstrlen));
+               bcmerror = BCME_NOMEM;
+               goto done;
+       }
+
+       if ((bcmerror = dhdpcie_readshared(bus)) < 0) {
+               goto done;
+       }
+
+       bcm_binit(&strbuf, data, size);
+
+       bcm_bprintf(&strbuf, "msgtrace address : 0x%08X\nconsole address  : 0x%08X\n",
+                   pciedev_shared->msgtrace_addr, pciedev_shared->console_addr);
+
+       if ((pciedev_shared->flags & PCIE_SHARED_ASSERT_BUILT) == 0) {
+               /* NOTE: Misspelled assert is intentional - DO NOT FIX.
+                * (Avoids conflict with real asserts for programmatic parsing of output.)
+                */
+               bcm_bprintf(&strbuf, "Assrt not built in dongle\n");
+       }
+
+       if ((bus->pcie_sh->flags & (PCIE_SHARED_ASSERT|PCIE_SHARED_TRAP)) == 0) {
+               /* NOTE: Misspelled assert is intentional - DO NOT FIX.
+                * (Avoids conflict with real asserts for programmatic parsing of output.)
+                */
+               bcm_bprintf(&strbuf, "No trap%s in dongle",
+                         (bus->pcie_sh->flags & PCIE_SHARED_ASSERT_BUILT)
+                         ?"/assrt" :"");
+       } else {
+               if (bus->pcie_sh->flags & PCIE_SHARED_ASSERT) {
+                       /* Download assert */
+                       bcm_bprintf(&strbuf, "Dongle assert");
+                       if (bus->pcie_sh->assert_exp_addr != 0) {
+                               str[0] = '\0';
+                               if ((bcmerror = dhdpcie_bus_membytes(bus, FALSE,
+                                       bus->pcie_sh->assert_exp_addr,
+                                       (uint8 *)str, maxstrlen)) < 0) {
+                                       goto done;
+                               }
+
+                               str[maxstrlen - 1] = '\0';
+                               bcm_bprintf(&strbuf, " expr \"%s\"", str);
+                       }
+
+                       if (bus->pcie_sh->assert_file_addr != 0) {
+                               str[0] = '\0';
+                               if ((bcmerror = dhdpcie_bus_membytes(bus, FALSE,
+                                       bus->pcie_sh->assert_file_addr,
+                                       (uint8 *)str, maxstrlen)) < 0) {
+                                       goto done;
+                               }
+
+                               str[maxstrlen - 1] = '\0';
+                               bcm_bprintf(&strbuf, " file \"%s\"", str);
+                       }
+
+                       bcm_bprintf(&strbuf, " line %d ",  bus->pcie_sh->assert_line);
+               }
+
+               if (bus->pcie_sh->flags & PCIE_SHARED_TRAP) {
+                       bus->dhd->dongle_trap_occured = TRUE;
+                       if ((bcmerror = dhdpcie_bus_membytes(bus, FALSE,
+                               bus->pcie_sh->trap_addr, (uint8*)&tr, sizeof(trap_t))) < 0) {
+                               goto done;
+                       }
+
+                       bcm_bprintf(&strbuf,
+                       "\nTRAP type 0x%x @ epc 0x%x, cpsr 0x%x, spsr 0x%x, sp 0x%x,"
+                       " lp 0x%x, rpc 0x%x"
+                       "\nTrap offset 0x%x, r0 0x%x, r1 0x%x, r2 0x%x, r3 0x%x, "
+                       "r4 0x%x, r5 0x%x, r6 0x%x, r7 0x%x\n\n",
+                       ltoh32(tr.type), ltoh32(tr.epc), ltoh32(tr.cpsr), ltoh32(tr.spsr),
+                       ltoh32(tr.r13), ltoh32(tr.r14), ltoh32(tr.pc),
+                       ltoh32(bus->pcie_sh->trap_addr),
+                       ltoh32(tr.r0), ltoh32(tr.r1), ltoh32(tr.r2), ltoh32(tr.r3),
+                       ltoh32(tr.r4), ltoh32(tr.r5), ltoh32(tr.r6), ltoh32(tr.r7));
+
+                       addr =  bus->pcie_sh->console_addr + OFFSETOF(hnd_cons_t, log);
+                       if ((rv = dhdpcie_bus_membytes(bus, FALSE, addr,
+                               (uint8 *)&console_ptr, sizeof(console_ptr))) < 0) {
+                               goto printbuf;
+                       }
+
+                       addr =  bus->pcie_sh->console_addr + OFFSETOF(hnd_cons_t, log.buf_size);
+                       if ((rv = dhdpcie_bus_membytes(bus, FALSE, addr,
+                               (uint8 *)&console_size, sizeof(console_size))) < 0) {
+                               goto printbuf;
+                       }
+
+                       addr =  bus->pcie_sh->console_addr + OFFSETOF(hnd_cons_t, log.idx);
+                       if ((rv = dhdpcie_bus_membytes(bus, FALSE, addr,
+                               (uint8 *)&console_index, sizeof(console_index))) < 0) {
+                               goto printbuf;
+                       }
+
+                       console_ptr = ltoh32(console_ptr);
+                       console_size = ltoh32(console_size);
+                       console_index = ltoh32(console_index);
+
+                       if (console_size > CONSOLE_BUFFER_MAX ||
+                               !(console_buffer = MALLOC(bus->dhd->osh, console_size))) {
+                               goto printbuf;
+                       }
+
+                       if ((rv = dhdpcie_bus_membytes(bus, FALSE, console_ptr,
+                               (uint8 *)console_buffer, console_size)) < 0) {
+                               goto printbuf;
+                       }
+
+                       for (i = 0, n = 0; i < console_size; i += n + 1) {
+                               for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
+                                       ch = console_buffer[(console_index + i + n) % console_size];
+                                       if (ch == '\n')
+                                               break;
+                                       line[n] = ch;
+                               }
+
+
+                               if (n > 0) {
+                                       if (line[n - 1] == '\r')
+                                               n--;
+                                       line[n] = 0;
+                                       /* Don't use DHD_ERROR macro since we print
+                                        * a lot of information quickly. The macro
+                                        * will truncate a lot of the printfs
+                                        */
+
+                                       printf("CONSOLE: %s\n", line);
+                               }
+                       }
+               }
+       }
+
+printbuf:
+       if (bus->pcie_sh->flags & (PCIE_SHARED_ASSERT | PCIE_SHARED_TRAP)) {
+               printf("%s: %s\n", __FUNCTION__, strbuf.origbuf);
+
+               /* wake up IOCTL wait event */
+               dhd_wakeup_ioctl_event(bus->dhd, IOCTL_RETURN_ON_TRAP);
+
+#if defined(DHD_FW_COREDUMP)
+               /* save core dump or write to a file */
+               if (bus->dhd->memdump_enabled) {
+                       bus->dhd->memdump_type = DUMP_TYPE_DONGLE_TRAP;
+                       dhdpcie_mem_dump(bus);
+               }
+#endif /* DHD_FW_COREDUMP */
+
+
+       }
+
+done:
+       if (mbuffer)
+               MFREE(bus->dhd->osh, mbuffer, msize);
+       if (str)
+               MFREE(bus->dhd->osh, str, maxstrlen);
+
+       if (console_buffer)
+               MFREE(bus->dhd->osh, console_buffer, console_size);
+
+       return bcmerror;
+} /* dhdpcie_checkdied */
+
+
+/* Custom copy of dhdpcie_mem_dump() that can be called at interrupt level */
+void dhdpcie_mem_dump_bugcheck(dhd_bus_t *bus, uint8 *buf)
+{
+       int ret = 0;
+       int size; /* Full mem size */
+       int start; /* Start address */
+       int read_size = 0; /* Read size of each iteration */
+       uint8 *databuf = buf;
+
+       if (bus == NULL) {
+               return;
+       }
+
+       start = bus->dongle_ram_base;
+       /* Get full mem size */
+       size = bus->ramsize;
+       /* Read mem content */
+       while (size)
+       {
+               read_size = MIN(MEMBLOCK, size);
+               if ((ret = dhdpcie_bus_membytes(bus, FALSE, start, databuf, read_size))) {
+                       return;
+               }
+
+               /* Decrement size and increment start address */
+               size -= read_size;
+               start += read_size;
+               databuf += read_size;
+       }
+       bus->dhd->soc_ram = buf;
+       bus->dhd->soc_ram_length = bus->ramsize;
+       return;
+}
+
+
+#if defined(DHD_FW_COREDUMP)
+static int
+dhdpcie_mem_dump(dhd_bus_t *bus)
+{
+       int ret = 0;
+       int size; /* Full mem size */
+       int start = bus->dongle_ram_base; /* Start address */
+       int read_size = 0; /* Read size of each iteration */
+       uint8 *buf = NULL, *databuf = NULL;
+
+#ifdef EXYNOS_PCIE_DEBUG
+       exynos_pcie_register_dump(1);
+#endif /* EXYNOS_PCIE_DEBUG */
+
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+       if (bus->is_linkdown) {
+               DHD_ERROR(("%s: PCIe link was down so skip\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+
+       /* Get full mem size */
+       size = bus->ramsize;
+#if defined(CONFIG_DHD_USE_STATIC_BUF) && defined(DHD_USE_STATIC_MEMDUMP)
+       buf = DHD_OS_PREALLOC(bus->dhd, DHD_PREALLOC_MEMDUMP_BUF, size);
+       bzero(buf, size);
+#else
+       buf = MALLOC(bus->dhd->osh, size);
+#endif /* CONFIG_DHD_USE_STATIC_BUF && DHD_USE_STATIC_MEMDUMP */
+       if (!buf) {
+               DHD_ERROR(("%s: Out of memory (%d bytes)\n", __FUNCTION__, size));
+               return BCME_ERROR;
+       }
+
+       /* Read mem content */
+       DHD_TRACE_HW4(("Dump dongle memory"));
+       databuf = buf;
+       while (size)
+       {
+               read_size = MIN(MEMBLOCK, size);
+               if ((ret = dhdpcie_bus_membytes(bus, FALSE, start, databuf, read_size)))
+               {
+                       DHD_ERROR(("%s: Error membytes %d\n", __FUNCTION__, ret));
+                       if (buf) {
+                               MFREE(bus->dhd->osh, buf, size);
+                       }
+                       bus->dhd->memdump_success = FALSE;
+                       return BCME_ERROR;
+               }
+               DHD_TRACE(("."));
+
+               /* Decrement size and increment start address */
+               size -= read_size;
+               start += read_size;
+               databuf += read_size;
+       }
+       bus->dhd->memdump_success = TRUE;
+
+       DHD_TRACE_HW4(("%s FUNC: Copy fw image to the embedded buffer \n", __FUNCTION__));
+
+       dhd_save_fwdump(bus->dhd, buf, bus->ramsize);
+       dhd_schedule_memdump(bus->dhd, buf, bus->ramsize);
+
+       return ret;
+}
+
+int
+dhd_bus_mem_dump(dhd_pub_t *dhdp)
+{
+       dhd_bus_t *bus = dhdp->bus;
+
+       if (bus->suspended) {
+               DHD_ERROR(("%s: Bus is suspend so skip\n", __FUNCTION__));
+               return 0;
+       }
+
+       return dhdpcie_mem_dump(bus);
+}
+
+#ifdef BCMDHDX
+int
+dhdx_dongle_mem_dump()
+{
+       if (!g_dhd_bus) {
+               DHD_ERROR(("%s: Bus is NULL\n", __FUNCTION__));
+               return -ENODEV;
+       }
+
+       if (g_dhd_bus->suspended) {
+               DHD_ERROR(("%s: Bus is suspend so skip\n", __FUNCTION__));
+               return 0;
+       }
+
+       g_dhd_bus->dhd->memdump_enabled = DUMP_MEMFILE_BUGON;
+       g_dhd_bus->dhd->memdump_type = DUMP_TYPE_AP_ABNORMAL_ACCESS;
+
+       return dhdpcie_mem_dump(g_dhd_bus);
+}
+EXPORT_SYMBOL(dhdx_dongle_mem_dump);
+#else
+int
+dhd_dongle_mem_dump()
+{
+       if (!g_dhd_bus) {
+               DHD_ERROR(("%s: Bus is NULL\n", __FUNCTION__));
+               return -ENODEV;
+       }
+
+       if (g_dhd_bus->suspended) {
+               DHD_ERROR(("%s: Bus is suspend so skip\n", __FUNCTION__));
+               return 0;
+       }
+
+       g_dhd_bus->dhd->memdump_enabled = DUMP_MEMFILE_BUGON;
+       g_dhd_bus->dhd->memdump_type = DUMP_TYPE_AP_ABNORMAL_ACCESS;
+
+       return dhdpcie_mem_dump(g_dhd_bus);
+}
+EXPORT_SYMBOL(dhd_dongle_mem_dump);
+#endif /* BCMDHDX */
+#endif /* DHD_FW_COREDUMP */
+
+int
+dhd_socram_dump(dhd_bus_t *bus)
+{
+#if defined(DHD_FW_COREDUMP)
+       return (dhdpcie_mem_dump(bus));
+#else
+       return -1;
+#endif
+}
+
+/**
+ * Transfers bytes from host to dongle using pio mode.
+ * Parameter 'address' is a backplane address.
+ */
+static int
+dhdpcie_bus_membytes(dhd_bus_t *bus, bool write, ulong address, uint8 *data, uint size)
+{
+       uint dsize;
+       int detect_endian_flag = 0x01;
+       bool little_endian;
+
+       if (write && bus->is_linkdown) {
+               DHD_ERROR(("%s: PCIe link was down\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       /* Detect endianness. */
+       little_endian = *(char *)&detect_endian_flag;
+
+       /* In remap mode, adjust address beyond socram and redirect
+        * to devram at SOCDEVRAM_BP_ADDR since remap address > orig_ramsize
+        * is not backplane accessible
+        */
+
+       /* Determine initial transfer parameters */
+       dsize = sizeof(uint64);
+
+       /* Do the transfer(s) */
+       if (write) {
+               while (size) {
+                       if (size >= sizeof(uint64) && little_endian &&
+#ifdef CONFIG_64BIT
+                               !(address % 8) &&
+#endif /* CONFIG_64BIT */
+                               1) {
+                               dhdpcie_bus_wtcm64(bus, address, *((uint64 *)data));
+                       } else {
+                               dsize = sizeof(uint8);
+                               dhdpcie_bus_wtcm8(bus, address, *data);
+                       }
+
+                       /* Adjust for next transfer (if any) */
+                       if ((size -= dsize)) {
+                               data += dsize;
+                               address += dsize;
+                       }
+               }
+       } else {
+               while (size) {
+                       if (size >= sizeof(uint64) && little_endian &&
+#ifdef CONFIG_64BIT
+                               !(address % 8) &&
+#endif /* CONFIG_64BIT */
+                               1) {
+                               *(uint64 *)data = dhdpcie_bus_rtcm64(bus, address);
+                       } else {
+                               dsize = sizeof(uint8);
+                               *data = dhdpcie_bus_rtcm8(bus, address);
+                       }
+
+                       /* Adjust for next transfer (if any) */
+                       if ((size -= dsize) > 0) {
+                               data += dsize;
+                               address += dsize;
+                       }
+               }
+       }
+       return BCME_OK;
+} /* dhdpcie_bus_membytes */
+
+/**
+ * Transfers one transmit (ethernet) packet that was queued in the (flow controlled) flow ring queue
+ * to the (non flow controlled) flow ring.
+ */
+int BCMFASTPATH
+dhd_bus_schedule_queue(struct dhd_bus  *bus, uint16 flow_id, bool txs)
+{
+       flow_ring_node_t *flow_ring_node;
+       int ret = BCME_OK;
+#ifdef DHD_LOSSLESS_ROAMING
+       dhd_pub_t *dhdp = bus->dhd;
+#endif
+       DHD_INFO(("%s: flow_id is %d\n", __FUNCTION__, flow_id));
+
+       /* ASSERT on flow_id */
+       if (flow_id >= bus->max_sub_queues) {
+               DHD_ERROR(("%s: flow_id is invalid %d, max %d\n", __FUNCTION__,
+                       flow_id, bus->max_sub_queues));
+               return 0;
+       }
+
+       flow_ring_node = DHD_FLOW_RING(bus->dhd, flow_id);
+
+#ifdef DHD_LOSSLESS_ROAMING
+       if ((dhdp->dequeue_prec_map & (1 << flow_ring_node->flow_info.tid)) == 0) {
+               DHD_INFO(("%s: tid %d is not in precedence map. block scheduling\n",
+                       __FUNCTION__, flow_ring_node->flow_info.tid));
+               return BCME_OK;
+       }
+#endif /* DHD_LOSSLESS_ROAMING */
+
+       {
+               unsigned long flags;
+               void *txp = NULL;
+               flow_queue_t *queue;
+#ifdef DHD_LOSSLESS_ROAMING
+               struct ether_header *eh;
+               uint8 *pktdata;
+#endif /* DHD_LOSSLESS_ROAMING */
+
+               queue = &flow_ring_node->queue; /* queue associated with flow ring */
+
+               DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+
+               if (flow_ring_node->status != FLOW_RING_STATUS_OPEN) {
+                       DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+                       return BCME_NOTREADY;
+               }
+
+               while ((txp = dhd_flow_queue_dequeue(bus->dhd, queue)) != NULL) {
+                       PKTORPHAN(txp);
+
+                       /*
+                        * Modifying the packet length caused P2P cert failures.
+                        * Specifically on test cases where a packet of size 52 bytes
+                        * was injected, the sniffer capture showed 62 bytes because of
+                        * which the cert tests failed. So making the below change
+                        * only Router specific.
+                        */
+
+#ifdef DHDTCPACK_SUPPRESS
+                       if (bus->dhd->tcpack_sup_mode != TCPACK_SUP_HOLD) {
+                               ret = dhd_tcpack_check_xmit(bus->dhd, txp);
+                               if (ret != BCME_OK) {
+                                       DHD_ERROR(("%s: dhd_tcpack_check_xmit() error.\n",
+                                               __FUNCTION__));
+                               }
+                       }
+#endif /* DHDTCPACK_SUPPRESS */
+#ifdef DHD_LOSSLESS_ROAMING
+                       pktdata = (uint8 *)PKTDATA(OSH_NULL, txp);
+                       eh = (struct ether_header *) pktdata;
+                       if (eh->ether_type == hton16(ETHER_TYPE_802_1X)) {
+                               uint8 prio = (uint8)PKTPRIO(txp);
+
+                               /* Restore to original priority for 802.1X packet */
+                               if (prio == PRIO_8021D_NC) {
+                                       PKTSETPRIO(txp, dhdp->prio_8021x);
+                               }
+                       }
+#endif /* DHD_LOSSLESS_ROAMING */
+
+                       /* Attempt to transfer packet over flow ring */
+                       ret = dhd_prot_txdata(bus->dhd, txp, flow_ring_node->flow_info.ifindex);
+                       if (ret != BCME_OK) { /* may not have resources in flow ring */
+                               DHD_INFO(("%s: Reinserrt %d\n", __FUNCTION__, ret));
+                               dhd_prot_txdata_write_flush(bus->dhd, flow_id, FALSE);
+                               /* reinsert at head */
+                               dhd_flow_queue_reinsert(bus->dhd, queue, txp);
+                               DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+
+                               /* If we are able to requeue back, return success */
+                               return BCME_OK;
+                       }
+               }
+
+               dhd_prot_txdata_write_flush(bus->dhd, flow_id, FALSE);
+
+               DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+       }
+
+       return ret;
+} /* dhd_bus_schedule_queue */
+
+/** Sends an (ethernet) data frame (in 'txp') to the dongle. Callee disposes of txp. */
+int BCMFASTPATH
+dhd_bus_txdata(struct dhd_bus *bus, void *txp, uint8 ifidx)
+{
+       uint16 flowid;
+       flow_queue_t *queue;
+       flow_ring_node_t *flow_ring_node;
+       unsigned long flags;
+       int ret = BCME_OK;
+       void *txp_pend = NULL;
+
+       if (!bus->dhd->flowid_allocator) {
+               DHD_ERROR(("%s: Flow ring not intited yet  \n", __FUNCTION__));
+               goto toss;
+       }
+
+       flowid = DHD_PKT_GET_FLOWID(txp);
+
+       flow_ring_node = DHD_FLOW_RING(bus->dhd, flowid);
+
+       DHD_TRACE(("%s: pkt flowid %d, status %d active %d\n",
+               __FUNCTION__, flowid, flow_ring_node->status,
+               flow_ring_node->active));
+
+       DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+       if ((flowid >= bus->dhd->num_flow_rings) ||
+               (!flow_ring_node->active) ||
+               (flow_ring_node->status == FLOW_RING_STATUS_DELETE_PENDING) ||
+               (flow_ring_node->status == FLOW_RING_STATUS_STA_FREEING)) {
+               DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+               DHD_INFO(("%s: Dropping pkt flowid %d, status %d active %d\n",
+                       __FUNCTION__, flowid, flow_ring_node->status,
+                       flow_ring_node->active));
+               ret = BCME_ERROR;
+               goto toss;
+       }
+
+       queue = &flow_ring_node->queue; /* queue associated with flow ring */
+
+       if ((ret = dhd_flow_queue_enqueue(bus->dhd, queue, txp)) != BCME_OK) {
+               txp_pend = txp;
+       }
+
+       DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+
+       if (flow_ring_node->status) {
+               DHD_INFO(("%s: Enq pkt flowid %d, status %d active %d\n",
+                       __FUNCTION__, flowid, flow_ring_node->status,
+                       flow_ring_node->active));
+               if (txp_pend) {
+                       txp = txp_pend;
+                       goto toss;
+               }
+               return BCME_OK;
+       }
+       ret = dhd_bus_schedule_queue(bus, flowid, FALSE); /* from queue to flowring */
+
+       /* If we have anything pending, try to push into q */
+       if (txp_pend) {
+               DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+
+               if ((ret = dhd_flow_queue_enqueue(bus->dhd, queue, txp_pend)) != BCME_OK) {
+                       DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+                       txp = txp_pend;
+                       goto toss;
+               }
+
+               DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+       }
+
+       return ret;
+
+toss:
+       DHD_INFO(("%s: Toss %d\n", __FUNCTION__, ret));
+       PKTCFREE(bus->dhd->osh, txp, TRUE);
+       return ret;
+} /* dhd_bus_txdata */
+
+
+void
+dhd_bus_stop_queue(struct dhd_bus *bus)
+{
+       dhd_txflowcontrol(bus->dhd, ALL_INTERFACES, ON);
+       bus->bus_flowctrl = TRUE;
+}
+
+void
+dhd_bus_start_queue(struct dhd_bus *bus)
+{
+       dhd_txflowcontrol(bus->dhd, ALL_INTERFACES, OFF);
+       bus->bus_flowctrl = TRUE;
+}
+
+#if defined(DHD_DEBUG)
+/* Device console input function */
+int dhd_bus_console_in(dhd_pub_t *dhd, uchar *msg, uint msglen)
+{
+       dhd_bus_t *bus = dhd->bus;
+       uint32 addr, val;
+       int rv;
+       /* Address could be zero if CONSOLE := 0 in dongle Makefile */
+       if (bus->console_addr == 0)
+               return BCME_UNSUPPORTED;
+
+       /* Don't allow input if dongle is in reset */
+       if (bus->dhd->dongle_reset) {
+               dhd_os_sdunlock(bus->dhd);
+               return BCME_NOTREADY;
+       }
+
+       /* Zero cbuf_index */
+       addr = bus->console_addr + OFFSETOF(hnd_cons_t, cbuf_idx);
+       val = htol32(0);
+       if ((rv = dhdpcie_bus_membytes(bus, TRUE, addr, (uint8 *)&val, sizeof(val))) < 0)
+               goto done;
+
+       /* Write message into cbuf */
+       addr = bus->console_addr + OFFSETOF(hnd_cons_t, cbuf);
+       if ((rv = dhdpcie_bus_membytes(bus, TRUE, addr, (uint8 *)msg, msglen)) < 0)
+               goto done;
+
+       /* Write length into vcons_in */
+       addr = bus->console_addr + OFFSETOF(hnd_cons_t, vcons_in);
+       val = htol32(msglen);
+       if ((rv = dhdpcie_bus_membytes(bus, TRUE, addr, (uint8 *)&val, sizeof(val))) < 0)
+               goto done;
+
+       /* generate an interrupt to dongle to indicate that it needs to process cons command */
+       dhdpcie_send_mb_data(bus, H2D_HOST_CONS_INT);
+done:
+       return rv;
+} /* dhd_bus_console_in */
+#endif /* defined(DHD_DEBUG) */
+
+/**
+ * Called on frame reception, the frame was received from the dongle on interface 'ifidx' and is
+ * contained in 'pkt'. Processes rx frame, forwards up the layer to netif.
+ */
+void BCMFASTPATH
+dhd_bus_rx_frame(struct dhd_bus *bus, void* pkt, int ifidx, uint pkt_count)
+{
+       dhd_rx_frame(bus->dhd, ifidx, pkt, pkt_count, 0);
+}
+
+/** 'offset' is a backplane address */
+void
+dhdpcie_bus_wtcm8(dhd_bus_t *bus, ulong offset, uint8 data)
+{
+       *(volatile uint8 *)(bus->tcm + offset) = (uint8)data;
+}
+
+uint8
+dhdpcie_bus_rtcm8(dhd_bus_t *bus, ulong offset)
+{
+       volatile uint8 data;
+
+               data = *(volatile uint8 *)(bus->tcm + offset);
+
+       return data;
+}
+
+void
+dhdpcie_bus_wtcm32(dhd_bus_t *bus, ulong offset, uint32 data)
+{
+       *(volatile uint32 *)(bus->tcm + offset) = (uint32)data;
+}
+void
+dhdpcie_bus_wtcm16(dhd_bus_t *bus, ulong offset, uint16 data)
+{
+       *(volatile uint16 *)(bus->tcm + offset) = (uint16)data;
+}
+void
+dhdpcie_bus_wtcm64(dhd_bus_t *bus, ulong offset, uint64 data)
+{
+       *(volatile uint64 *)(bus->tcm + offset) = (uint64)data;
+}
+
+uint16
+dhdpcie_bus_rtcm16(dhd_bus_t *bus, ulong offset)
+{
+       volatile uint16 data;
+
+               data = *(volatile uint16 *)(bus->tcm + offset);
+
+       return data;
+}
+
+uint32
+dhdpcie_bus_rtcm32(dhd_bus_t *bus, ulong offset)
+{
+       volatile uint32 data;
+
+               data = *(volatile uint32 *)(bus->tcm + offset);
+
+       return data;
+}
+
+uint64
+dhdpcie_bus_rtcm64(dhd_bus_t *bus, ulong offset)
+{
+       volatile uint64 data;
+
+               data = *(volatile uint64 *)(bus->tcm + offset);
+
+       return data;
+}
+
+/** A snippet of dongle memory is shared between host and dongle */
+void
+dhd_bus_cmn_writeshared(dhd_bus_t *bus, void *data, uint32 len, uint8 type, uint16 ringid)
+{
+       uint64 long_data;
+       ulong tcm_offset;
+
+       DHD_INFO(("%s: writing to dongle type %d len %d\n", __FUNCTION__, type, len));
+
+       if (bus->is_linkdown) {
+               DHD_ERROR(("%s: PCIe link was down\n", __FUNCTION__));
+               return;
+       }
+
+       switch (type) {
+               case D2H_DMA_SCRATCH_BUF:
+               {
+                       pciedev_shared_t *sh = (pciedev_shared_t*)bus->shared_addr;
+                       long_data = HTOL64(*(uint64 *)data);
+                       tcm_offset = (ulong)&(sh->host_dma_scratch_buffer);
+                       dhdpcie_bus_membytes(bus, TRUE, tcm_offset, (uint8*) &long_data, len);
+                       prhex(__FUNCTION__, data, len);
+                       break;
+               }
+
+               case D2H_DMA_SCRATCH_BUF_LEN:
+               {
+                       pciedev_shared_t *sh = (pciedev_shared_t*)bus->shared_addr;
+                       tcm_offset = (ulong)&(sh->host_dma_scratch_buffer_len);
+                       dhdpcie_bus_wtcm32(bus, tcm_offset, (uint32) HTOL32(*(uint32 *)data));
+                       prhex(__FUNCTION__, data, len);
+                       break;
+               }
+
+               case H2D_DMA_INDX_WR_BUF:
+               {
+                       pciedev_shared_t *shmem = (pciedev_shared_t *)bus->pcie_sh;
+
+                       long_data = HTOL64(*(uint64 *)data);
+                       tcm_offset = (ulong)shmem->rings_info_ptr;
+                       tcm_offset += OFFSETOF(ring_info_t, h2d_w_idx_hostaddr);
+                       dhdpcie_bus_membytes(bus, TRUE, tcm_offset, (uint8*) &long_data, len);
+                       prhex(__FUNCTION__, data, len);
+                       break;
+               }
+
+               case H2D_DMA_INDX_RD_BUF:
+               {
+                       pciedev_shared_t *shmem = (pciedev_shared_t *)bus->pcie_sh;
+                       long_data = HTOL64(*(uint64 *)data);
+                       tcm_offset = (ulong)shmem->rings_info_ptr;
+                       tcm_offset += OFFSETOF(ring_info_t, h2d_r_idx_hostaddr);
+                       dhdpcie_bus_membytes(bus, TRUE, tcm_offset, (uint8*) &long_data, len);
+                       prhex(__FUNCTION__, data, len);
+                       break;
+               }
+
+               case D2H_DMA_INDX_WR_BUF:
+               {
+                       pciedev_shared_t *shmem = (pciedev_shared_t *)bus->pcie_sh;
+                       long_data = HTOL64(*(uint64 *)data);
+                       tcm_offset = (ulong)shmem->rings_info_ptr;
+                       tcm_offset += OFFSETOF(ring_info_t, d2h_w_idx_hostaddr);
+                       dhdpcie_bus_membytes(bus, TRUE, tcm_offset, (uint8*) &long_data, len);
+                       prhex(__FUNCTION__, data, len);
+                       break;
+               }
+
+               case D2H_DMA_INDX_RD_BUF:
+               {
+                       pciedev_shared_t *shmem = (pciedev_shared_t *)bus->pcie_sh;
+                       long_data = HTOL64(*(uint64 *)data);
+                       tcm_offset = (ulong)shmem->rings_info_ptr;
+                       tcm_offset += OFFSETOF(ring_info_t, d2h_r_idx_hostaddr);
+                       dhdpcie_bus_membytes(bus, TRUE, tcm_offset, (uint8*) &long_data, len);
+                       prhex(__FUNCTION__, data, len);
+                       break;
+               }
+
+               case RING_ITEM_LEN:
+                       tcm_offset = bus->ring_sh[ringid].ring_mem_addr;
+                       tcm_offset += OFFSETOF(ring_mem_t, len_items);
+                       dhdpcie_bus_wtcm16(bus, tcm_offset, (uint16) HTOL16(*(uint16 *)data));
+                       break;
+
+               case RING_MAX_ITEMS:
+                       tcm_offset = bus->ring_sh[ringid].ring_mem_addr;
+                       tcm_offset += OFFSETOF(ring_mem_t, max_item);
+                       dhdpcie_bus_wtcm16(bus, tcm_offset, (uint16) HTOL16(*(uint16 *)data));
+                       break;
+
+               case RING_BUF_ADDR:
+                       long_data = HTOL64(*(uint64 *)data);
+                       tcm_offset = bus->ring_sh[ringid].ring_mem_addr;
+                       tcm_offset += OFFSETOF(ring_mem_t, base_addr);
+                       dhdpcie_bus_membytes(bus, TRUE, tcm_offset, (uint8 *) &long_data, len);
+                       prhex(__FUNCTION__, data, len);
+                       break;
+
+               case RING_WR_UPD:
+                       tcm_offset = bus->ring_sh[ringid].ring_state_w;
+                       dhdpcie_bus_wtcm16(bus, tcm_offset, (uint16) HTOL16(*(uint16 *)data));
+                       break;
+
+               case RING_RD_UPD:
+                       tcm_offset = bus->ring_sh[ringid].ring_state_r;
+                       dhdpcie_bus_wtcm16(bus, tcm_offset, (uint16) HTOL16(*(uint16 *)data));
+                       break;
+
+               case D2H_MB_DATA:
+                       dhdpcie_bus_wtcm32(bus, bus->d2h_mb_data_ptr_addr,
+                               (uint32) HTOL32(*(uint32 *)data));
+                       break;
+
+               case H2D_MB_DATA:
+                       dhdpcie_bus_wtcm32(bus, bus->h2d_mb_data_ptr_addr,
+                               (uint32) HTOL32(*(uint32 *)data));
+                       break;
+
+               default:
+                       break;
+       }
+} /* dhd_bus_cmn_writeshared */
+
+/** A snippet of dongle memory is shared between host and dongle */
+void
+dhd_bus_cmn_readshared(dhd_bus_t *bus, void* data, uint8 type, uint16 ringid)
+{
+       ulong tcm_offset;
+
+       switch (type) {
+               case RING_WR_UPD:
+                       tcm_offset = bus->ring_sh[ringid].ring_state_w;
+                       *(uint16*)data = LTOH16(dhdpcie_bus_rtcm16(bus, tcm_offset));
+                       break;
+               case RING_RD_UPD:
+                       tcm_offset = bus->ring_sh[ringid].ring_state_r;
+                       *(uint16*)data = LTOH16(dhdpcie_bus_rtcm16(bus, tcm_offset));
+                       break;
+               case TOTAL_LFRAG_PACKET_CNT:
+               {
+                       pciedev_shared_t *sh = (pciedev_shared_t*)bus->shared_addr;
+                       *(uint16*)data = LTOH16(dhdpcie_bus_rtcm16(bus,
+                               (ulong) &sh->total_lfrag_pkt_cnt));
+                       break;
+               }
+               case H2D_MB_DATA:
+                       *(uint32*)data = LTOH32(dhdpcie_bus_rtcm32(bus, bus->h2d_mb_data_ptr_addr));
+                       break;
+               case D2H_MB_DATA:
+                       *(uint32*)data = LTOH32(dhdpcie_bus_rtcm32(bus, bus->d2h_mb_data_ptr_addr));
+                       break;
+               case MAX_HOST_RXBUFS:
+               {
+                       pciedev_shared_t *sh = (pciedev_shared_t*)bus->shared_addr;
+                       *(uint16*)data = LTOH16(dhdpcie_bus_rtcm16(bus,
+                               (ulong) &sh->max_host_rxbufs));
+                       break;
+               }
+               default :
+                       break;
+       }
+}
+
+uint32 dhd_bus_get_sharedflags(dhd_bus_t *bus)
+{
+       return ((pciedev_shared_t*)bus->pcie_sh)->flags;
+}
+
+void
+dhd_bus_clearcounts(dhd_pub_t *dhdp)
+{
+}
+
+int
+dhd_bus_iovar_op(dhd_pub_t *dhdp, const char *name,
+                 void *params, int plen, void *arg, int len, bool set)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       const bcm_iovar_t *vi = NULL;
+       int bcmerror = 0;
+       int val_size;
+       uint32 actionid;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       ASSERT(name);
+       ASSERT(len >= 0);
+
+       /* Get MUST have return space */
+       ASSERT(set || (arg && len));
+
+       /* Set does NOT take qualifiers */
+       ASSERT(!set || (!params && !plen));
+
+       DHD_INFO(("%s: %s %s, len %d plen %d\n", __FUNCTION__,
+                name, (set ? "set" : "get"), len, plen));
+
+       /* Look up var locally; if not found pass to host driver */
+       if ((vi = bcm_iovar_lookup(dhdpcie_iovars, name)) == NULL) {
+               goto exit;
+       }
+
+
+       /* set up 'params' pointer in case this is a set command so that
+        * the convenience int and bool code can be common to set and get
+        */
+       if (params == NULL) {
+               params = arg;
+               plen = len;
+       }
+
+       if (vi->type == IOVT_VOID)
+               val_size = 0;
+       else if (vi->type == IOVT_BUFFER)
+               val_size = len;
+       else
+               /* all other types are integer sized */
+               val_size = sizeof(int);
+
+       actionid = set ? IOV_SVAL(vi->varid) : IOV_GVAL(vi->varid);
+       bcmerror = dhdpcie_bus_doiovar(bus, vi, actionid, name, params, plen, arg, len, val_size);
+
+exit:
+       return bcmerror;
+} /* dhd_bus_iovar_op */
+
+#ifdef BCM_BUZZZ
+#include <bcm_buzzz.h>
+
+int
+dhd_buzzz_dump_cntrs(char *p, uint32 *core, uint32 *log,
+       const int num_counters)
+{
+       int bytes = 0;
+       uint32 ctr;
+       uint32 curr[BCM_BUZZZ_COUNTERS_MAX], prev[BCM_BUZZZ_COUNTERS_MAX];
+       uint32 delta[BCM_BUZZZ_COUNTERS_MAX];
+
+       /* Compute elapsed counter values per counter event type */
+       for (ctr = 0U; ctr < num_counters; ctr++) {
+               prev[ctr] = core[ctr];
+               curr[ctr] = *log++;
+               core[ctr] = curr[ctr];  /* saved for next log */
+
+               if (curr[ctr] < prev[ctr])
+                       delta[ctr] = curr[ctr] + (~0U - prev[ctr]);
+               else
+                       delta[ctr] = (curr[ctr] - prev[ctr]);
+
+               bytes += sprintf(p + bytes, "%12u ", delta[ctr]);
+       }
+
+       return bytes;
+}
+
+typedef union cm3_cnts { /* export this in bcm_buzzz.h */
+       uint32 u32;
+       uint8  u8[4];
+       struct {
+               uint8 cpicnt;
+               uint8 exccnt;
+               uint8 sleepcnt;
+               uint8 lsucnt;
+       };
+} cm3_cnts_t;
+
+int
+dhd_bcm_buzzz_dump_cntrs6(char *p, uint32 *core, uint32 *log)
+{
+       int bytes = 0;
+
+       uint32 cyccnt, instrcnt;
+       cm3_cnts_t cm3_cnts;
+       uint8 foldcnt;
+
+       {   /* 32bit cyccnt */
+               uint32 curr, prev, delta;
+               prev = core[0]; curr = *log++; core[0] = curr;
+               if (curr < prev)
+                       delta = curr + (~0U - prev);
+               else
+                       delta = (curr - prev);
+
+               bytes += sprintf(p + bytes, "%12u ", delta);
+               cyccnt = delta;
+       }
+
+       {       /* Extract the 4 cnts: cpi, exc, sleep and lsu */
+               int i;
+               uint8 max8 = ~0;
+               cm3_cnts_t curr, prev, delta;
+               prev.u32 = core[1]; curr.u32 = * log++; core[1] = curr.u32;
+               for (i = 0; i < 4; i++) {
+                       if (curr.u8[i] < prev.u8[i])
+                               delta.u8[i] = curr.u8[i] + (max8 - prev.u8[i]);
+                       else
+                               delta.u8[i] = (curr.u8[i] - prev.u8[i]);
+                       bytes += sprintf(p + bytes, "%4u ", delta.u8[i]);
+               }
+               cm3_cnts.u32 = delta.u32;
+       }
+
+       {   /* Extract the foldcnt from arg0 */
+               uint8 curr, prev, delta, max8 = ~0;
+               bcm_buzzz_arg0_t arg0; arg0.u32 = *log;
+               prev = core[2]; curr = arg0.klog.cnt; core[2] = curr;
+               if (curr < prev)
+                       delta = curr + (max8 - prev);
+               else
+                       delta = (curr - prev);
+               bytes += sprintf(p + bytes, "%4u ", delta);
+               foldcnt = delta;
+       }
+
+       instrcnt = cyccnt - (cm3_cnts.u8[0] + cm3_cnts.u8[1] + cm3_cnts.u8[2]
+                                + cm3_cnts.u8[3]) + foldcnt;
+       if (instrcnt > 0xFFFFFF00)
+               bytes += sprintf(p + bytes, "[%10s] ", "~");
+       else
+               bytes += sprintf(p + bytes, "[%10u] ", instrcnt);
+       return bytes;
+}
+
+int
+dhd_buzzz_dump_log(char *p, uint32 *core, uint32 *log, bcm_buzzz_t *buzzz)
+{
+       int bytes = 0;
+       bcm_buzzz_arg0_t arg0;
+       static uint8 * fmt[] = BCM_BUZZZ_FMT_STRINGS;
+
+       if (buzzz->counters == 6) {
+               bytes += dhd_bcm_buzzz_dump_cntrs6(p, core, log);
+               log += 2; /* 32bit cyccnt + (4 x 8bit) CM3 */
+       } else {
+               bytes += dhd_buzzz_dump_cntrs(p, core, log, buzzz->counters);
+               log += buzzz->counters; /* (N x 32bit) CR4=3, CA7=4 */
+       }
+
+       /* Dump the logged arguments using the registered formats */
+       arg0.u32 = *log++;
+
+       switch (arg0.klog.args) {
+               case 0:
+                       bytes += sprintf(p + bytes, fmt[arg0.klog.id]);
+                       break;
+               case 1:
+               {
+                       uint32 arg1 = *log++;
+                       bytes += sprintf(p + bytes, fmt[arg0.klog.id], arg1);
+                       break;
+               }
+               case 2:
+               {
+                       uint32 arg1, arg2;
+                       arg1 = *log++; arg2 = *log++;
+                       bytes += sprintf(p + bytes, fmt[arg0.klog.id], arg1, arg2);
+                       break;
+               }
+               case 3:
+               {
+                       uint32 arg1, arg2, arg3;
+                       arg1 = *log++; arg2 = *log++; arg3 = *log++;
+                       bytes += sprintf(p + bytes, fmt[arg0.klog.id], arg1, arg2, arg3);
+                       break;
+               }
+               case 4:
+               {
+                       uint32 arg1, arg2, arg3, arg4;
+                       arg1 = *log++; arg2 = *log++;
+                       arg3 = *log++; arg4 = *log++;
+                       bytes += sprintf(p + bytes, fmt[arg0.klog.id], arg1, arg2, arg3, arg4);
+                       break;
+               }
+               default:
+                       printf("Maximum one argument supported\n");
+                       break;
+       }
+
+       bytes += sprintf(p + bytes, "\n");
+
+       return bytes;
+}
+
+void dhd_buzzz_dump(bcm_buzzz_t *buzzz_p, void *buffer_p, char *p)
+{
+       int i;
+       uint32 total, part1, part2, log_sz, core[BCM_BUZZZ_COUNTERS_MAX];
+       void * log;
+
+       for (i = 0; i < BCM_BUZZZ_COUNTERS_MAX; i++) {
+               core[i] = 0;
+       }
+
+       log_sz = buzzz_p->log_sz;
+
+       part1 = ((uint32)buzzz_p->cur - (uint32)buzzz_p->log) / log_sz;
+
+       if (buzzz_p->wrap == TRUE) {
+               part2 = ((uint32)buzzz_p->end - (uint32)buzzz_p->cur) / log_sz;
+               total = (buzzz_p->buffer_sz - BCM_BUZZZ_LOGENTRY_MAXSZ) / log_sz;
+       } else {
+               part2 = 0U;
+               total = buzzz_p->count;
+       }
+
+       if (total == 0U) {
+               printf("bcm_buzzz_dump total<%u> done\n", total);
+               return;
+       } else {
+               printf("bcm_buzzz_dump total<%u> : part2<%u> + part1<%u>\n",
+                      total, part2, part1);
+       }
+
+       if (part2) {   /* with wrap */
+               log = (void*)((size_t)buffer_p + (buzzz_p->cur - buzzz_p->log));
+               while (part2--) {   /* from cur to end : part2 */
+                       p[0] = '\0';
+                       dhd_buzzz_dump_log(p, core, (uint32 *)log, buzzz_p);
+                       printf("%s", p);
+                       log = (void*)((size_t)log + buzzz_p->log_sz);
+               }
+       }
+
+       log = (void*)buffer_p;
+       while (part1--) {
+               p[0] = '\0';
+               dhd_buzzz_dump_log(p, core, (uint32 *)log, buzzz_p);
+               printf("%s", p);
+               log = (void*)((size_t)log + buzzz_p->log_sz);
+       }
+
+       printf("bcm_buzzz_dump done.\n");
+}
+
+int dhd_buzzz_dump_dngl(dhd_bus_t *bus)
+{
+       bcm_buzzz_t * buzzz_p = NULL;
+       void * buffer_p = NULL;
+       char * page_p = NULL;
+       pciedev_shared_t *sh;
+       int ret = 0;
+
+       if (bus->dhd->busstate != DHD_BUS_DATA) {
+               return BCME_UNSUPPORTED;
+       }
+       if ((page_p = (char *)MALLOC(bus->dhd->osh, 4096)) == NULL) {
+               printf("Page memory allocation failure\n");
+               goto done;
+       }
+       if ((buzzz_p = MALLOC(bus->dhd->osh, sizeof(bcm_buzzz_t))) == NULL) {
+               printf("BCM BUZZZ memory allocation failure\n");
+               goto done;
+       }
+
+       ret = dhdpcie_readshared(bus);
+       if (ret < 0) {
+               DHD_ERROR(("%s :Shared area read failed \n", __FUNCTION__));
+               goto done;
+       }
+
+       sh = bus->pcie_sh;
+
+       DHD_INFO(("%s buzzz:%08x\n", __FUNCTION__, sh->buzzz));
+
+       if (sh->buzzz != 0U) {  /* Fetch and display dongle BUZZZ Trace */
+
+               dhdpcie_bus_membytes(bus, FALSE, (ulong)sh->buzzz,
+                                    (uint8 *)buzzz_p, sizeof(bcm_buzzz_t));
+
+               printf("BUZZZ[0x%08x]: log<0x%08x> cur<0x%08x> end<0x%08x> "
+                       "count<%u> status<%u> wrap<%u>\n"
+                       "cpu<0x%02X> counters<%u> group<%u> buffer_sz<%u> log_sz<%u>\n",
+                       (int)sh->buzzz,
+                       (int)buzzz_p->log, (int)buzzz_p->cur, (int)buzzz_p->end,
+                       buzzz_p->count, buzzz_p->status, buzzz_p->wrap,
+                       buzzz_p->cpu_idcode, buzzz_p->counters, buzzz_p->group,
+                       buzzz_p->buffer_sz, buzzz_p->log_sz);
+
+               if (buzzz_p->count == 0) {
+                       printf("Empty dongle BUZZZ trace\n\n");
+                       goto done;
+               }
+
+               /* Allocate memory for trace buffer and format strings */
+               buffer_p = MALLOC(bus->dhd->osh, buzzz_p->buffer_sz);
+               if (buffer_p == NULL) {
+                       printf("Buffer memory allocation failure\n");
+                       goto done;
+               }
+
+               /* Fetch the trace. format strings are exported via bcm_buzzz.h */
+               dhdpcie_bus_membytes(bus, FALSE, (uint32)buzzz_p->log,   /* Trace */
+                                    (uint8 *)buffer_p, buzzz_p->buffer_sz);
+
+               /* Process and display the trace using formatted output */
+
+               {
+                       int ctr;
+                       for (ctr = 0; ctr < buzzz_p->counters; ctr++) {
+                               printf("<Evt[%02X]> ", buzzz_p->eventid[ctr]);
+                       }
+                       printf("<code execution point>\n");
+               }
+
+               dhd_buzzz_dump(buzzz_p, buffer_p, page_p);
+
+               printf("----- End of dongle BCM BUZZZ Trace -----\n\n");
+
+               MFREE(bus->dhd->osh, buffer_p, buzzz_p->buffer_sz); buffer_p = NULL;
+       }
+
+done:
+
+       if (page_p)   MFREE(bus->dhd->osh, page_p, 4096);
+       if (buzzz_p)  MFREE(bus->dhd->osh, buzzz_p, sizeof(bcm_buzzz_t));
+       if (buffer_p) MFREE(bus->dhd->osh, buffer_p, buzzz_p->buffer_sz);
+
+       return BCME_OK;
+}
+#endif /* BCM_BUZZZ */
+
+#define PCIE_GEN2(sih) ((BUSTYPE((sih)->bustype) == PCI_BUS) &&        \
+       ((sih)->buscoretype == PCIE2_CORE_ID))
+
+static bool
+pcie2_mdiosetblock(dhd_bus_t *bus, uint blk)
+{
+       uint mdiodata, mdioctrl, i = 0;
+       uint pcie_serdes_spinwait = 200;
+
+       mdioctrl = MDIOCTL2_DIVISOR_VAL | (0x1F << MDIOCTL2_REGADDR_SHF);
+       mdiodata = (blk << MDIODATA2_DEVADDR_SHF) | MDIODATA2_DONE;
+
+       si_corereg(bus->sih, bus->sih->buscoreidx, PCIE2_MDIO_CONTROL, ~0, mdioctrl);
+       si_corereg(bus->sih, bus->sih->buscoreidx, PCIE2_MDIO_WR_DATA, ~0, mdiodata);
+
+       OSL_DELAY(10);
+       /* retry till the transaction is complete */
+       while (i < pcie_serdes_spinwait) {
+               uint mdioctrl_read = si_corereg(bus->sih, bus->sih->buscoreidx, PCIE2_MDIO_WR_DATA,
+                       0, 0);
+               if (!(mdioctrl_read & MDIODATA2_DONE)) {
+                       break;
+               }
+               OSL_DELAY(1000);
+               i++;
+       }
+
+       if (i >= pcie_serdes_spinwait) {
+               DHD_ERROR(("pcie_mdiosetblock: timed out\n"));
+               return FALSE;
+       }
+
+       return TRUE;
+}
+
+
+int
+dhd_bus_devreset(dhd_pub_t *dhdp, uint8 flag)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       int bcmerror = 0;
+       unsigned long flags;
+#ifdef CONFIG_ARCH_MSM
+       int retry = POWERUP_MAX_RETRY;
+#endif /* CONFIG_ARCH_MSM */
+
+       if (dhd_download_fw_on_driverload) {
+               bcmerror = dhd_bus_start(dhdp);
+       } else {
+               if (flag == TRUE) { /* Turn off WLAN */
+                       /* Removing Power */
+                       DHD_ERROR(("%s: == Power OFF ==\n", __FUNCTION__));
+
+                       bus->dhd->up = FALSE;
+
+                       if (bus->dhd->busstate != DHD_BUS_DOWN) {
+                               dhdpcie_advertise_bus_cleanup(bus->dhd);
+                               if (bus->intr) {
+                                       dhdpcie_free_irq(bus);
+                               }
+#ifdef BCMPCIE_OOB_HOST_WAKE
+                               /* Clean up any pending host wake IRQ */
+                               dhd_bus_oob_intr_set(bus->dhd, FALSE);
+                               dhd_bus_oob_intr_unregister(bus->dhd);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+                               dhd_os_wd_timer(dhdp, 0);
+                               dhd_bus_stop(bus, TRUE);
+                               dhd_prot_reset(dhdp);
+                               dhd_clear(dhdp);
+                               dhd_bus_release_dongle(bus);
+                               dhdpcie_bus_free_resource(bus);
+                               bcmerror = dhdpcie_bus_disable_device(bus);
+                               if (bcmerror) {
+                                       DHD_ERROR(("%s: dhdpcie_bus_disable_device: %d\n",
+                                               __FUNCTION__, bcmerror));
+                                       goto done;
+                               }
+#ifdef CONFIG_ARCH_MSM
+                               bcmerror = dhdpcie_bus_clock_stop(bus);
+                               if (bcmerror) {
+                                       DHD_ERROR(("%s: host clock stop failed: %d\n",
+                                               __FUNCTION__, bcmerror));
+                                       goto done;
+                               }
+#endif /* CONFIG_ARCH_MSM */
+                               DHD_GENERAL_LOCK(bus->dhd, flags);
+                               bus->dhd->busstate = DHD_BUS_DOWN;
+                               DHD_GENERAL_UNLOCK(bus->dhd, flags);
+                       } else {
+                               if (bus->intr) {
+                                       dhdpcie_free_irq(bus);
+                               }
+#ifdef BCMPCIE_OOB_HOST_WAKE
+                               /* Clean up any pending host wake IRQ */
+                               dhd_bus_oob_intr_set(bus->dhd, FALSE);
+                               dhd_bus_oob_intr_unregister(bus->dhd);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+                               dhd_prot_reset(dhdp);
+                               dhd_clear(dhdp);
+                               dhd_bus_release_dongle(bus);
+                               dhdpcie_bus_free_resource(bus);
+                               bcmerror = dhdpcie_bus_disable_device(bus);
+                               if (bcmerror) {
+                                       DHD_ERROR(("%s: dhdpcie_bus_disable_device: %d\n",
+                                               __FUNCTION__, bcmerror));
+                                       goto done;
+                               }
+
+#ifdef CONFIG_ARCH_MSM
+                               bcmerror = dhdpcie_bus_clock_stop(bus);
+                               if (bcmerror) {
+                                       DHD_ERROR(("%s: host clock stop failed: %d\n",
+                                               __FUNCTION__, bcmerror));
+                                       goto done;
+                               }
+#endif  /* CONFIG_ARCH_MSM */
+                       }
+
+                       bus->dhd->dongle_reset = TRUE;
+                       DHD_ERROR(("%s:  WLAN OFF Done\n", __FUNCTION__));
+
+               } else { /* Turn on WLAN */
+                       if (bus->dhd->busstate == DHD_BUS_DOWN) {
+                               /* Powering On */
+                               DHD_ERROR(("%s: == Power ON ==\n", __FUNCTION__));
+#ifdef CONFIG_ARCH_MSM
+                               while (--retry) {
+                                       bcmerror = dhdpcie_bus_clock_start(bus);
+                                       if (!bcmerror) {
+                                               DHD_ERROR(("%s: dhdpcie_bus_clock_start OK\n",
+                                                       __FUNCTION__));
+                                               break;
+                                       } else {
+                                               OSL_SLEEP(10);
+                                       }
+                               }
+
+                               if (bcmerror && !retry) {
+                                       DHD_ERROR(("%s: host pcie clock enable failed: %d\n",
+                                               __FUNCTION__, bcmerror));
+                                       goto done;
+                               }
+#endif /* CONFIG_ARCH_MSM */
+                               bus->is_linkdown = 0;
+                               bus->pci_d3hot_done = 0;
+                               bcmerror = dhdpcie_bus_enable_device(bus);
+                               if (bcmerror) {
+                                       DHD_ERROR(("%s: host configuration restore failed: %d\n",
+                                               __FUNCTION__, bcmerror));
+                                       goto done;
+                               }
+
+                               bcmerror = dhdpcie_bus_alloc_resource(bus);
+                               if (bcmerror) {
+                                       DHD_ERROR(("%s: dhdpcie_bus_resource_alloc failed: %d\n",
+                                               __FUNCTION__, bcmerror));
+                                       goto done;
+                               }
+
+                               bcmerror = dhdpcie_bus_dongle_attach(bus);
+                               if (bcmerror) {
+                                       DHD_ERROR(("%s: dhdpcie_bus_dongle_attach failed: %d\n",
+                                               __FUNCTION__, bcmerror));
+                                       goto done;
+                               }
+
+                               bcmerror = dhd_bus_request_irq(bus);
+                               if (bcmerror) {
+                                       DHD_ERROR(("%s: dhd_bus_request_irq failed: %d\n",
+                                               __FUNCTION__, bcmerror));
+                                       goto done;
+                               }
+
+                               bus->dhd->dongle_reset = FALSE;
+
+                               bcmerror = dhd_bus_start(dhdp);
+                               if (bcmerror) {
+                                       DHD_ERROR(("%s: dhd_bus_start: %d\n",
+                                               __FUNCTION__, bcmerror));
+                                       goto done;
+                               }
+
+                               bus->dhd->up = TRUE;
+                               DHD_ERROR(("%s: WLAN Power On Done\n", __FUNCTION__));
+                       } else {
+                               DHD_ERROR(("%s: what should we do here\n", __FUNCTION__));
+                               goto done;
+                       }
+               }
+       }
+
+done:
+       if (bcmerror) {
+               DHD_GENERAL_LOCK(bus->dhd, flags);
+               bus->dhd->busstate = DHD_BUS_DOWN;
+               DHD_GENERAL_UNLOCK(bus->dhd, flags);
+       }
+
+       return bcmerror;
+}
+
+static int
+pcie2_mdioop(dhd_bus_t *bus, uint physmedia, uint regaddr, bool write, uint *val,
+       bool slave_bypass)
+{
+       uint pcie_serdes_spinwait = 200, i = 0, mdio_ctrl;
+       uint32 reg32;
+
+       pcie2_mdiosetblock(bus, physmedia);
+
+       /* enable mdio access to SERDES */
+       mdio_ctrl = MDIOCTL2_DIVISOR_VAL;
+       mdio_ctrl |= (regaddr << MDIOCTL2_REGADDR_SHF);
+
+       if (slave_bypass)
+               mdio_ctrl |= MDIOCTL2_SLAVE_BYPASS;
+
+       if (!write)
+               mdio_ctrl |= MDIOCTL2_READ;
+
+       si_corereg(bus->sih, bus->sih->buscoreidx, PCIE2_MDIO_CONTROL, ~0, mdio_ctrl);
+
+       if (write) {
+               reg32 =  PCIE2_MDIO_WR_DATA;
+               si_corereg(bus->sih, bus->sih->buscoreidx, PCIE2_MDIO_WR_DATA, ~0,
+                       *val | MDIODATA2_DONE);
+       } else
+               reg32 =  PCIE2_MDIO_RD_DATA;
+
+       /* retry till the transaction is complete */
+       while (i < pcie_serdes_spinwait) {
+               uint done_val =  si_corereg(bus->sih, bus->sih->buscoreidx, reg32, 0, 0);
+               if (!(done_val & MDIODATA2_DONE)) {
+                       if (!write) {
+                               *val = si_corereg(bus->sih, bus->sih->buscoreidx,
+                                       PCIE2_MDIO_RD_DATA, 0, 0);
+                               *val = *val & MDIODATA2_MASK;
+                       }
+                       return 0;
+               }
+               OSL_DELAY(1000);
+               i++;
+       }
+       return -1;
+}
+
+static int
+dhdpcie_bus_doiovar(dhd_bus_t *bus, const bcm_iovar_t *vi, uint32 actionid, const char *name,
+                void *params, int plen, void *arg, int len, int val_size)
+{
+       int bcmerror = 0;
+       int32 int_val = 0;
+       int32 int_val2 = 0;
+       int32 int_val3 = 0;
+       bool bool_val = 0;
+
+       DHD_TRACE(("%s: Enter, action %d name %s params %p plen %d arg %p len %d val_size %d\n",
+                  __FUNCTION__, actionid, name, params, plen, arg, len, val_size));
+
+       if ((bcmerror = bcm_iovar_lencheck(vi, arg, len, IOV_ISSET(actionid))) != 0)
+               goto exit;
+
+       if (plen >= (int)sizeof(int_val))
+               bcopy(params, &int_val, sizeof(int_val));
+
+       if (plen >= (int)sizeof(int_val) * 2)
+               bcopy((void*)((uintptr)params + sizeof(int_val)), &int_val2, sizeof(int_val2));
+
+       if (plen >= (int)sizeof(int_val) * 3)
+               bcopy((void*)((uintptr)params + 2 * sizeof(int_val)), &int_val3, sizeof(int_val3));
+
+       bool_val = (int_val != 0) ? TRUE : FALSE;
+
+       /* Check if dongle is in reset. If so, only allow DEVRESET iovars */
+       if (bus->dhd->dongle_reset && !(actionid == IOV_SVAL(IOV_DEVRESET) ||
+                                       actionid == IOV_GVAL(IOV_DEVRESET))) {
+               bcmerror = BCME_NOTREADY;
+               goto exit;
+       }
+
+       switch (actionid) {
+
+
+       case IOV_SVAL(IOV_VARS):
+               bcmerror = dhdpcie_downloadvars(bus, arg, len);
+               break;
+
+       case IOV_SVAL(IOV_PCIEREG):
+               si_corereg(bus->sih, bus->sih->buscoreidx, OFFSETOF(sbpcieregs_t, configaddr), ~0,
+                       int_val);
+               si_corereg(bus->sih, bus->sih->buscoreidx, OFFSETOF(sbpcieregs_t, configdata), ~0,
+                       int_val2);
+               break;
+
+       case IOV_GVAL(IOV_PCIEREG):
+               si_corereg(bus->sih, bus->sih->buscoreidx, OFFSETOF(sbpcieregs_t, configaddr), ~0,
+                       int_val);
+               int_val = si_corereg(bus->sih, bus->sih->buscoreidx,
+                       OFFSETOF(sbpcieregs_t, configdata), 0, 0);
+               bcopy(&int_val, arg, sizeof(int_val));
+               break;
+
+       case IOV_SVAL(IOV_PCIECOREREG):
+               si_corereg(bus->sih, bus->sih->buscoreidx, int_val, ~0, int_val2);
+               break;
+       case IOV_GVAL(IOV_BAR0_SECWIN_REG):
+       {
+               sdreg_t sdreg;
+               uint32 addr, size;
+
+               bcopy(params, &sdreg, sizeof(sdreg));
+
+               addr = sdreg.offset;
+               size = sdreg.func;
+
+               if (si_backplane_access(bus->sih, addr, size, &int_val, TRUE) != BCME_OK) {
+                       DHD_ERROR(("Invalid size/addr combination \n"));
+                       bcmerror = BCME_ERROR;
+                       break;
+               }
+               bcopy(&int_val, arg, sizeof(int32));
+               break;
+       }
+
+       case IOV_SVAL(IOV_BAR0_SECWIN_REG):
+       {
+               sdreg_t sdreg;
+               uint32 addr, size;
+
+               bcopy(params, &sdreg, sizeof(sdreg));
+
+               addr = sdreg.offset;
+               size = sdreg.func;
+               if (si_backplane_access(bus->sih, addr, size, &sdreg.value, FALSE) != BCME_OK) {
+                       DHD_ERROR(("Invalid size/addr combination \n"));
+                       bcmerror = BCME_ERROR;
+               }
+               break;
+       }
+
+       case IOV_GVAL(IOV_SBREG):
+       {
+               sdreg_t sdreg;
+               uint32 addr, size;
+
+               bcopy(params, &sdreg, sizeof(sdreg));
+
+               addr = sdreg.offset | SI_ENUM_BASE;
+               size = sdreg.func;
+
+               if (si_backplane_access(bus->sih, addr, size, &int_val, TRUE) != BCME_OK) {
+                       DHD_ERROR(("Invalid size/addr combination \n"));
+                       bcmerror = BCME_ERROR;
+                       break;
+               }
+               bcopy(&int_val, arg, sizeof(int32));
+               break;
+       }
+
+       case IOV_SVAL(IOV_SBREG):
+       {
+               sdreg_t sdreg;
+               uint32 addr, size;
+
+               bcopy(params, &sdreg, sizeof(sdreg));
+
+               addr = sdreg.offset | SI_ENUM_BASE;
+               size = sdreg.func;
+               if (si_backplane_access(bus->sih, addr, size, &sdreg.value, FALSE) != BCME_OK) {
+                       DHD_ERROR(("Invalid size/addr combination \n"));
+                       bcmerror = BCME_ERROR;
+               }
+               break;
+       }
+
+       case IOV_GVAL(IOV_PCIESERDESREG):
+       {
+               uint val;
+               if (!PCIE_GEN2(bus->sih)) {
+                       DHD_ERROR(("supported only in pcie gen2\n"));
+                       bcmerror = BCME_ERROR;
+                       break;
+               }
+
+               if (!pcie2_mdioop(bus, int_val, int_val2, FALSE, &val, FALSE)) {
+                       bcopy(&val, arg, sizeof(int32));
+               } else {
+                       DHD_ERROR(("pcie2_mdioop failed.\n"));
+                       bcmerror = BCME_ERROR;
+               }
+               break;
+       }
+
+       case IOV_SVAL(IOV_PCIESERDESREG):
+               if (!PCIE_GEN2(bus->sih)) {
+                       DHD_ERROR(("supported only in pcie gen2\n"));
+                       bcmerror = BCME_ERROR;
+                       break;
+               }
+               if (pcie2_mdioop(bus, int_val, int_val2, TRUE, &int_val3, FALSE)) {
+                       DHD_ERROR(("pcie2_mdioop failed.\n"));
+                       bcmerror = BCME_ERROR;
+               }
+               break;
+       case IOV_GVAL(IOV_PCIECOREREG):
+               int_val = si_corereg(bus->sih, bus->sih->buscoreidx, int_val, 0, 0);
+               bcopy(&int_val, arg, sizeof(int_val));
+               break;
+
+       case IOV_SVAL(IOV_PCIECFGREG):
+               OSL_PCI_WRITE_CONFIG(bus->osh, int_val, 4, int_val2);
+               break;
+
+       case IOV_GVAL(IOV_PCIECFGREG):
+               int_val = OSL_PCI_READ_CONFIG(bus->osh, int_val, 4);
+               bcopy(&int_val, arg, sizeof(int_val));
+               break;
+
+       case IOV_SVAL(IOV_PCIE_LPBK):
+               bcmerror = dhdpcie_bus_lpback_req(bus, int_val);
+               break;
+
+       case IOV_SVAL(IOV_PCIE_DMAXFER):
+               bcmerror = dhdpcie_bus_dmaxfer_req(bus, int_val, int_val2, int_val3);
+               break;
+
+       case IOV_GVAL(IOV_PCIE_SUSPEND):
+               int_val = (bus->dhd->busstate == DHD_BUS_SUSPEND) ? 1 : 0;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_PCIE_SUSPEND):
+               dhdpcie_bus_suspend(bus, bool_val);
+               break;
+
+       case IOV_GVAL(IOV_MEMSIZE):
+               int_val = (int32)bus->ramsize;
+               bcopy(&int_val, arg, val_size);
+               break;
+       case IOV_SVAL(IOV_MEMBYTES):
+       case IOV_GVAL(IOV_MEMBYTES):
+       {
+               uint32 address;         /* absolute backplane address */
+               uint size, dsize;
+               uint8 *data;
+
+               bool set = (actionid == IOV_SVAL(IOV_MEMBYTES));
+
+               ASSERT(plen >= 2*sizeof(int));
+
+               address = (uint32)int_val;
+               bcopy((char *)params + sizeof(int_val), &int_val, sizeof(int_val));
+               size = (uint)int_val;
+
+               /* Do some validation */
+               dsize = set ? plen - (2 * sizeof(int)) : len;
+               if (dsize < size) {
+                       DHD_ERROR(("%s: error on %s membytes, addr 0x%08x size %d dsize %d\n",
+                                  __FUNCTION__, (set ? "set" : "get"), address, size, dsize));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+
+               DHD_INFO(("%s: Request to %s %d bytes at address 0x%08x\n dsize %d ", __FUNCTION__,
+                         (set ? "write" : "read"), size, address, dsize));
+
+               /* check if CR4 */
+               if (si_setcore(bus->sih, ARMCR4_CORE_ID, 0) ||
+                   si_setcore(bus->sih, SYSMEM_CORE_ID, 0)) {
+                       /* if address is 0, store the reset instruction to be written in 0 */
+                       if (set && address == bus->dongle_ram_base) {
+                               bus->resetinstr = *(((uint32*)params) + 2);
+                       }
+               } else {
+               /* If we know about SOCRAM, check for a fit */
+               if ((bus->orig_ramsize) &&
+                   ((address > bus->orig_ramsize) || (address + size > bus->orig_ramsize)))
+               {
+                       uint8 enable, protect, remap;
+                       si_socdevram(bus->sih, FALSE, &enable, &protect, &remap);
+                       if (!enable || protect) {
+                               DHD_ERROR(("%s: ramsize 0x%08x doesn't have %d bytes at 0x%08x\n",
+                                       __FUNCTION__, bus->orig_ramsize, size, address));
+                               DHD_ERROR(("%s: socram enable %d, protect %d\n",
+                                       __FUNCTION__, enable, protect));
+                               bcmerror = BCME_BADARG;
+                               break;
+                       }
+
+                       if (!REMAP_ENAB(bus) && (address >= SOCDEVRAM_ARM_ADDR)) {
+                               uint32 devramsize = si_socdevram_size(bus->sih);
+                               if ((address < SOCDEVRAM_ARM_ADDR) ||
+                                       (address + size > (SOCDEVRAM_ARM_ADDR + devramsize))) {
+                                       DHD_ERROR(("%s: bad address 0x%08x, size 0x%08x\n",
+                                               __FUNCTION__, address, size));
+                                       DHD_ERROR(("%s: socram range 0x%08x,size 0x%08x\n",
+                                               __FUNCTION__, SOCDEVRAM_ARM_ADDR, devramsize));
+                                       bcmerror = BCME_BADARG;
+                                       break;
+                               }
+                               /* move it such that address is real now */
+                               address -= SOCDEVRAM_ARM_ADDR;
+                               address += SOCDEVRAM_BP_ADDR;
+                               DHD_INFO(("%s: Request to %s %d bytes @ Mapped address 0x%08x\n",
+                                       __FUNCTION__, (set ? "write" : "read"), size, address));
+                       } else if (REMAP_ENAB(bus) && REMAP_ISADDR(bus, address) && remap) {
+                               /* Can not access remap region while devram remap bit is set
+                                * ROM content would be returned in this case
+                                */
+                               DHD_ERROR(("%s: Need to disable remap for address 0x%08x\n",
+                                       __FUNCTION__, address));
+                               bcmerror = BCME_ERROR;
+                               break;
+                       }
+               }
+               }
+
+               /* Generate the actual data pointer */
+               data = set ? (uint8*)params + 2 * sizeof(int): (uint8*)arg;
+
+               /* Call to do the transfer */
+               bcmerror = dhdpcie_bus_membytes(bus, set, address, data, size);
+
+               break;
+       }
+
+#ifdef BCM_BUZZZ
+       /* Dump dongle side buzzz trace to console */
+       case IOV_GVAL(IOV_BUZZZ_DUMP):
+               bcmerror = dhd_buzzz_dump_dngl(bus);
+               break;
+#endif /* BCM_BUZZZ */
+
+       case IOV_SVAL(IOV_SET_DOWNLOAD_STATE):
+               bcmerror = dhdpcie_bus_download_state(bus, bool_val);
+               break;
+
+       case IOV_GVAL(IOV_RAMSIZE):
+               int_val = (int32)bus->ramsize;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_GVAL(IOV_RAMSTART):
+               int_val = (int32)bus->dongle_ram_base;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_GVAL(IOV_CC_NVMSHADOW):
+       {
+               struct bcmstrbuf dump_b;
+
+               bcm_binit(&dump_b, arg, len);
+               bcmerror = dhdpcie_cc_nvmshadow(bus, &dump_b);
+               break;
+       }
+
+       case IOV_GVAL(IOV_SLEEP_ALLOWED):
+               bool_val = bus->sleep_allowed;
+               bcopy(&bool_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_SLEEP_ALLOWED):
+               bus->sleep_allowed = bool_val;
+               break;
+
+       case IOV_GVAL(IOV_DONGLEISOLATION):
+               int_val = bus->dhd->dongle_isolation;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_DONGLEISOLATION):
+               bus->dhd->dongle_isolation = bool_val;
+               break;
+
+       case IOV_GVAL(IOV_LTRSLEEPON_UNLOOAD):
+               int_val = bus->ltrsleep_on_unload;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_LTRSLEEPON_UNLOOAD):
+               bus->ltrsleep_on_unload = bool_val;
+               break;
+
+       case IOV_GVAL(IOV_DUMP_RINGUPD_BLOCK):
+       {
+               struct bcmstrbuf dump_b;
+               bcm_binit(&dump_b, arg, len);
+               bcmerror = dhd_prot_ringupd_dump(bus->dhd, &dump_b);
+               break;
+       }
+       case IOV_GVAL(IOV_DMA_RINGINDICES):
+       {       int h2d_support, d2h_support;
+
+               d2h_support = DMA_INDX_ENAB(bus->dhd->dma_d2h_ring_upd_support) ? 1 : 0;
+               h2d_support = DMA_INDX_ENAB(bus->dhd->dma_h2d_ring_upd_support) ? 1 : 0;
+               int_val = d2h_support | (h2d_support << 1);
+               bcopy(&int_val, arg, sizeof(int_val));
+               break;
+       }
+       case IOV_SVAL(IOV_DMA_RINGINDICES):
+               /* Can change it only during initialization/FW download */
+               if (bus->dhd->busstate == DHD_BUS_DOWN) {
+                       if ((int_val > 3) || (int_val < 0)) {
+                               DHD_ERROR(("Bad argument. Possible values: 0, 1, 2 & 3\n"));
+                               bcmerror = BCME_BADARG;
+                       } else {
+                               bus->dhd->dma_d2h_ring_upd_support = (int_val & 1) ? TRUE : FALSE;
+                               bus->dhd->dma_h2d_ring_upd_support = (int_val & 2) ? TRUE : FALSE;
+                       }
+               } else {
+                       DHD_ERROR(("%s: Can change only when bus down (before FW download)\n",
+                               __FUNCTION__));
+                       bcmerror = BCME_NOTDOWN;
+               }
+               break;
+
+       case IOV_GVAL(IOV_METADATA_DBG):
+               int_val = dhd_prot_metadata_dbg_get(bus->dhd);
+               bcopy(&int_val, arg, val_size);
+               break;
+       case IOV_SVAL(IOV_METADATA_DBG):
+               dhd_prot_metadata_dbg_set(bus->dhd, (int_val != 0));
+               break;
+
+       case IOV_GVAL(IOV_RX_METADATALEN):
+               int_val = dhd_prot_metadatalen_get(bus->dhd, TRUE);
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_RX_METADATALEN):
+               if (int_val > 64) {
+                       bcmerror = BCME_BUFTOOLONG;
+                       break;
+               }
+               dhd_prot_metadatalen_set(bus->dhd, int_val, TRUE);
+               break;
+
+       case IOV_SVAL(IOV_TXP_THRESHOLD):
+               dhd_prot_txp_threshold(bus->dhd, TRUE, int_val);
+               break;
+
+       case IOV_GVAL(IOV_TXP_THRESHOLD):
+               int_val = dhd_prot_txp_threshold(bus->dhd, FALSE, int_val);
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_DB1_FOR_MB):
+               if (int_val)
+                       bus->db1_for_mb = TRUE;
+               else
+                       bus->db1_for_mb = FALSE;
+               break;
+
+       case IOV_GVAL(IOV_DB1_FOR_MB):
+               if (bus->db1_for_mb)
+                       int_val = 1;
+               else
+                       int_val = 0;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_GVAL(IOV_TX_METADATALEN):
+               int_val = dhd_prot_metadatalen_get(bus->dhd, FALSE);
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_TX_METADATALEN):
+               if (int_val > 64) {
+                       bcmerror = BCME_BUFTOOLONG;
+                       break;
+               }
+               dhd_prot_metadatalen_set(bus->dhd, int_val, FALSE);
+               break;
+
+       case IOV_SVAL(IOV_DEVRESET):
+               dhd_bus_devreset(bus->dhd, (uint8)bool_val);
+               break;
+
+       case IOV_GVAL(IOV_FLOW_PRIO_MAP):
+               int_val = bus->dhd->flow_prio_map_type;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_FLOW_PRIO_MAP):
+               int_val = (int32)dhd_update_flow_prio_map(bus->dhd, (uint8)int_val);
+               bcopy(&int_val, arg, val_size);
+               break;
+
+#ifdef DHD_PCIE_RUNTIMEPM
+       case IOV_GVAL(IOV_IDLETIME):
+               int_val = bus->idletime;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_IDLETIME):
+               if (int_val < 0) {
+                       bcmerror = BCME_BADARG;
+               } else {
+                       bus->idletime = int_val;
+               }
+               break;
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+       case IOV_GVAL(IOV_TXBOUND):
+               int_val = (int32)dhd_txbound;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_TXBOUND):
+               dhd_txbound = (uint)int_val;
+               break;
+
+       case IOV_GVAL(IOV_RXBOUND):
+               int_val = (int32)dhd_rxbound;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_RXBOUND):
+               dhd_rxbound = (uint)int_val;
+               break;
+
+       case IOV_SVAL(IOV_HANGREPORT):
+               bus->dhd->hang_report = bool_val;
+               DHD_ERROR(("%s: Set hang_report as %d\n",
+                       __FUNCTION__, bus->dhd->hang_report));
+               break;
+
+       case IOV_GVAL(IOV_HANGREPORT):
+               int_val = (int32)bus->dhd->hang_report;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       default:
+               bcmerror = BCME_UNSUPPORTED;
+               break;
+       }
+
+exit:
+       return bcmerror;
+} /* dhdpcie_bus_doiovar */
+
+/** Transfers bytes from host to dongle using pio mode */
+static int
+dhdpcie_bus_lpback_req(struct  dhd_bus *bus, uint32 len)
+{
+       if (bus->dhd == NULL) {
+               DHD_ERROR(("bus not inited\n"));
+               return 0;
+       }
+       if (bus->dhd->prot == NULL) {
+               DHD_ERROR(("prot is not inited\n"));
+               return 0;
+       }
+       if (bus->dhd->busstate != DHD_BUS_DATA) {
+               DHD_ERROR(("not in a readystate to LPBK  is not inited\n"));
+               return 0;
+       }
+       dhdmsgbuf_lpbk_req(bus->dhd, len);
+       return 0;
+}
+
+int
+dhdpcie_bus_suspend(struct dhd_bus *bus, bool state)
+{
+       int timeleft;
+       unsigned long flags;
+       int rc = 0;
+
+       if (bus->dhd == NULL) {
+               DHD_ERROR(("bus not inited\n"));
+               return BCME_ERROR;
+       }
+       if (bus->dhd->prot == NULL) {
+               DHD_ERROR(("prot is not inited\n"));
+               return BCME_ERROR;
+       }
+
+       if (dhd_query_bus_erros(bus->dhd)) {
+               return BCME_ERROR;
+       }
+
+       DHD_GENERAL_LOCK(bus->dhd, flags);
+       if (bus->dhd->busstate != DHD_BUS_DATA && bus->dhd->busstate != DHD_BUS_SUSPEND) {
+               DHD_ERROR(("not in a readystate to LPBK  is not inited\n"));
+               DHD_GENERAL_UNLOCK(bus->dhd, flags);
+               return BCME_ERROR;
+       }
+       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+       if (bus->dhd->dongle_reset) {
+               DHD_ERROR(("Dongle is in reset state.\n"));
+               return -EIO;
+       }
+
+       if (bus->suspended == state) { /* Set to same state */
+               DHD_ERROR(("Bus is already in SUSPEND state.\n"));
+               return BCME_OK;
+       }
+
+       if (state) {
+               int idle_retry = 0;
+               int active;
+
+               if (bus->is_linkdown) {
+                       DHD_ERROR(("%s: PCIe link was down, state=%d\n",
+                               __FUNCTION__, state));
+                       return BCME_ERROR;
+               }
+
+               /* Suspend */
+               DHD_ERROR(("%s: Entering suspend state\n", __FUNCTION__));
+               bus->wait_for_d3_ack = 0;
+               bus->suspended = TRUE;
+
+
+               DHD_GENERAL_LOCK(bus->dhd, flags);
+               /* stop all interface network queue. */
+               dhd_bus_stop_queue(bus);
+               bus->dhd->busstate = DHD_BUS_SUSPEND;
+               if (bus->dhd->dhd_bus_busy_state & DHD_BUS_BUSY_IN_TX) {
+                       DHD_ERROR(("Tx Request is not ended\n"));
+                       bus->dhd->busstate = DHD_BUS_DATA;
+                       /* resume all interface network queue. */
+                       dhd_bus_start_queue(bus);
+                       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+                       bus->suspended = FALSE;
+                       return -EBUSY;
+               }
+
+               bus->dhd->dhd_bus_busy_state |= DHD_BUS_BUSY_IN_SUSPEND;
+               DHD_GENERAL_UNLOCK(bus->dhd, flags);
+
+               DHD_OS_WAKE_LOCK_WAIVE(bus->dhd);
+               dhd_os_set_ioctl_resp_timeout(D3_ACK_RESP_TIMEOUT);
+               dhdpcie_send_mb_data(bus, H2D_HOST_D3_INFORM);
+               timeleft = dhd_os_d3ack_wait(bus->dhd, &bus->wait_for_d3_ack);
+               dhd_os_set_ioctl_resp_timeout(IOCTL_RESP_TIMEOUT);
+               DHD_OS_WAKE_LOCK_RESTORE(bus->dhd);
+
+               {
+                       uint32 d2h_mb_data = 0;
+                       uint32 zero = 0;
+
+                       /* If wait_for_d3_ack was not updated because D2H MB was not received */
+                       if (bus->wait_for_d3_ack == 0) {
+                               /* Read the Mb data to see if the Dongle has actually sent D3 ACK */
+                               dhd_bus_cmn_readshared(bus, &d2h_mb_data, D2H_MB_DATA, 0);
+
+                               if (!D2H_DEV_MB_INVALIDATED(d2h_mb_data) &&
+                                       (d2h_mb_data & D2H_DEV_D3_ACK)) {
+                                       DHD_ERROR(("*** D3 WAR for missing interrupt ***\r\n"));
+                                       /* Clear the MB Data */
+                                       dhd_bus_cmn_writeshared(bus, &zero, sizeof(uint32),
+                                               D2H_MB_DATA, 0);
+
+                                       /* Consider that D3 ACK is received */
+                                       bus->wait_for_d3_ack = 1;
+                                       bus->d3_ack_war_cnt++;
+
+                               } /* d2h_mb_data & D2H_DEV_D3_ACK */
+                       } /* bus->wait_for_d3_ack was 0 */
+               }
+
+               /* To allow threads that got pre-empted to complete.
+                */
+               while ((active = dhd_os_check_wakelock_all(bus->dhd)) &&
+                       (idle_retry < MAX_WKLK_IDLE_CHECK)) {
+                       msleep(1);
+                       idle_retry++;
+               }
+
+               if (bus->wait_for_d3_ack) {
+                       DHD_ERROR(("%s: Got D3 Ack \n", __FUNCTION__));
+                       /* Got D3 Ack. Suspend the bus */
+                       if (active) {
+                               DHD_ERROR(("%s():Suspend failed because of wakelock restoring "
+                                       "Dongle to D0\n", __FUNCTION__));
+
+                               /*
+                                * Dongle still thinks that it has to be in D3 state
+                                * until gets a D0 Inform, but we are backing off from suspend.
+                                * Ensure that Dongle is brought back to D0.
+                                *
+                                * Bringing back Dongle from D3 Ack state to D0 state
+                                * is a 2 step process. Dongle would want to know that D0 Inform
+                                * would be sent as a MB interrupt
+                                * to bring it out of D3 Ack state to D0 state.
+                                * So we have to send both this message.
+                                */
+                               DHD_OS_WAKE_LOCK_WAIVE(bus->dhd);
+                               dhdpcie_send_mb_data(bus,
+                                       (H2D_HOST_D0_INFORM_IN_USE | H2D_HOST_D0_INFORM));
+                               DHD_OS_WAKE_LOCK_RESTORE(bus->dhd);
+
+                               bus->suspended = FALSE;
+                               DHD_GENERAL_LOCK(bus->dhd, flags);
+                               bus->dhd->busstate = DHD_BUS_DATA;
+                               /* resume all interface network queue. */
+                               dhd_bus_start_queue(bus);
+                               DHD_GENERAL_UNLOCK(bus->dhd, flags);
+                               rc = BCME_ERROR;
+                       } else {
+                               DHD_OS_WAKE_LOCK_WAIVE(bus->dhd);
+                               dhdpcie_send_mb_data(bus, (H2D_HOST_D0_INFORM_IN_USE));
+                               DHD_OS_WAKE_LOCK_RESTORE(bus->dhd);
+                               dhdpcie_bus_intr_disable(bus);
+                               rc = dhdpcie_pci_suspend_resume(bus, state);
+                               dhd_bus_set_device_wake(bus, FALSE);
+                       }
+                       bus->dhd->d3ackcnt_timeout = 0;
+#if defined(BCMPCIE_OOB_HOST_WAKE)
+                       dhdpcie_oob_intr_set(bus, TRUE);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+               } else if (timeleft == 0) {
+                       bus->dhd->d3ack_timeout_occured = TRUE;
+                       bus->dhd->d3ackcnt_timeout++;
+                       DHD_ERROR(("%s: resumed on timeout for D3 ACK d3_inform_cnt %d \n",
+                               __FUNCTION__, bus->dhd->d3ackcnt_timeout));
+                       dhd_prot_debug_info_print(bus->dhd);
+#ifdef DHD_FW_COREDUMP
+                       if (bus->dhd->memdump_enabled) {
+                               /* write core dump to file */
+                               bus->dhd->memdump_type = DUMP_TYPE_D3_ACK_TIMEOUT;
+                               dhdpcie_mem_dump(bus);
+                       }
+#endif /* DHD_FW_COREDUMP */
+                       bus->suspended = FALSE;
+                       DHD_GENERAL_LOCK(bus->dhd, flags);
+                       bus->dhd->busstate = DHD_BUS_DATA;
+                       /* resume all interface network queue. */
+                       dhd_bus_start_queue(bus);
+                       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+                       if (bus->dhd->d3ackcnt_timeout >= MAX_CNTL_D3ACK_TIMEOUT) {
+                               DHD_ERROR(("%s: Event HANG send up "
+                                       "due to PCIe linkdown\n", __FUNCTION__));
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#ifdef CONFIG_ARCH_MSM
+                               bus->no_cfg_restore = 1;
+#endif /* CONFIG_ARCH_MSM */
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+                               dhd_os_check_hang(bus->dhd, 0, -ETIMEDOUT);
+                       }
+                       rc = -ETIMEDOUT;
+
+               }
+
+               bus->wait_for_d3_ack = 1;
+               DHD_GENERAL_LOCK(bus->dhd, flags);
+               bus->dhd->dhd_bus_busy_state &= ~DHD_BUS_BUSY_IN_SUSPEND;
+               dhd_os_busbusy_wake(bus->dhd);
+               DHD_GENERAL_UNLOCK(bus->dhd, flags);
+       } else {
+               /* Resume */
+#if defined(BCMPCIE_OOB_HOST_WAKE)
+               DHD_OS_OOB_IRQ_WAKE_UNLOCK(bus->dhd);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+               DHD_GENERAL_LOCK(bus->dhd, flags);
+               bus->dhd->dhd_bus_busy_state |= DHD_BUS_BUSY_IN_RESUME;
+               DHD_GENERAL_UNLOCK(bus->dhd, flags);
+               rc = dhdpcie_pci_suspend_resume(bus, state);
+               if (bus->dhd->busstate == DHD_BUS_SUSPEND) {
+                       DHD_OS_WAKE_LOCK_WAIVE(bus->dhd);
+                       dhdpcie_send_mb_data(bus, (H2D_HOST_D0_INFORM));
+                       DHD_OS_WAKE_LOCK_RESTORE(bus->dhd);
+                       dhd_bus_set_device_wake(bus, TRUE);
+               }
+               bus->suspended = FALSE;
+               DHD_GENERAL_LOCK(bus->dhd, flags);
+               bus->dhd->busstate = DHD_BUS_DATA;
+               bus->dhd->dhd_bus_busy_state &= ~DHD_BUS_BUSY_IN_RESUME;
+#ifdef DHD_PCIE_RUNTIMEPM
+               if (bus->dhd->dhd_bus_busy_state & DHD_BUS_BUSY_RPM_SUSPEND_DONE) {
+                       bus->bus_wake = 1;
+                       OSL_SMP_WMB();
+                       wake_up_interruptible(&bus->rpm_queue);
+               }
+#endif /* DHD_PCIE_RUNTIMEPM */
+               /* resume all interface network queue. */
+               dhd_bus_start_queue(bus);
+               dhd_os_busbusy_wake(bus->dhd);
+               DHD_GENERAL_UNLOCK(bus->dhd, flags);
+               dhdpcie_bus_intr_enable(bus);
+       }
+       return rc;
+}
+
+/** Transfers bytes from host to dongle and to host again using DMA */
+static int
+dhdpcie_bus_dmaxfer_req(struct  dhd_bus *bus, uint32 len, uint32 srcdelay, uint32 destdelay)
+{
+       if (bus->dhd == NULL) {
+               DHD_ERROR(("bus not inited\n"));
+               return BCME_ERROR;
+       }
+       if (bus->dhd->prot == NULL) {
+               DHD_ERROR(("prot is not inited\n"));
+               return BCME_ERROR;
+       }
+       if (bus->dhd->busstate != DHD_BUS_DATA) {
+               DHD_ERROR(("not in a readystate to LPBK  is not inited\n"));
+               return BCME_ERROR;
+       }
+
+       if (len < 5 || len > 4194296) {
+               DHD_ERROR(("len is too small or too large\n"));
+               return BCME_ERROR;
+       }
+       return dhdmsgbuf_dmaxfer_req(bus->dhd, len, srcdelay, destdelay);
+}
+
+
+
+static int
+dhdpcie_bus_download_state(dhd_bus_t *bus, bool enter)
+{
+       int bcmerror = 0;
+       uint32 *cr4_regs;
+
+       if (!bus->sih) {
+               DHD_ERROR(("%s: NULL sih!!\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+       /* To enter download state, disable ARM and reset SOCRAM.
+        * To exit download state, simply reset ARM (default is RAM boot).
+        */
+       if (enter) {
+               bus->alp_only = TRUE;
+
+               /* some chips (e.g. 43602) have two ARM cores, the CR4 is receives the firmware. */
+               cr4_regs = si_setcore(bus->sih, ARMCR4_CORE_ID, 0);
+
+               if (cr4_regs == NULL && !(si_setcore(bus->sih, ARM7S_CORE_ID, 0)) &&
+                   !(si_setcore(bus->sih, ARMCM3_CORE_ID, 0)) &&
+                   !(si_setcore(bus->sih, ARMCA7_CORE_ID, 0))) {
+                       DHD_ERROR(("%s: Failed to find ARM core!\n", __FUNCTION__));
+                       bcmerror = BCME_ERROR;
+                       goto fail;
+               }
+
+               if (si_setcore(bus->sih, ARMCA7_CORE_ID, 0)) {
+                       /* Halt ARM & remove reset */
+                       si_core_reset(bus->sih, SICF_CPUHALT, SICF_CPUHALT);
+                       if (!(si_setcore(bus->sih, SYSMEM_CORE_ID, 0))) {
+                               DHD_ERROR(("%s: Failed to find SYSMEM core!\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+                       si_core_reset(bus->sih, 0, 0);
+                       /* reset last 4 bytes of RAM address. to be used for shared area */
+                       dhdpcie_init_shared_addr(bus);
+               } else if (cr4_regs == NULL) { /* no CR4 present on chip */
+                       si_core_disable(bus->sih, 0);
+
+                       if (!(si_setcore(bus->sih, SOCRAM_CORE_ID, 0))) {
+                               DHD_ERROR(("%s: Failed to find SOCRAM core!\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+
+                       si_core_reset(bus->sih, 0, 0);
+
+                       /* Clear the top bit of memory */
+                       if (bus->ramsize) {
+                               uint32 zeros = 0;
+                               if (dhdpcie_bus_membytes(bus, TRUE, bus->ramsize - 4,
+                                                    (uint8*)&zeros, 4) < 0) {
+                                       bcmerror = BCME_ERROR;
+                                       goto fail;
+                               }
+                       }
+               } else {
+                       /* For CR4,
+                        * Halt ARM
+                        * Remove ARM reset
+                        * Read RAM base address [0x18_0000]
+                        * [next] Download firmware
+                        * [done at else] Populate the reset vector
+                        * [done at else] Remove ARM halt
+                       */
+                       /* Halt ARM & remove reset */
+                       si_core_reset(bus->sih, SICF_CPUHALT, SICF_CPUHALT);
+                       if (BCM43602_CHIP(bus->sih->chip)) {
+                               W_REG(bus->pcie_mb_intr_osh, cr4_regs + ARMCR4REG_BANKIDX, 5);
+                               W_REG(bus->pcie_mb_intr_osh, cr4_regs + ARMCR4REG_BANKPDA, 0);
+                               W_REG(bus->pcie_mb_intr_osh, cr4_regs + ARMCR4REG_BANKIDX, 7);
+                               W_REG(bus->pcie_mb_intr_osh, cr4_regs + ARMCR4REG_BANKPDA, 0);
+                       }
+                       /* reset last 4 bytes of RAM address. to be used for shared area */
+                       dhdpcie_init_shared_addr(bus);
+               }
+       } else {
+               if (si_setcore(bus->sih, ARMCA7_CORE_ID, 0)) {
+                       /* write vars */
+                       if ((bcmerror = dhdpcie_bus_write_vars(bus))) {
+                               DHD_ERROR(("%s: could not write vars to RAM\n", __FUNCTION__));
+                               goto fail;
+                       }
+                       /* switch back to arm core again */
+                       if (!(si_setcore(bus->sih, ARMCA7_CORE_ID, 0))) {
+                               DHD_ERROR(("%s: Failed to find ARM CA7 core!\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+                       /* write address 0 with reset instruction */
+                       bcmerror = dhdpcie_bus_membytes(bus, TRUE, 0,
+                               (uint8 *)&bus->resetinstr, sizeof(bus->resetinstr));
+                       /* now remove reset and halt and continue to run CA7 */
+               } else if (!si_setcore(bus->sih, ARMCR4_CORE_ID, 0)) {
+                       if (!(si_setcore(bus->sih, SOCRAM_CORE_ID, 0))) {
+                               DHD_ERROR(("%s: Failed to find SOCRAM core!\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+
+                       if (!si_iscoreup(bus->sih)) {
+                               DHD_ERROR(("%s: SOCRAM core is down after reset?\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+
+                       /* Enable remap before ARM reset but after vars.
+                        * No backplane access in remap mode
+                        */
+                       if (!si_setcore(bus->sih, PCMCIA_CORE_ID, 0) &&
+                           !si_setcore(bus->sih, SDIOD_CORE_ID, 0)) {
+                               DHD_ERROR(("%s: Can't change back to SDIO core?\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+
+
+                       if (!(si_setcore(bus->sih, ARM7S_CORE_ID, 0)) &&
+                           !(si_setcore(bus->sih, ARMCM3_CORE_ID, 0))) {
+                               DHD_ERROR(("%s: Failed to find ARM core!\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+               } else {
+                       if (BCM43602_CHIP(bus->sih->chip)) {
+                               /* Firmware crashes on SOCSRAM access when core is in reset */
+                               if (!(si_setcore(bus->sih, SOCRAM_CORE_ID, 0))) {
+                                       DHD_ERROR(("%s: Failed to find SOCRAM core!\n",
+                                               __FUNCTION__));
+                                       bcmerror = BCME_ERROR;
+                                       goto fail;
+                               }
+                               si_core_reset(bus->sih, 0, 0);
+                               si_setcore(bus->sih, ARMCR4_CORE_ID, 0);
+                       }
+
+                       /* write vars */
+                       if ((bcmerror = dhdpcie_bus_write_vars(bus))) {
+                               DHD_ERROR(("%s: could not write vars to RAM\n", __FUNCTION__));
+                               goto fail;
+                       }
+
+                       /* switch back to arm core again */
+                       if (!(si_setcore(bus->sih, ARMCR4_CORE_ID, 0))) {
+                               DHD_ERROR(("%s: Failed to find ARM CR4 core!\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+
+                       /* write address 0 with reset instruction */
+                       bcmerror = dhdpcie_bus_membytes(bus, TRUE, 0,
+                               (uint8 *)&bus->resetinstr, sizeof(bus->resetinstr));
+
+                       if (bcmerror == BCME_OK) {
+                               uint32 tmp;
+
+                               bcmerror = dhdpcie_bus_membytes(bus, FALSE, 0,
+                                                               (uint8 *)&tmp, sizeof(tmp));
+
+                               if (bcmerror == BCME_OK && tmp != bus->resetinstr) {
+                                       DHD_ERROR(("%s: Failed to write 0x%08x to addr 0\n",
+                                                 __FUNCTION__, bus->resetinstr));
+                                       DHD_ERROR(("%s: contents of addr 0 is 0x%08x\n",
+                                                 __FUNCTION__, tmp));
+                                       bcmerror = BCME_ERROR;
+                                       goto fail;
+                               }
+                       }
+
+                       /* now remove reset and halt and continue to run CR4 */
+               }
+
+               si_core_reset(bus->sih, 0, 0);
+
+               /* Allow HT Clock now that the ARM is running. */
+               bus->alp_only = FALSE;
+
+               bus->dhd->busstate = DHD_BUS_LOAD;
+       }
+
+fail:
+       /* Always return to PCIE core */
+       si_setcore(bus->sih, PCIE2_CORE_ID, 0);
+
+       return bcmerror;
+} /* dhdpcie_bus_download_state */
+
+static int
+dhdpcie_bus_write_vars(dhd_bus_t *bus)
+{
+       int bcmerror = 0;
+       uint32 varsize, phys_size;
+       uint32 varaddr;
+       uint8 *vbuffer;
+       uint32 varsizew;
+#ifdef DHD_DEBUG
+       uint8 *nvram_ularray;
+#endif /* DHD_DEBUG */
+
+       /* Even if there are no vars are to be written, we still need to set the ramsize. */
+       varsize = bus->varsz ? ROUNDUP(bus->varsz, 4) : 0;
+       varaddr = (bus->ramsize - 4) - varsize;
+
+       varaddr += bus->dongle_ram_base;
+
+       if (bus->vars) {
+
+               vbuffer = (uint8 *)MALLOC(bus->dhd->osh, varsize);
+               if (!vbuffer)
+                       return BCME_NOMEM;
+
+               bzero(vbuffer, varsize);
+               bcopy(bus->vars, vbuffer, bus->varsz);
+               /* Write the vars list */
+               DHD_INFO_HW4(("%s: tcm: %p varaddr: 0x%x varsize: %d\n",
+                       __FUNCTION__, bus->tcm, varaddr, varsize));
+               bcmerror = dhdpcie_bus_membytes(bus, TRUE, varaddr, vbuffer, varsize);
+
+               /* Implement read back and verify later */
+#ifdef DHD_DEBUG
+               /* Verify NVRAM bytes */
+               DHD_INFO(("Compare NVRAM dl & ul; varsize=%d\n", varsize));
+               nvram_ularray = (uint8*)MALLOC(bus->dhd->osh, varsize);
+               if (!nvram_ularray)
+                       return BCME_NOMEM;
+
+               /* Upload image to verify downloaded contents. */
+               memset(nvram_ularray, 0xaa, varsize);
+
+               /* Read the vars list to temp buffer for comparison */
+               bcmerror = dhdpcie_bus_membytes(bus, FALSE, varaddr, nvram_ularray, varsize);
+               if (bcmerror) {
+                               DHD_ERROR(("%s: error %d on reading %d nvram bytes at 0x%08x\n",
+                                       __FUNCTION__, bcmerror, varsize, varaddr));
+               }
+
+               /* Compare the org NVRAM with the one read from RAM */
+               if (memcmp(vbuffer, nvram_ularray, varsize)) {
+                       DHD_ERROR(("%s: Downloaded NVRAM image is corrupted.\n", __FUNCTION__));
+               } else
+                       DHD_ERROR(("%s: Download, Upload and compare of NVRAM succeeded.\n",
+                       __FUNCTION__));
+
+               MFREE(bus->dhd->osh, nvram_ularray, varsize);
+#endif /* DHD_DEBUG */
+
+               MFREE(bus->dhd->osh, vbuffer, varsize);
+       }
+
+       phys_size = REMAP_ENAB(bus) ? bus->ramsize : bus->orig_ramsize;
+
+       phys_size += bus->dongle_ram_base;
+
+       /* adjust to the user specified RAM */
+       DHD_INFO(("Physical memory size: %d, usable memory size: %d\n",
+               phys_size, bus->ramsize));
+       DHD_INFO(("Vars are at %d, orig varsize is %d\n",
+               varaddr, varsize));
+       varsize = ((phys_size - 4) - varaddr);
+
+       /*
+        * Determine the length token:
+        * Varsize, converted to words, in lower 16-bits, checksum in upper 16-bits.
+        */
+       if (bcmerror) {
+               varsizew = 0;
+               bus->nvram_csm = varsizew;
+       } else {
+               varsizew = varsize / 4;
+               varsizew = (~varsizew << 16) | (varsizew & 0x0000FFFF);
+               bus->nvram_csm = varsizew;
+               varsizew = htol32(varsizew);
+       }
+
+       DHD_INFO(("New varsize is %d, length token=0x%08x\n", varsize, varsizew));
+
+       /* Write the length token to the last word */
+       DHD_INFO_HW4(("%s: tcm: %p phys_size: 0x%x varsizew: %x\n",
+                       __FUNCTION__, bus->tcm, phys_size, varsizew));
+       bcmerror = dhdpcie_bus_membytes(bus, TRUE, (phys_size - 4),
+               (uint8*)&varsizew, 4);
+
+       return bcmerror;
+} /* dhdpcie_bus_write_vars */
+
+int
+dhdpcie_downloadvars(dhd_bus_t *bus, void *arg, int len)
+{
+       int bcmerror = BCME_OK;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       /* Basic sanity checks */
+       if (bus->dhd->up) {
+               bcmerror = BCME_NOTDOWN;
+               goto err;
+       }
+       if (!len) {
+               bcmerror = BCME_BUFTOOSHORT;
+               goto err;
+       }
+
+       /* Free the old ones and replace with passed variables */
+       if (bus->vars)
+               MFREE(bus->dhd->osh, bus->vars, bus->varsz);
+
+       bus->vars = MALLOC(bus->dhd->osh, len);
+       bus->varsz = bus->vars ? len : 0;
+       if (bus->vars == NULL) {
+               bcmerror = BCME_NOMEM;
+               goto err;
+       }
+
+       /* Copy the passed variables, which should include the terminating double-null */
+       bcopy(arg, bus->vars, bus->varsz);
+
+
+err:
+       return bcmerror;
+}
+
+#ifndef BCMPCIE_OOB_HOST_WAKE
+/* loop through the capability list and see if the pcie capabilty exists */
+uint8
+dhdpcie_find_pci_capability(osl_t *osh, uint8 req_cap_id)
+{
+       uint8 cap_id;
+       uint8 cap_ptr = 0;
+       uint8 byte_val;
+
+       /* check for Header type 0 */
+       byte_val = read_pci_cfg_byte(PCI_CFG_HDR);
+       if ((byte_val & 0x7f) != PCI_HEADER_NORMAL) {
+               DHD_ERROR(("%s : PCI config header not normal.\n", __FUNCTION__));
+               goto end;
+       }
+
+       /* check if the capability pointer field exists */
+       byte_val = read_pci_cfg_byte(PCI_CFG_STAT);
+       if (!(byte_val & PCI_CAPPTR_PRESENT)) {
+               DHD_ERROR(("%s : PCI CAP pointer not present.\n", __FUNCTION__));
+               goto end;
+       }
+
+       cap_ptr = read_pci_cfg_byte(PCI_CFG_CAPPTR);
+       /* check if the capability pointer is 0x00 */
+       if (cap_ptr == 0x00) {
+               DHD_ERROR(("%s : PCI CAP pointer is 0x00.\n", __FUNCTION__));
+               goto end;
+       }
+
+       /* loop thr'u the capability list and see if the pcie capabilty exists */
+
+       cap_id = read_pci_cfg_byte(cap_ptr);
+
+       while (cap_id != req_cap_id) {
+               cap_ptr = read_pci_cfg_byte((cap_ptr + 1));
+               if (cap_ptr == 0x00) break;
+               cap_id = read_pci_cfg_byte(cap_ptr);
+       }
+
+end:
+       return cap_ptr;
+}
+
+void
+dhdpcie_pme_active(osl_t *osh, bool enable)
+{
+       uint8 cap_ptr;
+       uint32 pme_csr;
+
+       cap_ptr = dhdpcie_find_pci_capability(osh, PCI_CAP_POWERMGMTCAP_ID);
+
+       if (!cap_ptr) {
+               DHD_ERROR(("%s : Power Management Capability not present\n", __FUNCTION__));
+               return;
+       }
+
+       pme_csr = OSL_PCI_READ_CONFIG(osh, cap_ptr + PME_CSR_OFFSET, sizeof(uint32));
+       DHD_ERROR(("%s : pme_sts_ctrl 0x%x\n", __FUNCTION__, pme_csr));
+
+       pme_csr |= PME_CSR_PME_STAT;
+       if (enable) {
+               pme_csr |= PME_CSR_PME_EN;
+       } else {
+               pme_csr &= ~PME_CSR_PME_EN;
+       }
+
+       OSL_PCI_WRITE_CONFIG(osh, cap_ptr + PME_CSR_OFFSET, sizeof(uint32), pme_csr);
+}
+
+bool
+dhdpcie_pme_cap(osl_t *osh)
+{
+       uint8 cap_ptr;
+       uint32 pme_cap;
+
+       cap_ptr = dhdpcie_find_pci_capability(osh, PCI_CAP_POWERMGMTCAP_ID);
+
+       if (!cap_ptr) {
+               DHD_ERROR(("%s : Power Management Capability not present\n", __FUNCTION__));
+               return FALSE;
+       }
+
+       pme_cap = OSL_PCI_READ_CONFIG(osh, cap_ptr, sizeof(uint32));
+
+       DHD_ERROR(("%s : pme_cap 0x%x\n", __FUNCTION__, pme_cap));
+
+       return ((pme_cap & PME_CAP_PM_STATES) != 0);
+}
+#endif /* !BCMPCIE_OOB_HOST_WAKE */
+
+void dhd_dump_intr_registers(dhd_pub_t *dhd, struct bcmstrbuf *strbuf)
+{
+       uint32 intstatus = 0;
+       uint32 intmask = 0;
+       uint32 mbintstatus = 0;
+       uint32 d2h_mb_data = 0;
+
+       intstatus = si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, PCIMailBoxInt, 0, 0);
+       intmask = si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, PCIMailBoxMask, 0, 0);
+       mbintstatus = si_corereg(dhd->bus->sih, dhd->bus->sih->buscoreidx, PCID2H_MailBox, 0, 0);
+       dhd_bus_cmn_readshared(dhd->bus, &d2h_mb_data, D2H_MB_DATA, 0);
+
+       bcm_bprintf(strbuf, "intstatus=0x%x intmask=0x%x mbintstatus=0x%x\n",
+               intstatus, intmask, mbintstatus);
+       bcm_bprintf(strbuf, "d2h_mb_data=0x%x def_intmask=0x%x\n",
+               d2h_mb_data, dhd->bus->def_intmask);
+}
+
+/** Add bus dump output to a buffer */
+void dhd_bus_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf)
+{
+       uint16 flowid;
+       int ix = 0;
+       flow_ring_node_t *flow_ring_node;
+       flow_info_t *flow_info;
+       char eabuf[ETHER_ADDR_STR_LEN];
+
+       if (dhdp->busstate != DHD_BUS_DATA)
+               return;
+
+       dhd_prot_print_info(dhdp, strbuf);
+       dhd_dump_intr_registers(dhdp, strbuf);
+       bcm_bprintf(strbuf, "h2d_mb_data_ptr_addr 0x%x, d2h_mb_data_ptr_addr 0x%x\n",
+               dhdp->bus->h2d_mb_data_ptr_addr, dhdp->bus->d2h_mb_data_ptr_addr);
+       bcm_bprintf(strbuf, "dhd cumm_ctr %d\n", DHD_CUMM_CTR_READ(&dhdp->cumm_ctr));
+       bcm_bprintf(strbuf,
+               "%s %4s %2s %4s %17s %4s %4s %10s %4s %4s %17s %17s %7s ",
+               "Num:", "Flow", "If", "Prio", ":Dest_MacAddress:", "Qlen", "CLen",
+               "Overflows", "RD", "WR", "BASE(VA)", "BASE(PA)", "SIZE");
+       bcm_bprintf(strbuf, "%5s %6s %5s \n", "Acked", "tossed", "noack");
+
+       for (flowid = 0; flowid < dhdp->num_flow_rings; flowid++) {
+               flow_ring_node = DHD_FLOW_RING(dhdp, flowid);
+               if (flow_ring_node->active) {
+                       flow_info = &flow_ring_node->flow_info;
+                       bcm_bprintf(strbuf,
+                               "%3d. %4d %2d %4d %17s %4d %4d %10u ", ix++,
+                               flow_ring_node->flowid, flow_info->ifindex, flow_info->tid,
+                               bcm_ether_ntoa((struct ether_addr *)&flow_info->da, eabuf),
+                               DHD_FLOW_QUEUE_LEN(&flow_ring_node->queue),
+                               DHD_CUMM_CTR_READ(DHD_FLOW_QUEUE_CLEN_PTR(&flow_ring_node->queue)),
+                               DHD_FLOW_QUEUE_FAILURES(&flow_ring_node->queue));
+                       dhd_prot_print_flow_ring(dhdp, flow_ring_node->prot_info, strbuf,
+                               "%4d %4d %17p %8x:%8x %7d ");
+                       bcm_bprintf(strbuf,
+                               "%5s %6s %5s\n", "NA", "NA", "NA");
+               }
+       }
+       bcm_bprintf(strbuf, "D3 inform cnt %d\n", dhdp->bus->d3_inform_cnt);
+       bcm_bprintf(strbuf, "D0 inform cnt %d\n", dhdp->bus->d0_inform_cnt);
+       bcm_bprintf(strbuf, "D0 inform in use cnt %d\n", dhdp->bus->d0_inform_in_use_cnt);
+       bcm_bprintf(strbuf, "D3 Ack WAR cnt %d\n", dhdp->bus->d3_ack_war_cnt);
+}
+
+/**
+ * Brings transmit packets on all flow rings closer to the dongle, by moving (a subset) from their
+ * flow queue to their flow ring.
+ */
+static void
+dhd_update_txflowrings(dhd_pub_t *dhd)
+{
+       unsigned long flags;
+       dll_t *item, *next;
+       flow_ring_node_t *flow_ring_node;
+       struct dhd_bus *bus = dhd->bus;
+
+       DHD_FLOWRING_LIST_LOCK(bus->dhd->flowring_list_lock, flags);
+       for (item = dll_head_p(&bus->const_flowring);
+               (!dhd_is_device_removed(dhd) && !dll_end(&bus->const_flowring, item));
+               item = next) {
+               if (dhd->hang_was_sent) {
+                       break;
+               }
+
+               next = dll_next_p(item);
+               flow_ring_node = dhd_constlist_to_flowring(item);
+
+               /* Ensure that flow_ring_node in the list is Not Null */
+               ASSERT(flow_ring_node != NULL);
+
+               /* Ensure that the flowring node has valid contents */
+               ASSERT(flow_ring_node->prot_info != NULL);
+
+               dhd_prot_update_txflowring(dhd, flow_ring_node->flowid, flow_ring_node->prot_info);
+       }
+       DHD_FLOWRING_LIST_UNLOCK(bus->dhd->flowring_list_lock, flags);
+}
+
+/** Mailbox ringbell Function */
+static void
+dhd_bus_gen_devmb_intr(struct dhd_bus *bus)
+{
+       if ((bus->sih->buscorerev == 2) || (bus->sih->buscorerev == 6) ||
+               (bus->sih->buscorerev == 4)) {
+               DHD_ERROR(("mailbox communication not supported\n"));
+               return;
+       }
+       if (bus->db1_for_mb)  {
+               /* this is a pcie core register, not the config register */
+               DHD_INFO(("writing a mail box interrupt to the device, through doorbell 1\n"));
+               si_corereg(bus->sih, bus->sih->buscoreidx, PCIH2D_DB1, ~0, 0x12345678);
+       } else {
+               DHD_INFO(("writing a mail box interrupt to the device, through config space\n"));
+               dhdpcie_bus_cfg_write_dword(bus, PCISBMbx, 4, (1 << 0));
+               dhdpcie_bus_cfg_write_dword(bus, PCISBMbx, 4, (1 << 0));
+       }
+}
+
+static void
+dhd_bus_set_device_wake(struct dhd_bus *bus, bool val)
+{
+       if (bus->device_wake_state != val)
+       {
+               DHD_INFO(("Set Device_Wake to %d\n", val));
+#ifdef PCIE_OOB
+               if (bus->oob_enabled)
+               {
+                       if (val)
+                       {
+                               gpio_port = gpio_port | (1 << DEVICE_WAKE);
+                               gpio_write_port_non_block(gpio_handle_val, gpio_port);
+                       } else {
+                               gpio_port = gpio_port & (0xff ^ (1 << DEVICE_WAKE));
+                               gpio_write_port_non_block(gpio_handle_val, gpio_port);
+                       }
+               }
+#endif /* PCIE_OOB */
+               bus->device_wake_state = val;
+       }
+}
+
+#ifdef PCIE_OOB
+void
+dhd_oob_set_bt_reg_on(struct dhd_bus *bus, bool val)
+{
+       DHD_INFO(("Set Device_Wake to %d\n", val));
+       if (val)
+       {
+               gpio_port = gpio_port | (1 << BIT_BT_REG_ON);
+               gpio_write_port(gpio_handle_val, gpio_port);
+       } else {
+               gpio_port = gpio_port & (0xff ^ (1 << BIT_BT_REG_ON));
+               gpio_write_port(gpio_handle_val, gpio_port);
+       }
+}
+
+int
+dhd_oob_get_bt_reg_on(struct dhd_bus *bus)
+{
+       int ret;
+       uint8 val;
+       ret = gpio_read_port(gpio_handle_val, &val);
+
+       if (ret < 0) {
+               DHD_ERROR(("gpio_read_port returns %d\n", ret));
+               return ret;
+       }
+
+       if (val & (1 << BIT_BT_REG_ON))
+       {
+               ret = 1;
+       } else {
+               ret = 0;
+       }
+
+       return ret;
+}
+
+static void
+dhd_bus_doorbell_timeout_reset(struct dhd_bus *bus)
+{
+       if (dhd_doorbell_timeout)
+               dhd_timeout_start(&bus->doorbell_timer,
+                       (dhd_doorbell_timeout * 1000) / dhd_watchdog_ms);
+       else if (!(bus->dhd->busstate == DHD_BUS_SUSPEND))
+               dhd_bus_set_device_wake(bus, FALSE);
+}
+#endif /* PCIE_OOB */
+
+/** mailbox doorbell ring function */
+void
+dhd_bus_ringbell(struct dhd_bus *bus, uint32 value)
+{
+       if ((bus->sih->buscorerev == 2) || (bus->sih->buscorerev == 6) ||
+               (bus->sih->buscorerev == 4)) {
+               si_corereg(bus->sih, bus->sih->buscoreidx, PCIMailBoxInt, PCIE_INTB, PCIE_INTB);
+       } else {
+               /* this is a pcie core register, not the config regsiter */
+               DHD_INFO(("writing a door bell to the device\n"));
+               si_corereg(bus->sih, bus->sih->buscoreidx, PCIH2D_MailBox, ~0, 0x12345678);
+       }
+}
+
+void
+dhdpcie_bus_ringbell_fast(struct dhd_bus *bus, uint32 value)
+{
+#ifdef PCIE_OOB
+       dhd_bus_set_device_wake(bus, TRUE);
+       dhd_bus_doorbell_timeout_reset(bus);
+#endif
+       W_REG(bus->pcie_mb_intr_osh, bus->pcie_mb_intr_addr, value);
+}
+
+static void
+dhd_bus_ringbell_oldpcie(struct dhd_bus *bus, uint32 value)
+{
+       uint32 w;
+       w = (R_REG(bus->pcie_mb_intr_osh, bus->pcie_mb_intr_addr) & ~PCIE_INTB) | PCIE_INTB;
+       W_REG(bus->pcie_mb_intr_osh, bus->pcie_mb_intr_addr, w);
+}
+
+dhd_mb_ring_t
+dhd_bus_get_mbintr_fn(struct dhd_bus *bus)
+{
+       if ((bus->sih->buscorerev == 2) || (bus->sih->buscorerev == 6) ||
+               (bus->sih->buscorerev == 4)) {
+               bus->pcie_mb_intr_addr = si_corereg_addr(bus->sih, bus->sih->buscoreidx,
+                       PCIMailBoxInt);
+               if (bus->pcie_mb_intr_addr) {
+                       bus->pcie_mb_intr_osh = si_osh(bus->sih);
+                       return dhd_bus_ringbell_oldpcie;
+               }
+       } else {
+               bus->pcie_mb_intr_addr = si_corereg_addr(bus->sih, bus->sih->buscoreidx,
+                       PCIH2D_MailBox);
+               if (bus->pcie_mb_intr_addr) {
+                       bus->pcie_mb_intr_osh = si_osh(bus->sih);
+                       return dhdpcie_bus_ringbell_fast;
+               }
+       }
+       return dhd_bus_ringbell;
+}
+
+bool BCMFASTPATH
+dhd_bus_dpc(struct dhd_bus *bus)
+{
+       bool resched = FALSE;     /* Flag indicating resched wanted */
+       unsigned long flags;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       DHD_GENERAL_LOCK(bus->dhd, flags);
+       /* Check for only DHD_BUS_DOWN and not for DHD_BUS_DOWN_IN_PROGRESS
+        * to avoid IOCTL Resumed On timeout when ioctl is waiting for response
+        * and rmmod is fired in parallel, which will make DHD_BUS_DOWN_IN_PROGRESS
+        * and if we return from here, then IOCTL response will never be handled
+        */
+       if (bus->dhd->busstate == DHD_BUS_DOWN) {
+               DHD_ERROR(("%s: Bus down, ret\n", __FUNCTION__));
+               bus->intstatus = 0;
+               DHD_GENERAL_UNLOCK(bus->dhd, flags);
+               return 0;
+       }
+       bus->dhd->dhd_bus_busy_state |= DHD_BUS_BUSY_IN_DPC;
+       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+
+       resched = dhdpcie_bus_process_mailbox_intr(bus, bus->intstatus);
+       if (!resched) {
+               bus->intstatus = 0;
+               if (!bus->pci_d3hot_done) {
+                       dhdpcie_bus_intr_enable(bus);
+               } else {
+                       DHD_ERROR(("%s: dhdpcie_bus_intr_enable skip in pci D3hot state \n",
+                                       __FUNCTION__));
+               }
+       }
+
+       DHD_GENERAL_LOCK(bus->dhd, flags);
+       bus->dhd->dhd_bus_busy_state &= ~DHD_BUS_BUSY_IN_DPC;
+       dhd_os_busbusy_wake(bus->dhd);
+       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+
+       return resched;
+
+}
+
+
+static void
+dhdpcie_send_mb_data(dhd_bus_t *bus, uint32 h2d_mb_data)
+{
+       uint32 cur_h2d_mb_data = 0;
+
+       DHD_INFO_HW4(("%s: H2D_MB_DATA: 0x%08X\n", __FUNCTION__, h2d_mb_data));
+
+       if (bus->is_linkdown) {
+               DHD_ERROR(("%s: PCIe link was down\n", __FUNCTION__));
+               return;
+       }
+
+       dhd_bus_cmn_readshared(bus, &cur_h2d_mb_data, H2D_MB_DATA, 0);
+
+       if (cur_h2d_mb_data != 0) {
+               uint32 i = 0;
+               DHD_INFO(("GRRRRRRR: MB transaction is already pending 0x%04x\n", cur_h2d_mb_data));
+               while ((i++ < 100) && cur_h2d_mb_data) {
+                       OSL_DELAY(10);
+                       dhd_bus_cmn_readshared(bus, &cur_h2d_mb_data, H2D_MB_DATA, 0);
+               }
+               if (i >= 100) {
+                       DHD_ERROR(("%s : waited 1ms for the dngl "
+                               "to ack the previous mb transaction\n", __FUNCTION__));
+                       DHD_ERROR(("%s : MB transaction is still pending 0x%04x\n",
+                               __FUNCTION__, cur_h2d_mb_data));
+               }
+       }
+
+       dhd_bus_cmn_writeshared(bus, &h2d_mb_data, sizeof(uint32), H2D_MB_DATA, 0);
+       dhd_bus_gen_devmb_intr(bus);
+
+       if (h2d_mb_data == H2D_HOST_D3_INFORM) {
+               DHD_INFO_HW4(("%s: send H2D_HOST_D3_INFORM to dongle\n", __FUNCTION__));
+               bus->d3_inform_cnt++;
+       }
+       if (h2d_mb_data == H2D_HOST_D0_INFORM_IN_USE) {
+               DHD_INFO_HW4(("%s: send H2D_HOST_D0_INFORM_IN_USE to dongle\n", __FUNCTION__));
+               bus->d0_inform_in_use_cnt++;
+       }
+       if (h2d_mb_data == H2D_HOST_D0_INFORM) {
+               DHD_INFO_HW4(("%s: send H2D_HOST_D0_INFORM to dongle\n", __FUNCTION__));
+               bus->d0_inform_cnt++;
+       }
+}
+
+static void
+dhdpcie_handle_mb_data(dhd_bus_t *bus)
+{
+       uint32 d2h_mb_data = 0;
+       uint32 zero = 0;
+       dhd_bus_cmn_readshared(bus, &d2h_mb_data, D2H_MB_DATA, 0);
+       if (D2H_DEV_MB_INVALIDATED(d2h_mb_data)) {
+               DHD_INFO_HW4(("%s: Invalid D2H_MB_DATA: 0x%08x\n",
+                       __FUNCTION__, d2h_mb_data));
+               return;
+       }
+
+       dhd_bus_cmn_writeshared(bus, &zero, sizeof(uint32), D2H_MB_DATA, 0);
+
+       DHD_INFO_HW4(("D2H_MB_DATA: 0x%08x\n", d2h_mb_data));
+       if (d2h_mb_data & D2H_DEV_FWHALT)  {
+               DHD_ERROR(("FW trap has happened\n"));
+               dhdpcie_checkdied(bus, NULL, 0);
+               /* not ready yet dhd_os_ind_firmware_stall(bus->dhd); */
+               return;
+       }
+       if (d2h_mb_data & D2H_DEV_DS_ENTER_REQ)  {
+               /* what should we do */
+               DHD_INFO(("D2H_MB_DATA: DEEP SLEEP REQ\n"));
+               dhdpcie_send_mb_data(bus, H2D_HOST_DS_ACK);
+               DHD_INFO(("D2H_MB_DATA: sent DEEP SLEEP ACK\n"));
+       }
+       if (d2h_mb_data & D2H_DEV_DS_EXIT_NOTE)  {
+               /* what should we do */
+               DHD_INFO(("D2H_MB_DATA: DEEP SLEEP EXIT\n"));
+       }
+       if (d2h_mb_data & D2H_DEV_D3_ACK)  {
+               /* what should we do */
+               DHD_INFO_HW4(("D2H_MB_DATA: D3 ACK\n"));
+               if (!bus->wait_for_d3_ack) {
+                       bus->wait_for_d3_ack = 1;
+                       dhd_os_d3ack_wake(bus->dhd);
+               }
+       }
+}
+
+/* Inform Dongle to print HW Registers for Livelock Debug */
+void dhdpcie_bus_dongle_print_hwregs(struct dhd_bus *bus)
+{
+       dhdpcie_send_mb_data(bus, H2D_FW_TRAP);
+}
+
+static bool
+dhdpcie_bus_process_mailbox_intr(dhd_bus_t *bus, uint32 intstatus)
+{
+       bool resched = FALSE;
+
+       if ((bus->sih->buscorerev == 2) || (bus->sih->buscorerev == 6) ||
+               (bus->sih->buscorerev == 4)) {
+               /* Msg stream interrupt */
+               if (intstatus & I_BIT1) {
+                       resched = dhdpci_bus_read_frames(bus);
+               } else if (intstatus & I_BIT0) {
+                       /* do nothing for Now */
+               }
+       } else {
+               if (intstatus & (PCIE_MB_TOPCIE_FN0_0 | PCIE_MB_TOPCIE_FN0_1))
+                       dhdpcie_handle_mb_data(bus);
+
+               if (bus->dhd->busstate == DHD_BUS_SUSPEND) {
+                       goto exit;
+               }
+
+               if (intstatus & PCIE_MB_D2H_MB_MASK) {
+                       resched = dhdpci_bus_read_frames(bus);
+               }
+       }
+
+exit:
+       return resched;
+}
+
+static bool
+dhdpci_bus_read_frames(dhd_bus_t *bus)
+{
+       bool more = FALSE;
+
+       /* There may be frames in both ctrl buf and data buf; check ctrl buf first */
+       DHD_PERIM_LOCK_ALL((bus->dhd->fwder_unit % FWDER_MAX_UNIT));
+       dhd_prot_process_ctrlbuf(bus->dhd);
+       /* Unlock to give chance for resp to be handled */
+       DHD_PERIM_UNLOCK_ALL((bus->dhd->fwder_unit % FWDER_MAX_UNIT));
+
+       DHD_PERIM_LOCK_ALL((bus->dhd->fwder_unit % FWDER_MAX_UNIT));
+       /* update the flow ring cpls */
+       dhd_update_txflowrings(bus->dhd);
+
+       /* With heavy TX traffic, we could get a lot of TxStatus
+        * so add bound
+        */
+       more |= dhd_prot_process_msgbuf_txcpl(bus->dhd, dhd_txbound);
+
+       /* With heavy RX traffic, this routine potentially could spend some time
+        * processing RX frames without RX bound
+        */
+       more |= dhd_prot_process_msgbuf_rxcpl(bus->dhd, dhd_rxbound);
+
+       /* don't talk to the dongle if fw is about to be reloaded */
+       if (bus->dhd->hang_was_sent) {
+               more = FALSE;
+       }
+       DHD_PERIM_UNLOCK_ALL((bus->dhd->fwder_unit % FWDER_MAX_UNIT));
+
+       return more;
+}
+
+bool
+dhdpcie_tcm_valid(dhd_bus_t *bus)
+{
+       uint32 addr = 0;
+       int rv;
+       uint32 shaddr = 0;
+       pciedev_shared_t sh;
+
+       shaddr = bus->dongle_ram_base + bus->ramsize - 4;
+
+       /* Read last word in memory to determine address of pciedev_shared structure */
+       addr = LTOH32(dhdpcie_bus_rtcm32(bus, shaddr));
+
+       if ((addr == 0) || (addr == bus->nvram_csm) || (addr < bus->dongle_ram_base) ||
+               (addr > shaddr)) {
+               DHD_ERROR(("%s: address (0x%08x) of pciedev_shared invalid addr\n",
+                       __FUNCTION__, addr));
+               return FALSE;
+       }
+
+       /* Read hndrte_shared structure */
+       if ((rv = dhdpcie_bus_membytes(bus, FALSE, addr, (uint8 *)&sh,
+               sizeof(pciedev_shared_t))) < 0) {
+               DHD_ERROR(("Failed to read PCIe shared struct with %d\n", rv));
+               return FALSE;
+       }
+
+       /* Compare any field in pciedev_shared_t */
+       if (sh.console_addr != bus->pcie_sh->console_addr) {
+               DHD_ERROR(("Contents of pciedev_shared_t structure are not matching.\n"));
+               return FALSE;
+       }
+
+       return TRUE;
+}
+
+static bool
+dhdpcie_check_firmware_compatible(uint32 firmware_api_version, uint32 host_api_version)
+{
+       DHD_INFO(("firmware api revision %d, host api revision %d\n",
+               firmware_api_version, host_api_version));
+       if (firmware_api_version <= host_api_version)
+               return TRUE;
+       if ((firmware_api_version == 6) && (host_api_version == 5))
+               return TRUE;
+       if ((firmware_api_version == 5) && (host_api_version == 6))
+               return TRUE;
+       return FALSE;
+}
+
+static int
+dhdpcie_readshared(dhd_bus_t *bus)
+{
+       uint32 addr = 0;
+       int rv, dma_indx_wr_buf, dma_indx_rd_buf;
+       uint32 shaddr = 0;
+       pciedev_shared_t *sh = bus->pcie_sh;
+       dhd_timeout_t tmo;
+
+       shaddr = bus->dongle_ram_base + bus->ramsize - 4;
+
+       DHD_INFO_HW4(("%s: ram_base: 0x%x ramsize 0x%x tcm: %p shaddr: 0x%x nvram_csm: 0x%x\n",
+               __FUNCTION__, bus->dongle_ram_base, bus->ramsize,
+               bus->tcm, shaddr, bus->nvram_csm));
+       /* start a timer for 5 seconds */
+       dhd_timeout_start(&tmo, MAX_READ_TIMEOUT);
+
+       while (((addr == 0) || (addr == bus->nvram_csm)) && !dhd_timeout_expired(&tmo)) {
+               /* Read last word in memory to determine address of pciedev_shared structure */
+               addr = LTOH32(dhdpcie_bus_rtcm32(bus, shaddr));
+       }
+
+       if ((addr == 0) || (addr == bus->nvram_csm) || (addr < bus->dongle_ram_base) ||
+               (addr > shaddr)) {
+               DHD_ERROR(("%s: address (0x%08x) of pciedev_shared invalid\n",
+                       __FUNCTION__, addr));
+               DHD_ERROR(("Waited %u usec, dongle is not ready\n", tmo.elapsed));
+               return BCME_ERROR;
+       } else {
+               bus->shared_addr = (ulong)addr;
+               DHD_ERROR(("PCIe shared addr (0x%08x) read took %u usec "
+                       "before dongle is ready\n", addr, tmo.elapsed));
+       }
+
+       /* Read hndrte_shared structure */
+       if ((rv = dhdpcie_bus_membytes(bus, FALSE, addr, (uint8 *)sh,
+               sizeof(pciedev_shared_t))) < 0) {
+               DHD_ERROR(("Failed to read PCIe shared struct with %d\n", rv));
+               return rv;
+       }
+
+       /* Endianness */
+       sh->flags = ltoh32(sh->flags);
+       sh->trap_addr = ltoh32(sh->trap_addr);
+       sh->assert_exp_addr = ltoh32(sh->assert_exp_addr);
+       sh->assert_file_addr = ltoh32(sh->assert_file_addr);
+       sh->assert_line = ltoh32(sh->assert_line);
+       sh->console_addr = ltoh32(sh->console_addr);
+       sh->msgtrace_addr = ltoh32(sh->msgtrace_addr);
+       sh->dma_rxoffset = ltoh32(sh->dma_rxoffset);
+       sh->rings_info_ptr = ltoh32(sh->rings_info_ptr);
+
+#ifdef DHD_DEBUG
+       /* load bus console address */
+       bus->console_addr = sh->console_addr;
+#endif
+
+       /* Read the dma rx offset */
+       bus->dma_rxoffset = bus->pcie_sh->dma_rxoffset;
+       dhd_prot_rx_dataoffset(bus->dhd, bus->dma_rxoffset);
+
+       DHD_ERROR(("DMA RX offset from shared Area %d\n", bus->dma_rxoffset));
+
+       if (!(dhdpcie_check_firmware_compatible(sh->flags & PCIE_SHARED_VERSION_MASK,
+               PCIE_SHARED_VERSION)))
+       {
+               DHD_ERROR(("%s: pcie_shared version %d in dhd "
+                          "is older than pciedev_shared version %d in dongle\n",
+                          __FUNCTION__, PCIE_SHARED_VERSION,
+                          sh->flags & PCIE_SHARED_VERSION_MASK));
+               return BCME_ERROR;
+       }
+
+       bus->rw_index_sz = (sh->flags & PCIE_SHARED_2BYTE_INDICES) ?
+               sizeof(uint16) : sizeof(uint32);
+       DHD_ERROR(("%s: Dongle advertizes %d size indices\n",
+               __FUNCTION__, bus->rw_index_sz));
+
+       /* Does the FW support DMA'ing r/w indices */
+       if (sh->flags & PCIE_SHARED_DMA_INDEX) {
+
+
+               DHD_ERROR(("%s: Host support DMAing indices: H2D:%d - D2H:%d. FW supports it\n",
+                       __FUNCTION__,
+                       (DMA_INDX_ENAB(bus->dhd->dma_h2d_ring_upd_support) ? 1 : 0),
+                       (DMA_INDX_ENAB(bus->dhd->dma_d2h_ring_upd_support) ? 1 : 0)));
+
+       } else if (DMA_INDX_ENAB(bus->dhd->dma_d2h_ring_upd_support) ||
+                  DMA_INDX_ENAB(bus->dhd->dma_h2d_ring_upd_support)) {
+
+#ifdef BCM_INDX_DMA
+               DHD_ERROR(("%s: Incompatible FW. FW does not support DMAing indices\n",
+                       __FUNCTION__));
+               return BCME_ERROR;
+#endif
+               DHD_ERROR(("%s: Host supports DMAing indices but FW does not\n",
+                       __FUNCTION__));
+               bus->dhd->dma_d2h_ring_upd_support = FALSE;
+               bus->dhd->dma_h2d_ring_upd_support = FALSE;
+       }
+
+
+       /* get ring_info, ring_state and mb data ptrs and store the addresses in bus structure */
+       {
+               ring_info_t  ring_info;
+
+               if ((rv = dhdpcie_bus_membytes(bus, FALSE, sh->rings_info_ptr,
+                       (uint8 *)&ring_info, sizeof(ring_info_t))) < 0)
+                       return rv;
+
+               bus->h2d_mb_data_ptr_addr = ltoh32(sh->h2d_mb_data_ptr);
+               bus->d2h_mb_data_ptr_addr = ltoh32(sh->d2h_mb_data_ptr);
+
+
+               bus->max_sub_queues = ltoh16(ring_info.max_sub_queues);
+
+               /* If both FW and Host support DMA'ing indices, allocate memory and notify FW
+                * The max_sub_queues is read from FW initialized ring_info
+                */
+               if (DMA_INDX_ENAB(bus->dhd->dma_h2d_ring_upd_support)) {
+                       dma_indx_wr_buf = dhd_prot_dma_indx_init(bus->dhd, bus->rw_index_sz,
+                               H2D_DMA_INDX_WR_BUF, bus->max_sub_queues);
+                       dma_indx_rd_buf = dhd_prot_dma_indx_init(bus->dhd, bus->rw_index_sz,
+                               D2H_DMA_INDX_RD_BUF, BCMPCIE_D2H_COMMON_MSGRINGS);
+
+                       if ((dma_indx_wr_buf != BCME_OK) || (dma_indx_rd_buf != BCME_OK)) {
+                               DHD_ERROR(("%s: Failed to allocate memory for dma'ing h2d indices"
+                                       "Host will use w/r indices in TCM\n",
+                                       __FUNCTION__));
+                               bus->dhd->dma_h2d_ring_upd_support = FALSE;
+                       }
+               }
+
+               if (DMA_INDX_ENAB(bus->dhd->dma_d2h_ring_upd_support)) {
+                       dma_indx_wr_buf = dhd_prot_dma_indx_init(bus->dhd, bus->rw_index_sz,
+                               D2H_DMA_INDX_WR_BUF, BCMPCIE_D2H_COMMON_MSGRINGS);
+                       dma_indx_rd_buf = dhd_prot_dma_indx_init(bus->dhd, bus->rw_index_sz,
+                               H2D_DMA_INDX_RD_BUF, bus->max_sub_queues);
+
+                       if ((dma_indx_wr_buf != BCME_OK) || (dma_indx_rd_buf != BCME_OK)) {
+                               DHD_ERROR(("%s: Failed to allocate memory for dma'ing d2h indices"
+                                       "Host will use w/r indices in TCM\n",
+                                       __FUNCTION__));
+                               bus->dhd->dma_d2h_ring_upd_support = FALSE;
+                       }
+               }
+
+               /* read ringmem and ringstate ptrs from shared area and store in host variables */
+               dhd_fillup_ring_sharedptr_info(bus, &ring_info);
+
+               bcm_print_bytes("ring_info_raw", (uchar *)&ring_info, sizeof(ring_info_t));
+               DHD_INFO(("ring_info\n"));
+
+               DHD_ERROR(("%s: max H2D queues %d\n",
+                       __FUNCTION__, ltoh16(ring_info.max_sub_queues)));
+
+               DHD_INFO(("mail box address\n"));
+               DHD_INFO(("%s: h2d_mb_data_ptr_addr 0x%04x\n",
+                       __FUNCTION__, bus->h2d_mb_data_ptr_addr));
+               DHD_INFO(("%s: d2h_mb_data_ptr_addr 0x%04x\n",
+                       __FUNCTION__, bus->d2h_mb_data_ptr_addr));
+       }
+
+       bus->dhd->d2h_sync_mode = sh->flags & PCIE_SHARED_D2H_SYNC_MODE_MASK;
+       DHD_INFO(("%s: d2h_sync_mode 0x%08x\n",
+               __FUNCTION__, bus->dhd->d2h_sync_mode));
+
+       return BCME_OK;
+} /* dhdpcie_readshared */
+
+/** Read ring mem and ring state ptr info from shared memory area in device memory */
+static void
+dhd_fillup_ring_sharedptr_info(dhd_bus_t *bus, ring_info_t *ring_info)
+{
+       uint16 i = 0;
+       uint16 j = 0;
+       uint32 tcm_memloc;
+       uint32  d2h_w_idx_ptr, d2h_r_idx_ptr, h2d_w_idx_ptr, h2d_r_idx_ptr;
+
+       /* Ring mem ptr info */
+       /* Alloated in the order
+               H2D_MSGRING_CONTROL_SUBMIT              0
+               H2D_MSGRING_RXPOST_SUBMIT               1
+               D2H_MSGRING_CONTROL_COMPLETE            2
+               D2H_MSGRING_TX_COMPLETE                 3
+               D2H_MSGRING_RX_COMPLETE                 4
+       */
+
+       {
+               /* ringmemptr holds start of the mem block address space */
+               tcm_memloc = ltoh32(ring_info->ringmem_ptr);
+
+               /* Find out ringmem ptr for each ring common  ring */
+               for (i = 0; i <= BCMPCIE_COMMON_MSGRING_MAX_ID; i++) {
+                       bus->ring_sh[i].ring_mem_addr = tcm_memloc;
+                       /* Update mem block */
+                       tcm_memloc = tcm_memloc + sizeof(ring_mem_t);
+                       DHD_INFO(("ring id %d ring mem addr 0x%04x \n",
+                               i, bus->ring_sh[i].ring_mem_addr));
+               }
+       }
+
+       /* Ring state mem ptr info */
+       {
+               d2h_w_idx_ptr = ltoh32(ring_info->d2h_w_idx_ptr);
+               d2h_r_idx_ptr = ltoh32(ring_info->d2h_r_idx_ptr);
+               h2d_w_idx_ptr = ltoh32(ring_info->h2d_w_idx_ptr);
+               h2d_r_idx_ptr = ltoh32(ring_info->h2d_r_idx_ptr);
+
+               /* Store h2d common ring write/read pointers */
+               for (i = 0; i < BCMPCIE_H2D_COMMON_MSGRINGS; i++) {
+                       bus->ring_sh[i].ring_state_w = h2d_w_idx_ptr;
+                       bus->ring_sh[i].ring_state_r = h2d_r_idx_ptr;
+
+                       /* update mem block */
+                       h2d_w_idx_ptr = h2d_w_idx_ptr + bus->rw_index_sz;
+                       h2d_r_idx_ptr = h2d_r_idx_ptr + bus->rw_index_sz;
+
+                       DHD_INFO(("h2d w/r : idx %d write %x read %x \n", i,
+                               bus->ring_sh[i].ring_state_w, bus->ring_sh[i].ring_state_r));
+               }
+
+               /* Store d2h common ring write/read pointers */
+               for (j = 0; j < BCMPCIE_D2H_COMMON_MSGRINGS; j++, i++) {
+                       bus->ring_sh[i].ring_state_w = d2h_w_idx_ptr;
+                       bus->ring_sh[i].ring_state_r = d2h_r_idx_ptr;
+
+                       /* update mem block */
+                       d2h_w_idx_ptr = d2h_w_idx_ptr + bus->rw_index_sz;
+                       d2h_r_idx_ptr = d2h_r_idx_ptr + bus->rw_index_sz;
+
+                       DHD_INFO(("d2h w/r : idx %d write %x read %x \n", i,
+                               bus->ring_sh[i].ring_state_w, bus->ring_sh[i].ring_state_r));
+               }
+
+               /* Store txflow ring write/read pointers */
+               for (j = 0; j < (bus->max_sub_queues - BCMPCIE_H2D_COMMON_MSGRINGS);
+                       i++, j++)
+               {
+                       bus->ring_sh[i].ring_state_w = h2d_w_idx_ptr;
+                       bus->ring_sh[i].ring_state_r = h2d_r_idx_ptr;
+
+                       /* update mem block */
+                       h2d_w_idx_ptr = h2d_w_idx_ptr + bus->rw_index_sz;
+                       h2d_r_idx_ptr = h2d_r_idx_ptr + bus->rw_index_sz;
+
+                       DHD_INFO(("FLOW Rings h2d w/r : idx %d write %x read %x \n", i,
+                               bus->ring_sh[i].ring_state_w,
+                               bus->ring_sh[i].ring_state_r));
+               }
+       }
+} /* dhd_fillup_ring_sharedptr_info */
+
+/**
+ * Initialize bus module: prepare for communication with the dongle. Called after downloading
+ * firmware into the dongle.
+ */
+int dhd_bus_init(dhd_pub_t *dhdp, bool enforce_mutex)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       int  ret = 0;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       ASSERT(bus->dhd);
+       if (!bus->dhd)
+               return 0;
+
+       /* Make sure we're talking to the core. */
+       bus->reg = si_setcore(bus->sih, PCIE2_CORE_ID, 0);
+       ASSERT(bus->reg != NULL);
+
+       /* before opening up bus for data transfer, check if shared are is intact */
+       ret = dhdpcie_readshared(bus);
+       if (ret < 0) {
+               DHD_ERROR(("%s :Shared area read failed \n", __FUNCTION__));
+               return ret;
+       }
+
+       /* Make sure we're talking to the core. */
+       bus->reg = si_setcore(bus->sih, PCIE2_CORE_ID, 0);
+       ASSERT(bus->reg != NULL);
+
+       /* Set bus state according to enable result */
+       dhdp->busstate = DHD_BUS_DATA;
+
+       if (!dhd_download_fw_on_driverload)
+               dhd_dpc_enable(bus->dhd);
+
+       /* Enable the interrupt after device is up */
+       dhdpcie_bus_intr_enable(bus);
+
+       /* bcmsdh_intr_unmask(bus->sdh); */
+
+#ifdef DHD_PCIE_RUNTIMEPM
+       bus->idlecount = 0;
+       bus->idletime = (int32)MAX_IDLE_COUNT;
+       init_waitqueue_head(&bus->rpm_queue);
+       mutex_init(&bus->pm_lock);
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+       bus->d3_ack_war_cnt = 0;
+
+       return ret;
+}
+
+static void
+dhdpcie_init_shared_addr(dhd_bus_t *bus)
+{
+       uint32 addr = 0;
+       uint32 val = 0;
+       addr = bus->dongle_ram_base + bus->ramsize - 4;
+#ifdef DHD_PCIE_RUNTIMEPM
+       dhdpcie_runtime_bus_wake(bus->dhd, TRUE, __builtin_return_address(0));
+#endif /* DHD_PCIE_RUNTIMEPM */
+       DHD_INFO_HW4(("%s: tcm: %p, addr: 0x%x val: 0x%x\n", __FUNCTION__, bus->tcm, addr, val));
+       dhdpcie_bus_membytes(bus, TRUE, addr, (uint8 *)&val, sizeof(val));
+}
+
+
+bool
+dhdpcie_chipmatch(uint16 vendor, uint16 device)
+{
+       if (vendor != PCI_VENDOR_ID_BROADCOM) {
+               DHD_ERROR(("%s: Unsupported vendor %x device %x\n", __FUNCTION__,
+                       vendor, device));
+               return (-ENODEV);
+       }
+
+       if ((device == BCM4350_D11AC_ID) || (device == BCM4350_D11AC2G_ID) ||
+               (device == BCM4350_D11AC5G_ID) || (device == BCM4350_CHIP_ID) ||
+               (device == BCM43569_CHIP_ID))
+               return 0;
+
+       if ((device == BCM4354_D11AC_ID) || (device == BCM4354_D11AC2G_ID) ||
+               (device == BCM4354_D11AC5G_ID) || (device == BCM4354_CHIP_ID))
+               return 0;
+
+       if ((device == BCM4356_D11AC_ID) || (device == BCM4356_D11AC2G_ID) ||
+               (device == BCM4356_D11AC5G_ID) || (device == BCM4356_CHIP_ID))
+               return 0;
+
+       if ((device == BCM4345_D11AC_ID) || (device == BCM4345_D11AC2G_ID) ||
+               (device == BCM4345_D11AC5G_ID) || BCM4345_CHIP(device))
+               return 0;
+
+       if ((device == BCM4335_D11AC_ID) || (device == BCM4335_D11AC2G_ID) ||
+               (device == BCM4335_D11AC5G_ID) || (device == BCM4335_CHIP_ID))
+               return 0;
+
+       if ((device == BCM43602_D11AC_ID) || (device == BCM43602_D11AC2G_ID) ||
+               (device == BCM43602_D11AC5G_ID) || (device == BCM43602_CHIP_ID))
+               return 0;
+
+       if ((device == BCM43569_D11AC_ID) || (device == BCM43569_D11AC2G_ID) ||
+               (device == BCM43569_D11AC5G_ID) || (device == BCM43569_CHIP_ID))
+               return 0;
+
+       if ((device == BCM4358_D11AC_ID) || (device == BCM4358_D11AC2G_ID) ||
+               (device == BCM4358_D11AC5G_ID))
+               return 0;
+
+       if ((device == BCM4349_D11AC_ID) || (device == BCM4349_D11AC2G_ID) ||
+               (device == BCM4349_D11AC5G_ID) || (device == BCM4349_CHIP_ID))
+               return 0;
+
+       if ((device == BCM4355_D11AC_ID) || (device == BCM4355_D11AC2G_ID) ||
+               (device == BCM4355_D11AC5G_ID) || (device == BCM4355_CHIP_ID))
+               return 0;
+
+       if ((device == BCM4359_D11AC_ID) || (device == BCM4359_D11AC2G_ID) ||
+               (device == BCM4359_D11AC5G_ID))
+               return 0;
+
+       if ((device == BCM43596_D11AC_ID) || (device == BCM43596_D11AC2G_ID) ||
+               (device == BCM43596_D11AC5G_ID))
+               return 0;
+
+       if ((device == BCM43597_D11AC_ID) || (device == BCM43597_D11AC2G_ID) ||
+               (device == BCM43597_D11AC5G_ID))
+               return 0;
+
+
+       if ((device == BCM4365_D11AC_ID) || (device == BCM4365_D11AC2G_ID) ||
+               (device == BCM4365_D11AC5G_ID) || (device == BCM4365_CHIP_ID))
+               return 0;
+
+       if ((device == BCM4366_D11AC_ID) || (device == BCM4366_D11AC2G_ID) ||
+               (device == BCM4366_D11AC5G_ID) || (device == BCM4366_CHIP_ID))
+               return 0;
+
+       DHD_ERROR(("%s: Unsupported vendor %x device %x\n", __FUNCTION__, vendor, device));
+       return (-ENODEV);
+} /* dhdpcie_chipmatch */
+
+/**
+ * Name:  dhdpcie_cc_nvmshadow
+ *
+ * Description:
+ * A shadow of OTP/SPROM exists in ChipCommon Region
+ * betw. 0x800 and 0xBFF (Backplane Addr. 0x1800_0800 and 0x1800_0BFF).
+ * Strapping option (SPROM vs. OTP), presence of OTP/SPROM and its size
+ * can also be read from ChipCommon Registers.
+ */
+static int
+dhdpcie_cc_nvmshadow(dhd_bus_t *bus, struct bcmstrbuf *b)
+{
+       uint16 dump_offset = 0;
+       uint32 dump_size = 0, otp_size = 0, sprom_size = 0;
+
+       /* Table for 65nm OTP Size (in bits) */
+       int  otp_size_65nm[8] = {0, 2048, 4096, 8192, 4096, 6144, 512, 1024};
+
+       volatile uint16 *nvm_shadow;
+
+       uint cur_coreid;
+       uint chipc_corerev;
+       chipcregs_t *chipcregs;
+
+       /* Save the current core */
+       cur_coreid = si_coreid(bus->sih);
+       /* Switch to ChipC */
+       chipcregs = (chipcregs_t *)si_setcore(bus->sih, CC_CORE_ID, 0);
+       ASSERT(chipcregs != NULL);
+
+       chipc_corerev = si_corerev(bus->sih);
+
+       /* Check ChipcommonCore Rev */
+       if (chipc_corerev < 44) {
+               DHD_ERROR(("%s: ChipcommonCore Rev %d < 44\n", __FUNCTION__, chipc_corerev));
+               return BCME_UNSUPPORTED;
+       }
+
+       /* Check ChipID */
+       if (((uint16)bus->sih->chip != BCM4350_CHIP_ID) && !BCM4345_CHIP((uint16)bus->sih->chip)) {
+               DHD_ERROR(("%s: cc_nvmdump cmd. supported for 4350/4345 only\n",
+                       __FUNCTION__));
+               return BCME_UNSUPPORTED;
+       }
+
+       /* Check if SRC_PRESENT in SpromCtrl(0x190 in ChipCommon Regs) is set */
+       if (chipcregs->sromcontrol & SRC_PRESENT) {
+               /* SPROM Size: 1Kbits (0x0), 4Kbits (0x1), 16Kbits(0x2) */
+               sprom_size = (1 << (2 * ((chipcregs->sromcontrol & SRC_SIZE_MASK)
+                                       >> SRC_SIZE_SHIFT))) * 1024;
+               bcm_bprintf(b, "\nSPROM Present (Size %d bits)\n", sprom_size);
+       }
+
+       if (chipcregs->sromcontrol & SRC_OTPPRESENT) {
+               bcm_bprintf(b, "\nOTP Present");
+
+               if (((chipcregs->otplayout & OTPL_WRAP_TYPE_MASK) >> OTPL_WRAP_TYPE_SHIFT)
+                       == OTPL_WRAP_TYPE_40NM) {
+                       /* 40nm OTP: Size = (OtpSize + 1) * 1024 bits */
+                       otp_size =  (((chipcregs->capabilities & CC_CAP_OTPSIZE)
+                                       >> CC_CAP_OTPSIZE_SHIFT) + 1) * 1024;
+                       bcm_bprintf(b, "(Size %d bits)\n", otp_size);
+               } else {
+                       /* This part is untested since newer chips have 40nm OTP */
+                       otp_size = otp_size_65nm[(chipcregs->capabilities & CC_CAP_OTPSIZE)
+                                       >> CC_CAP_OTPSIZE_SHIFT];
+                       bcm_bprintf(b, "(Size %d bits)\n", otp_size);
+                       DHD_INFO(("%s: 65nm/130nm OTP Size not tested. \n",
+                               __FUNCTION__));
+               }
+       }
+
+       if (((chipcregs->sromcontrol & SRC_PRESENT) == 0) &&
+               ((chipcregs->capabilities & CC_CAP_OTPSIZE) == 0)) {
+               DHD_ERROR(("%s: SPROM and OTP could not be found \n",
+                       __FUNCTION__));
+               return BCME_NOTFOUND;
+       }
+
+       /* Check the strapping option in SpromCtrl: Set = OTP otherwise SPROM */
+       if ((chipcregs->sromcontrol & SRC_OTPSEL) &&
+               (chipcregs->sromcontrol & SRC_OTPPRESENT)) {
+
+               bcm_bprintf(b, "OTP Strap selected.\n"
+                              "\nOTP Shadow in ChipCommon:\n");
+
+               dump_size = otp_size / 16 ; /* 16bit words */
+
+       } else if (((chipcregs->sromcontrol & SRC_OTPSEL) == 0) &&
+               (chipcregs->sromcontrol & SRC_PRESENT)) {
+
+               bcm_bprintf(b, "SPROM Strap selected\n"
+                               "\nSPROM Shadow in ChipCommon:\n");
+
+               /* If SPROM > 8K only 8Kbits is mapped to ChipCommon (0x800 - 0xBFF) */
+               /* dump_size in 16bit words */
+               dump_size = sprom_size > 8 ? (8 * 1024) / 16 : sprom_size / 16;
+       } else {
+               DHD_ERROR(("%s: NVM Shadow does not exist in ChipCommon\n",
+                       __FUNCTION__));
+               return BCME_NOTFOUND;
+       }
+
+       if (bus->regs == NULL) {
+               DHD_ERROR(("ChipCommon Regs. not initialized\n"));
+               return BCME_NOTREADY;
+       } else {
+           bcm_bprintf(b, "\n OffSet:");
+
+           /* Point to the SPROM/OTP shadow in ChipCommon */
+           nvm_shadow = chipcregs->sromotp;
+
+          /*
+           * Read 16 bits / iteration.
+           * dump_size & dump_offset in 16-bit words
+           */
+           while (dump_offset < dump_size) {
+               if (dump_offset % 2 == 0)
+                       /* Print the offset in the shadow space in Bytes */
+                       bcm_bprintf(b, "\n 0x%04x", dump_offset * 2);
+
+               bcm_bprintf(b, "\t0x%04x", *(nvm_shadow + dump_offset));
+               dump_offset += 0x1;
+           }
+       }
+
+       /* Switch back to the original core */
+       si_setcore(bus->sih, cur_coreid, 0);
+
+       return BCME_OK;
+} /* dhdpcie_cc_nvmshadow */
+
+/**
+ * Name:  dhdpcie_sromotp_customvar
+ *
+ * Description:
+ * read otp/sprom and parse & store customvar.
+ *
+ * A shadow of OTP/SPROM exists in ChipCommon Region
+ * betw. 0x800 and 0xBFF (Backplane Addr. 0x1800_0800 and 0x1800_0BFF).
+ * Strapping option (SPROM vs. OTP), presence of OTP/SPROM and its size
+ * can also be read from ChipCommon Registers.
+ */
+static int
+dhdpcie_sromotp_customvar(dhd_bus_t *bus, uint32 *customvar1, uint32 *customvar2)
+{
+       uint16 dump_offset = 0;
+       uint32 dump_size = 0, otp_size = 0, sprom_size = 0;
+
+       /* Table for 65nm OTP Size (in bits) */
+       int  otp_size_65nm[8] = {0, 2048, 4096, 8192, 4096, 6144, 512, 1024};
+
+#ifdef CUSTOMER_HW2
+       uint32 otp_start_addr;
+       uint32 otp_end_addr;
+       uint32 cur_addr;
+       uint32 byte_enable;
+       int delay;
+#else
+       volatile uint16 *nvm_shadow;
+#endif /* CUSTOMER_HW2 */
+
+       uint cur_coreid;
+       uint chipc_corerev;
+       chipcregs_t *chipcregs;
+       uint16 *otp_dump;
+       uint8 *cis;
+       uint8 tup, tlen;
+       int i = 0;
+
+       /* Save the current core */
+       cur_coreid = si_coreid(bus->sih);
+       /* Switch to ChipC */
+       chipcregs = (chipcregs_t *)si_setcore(bus->sih, CC_CORE_ID, 0);
+       ASSERT(chipcregs != NULL);
+
+       chipc_corerev = si_corerev(bus->sih);
+
+       /* Check ChipcommonCore Rev */
+       if (chipc_corerev < 44) {
+               DHD_ERROR(("%s: ChipcommonCore Rev %d < 44\n", __FUNCTION__, chipc_corerev));
+               return BCME_UNSUPPORTED;
+       }
+
+       /* Check ChipID */
+       if (((uint16)bus->sih->chip != BCM4350_CHIP_ID) && !BCM4345_CHIP((uint16)bus->sih->chip) &&
+               ((uint16)bus->sih->chip != BCM4355_CHIP_ID) &&
+               ((uint16)bus->sih->chip != BCM4359_CHIP_ID) &&
+               ((uint16)bus->sih->chip != BCM4349_CHIP_ID)) {
+               DHD_ERROR(("%s: supported for chips"
+                                       "4350/4345/4355/4364/4349/4359 only\n", __FUNCTION__));
+               return BCME_UNSUPPORTED;
+       }
+
+       /* Check if SRC_PRESENT in SpromCtrl(0x190 in ChipCommon Regs) is set */
+       if (chipcregs->sromcontrol & SRC_PRESENT) {
+               /* SPROM Size: 1Kbits (0x0), 4Kbits (0x1), 16Kbits(0x2) */
+               sprom_size = (1 << (2 * ((chipcregs->sromcontrol & SRC_SIZE_MASK)
+                                       >> SRC_SIZE_SHIFT))) * 1024;
+               DHD_TRACE(("\nSPROM Present (Size %d bits)\n", sprom_size));
+       }
+
+       if (chipcregs->sromcontrol & SRC_OTPPRESENT) {
+               DHD_TRACE(("\nOTP Present"));
+
+               if (((chipcregs->otplayout & OTPL_WRAP_TYPE_MASK) >> OTPL_WRAP_TYPE_SHIFT)
+                       == OTPL_WRAP_TYPE_40NM) {
+                       /* 40nm OTP: Size = (OtpSize + 1) * 1024 bits */
+                       /* Chipcommon rev51 is a variation on rev45 and does not support
+                        * the latest OTP configuration.
+                        */
+                       if (chipc_corerev != 51 && chipc_corerev >= 49) {
+                               otp_size = (((chipcregs->otplayout & OTPL_ROW_SIZE_MASK)
+                                       >> OTPL_ROW_SIZE_SHIFT) + 1) * 1024;
+                               DHD_TRACE(("(Size %d bits)\n", otp_size));
+                       } else {
+                               otp_size =  (((chipcregs->capabilities & CC_CAP_OTPSIZE)
+                                       >> CC_CAP_OTPSIZE_SHIFT) + 1) * 1024;
+                               DHD_TRACE(("(Size %d bits)\n", otp_size));
+                       }
+               } else {
+                       /* This part is untested since newer chips have 40nm OTP */
+                       /* Chipcommon rev51 is a variation on rev45 and does not support
+                        * the latest OTP configuration.
+                        */
+                       if (chipc_corerev != 51 && chipc_corerev >= 49) {
+                               otp_size = otp_size_65nm[(chipcregs->otplayout & OTPL_ROW_SIZE_MASK)
+                                               >> OTPL_ROW_SIZE_SHIFT];
+                               DHD_TRACE(("(Size %d bits)\n", otp_size));
+                       } else {
+                               otp_size = otp_size_65nm[(chipcregs->capabilities & CC_CAP_OTPSIZE)
+                                               >> CC_CAP_OTPSIZE_SHIFT];
+                               DHD_TRACE(("(Size %d bits)\n", otp_size));
+                               DHD_TRACE(("%s: 65nm/130nm OTP Size not tested. \n",
+                                       __FUNCTION__));
+                       }
+               }
+       }
+
+       /* Chipcommon rev51 is a variation on rev45 and does not support
+        * the latest OTP configuration.
+        */
+       if (chipc_corerev != 51 && chipc_corerev >= 49) {
+               if (((chipcregs->sromcontrol & SRC_PRESENT) == 0) &&
+                       ((chipcregs->otplayout & OTPL_ROW_SIZE_MASK) == 0)) {
+                       DHD_ERROR(("%s: SPROM and OTP could not be found "
+                               "sromcontrol = %x, otplayout = %x \n",
+                               __FUNCTION__, chipcregs->sromcontrol, chipcregs->otplayout));
+                       return BCME_NOTFOUND;
+               }
+       } else {
+               if (((chipcregs->sromcontrol & SRC_PRESENT) == 0) &&
+                       ((chipcregs->capabilities & CC_CAP_OTPSIZE) == 0)) {
+                       DHD_ERROR(("%s: SPROM and OTP could not be found "
+                               "sromcontrol = %x, capablities = %x \n",
+                               __FUNCTION__, chipcregs->sromcontrol, chipcregs->capabilities));
+                       return BCME_NOTFOUND;
+               }
+       }
+
+       /* Check the strapping option in SpromCtrl: Set = OTP otherwise SPROM */
+       if ((!(chipcregs->sromcontrol & SRC_PRESENT) || (chipcregs->sromcontrol & SRC_OTPSEL)) &&
+               (chipcregs->sromcontrol & SRC_OTPPRESENT)) {
+
+               DHD_TRACE(("OTP Strap selected.\n"
+                              "\nOTP Shadow in ChipCommon:\n"));
+
+               dump_size = otp_size / 16 ; /* 16bit words */
+
+       } else if (((chipcregs->sromcontrol & SRC_OTPSEL) == 0) &&
+               (chipcregs->sromcontrol & SRC_PRESENT)) {
+
+               DHD_TRACE(("SPROM Strap selected\n"
+                               "\nSPROM Shadow in ChipCommon:\n"));
+
+               /* If SPROM > 8K only 8Kbits is mapped to ChipCommon (0x800 - 0xBFF) */
+               /* dump_size in 16bit words */
+               dump_size = sprom_size > 8 ? (8 * 1024) / 16 : sprom_size / 16;
+       } else {
+               DHD_ERROR(("%s: NVM Shadow does not exist in ChipCommon\n",
+                       __FUNCTION__));
+               return BCME_NOTFOUND;
+       }
+
+       if (bus->regs == NULL) {
+               DHD_ERROR(("ChipCommon Regs. not initialized\n"));
+               return BCME_NOTREADY;
+       }
+
+#ifdef CUSTOMER_HW2
+
+       /* Use CC backplane interconnect registers to read OTP region */
+       otp_start_addr = si_corebase(bus->sih, GCI_CORE_ID);
+       if (!otp_start_addr) {
+               DHD_ERROR(("%s: Failed to find gci core base addr\n",
+                       __FUNCTION__));
+               return BCME_NOTFOUND;
+       }
+
+       otp_dump = kzalloc(dump_size*2, GFP_KERNEL);
+       if (otp_dump == NULL) {
+               DHD_ERROR(("%s: Insufficient system memory of size %d\n",
+                       __FUNCTION__, dump_size));
+               return BCME_NOMEM;
+       }
+
+       /* Read 16 bits / iteration.
+        * dump_size is in 16-bit words
+        */
+       otp_end_addr = otp_start_addr + (dump_size * 2);
+       cur_addr = otp_start_addr;
+       /* ByteEnables(3:0) bits represent backplane address and data
+        * locations to read/write in 4-byte width.
+        */
+       byte_enable = 0x03;
+
+       while (cur_addr < otp_end_addr) {
+               W_REG(bus->osh, &chipcregs->bp_addrlow, cur_addr);
+               W_REG(bus->osh, &chipcregs->bp_addrhigh, 0x0);
+               /* 0x0200 will set StartBusy bit to start indirect backplane access */
+               W_REG(bus->osh, &chipcregs->bp_indaccess, 0x0200 | byte_enable);
+
+               for (delay = 0; delay < STARTBUSY_BIT_POLL_MAX_TIME; delay++) {
+                       /* Hardware clears StartBusy bit on transfer completion */
+                       if (R_REG(bus->osh, &chipcregs->bp_indaccess) == byte_enable)
+                               break;
+                       OSL_DELAY(100);
+               }
+               if (delay == STARTBUSY_BIT_POLL_MAX_TIME) {
+                       DHD_ERROR(("%s: Read from 0x%x didn't complete\n", __FUNCTION__, cur_addr));
+                       if (otp_dump) {
+                               kfree(otp_dump);
+                               otp_dump = NULL;
+                       }
+                       return BCME_ERROR;
+               }
+
+               if (byte_enable == 0x03) {
+                       *(otp_dump + dump_offset) = R_REG(bus->osh, &chipcregs->bp_data) & 0xFFFF;
+                       byte_enable = 0x0c;
+               } else {
+                       *(otp_dump + dump_offset) =
+                               (R_REG(bus->osh, &chipcregs->bp_data) >> 16) & 0xFFFF;
+                       byte_enable = 0x03;
+               }
+
+               cur_addr += 2;
+               dump_offset += 1;
+       }
+
+#else /* CUSTOMER_HW2 */
+
+       /* Chipcommon rev51 is a variation on rev45 and does not support
+        * the latest OTP configuration.
+        */
+       if (chipc_corerev != 51 && chipc_corerev >= 49) {
+               /* Chip common can read only 8kbits,
+               * for ccrev >= 49 otp size is around 12 kbits so use GCI core
+               */
+               nvm_shadow = (volatile uint16 *)si_setcore(bus->sih, GCI_CORE_ID, 0);
+       } else {
+               /* Point to the SPROM/OTP shadow in ChipCommon */
+               nvm_shadow = chipcregs->sromotp;
+       }
+
+       if (nvm_shadow == NULL) {
+               DHD_ERROR(("%s: NVM Shadow is not intialized\n", __FUNCTION__));
+               return BCME_NOTFOUND;
+       }
+
+       otp_dump = kzalloc(dump_size*2, GFP_KERNEL);
+       if (otp_dump == NULL) {
+               DHD_ERROR(("%s: Insufficient system memory of size %d\n",
+                       __FUNCTION__, dump_size));
+               return BCME_NOMEM;
+       }
+
+       /*
+       * Read 16 bits / iteration.
+       * dump_size & dump_offset in 16-bit words
+       */
+       while (dump_offset < dump_size) {
+               *(otp_dump + dump_offset) = *(nvm_shadow + dump_offset);
+               dump_offset += 0x1;
+       }
+
+#endif /* CUSTOMER_HW2 */
+
+       /* Read from cis tuple start address */
+       cis = (uint8 *)otp_dump + CISTPL_OFFSET;
+
+       /* parse value of customvar2 tuple */
+       do {
+               tup = cis[i++];
+               if (tup == CISTPL_NULL || tup == CISTPL_END)
+                       tlen = 0;
+               else
+                       tlen = cis[i++];
+
+               if ((i + tlen) >= dump_size*2)
+                       break;
+
+               switch (tup) {
+                       case CISTPL_BRCM_HNBU:
+                               switch (cis[i]) {
+                               case HNBU_CUSTOM1:
+                                       *customvar1 = ((cis[i + 4] << 24) +
+                                               (cis[i + 3] << 16) + (cis[i + 2] << 8) +
+                                               cis[i + 1]);
+                                       DHD_TRACE(("%s : customvar1 [%x]\n",
+                                               __FUNCTION__, *customvar1));
+                                       break;
+                               case HNBU_CUSTOM2:
+                                       *customvar2 = ((cis[i + 4] << 24) +
+                                               (cis[i + 3] << 16) + (cis[i + 2] << 8) +
+                                               cis[i + 1]);
+                                       DHD_TRACE(("%s : customvar2 [%x]\n",
+                                               __FUNCTION__, *customvar2));
+                                       break;
+                               default:
+                                       break;
+                               }
+                               break;
+                       default:
+                               break;
+               }
+
+               i += tlen;
+       } while (tup != 0xff);
+
+       if (otp_dump) {
+               kfree(otp_dump);
+               otp_dump = NULL;
+       }
+
+       /* Switch back to the original core */
+       si_setcore(bus->sih, cur_coreid, 0);
+
+       return BCME_OK;
+} /* dhdpcie_sromotp_customvar */
+
+/** Flow rings are dynamically created and destroyed */
+void dhd_bus_clean_flow_ring(dhd_bus_t *bus, void *node)
+{
+       void *pkt;
+       flow_queue_t *queue;
+       flow_ring_node_t *flow_ring_node = (flow_ring_node_t *)node;
+       unsigned long flags;
+
+       queue = &flow_ring_node->queue;
+
+#ifdef DHDTCPACK_SUPPRESS
+       /* Clean tcp_ack_info_tbl in order to prevent access to flushed pkt,
+        * when there is a newly coming packet from network stack.
+        */
+       dhd_tcpack_info_tbl_clean(bus->dhd);
+#endif /* DHDTCPACK_SUPPRESS */
+
+       /* clean up BUS level info */
+       DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+
+       /* Flush all pending packets in the queue, if any */
+       while ((pkt = dhd_flow_queue_dequeue(bus->dhd, queue)) != NULL) {
+               PKTFREE(bus->dhd->osh, pkt, TRUE);
+       }
+       ASSERT(DHD_FLOW_QUEUE_EMPTY(queue));
+
+       flow_ring_node->status = FLOW_RING_STATUS_CLOSED;
+       flow_ring_node->active = FALSE;
+
+       DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+
+       DHD_FLOWRING_LIST_LOCK(bus->dhd->flowring_list_lock, flags);
+       dll_delete(&flow_ring_node->list);
+       DHD_FLOWRING_LIST_UNLOCK(bus->dhd->flowring_list_lock, flags);
+
+       /* Release the flowring object back into the pool */
+       dhd_prot_flowrings_pool_release(bus->dhd,
+               flow_ring_node->flowid, flow_ring_node->prot_info);
+
+       /* Free the flowid back to the flowid allocator */
+       dhd_flowid_free(bus->dhd, flow_ring_node->flow_info.ifindex,
+               flow_ring_node->flowid);
+}
+
+/**
+ * Allocate a Flow ring buffer,
+ * Init Ring buffer, send Msg to device about flow ring creation
+*/
+int
+dhd_bus_flow_ring_create_request(dhd_bus_t *bus, void *arg)
+{
+       flow_ring_node_t *flow_ring_node = (flow_ring_node_t *)arg;
+
+       DHD_INFO(("%s :Flow create\n", __FUNCTION__));
+
+       /* Send Msg to device about flow ring creation */
+       if (dhd_prot_flow_ring_create(bus->dhd, flow_ring_node) != BCME_OK)
+               return BCME_NOMEM;
+
+       return BCME_OK;
+}
+
+/** Handle response from dongle on a 'flow ring create' request */
+void
+dhd_bus_flow_ring_create_response(dhd_bus_t *bus, uint16 flowid, int32 status)
+{
+       flow_ring_node_t *flow_ring_node;
+       unsigned long flags;
+
+       DHD_INFO(("%s :Flow Response %d \n", __FUNCTION__, flowid));
+
+       flow_ring_node = DHD_FLOW_RING(bus->dhd, flowid);
+       ASSERT(flow_ring_node->flowid == flowid);
+
+       if (status != BCME_OK) {
+               DHD_ERROR(("%s Flow create Response failure error status = %d \n",
+                    __FUNCTION__, status));
+               /* Call Flow clean up */
+               dhd_bus_clean_flow_ring(bus, flow_ring_node);
+               return;
+       }
+
+       DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+       flow_ring_node->status = FLOW_RING_STATUS_OPEN;
+       DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+
+       /* Now add the Flow ring node into the active list
+        * Note that this code to add the newly created node to the active
+        * list was living in dhd_flowid_lookup. But note that after
+        * adding the node to the active list the contents of node is being
+        * filled in dhd_prot_flow_ring_create.
+        * If there is a D2H interrupt after the node gets added to the
+        * active list and before the node gets populated with values
+        * from the Bottom half dhd_update_txflowrings would be called.
+        * which will then try to walk through the active flow ring list,
+        * pickup the nodes and operate on them. Now note that since
+        * the function dhd_prot_flow_ring_create is not finished yet
+        * the contents of flow_ring_node can still be NULL leading to
+        * crashes. Hence the flow_ring_node should be added to the
+        * active list only after its truely created, which is after
+        * receiving the create response message from the Host.
+        */
+
+       DHD_FLOWRING_LIST_LOCK(bus->dhd->flowring_list_lock, flags);
+       dll_prepend(&bus->const_flowring, &flow_ring_node->list);
+       DHD_FLOWRING_LIST_UNLOCK(bus->dhd->flowring_list_lock, flags);
+
+       dhd_bus_schedule_queue(bus, flowid, FALSE); /* from queue to flowring */
+
+       return;
+}
+
+int
+dhd_bus_flow_ring_delete_request(dhd_bus_t *bus, void *arg)
+{
+       void * pkt;
+       flow_queue_t *queue;
+       flow_ring_node_t *flow_ring_node;
+       unsigned long flags;
+
+       DHD_INFO(("%s :Flow Delete\n", __FUNCTION__));
+
+       flow_ring_node = (flow_ring_node_t *)arg;
+
+       DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+       if (flow_ring_node->status == FLOW_RING_STATUS_DELETE_PENDING) {
+               DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+               DHD_ERROR(("%s :Delete Pending Flow %d\n",
+                       __FUNCTION__, flow_ring_node->flowid));
+               return BCME_ERROR;
+       }
+       flow_ring_node->status = FLOW_RING_STATUS_DELETE_PENDING;
+
+       queue = &flow_ring_node->queue; /* queue associated with flow ring */
+
+#ifdef DHDTCPACK_SUPPRESS
+       /* Clean tcp_ack_info_tbl in order to prevent access to flushed pkt,
+        * when there is a newly coming packet from network stack.
+        */
+       dhd_tcpack_info_tbl_clean(bus->dhd);
+#endif /* DHDTCPACK_SUPPRESS */
+       /* Flush all pending packets in the queue, if any */
+       while ((pkt = dhd_flow_queue_dequeue(bus->dhd, queue)) != NULL) {
+               PKTFREE(bus->dhd->osh, pkt, TRUE);
+       }
+       ASSERT(DHD_FLOW_QUEUE_EMPTY(queue));
+
+       DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+
+       /* Send Msg to device about flow ring deletion */
+       dhd_prot_flow_ring_delete(bus->dhd, flow_ring_node);
+
+       return BCME_OK;
+}
+
+void
+dhd_bus_flow_ring_delete_response(dhd_bus_t *bus, uint16 flowid, uint32 status)
+{
+       flow_ring_node_t *flow_ring_node;
+
+       DHD_INFO(("%s :Flow Delete Response %d \n", __FUNCTION__, flowid));
+
+       flow_ring_node = DHD_FLOW_RING(bus->dhd, flowid);
+       ASSERT(flow_ring_node->flowid == flowid);
+
+       if (status != BCME_OK) {
+               DHD_ERROR(("%s Flow Delete Response failure error status = %d \n",
+                   __FUNCTION__, status));
+               return;
+       }
+       /* Call Flow clean up */
+       dhd_bus_clean_flow_ring(bus, flow_ring_node);
+
+       return;
+
+}
+
+/** This function is not called. Obsolete ? */
+int dhd_bus_flow_ring_flush_request(dhd_bus_t *bus, void *arg)
+{
+       void *pkt;
+       flow_queue_t *queue;
+       flow_ring_node_t *flow_ring_node;
+       unsigned long flags;
+
+       DHD_INFO(("%s :Flow Delete\n", __FUNCTION__));
+
+       flow_ring_node = (flow_ring_node_t *)arg;
+       queue = &flow_ring_node->queue; /* queue associated with flow ring */
+
+       DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+
+#ifdef DHDTCPACK_SUPPRESS
+       /* Clean tcp_ack_info_tbl in order to prevent access to flushed pkt,
+        * when there is a newly coming packet from network stack.
+        */
+       dhd_tcpack_info_tbl_clean(bus->dhd);
+#endif /* DHDTCPACK_SUPPRESS */
+
+       /* Flush all pending packets in the queue, if any */
+       while ((pkt = dhd_flow_queue_dequeue(bus->dhd, queue)) != NULL) {
+               PKTFREE(bus->dhd->osh, pkt, TRUE);
+       }
+       ASSERT(DHD_FLOW_QUEUE_EMPTY(queue));
+
+       DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+
+       /* Send Msg to device about flow ring flush */
+       dhd_prot_flow_ring_flush(bus->dhd, flow_ring_node);
+
+       flow_ring_node->status = FLOW_RING_STATUS_FLUSH_PENDING;
+       return BCME_OK;
+}
+
+void
+dhd_bus_flow_ring_flush_response(dhd_bus_t *bus, uint16 flowid, uint32 status)
+{
+       flow_ring_node_t *flow_ring_node;
+
+       if (status != BCME_OK) {
+               DHD_ERROR(("%s Flow flush Response failure error status = %d \n",
+                   __FUNCTION__, status));
+               return;
+       }
+
+       flow_ring_node = DHD_FLOW_RING(bus->dhd, flowid);
+       ASSERT(flow_ring_node->flowid == flowid);
+
+       flow_ring_node->status = FLOW_RING_STATUS_OPEN;
+       return;
+}
+
+uint32
+dhd_bus_max_h2d_queues(struct dhd_bus *bus)
+{
+       return bus->max_sub_queues;
+}
+
+/* To be symmetric with SDIO */
+void
+dhd_bus_pktq_flush(dhd_pub_t *dhdp)
+{
+       return;
+}
+
+void
+dhd_bus_set_linkdown(dhd_pub_t *dhdp, bool val)
+{
+       dhdp->bus->is_linkdown = val;
+}
+
+int
+dhdpcie_bus_clock_start(struct dhd_bus *bus)
+{
+       return dhdpcie_start_host_pcieclock(bus);
+}
+
+int
+dhdpcie_bus_clock_stop(struct dhd_bus *bus)
+{
+       return dhdpcie_stop_host_pcieclock(bus);
+}
+
+int
+dhdpcie_bus_disable_device(struct dhd_bus *bus)
+{
+       return dhdpcie_disable_device(bus);
+}
+
+int
+dhdpcie_bus_enable_device(struct dhd_bus *bus)
+{
+       return dhdpcie_enable_device(bus);
+}
+
+int
+dhdpcie_bus_alloc_resource(struct dhd_bus *bus)
+{
+       return dhdpcie_alloc_resource(bus);
+}
+
+void
+dhdpcie_bus_free_resource(struct dhd_bus *bus)
+{
+       dhdpcie_free_resource(bus);
+}
+
+int
+dhd_bus_request_irq(struct dhd_bus *bus)
+{
+       return dhdpcie_bus_request_irq(bus);
+}
+
+bool
+dhdpcie_bus_dongle_attach(struct dhd_bus *bus)
+{
+       return dhdpcie_dongle_attach(bus);
+}
+
+int
+dhd_bus_release_dongle(struct dhd_bus *bus)
+{
+       bool dongle_isolation;
+       osl_t *osh;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (bus) {
+               osh = bus->osh;
+               ASSERT(osh);
+
+               if (bus->dhd) {
+                       dongle_isolation = bus->dhd->dongle_isolation;
+                       dhdpcie_bus_release_dongle(bus, osh, dongle_isolation, TRUE);
+               }
+       }
+
+       return 0;
+}
+
+#ifdef BCMPCIE_OOB_HOST_WAKE
+int
+dhd_bus_oob_intr_register(dhd_pub_t *dhdp)
+{
+       return dhdpcie_oob_intr_register(dhdp->bus);
+}
+
+void
+dhd_bus_oob_intr_unregister(dhd_pub_t *dhdp)
+{
+       dhdpcie_oob_intr_unregister(dhdp->bus);
+}
+
+void
+dhd_bus_oob_intr_set(dhd_pub_t *dhdp, bool enable)
+{
+       dhdpcie_oob_intr_set(dhdp->bus, enable);
+}
+#endif /* BCMPCIE_OOB_HOST_WAKE */
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_pcie.h b/drivers/net/wireless/bcmdhd_1363/dhd_pcie.h
new file mode 100644 (file)
index 0000000..3072ca2
--- /dev/null
@@ -0,0 +1,315 @@
+/*
+ * Linux DHD Bus Module for PCIE
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_pcie.h 607608 2015-12-21 13:14:19Z $
+ */
+
+
+#ifndef dhd_pcie_h
+#define dhd_pcie_h
+
+#include <bcmpcie.h>
+#include <hnd_cons.h>
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#ifdef CONFIG_ARCH_MSM
+#ifdef CONFIG_PCI_MSM
+#include <linux/msm_pcie.h>
+#else
+#include <mach/msm_pcie.h>
+#endif /* CONFIG_PCI_MSM */
+#endif /* CONFIG_ARCH_MSM */
+#ifdef EXYNOS_PCIE_LINKDOWN_RECOVERY
+#ifdef CONFIG_SOC_EXYNOS8890
+#include <linux/exynos-pci-noti.h>
+extern int exynos_pcie_register_event(struct exynos_pcie_register_event *reg);
+extern int exynos_pcie_deregister_event(struct exynos_pcie_register_event *reg);
+#endif /* CONFIG_SOC_EXYNOS8890 */
+#endif /* EXYNOS_PCIE_LINKDOWN_RECOVERY */
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+
+#ifdef DHD_PCIE_RUNTIMEPM
+#include <linux/mutex.h>
+#include <linux/wait.h>
+
+#define DEFAULT_DHD_RUNTIME_MS 100
+#ifndef CUSTOM_DHD_RUNTIME_MS
+#define CUSTOM_DHD_RUNTIME_MS DEFAULT_DHD_RUNTIME_MS
+#endif /* CUSTOM_DHD_RUNTIME_MS */
+
+
+#ifndef MAX_IDLE_COUNT
+#define MAX_IDLE_COUNT 16
+#endif /* MAX_IDLE_COUNT */
+
+#ifndef MAX_RESUME_WAIT
+#define MAX_RESUME_WAIT 100
+#endif /* MAX_RESUME_WAIT */
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+/* defines */
+
+#define PCMSGBUF_HDRLEN 0
+#define DONGLE_REG_MAP_SIZE (32 * 1024)
+#define DONGLE_TCM_MAP_SIZE (4096 * 1024)
+#define DONGLE_MIN_MEMSIZE (128 *1024)
+#ifdef DHD_DEBUG
+#define DHD_PCIE_SUCCESS 0
+#define DHD_PCIE_FAILURE 1
+#endif /* DHD_DEBUG */
+#define        REMAP_ENAB(bus)                 ((bus)->remap)
+#define        REMAP_ISADDR(bus, a)            (((a) >= ((bus)->orig_ramsize)) && ((a) < ((bus)->ramsize)))
+
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#ifdef CONFIG_ARCH_MSM
+#define struct_pcie_notify             struct msm_pcie_notify
+#define struct_pcie_register_event     struct msm_pcie_register_event
+#endif /* CONFIG_ARCH_MSM */
+#ifdef EXYNOS_PCIE_LINKDOWN_RECOVERY
+#ifdef CONFIG_SOC_EXYNOS8890
+#define struct_pcie_notify             struct exynos_pcie_notify
+#define struct_pcie_register_event     struct exynos_pcie_register_event
+#endif /* CONFIG_SOC_EXYNOS8890 */
+#endif /* EXYNOS_PCIE_LINKDOWN_RECOVERY */
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+
+/*
+ * Router with 4366 can have 128 stations and 16 BSS,
+ * hence (128 stations x 4 access categories for ucast) + 16 bc/mc flowrings
+ */
+#define MAX_DHD_TX_FLOWS       320
+
+/* user defined data structures */
+/* Device console log buffer state */
+#define CONSOLE_LINE_MAX       192
+#define CONSOLE_BUFFER_MAX     (8 * 1024)
+
+#ifndef MAX_CNTL_D3ACK_TIMEOUT
+#define MAX_CNTL_D3ACK_TIMEOUT 2
+#endif /* MAX_CNTL_D3ACK_TIMEOUT */
+
+#ifdef DHD_DEBUG
+
+typedef struct dhd_console {
+        uint           count;  /* Poll interval msec counter */
+        uint           log_addr;                /* Log struct address (fixed) */
+        hnd_log_t       log;                    /* Log struct (host copy) */
+        uint            bufsize;                /* Size of log buffer */
+        uint8           *buf;                   /* Log buffer (host copy) */
+        uint            last;                   /* Last buffer read index */
+} dhd_console_t;
+#endif /* DHD_DEBUG */
+typedef struct ring_sh_info {
+       uint32 ring_mem_addr;
+       uint32 ring_state_w;
+       uint32 ring_state_r;
+} ring_sh_info_t;
+
+typedef struct dhd_bus {
+       dhd_pub_t       *dhd;
+       struct pci_dev  *dev;           /* pci device handle */
+       dll_t       const_flowring; /* constructed list of tx flowring queues */
+
+       si_t            *sih;                   /* Handle for SI calls */
+       char            *vars;                  /* Variables (from CIS and/or other) */
+       uint            varsz;                  /* Size of variables buffer */
+       uint32          sbaddr;                 /* Current SB window pointer (-1, invalid) */
+       sbpcieregs_t    *reg;                   /* Registers for PCIE core */
+
+       uint            armrev;                 /* CPU core revision */
+       uint            ramrev;                 /* SOCRAM core revision */
+       uint32          ramsize;                /* Size of RAM in SOCRAM (bytes) */
+       uint32          orig_ramsize;           /* Size of RAM in SOCRAM (bytes) */
+       uint32          srmemsize;              /* Size of SRMEM */
+
+       uint32          bus;                    /* gSPI or SDIO bus */
+       uint32          intstatus;              /* Intstatus bits (events) pending */
+       bool            dpc_sched;              /* Indicates DPC schedule (intrpt rcvd) */
+       bool            fcstate;                /* State of dongle flow-control */
+
+       uint16          cl_devid;               /* cached devid for dhdsdio_probe_attach() */
+       char            *fw_path;               /* module_param: path to firmware image */
+       char            *nv_path;               /* module_param: path to nvram vars file */
+#ifdef CACHE_FW_IMAGES
+       int                     processed_nvram_params_len;     /* Modified len of NVRAM info */
+#endif
+
+
+       struct pktq     txq;                    /* Queue length used for flow-control */
+
+       bool            intr;                   /* Use interrupts */
+       bool            ipend;                  /* Device interrupt is pending */
+       bool            intdis;                 /* Interrupts disabled by isr */
+       uint            intrcount;              /* Count of device interrupt callbacks */
+       uint            lastintrs;              /* Count as of last watchdog timer */
+
+#ifdef DHD_DEBUG
+       dhd_console_t   console;                /* Console output polling support */
+       uint            console_addr;           /* Console address from shared struct */
+#endif /* DHD_DEBUG */
+
+       bool            alp_only;               /* Don't use HT clock (ALP only) */
+
+       bool            remap;          /* Contiguous 1MB RAM: 512K socram + 512K devram
+                                        * Available with socram rev 16
+                                        * Remap region not DMA-able
+                                        */
+       uint32          resetinstr;
+       uint32          dongle_ram_base;
+
+       ulong           shared_addr;
+       pciedev_shared_t        *pcie_sh;
+       bool bus_flowctrl;
+       uint32          dma_rxoffset;
+       volatile char   *regs;          /* pci device memory va */
+       volatile char   *tcm;           /* pci device memory va */
+       osl_t           *osh;
+       uint32          nvram_csm;      /* Nvram checksum */
+       uint16          pollrate;
+       uint16  polltick;
+
+       uint32  *pcie_mb_intr_addr;
+       void    *pcie_mb_intr_osh;
+       bool    sleep_allowed;
+
+       /* version 3 shared struct related info start */
+       ring_sh_info_t  ring_sh[BCMPCIE_COMMON_MSGRINGS + MAX_DHD_TX_FLOWS];
+       uint8   h2d_ring_count;
+       uint8   d2h_ring_count;
+       uint32  ringmem_ptr;
+       uint32  ring_state_ptr;
+
+       uint32 d2h_dma_scratch_buffer_mem_addr;
+
+       uint32 h2d_mb_data_ptr_addr;
+       uint32 d2h_mb_data_ptr_addr;
+       /* version 3 shared struct related info end */
+
+       uint32 def_intmask;
+       bool    ltrsleep_on_unload;
+       uint    wait_for_d3_ack;
+       uint32 max_sub_queues;
+       uint32  rw_index_sz;
+       bool    db1_for_mb;
+       bool    suspended;
+
+       dhd_timeout_t doorbell_timer;
+       bool    device_wake_state;
+       bool    irq_registered;
+#ifdef PCIE_OOB
+       bool    oob_enabled;
+#endif /* PCIE_OOB */
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#if defined(CONFIG_ARCH_MSM) || (defined(EXYNOS_PCIE_LINKDOWN_RECOVERY) && \
+       defined(CONFIG_SOC_EXYNOS8890))
+#ifdef CONFIG_ARCH_MSM
+       uint8 no_cfg_restore;
+#endif /* CONFIG_ARCH_MSM */
+       struct_pcie_register_event pcie_event;
+#endif /* CONFIG_ARCH_MSM || (EXYNOS_PCIE_LINKDOWN_RECOVERY && CONFIG_SOC_EXYNOS8890) */
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+#ifdef DHD_PCIE_RUNTIMEPM
+       int32 idlecount;                /* Activity timeout counter */
+       int32 idletime;                 /* Control for activity timeout */
+       int32 bus_wake;                 /* For wake up the bus */
+       bool runtime_resume_done;       /* For check runtime suspend end */
+       struct mutex pm_lock;            /* Synchronize for system PM & runtime PM */
+       wait_queue_head_t rpm_queue;    /* wait-queue for bus wake up */
+#endif /* DHD_PCIE_RUNTIMEPM */
+       uint32 d3_inform_cnt;
+       uint32 d0_inform_cnt;
+       uint32 d0_inform_in_use_cnt;
+       uint8 force_suspend;
+       uint32 d3_ack_war_cnt;
+       uint8 is_linkdown;
+       uint32 pci_d3hot_done;
+} dhd_bus_t;
+
+/* function declarations */
+
+extern uint32* dhdpcie_bus_reg_map(osl_t *osh, ulong addr, int size);
+extern int dhdpcie_bus_register(void);
+extern void dhdpcie_bus_unregister(void);
+extern bool dhdpcie_chipmatch(uint16 vendor, uint16 device);
+
+extern struct dhd_bus* dhdpcie_bus_attach(osl_t *osh,
+       volatile char *regs, volatile char *tcm, void *pci_dev);
+extern uint32 dhdpcie_bus_cfg_read_dword(struct dhd_bus *bus, uint32 addr, uint32 size);
+extern void dhdpcie_bus_cfg_write_dword(struct dhd_bus *bus, uint32 addr, uint32 size, uint32 data);
+extern void dhdpcie_bus_intr_enable(struct dhd_bus *bus);
+extern void dhdpcie_bus_intr_disable(struct dhd_bus *bus);
+extern void dhdpcie_bus_release(struct dhd_bus *bus);
+extern int32 dhdpcie_bus_isr(struct dhd_bus *bus);
+extern void dhdpcie_free_irq(dhd_bus_t *bus);
+extern void dhdpcie_bus_ringbell_fast(struct dhd_bus *bus, uint32 value);
+extern int dhdpcie_bus_suspend(struct  dhd_bus *bus, bool state);
+extern int dhdpcie_pci_suspend_resume(struct  dhd_bus *bus, bool state);
+extern bool dhdpcie_tcm_valid(dhd_bus_t *bus);
+extern void dhdpcie_bus_dongle_print_hwregs(struct dhd_bus *bus);
+#ifndef BCMPCIE_OOB_HOST_WAKE
+extern void dhdpcie_pme_active(osl_t *osh, bool enable);
+#endif /* !BCMPCIE_OOB_HOST_WAKE */
+extern bool dhdpcie_pme_cap(osl_t *osh);
+extern int dhdpcie_start_host_pcieclock(dhd_bus_t *bus);
+extern int dhdpcie_stop_host_pcieclock(dhd_bus_t *bus);
+extern int dhdpcie_disable_device(dhd_bus_t *bus);
+extern int dhdpcie_enable_device(dhd_bus_t *bus);
+extern int dhdpcie_alloc_resource(dhd_bus_t *bus);
+extern void dhdpcie_free_resource(dhd_bus_t *bus);
+extern int dhdpcie_bus_request_irq(struct dhd_bus *bus);
+#ifdef BCMPCIE_OOB_HOST_WAKE
+extern int dhdpcie_oob_intr_register(dhd_bus_t *bus);
+extern void dhdpcie_oob_intr_unregister(dhd_bus_t *bus);
+extern void dhdpcie_oob_intr_set(dhd_bus_t *bus, bool enable);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+#ifdef PCIE_OOB
+extern void dhd_oob_set_bt_reg_on(struct dhd_bus *bus, bool val);
+extern int dhd_oob_get_bt_reg_on(struct dhd_bus *bus);
+#endif /* PCIE_OOB */
+
+#ifdef USE_EXYNOS_PCIE_RC_PMPATCH
+#if defined(CONFIG_MACH_UNIVERSAL5433)
+#define SAMSUNG_PCIE_DEVICE_ID 0xa5e3
+#define SAMSUNG_PCIE_CH_NUM
+#elif defined(CONFIG_MACH_UNIVERSAL7420)
+#define SAMSUNG_PCIE_DEVICE_ID 0xa575
+#define SAMSUNG_PCIE_CH_NUM 1
+#elif defined(CONFIG_SOC_EXYNOS8890)
+#define SAMSUNG_PCIE_DEVICE_ID 0xa544
+#define SAMSUNG_PCIE_CH_NUM 0
+#else
+#error "Not supported platform"
+#endif
+#ifdef CONFIG_MACH_UNIVERSAL5433
+extern int exynos_pcie_pm_suspend(void);
+extern int exynos_pcie_pm_resume(void);
+#else
+extern int exynos_pcie_pm_suspend(int ch_num);
+extern int exynos_pcie_pm_resume(int ch_num);
+#endif /* CONFIG_MACH_UNIVERSAL5433 */
+#endif /* USE_EXYNOS_PCIE_RC_PMPATCH */
+
+extern int dhd_buzzz_dump_dngl(dhd_bus_t *bus);
+#endif /* dhd_pcie_h */
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_pcie_linux.c b/drivers/net/wireless/bcmdhd_1363/dhd_pcie_linux.c
new file mode 100644 (file)
index 0000000..aa363b9
--- /dev/null
@@ -0,0 +1,1583 @@
+/*
+ * Linux DHD Bus Module for PCIE
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_pcie_linux.c 650724 2016-07-22 08:41:52Z $
+ */
+
+
+/* include files */
+#include <typedefs.h>
+#include <bcmutils.h>
+#include <bcmdevs.h>
+#include <siutils.h>
+#include <hndsoc.h>
+#include <hndpmu.h>
+#include <sbchipc.h>
+#if defined(DHD_DEBUG)
+#include <hnd_armtrap.h>
+#include <hnd_cons.h>
+#endif /* defined(DHD_DEBUG) */
+#include <dngl_stats.h>
+#include <pcie_core.h>
+#include <dhd.h>
+#include <dhd_bus.h>
+#include <dhd_proto.h>
+#include <dhd_dbg.h>
+#include <dhdioctl.h>
+#include <bcmmsgbuf.h>
+#include <pcicfg.h>
+#include <dhd_pcie.h>
+#include <dhd_linux.h>
+#ifdef CONFIG_ARCH_MSM
+#ifdef CONFIG_PCI_MSM
+#include <linux/msm_pcie.h>
+#else
+#include <mach/msm_pcie.h>
+#endif /* CONFIG_PCI_MSM */
+#endif /* CONFIG_ARCH_MSM */
+
+#define PCI_CFG_RETRY          10
+#define OS_HANDLE_MAGIC                0x1234abcd      /* Magic # to recognize osh */
+#define BCM_MEM_FILENAME_LEN   24              /* Mem. filename length */
+
+#define OSL_PKTTAG_CLEAR(p) \
+do { \
+       struct sk_buff *s = (struct sk_buff *)(p); \
+       ASSERT(OSL_PKTTAG_SZ == 32); \
+       *(uint32 *)(&s->cb[0]) = 0; *(uint32 *)(&s->cb[4]) = 0; \
+       *(uint32 *)(&s->cb[8]) = 0; *(uint32 *)(&s->cb[12]) = 0; \
+       *(uint32 *)(&s->cb[16]) = 0; *(uint32 *)(&s->cb[20]) = 0; \
+       *(uint32 *)(&s->cb[24]) = 0; *(uint32 *)(&s->cb[28]) = 0; \
+} while (0)
+
+
+/* user defined data structures  */
+
+typedef struct dhd_pc_res {
+       uint32 bar0_size;
+       void* bar0_addr;
+       uint32 bar1_size;
+       void* bar1_addr;
+} pci_config_res, *pPci_config_res;
+
+typedef bool (*dhdpcie_cb_fn_t)(void *);
+
+typedef struct dhdpcie_info
+{
+       dhd_bus_t       *bus;
+       osl_t                   *osh;
+       struct pci_dev  *dev;           /* pci device handle */
+       volatile char   *regs;          /* pci device memory va */
+       volatile char   *tcm;           /* pci device memory va */
+       uint32                  tcm_size;       /* pci device memory size */
+       struct pcos_info *pcos_info;
+       uint16          last_intrstatus;        /* to cache intrstatus */
+       int     irq;
+       char pciname[32];
+       struct pci_saved_state* default_state;
+       struct pci_saved_state* state;
+#ifdef BCMPCIE_OOB_HOST_WAKE
+       void *os_cxt;                   /* Pointer to per-OS private data */
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+} dhdpcie_info_t;
+
+
+struct pcos_info {
+       dhdpcie_info_t *pc;
+       spinlock_t lock;
+       wait_queue_head_t intr_wait_queue;
+       struct timer_list tuning_timer;
+       int tuning_timer_exp;
+       atomic_t timer_enab;
+       struct tasklet_struct tuning_tasklet;
+};
+
+#ifdef BCMPCIE_OOB_HOST_WAKE
+typedef struct dhdpcie_os_info {
+       int                     oob_irq_num;    /* valid when hardware or software oob in use */
+       unsigned long           oob_irq_flags;  /* valid when hardware or software oob in use */
+       bool                    oob_irq_registered;
+       bool                    oob_irq_enabled;
+       bool                    oob_irq_wake_enabled;
+       spinlock_t              oob_irq_spinlock;
+       void                    *dev;           /* handle to the underlying device */
+} dhdpcie_os_info_t;
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+
+/* function declarations */
+static int __devinit
+dhdpcie_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent);
+static void __devexit
+dhdpcie_pci_remove(struct pci_dev *pdev);
+static int dhdpcie_init(struct pci_dev *pdev);
+static irqreturn_t dhdpcie_isr(int irq, void *arg);
+/* OS Routine functions for PCI suspend/resume */
+
+static int dhdpcie_set_suspend_resume(struct pci_dev *dev, bool state);
+static int dhdpcie_resume_host_dev(dhd_bus_t *bus);
+static int dhdpcie_suspend_host_dev(dhd_bus_t *bus);
+static int dhdpcie_resume_dev(struct pci_dev *dev);
+static int dhdpcie_suspend_dev(struct pci_dev *dev);
+#ifdef DHD_PCIE_RUNTIMEPM
+static int dhdpcie_pm_suspend(struct device *dev);
+static int dhdpcie_pm_prepare(struct device *dev);
+static int dhdpcie_pm_resume(struct device *dev);
+static void dhdpcie_pm_complete(struct device *dev);
+#else
+static int dhdpcie_pci_suspend(struct pci_dev *dev, pm_message_t state);
+static int dhdpcie_pci_resume(struct pci_dev *dev);
+#endif /* DHD_PCIE_RUNTIMEPM */
+static struct pci_device_id dhdpcie_pci_devid[] __devinitdata = {
+       { vendor: 0x14e4,
+       device: PCI_ANY_ID,
+       subvendor: PCI_ANY_ID,
+       subdevice: PCI_ANY_ID,
+       class: PCI_CLASS_NETWORK_OTHER << 8,
+       class_mask: 0xffff00,
+       driver_data: 0,
+       },
+       { 0, }
+};
+MODULE_DEVICE_TABLE(pci, dhdpcie_pci_devid);
+
+/* Power Management Hooks */
+#ifdef DHD_PCIE_RUNTIMEPM
+static const struct dev_pm_ops dhd_pcie_pm_ops = {
+       .prepare = dhdpcie_pm_prepare,
+       .suspend = dhdpcie_pm_suspend,
+       .resume = dhdpcie_pm_resume,
+       .complete = dhdpcie_pm_complete,
+};
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+static struct pci_driver dhdpcie_driver = {
+       node:           {},
+#ifndef BCMDHDX
+       name:           "pcieh",
+#else
+       name:           "pciehx",
+#endif /* BCMDHDX */
+       id_table:       dhdpcie_pci_devid,
+       probe:          dhdpcie_pci_probe,
+       remove:         dhdpcie_pci_remove,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+       save_state:     NULL,
+#endif
+#ifdef DHD_PCIE_RUNTIMEPM
+       .driver.pm = &dhd_pcie_pm_ops,
+#else
+       suspend:        dhdpcie_pci_suspend,
+       resume:         dhdpcie_pci_resume,
+#endif /* DHD_PCIE_RUNTIMEPM */
+};
+
+int dhdpcie_init_succeeded = FALSE;
+
+#ifdef DHD_PCIE_RUNTIMEPM
+static int dhdpcie_pm_suspend(struct device *dev)
+{
+       struct pci_dev *pdev = to_pci_dev(dev);
+       return dhdpcie_set_suspend_resume(pdev, TRUE);
+}
+
+static int dhdpcie_pm_prepare(struct device *dev)
+{
+       struct pci_dev *pdev = to_pci_dev(dev);
+       dhdpcie_info_t *pch = pci_get_drvdata(pdev);
+       dhd_bus_t *bus = NULL;
+
+       if (pch) {
+               bus = pch->bus;
+               DHD_DISABLE_RUNTIME_PM(bus->dhd);
+       }
+
+       return 0;
+}
+
+static int dhdpcie_pm_resume(struct device *dev)
+{
+       struct pci_dev *pdev = to_pci_dev(dev);
+       return dhdpcie_set_suspend_resume(pdev, FALSE);
+}
+
+static void dhdpcie_pm_complete(struct device *dev)
+{
+       struct pci_dev *pdev = to_pci_dev(dev);
+       dhdpcie_info_t *pch = pci_get_drvdata(pdev);
+       dhd_bus_t *bus = NULL;
+
+       if (pch) {
+               bus = pch->bus;
+               DHD_ENABLE_RUNTIME_PM(bus->dhd);
+       }
+
+       return;
+}
+#else
+static int dhdpcie_pci_suspend(struct pci_dev * pdev, pm_message_t state)
+{
+       BCM_REFERENCE(state);
+       return dhdpcie_set_suspend_resume(pdev, TRUE);
+}
+
+static int dhdpcie_pci_resume(struct pci_dev *pdev)
+{
+       return dhdpcie_set_suspend_resume(pdev, FALSE);
+}
+
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+static int dhdpcie_set_suspend_resume(struct pci_dev *pdev, bool state)
+{
+       int ret = 0;
+       dhdpcie_info_t *pch = pci_get_drvdata(pdev);
+       dhd_bus_t *bus = NULL;
+
+       if (pch) {
+               bus = pch->bus;
+       }
+
+#ifdef DHD_PCIE_RUNTIMEPM
+       if (bus && !bus->dhd->dongle_reset) {
+               /* if wakelock is held during suspend, return failed */
+               if (state == TRUE && dhd_os_check_wakelock_all(bus->dhd)) {
+                       return -EBUSY;
+               }
+
+               mutex_lock(&bus->pm_lock);
+       }
+#endif /* DHD_PCIE_RUNTIMEPM */
+
+       /* When firmware is not loaded do the PCI bus */
+       /* suspend/resume only */
+       if (bus && (bus->dhd->busstate == DHD_BUS_DOWN) &&
+               !bus->dhd->dongle_reset) {
+               ret = dhdpcie_pci_suspend_resume(bus, state);
+#ifdef DHD_PCIE_RUNTIMEPM
+               mutex_unlock(&bus->pm_lock);
+#endif /* DHD_PCIE_RUNTIMEPM */
+               return ret;
+       }
+
+       if (bus && ((bus->dhd->busstate == DHD_BUS_SUSPEND)||
+               (bus->dhd->busstate == DHD_BUS_DATA)) &&
+               (bus->suspended != state)) {
+               ret = dhdpcie_bus_suspend(bus, state);
+       }
+
+#ifdef DHD_PCIE_RUNTIMEPM
+       if (bus && !bus->dhd->dongle_reset) {
+               mutex_unlock(&bus->pm_lock);
+       }
+#endif /* DHD_PCIE_RUNTIMEPM */
+       return ret;
+}
+
+extern void dhd_dpc_tasklet_kill(dhd_pub_t *dhdp);
+
+static int dhdpcie_suspend_dev(struct pci_dev *dev)
+{
+       int ret;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0))
+       dhdpcie_info_t *pch = pci_get_drvdata(dev);
+       dhd_bus_t *bus = pch->bus;
+
+       if (bus->is_linkdown) {
+               DHD_ERROR(("%s: PCIe link is down\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+#endif /* OEM_ANDROID && LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0) */
+       DHD_TRACE_HW4(("%s: Enter\n", __FUNCTION__));
+       disable_irq(dev->irq);
+       dhd_dpc_tasklet_kill(bus->dhd);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0))
+       bus->pci_d3hot_done = 1;
+#endif /* OEM_ANDROID && LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0) */
+       pci_save_state(dev);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0))
+       pch->state = pci_store_saved_state(dev);
+#endif /* OEM_ANDROID && LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0) */
+       pci_enable_wake(dev, PCI_D0, TRUE);
+       if (pci_is_enabled(dev)) {
+               pci_disable_device(dev);
+       }
+       ret = pci_set_power_state(dev, PCI_D3hot);
+       if (ret) {
+               DHD_ERROR(("%s: pci_set_power_state error %d\n",
+                       __FUNCTION__, ret));
+       }
+       return ret;
+}
+
+static int dhdpcie_resume_dev(struct pci_dev *dev)
+{
+       int err = 0;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0))
+       dhdpcie_info_t *pch = pci_get_drvdata(dev);
+       dhd_bus_t *bus = pch->bus;
+       pci_load_and_free_saved_state(dev, &pch->state);
+#endif /* OEM_ANDROID && LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0) */
+       DHD_TRACE_HW4(("%s: Enter\n", __FUNCTION__));
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0))
+       bus->pci_d3hot_done = 0;
+#endif /* OEM_ANDROID && LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0) */
+       pci_restore_state(dev);
+       err = pci_enable_device(dev);
+       if (err) {
+               printf("%s:pci_enable_device error %d \n", __FUNCTION__, err);
+               goto out;
+       }
+       pci_set_master(dev);
+       err = pci_set_power_state(dev, PCI_D0);
+       if (err) {
+               printf("%s:pci_set_power_state error %d \n", __FUNCTION__, err);
+               goto out;
+       }
+
+out:
+       enable_irq(dev->irq);
+       return err;
+}
+
+static int dhdpcie_resume_host_dev(dhd_bus_t *bus)
+{
+       int bcmerror = 0;
+#ifdef USE_EXYNOS_PCIE_RC_PMPATCH
+       bcmerror = exynos_pcie_pm_resume(SAMSUNG_PCIE_CH_NUM);
+#endif /* USE_EXYNOS_PCIE_RC_PMPATCH */
+#ifdef CONFIG_ARCH_MSM
+       bcmerror = dhdpcie_start_host_pcieclock(bus);
+#endif /* CONFIG_ARCH_MSM */
+       if (bcmerror < 0) {
+               DHD_ERROR(("%s: PCIe RC resume failed!!! (%d)\n",
+                       __FUNCTION__, bcmerror));
+               bus->is_linkdown = 1;
+#ifdef CONFIG_ARCH_MSM
+               bus->no_cfg_restore = 1;
+#endif /* CONFIG_ARCH_MSM */
+       }
+
+       return bcmerror;
+}
+
+static int dhdpcie_suspend_host_dev(dhd_bus_t *bus)
+{
+       int bcmerror = 0;
+#ifdef USE_EXYNOS_PCIE_RC_PMPATCH
+       struct pci_dev *rc_pci_dev;
+       rc_pci_dev = pci_get_device(0x144d, SAMSUNG_PCIE_DEVICE_ID, NULL);
+       if (rc_pci_dev) {
+               pci_save_state(rc_pci_dev);
+       }
+       exynos_pcie_pm_suspend(SAMSUNG_PCIE_CH_NUM);
+#endif /* USE_EXYNOS_PCIE_RC_PMPATCH */
+#ifdef CONFIG_ARCH_MSM
+       bcmerror = dhdpcie_stop_host_pcieclock(bus);
+#endif /* CONFIG_ARCH_MSM */
+       return bcmerror;
+}
+
+int dhdpcie_pci_suspend_resume(dhd_bus_t *bus, bool state)
+{
+       int rc;
+
+       struct pci_dev *dev = bus->dev;
+
+       if (state) {
+               if (bus->is_linkdown) {
+                       DHD_ERROR(("%s: PCIe link was down\n", __FUNCTION__));
+                       return BCME_ERROR;
+               }
+#ifndef BCMPCIE_OOB_HOST_WAKE
+               dhdpcie_pme_active(bus->osh, state);
+#endif /* !BCMPCIE_OOB_HOST_WAKE */
+               rc = dhdpcie_suspend_dev(dev);
+               if (!rc) {
+                       dhdpcie_suspend_host_dev(bus);
+               }
+       } else {
+               dhdpcie_resume_host_dev(bus);
+               rc = dhdpcie_resume_dev(dev);
+#ifndef        BCMPCIE_OOB_HOST_WAKE
+               dhdpcie_pme_active(bus->osh, state);
+#endif /* !BCMPCIE_OOB_HOST_WAKE */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+               if (bus->is_linkdown) {
+                       bus->dhd->hang_reason = HANG_REASON_PCIE_RC_LINK_UP_FAIL;
+                       dhd_os_send_hang_message(bus->dhd);
+               }
+#endif 
+       }
+       return rc;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+static int dhdpcie_device_scan(struct device *dev, void *data)
+{
+       struct pci_dev *pcidev;
+       int *cnt = data;
+
+       pcidev = container_of(dev, struct pci_dev, dev);
+       if (pcidev->vendor != 0x14e4)
+               return 0;
+
+       DHD_INFO(("Found Broadcom PCI device 0x%04x\n", pcidev->device));
+       *cnt += 1;
+       if (pcidev->driver && strcmp(pcidev->driver->name, dhdpcie_driver.name))
+               DHD_ERROR(("Broadcom PCI Device 0x%04x has allocated with driver %s\n",
+                       pcidev->device, pcidev->driver->name));
+
+       return 0;
+}
+#endif /* LINUX_VERSION >= 2.6.0 */
+
+int
+dhdpcie_bus_register(void)
+{
+       int error = 0;
+
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+       if (!(error = pci_module_init(&dhdpcie_driver)))
+               return 0;
+
+       DHD_ERROR(("%s: pci_module_init failed 0x%x\n", __FUNCTION__, error));
+#else
+       if (!(error = pci_register_driver(&dhdpcie_driver))) {
+               bus_for_each_dev(dhdpcie_driver.driver.bus, NULL, &error, dhdpcie_device_scan);
+               if (!error) {
+                       DHD_ERROR(("No Broadcom PCI device enumerated!\n"));
+               } else if (!dhdpcie_init_succeeded) {
+                       DHD_ERROR(("%s: dhdpcie initialize failed.\n", __FUNCTION__));
+               } else {
+                       return 0;
+               }
+
+               pci_unregister_driver(&dhdpcie_driver);
+               error = BCME_ERROR;
+       }
+#endif /* LINUX_VERSION < 2.6.0 */
+
+       return error;
+}
+
+
+void
+dhdpcie_bus_unregister(void)
+{
+       pci_unregister_driver(&dhdpcie_driver);
+}
+
+int __devinit
+dhdpcie_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+{
+#ifndef MULTI_CHIP_SUPPORT
+       /* Don't enumerate more than one device */
+       if (dhdpcie_init_succeeded) {
+               DHD_TRACE(("%s: PCIe Enumeration is already done.\n",
+               __func__));
+               return -ENODEV;
+       }
+#endif /* MULTI_CHIP_SUPPORT */
+
+       if (dhdpcie_chipmatch (pdev->vendor, pdev->device)) {
+               DHD_ERROR(("%s: chipmatch failed!!\n", __FUNCTION__));
+                       return -ENODEV;
+       }
+       printf("PCI_PROBE:  bus %X, slot %X,vendor %X, device %X"
+               "(good PCI location)\n", pdev->bus->number,
+               PCI_SLOT(pdev->devfn), pdev->vendor, pdev->device);
+
+       if (dhdpcie_init (pdev)) {
+               DHD_ERROR(("%s: PCIe Enumeration failed\n", __FUNCTION__));
+               return -ENODEV;
+       }
+
+#ifdef BCMPCIE_DISABLE_ASYNC_SUSPEND
+       /* disable async suspend */
+       device_disable_async_suspend(&pdev->dev);
+#endif /* BCMPCIE_DISABLE_ASYNC_SUSPEND */
+
+       DHD_TRACE(("%s: PCIe Enumeration done!!\n", __FUNCTION__));
+       return 0;
+}
+
+int
+dhdpcie_detach(dhdpcie_info_t *pch)
+{
+       if (pch) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0))
+               if (!dhd_download_fw_on_driverload) {
+                       pci_load_and_free_saved_state(pch->dev, &pch->default_state);
+               }
+#endif /* OEM_ANDROID && LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0) */
+               MFREE(pch->osh, pch, sizeof(dhdpcie_info_t));
+       }
+       return 0;
+}
+
+
+void __devexit
+dhdpcie_pci_remove(struct pci_dev *pdev)
+{
+       osl_t *osh = NULL;
+       dhdpcie_info_t *pch = NULL;
+       dhd_bus_t *bus = NULL;
+
+       DHD_TRACE(("%s Enter\n", __FUNCTION__));
+       pch = pci_get_drvdata(pdev);
+       bus = pch->bus;
+       osh = pch->osh;
+
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+       if (bus) {
+#ifdef CONFIG_ARCH_MSM
+               msm_pcie_deregister_event(&bus->pcie_event);
+#endif /* CONFIG_ARCH_MSM */
+#ifdef EXYNOS_PCIE_LINKDOWN_RECOVERY
+#ifdef CONFIG_SOC_EXYNOS8890
+               exynos_pcie_deregister_event(&bus->pcie_event);
+#endif /* CONFIG_SOC_EXYNOS8890 */
+#endif /* EXYNOS_PCIE_LINKDOWN_RECOVERY */
+       }
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+       dhdpcie_bus_release(bus);
+       pci_disable_device(pdev);
+#ifdef BCMPCIE_OOB_HOST_WAKE
+       /* pcie os info detach */
+       MFREE(osh, pch->os_cxt, sizeof(dhdpcie_os_info_t));
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+       /* pcie info detach */
+       dhdpcie_detach(pch);
+       /* osl detach */
+       osl_detach(osh);
+
+       dhdpcie_init_succeeded = FALSE;
+
+       DHD_TRACE(("%s Exit\n", __FUNCTION__));
+
+       return;
+}
+
+/* Free Linux irq */
+int
+dhdpcie_request_irq(dhdpcie_info_t *dhdpcie_info)
+{
+       dhd_bus_t *bus = dhdpcie_info->bus;
+       struct pci_dev *pdev = dhdpcie_info->bus->dev;
+
+       if (!bus->irq_registered) {
+               snprintf(dhdpcie_info->pciname, sizeof(dhdpcie_info->pciname),
+                   "dhdpcie:%s", pci_name(pdev));
+#ifndef PCIE_INTX_SUPPORT
+               pci_enable_msi(pdev);
+#endif /* !PCIE_INTX_SUPPORT */
+               if (request_irq(pdev->irq, dhdpcie_isr, IRQF_SHARED,
+                       dhdpcie_info->pciname, bus) < 0) {
+                       DHD_ERROR(("%s: request_irq() failed\n", __FUNCTION__));
+                       return -1;
+               } else {
+                       bus->irq_registered = TRUE;
+               }
+       } else {
+               DHD_ERROR(("%s: PCI IRQ is already registered\n", __FUNCTION__));
+       }
+
+       DHD_TRACE(("%s %s\n", __FUNCTION__, dhdpcie_info->pciname));
+
+
+       return 0; /* SUCCESS */
+}
+
+#ifdef CONFIG_PHYS_ADDR_T_64BIT
+#define PRINTF_RESOURCE        "0x%016llx"
+#else
+#define PRINTF_RESOURCE        "0x%08x"
+#endif
+
+/*
+
+Name:  osl_pci_get_resource
+
+Parametrs:
+
+1: struct pci_dev *pdev   -- pci device structure
+2: pci_res                       -- structure containing pci configuration space values
+
+
+Return value:
+
+int   - Status (TRUE or FALSE)
+
+Description:
+Access PCI configuration space, retrieve  PCI allocated resources , updates in resource structure.
+
+ */
+int dhdpcie_get_resource(dhdpcie_info_t *dhdpcie_info)
+{
+       phys_addr_t  bar0_addr, bar1_addr;
+       ulong bar1_size;
+       struct pci_dev *pdev = NULL;
+       pdev = dhdpcie_info->dev;
+       do {
+               if (pci_enable_device(pdev)) {
+                       printf("%s: Cannot enable PCI device\n", __FUNCTION__);
+                       break;
+               }
+               pci_set_master(pdev);
+               bar0_addr = pci_resource_start(pdev, 0);        /* Bar-0 mapped address */
+               bar1_addr = pci_resource_start(pdev, 2);        /* Bar-1 mapped address */
+
+               /* read Bar-1 mapped memory range */
+               bar1_size = pci_resource_len(pdev, 2);
+
+               if ((bar1_size == 0) || (bar1_addr == 0)) {
+                       printf("%s: BAR1 Not enabled for this device  size(%ld),"
+                               " addr(0x"PRINTF_RESOURCE")\n",
+                               __FUNCTION__, bar1_size, bar1_addr);
+                       goto err;
+               }
+
+               dhdpcie_info->regs = (volatile char *) REG_MAP(bar0_addr, DONGLE_REG_MAP_SIZE);
+               dhdpcie_info->tcm = (volatile char *) REG_MAP(bar1_addr, DONGLE_TCM_MAP_SIZE);
+               dhdpcie_info->tcm_size = DONGLE_TCM_MAP_SIZE;
+
+               if (!dhdpcie_info->regs || !dhdpcie_info->tcm) {
+                       DHD_ERROR(("%s:ioremap() failed\n", __FUNCTION__));
+                       break;
+               }
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0))
+               if (!dhd_download_fw_on_driverload) {
+                       /* Backup PCIe configuration so as to use Wi-Fi on/off process
+                        * in case of built in driver
+                        */
+                       pci_save_state(pdev);
+                       dhdpcie_info->default_state = pci_store_saved_state(pdev);
+
+                       if (dhdpcie_info->default_state == NULL) {
+                               DHD_ERROR(("%s pci_store_saved_state returns NULL\n",
+                                       __FUNCTION__));
+                               REG_UNMAP(dhdpcie_info->regs);
+                               REG_UNMAP(dhdpcie_info->tcm);
+                               pci_disable_device(pdev);
+                               break;
+                       }
+               }
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0) */
+
+               DHD_TRACE(("%s:Phys addr : reg space = %p base addr 0x"PRINTF_RESOURCE" \n",
+                       __FUNCTION__, dhdpcie_info->regs, bar0_addr));
+               DHD_TRACE(("%s:Phys addr : tcm_space = %p base addr 0x"PRINTF_RESOURCE" \n",
+                       __FUNCTION__, dhdpcie_info->tcm, bar1_addr));
+
+               return 0; /* SUCCESS  */
+       } while (0);
+err:
+       return -1;  /* FAILURE */
+}
+
+int dhdpcie_scan_resource(dhdpcie_info_t *dhdpcie_info)
+{
+
+       DHD_TRACE(("%s: ENTER\n", __FUNCTION__));
+
+       do {
+               /* define it here only!! */
+               if (dhdpcie_get_resource (dhdpcie_info)) {
+                       DHD_ERROR(("%s: Failed to get PCI resources\n", __FUNCTION__));
+                       break;
+               }
+               DHD_TRACE(("%s:Exit - SUCCESS \n",
+                       __FUNCTION__));
+
+               return 0; /* SUCCESS */
+
+       } while (0);
+
+       DHD_TRACE(("%s:Exit - FAILURE \n", __FUNCTION__));
+
+       return -1; /* FAILURE */
+
+}
+
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#if defined(CONFIG_ARCH_MSM) || (defined(EXYNOS_PCIE_LINKDOWN_RECOVERY) && \
+       defined(CONFIG_SOC_EXYNOS8890))
+void dhdpcie_linkdown_cb(struct_pcie_notify *noti)
+{
+       struct pci_dev *pdev = (struct pci_dev *)noti->user;
+       dhdpcie_info_t *pch = NULL;
+
+       if (pdev) {
+               pch = pci_get_drvdata(pdev);
+               if (pch) {
+                       dhd_bus_t *bus = pch->bus;
+                       if (bus) {
+                               dhd_pub_t *dhd = bus->dhd;
+                               if (dhd) {
+                                       DHD_ERROR(("%s: Event HANG send up "
+                                               "due to PCIe linkdown\n",
+                                               __FUNCTION__));
+#ifdef CONFIG_ARCH_MSM
+                                       bus->no_cfg_restore = 1;
+#endif /* CONFIG_ARCH_MSM */
+                                       bus->is_linkdown = 1;
+                                       DHD_OS_WAKE_LOCK(dhd);
+                                       dhd->hang_reason = HANG_REASON_PCIE_LINK_DOWN;
+                                       dhd_os_send_hang_message(dhd);
+                               }
+                       }
+               }
+       }
+
+}
+#endif /* CONFIG_ARCH_MSM || (EXYNOS_PCIE_LINKDOWN_RECOVERY && CONFIG_SOC_EXYNOS8890) */
+#endif /* EXYNOS_PCIE_LINKDOWN_RECOVERY */
+
+int dhdpcie_init(struct pci_dev *pdev)
+{
+
+       osl_t                           *osh = NULL;
+       dhd_bus_t                       *bus = NULL;
+       dhdpcie_info_t          *dhdpcie_info =  NULL;
+       wifi_adapter_info_t     *adapter = NULL;
+#ifdef BCMPCIE_OOB_HOST_WAKE
+       dhdpcie_os_info_t       *dhdpcie_osinfo = NULL;
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+
+       do {
+               /* osl attach */
+               if (!(osh = osl_attach(pdev, PCI_BUS, FALSE))) {
+                       DHD_ERROR(("%s: osl_attach failed\n", __FUNCTION__));
+                       break;
+               }
+
+               /* initialize static buffer */
+               adapter = dhd_wifi_platform_get_adapter(PCI_BUS, pdev->bus->number,
+                       PCI_SLOT(pdev->devfn));
+               if (adapter != NULL)
+                       DHD_ERROR(("%s: found adapter info '%s'\n", __FUNCTION__, adapter->name));
+               else
+                       DHD_ERROR(("%s: can't find adapter info for this chip\n", __FUNCTION__));
+               osl_static_mem_init(osh, adapter);
+
+               /* Set ACP coherence flag */
+               if (OSL_ACP_WAR_ENAB() || OSL_ARCH_IS_COHERENT())
+                       osl_flag_set(osh, OSL_ACP_COHERENCE);
+
+               /*  allocate linux spcific pcie structure here */
+               if (!(dhdpcie_info = MALLOC(osh, sizeof(dhdpcie_info_t)))) {
+                       DHD_ERROR(("%s: MALLOC of dhd_bus_t failed\n", __FUNCTION__));
+                       break;
+               }
+               bzero(dhdpcie_info, sizeof(dhdpcie_info_t));
+               dhdpcie_info->osh = osh;
+               dhdpcie_info->dev = pdev;
+
+#ifdef BCMPCIE_OOB_HOST_WAKE
+               /* allocate OS speicific structure */
+               dhdpcie_osinfo = MALLOC(osh, sizeof(dhdpcie_os_info_t));
+               if (dhdpcie_osinfo == NULL) {
+                       DHD_ERROR(("%s: MALLOC of dhdpcie_os_info_t failed\n",
+                               __FUNCTION__));
+                       break;
+               }
+               bzero(dhdpcie_osinfo, sizeof(dhdpcie_os_info_t));
+               dhdpcie_info->os_cxt = (void *)dhdpcie_osinfo;
+
+               /* Initialize host wake IRQ */
+               spin_lock_init(&dhdpcie_osinfo->oob_irq_spinlock);
+               /* Get customer specific host wake IRQ parametres: IRQ number as IRQ type */
+               dhdpcie_osinfo->oob_irq_num = wifi_platform_get_irq_number(adapter,
+                       &dhdpcie_osinfo->oob_irq_flags);
+               if (dhdpcie_osinfo->oob_irq_num < 0) {
+                       DHD_ERROR(("%s: Host OOB irq is not defined\n", __FUNCTION__));
+               }
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+
+               /* Find the PCI resources, verify the  */
+               /* vendor and device ID, map BAR regions and irq,  update in structures */
+               if (dhdpcie_scan_resource(dhdpcie_info)) {
+                       DHD_ERROR(("%s: dhd_Scan_PCI_Res failed\n", __FUNCTION__));
+
+                       break;
+               }
+
+               /* Bus initialization */
+               bus = dhdpcie_bus_attach(osh, dhdpcie_info->regs, dhdpcie_info->tcm, pdev);
+               if (!bus) {
+                       DHD_ERROR(("%s:dhdpcie_bus_attach() failed\n", __FUNCTION__));
+                       break;
+               }
+
+               dhdpcie_info->bus = bus;
+               bus->is_linkdown = 0;
+               bus->pci_d3hot_done = 0;
+#ifdef DONGLE_ENABLE_ISOLATION
+               bus->dhd->dongle_isolation = TRUE;
+#endif /* DONGLE_ENABLE_ISOLATION */
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#ifdef CONFIG_ARCH_MSM
+               bus->pcie_event.events = MSM_PCIE_EVENT_LINKDOWN;
+               bus->pcie_event.user = pdev;
+               bus->pcie_event.mode = MSM_PCIE_TRIGGER_CALLBACK;
+               bus->pcie_event.callback = dhdpcie_linkdown_cb;
+               bus->pcie_event.options = MSM_PCIE_CONFIG_NO_RECOVERY;
+               msm_pcie_register_event(&bus->pcie_event);
+               bus->no_cfg_restore = 0;
+#endif /* CONFIG_ARCH_MSM */
+#ifdef EXYNOS_PCIE_LINKDOWN_RECOVERY
+#ifdef CONFIG_SOC_EXYNOS8890
+               bus->pcie_event.events = EXYNOS_PCIE_EVENT_LINKDOWN;
+               bus->pcie_event.user = pdev;
+               bus->pcie_event.mode = EXYNOS_PCIE_TRIGGER_CALLBACK;
+               bus->pcie_event.callback = dhdpcie_linkdown_cb;
+               exynos_pcie_register_event(&bus->pcie_event);
+#endif /* CONFIG_SOC_EXYNOS8890 */
+#endif /* EXYNOS_PCIE_LINKDOWN_RECOVERY */
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+
+               if (bus->intr) {
+                       /* Register interrupt callback, but mask it (not operational yet). */
+                       DHD_INTR(("%s: Registering and masking interrupts\n", __FUNCTION__));
+                       dhdpcie_bus_intr_disable(bus);
+
+                       if (dhdpcie_request_irq(dhdpcie_info)) {
+                               DHD_ERROR(("%s: request_irq() failed\n", __FUNCTION__));
+                               break;
+                       }
+               } else {
+                       bus->pollrate = 1;
+                       DHD_INFO(("%s: PCIe interrupt function is NOT registered "
+                               "due to polling mode\n", __FUNCTION__));
+               }
+
+#if defined(BCM_REQUEST_FW)
+               if (dhd_bus_download_firmware(bus, osh, NULL, NULL) < 0) {
+               DHD_ERROR(("%s: failed to download firmware\n", __FUNCTION__));
+               }
+               bus->nv_path = NULL;
+               bus->fw_path = NULL;
+#endif /* BCM_REQUEST_FW */
+
+               /* set private data for pci_dev */
+               pci_set_drvdata(pdev, dhdpcie_info);
+
+               if (dhd_download_fw_on_driverload) {
+                       if (dhd_bus_start(bus->dhd)) {
+                               DHD_ERROR(("%s: dhd_bud_start() failed\n", __FUNCTION__));
+                               if (!allow_delay_fwdl)
+                                       break;
+                       }
+               } else {
+                       /* Set ramdom MAC address during boot time */
+                       get_random_bytes(&bus->dhd->mac.octet[3], 3);
+                       /* Adding BRCM OUI */
+                       bus->dhd->mac.octet[0] = 0;
+                       bus->dhd->mac.octet[1] = 0x90;
+                       bus->dhd->mac.octet[2] = 0x4C;
+               }
+
+               /* Attach to the OS network interface */
+               DHD_TRACE(("%s(): Calling dhd_register_if() \n", __FUNCTION__));
+               if (dhd_register_if(bus->dhd, 0, TRUE)) {
+                       DHD_ERROR(("%s(): ERROR.. dhd_register_if() failed\n", __FUNCTION__));
+                       break;
+               }
+
+               dhdpcie_init_succeeded = TRUE;
+
+               DHD_TRACE(("%s:Exit - SUCCESS \n", __FUNCTION__));
+               return 0;  /* return  SUCCESS  */
+
+       } while (0);
+       /* reverse the initialization in order in case of error */
+
+       if (bus)
+               dhdpcie_bus_release(bus);
+
+#ifdef BCMPCIE_OOB_HOST_WAKE
+       if (dhdpcie_osinfo) {
+               MFREE(osh, dhdpcie_osinfo, sizeof(dhdpcie_os_info_t));
+       }
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+
+       if (dhdpcie_info)
+               dhdpcie_detach(dhdpcie_info);
+       pci_disable_device(pdev);
+       if (osh)
+               osl_detach(osh);
+
+       dhdpcie_init_succeeded = FALSE;
+
+       DHD_TRACE(("%s:Exit - FAILURE \n", __FUNCTION__));
+
+       return -1; /* return FAILURE  */
+}
+
+/* Free Linux irq */
+void
+dhdpcie_free_irq(dhd_bus_t *bus)
+{
+       struct pci_dev *pdev = NULL;
+
+       DHD_TRACE(("%s: freeing up the IRQ\n", __FUNCTION__));
+       if (!bus) {
+               return;
+       }
+
+       if (bus->irq_registered) {
+               pdev = bus->dev;
+               free_irq(pdev->irq, bus);
+#ifndef PCIE_INTX_SUPPORT
+               pci_disable_msi(pdev);
+#endif /* !PCIE_INTX_SUPPORT */
+               bus->irq_registered = FALSE;
+       } else {
+               DHD_ERROR(("%s: PCIe IRQ is not registered\n", __FUNCTION__));
+       }
+       DHD_TRACE(("%s: Exit\n", __FUNCTION__));
+       return;
+}
+
+/*
+
+Name:  dhdpcie_isr
+
+Parametrs:
+
+1: IN int irq   -- interrupt vector
+2: IN void *arg      -- handle to private data structure
+
+Return value:
+
+Status (TRUE or FALSE)
+
+Description:
+Interrupt Service routine checks for the status register,
+disable interrupt and queue DPC if mail box interrupts are raised.
+*/
+
+
+irqreturn_t
+dhdpcie_isr(int irq, void *arg)
+{
+       dhd_bus_t *bus = (dhd_bus_t*)arg;
+       if (dhdpcie_bus_isr(bus))
+               return TRUE;
+       else
+               return FALSE;
+}
+
+int
+dhdpcie_start_host_pcieclock(dhd_bus_t *bus)
+{
+       int ret = 0;
+#ifdef CONFIG_ARCH_MSM
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+       int options = 0;
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+#endif /* CONFIG_ARCH_MSM */
+       DHD_TRACE(("%s Enter:\n", __FUNCTION__));
+
+       if (bus == NULL) {
+               return BCME_ERROR;
+       }
+
+       if (bus->dev == NULL) {
+               return BCME_ERROR;
+       }
+
+#ifdef CONFIG_ARCH_MSM
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+       if (bus->no_cfg_restore) {
+               options = MSM_PCIE_CONFIG_NO_CFG_RESTORE;
+       }
+       ret = msm_pcie_pm_control(MSM_PCIE_RESUME, bus->dev->bus->number,
+               bus->dev, NULL, options);
+       if (bus->no_cfg_restore && !ret) {
+               msm_pcie_recover_config(bus->dev);
+               bus->no_cfg_restore = 0;
+       }
+#else
+       ret = msm_pcie_pm_control(MSM_PCIE_RESUME, bus->dev->bus->number,
+               bus->dev, NULL, 0);
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+       if (ret) {
+               DHD_ERROR(("%s Failed to bring up PCIe link\n", __FUNCTION__));
+               goto done;
+       }
+
+done:
+#endif /* CONFIG_ARCH_MSM */
+       DHD_TRACE(("%s Exit:\n", __FUNCTION__));
+       return ret;
+}
+
+int
+dhdpcie_stop_host_pcieclock(dhd_bus_t *bus)
+{
+       int ret = 0;
+#ifdef CONFIG_ARCH_MSM
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+       int options = 0;
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+#endif /* CONFIG_ARCH_MSM */
+
+       DHD_TRACE(("%s Enter:\n", __FUNCTION__));
+
+       if (bus == NULL) {
+               return BCME_ERROR;
+       }
+
+       if (bus->dev == NULL) {
+               return BCME_ERROR;
+       }
+
+#ifdef CONFIG_ARCH_MSM
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+       if (bus->no_cfg_restore) {
+               options = MSM_PCIE_CONFIG_NO_CFG_RESTORE | MSM_PCIE_CONFIG_LINKDOWN;
+       }
+
+       ret = msm_pcie_pm_control(MSM_PCIE_SUSPEND, bus->dev->bus->number,
+               bus->dev, NULL, options);
+#else
+       ret = msm_pcie_pm_control(MSM_PCIE_SUSPEND, bus->dev->bus->number,
+               bus->dev, NULL, 0);
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+       if (ret) {
+               DHD_ERROR(("Failed to stop PCIe link\n"));
+               goto done;
+       }
+done:
+#endif /* CONFIG_ARCH_MSM */
+       DHD_TRACE(("%s Exit:\n", __FUNCTION__));
+       return ret;
+}
+
+int
+dhdpcie_disable_device(dhd_bus_t *bus)
+{
+       DHD_TRACE(("%s Enter:\n", __FUNCTION__));
+
+       if (bus == NULL) {
+               return BCME_ERROR;
+       }
+
+       if (bus->dev == NULL) {
+               return BCME_ERROR;
+       }
+
+       pci_disable_device(bus->dev);
+
+       return 0;
+}
+
+int
+dhdpcie_enable_device(dhd_bus_t *bus)
+{
+       int ret = BCME_ERROR;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0))
+       dhdpcie_info_t *pch;
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0) */
+
+       DHD_TRACE(("%s Enter:\n", __FUNCTION__));
+
+       if (bus == NULL) {
+               return BCME_ERROR;
+       }
+
+       if (bus->dev == NULL) {
+               return BCME_ERROR;
+       }
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0))
+       pch = pci_get_drvdata(bus->dev);
+       if (pch == NULL) {
+               return BCME_ERROR;
+       }
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)) && !defined(CONFIG_SOC_EXYNOS8890)
+       /* Updated with pci_load_and_free_saved_state to compatible
+        * with kernel 3.14 or higher
+        */
+       pci_load_and_free_saved_state(bus->dev, &pch->default_state);
+       pch->default_state = pci_store_saved_state(bus->dev);
+#else
+       pci_load_saved_state(bus->dev, pch->default_state);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0)) && !CONFIG_SOC_EXYNOS8890 */
+
+       pci_restore_state(bus->dev);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)) */
+
+       ret = pci_enable_device(bus->dev);
+       if (ret) {
+               pci_disable_device(bus->dev);
+       } else {
+               pci_set_master(bus->dev);
+       }
+
+       return ret;
+}
+
+int
+dhdpcie_alloc_resource(dhd_bus_t *bus)
+{
+       dhdpcie_info_t *dhdpcie_info;
+       phys_addr_t bar0_addr, bar1_addr;
+       ulong bar1_size;
+
+       do {
+               if (bus == NULL) {
+                       DHD_ERROR(("%s: bus is NULL\n", __FUNCTION__));
+                       break;
+               }
+
+               if (bus->dev == NULL) {
+                       DHD_ERROR(("%s: bus->dev is NULL\n", __FUNCTION__));
+                       break;
+               }
+
+               dhdpcie_info = pci_get_drvdata(bus->dev);
+               if (dhdpcie_info == NULL) {
+                       DHD_ERROR(("%s: dhdpcie_info is NULL\n", __FUNCTION__));
+                       break;
+               }
+
+               bar0_addr = pci_resource_start(bus->dev, 0);    /* Bar-0 mapped address */
+               bar1_addr = pci_resource_start(bus->dev, 2);    /* Bar-1 mapped address */
+
+               /* read Bar-1 mapped memory range */
+               bar1_size = pci_resource_len(bus->dev, 2);
+
+               if ((bar1_size == 0) || (bar1_addr == 0)) {
+                       printf("%s: BAR1 Not enabled for this device size(%ld),"
+                               " addr(0x"PRINTF_RESOURCE")\n",
+                               __FUNCTION__, bar1_size, bar1_addr);
+                       break;
+               }
+
+               dhdpcie_info->regs = (volatile char *) REG_MAP(bar0_addr, DONGLE_REG_MAP_SIZE);
+               if (!dhdpcie_info->regs) {
+                       DHD_ERROR(("%s: ioremap() for regs is failed\n", __FUNCTION__));
+                       break;
+               }
+
+               bus->regs = dhdpcie_info->regs;
+               dhdpcie_info->tcm = (volatile char *) REG_MAP(bar1_addr, DONGLE_TCM_MAP_SIZE);
+               dhdpcie_info->tcm_size = DONGLE_TCM_MAP_SIZE;
+               if (!dhdpcie_info->tcm) {
+                       DHD_ERROR(("%s: ioremap() for regs is failed\n", __FUNCTION__));
+                       REG_UNMAP(dhdpcie_info->regs);
+                       bus->regs = NULL;
+                       break;
+               }
+
+               bus->tcm = dhdpcie_info->tcm;
+
+               DHD_TRACE(("%s:Phys addr : reg space = %p base addr 0x"PRINTF_RESOURCE" \n",
+                       __FUNCTION__, dhdpcie_info->regs, bar0_addr));
+               DHD_TRACE(("%s:Phys addr : tcm_space = %p base addr 0x"PRINTF_RESOURCE" \n",
+                       __FUNCTION__, dhdpcie_info->tcm, bar1_addr));
+
+               return 0;
+       } while (0);
+
+       return BCME_ERROR;
+}
+
+void
+dhdpcie_free_resource(dhd_bus_t *bus)
+{
+       dhdpcie_info_t *dhdpcie_info;
+
+       if (bus == NULL) {
+               DHD_ERROR(("%s: bus is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       if (bus->dev == NULL) {
+               DHD_ERROR(("%s: bus->dev is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       dhdpcie_info = pci_get_drvdata(bus->dev);
+       if (dhdpcie_info == NULL) {
+               DHD_ERROR(("%s: dhdpcie_info is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       if (bus->regs) {
+               REG_UNMAP(dhdpcie_info->regs);
+               bus->regs = NULL;
+       }
+
+       if (bus->tcm) {
+               REG_UNMAP(dhdpcie_info->tcm);
+               bus->tcm = NULL;
+       }
+}
+
+int
+dhdpcie_bus_request_irq(struct dhd_bus *bus)
+{
+       dhdpcie_info_t *dhdpcie_info;
+       int ret = 0;
+
+       if (bus == NULL) {
+               DHD_ERROR(("%s: bus is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       if (bus->dev == NULL) {
+               DHD_ERROR(("%s: bus->dev is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       dhdpcie_info = pci_get_drvdata(bus->dev);
+       if (dhdpcie_info == NULL) {
+               DHD_ERROR(("%s: dhdpcie_info is NULL\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       if (bus->intr) {
+               /* Register interrupt callback, but mask it (not operational yet). */
+               DHD_INTR(("%s: Registering and masking interrupts\n", __FUNCTION__));
+               dhdpcie_bus_intr_disable(bus);
+               ret = dhdpcie_request_irq(dhdpcie_info);
+               if (ret) {
+                       DHD_ERROR(("%s: request_irq() failed, ret=%d\n",
+                               __FUNCTION__, ret));
+                       return ret;
+               }
+       }
+
+       return ret;
+}
+
+#ifdef BCMPCIE_OOB_HOST_WAKE
+void dhdpcie_oob_intr_set(dhd_bus_t *bus, bool enable)
+{
+       unsigned long flags;
+       dhdpcie_info_t *pch;
+       dhdpcie_os_info_t *dhdpcie_osinfo;
+
+       if (bus == NULL) {
+               DHD_ERROR(("%s: bus is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       if (bus->dev == NULL) {
+               DHD_ERROR(("%s: bus->dev is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       pch = pci_get_drvdata(bus->dev);
+       if (pch == NULL) {
+               DHD_ERROR(("%s: pch is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       dhdpcie_osinfo = (dhdpcie_os_info_t *)pch->os_cxt;
+       spin_lock_irqsave(&dhdpcie_osinfo->oob_irq_spinlock, flags);
+       if ((dhdpcie_osinfo->oob_irq_enabled != enable) &&
+               (dhdpcie_osinfo->oob_irq_num > 0)) {
+               if (enable) {
+                       enable_irq(dhdpcie_osinfo->oob_irq_num);
+               } else {
+                       disable_irq_nosync(dhdpcie_osinfo->oob_irq_num);
+               }
+               dhdpcie_osinfo->oob_irq_enabled = enable;
+       }
+       spin_unlock_irqrestore(&dhdpcie_osinfo->oob_irq_spinlock, flags);
+}
+
+static irqreturn_t wlan_oob_irq(int irq, void *data)
+{
+       dhd_bus_t *bus;
+       DHD_TRACE(("%s: IRQ Triggered\n", __FUNCTION__));
+       bus = (dhd_bus_t *)data;
+       dhdpcie_oob_intr_set(bus, FALSE);
+#ifdef DHD_PCIE_RUNTIMEPM
+       dhdpcie_runtime_bus_wake(bus->dhd, FALSE, wlan_oob_irq);
+#endif /* DHD_PCIE_RUNTIMPM */
+       if (bus->dhd->up && bus->suspended) {
+               DHD_OS_OOB_IRQ_WAKE_LOCK_TIMEOUT(bus->dhd, OOB_WAKE_LOCK_TIMEOUT);
+       }
+       return IRQ_HANDLED;
+}
+
+int dhdpcie_oob_intr_register(dhd_bus_t *bus)
+{
+       int err = 0;
+       dhdpcie_info_t *pch;
+       dhdpcie_os_info_t *dhdpcie_osinfo;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+       if (bus == NULL) {
+               DHD_ERROR(("%s: bus is NULL\n", __FUNCTION__));
+               return -EINVAL;
+       }
+
+       if (bus->dev == NULL) {
+               DHD_ERROR(("%s: bus->dev is NULL\n", __FUNCTION__));
+               return -EINVAL;
+       }
+
+       pch = pci_get_drvdata(bus->dev);
+       if (pch == NULL) {
+               DHD_ERROR(("%s: pch is NULL\n", __FUNCTION__));
+               return -EINVAL;
+       }
+
+       dhdpcie_osinfo = (dhdpcie_os_info_t *)pch->os_cxt;
+       if (dhdpcie_osinfo->oob_irq_registered) {
+               DHD_ERROR(("%s: irq is already registered\n", __FUNCTION__));
+               return -EBUSY;
+       }
+
+       if (dhdpcie_osinfo->oob_irq_num > 0) {
+               DHD_INFO_HW4(("%s OOB irq=%d flags=%X \n", __FUNCTION__,
+                       (int)dhdpcie_osinfo->oob_irq_num,
+                       (int)dhdpcie_osinfo->oob_irq_flags));
+               err = request_irq(dhdpcie_osinfo->oob_irq_num, wlan_oob_irq,
+                       dhdpcie_osinfo->oob_irq_flags, "dhdpcie_host_wake",
+                       bus);
+               if (err) {
+                       DHD_ERROR(("%s: request_irq failed with %d\n",
+                               __FUNCTION__, err));
+                       return err;
+               }
+               err = enable_irq_wake(dhdpcie_osinfo->oob_irq_num);
+               if (!err) {
+                       dhdpcie_osinfo->oob_irq_wake_enabled = TRUE;
+               }
+               dhdpcie_osinfo->oob_irq_enabled = TRUE;
+       }
+
+       dhdpcie_osinfo->oob_irq_registered = TRUE;
+
+       return err;
+}
+
+void dhdpcie_oob_intr_unregister(dhd_bus_t *bus)
+{
+       int err = 0;
+       dhdpcie_info_t *pch;
+       dhdpcie_os_info_t *dhdpcie_osinfo;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+       if (bus == NULL) {
+               DHD_ERROR(("%s: bus is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       if (bus->dev == NULL) {
+               DHD_ERROR(("%s: bus->dev is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       pch = pci_get_drvdata(bus->dev);
+       if (pch == NULL) {
+               DHD_ERROR(("%s: pch is NULL\n", __FUNCTION__));
+               return;
+       }
+
+       dhdpcie_osinfo = (dhdpcie_os_info_t *)pch->os_cxt;
+       if (!dhdpcie_osinfo->oob_irq_registered) {
+               DHD_ERROR(("%s: irq is not registered\n", __FUNCTION__));
+               return;
+       }
+       if (dhdpcie_osinfo->oob_irq_num > 0) {
+               if (dhdpcie_osinfo->oob_irq_wake_enabled) {
+                       err = disable_irq_wake(dhdpcie_osinfo->oob_irq_num);
+                       if (!err) {
+                               dhdpcie_osinfo->oob_irq_wake_enabled = FALSE;
+                       }
+               }
+               if (dhdpcie_osinfo->oob_irq_enabled) {
+                       disable_irq(dhdpcie_osinfo->oob_irq_num);
+                       dhdpcie_osinfo->oob_irq_enabled = FALSE;
+               }
+               free_irq(dhdpcie_osinfo->oob_irq_num, bus);
+       }
+       dhdpcie_osinfo->oob_irq_registered = FALSE;
+}
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+
+#ifdef DHD_PCIE_RUNTIMEPM
+bool dhd_runtimepm_state(dhd_pub_t *dhd)
+{
+       dhd_bus_t *bus;
+       unsigned long flags;
+       bus = dhd->bus;
+
+       DHD_GENERAL_LOCK(dhd, flags);
+       if (bus->suspended == TRUE) {
+               DHD_GENERAL_UNLOCK(dhd, flags);
+               DHD_INFO(("Bus is already suspended system PM: %d\n", bus->suspended));
+               return FALSE;
+       }
+
+       bus->idlecount++;
+
+       DHD_TRACE(("%s : Enter \n", __FUNCTION__));
+       if ((bus->idletime > 0) && (bus->idlecount >= bus->idletime)) {
+               bus->idlecount = 0;
+               if (dhd->dhd_bus_busy_state == 0 && dhd->busstate != DHD_BUS_DOWN &&
+                               dhd->busstate != DHD_BUS_DOWN_IN_PROGRESS) {
+                       bus->bus_wake = 0;
+                       dhd->dhd_bus_busy_state |= DHD_BUS_BUSY_RPM_SUSPEND_IN_PROGRESS;
+                       bus->runtime_resume_done = FALSE;
+                       /* stop all interface network queue. */
+                       dhd_bus_stop_queue(bus);
+                       DHD_GENERAL_UNLOCK(dhd, flags);
+                       DHD_ERROR(("%s: DHD Idle state!! -  idletime :%d, wdtick :%d \n",
+                                       __FUNCTION__, bus->idletime, dhd_runtimepm_ms));
+                       /* RPM suspend is failed, return FALSE then re-trying */
+                       if (dhdpcie_set_suspend_resume(bus->dev, TRUE)) {
+                               DHD_ERROR(("%s: exit with wakelock \n", __FUNCTION__));
+                               DHD_GENERAL_LOCK(dhd, flags);
+                               dhd->dhd_bus_busy_state &= ~DHD_BUS_BUSY_RPM_SUSPEND_IN_PROGRESS;
+                               bus->runtime_resume_done = TRUE;
+                               /* It can make stuck NET TX Queue without below */
+                               dhd_bus_start_queue(bus);
+                               DHD_GENERAL_UNLOCK(dhd, flags);
+                               smp_wmb();
+                               wake_up_interruptible(&bus->rpm_queue);
+                               return FALSE;
+                       }
+
+                       DHD_GENERAL_LOCK(dhd, flags);
+                       dhd->dhd_bus_busy_state &= ~DHD_BUS_BUSY_RPM_SUSPEND_IN_PROGRESS;
+                       dhd->dhd_bus_busy_state |= DHD_BUS_BUSY_RPM_SUSPEND_DONE;
+                       /* For making sure NET TX Queue active  */
+                       dhd_bus_start_queue(bus);
+                       DHD_GENERAL_UNLOCK(dhd, flags);
+
+                       wait_event_interruptible(bus->rpm_queue, bus->bus_wake);
+
+                       DHD_GENERAL_LOCK(dhd, flags);
+                       dhd->dhd_bus_busy_state &= ~DHD_BUS_BUSY_RPM_SUSPEND_DONE;
+                       dhd->dhd_bus_busy_state |= DHD_BUS_BUSY_RPM_RESUME_IN_PROGRESS;
+                       DHD_GENERAL_UNLOCK(dhd, flags);
+
+                       dhdpcie_set_suspend_resume(bus->dev, FALSE);
+
+                       DHD_GENERAL_LOCK(dhd, flags);
+                       dhd->dhd_bus_busy_state &= ~DHD_BUS_BUSY_RPM_RESUME_IN_PROGRESS;
+                       /* Inform the wake up context that Resume is over */
+                       bus->runtime_resume_done = TRUE;
+                       /* For making sure NET TX Queue active  */
+                       dhd_bus_start_queue(bus);
+                       DHD_GENERAL_UNLOCK(dhd, flags);
+
+                       smp_wmb();
+                       wake_up_interruptible(&bus->rpm_queue);
+                       DHD_ERROR(("%s : runtime resume ended\n", __FUNCTION__));
+                       return TRUE;
+               } else {
+                       DHD_GENERAL_UNLOCK(dhd, flags);
+                       /* Since one of the contexts are busy (TX, IOVAR or RX)
+                        * we should not suspend
+                        */
+                       DHD_ERROR(("%s : bus is active with dhd_bus_busy_state = 0x%x\n",
+                               __FUNCTION__, dhd->dhd_bus_busy_state));
+                       return FALSE;
+               }
+       }
+
+       DHD_GENERAL_UNLOCK(dhd, flags);
+       return FALSE;
+} /* dhd_runtimepm_state */
+
+/*
+ * dhd_runtime_bus_wake
+ *  TRUE - related with runtime pm context
+ *  FALSE - It isn't invloved in runtime pm context
+ */
+bool dhd_runtime_bus_wake(dhd_bus_t *bus, bool wait, void *func_addr)
+{
+       unsigned long flags;
+       bus->idlecount = 0;
+       DHD_TRACE(("%s : enter\n", __FUNCTION__));
+       if (bus->dhd->up == FALSE) {
+               DHD_INFO(("%s : dhd is not up\n", __FUNCTION__));
+               return FALSE;
+       }
+
+       DHD_GENERAL_LOCK(bus->dhd, flags);
+       if (bus->dhd->dhd_bus_busy_state & DHD_BUS_BUSY_RPM_ALL) {
+               /* Wake up RPM state thread if it is suspend in progress or suspended */
+               if (bus->dhd->dhd_bus_busy_state & DHD_BUS_BUSY_RPM_SUSPEND_IN_PROGRESS ||
+                               bus->dhd->dhd_bus_busy_state & DHD_BUS_BUSY_RPM_SUSPEND_DONE) {
+                       bus->bus_wake = 1;
+
+                       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+
+                       DHD_ERROR(("Runtime Resume is called in %pf\n", func_addr));
+                       smp_wmb();
+                       wake_up_interruptible(&bus->rpm_queue);
+               /* No need to wake up the RPM state thread */
+               } else if (bus->dhd->dhd_bus_busy_state & DHD_BUS_BUSY_RPM_RESUME_IN_PROGRESS) {
+                       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+               }
+
+               /* If wait is TRUE, function with wait = TRUE will be wait in here  */
+               if (wait) {
+                       wait_event_interruptible(bus->rpm_queue, bus->runtime_resume_done);
+               } else {
+                       DHD_INFO(("%s: bus wakeup but no wait until resume done\n", __FUNCTION__));
+               }
+               /* If it is called from RPM context, it returns TRUE */
+               return TRUE;
+       }
+
+       DHD_GENERAL_UNLOCK(bus->dhd, flags);
+
+       return FALSE;
+}
+
+bool dhdpcie_runtime_bus_wake(dhd_pub_t *dhdp, bool wait, void* func_addr)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       return dhd_runtime_bus_wake(bus, wait, func_addr);
+}
+
+void dhdpcie_block_runtime_pm(dhd_pub_t *dhdp)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       bus->idletime = 0;
+}
+
+bool dhdpcie_is_resume_done(dhd_pub_t *dhdp)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       return bus->runtime_resume_done;
+}
+#endif /* DHD_PCIE_RUNTIMEPM */
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_pno.c b/drivers/net/wireless/bcmdhd_1363/dhd_pno.c
new file mode 100644 (file)
index 0000000..a3c5187
--- /dev/null
@@ -0,0 +1,3892 @@
+/*
+ * Broadcom Dongle Host Driver (DHD)
+ * Prefered Network Offload and Wi-Fi Location Service(WLS) code.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_pno.c 664799 2017-04-24 09:48:40Z $
+ */
+
+#if defined(GSCAN_SUPPORT) && !defined(PNO_SUPPORT)
+#error "GSCAN needs PNO to be enabled!"
+#endif
+
+#ifdef PNO_SUPPORT
+#include <typedefs.h>
+#include <osl.h>
+
+#include <epivers.h>
+#include <bcmutils.h>
+
+#include <bcmendian.h>
+#include <linuxver.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/sort.h>
+#include <dngl_stats.h>
+#include <wlioctl.h>
+
+#include <proto/bcmevent.h>
+#include <dhd.h>
+#include <dhd_pno.h>
+#include <dhd_dbg.h>
+#ifdef GSCAN_SUPPORT
+#include <linux/gcd.h>
+#endif /* GSCAN_SUPPORT */
+
+#ifdef __BIG_ENDIAN
+#include <bcmendian.h>
+#define htod32(i) (bcmswap32(i))
+#define htod16(i) (bcmswap16(i))
+#define dtoh32(i) (bcmswap32(i))
+#define dtoh16(i) (bcmswap16(i))
+#define htodchanspec(i) htod16(i)
+#define dtohchanspec(i) dtoh16(i)
+#else
+#define htod32(i) (i)
+#define htod16(i) (i)
+#define dtoh32(i) (i)
+#define dtoh16(i) (i)
+#define htodchanspec(i) (i)
+#define dtohchanspec(i) (i)
+#endif /* IL_BIGENDINA */
+
+#define NULL_CHECK(p, s, err)  \
+                       do { \
+                               if (!(p)) { \
+                                       printf("NULL POINTER (%s) : %s\n", __FUNCTION__, (s)); \
+                                       err = BCME_ERROR; \
+                                       return err; \
+                               } \
+                       } while (0)
+#define PNO_GET_PNOSTATE(dhd) ((dhd_pno_status_info_t *)dhd->pno_state)
+#define PNO_BESTNET_LEN 1024
+#define PNO_ON 1
+#define PNO_OFF 0
+#define CHANNEL_2G_MAX 14
+#define CHANNEL_5G_MAX 165
+#define MAX_NODE_CNT 5
+#define WLS_SUPPORTED(pno_state) (pno_state->wls_supported == TRUE)
+#define TIME_DIFF(timestamp1, timestamp2) (abs((uint32)(timestamp1/1000)  \
+                                               - (uint32)(timestamp2/1000)))
+#define TIME_DIFF_MS(timestamp1, timestamp2) (abs((uint32)(timestamp1)  \
+                                               - (uint32)(timestamp2)))
+#define TIMESPEC_TO_US(ts)  (((uint64)(ts).tv_sec * USEC_PER_SEC) + \
+                                                       (ts).tv_nsec / NSEC_PER_USEC)
+
+#define ENTRY_OVERHEAD strlen("bssid=\nssid=\nfreq=\nlevel=\nage=\ndist=\ndistSd=\n====")
+#define TIME_MIN_DIFF 5
+static wlc_ssid_ext_t * dhd_pno_get_legacy_pno_ssid(dhd_pub_t *dhd,
+        dhd_pno_status_info_t *pno_state);
+#ifdef GSCAN_SUPPORT
+static wl_pfn_gscan_channel_bucket_t *
+dhd_pno_gscan_create_channel_list(dhd_pub_t *dhd, dhd_pno_status_info_t *pno_state,
+uint16 *chan_list, uint32 *num_buckets, uint32 *num_buckets_to_fw);
+#endif /* GSCAN_SUPPORT */
+
+static inline bool
+is_dfs(uint16 channel)
+{
+       if (channel >= 52 && channel <= 64)                     /* class 2 */
+               return TRUE;
+       else if (channel >= 100 && channel <= 140)      /* class 4 */
+               return TRUE;
+       else
+               return FALSE;
+}
+int
+dhd_pno_clean(dhd_pub_t *dhd)
+{
+       int pfn = 0;
+       int err;
+       dhd_pno_status_info_t *_pno_state;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+       /* Disable PNO */
+       err = dhd_iovar(dhd, 0, "pfn", (char *)&pfn, sizeof(pfn), 1);
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to execute pfn(error : %d)\n",
+                       __FUNCTION__, err));
+               goto exit;
+       }
+       _pno_state->pno_status = DHD_PNO_DISABLED;
+       err = dhd_iovar(dhd, 0, "pfnclear", NULL, 0, 1);
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to execute pfnclear(error : %d)\n",
+                       __FUNCTION__, err));
+       }
+exit:
+       return err;
+}
+
+bool
+dhd_is_pno_supported(dhd_pub_t *dhd)
+{
+       dhd_pno_status_info_t *_pno_state;
+
+       if (!dhd || !dhd->pno_state) {
+               DHD_ERROR(("NULL POINTER : %s\n",
+                       __FUNCTION__));
+               return FALSE;
+       }
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       return WLS_SUPPORTED(_pno_state);
+}
+
+int
+dhd_pno_set_mac_oui(dhd_pub_t *dhd, uint8 *oui)
+{
+       int err = BCME_OK;
+       dhd_pno_status_info_t *_pno_state;
+
+       if (!dhd || !dhd->pno_state) {
+               DHD_ERROR(("NULL POINTER : %s\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       if (ETHER_ISMULTI(oui)) {
+               DHD_ERROR(("Expected unicast OUI\n"));
+               err = BCME_ERROR;
+       } else {
+               memcpy(_pno_state->pno_oui, oui, DOT11_OUI_LEN);
+               DHD_PNO(("PNO mac oui to be used - %02x:%02x:%02x\n", _pno_state->pno_oui[0],
+                   _pno_state->pno_oui[1], _pno_state->pno_oui[2]));
+       }
+
+       return err;
+}
+
+#ifdef GSCAN_SUPPORT
+static uint64
+convert_fw_rel_time_to_systime(uint32 fw_ts_ms)
+{
+       struct timespec ts;
+
+       get_monotonic_boottime(&ts);
+       return ((uint64)(TIMESPEC_TO_US(ts)) - (uint64)(fw_ts_ms * 1000));
+}
+
+static int
+_dhd_pno_gscan_cfg(dhd_pub_t *dhd, wl_pfn_gscan_cfg_t *pfncfg_gscan_param, int size)
+{
+       int err = BCME_OK;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+
+       err = dhd_iovar(dhd, 0, "pfn_gscan_cfg", (char *)pfncfg_gscan_param, size, 1);
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to execute pfncfg_gscan_param\n", __FUNCTION__));
+               goto exit;
+       }
+exit:
+       return err;
+}
+
+static bool
+is_batch_retrieval_complete(struct dhd_pno_gscan_params *gscan_params)
+{
+       smp_rmb();
+       return (gscan_params->get_batch_flag == GSCAN_BATCH_RETRIEVAL_COMPLETE);
+}
+#endif /* GSCAN_SUPPORT */
+
+static int
+dhd_pno_set_mac_addr(dhd_pub_t *dhd, struct ether_addr *macaddr)
+{
+       int err;
+       wl_pfn_macaddr_cfg_t cfg;
+
+       cfg.version = WL_PFN_MACADDR_CFG_VER;
+       if (ETHER_ISNULLADDR(macaddr)) {
+               cfg.flags = 0;
+       } else {
+               cfg.flags = (WL_PFN_MAC_OUI_ONLY_MASK | WL_PFN_SET_MAC_UNASSOC_MASK);
+       }
+       memcpy(&cfg.macaddr, macaddr, ETHER_ADDR_LEN);
+
+       err = dhd_iovar(dhd, 0, "pfn_macaddr", (char *)&cfg, sizeof(cfg), 1);
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to execute pfn_macaddr\n", __FUNCTION__));
+       }
+
+       return err;
+}
+
+static int
+_dhd_pno_suspend(dhd_pub_t *dhd)
+{
+       int err;
+       int suspend = 1;
+       dhd_pno_status_info_t *_pno_state;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       err = dhd_iovar(dhd, 0, "pfn_suspend", (char *)&suspend, sizeof(suspend), 1);
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to suspend pfn(error :%d)\n", __FUNCTION__, err));
+               goto exit;
+
+       }
+       _pno_state->pno_status = DHD_PNO_SUSPEND;
+exit:
+       return err;
+}
+static int
+_dhd_pno_enable(dhd_pub_t *dhd, int enable)
+{
+       int err = BCME_OK;
+       dhd_pno_status_info_t *_pno_state;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+
+       if (enable & 0xfffe) {
+               DHD_ERROR(("%s invalid value\n", __FUNCTION__));
+               err = BCME_BADARG;
+               goto exit;
+       }
+       if (!dhd_support_sta_mode(dhd)) {
+               DHD_ERROR(("PNO is not allowed for non-STA mode"));
+               err = BCME_BADOPTION;
+               goto exit;
+       }
+       if (enable) {
+               if ((_pno_state->pno_mode & DHD_PNO_LEGACY_MODE) &&
+                       dhd_is_associated(dhd, 0, NULL)) {
+                       DHD_ERROR(("%s Legacy PNO mode cannot be enabled "
+                               "in assoc mode , ignore it\n", __FUNCTION__));
+                       err = BCME_BADOPTION;
+                       goto exit;
+               }
+       }
+       /* Enable/Disable PNO */
+       err = dhd_iovar(dhd, 0, "pfn", (char *)&enable, sizeof(enable), 1);
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to execute pfn_set - %d\n", __FUNCTION__, err));
+               goto exit;
+       }
+       _pno_state->pno_status = (enable)?
+               DHD_PNO_ENABLED : DHD_PNO_DISABLED;
+       if (!enable)
+               _pno_state->pno_mode = DHD_PNO_NONE_MODE;
+
+       DHD_PNO(("%s set pno as %s\n",
+               __FUNCTION__, enable ? "Enable" : "Disable"));
+exit:
+       return err;
+}
+
+static int
+_dhd_pno_set(dhd_pub_t *dhd, const dhd_pno_params_t *pno_params, dhd_pno_mode_t mode)
+{
+       int err = BCME_OK;
+       wl_pfn_param_t pfn_param;
+       dhd_pno_params_t *_params;
+       dhd_pno_status_info_t *_pno_state;
+       bool combined_scan = FALSE;
+       struct ether_addr macaddr;
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+
+       memset(&pfn_param, 0, sizeof(pfn_param));
+
+       /* set pfn parameters */
+       pfn_param.version = htod32(PFN_VERSION);
+       pfn_param.flags = ((PFN_LIST_ORDER << SORT_CRITERIA_BIT) |
+               (ENABLE << IMMEDIATE_SCAN_BIT) | (ENABLE << REPORT_SEPERATELY_BIT));
+       if (mode == DHD_PNO_LEGACY_MODE) {
+               /* check and set extra pno params */
+               if ((pno_params->params_legacy.pno_repeat != 0) ||
+                       (pno_params->params_legacy.pno_freq_expo_max != 0)) {
+                       pfn_param.flags |= htod16(ENABLE << ENABLE_ADAPTSCAN_BIT);
+                       pfn_param.repeat = (uchar) (pno_params->params_legacy.pno_repeat);
+                       pfn_param.exp = (uchar) (pno_params->params_legacy.pno_freq_expo_max);
+               }
+               /* set up pno scan fr */
+               if (pno_params->params_legacy.scan_fr != 0)
+                       pfn_param.scan_freq = htod32(pno_params->params_legacy.scan_fr);
+               if (_pno_state->pno_mode & DHD_PNO_BATCH_MODE) {
+                       DHD_PNO(("will enable combined scan with BATCHIG SCAN MODE\n"));
+                       mode |= DHD_PNO_BATCH_MODE;
+                       combined_scan = TRUE;
+               } else if (_pno_state->pno_mode & DHD_PNO_HOTLIST_MODE) {
+                       DHD_PNO(("will enable combined scan with HOTLIST SCAN MODE\n"));
+                       mode |= DHD_PNO_HOTLIST_MODE;
+                       combined_scan = TRUE;
+               }
+#ifdef GSCAN_SUPPORT
+               else if (_pno_state->pno_mode & DHD_PNO_GSCAN_MODE) {
+                       DHD_PNO(("will enable combined scan with GSCAN SCAN MODE\n"));
+                       mode |= DHD_PNO_GSCAN_MODE;
+               }
+#endif /* GSCAN_SUPPORT */
+       }
+       if (mode & (DHD_PNO_BATCH_MODE | DHD_PNO_HOTLIST_MODE)) {
+               /* Scan frequency of 30 sec */
+               pfn_param.scan_freq = htod32(30);
+               /* slow adapt scan is off by default */
+               pfn_param.slow_freq = htod32(0);
+               /* RSSI margin of 30 dBm */
+               pfn_param.rssi_margin = htod16(PNO_RSSI_MARGIN_DBM);
+               /* Network timeout 60 sec */
+               pfn_param.lost_network_timeout = htod32(60);
+               /* best n = 2 by default */
+               pfn_param.bestn = DEFAULT_BESTN;
+               /* mscan m=0 by default, so not record best networks by default */
+               pfn_param.mscan = DEFAULT_MSCAN;
+               /*  default repeat = 10 */
+               pfn_param.repeat = DEFAULT_REPEAT;
+               /* by default, maximum scan interval = 2^2
+                * scan_freq when adaptive scan is turned on
+                */
+               pfn_param.exp = DEFAULT_EXP;
+               if (mode == DHD_PNO_BATCH_MODE) {
+                       /* In case of BATCH SCAN */
+                       if (pno_params->params_batch.bestn)
+                               pfn_param.bestn = pno_params->params_batch.bestn;
+                       if (pno_params->params_batch.scan_fr)
+                               pfn_param.scan_freq = htod32(pno_params->params_batch.scan_fr);
+                       if (pno_params->params_batch.mscan)
+                               pfn_param.mscan = pno_params->params_batch.mscan;
+                       /* enable broadcast scan */
+                       pfn_param.flags |= (ENABLE << ENABLE_BD_SCAN_BIT);
+               } else if (mode == DHD_PNO_HOTLIST_MODE) {
+                       /* In case of HOTLIST SCAN */
+                       if (pno_params->params_hotlist.scan_fr)
+                               pfn_param.scan_freq = htod32(pno_params->params_hotlist.scan_fr);
+                       pfn_param.bestn = 0;
+                       pfn_param.repeat = 0;
+                       /* enable broadcast scan */
+                       pfn_param.flags |= (ENABLE << ENABLE_BD_SCAN_BIT);
+               }
+               if (combined_scan) {
+                       /* Disable Adaptive Scan */
+                       pfn_param.flags &= ~(htod16(ENABLE << ENABLE_ADAPTSCAN_BIT));
+                       pfn_param.flags |= (ENABLE << ENABLE_BD_SCAN_BIT);
+                       pfn_param.repeat = 0;
+                       pfn_param.exp = 0;
+                       if (_pno_state->pno_mode & DHD_PNO_BATCH_MODE) {
+                               /* In case of Legacy PNO + BATCH SCAN */
+                               _params = &(_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS]);
+                               if (_params->params_batch.bestn)
+                                       pfn_param.bestn = _params->params_batch.bestn;
+                               if (_params->params_batch.scan_fr)
+                                       pfn_param.scan_freq = htod32(_params->params_batch.scan_fr);
+                               if (_params->params_batch.mscan)
+                                       pfn_param.mscan = _params->params_batch.mscan;
+                       } else if (_pno_state->pno_mode & DHD_PNO_HOTLIST_MODE) {
+                               /* In case of Legacy PNO + HOTLIST SCAN */
+                               _params = &(_pno_state->pno_params_arr[INDEX_OF_HOTLIST_PARAMS]);
+                               if (_params->params_hotlist.scan_fr)
+                               pfn_param.scan_freq = htod32(_params->params_hotlist.scan_fr);
+                               pfn_param.bestn = 0;
+                               pfn_param.repeat = 0;
+                       }
+               }
+       }
+#ifdef GSCAN_SUPPORT
+       if (mode & DHD_PNO_GSCAN_MODE) {
+               uint32 lost_network_timeout;
+
+               pfn_param.scan_freq = htod32(pno_params->params_gscan.scan_fr);
+               if (pno_params->params_gscan.mscan) {
+                       pfn_param.bestn = pno_params->params_gscan.bestn;
+                       pfn_param.mscan =  pno_params->params_gscan.mscan;
+                       pfn_param.flags |= (ENABLE << ENABLE_BD_SCAN_BIT);
+               }
+               /* RSSI margin of 30 dBm */
+               pfn_param.rssi_margin = htod16(PNO_RSSI_MARGIN_DBM);
+               /* ADAPTIVE turned off */
+               pfn_param.flags &= ~(htod16(ENABLE << ENABLE_ADAPTSCAN_BIT));
+               pfn_param.repeat = 0;
+               pfn_param.exp = 0;
+               pfn_param.slow_freq = 0;
+
+               if (_pno_state->pno_mode & DHD_PNO_LEGACY_MODE) {
+                       dhd_pno_status_info_t *_pno_state = PNO_GET_PNOSTATE(dhd);
+                       dhd_pno_params_t *_params;
+
+                       _params = &(_pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS]);
+
+                       pfn_param.scan_freq = htod32(MIN(pno_params->params_gscan.scan_fr,
+                       _params->params_legacy.scan_fr));
+               }
+
+               lost_network_timeout = (pno_params->params_gscan.max_ch_bucket_freq *
+                                       pfn_param.scan_freq *
+                                       pno_params->params_gscan.lost_ap_window);
+               if (lost_network_timeout) {
+                       pfn_param.lost_network_timeout = htod32(MIN(lost_network_timeout,
+                                                        GSCAN_MIN_BSSID_TIMEOUT));
+               } else {
+                       pfn_param.lost_network_timeout = htod32(GSCAN_MIN_BSSID_TIMEOUT);
+               }
+       } else
+#endif /* GSCAN_SUPPORT */
+       {
+               if (pfn_param.scan_freq < htod32(PNO_SCAN_MIN_FW_SEC) ||
+                       pfn_param.scan_freq > htod32(PNO_SCAN_MAX_FW_SEC)) {
+                       DHD_ERROR(("%s pno freq(%d sec) is not valid \n",
+                               __FUNCTION__, PNO_SCAN_MIN_FW_SEC));
+                       err = BCME_BADARG;
+                       goto exit;
+               }
+       }
+
+       memset(&macaddr, 0, ETHER_ADDR_LEN);
+       memcpy(&macaddr, _pno_state->pno_oui, DOT11_OUI_LEN);
+
+       DHD_PNO(("Setting mac oui to FW - %02x:%02x:%02x\n", _pno_state->pno_oui[0],
+           _pno_state->pno_oui[1], _pno_state->pno_oui[2]));
+       err = dhd_pno_set_mac_addr(dhd, &macaddr);
+       if (err < 0) {
+       DHD_ERROR(("%s : failed to set pno mac address, error - %d\n", __FUNCTION__, err));
+               goto exit;
+       }
+
+
+#ifdef GSCAN_SUPPORT
+                       if (mode == DHD_PNO_BATCH_MODE ||
+                               ((mode & DHD_PNO_GSCAN_MODE) && pno_params->params_gscan.mscan)) {
+#else
+                       if (mode == DHD_PNO_BATCH_MODE) {
+#endif /* GSCAN_SUPPORT */
+
+               int _tmp = pfn_param.bestn;
+               /* set bestn to calculate the max mscan which firmware supports */
+               err = dhd_iovar(dhd, 0, "pfnmem", (char *)&_tmp, sizeof(_tmp), 1);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to set pfnmem\n", __FUNCTION__));
+                       goto exit;
+               }
+               /* get max mscan which the firmware supports */
+               err = dhd_iovar(dhd, 0, "pfnmem", (char *)&_tmp, sizeof(_tmp), 0);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to get pfnmem\n", __FUNCTION__));
+                       goto exit;
+               }
+               DHD_PNO((" returned mscan : %d, set bestn : %d\n", _tmp, pfn_param.bestn));
+               pfn_param.mscan = MIN(pfn_param.mscan, _tmp);
+       }
+       err = dhd_iovar(dhd, 0, "pfn_set", (char *)&pfn_param, sizeof(pfn_param), 1);
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to execute pfn_set %d\n", __FUNCTION__, err));
+               goto exit;
+       }
+       /* need to return mscan if this is for batch scan instead of err */
+       err = (mode == DHD_PNO_BATCH_MODE)? pfn_param.mscan : err;
+exit:
+       return err;
+}
+static int
+_dhd_pno_add_ssid(dhd_pub_t *dhd, wlc_ssid_ext_t* ssids_list, int nssid)
+{
+       int err = BCME_OK;
+       int i = 0;
+       wl_pfn_t pfn_element;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       if (nssid) {
+               NULL_CHECK(ssids_list, "ssid list is NULL", err);
+       }
+       memset(&pfn_element, 0, sizeof(pfn_element));
+       {
+               int j;
+               for (j = 0; j < nssid; j++) {
+                       DHD_PNO(("%d: scan  for  %s size = %d hidden = %d\n", j,
+                               ssids_list[j].SSID, ssids_list[j].SSID_len, ssids_list[j].hidden));
+               }
+       }
+       /* Check for broadcast ssid */
+       for (i = 0; i < nssid; i++) {
+               if (!ssids_list[i].SSID_len) {
+                       DHD_ERROR(("%d: Broadcast SSID is ilegal for PNO setting\n", i));
+                       err = BCME_ERROR;
+                       goto exit;
+               }
+       }
+       /* set all pfn ssid */
+       for (i = 0; i < nssid; i++) {
+               pfn_element.infra = htod32(DOT11_BSSTYPE_INFRASTRUCTURE);
+               pfn_element.auth = (DOT11_OPEN_SYSTEM);
+               pfn_element.wpa_auth = htod32(WPA_AUTH_PFN_ANY);
+               pfn_element.wsec = htod32(0);
+               pfn_element.infra = htod32(1);
+               if (ssids_list[i].hidden) {
+                       pfn_element.flags = htod32(ENABLE << WL_PFN_HIDDEN_BIT);
+               } else {
+                       pfn_element.flags = 0;
+               }
+               memcpy((char *)pfn_element.ssid.SSID, ssids_list[i].SSID,
+                       ssids_list[i].SSID_len);
+               pfn_element.ssid.SSID_len = ssids_list[i].SSID_len;
+               err = dhd_iovar(dhd, 0, "pfn_add", (char *)&pfn_element,
+                       sizeof(pfn_element), 1);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to execute pfn_add\n", __FUNCTION__));
+                       goto exit;
+               }
+       }
+exit:
+       return err;
+}
+/* qsort compare function */
+static int
+_dhd_pno_cmpfunc(const void *a, const void *b)
+{
+       return (*(uint16*)a - *(uint16*)b);
+}
+static int
+_dhd_pno_chan_merge(uint16 *d_chan_list, int *nchan,
+       uint16 *chan_list1, int nchan1, uint16 *chan_list2, int nchan2)
+{
+       int err = BCME_OK;
+       int i = 0, j = 0, k = 0;
+       uint16 tmp;
+       NULL_CHECK(d_chan_list, "d_chan_list is NULL", err);
+       NULL_CHECK(nchan, "nchan is NULL", err);
+       NULL_CHECK(chan_list1, "chan_list1 is NULL", err);
+       NULL_CHECK(chan_list2, "chan_list2 is NULL", err);
+       /* chan_list1 and chan_list2 should be sorted at first */
+       while (i < nchan1 && j < nchan2) {
+               tmp = chan_list1[i] < chan_list2[j]?
+                       chan_list1[i++] : chan_list2[j++];
+               for (; i < nchan1 && chan_list1[i] == tmp; i++);
+               for (; j < nchan2 && chan_list2[j] == tmp; j++);
+               d_chan_list[k++] = tmp;
+       }
+
+       while (i < nchan1) {
+               tmp = chan_list1[i++];
+               for (; i < nchan1 && chan_list1[i] == tmp; i++);
+               d_chan_list[k++] = tmp;
+       }
+
+       while (j < nchan2) {
+               tmp = chan_list2[j++];
+               for (; j < nchan2 && chan_list2[j] == tmp; j++);
+               d_chan_list[k++] = tmp;
+
+       }
+       *nchan = k;
+       return err;
+}
+static int
+_dhd_pno_get_channels(dhd_pub_t *dhd, uint16 *d_chan_list,
+       int *nchan, uint8 band, bool skip_dfs)
+{
+       int err = BCME_OK;
+       int i, j;
+       uint32 chan_buf[WL_NUMCHANNELS + 1];
+       wl_uint32_list_t *list;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       if (*nchan) {
+               NULL_CHECK(d_chan_list, "d_chan_list is NULL", err);
+       }
+       list = (wl_uint32_list_t *) (void *)chan_buf;
+       list->count = htod32(WL_NUMCHANNELS);
+       err = dhd_wl_ioctl_cmd(dhd, WLC_GET_VALID_CHANNELS, chan_buf, sizeof(chan_buf), FALSE, 0);
+       if (err < 0) {
+               DHD_ERROR(("failed to get channel list (err: %d)\n", err));
+               goto exit;
+       }
+       for (i = 0, j = 0; i < dtoh32(list->count) && i < *nchan; i++) {
+               if (band == WLC_BAND_2G) {
+                       if (dtoh32(list->element[i]) > CHANNEL_2G_MAX)
+                               continue;
+               } else if (band == WLC_BAND_5G) {
+                       if (dtoh32(list->element[i]) <= CHANNEL_2G_MAX)
+                               continue;
+                       if (skip_dfs && is_dfs(dtoh32(list->element[i])))
+                               continue;
+
+
+       } else if (band == WLC_BAND_AUTO) {
+               if (skip_dfs || !is_dfs(dtoh32(list->element[i])))
+                               continue;
+                } else { /* All channels */
+               if (skip_dfs && is_dfs(dtoh32(list->element[i])))
+                               continue;
+               }
+                       if (dtoh32(list->element[i]) <= CHANNEL_5G_MAX) {
+                       d_chan_list[j++] = (uint16) dtoh32(list->element[i]);
+               } else {
+                       err = BCME_BADCHAN;
+                       goto exit;
+               }
+       }
+       *nchan = j;
+exit:
+       return err;
+}
+static int
+_dhd_pno_convert_format(dhd_pub_t *dhd, struct dhd_pno_batch_params *params_batch,
+       char *buf, int nbufsize)
+{
+       int err = BCME_OK;
+       int bytes_written = 0, nreadsize = 0;
+       int t_delta = 0;
+       int nleftsize = nbufsize;
+       uint8 cnt = 0;
+       char *bp = buf;
+       char eabuf[ETHER_ADDR_STR_LEN];
+#ifdef PNO_DEBUG
+       char *_base_bp;
+       char msg[150];
+#endif
+       dhd_pno_bestnet_entry_t *iter, *next;
+       dhd_pno_scan_results_t *siter, *snext;
+       dhd_pno_best_header_t *phead, *pprev;
+       NULL_CHECK(params_batch, "params_batch is NULL", err);
+       if (nbufsize > 0)
+               NULL_CHECK(buf, "buf is NULL", err);
+       /* initialize the buffer */
+       memset(buf, 0, nbufsize);
+       DHD_PNO(("%s enter \n", __FUNCTION__));
+       /* # of scans */
+       if (!params_batch->get_batch.batch_started) {
+               bp += nreadsize = sprintf(bp, "scancount=%d\n",
+                       params_batch->get_batch.expired_tot_scan_cnt);
+               nleftsize -= nreadsize;
+               params_batch->get_batch.batch_started = TRUE;
+       }
+       DHD_PNO(("%s scancount %d\n", __FUNCTION__, params_batch->get_batch.expired_tot_scan_cnt));
+       /* preestimate scan count until which scan result this report is going to end */
+       list_for_each_entry_safe(siter, snext,
+               &params_batch->get_batch.expired_scan_results_list, list) {
+               phead = siter->bestnetheader;
+               while (phead != NULL) {
+                       /* if left_size is less than bestheader total size , stop this */
+                       if (nleftsize <=
+                               (phead->tot_size + phead->tot_cnt * ENTRY_OVERHEAD))
+                               goto exit;
+                       /* increase scan count */
+                       cnt++;
+                       /* # best of each scan */
+                       DHD_PNO(("\n<loop : %d, apcount %d>\n", cnt - 1, phead->tot_cnt));
+                       /* attribute of the scan */
+                       if (phead->reason & PNO_STATUS_ABORT_MASK) {
+                               bp += nreadsize = sprintf(bp, "trunc\n");
+                               nleftsize -= nreadsize;
+                       }
+                       list_for_each_entry_safe(iter, next,
+                               &phead->entry_list, list) {
+                               t_delta = jiffies_to_msecs(jiffies - iter->recorded_time);
+#ifdef PNO_DEBUG
+                               _base_bp = bp;
+                               memset(msg, 0, sizeof(msg));
+#endif
+                               /* BSSID info */
+                               bp += nreadsize = sprintf(bp, "bssid=%s\n",
+                               bcm_ether_ntoa((const struct ether_addr *)&iter->BSSID, eabuf));
+                               nleftsize -= nreadsize;
+                               /* SSID */
+                               bp += nreadsize = sprintf(bp, "ssid=%s\n", iter->SSID);
+                               nleftsize -= nreadsize;
+                               /* channel */
+                               bp += nreadsize = sprintf(bp, "freq=%d\n",
+                               wf_channel2mhz(iter->channel,
+                               iter->channel <= CH_MAX_2G_CHANNEL?
+                               WF_CHAN_FACTOR_2_4_G : WF_CHAN_FACTOR_5_G));
+                               nleftsize -= nreadsize;
+                               /* RSSI */
+                               bp += nreadsize = sprintf(bp, "level=%d\n", iter->RSSI);
+                               nleftsize -= nreadsize;
+                               /* add the time consumed in Driver to the timestamp of firmware */
+                               iter->timestamp += t_delta;
+                               bp += nreadsize = sprintf(bp, "age=%d\n", iter->timestamp);
+                               nleftsize -= nreadsize;
+                               /* RTT0 */
+                               bp += nreadsize = sprintf(bp, "dist=%d\n",
+                               (iter->rtt0 == 0)? -1 : iter->rtt0);
+                               nleftsize -= nreadsize;
+                               /* RTT1 */
+                               bp += nreadsize = sprintf(bp, "distSd=%d\n",
+                               (iter->rtt0 == 0)? -1 : iter->rtt1);
+                               nleftsize -= nreadsize;
+                               bp += nreadsize = sprintf(bp, "%s", AP_END_MARKER);
+                               nleftsize -= nreadsize;
+                               list_del(&iter->list);
+                               MFREE(dhd->osh, iter, BESTNET_ENTRY_SIZE);
+#ifdef PNO_DEBUG
+                               memcpy(msg, _base_bp, bp - _base_bp);
+                               DHD_PNO(("Entry : \n%s", msg));
+#endif
+                       }
+                       bp += nreadsize = sprintf(bp, "%s", SCAN_END_MARKER);
+                       DHD_PNO(("%s", SCAN_END_MARKER));
+                       nleftsize -= nreadsize;
+                       pprev = phead;
+                       /* reset the header */
+                       siter->bestnetheader = phead = phead->next;
+                       MFREE(dhd->osh, pprev, BEST_HEADER_SIZE);
+
+                       siter->cnt_header--;
+               }
+               if (phead == NULL) {
+                       /* we store all entry in this scan , so it is ok to delete */
+                       list_del(&siter->list);
+                       MFREE(dhd->osh, siter, SCAN_RESULTS_SIZE);
+               }
+       }
+exit:
+       if (cnt < params_batch->get_batch.expired_tot_scan_cnt) {
+               DHD_ERROR(("Buffer size is small to save all batch entry,"
+                       " cnt : %d (remained_scan_cnt): %d\n",
+                       cnt, params_batch->get_batch.expired_tot_scan_cnt - cnt));
+       }
+       params_batch->get_batch.expired_tot_scan_cnt -= cnt;
+       /* set FALSE only if the link list  is empty after returning the data */
+       if (list_empty(&params_batch->get_batch.expired_scan_results_list)) {
+               params_batch->get_batch.batch_started = FALSE;
+               bp += sprintf(bp, "%s", RESULTS_END_MARKER);
+               DHD_PNO(("%s", RESULTS_END_MARKER));
+               DHD_PNO(("%s : Getting the batching data is complete\n", __FUNCTION__));
+       }
+       /* return used memory in buffer */
+       bytes_written = (int32)(bp - buf);
+       return bytes_written;
+}
+static int
+_dhd_pno_clear_all_batch_results(dhd_pub_t *dhd, struct list_head *head, bool only_last)
+{
+       int err = BCME_OK;
+       int removed_scan_cnt = 0;
+       dhd_pno_scan_results_t *siter, *snext;
+       dhd_pno_best_header_t *phead, *pprev;
+       dhd_pno_bestnet_entry_t *iter, *next;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(head, "head is NULL", err);
+       NULL_CHECK(head->next, "head->next is NULL", err);
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+       list_for_each_entry_safe(siter, snext,
+               head, list) {
+               if (only_last) {
+                       /* in case that we need to delete only last one */
+                       if (!list_is_last(&siter->list, head)) {
+                               /* skip if the one is not last */
+                               continue;
+                       }
+               }
+               /* delete all data belong if the one is last */
+               phead = siter->bestnetheader;
+               while (phead != NULL) {
+                       removed_scan_cnt++;
+                       list_for_each_entry_safe(iter, next,
+                       &phead->entry_list, list) {
+                               list_del(&iter->list);
+                               MFREE(dhd->osh, iter, BESTNET_ENTRY_SIZE);
+                       }
+                       pprev = phead;
+                       phead = phead->next;
+                       MFREE(dhd->osh, pprev, BEST_HEADER_SIZE);
+               }
+               if (phead == NULL) {
+                       /* it is ok to delete top node */
+                       list_del(&siter->list);
+                       MFREE(dhd->osh, siter, SCAN_RESULTS_SIZE);
+               }
+       }
+       return removed_scan_cnt;
+}
+
+static int
+_dhd_pno_cfg(dhd_pub_t *dhd, uint16 *channel_list, int nchan)
+{
+       int err = BCME_OK;
+       int i = 0;
+       wl_pfn_cfg_t pfncfg_param;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       if (nchan) {
+               NULL_CHECK(channel_list, "nchan is NULL", err);
+       }
+       DHD_PNO(("%s enter :  nchan : %d\n", __FUNCTION__, nchan));
+       memset(&pfncfg_param, 0, sizeof(wl_pfn_cfg_t));
+       /* Setup default values */
+       pfncfg_param.reporttype = htod32(WL_PFN_REPORT_ALLNET);
+       pfncfg_param.channel_num = htod32(0);
+
+       for (i = 0; i < nchan && nchan < WL_NUMCHANNELS; i++)
+               pfncfg_param.channel_list[i] = channel_list[i];
+
+       pfncfg_param.channel_num = htod32(nchan);
+       err = dhd_iovar(dhd, 0, "pfn_cfg", (char *)&pfncfg_param, sizeof(pfncfg_param), 1);
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to execute pfn_cfg\n", __FUNCTION__));
+               goto exit;
+       }
+exit:
+       return err;
+}
+static int
+_dhd_pno_reinitialize_prof(dhd_pub_t *dhd, dhd_pno_params_t *params, dhd_pno_mode_t mode)
+{
+       int err = BCME_OK;
+       dhd_pno_status_info_t *_pno_state;
+       NULL_CHECK(dhd, "dhd is NULL\n", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL\n", err);
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       mutex_lock(&_pno_state->pno_mutex);
+       switch (mode) {
+       case DHD_PNO_LEGACY_MODE: {
+               struct dhd_pno_ssid *iter, *next;
+               if (params->params_legacy.nssid > 0) {
+                       list_for_each_entry_safe(iter, next,
+                               &params->params_legacy.ssid_list, list) {
+                               list_del(&iter->list);
+                               kfree(iter);
+                       }
+               }
+               params->params_legacy.nssid = 0;
+               params->params_legacy.scan_fr = 0;
+               params->params_legacy.pno_freq_expo_max = 0;
+               params->params_legacy.pno_repeat = 0;
+               params->params_legacy.nchan = 0;
+               memset(params->params_legacy.chan_list, 0,
+                       sizeof(params->params_legacy.chan_list));
+               break;
+       }
+       case DHD_PNO_BATCH_MODE: {
+               params->params_batch.scan_fr = 0;
+               params->params_batch.mscan = 0;
+               params->params_batch.nchan = 0;
+               params->params_batch.rtt = 0;
+               params->params_batch.bestn = 0;
+               params->params_batch.nchan = 0;
+               params->params_batch.band = WLC_BAND_AUTO;
+               memset(params->params_batch.chan_list, 0,
+                       sizeof(params->params_batch.chan_list));
+               params->params_batch.get_batch.batch_started = FALSE;
+               params->params_batch.get_batch.buf = NULL;
+               params->params_batch.get_batch.bufsize = 0;
+               params->params_batch.get_batch.reason = 0;
+               _dhd_pno_clear_all_batch_results(dhd,
+                       &params->params_batch.get_batch.scan_results_list, FALSE);
+               _dhd_pno_clear_all_batch_results(dhd,
+                       &params->params_batch.get_batch.expired_scan_results_list, FALSE);
+               params->params_batch.get_batch.tot_scan_cnt = 0;
+               params->params_batch.get_batch.expired_tot_scan_cnt = 0;
+               params->params_batch.get_batch.top_node_cnt = 0;
+               INIT_LIST_HEAD(&params->params_batch.get_batch.scan_results_list);
+               INIT_LIST_HEAD(&params->params_batch.get_batch.expired_scan_results_list);
+               break;
+       }
+       case DHD_PNO_HOTLIST_MODE: {
+               struct dhd_pno_bssid *iter, *next;
+               if (params->params_hotlist.nbssid > 0) {
+                       list_for_each_entry_safe(iter, next,
+                               &params->params_hotlist.bssid_list, list) {
+                               list_del(&iter->list);
+                               kfree(iter);
+                       }
+               }
+               params->params_hotlist.scan_fr = 0;
+               params->params_hotlist.nbssid = 0;
+               params->params_hotlist.nchan = 0;
+               params->params_batch.band = WLC_BAND_AUTO;
+               memset(params->params_hotlist.chan_list, 0,
+                       sizeof(params->params_hotlist.chan_list));
+               break;
+       }
+       default:
+               DHD_ERROR(("%s : unknown mode : %d\n", __FUNCTION__, mode));
+               break;
+       }
+       mutex_unlock(&_pno_state->pno_mutex);
+       return err;
+}
+static int
+_dhd_pno_add_bssid(dhd_pub_t *dhd, wl_pfn_bssid_t *p_pfn_bssid, int nbssid)
+{
+       int err = BCME_OK;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       if (nbssid) {
+               NULL_CHECK(p_pfn_bssid, "bssid list is NULL", err);
+       }
+       err = dhd_iovar(dhd, 0, "pfn_add_bssid", (char *)p_pfn_bssid,
+               sizeof(wl_pfn_bssid_t) * nbssid, 1);
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to execute pfn_cfg\n", __FUNCTION__));
+               goto exit;
+       }
+exit:
+       return err;
+}
+
+#ifdef GSCAN_SUPPORT
+static int
+_dhd_pno_add_significant_bssid(dhd_pub_t *dhd,
+   wl_pfn_significant_bssid_t *p_pfn_significant_bssid, int nbssid)
+{
+       int err = BCME_OK;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+
+       if (!nbssid) {
+               err = BCME_ERROR;
+               goto exit;
+       }
+
+       NULL_CHECK(p_pfn_significant_bssid, "bssid list is NULL", err);
+
+       err = dhd_iovar(dhd, 0, "pfn_add_swc_bssid", (char *)p_pfn_significant_bssid,
+               sizeof(wl_pfn_significant_bssid_t) * nbssid, 1);
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to execute pfn_significant_bssid %d\n", __FUNCTION__, err));
+               goto exit;
+       }
+exit:
+       return err;
+}
+#endif /* GSCAN_SUPPORT */
+
+int
+dhd_pno_stop_for_ssid(dhd_pub_t *dhd)
+{
+       int err = BCME_OK;
+       uint32 mode = 0;
+       dhd_pno_status_info_t *_pno_state;
+       dhd_pno_params_t *_params;
+       wl_pfn_bssid_t *p_pfn_bssid = NULL;
+       NULL_CHECK(dhd, "dev is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       if (!(_pno_state->pno_mode & DHD_PNO_LEGACY_MODE)) {
+               DHD_ERROR(("%s : LEGACY PNO MODE is not enabled\n", __FUNCTION__));
+               goto exit;
+       }
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+       _pno_state->pno_mode &= ~DHD_PNO_LEGACY_MODE;
+#ifdef GSCAN_SUPPORT
+       if (_pno_state->pno_mode & DHD_PNO_GSCAN_MODE) {
+               struct dhd_pno_gscan_params *gscan_params;
+
+               _params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS];
+               gscan_params = &_params->params_gscan;
+
+               if (gscan_params->mscan)
+                       dhd_pno_get_for_batch(dhd, NULL, 0, PNO_STATUS_DISABLE);
+                       /* save current pno_mode before calling dhd_pno_clean */
+               mode = _pno_state->pno_mode;
+               err = dhd_pno_clean(dhd);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to call dhd_pno_clean (err: %d)\n",
+                               __FUNCTION__, err));
+                       goto exit;
+               }
+               /* restore previous pno_mode */
+               _pno_state->pno_mode = mode;
+               /* Restart gscan */
+               err = dhd_pno_initiate_gscan_request(dhd, 1, 0);
+               goto exit;
+       }
+#endif /* GSCAN_SUPPORT */
+       /* restart Batch mode  if the batch mode is on */
+       if (_pno_state->pno_mode & (DHD_PNO_BATCH_MODE | DHD_PNO_HOTLIST_MODE)) {
+               /* retrieve the batching data from firmware into host */
+               dhd_pno_get_for_batch(dhd, NULL, 0, PNO_STATUS_DISABLE);
+               /* save current pno_mode before calling dhd_pno_clean */
+               mode = _pno_state->pno_mode;
+               dhd_pno_clean(dhd);
+               /* restore previous pno_mode */
+               _pno_state->pno_mode = mode;
+               if (_pno_state->pno_mode & DHD_PNO_BATCH_MODE) {
+                       _params = &(_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS]);
+                       /* restart BATCH SCAN */
+                       err = dhd_pno_set_for_batch(dhd, &_params->params_batch);
+                       if (err < 0) {
+                               _pno_state->pno_mode &= ~DHD_PNO_BATCH_MODE;
+                               DHD_ERROR(("%s : failed to restart batch scan(err: %d)\n",
+                                       __FUNCTION__, err));
+                               goto exit;
+                       }
+               } else if (_pno_state->pno_mode & DHD_PNO_HOTLIST_MODE) {
+                       /* restart HOTLIST SCAN */
+                       struct dhd_pno_bssid *iter, *next;
+                       _params = &(_pno_state->pno_params_arr[INDEX_OF_HOTLIST_PARAMS]);
+                       p_pfn_bssid = kzalloc(sizeof(wl_pfn_bssid_t) *
+                       _params->params_hotlist.nbssid, GFP_KERNEL);
+                       if (p_pfn_bssid == NULL) {
+                               DHD_ERROR(("%s : failed to allocate wl_pfn_bssid_t array"
+                               " (count: %d)",
+                                       __FUNCTION__, _params->params_hotlist.nbssid));
+                               err = BCME_ERROR;
+                               _pno_state->pno_mode &= ~DHD_PNO_HOTLIST_MODE;
+                               goto exit;
+                       }
+                       /* convert dhd_pno_bssid to wl_pfn_bssid */
+                       list_for_each_entry_safe(iter, next,
+                       &_params->params_hotlist.bssid_list, list) {
+                               memcpy(&p_pfn_bssid->macaddr,
+                               &iter->macaddr, ETHER_ADDR_LEN);
+                               p_pfn_bssid->flags = iter->flags;
+                               p_pfn_bssid++;
+                       }
+                       err = dhd_pno_set_for_hotlist(dhd, p_pfn_bssid, &_params->params_hotlist);
+                       if (err < 0) {
+                               _pno_state->pno_mode &= ~DHD_PNO_HOTLIST_MODE;
+                               DHD_ERROR(("%s : failed to restart hotlist scan(err: %d)\n",
+                                       __FUNCTION__, err));
+                               goto exit;
+                       }
+               }
+       } else {
+               err = dhd_pno_clean(dhd);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to call dhd_pno_clean (err: %d)\n",
+                               __FUNCTION__, err));
+                       goto exit;
+               }
+       }
+exit:
+       kfree(p_pfn_bssid);
+       return err;
+}
+
+int
+dhd_pno_enable(dhd_pub_t *dhd, int enable)
+{
+       int err = BCME_OK;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+       return (_dhd_pno_enable(dhd, enable));
+}
+
+static wlc_ssid_ext_t *
+dhd_pno_get_legacy_pno_ssid(dhd_pub_t *dhd, dhd_pno_status_info_t *pno_state)
+{
+       int i;
+       struct dhd_pno_ssid *iter, *next;
+       dhd_pno_params_t        *_params1 = &pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS];
+       wlc_ssid_ext_t *p_ssid_list;
+
+       p_ssid_list = kzalloc(sizeof(wlc_ssid_ext_t) *
+                          _params1->params_legacy.nssid, GFP_KERNEL);
+       if (p_ssid_list == NULL) {
+               DHD_ERROR(("%s : failed to allocate wlc_ssid_ext_t array (count: %d)",
+                       __FUNCTION__, _params1->params_legacy.nssid));
+               pno_state->pno_mode &= ~DHD_PNO_LEGACY_MODE;
+               goto exit;
+       }
+       i = 0;
+       /* convert dhd_pno_ssid to wlc_ssid_ext_t */
+       list_for_each_entry_safe(iter, next, &_params1->params_legacy.ssid_list, list) {
+               p_ssid_list[i].SSID_len = iter->SSID_len;
+               p_ssid_list[i].hidden = iter->hidden;
+               memcpy(p_ssid_list[i].SSID, iter->SSID, p_ssid_list[i].SSID_len);
+               i++;
+       }
+exit:
+       return p_ssid_list;
+}
+
+static int
+dhd_pno_add_to_ssid_list(dhd_pno_params_t *params, wlc_ssid_ext_t *ssid_list,
+    int nssid)
+{
+       int ret = 0;
+       int i;
+       struct dhd_pno_ssid *_pno_ssid;
+
+       for (i = 0; i < nssid; i++) {
+               if (ssid_list[i].SSID_len > DOT11_MAX_SSID_LEN) {
+                       DHD_ERROR(("%s : Invalid SSID length %d\n",
+                               __FUNCTION__, ssid_list[i].SSID_len));
+                       ret = BCME_ERROR;
+                       goto exit;
+               }
+               _pno_ssid = kzalloc(sizeof(struct dhd_pno_ssid), GFP_KERNEL);
+               if (_pno_ssid == NULL) {
+                       DHD_ERROR(("%s : failed to allocate struct dhd_pno_ssid\n",
+                               __FUNCTION__));
+                       ret = BCME_ERROR;
+                       goto exit;
+               }
+               _pno_ssid->SSID_len = ssid_list[i].SSID_len;
+               _pno_ssid->hidden = ssid_list[i].hidden;
+               memcpy(_pno_ssid->SSID, ssid_list[i].SSID, _pno_ssid->SSID_len);
+               list_add_tail(&_pno_ssid->list, &params->params_legacy.ssid_list);
+       }
+
+exit:
+       return ret;
+}
+
+int
+dhd_pno_set_for_ssid(dhd_pub_t *dhd, wlc_ssid_ext_t* ssid_list, int nssid,
+       uint16  scan_fr, int pno_repeat, int pno_freq_expo_max, uint16 *channel_list, int nchan)
+{
+       dhd_pno_params_t *_params;
+       dhd_pno_params_t *_params2;
+       dhd_pno_status_info_t *_pno_state;
+       uint16 _chan_list[WL_NUMCHANNELS];
+       int32 tot_nchan = 0;
+       int err = BCME_OK;
+       int i;
+       int mode = 0;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+
+       if (!dhd_support_sta_mode(dhd)) {
+               err = BCME_BADOPTION;
+               goto exit_no_clear;
+       }
+       DHD_PNO(("%s enter : scan_fr :%d, pno_repeat :%d,"
+                       "pno_freq_expo_max: %d, nchan :%d\n", __FUNCTION__,
+                       scan_fr, pno_repeat, pno_freq_expo_max, nchan));
+
+       _params = &(_pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS]);
+       /* If GSCAN is also ON will handle this down below */
+#ifdef GSCAN_SUPPORT
+       if (_pno_state->pno_mode & DHD_PNO_LEGACY_MODE &&
+               !(_pno_state->pno_mode & DHD_PNO_GSCAN_MODE)) {
+#else
+               if (_pno_state->pno_mode & DHD_PNO_LEGACY_MODE) {
+#endif /* GSCAN_SUPPORT */
+               DHD_ERROR(("%s : Legacy PNO mode was already started, "
+                       "will disable previous one to start new one\n", __FUNCTION__));
+               err = dhd_pno_stop_for_ssid(dhd);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to stop legacy PNO (err %d)\n",
+                               __FUNCTION__, err));
+                       goto exit_no_clear;
+               }
+       }
+       _pno_state->pno_mode |= DHD_PNO_LEGACY_MODE;
+       err = _dhd_pno_reinitialize_prof(dhd, _params, DHD_PNO_LEGACY_MODE);
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to reinitialize profile (err %d)\n",
+                       __FUNCTION__, err));
+               goto exit_no_clear;
+       }
+       memset(_chan_list, 0, sizeof(_chan_list));
+       tot_nchan = MIN(nchan, WL_NUMCHANNELS);
+       if (tot_nchan > 0 && channel_list) {
+               for (i = 0; i < tot_nchan; i++)
+               _params->params_legacy.chan_list[i] = _chan_list[i] = channel_list[i];
+       }
+#ifdef GSCAN_SUPPORT
+       else {
+               tot_nchan = WL_NUMCHANNELS;
+               err = _dhd_pno_get_channels(dhd, _chan_list, &tot_nchan,
+                               (WLC_BAND_2G | WLC_BAND_5G), TRUE);
+               if (err < 0) {
+                       tot_nchan = 0;
+                       DHD_PNO(("Could not get channel list for PNO SSID\n"));
+               } else {
+                       for (i = 0; i < tot_nchan; i++)
+                       _params->params_legacy.chan_list[i] = _chan_list[i];
+               }
+       }
+#endif /* GSCAN_SUPPORT */
+
+       if (_pno_state->pno_mode & (DHD_PNO_BATCH_MODE | DHD_PNO_HOTLIST_MODE)) {
+               DHD_PNO(("BATCH SCAN is on progress in firmware\n"));
+               /* retrieve the batching data from firmware into host */
+               dhd_pno_get_for_batch(dhd, NULL, 0, PNO_STATUS_DISABLE);
+               /* store current pno_mode before disabling pno */
+               mode = _pno_state->pno_mode;
+               err = _dhd_pno_enable(dhd, PNO_OFF);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to disable PNO\n", __FUNCTION__));
+                       goto exit_no_clear;
+               }
+               /* restore the previous mode */
+               _pno_state->pno_mode = mode;
+               /* use superset of channel list between two mode */
+               if (_pno_state->pno_mode & DHD_PNO_BATCH_MODE) {
+                       _params2 = &(_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS]);
+                       if (_params2->params_batch.nchan > 0 && tot_nchan > 0) {
+                               err = _dhd_pno_chan_merge(_chan_list, &tot_nchan,
+                                       &_params2->params_batch.chan_list[0],
+                                       _params2->params_batch.nchan,
+                                       &channel_list[0], tot_nchan);
+                               if (err < 0) {
+                                       DHD_ERROR(("%s : failed to merge channel list"
+                                       " between legacy and batch\n",
+                                               __FUNCTION__));
+                                       goto exit_no_clear;
+                               }
+                       }  else {
+                               DHD_PNO(("superset channel will use"
+                               " all channels in firmware\n"));
+                       }
+               } else if (_pno_state->pno_mode & DHD_PNO_HOTLIST_MODE) {
+                       _params2 = &(_pno_state->pno_params_arr[INDEX_OF_HOTLIST_PARAMS]);
+                       if (_params2->params_hotlist.nchan > 0 && tot_nchan > 0) {
+                               err = _dhd_pno_chan_merge(_chan_list, &tot_nchan,
+                                       &_params2->params_hotlist.chan_list[0],
+                                       _params2->params_hotlist.nchan,
+                                       &channel_list[0], tot_nchan);
+                               if (err < 0) {
+                                       DHD_ERROR(("%s : failed to merge channel list"
+                                       " between legacy and hotlist\n",
+                                               __FUNCTION__));
+                                       goto exit_no_clear;
+                               }
+                       }
+               }
+       }
+       _params->params_legacy.scan_fr = scan_fr;
+       _params->params_legacy.pno_repeat = pno_repeat;
+       _params->params_legacy.pno_freq_expo_max = pno_freq_expo_max;
+       _params->params_legacy.nchan = tot_nchan;
+       _params->params_legacy.nssid = nssid;
+       INIT_LIST_HEAD(&_params->params_legacy.ssid_list);
+#ifdef GSCAN_SUPPORT
+       /* dhd_pno_initiate_gscan_request will handle simultaneous Legacy PNO and GSCAN */
+       if (_pno_state->pno_mode & DHD_PNO_GSCAN_MODE) {
+               if (dhd_pno_add_to_ssid_list(_params, ssid_list, nssid) < 0) {
+                       err = BCME_ERROR;
+                       goto exit;
+               }
+               DHD_PNO(("GSCAN mode is ON! Will restart GSCAN+Legacy PNO\n"));
+               err = dhd_pno_initiate_gscan_request(dhd, 1, 0);
+               goto exit;
+       }
+#endif /* GSCAN_SUPPORT */
+       if ((err = _dhd_pno_set(dhd, _params, DHD_PNO_LEGACY_MODE)) < 0) {
+               DHD_ERROR(("failed to set call pno_set (err %d) in firmware\n", err));
+               goto exit;
+       }
+       if ((err = _dhd_pno_add_ssid(dhd, ssid_list, nssid)) < 0) {
+               DHD_ERROR(("failed to add ssid list(err %d), %d in firmware\n", err, nssid));
+               goto exit;
+       }
+       if (dhd_pno_add_to_ssid_list(_params, ssid_list, nssid) < 0) {
+               err = BCME_ERROR;
+               goto exit;
+       }
+       if (tot_nchan > 0) {
+               if ((err = _dhd_pno_cfg(dhd, _chan_list, tot_nchan)) < 0) {
+                       DHD_ERROR(("%s : failed to set call pno_cfg (err %d) in firmware\n",
+                               __FUNCTION__, err));
+                       goto exit;
+               }
+       }
+       if (_pno_state->pno_status == DHD_PNO_DISABLED) {
+               if ((err = _dhd_pno_enable(dhd, PNO_ON)) < 0)
+                       DHD_ERROR(("%s : failed to enable PNO\n", __FUNCTION__));
+       }
+exit:
+       if (err < 0) {
+               _dhd_pno_reinitialize_prof(dhd, _params, DHD_PNO_LEGACY_MODE);
+       }
+exit_no_clear:
+       /* clear mode in case of error */
+       if (err < 0) {
+               int ret = dhd_pno_clean(dhd);
+
+               if (ret < 0) {
+                       DHD_ERROR(("%s : failed to call dhd_pno_clean (err: %d)\n",
+                               __FUNCTION__, ret));
+               } else {
+                       _pno_state->pno_mode &= ~DHD_PNO_LEGACY_MODE;
+               }
+       }
+       return err;
+}
+int
+dhd_pno_set_for_batch(dhd_pub_t *dhd, struct dhd_pno_batch_params *batch_params)
+{
+       int err = BCME_OK;
+       uint16 _chan_list[WL_NUMCHANNELS];
+       int rem_nchan = 0, tot_nchan = 0;
+       int mode = 0, mscan = 0;
+       dhd_pno_params_t *_params;
+       dhd_pno_params_t *_params2;
+       dhd_pno_status_info_t *_pno_state;
+       wlc_ssid_ext_t *p_ssid_list = NULL;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       NULL_CHECK(batch_params, "batch_params is NULL", err);
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+       if (!dhd_support_sta_mode(dhd)) {
+               err = BCME_BADOPTION;
+               goto exit;
+       }
+       if (!WLS_SUPPORTED(_pno_state)) {
+               DHD_ERROR(("%s : wifi location service is not supported\n", __FUNCTION__));
+               err = BCME_UNSUPPORTED;
+               goto exit;
+       }
+       _params = &_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS];
+       if (!(_pno_state->pno_mode & DHD_PNO_BATCH_MODE)) {
+               _pno_state->pno_mode |= DHD_PNO_BATCH_MODE;
+               err = _dhd_pno_reinitialize_prof(dhd, _params, DHD_PNO_BATCH_MODE);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to call _dhd_pno_reinitialize_prof\n",
+                               __FUNCTION__));
+                       goto exit;
+               }
+       } else {
+               /* batch mode is already started */
+               return -EBUSY;
+       }
+       _params->params_batch.scan_fr = batch_params->scan_fr;
+       _params->params_batch.bestn = batch_params->bestn;
+       _params->params_batch.mscan = (batch_params->mscan)?
+               batch_params->mscan : DEFAULT_BATCH_MSCAN;
+       _params->params_batch.nchan = batch_params->nchan;
+       memcpy(_params->params_batch.chan_list, batch_params->chan_list,
+               sizeof(_params->params_batch.chan_list));
+
+       memset(_chan_list, 0, sizeof(_chan_list));
+
+       rem_nchan = ARRAYSIZE(batch_params->chan_list) - batch_params->nchan;
+       if (batch_params->band == WLC_BAND_2G || batch_params->band == WLC_BAND_5G) {
+               /* get a valid channel list based on band B or A */
+               err = _dhd_pno_get_channels(dhd,
+               &_params->params_batch.chan_list[batch_params->nchan],
+               &rem_nchan, batch_params->band, FALSE);
+               if (err < 0) {
+                       DHD_ERROR(("%s: failed to get valid channel list(band : %d)\n",
+                               __FUNCTION__, batch_params->band));
+                       goto exit;
+               }
+               /* now we need to update nchan because rem_chan has valid channel count */
+               _params->params_batch.nchan += rem_nchan;
+               /* need to sort channel list */
+               sort(_params->params_batch.chan_list, _params->params_batch.nchan,
+                       sizeof(_params->params_batch.chan_list[0]), _dhd_pno_cmpfunc, NULL);
+       }
+#ifdef PNO_DEBUG
+{
+               DHD_PNO(("Channel list : "));
+               for (i = 0; i < _params->params_batch.nchan; i++) {
+                       DHD_PNO(("%d ", _params->params_batch.chan_list[i]));
+               }
+               DHD_PNO(("\n"));
+}
+#endif
+       if (_params->params_batch.nchan) {
+               /* copy the channel list into local array */
+               memcpy(_chan_list, _params->params_batch.chan_list, sizeof(_chan_list));
+               tot_nchan = _params->params_batch.nchan;
+       }
+       if (_pno_state->pno_mode & DHD_PNO_LEGACY_MODE) {
+               DHD_PNO(("PNO SSID is on progress in firmware\n"));
+               /* store current pno_mode before disabling pno */
+               mode = _pno_state->pno_mode;
+               err = _dhd_pno_enable(dhd, PNO_OFF);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to disable PNO\n", __FUNCTION__));
+                       goto exit;
+               }
+               /* restore the previous mode */
+               _pno_state->pno_mode = mode;
+               /* Use the superset for channelist between two mode */
+               _params2 = &(_pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS]);
+               if (_params2->params_legacy.nchan > 0 && _params->params_batch.nchan > 0) {
+                       err = _dhd_pno_chan_merge(_chan_list, &tot_nchan,
+                               &_params2->params_legacy.chan_list[0],
+                               _params2->params_legacy.nchan,
+                               &_params->params_batch.chan_list[0], _params->params_batch.nchan);
+                       if (err < 0) {
+                               DHD_ERROR(("%s : failed to merge channel list"
+                               " between legacy and batch\n",
+                                       __FUNCTION__));
+                               goto exit;
+                       }
+               } else {
+                       DHD_PNO(("superset channel will use all channels in firmware\n"));
+               }
+               p_ssid_list = dhd_pno_get_legacy_pno_ssid(dhd, _pno_state);
+               if (!p_ssid_list) {
+                       err = BCME_NOMEM;
+                       DHD_ERROR(("failed to get Legacy PNO SSID list\n"));
+                       goto exit;
+               }
+               if ((err = _dhd_pno_add_ssid(dhd, p_ssid_list,
+                       _params2->params_legacy.nssid)) < 0) {
+                       DHD_ERROR(("failed to add ssid list (err %d) in firmware\n", err));
+                       goto exit;
+               }
+       }
+       if ((err = _dhd_pno_set(dhd, _params, DHD_PNO_BATCH_MODE)) < 0) {
+               DHD_ERROR(("%s : failed to set call pno_set (err %d) in firmware\n",
+                       __FUNCTION__, err));
+               goto exit;
+       } else {
+               /* we need to return mscan */
+               mscan = err;
+       }
+       if (tot_nchan > 0) {
+               if ((err = _dhd_pno_cfg(dhd, _chan_list, tot_nchan)) < 0) {
+                       DHD_ERROR(("%s : failed to set call pno_cfg (err %d) in firmware\n",
+                               __FUNCTION__, err));
+                       goto exit;
+               }
+       }
+       if (_pno_state->pno_status == DHD_PNO_DISABLED) {
+               if ((err = _dhd_pno_enable(dhd, PNO_ON)) < 0)
+                       DHD_ERROR(("%s : failed to enable PNO\n", __FUNCTION__));
+       }
+exit:
+       /* clear mode in case of error */
+       if (err < 0)
+               _pno_state->pno_mode &= ~DHD_PNO_BATCH_MODE;
+       else {
+               /* return #max scan firmware can do */
+               err = mscan;
+       }
+       if (p_ssid_list)
+               kfree(p_ssid_list);
+       return err;
+}
+
+
+#ifdef GSCAN_SUPPORT
+static void
+dhd_pno_reset_cfg_gscan(dhd_pno_params_t *_params,
+            dhd_pno_status_info_t *_pno_state, uint8 flags)
+{
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+
+       if (flags & GSCAN_FLUSH_SCAN_CFG) {
+               _params->params_gscan.bestn = 0;
+               _params->params_gscan.mscan = 0;
+               _params->params_gscan.buffer_threshold = GSCAN_BATCH_NO_THR_SET;
+               _params->params_gscan.scan_fr = 0;
+               _params->params_gscan.send_all_results_flag = 0;
+               memset(_params->params_gscan.channel_bucket, 0,
+               _params->params_gscan.nchannel_buckets *
+                sizeof(struct dhd_pno_gscan_channel_bucket));
+               _params->params_gscan.nchannel_buckets = 0;
+               DHD_PNO(("Flush Scan config\n"));
+       }
+       if (flags & GSCAN_FLUSH_HOTLIST_CFG) {
+               struct dhd_pno_bssid *iter, *next;
+               if (_params->params_gscan.nbssid_hotlist > 0) {
+                       list_for_each_entry_safe(iter, next,
+                               &_params->params_gscan.hotlist_bssid_list, list) {
+                               list_del(&iter->list);
+                               kfree(iter);
+                       }
+               }
+               _params->params_gscan.nbssid_hotlist = 0;
+               DHD_PNO(("Flush Hotlist Config\n"));
+       }
+       if (flags & GSCAN_FLUSH_SIGNIFICANT_CFG) {
+               dhd_pno_significant_bssid_t *iter, *next;
+
+               if (_params->params_gscan.nbssid_significant_change > 0) {
+                       list_for_each_entry_safe(iter, next,
+                               &_params->params_gscan.significant_bssid_list, list) {
+                               list_del(&iter->list);
+                               kfree(iter);
+                       }
+               }
+               _params->params_gscan.nbssid_significant_change = 0;
+               DHD_PNO(("Flush Significant Change Config\n"));
+       }
+
+       return;
+}
+
+void
+dhd_pno_lock_batch_results(dhd_pub_t *dhd)
+{
+       dhd_pno_status_info_t *_pno_state;
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       mutex_lock(&_pno_state->pno_mutex);
+       return;
+}
+
+void
+dhd_pno_unlock_batch_results(dhd_pub_t *dhd)
+{
+       dhd_pno_status_info_t *_pno_state;
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       mutex_unlock(&_pno_state->pno_mutex);
+       return;
+}
+
+void
+dhd_wait_batch_results_complete(dhd_pub_t *dhd)
+{
+       dhd_pno_status_info_t *_pno_state;
+       dhd_pno_params_t *_params;
+
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       _params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS];
+
+       /* Has the workqueue finished its job already?? */
+       if (_params->params_gscan.get_batch_flag == GSCAN_BATCH_RETRIEVAL_IN_PROGRESS) {
+               DHD_PNO(("%s: Waiting to complete retrieval..\n", __FUNCTION__));
+               wait_event_interruptible_timeout(_pno_state->batch_get_wait,
+                    is_batch_retrieval_complete(&_params->params_gscan),
+                    msecs_to_jiffies(GSCAN_BATCH_GET_MAX_WAIT));
+       } else { /* GSCAN_BATCH_RETRIEVAL_COMPLETE */
+               gscan_results_cache_t *iter;
+               uint16 num_results = 0;
+               int err;
+
+               mutex_lock(&_pno_state->pno_mutex);
+               iter = _params->params_gscan.gscan_batch_cache;
+               while (iter) {
+                       num_results += iter->tot_count - iter->tot_consumed;
+                       iter = iter->next;
+               }
+               mutex_unlock(&_pno_state->pno_mutex);
+
+               /* All results consumed/No results cached??
+                * Get fresh results from FW
+                */
+               if (!num_results) {
+                       DHD_PNO(("%s: No results cached, getting from FW..\n", __FUNCTION__));
+                       err = dhd_retreive_batch_scan_results(dhd);
+                       if (err == BCME_OK) {
+                               wait_event_interruptible_timeout(_pno_state->batch_get_wait,
+                                 is_batch_retrieval_complete(&_params->params_gscan),
+                                 msecs_to_jiffies(GSCAN_BATCH_GET_MAX_WAIT));
+                       }
+               }
+       }
+       DHD_PNO(("%s: Wait complete\n", __FUNCTION__));
+
+       return;
+}
+
+static void *
+dhd_get_gscan_batch_results(dhd_pub_t *dhd, uint32 *len)
+{
+       gscan_results_cache_t *iter, *results;
+       dhd_pno_status_info_t *_pno_state;
+       dhd_pno_params_t *_params;
+       uint16 num_scan_ids = 0, num_results = 0;
+
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       _params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS];
+
+       iter = results = _params->params_gscan.gscan_batch_cache;
+       while (iter) {
+               num_results += iter->tot_count - iter->tot_consumed;
+               num_scan_ids++;
+               iter = iter->next;
+       }
+
+       *len = ((num_results << 16) | (num_scan_ids));
+       return results;
+}
+
+void *
+dhd_pno_get_gscan(dhd_pub_t *dhd, dhd_pno_gscan_cmd_cfg_t type,
+         void *info, uint32 *len)
+{
+       void *ret = NULL;
+       dhd_pno_gscan_capabilities_t *ptr;
+
+       if (!len) {
+               DHD_ERROR(("%s: len is NULL\n", __FUNCTION__));
+               return ret;
+       }
+
+       switch (type) {
+               case DHD_PNO_GET_CAPABILITIES:
+                       ptr = (dhd_pno_gscan_capabilities_t *)
+                       kmalloc(sizeof(dhd_pno_gscan_capabilities_t), GFP_KERNEL);
+                       if (!ptr)
+                               break;
+                       /* Hardcoding these values for now, need to get
+                        * these values from FW, will change in a later check-in
+                        */
+                       ptr->max_scan_cache_size = 12;
+                       ptr->max_scan_buckets = GSCAN_MAX_CH_BUCKETS;
+                       ptr->max_ap_cache_per_scan = 16;
+                       ptr->max_rssi_sample_size = PFN_SWC_RSSI_WINDOW_MAX;
+                       ptr->max_scan_reporting_threshold = 100;
+                       ptr->max_hotlist_aps = PFN_HOTLIST_MAX_NUM_APS;
+                       ptr->max_significant_wifi_change_aps = PFN_SWC_MAX_NUM_APS;
+                       ret = (void *)ptr;
+                       *len = sizeof(dhd_pno_gscan_capabilities_t);
+                       break;
+
+               case DHD_PNO_GET_BATCH_RESULTS:
+                       ret = dhd_get_gscan_batch_results(dhd, len);
+                       break;
+               case DHD_PNO_GET_CHANNEL_LIST:
+                       if (info) {
+                               uint16 ch_list[WL_NUMCHANNELS];
+                               uint32 *ptr, mem_needed, i;
+                               int32 err, nchan = WL_NUMCHANNELS;
+                               uint32 *gscan_band = (uint32 *) info;
+                               uint8 band = 0;
+
+                               /* No band specified?, nothing to do */
+                               if ((*gscan_band & GSCAN_BAND_MASK) == 0) {
+                                       DHD_PNO(("No band specified\n"));
+                                       *len = 0;
+                                       break;
+                               }
+
+                               /* HAL and DHD use different bits for 2.4G and
+                                * 5G in bitmap. Hence translating it here...
+                                */
+                               if (*gscan_band & GSCAN_BG_BAND_MASK) {
+                                       band |= WLC_BAND_2G;
+                               }
+                               if (*gscan_band & GSCAN_A_BAND_MASK) {
+                                       band |= WLC_BAND_5G;
+                               }
+
+                               err = _dhd_pno_get_channels(dhd, ch_list, &nchan,
+                                                         (band & GSCAN_ABG_BAND_MASK),
+                                                         !(*gscan_band & GSCAN_DFS_MASK));
+
+                               if (err < 0) {
+                                       DHD_ERROR(("%s: failed to get valid channel list\n",
+                                               __FUNCTION__));
+                                       *len = 0;
+                               } else {
+                                       mem_needed = sizeof(uint32) * nchan;
+                                       ptr = (uint32 *) kmalloc(mem_needed, GFP_KERNEL);
+                                       if (!ptr) {
+                                               DHD_ERROR(("%s: Unable to malloc %d bytes\n",
+                                                       __FUNCTION__, mem_needed));
+                                               break;
+                                       }
+                                       for (i = 0; i < nchan; i++) {
+                                               ptr[i] = wf_channel2mhz(ch_list[i],
+                                                       (ch_list[i] <= CH_MAX_2G_CHANNEL?
+                                                       WF_CHAN_FACTOR_2_4_G : WF_CHAN_FACTOR_5_G));
+                                       }
+                                       ret = ptr;
+                                       *len = mem_needed;
+                               }
+                       } else {
+                               *len = 0;
+                               DHD_ERROR(("%s: info buffer is NULL\n", __FUNCTION__));
+                       }
+                       break;
+
+               default:
+                       DHD_ERROR(("%s: Unrecognized cmd type - %d\n", __FUNCTION__, type));
+                       break;
+       }
+
+       return ret;
+
+}
+
+int
+dhd_pno_set_cfg_gscan(dhd_pub_t *dhd, dhd_pno_gscan_cmd_cfg_t type,
+    void *buf, uint8 flush)
+{
+       int err = BCME_OK;
+       dhd_pno_params_t *_params;
+       int i;
+       dhd_pno_status_info_t *_pno_state;
+
+       NULL_CHECK(dhd, "dhd is NULL", err);
+
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       _params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS];
+       mutex_lock(&_pno_state->pno_mutex);
+
+       switch (type) {
+               case DHD_PNO_BATCH_SCAN_CFG_ID:
+               {
+                       gscan_batch_params_t *ptr = (gscan_batch_params_t *)buf;
+                       _params->params_gscan.bestn = ptr->bestn;
+                       _params->params_gscan.mscan = ptr->mscan;
+                       _params->params_gscan.buffer_threshold = ptr->buffer_threshold;
+                       break;
+               }
+               case DHD_PNO_GEOFENCE_SCAN_CFG_ID:
+               {
+                       gscan_hotlist_scan_params_t *ptr = (gscan_hotlist_scan_params_t *)buf;
+                       struct dhd_pno_bssid *_pno_bssid;
+                       struct bssid_t *bssid_ptr;
+                       int8 flags;
+
+                       if (flush) {
+                               dhd_pno_reset_cfg_gscan(_params, _pno_state,
+                                   GSCAN_FLUSH_HOTLIST_CFG);
+                       }
+
+                       if (!ptr->nbssid) {
+                               break;
+                       }
+                       if (!_params->params_gscan.nbssid_hotlist) {
+                               INIT_LIST_HEAD(&_params->params_gscan.hotlist_bssid_list);
+                       }
+                       if ((_params->params_gscan.nbssid_hotlist +
+                                 ptr->nbssid) > PFN_SWC_MAX_NUM_APS) {
+                               DHD_ERROR(("Excessive number of hotlist APs programmed %d\n",
+                                    (_params->params_gscan.nbssid_hotlist +
+                                     ptr->nbssid)));
+                               err = BCME_RANGE;
+                               goto exit;
+                       }
+
+                       for (i = 0, bssid_ptr = ptr->bssid; i < ptr->nbssid; i++, bssid_ptr++) {
+                               _pno_bssid = kzalloc(sizeof(struct dhd_pno_bssid), GFP_KERNEL);
+
+                               if (!_pno_bssid) {
+                                       DHD_ERROR(("_pno_bssid is NULL, cannot kalloc %zd bytes",
+                                              sizeof(struct dhd_pno_bssid)));
+                                       err = BCME_NOMEM;
+                                       goto exit;
+                               }
+                               memcpy(&_pno_bssid->macaddr, &bssid_ptr->macaddr, ETHER_ADDR_LEN);
+
+                               flags = (int8) bssid_ptr->rssi_reporting_threshold;
+                               _pno_bssid->flags = flags  << WL_PFN_RSSI_SHIFT;
+                               list_add_tail(&_pno_bssid->list,
+                                  &_params->params_gscan.hotlist_bssid_list);
+                       }
+
+                       _params->params_gscan.nbssid_hotlist += ptr->nbssid;
+                       _params->params_gscan.lost_ap_window = ptr->lost_ap_window;
+                       break;
+               }
+               case DHD_PNO_SIGNIFICANT_SCAN_CFG_ID:
+               {
+                       gscan_swc_params_t *ptr = (gscan_swc_params_t *)buf;
+                       dhd_pno_significant_bssid_t *_pno_significant_change_bssid;
+                       wl_pfn_significant_bssid_t *significant_bssid_ptr;
+
+                       if (flush) {
+                               dhd_pno_reset_cfg_gscan(_params, _pno_state,
+                                  GSCAN_FLUSH_SIGNIFICANT_CFG);
+                       }
+
+                       if (!ptr->nbssid) {
+                               break;
+                       }
+                       if (!_params->params_gscan.nbssid_significant_change) {
+                               INIT_LIST_HEAD(&_params->params_gscan.significant_bssid_list);
+                       }
+                       if ((_params->params_gscan.nbssid_significant_change +
+                                 ptr->nbssid) > PFN_SWC_MAX_NUM_APS) {
+                               DHD_ERROR(("Excessive number of SWC APs programmed %d\n",
+                                    (_params->params_gscan.nbssid_significant_change +
+                                     ptr->nbssid)));
+                               err = BCME_RANGE;
+                               goto exit;
+                       }
+
+                       for (i = 0, significant_bssid_ptr = ptr->bssid_elem_list;
+                            i < ptr->nbssid; i++, significant_bssid_ptr++) {
+                               _pno_significant_change_bssid =
+                                     kzalloc(sizeof(dhd_pno_significant_bssid_t),
+                                     GFP_KERNEL);
+
+                               if (!_pno_significant_change_bssid) {
+                                       DHD_ERROR(("SWC bssidptr is NULL, cannot kalloc %zd bytes",
+                                       sizeof(dhd_pno_significant_bssid_t)));
+                                       err = BCME_NOMEM;
+                                       goto exit;
+                               }
+                               memcpy(&_pno_significant_change_bssid->BSSID,
+                                   &significant_bssid_ptr->macaddr, ETHER_ADDR_LEN);
+                               _pno_significant_change_bssid->rssi_low_threshold =
+                                   significant_bssid_ptr->rssi_low_threshold;
+                               _pno_significant_change_bssid->rssi_high_threshold =
+                                   significant_bssid_ptr->rssi_high_threshold;
+                               list_add_tail(&_pno_significant_change_bssid->list,
+                                   &_params->params_gscan.significant_bssid_list);
+                       }
+
+                       _params->params_gscan.swc_nbssid_threshold = ptr->swc_threshold;
+                       _params->params_gscan.swc_rssi_window_size = ptr->rssi_window;
+                       _params->params_gscan.lost_ap_window = ptr->lost_ap_window;
+                       _params->params_gscan.nbssid_significant_change += ptr->nbssid;
+                       break;
+               }
+               case DHD_PNO_SCAN_CFG_ID:
+               {
+                       int i, k, valid = 0;
+                       uint16 band, min;
+                       gscan_scan_params_t *ptr = (gscan_scan_params_t *)buf;
+                       struct dhd_pno_gscan_channel_bucket *ch_bucket;
+
+                       if (ptr->nchannel_buckets <= GSCAN_MAX_CH_BUCKETS) {
+                               _params->params_gscan.nchannel_buckets = ptr->nchannel_buckets;
+
+                               memcpy(_params->params_gscan.channel_bucket, ptr->channel_bucket,
+                                   _params->params_gscan.nchannel_buckets *
+                                   sizeof(struct dhd_pno_gscan_channel_bucket));
+                               min = ptr->channel_bucket[0].bucket_freq_multiple;
+                               ch_bucket = _params->params_gscan.channel_bucket;
+
+                               for (i = 0; i < ptr->nchannel_buckets; i++) {
+                                       band = ch_bucket[i].band;
+                                       for (k = 0; k < ptr->channel_bucket[i].num_channels; k++)  {
+                                               ch_bucket[i].chan_list[k] =
+                                               wf_mhz2channel(ptr->channel_bucket[i].chan_list[k],
+                                                       0);
+                                       }
+                                       ch_bucket[i].band = 0;
+                                       /* HAL and DHD use different bits for 2.4G and
+                                        * 5G in bitmap. Hence translating it here...
+                                        */
+                                       if (band & GSCAN_BG_BAND_MASK)
+                                               ch_bucket[i].band |= WLC_BAND_2G;
+
+                                       if (band & GSCAN_A_BAND_MASK)
+                                               ch_bucket[i].band |= WLC_BAND_5G;
+
+                                       if (band & GSCAN_DFS_MASK)
+                                               ch_bucket[i].band |= GSCAN_DFS_MASK;
+                                       if (ptr->scan_fr ==
+                                           ptr->channel_bucket[i].bucket_freq_multiple) {
+                                               valid = 1;
+                                       }
+                                       if (ptr->channel_bucket[i].bucket_freq_multiple < min)
+                                               min = ptr->channel_bucket[i].bucket_freq_multiple;
+
+                                       DHD_PNO(("band %d report_flag %d\n", ch_bucket[i].band,
+                                                 ch_bucket[i].report_flag));
+                               }
+                               if (!valid)
+                                       ptr->scan_fr = min;
+
+                               for (i = 0; i < ptr->nchannel_buckets; i++) {
+                                       ch_bucket[i].bucket_freq_multiple =
+                                       ch_bucket[i].bucket_freq_multiple/ptr->scan_fr;
+                               }
+                               _params->params_gscan.scan_fr = ptr->scan_fr;
+
+                               DHD_PNO(("num_buckets %d scan_fr %d\n", ptr->nchannel_buckets,
+                                       _params->params_gscan.scan_fr));
+                       } else {
+                               err = BCME_BADARG;
+                       }
+                       break;
+               }
+               default:
+                       err = BCME_BADARG;
+                       DHD_ERROR(("%s: Unrecognized cmd type - %d\n", __FUNCTION__, type));
+                       break;
+       }
+exit:
+       mutex_unlock(&_pno_state->pno_mutex);
+       return err;
+
+}
+
+
+static bool
+validate_gscan_params(struct dhd_pno_gscan_params *gscan_params)
+{
+       unsigned int i, k;
+
+       if (!gscan_params->scan_fr || !gscan_params->nchannel_buckets) {
+               DHD_ERROR(("%s : Scan freq - %d or number of channel buckets - %d is empty\n",
+                __FUNCTION__, gscan_params->scan_fr, gscan_params->nchannel_buckets));
+               return false;
+       }
+
+       for (i = 0; i < gscan_params->nchannel_buckets; i++) {
+               if (!gscan_params->channel_bucket[i].band) {
+                       for (k = 0; k < gscan_params->channel_bucket[i].num_channels; k++) {
+                               if (gscan_params->channel_bucket[i].chan_list[k] > CHANNEL_5G_MAX) {
+                                       DHD_ERROR(("%s : Unknown channel %d\n", __FUNCTION__,
+                                        gscan_params->channel_bucket[i].chan_list[k]));
+                                       return false;
+                               }
+                       }
+               }
+       }
+
+       return true;
+}
+
+static int
+dhd_pno_set_for_gscan(dhd_pub_t *dhd, struct dhd_pno_gscan_params *gscan_params)
+{
+       int err = BCME_OK;
+       int mode, i = 0, k;
+       uint16 _chan_list[WL_NUMCHANNELS];
+       int tot_nchan = 0;
+       int num_buckets_to_fw, tot_num_buckets, gscan_param_size = 0;
+       dhd_pno_status_info_t *_pno_state = PNO_GET_PNOSTATE(dhd);
+       wl_pfn_gscan_channel_bucket_t *ch_bucket = NULL;
+       wl_pfn_gscan_cfg_t *pfn_gscan_cfg_t = NULL;
+       wl_pfn_significant_bssid_t *p_pfn_significant_bssid = NULL;
+       wl_pfn_bssid_t *p_pfn_bssid = NULL;
+       wlc_ssid_ext_t *pssid_list = NULL;
+       dhd_pno_params_t        *params_legacy;
+       dhd_pno_params_t        *_params;
+
+       params_legacy = &_pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS];
+       _params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS];
+
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       NULL_CHECK(gscan_params, "gscan_params is NULL", err);
+
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+
+       if (!dhd_support_sta_mode(dhd)) {
+               err = BCME_BADOPTION;
+               goto exit;
+       }
+       if (!WLS_SUPPORTED(_pno_state)) {
+               DHD_ERROR(("%s : wifi location service is not supported\n", __FUNCTION__));
+               err = BCME_UNSUPPORTED;
+               goto exit;
+       }
+
+       if (!validate_gscan_params(gscan_params)) {
+               DHD_ERROR(("%s : Cannot start gscan - bad params\n", __FUNCTION__));
+               err = BCME_BADARG;
+               goto exit;
+       }
+       /* Create channel list based on channel buckets */
+       if (!(ch_bucket = dhd_pno_gscan_create_channel_list(dhd, _pno_state,
+           _chan_list, &tot_num_buckets, &num_buckets_to_fw))) {
+               goto exit;
+       }
+
+       if (_pno_state->pno_mode & (DHD_PNO_GSCAN_MODE | DHD_PNO_LEGACY_MODE)) {
+               /* store current pno_mode before disabling pno */
+               mode = _pno_state->pno_mode;
+               err = dhd_pno_clean(dhd);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to disable PNO\n", __FUNCTION__));
+                       goto exit;
+               }
+               /* restore the previous mode */
+               _pno_state->pno_mode = mode;
+       }
+
+       _pno_state->pno_mode |= DHD_PNO_GSCAN_MODE;
+
+       if (_pno_state->pno_mode & DHD_PNO_LEGACY_MODE) {
+               pssid_list = dhd_pno_get_legacy_pno_ssid(dhd, _pno_state);
+
+               if (!pssid_list) {
+                       err = BCME_NOMEM;
+                       DHD_ERROR(("failed to get Legacy PNO SSID list\n"));
+                       goto exit;
+               }
+
+               if ((err = _dhd_pno_add_ssid(dhd, pssid_list,
+                       params_legacy->params_legacy.nssid)) < 0) {
+                       DHD_ERROR(("failed to add ssid list (err %d) in firmware\n", err));
+                       goto exit;
+               }
+       }
+
+       if ((err = _dhd_pno_set(dhd, _params, DHD_PNO_GSCAN_MODE)) < 0) {
+               DHD_ERROR(("failed to set call pno_set (err %d) in firmware\n", err));
+               goto exit;
+       }
+
+       gscan_param_size = sizeof(wl_pfn_gscan_cfg_t) +
+                 (num_buckets_to_fw - 1) * sizeof(wl_pfn_gscan_channel_bucket_t);
+       pfn_gscan_cfg_t = (wl_pfn_gscan_cfg_t *) MALLOC(dhd->osh, gscan_param_size);
+
+       if (!pfn_gscan_cfg_t) {
+               DHD_ERROR(("%s: failed to malloc memory of size %d\n",
+                  __FUNCTION__, gscan_param_size));
+               err = BCME_NOMEM;
+               goto exit;
+       }
+
+
+       if (gscan_params->mscan) {
+               pfn_gscan_cfg_t->buffer_threshold = gscan_params->buffer_threshold;
+       } else {
+               pfn_gscan_cfg_t->buffer_threshold = GSCAN_BATCH_NO_THR_SET;
+       }
+       if (gscan_params->nbssid_significant_change) {
+               pfn_gscan_cfg_t->swc_nbssid_threshold = gscan_params->swc_nbssid_threshold;
+               pfn_gscan_cfg_t->swc_rssi_window_size = gscan_params->swc_rssi_window_size;
+               pfn_gscan_cfg_t->lost_ap_window = gscan_params->lost_ap_window;
+       } else {
+               pfn_gscan_cfg_t->swc_nbssid_threshold = 0;
+               pfn_gscan_cfg_t->swc_rssi_window_size = 0;
+               pfn_gscan_cfg_t->lost_ap_window = 0;
+       }
+
+       pfn_gscan_cfg_t->flags =
+                (gscan_params->send_all_results_flag & GSCAN_SEND_ALL_RESULTS_MASK);
+       pfn_gscan_cfg_t->count_of_channel_buckets = num_buckets_to_fw;
+
+
+       for (i = 0, k = 0; i < tot_num_buckets; i++) {
+               if (ch_bucket[i].bucket_end_index  != CHANNEL_BUCKET_EMPTY_INDEX) {
+                       pfn_gscan_cfg_t->channel_bucket[k].bucket_end_index =
+                                  ch_bucket[i].bucket_end_index;
+                       pfn_gscan_cfg_t->channel_bucket[k].bucket_freq_multiple =
+                                  ch_bucket[i].bucket_freq_multiple;
+                       pfn_gscan_cfg_t->channel_bucket[k].report_flag =
+                               ch_bucket[i].report_flag;
+                       k++;
+               }
+       }
+
+       tot_nchan = pfn_gscan_cfg_t->channel_bucket[num_buckets_to_fw - 1].bucket_end_index + 1;
+       DHD_PNO(("Total channel num %d total ch_buckets  %d ch_buckets_to_fw %d \n", tot_nchan,
+             tot_num_buckets, num_buckets_to_fw));
+
+       if ((err = _dhd_pno_cfg(dhd, _chan_list, tot_nchan)) < 0) {
+               DHD_ERROR(("%s : failed to set call pno_cfg (err %d) in firmware\n",
+                       __FUNCTION__, err));
+               goto exit;
+       }
+
+       if ((err = _dhd_pno_gscan_cfg(dhd, pfn_gscan_cfg_t, gscan_param_size)) < 0) {
+               DHD_ERROR(("%s : failed to set call pno_gscan_cfg (err %d) in firmware\n",
+                       __FUNCTION__, err));
+               goto exit;
+       }
+       if (gscan_params->nbssid_significant_change) {
+               dhd_pno_significant_bssid_t *iter, *next;
+
+
+               p_pfn_significant_bssid = kzalloc(sizeof(wl_pfn_significant_bssid_t) *
+                                  gscan_params->nbssid_significant_change, GFP_KERNEL);
+               if (p_pfn_significant_bssid == NULL) {
+                       DHD_ERROR(("%s : failed to allocate memory %zd\n",
+                               __FUNCTION__,
+                               sizeof(wl_pfn_significant_bssid_t) *
+                               gscan_params->nbssid_significant_change));
+                       err = BCME_NOMEM;
+                       goto exit;
+               }
+               i = 0;
+               /* convert dhd_pno_significant_bssid_t to wl_pfn_significant_bssid_t */
+               list_for_each_entry_safe(iter, next, &gscan_params->significant_bssid_list, list) {
+                       p_pfn_significant_bssid[i].rssi_low_threshold = iter->rssi_low_threshold;
+                       p_pfn_significant_bssid[i].rssi_high_threshold = iter->rssi_high_threshold;
+                       memcpy(&p_pfn_significant_bssid[i].macaddr, &iter->BSSID, ETHER_ADDR_LEN);
+                       i++;
+               }
+               DHD_PNO(("nbssid_significant_change %d \n",
+                               gscan_params->nbssid_significant_change));
+               err = _dhd_pno_add_significant_bssid(dhd, p_pfn_significant_bssid,
+                                    gscan_params->nbssid_significant_change);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to call _dhd_pno_add_significant_bssid(err :%d)\n",
+                               __FUNCTION__, err));
+                       goto exit;
+               }
+       }
+
+       if (gscan_params->nbssid_hotlist) {
+               struct dhd_pno_bssid *iter, *next;
+               wl_pfn_bssid_t *ptr;
+               p_pfn_bssid = (wl_pfn_bssid_t *)kzalloc(sizeof(wl_pfn_bssid_t) *
+                      gscan_params->nbssid_hotlist, GFP_KERNEL);
+               if (p_pfn_bssid == NULL) {
+                       DHD_ERROR(("%s : failed to allocate wl_pfn_bssid_t array"
+                       " (count: %d)",
+                               __FUNCTION__, _params->params_hotlist.nbssid));
+                       err = BCME_NOMEM;
+                       _pno_state->pno_mode &= ~DHD_PNO_HOTLIST_MODE;
+                       goto exit;
+               }
+               ptr = p_pfn_bssid;
+               /* convert dhd_pno_bssid to wl_pfn_bssid */
+               DHD_PNO(("nhotlist %d\n", gscan_params->nbssid_hotlist));
+               list_for_each_entry_safe(iter, next,
+                         &gscan_params->hotlist_bssid_list, list) {
+                       memcpy(&ptr->macaddr,
+                       &iter->macaddr, ETHER_ADDR_LEN);
+                       ptr->flags = iter->flags;
+                       ptr++;
+               }
+
+               err = _dhd_pno_add_bssid(dhd, p_pfn_bssid, gscan_params->nbssid_hotlist);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to call _dhd_pno_add_bssid(err :%d)\n",
+                               __FUNCTION__, err));
+                       goto exit;
+               }
+       }
+
+       if ((err = _dhd_pno_enable(dhd, PNO_ON)) < 0) {
+               DHD_ERROR(("%s : failed to enable PNO err %d\n", __FUNCTION__, err));
+       }
+
+exit:
+       /* clear mode in case of error */
+       if (err < 0) {
+               int ret = dhd_pno_clean(dhd);
+
+               if (ret < 0) {
+                       DHD_ERROR(("%s : failed to call dhd_pno_clean (err: %d)\n",
+                               __FUNCTION__, ret));
+               } else {
+                       _pno_state->pno_mode &= ~DHD_PNO_GSCAN_MODE;
+               }
+       }
+       kfree(pssid_list);
+       kfree(p_pfn_significant_bssid);
+       kfree(p_pfn_bssid);
+       if (pfn_gscan_cfg_t) {
+               MFREE(dhd->osh, pfn_gscan_cfg_t, gscan_param_size);
+       }
+       if (ch_bucket) {
+               MFREE(dhd->osh, ch_bucket,
+               (tot_num_buckets * sizeof(wl_pfn_gscan_channel_bucket_t)));
+       }
+       return err;
+
+}
+
+
+static void
+dhd_pno_merge_gscan_pno_channels(dhd_pno_status_info_t *pno_state,
+                                uint16 *chan_list,
+                                uint8 *ch_scratch_pad,
+                                wl_pfn_gscan_channel_bucket_t *ch_bucket,
+                                uint32 *num_buckets_to_fw,
+                                int num_channels)
+{
+       uint16 chan_buf[WL_NUMCHANNELS];
+       int i, j = 0, ch_bucket_idx = 0;
+       dhd_pno_params_t *_params = &pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS];
+       dhd_pno_params_t *_params1 = &pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS];
+       uint16 *legacy_chan_list = _params1->params_legacy.chan_list;
+       bool is_legacy_scan_freq_higher;
+       uint8 report_flag = CH_BUCKET_REPORT_REGULAR;
+
+       if (!_params1->params_legacy.scan_fr)
+               _params1->params_legacy.scan_fr = PNO_SCAN_MIN_FW_SEC;
+
+       is_legacy_scan_freq_higher =
+            _params->params_gscan.scan_fr < _params1->params_legacy.scan_fr;
+
+       /* Calculate new Legacy scan multiple of base scan_freq
+       * The legacy PNO channel bucket is added at the end of the
+       * channel bucket list.
+       */
+       if (is_legacy_scan_freq_higher) {
+               ch_bucket[_params->params_gscan.nchannel_buckets].bucket_freq_multiple =
+               _params1->params_legacy.scan_fr/_params->params_gscan.scan_fr;
+
+       } else {
+               uint16 max = 0;
+
+               /* Calculate new multiple of base scan_freq for gscan buckets */
+               ch_bucket[_params->params_gscan.nchannel_buckets].bucket_freq_multiple = 1;
+               for (i = 0; i < _params->params_gscan.nchannel_buckets; i++) {
+                       ch_bucket[i].bucket_freq_multiple *= _params->params_gscan.scan_fr;
+                       ch_bucket[i].bucket_freq_multiple /= _params1->params_legacy.scan_fr;
+                       if (max < ch_bucket[i].bucket_freq_multiple)
+                               max = ch_bucket[i].bucket_freq_multiple;
+               }
+               _params->params_gscan.max_ch_bucket_freq =  max;
+       }
+
+       /* Off to remove duplicates!!
+        * Find channels that are already being serviced by gscan before legacy bucket
+        * These have to be removed from legacy bucket.
+        *  !!Assuming chan_list channels are validated list of channels!!
+        * ch_scratch_pad is 1 at gscan bucket locations see dhd_pno_gscan_create_channel_list()
+        */
+       for (i = 0; i < _params1->params_legacy.nchan; i++)
+               ch_scratch_pad[legacy_chan_list[i]] += 2;
+
+       ch_bucket_idx = 0;
+       memcpy(chan_buf, chan_list, num_channels * sizeof(uint16));
+
+       /* Finally create channel list and bucket
+        * At this point ch_scratch_pad can have 4 values:
+        * 0 - Channel not present in either Gscan or Legacy PNO bucket
+        * 1 - Channel present only in Gscan bucket
+        * 2 - Channel present only in Legacy PNO bucket
+        * 3 - Channel present in both Gscan and Legacy PNO buckets
+        * Thus Gscan buckets can have values 1 or 3 and Legacy 2 or 3
+        * For channel buckets with scan_freq < legacy accept all
+        * channels i.e. ch_scratch_pad = 1 and 3
+        * else accept only ch_scratch_pad = 1 and mark rejects as
+        * ch_scratch_pad = 4 so that they go in legacy
+        */
+       for (i = 0; i < _params->params_gscan.nchannel_buckets; i++) {
+               if (ch_bucket[i].bucket_freq_multiple <=
+               ch_bucket[_params->params_gscan.nchannel_buckets].bucket_freq_multiple) {
+                       for (; ch_bucket_idx <= ch_bucket[i].bucket_end_index; ch_bucket_idx++, j++)
+                               chan_list[j] = chan_buf[ch_bucket_idx];
+
+                       ch_bucket[i].bucket_end_index = j - 1;
+               } else {
+                       num_channels = 0;
+                       for (; ch_bucket_idx <= ch_bucket[i].bucket_end_index; ch_bucket_idx++) {
+                               if (ch_scratch_pad[chan_buf[ch_bucket_idx]] == 1) {
+                                       chan_list[j] = chan_buf[ch_bucket_idx];
+                                       j++;
+                                       num_channels++;
+                               } else {
+                                       ch_scratch_pad[chan_buf[ch_bucket_idx]] = 4;
+                                       /* If Gscan channel is merged off to legacy bucket and
+                                        * if the gscan channel bucket has a report flag > 0
+                                        * use the same for legacy
+                                        */
+                                       if (report_flag < ch_bucket[i].report_flag)
+                                               report_flag = ch_bucket[i].report_flag;
+                               }
+                       }
+
+                       if (num_channels) {
+                               ch_bucket[i].bucket_end_index = j - 1;
+                       } else {
+                               ch_bucket[i].bucket_end_index = CHANNEL_BUCKET_EMPTY_INDEX;
+                               *num_buckets_to_fw = *num_buckets_to_fw - 1;
+                       }
+               }
+
+       }
+
+       num_channels = 0;
+       ch_bucket[_params->params_gscan.nchannel_buckets].report_flag = report_flag;
+       /* Now add channels to the legacy scan bucket
+        * ch_scratch_pad = 0 to 4 at this point, for legacy -> 2,3,4. 2 means exclusively
+        * Legacy so add to bucket. 4 means it is a reject of gscan bucket and must
+        * be added to Legacy bucket,reject 3
+        */
+       for (i = 0; i < _params1->params_legacy.nchan; i++) {
+               if (ch_scratch_pad[legacy_chan_list[i]] != 3) {
+                       chan_list[j] = legacy_chan_list[i];
+                       j++;
+                       num_channels++;
+               }
+       }
+       if (num_channels) {
+               ch_bucket[_params->params_gscan.nchannel_buckets].bucket_end_index = j - 1;
+       }
+       else {
+               ch_bucket[_params->params_gscan.nchannel_buckets].bucket_end_index =
+                           CHANNEL_BUCKET_EMPTY_INDEX;
+               *num_buckets_to_fw = *num_buckets_to_fw - 1;
+       }
+
+       return;
+}
+static wl_pfn_gscan_channel_bucket_t *
+dhd_pno_gscan_create_channel_list(dhd_pub_t *dhd,
+                                  dhd_pno_status_info_t *_pno_state,
+                                  uint16 *chan_list,
+                                  uint32 *num_buckets,
+                                  uint32 *num_buckets_to_fw)
+{
+       int i, num_channels, err, nchan = WL_NUMCHANNELS;
+       uint16 *ptr = chan_list, max;
+       uint8 *ch_scratch_pad;
+       wl_pfn_gscan_channel_bucket_t *ch_bucket;
+       dhd_pno_params_t *_params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS];
+       bool is_pno_legacy_running = _pno_state->pno_mode & DHD_PNO_LEGACY_MODE;
+       dhd_pno_gscan_channel_bucket_t *gscan_buckets = _params->params_gscan.channel_bucket;
+
+       if (is_pno_legacy_running)
+               *num_buckets = _params->params_gscan.nchannel_buckets + 1;
+        else
+               *num_buckets = _params->params_gscan.nchannel_buckets;
+
+
+       *num_buckets_to_fw = *num_buckets;
+
+
+       ch_bucket = (wl_pfn_gscan_channel_bucket_t *) MALLOC(dhd->osh,
+               ((*num_buckets) * sizeof(wl_pfn_gscan_channel_bucket_t)));
+
+       if (!ch_bucket) {
+               DHD_ERROR(("%s: failed to malloc memory of size %zd\n",
+                       __FUNCTION__, (*num_buckets) * sizeof(wl_pfn_gscan_channel_bucket_t)));
+               *num_buckets_to_fw = *num_buckets = 0;
+               return NULL;
+       }
+
+       max = gscan_buckets[0].bucket_freq_multiple;
+       num_channels = 0;
+       for (i = 0; i < _params->params_gscan.nchannel_buckets; i++) {
+               if (!gscan_buckets[i].band) {
+                       num_channels += gscan_buckets[i].num_channels;
+                       memcpy(ptr, gscan_buckets[i].chan_list,
+                           gscan_buckets[i].num_channels * sizeof(uint16));
+                       ptr = ptr + gscan_buckets[i].num_channels;
+               } else {
+                       /* get a valid channel list based on band B or A */
+                       err = _dhd_pno_get_channels(dhd, ptr,
+                               &nchan, (gscan_buckets[i].band & GSCAN_ABG_BAND_MASK),
+                               !(gscan_buckets[i].band & GSCAN_DFS_MASK));
+
+                       if (err < 0) {
+                               DHD_ERROR(("%s: failed to get valid channel list(band : %d)\n",
+                                       __FUNCTION__, gscan_buckets[i].band));
+                               MFREE(dhd->osh, ch_bucket,
+                                     ((*num_buckets) * sizeof(wl_pfn_gscan_channel_bucket_t)));
+                               *num_buckets_to_fw = *num_buckets = 0;
+                               return NULL;
+                       }
+
+                       num_channels += nchan;
+                       ptr = ptr + nchan;
+               }
+
+               ch_bucket[i].bucket_end_index = num_channels - 1;
+               ch_bucket[i].bucket_freq_multiple = gscan_buckets[i].bucket_freq_multiple;
+               ch_bucket[i].report_flag = gscan_buckets[i].report_flag;
+               if (max < gscan_buckets[i].bucket_freq_multiple)
+                       max = gscan_buckets[i].bucket_freq_multiple;
+               nchan = WL_NUMCHANNELS - num_channels;
+               DHD_PNO(("end_idx  %d freq_mult - %d\n",
+               ch_bucket[i].bucket_end_index, ch_bucket[i].bucket_freq_multiple));
+       }
+
+       ch_scratch_pad = (uint8 *) kzalloc(CHANNEL_5G_MAX, GFP_KERNEL);
+       if (!ch_scratch_pad) {
+               DHD_ERROR(("%s: failed to malloc memory of size %d\n",
+                       __FUNCTION__, CHANNEL_5G_MAX));
+               MFREE(dhd->osh, ch_bucket,
+                     ((*num_buckets) * sizeof(wl_pfn_gscan_channel_bucket_t)));
+               *num_buckets_to_fw = *num_buckets = 0;
+               return NULL;
+       }
+
+       /* Need to look for duplicates in gscan buckets if the framework programmed
+        * the gscan buckets badly, for now return error if there are duplicates.
+        * Plus as an added bonus, we get all channels in Gscan bucket
+        * set to 1 for dhd_pno_merge_gscan_pno_channels()
+        */
+       for (i = 0; i < num_channels; i++) {
+               if (!ch_scratch_pad[chan_list[i]]) {
+                       ch_scratch_pad[chan_list[i]] = 1;
+               } else {
+                       DHD_ERROR(("%s: Duplicate channel - %d programmed in channel bucket\n",
+                               __FUNCTION__, chan_list[i]));
+                       MFREE(dhd->osh, ch_bucket, ((*num_buckets) *
+                            sizeof(wl_pfn_gscan_channel_bucket_t)));
+                       *num_buckets_to_fw = *num_buckets = 0;
+                       kfree(ch_scratch_pad);
+                       return NULL;
+               }
+       }
+       _params->params_gscan.max_ch_bucket_freq = max;
+       /* Legacy PNO maybe running, which means we need to create a legacy PNO bucket
+        * Plus need to remove duplicates as the legacy PNO chan_list may have common channels
+        * If channel is to be scanned more frequently as per gscan requirements
+        * remove from legacy PNO ch_bucket. Similarly, if legacy wants a channel scanned
+        * more often, it is removed from the Gscan channel bucket.
+        * In the end both are satisfied.
+        */
+       if (is_pno_legacy_running)
+               dhd_pno_merge_gscan_pno_channels(_pno_state, chan_list,
+                   ch_scratch_pad, ch_bucket, num_buckets_to_fw, num_channels);
+
+       kfree(ch_scratch_pad);
+       return ch_bucket;
+}
+
+static int
+dhd_pno_stop_for_gscan(dhd_pub_t *dhd)
+{
+       int err = BCME_OK;
+       int mode;
+       wlc_ssid_ext_t *pssid_list = NULL;
+       dhd_pno_status_info_t *_pno_state;
+
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+
+       if (!dhd_support_sta_mode(dhd)) {
+               err = BCME_BADOPTION;
+               goto exit;
+       }
+       if (!WLS_SUPPORTED(_pno_state)) {
+               DHD_ERROR(("%s : wifi location service is not supported\n",
+                       __FUNCTION__));
+               err = BCME_UNSUPPORTED;
+               goto exit;
+       }
+
+       if (!(_pno_state->pno_mode & DHD_PNO_GSCAN_MODE)) {
+               DHD_ERROR(("%s : GSCAN is not enabled\n", __FUNCTION__));
+               goto exit;
+       }
+       mutex_lock(&_pno_state->pno_mutex);
+       mode = _pno_state->pno_mode & ~DHD_PNO_GSCAN_MODE;
+       err = dhd_pno_clean(dhd);
+       if (err < 0) {
+
+               DHD_ERROR(("%s : failed to call dhd_pno_clean (err: %d)\n",
+                       __FUNCTION__, err));
+               mutex_unlock(&_pno_state->pno_mutex);
+               return err;
+       }
+       _pno_state->pno_mode = mode;
+       mutex_unlock(&_pno_state->pno_mutex);
+
+       /* Reprogram Legacy PNO if it was running */
+       if (_pno_state->pno_mode & DHD_PNO_LEGACY_MODE) {
+               struct dhd_pno_legacy_params *params_legacy;
+               uint16 chan_list[WL_NUMCHANNELS];
+
+               params_legacy = &(_pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS].params_legacy);
+               _pno_state->pno_mode &= ~DHD_PNO_LEGACY_MODE;
+               pssid_list = dhd_pno_get_legacy_pno_ssid(dhd, _pno_state);
+               if (!pssid_list) {
+                       err = BCME_NOMEM;
+                       DHD_ERROR(("failed to get Legacy PNO SSID list\n"));
+                       goto exit;
+               }
+
+               DHD_PNO(("Restarting Legacy PNO SSID scan...\n"));
+               memcpy(chan_list, params_legacy->chan_list,
+                   (params_legacy->nchan * sizeof(uint16)));
+               err = dhd_pno_set_for_ssid(dhd, pssid_list, params_legacy->nssid,
+                       params_legacy->scan_fr, params_legacy->pno_repeat,
+                       params_legacy->pno_freq_expo_max, chan_list,
+                       params_legacy->nchan);
+               if (err < 0) {
+                       _pno_state->pno_mode &= ~DHD_PNO_LEGACY_MODE;
+                       DHD_ERROR(("%s : failed to restart legacy PNO scan(err: %d)\n",
+                               __FUNCTION__, err));
+                       goto exit;
+               }
+
+       }
+
+exit:
+       kfree(pssid_list);
+       return err;
+}
+
+int
+dhd_pno_initiate_gscan_request(dhd_pub_t *dhd, bool run, bool flush)
+{
+       int err = BCME_OK;
+       dhd_pno_params_t *params;
+       dhd_pno_status_info_t *_pno_state;
+       struct dhd_pno_gscan_params *gscan_params;
+
+       NULL_CHECK(dhd, "dhd is NULL\n", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+
+       DHD_PNO(("%s enter - run %d flush %d\n", __FUNCTION__, run, flush));
+       params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS];
+       gscan_params = &params->params_gscan;
+
+       if (run) {
+               err = dhd_pno_set_for_gscan(dhd, gscan_params);
+       } else {
+               if (flush) {
+                       mutex_lock(&_pno_state->pno_mutex);
+                       dhd_pno_reset_cfg_gscan(params, _pno_state, GSCAN_FLUSH_ALL_CFG);
+                       mutex_unlock(&_pno_state->pno_mutex);
+               }
+               /* Need to stop all gscan */
+               err = dhd_pno_stop_for_gscan(dhd);
+       }
+
+       return err;
+}
+
+int
+dhd_pno_enable_full_scan_result(dhd_pub_t *dhd, bool real_time_flag)
+{
+       int err = BCME_OK;
+       dhd_pno_params_t *params;
+       dhd_pno_status_info_t *_pno_state;
+       struct dhd_pno_gscan_params *gscan_params;
+       uint8 old_flag;
+
+       NULL_CHECK(dhd, "dhd is NULL\n", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+
+       if (!WLS_SUPPORTED(_pno_state)) {
+               DHD_ERROR(("%s : wifi location service is not supported\n", __FUNCTION__));
+               err = BCME_UNSUPPORTED;
+               goto exit;
+       }
+
+       params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS];
+       gscan_params = &params->params_gscan;
+
+       mutex_lock(&_pno_state->pno_mutex);
+
+       old_flag = gscan_params->send_all_results_flag;
+       gscan_params->send_all_results_flag = (uint8) real_time_flag;
+       if (_pno_state->pno_mode & DHD_PNO_GSCAN_MODE) {
+           if (old_flag != gscan_params->send_all_results_flag) {
+                       wl_pfn_gscan_cfg_t gscan_cfg;
+                       gscan_cfg.flags = (gscan_params->send_all_results_flag &
+                               GSCAN_SEND_ALL_RESULTS_MASK);
+                       gscan_cfg.flags |= GSCAN_CFG_FLAGS_ONLY_MASK;
+
+                       if ((err = _dhd_pno_gscan_cfg(dhd, &gscan_cfg,
+                               sizeof(wl_pfn_gscan_cfg_t))) < 0) {
+                               DHD_ERROR(("%s : pno_gscan_cfg failed (err %d) in firmware\n",
+                                       __FUNCTION__, err));
+                               goto exit_mutex_unlock;
+                       }
+               } else {
+                       DHD_PNO(("No change in flag - %d\n", old_flag));
+               }
+       } else {
+               DHD_PNO(("Gscan not started\n"));
+       }
+exit_mutex_unlock:
+       mutex_unlock(&_pno_state->pno_mutex);
+exit:
+       return err;
+}
+
+int dhd_gscan_batch_cache_cleanup(dhd_pub_t *dhd)
+{
+       int ret = 0;
+       dhd_pno_params_t *params;
+       struct dhd_pno_gscan_params *gscan_params;
+       dhd_pno_status_info_t *_pno_state;
+       gscan_results_cache_t *iter, *tmp;
+
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS];
+       gscan_params = &params->params_gscan;
+       iter = gscan_params->gscan_batch_cache;
+
+       while (iter) {
+               if (iter->tot_consumed == iter->tot_count) {
+                       tmp = iter->next;
+                       kfree(iter);
+                       iter = tmp;
+               } else
+                       break;
+}
+       gscan_params->gscan_batch_cache = iter;
+       ret = (iter == NULL);
+       return ret;
+}
+
+static int
+_dhd_pno_get_gscan_batch_from_fw(dhd_pub_t *dhd)
+{
+       int err = BCME_OK;
+       uint32 timestamp = 0, ts = 0, i, j, timediff;
+       dhd_pno_params_t *params;
+       dhd_pno_status_info_t *_pno_state;
+       wl_pfn_lnet_info_t *plnetinfo;
+       struct dhd_pno_gscan_params *gscan_params;
+       wl_pfn_lscanresults_t *plbestnet = NULL;
+       gscan_results_cache_t *iter, *tail;
+       wifi_gscan_result_t *result;
+       uint8 *nAPs_per_scan = NULL;
+       uint8 num_scans_in_cur_iter;
+       uint16 count, scan_id = 0;
+
+       NULL_CHECK(dhd, "dhd is NULL\n", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS];
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+
+       if (!WLS_SUPPORTED(_pno_state)) {
+               DHD_ERROR(("%s : wifi location service is not supported\n", __FUNCTION__));
+               err = BCME_UNSUPPORTED;
+               goto exit;
+       }
+
+       gscan_params = &params->params_gscan;
+       nAPs_per_scan = (uint8 *) MALLOC(dhd->osh, gscan_params->mscan);
+
+       if (!nAPs_per_scan) {
+               DHD_ERROR(("%s :Out of memory!! Cant malloc %d bytes\n", __FUNCTION__,
+               gscan_params->mscan));
+               err = BCME_NOMEM;
+               goto exit;
+       }
+
+       plbestnet = (wl_pfn_lscanresults_t *)MALLOC(dhd->osh, PNO_BESTNET_LEN);
+
+       mutex_lock(&_pno_state->pno_mutex);
+       iter = gscan_params->gscan_batch_cache;
+       /* If a cache has not been consumed , just delete it */
+       while (iter) {
+               iter->tot_consumed = iter->tot_count;
+               iter = iter->next;
+       }
+       dhd_gscan_batch_cache_cleanup(dhd);
+
+       if (!(_pno_state->pno_mode & DHD_PNO_GSCAN_MODE)) {
+               DHD_ERROR(("%s : GSCAN is not enabled\n", __FUNCTION__));
+               goto exit_mutex_unlock;
+       }
+
+       timediff = gscan_params->scan_fr * 1000;
+       timediff = timediff >> 1;
+
+       /* Ok, now lets start getting results from the FW */
+       plbestnet->status = PFN_INCOMPLETE;
+       tail = gscan_params->gscan_batch_cache;
+       while (plbestnet->status != PFN_COMPLETE) {
+               memset(plbestnet, 0, PNO_BESTNET_LEN);
+               err = dhd_iovar(dhd, 0, "pfnlbest", (char *)plbestnet, PNO_BESTNET_LEN, 0);
+               if (err < 0) {
+                       DHD_ERROR(("%s : Cannot get all the batch results, err :%d\n",
+                               __FUNCTION__, err));
+                       goto exit_mutex_unlock;
+               }
+               DHD_PNO(("ver %d, status : %d, count %d\n", plbestnet->version,
+                       plbestnet->status, plbestnet->count));
+               if (plbestnet->version != PFN_SCANRESULT_VERSION) {
+                       err = BCME_VERSION;
+                       DHD_ERROR(("bestnet version(%d) is mismatch with Driver version(%d)\n",
+                               plbestnet->version, PFN_SCANRESULT_VERSION));
+                       goto exit_mutex_unlock;
+               }
+
+               num_scans_in_cur_iter = 0;
+               timestamp = plbestnet->netinfo[0].timestamp;
+               /* find out how many scans' results did we get in this batch of FW results */
+               for (i = 0, count = 0; i < plbestnet->count; i++, count++) {
+                       plnetinfo = &plbestnet->netinfo[i];
+                       /* Unlikely to happen, but just in case the results from
+                        * FW doesnt make sense..... Assume its part of one single scan
+                        */
+                       if (num_scans_in_cur_iter > gscan_params->mscan) {
+                               num_scans_in_cur_iter = 0;
+                               count = plbestnet->count;
+                               break;
+                       }
+                       if (TIME_DIFF_MS(timestamp, plnetinfo->timestamp) > timediff) {
+                               nAPs_per_scan[num_scans_in_cur_iter] = count;
+                               count = 0;
+                               num_scans_in_cur_iter++;
+                       }
+                       timestamp = plnetinfo->timestamp;
+               }
+               nAPs_per_scan[num_scans_in_cur_iter] = count;
+               num_scans_in_cur_iter++;
+
+               DHD_PNO(("num_scans_in_cur_iter %d\n", num_scans_in_cur_iter));
+               plnetinfo = &plbestnet->netinfo[0];
+
+               for (i = 0; i < num_scans_in_cur_iter; i++) {
+                       iter = (gscan_results_cache_t *)
+                       kzalloc(((nAPs_per_scan[i] - 1) * sizeof(wifi_gscan_result_t)) +
+                                     sizeof(gscan_results_cache_t), GFP_KERNEL);
+                       if (!iter) {
+                               DHD_ERROR(("%s :Out of memory!! Cant malloc %d bytes\n",
+                                __FUNCTION__, gscan_params->mscan));
+                               err = BCME_NOMEM;
+                               goto exit_mutex_unlock;
+                       }
+                       /* Need this check because the new set of results from FW
+                        * maybe a continuation of previous sets' scan results
+                        */
+                       if (TIME_DIFF_MS(ts, plnetinfo->timestamp) > timediff) {
+                               iter->scan_id = ++scan_id;
+                       } else {
+                               iter->scan_id = scan_id;
+                       }
+                       DHD_PNO(("scan_id %d tot_count %d\n", scan_id, nAPs_per_scan[i]));
+                       iter->tot_count = nAPs_per_scan[i];
+                       iter->tot_consumed = 0;
+
+                       if (plnetinfo->flags & PFN_PARTIAL_SCAN_MASK) {
+                               DHD_PNO(("This scan is aborted\n"));
+                               iter->flag = (ENABLE << PNO_STATUS_ABORT);
+                       } else if (gscan_params->reason) {
+                               iter->flag = (ENABLE << gscan_params->reason);
+                       }
+
+                       if (!tail) {
+                               gscan_params->gscan_batch_cache = iter;
+                       } else {
+                               tail->next = iter;
+                       }
+                       tail = iter;
+                       iter->next = NULL;
+                       for (j = 0; j < nAPs_per_scan[i]; j++, plnetinfo++) {
+                               result = &iter->results[j];
+
+                               result->channel = wf_channel2mhz(plnetinfo->pfnsubnet.channel,
+                                       (plnetinfo->pfnsubnet.channel <= CH_MAX_2G_CHANNEL?
+                                       WF_CHAN_FACTOR_2_4_G : WF_CHAN_FACTOR_5_G));
+                               result->rssi = (int32) plnetinfo->RSSI;
+                               /* Info not available & not expected */
+                               result->beacon_period = 0;
+                               result->capability = 0;
+                               result->ie_length = 0;
+                               result->rtt = (uint64) plnetinfo->rtt0;
+                               result->rtt_sd = (uint64) plnetinfo->rtt1;
+                               result->ts = convert_fw_rel_time_to_systime(plnetinfo->timestamp);
+                               ts = plnetinfo->timestamp;
+                               if (plnetinfo->pfnsubnet.SSID_len > DOT11_MAX_SSID_LEN) {
+                                       DHD_ERROR(("%s: Invalid SSID length %d\n",
+                                             __FUNCTION__, plnetinfo->pfnsubnet.SSID_len));
+                                       plnetinfo->pfnsubnet.SSID_len = DOT11_MAX_SSID_LEN;
+                               }
+                               memcpy(result->ssid, plnetinfo->pfnsubnet.SSID,
+                                       plnetinfo->pfnsubnet.SSID_len);
+                               result->ssid[plnetinfo->pfnsubnet.SSID_len] = '\0';
+                               memcpy(&result->macaddr, &plnetinfo->pfnsubnet.BSSID,
+                                   ETHER_ADDR_LEN);
+
+                               DHD_PNO(("\tSSID : "));
+                               DHD_PNO(("\n"));
+                                       DHD_PNO(("\tBSSID: %02x:%02x:%02x:%02x:%02x:%02x\n",
+                                       result->macaddr.octet[0],
+                                       result->macaddr.octet[1],
+                                       result->macaddr.octet[2],
+                                       result->macaddr.octet[3],
+                                       result->macaddr.octet[4],
+                                       result->macaddr.octet[5]));
+                               DHD_PNO(("\tchannel: %d, RSSI: %d, timestamp: %d ms\n",
+                                       plnetinfo->pfnsubnet.channel,
+                                       plnetinfo->RSSI, plnetinfo->timestamp));
+                               DHD_PNO(("\tRTT0 : %d, RTT1: %d\n",
+                                   plnetinfo->rtt0, plnetinfo->rtt1));
+
+                       }
+               }
+       }
+exit_mutex_unlock:
+       mutex_unlock(&_pno_state->pno_mutex);
+exit:
+       params->params_gscan.get_batch_flag = GSCAN_BATCH_RETRIEVAL_COMPLETE;
+       smp_wmb();
+       wake_up_interruptible(&_pno_state->batch_get_wait);
+       if (nAPs_per_scan) {
+               MFREE(dhd->osh, nAPs_per_scan, gscan_params->mscan);
+       }
+       if (plbestnet) {
+               MFREE(dhd->osh, plbestnet, PNO_BESTNET_LEN);
+       }
+       DHD_PNO(("Batch retrieval done!\n"));
+       return err;
+}
+#endif /* GSCAN_SUPPORT */
+
+static int
+_dhd_pno_get_for_batch(dhd_pub_t *dhd, char *buf, int bufsize, int reason)
+{
+       int err = BCME_OK;
+       int i, j;
+       uint32 timestamp = 0;
+       dhd_pno_params_t *_params = NULL;
+       dhd_pno_status_info_t *_pno_state = NULL;
+       wl_pfn_lscanresults_t *plbestnet = NULL;
+       wl_pfn_lnet_info_t *plnetinfo;
+       dhd_pno_bestnet_entry_t *pbestnet_entry;
+       dhd_pno_best_header_t *pbestnetheader = NULL;
+       dhd_pno_scan_results_t *pscan_results = NULL, *siter, *snext;
+       bool allocate_header = FALSE;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       if (!dhd_support_sta_mode(dhd)) {
+               err = BCME_BADOPTION;
+               goto exit_no_unlock;
+       }
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+
+       if (!WLS_SUPPORTED(_pno_state)) {
+               DHD_ERROR(("%s : wifi location service is not supported\n", __FUNCTION__));
+               err = BCME_UNSUPPORTED;
+               goto exit_no_unlock;
+       }
+#ifdef GSCAN_SUPPORT
+       if (!(_pno_state->pno_mode & (DHD_PNO_BATCH_MODE | DHD_PNO_GSCAN_MODE))) {
+#else
+       if (!(_pno_state->pno_mode & DHD_PNO_BATCH_MODE)) {
+#endif /* GSCAN_SUPPORT */
+               DHD_ERROR(("%s: Batching SCAN mode is not enabled\n", __FUNCTION__));
+               goto exit_no_unlock;
+       }
+       mutex_lock(&_pno_state->pno_mutex);
+       _params = &_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS];
+       if (buf && bufsize) {
+               if (!list_empty(&_params->params_batch.get_batch.expired_scan_results_list)) {
+                       /* need to check whether we have cashed data or not */
+                       DHD_PNO(("%s: have cashed batching data in Driver\n",
+                               __FUNCTION__));
+                       /* convert to results format */
+                       goto convert_format;
+               } else {
+                       /* this is a first try to get batching results */
+                       if (!list_empty(&_params->params_batch.get_batch.scan_results_list)) {
+                               /* move the scan_results_list to expired_scan_results_lists */
+                               list_for_each_entry_safe(siter, snext,
+                                       &_params->params_batch.get_batch.scan_results_list, list) {
+                                       list_move_tail(&siter->list,
+                                       &_params->params_batch.get_batch.expired_scan_results_list);
+                               }
+                               _params->params_batch.get_batch.top_node_cnt = 0;
+                               _params->params_batch.get_batch.expired_tot_scan_cnt =
+                                       _params->params_batch.get_batch.tot_scan_cnt;
+                               _params->params_batch.get_batch.tot_scan_cnt = 0;
+                               goto convert_format;
+                       }
+               }
+       }
+       /* create dhd_pno_scan_results_t whenever we got event WLC_E_PFN_BEST_BATCHING */
+       pscan_results = (dhd_pno_scan_results_t *)MALLOC(dhd->osh, SCAN_RESULTS_SIZE);
+       if (pscan_results == NULL) {
+               err = BCME_NOMEM;
+               DHD_ERROR(("failed to allocate dhd_pno_scan_results_t\n"));
+               goto exit;
+       }
+       pscan_results->bestnetheader = NULL;
+       pscan_results->cnt_header = 0;
+       /* add the element into list unless total node cnt is less than MAX_NODE_ CNT */
+       if (_params->params_batch.get_batch.top_node_cnt < MAX_NODE_CNT) {
+               list_add(&pscan_results->list, &_params->params_batch.get_batch.scan_results_list);
+               _params->params_batch.get_batch.top_node_cnt++;
+       } else {
+               int _removed_scan_cnt;
+               /* remove oldest one and add new one */
+               DHD_PNO(("%s : Remove oldest node and add new one\n", __FUNCTION__));
+               _removed_scan_cnt = _dhd_pno_clear_all_batch_results(dhd,
+                       &_params->params_batch.get_batch.scan_results_list, TRUE);
+               _params->params_batch.get_batch.tot_scan_cnt -= _removed_scan_cnt;
+               list_add(&pscan_results->list, &_params->params_batch.get_batch.scan_results_list);
+
+       }
+       plbestnet = (wl_pfn_lscanresults_t *)MALLOC(dhd->osh, PNO_BESTNET_LEN);
+       NULL_CHECK(plbestnet, "failed to allocate buffer for bestnet", err);
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+       memset(plbestnet, 0, PNO_BESTNET_LEN);
+       while (plbestnet->status != PFN_COMPLETE) {
+               memset(plbestnet, 0, PNO_BESTNET_LEN);
+               err = dhd_iovar(dhd, 0, "pfnlbest", (char *)plbestnet, PNO_BESTNET_LEN, 0);
+               if (err < 0) {
+                       if (err == BCME_EPERM) {
+                               DHD_ERROR(("we cannot get the batching data "
+                                       "during scanning in firmware, try again\n,"));
+                               msleep(500);
+                               continue;
+                       } else {
+                               DHD_ERROR(("%s : failed to execute pfnlbest (err :%d)\n",
+                                       __FUNCTION__, err));
+                               goto exit;
+                       }
+               }
+               DHD_PNO(("ver %d, status : %d, count %d\n", plbestnet->version,
+                       plbestnet->status, plbestnet->count));
+               if (plbestnet->version != PFN_SCANRESULT_VERSION) {
+                       err = BCME_VERSION;
+                       DHD_ERROR(("bestnet version(%d) is mismatch with Driver version(%d)\n",
+                               plbestnet->version, PFN_SCANRESULT_VERSION));
+                       goto exit;
+               }
+               plnetinfo = plbestnet->netinfo;
+               for (i = 0; i < plbestnet->count; i++) {
+                       pbestnet_entry = (dhd_pno_bestnet_entry_t *)
+                       MALLOC(dhd->osh, BESTNET_ENTRY_SIZE);
+                       if (pbestnet_entry == NULL) {
+                               err = BCME_NOMEM;
+                               DHD_ERROR(("failed to allocate dhd_pno_bestnet_entry\n"));
+                               goto exit;
+                       }
+                       memset(pbestnet_entry, 0, BESTNET_ENTRY_SIZE);
+                       pbestnet_entry->recorded_time = jiffies; /* record the current time */
+                       /* create header for the first entry */
+                       allocate_header = (i == 0)? TRUE : FALSE;
+                       /* check whether the new generation is started or not */
+                       if (timestamp && (TIME_DIFF(timestamp, plnetinfo->timestamp)
+                               > TIME_MIN_DIFF))
+                               allocate_header = TRUE;
+                       timestamp = plnetinfo->timestamp;
+                       if (allocate_header) {
+                               pbestnetheader = (dhd_pno_best_header_t *)
+                               MALLOC(dhd->osh, BEST_HEADER_SIZE);
+                               if (pbestnetheader == NULL) {
+                                       err = BCME_NOMEM;
+                                       if (pbestnet_entry)
+                                               MFREE(dhd->osh, pbestnet_entry,
+                                               BESTNET_ENTRY_SIZE);
+                                       DHD_ERROR(("failed to allocate dhd_pno_bestnet_entry\n"));
+                                       goto exit;
+                               }
+                               /* increase total cnt of bestnet header */
+                               pscan_results->cnt_header++;
+                               /* need to record the reason to call dhd_pno_get_for_bach */
+                               if (reason)
+                                       pbestnetheader->reason = (ENABLE << reason);
+                               memset(pbestnetheader, 0, BEST_HEADER_SIZE);
+                               /* initialize the head of linked list */
+                               INIT_LIST_HEAD(&(pbestnetheader->entry_list));
+                               /* link the pbestnet heaer into existed list */
+                               if (pscan_results->bestnetheader == NULL)
+                                       /* In case of header */
+                                       pscan_results->bestnetheader = pbestnetheader;
+                               else {
+                                       dhd_pno_best_header_t *head = pscan_results->bestnetheader;
+                                       pscan_results->bestnetheader = pbestnetheader;
+                                       pbestnetheader->next = head;
+                               }
+                       }
+                       /* fills the best network info */
+                       pbestnet_entry->channel = plnetinfo->pfnsubnet.channel;
+                       pbestnet_entry->RSSI = plnetinfo->RSSI;
+                       if (plnetinfo->flags & PFN_PARTIAL_SCAN_MASK) {
+                               /* if RSSI is positive value, we assume that
+                                * this scan is aborted by other scan
+                                */
+                               DHD_PNO(("This scan is aborted\n"));
+                               pbestnetheader->reason = (ENABLE << PNO_STATUS_ABORT);
+                       }
+                       pbestnet_entry->rtt0 = plnetinfo->rtt0;
+                       pbestnet_entry->rtt1 = plnetinfo->rtt1;
+                       pbestnet_entry->timestamp = plnetinfo->timestamp;
+                       if (plnetinfo->pfnsubnet.SSID_len > DOT11_MAX_SSID_LEN) {
+                               DHD_ERROR(("%s: Invalid SSID length %d: trimming it to max\n",
+                                     __FUNCTION__, plnetinfo->pfnsubnet.SSID_len));
+                               plnetinfo->pfnsubnet.SSID_len = DOT11_MAX_SSID_LEN;
+                       }
+                       pbestnet_entry->SSID_len = plnetinfo->pfnsubnet.SSID_len;
+                       memcpy(pbestnet_entry->SSID, plnetinfo->pfnsubnet.SSID,
+                               pbestnet_entry->SSID_len);
+                       memcpy(&pbestnet_entry->BSSID, &plnetinfo->pfnsubnet.BSSID, ETHER_ADDR_LEN);
+                       /* add the element into list */
+                       list_add_tail(&pbestnet_entry->list, &pbestnetheader->entry_list);
+                       /* increase best entry count */
+                       pbestnetheader->tot_cnt++;
+                       pbestnetheader->tot_size += BESTNET_ENTRY_SIZE;
+                       DHD_PNO(("Header %d\n", pscan_results->cnt_header - 1));
+                       DHD_PNO(("\tSSID : "));
+                       for (j = 0; j < plnetinfo->pfnsubnet.SSID_len; j++)
+                               DHD_PNO(("%c", plnetinfo->pfnsubnet.SSID[j]));
+                       DHD_PNO(("\n"));
+                       DHD_PNO(("\tBSSID: %02x:%02x:%02x:%02x:%02x:%02x\n",
+                               plnetinfo->pfnsubnet.BSSID.octet[0],
+                               plnetinfo->pfnsubnet.BSSID.octet[1],
+                               plnetinfo->pfnsubnet.BSSID.octet[2],
+                               plnetinfo->pfnsubnet.BSSID.octet[3],
+                               plnetinfo->pfnsubnet.BSSID.octet[4],
+                               plnetinfo->pfnsubnet.BSSID.octet[5]));
+                       DHD_PNO(("\tchannel: %d, RSSI: %d, timestamp: %d ms\n",
+                               plnetinfo->pfnsubnet.channel,
+                               plnetinfo->RSSI, plnetinfo->timestamp));
+                       DHD_PNO(("\tRTT0 : %d, RTT1: %d\n", plnetinfo->rtt0, plnetinfo->rtt1));
+                       plnetinfo++;
+               }
+       }
+       if (pscan_results->cnt_header == 0) {
+               /* In case that we didn't get any data from the firmware
+                * Remove the current scan_result list from get_bach.scan_results_list.
+                */
+               DHD_PNO(("NO BATCH DATA from Firmware, Delete current SCAN RESULT LIST\n"));
+               list_del(&pscan_results->list);
+               MFREE(dhd->osh, pscan_results, SCAN_RESULTS_SIZE);
+               _params->params_batch.get_batch.top_node_cnt--;
+       } else {
+               /* increase total scan count using current scan count */
+               _params->params_batch.get_batch.tot_scan_cnt += pscan_results->cnt_header;
+       }
+
+       if (buf && bufsize) {
+               /* This is a first try to get batching results */
+               if (!list_empty(&_params->params_batch.get_batch.scan_results_list)) {
+                       /* move the scan_results_list to expired_scan_results_lists */
+                       list_for_each_entry_safe(siter, snext,
+                               &_params->params_batch.get_batch.scan_results_list, list) {
+                               list_move_tail(&siter->list,
+                                       &_params->params_batch.get_batch.expired_scan_results_list);
+                       }
+                       /* reset gloval values after  moving to expired list */
+                       _params->params_batch.get_batch.top_node_cnt = 0;
+                       _params->params_batch.get_batch.expired_tot_scan_cnt =
+                               _params->params_batch.get_batch.tot_scan_cnt;
+                       _params->params_batch.get_batch.tot_scan_cnt = 0;
+               }
+convert_format:
+               err = _dhd_pno_convert_format(dhd, &_params->params_batch, buf, bufsize);
+               if (err < 0) {
+                       DHD_ERROR(("failed to convert the data into upper layer format\n"));
+                       goto exit;
+               }
+       }
+exit:
+       if (plbestnet)
+               MFREE(dhd->osh, plbestnet, PNO_BESTNET_LEN);
+       if (_params) {
+               _params->params_batch.get_batch.buf = NULL;
+               _params->params_batch.get_batch.bufsize = 0;
+               _params->params_batch.get_batch.bytes_written = err;
+       }
+       mutex_unlock(&_pno_state->pno_mutex);
+exit_no_unlock:
+       if (waitqueue_active(&_pno_state->get_batch_done.wait))
+               complete(&_pno_state->get_batch_done);
+       return err;
+}
+static void
+_dhd_pno_get_batch_handler(struct work_struct *work)
+{
+       dhd_pno_status_info_t *_pno_state;
+       dhd_pub_t *dhd;
+       struct dhd_pno_batch_params *params_batch;
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+       _pno_state = container_of(work, struct dhd_pno_status_info, work);
+       dhd = _pno_state->dhd;
+       if (dhd == NULL) {
+               DHD_ERROR(("%s : dhd is NULL\n", __FUNCTION__));
+               return;
+       }
+
+#ifdef GSCAN_SUPPORT
+       if (_pno_state->pno_mode & DHD_PNO_GSCAN_MODE) {
+               _dhd_pno_get_gscan_batch_from_fw(dhd);
+               return;
+       } else
+#endif /* GSCAN_SUPPORT */
+       {
+               params_batch = &_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS].params_batch;
+
+               _dhd_pno_get_for_batch(dhd, params_batch->get_batch.buf,
+                       params_batch->get_batch.bufsize, params_batch->get_batch.reason);
+       }
+
+}
+
+int
+dhd_pno_get_for_batch(dhd_pub_t *dhd, char *buf, int bufsize, int reason)
+{
+       int err = BCME_OK;
+       char *pbuf = buf;
+       dhd_pno_status_info_t *_pno_state;
+       struct dhd_pno_batch_params *params_batch;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       if (!dhd_support_sta_mode(dhd)) {
+               err = BCME_BADOPTION;
+               goto exit;
+       }
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+
+       if (!WLS_SUPPORTED(_pno_state)) {
+               DHD_ERROR(("%s : wifi location service is not supported\n", __FUNCTION__));
+               err = BCME_UNSUPPORTED;
+               goto exit;
+       }
+       params_batch = &_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS].params_batch;
+#ifdef GSCAN_SUPPORT
+       if (_pno_state->pno_mode & DHD_PNO_GSCAN_MODE) {
+               struct dhd_pno_gscan_params *gscan_params;
+               gscan_params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS].params_gscan;
+               gscan_params->reason = reason;
+               err = dhd_retreive_batch_scan_results(dhd);
+               if (err == BCME_OK) {
+                       wait_event_interruptible_timeout(_pno_state->batch_get_wait,
+                            is_batch_retrieval_complete(gscan_params),
+                            msecs_to_jiffies(GSCAN_BATCH_GET_MAX_WAIT));
+               }
+       } else
+#endif
+       {
+               if (!(_pno_state->pno_mode & DHD_PNO_BATCH_MODE)) {
+                       DHD_ERROR(("%s: Batching SCAN mode is not enabled\n", __FUNCTION__));
+                       memset(pbuf, 0, bufsize);
+                       pbuf += sprintf(pbuf, "scancount=%d\n", 0);
+                       sprintf(pbuf, "%s", RESULTS_END_MARKER);
+                       err = strlen(buf);
+                       goto exit;
+               }
+               params_batch->get_batch.buf = buf;
+               params_batch->get_batch.bufsize = bufsize;
+               params_batch->get_batch.reason = reason;
+               params_batch->get_batch.bytes_written = 0;
+               schedule_work(&_pno_state->work);
+               wait_for_completion(&_pno_state->get_batch_done);
+       }
+
+#ifdef GSCAN_SUPPORT
+       if (!(_pno_state->pno_mode & DHD_PNO_GSCAN_MODE))
+#endif
+       err = params_batch->get_batch.bytes_written;
+exit:
+       return err;
+}
+
+int
+dhd_pno_stop_for_batch(dhd_pub_t *dhd)
+{
+       int err = BCME_OK;
+       int mode = 0;
+       int i = 0;
+       dhd_pno_status_info_t *_pno_state;
+       dhd_pno_params_t *_params;
+       wl_pfn_bssid_t *p_pfn_bssid = NULL;
+       wlc_ssid_ext_t *p_ssid_list = NULL;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+       if (!dhd_support_sta_mode(dhd)) {
+               err = BCME_BADOPTION;
+               goto exit;
+       }
+       if (!WLS_SUPPORTED(_pno_state)) {
+               DHD_ERROR(("%s : wifi location service is not supported\n",
+                       __FUNCTION__));
+               err = BCME_UNSUPPORTED;
+               goto exit;
+       }
+
+#ifdef GSCAN_SUPPORT
+       if (_pno_state->pno_mode & DHD_PNO_GSCAN_MODE) {
+               DHD_PNO(("Gscan is ongoing, nothing to stop here\n"));
+               return err;
+       }
+#endif
+
+       if (!(_pno_state->pno_mode & DHD_PNO_BATCH_MODE)) {
+               DHD_ERROR(("%s : PNO BATCH MODE is not enabled\n", __FUNCTION__));
+               goto exit;
+       }
+       _pno_state->pno_mode &= ~DHD_PNO_BATCH_MODE;
+       if (_pno_state->pno_mode & (DHD_PNO_LEGACY_MODE | DHD_PNO_HOTLIST_MODE)) {
+               mode = _pno_state->pno_mode;
+               dhd_pno_clean(dhd);
+               _pno_state->pno_mode = mode;
+               /* restart Legacy PNO if the Legacy PNO is on */
+               if (_pno_state->pno_mode & DHD_PNO_LEGACY_MODE) {
+                       struct dhd_pno_legacy_params *_params_legacy;
+                       _params_legacy =
+                               &(_pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS].params_legacy);
+                       p_ssid_list = dhd_pno_get_legacy_pno_ssid(dhd, _pno_state);
+                       if (!p_ssid_list) {
+                               err = BCME_NOMEM;
+                               DHD_ERROR(("failed to get Legacy PNO SSID list\n"));
+                               goto exit;
+                       }
+                       err = dhd_pno_set_for_ssid(dhd, p_ssid_list, _params_legacy->nssid,
+                               _params_legacy->scan_fr, _params_legacy->pno_repeat,
+                               _params_legacy->pno_freq_expo_max, _params_legacy->chan_list,
+                               _params_legacy->nchan);
+                       if (err < 0) {
+                               _pno_state->pno_mode &= ~DHD_PNO_LEGACY_MODE;
+                               DHD_ERROR(("%s : failed to restart legacy PNO scan(err: %d)\n",
+                                       __FUNCTION__, err));
+                               goto exit;
+                       }
+               } else if (_pno_state->pno_mode & DHD_PNO_HOTLIST_MODE) {
+                       struct dhd_pno_bssid *iter, *next;
+                       _params = &(_pno_state->pno_params_arr[INDEX_OF_HOTLIST_PARAMS]);
+                       p_pfn_bssid = kzalloc(sizeof(wl_pfn_bssid_t) *
+                               _params->params_hotlist.nbssid, GFP_KERNEL);
+                       if (p_pfn_bssid == NULL) {
+                               DHD_ERROR(("%s : failed to allocate wl_pfn_bssid_t array"
+                                       " (count: %d)",
+                                       __FUNCTION__, _params->params_hotlist.nbssid));
+                               err = BCME_ERROR;
+                               _pno_state->pno_mode &= ~DHD_PNO_HOTLIST_MODE;
+                               goto exit;
+                       }
+                       i = 0;
+                       /* convert dhd_pno_bssid to wl_pfn_bssid */
+                       list_for_each_entry_safe(iter, next,
+                               &_params->params_hotlist.bssid_list, list) {
+                               memcpy(&p_pfn_bssid[i].macaddr, &iter->macaddr, ETHER_ADDR_LEN);
+                               p_pfn_bssid[i].flags = iter->flags;
+                               i++;
+                       }
+                       err = dhd_pno_set_for_hotlist(dhd, p_pfn_bssid, &_params->params_hotlist);
+                       if (err < 0) {
+                               _pno_state->pno_mode &= ~DHD_PNO_HOTLIST_MODE;
+                               DHD_ERROR(("%s : failed to restart hotlist scan(err: %d)\n",
+                                       __FUNCTION__, err));
+                               goto exit;
+                       }
+               }
+       } else {
+               err = dhd_pno_clean(dhd);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to call dhd_pno_clean (err: %d)\n",
+                               __FUNCTION__, err));
+                       goto exit;
+               }
+       }
+exit:
+       _params = &_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS];
+       _dhd_pno_reinitialize_prof(dhd, _params, DHD_PNO_BATCH_MODE);
+       kfree(p_ssid_list);
+       kfree(p_pfn_bssid);
+       return err;
+}
+
+int
+dhd_pno_set_for_hotlist(dhd_pub_t *dhd, wl_pfn_bssid_t *p_pfn_bssid,
+       struct dhd_pno_hotlist_params *hotlist_params)
+{
+       int err = BCME_OK;
+       int i;
+       uint16 _chan_list[WL_NUMCHANNELS];
+       int rem_nchan = 0;
+       int tot_nchan = 0;
+       int mode = 0;
+       dhd_pno_params_t *_params;
+       dhd_pno_params_t *_params2;
+       struct dhd_pno_bssid *_pno_bssid;
+       dhd_pno_status_info_t *_pno_state;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       NULL_CHECK(hotlist_params, "hotlist_params is NULL", err);
+       NULL_CHECK(p_pfn_bssid, "p_pfn_bssid is NULL", err);
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+
+       if (!dhd_support_sta_mode(dhd)) {
+               err = BCME_BADOPTION;
+               goto exit;
+       }
+       if (!WLS_SUPPORTED(_pno_state)) {
+               DHD_ERROR(("%s : wifi location service is not supported\n", __FUNCTION__));
+               err = BCME_UNSUPPORTED;
+               goto exit;
+       }
+       _params = &_pno_state->pno_params_arr[INDEX_OF_HOTLIST_PARAMS];
+       if (!(_pno_state->pno_mode & DHD_PNO_HOTLIST_MODE)) {
+               _pno_state->pno_mode |= DHD_PNO_HOTLIST_MODE;
+               err = _dhd_pno_reinitialize_prof(dhd, _params, DHD_PNO_HOTLIST_MODE);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to call _dhd_pno_reinitialize_prof\n",
+                               __FUNCTION__));
+                       goto exit;
+               }
+       }
+       _params->params_batch.nchan = hotlist_params->nchan;
+       _params->params_batch.scan_fr = hotlist_params->scan_fr;
+       if (hotlist_params->nchan)
+               memcpy(_params->params_hotlist.chan_list, hotlist_params->chan_list,
+                       sizeof(_params->params_hotlist.chan_list));
+       memset(_chan_list, 0, sizeof(_chan_list));
+
+       rem_nchan = ARRAYSIZE(hotlist_params->chan_list) - hotlist_params->nchan;
+       if (hotlist_params->band == WLC_BAND_2G || hotlist_params->band == WLC_BAND_5G) {
+               /* get a valid channel list based on band B or A */
+               err = _dhd_pno_get_channels(dhd,
+               &_params->params_hotlist.chan_list[hotlist_params->nchan],
+               &rem_nchan, hotlist_params->band, FALSE);
+               if (err < 0) {
+                       DHD_ERROR(("%s: failed to get valid channel list(band : %d)\n",
+                               __FUNCTION__, hotlist_params->band));
+                       goto exit;
+               }
+               /* now we need to update nchan because rem_chan has valid channel count */
+               _params->params_hotlist.nchan += rem_nchan;
+               /* need to sort channel list */
+               sort(_params->params_hotlist.chan_list, _params->params_hotlist.nchan,
+                       sizeof(_params->params_hotlist.chan_list[0]), _dhd_pno_cmpfunc, NULL);
+       }
+#ifdef PNO_DEBUG
+{
+               int i;
+               DHD_PNO(("Channel list : "));
+               for (i = 0; i < _params->params_batch.nchan; i++) {
+                       DHD_PNO(("%d ", _params->params_batch.chan_list[i]));
+               }
+               DHD_PNO(("\n"));
+}
+#endif
+       if (_params->params_hotlist.nchan) {
+               /* copy the channel list into local array */
+               memcpy(_chan_list, _params->params_hotlist.chan_list,
+                       sizeof(_chan_list));
+               tot_nchan = _params->params_hotlist.nchan;
+       }
+       if (_pno_state->pno_mode & DHD_PNO_LEGACY_MODE) {
+                       DHD_PNO(("PNO SSID is on progress in firmware\n"));
+                       /* store current pno_mode before disabling pno */
+                       mode = _pno_state->pno_mode;
+                       err = _dhd_pno_enable(dhd, PNO_OFF);
+                       if (err < 0) {
+                               DHD_ERROR(("%s : failed to disable PNO\n", __FUNCTION__));
+                               goto exit;
+                       }
+                       /* restore the previous mode */
+                       _pno_state->pno_mode = mode;
+                       /* Use the superset for channelist between two mode */
+                       _params2 = &(_pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS]);
+                       if (_params2->params_legacy.nchan > 0 &&
+                               _params->params_hotlist.nchan > 0) {
+                               err = _dhd_pno_chan_merge(_chan_list, &tot_nchan,
+                                       &_params2->params_legacy.chan_list[0],
+                                       _params2->params_legacy.nchan,
+                                       &_params->params_hotlist.chan_list[0],
+                                       _params->params_hotlist.nchan);
+                               if (err < 0) {
+                                       DHD_ERROR(("%s : failed to merge channel list"
+                                               "between legacy and hotlist\n",
+                                               __FUNCTION__));
+                                       goto exit;
+                               }
+                       }
+
+       }
+
+       INIT_LIST_HEAD(&(_params->params_hotlist.bssid_list));
+
+       err = _dhd_pno_add_bssid(dhd, p_pfn_bssid, hotlist_params->nbssid);
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to call _dhd_pno_add_bssid(err :%d)\n",
+                       __FUNCTION__, err));
+               goto exit;
+       }
+       if ((err = _dhd_pno_set(dhd, _params, DHD_PNO_HOTLIST_MODE)) < 0) {
+               DHD_ERROR(("%s : failed to set call pno_set (err %d) in firmware\n",
+                       __FUNCTION__, err));
+               goto exit;
+       }
+       if (tot_nchan > 0) {
+               if ((err = _dhd_pno_cfg(dhd, _chan_list, tot_nchan)) < 0) {
+                       DHD_ERROR(("%s : failed to set call pno_cfg (err %d) in firmware\n",
+                               __FUNCTION__, err));
+                       goto exit;
+               }
+       }
+       for (i = 0; i < hotlist_params->nbssid; i++) {
+               _pno_bssid = kzalloc(sizeof(struct dhd_pno_bssid), GFP_KERNEL);
+               NULL_CHECK(_pno_bssid, "_pfn_bssid is NULL", err);
+               memcpy(&_pno_bssid->macaddr, &p_pfn_bssid[i].macaddr, ETHER_ADDR_LEN);
+               _pno_bssid->flags = p_pfn_bssid[i].flags;
+               list_add_tail(&_pno_bssid->list, &_params->params_hotlist.bssid_list);
+       }
+       _params->params_hotlist.nbssid = hotlist_params->nbssid;
+       if (_pno_state->pno_status == DHD_PNO_DISABLED) {
+               if ((err = _dhd_pno_enable(dhd, PNO_ON)) < 0)
+                       DHD_ERROR(("%s : failed to enable PNO\n", __FUNCTION__));
+       }
+exit:
+       /* clear mode in case of error */
+       if (err < 0)
+               _pno_state->pno_mode &= ~DHD_PNO_HOTLIST_MODE;
+       return err;
+}
+
+int
+dhd_pno_stop_for_hotlist(dhd_pub_t *dhd)
+{
+       int err = BCME_OK;
+       uint32 mode = 0;
+       dhd_pno_status_info_t *_pno_state;
+       dhd_pno_params_t *_params;
+       wlc_ssid_ext_t *p_ssid_list = NULL;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+
+       if (!WLS_SUPPORTED(_pno_state)) {
+               DHD_ERROR(("%s : wifi location service is not supported\n",
+                       __FUNCTION__));
+               err = BCME_UNSUPPORTED;
+               goto exit;
+       }
+
+       if (!(_pno_state->pno_mode & DHD_PNO_HOTLIST_MODE)) {
+               DHD_ERROR(("%s : Hotlist MODE is not enabled\n",
+                       __FUNCTION__));
+               goto exit;
+       }
+       _pno_state->pno_mode &= ~DHD_PNO_BATCH_MODE;
+
+       if (_pno_state->pno_mode & (DHD_PNO_LEGACY_MODE | DHD_PNO_BATCH_MODE)) {
+               /* retrieve the batching data from firmware into host */
+               dhd_pno_get_for_batch(dhd, NULL, 0, PNO_STATUS_DISABLE);
+               /* save current pno_mode before calling dhd_pno_clean */
+               mode = _pno_state->pno_mode;
+               err = dhd_pno_clean(dhd);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to call dhd_pno_clean (err: %d)\n",
+                               __FUNCTION__, err));
+                       goto exit;
+               }
+               /* restore previos pno mode */
+               _pno_state->pno_mode = mode;
+               if (_pno_state->pno_mode & DHD_PNO_LEGACY_MODE) {
+                       /* restart Legacy PNO Scan */
+                       struct dhd_pno_legacy_params *_params_legacy;
+                       _params_legacy =
+                       &(_pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS].params_legacy);
+                       p_ssid_list = dhd_pno_get_legacy_pno_ssid(dhd, _pno_state);
+                       if (!p_ssid_list) {
+                               err = BCME_NOMEM;
+                               DHD_ERROR(("failed to get Legacy PNO SSID list\n"));
+                               goto exit;
+                       }
+                       err = dhd_pno_set_for_ssid(dhd, p_ssid_list, _params_legacy->nssid,
+                               _params_legacy->scan_fr, _params_legacy->pno_repeat,
+                               _params_legacy->pno_freq_expo_max, _params_legacy->chan_list,
+                               _params_legacy->nchan);
+                       if (err < 0) {
+                               _pno_state->pno_mode &= ~DHD_PNO_LEGACY_MODE;
+                               DHD_ERROR(("%s : failed to restart legacy PNO scan(err: %d)\n",
+                                       __FUNCTION__, err));
+                               goto exit;
+                       }
+               } else if (_pno_state->pno_mode & DHD_PNO_BATCH_MODE) {
+                       /* restart Batching Scan */
+                       _params = &(_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS]);
+                       /* restart BATCH SCAN */
+                       err = dhd_pno_set_for_batch(dhd, &_params->params_batch);
+                       if (err < 0) {
+                               _pno_state->pno_mode &= ~DHD_PNO_BATCH_MODE;
+                               DHD_ERROR(("%s : failed to restart batch scan(err: %d)\n",
+                                       __FUNCTION__,  err));
+                               goto exit;
+                       }
+               }
+       } else {
+               err = dhd_pno_clean(dhd);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to call dhd_pno_clean (err: %d)\n",
+                               __FUNCTION__, err));
+                       goto exit;
+               }
+       }
+exit:
+       kfree(p_ssid_list);
+       return err;
+}
+
+#ifdef GSCAN_SUPPORT
+int
+dhd_retreive_batch_scan_results(dhd_pub_t *dhd)
+{
+       int err = BCME_OK;
+       dhd_pno_status_info_t *_pno_state;
+       dhd_pno_params_t *_params;
+       struct dhd_pno_batch_params *params_batch;
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       _params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS];
+
+       params_batch = &_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS].params_batch;
+       if (_params->params_gscan.get_batch_flag == GSCAN_BATCH_RETRIEVAL_COMPLETE) {
+               DHD_PNO(("Retreive batch results\n"));
+               params_batch->get_batch.buf = NULL;
+               params_batch->get_batch.bufsize = 0;
+               params_batch->get_batch.reason = PNO_STATUS_EVENT;
+               _params->params_gscan.get_batch_flag = GSCAN_BATCH_RETRIEVAL_IN_PROGRESS;
+               schedule_work(&_pno_state->work);
+       } else {
+               DHD_PNO(("%s : WLC_E_PFN_BEST_BATCHING retrieval"
+                       "already in progress, will skip\n", __FUNCTION__));
+               err = BCME_ERROR;
+       }
+
+       return err;
+}
+
+/* Handle Significant WiFi Change (SWC) event from FW
+ * Send event to HAL when all results arrive from FW
+ */
+void *
+dhd_handle_swc_evt(dhd_pub_t *dhd, const void *event_data, int *send_evt_bytes)
+{
+       void *ptr = NULL;
+       dhd_pno_status_info_t *_pno_state = PNO_GET_PNOSTATE(dhd);
+       struct dhd_pno_gscan_params *gscan_params;
+       struct dhd_pno_swc_evt_param *params;
+       wl_pfn_swc_results_t *results = (wl_pfn_swc_results_t *)event_data;
+       wl_pfn_significant_net_t *change_array;
+       int i;
+
+
+       gscan_params = &(_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS].params_gscan);
+       params = &(gscan_params->param_significant);
+
+       if (!results->total_count) {
+               *send_evt_bytes = 0;
+               return ptr;
+       }
+
+       if (!params->results_rxed_so_far) {
+               if (!params->change_array) {
+                       params->change_array = (wl_pfn_significant_net_t *)
+                       kmalloc(sizeof(wl_pfn_significant_net_t) * results->total_count,
+                       GFP_KERNEL);
+
+                       if (!params->change_array) {
+                               DHD_ERROR(("%s Cannot Malloc %zd bytes!!\n", __FUNCTION__,
+                               sizeof(wl_pfn_significant_net_t) * results->total_count));
+                               *send_evt_bytes = 0;
+                               return ptr;
+                       }
+               } else {
+                       DHD_ERROR(("RX'ed WLC_E_PFN_SWC evt from FW, previous evt not complete!!"));
+                       *send_evt_bytes = 0;
+                       return ptr;
+               }
+
+       }
+
+       DHD_PNO(("%s: pkt_count %d total_count %d\n", __FUNCTION__,
+       results->pkt_count, results->total_count));
+
+       for (i = 0; i < results->pkt_count; i++) {
+               DHD_PNO(("\t %02x:%02x:%02x:%02x:%02x:%02x\n",
+               results->list[i].BSSID.octet[0],
+               results->list[i].BSSID.octet[1],
+               results->list[i].BSSID.octet[2],
+               results->list[i].BSSID.octet[3],
+               results->list[i].BSSID.octet[4],
+               results->list[i].BSSID.octet[5]));
+       }
+
+       change_array = &params->change_array[params->results_rxed_so_far];
+       if ((params->results_rxed_so_far + results->pkt_count) <= results->total_count) {
+               memcpy(change_array, results->list,
+                       sizeof(wl_pfn_significant_net_t) * results->pkt_count);
+               params->results_rxed_so_far += results->pkt_count;
+       } else {
+               /* In case of spurious event or invalid data send hang event */
+               dhd->hang_reason = HANG_REASON_INVALID_EVENT_OR_DATA;
+               dhd_os_send_hang_message(dhd);
+       }
+
+       if (params->results_rxed_so_far == results->total_count) {
+               params->results_rxed_so_far = 0;
+               *send_evt_bytes = sizeof(wl_pfn_significant_net_t) * results->total_count;
+               /* Pack up change buffer to send up and reset
+                * results_rxed_so_far, after its done.
+                */
+               ptr = (void *) params->change_array;
+               /* expecting the callee to free this mem chunk */
+               params->change_array = NULL;
+       }
+        else {
+               *send_evt_bytes = 0;
+       }
+
+       return ptr;
+}
+
+void
+dhd_gscan_hotlist_cache_cleanup(dhd_pub_t *dhd, hotlist_type_t type)
+{
+       dhd_pno_status_info_t *_pno_state = PNO_GET_PNOSTATE(dhd);
+       struct dhd_pno_gscan_params *gscan_params;
+       gscan_results_cache_t *iter, *tmp;
+
+       if (!_pno_state) {
+               return;
+       }
+       gscan_params = &(_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS].params_gscan);
+
+       if (type == HOTLIST_FOUND) {
+               iter = gscan_params->gscan_hotlist_found;
+               gscan_params->gscan_hotlist_found = NULL;
+       } else {
+               iter = gscan_params->gscan_hotlist_lost;
+               gscan_params->gscan_hotlist_lost = NULL;
+       }
+
+       while (iter) {
+               tmp = iter->next;
+               kfree(iter);
+               iter = tmp;
+       }
+
+       return;
+}
+
+void *
+dhd_process_full_gscan_result(dhd_pub_t *dhd, const void *data, int *size)
+{
+       wl_bss_info_t *bi = NULL;
+       wl_gscan_result_t *gscan_result;
+       wifi_gscan_result_t *result = NULL;
+       u32 bi_length = 0;
+       uint8 channel;
+       uint32 mem_needed;
+
+       struct timespec ts;
+
+       *size = 0;
+
+       gscan_result = (wl_gscan_result_t *)data;
+
+       if (!gscan_result) {
+               DHD_ERROR(("Invalid gscan result (NULL pointer)\n"));
+               goto exit;
+       }
+       if (!gscan_result->bss_info) {
+               DHD_ERROR(("Invalid gscan bss info (NULL pointer)\n"));
+               goto exit;
+       }
+       bi = &gscan_result->bss_info[0].info;
+       bi_length = dtoh32(bi->length);
+       if (bi_length != (dtoh32(gscan_result->buflen) -
+               WL_GSCAN_RESULTS_FIXED_SIZE - WL_GSCAN_INFO_FIXED_FIELD_SIZE)) {
+               DHD_ERROR(("Invalid bss_info length %d: ignoring\n", bi_length));
+               goto exit;
+       }
+       if (bi->SSID_len > DOT11_MAX_SSID_LEN) {
+               DHD_ERROR(("Invalid SSID length %d: trimming it to max\n", bi->SSID_len));
+               bi->SSID_len = DOT11_MAX_SSID_LEN;
+       }
+
+       mem_needed = OFFSETOF(wifi_gscan_result_t, ie_data) + bi->ie_length;
+       result = kmalloc(mem_needed, GFP_KERNEL);
+
+       if (!result) {
+               DHD_ERROR(("%s Cannot malloc scan result buffer %d bytes\n",
+                __FUNCTION__, mem_needed));
+               goto exit;
+       }
+
+       memcpy(result->ssid, bi->SSID, bi->SSID_len);
+       result->ssid[bi->SSID_len] = '\0';
+       channel = wf_chspec_ctlchan(bi->chanspec);
+       result->channel = wf_channel2mhz(channel,
+               (channel <= CH_MAX_2G_CHANNEL?
+               WF_CHAN_FACTOR_2_4_G : WF_CHAN_FACTOR_5_G));
+       result->rssi = (int32) bi->RSSI;
+       result->rtt = 0;
+       result->rtt_sd = 0;
+       get_monotonic_boottime(&ts);
+       result->ts = (uint64) TIMESPEC_TO_US(ts);
+       result->beacon_period = dtoh16(bi->beacon_period);
+       result->capability = dtoh16(bi->capability);
+       result->ie_length = dtoh32(bi->ie_length);
+       memcpy(&result->macaddr, &bi->BSSID, ETHER_ADDR_LEN);
+       memcpy(result->ie_data, ((uint8 *)bi + bi->ie_offset), bi->ie_length);
+       *size = mem_needed;
+exit:
+       return result;
+}
+
+void *
+dhd_handle_hotlist_scan_evt(dhd_pub_t *dhd, const void *event_data,
+        int *send_evt_bytes, hotlist_type_t type)
+{
+       void *ptr = NULL;
+       dhd_pno_status_info_t *_pno_state = PNO_GET_PNOSTATE(dhd);
+       struct dhd_pno_gscan_params *gscan_params;
+       wl_pfn_scanresults_t *results = (wl_pfn_scanresults_t *)event_data;
+       wifi_gscan_result_t *hotlist_found_array;
+       wl_pfn_net_info_t *plnetinfo;
+       gscan_results_cache_t *gscan_hotlist_cache;
+       int malloc_size = 0, i, total = 0;
+
+       gscan_params = &(_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS].params_gscan);
+
+       if (!results->count) {
+               *send_evt_bytes = 0;
+               return ptr;
+       }
+
+       malloc_size = sizeof(gscan_results_cache_t) +
+       ((results->count - 1) * sizeof(wifi_gscan_result_t));
+       gscan_hotlist_cache = (gscan_results_cache_t *) kmalloc(malloc_size, GFP_KERNEL);
+
+       if (!gscan_hotlist_cache) {
+               DHD_ERROR(("%s Cannot Malloc %d bytes!!\n", __FUNCTION__, malloc_size));
+               *send_evt_bytes = 0;
+               return ptr;
+       }
+
+       if (type == HOTLIST_FOUND) {
+               gscan_hotlist_cache->next = gscan_params->gscan_hotlist_found;
+               gscan_params->gscan_hotlist_found = gscan_hotlist_cache;
+               DHD_PNO(("%s enter, FOUND results count %d\n", __FUNCTION__, results->count));
+       } else {
+               gscan_hotlist_cache->next = gscan_params->gscan_hotlist_lost;
+               gscan_params->gscan_hotlist_lost = gscan_hotlist_cache;
+               DHD_PNO(("%s enter, LOST results count %d\n", __FUNCTION__, results->count));
+       }
+
+       gscan_hotlist_cache->tot_count = results->count;
+       gscan_hotlist_cache->tot_consumed = 0;
+       plnetinfo = results->netinfo;
+
+       for (i = 0; i < results->count; i++, plnetinfo++) {
+               hotlist_found_array = &gscan_hotlist_cache->results[i];
+               hotlist_found_array->channel = wf_channel2mhz(plnetinfo->pfnsubnet.channel,
+                       (plnetinfo->pfnsubnet.channel <= CH_MAX_2G_CHANNEL?
+                       WF_CHAN_FACTOR_2_4_G : WF_CHAN_FACTOR_5_G));
+               hotlist_found_array->rssi = (int32) plnetinfo->RSSI;
+               /* Info not available & not expected */
+               hotlist_found_array->beacon_period = 0;
+               hotlist_found_array->capability = 0;
+               hotlist_found_array->ie_length = 0;
+
+               hotlist_found_array->ts = convert_fw_rel_time_to_systime(plnetinfo->timestamp);
+               if (plnetinfo->pfnsubnet.SSID_len > DOT11_MAX_SSID_LEN) {
+                       DHD_ERROR(("Invalid SSID length %d: trimming it to max\n",
+                                 plnetinfo->pfnsubnet.SSID_len));
+                       plnetinfo->pfnsubnet.SSID_len = DOT11_MAX_SSID_LEN;
+               }
+               memcpy(hotlist_found_array->ssid, plnetinfo->pfnsubnet.SSID,
+                       plnetinfo->pfnsubnet.SSID_len);
+               hotlist_found_array->ssid[plnetinfo->pfnsubnet.SSID_len] = '\0';
+
+               memcpy(&hotlist_found_array->macaddr, &plnetinfo->pfnsubnet.BSSID, ETHER_ADDR_LEN);
+       DHD_PNO(("\t%s %02x:%02x:%02x:%02x:%02x:%02x rssi %d\n", hotlist_found_array->ssid,
+               hotlist_found_array->macaddr.octet[0],
+               hotlist_found_array->macaddr.octet[1],
+               hotlist_found_array->macaddr.octet[2],
+               hotlist_found_array->macaddr.octet[3],
+               hotlist_found_array->macaddr.octet[4],
+               hotlist_found_array->macaddr.octet[5],
+               hotlist_found_array->rssi));
+       }
+
+
+       if (results->status == PFN_COMPLETE) {
+               ptr = (void *) gscan_hotlist_cache;
+               while (gscan_hotlist_cache) {
+                       total += gscan_hotlist_cache->tot_count;
+                       gscan_hotlist_cache = gscan_hotlist_cache->next;
+               }
+               *send_evt_bytes =  total * sizeof(wifi_gscan_result_t);
+       }
+
+       return ptr;
+}
+#endif /* GSCAN_SUPPORT */
+int
+dhd_pno_event_handler(dhd_pub_t *dhd, wl_event_msg_t *event, void *event_data)
+{
+       int err = BCME_OK;
+       uint event_type;
+       dhd_pno_status_info_t *_pno_state;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       if (!WLS_SUPPORTED(_pno_state)) {
+               DHD_ERROR(("%s : wifi location service is not supported\n", __FUNCTION__));
+               err = BCME_UNSUPPORTED;
+               goto exit;
+       }
+       event_type = ntoh32(event->event_type);
+       DHD_PNO(("%s enter : event_type :%d\n", __FUNCTION__, event_type));
+       switch (event_type) {
+       case WLC_E_PFN_BSSID_NET_FOUND:
+       case WLC_E_PFN_BSSID_NET_LOST:
+               /* TODO : need to implement event logic using generic netlink */
+               break;
+       case WLC_E_PFN_BEST_BATCHING:
+#ifndef GSCAN_SUPPORT
+       {
+               struct dhd_pno_batch_params *params_batch;
+               params_batch = &_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS].params_batch;
+               if (!waitqueue_active(&_pno_state->get_batch_done.wait)) {
+                       DHD_PNO(("%s : WLC_E_PFN_BEST_BATCHING\n", __FUNCTION__));
+                       params_batch->get_batch.buf = NULL;
+                       params_batch->get_batch.bufsize = 0;
+                       params_batch->get_batch.reason = PNO_STATUS_EVENT;
+                       schedule_work(&_pno_state->work);
+               } else
+                       DHD_PNO(("%s : WLC_E_PFN_BEST_BATCHING"
+                               "will skip this event\n", __FUNCTION__));
+               break;
+       }
+#else
+               break;
+#endif /* !GSCAN_SUPPORT */
+       default:
+               DHD_ERROR(("unknown event : %d\n", event_type));
+       }
+exit:
+       return err;
+}
+
+int dhd_pno_init(dhd_pub_t *dhd)
+{
+       int err = BCME_OK;
+       dhd_pno_status_info_t *_pno_state;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+       UNUSED_PARAMETER(_dhd_pno_suspend);
+       if (dhd->pno_state)
+               goto exit;
+       dhd->pno_state = MALLOC(dhd->osh, sizeof(dhd_pno_status_info_t));
+       NULL_CHECK(dhd->pno_state, "failed to create dhd_pno_state", err);
+       memset(dhd->pno_state, 0, sizeof(dhd_pno_status_info_t));
+       /* need to check whether current firmware support batching and hotlist scan */
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       _pno_state->wls_supported = TRUE;
+       _pno_state->dhd = dhd;
+       mutex_init(&_pno_state->pno_mutex);
+       INIT_WORK(&_pno_state->work, _dhd_pno_get_batch_handler);
+       init_completion(&_pno_state->get_batch_done);
+#ifdef GSCAN_SUPPORT
+       init_waitqueue_head(&_pno_state->batch_get_wait);
+#endif /* GSCAN_SUPPORT */
+       err = dhd_iovar(dhd, 0, "pfnlbest", NULL, 0, 0);
+       if (err == BCME_UNSUPPORTED) {
+               _pno_state->wls_supported = FALSE;
+               DHD_INFO(("Current firmware doesn't support"
+                       " Android Location Service\n"));
+       } else {
+               DHD_ERROR(("%s: Support Android Location Service\n",
+                       __FUNCTION__));
+       }
+exit:
+       return err;
+}
+
+int dhd_pno_deinit(dhd_pub_t *dhd)
+{
+       int err = BCME_OK;
+       dhd_pno_status_info_t *_pno_state;
+       dhd_pno_params_t *_params;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+
+       DHD_PNO(("%s enter\n", __FUNCTION__));
+       _pno_state = PNO_GET_PNOSTATE(dhd);
+       NULL_CHECK(_pno_state, "pno_state is NULL", err);
+       /* may need to free legacy ssid_list */
+       if (_pno_state->pno_mode & DHD_PNO_LEGACY_MODE) {
+               _params = &_pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS];
+               _dhd_pno_reinitialize_prof(dhd, _params, DHD_PNO_LEGACY_MODE);
+       }
+
+#ifdef GSCAN_SUPPORT
+       if (_pno_state->pno_mode & DHD_PNO_GSCAN_MODE) {
+               _params = &_pno_state->pno_params_arr[INDEX_OF_GSCAN_PARAMS];
+               mutex_lock(&_pno_state->pno_mutex);
+               dhd_pno_reset_cfg_gscan(_params, _pno_state, GSCAN_FLUSH_ALL_CFG);
+               mutex_unlock(&_pno_state->pno_mutex);
+       }
+#endif /* GSCAN_SUPPORT */
+
+       if (_pno_state->pno_mode & DHD_PNO_BATCH_MODE) {
+               _params = &_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS];
+               /* clear resource if the BATCH MODE is on */
+               _dhd_pno_reinitialize_prof(dhd, _params, DHD_PNO_BATCH_MODE);
+       }
+       cancel_work_sync(&_pno_state->work);
+       MFREE(dhd->osh, _pno_state, sizeof(dhd_pno_status_info_t));
+       dhd->pno_state = NULL;
+       return err;
+}
+#endif /* PNO_SUPPORT */
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_pno.h b/drivers/net/wireless/bcmdhd_1363/dhd_pno.h
new file mode 100644 (file)
index 0000000..87164db
--- /dev/null
@@ -0,0 +1,498 @@
+/*
+ * Header file of Broadcom Dongle Host Driver (DHD)
+ * Prefered Network Offload code and Wi-Fi Location Service(WLS) code.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_pno.h 591285 2015-10-07 11:56:29Z $
+ */
+
+#ifndef __DHD_PNO_H__
+#define __DHD_PNO_H__
+
+#if defined(PNO_SUPPORT)
+#define PNO_TLV_PREFIX                 'S'
+#define PNO_TLV_VERSION                        '1'
+#define PNO_TLV_SUBTYPE_LEGACY_PNO '2'
+#define PNO_TLV_RESERVED               '0'
+#define PNO_BATCHING_SET "SET"
+#define PNO_BATCHING_GET "GET"
+#define PNO_BATCHING_STOP "STOP"
+#define PNO_PARAMS_DELIMETER " "
+#define PNO_PARAM_CHANNEL_DELIMETER ","
+#define PNO_PARAM_VALUE_DELLIMETER '='
+#define PNO_PARAM_SCANFREQ "SCANFREQ"
+#define PNO_PARAM_BESTN        "BESTN"
+#define PNO_PARAM_MSCAN "MSCAN"
+#define PNO_PARAM_CHANNEL "CHANNEL"
+#define PNO_PARAM_RTT "RTT"
+
+#define PNO_TLV_TYPE_SSID_IE           'S'
+#define PNO_TLV_TYPE_TIME              'T'
+#define PNO_TLV_FREQ_REPEAT            'R'
+#define PNO_TLV_FREQ_EXPO_MAX          'M'
+
+#define MAXNUM_SSID_PER_ADD    16
+#define MAXNUM_PNO_PARAMS 2
+#define PNO_TLV_COMMON_LENGTH  1
+#define DEFAULT_BATCH_MSCAN 16
+
+#define RESULTS_END_MARKER "----\n"
+#define SCAN_END_MARKER "####\n"
+#define AP_END_MARKER "====\n"
+#define PNO_RSSI_MARGIN_DBM          30
+
+#ifdef GSCAN_SUPPORT
+
+#define GSCAN_MAX_CH_BUCKETS         8
+#define GSCAN_BG_BAND_MASK             (1 << 0)
+#define GSCAN_A_BAND_MASK              (1 << 1)
+#define GSCAN_DFS_MASK                 (1 << 2)
+#define GSCAN_ABG_BAND_MASK            (GSCAN_A_BAND_MASK | GSCAN_BG_BAND_MASK)
+#define GSCAN_BAND_MASK                (GSCAN_ABG_BAND_MASK | GSCAN_DFS_MASK)
+
+#define GSCAN_FLUSH_HOTLIST_CFG      (1 << 0)
+#define GSCAN_FLUSH_SIGNIFICANT_CFG  (1 << 1)
+#define GSCAN_FLUSH_SCAN_CFG         (1 << 2)
+#define GSCAN_FLUSH_ALL_CFG     (GSCAN_FLUSH_SCAN_CFG | \
+                                                               GSCAN_FLUSH_SIGNIFICANT_CFG | \
+                                                               GSCAN_FLUSH_HOTLIST_CFG)
+/* Do not change GSCAN_BATCH_RETRIEVAL_COMPLETE */
+#define GSCAN_BATCH_RETRIEVAL_COMPLETE      0
+#define GSCAN_BATCH_RETRIEVAL_IN_PROGRESS   1
+#define GSCAN_BATCH_NO_THR_SET              101
+#define GSCAN_LOST_AP_WINDOW_DEFAULT        4
+#define GSCAN_MIN_BSSID_TIMEOUT             90
+#define GSCAN_BATCH_GET_MAX_WAIT            500
+#define CHANNEL_BUCKET_EMPTY_INDEX                      0xFFFF
+#define GSCAN_RETRY_THRESHOLD              3
+#endif /* GSCAN_SUPPORT */
+
+enum scan_status {
+       /* SCAN ABORT by other scan */
+       PNO_STATUS_ABORT,
+       /* RTT is presence or not */
+       PNO_STATUS_RTT_PRESENCE,
+       /* Disable PNO by Driver */
+       PNO_STATUS_DISABLE,
+       /* NORMAL BATCHING GET */
+       PNO_STATUS_NORMAL,
+       /* WLC_E_PFN_BEST_BATCHING */
+       PNO_STATUS_EVENT,
+       PNO_STATUS_MAX
+};
+#define PNO_STATUS_ABORT_MASK 0x0001
+#define PNO_STATUS_RTT_MASK 0x0002
+#define PNO_STATUS_DISABLE_MASK 0x0004
+#define PNO_STATUS_OOM_MASK 0x0010
+
+enum index_mode {
+       INDEX_OF_LEGACY_PARAMS,
+       INDEX_OF_BATCH_PARAMS,
+       INDEX_OF_HOTLIST_PARAMS,
+       /* GSCAN includes hotlist scan and they do not run
+        * independent of each other
+        */
+#ifdef GSCAN_SUPPORT
+       INDEX_OF_GSCAN_PARAMS = INDEX_OF_HOTLIST_PARAMS,
+#endif /* GSCAN_SUPPORT */
+       INDEX_MODE_MAX
+};
+enum dhd_pno_status {
+       DHD_PNO_DISABLED,
+       DHD_PNO_ENABLED,
+       DHD_PNO_SUSPEND
+};
+typedef struct cmd_tlv {
+       char prefix;
+       char version;
+       char subtype;
+       char reserved;
+} cmd_tlv_t;
+#ifdef GSCAN_SUPPORT
+typedef enum {
+    WIFI_BAND_UNSPECIFIED,
+    WIFI_BAND_BG = 1,                       /* 2.4 GHz                   */
+    WIFI_BAND_A = 2,                        /* 5 GHz without DFS         */
+    WIFI_BAND_A_DFS = 4,                    /* 5 GHz DFS only            */
+    WIFI_BAND_A_WITH_DFS = 6,               /* 5 GHz with DFS            */
+    WIFI_BAND_ABG = 3,                      /* 2.4 GHz + 5 GHz; no DFS   */
+    WIFI_BAND_ABG_WITH_DFS = 7,             /* 2.4 GHz + 5 GHz with DFS  */
+} gscan_wifi_band_t;
+
+typedef enum {
+       HOTLIST_LOST,
+       HOTLIST_FOUND
+} hotlist_type_t;
+
+typedef enum dhd_pno_gscan_cmd_cfg {
+       DHD_PNO_BATCH_SCAN_CFG_ID,
+       DHD_PNO_GEOFENCE_SCAN_CFG_ID,
+       DHD_PNO_SIGNIFICANT_SCAN_CFG_ID,
+       DHD_PNO_SCAN_CFG_ID,
+       DHD_PNO_GET_CAPABILITIES,
+       DHD_PNO_GET_BATCH_RESULTS,
+       DHD_PNO_GET_CHANNEL_LIST
+} dhd_pno_gscan_cmd_cfg_t;
+
+typedef enum dhd_pno_mode {
+       /* Wi-Fi Legacy PNO Mode */
+       DHD_PNO_NONE_MODE   = 0,
+       DHD_PNO_LEGACY_MODE = (1 << (0)),
+       /* Wi-Fi Android BATCH SCAN Mode */
+       DHD_PNO_BATCH_MODE = (1 << (1)),
+       /* Wi-Fi Android Hotlist SCAN Mode */
+       DHD_PNO_HOTLIST_MODE = (1 << (2)),
+       /* Wi-Fi Google Android SCAN Mode */
+       DHD_PNO_GSCAN_MODE = (1 << (3))
+} dhd_pno_mode_t;
+#else
+typedef enum dhd_pno_mode {
+       /* Wi-Fi Legacy PNO Mode */
+       DHD_PNO_NONE_MODE   = 0,
+       DHD_PNO_LEGACY_MODE = (1 << (0)),
+       /* Wi-Fi Android BATCH SCAN Mode */
+       DHD_PNO_BATCH_MODE = (1 << (1)),
+       /* Wi-Fi Android Hotlist SCAN Mode */
+       DHD_PNO_HOTLIST_MODE = (1 << (2))
+} dhd_pno_mode_t;
+#endif /* GSCAN_SUPPORT */
+struct dhd_pno_ssid {
+       bool            hidden;
+       uint32          SSID_len;
+       uchar           SSID[DOT11_MAX_SSID_LEN];
+       struct list_head list;
+};
+struct dhd_pno_bssid {
+       struct ether_addr       macaddr;
+       /* Bit4: suppress_lost, Bit3: suppress_found */
+       uint16                  flags;
+       struct list_head list;
+};
+typedef struct dhd_pno_bestnet_entry {
+       struct ether_addr BSSID;
+       uint8   SSID_len;
+       uint8   SSID[DOT11_MAX_SSID_LEN];
+       int8    RSSI;
+       uint8   channel;
+       uint32  timestamp;
+       uint16  rtt0; /* distance_cm based on RTT */
+       uint16  rtt1; /* distance_cm based on sample standard deviation */
+       unsigned long recorded_time;
+       struct list_head list;
+} dhd_pno_bestnet_entry_t;
+#define BESTNET_ENTRY_SIZE (sizeof(dhd_pno_bestnet_entry_t))
+
+typedef struct dhd_pno_bestnet_header {
+       struct dhd_pno_bestnet_header *next;
+       uint8 reason;
+       uint32 tot_cnt;
+       uint32 tot_size;
+       struct list_head entry_list;
+} dhd_pno_best_header_t;
+#define BEST_HEADER_SIZE (sizeof(dhd_pno_best_header_t))
+
+typedef struct dhd_pno_scan_results {
+       dhd_pno_best_header_t *bestnetheader;
+       uint8 cnt_header;
+       struct list_head list;
+} dhd_pno_scan_results_t;
+#define SCAN_RESULTS_SIZE (sizeof(dhd_pno_scan_results_t))
+
+struct dhd_pno_get_batch_info {
+       /* info related to get batch */
+       char *buf;
+       bool batch_started;
+       uint32 tot_scan_cnt;
+       uint32 expired_tot_scan_cnt;
+       uint32 top_node_cnt;
+       uint32 bufsize;
+       uint32 bytes_written;
+       int reason;
+       struct list_head scan_results_list;
+       struct list_head expired_scan_results_list;
+};
+struct dhd_pno_legacy_params {
+       uint16 scan_fr;
+       uint16 chan_list[WL_NUMCHANNELS];
+       uint16 nchan;
+       int pno_repeat;
+       int pno_freq_expo_max;
+       int nssid;
+       struct list_head ssid_list;
+};
+struct dhd_pno_batch_params {
+       int32 scan_fr;
+       uint8 bestn;
+       uint8 mscan;
+       uint8 band;
+       uint16 chan_list[WL_NUMCHANNELS];
+       uint16 nchan;
+       uint16 rtt;
+       struct dhd_pno_get_batch_info get_batch;
+};
+struct dhd_pno_hotlist_params {
+       uint8 band;
+       int32 scan_fr;
+       uint16 chan_list[WL_NUMCHANNELS];
+       uint16 nchan;
+       uint16 nbssid;
+       struct list_head bssid_list;
+};
+#ifdef GSCAN_SUPPORT
+typedef struct dhd_pno_gscan_channel_bucket {
+       uint16 bucket_freq_multiple;
+       /* band = 1 All bg band channels,
+        * band = 2 All a band channels,
+        * band = 0 chan_list channels
+        */
+       uint16 band;
+       uint8 report_flag;
+       uint8 num_channels;
+       uint16 chan_list[GSCAN_MAX_CH_BUCKETS];
+} dhd_pno_gscan_channel_bucket_t;
+
+typedef struct dhd_pno_swc_evt_param {
+       uint16 results_rxed_so_far;
+       wl_pfn_significant_net_t *change_array;
+} dhd_pno_swc_evt_param_t;
+
+typedef struct wifi_gscan_result {
+       uint64 ts;                           /* Time of discovery           */
+       char ssid[DOT11_MAX_SSID_LEN+1];     /* null terminated             */
+       struct ether_addr       macaddr;         /* BSSID                      */
+       uint32 channel;                      /* channel frequency in MHz    */
+       int32 rssi;                          /* in db                       */
+       uint64 rtt;                          /* in nanoseconds              */
+       uint64 rtt_sd;                       /* standard deviation in rtt   */
+       uint16 beacon_period;                /* units are Kusec             */
+       uint16 capability;                   /* Capability information       */
+       uint32 ie_length;                    /* byte length of Information Elements */
+       char  ie_data[1];                    /* IE data to follow       */
+} wifi_gscan_result_t;
+
+typedef struct gscan_results_cache {
+       struct gscan_results_cache *next;
+       uint8  scan_id;
+       uint8  flag;
+       uint8  tot_count;
+       uint8  tot_consumed;
+       wifi_gscan_result_t results[1];
+} gscan_results_cache_t;
+
+typedef struct dhd_pno_gscan_capabilities {
+       int max_scan_cache_size;
+       int max_scan_buckets;
+       int max_ap_cache_per_scan;
+       int max_rssi_sample_size;
+       int max_scan_reporting_threshold;
+       int max_hotlist_aps;
+       int max_significant_wifi_change_aps;
+} dhd_pno_gscan_capabilities_t;
+
+struct dhd_pno_gscan_params {
+       int32 scan_fr;
+       uint8 bestn;
+       uint8 mscan;
+       uint8 buffer_threshold;
+       uint8 swc_nbssid_threshold;
+       uint8 swc_rssi_window_size;
+       uint8 lost_ap_window;
+       uint8 nchannel_buckets;
+       uint8 reason;
+       uint8 get_batch_flag;
+       uint8 send_all_results_flag;
+       uint16 max_ch_bucket_freq;
+       gscan_results_cache_t *gscan_batch_cache;
+       gscan_results_cache_t *gscan_hotlist_found;
+       gscan_results_cache_t *gscan_hotlist_lost;
+       uint16 nbssid_significant_change;
+       uint16 nbssid_hotlist;
+       struct dhd_pno_swc_evt_param param_significant;
+       struct dhd_pno_gscan_channel_bucket channel_bucket[GSCAN_MAX_CH_BUCKETS];
+       struct list_head hotlist_bssid_list;
+       struct list_head significant_bssid_list;
+};
+
+typedef struct gscan_scan_params {
+       int32 scan_fr;
+       uint16 nchannel_buckets;
+       struct dhd_pno_gscan_channel_bucket channel_bucket[GSCAN_MAX_CH_BUCKETS];
+} gscan_scan_params_t;
+
+typedef struct gscan_batch_params {
+       uint8 bestn;
+       uint8 mscan;
+       uint8 buffer_threshold;
+} gscan_batch_params_t;
+
+struct bssid_t {
+       struct ether_addr       macaddr;
+       int16 rssi_reporting_threshold;  /* 0 -> no reporting threshold */
+};
+
+typedef struct gscan_hotlist_scan_params {
+       uint16 lost_ap_window; /* number of scans to declare LOST */
+       uint16 nbssid;   /* number of bssids  */
+       struct bssid_t bssid[1];  /* n bssids to follow */
+} gscan_hotlist_scan_params_t;
+
+/* SWC (Significant WiFi Change) params */
+typedef struct gscan_swc_params {
+       /* Rssi averaging window size */
+       uint8 rssi_window;
+       /* Number of scans that the AP has to be absent before
+        * being declared LOST
+        */
+       uint8 lost_ap_window;
+       /* if x  Aps have a significant change generate an event. */
+       uint8 swc_threshold;
+       uint8 nbssid;
+       wl_pfn_significant_bssid_t bssid_elem_list[1];
+} gscan_swc_params_t;
+
+typedef struct dhd_pno_significant_bssid {
+       struct ether_addr BSSID;
+       int8 rssi_low_threshold;
+       int8 rssi_high_threshold;
+       struct list_head list;
+} dhd_pno_significant_bssid_t;
+#endif /* GSCAN_SUPPORT */
+typedef union dhd_pno_params {
+       struct dhd_pno_legacy_params params_legacy;
+       struct dhd_pno_batch_params params_batch;
+       struct dhd_pno_hotlist_params params_hotlist;
+#ifdef GSCAN_SUPPORT
+       struct dhd_pno_gscan_params params_gscan;
+#endif /* GSCAN_SUPPORT */
+} dhd_pno_params_t;
+typedef struct dhd_pno_status_info {
+       uint8 pno_oui[DOT11_OUI_LEN];
+       dhd_pub_t *dhd;
+       struct work_struct work;
+       struct mutex pno_mutex;
+#ifdef GSCAN_SUPPORT
+       wait_queue_head_t batch_get_wait;
+#endif /* GSCAN_SUPPORT */
+       struct completion get_batch_done;
+       bool wls_supported; /* wifi location service supported or not */
+       enum dhd_pno_status pno_status;
+       enum dhd_pno_mode pno_mode;
+       dhd_pno_params_t pno_params_arr[INDEX_MODE_MAX];
+       struct list_head head_list;
+} dhd_pno_status_info_t;
+
+/* wrapper functions */
+extern int
+dhd_dev_pno_enable(struct net_device *dev, int enable);
+
+extern int
+dhd_dev_pno_stop_for_ssid(struct net_device *dev);
+
+extern int
+dhd_dev_pno_set_for_ssid(struct net_device *dev, wlc_ssid_ext_t* ssids_local, int nssid,
+       uint16 scan_fr, int pno_repeat, int pno_freq_expo_max, uint16 *channel_list, int nchan);
+
+extern int
+dhd_dev_pno_set_for_batch(struct net_device *dev,
+       struct dhd_pno_batch_params *batch_params);
+
+extern int
+dhd_dev_pno_get_for_batch(struct net_device *dev, char *buf, int bufsize);
+
+extern int
+dhd_dev_pno_stop_for_batch(struct net_device *dev);
+
+extern int
+dhd_dev_pno_set_for_hotlist(struct net_device *dev, wl_pfn_bssid_t *p_pfn_bssid,
+       struct dhd_pno_hotlist_params *hotlist_params);
+extern int dhd_dev_pno_set_mac_oui(struct net_device *dev, uint8 *oui);
+#ifdef GSCAN_SUPPORT
+extern int
+dhd_dev_pno_set_cfg_gscan(struct net_device *dev, dhd_pno_gscan_cmd_cfg_t type,
+              void *buf, uint8 flush);
+extern void *
+dhd_dev_pno_get_gscan(struct net_device *dev, dhd_pno_gscan_cmd_cfg_t type, void *info,
+        uint32 *len);
+void dhd_dev_pno_lock_access_batch_results(struct net_device *dev);
+void dhd_dev_pno_unlock_access_batch_results(struct net_device *dev);
+extern int dhd_dev_pno_run_gscan(struct net_device *dev, bool run, bool flush);
+extern int dhd_dev_pno_enable_full_scan_result(struct net_device *dev, bool real_time);
+extern void * dhd_dev_swc_scan_event(struct net_device *dev, const void  *data,
+              int *send_evt_bytes);
+int dhd_retreive_batch_scan_results(dhd_pub_t *dhd);
+extern void * dhd_dev_hotlist_scan_event(struct net_device *dev,
+            const void  *data, int *send_evt_bytes, hotlist_type_t type);
+void * dhd_dev_process_full_gscan_result(struct net_device *dev,
+            const void  *data, int *send_evt_bytes);
+extern int dhd_dev_gscan_batch_cache_cleanup(struct net_device *dev);
+extern void dhd_dev_gscan_hotlist_cache_cleanup(struct net_device *dev, hotlist_type_t type);
+extern void dhd_dev_wait_batch_results_complete(struct net_device *dev);
+#endif /* GSCAN_SUPPORT */
+/* dhd pno fuctions */
+extern int dhd_pno_stop_for_ssid(dhd_pub_t *dhd);
+extern int dhd_pno_enable(dhd_pub_t *dhd, int enable);
+extern int dhd_pno_set_for_ssid(dhd_pub_t *dhd, wlc_ssid_ext_t* ssid_list, int nssid,
+       uint16  scan_fr, int pno_repeat, int pno_freq_expo_max, uint16 *channel_list, int nchan);
+
+extern int dhd_pno_set_for_batch(dhd_pub_t *dhd, struct dhd_pno_batch_params *batch_params);
+
+extern int dhd_pno_get_for_batch(dhd_pub_t *dhd, char *buf, int bufsize, int reason);
+
+
+extern int dhd_pno_stop_for_batch(dhd_pub_t *dhd);
+
+extern int dhd_pno_set_for_hotlist(dhd_pub_t *dhd, wl_pfn_bssid_t *p_pfn_bssid,
+       struct dhd_pno_hotlist_params *hotlist_params);
+
+extern int dhd_pno_stop_for_hotlist(dhd_pub_t *dhd);
+
+extern int dhd_pno_event_handler(dhd_pub_t *dhd, wl_event_msg_t *event, void *event_data);
+extern int dhd_pno_init(dhd_pub_t *dhd);
+extern int dhd_pno_deinit(dhd_pub_t *dhd);
+extern bool dhd_is_pno_supported(dhd_pub_t *dhd);
+extern int dhd_pno_set_mac_oui(dhd_pub_t *dhd, uint8 *oui);
+#ifdef GSCAN_SUPPORT
+extern int dhd_pno_set_cfg_gscan(dhd_pub_t *dhd, dhd_pno_gscan_cmd_cfg_t type,
+                       void *buf, uint8 flush);
+extern void * dhd_pno_get_gscan(dhd_pub_t *dhd, dhd_pno_gscan_cmd_cfg_t type, void *info,
+                       uint32 *len);
+extern void dhd_pno_lock_batch_results(dhd_pub_t *dhd);
+extern void dhd_pno_unlock_batch_results(dhd_pub_t *dhd);
+extern int dhd_pno_initiate_gscan_request(dhd_pub_t *dhd, bool run, bool flush);
+extern int dhd_pno_enable_full_scan_result(dhd_pub_t *dhd, bool real_time_flag);
+extern int dhd_pno_cfg_gscan(dhd_pub_t *dhd, dhd_pno_gscan_cmd_cfg_t type, void *buf);
+extern int dhd_dev_retrieve_batch_scan(struct net_device *dev);
+extern void *dhd_handle_swc_evt(dhd_pub_t *dhd, const void *event_data, int *send_evt_bytes);
+extern void *dhd_handle_hotlist_scan_evt(dhd_pub_t *dhd, const void *event_data,
+                       int *send_evt_bytes, hotlist_type_t type);
+extern void *dhd_process_full_gscan_result(dhd_pub_t *dhd, const void *event_data,
+                       int *send_evt_bytes);
+extern int dhd_gscan_batch_cache_cleanup(dhd_pub_t *dhd);
+extern void dhd_gscan_hotlist_cache_cleanup(dhd_pub_t *dhd, hotlist_type_t type);
+extern void dhd_wait_batch_results_complete(dhd_pub_t *dhd);
+#endif /* GSCAN_SUPPORT */
+#endif 
+
+#endif /* __DHD_PNO_H__ */
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_proto.h b/drivers/net/wireless/bcmdhd_1363/dhd_proto.h
new file mode 100644 (file)
index 0000000..c752477
--- /dev/null
@@ -0,0 +1,169 @@
+/*
+ * Header file describing the internal (inter-module) DHD interfaces.
+ *
+ * Provides type definitions and function prototypes used to link the
+ * DHD OS, bus, and protocol modules.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_proto.h 604483 2015-12-07 14:47:36Z $
+ */
+
+#ifndef _dhd_proto_h_
+#define _dhd_proto_h_
+
+#include <dhdioctl.h>
+#include <wlioctl.h>
+#ifdef BCMPCIE
+#include <dhd_flowring.h>
+#endif
+
+#define DEFAULT_IOCTL_RESP_TIMEOUT     2000
+#ifndef IOCTL_RESP_TIMEOUT
+/* In milli second default value for Production FW */
+#define IOCTL_RESP_TIMEOUT  DEFAULT_IOCTL_RESP_TIMEOUT
+#endif /* IOCTL_RESP_TIMEOUT */
+
+#ifndef MFG_IOCTL_RESP_TIMEOUT
+#define MFG_IOCTL_RESP_TIMEOUT  20000  /* In milli second default value for MFG FW */
+#endif /* MFG_IOCTL_RESP_TIMEOUT */
+
+#define DEFAULT_D3_ACK_RESP_TIMEOUT    4000
+#ifndef D3_ACK_RESP_TIMEOUT
+#define D3_ACK_RESP_TIMEOUT            DEFAULT_D3_ACK_RESP_TIMEOUT
+#endif /* D3_ACK_RESP_TIMEOUT */
+
+#define DEFAULT_DHD_BUS_BUSY_TIMEOUT   (IOCTL_RESP_TIMEOUT + 1000)
+#ifndef DHD_BUS_BUSY_TIMEOUT
+#define DHD_BUS_BUSY_TIMEOUT   DEFAULT_DHD_BUS_BUSY_TIMEOUT
+#endif /* DEFAULT_DHD_BUS_BUSY_TIMEOUT */
+
+#define IOCTL_DISABLE_TIMEOUT 0
+/*
+ * Exported from the dhd protocol module (dhd_cdc, dhd_rndis)
+ */
+
+/* Linkage, sets prot link and updates hdrlen in pub */
+extern int dhd_prot_attach(dhd_pub_t *dhdp);
+
+/* Initilizes the index block for dma'ing indices */
+extern int dhd_prot_dma_indx_init(dhd_pub_t *dhdp, uint32 rw_index_sz,
+       uint8 type, uint32 length);
+
+/* Unlink, frees allocated protocol memory (including dhd_prot) */
+extern void dhd_prot_detach(dhd_pub_t *dhdp);
+
+/* Initialize protocol: sync w/dongle state.
+ * Sets dongle media info (iswl, drv_version, mac address).
+ */
+extern int dhd_sync_with_dongle(dhd_pub_t *dhdp);
+
+/* Protocol initialization needed for IOCTL/IOVAR path */
+extern int dhd_prot_init(dhd_pub_t *dhd);
+
+/* Stop protocol: sync w/dongle state. */
+extern void dhd_prot_stop(dhd_pub_t *dhdp);
+
+/* Add any protocol-specific data header.
+ * Caller must reserve prot_hdrlen prepend space.
+ */
+extern void dhd_prot_hdrpush(dhd_pub_t *, int ifidx, void *txp);
+extern uint dhd_prot_hdrlen(dhd_pub_t *, void *txp);
+
+/* Remove any protocol-specific data header. */
+extern int dhd_prot_hdrpull(dhd_pub_t *, int *ifidx, void *rxp, uchar *buf, uint *len);
+
+/* Use protocol to issue ioctl to dongle */
+extern int dhd_prot_ioctl(dhd_pub_t *dhd, int ifidx, wl_ioctl_t * ioc, void * buf, int len);
+
+/* Handles a protocol control response asynchronously */
+extern int dhd_prot_ctl_complete(dhd_pub_t *dhd);
+
+/* Check for and handle local prot-specific iovar commands */
+extern int dhd_prot_iovar_op(dhd_pub_t *dhdp, const char *name,
+                             void *params, int plen, void *arg, int len, bool set);
+
+/* Add prot dump output to a buffer */
+extern void dhd_prot_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf);
+
+/* Update local copy of dongle statistics */
+extern void dhd_prot_dstats(dhd_pub_t *dhdp);
+
+extern int dhd_ioctl(dhd_pub_t * dhd_pub, dhd_ioctl_t *ioc, void * buf, uint buflen);
+
+extern int dhd_preinit_ioctls(dhd_pub_t *dhd);
+
+extern int dhd_process_pkt_reorder_info(dhd_pub_t *dhd, uchar *reorder_info_buf,
+       uint reorder_info_len, void **pkt, uint32 *free_buf_count);
+
+#ifdef BCMPCIE
+extern bool dhd_prot_process_msgbuf_txcpl(dhd_pub_t *dhd, uint bound);
+extern bool dhd_prot_process_msgbuf_rxcpl(dhd_pub_t *dhd, uint bound);
+extern int dhd_prot_process_ctrlbuf(dhd_pub_t * dhd);
+extern bool dhd_prot_dtohsplit(dhd_pub_t * dhd);
+extern int dhd_post_dummy_msg(dhd_pub_t *dhd);
+extern int dhdmsgbuf_lpbk_req(dhd_pub_t *dhd, uint len);
+extern void dhd_prot_rx_dataoffset(dhd_pub_t *dhd, uint32 offset);
+extern int dhd_prot_txdata(dhd_pub_t *dhd, void *p, uint8 ifidx);
+extern int dhdmsgbuf_dmaxfer_req(dhd_pub_t *dhd, uint len, uint srcdelay, uint destdelay);
+
+extern void dhd_dma_buf_init(dhd_pub_t *dhd, void *dma_buf,
+       void *va, uint32 len, dmaaddr_t pa, void *dmah, void *secdma);
+extern void dhd_prot_flowrings_pool_release(dhd_pub_t *dhd,
+       uint16 flowid, void *msgbuf_ring);
+extern int dhd_prot_flow_ring_create(dhd_pub_t *dhd, flow_ring_node_t *flow_ring_node);
+extern int dhd_post_tx_ring_item(dhd_pub_t *dhd, void *PKTBUF, uint8 ifindex);
+extern int dhd_prot_flow_ring_delete(dhd_pub_t *dhd, flow_ring_node_t *flow_ring_node);
+extern int dhd_prot_flow_ring_flush(dhd_pub_t *dhd, flow_ring_node_t *flow_ring_node);
+extern int dhd_prot_ringupd_dump(dhd_pub_t *dhd, struct bcmstrbuf *b);
+extern uint32 dhd_prot_metadata_dbg_set(dhd_pub_t *dhd, bool val);
+extern uint32 dhd_prot_metadata_dbg_get(dhd_pub_t *dhd);
+extern uint32 dhd_prot_metadatalen_set(dhd_pub_t *dhd, uint32 val, bool rx);
+extern uint32 dhd_prot_metadatalen_get(dhd_pub_t *dhd, bool rx);
+extern void dhd_prot_print_flow_ring(dhd_pub_t *dhd, void *msgbuf_flow_info,
+       struct bcmstrbuf *strbuf, const char * fmt);
+extern void dhd_prot_print_info(dhd_pub_t *dhd, struct bcmstrbuf *strbuf);
+extern void dhd_prot_update_txflowring(dhd_pub_t *dhdp, uint16 flow_id, void *msgring_info);
+extern void dhd_prot_txdata_write_flush(dhd_pub_t *dhd, uint16 flow_id, bool in_lock);
+extern uint32 dhd_prot_txp_threshold(dhd_pub_t *dhd, bool set, uint32 val);
+extern void dhd_prot_reset(dhd_pub_t *dhd);
+#ifdef DHD_LB
+extern void dhd_lb_tx_compl_handler(unsigned long data);
+extern void dhd_lb_rx_compl_handler(unsigned long data);
+extern void dhd_lb_rx_process_handler(unsigned long data);
+#endif /* DHD_LB */
+void dhd_prot_collect_memdump(dhd_pub_t *dhd);
+#endif /* BCMPCIE */
+/********************************
+ * For version-string expansion *
+ */
+#if defined(BDC)
+#define DHD_PROTOCOL "bdc"
+#elif defined(CDC)
+#define DHD_PROTOCOL "cdc"
+#else
+#define DHD_PROTOCOL "unknown"
+#endif /* proto */
+
+#endif /* _dhd_proto_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_rtt.c b/drivers/net/wireless/bcmdhd_1363/dhd_rtt.c
new file mode 100644 (file)
index 0000000..f51eee2
--- /dev/null
@@ -0,0 +1,729 @@
+/*
+ * Broadcom Dongle Host Driver (DHD), RTT
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: dhd_rtt.c 612549 2016-01-14 07:39:32Z $
+ */
+#ifdef RTT_SUPPORT
+#include <typedefs.h>
+#include <osl.h>
+
+#include <epivers.h>
+#include <bcmutils.h>
+
+#include <bcmendian.h>
+#include <linuxver.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/sort.h>
+#include <dngl_stats.h>
+#include <wlioctl.h>
+
+#include <proto/bcmevent.h>
+#include <dhd.h>
+#include <dhd_rtt.h>
+#include <dhd_dbg.h>
+#define GET_RTTSTATE(dhd) ((rtt_status_info_t *)dhd->rtt_state)
+static DEFINE_SPINLOCK(noti_list_lock);
+#define NULL_CHECK(p, s, err)  \
+                       do { \
+                               if (!(p)) { \
+                                       printf("NULL POINTER (%s) : %s\n", __FUNCTION__, (s)); \
+                                       err = BCME_ERROR; \
+                                       return err; \
+                               } \
+                       } while (0)
+
+#define RTT_TWO_SIDED(capability) \
+                       do { \
+                               if ((capability & RTT_CAP_ONE_WAY) == (uint8) (RTT_CAP_ONE_WAY)) \
+                                       return FALSE; \
+                               else \
+                                       return TRUE; \
+                       } while (0)
+#define TIMESPEC_TO_US(ts)  (((uint64)(ts).tv_sec * USEC_PER_SEC) + \
+                                                       (ts).tv_nsec / NSEC_PER_USEC)
+struct rtt_noti_callback {
+       struct list_head list;
+       void *ctx;
+       dhd_rtt_compl_noti_fn noti_fn;
+};
+
+typedef struct rtt_status_info {
+       dhd_pub_t *dhd;
+       int8 status;   /* current status for the current entry */
+       int8 cur_idx; /* current entry to do RTT */
+       int32 capability; /* rtt capability */
+       struct mutex rtt_mutex;
+       rtt_config_params_t rtt_config;
+       struct work_struct work;
+       struct list_head noti_fn_list;
+       struct list_head rtt_results_cache; /* store results for RTT */
+} rtt_status_info_t;
+
+static int dhd_rtt_start(dhd_pub_t *dhd);
+
+chanspec_t
+dhd_rtt_convert_to_chspec(wifi_channel_info_t channel)
+{
+       int bw;
+       /* set witdh to 20MHZ for 2.4G HZ */
+       if (channel.center_freq >= 2400 && channel.center_freq <= 2500) {
+               channel.width = WIFI_CHAN_WIDTH_20;
+       }
+       switch (channel.width) {
+       case WIFI_CHAN_WIDTH_20:
+               bw = WL_CHANSPEC_BW_20;
+               break;
+       case WIFI_CHAN_WIDTH_40:
+               bw = WL_CHANSPEC_BW_40;
+               break;
+       case WIFI_CHAN_WIDTH_80:
+               bw = WL_CHANSPEC_BW_80;
+               break;
+       case WIFI_CHAN_WIDTH_160:
+               bw = WL_CHANSPEC_BW_160;
+               break;
+       default:
+               DHD_ERROR(("doesn't support this bandwith : %d", channel.width));
+               bw = -1;
+               break;
+       }
+       return wf_channel2chspec(wf_mhz2channel(channel.center_freq, 0), bw);
+}
+
+int
+dhd_rtt_set_cfg(dhd_pub_t *dhd, rtt_config_params_t *params)
+{
+       int err = BCME_OK;
+       int idx;
+       rtt_status_info_t *rtt_status;
+       NULL_CHECK(params, "params is NULL", err);
+
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       rtt_status = GET_RTTSTATE(dhd);
+       NULL_CHECK(rtt_status, "rtt_status is NULL", err);
+       if (rtt_status->capability == RTT_CAP_NONE) {
+               DHD_ERROR(("doesn't support RTT \n"));
+               return BCME_ERROR;
+       }
+       if (rtt_status->status == RTT_STARTED) {
+               DHD_ERROR(("rtt is already started\n"));
+               return BCME_BUSY;
+       }
+       DHD_RTT(("%s enter\n", __FUNCTION__));
+       bcopy(params, &rtt_status->rtt_config, sizeof(rtt_config_params_t));
+       rtt_status->status = RTT_STARTED;
+       /* start to measure RTT from 1th device */
+       /* find next target to trigger RTT */
+       for (idx = rtt_status->cur_idx; idx < rtt_status->rtt_config.rtt_target_cnt; idx++) {
+               /* skip the disabled device */
+               if (rtt_status->rtt_config.target_info[idx].disable) {
+                       continue;
+               } else {
+                       /* set the idx to cur_idx */
+                       rtt_status->cur_idx = idx;
+                       break;
+               }
+       }
+       if (idx < rtt_status->rtt_config.rtt_target_cnt) {
+               DHD_RTT(("rtt_status->cur_idx : %d\n", rtt_status->cur_idx));
+               schedule_work(&rtt_status->work);
+       }
+       return err;
+}
+
+int
+dhd_rtt_stop(dhd_pub_t *dhd, struct ether_addr *mac_list, int mac_cnt)
+{
+       int err = BCME_OK;
+       int i = 0, j = 0;
+       rtt_status_info_t *rtt_status;
+
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       rtt_status = GET_RTTSTATE(dhd);
+       NULL_CHECK(rtt_status, "rtt_status is NULL", err);
+       if (rtt_status->status == RTT_STOPPED) {
+               DHD_ERROR(("rtt is not started\n"));
+               return BCME_OK;
+       }
+       DHD_RTT(("%s enter\n", __FUNCTION__));
+       mutex_lock(&rtt_status->rtt_mutex);
+       for (i = 0; i < mac_cnt; i++) {
+               for (j = 0; j < rtt_status->rtt_config.rtt_target_cnt; j++) {
+                       if (!bcmp(&mac_list[i], &rtt_status->rtt_config.target_info[j].addr,
+                               ETHER_ADDR_LEN)) {
+                               rtt_status->rtt_config.target_info[j].disable = TRUE;
+                       }
+               }
+       }
+       mutex_unlock(&rtt_status->rtt_mutex);
+       return err;
+}
+
+static int
+dhd_rtt_start(dhd_pub_t *dhd)
+{
+       int err = BCME_OK;
+       int mpc = 0;
+       int nss, mcs, bw;
+       uint32 rspec = 0;
+       int8 eabuf[ETHER_ADDR_STR_LEN];
+       int8 chanbuf[CHANSPEC_STR_LEN];
+       bool set_mpc = FALSE;
+       wl_proxd_iovar_t proxd_iovar;
+       wl_proxd_params_iovar_t proxd_params;
+       wl_proxd_params_iovar_t proxd_tune;
+       wl_proxd_params_tof_method_t *tof_params = &proxd_params.u.tof_params;
+       rtt_status_info_t *rtt_status;
+       rtt_target_info_t *rtt_target;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+
+       rtt_status = GET_RTTSTATE(dhd);
+       NULL_CHECK(rtt_status, "rtt_status is NULL", err);
+       /* turn off mpc in case of non-associted */
+       if (!dhd_is_associated(dhd, 0, NULL)) {
+               err = dhd_iovar(dhd, 0, "mpc", (char *)&mpc, sizeof(mpc), 1);
+               if (err < 0) {
+                       DHD_ERROR(("%s : failed to set proxd_tune\n", __FUNCTION__));
+                       goto exit;
+               }
+               set_mpc = TRUE;
+       }
+
+       if (rtt_status->cur_idx >= rtt_status->rtt_config.rtt_target_cnt) {
+               err = BCME_RANGE;
+               goto exit;
+       }
+       DHD_RTT(("%s enter\n", __FUNCTION__));
+       bzero(&proxd_tune, sizeof(proxd_tune));
+       bzero(&proxd_params, sizeof(proxd_params));
+       mutex_lock(&rtt_status->rtt_mutex);
+       /* Get a target information */
+       rtt_target = &rtt_status->rtt_config.target_info[rtt_status->cur_idx];
+       mutex_unlock(&rtt_status->rtt_mutex);
+       /* set role */
+       proxd_iovar.method = PROXD_TOF_METHOD;
+       proxd_iovar.mode = WL_PROXD_MODE_INITIATOR;
+
+       /* make sure that proxd is stop */
+       /* dhd_iovar(dhd, 0, "proxd_stop", (char *)NULL, 0, 1); */
+
+       err = dhd_iovar(dhd, 0, "proxd", (char *)&proxd_iovar, sizeof(proxd_iovar), 1);
+       if (err < 0 && err != BCME_BUSY) {
+               DHD_ERROR(("%s : failed to set proxd %d\n", __FUNCTION__, err));
+               goto exit;
+       }
+       if (err == BCME_BUSY) {
+               DHD_RTT(("BCME_BUSY occurred\n"));
+       }
+       /* mac address */
+       bcopy(&rtt_target->addr, &tof_params->tgt_mac, ETHER_ADDR_LEN);
+       /* frame count */
+       if (rtt_target->ftm_cnt > RTT_MAX_FRAME_CNT) {
+               rtt_target->ftm_cnt = RTT_MAX_FRAME_CNT;
+       }
+
+       if (rtt_target->ftm_cnt) {
+               tof_params->ftm_cnt = htol16(rtt_target->ftm_cnt);
+       } else {
+               tof_params->ftm_cnt = htol16(DEFAULT_FTM_CNT);
+       }
+
+       if (rtt_target->retry_cnt > RTT_MAX_RETRY_CNT) {
+               rtt_target->retry_cnt = RTT_MAX_RETRY_CNT;
+       }
+
+       /* retry count */
+       if (rtt_target->retry_cnt) {
+               tof_params->retry_cnt = htol16(rtt_target->retry_cnt);
+       } else {
+               tof_params->retry_cnt = htol16(DEFAULT_RETRY_CNT);
+       }
+
+       /* chanspec */
+       tof_params->chanspec = htol16(rtt_target->chanspec);
+       /* set parameter */
+       DHD_RTT(("Target addr(Idx %d) %s, Channel : %s for RTT (ftm_cnt %d, rety_cnt : %d)\n",
+               rtt_status->cur_idx,
+               bcm_ether_ntoa((const struct ether_addr *)&rtt_target->addr, eabuf),
+               wf_chspec_ntoa(rtt_target->chanspec, chanbuf), rtt_target->ftm_cnt,
+               rtt_target->retry_cnt));
+
+       if (rtt_target->type == RTT_ONE_WAY) {
+               proxd_tune.u.tof_tune.flags = htol32(WL_PROXD_FLAG_ONEWAY);
+               /* report RTT results for initiator */
+               proxd_tune.u.tof_tune.flags |= htol32(WL_PROXD_FLAG_INITIATOR_RPTRTT);
+               proxd_tune.u.tof_tune.vhtack = 0;
+               tof_params->tx_rate = htol16(WL_RATE_6M);
+               tof_params->vht_rate = htol16((WL_RATE_6M >> 16));
+       } else { /* RTT TWO WAY */
+               /* initiator will send the rtt result to the target  */
+               proxd_tune.u.tof_tune.flags = htol32(WL_PROXD_FLAG_INITIATOR_REPORT);
+               tof_params->timeout = 10; /* 10ms for timeout */
+               rspec = WL_RSPEC_ENCODE_VHT;    /* 11ac VHT */
+               nss = 1; /* default Nss = 1 */
+               mcs = 0; /* default MCS 0 */
+               rspec |= (nss << WL_RSPEC_VHT_NSS_SHIFT) | mcs;
+               bw = 0;
+               switch (CHSPEC_BW(rtt_target->chanspec)) {
+               case WL_CHANSPEC_BW_20:
+                       bw = WL_RSPEC_BW_20MHZ;
+                       break;
+               case WL_CHANSPEC_BW_40:
+                       bw = WL_RSPEC_BW_40MHZ;
+                       break;
+               case WL_CHANSPEC_BW_80:
+                       bw = WL_RSPEC_BW_80MHZ;
+                       break;
+               case WL_CHANSPEC_BW_160:
+                       bw = WL_RSPEC_BW_160MHZ;
+                       break;
+               default:
+                       DHD_ERROR(("CHSPEC_BW not supported : %d",
+                               CHSPEC_BW(rtt_target->chanspec)));
+                       goto exit;
+               }
+               rspec |= bw;
+               tof_params->tx_rate = htol16(rspec & 0xffff);
+               tof_params->vht_rate = htol16(rspec >> 16);
+       }
+
+       /* Set Method to TOF */
+       proxd_tune.method = PROXD_TOF_METHOD;
+       err = dhd_iovar(dhd, 0, "proxd_tune", (char *)&proxd_tune, sizeof(proxd_tune), 1);
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to set proxd_tune %d\n", __FUNCTION__, err));
+               goto exit;
+       }
+
+       /* Set Method to TOF */
+       proxd_params.method = PROXD_TOF_METHOD;
+       err = dhd_iovar(dhd, 0, "proxd_params", (char *)&proxd_params, sizeof(proxd_params), 1);
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to set proxd_params %d\n", __FUNCTION__, err));
+               goto exit;
+       }
+       err = dhd_iovar(dhd, 0, "proxd_find", (char *)NULL, 0, 1);
+       if (err < 0) {
+               DHD_ERROR(("%s : failed to set proxd_find %d\n", __FUNCTION__, err));
+               goto exit;
+       }
+exit:
+       if (err < 0) {
+               rtt_status->status = RTT_STOPPED;
+               if (set_mpc) {
+                       /* enable mpc again in case of error */
+                       mpc = 1;
+                       err = dhd_iovar(dhd, 0, "mpc", (char *)&mpc, sizeof(mpc), 1);
+               }
+       }
+       return err;
+}
+
+int
+dhd_rtt_register_noti_callback(dhd_pub_t *dhd, void *ctx, dhd_rtt_compl_noti_fn noti_fn)
+{
+       int err = BCME_OK;
+       struct rtt_noti_callback *cb = NULL, *iter;
+       rtt_status_info_t *rtt_status;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(noti_fn, "noti_fn is NULL", err);
+
+       rtt_status = GET_RTTSTATE(dhd);
+       NULL_CHECK(rtt_status, "rtt_status is NULL", err);
+       spin_lock_bh(&noti_list_lock);
+       list_for_each_entry(iter, &rtt_status->noti_fn_list, list) {
+               if (iter->noti_fn == noti_fn) {
+                       goto exit;
+               }
+       }
+       cb = kmalloc(sizeof(struct rtt_noti_callback), GFP_ATOMIC);
+       if (!cb) {
+               err = -ENOMEM;
+               goto exit;
+       }
+       cb->noti_fn = noti_fn;
+       cb->ctx = ctx;
+       list_add(&cb->list, &rtt_status->noti_fn_list);
+exit:
+       spin_unlock_bh(&noti_list_lock);
+       return err;
+}
+
+int
+dhd_rtt_unregister_noti_callback(dhd_pub_t *dhd, dhd_rtt_compl_noti_fn noti_fn)
+{
+       int err = BCME_OK;
+       struct rtt_noti_callback *cb = NULL, *iter;
+       rtt_status_info_t *rtt_status;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       NULL_CHECK(noti_fn, "noti_fn is NULL", err);
+       rtt_status = GET_RTTSTATE(dhd);
+       NULL_CHECK(rtt_status, "rtt_status is NULL", err);
+       spin_lock_bh(&noti_list_lock);
+       list_for_each_entry(iter, &rtt_status->noti_fn_list, list) {
+               if (iter->noti_fn == noti_fn) {
+                       cb = iter;
+                       list_del(&cb->list);
+                       break;
+               }
+       }
+       spin_unlock_bh(&noti_list_lock);
+       if (cb) {
+               kfree(cb);
+       }
+       return err;
+}
+
+static int
+dhd_rtt_convert_to_host(rtt_result_t *rtt_results, const wl_proxd_event_data_t* evp)
+{
+       int err = BCME_OK;
+       int i;
+       char eabuf[ETHER_ADDR_STR_LEN];
+       char diststr[40];
+       struct timespec ts;
+       NULL_CHECK(rtt_results, "rtt_results is NULL", err);
+       NULL_CHECK(evp, "evp is NULL", err);
+       DHD_RTT(("%s enter\n", __FUNCTION__));
+       rtt_results->distance = ntoh32(evp->distance);
+       rtt_results->sdrtt = ntoh32(evp->sdrtt);
+       rtt_results->ftm_cnt = ntoh16(evp->ftm_cnt);
+       rtt_results->avg_rssi = ntoh16(evp->avg_rssi);
+       rtt_results->validfrmcnt = ntoh16(evp->validfrmcnt);
+       rtt_results->meanrtt = ntoh32(evp->meanrtt);
+       rtt_results->modertt = ntoh32(evp->modertt);
+       rtt_results->medianrtt = ntoh32(evp->medianrtt);
+       rtt_results->err_code = evp->err_code;
+       rtt_results->tx_rate.preamble = (evp->OFDM_frame_type == TOF_FRAME_RATE_VHT)? 3 : 0;
+       rtt_results->tx_rate.nss = 0; /* 1 x 1 */
+       rtt_results->tx_rate.bw =
+               (evp->bandwidth == TOF_BW_80MHZ)? 2 : (evp->bandwidth == TOF_BW_40MHZ)? 1 : 0;
+       rtt_results->TOF_type = evp->TOF_type;
+       if (evp->TOF_type == TOF_TYPE_ONE_WAY) {
+               /* convert to 100kbps unit */
+               rtt_results->tx_rate.bitrate = WL_RATE_6M * 5;
+               rtt_results->tx_rate.rateMcsIdx = WL_RATE_6M;
+       } else {
+               rtt_results->tx_rate.bitrate = WL_RATE_6M * 5;
+               rtt_results->tx_rate.rateMcsIdx = 0; /* MCS 0 */
+       }
+       memset(diststr, 0, sizeof(diststr));
+       if (rtt_results->distance == 0xffffffff || rtt_results->distance == 0) {
+               sprintf(diststr, "distance=-1m\n");
+       } else {
+               sprintf(diststr, "distance=%d.%d m\n",
+                       rtt_results->distance >> 4, ((rtt_results->distance & 0xf) * 125) >> 1);
+       }
+
+       if (ntoh32(evp->mode) == WL_PROXD_MODE_INITIATOR) {
+               DHD_RTT(("Target:(%s) %s;\n", bcm_ether_ntoa((&evp->peer_mac), eabuf), diststr));
+               DHD_RTT(("RTT : mean %d mode %d median %d\n", rtt_results->meanrtt,
+                       rtt_results->modertt, rtt_results->medianrtt));
+       } else {
+               DHD_RTT(("Initiator:(%s) %s; ", bcm_ether_ntoa((&evp->peer_mac), eabuf), diststr));
+       }
+       if (rtt_results->sdrtt > 0) {
+               DHD_RTT(("sigma:%d.%d\n", rtt_results->sdrtt/10, rtt_results->sdrtt % 10));
+       } else {
+               DHD_RTT(("sigma:0\n"));
+       }
+
+       DHD_RTT(("rssi:%d validfrmcnt %d, err_code : %d\n", rtt_results->avg_rssi,
+               rtt_results->validfrmcnt, evp->err_code));
+
+       switch (evp->err_code) {
+       case TOF_REASON_OK:
+               rtt_results->err_code = RTT_REASON_SUCCESS;
+               break;
+       case TOF_REASON_TIMEOUT:
+               rtt_results->err_code = RTT_REASON_TIMEOUT;
+               break;
+       case TOF_REASON_NOACK:
+               rtt_results->err_code = RTT_REASON_NO_RSP;
+               break;
+       case TOF_REASON_ABORT:
+               rtt_results->err_code = RTT_REASON_ABORT;
+               break;
+       default:
+               rtt_results->err_code = RTT_REASON_FAILURE;
+               break;
+       }
+       rtt_results->peer_mac = evp->peer_mac;
+       /* get the time elapsed from boot time */
+       get_monotonic_boottime(&ts);
+       rtt_results->ts = (uint64) TIMESPEC_TO_US(ts);
+
+       for (i = 0; i < rtt_results->ftm_cnt; i++) {
+               rtt_results->ftm_buff[i].value = ltoh32(evp->ftm_buff[i].value);
+               rtt_results->ftm_buff[i].rssi = ltoh32(evp->ftm_buff[i].rssi);
+       }
+       return err;
+}
+
+int
+dhd_rtt_event_handler(dhd_pub_t *dhd, wl_event_msg_t *event, void *event_data)
+{
+       int err = BCME_OK;
+       int len = 0;
+       int idx;
+       uint event_type, reason, ftm_cnt;
+       rtt_status_info_t *rtt_status;
+       wl_proxd_event_data_t* evp;
+       struct rtt_noti_callback *iter;
+       rtt_result_t *rtt_result, *entry, *next;
+       gfp_t kflags;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       rtt_status = GET_RTTSTATE(dhd);
+       NULL_CHECK(rtt_status, "rtt_status is NULL", err);
+       event_type = ntoh32_ua((void *)&event->event_type);
+       reason = ntoh32_ua((void *)&event->reason);
+
+       if (event_type != WLC_E_PROXD) {
+               goto exit;
+       }
+       kflags = in_softirq()? GFP_ATOMIC : GFP_KERNEL;
+       evp = (wl_proxd_event_data_t*)event_data;
+       DHD_RTT(("%s enter : mode: %s, reason :%d \n", __FUNCTION__,
+               (ntoh16(evp->mode) == WL_PROXD_MODE_INITIATOR)?
+               "initiator":"target", reason));
+       switch (reason) {
+       case WLC_E_PROXD_STOP:
+               DHD_RTT(("WLC_E_PROXD_STOP\n"));
+               break;
+       case WLC_E_PROXD_ERROR:
+       case WLC_E_PROXD_COMPLETED:
+               if (reason == WLC_E_PROXD_ERROR) {
+                       DHD_RTT(("WLC_E_PROXD_ERROR\n"));
+               } else {
+                       DHD_RTT(("WLC_E_PROXD_COMPLETED\n"));
+               }
+
+               if (!in_atomic()) {
+                       mutex_lock(&rtt_status->rtt_mutex);
+               }
+               ftm_cnt = ntoh16(evp->ftm_cnt);
+
+               if (ftm_cnt > 0) {
+                       len = OFFSETOF(rtt_result_t, ftm_buff);
+               } else {
+                       len = sizeof(rtt_result_t);
+               }
+               /* check whether the results is already reported or not */
+               list_for_each_entry(entry, &rtt_status->rtt_results_cache, list) {
+                       if (!memcmp(&entry->peer_mac, &evp->peer_mac, ETHER_ADDR_LEN))  {
+                               if (!in_atomic()) {
+                                       mutex_unlock(&rtt_status->rtt_mutex);
+                               }
+                               goto exit;
+                       }
+               }
+               rtt_result = kzalloc(len + sizeof(ftm_sample_t) * ftm_cnt, kflags);
+               if (!rtt_result) {
+                       if (!in_atomic()) {
+                               mutex_unlock(&rtt_status->rtt_mutex);
+                       }
+                       err = -ENOMEM;
+                       goto exit;
+               }
+               /* point to target_info in status struct and increase pointer */
+               rtt_result->target_info = &rtt_status->rtt_config.target_info[rtt_status->cur_idx];
+               /* find next target to trigger RTT */
+               for (idx = (rtt_status->cur_idx + 1);
+                       idx < rtt_status->rtt_config.rtt_target_cnt; idx++) {
+                       /* skip the disabled device */
+                       if (rtt_status->rtt_config.target_info[idx].disable) {
+                               continue;
+                       } else {
+                               /* set the idx to cur_idx */
+                               rtt_status->cur_idx = idx;
+                               break;
+                       }
+               }
+               /* convert the event results to host format */
+               dhd_rtt_convert_to_host(rtt_result, evp);
+               list_add_tail(&rtt_result->list, &rtt_status->rtt_results_cache);
+               if (idx < rtt_status->rtt_config.rtt_target_cnt) {
+                       /* restart to measure RTT from next device */
+                       schedule_work(&rtt_status->work);
+               } else {
+                       DHD_RTT(("RTT_STOPPED\n"));
+                       rtt_status->status = RTT_STOPPED;
+                       /* to turn on mpc mode */
+                       schedule_work(&rtt_status->work);
+                       /* notify the completed information to others */
+                       list_for_each_entry(iter, &rtt_status->noti_fn_list, list) {
+                               iter->noti_fn(iter->ctx, &rtt_status->rtt_results_cache);
+                       }
+                       /* remove the rtt results in cache */
+                       list_for_each_entry_safe(rtt_result, next,
+                               &rtt_status->rtt_results_cache, list) {
+                               list_del(&rtt_result->list);
+                               kfree(rtt_result);
+                       }
+                       /* reinit the HEAD */
+                       INIT_LIST_HEAD(&rtt_status->rtt_results_cache);
+                       /* clear information for rtt_config */
+                       bzero(&rtt_status->rtt_config, sizeof(rtt_status->rtt_config));
+                       rtt_status->cur_idx = 0;
+               }
+               if (!in_atomic()) {
+                       mutex_unlock(&rtt_status->rtt_mutex);
+               }
+
+               break;
+       case WLC_E_PROXD_GONE:
+               DHD_RTT(("WLC_E_PROXD_GONE\n"));
+               break;
+       case WLC_E_PROXD_START:
+               /* event for targets / accesspoints  */
+               DHD_RTT(("WLC_E_PROXD_START\n"));
+               break;
+       case WLC_E_PROXD_COLLECT_START:
+               DHD_RTT(("WLC_E_PROXD_COLLECT_START\n"));
+               break;
+       case WLC_E_PROXD_COLLECT_STOP:
+               DHD_RTT(("WLC_E_PROXD_COLLECT_STOP\n"));
+               break;
+       case WLC_E_PROXD_COLLECT_COMPLETED:
+               DHD_RTT(("WLC_E_PROXD_COLLECT_COMPLETED\n"));
+               break;
+       case WLC_E_PROXD_COLLECT_ERROR:
+               DHD_RTT(("WLC_E_PROXD_COLLECT_ERROR; "));
+               break;
+       default:
+               DHD_ERROR(("WLC_E_PROXD: supported EVENT reason code:%d\n", reason));
+               break;
+       }
+
+exit:
+       return err;
+}
+
+static void
+dhd_rtt_work(struct work_struct *work)
+{
+       rtt_status_info_t *rtt_status;
+       dhd_pub_t *dhd;
+       rtt_status = container_of(work, rtt_status_info_t, work);
+       if (rtt_status == NULL) {
+               DHD_ERROR(("%s : rtt_status is NULL\n", __FUNCTION__));
+               return;
+       }
+       dhd = rtt_status->dhd;
+       if (dhd == NULL) {
+               DHD_ERROR(("%s : dhd is NULL\n", __FUNCTION__));
+               return;
+       }
+       (void) dhd_rtt_start(dhd);
+}
+
+int
+dhd_rtt_capability(dhd_pub_t *dhd, rtt_capabilities_t *capa)
+{
+       rtt_status_info_t *rtt_status;
+       int err = BCME_OK;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       rtt_status = GET_RTTSTATE(dhd);
+       NULL_CHECK(rtt_status, "rtt_status is NULL", err);
+       NULL_CHECK(capa, "capa is NULL", err);
+       bzero(capa, sizeof(rtt_capabilities_t));
+
+       if (rtt_status->capability & RTT_CAP_ONE_WAY) {
+               capa->rtt_one_sided_supported = 1;
+       }
+       if (rtt_status->capability & RTT_CAP_11V_WAY) {
+               capa->rtt_11v_supported = 1;
+       }
+       if (rtt_status->capability & RTT_CAP_11MC_WAY) {
+               capa->rtt_ftm_supported = 1;
+       }
+       if (rtt_status->capability & RTT_CAP_VS_WAY) {
+               capa->rtt_vs_supported = 1;
+       }
+
+       return err;
+}
+
+int
+dhd_rtt_init(dhd_pub_t *dhd)
+{
+       int err = BCME_OK;
+       rtt_status_info_t *rtt_status;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       if (dhd->rtt_state) {
+               goto exit;
+       }
+       dhd->rtt_state = MALLOC(dhd->osh, sizeof(rtt_status_info_t));
+       if (dhd->rtt_state == NULL) {
+               DHD_ERROR(("failed to create rtt_state\n"));
+               goto exit;
+       }
+       bzero(dhd->rtt_state, sizeof(rtt_status_info_t));
+       rtt_status = GET_RTTSTATE(dhd);
+       rtt_status->dhd = dhd;
+       err = dhd_iovar(dhd, 0, "proxd_params", NULL, 0, 1);
+       if (err != BCME_UNSUPPORTED) {
+               rtt_status->capability |= RTT_CAP_ONE_WAY;
+               rtt_status->capability |= RTT_CAP_VS_WAY;
+               DHD_ERROR(("%s: Support RTT Service\n", __FUNCTION__));
+       }
+       mutex_init(&rtt_status->rtt_mutex);
+       INIT_LIST_HEAD(&rtt_status->noti_fn_list);
+       INIT_LIST_HEAD(&rtt_status->rtt_results_cache);
+       INIT_WORK(&rtt_status->work, dhd_rtt_work);
+exit:
+       return err;
+}
+
+int
+dhd_rtt_deinit(dhd_pub_t *dhd)
+{
+       int err = BCME_OK;
+       rtt_status_info_t *rtt_status;
+       rtt_result_t *rtt_result, *next;
+       struct rtt_noti_callback *iter, *iter2;
+       NULL_CHECK(dhd, "dhd is NULL", err);
+       rtt_status = GET_RTTSTATE(dhd);
+       NULL_CHECK(rtt_status, "rtt_status is NULL", err);
+       rtt_status->status = RTT_STOPPED;
+       /* clear evt callback list */
+       if (!list_empty(&rtt_status->noti_fn_list)) {
+               list_for_each_entry_safe(iter, iter2, &rtt_status->noti_fn_list, list) {
+                       list_del(&iter->list);
+                       kfree(iter);
+               }
+       }
+       /* remove the rtt results */
+       if (!list_empty(&rtt_status->rtt_results_cache)) {
+               list_for_each_entry_safe(rtt_result, next, &rtt_status->rtt_results_cache, list) {
+                       list_del(&rtt_result->list);
+                       kfree(rtt_result);
+               }
+       }
+       MFREE(dhd->osh, dhd->rtt_state, sizeof(rtt_status_info_t));
+       dhd->rtt_state = NULL;
+       return err;
+}
+#endif /* RTT_SUPPORT */
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_rtt.h b/drivers/net/wireless/bcmdhd_1363/dhd_rtt.h
new file mode 100644 (file)
index 0000000..acd4d6c
--- /dev/null
@@ -0,0 +1,234 @@
+/*
+ * Broadcom Dongle Host Driver (DHD), RTT
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: dhd_rtt.h 558438 2015-05-22 06:05:11Z $
+ */
+#ifndef __DHD_RTT_H__
+#define __DHD_RTT_H__
+
+#include "dngl_stats.h"
+
+#define RTT_MAX_TARGET_CNT     10
+#define RTT_MAX_FRAME_CNT      25
+#define RTT_MAX_RETRY_CNT      10
+#define DEFAULT_FTM_CNT                6
+#define DEFAULT_RETRY_CNT      6
+
+
+/* DSSS, CCK and 802.11n rates in [500kbps] units */
+#define WL_MAXRATE     108     /* in 500kbps units */
+#define WL_RATE_1M     2       /* in 500kbps units */
+#define WL_RATE_2M     4       /* in 500kbps units */
+#define WL_RATE_5M5    11      /* in 500kbps units */
+#define WL_RATE_11M    22      /* in 500kbps units */
+#define WL_RATE_6M     12      /* in 500kbps units */
+#define WL_RATE_9M     18      /* in 500kbps units */
+#define WL_RATE_12M    24      /* in 500kbps units */
+#define WL_RATE_18M    36      /* in 500kbps units */
+#define WL_RATE_24M    48      /* in 500kbps units */
+#define WL_RATE_36M    72      /* in 500kbps units */
+#define WL_RATE_48M    96      /* in 500kbps units */
+#define WL_RATE_54M    108     /* in 500kbps units */
+
+
+enum rtt_role {
+       RTT_INITIATOR = 0,
+       RTT_TARGET = 1
+};
+enum rtt_status {
+       RTT_STOPPED = 0,
+       RTT_STARTED = 1
+};
+typedef int64_t wifi_timestamp; /* In microseconds (us) */
+typedef int64_t wifi_timespan;
+typedef int wifi_rssi;
+
+typedef enum {
+       RTT_INVALID,
+       RTT_ONE_WAY,
+       RTT_TWO_WAY,
+       RTT_AUTO
+} rtt_type_t;
+
+typedef enum {
+       RTT_PEER_STA,
+       RTT_PEER_AP,
+       RTT_PEER_P2P,
+       RTT_PEER_NAN,
+       RTT_PEER_INVALID
+} rtt_peer_type_t;
+
+typedef enum rtt_reason {
+       RTT_REASON_SUCCESS,
+       RTT_REASON_FAILURE,
+       RTT_REASON_NO_RSP,
+       RTT_REASON_REJECTED,
+       RTT_REASON_NOT_SCHEDULED_YET,
+       RTT_REASON_TIMEOUT,
+       RTT_REASON_AP_ON_DIFF_CH,
+       RTT_REASON_AP_NO_CAP,
+       RTT_REASON_ABORT
+} rtt_reason_t;
+
+typedef enum rtt_capability {
+       RTT_CAP_NONE = 0,
+       RTT_CAP_ONE_WAY  = (1 << (0)),
+       RTT_CAP_11V_WAY  = (1 << (1)),  /* IEEE802.11v */
+       RTT_CAP_11MC_WAY  = (1 << (2)), /* IEEE802.11mc */
+       RTT_CAP_VS_WAY = (1 << (3)) /* BRCM vendor specific */
+} rtt_capability_t;
+
+typedef struct wifi_channel_info {
+       wifi_channel_width_t width;
+       wifi_channel center_freq; /* primary 20 MHz channel */
+       wifi_channel center_freq0; /* center freq (MHz) first segment */
+       wifi_channel center_freq1; /* center freq (MHz) second segment valid for 80 + 80 */
+} wifi_channel_info_t;
+
+typedef struct wifi_rate {
+       uint32 preamble :3; /* 0: OFDM, 1: CCK, 2 : HT, 3: VHT, 4..7 reserved */
+       uint32 nss              :2; /* 0 : 1x1, 1: 2x2, 3: 3x3, 4: 4x4 */
+       uint32 bw               :3; /* 0: 20Mhz, 1: 40Mhz, 2: 80Mhz, 3: 160Mhz */
+       /* OFDM/CCK rate code would be as per IEEE std in the unit of 0.5 mb
+       * HT/VHT it would be mcs index
+       */
+       uint32 rateMcsIdx :8;
+       uint32 reserved :16; /* reserved */
+       uint32 bitrate; /* unit of 100 Kbps */
+} wifi_rate_t;
+
+typedef struct rtt_target_info {
+       struct ether_addr addr;
+       rtt_type_t type; /* rtt_type */
+       rtt_peer_type_t peer; /* peer type */
+       wifi_channel_info_t channel; /* channel information */
+       chanspec_t chanspec; /* chanspec for channel */
+       int8    continuous; /* 0 = single shot or 1 = continous raging */
+       bool    disable; /* disable for RTT measurement */
+       uint32  interval; /* interval of RTT measurement (unit ms) when continuous = true */
+       uint32  measure_cnt; /* total number of RTT measurement when continuous */
+       uint32  ftm_cnt; /* num of packets in each RTT measurement */
+       uint32  retry_cnt; /* num of retries if sampling fails */
+} rtt_target_info_t;
+
+typedef struct rtt_result {
+       struct list_head list;
+       uint16 ver;                     /* version */
+       rtt_target_info_t *target_info; /* target info */
+       uint16 mode;                    /* mode: target/initiator */
+       uint16 method;                  /* method: rssi/TOF/AOA */
+       uint8  err_code;                /* error classification */
+       uint8  TOF_type;                /* one way or two way TOF */
+       wifi_rate_t tx_rate;           /* tx rate */
+       struct ether_addr peer_mac;     /* (e.g for tgt:initiator's */
+       int32 distance;         /* dst to tgt, units (meter * 16) */
+       uint32 meanrtt;                 /* mean delta */
+       uint32 modertt;                 /* Mode delta */
+       uint32 medianrtt;               /* median RTT */
+       uint32 sdrtt;                   /* Standard deviation of RTT */
+       int16  avg_rssi;                /* avg rssi across the ftm frames */
+       int16  validfrmcnt;             /* Firmware's valid frame counts */
+       wifi_timestamp ts; /* the time elapsed from boot time when driver get this result */
+       uint16 ftm_cnt;                 /*  num of rtd measurments/length in the ftm buffer  */
+       ftm_sample_t ftm_buff[1];       /* 1 ... ftm_cnt  */
+} rtt_result_t;
+
+typedef struct rtt_report {
+       struct ether_addr addr;
+       uint num_measurement; /* measurement number in case of continous raging */
+       rtt_reason_t status; /* raging status */
+       rtt_type_t type; /* rtt type */
+       rtt_peer_type_t peer; /* peer type */
+       wifi_channel_info_t channel; /* channel information */
+       wifi_rssi  rssi; /* avg rssi accroos the ftm frames */
+       wifi_rssi  rssi_spread; /* rssi spread in 0.5 db steps e.g. 5 implies 2.5 spread */
+       wifi_rate_t tx_rate;           /* tx rate */
+       wifi_timespan rtt;      /*  round trip time in nanoseconds */
+       wifi_timespan rtt_sd;   /* rtt standard deviation in nanoseconds */
+       wifi_timespan rtt_spread; /* difference between max and min rtt times recorded */
+       int32 distance; /* distance in cm (optional) */
+       int32 distance_sd; /* standard deviation in cm (optional) */
+       int32 distance_spread; /* difference between max and min distance recorded (optional) */
+       wifi_timestamp ts; /* time of the measurement (in microseconds since boot) */
+} rtt_report_t;
+
+/* RTT Capabilities */
+typedef struct rtt_capabilities {
+       uint8 rtt_one_sided_supported;  /* if 1-sided rtt data collection is supported */
+       uint8 rtt_11v_supported;        /* if 11v rtt data collection is supported */
+       uint8 rtt_ftm_supported;        /* if ftm rtt data collection is supported */
+       uint8 rtt_vs_supported;         /* if vendor specific data collection supported */
+} rtt_capabilities_t;
+
+typedef struct rtt_config_params {
+       int8 rtt_target_cnt;
+       rtt_target_info_t target_info[RTT_MAX_TARGET_CNT];
+} rtt_config_params_t;
+
+typedef void (*dhd_rtt_compl_noti_fn)(void *ctx, void *rtt_data);
+/* Linux wrapper to call common dhd_rtt_set_cfg */
+int
+dhd_dev_rtt_set_cfg(struct net_device *dev, void *buf);
+
+int
+dhd_dev_rtt_cancel_cfg(struct net_device *dev, struct ether_addr *mac_list, int mac_cnt);
+
+int
+dhd_dev_rtt_register_noti_callback(struct net_device *dev, void *ctx,
+       dhd_rtt_compl_noti_fn noti_fn);
+
+int
+dhd_dev_rtt_unregister_noti_callback(struct net_device *dev, dhd_rtt_compl_noti_fn noti_fn);
+
+int
+dhd_dev_rtt_capability(struct net_device *dev, rtt_capabilities_t *capa);
+
+/* export to upper layer */
+chanspec_t
+dhd_rtt_convert_to_chspec(wifi_channel_info_t channel);
+
+int
+dhd_rtt_set_cfg(dhd_pub_t *dhd, rtt_config_params_t *params);
+
+int
+dhd_rtt_stop(dhd_pub_t *dhd, struct ether_addr *mac_list, int mac_cnt);
+
+
+int
+dhd_rtt_register_noti_callback(dhd_pub_t *dhd, void *ctx, dhd_rtt_compl_noti_fn noti_fn);
+
+int
+dhd_rtt_unregister_noti_callback(dhd_pub_t *dhd, dhd_rtt_compl_noti_fn noti_fn);
+
+int
+dhd_rtt_event_handler(dhd_pub_t *dhd, wl_event_msg_t *event, void *event_data);
+
+int
+dhd_rtt_capability(dhd_pub_t *dhd, rtt_capabilities_t *capa);
+
+int
+dhd_rtt_init(dhd_pub_t *dhd);
+
+int
+dhd_rtt_deinit(dhd_pub_t *dhd);
+#endif /* __DHD_RTT_H__ */
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_sdio.c b/drivers/net/wireless/bcmdhd_1363/dhd_sdio.c
new file mode 100644 (file)
index 0000000..ca663b6
--- /dev/null
@@ -0,0 +1,8445 @@
+/*
+ * DHD Bus Module for SDIO
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_sdio.c 662780 2016-11-11 06:44:38Z $
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+#include <bcmsdh.h>
+
+#ifdef BCMEMBEDIMAGE
+#include BCMEMBEDIMAGE
+#endif /* BCMEMBEDIMAGE */
+
+#include <bcmdefs.h>
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <bcmdevs.h>
+
+#include <siutils.h>
+#include <hndpmu.h>
+#include <hndsoc.h>
+#include <bcmsdpcm.h>
+#include <hnd_armtrap.h>
+#include <hnd_cons.h>
+#include <sbchipc.h>
+#include <sbhnddma.h>
+
+#include <sdio.h>
+#include <sbsdio.h>
+#include <sbsdpcmdev.h>
+#include <bcmsdpcm.h>
+#include <bcmsdbus.h>
+
+#include <proto/ethernet.h>
+#include <proto/802.1d.h>
+#include <proto/802.11.h>
+
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_bus.h>
+#include <dhd_proto.h>
+#include <dhd_dbg.h>
+#include <dhdioctl.h>
+#include <sdiovar.h>
+
+#ifdef PROP_TXSTATUS
+#include <dhd_wlfc.h>
+#endif
+#ifdef DHDTCPACK_SUPPRESS
+#include <dhd_ip.h>
+#endif /* DHDTCPACK_SUPPRESS */
+
+bool dhd_mp_halting(dhd_pub_t *dhdp);
+extern void bcmsdh_waitfor_iodrain(void *sdh);
+extern void bcmsdh_reject_ioreqs(void *sdh, bool reject);
+extern bool  bcmsdh_fatal_error(void *sdh);
+
+#ifndef DHDSDIO_MEM_DUMP_FNAME
+#define DHDSDIO_MEM_DUMP_FNAME         "mem_dump"
+#endif
+
+#define QLEN           (1024) /* bulk rx and tx queue lengths */
+#define FCHI           (QLEN - 10)
+#define FCLOW          (FCHI / 2)
+#define PRIOMASK       7
+
+#define TXRETRIES      2       /* # of retries for tx frames */
+#define READ_FRM_CNT_RETRIES   3
+#ifndef DHD_RXBOUND
+#define DHD_RXBOUND    50      /* Default for max rx frames in one scheduling */
+#endif
+
+#ifndef DHD_TXBOUND
+#define DHD_TXBOUND    20      /* Default for max tx frames in one scheduling */
+#endif
+
+#define DHD_TXMINMAX   1       /* Max tx frames if rx still pending */
+
+#define MEMBLOCK       2048            /* Block size used for downloading of dongle image */
+#define MAX_DATA_BUF   (64 * 1024)     /* Must be large enough to hold biggest possible glom */
+
+#ifndef DHD_FIRSTREAD
+#define DHD_FIRSTREAD   32
+#endif
+#if !ISPOWEROF2(DHD_FIRSTREAD)
+#error DHD_FIRSTREAD is not a power of 2!
+#endif
+
+/* Total length of frame header for dongle protocol */
+#define SDPCM_HDRLEN   (SDPCM_FRAMETAG_LEN + SDPCM_SWHEADER_LEN)
+#define SDPCM_HDRLEN_TXGLOM    (SDPCM_HDRLEN + SDPCM_HWEXT_LEN)
+#define MAX_TX_PKTCHAIN_CNT    SDPCM_MAXGLOM_SIZE
+
+#ifdef SDTEST
+#define SDPCM_RESERVE  (SDPCM_HDRLEN + SDPCM_TEST_HDRLEN + DHD_SDALIGN)
+#else
+#define SDPCM_RESERVE  (SDPCM_HDRLEN + DHD_SDALIGN)
+#endif
+
+/* Space for header read, limit for data packets */
+#ifndef MAX_HDR_READ
+#define MAX_HDR_READ   32
+#endif
+#if !ISPOWEROF2(MAX_HDR_READ)
+#error MAX_HDR_READ is not a power of 2!
+#endif
+
+#define MAX_RX_DATASZ  2048
+
+/* Maximum milliseconds to wait for F2 to come up */
+#define DHD_WAIT_F2RDY 3000
+
+/* Bump up limit on waiting for HT to account for first startup;
+ * if the image is doing a CRC calculation before programming the PMU
+ * for HT availability, it could take a couple hundred ms more, so
+ * max out at a 1 second (1000000us).
+ */
+#if (PMU_MAX_TRANSITION_DLY <= 1000000)
+#undef PMU_MAX_TRANSITION_DLY
+#define PMU_MAX_TRANSITION_DLY 1000000
+#endif
+
+/* hooks for limiting threshold custom tx num in rx processing */
+#define DEFAULT_TXINRX_THRES    0
+#ifndef CUSTOM_TXINRX_THRES
+#define CUSTOM_TXINRX_THRES     DEFAULT_TXINRX_THRES
+#endif
+
+/* Value for ChipClockCSR during initial setup */
+#define DHD_INIT_CLKCTL1       (SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_ALP_AVAIL_REQ)
+#define DHD_INIT_CLKCTL2       (SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_FORCE_ALP)
+
+/* Flags for SDH calls */
+#define F2SYNC (SDIO_REQ_4BYTE | SDIO_REQ_FIXED)
+
+/* Packet free applicable unconditionally for sdio and sdspi.  Conditional if
+ * bufpool was present for gspi bus.
+ */
+#define PKTFREE2()             if ((bus->bus != SPI_BUS) || bus->usebufpool) \
+                                       PKTFREE(bus->dhd->osh, pkt, FALSE);
+DHD_SPINWAIT_SLEEP_INIT(sdioh_spinwait_sleep);
+
+
+/* Device console log buffer state */
+#define CONSOLE_LINE_MAX       192
+#define CONSOLE_BUFFER_MAX     2024
+typedef struct dhd_console {
+       uint            count;                  /* Poll interval msec counter */
+       uint            log_addr;               /* Log struct address (fixed) */
+       hnd_log_t       log;                    /* Log struct (host copy) */
+       uint            bufsize;                /* Size of log buffer */
+       uint8           *buf;                   /* Log buffer (host copy) */
+       uint            last;                   /* Last buffer read index */
+} dhd_console_t;
+
+#define        REMAP_ENAB(bus)                 ((bus)->remap)
+#define        REMAP_ISADDR(bus, a)            (((a) >= ((bus)->orig_ramsize)) && ((a) < ((bus)->ramsize)))
+#define        KSO_ENAB(bus)                   ((bus)->kso)
+#define        SR_ENAB(bus)                    ((bus)->_srenab)
+#define        SLPAUTO_ENAB(bus)               ((SR_ENAB(bus)) && ((bus)->_slpauto))
+#define        MIN_RSRC_ADDR                   (SI_ENUM_BASE + 0x618)
+#define        MIN_RSRC_SR                     0x3
+#define        CORE_CAPEXT_ADDR                (SI_ENUM_BASE + 0x64c)
+#define        CORE_CAPEXT_SR_SUPPORTED_MASK   (1 << 1)
+#define RCTL_MACPHY_DISABLE_MASK       (1 << 26)
+#define RCTL_LOGIC_DISABLE_MASK                (1 << 27)
+
+#define        OOB_WAKEUP_ENAB(bus)            ((bus)->_oobwakeup)
+#define        GPIO_DEV_SRSTATE                16      /* Host gpio17 mapped to device gpio0 SR state */
+#define        GPIO_DEV_SRSTATE_TIMEOUT        320000  /* 320ms */
+#define        GPIO_DEV_WAKEUP                 17      /* Host gpio17 mapped to device gpio1 wakeup */
+#define        CC_CHIPCTRL2_GPIO1_WAKEUP       (1  << 0)
+#define        CC_CHIPCTRL3_SR_ENG_ENABLE      (1  << 2)
+#define OVERFLOW_BLKSZ512_WM           96
+#define OVERFLOW_BLKSZ512_MES          80
+
+#define CC_PMUCC3      (0x3)
+/* Private data for SDIO bus interaction */
+typedef struct dhd_bus {
+       dhd_pub_t       *dhd;
+
+       bcmsdh_info_t   *sdh;                   /* Handle for BCMSDH calls */
+       si_t            *sih;                   /* Handle for SI calls */
+       char            *vars;                  /* Variables (from CIS and/or other) */
+       uint            varsz;                  /* Size of variables buffer */
+       uint32          sbaddr;                 /* Current SB window pointer (-1, invalid) */
+
+       sdpcmd_regs_t   *regs;                  /* Registers for SDIO core */
+       uint            sdpcmrev;               /* SDIO core revision */
+       uint            armrev;                 /* CPU core revision */
+       uint            ramrev;                 /* SOCRAM core revision */
+       uint32          ramsize;                /* Size of RAM in SOCRAM (bytes) */
+       uint32          orig_ramsize;           /* Size of RAM in SOCRAM (bytes) */
+       uint32          srmemsize;              /* Size of SRMEM */
+
+       uint32          bus;                    /* gSPI or SDIO bus */
+       uint32          bus_num;                /* bus number */
+       uint32          slot_num;               /* slot ID */
+       uint32          hostintmask;    /* Copy of Host Interrupt Mask */
+       uint32          intstatus;              /* Intstatus bits (events) pending */
+       bool            dpc_sched;              /* Indicates DPC schedule (intrpt rcvd) */
+       bool            fcstate;                /* State of dongle flow-control */
+
+       uint16          cl_devid;               /* cached devid for dhdsdio_probe_attach() */
+       char            *fw_path;               /* module_param: path to firmware image */
+       char            *nv_path;               /* module_param: path to nvram vars file */
+
+       uint            blocksize;              /* Block size of SDIO transfers */
+       uint            roundup;                /* Max roundup limit */
+
+       struct pktq     txq;                    /* Queue length used for flow-control */
+       uint8           flowcontrol;            /* per prio flow control bitmask */
+       uint8           tx_seq;                 /* Transmit sequence number (next) */
+       uint8           tx_max;                 /* Maximum transmit sequence allowed */
+
+       uint8           hdrbuf[MAX_HDR_READ + DHD_SDALIGN];
+       uint8           *rxhdr;                 /* Header of current rx frame (in hdrbuf) */
+       uint16          nextlen;                /* Next Read Len from last header */
+       uint8           rx_seq;                 /* Receive sequence number (expected) */
+       bool            rxskip;                 /* Skip receive (awaiting NAK ACK) */
+
+       void            *glomd;                 /* Packet containing glomming descriptor */
+       void            *glom;                  /* Packet chain for glommed superframe */
+       uint            glomerr;                /* Glom packet read errors */
+
+       uint8           *rxbuf;                 /* Buffer for receiving control packets */
+       uint            rxblen;                 /* Allocated length of rxbuf */
+       uint8           *rxctl;                 /* Aligned pointer into rxbuf */
+       uint8           *databuf;               /* Buffer for receiving big glom packet */
+       uint8           *dataptr;               /* Aligned pointer into databuf */
+       uint            rxlen;                  /* Length of valid data in buffer */
+
+       uint8           sdpcm_ver;              /* Bus protocol reported by dongle */
+
+       bool            intr;                   /* Use interrupts */
+       bool            poll;                   /* Use polling */
+       bool            ipend;                  /* Device interrupt is pending */
+       bool            intdis;                 /* Interrupts disabled by isr */
+       uint            intrcount;              /* Count of device interrupt callbacks */
+       uint            lastintrs;              /* Count as of last watchdog timer */
+       uint            spurious;               /* Count of spurious interrupts */
+       uint            pollrate;               /* Ticks between device polls */
+       uint            polltick;               /* Tick counter */
+       uint            pollcnt;                /* Count of active polls */
+
+#ifdef DHD_DEBUG
+       dhd_console_t   console;                /* Console output polling support */
+       uint            console_addr;           /* Console address from shared struct */
+#endif /* DHD_DEBUG */
+
+       uint            regfails;               /* Count of R_REG/W_REG failures */
+
+       uint            clkstate;               /* State of sd and backplane clock(s) */
+       bool            activity;               /* Activity flag for clock down */
+       int32           idletime;               /* Control for activity timeout */
+       int32           idlecount;              /* Activity timeout counter */
+       int32           idleclock;              /* How to set bus driver when idle */
+       int32           sd_divisor;             /* Speed control to bus driver */
+       int32           sd_mode;                /* Mode control to bus driver */
+       int32           sd_rxchain;             /* If bcmsdh api accepts PKT chains */
+       bool            use_rxchain;            /* If dhd should use PKT chains */
+       bool            sleeping;               /* Is SDIO bus sleeping? */
+#if defined(SUPPORT_P2P_GO_PS)
+       wait_queue_head_t bus_sleep;
+#endif /* LINUX && SUPPORT_P2P_GO_PS */
+       uint            rxflow_mode;            /* Rx flow control mode */
+       bool            rxflow;                 /* Is rx flow control on */
+       uint            prev_rxlim_hit;         /* Is prev rx limit exceeded (per dpc schedule) */
+       bool            alp_only;               /* Don't use HT clock (ALP only) */
+       /* Field to decide if rx of control frames happen in rxbuf or lb-pool */
+       bool            usebufpool;
+       int32           txinrx_thres;   /* num of in-queued pkts */
+       int32           dotxinrx;       /* tx first in dhdsdio_readframes */
+#ifdef SDTEST
+       /* external loopback */
+       bool            ext_loop;
+       uint8           loopid;
+
+       /* pktgen configuration */
+       uint            pktgen_freq;            /* Ticks between bursts */
+       uint            pktgen_count;           /* Packets to send each burst */
+       uint            pktgen_print;           /* Bursts between count displays */
+       uint            pktgen_total;           /* Stop after this many */
+       uint            pktgen_minlen;          /* Minimum packet data len */
+       uint            pktgen_maxlen;          /* Maximum packet data len */
+       uint            pktgen_mode;            /* Configured mode: tx, rx, or echo */
+       uint            pktgen_stop;            /* Number of tx failures causing stop */
+
+       /* active pktgen fields */
+       uint            pktgen_tick;            /* Tick counter for bursts */
+       uint            pktgen_ptick;           /* Burst counter for printing */
+       uint            pktgen_sent;            /* Number of test packets generated */
+       uint            pktgen_rcvd;            /* Number of test packets received */
+       uint            pktgen_prev_time;       /* Time at which previous stats where printed */
+       uint            pktgen_prev_sent;       /* Number of test packets generated when
+                                                * previous stats were printed
+                                                */
+       uint            pktgen_prev_rcvd;       /* Number of test packets received when
+                                                * previous stats were printed
+                                                */
+       uint            pktgen_fail;            /* Number of failed send attempts */
+       uint16          pktgen_len;             /* Length of next packet to send */
+#define PKTGEN_RCV_IDLE     (0)
+#define PKTGEN_RCV_ONGOING  (1)
+       uint16          pktgen_rcv_state;               /* receive state */
+       uint            pktgen_rcvd_rcvsession; /* test pkts rcvd per rcv session. */
+#endif /* SDTEST */
+
+       /* Some additional counters */
+       uint            tx_sderrs;              /* Count of tx attempts with sd errors */
+       uint            fcqueued;               /* Tx packets that got queued */
+       uint            rxrtx;                  /* Count of rtx requests (NAK to dongle) */
+       uint            rx_toolong;             /* Receive frames too long to receive */
+       uint            rxc_errors;             /* SDIO errors when reading control frames */
+       uint            rx_hdrfail;             /* SDIO errors on header reads */
+       uint            rx_badhdr;              /* Bad received headers (roosync?) */
+       uint            rx_badseq;              /* Mismatched rx sequence number */
+       uint            fc_rcvd;                /* Number of flow-control events received */
+       uint            fc_xoff;                /* Number which turned on flow-control */
+       uint            fc_xon;                 /* Number which turned off flow-control */
+       uint            rxglomfail;             /* Failed deglom attempts */
+       uint            rxglomframes;           /* Number of glom frames (superframes) */
+       uint            rxglompkts;             /* Number of packets from glom frames */
+       uint            f2rxhdrs;               /* Number of header reads */
+       uint            f2rxdata;               /* Number of frame data reads */
+       uint            f2txdata;               /* Number of f2 frame writes */
+       uint            f1regdata;              /* Number of f1 register accesses */
+#ifdef DHDENABLE_TAILPAD
+       uint            tx_tailpad_chain;       /* Number of tail padding by chaining pad_pkt */
+       uint            tx_tailpad_pktget;      /* Number of tail padding by new PKTGET */
+#endif /* DHDENABLE_TAILPAD */
+       uint8           *ctrl_frame_buf;
+       uint32          ctrl_frame_len;
+       bool            ctrl_frame_stat;
+       uint32          rxint_mode;     /* rx interrupt mode */
+       bool            remap;          /* Contiguous 1MB RAM: 512K socram + 512K devram
+                                        * Available with socram rev 16
+                                        * Remap region not DMA-able
+                                        */
+       bool            kso;
+       bool            _slpauto;
+       bool            _oobwakeup;
+       bool            _srenab;
+       bool        readframes;
+       bool        reqbussleep;
+       uint32          resetinstr;
+       uint32          dongle_ram_base;
+
+       void            *glom_pkt_arr[SDPCM_MAXGLOM_SIZE];      /* Array of pkts for glomming */
+       uint32          txglom_cnt;     /* Number of pkts in the glom array */
+       uint32          txglom_total_len;       /* Total length of pkts in glom array */
+       bool            txglom_enable;  /* Flag to indicate whether tx glom is enabled/disabled */
+       uint32          txglomsize;     /* Glom size limitation */
+#ifdef DHDENABLE_TAILPAD
+       void            *pad_pkt;
+#endif /* DHDENABLE_TAILPAD */
+} dhd_bus_t;
+
+/* clkstate */
+#define CLK_NONE       0
+#define CLK_SDONLY     1
+#define CLK_PENDING    2       /* Not used yet */
+#define CLK_AVAIL      3
+
+#define DHD_NOPMU(dhd) (FALSE)
+
+#if defined(BCMSDIOH_STD)
+#define BLK_64_MAXTXGLOM 20
+#endif /* BCMSDIOH_STD */
+
+#ifdef DHD_DEBUG
+static int qcount[NUMPRIO];
+static int tx_packets[NUMPRIO];
+#endif /* DHD_DEBUG */
+
+/* Deferred transmit */
+const uint dhd_deferred_tx = 1;
+
+extern uint dhd_watchdog_ms;
+
+extern void dhd_os_wd_timer(void *bus, uint wdtick);
+int dhd_enableOOB(dhd_pub_t *dhd, bool sleep);
+
+/* Tx/Rx bounds */
+uint dhd_txbound;
+uint dhd_rxbound;
+uint dhd_txminmax = DHD_TXMINMAX;
+
+/* override the RAM size if possible */
+#define DONGLE_MIN_RAMSIZE (128 *1024)
+int dhd_dongle_ramsize;
+
+uint dhd_doflow = TRUE;
+uint dhd_dpcpoll = FALSE;
+
+module_param(dhd_doflow, uint, 0644);
+module_param(dhd_dpcpoll, uint, 0644);
+
+static bool dhd_alignctl;
+
+static bool sd1idle;
+
+static bool retrydata;
+#define RETRYCHAN(chan) (((chan) == SDPCM_EVENT_CHANNEL) || retrydata)
+
+static uint watermark = 8;
+static uint mesbusyctrl = 0;
+static const uint firstread = DHD_FIRSTREAD;
+
+/* Retry count for register access failures */
+static const uint retry_limit = 2;
+
+/* Force even SD lengths (some host controllers mess up on odd bytes) */
+static bool forcealign;
+
+#define ALIGNMENT  4
+
+#if defined(OOB_INTR_ONLY) && defined(HW_OOB)
+extern void bcmsdh_enable_hw_oob_intr(void *sdh, bool enable);
+#endif
+
+#if defined(OOB_INTR_ONLY) && defined(SDIO_ISR_THREAD)
+#error OOB_INTR_ONLY is NOT working with SDIO_ISR_THREAD
+#endif /* defined(OOB_INTR_ONLY) && defined(SDIO_ISR_THREAD) */
+#define PKTALIGN(osh, p, len, align)                                   \
+       do {                                                            \
+               uintptr datalign;                                               \
+               datalign = (uintptr)PKTDATA((osh), (p));                \
+               datalign = ROUNDUP(datalign, (align)) - datalign;       \
+               ASSERT(datalign < (align));                             \
+               ASSERT(PKTLEN((osh), (p)) >= ((len) + datalign));       \
+               if (datalign)                                           \
+                       PKTPULL((osh), (p), (uint)datalign);                    \
+               PKTSETLEN((osh), (p), (len));                           \
+       } while (0)
+
+/* Limit on rounding up frames */
+static const uint max_roundup = 512;
+
+/* Try doing readahead */
+static bool dhd_readahead;
+
+/* To check if there's window offered */
+#define DATAOK(bus) \
+       (((uint8)(bus->tx_max - bus->tx_seq) > 1) && \
+       (((uint8)(bus->tx_max - bus->tx_seq) & 0x80) == 0))
+
+/* To check if there's window offered for ctrl frame */
+#define TXCTLOK(bus) \
+       (((uint8)(bus->tx_max - bus->tx_seq) != 0) && \
+       (((uint8)(bus->tx_max - bus->tx_seq) & 0x80) == 0))
+
+/* Number of pkts available in dongle for data RX */
+#define DATABUFCNT(bus) \
+       ((uint8)(bus->tx_max - bus->tx_seq) - 1)
+
+/* Macros to get register read/write status */
+/* NOTE: these assume a local dhdsdio_bus_t *bus! */
+#define R_SDREG(regvar, regaddr, retryvar) \
+do { \
+       retryvar = 0; \
+       do { \
+               regvar = R_REG(bus->dhd->osh, regaddr); \
+       } while (bcmsdh_regfail(bus->sdh) && (++retryvar <= retry_limit)); \
+       if (retryvar) { \
+               bus->regfails += (retryvar-1); \
+               if (retryvar > retry_limit) { \
+                       DHD_ERROR(("%s: FAILED" #regvar "READ, LINE %d\n", \
+                                  __FUNCTION__, __LINE__)); \
+                       regvar = 0; \
+               } \
+       } \
+} while (0)
+
+#define W_SDREG(regval, regaddr, retryvar) \
+do { \
+       retryvar = 0; \
+       do { \
+               W_REG(bus->dhd->osh, regaddr, regval); \
+       } while (bcmsdh_regfail(bus->sdh) && (++retryvar <= retry_limit)); \
+       if (retryvar) { \
+               bus->regfails += (retryvar-1); \
+               if (retryvar > retry_limit) \
+                       DHD_ERROR(("%s: FAILED REGISTER WRITE, LINE %d\n", \
+                                  __FUNCTION__, __LINE__)); \
+       } \
+} while (0)
+
+#define BUS_WAKE(bus) \
+       do { \
+               bus->idlecount = 0; \
+               if ((bus)->sleeping) \
+                       dhdsdio_bussleep((bus), FALSE); \
+       } while (0);
+
+/*
+ * pktavail interrupts from dongle to host can be managed in 3 different ways
+ * whenever there is a packet available in dongle to transmit to host.
+ *
+ * Mode 0:     Dongle writes the software host mailbox and host is interrupted.
+ * Mode 1:     (sdiod core rev >= 4)
+ *             Device sets a new bit in the intstatus whenever there is a packet
+ *             available in fifo.  Host can't clear this specific status bit until all the
+ *             packets are read from the FIFO.  No need to ack dongle intstatus.
+ * Mode 2:     (sdiod core rev >= 4)
+ *             Device sets a bit in the intstatus, and host acks this by writing
+ *             one to this bit.  Dongle won't generate anymore packet interrupts
+ *             until host reads all the packets from the dongle and reads a zero to
+ *             figure that there are no more packets.  No need to disable host ints.
+ *             Need to ack the intstatus.
+ */
+
+#define SDIO_DEVICE_HMB_RXINT          0       /* default old way */
+#define SDIO_DEVICE_RXDATAINT_MODE_0   1       /* from sdiod rev 4 */
+#define SDIO_DEVICE_RXDATAINT_MODE_1   2       /* from sdiod rev 4 */
+
+
+#define FRAME_AVAIL_MASK(bus)  \
+       ((bus->rxint_mode == SDIO_DEVICE_HMB_RXINT) ? I_HMB_FRAME_IND : I_XMTDATA_AVAIL)
+
+#define DHD_BUS                        SDIO_BUS
+
+#define PKT_AVAILABLE(bus, intstatus)  ((intstatus) & (FRAME_AVAIL_MASK(bus)))
+
+#define HOSTINTMASK            (I_HMB_SW_MASK | I_CHIPACTIVE)
+
+#define GSPI_PR55150_BAILOUT
+
+#ifdef SDTEST
+static void dhdsdio_testrcv(dhd_bus_t *bus, void *pkt, uint seq);
+static void dhdsdio_sdtest_set(dhd_bus_t *bus, uint count);
+#endif
+
+static int dhdsdio_checkdied(dhd_bus_t *bus, char *data, uint size);
+#ifdef DHD_DEBUG
+static int dhd_serialconsole(dhd_bus_t *bus, bool get, bool enable, int *bcmerror);
+#endif /* DHD_DEBUG */
+
+#if defined(DHD_FW_COREDUMP)
+static int dhdsdio_mem_dump(dhd_bus_t *bus);
+#endif /* DHD_FW_COREDUMP */
+static int dhdsdio_devcap_set(dhd_bus_t *bus, uint8 cap);
+static int dhdsdio_download_state(dhd_bus_t *bus, bool enter);
+
+static void dhdsdio_release(dhd_bus_t *bus, osl_t *osh);
+static void dhdsdio_release_malloc(dhd_bus_t *bus, osl_t *osh);
+static void dhdsdio_disconnect(void *ptr);
+static bool dhdsdio_chipmatch(uint16 chipid);
+static bool dhdsdio_probe_attach(dhd_bus_t *bus, osl_t *osh, void *sdh,
+                                 void * regsva, uint16  devid);
+static bool dhdsdio_probe_malloc(dhd_bus_t *bus, osl_t *osh, void *sdh);
+static bool dhdsdio_probe_init(dhd_bus_t *bus, osl_t *osh, void *sdh);
+static void dhdsdio_release_dongle(dhd_bus_t *bus, osl_t *osh, bool dongle_isolation,
+       bool reset_flag);
+
+static void dhd_dongle_setramsize(struct dhd_bus *bus, int mem_size);
+static int dhd_bcmsdh_recv_buf(dhd_bus_t *bus, uint32 addr, uint fn, uint flags,
+       uint8 *buf, uint nbytes,
+       void *pkt, bcmsdh_cmplt_fn_t complete, void *handle);
+static int dhd_bcmsdh_send_buf(dhd_bus_t *bus, uint32 addr, uint fn, uint flags,
+       uint8 *buf, uint nbytes,
+       void *pkt, bcmsdh_cmplt_fn_t complete, void *handle, int max_retry);
+static int dhdsdio_txpkt(dhd_bus_t *bus, uint chan, void** pkts, int num_pkt, bool free_pkt);
+static int dhdsdio_txpkt_preprocess(dhd_bus_t *bus, void *pkt, int chan, int txseq,
+       int prev_chain_total_len, bool last_chained_pkt,
+       int *pad_pkt_len, void **new_pkt);
+static int dhdsdio_txpkt_postprocess(dhd_bus_t *bus, void *pkt);
+
+static int dhdsdio_download_firmware(dhd_bus_t *bus, osl_t *osh, void *sdh);
+static int _dhdsdio_download_firmware(dhd_bus_t *bus);
+
+static int dhdsdio_download_code_file(dhd_bus_t *bus, char *image_path);
+static int dhdsdio_download_nvram(dhd_bus_t *bus);
+#ifdef BCMEMBEDIMAGE
+static int dhdsdio_download_code_array(dhd_bus_t *bus);
+#endif
+static int dhdsdio_bussleep(dhd_bus_t *bus, bool sleep);
+static int dhdsdio_clkctl(dhd_bus_t *bus, uint target, bool pendok);
+static uint8 dhdsdio_sleepcsr_get(dhd_bus_t *bus);
+
+#ifdef WLMEDIA_HTSF
+#include <htsf.h>
+extern uint32 dhd_get_htsf(void *dhd, int ifidx);
+#endif /* WLMEDIA_HTSF */
+
+static void
+dhdsdio_tune_fifoparam(struct dhd_bus *bus)
+{
+       int err;
+       uint8 devctl, wm, mes;
+
+       if (bus->sih->buscorerev >= 15) {
+               /* See .ppt in PR for these recommended values */
+               if (bus->blocksize == 512) {
+                       wm = OVERFLOW_BLKSZ512_WM;
+                       mes = OVERFLOW_BLKSZ512_MES;
+               } else {
+                       mes = bus->blocksize/4;
+                       wm = bus->blocksize/4;
+               }
+
+               watermark = wm;
+               mesbusyctrl = mes;
+       } else {
+               DHD_INFO(("skip fifotune: SdioRev(%d) is lower than minimal requested ver\n",
+                       bus->sih->buscorerev));
+               return;
+       }
+
+       /* Update watermark */
+       if (wm > 0) {
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_WATERMARK, wm, &err);
+
+               devctl = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
+               devctl |= SBSDIO_DEVCTL_F2WM_ENAB;
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
+       }
+
+       /* Update MES */
+       if (mes > 0) {
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_MESBUSYCTRL,
+                       (mes | SBSDIO_MESBUSYCTRL_ENAB), &err);
+       }
+
+       DHD_INFO(("Apply overflow WAR: 0x%02x 0x%02x 0x%02x\n",
+               bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err),
+               bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_WATERMARK, &err),
+               bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_MESBUSYCTRL, &err)));
+}
+
+static void
+dhd_dongle_setramsize(struct dhd_bus *bus, int mem_size)
+{
+       int32 min_size =  DONGLE_MIN_RAMSIZE;
+       /* Restrict the ramsize to user specified limit */
+       DHD_ERROR(("user: Restrict the dongle ram size to %d, min accepted %d\n",
+               dhd_dongle_ramsize, min_size));
+       if ((dhd_dongle_ramsize > min_size) &&
+               (dhd_dongle_ramsize < (int32)bus->orig_ramsize))
+               bus->ramsize = dhd_dongle_ramsize;
+}
+
+static int
+dhdsdio_set_siaddr_window(dhd_bus_t *bus, uint32 address)
+{
+       int err = 0;
+       bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRLOW,
+                        (address >> 8) & SBSDIO_SBADDRLOW_MASK, &err);
+       if (!err)
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRMID,
+                                (address >> 16) & SBSDIO_SBADDRMID_MASK, &err);
+       if (!err)
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRHIGH,
+                                (address >> 24) & SBSDIO_SBADDRHIGH_MASK, &err);
+       return err;
+}
+
+
+#ifdef USE_OOB_GPIO1
+static int
+dhdsdio_oobwakeup_init(dhd_bus_t *bus)
+{
+       uint32 val, addr, data;
+
+       bcmsdh_gpioouten(bus->sdh, GPIO_DEV_WAKEUP);
+
+       addr = SI_ENUM_BASE + OFFSETOF(chipcregs_t, chipcontrol_addr);
+       data = SI_ENUM_BASE + OFFSETOF(chipcregs_t, chipcontrol_data);
+
+       /* Set device for gpio1 wakeup */
+       bcmsdh_reg_write(bus->sdh, addr, 4, 2);
+       val = bcmsdh_reg_read(bus->sdh, data, 4);
+       val |= CC_CHIPCTRL2_GPIO1_WAKEUP;
+       bcmsdh_reg_write(bus->sdh, data, 4, val);
+
+       bus->_oobwakeup = TRUE;
+
+       return 0;
+}
+#endif /* USE_OOB_GPIO1 */
+
+/*
+ * Query if FW is in SR mode
+ */
+static bool
+dhdsdio_sr_cap(dhd_bus_t *bus)
+{
+       bool cap = FALSE;
+       uint32  core_capext, addr, data;
+
+       if (bus->sih->chip == BCM43430_CHIP_ID) {
+               /* check if fw initialized sr engine */
+               addr = SI_ENUM_BASE + OFFSETOF(chipcregs_t, sr_control1);
+               if (bcmsdh_reg_read(bus->sdh, addr, 4) != 0)
+                       cap = TRUE;
+
+               return cap;
+       }
+       if (bus->sih->chip == BCM4324_CHIP_ID) {
+                       addr = SI_ENUM_BASE + OFFSETOF(chipcregs_t, chipcontrol_addr);
+                       data = SI_ENUM_BASE + OFFSETOF(chipcregs_t, chipcontrol_data);
+                       bcmsdh_reg_write(bus->sdh, addr, 4, 3);
+                       core_capext = bcmsdh_reg_read(bus->sdh, data, 4);
+       } else if (bus->sih->chip == BCM4330_CHIP_ID) {
+                       core_capext = FALSE;
+       } else if ((bus->sih->chip == BCM4335_CHIP_ID) ||
+               (bus->sih->chip == BCM4339_CHIP_ID) ||
+               (bus->sih->chip == BCM43349_CHIP_ID) ||
+               (bus->sih->chip == BCM4345_CHIP_ID) ||
+               (bus->sih->chip == BCM43454_CHIP_ID) ||
+               (bus->sih->chip == BCM4354_CHIP_ID) ||
+               (bus->sih->chip == BCM4356_CHIP_ID) ||
+               (bus->sih->chip == BCM4358_CHIP_ID) ||
+               (BCM4349_CHIP(bus->sih->chip))          ||
+               (bus->sih->chip == BCM4350_CHIP_ID)) {
+               core_capext = TRUE;
+       } else {
+                       core_capext = bcmsdh_reg_read(bus->sdh, CORE_CAPEXT_ADDR, 4);
+                       core_capext = (core_capext & CORE_CAPEXT_SR_SUPPORTED_MASK);
+       }
+       if (!(core_capext))
+               return FALSE;
+
+       if (bus->sih->chip == BCM4324_CHIP_ID) {
+               /* FIX: Should change to query SR control register instead */
+               cap = TRUE;
+       } else if ((bus->sih->chip == BCM4335_CHIP_ID) ||
+               (bus->sih->chip == BCM4339_CHIP_ID) ||
+               (bus->sih->chip == BCM43349_CHIP_ID) ||
+               (bus->sih->chip == BCM4345_CHIP_ID) ||
+               (bus->sih->chip == BCM43454_CHIP_ID) ||
+               (bus->sih->chip == BCM4354_CHIP_ID) ||
+               (bus->sih->chip == BCM4356_CHIP_ID) ||
+               (bus->sih->chip == BCM4358_CHIP_ID) ||
+               (bus->sih->chip == BCM4350_CHIP_ID)) {
+               uint32 enabval = 0;
+               addr = SI_ENUM_BASE + OFFSETOF(chipcregs_t, chipcontrol_addr);
+               data = SI_ENUM_BASE + OFFSETOF(chipcregs_t, chipcontrol_data);
+               bcmsdh_reg_write(bus->sdh, addr, 4, CC_PMUCC3);
+               enabval = bcmsdh_reg_read(bus->sdh, data, 4);
+
+               if ((bus->sih->chip == BCM4350_CHIP_ID) ||
+                       (bus->sih->chip == BCM4345_CHIP_ID) ||
+                       (bus->sih->chip == BCM43454_CHIP_ID) ||
+                       (bus->sih->chip == BCM4354_CHIP_ID) ||
+                       (bus->sih->chip == BCM4356_CHIP_ID) ||
+                       (bus->sih->chip == BCM4358_CHIP_ID))
+                       enabval &= CC_CHIPCTRL3_SR_ENG_ENABLE;
+
+               if (enabval)
+                       cap = TRUE;
+       } else {
+               data = bcmsdh_reg_read(bus->sdh,
+                       SI_ENUM_BASE + OFFSETOF(chipcregs_t, retention_ctl), 4);
+               if ((data & (RCTL_MACPHY_DISABLE_MASK | RCTL_LOGIC_DISABLE_MASK)) == 0)
+                       cap = TRUE;
+       }
+
+       return cap;
+}
+
+static int
+dhdsdio_srwar_init(dhd_bus_t *bus)
+{
+       bcmsdh_gpio_init(bus->sdh);
+
+#ifdef USE_OOB_GPIO1
+       dhdsdio_oobwakeup_init(bus);
+#endif
+
+
+       return 0;
+}
+
+static int
+dhdsdio_sr_init(dhd_bus_t *bus)
+{
+       uint8 val;
+       int err = 0;
+
+       if ((bus->sih->chip == BCM4334_CHIP_ID) && (bus->sih->chiprev == 2))
+               dhdsdio_srwar_init(bus);
+
+       val = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_WAKEUPCTRL, NULL);
+       val |= 1 << SBSDIO_FUNC1_WCTRL_HTWAIT_SHIFT;
+       bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_WAKEUPCTRL,
+               1 << SBSDIO_FUNC1_WCTRL_HTWAIT_SHIFT, &err);
+       val = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_WAKEUPCTRL, NULL);
+
+#ifdef USE_CMD14
+       /* Add CMD14 Support */
+       dhdsdio_devcap_set(bus,
+               (SDIOD_CCCR_BRCM_CARDCAP_CMD14_SUPPORT | SDIOD_CCCR_BRCM_CARDCAP_CMD14_EXT));
+#endif /* USE_CMD14 */
+
+       dhdsdio_devcap_set(bus, SDIOD_CCCR_BRCM_CARDCAP_CMD_NODEC);
+
+       bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1,
+               SBSDIO_FUNC1_CHIPCLKCSR, SBSDIO_FORCE_HT, &err);
+
+       bus->_slpauto = dhd_slpauto ? TRUE : FALSE;
+
+       bus->_srenab = TRUE;
+
+       return 0;
+}
+
+/*
+ * FIX: Be sure KSO bit is enabled
+ * Currently, it's defaulting to 0 which should be 1.
+ */
+static int
+dhdsdio_clk_kso_init(dhd_bus_t *bus)
+{
+       uint8 val;
+       int err = 0;
+
+       /* set flag */
+       bus->kso = TRUE;
+
+       /*
+        * Enable KeepSdioOn (KSO) bit for normal operation
+        * Default is 0 (4334A0) so set it. Fixed in B0.
+        */
+       val = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SLEEPCSR, NULL);
+       if (!(val & SBSDIO_FUNC1_SLEEPCSR_KSO_MASK)) {
+               val |= (SBSDIO_FUNC1_SLEEPCSR_KSO_EN << SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT);
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SLEEPCSR, val, &err);
+               if (err)
+                       DHD_ERROR(("%s: SBSDIO_FUNC1_SLEEPCSR err: 0x%x\n", __FUNCTION__, err));
+       }
+
+       return 0;
+}
+
+#define KSO_DBG(x)
+#define KSO_WAIT_US 50
+#define KSO_WAIT_MS 1
+#define KSO_SLEEP_RETRY_COUNT 20
+#define KSO_WAKE_RETRY_COUNT 100
+#define ERROR_BCME_NODEVICE_MAX 1
+
+#define DEFAULT_MAX_KSO_ATTEMPTS (PMU_MAX_TRANSITION_DLY/KSO_WAIT_US)
+#ifndef CUSTOM_MAX_KSO_ATTEMPTS
+#define CUSTOM_MAX_KSO_ATTEMPTS DEFAULT_MAX_KSO_ATTEMPTS
+#endif
+
+static int
+dhdsdio_clk_kso_enab(dhd_bus_t *bus, bool on)
+{
+       uint8 wr_val = 0, rd_val, cmp_val, bmask;
+       int err = 0;
+       int try_cnt = 0;
+
+       KSO_DBG(("%s> op:%s\n", __FUNCTION__, (on ? "KSO_SET" : "KSO_CLR")));
+
+       wr_val |= (on << SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT);
+
+       bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SLEEPCSR, wr_val, &err);
+
+       if (on) {
+               cmp_val = SBSDIO_FUNC1_SLEEPCSR_KSO_MASK |  SBSDIO_FUNC1_SLEEPCSR_DEVON_MASK;
+               bmask = cmp_val;
+
+               OSL_SLEEP(3);
+
+       } else {
+               /* Put device to sleep, turn off  KSO  */
+               cmp_val = 0;
+               bmask = SBSDIO_FUNC1_SLEEPCSR_KSO_MASK;
+       }
+
+       do {
+               rd_val = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SLEEPCSR, &err);
+               if (((rd_val & bmask) == cmp_val) && !err)
+                       break;
+
+               KSO_DBG(("%s> KSO wr/rd retry:%d, ERR:%x \n", __FUNCTION__, try_cnt, err));
+
+               if (((try_cnt + 1) % KSO_SLEEP_RETRY_COUNT) == 0) {
+                       OSL_SLEEP(KSO_WAIT_MS);
+               } else
+                       OSL_DELAY(KSO_WAIT_US);
+
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SLEEPCSR, wr_val, &err);
+       } while (try_cnt++ < CUSTOM_MAX_KSO_ATTEMPTS);
+
+
+       if (try_cnt > 2)
+               KSO_DBG(("%s> op:%s, try_cnt:%d, rd_val:%x, ERR:%x \n",
+                       __FUNCTION__, (on ? "KSO_SET" : "KSO_CLR"), try_cnt, rd_val, err));
+
+       if (try_cnt > CUSTOM_MAX_KSO_ATTEMPTS)  {
+               DHD_ERROR(("%s> op:%s, ERROR: try_cnt:%d, rd_val:%x, ERR:%x \n",
+                       __FUNCTION__, (on ? "KSO_SET" : "KSO_CLR"), try_cnt, rd_val, err));
+       }
+
+       return err;
+}
+
+static int
+dhdsdio_clk_kso_iovar(dhd_bus_t *bus, bool on)
+{
+       int err = 0;
+
+       if (on == FALSE) {
+
+               BUS_WAKE(bus);
+               dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+               DHD_ERROR(("%s: KSO disable clk: 0x%x\n", __FUNCTION__,
+                       bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1,
+                       SBSDIO_FUNC1_CHIPCLKCSR, &err)));
+               dhdsdio_clk_kso_enab(bus, FALSE);
+       } else {
+               DHD_ERROR(("%s: KSO enable\n", __FUNCTION__));
+
+               /* Make sure we have SD bus access */
+               if (bus->clkstate == CLK_NONE) {
+                       DHD_ERROR(("%s: Request SD clk\n", __FUNCTION__));
+                       dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+               }
+
+               dhdsdio_clk_kso_enab(bus, TRUE);
+
+               DHD_ERROR(("%s: sleepcsr: 0x%x\n", __FUNCTION__,
+                       dhdsdio_sleepcsr_get(bus)));
+       }
+
+       bus->kso = on;
+       BCM_REFERENCE(err);
+
+       return 0;
+}
+
+static uint8
+dhdsdio_sleepcsr_get(dhd_bus_t *bus)
+{
+       int err = 0;
+       uint8 val = 0;
+
+       val = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SLEEPCSR, &err);
+       if (err)
+               DHD_TRACE(("Failed to read SLEEPCSR: %d\n", err));
+
+       return val;
+}
+
+uint8
+dhdsdio_devcap_get(dhd_bus_t *bus)
+{
+       return bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_BRCM_CARDCAP, NULL);
+}
+
+static int
+dhdsdio_devcap_set(dhd_bus_t *bus, uint8 cap)
+{
+       int err = 0;
+
+       bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_BRCM_CARDCAP, cap, &err);
+       if (err)
+               DHD_ERROR(("%s: devcap set err: 0x%x\n", __FUNCTION__, err));
+
+       return 0;
+}
+
+static int
+dhdsdio_clk_devsleep_iovar(dhd_bus_t *bus, bool on)
+{
+       int err = 0, retry;
+       uint8 val;
+
+       retry = 0;
+       if (on == TRUE) {
+               /* Enter Sleep */
+
+               /* Be sure we request clk before going to sleep
+                * so we can wake-up with clk request already set
+                * else device can go back to sleep immediately
+                */
+               if (!SLPAUTO_ENAB(bus))
+                       dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+               else {
+                       val = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+                       if ((val & SBSDIO_CSR_MASK) == 0) {
+                               DHD_ERROR(("%s: No clock before enter sleep:0x%x\n",
+                                       __FUNCTION__, val));
+
+                               /* Reset clock request */
+                               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+                                       SBSDIO_ALP_AVAIL_REQ, &err);
+                               DHD_ERROR(("%s: clock before sleep:0x%x\n", __FUNCTION__,
+                                       bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1,
+                                       SBSDIO_FUNC1_CHIPCLKCSR, &err)));
+                       }
+               }
+
+               DHD_TRACE(("%s: clk before sleep: 0x%x\n", __FUNCTION__,
+                       bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1,
+                       SBSDIO_FUNC1_CHIPCLKCSR, &err)));
+#ifdef USE_CMD14
+               err = bcmsdh_sleep(bus->sdh, TRUE);
+#else
+
+
+               err = dhdsdio_clk_kso_enab(bus, FALSE);
+               if (OOB_WAKEUP_ENAB(bus))
+               {
+                       err = bcmsdh_gpioout(bus->sdh, GPIO_DEV_WAKEUP, FALSE);  /* GPIO_1 is off */
+               }
+#endif /* USE_CMD14 */
+       } else {
+               /* Exit Sleep */
+               /* Make sure we have SD bus access */
+               if (bus->clkstate == CLK_NONE) {
+                       DHD_TRACE(("%s: Request SD clk\n", __FUNCTION__));
+                       dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+               }
+
+               if ((bus->sih->chip == BCM4334_CHIP_ID) && (bus->sih->chiprev == 2)) {
+                       SPINWAIT_SLEEP(sdioh_spinwait_sleep,
+                               (bcmsdh_gpioin(bus->sdh, GPIO_DEV_SRSTATE) != TRUE),
+                               GPIO_DEV_SRSTATE_TIMEOUT);
+
+                       if (bcmsdh_gpioin(bus->sdh, GPIO_DEV_SRSTATE) == FALSE) {
+                               DHD_ERROR(("ERROR: GPIO_DEV_SRSTATE still low!\n"));
+                       }
+               }
+#ifdef USE_CMD14
+               err = bcmsdh_sleep(bus->sdh, FALSE);
+               if (SLPAUTO_ENAB(bus) && (err != 0)) {
+                       OSL_DELAY(10000);
+                       DHD_TRACE(("%s: Resync device sleep\n", __FUNCTION__));
+
+                       /* Toggle sleep to resync with host and device */
+                       err = bcmsdh_sleep(bus->sdh, TRUE);
+                       OSL_DELAY(10000);
+                       err = bcmsdh_sleep(bus->sdh, FALSE);
+
+                       if (err) {
+                               OSL_DELAY(10000);
+                               DHD_ERROR(("%s: CMD14 exit failed again!\n", __FUNCTION__));
+
+                               /* Toggle sleep to resync with host and device */
+                               err = bcmsdh_sleep(bus->sdh, TRUE);
+                               OSL_DELAY(10000);
+                               err = bcmsdh_sleep(bus->sdh, FALSE);
+                               if (err) {
+                                       DHD_ERROR(("%s: CMD14 exit failed twice!\n", __FUNCTION__));
+                                       DHD_ERROR(("%s: FATAL: Device non-response!\n",
+                                               __FUNCTION__));
+                                       err = 0;
+                               }
+                       }
+               }
+#else
+               if (OOB_WAKEUP_ENAB(bus))
+               {
+                       err = bcmsdh_gpioout(bus->sdh, GPIO_DEV_WAKEUP, TRUE);  /* GPIO_1 is on */
+               }
+               do {
+                       err = dhdsdio_clk_kso_enab(bus, TRUE);
+                       if (err)
+                               OSL_SLEEP(10);
+               } while ((err != 0) && (++retry < 3));
+
+               if (err != 0) {
+                       DHD_ERROR(("ERROR: kso set failed retry: %d\n", retry));
+                       err = 0; /* continue anyway */
+               }
+
+
+#endif /* !USE_CMD14 */
+
+               if (err == 0) {
+                       uint8 csr;
+
+                       /* Wait for device ready during transition to wake-up */
+                       SPINWAIT_SLEEP(sdioh_spinwait_sleep,
+                               (((csr = dhdsdio_sleepcsr_get(bus)) &
+                               SBSDIO_FUNC1_SLEEPCSR_DEVON_MASK) !=
+                               (SBSDIO_FUNC1_SLEEPCSR_DEVON_MASK)), (20000));
+
+                       DHD_TRACE(("%s: ExitSleep sleepcsr: 0x%x\n", __FUNCTION__, csr));
+
+                       if (!(csr & SBSDIO_FUNC1_SLEEPCSR_DEVON_MASK)) {
+                               DHD_ERROR(("%s:ERROR: ExitSleep device NOT Ready! 0x%x\n",
+                                       __FUNCTION__, csr));
+                               err = BCME_NODEVICE;
+                       }
+
+                       SPINWAIT_SLEEP(sdioh_spinwait_sleep,
+                               (((csr = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1,
+                               SBSDIO_FUNC1_CHIPCLKCSR, &err)) & SBSDIO_HT_AVAIL) !=
+                               (SBSDIO_HT_AVAIL)), (10000));
+
+                       DHD_TRACE(("%s: SBSDIO_FUNC1_CHIPCLKCSR : 0x%x\n", __FUNCTION__, csr));
+                       if (!err && ((csr & SBSDIO_HT_AVAIL) != SBSDIO_HT_AVAIL)) {
+                               DHD_ERROR(("%s:ERROR: device NOT Ready! 0x%x\n",
+                                       __FUNCTION__, csr));
+                               err = BCME_NODEVICE;
+                       }
+               }
+       }
+
+       /* Update if successful */
+       if (err == 0)
+               bus->kso = on ? FALSE : TRUE;
+       else {
+               DHD_ERROR(("%s: Sleep request failed: kso:%d on:%d err:%d\n",
+                       __FUNCTION__, bus->kso, on, err));
+               if (!on && retry > 2)
+                       bus->kso = FALSE;
+       }
+
+       return err;
+}
+
+/* Turn backplane clock on or off */
+static int
+dhdsdio_htclk(dhd_bus_t *bus, bool on, bool pendok)
+{
+#define HT_AVAIL_ERROR_MAX 10
+       static int ht_avail_error = 0;
+       int err;
+       uint8 clkctl, clkreq, devctl;
+       bcmsdh_info_t *sdh;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       clkctl = 0;
+       sdh = bus->sdh;
+
+
+       if (!KSO_ENAB(bus))
+               return BCME_OK;
+
+       if (SLPAUTO_ENAB(bus)) {
+               bus->clkstate = (on ? CLK_AVAIL : CLK_SDONLY);
+               return BCME_OK;
+       }
+
+       if (on) {
+               /* Request HT Avail */
+               clkreq = bus->alp_only ? SBSDIO_ALP_AVAIL_REQ : SBSDIO_HT_AVAIL_REQ;
+
+
+
+               bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
+               if (err) {
+                       ht_avail_error++;
+                       if (ht_avail_error < HT_AVAIL_ERROR_MAX) {
+                               DHD_ERROR(("%s: HT Avail request error: %d\n", __FUNCTION__, err));
+                       }
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+                       else if (ht_avail_error == HT_AVAIL_ERROR_MAX) {
+                               bus->dhd->hang_reason = HANG_REASON_HT_AVAIL_ERROR;
+                               dhd_os_send_hang_message(bus->dhd);
+                       }
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27) */
+                       return BCME_ERROR;
+               } else {
+                       ht_avail_error = 0;
+               }
+
+
+               /* Check current status */
+               clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+               if (err) {
+                       DHD_ERROR(("%s: HT Avail read error: %d\n", __FUNCTION__, err));
+                       return BCME_ERROR;
+               }
+
+#if !defined(OOB_INTR_ONLY) || defined(OOB_PARAM)
+               /* Go to pending and await interrupt if appropriate */
+               if (1 &&
+#if defined(OOB_PARAM)
+                       bus->dhd->oob_disable &&
+#endif /* OOB_PARAM */
+                       !SBSDIO_CLKAV(clkctl, bus->alp_only) && pendok) {
+                       /* Allow only clock-available interrupt */
+                       devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
+                       if (err) {
+                               DHD_ERROR(("%s: Devctl access error setting CA: %d\n",
+                                          __FUNCTION__, err));
+                               return BCME_ERROR;
+                       }
+
+                       devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
+                       bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
+                       DHD_INFO(("CLKCTL: set PENDING\n"));
+                       bus->clkstate = CLK_PENDING;
+                       return BCME_OK;
+               } else
+#endif /* !defined(OOB_INTR_ONLY) || defined(OOB_PARAM) */
+               {
+                       if (bus->clkstate == CLK_PENDING) {
+                               /* Cancel CA-only interrupt filter */
+                               devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
+                               devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
+                               bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
+                       }
+               }
+
+               /* Otherwise, wait here (polling) for HT Avail */
+               if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
+                       SPINWAIT_SLEEP(sdioh_spinwait_sleep,
+                               ((clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
+                                                           SBSDIO_FUNC1_CHIPCLKCSR, &err)),
+                                 !SBSDIO_CLKAV(clkctl, bus->alp_only)), PMU_MAX_TRANSITION_DLY);
+               }
+               if (err) {
+                       DHD_ERROR(("%s: HT Avail request error: %d\n", __FUNCTION__, err));
+                       return BCME_ERROR;
+               }
+               if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
+                       DHD_ERROR(("%s: HT Avail timeout (%d): clkctl 0x%02x\n",
+                                  __FUNCTION__, PMU_MAX_TRANSITION_DLY, clkctl));
+                       return BCME_ERROR;
+               }
+
+               /* Mark clock available */
+               bus->clkstate = CLK_AVAIL;
+               DHD_INFO(("CLKCTL: turned ON\n"));
+
+#if defined(DHD_DEBUG)
+               if (bus->alp_only == TRUE) {
+#if !defined(BCMLXSDMMC)
+                       if (!SBSDIO_ALPONLY(clkctl)) {
+                               DHD_ERROR(("%s: HT Clock, when ALP Only\n", __FUNCTION__));
+                       }
+#endif /* !defined(BCMLXSDMMC) */
+               } else {
+                       if (SBSDIO_ALPONLY(clkctl)) {
+                               DHD_ERROR(("%s: HT Clock should be on.\n", __FUNCTION__));
+                       }
+               }
+#endif /* defined (DHD_DEBUG) */
+
+               bus->activity = TRUE;
+#ifdef DHD_USE_IDLECOUNT
+               bus->idlecount = 0;
+#endif /* DHD_USE_IDLECOUNT */
+       } else {
+               clkreq = 0;
+
+               if (bus->clkstate == CLK_PENDING) {
+                       /* Cancel CA-only interrupt filter */
+                       devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
+                       devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
+                       bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
+               }
+
+               bus->clkstate = CLK_SDONLY;
+               if (!SR_ENAB(bus)) {
+                       bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
+                       DHD_INFO(("CLKCTL: turned OFF\n"));
+                       if (err) {
+                               DHD_ERROR(("%s: Failed access turning clock off: %d\n",
+                                          __FUNCTION__, err));
+                               return BCME_ERROR;
+                       }
+               }
+       }
+       return BCME_OK;
+}
+
+/* Change idle/active SD state */
+static int
+dhdsdio_sdclk(dhd_bus_t *bus, bool on)
+{
+       int err;
+       int32 iovalue;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (on) {
+               if (bus->idleclock == DHD_IDLE_STOP) {
+                       /* Turn on clock and restore mode */
+                       iovalue = 1;
+                       err = bcmsdh_iovar_op(bus->sdh, "sd_clock", NULL, 0,
+                                             &iovalue, sizeof(iovalue), TRUE);
+                       if (err) {
+                               DHD_ERROR(("%s: error enabling sd_clock: %d\n",
+                                          __FUNCTION__, err));
+                               return BCME_ERROR;
+                       }
+
+                       iovalue = bus->sd_mode;
+                       err = bcmsdh_iovar_op(bus->sdh, "sd_mode", NULL, 0,
+                                             &iovalue, sizeof(iovalue), TRUE);
+                       if (err) {
+                               DHD_ERROR(("%s: error changing sd_mode: %d\n",
+                                          __FUNCTION__, err));
+                               return BCME_ERROR;
+                       }
+               } else if (bus->idleclock != DHD_IDLE_ACTIVE) {
+                       /* Restore clock speed */
+                       iovalue = bus->sd_divisor;
+                       err = bcmsdh_iovar_op(bus->sdh, "sd_divisor", NULL, 0,
+                                             &iovalue, sizeof(iovalue), TRUE);
+                       if (err) {
+                               DHD_ERROR(("%s: error restoring sd_divisor: %d\n",
+                                          __FUNCTION__, err));
+                               return BCME_ERROR;
+                       }
+               }
+               bus->clkstate = CLK_SDONLY;
+       } else {
+               /* Stop or slow the SD clock itself */
+               if ((bus->sd_divisor == -1) || (bus->sd_mode == -1)) {
+                       DHD_TRACE(("%s: can't idle clock, divisor %d mode %d\n",
+                                  __FUNCTION__, bus->sd_divisor, bus->sd_mode));
+                       return BCME_ERROR;
+               }
+               if (bus->idleclock == DHD_IDLE_STOP) {
+                       if (sd1idle) {
+                               /* Change to SD1 mode and turn off clock */
+                               iovalue = 1;
+                               err = bcmsdh_iovar_op(bus->sdh, "sd_mode", NULL, 0,
+                                                     &iovalue, sizeof(iovalue), TRUE);
+                               if (err) {
+                                       DHD_ERROR(("%s: error changing sd_clock: %d\n",
+                                                  __FUNCTION__, err));
+                                       return BCME_ERROR;
+                               }
+                       }
+
+                       iovalue = 0;
+                       err = bcmsdh_iovar_op(bus->sdh, "sd_clock", NULL, 0,
+                                             &iovalue, sizeof(iovalue), TRUE);
+                       if (err) {
+                               DHD_ERROR(("%s: error disabling sd_clock: %d\n",
+                                          __FUNCTION__, err));
+                               return BCME_ERROR;
+                       }
+               } else if (bus->idleclock != DHD_IDLE_ACTIVE) {
+                       /* Set divisor to idle value */
+                       iovalue = bus->idleclock;
+                       err = bcmsdh_iovar_op(bus->sdh, "sd_divisor", NULL, 0,
+                                             &iovalue, sizeof(iovalue), TRUE);
+                       if (err) {
+                               DHD_ERROR(("%s: error changing sd_divisor: %d\n",
+                                          __FUNCTION__, err));
+                               return BCME_ERROR;
+                       }
+               }
+               bus->clkstate = CLK_NONE;
+       }
+
+       return BCME_OK;
+}
+
+/* Transition SD and backplane clock readiness */
+static int
+dhdsdio_clkctl(dhd_bus_t *bus, uint target, bool pendok)
+{
+       int ret = BCME_OK;
+#ifdef DHD_DEBUG
+       uint oldstate = bus->clkstate;
+#endif /* DHD_DEBUG */
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       /* Early exit if we're already there */
+       if (bus->clkstate == target) {
+               if (target == CLK_AVAIL) {
+                       dhd_os_wd_timer(bus->dhd, dhd_watchdog_ms);
+                       bus->activity = TRUE;
+#ifdef DHD_USE_IDLECOUNT
+                       bus->idlecount = 0;
+#endif /* DHD_USE_IDLECOUNT */
+               }
+               return ret;
+       }
+
+       switch (target) {
+       case CLK_AVAIL:
+               /* Make sure SD clock is available */
+               if (bus->clkstate == CLK_NONE)
+                       dhdsdio_sdclk(bus, TRUE);
+               /* Now request HT Avail on the backplane */
+               ret = dhdsdio_htclk(bus, TRUE, pendok);
+               if (ret == BCME_OK) {
+                       dhd_os_wd_timer(bus->dhd, dhd_watchdog_ms);
+               bus->activity = TRUE;
+#ifdef DHD_USE_IDLECOUNT
+                       bus->idlecount = 0;
+#endif /* DHD_USE_IDLECOUNT */
+               }
+               break;
+
+       case CLK_SDONLY:
+               /* Remove HT request, or bring up SD clock */
+               if (bus->clkstate == CLK_NONE)
+                       ret = dhdsdio_sdclk(bus, TRUE);
+               else if (bus->clkstate == CLK_AVAIL)
+                       ret = dhdsdio_htclk(bus, FALSE, FALSE);
+               else
+                       DHD_ERROR(("dhdsdio_clkctl: request for %d -> %d\n",
+                                  bus->clkstate, target));
+               if (ret == BCME_OK) {
+                       dhd_os_wd_timer(bus->dhd, dhd_watchdog_ms);
+               }
+               break;
+
+       case CLK_NONE:
+               /* Make sure to remove HT request */
+               if (bus->clkstate == CLK_AVAIL)
+                       ret = dhdsdio_htclk(bus, FALSE, FALSE);
+               /* Now remove the SD clock */
+               ret = dhdsdio_sdclk(bus, FALSE);
+#ifdef DHD_DEBUG
+               if (dhd_console_ms == 0)
+#endif /* DHD_DEBUG */
+               if (bus->poll == 0)
+                       dhd_os_wd_timer(bus->dhd, 0);
+               break;
+       }
+#ifdef DHD_DEBUG
+       DHD_INFO(("dhdsdio_clkctl: %d -> %d\n", oldstate, bus->clkstate));
+#endif /* DHD_DEBUG */
+
+       return ret;
+}
+
+static int
+dhdsdio_bussleep(dhd_bus_t *bus, bool sleep)
+{
+       int err = 0;
+       bcmsdh_info_t *sdh = bus->sdh;
+       sdpcmd_regs_t *regs = bus->regs;
+       uint retries = 0;
+
+       DHD_INFO(("dhdsdio_bussleep: request %s (currently %s)\n",
+                 (sleep ? "SLEEP" : "WAKE"),
+                 (bus->sleeping ? "SLEEP" : "WAKE")));
+
+       if (bus->dhd->hang_was_sent)
+               return BCME_ERROR;
+
+       /* Done if we're already in the requested state */
+       if (sleep == bus->sleeping)
+               return BCME_OK;
+
+       /* Going to sleep: set the alarm and turn off the lights... */
+       if (sleep) {
+               /* Don't sleep if something is pending */
+#ifdef DHD_USE_IDLECOUNT
+               if (bus->dpc_sched || bus->rxskip || pktq_len(&bus->txq) || bus->readframes ||
+                       bus->ctrl_frame_stat)
+#else
+               if (bus->dpc_sched || bus->rxskip || pktq_len(&bus->txq))
+#endif /* DHD_USE_IDLECOUNT */
+                       return BCME_BUSY;
+
+
+               if (!SLPAUTO_ENAB(bus)) {
+                       /* Disable SDIO interrupts (no longer interested) */
+                       bcmsdh_intr_disable(bus->sdh);
+
+                       /* Make sure the controller has the bus up */
+                       dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+                       /* Tell device to start using OOB wakeup */
+                       W_SDREG(SMB_USE_OOB, &regs->tosbmailbox, retries);
+                       if (retries > retry_limit)
+                               DHD_ERROR(("CANNOT SIGNAL CHIP, WILL NOT WAKE UP!!\n"));
+
+                       /* Turn off our contribution to the HT clock request */
+                       dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+
+                       bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+                               SBSDIO_FORCE_HW_CLKREQ_OFF, NULL);
+
+                       /* Isolate the bus */
+                       if (bus->sih->chip != BCM4329_CHIP_ID &&
+                               bus->sih->chip != BCM4319_CHIP_ID) {
+                               bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL,
+                                       SBSDIO_DEVCTL_PADS_ISO, NULL);
+                       }
+               } else {
+                       /* Leave interrupts enabled since device can exit sleep and
+                        * interrupt host
+                        */
+                       err = dhdsdio_clk_devsleep_iovar(bus, TRUE /* sleep */);
+               }
+
+               /* Change state */
+               bus->sleeping = TRUE;
+#if defined(SUPPORT_P2P_GO_PS)
+               wake_up(&bus->bus_sleep);
+#endif /* LINUX && SUPPORT_P2P_GO_PS */
+       } else {
+               /* Waking up: bus power up is ok, set local state */
+
+               if (!SLPAUTO_ENAB(bus)) {
+                       bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, 0, &err);
+
+                       /* Force pad isolation off if possible (in case power never toggled) */
+                       bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, 0, NULL);
+
+
+                       /* Make sure the controller has the bus up */
+                       dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+                       /* Send misc interrupt to indicate OOB not needed */
+                       W_SDREG(0, &regs->tosbmailboxdata, retries);
+                       if (retries <= retry_limit)
+                               W_SDREG(SMB_DEV_INT, &regs->tosbmailbox, retries);
+
+                       if (retries > retry_limit)
+                               DHD_ERROR(("CANNOT SIGNAL CHIP TO CLEAR OOB!!\n"));
+
+                       /* Make sure we have SD bus access */
+                       dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+
+                       /* Enable interrupts again */
+                       if (bus->intr && (bus->dhd->busstate == DHD_BUS_DATA)) {
+                               bus->intdis = FALSE;
+                               bcmsdh_intr_enable(bus->sdh);
+                       }
+               } else {
+                       err = dhdsdio_clk_devsleep_iovar(bus, FALSE /* wake */);
+               }
+
+               if (err == 0) {
+                       /* Change state */
+                       bus->sleeping = FALSE;
+               }
+       }
+
+       return err;
+}
+
+#ifdef USE_DYNAMIC_F2_BLKSIZE
+int dhdsdio_func_blocksize(dhd_pub_t *dhd, int function_num, int block_size)
+{
+       int func_blk_size = function_num;
+       int bcmerr = 0;
+       int result;
+
+       bcmerr = dhd_bus_iovar_op(dhd, "sd_blocksize", &func_blk_size,
+               sizeof(int), &result, sizeof(int), IOV_GET);
+
+       if (bcmerr != BCME_OK) {
+               DHD_ERROR(("%s: Get F%d Block size error\n", __FUNCTION__, function_num));
+               return BCME_ERROR;
+       }
+
+       if (result != block_size) {
+               DHD_TRACE_HW4(("%s: F%d Block size set from %d to %d\n",
+                       __FUNCTION__, function_num, result, block_size));
+               func_blk_size = function_num << 16 | block_size;
+               bcmerr = dhd_bus_iovar_op(dhd, "sd_blocksize", NULL,
+                       0, &func_blk_size, sizeof(int32), IOV_SET);
+               if (bcmerr != BCME_OK) {
+                       DHD_ERROR(("%s: Set F2 Block size error\n", __FUNCTION__));
+                       return BCME_ERROR;
+               }
+       }
+
+       return BCME_OK;
+}
+#endif /* USE_DYNAMIC_F2_BLKSIZE */
+
+#if defined(OOB_INTR_ONLY)
+void
+dhd_enable_oob_intr(struct dhd_bus *bus, bool enable)
+{
+#if defined(HW_OOB)
+       bcmsdh_enable_hw_oob_intr(bus->sdh, enable);
+#else
+       sdpcmd_regs_t *regs = bus->regs;
+       uint retries = 0;
+
+       dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+       if (enable == TRUE) {
+
+               /* Tell device to start using OOB wakeup */
+               W_SDREG(SMB_USE_OOB, &regs->tosbmailbox, retries);
+               if (retries > retry_limit)
+                       DHD_ERROR(("CANNOT SIGNAL CHIP, WILL NOT WAKE UP!!\n"));
+
+       } else {
+               /* Send misc interrupt to indicate OOB not needed */
+               W_SDREG(0, &regs->tosbmailboxdata, retries);
+               if (retries <= retry_limit)
+                       W_SDREG(SMB_DEV_INT, &regs->tosbmailbox, retries);
+       }
+
+       /* Turn off our contribution to the HT clock request */
+       dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+#endif /* !defined(HW_OOB) */
+}
+#endif 
+
+int
+dhd_bus_txdata(struct dhd_bus *bus, void *pkt)
+{
+       int ret = BCME_ERROR;
+       osl_t *osh;
+       uint datalen, prec;
+#if defined(DHD_TX_DUMP)
+       uint8 *dump_data;
+       uint16 protocol;
+#endif /* DHD_TX_DUMP */
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       osh = bus->dhd->osh;
+       datalen = PKTLEN(osh, pkt);
+
+#ifdef SDTEST
+       /* Push the test header if doing loopback */
+       if (bus->ext_loop) {
+               uint8* data;
+               PKTPUSH(osh, pkt, SDPCM_TEST_HDRLEN);
+               data = PKTDATA(osh, pkt);
+               *data++ = SDPCM_TEST_ECHOREQ;
+               *data++ = (uint8)bus->loopid++;
+               *data++ = (datalen >> 0);
+               *data++ = (datalen >> 8);
+               datalen += SDPCM_TEST_HDRLEN;
+       }
+#else /* SDTEST */
+       BCM_REFERENCE(datalen);
+#endif /* SDTEST */
+
+#if defined(DHD_TX_DUMP)
+       dump_data = PKTDATA(osh, pkt);
+       dump_data += 4; /* skip 4 bytes header */
+       protocol = (dump_data[12] << 8) | dump_data[13];
+
+       if (protocol == ETHER_TYPE_802_1X) {
+               DHD_ERROR(("ETHER_TYPE_802_1X [TX]: ver %d, type %d, replay %d\n",
+                       dump_data[14], dump_data[15], dump_data[30]));
+       }
+#endif /* DHD_TX_DUMP */
+
+#if defined(DHD_TX_DUMP) && defined(DHD_TX_FULL_DUMP)
+       {
+               int i;
+               DHD_ERROR(("TX DUMP\n"));
+
+               for (i = 0; i < (datalen - 4); i++) {
+                       DHD_ERROR(("%02X ", dump_data[i]));
+                       if ((i & 15) == 15)
+                               printk("\n");
+               }
+               DHD_ERROR(("\n"));
+       }
+#endif /* DHD_TX_DUMP && DHD_TX_FULL_DUMP */
+
+       prec = PRIO2PREC((PKTPRIO(pkt) & PRIOMASK));
+
+       /* Check for existing queue, current flow-control, pending event, or pending clock */
+       if (dhd_deferred_tx || bus->fcstate || pktq_len(&bus->txq) || bus->dpc_sched ||
+           (!DATAOK(bus)) || (bus->flowcontrol & NBITVAL(prec)) ||
+           (bus->clkstate != CLK_AVAIL)) {
+               bool deq_ret;
+               int pkq_len;
+
+               DHD_TRACE(("%s: deferring pktq len %d\n", __FUNCTION__, pktq_len(&bus->txq)));
+               bus->fcqueued++;
+
+               /* Priority based enq */
+               dhd_os_sdlock_txq(bus->dhd);
+               deq_ret = dhd_prec_enq(bus->dhd, &bus->txq, pkt, prec);
+               dhd_os_sdunlock_txq(bus->dhd);
+
+               if (!deq_ret) {
+#ifdef PROP_TXSTATUS
+                       if (DHD_PKTTAG_WLFCPKT(PKTTAG(pkt)) == 0)
+#endif /* PROP_TXSTATUS */
+                       {
+#ifdef DHDTCPACK_SUPPRESS
+                               if (dhd_tcpack_check_xmit(bus->dhd, pkt) == BCME_ERROR) {
+                                       DHD_ERROR(("%s %d: tcpack_suppress ERROR!!! Stop using\n",
+                                               __FUNCTION__, __LINE__));
+                                       dhd_tcpack_suppress_set(bus->dhd, TCPACK_SUP_OFF);
+                               }
+#endif /* DHDTCPACK_SUPPRESS */
+                               dhd_txcomplete(bus->dhd, pkt, FALSE);
+                               PKTFREE(osh, pkt, TRUE);
+                       }
+                       ret = BCME_NORESOURCE;
+               } else
+                       ret = BCME_OK;
+
+               dhd_os_sdlock_txq(bus->dhd);
+               pkq_len = pktq_len(&bus->txq);
+               dhd_os_sdunlock_txq(bus->dhd);
+               if (pkq_len >= FCHI) {
+                       bool wlfc_enabled = FALSE;
+#ifdef PROP_TXSTATUS
+                       wlfc_enabled = (dhd_wlfc_flowcontrol(bus->dhd, ON, FALSE) !=
+                               WLFC_UNSUPPORTED);
+#endif
+                       if (!wlfc_enabled && dhd_doflow) {
+                               dhd_txflowcontrol(bus->dhd, ALL_INTERFACES, ON);
+                       }
+               }
+
+#ifdef DHD_DEBUG
+               dhd_os_sdlock_txq(bus->dhd);
+               if (pktq_plen(&bus->txq, prec) > qcount[prec])
+                       qcount[prec] = pktq_plen(&bus->txq, prec);
+               dhd_os_sdunlock_txq(bus->dhd);
+#endif
+
+               /* Schedule DPC if needed to send queued packet(s) */
+               if (dhd_deferred_tx && !bus->dpc_sched) {
+                       bus->dpc_sched = TRUE;
+                       dhd_sched_dpc(bus->dhd);
+               }
+       } else {
+               int chan = SDPCM_DATA_CHANNEL;
+
+#ifdef SDTEST
+               chan = (bus->ext_loop ? SDPCM_TEST_CHANNEL : SDPCM_DATA_CHANNEL);
+#endif
+               /* Lock: we're about to use shared data/code (and SDIO) */
+               dhd_os_sdlock(bus->dhd);
+
+               /* Otherwise, send it now */
+               BUS_WAKE(bus);
+               /* Make sure back plane ht clk is on, no pending allowed */
+               dhdsdio_clkctl(bus, CLK_AVAIL, TRUE);
+
+               ret = dhdsdio_txpkt(bus, chan, &pkt, 1, TRUE);
+
+               if (ret != BCME_OK)
+                       bus->dhd->tx_errors++;
+               else
+                       bus->dhd->dstats.tx_bytes += datalen;
+
+               if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
+                       bus->activity = FALSE;
+                       dhdsdio_clkctl(bus, CLK_NONE, TRUE);
+               }
+
+               dhd_os_sdunlock(bus->dhd);
+       }
+
+       return ret;
+}
+
+/* align packet data pointer and packet length to n-byte boundary, process packet headers,
+ * a new packet may be allocated if there is not enough head and/or tail from for padding.
+ * the caller is responsible for updating the glom size in the head packet (when glom is
+ * used)
+ *
+ * pad_pkt_len: returns the length of extra padding needed from the padding packet, this parameter
+ * is taken in tx glom mode only
+ *
+ * new_pkt: out, pointer of the new packet allocated due to insufficient head room for alignment
+ * padding, NULL if not needed, the caller is responsible for freeing the new packet
+ *
+ * return: positive value - length of the packet, including head and tail padding
+ *                negative value - errors
+ */
+static int dhdsdio_txpkt_preprocess(dhd_bus_t *bus, void *pkt, int chan, int txseq,
+       int prev_chain_total_len, bool last_chained_pkt,
+       int *pad_pkt_len, void **new_pkt)
+{
+       osl_t *osh;
+       uint8 *frame;
+       int pkt_len;
+       int modulo;
+       int head_padding;
+       int tail_padding = 0;
+       uint32 swheader;
+       uint32 swhdr_offset;
+       bool alloc_new_pkt = FALSE;
+       uint8 sdpcm_hdrlen = bus->txglom_enable ? SDPCM_HDRLEN_TXGLOM : SDPCM_HDRLEN;
+
+       *new_pkt = NULL;
+       osh = bus->dhd->osh;
+
+#ifdef DHDTCPACK_SUPPRESS
+       if (dhd_tcpack_check_xmit(bus->dhd, pkt) == BCME_ERROR) {
+               DHD_ERROR(("%s %d: tcpack_suppress ERROR!!! Stop using it\n",
+                       __FUNCTION__, __LINE__));
+               dhd_tcpack_suppress_set(bus->dhd, TCPACK_SUP_OFF);
+       }
+#endif /* DHDTCPACK_SUPPRESS */
+
+       /* Add space for the SDPCM hardware/software headers */
+       PKTPUSH(osh, pkt, sdpcm_hdrlen);
+       ASSERT(ISALIGNED((uintptr)PKTDATA(osh, pkt), 2));
+
+       frame = (uint8*)PKTDATA(osh, pkt);
+       pkt_len = (uint16)PKTLEN(osh, pkt);
+
+#ifdef WLMEDIA_HTSF
+       frame = (uint8*)PKTDATA(osh, pkt);
+       if (PKTLEN(osh, pkt) >= 100) {
+               htsf_ts = (htsfts_t*) (frame + HTSF_HOSTOFFSET + 12);
+               if (htsf_ts->magic == HTSFMAGIC) {
+                       htsf_ts->c20 = get_cycles();
+                       htsf_ts->t20 = dhd_get_htsf(bus->dhd->info, 0);
+               }
+       }
+#endif /* WLMEDIA_HTSF */
+#ifdef DHD_DEBUG
+       if (PKTPRIO(pkt) < ARRAYSIZE(tx_packets))
+               tx_packets[PKTPRIO(pkt)]++;
+#endif /* DHD_DEBUG */
+
+       /* align the data pointer, allocate a new packet if there is not enough space (new
+        * packet data pointer will be aligned thus no padding will be needed)
+        */
+       head_padding = (ulong)frame % DHD_SDALIGN;
+       if (PKTHEADROOM(osh, pkt) < head_padding) {
+               head_padding = 0;
+               alloc_new_pkt = TRUE;
+       } else {
+               uint cur_chain_total_len;
+               int chain_tail_padding = 0;
+
+               /* All packets need to be aligned by DHD_SDALIGN */
+               modulo = (pkt_len + head_padding) % DHD_SDALIGN;
+               tail_padding = modulo > 0 ? (DHD_SDALIGN - modulo) : 0;
+
+               /* Total pkt chain length needs to be aligned by block size,
+                * unless it is a single pkt chain with total length less than one block size,
+                * which we prefer sending by byte mode.
+                *
+                * Do the chain alignment here if
+                * 1. This is the last pkt of the chain of multiple pkts or a single pkt.
+                * 2-1. This chain is of multiple pkts, or
+                * 2-2. This is a single pkt whose size is longer than one block size.
+                */
+               cur_chain_total_len = prev_chain_total_len +
+                       (head_padding + pkt_len + tail_padding);
+               if (last_chained_pkt && bus->blocksize != 0 &&
+                       (cur_chain_total_len > (int)bus->blocksize || prev_chain_total_len > 0)) {
+                       modulo = cur_chain_total_len % bus->blocksize;
+                       chain_tail_padding = modulo > 0 ? (bus->blocksize - modulo) : 0;
+               }
+
+#ifdef DHDENABLE_TAILPAD
+               if (PKTTAILROOM(osh, pkt) < tail_padding) {
+                       /* We don't have tail room to align by DHD_SDALIGN */
+                       alloc_new_pkt = TRUE;
+                       bus->tx_tailpad_pktget++;
+               } else if (PKTTAILROOM(osh, pkt) < tail_padding + chain_tail_padding) {
+                       /* We have tail room for tail_padding of this pkt itself, but not for
+                        * total pkt chain alignment by block size.
+                        * Use the padding packet to avoid memory copy if applicable,
+                        * otherwise, just allocate a new pkt.
+                        */
+                       if (bus->pad_pkt) {
+                               *pad_pkt_len = chain_tail_padding;
+                               bus->tx_tailpad_chain++;
+                       } else {
+                               alloc_new_pkt = TRUE;
+                               bus->tx_tailpad_pktget++;
+                       }
+               } else
+               /* This last pkt's tailroom is sufficient to hold both tail_padding
+                * of the pkt itself and chain_tail_padding of total pkt chain
+                */
+#endif /* DHDENABLE_TAILPAD */
+               tail_padding += chain_tail_padding;
+       }
+
+       DHD_INFO(("%s sdhdr len + orig_pkt_len %d h_pad %d t_pad %d pad_pkt_len %d\n",
+               __FUNCTION__, pkt_len, head_padding, tail_padding, *pad_pkt_len));
+
+       if (alloc_new_pkt) {
+               void *tmp_pkt;
+               int newpkt_size;
+               int cur_total_len;
+
+               ASSERT(*pad_pkt_len == 0);
+
+               DHD_INFO(("%s allocating new packet for padding\n", __FUNCTION__));
+
+               /* head pointer is aligned now, no padding needed */
+               head_padding = 0;
+
+               /* update the tail padding as it depends on the head padding, since a new packet is
+                * allocated, the head padding is non longer needed and packet length is chagned
+                */
+
+               cur_total_len = prev_chain_total_len + pkt_len;
+               if (last_chained_pkt && bus->blocksize != 0 &&
+                       (cur_total_len > (int)bus->blocksize || prev_chain_total_len > 0)) {
+                       modulo = cur_total_len % bus->blocksize;
+                       tail_padding = modulo > 0 ? (bus->blocksize - modulo) : 0;
+               }
+               else {
+                       modulo = pkt_len % DHD_SDALIGN;
+                       tail_padding = modulo > 0 ? (DHD_SDALIGN - modulo) : 0;
+               }
+
+               newpkt_size = PKTLEN(osh, pkt) + bus->blocksize + DHD_SDALIGN;
+               bus->dhd->tx_realloc++;
+               tmp_pkt = PKTGET(osh, newpkt_size, TRUE);
+               if (tmp_pkt == NULL) {
+                       DHD_ERROR(("failed to alloc new %d byte packet\n", newpkt_size));
+                       return BCME_NOMEM;
+               }
+               PKTALIGN(osh, tmp_pkt, PKTLEN(osh, pkt), DHD_SDALIGN);
+               bcopy(PKTDATA(osh, pkt), PKTDATA(osh, tmp_pkt), PKTLEN(osh, pkt));
+               *new_pkt = tmp_pkt;
+               pkt = tmp_pkt;
+       }
+
+       if (head_padding)
+               PKTPUSH(osh, pkt, head_padding);
+
+       frame = (uint8*)PKTDATA(osh, pkt);
+       bzero(frame, head_padding + sdpcm_hdrlen);
+       pkt_len = (uint16)PKTLEN(osh, pkt);
+
+       /* the header has the followming format
+        * 4-byte HW frame tag: length, ~length (for glom this is the total length)
+        *
+        * 8-byte HW extesion flags (glom mode only) as the following:
+        *                      2-byte packet length, excluding HW tag and padding
+        *                      2-byte frame channel and frame flags (e.g. next frame following)
+        *                      2-byte header length
+        *                      2-byte tail padding size
+        *
+        * 8-byte SW frame tags as the following
+        *                      4-byte flags: host tx seq, channel, data offset
+        *                      4-byte flags: TBD
+        */
+
+       swhdr_offset = SDPCM_FRAMETAG_LEN;
+
+       /* hardware frame tag:
+        *
+        * in tx-glom mode, dongle only checks the hardware frame tag in the first
+        * packet and sees it as the total lenght of the glom (including tail padding),
+        * for each packet in the glom, the packet length needs to be updated, (see
+        * below PKTSETLEN)
+        *
+        * in non tx-glom mode, PKTLEN still need to include tail padding as to be
+        * referred to in sdioh_request_buffer(). The tail length will be excluded in
+        * dhdsdio_txpkt_postprocess().
+        */
+       *(uint16*)frame = (uint16)htol16(pkt_len);
+       *(((uint16*)frame) + 1) = (uint16)htol16(~pkt_len);
+       pkt_len += tail_padding;
+
+       /* hardware extesion flags */
+       if (bus->txglom_enable) {
+               uint32 hwheader1;
+               uint32 hwheader2;
+
+               swhdr_offset += SDPCM_HWEXT_LEN;
+               hwheader1 = (pkt_len - SDPCM_FRAMETAG_LEN - tail_padding) |
+                       (last_chained_pkt << 24);
+               hwheader2 = (tail_padding) << 16;
+               htol32_ua_store(hwheader1, frame + SDPCM_FRAMETAG_LEN);
+               htol32_ua_store(hwheader2, frame + SDPCM_FRAMETAG_LEN + 4);
+       }
+       PKTSETLEN((osh), (pkt), (pkt_len));
+
+       /* software frame tags */
+       swheader = ((chan << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK)
+               | (txseq % SDPCM_SEQUENCE_WRAP) |
+               (((head_padding + sdpcm_hdrlen) << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
+       htol32_ua_store(swheader, frame + swhdr_offset);
+       htol32_ua_store(0, frame + swhdr_offset + sizeof(swheader));
+
+       return pkt_len;
+}
+
+static int dhdsdio_txpkt_postprocess(dhd_bus_t *bus, void *pkt)
+{
+       osl_t *osh;
+       uint8 *frame;
+       int data_offset;
+       int tail_padding;
+       int swhdr_offset = SDPCM_FRAMETAG_LEN + (bus->txglom_enable ? SDPCM_HWEXT_LEN : 0);
+
+       (void)osh;
+       osh = bus->dhd->osh;
+
+       /* restore pkt buffer pointer, but keeps the header pushed by dhd_prot_hdrpush */
+       frame = (uint8*)PKTDATA(osh, pkt);
+
+       DHD_INFO(("%s PKTLEN before postprocess %d",
+               __FUNCTION__, PKTLEN(osh, pkt)));
+
+       /* PKTLEN still includes tail_padding, so exclude it.
+        * We shall have head_padding + original pkt_len for PKTLEN afterwards.
+        */
+       if (bus->txglom_enable) {
+               /* txglom pkts have tail_padding length in HW ext header */
+               tail_padding = ltoh32_ua(frame + SDPCM_FRAMETAG_LEN + 4) >> 16;
+               PKTSETLEN(osh, pkt, PKTLEN(osh, pkt) - tail_padding);
+               DHD_INFO((" txglom pkt: tail_padding %d PKTLEN %d\n",
+                       tail_padding, PKTLEN(osh, pkt)));
+       } else {
+               /* non-txglom pkts have head_padding + original pkt length in HW frame tag.
+                * We cannot refer to this field for txglom pkts as the first pkt of the chain will
+                * have the field for the total length of the chain.
+                */
+               PKTSETLEN(osh, pkt, *(uint16*)frame);
+               DHD_INFO((" non-txglom pkt: HW frame tag len %d after PKTLEN %d\n",
+                       *(uint16*)frame, PKTLEN(osh, pkt)));
+       }
+
+       data_offset = ltoh32_ua(frame + swhdr_offset);
+       data_offset = (data_offset & SDPCM_DOFFSET_MASK) >> SDPCM_DOFFSET_SHIFT;
+       /* Get rid of sdpcm header + head_padding */
+       PKTPULL(osh, pkt, data_offset);
+
+       DHD_INFO(("%s data_offset %d, PKTLEN %d\n",
+               __FUNCTION__, data_offset, PKTLEN(osh, pkt)));
+
+       return BCME_OK;
+}
+
+static int dhdsdio_txpkt(dhd_bus_t *bus, uint chan, void** pkts, int num_pkt, bool free_pkt)
+{
+       int i;
+       int ret = 0;
+       osl_t *osh;
+       bcmsdh_info_t *sdh;
+       void *pkt = NULL;
+       void *pkt_chain;
+       int total_len = 0;
+       void *head_pkt = NULL;
+       void *prev_pkt = NULL;
+       int pad_pkt_len = 0;
+       int new_pkt_num = 0;
+       void *new_pkts[MAX_TX_PKTCHAIN_CNT];
+       bool wlfc_enabled = FALSE;
+
+       if (bus->dhd->dongle_reset)
+               return BCME_NOTREADY;
+
+       sdh = bus->sdh;
+       osh = bus->dhd->osh;
+       /* init new_pkts[0] to make some compiler happy, not necessary as we check new_pkt_num */
+       new_pkts[0] = NULL;
+
+       for (i = 0; i < num_pkt; i++) {
+               int pkt_len;
+               bool last_pkt;
+               void *new_pkt = NULL;
+
+               pkt = pkts[i];
+               ASSERT(pkt);
+               last_pkt = (i == num_pkt - 1);
+               pkt_len = dhdsdio_txpkt_preprocess(bus, pkt, chan, bus->tx_seq + i,
+                       total_len, last_pkt, &pad_pkt_len, &new_pkt);
+               if (pkt_len <= 0)
+                       goto done;
+               if (new_pkt) {
+                       pkt = new_pkt;
+                       new_pkts[new_pkt_num++] = new_pkt;
+               }
+               total_len += pkt_len;
+
+               PKTSETNEXT(osh, pkt, NULL);
+               /* insert the packet into the list */
+               head_pkt ? PKTSETNEXT(osh, prev_pkt, pkt) : (head_pkt = pkt);
+               prev_pkt = pkt;
+
+       }
+
+       /* Update the HW frame tag (total length) in the first pkt of the glom */
+       if (bus->txglom_enable) {
+               uint8 *frame;
+
+               total_len += pad_pkt_len;
+               frame = (uint8*)PKTDATA(osh, head_pkt);
+               *(uint16*)frame = (uint16)htol16(total_len);
+               *(((uint16*)frame) + 1) = (uint16)htol16(~total_len);
+
+       }
+
+#ifdef DHDENABLE_TAILPAD
+       /* if a padding packet if needed, insert it to the end of the link list */
+       if (pad_pkt_len) {
+               PKTSETLEN(osh, bus->pad_pkt, pad_pkt_len);
+               PKTSETNEXT(osh, pkt, bus->pad_pkt);
+       }
+#endif /* DHDENABLE_TAILPAD */
+
+       /* dhd_bcmsdh_send_buf ignores the buffer pointer if he packet
+        * parameter is not NULL, for non packet chian we pass NULL pkt pointer
+        * so it will take the aligned length and buffer pointer.
+        */
+       pkt_chain = PKTNEXT(osh, head_pkt) ? head_pkt : NULL;
+       ret = dhd_bcmsdh_send_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
+               PKTDATA(osh, head_pkt), total_len, pkt_chain, NULL, NULL, TXRETRIES);
+       if (ret == BCME_OK)
+               bus->tx_seq = (bus->tx_seq + num_pkt) % SDPCM_SEQUENCE_WRAP;
+
+       /* if a padding packet was needed, remove it from the link list as it not a data pkt */
+       if (pad_pkt_len && pkt)
+               PKTSETNEXT(osh, pkt, NULL);
+
+done:
+       pkt = head_pkt;
+       while (pkt) {
+               void *pkt_next = PKTNEXT(osh, pkt);
+               PKTSETNEXT(osh, pkt, NULL);
+               dhdsdio_txpkt_postprocess(bus, pkt);
+               pkt = pkt_next;
+       }
+
+       /* new packets might be allocated due to insufficient room for padding, but we
+        * still have to indicate the original packets to upper layer
+        */
+       for (i = 0; i < num_pkt; i++) {
+               pkt = pkts[i];
+               wlfc_enabled = FALSE;
+#ifdef PROP_TXSTATUS
+               if (DHD_PKTTAG_WLFCPKT(PKTTAG(pkt))) {
+                       wlfc_enabled = (dhd_wlfc_txcomplete(bus->dhd, pkt, ret == 0) !=
+                               WLFC_UNSUPPORTED);
+               }
+#endif /* PROP_TXSTATUS */
+               if (!wlfc_enabled) {
+                       PKTSETNEXT(osh, pkt, NULL);
+                       dhd_txcomplete(bus->dhd, pkt, ret != 0);
+                       if (free_pkt)
+                               PKTFREE(osh, pkt, TRUE);
+               }
+       }
+
+       for (i = 0; i < new_pkt_num; i++)
+               PKTFREE(osh, new_pkts[i], TRUE);
+
+       return ret;
+}
+
+static uint
+dhdsdio_sendfromq(dhd_bus_t *bus, uint maxframes)
+{
+       uint cnt = 0;
+       uint8 tx_prec_map;
+       uint16 txpktqlen = 0;
+       uint32 intstatus = 0;
+       uint retries = 0;
+       osl_t *osh;
+       uint datalen = 0;
+       dhd_pub_t *dhd = bus->dhd;
+       sdpcmd_regs_t *regs = bus->regs;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (!KSO_ENAB(bus)) {
+               DHD_ERROR(("%s: Device asleep\n", __FUNCTION__));
+               return BCME_NODEVICE;
+       }
+
+       osh = dhd->osh;
+       tx_prec_map = ~bus->flowcontrol;
+#ifdef DHD_LOSSLESS_ROAMING
+       tx_prec_map &= dhd->dequeue_prec_map;
+#endif
+       for (cnt = 0; (cnt < maxframes) && DATAOK(bus);) {
+               int i;
+               int num_pkt = 1;
+               void *pkts[MAX_TX_PKTCHAIN_CNT];
+               int prec_out;
+
+               dhd_os_sdlock_txq(bus->dhd);
+               if (bus->txglom_enable) {
+                       uint32 glomlimit = (uint32)bus->txglomsize;
+#if defined(BCMSDIOH_STD)
+                       if (bus->blocksize == 64) {
+                               glomlimit = MIN((uint32)bus->txglomsize, BLK_64_MAXTXGLOM);
+                       }
+#endif /* BCMSDIOH_STD */
+                       num_pkt = MIN((uint32)DATABUFCNT(bus), glomlimit);
+                       num_pkt = MIN(num_pkt, ARRAYSIZE(pkts));
+               }
+               num_pkt = MIN(num_pkt, pktq_mlen(&bus->txq, tx_prec_map));
+               for (i = 0; i < num_pkt; i++) {
+                       pkts[i] = pktq_mdeq(&bus->txq, tx_prec_map, &prec_out);
+                       if (!pkts[i]) {
+                               DHD_ERROR(("%s: pktq_mlen non-zero when no pkt\n",
+                                       __FUNCTION__));
+                               ASSERT(0);
+                               break;
+                       }
+                       PKTORPHAN(pkts[i]);
+                       datalen += PKTLEN(osh, pkts[i]);
+               }
+               dhd_os_sdunlock_txq(bus->dhd);
+
+               if (i == 0)
+                       break;
+               if (dhdsdio_txpkt(bus, SDPCM_DATA_CHANNEL, pkts, i, TRUE) != BCME_OK)
+                       dhd->tx_errors++;
+               else
+                       dhd->dstats.tx_bytes += datalen;
+               cnt += i;
+
+               /* In poll mode, need to check for other events */
+               if (!bus->intr && cnt)
+               {
+                       /* Check device status, signal pending interrupt */
+                       R_SDREG(intstatus, &regs->intstatus, retries);
+                       bus->f2txdata++;
+                       if (bcmsdh_regfail(bus->sdh))
+                               break;
+                       if (intstatus & bus->hostintmask)
+                               bus->ipend = TRUE;
+               }
+
+       }
+
+       dhd_os_sdlock_txq(bus->dhd);
+       txpktqlen = pktq_len(&bus->txq);
+       dhd_os_sdunlock_txq(bus->dhd);
+
+       /* Do flow-control if needed */
+       if (dhd->up && (dhd->busstate == DHD_BUS_DATA) && (txpktqlen < FCLOW)) {
+               bool wlfc_enabled = FALSE;
+#ifdef PROP_TXSTATUS
+               wlfc_enabled = (dhd_wlfc_flowcontrol(dhd, OFF, TRUE) != WLFC_UNSUPPORTED);
+#endif
+               if (!wlfc_enabled && dhd_doflow && dhd->txoff) {
+                       dhd_txflowcontrol(dhd, ALL_INTERFACES, OFF);
+               }
+       }
+
+       return cnt;
+}
+
+static void
+dhdsdio_sendpendctl(dhd_bus_t *bus)
+{
+       bcmsdh_info_t *sdh = bus->sdh;
+       int ret;
+       uint8* frame_seq = bus->ctrl_frame_buf + SDPCM_FRAMETAG_LEN;
+
+       if (bus->txglom_enable)
+               frame_seq += SDPCM_HWEXT_LEN;
+
+       if (*frame_seq != bus->tx_seq) {
+               DHD_INFO(("%s IOCTL frame seq lag detected!"
+                       " frm_seq:%d != bus->tx_seq:%d, corrected\n",
+                       __FUNCTION__, *frame_seq, bus->tx_seq));
+               *frame_seq = bus->tx_seq;
+       }
+
+       ret = dhd_bcmsdh_send_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
+               (uint8 *)bus->ctrl_frame_buf, (uint32)bus->ctrl_frame_len,
+               NULL, NULL, NULL, 1);
+       if (ret == BCME_OK)
+               bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
+
+       bus->ctrl_frame_stat = FALSE;
+       dhd_wait_event_wakeup(bus->dhd);
+}
+
+int
+dhd_bus_txctl(struct dhd_bus *bus, uchar *msg, uint msglen)
+{
+       static int err_nodevice = 0;
+       uint8 *frame;
+       uint16 len;
+       uint32 swheader;
+       bcmsdh_info_t *sdh = bus->sdh;
+       uint8 doff = 0;
+       int ret = -1;
+       uint8 sdpcm_hdrlen = bus->txglom_enable ? SDPCM_HDRLEN_TXGLOM : SDPCM_HDRLEN;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (bus->dhd->dongle_reset)
+               return -EIO;
+
+       /* Back the pointer to make a room for bus header */
+       frame = msg - sdpcm_hdrlen;
+       len = (msglen += sdpcm_hdrlen);
+
+       /* Add alignment padding (optional for ctl frames) */
+       if (dhd_alignctl) {
+               if ((doff = ((uintptr)frame % DHD_SDALIGN))) {
+                       frame -= doff;
+                       len += doff;
+                       msglen += doff;
+                       bzero(frame, doff + sdpcm_hdrlen);
+               }
+               ASSERT(doff < DHD_SDALIGN);
+       }
+       doff += sdpcm_hdrlen;
+
+       /* Round send length to next SDIO block */
+       if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
+               uint16 pad = bus->blocksize - (len % bus->blocksize);
+               if ((pad <= bus->roundup) && (pad < bus->blocksize))
+                       len += pad;
+       } else if (len % DHD_SDALIGN) {
+               len += DHD_SDALIGN - (len % DHD_SDALIGN);
+       }
+
+       /* Satisfy length-alignment requirements */
+       if (forcealign && (len & (ALIGNMENT - 1)))
+               len = ROUNDUP(len, ALIGNMENT);
+
+       ASSERT(ISALIGNED((uintptr)frame, 2));
+
+
+       /* Need to lock here to protect txseq and SDIO tx calls */
+       dhd_os_sdlock(bus->dhd);
+
+       BUS_WAKE(bus);
+
+       /* Make sure backplane clock is on */
+       dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+       /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
+       *(uint16*)frame = htol16((uint16)msglen);
+       *(((uint16*)frame) + 1) = htol16(~msglen);
+
+       if (bus->txglom_enable) {
+               uint32 hwheader1, hwheader2;
+               /* Software tag: channel, sequence number, data offset */
+               swheader = ((SDPCM_CONTROL_CHANNEL << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK)
+                               | bus->tx_seq
+                               | ((doff << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
+               htol32_ua_store(swheader, frame + SDPCM_FRAMETAG_LEN + SDPCM_HWEXT_LEN);
+               htol32_ua_store(0, frame + SDPCM_FRAMETAG_LEN
+                       + SDPCM_HWEXT_LEN + sizeof(swheader));
+
+               hwheader1 = (msglen - SDPCM_FRAMETAG_LEN) | (1 << 24);
+               hwheader2 = (len - (msglen)) << 16;
+               htol32_ua_store(hwheader1, frame + SDPCM_FRAMETAG_LEN);
+               htol32_ua_store(hwheader2, frame + SDPCM_FRAMETAG_LEN + 4);
+
+               *(uint16*)frame = htol16(len);
+               *(((uint16*)frame) + 1) = htol16(~(len));
+       } else {
+               /* Software tag: channel, sequence number, data offset */
+               swheader = ((SDPCM_CONTROL_CHANNEL << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK)
+                       | bus->tx_seq | ((doff << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
+               htol32_ua_store(swheader, frame + SDPCM_FRAMETAG_LEN);
+               htol32_ua_store(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
+       }
+       if (!TXCTLOK(bus)) {
+               DHD_INFO(("%s: No bus credit bus->tx_max %d, bus->tx_seq %d\n",
+                       __FUNCTION__, bus->tx_max, bus->tx_seq));
+               bus->ctrl_frame_stat = TRUE;
+               /* Send from dpc */
+               bus->ctrl_frame_buf = frame;
+               bus->ctrl_frame_len = len;
+
+               if (!bus->dpc_sched) {
+                       bus->dpc_sched = TRUE;
+                       dhd_sched_dpc(bus->dhd);
+               }
+               if (bus->ctrl_frame_stat) {
+                       dhd_wait_for_event(bus->dhd, &bus->ctrl_frame_stat);
+               }
+
+               if (bus->ctrl_frame_stat == FALSE) {
+                       DHD_INFO(("%s: ctrl_frame_stat == FALSE\n", __FUNCTION__));
+                       ret = 0;
+               } else {
+                       bus->dhd->txcnt_timeout++;
+                       if (!bus->dhd->hang_was_sent) {
+#ifdef CUSTOMER_HW4_DEBUG
+                               uint32 status, retry = 0;
+                               R_SDREG(status, &bus->regs->intstatus, retry);
+                               DHD_TRACE_HW4(("%s: txcnt_timeout, INT status=0x%08X\n",
+                                       __FUNCTION__, status));
+                               DHD_TRACE_HW4(("%s : tx_max : %d, tx_seq : %d, clkstate : %d \n",
+                                       __FUNCTION__, bus->tx_max, bus->tx_seq, bus->clkstate));
+#endif /* CUSTOMER_HW4_DEBUG */
+                               DHD_ERROR(("%s: ctrl_frame_stat == TRUE txcnt_timeout=%d\n",
+                                       __FUNCTION__, bus->dhd->txcnt_timeout));
+                       }
+                       ret = -1;
+                       bus->ctrl_frame_stat = FALSE;
+                       goto done;
+               }
+       }
+
+       bus->dhd->txcnt_timeout = 0;
+       bus->ctrl_frame_stat = TRUE;
+
+       if (ret == -1) {
+#ifdef DHD_DEBUG
+               if (DHD_BYTES_ON() && DHD_CTL_ON()) {
+                       prhex("Tx Frame", frame, len);
+               } else if (DHD_HDRS_ON()) {
+                       prhex("TxHdr", frame, MIN(len, 16));
+               }
+#endif
+               ret = dhd_bcmsdh_send_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
+                                         frame, len, NULL, NULL, NULL, TXRETRIES);
+               if (ret == BCME_OK)
+                       bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
+       }
+       bus->ctrl_frame_stat = FALSE;
+
+done:
+       if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
+               bus->activity = FALSE;
+               dhdsdio_clkctl(bus, CLK_NONE, TRUE);
+       }
+
+       dhd_os_sdunlock(bus->dhd);
+
+       if (ret)
+               bus->dhd->tx_ctlerrs++;
+       else
+               bus->dhd->tx_ctlpkts++;
+
+       if (bus->dhd->txcnt_timeout >= MAX_CNTL_TX_TIMEOUT)
+               return -ETIMEDOUT;
+
+       if (ret == BCME_NODEVICE)
+               err_nodevice++;
+       else
+               err_nodevice = 0;
+
+       return ret ? err_nodevice >= ERROR_BCME_NODEVICE_MAX ? -ETIMEDOUT : -EIO : 0;
+}
+
+int
+dhd_bus_rxctl(struct dhd_bus *bus, uchar *msg, uint msglen)
+{
+       int timeleft;
+       uint rxlen = 0;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (bus->dhd->dongle_reset)
+               return -EIO;
+
+       /* Wait until control frame is available */
+       timeleft = dhd_os_ioctl_resp_wait(bus->dhd, &bus->rxlen);
+
+       dhd_os_sdlock(bus->dhd);
+       rxlen = bus->rxlen;
+       bcopy(bus->rxctl, msg, MIN(msglen, rxlen));
+       bus->rxlen = 0;
+       dhd_os_sdunlock(bus->dhd);
+
+       if (rxlen) {
+               DHD_CTL(("%s: resumed on rxctl frame, got %d expected %d\n",
+                       __FUNCTION__, rxlen, msglen));
+       } else if (timeleft == 0) {
+#ifdef DHD_DEBUG
+               uint32 status, retry = 0;
+               R_SDREG(status, &bus->regs->intstatus, retry);
+               DHD_ERROR(("%s: resumed on timeout, INT status=0x%08X\n",
+                       __FUNCTION__, status));
+#else
+               DHD_ERROR(("%s: resumed on timeout\n", __FUNCTION__));
+#endif /* DHD_DEBUG */
+               dhd_os_sdlock(bus->dhd);
+               dhdsdio_checkdied(bus, NULL, 0);
+               dhd_os_sdunlock(bus->dhd);
+       } else {
+               DHD_CTL(("%s: resumed for unknown reason?\n", __FUNCTION__));
+               dhd_os_sdlock(bus->dhd);
+               dhdsdio_checkdied(bus, NULL, 0);
+               dhd_os_sdunlock(bus->dhd);
+       }
+       if (timeleft == 0) {
+               if (rxlen == 0)
+                       bus->dhd->rxcnt_timeout++;
+               DHD_ERROR(("%s: rxcnt_timeout=%d, rxlen=%d\n", __FUNCTION__,
+                       bus->dhd->rxcnt_timeout, rxlen));
+       }
+       else
+               bus->dhd->rxcnt_timeout = 0;
+
+       if (rxlen)
+               bus->dhd->rx_ctlpkts++;
+       else
+               bus->dhd->rx_ctlerrs++;
+
+       if (bus->dhd->rxcnt_timeout >= MAX_CNTL_RX_TIMEOUT)
+               return -ETIMEDOUT;
+
+       if (bus->dhd->dongle_trap_occured)
+               return -EREMOTEIO;
+
+       return rxlen ? (int)rxlen : -EIO;
+}
+
+/* IOVar table */
+enum {
+       IOV_INTR = 1,
+       IOV_POLLRATE,
+       IOV_SDREG,
+       IOV_SBREG,
+       IOV_SDCIS,
+       IOV_MEMBYTES,
+       IOV_RAMSIZE,
+       IOV_RAMSTART,
+#ifdef DHD_DEBUG
+       IOV_CHECKDIED,
+       IOV_SERIALCONS,
+#endif /* DHD_DEBUG */
+       IOV_SET_DOWNLOAD_STATE,
+       IOV_SOCRAM_STATE,
+       IOV_FORCEEVEN,
+       IOV_SDIOD_DRIVE,
+       IOV_READAHEAD,
+       IOV_SDRXCHAIN,
+       IOV_ALIGNCTL,
+       IOV_SDALIGN,
+       IOV_DEVRESET,
+       IOV_CPU,
+#if defined(USE_SDIOFIFO_IOVAR)
+       IOV_WATERMARK,
+       IOV_MESBUSYCTRL,
+#endif /* USE_SDIOFIFO_IOVAR */
+#ifdef SDTEST
+       IOV_PKTGEN,
+       IOV_EXTLOOP,
+#endif /* SDTEST */
+       IOV_SPROM,
+       IOV_TXBOUND,
+       IOV_RXBOUND,
+       IOV_TXMINMAX,
+       IOV_IDLETIME,
+       IOV_IDLECLOCK,
+       IOV_SD1IDLE,
+       IOV_SLEEP,
+       IOV_DONGLEISOLATION,
+       IOV_KSO,
+       IOV_DEVSLEEP,
+       IOV_DEVCAP,
+       IOV_VARS,
+#ifdef SOFTAP
+       IOV_FWPATH,
+#endif
+       IOV_TXGLOMSIZE,
+       IOV_TXGLOMMODE,
+       IOV_HANGREPORT,
+       IOV_TXINRX_THRES
+};
+
+const bcm_iovar_t dhdsdio_iovars[] = {
+       {"intr",        IOV_INTR,       0,      IOVT_BOOL,      0 },
+       {"sleep",       IOV_SLEEP,      0,      IOVT_BOOL,      0 },
+       {"pollrate",    IOV_POLLRATE,   0,      IOVT_UINT32,    0 },
+       {"idletime",    IOV_IDLETIME,   0,      IOVT_INT32,     0 },
+       {"idleclock",   IOV_IDLECLOCK,  0,      IOVT_INT32,     0 },
+       {"sd1idle",     IOV_SD1IDLE,    0,      IOVT_BOOL,      0 },
+       {"membytes",    IOV_MEMBYTES,   0,      IOVT_BUFFER,    2 * sizeof(int) },
+       {"ramsize",     IOV_RAMSIZE,    0,      IOVT_UINT32,    0 },
+       {"ramstart",    IOV_RAMSTART,   0,      IOVT_UINT32,    0 },
+       {"dwnldstate",  IOV_SET_DOWNLOAD_STATE, 0,      IOVT_BOOL,      0 },
+       {"socram_state",        IOV_SOCRAM_STATE,       0,      IOVT_BOOL,      0 },
+       {"vars",        IOV_VARS,       0,      IOVT_BUFFER,    0 },
+       {"sdiod_drive", IOV_SDIOD_DRIVE, 0,     IOVT_UINT32,    0 },
+       {"readahead",   IOV_READAHEAD,  0,      IOVT_BOOL,      0 },
+       {"sdrxchain",   IOV_SDRXCHAIN,  0,      IOVT_BOOL,      0 },
+       {"alignctl",    IOV_ALIGNCTL,   0,      IOVT_BOOL,      0 },
+       {"sdalign",     IOV_SDALIGN,    0,      IOVT_BOOL,      0 },
+       {"devreset",    IOV_DEVRESET,   0,      IOVT_BOOL,      0 },
+#ifdef DHD_DEBUG
+       {"sdreg",       IOV_SDREG,      0,      IOVT_BUFFER,    sizeof(sdreg_t) },
+       {"sbreg",       IOV_SBREG,      0,      IOVT_BUFFER,    sizeof(sdreg_t) },
+       {"sd_cis",      IOV_SDCIS,      0,      IOVT_BUFFER,    DHD_IOCTL_MAXLEN },
+       {"forcealign",  IOV_FORCEEVEN,  0,      IOVT_BOOL,      0 },
+       {"txbound",     IOV_TXBOUND,    0,      IOVT_UINT32,    0 },
+       {"rxbound",     IOV_RXBOUND,    0,      IOVT_UINT32,    0 },
+       {"txminmax",    IOV_TXMINMAX,   0,      IOVT_UINT32,    0 },
+       {"cpu",         IOV_CPU,        0,      IOVT_BOOL,      0 },
+#ifdef DHD_DEBUG
+       {"checkdied",   IOV_CHECKDIED,  0,      IOVT_BUFFER,    0 },
+       {"serial",      IOV_SERIALCONS, 0,      IOVT_UINT32,    0 },
+#endif /* DHD_DEBUG  */
+#endif /* DHD_DEBUG */
+#ifdef SDTEST
+       {"extloop",     IOV_EXTLOOP,    0,      IOVT_BOOL,      0 },
+       {"pktgen",      IOV_PKTGEN,     0,      IOVT_BUFFER,    sizeof(dhd_pktgen_t) },
+#endif /* SDTEST */
+#if defined(USE_SDIOFIFO_IOVAR)
+       {"watermark",   IOV_WATERMARK,  0,      IOVT_UINT32,    0 },
+       {"mesbusyctrl", IOV_MESBUSYCTRL,        0,      IOVT_UINT32,    0 },
+#endif /* USE_SDIOFIFO_IOVAR */
+       {"devcap", IOV_DEVCAP,  0,      IOVT_UINT32,    0 },
+       {"dngl_isolation", IOV_DONGLEISOLATION, 0,      IOVT_UINT32,    0 },
+       {"kso", IOV_KSO,        0,      IOVT_UINT32,    0 },
+       {"devsleep", IOV_DEVSLEEP,      0,      IOVT_UINT32,    0 },
+#ifdef SOFTAP
+       {"fwpath", IOV_FWPATH, 0, IOVT_BUFFER, 0 },
+#endif
+       {"txglomsize", IOV_TXGLOMSIZE, 0, IOVT_UINT32, 0 },
+       {"fw_hang_report", IOV_HANGREPORT, 0, IOVT_BOOL, 0 },
+       {"txinrx_thres", IOV_TXINRX_THRES, 0, IOVT_INT32, 0 },
+       {NULL, 0, 0, 0, 0 }
+};
+
+static void
+dhd_dump_pct(struct bcmstrbuf *strbuf, char *desc, uint num, uint div)
+{
+       uint q1, q2;
+
+       if (!div) {
+               bcm_bprintf(strbuf, "%s N/A", desc);
+       } else {
+               q1 = num / div;
+               q2 = (100 * (num - (q1 * div))) / div;
+               bcm_bprintf(strbuf, "%s %d.%02d", desc, q1, q2);
+       }
+}
+
+void
+dhd_bus_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf)
+{
+       dhd_bus_t *bus = dhdp->bus;
+
+       bcm_bprintf(strbuf, "Bus SDIO structure:\n");
+       bcm_bprintf(strbuf, "hostintmask 0x%08x intstatus 0x%08x sdpcm_ver %d\n",
+                   bus->hostintmask, bus->intstatus, bus->sdpcm_ver);
+       bcm_bprintf(strbuf, "fcstate %d qlen %u tx_seq %d, max %d, rxskip %d rxlen %u rx_seq %d\n",
+                   bus->fcstate, pktq_len(&bus->txq), bus->tx_seq, bus->tx_max, bus->rxskip,
+                   bus->rxlen, bus->rx_seq);
+       bcm_bprintf(strbuf, "intr %d intrcount %u lastintrs %u spurious %u\n",
+                   bus->intr, bus->intrcount, bus->lastintrs, bus->spurious);
+       bcm_bprintf(strbuf, "pollrate %u pollcnt %u regfails %u\n",
+                   bus->pollrate, bus->pollcnt, bus->regfails);
+
+       bcm_bprintf(strbuf, "\nAdditional counters:\n");
+#ifdef DHDENABLE_TAILPAD
+       bcm_bprintf(strbuf, "tx_tailpad_chain %u tx_tailpad_pktget %u\n",
+                   bus->tx_tailpad_chain, bus->tx_tailpad_pktget);
+#endif /* DHDENABLE_TAILPAD */
+       bcm_bprintf(strbuf, "tx_sderrs %u fcqueued %u rxrtx %u rx_toolong %u rxc_errors %u\n",
+                   bus->tx_sderrs, bus->fcqueued, bus->rxrtx, bus->rx_toolong,
+                   bus->rxc_errors);
+       bcm_bprintf(strbuf, "rx_hdrfail %u badhdr %u badseq %u\n",
+                   bus->rx_hdrfail, bus->rx_badhdr, bus->rx_badseq);
+       bcm_bprintf(strbuf, "fc_rcvd %u, fc_xoff %u, fc_xon %u\n",
+                   bus->fc_rcvd, bus->fc_xoff, bus->fc_xon);
+       bcm_bprintf(strbuf, "rxglomfail %u, rxglomframes %u, rxglompkts %u\n",
+                   bus->rxglomfail, bus->rxglomframes, bus->rxglompkts);
+       bcm_bprintf(strbuf, "f2rx (hdrs/data) %u (%u/%u), f2tx %u f1regs %u\n",
+                   (bus->f2rxhdrs + bus->f2rxdata), bus->f2rxhdrs, bus->f2rxdata,
+                   bus->f2txdata, bus->f1regdata);
+       {
+               dhd_dump_pct(strbuf, "\nRx: pkts/f2rd", bus->dhd->rx_packets,
+                            (bus->f2rxhdrs + bus->f2rxdata));
+               dhd_dump_pct(strbuf, ", pkts/f1sd", bus->dhd->rx_packets, bus->f1regdata);
+               dhd_dump_pct(strbuf, ", pkts/sd", bus->dhd->rx_packets,
+                            (bus->f2rxhdrs + bus->f2rxdata + bus->f1regdata));
+               dhd_dump_pct(strbuf, ", pkts/int", bus->dhd->rx_packets, bus->intrcount);
+               bcm_bprintf(strbuf, "\n");
+
+               dhd_dump_pct(strbuf, "Rx: glom pct", (100 * bus->rxglompkts),
+                            bus->dhd->rx_packets);
+               dhd_dump_pct(strbuf, ", pkts/glom", bus->rxglompkts, bus->rxglomframes);
+               bcm_bprintf(strbuf, "\n");
+
+               dhd_dump_pct(strbuf, "Tx: pkts/f2wr", bus->dhd->tx_packets, bus->f2txdata);
+               dhd_dump_pct(strbuf, ", pkts/f1sd", bus->dhd->tx_packets, bus->f1regdata);
+               dhd_dump_pct(strbuf, ", pkts/sd", bus->dhd->tx_packets,
+                            (bus->f2txdata + bus->f1regdata));
+               dhd_dump_pct(strbuf, ", pkts/int", bus->dhd->tx_packets, bus->intrcount);
+               bcm_bprintf(strbuf, "\n");
+
+               dhd_dump_pct(strbuf, "Total: pkts/f2rw",
+                            (bus->dhd->tx_packets + bus->dhd->rx_packets),
+                            (bus->f2txdata + bus->f2rxhdrs + bus->f2rxdata));
+               dhd_dump_pct(strbuf, ", pkts/f1sd",
+                            (bus->dhd->tx_packets + bus->dhd->rx_packets), bus->f1regdata);
+               dhd_dump_pct(strbuf, ", pkts/sd",
+                            (bus->dhd->tx_packets + bus->dhd->rx_packets),
+                            (bus->f2txdata + bus->f2rxhdrs + bus->f2rxdata + bus->f1regdata));
+               dhd_dump_pct(strbuf, ", pkts/int",
+                            (bus->dhd->tx_packets + bus->dhd->rx_packets), bus->intrcount);
+               bcm_bprintf(strbuf, "\n\n");
+       }
+
+#ifdef SDTEST
+       if (bus->pktgen_count) {
+               bcm_bprintf(strbuf, "pktgen config and count:\n");
+               bcm_bprintf(strbuf, "freq %u count %u print %u total %u min %u len %u\n",
+                           bus->pktgen_freq, bus->pktgen_count, bus->pktgen_print,
+                           bus->pktgen_total, bus->pktgen_minlen, bus->pktgen_maxlen);
+               bcm_bprintf(strbuf, "send attempts %u rcvd %u fail %u\n",
+                           bus->pktgen_sent, bus->pktgen_rcvd, bus->pktgen_fail);
+       }
+#endif /* SDTEST */
+#ifdef DHD_DEBUG
+       bcm_bprintf(strbuf, "dpc_sched %d host interrupt%spending\n",
+                   bus->dpc_sched, (bcmsdh_intr_pending(bus->sdh) ? " " : " not "));
+       bcm_bprintf(strbuf, "blocksize %u roundup %u\n", bus->blocksize, bus->roundup);
+#endif /* DHD_DEBUG */
+       bcm_bprintf(strbuf, "clkstate %d activity %d idletime %d idlecount %d sleeping %d\n",
+                   bus->clkstate, bus->activity, bus->idletime, bus->idlecount, bus->sleeping);
+}
+
+void
+dhd_bus_clearcounts(dhd_pub_t *dhdp)
+{
+       dhd_bus_t *bus = (dhd_bus_t *)dhdp->bus;
+
+       bus->intrcount = bus->lastintrs = bus->spurious = bus->regfails = 0;
+       bus->rxrtx = bus->rx_toolong = bus->rxc_errors = 0;
+       bus->rx_hdrfail = bus->rx_badhdr = bus->rx_badseq = 0;
+#ifdef DHDENABLE_TAILPAD
+       bus->tx_tailpad_chain = bus->tx_tailpad_pktget = 0;
+#endif /* DHDENABLE_TAILPAD */
+       bus->tx_sderrs = bus->fc_rcvd = bus->fc_xoff = bus->fc_xon = 0;
+       bus->rxglomfail = bus->rxglomframes = bus->rxglompkts = 0;
+       bus->f2rxhdrs = bus->f2rxdata = bus->f2txdata = bus->f1regdata = 0;
+}
+
+#ifdef SDTEST
+static int
+dhdsdio_pktgen_get(dhd_bus_t *bus, uint8 *arg)
+{
+       dhd_pktgen_t pktgen;
+
+       pktgen.version = DHD_PKTGEN_VERSION;
+       pktgen.freq = bus->pktgen_freq;
+       pktgen.count = bus->pktgen_count;
+       pktgen.print = bus->pktgen_print;
+       pktgen.total = bus->pktgen_total;
+       pktgen.minlen = bus->pktgen_minlen;
+       pktgen.maxlen = bus->pktgen_maxlen;
+       pktgen.numsent = bus->pktgen_sent;
+       pktgen.numrcvd = bus->pktgen_rcvd;
+       pktgen.numfail = bus->pktgen_fail;
+       pktgen.mode = bus->pktgen_mode;
+       pktgen.stop = bus->pktgen_stop;
+
+       bcopy(&pktgen, arg, sizeof(pktgen));
+
+       return 0;
+}
+
+static int
+dhdsdio_pktgen_set(dhd_bus_t *bus, uint8 *arg)
+{
+       dhd_pktgen_t pktgen;
+       uint oldcnt, oldmode;
+
+       bcopy(arg, &pktgen, sizeof(pktgen));
+       if (pktgen.version != DHD_PKTGEN_VERSION)
+               return BCME_BADARG;
+
+       oldcnt = bus->pktgen_count;
+       oldmode = bus->pktgen_mode;
+
+       bus->pktgen_freq = pktgen.freq;
+       bus->pktgen_count = pktgen.count;
+       bus->pktgen_print = pktgen.print;
+       bus->pktgen_total = pktgen.total;
+       bus->pktgen_minlen = pktgen.minlen;
+       bus->pktgen_maxlen = pktgen.maxlen;
+       bus->pktgen_mode = pktgen.mode;
+       bus->pktgen_stop = pktgen.stop;
+
+       bus->pktgen_tick = bus->pktgen_ptick = 0;
+       bus->pktgen_prev_time = jiffies;
+       bus->pktgen_len = MAX(bus->pktgen_len, bus->pktgen_minlen);
+       bus->pktgen_len = MIN(bus->pktgen_len, bus->pktgen_maxlen);
+
+       /* Clear counts for a new pktgen (mode change, or was stopped) */
+       if (bus->pktgen_count && (!oldcnt || oldmode != bus->pktgen_mode)) {
+               bus->pktgen_sent = bus->pktgen_prev_sent = bus->pktgen_rcvd = 0;
+               bus->pktgen_prev_rcvd = bus->pktgen_fail = 0;
+       }
+
+       return 0;
+}
+#endif /* SDTEST */
+
+static void
+dhdsdio_devram_remap(dhd_bus_t *bus, bool val)
+{
+       uint8 enable, protect, remap;
+
+       si_socdevram(bus->sih, FALSE, &enable, &protect, &remap);
+       remap = val ? TRUE : FALSE;
+       si_socdevram(bus->sih, TRUE, &enable, &protect, &remap);
+}
+
+static int
+dhdsdio_membytes(dhd_bus_t *bus, bool write, uint32 address, uint8 *data, uint size)
+{
+       int bcmerror = 0;
+       uint32 sdaddr;
+       uint dsize;
+
+       /* In remap mode, adjust address beyond socram and redirect
+        * to devram at SOCDEVRAM_BP_ADDR since remap address > orig_ramsize
+        * is not backplane accessible
+        */
+       if (REMAP_ENAB(bus) && REMAP_ISADDR(bus, address)) {
+               address -= bus->orig_ramsize;
+               address += SOCDEVRAM_BP_ADDR;
+       }
+
+       /* Determine initial transfer parameters */
+       sdaddr = address & SBSDIO_SB_OFT_ADDR_MASK;
+       if ((sdaddr + size) & SBSDIO_SBWINDOW_MASK)
+               dsize = (SBSDIO_SB_OFT_ADDR_LIMIT - sdaddr);
+       else
+               dsize = size;
+
+       /* Set the backplane window to include the start address */
+       if ((bcmerror = dhdsdio_set_siaddr_window(bus, address))) {
+               DHD_ERROR(("%s: window change failed\n", __FUNCTION__));
+               goto xfer_done;
+       }
+
+       /* Do the transfer(s) */
+       while (size) {
+               DHD_INFO(("%s: %s %d bytes at offset 0x%08x in window 0x%08x\n",
+                         __FUNCTION__, (write ? "write" : "read"), dsize, sdaddr,
+                         (address & SBSDIO_SBWINDOW_MASK)));
+               if ((bcmerror = bcmsdh_rwdata(bus->sdh, write, sdaddr, data, dsize))) {
+                       DHD_ERROR(("%s: membytes transfer failed\n", __FUNCTION__));
+                       break;
+               }
+
+               /* Adjust for next transfer (if any) */
+               if ((size -= dsize)) {
+                       data += dsize;
+                       address += dsize;
+                       if ((bcmerror = dhdsdio_set_siaddr_window(bus, address))) {
+                               DHD_ERROR(("%s: window change failed\n", __FUNCTION__));
+                               break;
+                       }
+                       sdaddr = 0;
+                       dsize = MIN(SBSDIO_SB_OFT_ADDR_LIMIT, size);
+               }
+
+       }
+
+xfer_done:
+       /* Return the window to backplane enumeration space for core access */
+       if (dhdsdio_set_siaddr_window(bus, bcmsdh_cur_sbwad(bus->sdh))) {
+               DHD_ERROR(("%s: FAILED to set window back to 0x%x\n", __FUNCTION__,
+                       bcmsdh_cur_sbwad(bus->sdh)));
+       }
+
+       return bcmerror;
+}
+
+static int
+dhdsdio_readshared(dhd_bus_t *bus, sdpcm_shared_t *sh)
+{
+       uint32 addr;
+       int rv, i;
+       uint32 shaddr = 0;
+
+       if (bus->sih == NULL) {
+               if (bus->dhd && bus->dhd->dongle_reset) {
+                       DHD_ERROR(("%s: Dongle is in reset state\n", __FUNCTION__));
+                       return BCME_NOTREADY;
+               } else {
+                       ASSERT(bus->dhd);
+                       ASSERT(bus->sih);
+                       DHD_ERROR(("%s: The address of sih is invalid\n", __FUNCTION__));
+                       return BCME_ERROR;
+               }
+       }
+       if (CHIPID(bus->sih->chip) == BCM43430_CHIP_ID && !dhdsdio_sr_cap(bus))
+               bus->srmemsize = 0;
+
+       shaddr = bus->dongle_ram_base + bus->ramsize - 4;
+       i = 0;
+       do {
+               /* Read last word in memory to determine address of sdpcm_shared structure */
+               if ((rv = dhdsdio_membytes(bus, FALSE, shaddr, (uint8 *)&addr, 4)) < 0)
+                       return rv;
+
+               addr = ltoh32(addr);
+
+               DHD_INFO(("sdpcm_shared address 0x%08X\n", addr));
+
+               /*
+                * Check if addr is valid.
+                * NVRAM length at the end of memory should have been overwritten.
+                */
+               if (addr == 0 || ((~addr >> 16) & 0xffff) == (addr & 0xffff)) {
+                       if ((bus->srmemsize > 0) && (i++ == 0)) {
+                               shaddr -= bus->srmemsize;
+                       } else {
+                               DHD_ERROR(("%s: address (0x%08x) of sdpcm_shared invalid\n",
+                                       __FUNCTION__, addr));
+                               return BCME_ERROR;
+                       }
+               } else
+                       break;
+       } while (i < 2);
+
+       /* Read hndrte_shared structure */
+       if ((rv = dhdsdio_membytes(bus, FALSE, addr, (uint8 *)sh, sizeof(sdpcm_shared_t))) < 0)
+               return rv;
+
+       /* Endianness */
+       sh->flags = ltoh32(sh->flags);
+       sh->trap_addr = ltoh32(sh->trap_addr);
+       sh->assert_exp_addr = ltoh32(sh->assert_exp_addr);
+       sh->assert_file_addr = ltoh32(sh->assert_file_addr);
+       sh->assert_line = ltoh32(sh->assert_line);
+       sh->console_addr = ltoh32(sh->console_addr);
+       sh->msgtrace_addr = ltoh32(sh->msgtrace_addr);
+
+       if ((sh->flags & SDPCM_SHARED_VERSION_MASK) == 3 && SDPCM_SHARED_VERSION == 1)
+               return BCME_OK;
+
+       if ((sh->flags & SDPCM_SHARED_VERSION_MASK) != SDPCM_SHARED_VERSION) {
+               DHD_ERROR(("%s: sdpcm_shared version %d in dhd "
+                          "is different than sdpcm_shared version %d in dongle\n",
+                          __FUNCTION__, SDPCM_SHARED_VERSION,
+                          sh->flags & SDPCM_SHARED_VERSION_MASK));
+               return BCME_ERROR;
+       }
+
+       return BCME_OK;
+}
+
+#define CONSOLE_LINE_MAX       192
+
+#ifdef DHD_DEBUG
+static int
+dhdsdio_readconsole(dhd_bus_t *bus)
+{
+       dhd_console_t *c = &bus->console;
+       uint8 line[CONSOLE_LINE_MAX], ch;
+       uint32 n, idx, addr;
+       int rv;
+
+       /* Don't do anything until FWREADY updates console address */
+       if (bus->console_addr == 0)
+               return 0;
+
+       if (!KSO_ENAB(bus))
+               return 0;
+
+       /* Read console log struct */
+       addr = bus->console_addr + OFFSETOF(hnd_cons_t, log);
+       if ((rv = dhdsdio_membytes(bus, FALSE, addr, (uint8 *)&c->log, sizeof(c->log))) < 0)
+               return rv;
+
+       /* Allocate console buffer (one time only) */
+       if (c->buf == NULL) {
+               c->bufsize = ltoh32(c->log.buf_size);
+               if ((c->buf = MALLOC(bus->dhd->osh, c->bufsize)) == NULL)
+                       return BCME_NOMEM;
+       }
+
+       idx = ltoh32(c->log.idx);
+
+       /* Protect against corrupt value */
+       if (idx > c->bufsize)
+               return BCME_ERROR;
+
+       /* Skip reading the console buffer if the index pointer has not moved */
+       if (idx == c->last)
+               return BCME_OK;
+
+       /* Read the console buffer */
+       addr = ltoh32(c->log.buf);
+       if ((rv = dhdsdio_membytes(bus, FALSE, addr, c->buf, c->bufsize)) < 0)
+               return rv;
+
+       while (c->last != idx) {
+               for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
+                       if (c->last == idx) {
+                               /* This would output a partial line.  Instead, back up
+                                * the buffer pointer and output this line next time around.
+                                */
+                               if (c->last >= n)
+                                       c->last -= n;
+                               else
+                                       c->last = c->bufsize - n;
+                               goto break2;
+                       }
+                       ch = c->buf[c->last];
+                       c->last = (c->last + 1) % c->bufsize;
+                       if (ch == '\n')
+                               break;
+                       line[n] = ch;
+               }
+
+               if (n > 0) {
+                       if (line[n - 1] == '\r')
+                               n--;
+                       line[n] = 0;
+                       printf("CONSOLE: %s\n", line);
+#ifdef LOG_INTO_TCPDUMP
+                       dhd_sendup_log(bus->dhd, line, n);
+#endif /* LOG_INTO_TCPDUMP */
+               }
+       }
+break2:
+
+       return BCME_OK;
+}
+#endif /* DHD_DEBUG */
+
+static int
+dhdsdio_checkdied(dhd_bus_t *bus, char *data, uint size)
+{
+       int bcmerror = 0;
+       uint msize = 512;
+       char *mbuffer = NULL;
+       char *console_buffer = NULL;
+       uint maxstrlen = 256;
+       char *str = NULL;
+       trap_t tr;
+       sdpcm_shared_t sdpcm_shared;
+       struct bcmstrbuf strbuf;
+       uint32 console_ptr, console_size, console_index;
+       uint8 line[CONSOLE_LINE_MAX], ch;
+       uint32 n, i, addr;
+       int rv;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (DHD_NOCHECKDIED_ON())
+               return 0;
+
+       if (data == NULL) {
+               /*
+                * Called after a rx ctrl timeout. "data" is NULL.
+                * allocate memory to trace the trap or assert.
+                */
+               size = msize;
+               mbuffer = data = MALLOC(bus->dhd->osh, msize);
+               if (mbuffer == NULL) {
+                       DHD_ERROR(("%s: MALLOC(%d) failed \n", __FUNCTION__, msize));
+                       bcmerror = BCME_NOMEM;
+                       goto done;
+               }
+       }
+
+       if ((str = MALLOC(bus->dhd->osh, maxstrlen)) == NULL) {
+               DHD_ERROR(("%s: MALLOC(%d) failed \n", __FUNCTION__, maxstrlen));
+               bcmerror = BCME_NOMEM;
+               goto done;
+       }
+
+       if ((bcmerror = dhdsdio_readshared(bus, &sdpcm_shared)) < 0)
+               goto done;
+
+       bcm_binit(&strbuf, data, size);
+
+       bcm_bprintf(&strbuf, "msgtrace address : 0x%08X\nconsole address  : 0x%08X\n",
+                   sdpcm_shared.msgtrace_addr, sdpcm_shared.console_addr);
+
+       if ((sdpcm_shared.flags & SDPCM_SHARED_ASSERT_BUILT) == 0) {
+               /* NOTE: Misspelled assert is intentional - DO NOT FIX.
+                * (Avoids conflict with real asserts for programmatic parsing of output.)
+                */
+               bcm_bprintf(&strbuf, "Assrt not built in dongle\n");
+       }
+
+       if ((sdpcm_shared.flags & (SDPCM_SHARED_ASSERT|SDPCM_SHARED_TRAP)) == 0) {
+               /* NOTE: Misspelled assert is intentional - DO NOT FIX.
+                * (Avoids conflict with real asserts for programmatic parsing of output.)
+                */
+               bcm_bprintf(&strbuf, "No trap%s in dongle",
+                         (sdpcm_shared.flags & SDPCM_SHARED_ASSERT_BUILT)
+                         ?"/assrt" :"");
+       } else {
+               if (sdpcm_shared.flags & SDPCM_SHARED_ASSERT) {
+                       /* Download assert */
+                       bcm_bprintf(&strbuf, "Dongle assert");
+                       if (sdpcm_shared.assert_exp_addr != 0) {
+                               str[0] = '\0';
+                               if ((bcmerror = dhdsdio_membytes(bus, FALSE,
+                                                                sdpcm_shared.assert_exp_addr,
+                                                                (uint8 *)str, maxstrlen)) < 0)
+                                       goto done;
+
+                               str[maxstrlen - 1] = '\0';
+                               bcm_bprintf(&strbuf, " expr \"%s\"", str);
+                       }
+
+                       if (sdpcm_shared.assert_file_addr != 0) {
+                               str[0] = '\0';
+                               if ((bcmerror = dhdsdio_membytes(bus, FALSE,
+                                                                sdpcm_shared.assert_file_addr,
+                                                                (uint8 *)str, maxstrlen)) < 0)
+                                       goto done;
+
+                               str[maxstrlen - 1] = '\0';
+                               bcm_bprintf(&strbuf, " file \"%s\"", str);
+                       }
+
+                       bcm_bprintf(&strbuf, " line %d ", sdpcm_shared.assert_line);
+               }
+
+               if (sdpcm_shared.flags & SDPCM_SHARED_TRAP) {
+                       bus->dhd->dongle_trap_occured = TRUE;
+                       if ((bcmerror = dhdsdio_membytes(bus, FALSE,
+                                                        sdpcm_shared.trap_addr,
+                                                        (uint8*)&tr, sizeof(trap_t))) < 0)
+                               goto done;
+
+                       bcm_bprintf(&strbuf,
+                       "Dongle trap type 0x%x @ epc 0x%x, cpsr 0x%x, spsr 0x%x, sp 0x%x,"
+                                   "lp 0x%x, rpc 0x%x Trap offset 0x%x, "
+                       "r0 0x%x, r1 0x%x, r2 0x%x, r3 0x%x, "
+                       "r4 0x%x, r5 0x%x, r6 0x%x, r7 0x%x\n\n",
+                       ltoh32(tr.type), ltoh32(tr.epc), ltoh32(tr.cpsr), ltoh32(tr.spsr),
+                       ltoh32(tr.r13), ltoh32(tr.r14), ltoh32(tr.pc),
+                       ltoh32(sdpcm_shared.trap_addr),
+                       ltoh32(tr.r0), ltoh32(tr.r1), ltoh32(tr.r2), ltoh32(tr.r3),
+                       ltoh32(tr.r4), ltoh32(tr.r5), ltoh32(tr.r6), ltoh32(tr.r7));
+
+                       addr = sdpcm_shared.console_addr + OFFSETOF(hnd_cons_t, log);
+                       if ((rv = dhdsdio_membytes(bus, FALSE, addr,
+                               (uint8 *)&console_ptr, sizeof(console_ptr))) < 0)
+                               goto printbuf;
+
+                       addr = sdpcm_shared.console_addr + OFFSETOF(hnd_cons_t, log.buf_size);
+                       if ((rv = dhdsdio_membytes(bus, FALSE, addr,
+                               (uint8 *)&console_size, sizeof(console_size))) < 0)
+                               goto printbuf;
+
+                       addr = sdpcm_shared.console_addr + OFFSETOF(hnd_cons_t, log.idx);
+                       if ((rv = dhdsdio_membytes(bus, FALSE, addr,
+                               (uint8 *)&console_index, sizeof(console_index))) < 0)
+                               goto printbuf;
+
+                       console_ptr = ltoh32(console_ptr);
+                       console_size = ltoh32(console_size);
+                       console_index = ltoh32(console_index);
+
+                       if (console_size > CONSOLE_BUFFER_MAX ||
+                               !(console_buffer = MALLOC(bus->dhd->osh, console_size)))
+                               goto printbuf;
+
+                       if ((rv = dhdsdio_membytes(bus, FALSE, console_ptr,
+                               (uint8 *)console_buffer, console_size)) < 0)
+                               goto printbuf;
+
+                       for (i = 0, n = 0; i < console_size; i += n + 1) {
+                               for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
+                                       ch = console_buffer[(console_index + i + n) % console_size];
+                                       if (ch == '\n')
+                                               break;
+                                       line[n] = ch;
+                               }
+
+
+                               if (n > 0) {
+                                       if (line[n - 1] == '\r')
+                                               n--;
+                                       line[n] = 0;
+                                       /* Don't use DHD_ERROR macro since we print
+                                        * a lot of information quickly. The macro
+                                        * will truncate a lot of the printfs
+                                        */
+
+                                       if (dhd_msg_level & DHD_ERROR_VAL)
+                                               printf("CONSOLE: %s\n", line);
+                               }
+                       }
+               }
+       }
+
+printbuf:
+       if (sdpcm_shared.flags & (SDPCM_SHARED_ASSERT | SDPCM_SHARED_TRAP)) {
+               DHD_ERROR(("%s: %s\n", __FUNCTION__, strbuf.origbuf));
+       }
+
+#if defined(DHD_FW_COREDUMP)
+       if (sdpcm_shared.flags & SDPCM_SHARED_TRAP) {
+               /* Mem dump to a file on device */
+               dhdsdio_mem_dump(bus);
+       }
+#endif /* #if defined(DHD_FW_COREDUMP) */
+
+done:
+       if (mbuffer)
+               MFREE(bus->dhd->osh, mbuffer, msize);
+       if (str)
+               MFREE(bus->dhd->osh, str, maxstrlen);
+       if (console_buffer)
+               MFREE(bus->dhd->osh, console_buffer, console_size);
+
+       return bcmerror;
+}
+
+#if defined(DHD_FW_COREDUMP)
+static int
+dhdsdio_mem_dump(dhd_bus_t *bus)
+{
+       int ret = 0;
+       int size; /* Full mem size */
+       int start = bus->dongle_ram_base; /* Start address */
+       int read_size = 0; /* Read size of each iteration */
+       uint8 *buf = NULL, *databuf = NULL;
+
+       /* Get full mem size */
+       size = bus->ramsize;
+       buf = MALLOC(bus->dhd->osh, size);
+       if (!buf) {
+               printf("%s: Out of memory (%d bytes)\n", __FUNCTION__, size);
+               return -1;
+       }
+
+       /* Read mem content */
+       printf("Dump dongle memory");
+       databuf = buf;
+       while (size)
+       {
+               read_size = MIN(MEMBLOCK, size);
+               if ((ret = dhdsdio_membytes(bus, FALSE, start, databuf, read_size)))
+               {
+                       printf("%s: Error membytes %d\n", __FUNCTION__, ret);
+                       if (buf) {
+                               MFREE(bus->dhd->osh, buf, size);
+                       }
+                       return -1;
+               }
+               /* Decrement size and increment start address */
+               size -= read_size;
+               start += read_size;
+               databuf += read_size;
+       }
+       printf("Done\n");
+
+       dhd_save_fwdump(bus->dhd, buf, bus->ramsize);
+       /* free buf before return !!! */
+       if (write_to_file(bus->dhd, buf, bus->ramsize))
+       {
+               printf("%s: Error writing to files\n", __FUNCTION__);
+               return -1;
+       }
+
+       /* buf free handled in write_to_file, not here */
+       return 0;
+}
+#endif /* DHD_FW_COREDUMP */
+
+int
+dhd_socram_dump(dhd_bus_t * bus)
+{
+#if defined(DHD_FW_COREDUMP)
+       return (dhdsdio_mem_dump(bus));
+#else
+       return -1;
+#endif
+}
+
+int
+dhdsdio_downloadvars(dhd_bus_t *bus, void *arg, int len)
+{
+       int bcmerror = BCME_OK;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       /* Basic sanity checks */
+       if (bus->dhd->up) {
+               bcmerror = BCME_NOTDOWN;
+               goto err;
+       }
+       if (!len) {
+               bcmerror = BCME_BUFTOOSHORT;
+               goto err;
+       }
+
+       /* Free the old ones and replace with passed variables */
+       if (bus->vars)
+               MFREE(bus->dhd->osh, bus->vars, bus->varsz);
+
+       bus->vars = MALLOC(bus->dhd->osh, len);
+       bus->varsz = bus->vars ? len : 0;
+       if (bus->vars == NULL) {
+               bcmerror = BCME_NOMEM;
+               goto err;
+       }
+
+       /* Copy the passed variables, which should include the terminating double-null */
+       bcopy(arg, bus->vars, bus->varsz);
+err:
+       return bcmerror;
+}
+
+#ifdef DHD_DEBUG
+
+#define CC_PLL_CHIPCTRL_SERIAL_ENAB            (1  << 24)
+#define CC_CHIPCTRL_JTAG_SEL                   (1  << 3)
+#define CC_CHIPCTRL_GPIO_SEL                           (0x3)
+#define CC_PLL_CHIPCTRL_SERIAL_ENAB_4334       (1  << 28)
+
+static int
+dhd_serialconsole(dhd_bus_t *bus, bool set, bool enable, int *bcmerror)
+{
+       int int_val;
+       uint32 addr, data, uart_enab = 0;
+       uint32 jtag_sel = CC_CHIPCTRL_JTAG_SEL;
+       uint32 gpio_sel = CC_CHIPCTRL_GPIO_SEL;
+
+       addr = SI_ENUM_BASE + OFFSETOF(chipcregs_t, chipcontrol_addr);
+       data = SI_ENUM_BASE + OFFSETOF(chipcregs_t, chipcontrol_data);
+       *bcmerror = 0;
+
+       bcmsdh_reg_write(bus->sdh, addr, 4, 1);
+       if (bcmsdh_regfail(bus->sdh)) {
+               *bcmerror = BCME_SDIO_ERROR;
+               return -1;
+       }
+       int_val = bcmsdh_reg_read(bus->sdh, data, 4);
+       if (bcmsdh_regfail(bus->sdh)) {
+               *bcmerror = BCME_SDIO_ERROR;
+               return -1;
+       }
+       if (bus->sih->chip == BCM4330_CHIP_ID) {
+               uart_enab = CC_PLL_CHIPCTRL_SERIAL_ENAB;
+       }
+       else if (bus->sih->chip == BCM4334_CHIP_ID ||
+               bus->sih->chip == BCM43340_CHIP_ID ||
+               bus->sih->chip == BCM43341_CHIP_ID ||
+               bus->sih->chip == BCM43342_CHIP_ID ||
+               0) {
+               if (enable) {
+                       /* Moved to PMU chipcontrol 1 from 4330 */
+                       int_val &= ~gpio_sel;
+                       int_val |= jtag_sel;
+               } else {
+                       int_val |= gpio_sel;
+                       int_val &= ~jtag_sel;
+               }
+               uart_enab = CC_PLL_CHIPCTRL_SERIAL_ENAB_4334;
+       }
+
+       if (!set)
+               return (int_val & uart_enab);
+       if (enable)
+               int_val |= uart_enab;
+       else
+               int_val &= ~uart_enab;
+       bcmsdh_reg_write(bus->sdh, data, 4, int_val);
+       if (bcmsdh_regfail(bus->sdh)) {
+               *bcmerror = BCME_SDIO_ERROR;
+               return -1;
+       }
+       if (bus->sih->chip == BCM4330_CHIP_ID) {
+               uint32 chipcontrol;
+               addr = SI_ENUM_BASE + OFFSETOF(chipcregs_t, chipcontrol);
+               chipcontrol = bcmsdh_reg_read(bus->sdh, addr, 4);
+               chipcontrol &= ~jtag_sel;
+               if (enable) {
+                       chipcontrol |=  jtag_sel;
+                       chipcontrol &= ~gpio_sel;
+               }
+               bcmsdh_reg_write(bus->sdh, addr, 4, chipcontrol);
+       }
+
+       return (int_val & uart_enab);
+}
+#endif 
+
+static int
+dhdsdio_doiovar(dhd_bus_t *bus, const bcm_iovar_t *vi, uint32 actionid, const char *name,
+                void *params, int plen, void *arg, int len, int val_size)
+{
+       int bcmerror = 0;
+       int32 int_val = 0;
+       bool bool_val = 0;
+
+       DHD_TRACE(("%s: Enter, action %d name %s params %p plen %d arg %p len %d val_size %d\n",
+                  __FUNCTION__, actionid, name, params, plen, arg, len, val_size));
+
+       if ((bcmerror = bcm_iovar_lencheck(vi, arg, len, IOV_ISSET(actionid))) != 0)
+               goto exit;
+
+       if (plen >= (int)sizeof(int_val))
+               bcopy(params, &int_val, sizeof(int_val));
+
+       bool_val = (int_val != 0) ? TRUE : FALSE;
+
+
+       /* Some ioctls use the bus */
+       dhd_os_sdlock(bus->dhd);
+
+       /* Check if dongle is in reset. If so, only allow DEVRESET iovars */
+       if (bus->dhd->dongle_reset && !(actionid == IOV_SVAL(IOV_DEVRESET) ||
+                                       actionid == IOV_GVAL(IOV_DEVRESET))) {
+               bcmerror = BCME_NOTREADY;
+               goto exit;
+       }
+
+       /*
+        * Special handling for keepSdioOn: New SDIO Wake-up Mechanism
+        */
+       if ((vi->varid == IOV_KSO) && (IOV_ISSET(actionid))) {
+               dhdsdio_clk_kso_iovar(bus, bool_val);
+               goto exit;
+       } else if ((vi->varid == IOV_DEVSLEEP) && (IOV_ISSET(actionid))) {
+               {
+                       dhdsdio_clk_devsleep_iovar(bus, bool_val);
+                       if (!SLPAUTO_ENAB(bus) && (bool_val == FALSE) && (bus->ipend)) {
+                               DHD_ERROR(("INT pending in devsleep 1, dpc_sched: %d\n",
+                                       bus->dpc_sched));
+                               if (!bus->dpc_sched) {
+                                       bus->dpc_sched = TRUE;
+                                       dhd_sched_dpc(bus->dhd);
+                               }
+                       }
+               }
+               goto exit;
+       }
+
+       /* Handle sleep stuff before any clock mucking */
+       if (vi->varid == IOV_SLEEP) {
+               if (IOV_ISSET(actionid)) {
+                       bcmerror = dhdsdio_bussleep(bus, bool_val);
+               } else {
+                       int_val = (int32)bus->sleeping;
+                       bcopy(&int_val, arg, val_size);
+               }
+               goto exit;
+       }
+
+       /* Request clock to allow SDIO accesses */
+       if (!bus->dhd->dongle_reset) {
+               BUS_WAKE(bus);
+               dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+       }
+
+       switch (actionid) {
+       case IOV_GVAL(IOV_INTR):
+               int_val = (int32)bus->intr;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_INTR):
+               bus->intr = bool_val;
+               bus->intdis = FALSE;
+               if (bus->dhd->up) {
+                       if (bus->intr) {
+                               DHD_INTR(("%s: enable SDIO device interrupts\n", __FUNCTION__));
+                               bcmsdh_intr_enable(bus->sdh);
+                       } else {
+                               DHD_INTR(("%s: disable SDIO interrupts\n", __FUNCTION__));
+                               bcmsdh_intr_disable(bus->sdh);
+                       }
+               }
+               break;
+
+       case IOV_GVAL(IOV_POLLRATE):
+               int_val = (int32)bus->pollrate;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_POLLRATE):
+               bus->pollrate = (uint)int_val;
+               bus->poll = (bus->pollrate != 0);
+               break;
+
+       case IOV_GVAL(IOV_IDLETIME):
+               int_val = bus->idletime;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_IDLETIME):
+               if ((int_val < 0) && (int_val != DHD_IDLE_IMMEDIATE)) {
+                       bcmerror = BCME_BADARG;
+               } else {
+                       bus->idletime = int_val;
+               }
+               break;
+
+       case IOV_GVAL(IOV_IDLECLOCK):
+               int_val = (int32)bus->idleclock;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_IDLECLOCK):
+               bus->idleclock = int_val;
+               break;
+
+       case IOV_GVAL(IOV_SD1IDLE):
+               int_val = (int32)sd1idle;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_SD1IDLE):
+               sd1idle = bool_val;
+               break;
+
+
+       case IOV_SVAL(IOV_MEMBYTES):
+       case IOV_GVAL(IOV_MEMBYTES):
+       {
+               uint32 address;
+               uint size, dsize;
+               uint8 *data;
+
+               bool set = (actionid == IOV_SVAL(IOV_MEMBYTES));
+
+               ASSERT(plen >= 2*sizeof(int));
+
+               address = (uint32)int_val;
+               bcopy((char *)params + sizeof(int_val), &int_val, sizeof(int_val));
+               size = (uint)int_val;
+
+               /* Do some validation */
+               dsize = set ? plen - (2 * sizeof(int)) : len;
+               if (dsize < size) {
+                       DHD_ERROR(("%s: error on %s membytes, addr 0x%08x size %d dsize %d\n",
+                                  __FUNCTION__, (set ? "set" : "get"), address, size, dsize));
+                       bcmerror = BCME_BADARG;
+                       break;
+               }
+
+               DHD_INFO(("%s: Request to %s %d bytes at address 0x%08x\n", __FUNCTION__,
+                         (set ? "write" : "read"), size, address));
+
+               /* check if CR4 */
+               if (si_setcore(bus->sih, ARMCR4_CORE_ID, 0)) {
+                       /*
+                        * If address is start of RAM (i.e. a downloaded image),
+                        * store the reset instruction to be written in 0
+                        */
+                       if (set && address == bus->dongle_ram_base) {
+                               bus->resetinstr = *(((uint32*)params) + 2);
+                       }
+               } else {
+               /* If we know about SOCRAM, check for a fit */
+               if ((bus->orig_ramsize) &&
+                   ((address > bus->orig_ramsize) || (address + size > bus->orig_ramsize)))
+               {
+                       uint8 enable, protect, remap;
+                       si_socdevram(bus->sih, FALSE, &enable, &protect, &remap);
+                       if (!enable || protect) {
+                               DHD_ERROR(("%s: ramsize 0x%08x doesn't have %d bytes at 0x%08x\n",
+                                       __FUNCTION__, bus->orig_ramsize, size, address));
+                               DHD_ERROR(("%s: socram enable %d, protect %d\n",
+                                       __FUNCTION__, enable, protect));
+                               bcmerror = BCME_BADARG;
+                               break;
+                       }
+
+                       if (!REMAP_ENAB(bus) && (address >= SOCDEVRAM_ARM_ADDR)) {
+                               uint32 devramsize = si_socdevram_size(bus->sih);
+                               if ((address < SOCDEVRAM_ARM_ADDR) ||
+                                       (address + size > (SOCDEVRAM_ARM_ADDR + devramsize))) {
+                                       DHD_ERROR(("%s: bad address 0x%08x, size 0x%08x\n",
+                                               __FUNCTION__, address, size));
+                                       DHD_ERROR(("%s: socram range 0x%08x,size 0x%08x\n",
+                                               __FUNCTION__, SOCDEVRAM_ARM_ADDR, devramsize));
+                                       bcmerror = BCME_BADARG;
+                                       break;
+                               }
+                               /* move it such that address is real now */
+                               address -= SOCDEVRAM_ARM_ADDR;
+                               address += SOCDEVRAM_BP_ADDR;
+                               DHD_INFO(("%s: Request to %s %d bytes @ Mapped address 0x%08x\n",
+                                       __FUNCTION__, (set ? "write" : "read"), size, address));
+                       } else if (REMAP_ENAB(bus) && REMAP_ISADDR(bus, address) && remap) {
+                               /* Can not access remap region while devram remap bit is set
+                                * ROM content would be returned in this case
+                                */
+                               DHD_ERROR(("%s: Need to disable remap for address 0x%08x\n",
+                                       __FUNCTION__, address));
+                               bcmerror = BCME_ERROR;
+                               break;
+                       }
+               }
+               }
+
+               /* Generate the actual data pointer */
+               data = set ? (uint8*)params + 2 * sizeof(int): (uint8*)arg;
+
+               /* Call to do the transfer */
+               bcmerror = dhdsdio_membytes(bus, set, address, data, size);
+
+               break;
+       }
+
+       case IOV_GVAL(IOV_RAMSIZE):
+               int_val = (int32)bus->ramsize;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_GVAL(IOV_RAMSTART):
+               int_val = (int32)bus->dongle_ram_base;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_GVAL(IOV_SDIOD_DRIVE):
+               int_val = (int32)dhd_sdiod_drive_strength;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_SDIOD_DRIVE):
+               dhd_sdiod_drive_strength = int_val;
+               si_sdiod_drive_strength_init(bus->sih, bus->dhd->osh, dhd_sdiod_drive_strength);
+               break;
+
+       case IOV_SVAL(IOV_SET_DOWNLOAD_STATE):
+               bcmerror = dhdsdio_download_state(bus, bool_val);
+               break;
+
+       case IOV_SVAL(IOV_SOCRAM_STATE):
+               bcmerror = dhdsdio_download_state(bus, bool_val);
+               break;
+
+       case IOV_SVAL(IOV_VARS):
+               bcmerror = dhdsdio_downloadvars(bus, arg, len);
+               break;
+
+       case IOV_GVAL(IOV_READAHEAD):
+               int_val = (int32)dhd_readahead;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_READAHEAD):
+               if (bool_val && !dhd_readahead)
+                       bus->nextlen = 0;
+               dhd_readahead = bool_val;
+               break;
+
+       case IOV_GVAL(IOV_SDRXCHAIN):
+               int_val = (int32)bus->use_rxchain;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_SDRXCHAIN):
+               if (bool_val && !bus->sd_rxchain)
+                       bcmerror = BCME_UNSUPPORTED;
+               else
+                       bus->use_rxchain = bool_val;
+               break;
+       case IOV_GVAL(IOV_ALIGNCTL):
+               int_val = (int32)dhd_alignctl;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_ALIGNCTL):
+               dhd_alignctl = bool_val;
+               break;
+
+       case IOV_GVAL(IOV_SDALIGN):
+               int_val = DHD_SDALIGN;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+#ifdef DHD_DEBUG
+       case IOV_GVAL(IOV_VARS):
+               if (bus->varsz < (uint)len)
+                       bcopy(bus->vars, arg, bus->varsz);
+               else
+                       bcmerror = BCME_BUFTOOSHORT;
+               break;
+#endif /* DHD_DEBUG */
+
+#ifdef DHD_DEBUG
+       case IOV_GVAL(IOV_SDREG):
+       {
+               sdreg_t *sd_ptr;
+               uint32 addr, size;
+
+               sd_ptr = (sdreg_t *)params;
+
+               addr = (uint32)((ulong)bus->regs + sd_ptr->offset);
+               size = sd_ptr->func;
+               int_val = (int32)bcmsdh_reg_read(bus->sdh, addr, size);
+               if (bcmsdh_regfail(bus->sdh))
+                       bcmerror = BCME_SDIO_ERROR;
+               bcopy(&int_val, arg, sizeof(int32));
+               break;
+       }
+
+       case IOV_SVAL(IOV_SDREG):
+       {
+               sdreg_t *sd_ptr;
+               uint32 addr, size;
+
+               sd_ptr = (sdreg_t *)params;
+
+               addr = (uint32)((ulong)bus->regs + sd_ptr->offset);
+               size = sd_ptr->func;
+               bcmsdh_reg_write(bus->sdh, addr, size, sd_ptr->value);
+               if (bcmsdh_regfail(bus->sdh))
+                       bcmerror = BCME_SDIO_ERROR;
+               break;
+       }
+
+       /* Same as above, but offset is not backplane (not SDIO core) */
+       case IOV_GVAL(IOV_SBREG):
+       {
+               sdreg_t sdreg;
+               uint32 addr, size;
+
+               bcopy(params, &sdreg, sizeof(sdreg));
+
+               addr = SI_ENUM_BASE + sdreg.offset;
+               size = sdreg.func;
+               int_val = (int32)bcmsdh_reg_read(bus->sdh, addr, size);
+               if (bcmsdh_regfail(bus->sdh))
+                       bcmerror = BCME_SDIO_ERROR;
+               bcopy(&int_val, arg, sizeof(int32));
+               break;
+       }
+
+       case IOV_SVAL(IOV_SBREG):
+       {
+               sdreg_t sdreg;
+               uint32 addr, size;
+
+               bcopy(params, &sdreg, sizeof(sdreg));
+
+               addr = SI_ENUM_BASE + sdreg.offset;
+               size = sdreg.func;
+               bcmsdh_reg_write(bus->sdh, addr, size, sdreg.value);
+               if (bcmsdh_regfail(bus->sdh))
+                       bcmerror = BCME_SDIO_ERROR;
+               break;
+       }
+
+       case IOV_GVAL(IOV_SDCIS):
+       {
+               *(char *)arg = 0;
+
+               bcmstrcat(arg, "\nFunc 0\n");
+               bcmsdh_cis_read(bus->sdh, 0x10, (uint8 *)arg + strlen(arg), SBSDIO_CIS_SIZE_LIMIT);
+               bcmstrcat(arg, "\nFunc 1\n");
+               bcmsdh_cis_read(bus->sdh, 0x11, (uint8 *)arg + strlen(arg), SBSDIO_CIS_SIZE_LIMIT);
+               bcmstrcat(arg, "\nFunc 2\n");
+               bcmsdh_cis_read(bus->sdh, 0x12, (uint8 *)arg + strlen(arg), SBSDIO_CIS_SIZE_LIMIT);
+               break;
+       }
+
+       case IOV_GVAL(IOV_FORCEEVEN):
+               int_val = (int32)forcealign;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_FORCEEVEN):
+               forcealign = bool_val;
+               break;
+
+       case IOV_GVAL(IOV_TXBOUND):
+               int_val = (int32)dhd_txbound;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_TXBOUND):
+               dhd_txbound = (uint)int_val;
+               break;
+
+       case IOV_GVAL(IOV_RXBOUND):
+               int_val = (int32)dhd_rxbound;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_RXBOUND):
+               dhd_rxbound = (uint)int_val;
+               break;
+
+       case IOV_GVAL(IOV_TXMINMAX):
+               int_val = (int32)dhd_txminmax;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_TXMINMAX):
+               dhd_txminmax = (uint)int_val;
+               break;
+
+       case IOV_GVAL(IOV_SERIALCONS):
+               int_val = dhd_serialconsole(bus, FALSE, 0, &bcmerror);
+               if (bcmerror != 0)
+                       break;
+
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_SERIALCONS):
+               dhd_serialconsole(bus, TRUE, bool_val, &bcmerror);
+               break;
+
+
+#endif /* DHD_DEBUG */
+
+
+#ifdef SDTEST
+       case IOV_GVAL(IOV_EXTLOOP):
+               int_val = (int32)bus->ext_loop;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_EXTLOOP):
+               bus->ext_loop = bool_val;
+               break;
+
+       case IOV_GVAL(IOV_PKTGEN):
+               bcmerror = dhdsdio_pktgen_get(bus, arg);
+               break;
+
+       case IOV_SVAL(IOV_PKTGEN):
+               bcmerror = dhdsdio_pktgen_set(bus, arg);
+               break;
+#endif /* SDTEST */
+
+#if defined(USE_SDIOFIFO_IOVAR)
+       case IOV_GVAL(IOV_WATERMARK):
+               int_val = (int32)watermark;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_WATERMARK):
+               watermark = (uint)int_val;
+               watermark = (watermark > SBSDIO_WATERMARK_MASK) ? SBSDIO_WATERMARK_MASK : watermark;
+               DHD_ERROR(("Setting watermark as 0x%x.\n", watermark));
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_WATERMARK, (uint8)watermark, NULL);
+               break;
+
+       case IOV_GVAL(IOV_MESBUSYCTRL):
+               int_val = (int32)mesbusyctrl;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_MESBUSYCTRL):
+               mesbusyctrl = (uint)int_val;
+               mesbusyctrl = (mesbusyctrl > SBSDIO_MESBUSYCTRL_MASK)
+                       ? SBSDIO_MESBUSYCTRL_MASK : mesbusyctrl;
+               DHD_ERROR(("Setting mesbusyctrl as 0x%x.\n", mesbusyctrl));
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_MESBUSYCTRL,
+                       ((uint8)mesbusyctrl | 0x80), NULL);
+               break;
+#endif 
+
+
+       case IOV_GVAL(IOV_DONGLEISOLATION):
+               int_val = bus->dhd->dongle_isolation;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_DONGLEISOLATION):
+               bus->dhd->dongle_isolation = bool_val;
+               break;
+
+       case IOV_SVAL(IOV_DEVRESET):
+               DHD_TRACE(("%s: Called set IOV_DEVRESET=%d dongle_reset=%d busstate=%d\n",
+                          __FUNCTION__, bool_val, bus->dhd->dongle_reset,
+                          bus->dhd->busstate));
+
+               ASSERT(bus->dhd->osh);
+               /* ASSERT(bus->cl_devid); */
+
+               dhd_bus_devreset(bus->dhd, (uint8)bool_val);
+
+               break;
+       /*
+        * softap firmware is updated through module parameter or android private command
+        */
+
+       case IOV_GVAL(IOV_DEVRESET):
+               DHD_TRACE(("%s: Called get IOV_DEVRESET\n", __FUNCTION__));
+
+               /* Get its status */
+               int_val = (bool) bus->dhd->dongle_reset;
+               bcopy(&int_val, arg, val_size);
+
+               break;
+
+       case IOV_GVAL(IOV_KSO):
+               int_val = dhdsdio_sleepcsr_get(bus);
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_GVAL(IOV_DEVCAP):
+               int_val = dhdsdio_devcap_get(bus);
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_DEVCAP):
+               dhdsdio_devcap_set(bus, (uint8) int_val);
+               break;
+       case IOV_GVAL(IOV_TXGLOMSIZE):
+               int_val = (int32)bus->txglomsize;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_SVAL(IOV_TXGLOMSIZE):
+               if (int_val > SDPCM_MAXGLOM_SIZE) {
+                       bcmerror = BCME_ERROR;
+               } else {
+                       bus->txglomsize = (uint)int_val;
+               }
+               break;
+       case IOV_SVAL(IOV_HANGREPORT):
+               bus->dhd->hang_report = bool_val;
+               DHD_ERROR(("%s: Set hang_report as %d\n", __FUNCTION__, bus->dhd->hang_report));
+               break;
+
+       case IOV_GVAL(IOV_HANGREPORT):
+               int_val = (int32)bus->dhd->hang_report;
+               bcopy(&int_val, arg, val_size);
+               break;
+
+       case IOV_GVAL(IOV_TXINRX_THRES):
+               int_val = bus->txinrx_thres;
+               bcopy(&int_val, arg, val_size);
+               break;
+       case IOV_SVAL(IOV_TXINRX_THRES):
+               if (int_val < 0) {
+                       bcmerror = BCME_BADARG;
+               } else {
+                       bus->txinrx_thres = int_val;
+               }
+               break;
+
+       default:
+               bcmerror = BCME_UNSUPPORTED;
+               break;
+       }
+
+exit:
+       if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
+               bus->activity = FALSE;
+               dhdsdio_clkctl(bus, CLK_NONE, TRUE);
+       }
+
+       dhd_os_sdunlock(bus->dhd);
+
+       return bcmerror;
+}
+
+static int
+dhdsdio_write_vars(dhd_bus_t *bus)
+{
+       int bcmerror = 0;
+       uint32 varsize, phys_size;
+       uint32 varaddr;
+       uint8 *vbuffer;
+       uint32 varsizew;
+#ifdef DHD_DEBUG
+       uint8 *nvram_ularray;
+#endif /* DHD_DEBUG */
+
+       /* Even if there are no vars are to be written, we still need to set the ramsize. */
+       varsize = bus->varsz ? ROUNDUP(bus->varsz, 4) : 0;
+       varaddr = (bus->ramsize - 4) - varsize;
+
+       varaddr += bus->dongle_ram_base;
+
+       if (bus->vars) {
+               if ((bus->sih->buscoretype == SDIOD_CORE_ID) && (bus->sdpcmrev == 7)) {
+                       if (((varaddr & 0x3C) == 0x3C) && (varsize > 4)) {
+                               DHD_ERROR(("PR85623WAR in place\n"));
+                               varsize += 4;
+                               varaddr -= 4;
+                       }
+               }
+
+               vbuffer = (uint8 *)MALLOC(bus->dhd->osh, varsize);
+               if (!vbuffer)
+                       return BCME_NOMEM;
+
+               bzero(vbuffer, varsize);
+               bcopy(bus->vars, vbuffer, bus->varsz);
+
+               /* Write the vars list */
+               bcmerror = dhdsdio_membytes(bus, TRUE, varaddr, vbuffer, varsize);
+#ifdef DHD_DEBUG
+               /* Verify NVRAM bytes */
+               DHD_INFO(("Compare NVRAM dl & ul; varsize=%d\n", varsize));
+               nvram_ularray = (uint8*)MALLOC(bus->dhd->osh, varsize);
+               if (!nvram_ularray)
+                       return BCME_NOMEM;
+
+               /* Upload image to verify downloaded contents. */
+               memset(nvram_ularray, 0xaa, varsize);
+
+               /* Read the vars list to temp buffer for comparison */
+               bcmerror = dhdsdio_membytes(bus, FALSE, varaddr, nvram_ularray, varsize);
+               if (bcmerror) {
+                               DHD_ERROR(("%s: error %d on reading %d nvram bytes at 0x%08x\n",
+                                       __FUNCTION__, bcmerror, varsize, varaddr));
+               }
+               /* Compare the org NVRAM with the one read from RAM */
+               if (memcmp(vbuffer, nvram_ularray, varsize)) {
+                       DHD_ERROR(("%s: Downloaded NVRAM image is corrupted.\n", __FUNCTION__));
+               } else
+                       DHD_ERROR(("%s: Download, Upload and compare of NVRAM succeeded.\n",
+                       __FUNCTION__));
+
+               MFREE(bus->dhd->osh, nvram_ularray, varsize);
+#endif /* DHD_DEBUG */
+
+               MFREE(bus->dhd->osh, vbuffer, varsize);
+       }
+
+       phys_size = REMAP_ENAB(bus) ? bus->ramsize : bus->orig_ramsize;
+
+       phys_size += bus->dongle_ram_base;
+
+       /* adjust to the user specified RAM */
+       DHD_INFO(("Physical memory size: %d, usable memory size: %d\n",
+               phys_size, bus->ramsize));
+       DHD_INFO(("Vars are at %d, orig varsize is %d\n",
+               varaddr, varsize));
+       varsize = ((phys_size - 4) - varaddr);
+
+       /*
+        * Determine the length token:
+        * Varsize, converted to words, in lower 16-bits, checksum in upper 16-bits.
+        */
+       if (bcmerror) {
+               varsizew = 0;
+       } else {
+               varsizew = varsize / 4;
+               varsizew = (~varsizew << 16) | (varsizew & 0x0000FFFF);
+               varsizew = htol32(varsizew);
+       }
+
+       DHD_INFO(("New varsize is %d, length token=0x%08x\n", varsize, varsizew));
+
+       /* Write the length token to the last word */
+       bcmerror = dhdsdio_membytes(bus, TRUE, (phys_size - 4),
+               (uint8*)&varsizew, 4);
+
+       return bcmerror;
+}
+
+static int
+dhdsdio_download_state(dhd_bus_t *bus, bool enter)
+{
+       uint retries;
+       int bcmerror = 0;
+       int foundcr4 = 0;
+
+       if (!bus->sih)
+               return BCME_ERROR;
+       /* To enter download state, disable ARM and reset SOCRAM.
+        * To exit download state, simply reset ARM (default is RAM boot).
+        */
+       if (enter) {
+               bus->alp_only = TRUE;
+
+               if (!(si_setcore(bus->sih, ARM7S_CORE_ID, 0)) &&
+                   !(si_setcore(bus->sih, ARMCM3_CORE_ID, 0))) {
+                       if (si_setcore(bus->sih, ARMCR4_CORE_ID, 0)) {
+                               foundcr4 = 1;
+                       } else {
+                               DHD_ERROR(("%s: Failed to find ARM core!\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+               }
+
+               if (!foundcr4) {
+                       si_core_disable(bus->sih, 0);
+                       if (bcmsdh_regfail(bus->sdh)) {
+                               bcmerror = BCME_SDIO_ERROR;
+                               goto fail;
+                       }
+
+                       if (!(si_setcore(bus->sih, SOCRAM_CORE_ID, 0))) {
+                               DHD_ERROR(("%s: Failed to find SOCRAM core!\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+
+                       si_core_reset(bus->sih, 0, 0);
+                       if (bcmsdh_regfail(bus->sdh)) {
+                               DHD_ERROR(("%s: Failure trying reset SOCRAM core?\n",
+                                          __FUNCTION__));
+                               bcmerror = BCME_SDIO_ERROR;
+                               goto fail;
+                       }
+
+                       /* Disable remap for download */
+                       if (REMAP_ENAB(bus) && si_socdevram_remap_isenb(bus->sih))
+                               dhdsdio_devram_remap(bus, FALSE);
+
+                       if (CHIPID(bus->sih->chip) == BCM43430_CHIP_ID) {
+                               /* Disabling Remap for SRAM_3 */
+                               si_socram_set_bankpda(bus->sih, 0x3, 0x0);
+                       }
+
+                       /* Clear the top bit of memory */
+                       if (bus->ramsize) {
+                               uint32 zeros = 0;
+                               if (dhdsdio_membytes(bus, TRUE, bus->ramsize - 4,
+                                                    (uint8*)&zeros, 4) < 0) {
+                                       bcmerror = BCME_SDIO_ERROR;
+                                       goto fail;
+                               }
+                       }
+               } else {
+                       /* For CR4,
+                        * Halt ARM
+                        * Remove ARM reset
+                        * Read RAM base address [0x18_0000]
+                        * [next] Download firmware
+                        * [done at else] Populate the reset vector
+                        * [done at else] Remove ARM halt
+                       */
+                       /* Halt ARM & remove reset */
+                       si_core_reset(bus->sih, SICF_CPUHALT, SICF_CPUHALT);
+               }
+       } else {
+               if (!si_setcore(bus->sih, ARMCR4_CORE_ID, 0)) {
+                       if (!(si_setcore(bus->sih, SOCRAM_CORE_ID, 0))) {
+                               DHD_ERROR(("%s: Failed to find SOCRAM core!\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+
+                       if (!si_iscoreup(bus->sih)) {
+                               DHD_ERROR(("%s: SOCRAM core is down after reset?\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+
+                       if ((bcmerror = dhdsdio_write_vars(bus))) {
+                               DHD_ERROR(("%s: could not write vars to RAM\n", __FUNCTION__));
+                               goto fail;
+                       }
+
+                       /* Enable remap before ARM reset but after vars.
+                        * No backplane access in remap mode
+                        */
+                       if (REMAP_ENAB(bus) && !si_socdevram_remap_isenb(bus->sih))
+                               dhdsdio_devram_remap(bus, TRUE);
+
+                       if (!si_setcore(bus->sih, PCMCIA_CORE_ID, 0) &&
+                           !si_setcore(bus->sih, SDIOD_CORE_ID, 0)) {
+                               DHD_ERROR(("%s: Can't change back to SDIO core?\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+                       W_SDREG(0xFFFFFFFF, &bus->regs->intstatus, retries);
+
+
+                       if (!(si_setcore(bus->sih, ARM7S_CORE_ID, 0)) &&
+                           !(si_setcore(bus->sih, ARMCM3_CORE_ID, 0))) {
+                               DHD_ERROR(("%s: Failed to find ARM core!\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+               } else {
+                       /* cr4 has no socram, but tcm's */
+                       /* write vars */
+                       if ((bcmerror = dhdsdio_write_vars(bus))) {
+                               DHD_ERROR(("%s: could not write vars to RAM\n", __FUNCTION__));
+                               goto fail;
+                       }
+
+                       if (!si_setcore(bus->sih, PCMCIA_CORE_ID, 0) &&
+                           !si_setcore(bus->sih, SDIOD_CORE_ID, 0)) {
+                               DHD_ERROR(("%s: Can't change back to SDIO core?\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+                       W_SDREG(0xFFFFFFFF, &bus->regs->intstatus, retries);
+
+                       /* switch back to arm core again */
+                       if (!(si_setcore(bus->sih, ARMCR4_CORE_ID, 0))) {
+                               DHD_ERROR(("%s: Failed to find ARM CR4 core!\n", __FUNCTION__));
+                               bcmerror = BCME_ERROR;
+                               goto fail;
+                       }
+                       /* write address 0 with reset instruction */
+                       bcmerror = dhdsdio_membytes(bus, TRUE, 0,
+                               (uint8 *)&bus->resetinstr, sizeof(bus->resetinstr));
+
+                       if (bcmerror == BCME_OK) {
+                               uint32 tmp;
+
+                               /* verify write */
+                               bcmerror = dhdsdio_membytes(bus, FALSE, 0,
+                                                           (uint8 *)&tmp, sizeof(tmp));
+
+                               if (bcmerror == BCME_OK && tmp != bus->resetinstr) {
+                                       DHD_ERROR(("%s: Failed to write 0x%08x to addr 0\n",
+                                                 __FUNCTION__, bus->resetinstr));
+                                       DHD_ERROR(("%s: contents of addr 0 is 0x%08x\n",
+                                                 __FUNCTION__, tmp));
+                                       bcmerror = BCME_SDIO_ERROR;
+                                       goto fail;
+                               }
+                       }
+
+                       /* now remove reset and halt and continue to run CR4 */
+               }
+
+               si_core_reset(bus->sih, 0, 0);
+               if (bcmsdh_regfail(bus->sdh)) {
+                       DHD_ERROR(("%s: Failure trying to reset ARM core?\n", __FUNCTION__));
+                       bcmerror = BCME_SDIO_ERROR;
+                       goto fail;
+               }
+
+               /* Allow HT Clock now that the ARM is running. */
+               bus->alp_only = FALSE;
+
+               bus->dhd->busstate = DHD_BUS_LOAD;
+       }
+
+fail:
+       /* Always return to SDIOD core */
+       if (!si_setcore(bus->sih, PCMCIA_CORE_ID, 0))
+               si_setcore(bus->sih, SDIOD_CORE_ID, 0);
+
+       return bcmerror;
+}
+
+int
+dhd_bus_iovar_op(dhd_pub_t *dhdp, const char *name,
+                 void *params, int plen, void *arg, int len, bool set)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       const bcm_iovar_t *vi = NULL;
+       int bcmerror = 0;
+       int val_size;
+       uint32 actionid;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       ASSERT(name);
+       ASSERT(len >= 0);
+
+       /* Get MUST have return space */
+       ASSERT(set || (arg && len));
+
+       /* Set does NOT take qualifiers */
+       ASSERT(!set || (!params && !plen));
+
+       /* Look up var locally; if not found pass to host driver */
+       if ((vi = bcm_iovar_lookup(dhdsdio_iovars, name)) == NULL) {
+               dhd_os_sdlock(bus->dhd);
+
+               BUS_WAKE(bus);
+
+               /* Turn on clock in case SD command needs backplane */
+               dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+               bcmerror = bcmsdh_iovar_op(bus->sdh, name, params, plen, arg, len, set);
+
+               /* Check for bus configuration changes of interest */
+
+               /* If it was divisor change, read the new one */
+               if (set && strcmp(name, "sd_divisor") == 0) {
+                       if (bcmsdh_iovar_op(bus->sdh, "sd_divisor", NULL, 0,
+                                           &bus->sd_divisor, sizeof(int32), FALSE) != BCME_OK) {
+                               bus->sd_divisor = -1;
+                               DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, name));
+                       } else {
+                               DHD_INFO(("%s: noted %s update, value now %d\n",
+                                         __FUNCTION__, name, bus->sd_divisor));
+                       }
+               }
+               /* If it was a mode change, read the new one */
+               if (set && strcmp(name, "sd_mode") == 0) {
+                       if (bcmsdh_iovar_op(bus->sdh, "sd_mode", NULL, 0,
+                                           &bus->sd_mode, sizeof(int32), FALSE) != BCME_OK) {
+                               bus->sd_mode = -1;
+                               DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, name));
+                       } else {
+                               DHD_INFO(("%s: noted %s update, value now %d\n",
+                                         __FUNCTION__, name, bus->sd_mode));
+                       }
+               }
+               /* Similar check for blocksize change */
+               if (set && strcmp(name, "sd_blocksize") == 0) {
+                       int32 fnum = 2;
+                       if (bcmsdh_iovar_op(bus->sdh, "sd_blocksize", &fnum, sizeof(int32),
+                                           &bus->blocksize, sizeof(int32), FALSE) != BCME_OK) {
+                               bus->blocksize = 0;
+                               DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, "sd_blocksize"));
+                       } else {
+                               DHD_INFO(("%s: noted %s update, value now %d\n",
+                                         __FUNCTION__, "sd_blocksize", bus->blocksize));
+
+                               dhdsdio_tune_fifoparam(bus);
+                       }
+               }
+               bus->roundup = MIN(max_roundup, bus->blocksize);
+
+               if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
+                       bus->activity = FALSE;
+                       dhdsdio_clkctl(bus, CLK_NONE, TRUE);
+               }
+
+               dhd_os_sdunlock(bus->dhd);
+               goto exit;
+       }
+
+       DHD_CTL(("%s: %s %s, len %d plen %d\n", __FUNCTION__,
+                name, (set ? "set" : "get"), len, plen));
+
+       /* set up 'params' pointer in case this is a set command so that
+        * the convenience int and bool code can be common to set and get
+        */
+       if (params == NULL) {
+               params = arg;
+               plen = len;
+       }
+
+       if (vi->type == IOVT_VOID)
+               val_size = 0;
+       else if (vi->type == IOVT_BUFFER)
+               val_size = len;
+       else
+               /* all other types are integer sized */
+               val_size = sizeof(int);
+
+       actionid = set ? IOV_SVAL(vi->varid) : IOV_GVAL(vi->varid);
+       bcmerror = dhdsdio_doiovar(bus, vi, actionid, name, params, plen, arg, len, val_size);
+
+exit:
+       return bcmerror;
+}
+
+void
+dhd_bus_stop(struct dhd_bus *bus, bool enforce_mutex)
+{
+       osl_t *osh;
+       uint32 local_hostintmask;
+       uint8 saveclk;
+       uint retries;
+       int err;
+       bool wlfc_enabled = FALSE;
+
+       if (!bus->dhd)
+               return;
+
+       osh = bus->dhd->osh;
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       bcmsdh_waitlockfree(bus->sdh);
+
+       if (enforce_mutex)
+               dhd_os_sdlock(bus->dhd);
+
+       if ((bus->dhd->busstate == DHD_BUS_DOWN) || bus->dhd->hang_was_sent) {
+               /* if Firmware already hangs disbale any interrupt */
+               bus->dhd->busstate = DHD_BUS_DOWN;
+               bus->hostintmask = 0;
+               bcmsdh_intr_disable(bus->sdh);
+       } else {
+
+               BUS_WAKE(bus);
+
+               if (KSO_ENAB(bus)) {
+
+               /* Enable clock for device interrupts */
+               dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+               /* Disable and clear interrupts at the chip level also */
+               W_SDREG(0, &bus->regs->hostintmask, retries);
+               local_hostintmask = bus->hostintmask;
+               bus->hostintmask = 0;
+
+               /* Change our idea of bus state */
+               bus->dhd->busstate = DHD_BUS_DOWN;
+
+               /* Force clocks on backplane to be sure F2 interrupt propagates */
+               saveclk = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+               if (!err) {
+                       bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+                                        (saveclk | SBSDIO_FORCE_HT), &err);
+               }
+               if (err) {
+                       DHD_ERROR(("%s: Failed to force clock for F2: err %d\n",
+                                   __FUNCTION__, err));
+               }
+
+               /* Turn off the bus (F2), free any pending packets */
+               DHD_INTR(("%s: disable SDIO interrupts\n", __FUNCTION__));
+               bcmsdh_intr_disable(bus->sdh);
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IOEN, SDIO_FUNC_ENABLE_1, NULL);
+
+               /* Clear any pending interrupts now that F2 is disabled */
+               W_SDREG(local_hostintmask, &bus->regs->intstatus, retries);
+               }
+
+               /* Turn off the backplane clock (only) */
+               dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+       }
+
+#ifdef PROP_TXSTATUS
+       wlfc_enabled = (dhd_wlfc_cleanup_txq(bus->dhd, NULL, 0) != WLFC_UNSUPPORTED);
+#endif
+       if (!wlfc_enabled) {
+#ifdef DHDTCPACK_SUPPRESS
+               /* Clean tcp_ack_info_tbl in order to prevent access to flushed pkt,
+                * when there is a newly coming packet from network stack.
+                */
+               dhd_tcpack_info_tbl_clean(bus->dhd);
+#endif /* DHDTCPACK_SUPPRESS */
+               /* Clear the data packet queues */
+               pktq_flush(osh, &bus->txq, TRUE, NULL, 0);
+       }
+
+       /* Clear any held glomming stuff */
+       if (bus->glomd)
+               PKTFREE(osh, bus->glomd, FALSE);
+
+       if (bus->glom)
+               PKTFREE(osh, bus->glom, FALSE);
+
+       bus->glom = bus->glomd = NULL;
+
+       /* Clear rx control and wake any waiters */
+       bus->rxlen = 0;
+       dhd_os_ioctl_resp_wake(bus->dhd);
+
+       /* Reset some F2 state stuff */
+       bus->rxskip = FALSE;
+       bus->tx_seq = bus->rx_seq = 0;
+
+       bus->tx_max = 4;
+
+       if (enforce_mutex)
+               dhd_os_sdunlock(bus->dhd);
+}
+
+#if defined(BCMSDIOH_TXGLOM) && defined(BCMSDIOH_STD)
+extern uint sd_txglom;
+#endif
+void
+dhd_txglom_enable(dhd_pub_t *dhdp, bool enable)
+{
+       /* can't enable host txglom by default, some platforms have no
+        * (or crappy) ADMA support and txglom will cause kernel assertions (e.g.
+        * panda board)
+        */
+       dhd_bus_t *bus = dhdp->bus;
+#ifdef BCMSDIOH_TXGLOM
+       char buf[256];
+       uint32 rxglom;
+       int32 ret;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+#ifdef BCMSDIOH_STD
+       if (enable)
+               enable = sd_txglom;
+#endif /* BCMSDIOH_STD */
+
+       if (enable) {
+               rxglom = 1;
+               memset(buf, 0, sizeof(buf));
+               bcm_mkiovar("bus:rxglom", (void *)&rxglom, 4, buf, sizeof(buf));
+               ret = dhd_wl_ioctl_cmd(dhdp, WLC_SET_VAR, buf, sizeof(buf), TRUE, 0);
+               if (ret >= 0)
+                       bus->txglom_enable = TRUE;
+               else {
+#ifdef BCMSDIOH_STD
+                       sd_txglom = 0;
+#endif /* BCMSDIOH_STD */
+                       bus->txglom_enable = FALSE;
+               }
+       } else
+#endif /* BCMSDIOH_TXGLOM */
+               bus->txglom_enable = FALSE;
+}
+
+int
+dhd_bus_init(dhd_pub_t *dhdp, bool enforce_mutex)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       dhd_timeout_t tmo;
+       uint retries = 0;
+       uint8 ready, enable;
+       int err, ret = 0;
+       uint8 saveclk;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       ASSERT(bus->dhd);
+       if (!bus->dhd)
+               return 0;
+
+       if (enforce_mutex)
+               dhd_os_sdlock(bus->dhd);
+
+       /* Make sure backplane clock is on, needed to generate F2 interrupt */
+       dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+       if (bus->clkstate != CLK_AVAIL) {
+               DHD_ERROR(("%s: clock state is wrong. state = %d\n", __FUNCTION__, bus->clkstate));
+               ret = -1;
+               goto exit;
+       }
+
+
+       /* Force clocks on backplane to be sure F2 interrupt propagates */
+       saveclk = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+       if (!err) {
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+                                (saveclk | SBSDIO_FORCE_HT), &err);
+       }
+       if (err) {
+               DHD_ERROR(("%s: Failed to force clock for F2: err %d\n", __FUNCTION__, err));
+               ret = -1;
+               goto exit;
+       }
+
+       /* Enable function 2 (frame transfers) */
+       W_SDREG((SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT),
+               &bus->regs->tosbmailboxdata, retries);
+       enable = (SDIO_FUNC_ENABLE_1 | SDIO_FUNC_ENABLE_2);
+
+       bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IOEN, enable, NULL);
+
+       /* Give the dongle some time to do its thing and set IOR2 */
+       dhd_timeout_start(&tmo, DHD_WAIT_F2RDY * 1000);
+
+       ready = 0;
+       while (ready != enable && !dhd_timeout_expired(&tmo))
+               ready = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IORDY, NULL);
+
+       DHD_ERROR(("%s: enable 0x%02x, ready 0x%02x (waited %uus)\n",
+                 __FUNCTION__, enable, ready, tmo.elapsed));
+
+
+       /* If F2 successfully enabled, set core and enable interrupts */
+       if (ready == enable) {
+               /* Make sure we're talking to the core. */
+               if (!(bus->regs = si_setcore(bus->sih, PCMCIA_CORE_ID, 0)))
+                       bus->regs = si_setcore(bus->sih, SDIOD_CORE_ID, 0);
+               ASSERT(bus->regs != NULL);
+
+               /* Set up the interrupt mask and enable interrupts */
+               bus->hostintmask = HOSTINTMASK;
+               /* corerev 4 could use the newer interrupt logic to detect the frames */
+               if ((bus->sih->buscoretype == SDIOD_CORE_ID) && (bus->sdpcmrev == 4) &&
+                       (bus->rxint_mode != SDIO_DEVICE_HMB_RXINT)) {
+                       bus->hostintmask &= ~I_HMB_FRAME_IND;
+                       bus->hostintmask |= I_XMTDATA_AVAIL;
+               }
+               W_SDREG(bus->hostintmask, &bus->regs->hostintmask, retries);
+
+               if (bus->sih->buscorerev < 15) {
+                       bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_WATERMARK,
+                               (uint8)watermark, &err);
+               }
+
+               /* Set bus state according to enable result */
+               dhdp->busstate = DHD_BUS_DATA;
+
+               /* Need to set fn2 block size to match fn1 block size.
+                * Requests to fn2 go thru fn1. *
+                * faltwig has this code contitioned with #if !BCMSPI_ANDROID.
+                * It would be cleaner to use the ->sdh->block_sz[fno] instead of
+                * 64, but this layer has no access to sdh types.
+                */
+
+               /* bcmsdh_intr_unmask(bus->sdh); */
+
+               bus->intdis = FALSE;
+               if (bus->intr) {
+                       DHD_INTR(("%s: enable SDIO device interrupts\n", __FUNCTION__));
+                       bcmsdh_intr_enable(bus->sdh);
+               } else {
+                       DHD_INTR(("%s: disable SDIO interrupts\n", __FUNCTION__));
+                       bcmsdh_intr_disable(bus->sdh);
+               }
+
+       }
+
+
+       else {
+               /* Disable F2 again */
+               enable = SDIO_FUNC_ENABLE_1;
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IOEN, enable, NULL);
+       }
+
+       if (dhdsdio_sr_cap(bus)) {
+               dhdsdio_sr_init(bus);
+               /* Masking the chip active interrupt  permanantly */
+               bus->hostintmask &= ~I_CHIPACTIVE;
+               W_SDREG(bus->hostintmask, &bus->regs->hostintmask, retries);
+               DHD_INFO(("%s: disable I_CHIPACTIVE in hostintmask[0x%08x]\n",
+               __FUNCTION__, bus->hostintmask));
+       }
+       else
+               bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1,
+                       SBSDIO_FUNC1_CHIPCLKCSR, saveclk, &err);
+
+       /* If we didn't come up, turn off backplane clock */
+       if (dhdp->busstate != DHD_BUS_DATA)
+               dhdsdio_clkctl(bus, CLK_NONE, FALSE);
+
+exit:
+       if (enforce_mutex)
+               dhd_os_sdunlock(bus->dhd);
+
+       return ret;
+}
+
+static void
+dhdsdio_rxfail(dhd_bus_t *bus, bool abort, bool rtx)
+{
+       bcmsdh_info_t *sdh = bus->sdh;
+       sdpcmd_regs_t *regs = bus->regs;
+       uint retries = 0;
+       uint16 lastrbc;
+       uint8 hi, lo;
+       int err;
+
+       DHD_ERROR(("%s: %sterminate frame%s\n", __FUNCTION__,
+                  (abort ? "abort command, " : ""), (rtx ? ", send NAK" : "")));
+
+       if (!KSO_ENAB(bus)) {
+               DHD_ERROR(("%s: Device asleep\n", __FUNCTION__));
+               return;
+       }
+
+       if (abort) {
+               bcmsdh_abort(sdh, SDIO_FUNC_2);
+       }
+
+       bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_FRAMECTRL, SFC_RF_TERM, &err);
+       if (err) {
+               DHD_ERROR(("%s: SBSDIO_FUNC1_FRAMECTRL cmd err\n", __FUNCTION__));
+               goto fail;
+       }
+       bus->f1regdata++;
+
+       /* Wait until the packet has been flushed (device/FIFO stable) */
+       for (lastrbc = retries = 0xffff; retries > 0; retries--) {
+               hi = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_RFRAMEBCHI, NULL);
+               lo = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_RFRAMEBCLO, &err);
+               if (err) {
+                       DHD_ERROR(("%s: SBSDIO_FUNC1_RFAMEBCLO cmd err\n", __FUNCTION__));
+                       goto fail;
+               }
+
+               bus->f1regdata += 2;
+
+               if ((hi == 0) && (lo == 0))
+                       break;
+
+               if ((hi > (lastrbc >> 8)) && (lo > (lastrbc & 0x00ff))) {
+                       DHD_ERROR(("%s: count growing: last 0x%04x now 0x%04x\n",
+                                  __FUNCTION__, lastrbc, ((hi << 8) + lo)));
+               }
+               lastrbc = (hi << 8) + lo;
+       }
+
+       if (!retries) {
+               DHD_ERROR(("%s: count never zeroed: last 0x%04x\n", __FUNCTION__, lastrbc));
+       } else {
+               DHD_INFO(("%s: flush took %d iterations\n", __FUNCTION__, (0xffff - retries)));
+       }
+
+       if (rtx) {
+               bus->rxrtx++;
+               W_SDREG(SMB_NAK, &regs->tosbmailbox, retries);
+               bus->f1regdata++;
+               if (retries <= retry_limit) {
+                       bus->rxskip = TRUE;
+               }
+       }
+
+       /* Clear partial in any case */
+       bus->nextlen = 0;
+
+fail:
+       /* If we can't reach the device, signal failure */
+       if (err || bcmsdh_regfail(sdh))
+               bus->dhd->busstate = DHD_BUS_DOWN;
+}
+
+static void
+dhdsdio_read_control(dhd_bus_t *bus, uint8 *hdr, uint len, uint doff)
+{
+       bcmsdh_info_t *sdh = bus->sdh;
+       uint rdlen, pad;
+
+       int sdret;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       /* Control data already received in aligned rxctl */
+       if ((bus->bus == SPI_BUS) && (!bus->usebufpool))
+               goto gotpkt;
+
+       ASSERT(bus->rxbuf);
+       /* Set rxctl for frame (w/optional alignment) */
+       bus->rxctl = bus->rxbuf;
+       if (dhd_alignctl) {
+               bus->rxctl += firstread;
+               if ((pad = ((uintptr)bus->rxctl % DHD_SDALIGN)))
+                       bus->rxctl += (DHD_SDALIGN - pad);
+               bus->rxctl -= firstread;
+       }
+       ASSERT(bus->rxctl >= bus->rxbuf);
+
+       /* Copy the already-read portion over */
+       bcopy(hdr, bus->rxctl, firstread);
+       if (len <= firstread)
+               goto gotpkt;
+
+       /* Copy the full data pkt in gSPI case and process ioctl. */
+       if (bus->bus == SPI_BUS) {
+               bcopy(hdr, bus->rxctl, len);
+               goto gotpkt;
+       }
+
+       /* Raise rdlen to next SDIO block to avoid tail command */
+       rdlen = len - firstread;
+       if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
+               pad = bus->blocksize - (rdlen % bus->blocksize);
+               if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
+                   ((len + pad) < bus->dhd->maxctl))
+                       rdlen += pad;
+       } else if (rdlen % DHD_SDALIGN) {
+               rdlen += DHD_SDALIGN - (rdlen % DHD_SDALIGN);
+       }
+
+       /* Satisfy length-alignment requirements */
+       if (forcealign && (rdlen & (ALIGNMENT - 1)))
+               rdlen = ROUNDUP(rdlen, ALIGNMENT);
+
+       /* Drop if the read is too big or it exceeds our maximum */
+       if ((rdlen + firstread) > bus->dhd->maxctl) {
+               DHD_ERROR(("%s: %d-byte control read exceeds %d-byte buffer\n",
+                          __FUNCTION__, rdlen, bus->dhd->maxctl));
+               bus->dhd->rx_errors++;
+               dhdsdio_rxfail(bus, FALSE, FALSE);
+               goto done;
+       }
+
+       if ((len - doff) > bus->dhd->maxctl) {
+               DHD_ERROR(("%s: %d-byte ctl frame (%d-byte ctl data) exceeds %d-byte limit\n",
+                          __FUNCTION__, len, (len - doff), bus->dhd->maxctl));
+               bus->dhd->rx_errors++; bus->rx_toolong++;
+               dhdsdio_rxfail(bus, FALSE, FALSE);
+               goto done;
+       }
+
+
+       /* Read remainder of frame body into the rxctl buffer */
+       sdret = dhd_bcmsdh_recv_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
+                                   (bus->rxctl + firstread), rdlen, NULL, NULL, NULL);
+       bus->f2rxdata++;
+       ASSERT(sdret != BCME_PENDING);
+
+       /* Control frame failures need retransmission */
+       if (sdret < 0) {
+               DHD_ERROR(("%s: read %d control bytes failed: %d\n", __FUNCTION__, rdlen, sdret));
+               bus->rxc_errors++; /* dhd.rx_ctlerrs is higher level */
+               dhdsdio_rxfail(bus, TRUE, TRUE);
+               goto done;
+       }
+
+gotpkt:
+
+#ifdef DHD_DEBUG
+       if (DHD_BYTES_ON() && DHD_CTL_ON()) {
+               prhex("RxCtrl", bus->rxctl, len);
+       }
+#endif
+
+       /* Point to valid data and indicate its length */
+       bus->rxctl += doff;
+       bus->rxlen = len - doff;
+
+done:
+       /* Awake any waiters */
+       dhd_os_ioctl_resp_wake(bus->dhd);
+}
+int
+dhd_process_pkt_reorder_info(dhd_pub_t *dhd, uchar *reorder_info_buf, uint reorder_info_len,
+       void **pkt, uint32 *pkt_count);
+
+static uint8
+dhdsdio_rxglom(dhd_bus_t *bus, uint8 rxseq)
+{
+       uint16 dlen, totlen;
+       uint8 *dptr, num = 0;
+
+       uint16 sublen, check;
+       void *pfirst, *plast, *pnext;
+       void * list_tail[DHD_MAX_IFS] = { NULL };
+       void * list_head[DHD_MAX_IFS] = { NULL };
+       uint8 idx;
+       osl_t *osh = bus->dhd->osh;
+
+       int errcode;
+       uint8 chan, seq, doff, sfdoff;
+       uint8 txmax;
+       uchar reorder_info_buf[WLHOST_REORDERDATA_TOTLEN];
+       uint reorder_info_len;
+
+       int ifidx = 0;
+       bool usechain = bus->use_rxchain;
+
+       /* If packets, issue read(s) and send up packet chain */
+       /* Return sequence numbers consumed? */
+
+       DHD_TRACE(("dhdsdio_rxglom: start: glomd %p glom %p\n", bus->glomd, bus->glom));
+
+       /* If there's a descriptor, generate the packet chain */
+       if (bus->glomd) {
+               dhd_os_sdlock_rxq(bus->dhd);
+
+               pfirst = plast = pnext = NULL;
+               dlen = (uint16)PKTLEN(osh, bus->glomd);
+               dptr = PKTDATA(osh, bus->glomd);
+               if (!dlen || (dlen & 1)) {
+                       DHD_ERROR(("%s: bad glomd len (%d), ignore descriptor\n",
+                                  __FUNCTION__, dlen));
+                       dlen = 0;
+               }
+
+               for (totlen = num = 0; dlen; num++) {
+                       /* Get (and move past) next length */
+                       sublen = ltoh16_ua(dptr);
+                       dlen -= sizeof(uint16);
+                       dptr += sizeof(uint16);
+                       if ((sublen < SDPCM_HDRLEN) ||
+                           ((num == 0) && (sublen < (2 * SDPCM_HDRLEN)))) {
+                               DHD_ERROR(("%s: descriptor len %d bad: %d\n",
+                                          __FUNCTION__, num, sublen));
+                               pnext = NULL;
+                               break;
+                       }
+                       if (sublen % DHD_SDALIGN) {
+                               DHD_ERROR(("%s: sublen %d not a multiple of %d\n",
+                                          __FUNCTION__, sublen, DHD_SDALIGN));
+                               usechain = FALSE;
+                       }
+                       totlen += sublen;
+
+                       /* For last frame, adjust read len so total is a block multiple */
+                       if (!dlen) {
+                               sublen += (ROUNDUP(totlen, bus->blocksize) - totlen);
+                               totlen = ROUNDUP(totlen, bus->blocksize);
+                       }
+
+                       /* Allocate/chain packet for next subframe */
+                       if ((pnext = PKTGET(osh, sublen + DHD_SDALIGN, FALSE)) == NULL) {
+                               DHD_ERROR(("%s: PKTGET failed, num %d len %d\n",
+                                          __FUNCTION__, num, sublen));
+                               break;
+                       }
+                       ASSERT(!PKTLINK(pnext));
+                       if (!pfirst) {
+                               ASSERT(!plast);
+                               pfirst = plast = pnext;
+                       } else {
+                               ASSERT(plast);
+                               PKTSETNEXT(osh, plast, pnext);
+                               plast = pnext;
+                       }
+
+                       /* Adhere to start alignment requirements */
+                       PKTALIGN(osh, pnext, sublen, DHD_SDALIGN);
+               }
+
+               /* If all allocations succeeded, save packet chain in bus structure */
+               if (pnext) {
+                       DHD_GLOM(("%s: allocated %d-byte packet chain for %d subframes\n",
+                                 __FUNCTION__, totlen, num));
+                       if (DHD_GLOM_ON() && bus->nextlen) {
+                               if (totlen != bus->nextlen) {
+                                       DHD_GLOM(("%s: glomdesc mismatch: nextlen %d glomdesc %d "
+                                                 "rxseq %d\n", __FUNCTION__, bus->nextlen,
+                                                 totlen, rxseq));
+                               }
+                       }
+                       bus->glom = pfirst;
+                       pfirst = pnext = NULL;
+               } else {
+                       if (pfirst)
+                               PKTFREE(osh, pfirst, FALSE);
+                       bus->glom = NULL;
+                       num = 0;
+               }
+
+               /* Done with descriptor packet */
+               PKTFREE(osh, bus->glomd, FALSE);
+               bus->glomd = NULL;
+               bus->nextlen = 0;
+
+               dhd_os_sdunlock_rxq(bus->dhd);
+       }
+
+       /* Ok -- either we just generated a packet chain, or had one from before */
+       if (bus->glom) {
+               if (DHD_GLOM_ON()) {
+                       DHD_GLOM(("%s: attempt superframe read, packet chain:\n", __FUNCTION__));
+                       for (pnext = bus->glom; pnext; pnext = PKTNEXT(osh, pnext)) {
+                               DHD_GLOM(("    %p: %p len 0x%04x (%d)\n",
+                                         pnext, (uint8*)PKTDATA(osh, pnext),
+                                         PKTLEN(osh, pnext), PKTLEN(osh, pnext)));
+                       }
+               }
+
+               pfirst = bus->glom;
+               dlen = (uint16)pkttotlen(osh, pfirst);
+
+               /* Do an SDIO read for the superframe.  Configurable iovar to
+                * read directly into the chained packet, or allocate a large
+                * packet and and copy into the chain.
+                */
+               if (usechain) {
+                       errcode = dhd_bcmsdh_recv_buf(bus,
+                                                     bcmsdh_cur_sbwad(bus->sdh), SDIO_FUNC_2,
+                                                     F2SYNC, (uint8*)PKTDATA(osh, pfirst),
+                                                     dlen, pfirst, NULL, NULL);
+               } else if (bus->dataptr) {
+                       errcode = dhd_bcmsdh_recv_buf(bus,
+                                                     bcmsdh_cur_sbwad(bus->sdh), SDIO_FUNC_2,
+                                                     F2SYNC, bus->dataptr,
+                                                     dlen, NULL, NULL, NULL);
+                       sublen = (uint16)pktfrombuf(osh, pfirst, 0, dlen, bus->dataptr);
+                       if (sublen != dlen) {
+                               DHD_ERROR(("%s: FAILED TO COPY, dlen %d sublen %d\n",
+                                          __FUNCTION__, dlen, sublen));
+                               errcode = -1;
+                       }
+                       pnext = NULL;
+               } else {
+                       DHD_ERROR(("COULDN'T ALLOC %d-BYTE GLOM, FORCE FAILURE\n", dlen));
+                       errcode = -1;
+               }
+               bus->f2rxdata++;
+               ASSERT(errcode != BCME_PENDING);
+
+               /* On failure, kill the superframe, allow a couple retries */
+               if (errcode < 0) {
+                       DHD_ERROR(("%s: glom read of %d bytes failed: %d\n",
+                                  __FUNCTION__, dlen, errcode));
+                       bus->dhd->rx_errors++;
+
+                       if (bus->glomerr++ < 3) {
+                               dhdsdio_rxfail(bus, TRUE, TRUE);
+                       } else {
+                               bus->glomerr = 0;
+                               dhdsdio_rxfail(bus, TRUE, FALSE);
+                               dhd_os_sdlock_rxq(bus->dhd);
+                               PKTFREE(osh, bus->glom, FALSE);
+                               dhd_os_sdunlock_rxq(bus->dhd);
+                               bus->rxglomfail++;
+                               bus->glom = NULL;
+                       }
+                       return 0;
+               }
+
+#ifdef DHD_DEBUG
+               if (DHD_GLOM_ON()) {
+                       prhex("SUPERFRAME", PKTDATA(osh, pfirst),
+                             MIN(PKTLEN(osh, pfirst), 48));
+               }
+#endif
+
+
+               /* Validate the superframe header */
+               dptr = (uint8 *)PKTDATA(osh, pfirst);
+               sublen = ltoh16_ua(dptr);
+               check = ltoh16_ua(dptr + sizeof(uint16));
+
+               chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
+               seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
+               bus->nextlen = dptr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
+               if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
+                       DHD_INFO(("%s: got frame w/nextlen too large (%d) seq %d\n",
+                                 __FUNCTION__, bus->nextlen, seq));
+                       bus->nextlen = 0;
+               }
+               doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
+               txmax = SDPCM_WINDOW_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
+
+               errcode = 0;
+               if ((uint16)~(sublen^check)) {
+                       DHD_ERROR(("%s (superframe): HW hdr error: len/check 0x%04x/0x%04x\n",
+                                  __FUNCTION__, sublen, check));
+                       errcode = -1;
+               } else if (ROUNDUP(sublen, bus->blocksize) != dlen) {
+                       DHD_ERROR(("%s (superframe): len 0x%04x, rounded 0x%04x, expect 0x%04x\n",
+                                  __FUNCTION__, sublen, ROUNDUP(sublen, bus->blocksize), dlen));
+                       errcode = -1;
+               } else if (SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]) != SDPCM_GLOM_CHANNEL) {
+                       DHD_ERROR(("%s (superframe): bad channel %d\n", __FUNCTION__,
+                                  SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN])));
+                       errcode = -1;
+               } else if (SDPCM_GLOMDESC(&dptr[SDPCM_FRAMETAG_LEN])) {
+                       DHD_ERROR(("%s (superframe): got second descriptor?\n", __FUNCTION__));
+                       errcode = -1;
+               } else if ((doff < SDPCM_HDRLEN) ||
+                          (doff > (PKTLEN(osh, pfirst) - SDPCM_HDRLEN))) {
+                       DHD_ERROR(("%s (superframe): Bad data offset %d: HW %d pkt %d min %d\n",
+                               __FUNCTION__, doff, sublen, PKTLEN(osh, pfirst),
+                               SDPCM_HDRLEN));
+                       errcode = -1;
+               }
+
+               /* Check sequence number of superframe SW header */
+               if (rxseq != seq) {
+                       DHD_INFO(("%s: (superframe) rx_seq %d, expected %d\n",
+                                 __FUNCTION__, seq, rxseq));
+                       bus->rx_badseq++;
+                       rxseq = seq;
+               }
+
+               /* Check window for sanity */
+               if ((uint8)(txmax - bus->tx_seq) > 0x70) {
+                       DHD_ERROR(("%s: got unlikely tx max %d with tx_seq %d\n",
+                                  __FUNCTION__, txmax, bus->tx_seq));
+                       txmax = bus->tx_max;
+               }
+               bus->tx_max = txmax;
+
+               /* Remove superframe header, remember offset */
+               PKTPULL(osh, pfirst, doff);
+               sfdoff = doff;
+
+               /* Validate all the subframe headers */
+               for (num = 0, pnext = pfirst; pnext && !errcode;
+                    num++, pnext = PKTNEXT(osh, pnext)) {
+                       dptr = (uint8 *)PKTDATA(osh, pnext);
+                       dlen = (uint16)PKTLEN(osh, pnext);
+                       sublen = ltoh16_ua(dptr);
+                       check = ltoh16_ua(dptr + sizeof(uint16));
+                       chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
+                       doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
+#ifdef DHD_DEBUG
+                       if (DHD_GLOM_ON()) {
+                               prhex("subframe", dptr, 32);
+                       }
+#endif
+
+                       if ((uint16)~(sublen^check)) {
+                               DHD_ERROR(("%s (subframe %d): HW hdr error: "
+                                          "len/check 0x%04x/0x%04x\n",
+                                          __FUNCTION__, num, sublen, check));
+                               errcode = -1;
+                       } else if ((sublen > dlen) || (sublen < SDPCM_HDRLEN)) {
+                               DHD_ERROR(("%s (subframe %d): length mismatch: "
+                                          "len 0x%04x, expect 0x%04x\n",
+                                          __FUNCTION__, num, sublen, dlen));
+                               errcode = -1;
+                       } else if ((chan != SDPCM_DATA_CHANNEL) &&
+                                  (chan != SDPCM_EVENT_CHANNEL)) {
+                               DHD_ERROR(("%s (subframe %d): bad channel %d\n",
+                                          __FUNCTION__, num, chan));
+                               errcode = -1;
+                       } else if ((doff < SDPCM_HDRLEN) || (doff > sublen)) {
+                               DHD_ERROR(("%s (subframe %d): Bad data offset %d: HW %d min %d\n",
+                                          __FUNCTION__, num, doff, sublen, SDPCM_HDRLEN));
+                               errcode = -1;
+                       }
+               }
+
+               if (errcode) {
+                       /* Terminate frame on error, request a couple retries */
+                       if (bus->glomerr++ < 3) {
+                               /* Restore superframe header space */
+                               PKTPUSH(osh, pfirst, sfdoff);
+                               dhdsdio_rxfail(bus, TRUE, TRUE);
+                       } else {
+                               bus->glomerr = 0;
+                               dhdsdio_rxfail(bus, TRUE, FALSE);
+                               dhd_os_sdlock_rxq(bus->dhd);
+                               PKTFREE(osh, bus->glom, FALSE);
+                               dhd_os_sdunlock_rxq(bus->dhd);
+                               bus->rxglomfail++;
+                               bus->glom = NULL;
+                       }
+                       bus->nextlen = 0;
+                       return 0;
+               }
+
+               /* Basic SD framing looks ok - process each packet (header) */
+               bus->glom = NULL;
+               plast = NULL;
+
+               dhd_os_sdlock_rxq(bus->dhd);
+               for (num = 0; pfirst; rxseq++, pfirst = pnext) {
+                       pnext = PKTNEXT(osh, pfirst);
+                       PKTSETNEXT(osh, pfirst, NULL);
+
+                       dptr = (uint8 *)PKTDATA(osh, pfirst);
+                       sublen = ltoh16_ua(dptr);
+                       chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
+                       seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
+                       doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
+
+                       DHD_GLOM(("%s: Get subframe %d, %p(%p/%d), sublen %d chan %d seq %d\n",
+                                 __FUNCTION__, num, pfirst, PKTDATA(osh, pfirst),
+                                 PKTLEN(osh, pfirst), sublen, chan, seq));
+
+                       ASSERT((chan == SDPCM_DATA_CHANNEL) || (chan == SDPCM_EVENT_CHANNEL));
+
+                       if (rxseq != seq) {
+                               DHD_GLOM(("%s: rx_seq %d, expected %d\n",
+                                         __FUNCTION__, seq, rxseq));
+                               bus->rx_badseq++;
+                               rxseq = seq;
+                       }
+
+#ifdef DHD_DEBUG
+                       if (DHD_BYTES_ON() && DHD_DATA_ON()) {
+                               prhex("Rx Subframe Data", dptr, dlen);
+                       }
+#endif
+
+                       PKTSETLEN(osh, pfirst, sublen);
+                       PKTPULL(osh, pfirst, doff);
+
+                       reorder_info_len = sizeof(reorder_info_buf);
+
+                       if (PKTLEN(osh, pfirst) == 0) {
+                               PKTFREE(bus->dhd->osh, pfirst, FALSE);
+                               continue;
+                       } else if (dhd_prot_hdrpull(bus->dhd, &ifidx, pfirst, reorder_info_buf,
+                               &reorder_info_len) != 0) {
+                               DHD_ERROR(("%s: rx protocol error\n", __FUNCTION__));
+                               bus->dhd->rx_errors++;
+                               PKTFREE(osh, pfirst, FALSE);
+                               continue;
+                       }
+                       if (reorder_info_len) {
+                               uint32 free_buf_count;
+                               void *ppfirst;
+
+                               ppfirst = pfirst;
+                               /* Reordering info from the firmware */
+                               dhd_process_pkt_reorder_info(bus->dhd, reorder_info_buf,
+                                       reorder_info_len, &ppfirst, &free_buf_count);
+
+                               if (free_buf_count == 0) {
+                                       continue;
+                               }
+                               else {
+                                       void *temp;
+
+                                       /*  go to the end of the chain and attach the pnext there */
+                                       temp = ppfirst;
+                                       while (PKTNEXT(osh, temp) != NULL) {
+                                               temp = PKTNEXT(osh, temp);
+                                       }
+                                       pfirst = temp;
+                                       if (list_tail[ifidx] == NULL)
+                                               list_head[ifidx] = ppfirst;
+                                       else
+                                               PKTSETNEXT(osh, list_tail[ifidx], ppfirst);
+                                       list_tail[ifidx] = pfirst;
+                               }
+
+                               num += (uint8)free_buf_count;
+                       }
+                       else {
+                               /* this packet will go up, link back into chain and count it */
+
+                               if (list_tail[ifidx] == NULL) {
+                                       list_head[ifidx] = list_tail[ifidx] = pfirst;
+                               }
+                               else {
+                                       PKTSETNEXT(osh, list_tail[ifidx], pfirst);
+                                       list_tail[ifidx] = pfirst;
+                               }
+                               num++;
+                       }
+#ifdef DHD_DEBUG
+                       if (DHD_GLOM_ON()) {
+                               DHD_GLOM(("%s subframe %d to stack, %p(%p/%d) nxt/lnk %p/%p\n",
+                                         __FUNCTION__, num, pfirst,
+                                         PKTDATA(osh, pfirst), PKTLEN(osh, pfirst),
+                                         PKTNEXT(osh, pfirst), PKTLINK(pfirst)));
+                               prhex("", (uint8 *)PKTDATA(osh, pfirst),
+                                     MIN(PKTLEN(osh, pfirst), 32));
+                       }
+#endif /* DHD_DEBUG */
+               }
+               dhd_os_sdunlock_rxq(bus->dhd);
+
+               for (idx = 0; idx < DHD_MAX_IFS; idx++) {
+                       if (list_head[idx]) {
+                               void *temp;
+                               uint8 cnt = 0;
+                               temp = list_head[idx];
+                               do {
+                                       temp = PKTNEXT(osh, temp);
+                                       cnt++;
+                               } while (temp);
+                               if (cnt) {
+                                       dhd_os_sdunlock(bus->dhd);
+                                       dhd_rx_frame(bus->dhd, idx, list_head[idx], cnt, 0);
+                                       dhd_os_sdlock(bus->dhd);
+                               }
+                       }
+               }
+               bus->rxglomframes++;
+               bus->rxglompkts += num;
+       }
+       return num;
+}
+
+
+/* Return TRUE if there may be more frames to read */
+static uint
+dhdsdio_readframes(dhd_bus_t *bus, uint maxframes, bool *finished)
+{
+       osl_t *osh = bus->dhd->osh;
+       bcmsdh_info_t *sdh = bus->sdh;
+
+       uint16 len, check;      /* Extracted hardware header fields */
+       uint8 chan, seq, doff;  /* Extracted software header fields */
+       uint8 fcbits;           /* Extracted fcbits from software header */
+       uint8 delta;
+
+       void *pkt;      /* Packet for event or data frames */
+       uint16 pad;     /* Number of pad bytes to read */
+       uint16 rdlen;   /* Total number of bytes to read */
+       uint8 rxseq;    /* Next sequence number to expect */
+       uint rxleft = 0;        /* Remaining number of frames allowed */
+       int sdret;      /* Return code from bcmsdh calls */
+       uint8 txmax;    /* Maximum tx sequence offered */
+       bool len_consistent; /* Result of comparing readahead len and len from hw-hdr */
+       uint8 *rxbuf;
+       int ifidx = 0;
+       uint rxcount = 0; /* Total frames read */
+       uchar reorder_info_buf[WLHOST_REORDERDATA_TOTLEN];
+       uint reorder_info_len;
+       uint pkt_count;
+
+#if defined(DHD_DEBUG) || defined(SDTEST)
+       bool sdtest = FALSE;    /* To limit message spew from test mode */
+#endif
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       bus->readframes = TRUE;
+
+       if (!KSO_ENAB(bus)) {
+               DHD_ERROR(("%s: KSO off\n", __FUNCTION__));
+               bus->readframes = FALSE;
+               return 0;
+       }
+
+       ASSERT(maxframes);
+
+#ifdef SDTEST
+       /* Allow pktgen to override maxframes */
+       if (bus->pktgen_count && (bus->pktgen_mode == DHD_PKTGEN_RECV)) {
+               maxframes = bus->pktgen_count;
+               sdtest = TRUE;
+       }
+#endif
+
+       /* Not finished unless we encounter no more frames indication */
+       *finished = FALSE;
+
+
+       for (rxseq = bus->rx_seq, rxleft = maxframes;
+            !bus->rxskip && rxleft && bus->dhd->busstate != DHD_BUS_DOWN;
+            rxseq++, rxleft--) {
+#ifdef DHDTCPACK_SUP_DBG
+               if (bus->dhd->tcpack_sup_mode != TCPACK_SUP_DELAYTX) {
+                       if (bus->dotxinrx == FALSE)
+                               DHD_ERROR(("%s %d: dotxinrx FALSE with tcpack_sub_mode %d\n",
+                                       __FUNCTION__, __LINE__, bus->dhd->tcpack_sup_mode));
+               }
+#ifdef DEBUG_COUNTER
+               else if (pktq_mlen(&bus->txq, ~bus->flowcontrol) > 0) {
+                       tack_tbl.cnt[bus->dotxinrx ? 6 : 7]++;
+               }
+#endif /* DEBUG_COUNTER */
+#endif /* DHDTCPACK_SUP_DBG */
+               /* tx more to improve rx performance */
+               if (TXCTLOK(bus) && bus->ctrl_frame_stat && (bus->clkstate == CLK_AVAIL)) {
+                       dhdsdio_sendpendctl(bus);
+               } else if (bus->dotxinrx && (bus->clkstate == CLK_AVAIL) &&
+                       !bus->fcstate && DATAOK(bus) &&
+                       (pktq_mlen(&bus->txq, ~bus->flowcontrol) > bus->txinrx_thres)) {
+                       dhdsdio_sendfromq(bus, dhd_txbound);
+#ifdef DHDTCPACK_SUPPRESS
+                       /* In TCPACK_SUP_DELAYTX mode, do txinrx only if
+                        * 1. Any DATA packet to TX
+                        * 2. TCPACK to TCPDATA PSH packets.
+                        * in bus txq.
+                        */
+                       bus->dotxinrx = (bus->dhd->tcpack_sup_mode == TCPACK_SUP_DELAYTX) ?
+                               FALSE : TRUE;
+#endif
+               }
+
+               /* Handle glomming separately */
+               if (bus->glom || bus->glomd) {
+                       uint8 cnt;
+                       DHD_GLOM(("%s: calling rxglom: glomd %p, glom %p\n",
+                                 __FUNCTION__, bus->glomd, bus->glom));
+                       cnt = dhdsdio_rxglom(bus, rxseq);
+                       DHD_GLOM(("%s: rxglom returned %d\n", __FUNCTION__, cnt));
+                       rxseq += cnt - 1;
+                       rxleft = (rxleft > cnt) ? (rxleft - cnt) : 1;
+                       continue;
+               }
+
+               /* Try doing single read if we can */
+               if (dhd_readahead && bus->nextlen) {
+                       uint16 nextlen = bus->nextlen;
+                       bus->nextlen = 0;
+
+                       if (bus->bus == SPI_BUS) {
+                               rdlen = len = nextlen;
+                       }
+                       else {
+                               rdlen = len = nextlen << 4;
+
+                               /* Pad read to blocksize for efficiency */
+                               if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
+                                       pad = bus->blocksize - (rdlen % bus->blocksize);
+                                       if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
+                                               ((rdlen + pad + firstread) < MAX_RX_DATASZ))
+                                               rdlen += pad;
+                               } else if (rdlen % DHD_SDALIGN) {
+                                       rdlen += DHD_SDALIGN - (rdlen % DHD_SDALIGN);
+                               }
+                       }
+
+                       /* We use bus->rxctl buffer in WinXP for initial control pkt receives.
+                        * Later we use buffer-poll for data as well as control packets.
+                        * This is required because dhd receives full frame in gSPI unlike SDIO.
+                        * After the frame is received we have to distinguish whether it is data
+                        * or non-data frame.
+                        */
+                       /* Allocate a packet buffer */
+                       dhd_os_sdlock_rxq(bus->dhd);
+                       if (!(pkt = PKTGET(osh, rdlen + DHD_SDALIGN, FALSE))) {
+                               if (bus->bus == SPI_BUS) {
+                                       bus->usebufpool = FALSE;
+                                       bus->rxctl = bus->rxbuf;
+                                       if (dhd_alignctl) {
+                                               bus->rxctl += firstread;
+                                               if ((pad = ((uintptr)bus->rxctl % DHD_SDALIGN)))
+                                                       bus->rxctl += (DHD_SDALIGN - pad);
+                                               bus->rxctl -= firstread;
+                                       }
+                                       ASSERT(bus->rxctl >= bus->rxbuf);
+                                       rxbuf = bus->rxctl;
+                                       /* Read the entire frame */
+                                       sdret = dhd_bcmsdh_recv_buf(bus,
+                                                                   bcmsdh_cur_sbwad(sdh),
+                                                                   SDIO_FUNC_2,
+                                                                   F2SYNC, rxbuf, rdlen,
+                                                                   NULL, NULL, NULL);
+                                       bus->f2rxdata++;
+                                       ASSERT(sdret != BCME_PENDING);
+
+
+                                       /* Control frame failures need retransmission */
+                                       if (sdret < 0) {
+                                               DHD_ERROR(("%s: read %d control bytes failed: %d\n",
+                                                  __FUNCTION__, rdlen, sdret));
+                                               /* dhd.rx_ctlerrs is higher level */
+                                               bus->rxc_errors++;
+                                               dhd_os_sdunlock_rxq(bus->dhd);
+                                               dhdsdio_rxfail(bus, TRUE,
+                                                   (bus->bus == SPI_BUS) ? FALSE : TRUE);
+                                               continue;
+                                       }
+                               } else {
+                                       /* Give up on data, request rtx of events */
+                                       DHD_ERROR(("%s (nextlen): PKTGET failed: len %d rdlen %d "
+                                                  "expected rxseq %d\n",
+                                                  __FUNCTION__, len, rdlen, rxseq));
+                                       /* Just go try again w/normal header read */
+                                       dhd_os_sdunlock_rxq(bus->dhd);
+                                       continue;
+                               }
+                       } else {
+                               if (bus->bus == SPI_BUS)
+                                       bus->usebufpool = TRUE;
+
+                               ASSERT(!PKTLINK(pkt));
+                               PKTALIGN(osh, pkt, rdlen, DHD_SDALIGN);
+                               rxbuf = (uint8 *)PKTDATA(osh, pkt);
+                               /* Read the entire frame */
+                               sdret = dhd_bcmsdh_recv_buf(bus, bcmsdh_cur_sbwad(sdh),
+                                                           SDIO_FUNC_2,
+                                                           F2SYNC, rxbuf, rdlen,
+                                                           pkt, NULL, NULL);
+                               bus->f2rxdata++;
+                               ASSERT(sdret != BCME_PENDING);
+
+                               if (sdret < 0) {
+                                       DHD_ERROR(("%s (nextlen): read %d bytes failed: %d\n",
+                                          __FUNCTION__, rdlen, sdret));
+                                       PKTFREE(bus->dhd->osh, pkt, FALSE);
+                                       bus->dhd->rx_errors++;
+                                       dhd_os_sdunlock_rxq(bus->dhd);
+                                       /* Force retry w/normal header read.  Don't attempt NAK for
+                                        * gSPI
+                                        */
+                                       dhdsdio_rxfail(bus, TRUE,
+                                             (bus->bus == SPI_BUS) ? FALSE : TRUE);
+                                       continue;
+                               }
+                       }
+                       dhd_os_sdunlock_rxq(bus->dhd);
+
+                       /* Now check the header */
+                       bcopy(rxbuf, bus->rxhdr, SDPCM_HDRLEN);
+
+                       /* Extract hardware header fields */
+                       len = ltoh16_ua(bus->rxhdr);
+                       check = ltoh16_ua(bus->rxhdr + sizeof(uint16));
+
+                       /* All zeros means readahead info was bad */
+                       if (!(len|check)) {
+                               DHD_INFO(("%s (nextlen): read zeros in HW header???\n",
+                                          __FUNCTION__));
+                               dhd_os_sdlock_rxq(bus->dhd);
+                               PKTFREE2();
+                               dhd_os_sdunlock_rxq(bus->dhd);
+                               GSPI_PR55150_BAILOUT;
+                               continue;
+                       }
+
+                       /* Validate check bytes */
+                       if ((uint16)~(len^check)) {
+                               DHD_ERROR(("%s (nextlen): HW hdr error: nextlen/len/check"
+                                          " 0x%04x/0x%04x/0x%04x\n", __FUNCTION__, nextlen,
+                                          len, check));
+                               dhd_os_sdlock_rxq(bus->dhd);
+                               PKTFREE2();
+                               dhd_os_sdunlock_rxq(bus->dhd);
+                               bus->rx_badhdr++;
+                               dhdsdio_rxfail(bus, FALSE, FALSE);
+                               GSPI_PR55150_BAILOUT;
+                               continue;
+                       }
+
+                       /* Validate frame length */
+                       if (len < SDPCM_HDRLEN) {
+                               DHD_ERROR(("%s (nextlen): HW hdr length invalid: %d\n",
+                                          __FUNCTION__, len));
+                               dhd_os_sdlock_rxq(bus->dhd);
+                               PKTFREE2();
+                               dhd_os_sdunlock_rxq(bus->dhd);
+                               GSPI_PR55150_BAILOUT;
+                               continue;
+                       }
+
+                       /* Check for consistency with readahead info */
+                               len_consistent = (nextlen != (ROUNDUP(len, 16) >> 4));
+                       if (len_consistent) {
+                               /* Mismatch, force retry w/normal header (may be >4K) */
+                               DHD_ERROR(("%s (nextlen): mismatch, nextlen %d len %d rnd %d; "
+                                          "expected rxseq %d\n",
+                                          __FUNCTION__, nextlen, len, ROUNDUP(len, 16), rxseq));
+                               dhd_os_sdlock_rxq(bus->dhd);
+                               PKTFREE2();
+                               dhd_os_sdunlock_rxq(bus->dhd);
+                               dhdsdio_rxfail(bus, TRUE, (bus->bus == SPI_BUS) ? FALSE : TRUE);
+                               GSPI_PR55150_BAILOUT;
+                               continue;
+                       }
+
+
+                       /* Extract software header fields */
+                       chan = SDPCM_PACKET_CHANNEL(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+                       seq = SDPCM_PACKET_SEQUENCE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+                       doff = SDPCM_DOFFSET_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+                       txmax = SDPCM_WINDOW_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+
+                               bus->nextlen =
+                                        bus->rxhdr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
+                               if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
+                                       DHD_INFO(("%s (nextlen): got frame w/nextlen too large"
+                                                 " (%d), seq %d\n", __FUNCTION__, bus->nextlen,
+                                                 seq));
+                                       bus->nextlen = 0;
+                               }
+
+                               bus->dhd->rx_readahead_cnt ++;
+                       /* Handle Flow Control */
+                       fcbits = SDPCM_FCMASK_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+
+                       delta = 0;
+                       if (~bus->flowcontrol & fcbits) {
+                               bus->fc_xoff++;
+                               delta = 1;
+                       }
+                       if (bus->flowcontrol & ~fcbits) {
+                               bus->fc_xon++;
+                               delta = 1;
+                       }
+
+                       if (delta) {
+                               bus->fc_rcvd++;
+                               bus->flowcontrol = fcbits;
+                       }
+
+                       /* Check and update sequence number */
+                       if (rxseq != seq) {
+                               DHD_INFO(("%s (nextlen): rx_seq %d, expected %d\n",
+                                         __FUNCTION__, seq, rxseq));
+                               bus->rx_badseq++;
+                               rxseq = seq;
+                       }
+
+                       /* Check window for sanity */
+                       if ((uint8)(txmax - bus->tx_seq) > 0x70) {
+                                       DHD_ERROR(("%s: got unlikely tx max %d with tx_seq %d\n",
+                                               __FUNCTION__, txmax, bus->tx_seq));
+                                       txmax = bus->tx_max;
+                       }
+                       bus->tx_max = txmax;
+
+#ifdef DHD_DEBUG
+                       if (DHD_BYTES_ON() && DHD_DATA_ON()) {
+                               prhex("Rx Data", rxbuf, len);
+                       } else if (DHD_HDRS_ON()) {
+                               prhex("RxHdr", bus->rxhdr, SDPCM_HDRLEN);
+                       }
+#endif
+
+                       if (chan == SDPCM_CONTROL_CHANNEL) {
+                               if (bus->bus == SPI_BUS) {
+                                       dhdsdio_read_control(bus, rxbuf, len, doff);
+                                       if (bus->usebufpool) {
+                                               dhd_os_sdlock_rxq(bus->dhd);
+                                               PKTFREE(bus->dhd->osh, pkt, FALSE);
+                                               dhd_os_sdunlock_rxq(bus->dhd);
+                                       }
+                                       continue;
+                               } else {
+                                       DHD_ERROR(("%s (nextlen): readahead on control"
+                                                  " packet %d?\n", __FUNCTION__, seq));
+                                       /* Force retry w/normal header read */
+                                       bus->nextlen = 0;
+                                       dhdsdio_rxfail(bus, FALSE, TRUE);
+                                       dhd_os_sdlock_rxq(bus->dhd);
+                                       PKTFREE2();
+                                       dhd_os_sdunlock_rxq(bus->dhd);
+                                       continue;
+                               }
+                       }
+
+                       if ((bus->bus == SPI_BUS) && !bus->usebufpool) {
+                               DHD_ERROR(("Received %d bytes on %d channel. Running out of "
+                                          "rx pktbuf's or not yet malloced.\n", len, chan));
+                               continue;
+                       }
+
+                       /* Validate data offset */
+                       if ((doff < SDPCM_HDRLEN) || (doff > len)) {
+                               DHD_ERROR(("%s (nextlen): bad data offset %d: HW len %d min %d\n",
+                                          __FUNCTION__, doff, len, SDPCM_HDRLEN));
+                               dhd_os_sdlock_rxq(bus->dhd);
+                               PKTFREE2();
+                               dhd_os_sdunlock_rxq(bus->dhd);
+                               ASSERT(0);
+                               dhdsdio_rxfail(bus, FALSE, FALSE);
+                               continue;
+                       }
+
+                       /* All done with this one -- now deliver the packet */
+                       goto deliver;
+               }
+               /* gSPI frames should not be handled in fractions */
+               if (bus->bus == SPI_BUS) {
+                       break;
+               }
+
+               /* Read frame header (hardware and software) */
+               sdret = dhd_bcmsdh_recv_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
+                                           bus->rxhdr, firstread, NULL, NULL, NULL);
+               bus->f2rxhdrs++;
+               ASSERT(sdret != BCME_PENDING);
+
+               if (sdret < 0) {
+                       DHD_ERROR(("%s: RXHEADER FAILED: %d\n", __FUNCTION__, sdret));
+                       bus->rx_hdrfail++;
+                       dhdsdio_rxfail(bus, TRUE, TRUE);
+                       continue;
+               }
+
+#ifdef DHD_DEBUG
+               if (DHD_BYTES_ON() || DHD_HDRS_ON()) {
+                       prhex("RxHdr", bus->rxhdr, SDPCM_HDRLEN);
+               }
+#endif
+
+               /* Extract hardware header fields */
+               len = ltoh16_ua(bus->rxhdr);
+               check = ltoh16_ua(bus->rxhdr + sizeof(uint16));
+
+               /* All zeros means no more frames */
+               if (!(len|check)) {
+                       *finished = TRUE;
+                       break;
+               }
+
+               /* Validate check bytes */
+               if ((uint16)~(len^check)) {
+                       DHD_ERROR(("%s: HW hdr error: len/check 0x%04x/0x%04x\n",
+                                  __FUNCTION__, len, check));
+                       bus->rx_badhdr++;
+                       dhdsdio_rxfail(bus, FALSE, FALSE);
+                       continue;
+               }
+
+               /* Validate frame length */
+               if (len < SDPCM_HDRLEN) {
+                       DHD_ERROR(("%s: HW hdr length invalid: %d\n", __FUNCTION__, len));
+                       continue;
+               }
+
+               /* Extract software header fields */
+               chan = SDPCM_PACKET_CHANNEL(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+               seq = SDPCM_PACKET_SEQUENCE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+               doff = SDPCM_DOFFSET_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+               txmax = SDPCM_WINDOW_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+
+               /* Validate data offset */
+               if ((doff < SDPCM_HDRLEN) || (doff > len)) {
+                       DHD_ERROR(("%s: Bad data offset %d: HW len %d, min %d seq %d\n",
+                                  __FUNCTION__, doff, len, SDPCM_HDRLEN, seq));
+                       bus->rx_badhdr++;
+                       ASSERT(0);
+                       dhdsdio_rxfail(bus, FALSE, FALSE);
+                       continue;
+               }
+
+               /* Save the readahead length if there is one */
+               bus->nextlen = bus->rxhdr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
+               if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
+                       DHD_INFO(("%s (nextlen): got frame w/nextlen too large (%d), seq %d\n",
+                                 __FUNCTION__, bus->nextlen, seq));
+                       bus->nextlen = 0;
+               }
+
+               /* Handle Flow Control */
+               fcbits = SDPCM_FCMASK_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+
+               delta = 0;
+               if (~bus->flowcontrol & fcbits) {
+                       bus->fc_xoff++;
+                       delta = 1;
+               }
+               if (bus->flowcontrol & ~fcbits) {
+                       bus->fc_xon++;
+                       delta = 1;
+               }
+
+               if (delta) {
+                       bus->fc_rcvd++;
+                       bus->flowcontrol = fcbits;
+               }
+
+               /* Check and update sequence number */
+               if (rxseq != seq) {
+                       DHD_INFO(("%s: rx_seq %d, expected %d\n", __FUNCTION__, seq, rxseq));
+                       bus->rx_badseq++;
+                       rxseq = seq;
+               }
+
+               /* Check window for sanity */
+               if ((uint8)(txmax - bus->tx_seq) > 0x70) {
+                       DHD_ERROR(("%s: got unlikely tx max %d with tx_seq %d\n",
+                                  __FUNCTION__, txmax, bus->tx_seq));
+                       txmax = bus->tx_max;
+               }
+               bus->tx_max = txmax;
+
+               /* Call a separate function for control frames */
+               if (chan == SDPCM_CONTROL_CHANNEL) {
+                       dhdsdio_read_control(bus, bus->rxhdr, len, doff);
+                       continue;
+               }
+
+               ASSERT((chan == SDPCM_DATA_CHANNEL) || (chan == SDPCM_EVENT_CHANNEL) ||
+                      (chan == SDPCM_TEST_CHANNEL) || (chan == SDPCM_GLOM_CHANNEL));
+
+               /* Length to read */
+               rdlen = (len > firstread) ? (len - firstread) : 0;
+
+               /* May pad read to blocksize for efficiency */
+               if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
+                       pad = bus->blocksize - (rdlen % bus->blocksize);
+                       if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
+                           ((rdlen + pad + firstread) < MAX_RX_DATASZ))
+                               rdlen += pad;
+               } else if (rdlen % DHD_SDALIGN) {
+                       rdlen += DHD_SDALIGN - (rdlen % DHD_SDALIGN);
+               }
+
+               /* Satisfy length-alignment requirements */
+               if (forcealign && (rdlen & (ALIGNMENT - 1)))
+                       rdlen = ROUNDUP(rdlen, ALIGNMENT);
+
+               if ((rdlen + firstread) > MAX_RX_DATASZ) {
+                       /* Too long -- skip this frame */
+                       DHD_ERROR(("%s: too long: len %d rdlen %d\n", __FUNCTION__, len, rdlen));
+                       bus->dhd->rx_errors++; bus->rx_toolong++;
+                       dhdsdio_rxfail(bus, FALSE, FALSE);
+                       continue;
+               }
+
+               dhd_os_sdlock_rxq(bus->dhd);
+               if (!(pkt = PKTGET(osh, (rdlen + firstread + DHD_SDALIGN), FALSE))) {
+                       /* Give up on data, request rtx of events */
+                       DHD_ERROR(("%s: PKTGET failed: rdlen %d chan %d\n",
+                                  __FUNCTION__, rdlen, chan));
+                       bus->dhd->rx_dropped++;
+                       dhd_os_sdunlock_rxq(bus->dhd);
+                       dhdsdio_rxfail(bus, FALSE, RETRYCHAN(chan));
+                       continue;
+               }
+               dhd_os_sdunlock_rxq(bus->dhd);
+
+               ASSERT(!PKTLINK(pkt));
+
+               /* Leave room for what we already read, and align remainder */
+               ASSERT(firstread < (PKTLEN(osh, pkt)));
+               PKTPULL(osh, pkt, firstread);
+               PKTALIGN(osh, pkt, rdlen, DHD_SDALIGN);
+
+               /* Read the remaining frame data */
+               sdret = dhd_bcmsdh_recv_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
+                                           ((uint8 *)PKTDATA(osh, pkt)), rdlen, pkt, NULL, NULL);
+               bus->f2rxdata++;
+               ASSERT(sdret != BCME_PENDING);
+
+               if (sdret < 0) {
+                       DHD_ERROR(("%s: read %d %s bytes failed: %d\n", __FUNCTION__, rdlen,
+                                  ((chan == SDPCM_EVENT_CHANNEL) ? "event" :
+                                   ((chan == SDPCM_DATA_CHANNEL) ? "data" : "test")), sdret));
+                       dhd_os_sdlock_rxq(bus->dhd);
+                       PKTFREE(bus->dhd->osh, pkt, FALSE);
+                       dhd_os_sdunlock_rxq(bus->dhd);
+                       bus->dhd->rx_errors++;
+                       dhdsdio_rxfail(bus, TRUE, RETRYCHAN(chan));
+                       continue;
+               }
+
+               /* Copy the already-read portion */
+               PKTPUSH(osh, pkt, firstread);
+               bcopy(bus->rxhdr, PKTDATA(osh, pkt), firstread);
+
+#ifdef DHD_DEBUG
+               if (DHD_BYTES_ON() && DHD_DATA_ON()) {
+                       prhex("Rx Data", PKTDATA(osh, pkt), len);
+               }
+#endif
+
+deliver:
+               /* Save superframe descriptor and allocate packet frame */
+               if (chan == SDPCM_GLOM_CHANNEL) {
+                       if (SDPCM_GLOMDESC(&bus->rxhdr[SDPCM_FRAMETAG_LEN])) {
+                               DHD_GLOM(("%s: got glom descriptor, %d bytes:\n",
+                                         __FUNCTION__, len));
+#ifdef DHD_DEBUG
+                               if (DHD_GLOM_ON()) {
+                                       prhex("Glom Data", PKTDATA(osh, pkt), len);
+                               }
+#endif
+                               PKTSETLEN(osh, pkt, len);
+                               ASSERT(doff == SDPCM_HDRLEN);
+                               PKTPULL(osh, pkt, SDPCM_HDRLEN);
+                               bus->glomd = pkt;
+                       } else {
+                               DHD_ERROR(("%s: glom superframe w/o descriptor!\n", __FUNCTION__));
+                               dhdsdio_rxfail(bus, FALSE, FALSE);
+                       }
+                       continue;
+               }
+
+               /* Fill in packet len and prio, deliver upward */
+               PKTSETLEN(osh, pkt, len);
+               PKTPULL(osh, pkt, doff);
+
+#ifdef SDTEST
+               /* Test channel packets are processed separately */
+               if (chan == SDPCM_TEST_CHANNEL) {
+                       dhdsdio_testrcv(bus, pkt, seq);
+                       continue;
+               }
+#endif /* SDTEST */
+
+               if (PKTLEN(osh, pkt) == 0) {
+                       dhd_os_sdlock_rxq(bus->dhd);
+                       PKTFREE(bus->dhd->osh, pkt, FALSE);
+                       dhd_os_sdunlock_rxq(bus->dhd);
+                       continue;
+               } else if (dhd_prot_hdrpull(bus->dhd, &ifidx, pkt, reorder_info_buf,
+                       &reorder_info_len) != 0) {
+                       DHD_ERROR(("%s: rx protocol error\n", __FUNCTION__));
+                       dhd_os_sdlock_rxq(bus->dhd);
+                       PKTFREE(bus->dhd->osh, pkt, FALSE);
+                       dhd_os_sdunlock_rxq(bus->dhd);
+                       bus->dhd->rx_errors++;
+                       continue;
+               }
+               if (reorder_info_len) {
+                       /* Reordering info from the firmware */
+                       dhd_process_pkt_reorder_info(bus->dhd, reorder_info_buf, reorder_info_len,
+                               &pkt, &pkt_count);
+                       if (pkt_count == 0)
+                               continue;
+               }
+               else
+                       pkt_count = 1;
+
+               /* Unlock during rx call */
+               dhd_os_sdunlock(bus->dhd);
+               dhd_rx_frame(bus->dhd, ifidx, pkt, pkt_count, chan);
+               dhd_os_sdlock(bus->dhd);
+       }
+       rxcount = maxframes - rxleft;
+#ifdef DHD_DEBUG
+       /* Message if we hit the limit */
+       if (!rxleft && !sdtest)
+               DHD_DATA(("%s: hit rx limit of %d frames\n", __FUNCTION__, maxframes));
+       else
+#endif /* DHD_DEBUG */
+       DHD_DATA(("%s: processed %d frames\n", __FUNCTION__, rxcount));
+       /* Back off rxseq if awaiting rtx, update rx_seq */
+       if (bus->rxskip)
+               rxseq--;
+       bus->rx_seq = rxseq;
+
+       if (bus->reqbussleep)
+       {
+           dhdsdio_bussleep(bus, TRUE);
+               bus->reqbussleep = FALSE;
+       }
+       bus->readframes = FALSE;
+
+       return rxcount;
+}
+
+static uint32
+dhdsdio_hostmail(dhd_bus_t *bus)
+{
+       sdpcmd_regs_t *regs = bus->regs;
+       uint32 intstatus = 0;
+       uint32 hmb_data;
+       uint8 fcbits;
+       uint retries = 0;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       /* Read mailbox data and ack that we did so */
+       R_SDREG(hmb_data, &regs->tohostmailboxdata, retries);
+       if (retries <= retry_limit)
+               W_SDREG(SMB_INT_ACK, &regs->tosbmailbox, retries);
+       bus->f1regdata += 2;
+
+       /* Dongle recomposed rx frames, accept them again */
+       if (hmb_data & HMB_DATA_NAKHANDLED) {
+               DHD_INFO(("Dongle reports NAK handled, expect rtx of %d\n", bus->rx_seq));
+               if (!bus->rxskip) {
+                       DHD_ERROR(("%s: unexpected NAKHANDLED!\n", __FUNCTION__));
+               }
+               bus->rxskip = FALSE;
+               intstatus |= FRAME_AVAIL_MASK(bus);
+       }
+
+       /*
+        * DEVREADY does not occur with gSPI.
+        */
+       if (hmb_data & (HMB_DATA_DEVREADY | HMB_DATA_FWREADY)) {
+               bus->sdpcm_ver = (hmb_data & HMB_DATA_VERSION_MASK) >> HMB_DATA_VERSION_SHIFT;
+               if (bus->sdpcm_ver != SDPCM_PROT_VERSION)
+                       DHD_ERROR(("Version mismatch, dongle reports %d, expecting %d\n",
+                                  bus->sdpcm_ver, SDPCM_PROT_VERSION));
+               else
+                       DHD_INFO(("Dongle ready, protocol version %d\n", bus->sdpcm_ver));
+               /* make sure for the SDIO_DEVICE_RXDATAINT_MODE_1 corecontrol is proper */
+               if ((bus->sih->buscoretype == SDIOD_CORE_ID) && (bus->sdpcmrev >= 4) &&
+                   (bus->rxint_mode  == SDIO_DEVICE_RXDATAINT_MODE_1)) {
+                       uint32 val;
+
+                       val = R_REG(bus->dhd->osh, &bus->regs->corecontrol);
+                       val &= ~CC_XMTDATAAVAIL_MODE;
+                       val |= CC_XMTDATAAVAIL_CTRL;
+                       W_REG(bus->dhd->osh, &bus->regs->corecontrol, val);
+
+                       val = R_REG(bus->dhd->osh, &bus->regs->corecontrol);
+               }
+
+#ifdef DHD_DEBUG
+               /* Retrieve console state address now that firmware should have updated it */
+               {
+                       sdpcm_shared_t shared;
+                       if (dhdsdio_readshared(bus, &shared) == 0)
+                               bus->console_addr = shared.console_addr;
+               }
+#endif /* DHD_DEBUG */
+       }
+
+       /*
+        * Flow Control has been moved into the RX headers and this out of band
+        * method isn't used any more.  Leave this here for possibly remaining backward
+        * compatible with older dongles
+        */
+       if (hmb_data & HMB_DATA_FC) {
+               fcbits = (hmb_data & HMB_DATA_FCDATA_MASK) >> HMB_DATA_FCDATA_SHIFT;
+
+               if (fcbits & ~bus->flowcontrol)
+                       bus->fc_xoff++;
+               if (bus->flowcontrol & ~fcbits)
+                       bus->fc_xon++;
+
+               bus->fc_rcvd++;
+               bus->flowcontrol = fcbits;
+       }
+
+       /* At least print a message if FW halted */
+       if (hmb_data & HMB_DATA_FWHALT) {
+               DHD_ERROR(("INTERNAL ERROR: FIRMWARE HALTED : set BUS DOWN\n"));
+               dhdsdio_checkdied(bus, NULL, 0);
+               bus->dhd->busstate = DHD_BUS_DOWN;
+       }
+
+       /* Shouldn't be any others */
+       if (hmb_data & ~(HMB_DATA_DEVREADY |
+                        HMB_DATA_FWHALT |
+                        HMB_DATA_NAKHANDLED |
+                        HMB_DATA_FC |
+                        HMB_DATA_FWREADY |
+                        HMB_DATA_FCDATA_MASK |
+                        HMB_DATA_VERSION_MASK)) {
+               DHD_ERROR(("Unknown mailbox data content: 0x%02x\n", hmb_data));
+       }
+
+       return intstatus;
+}
+
+static bool
+dhdsdio_dpc(dhd_bus_t *bus)
+{
+       bcmsdh_info_t *sdh = bus->sdh;
+       sdpcmd_regs_t *regs = bus->regs;
+       uint32 intstatus, newstatus = 0;
+       uint retries = 0;
+       uint rxlimit = dhd_rxbound; /* Rx frames to read before resched */
+       uint txlimit = dhd_txbound; /* Tx frames to send before resched */
+       uint framecnt = 0;                /* Temporary counter of tx/rx frames */
+       bool rxdone = TRUE;               /* Flag for no more read data */
+       bool resched = FALSE;     /* Flag indicating resched wanted */
+#ifdef DEBUG_DPC_THREAD_WATCHDOG
+       bool is_resched_by_readframe = FALSE;
+#endif /* DEBUG_DPC_THREAD_WATCHDOG */
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       dhd_os_sdlock(bus->dhd);
+
+       if (bus->dhd->busstate == DHD_BUS_DOWN) {
+               DHD_ERROR(("%s: Bus down, ret\n", __FUNCTION__));
+               bus->intstatus = 0;
+               dhd_os_sdunlock(bus->dhd);
+               return 0;
+       }
+
+       /* Start with leftover status bits */
+       intstatus = bus->intstatus;
+
+       if (!SLPAUTO_ENAB(bus) && !KSO_ENAB(bus)) {
+               DHD_ERROR(("%s: Device asleep\n", __FUNCTION__));
+               goto exit;
+       }
+
+       /* If waiting for HTAVAIL, check status */
+       if (!SLPAUTO_ENAB(bus) && (bus->clkstate == CLK_PENDING)) {
+               int err;
+               uint8 clkctl, devctl = 0;
+
+#ifdef DHD_DEBUG
+               /* Check for inconsistent device control */
+               devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
+               if (err) {
+                       DHD_ERROR(("%s: error reading DEVCTL: %d\n", __FUNCTION__, err));
+                       bus->dhd->busstate = DHD_BUS_DOWN;
+               } else {
+                       ASSERT(devctl & SBSDIO_DEVCTL_CA_INT_ONLY);
+               }
+#endif /* DHD_DEBUG */
+
+               /* Read CSR, if clock on switch to AVAIL, else ignore */
+               clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+               if (err) {
+                       DHD_ERROR(("%s: error reading CSR: %d\n", __FUNCTION__, err));
+                       bus->dhd->busstate = DHD_BUS_DOWN;
+               }
+
+               DHD_INFO(("DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n", devctl, clkctl));
+
+               if (SBSDIO_HTAV(clkctl)) {
+                       devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
+                       if (err) {
+                               DHD_ERROR(("%s: error reading DEVCTL: %d\n",
+                                          __FUNCTION__, err));
+                               bus->dhd->busstate = DHD_BUS_DOWN;
+                       }
+                       devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
+                       bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
+                       if (err) {
+                               DHD_ERROR(("%s: error writing DEVCTL: %d\n",
+                                          __FUNCTION__, err));
+                               bus->dhd->busstate = DHD_BUS_DOWN;
+                       }
+                       bus->clkstate = CLK_AVAIL;
+               } else {
+                       goto clkwait;
+               }
+       }
+
+       BUS_WAKE(bus);
+
+       /* Make sure backplane clock is on */
+       dhdsdio_clkctl(bus, CLK_AVAIL, TRUE);
+       if (bus->clkstate != CLK_AVAIL)
+               goto clkwait;
+
+       /* Pending interrupt indicates new device status */
+       if (bus->ipend) {
+               bus->ipend = FALSE;
+               R_SDREG(newstatus, &regs->intstatus, retries);
+               bus->f1regdata++;
+               if (bcmsdh_regfail(bus->sdh))
+                       newstatus = 0;
+               newstatus &= bus->hostintmask;
+               bus->fcstate = !!(newstatus & I_HMB_FC_STATE);
+               if (newstatus) {
+                       bus->f1regdata++;
+                       if ((bus->rxint_mode == SDIO_DEVICE_RXDATAINT_MODE_0) &&
+                               (newstatus == I_XMTDATA_AVAIL)) {
+                       }
+                       else
+                               W_SDREG(newstatus, &regs->intstatus, retries);
+               }
+       }
+
+       /* Merge new bits with previous */
+       intstatus |= newstatus;
+       bus->intstatus = 0;
+
+       /* Handle flow-control change: read new state in case our ack
+        * crossed another change interrupt.  If change still set, assume
+        * FC ON for safety, let next loop through do the debounce.
+        */
+       if (intstatus & I_HMB_FC_CHANGE) {
+               intstatus &= ~I_HMB_FC_CHANGE;
+               W_SDREG(I_HMB_FC_CHANGE, &regs->intstatus, retries);
+               R_SDREG(newstatus, &regs->intstatus, retries);
+               bus->f1regdata += 2;
+               bus->fcstate = !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE));
+               intstatus |= (newstatus & bus->hostintmask);
+       }
+
+       /* Just being here means nothing more to do for chipactive */
+       if (intstatus & I_CHIPACTIVE) {
+               /* ASSERT(bus->clkstate == CLK_AVAIL); */
+               intstatus &= ~I_CHIPACTIVE;
+       }
+
+       /* Handle host mailbox indication */
+       if (intstatus & I_HMB_HOST_INT) {
+               intstatus &= ~I_HMB_HOST_INT;
+               intstatus |= dhdsdio_hostmail(bus);
+       }
+
+       /* Generally don't ask for these, can get CRC errors... */
+       if (intstatus & I_WR_OOSYNC) {
+               DHD_ERROR(("Dongle reports WR_OOSYNC\n"));
+               intstatus &= ~I_WR_OOSYNC;
+       }
+
+       if (intstatus & I_RD_OOSYNC) {
+               DHD_ERROR(("Dongle reports RD_OOSYNC\n"));
+               intstatus &= ~I_RD_OOSYNC;
+       }
+
+       if (intstatus & I_SBINT) {
+               DHD_ERROR(("Dongle reports SBINT\n"));
+               intstatus &= ~I_SBINT;
+       }
+
+       /* Would be active due to wake-wlan in gSPI */
+       if (intstatus & I_CHIPACTIVE) {
+               DHD_INFO(("Dongle reports CHIPACTIVE\n"));
+               intstatus &= ~I_CHIPACTIVE;
+       }
+
+       if (intstatus & I_HMB_FC_STATE) {
+               DHD_INFO(("Dongle reports HMB_FC_STATE\n"));
+               intstatus &= ~I_HMB_FC_STATE;
+       }
+
+       /* Ignore frame indications if rxskip is set */
+       if (bus->rxskip) {
+               intstatus &= ~FRAME_AVAIL_MASK(bus);
+       }
+
+       /* On frame indication, read available frames */
+       if (PKT_AVAILABLE(bus, intstatus)) {
+               framecnt = dhdsdio_readframes(bus, rxlimit, &rxdone);
+               if (rxdone || bus->rxskip)
+                       intstatus  &= ~FRAME_AVAIL_MASK(bus);
+               rxlimit -= MIN(framecnt, rxlimit);
+       }
+
+       /* Keep still-pending events for next scheduling */
+       bus->intstatus = intstatus;
+
+clkwait:
+       /* Re-enable interrupts to detect new device events (mailbox, rx frame)
+        * or clock availability.  (Allows tx loop to check ipend if desired.)
+        * (Unless register access seems hosed, as we may not be able to ACK...)
+        */
+       if (bus->intr && bus->intdis && !bcmsdh_regfail(sdh)) {
+               DHD_INTR(("%s: enable SDIO interrupts, rxdone %d framecnt %d\n",
+                         __FUNCTION__, rxdone, framecnt));
+               bus->intdis = FALSE;
+#if defined(OOB_INTR_ONLY)
+               OOB_PARAM_IF(!(bus->dhd->oob_disable)) {
+                       bcmsdh_oob_intr_set(bus->sdh, TRUE);
+               }
+#endif /* defined(OOB_INTR_ONLY) */
+               bcmsdh_intr_enable(sdh);
+       }
+
+#if defined(OOB_INTR_ONLY) && !defined(HW_OOB)
+       OOB_PARAM_IF(!(bus->dhd->oob_disable)) {
+               /* In case of SW-OOB(using edge trigger),
+                * Check interrupt status in the dongle again after enable irq on the host.
+                * and rechedule dpc if interrupt is pended in the dongle.
+                * There is a chance to miss OOB interrupt while irq is disabled on the host.
+                * No need to do this with HW-OOB(level trigger)
+                */
+               R_SDREG(newstatus, &regs->intstatus, retries);
+               if (bcmsdh_regfail(bus->sdh))
+                       newstatus = 0;
+               if (newstatus & bus->hostintmask) {
+                       bus->ipend = TRUE;
+                       resched = TRUE;
+               }
+       }
+#endif /* defined(OOB_INTR_ONLY) && !defined(HW_OOB) */
+
+#ifdef PROP_TXSTATUS
+       dhd_wlfc_commit_packets(bus->dhd, (f_commitpkt_t)dhd_bus_txdata, (void *)bus, NULL, FALSE);
+#endif
+
+       if (TXCTLOK(bus) && bus->ctrl_frame_stat && (bus->clkstate == CLK_AVAIL))
+               dhdsdio_sendpendctl(bus);
+
+       /* Send queued frames (limit 1 if rx may still be pending) */
+       else if ((bus->clkstate == CLK_AVAIL) && !bus->fcstate &&
+           pktq_mlen(&bus->txq, ~bus->flowcontrol) && txlimit && DATAOK(bus)) {
+               framecnt = rxdone ? txlimit : MIN(txlimit, dhd_txminmax);
+               framecnt = dhdsdio_sendfromq(bus, framecnt);
+               txlimit -= framecnt;
+       }
+       /* Resched the DPC if ctrl cmd is pending on bus credit */
+       if (bus->ctrl_frame_stat)
+               resched = TRUE;
+
+       /* Resched if events or tx frames are pending, else await next interrupt */
+       /* On failed register access, all bets are off: no resched or interrupts */
+       if ((bus->dhd->busstate == DHD_BUS_DOWN) || bcmsdh_regfail(sdh)) {
+               if ((bus->sih && bus->sih->buscorerev >= 12) && !(dhdsdio_sleepcsr_get(bus) &
+                       SBSDIO_FUNC1_SLEEPCSR_KSO_MASK)) {
+                       /* Bus failed because of KSO */
+                       DHD_ERROR(("%s: Bus failed due to KSO\n", __FUNCTION__));
+                       bus->kso = FALSE;
+               } else {
+                       DHD_ERROR(("%s: failed backplane access over SDIO, halting operation\n",
+                               __FUNCTION__));
+                       bus->dhd->busstate = DHD_BUS_DOWN;
+                       bus->intstatus = 0;
+               }
+       } else if (bus->clkstate == CLK_PENDING) {
+               /* Awaiting I_CHIPACTIVE; don't resched */
+       } else if (bus->intstatus || bus->ipend ||
+                  (!bus->fcstate && pktq_mlen(&bus->txq, ~bus->flowcontrol) && DATAOK(bus)) ||
+                       PKT_AVAILABLE(bus, bus->intstatus)) {  /* Read multiple frames */
+               resched = TRUE;
+       }
+
+       bus->dpc_sched = resched;
+
+       /* If we're done for now, turn off clock request. */
+       if ((bus->idletime == DHD_IDLE_IMMEDIATE) && (bus->clkstate != CLK_PENDING)) {
+               bus->activity = FALSE;
+               dhdsdio_clkctl(bus, CLK_NONE, FALSE);
+       }
+
+exit:
+
+       if (!resched && dhd_dpcpoll) {
+               if (dhdsdio_readframes(bus, dhd_rxbound, &rxdone) != 0) {
+                       resched = TRUE;
+#ifdef DEBUG_DPC_THREAD_WATCHDOG
+                       is_resched_by_readframe = TRUE;
+#endif /* DEBUG_DPC_THREAD_WATCHDOG */
+               }
+       }
+
+       dhd_os_sdunlock(bus->dhd);
+#ifdef DEBUG_DPC_THREAD_WATCHDOG
+       if (bus->dhd->dhd_bug_on) {
+               DHD_INFO(("%s: resched = %d ctrl_frame_stat = %d intstatus 0x%08x"
+                       " ipend = %d pktq_mlen = %d is_resched_by_readframe = %d \n",
+                       __FUNCTION__, resched, bus->ctrl_frame_stat,
+                       bus->intstatus, bus->ipend,
+                       pktq_mlen(&bus->txq, ~bus->flowcontrol), is_resched_by_readframe));
+
+                       bus->dhd->dhd_bug_on = FALSE;
+       }
+#endif /* DEBUG_DPC_THREAD_WATCHDOG */
+       return resched;
+}
+
+bool
+dhd_bus_dpc(struct dhd_bus *bus)
+{
+       bool resched;
+
+       /* Call the DPC directly. */
+       DHD_TRACE(("Calling dhdsdio_dpc() from %s\n", __FUNCTION__));
+       resched = dhdsdio_dpc(bus);
+
+       return resched;
+}
+
+void
+dhdsdio_isr(void *arg)
+{
+       dhd_bus_t *bus = (dhd_bus_t*)arg;
+       bcmsdh_info_t *sdh;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (!bus) {
+               DHD_ERROR(("%s : bus is null pointer , exit \n", __FUNCTION__));
+               return;
+       }
+       sdh = bus->sdh;
+
+       if (bus->dhd->busstate == DHD_BUS_DOWN) {
+               DHD_ERROR(("%s : bus is down. we have nothing to do\n", __FUNCTION__));
+               return;
+       }
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       /* Count the interrupt call */
+       bus->intrcount++;
+       bus->ipend = TRUE;
+
+       /* Shouldn't get this interrupt if we're sleeping? */
+       if (!SLPAUTO_ENAB(bus)) {
+               if (bus->sleeping) {
+                       DHD_ERROR(("INTERRUPT WHILE SLEEPING??\n"));
+                       return;
+               } else if (!KSO_ENAB(bus)) {
+                       DHD_ERROR(("ISR in devsleep 1\n"));
+               }
+       }
+
+       /* Disable additional interrupts (is this needed now)? */
+       if (bus->intr) {
+               DHD_INTR(("%s: disable SDIO interrupts\n", __FUNCTION__));
+       } else {
+               DHD_ERROR(("dhdsdio_isr() w/o interrupt configured!\n"));
+       }
+
+       bcmsdh_intr_disable(sdh);
+       bus->intdis = TRUE;
+
+#if defined(SDIO_ISR_THREAD) || defined(OOB_PARAM)
+       OOB_PARAM_IF(bus->dhd->oob_disable) {
+               DHD_TRACE(("Calling dhdsdio_dpc() from %s\n", __FUNCTION__));
+               DHD_OS_WAKE_LOCK(bus->dhd);
+               dhdsdio_dpc(bus);
+               DHD_OS_WAKE_UNLOCK(bus->dhd);
+       } OOB_PARAM_ELSE()
+#endif /* defined(SDIO_ISR_THREAD) || defined(OOB_PARAM) */
+#if !defined(SDIO_ISR_THREAD) || defined(OOB_PARAM)
+       {
+               bus->dpc_sched = TRUE;
+               dhd_sched_dpc(bus->dhd);
+       }
+#endif /* !defined(SDIO_ISR_THREAD) || defined(OOB_PARAM) */
+
+}
+
+#ifdef SDTEST
+static void
+dhdsdio_pktgen_init(dhd_bus_t *bus)
+{
+       /* Default to specified length, or full range */
+       if (dhd_pktgen_len) {
+               bus->pktgen_maxlen = MIN(dhd_pktgen_len, MAX_PKTGEN_LEN);
+               bus->pktgen_minlen = bus->pktgen_maxlen;
+       } else {
+               bus->pktgen_maxlen = MAX_PKTGEN_LEN;
+               bus->pktgen_minlen = 0;
+       }
+       bus->pktgen_len = (uint16)bus->pktgen_minlen;
+
+       /* Default to per-watchdog burst with 10s print time */
+       bus->pktgen_freq = 1;
+       bus->pktgen_print = dhd_watchdog_ms ? (10000 / dhd_watchdog_ms) : 0;
+       bus->pktgen_count = (dhd_pktgen * dhd_watchdog_ms + 999) / 1000;
+
+       /* Default to echo mode */
+       bus->pktgen_mode = DHD_PKTGEN_ECHO;
+       bus->pktgen_stop = 1;
+}
+
+static void
+dhdsdio_pktgen(dhd_bus_t *bus)
+{
+       void *pkt;
+       uint8 *data;
+       uint pktcount;
+       uint fillbyte;
+       osl_t *osh = bus->dhd->osh;
+       uint16 len;
+       ulong time_lapse;
+       uint sent_pkts;
+       uint rcvd_pkts;
+
+       /* Display current count if appropriate */
+       if (bus->pktgen_print && (++bus->pktgen_ptick >= bus->pktgen_print)) {
+               bus->pktgen_ptick = 0;
+               printf("%s: send attempts %d, rcvd %d, errors %d\n",
+                      __FUNCTION__, bus->pktgen_sent, bus->pktgen_rcvd, bus->pktgen_fail);
+
+               /* Print throughput stats only for constant length packet runs */
+               if (bus->pktgen_minlen == bus->pktgen_maxlen) {
+                       time_lapse = jiffies - bus->pktgen_prev_time;
+                       bus->pktgen_prev_time = jiffies;
+                       sent_pkts = bus->pktgen_sent - bus->pktgen_prev_sent;
+                       bus->pktgen_prev_sent = bus->pktgen_sent;
+                       rcvd_pkts = bus->pktgen_rcvd - bus->pktgen_prev_rcvd;
+                       bus->pktgen_prev_rcvd = bus->pktgen_rcvd;
+
+                       printf("%s: Tx Throughput %d kbps, Rx Throughput %d kbps\n",
+                         __FUNCTION__,
+                         (sent_pkts * bus->pktgen_len / jiffies_to_msecs(time_lapse)) * 8,
+                         (rcvd_pkts * bus->pktgen_len  / jiffies_to_msecs(time_lapse)) * 8);
+               }
+       }
+
+       /* For recv mode, just make sure dongle has started sending */
+       if (bus->pktgen_mode == DHD_PKTGEN_RECV) {
+               if (bus->pktgen_rcv_state == PKTGEN_RCV_IDLE) {
+                       bus->pktgen_rcv_state = PKTGEN_RCV_ONGOING;
+                       dhdsdio_sdtest_set(bus, bus->pktgen_total);
+               }
+               return;
+       }
+
+       /* Otherwise, generate or request the specified number of packets */
+       for (pktcount = 0; pktcount < bus->pktgen_count; pktcount++) {
+               /* Stop if total has been reached */
+               if (bus->pktgen_total && (bus->pktgen_sent >= bus->pktgen_total)) {
+                       bus->pktgen_count = 0;
+                       break;
+               }
+
+               /* Allocate an appropriate-sized packet */
+               if (bus->pktgen_mode == DHD_PKTGEN_RXBURST) {
+                       len = SDPCM_TEST_PKT_CNT_FLD_LEN;
+               } else {
+                       len = bus->pktgen_len;
+               }
+               if (!(pkt = PKTGET(osh, (len + SDPCM_HDRLEN + SDPCM_TEST_HDRLEN + DHD_SDALIGN),
+                                  TRUE))) {;
+                       DHD_ERROR(("%s: PKTGET failed!\n", __FUNCTION__));
+                       break;
+               }
+               PKTALIGN(osh, pkt, (len + SDPCM_HDRLEN + SDPCM_TEST_HDRLEN), DHD_SDALIGN);
+               data = (uint8*)PKTDATA(osh, pkt) + SDPCM_HDRLEN;
+
+               /* Write test header cmd and extra based on mode */
+               switch (bus->pktgen_mode) {
+               case DHD_PKTGEN_ECHO:
+                       *data++ = SDPCM_TEST_ECHOREQ;
+                       *data++ = (uint8)bus->pktgen_sent;
+                       break;
+
+               case DHD_PKTGEN_SEND:
+                       *data++ = SDPCM_TEST_DISCARD;
+                       *data++ = (uint8)bus->pktgen_sent;
+                       break;
+
+               case DHD_PKTGEN_RXBURST:
+                       *data++ = SDPCM_TEST_BURST;
+                       *data++ = (uint8)bus->pktgen_count; /* Just for backward compatability */
+                       break;
+
+               default:
+                       DHD_ERROR(("Unrecognized pktgen mode %d\n", bus->pktgen_mode));
+                       PKTFREE(osh, pkt, TRUE);
+                       bus->pktgen_count = 0;
+                       return;
+               }
+
+               /* Write test header length field */
+               *data++ = (bus->pktgen_len >> 0);
+               *data++ = (bus->pktgen_len >> 8);
+
+               /* Write frame count in a 4 byte field adjucent to SDPCM test header for
+                * burst mode
+                */
+               if (bus->pktgen_mode == DHD_PKTGEN_RXBURST) {
+                       *data++ = (uint8)(bus->pktgen_count >> 0);
+                       *data++ = (uint8)(bus->pktgen_count >> 8);
+                       *data++ = (uint8)(bus->pktgen_count >> 16);
+                       *data++ = (uint8)(bus->pktgen_count >> 24);
+               } else {
+
+                       /* Then fill in the remainder -- N/A for burst */
+                       for (fillbyte = 0; fillbyte < len; fillbyte++)
+                               *data++ = SDPCM_TEST_FILL(fillbyte, (uint8)bus->pktgen_sent);
+               }
+
+#ifdef DHD_DEBUG
+               if (DHD_BYTES_ON() && DHD_DATA_ON()) {
+                       data = (uint8*)PKTDATA(osh, pkt) + SDPCM_HDRLEN;
+                       prhex("dhdsdio_pktgen: Tx Data", data, PKTLEN(osh, pkt) - SDPCM_HDRLEN);
+               }
+#endif
+
+               /* Send it */
+               if (dhdsdio_txpkt(bus, SDPCM_TEST_CHANNEL, &pkt, 1, TRUE) != BCME_OK) {
+                       bus->pktgen_fail++;
+                       if (bus->pktgen_stop && bus->pktgen_stop == bus->pktgen_fail)
+                               bus->pktgen_count = 0;
+               }
+               bus->pktgen_sent++;
+
+               /* Bump length if not fixed, wrap at max */
+               if (++bus->pktgen_len > bus->pktgen_maxlen)
+                       bus->pktgen_len = (uint16)bus->pktgen_minlen;
+
+               /* Special case for burst mode: just send one request! */
+               if (bus->pktgen_mode == DHD_PKTGEN_RXBURST)
+                       break;
+       }
+}
+
+static void
+dhdsdio_sdtest_set(dhd_bus_t *bus, uint count)
+{
+       void *pkt;
+       uint8 *data;
+       osl_t *osh = bus->dhd->osh;
+
+       /* Allocate the packet */
+       if (!(pkt = PKTGET(osh, SDPCM_HDRLEN + SDPCM_TEST_HDRLEN +
+               SDPCM_TEST_PKT_CNT_FLD_LEN + DHD_SDALIGN, TRUE))) {
+               DHD_ERROR(("%s: PKTGET failed!\n", __FUNCTION__));
+               return;
+       }
+       PKTALIGN(osh, pkt, (SDPCM_HDRLEN + SDPCM_TEST_HDRLEN +
+               SDPCM_TEST_PKT_CNT_FLD_LEN), DHD_SDALIGN);
+       data = (uint8*)PKTDATA(osh, pkt) + SDPCM_HDRLEN;
+
+       /* Fill in the test header */
+       *data++ = SDPCM_TEST_SEND;
+       *data++ = (count > 0)?TRUE:FALSE;
+       *data++ = (bus->pktgen_maxlen >> 0);
+       *data++ = (bus->pktgen_maxlen >> 8);
+       *data++ = (uint8)(count >> 0);
+       *data++ = (uint8)(count >> 8);
+       *data++ = (uint8)(count >> 16);
+       *data++ = (uint8)(count >> 24);
+
+       /* Send it */
+       if (dhdsdio_txpkt(bus, SDPCM_TEST_CHANNEL, &pkt, 1, TRUE) != BCME_OK)
+               bus->pktgen_fail++;
+}
+
+
+static void
+dhdsdio_testrcv(dhd_bus_t *bus, void *pkt, uint seq)
+{
+       osl_t *osh = bus->dhd->osh;
+       uint8 *data;
+       uint pktlen;
+
+       uint8 cmd;
+       uint8 extra;
+       uint16 len;
+       uint16 offset;
+
+       /* Check for min length */
+       if ((pktlen = PKTLEN(osh, pkt)) < SDPCM_TEST_HDRLEN) {
+               DHD_ERROR(("dhdsdio_restrcv: toss runt frame, pktlen %d\n", pktlen));
+               PKTFREE(osh, pkt, FALSE);
+               return;
+       }
+
+       /* Extract header fields */
+       data = PKTDATA(osh, pkt);
+       cmd = *data++;
+       extra = *data++;
+       len = *data++; len += *data++ << 8;
+       DHD_TRACE(("%s:cmd:%d, xtra:%d,len:%d\n", __FUNCTION__, cmd, extra, len));
+       /* Check length for relevant commands */
+       if (cmd == SDPCM_TEST_DISCARD || cmd == SDPCM_TEST_ECHOREQ || cmd == SDPCM_TEST_ECHORSP) {
+               if (pktlen != len + SDPCM_TEST_HDRLEN) {
+                       DHD_ERROR(("dhdsdio_testrcv: frame length mismatch, pktlen %d seq %d"
+                                  " cmd %d extra %d len %d\n", pktlen, seq, cmd, extra, len));
+                       PKTFREE(osh, pkt, FALSE);
+                       return;
+               }
+       }
+
+       /* Process as per command */
+       switch (cmd) {
+       case SDPCM_TEST_ECHOREQ:
+               /* Rx->Tx turnaround ok (even on NDIS w/current implementation) */
+               *(uint8 *)(PKTDATA(osh, pkt)) = SDPCM_TEST_ECHORSP;
+               if (dhdsdio_txpkt(bus, SDPCM_TEST_CHANNEL, &pkt, 1, TRUE) == BCME_OK) {
+                       bus->pktgen_sent++;
+               } else {
+                       bus->pktgen_fail++;
+                       PKTFREE(osh, pkt, FALSE);
+               }
+               bus->pktgen_rcvd++;
+               break;
+
+       case SDPCM_TEST_ECHORSP:
+               if (bus->ext_loop) {
+                       PKTFREE(osh, pkt, FALSE);
+                       bus->pktgen_rcvd++;
+                       break;
+               }
+
+               for (offset = 0; offset < len; offset++, data++) {
+                       if (*data != SDPCM_TEST_FILL(offset, extra)) {
+                               DHD_ERROR(("dhdsdio_testrcv: echo data mismatch: "
+                                          "offset %d (len %d) expect 0x%02x rcvd 0x%02x\n",
+                                          offset, len, SDPCM_TEST_FILL(offset, extra), *data));
+                               break;
+                       }
+               }
+               PKTFREE(osh, pkt, FALSE);
+               bus->pktgen_rcvd++;
+               break;
+
+       case SDPCM_TEST_DISCARD:
+               {
+                       int i = 0;
+                       uint8 *prn = data;
+                       uint8 testval = extra;
+                       for (i = 0; i < len; i++) {
+                               if (*prn != testval) {
+                                       DHD_ERROR(("DIErr@Pkt#:%d,Ix:%d, expected:0x%x, got:0x%x\n",
+                                               i, bus->pktgen_rcvd_rcvsession, testval, *prn));
+                                       prn++; testval++;
+                               }
+                       }
+               }
+               PKTFREE(osh, pkt, FALSE);
+               bus->pktgen_rcvd++;
+               break;
+
+       case SDPCM_TEST_BURST:
+       case SDPCM_TEST_SEND:
+       default:
+               DHD_INFO(("dhdsdio_testrcv: unsupported or unknown command, pktlen %d seq %d"
+                         " cmd %d extra %d len %d\n", pktlen, seq, cmd, extra, len));
+               PKTFREE(osh, pkt, FALSE);
+               break;
+       }
+
+       /* For recv mode, stop at limit (and tell dongle to stop sending) */
+       if (bus->pktgen_mode == DHD_PKTGEN_RECV) {
+               if (bus->pktgen_rcv_state != PKTGEN_RCV_IDLE) {
+                       bus->pktgen_rcvd_rcvsession++;
+
+                       if (bus->pktgen_total &&
+                               (bus->pktgen_rcvd_rcvsession >= bus->pktgen_total)) {
+                       bus->pktgen_count = 0;
+                       DHD_ERROR(("Pktgen:rcv test complete!\n"));
+                       bus->pktgen_rcv_state = PKTGEN_RCV_IDLE;
+                       dhdsdio_sdtest_set(bus, FALSE);
+                               bus->pktgen_rcvd_rcvsession = 0;
+                       }
+               }
+       }
+}
+#endif /* SDTEST */
+
+int dhd_bus_oob_intr_register(dhd_pub_t *dhdp)
+{
+       int err = 0;
+
+#if defined(OOB_INTR_ONLY)
+       OOB_PARAM_IF(!(dhdp->oob_disable)) {
+               err = bcmsdh_oob_intr_register(dhdp->bus->sdh, dhdsdio_isr, dhdp->bus);
+       }
+#endif
+       return err;
+}
+
+void dhd_bus_oob_intr_unregister(dhd_pub_t *dhdp)
+{
+#if defined(OOB_INTR_ONLY)
+       OOB_PARAM_IF(!(dhdp->oob_disable)) {
+               bcmsdh_oob_intr_unregister(dhdp->bus->sdh);
+       }
+#endif
+}
+
+void dhd_bus_oob_intr_set(dhd_pub_t *dhdp, bool enable)
+{
+#if defined(OOB_INTR_ONLY)
+       OOB_PARAM_IF(!(dhdp->oob_disable)) {
+               bcmsdh_oob_intr_set(dhdp->bus->sdh, enable);
+       }
+#endif
+}
+
+void dhd_bus_dev_pm_stay_awake(dhd_pub_t *dhdpub)
+{
+       bcmsdh_dev_pm_stay_awake(dhdpub->bus->sdh);
+}
+
+void dhd_bus_dev_pm_relax(dhd_pub_t *dhdpub)
+{
+       bcmsdh_dev_relax(dhdpub->bus->sdh);
+}
+
+bool dhd_bus_dev_pm_enabled(dhd_pub_t *dhdpub)
+{
+       bool enabled = FALSE;
+
+       enabled = bcmsdh_dev_pm_enabled(dhdpub->bus->sdh);
+       return enabled;
+}
+
+extern bool
+dhd_bus_watchdog(dhd_pub_t *dhdp)
+{
+       dhd_bus_t *bus;
+
+       DHD_TIMER(("%s: Enter\n", __FUNCTION__));
+
+       bus = dhdp->bus;
+
+       if (bus->dhd->dongle_reset)
+               return FALSE;
+
+       if (bus->dhd->hang_was_sent) {
+               dhd_os_wd_timer(bus->dhd, 0);
+               return FALSE;
+       }
+
+       /* Ignore the timer if simulating bus down */
+       if (!SLPAUTO_ENAB(bus) && bus->sleeping)
+               return FALSE;
+
+       if (dhdp->busstate == DHD_BUS_DOWN)
+               return FALSE;
+
+       dhd_os_sdlock(bus->dhd);
+
+       /* Poll period: check device if appropriate. */
+       if (!SLPAUTO_ENAB(bus) && (bus->poll && (++bus->polltick >= bus->pollrate))) {
+               uint32 intstatus = 0;
+
+               /* Reset poll tick */
+               bus->polltick = 0;
+
+               /* Check device if no interrupts */
+               if (!bus->intr || (bus->intrcount == bus->lastintrs)) {
+
+                       if (!bus->dpc_sched) {
+                               uint8 devpend;
+                               devpend = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_0,
+                                                         SDIOD_CCCR_INTPEND, NULL);
+                               intstatus = devpend & (INTR_STATUS_FUNC1 | INTR_STATUS_FUNC2);
+                       }
+
+                       /* If there is something, make like the ISR and schedule the DPC */
+                       if (intstatus) {
+                               bus->pollcnt++;
+                               bus->ipend = TRUE;
+                               if (bus->intr) {
+                                       bcmsdh_intr_disable(bus->sdh);
+                               }
+                               bus->dpc_sched = TRUE;
+                               dhd_sched_dpc(bus->dhd);
+                       }
+               }
+
+               /* Update interrupt tracking */
+               bus->lastintrs = bus->intrcount;
+       }
+
+#ifdef DHD_DEBUG
+       /* Poll for console output periodically */
+       if (dhdp->busstate == DHD_BUS_DATA && dhd_console_ms != 0) {
+               bus->console.count += dhd_watchdog_ms;
+               if (bus->console.count >= dhd_console_ms) {
+                       bus->console.count -= dhd_console_ms;
+                       /* Make sure backplane clock is on */
+                       if (SLPAUTO_ENAB(bus))
+                               dhdsdio_bussleep(bus, FALSE);
+                       else
+                       dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+                       if (dhdsdio_readconsole(bus) < 0)
+                               dhd_console_ms = 0;     /* On error, stop trying */
+               }
+       }
+#endif /* DHD_DEBUG */
+
+#ifdef SDTEST
+       /* Generate packets if configured */
+       if (bus->pktgen_count && (++bus->pktgen_tick >= bus->pktgen_freq)) {
+               /* Make sure backplane clock is on */
+               if (SLPAUTO_ENAB(bus))
+                       dhdsdio_bussleep(bus, FALSE);
+               else
+                       dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+               bus->pktgen_tick = 0;
+               dhdsdio_pktgen(bus);
+       }
+#endif
+
+       /* On idle timeout clear activity flag and/or turn off clock */
+#ifdef DHD_USE_IDLECOUNT
+       if (bus->activity)
+               bus->activity = FALSE;
+       else {
+               bus->idlecount++;
+
+               if ((bus->idletime > 0) && (bus->idlecount >= bus->idletime)) {
+                       DHD_TIMER(("%s: DHD Idle state!!\n", __FUNCTION__));
+                       if (SLPAUTO_ENAB(bus)) {
+                               if (dhdsdio_bussleep(bus, TRUE) != BCME_BUSY)
+                                       dhd_os_wd_timer(bus->dhd, 0);
+                       } else
+                               dhdsdio_clkctl(bus, CLK_NONE, FALSE);
+
+                       bus->idlecount = 0;
+               }
+       }
+#else
+       if ((bus->idletime > 0) && (bus->clkstate == CLK_AVAIL)) {
+               if (++bus->idlecount >= bus->idletime) {
+                       bus->idlecount = 0;
+                       if (bus->activity) {
+                               bus->activity = FALSE;
+                               if (SLPAUTO_ENAB(bus)) {
+                                       if (!bus->readframes)
+                                               dhdsdio_bussleep(bus, TRUE);
+                                       else
+                                               bus->reqbussleep = TRUE;
+                               }
+                               else
+                                       dhdsdio_clkctl(bus, CLK_NONE, FALSE);
+                       }
+               }
+       }
+#endif /* DHD_USE_IDLECOUNT */
+
+       dhd_os_sdunlock(bus->dhd);
+
+       return bus->ipend;
+}
+
+#ifdef DHD_DEBUG
+extern int
+dhd_bus_console_in(dhd_pub_t *dhdp, uchar *msg, uint msglen)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       uint32 addr, val;
+       int rv;
+       void *pkt;
+
+       /* Address could be zero if CONSOLE := 0 in dongle Makefile */
+       if (bus->console_addr == 0)
+               return BCME_UNSUPPORTED;
+
+       /* Exclusive bus access */
+       dhd_os_sdlock(bus->dhd);
+
+       /* Don't allow input if dongle is in reset */
+       if (bus->dhd->dongle_reset) {
+               dhd_os_sdunlock(bus->dhd);
+               return BCME_NOTREADY;
+       }
+
+       /* Request clock to allow SDIO accesses */
+       BUS_WAKE(bus);
+       /* No pend allowed since txpkt is called later, ht clk has to be on */
+       dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+       /* Zero cbuf_index */
+       addr = bus->console_addr + OFFSETOF(hnd_cons_t, cbuf_idx);
+       val = htol32(0);
+       if ((rv = dhdsdio_membytes(bus, TRUE, addr, (uint8 *)&val, sizeof(val))) < 0)
+               goto done;
+
+       /* Write message into cbuf */
+       addr = bus->console_addr + OFFSETOF(hnd_cons_t, cbuf);
+       if ((rv = dhdsdio_membytes(bus, TRUE, addr, (uint8 *)msg, msglen)) < 0)
+               goto done;
+
+       /* Write length into vcons_in */
+       addr = bus->console_addr + OFFSETOF(hnd_cons_t, vcons_in);
+       val = htol32(msglen);
+       if ((rv = dhdsdio_membytes(bus, TRUE, addr, (uint8 *)&val, sizeof(val))) < 0)
+               goto done;
+
+       /* Bump dongle by sending an empty packet on the event channel.
+        * sdpcm_sendup (RX) checks for virtual console input.
+        */
+       if ((pkt = PKTGET(bus->dhd->osh, 4 + SDPCM_RESERVE, TRUE)) != NULL)
+               rv = dhdsdio_txpkt(bus, SDPCM_EVENT_CHANNEL, &pkt, 1, TRUE);
+
+done:
+       if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
+               bus->activity = FALSE;
+               dhdsdio_clkctl(bus, CLK_NONE, TRUE);
+       }
+
+       dhd_os_sdunlock(bus->dhd);
+
+       return rv;
+}
+#endif /* DHD_DEBUG */
+
+#ifdef DHD_DEBUG
+static void
+dhd_dump_cis(uint fn, uint8 *cis)
+{
+       uint byte, tag, tdata;
+       DHD_INFO(("Function %d CIS:\n", fn));
+
+       for (tdata = byte = 0; byte < SBSDIO_CIS_SIZE_LIMIT; byte++) {
+               if ((byte % 16) == 0)
+                       DHD_INFO(("    "));
+               DHD_INFO(("%02x ", cis[byte]));
+               if ((byte % 16) == 15)
+                       DHD_INFO(("\n"));
+               if (!tdata--) {
+                       tag = cis[byte];
+                       if (tag == 0xff)
+                               break;
+                       else if (!tag)
+                               tdata = 0;
+                       else if ((byte + 1) < SBSDIO_CIS_SIZE_LIMIT)
+                               tdata = cis[byte + 1] + 1;
+                       else
+                               DHD_INFO(("]"));
+               }
+       }
+       if ((byte % 16) != 15)
+               DHD_INFO(("\n"));
+}
+#endif /* DHD_DEBUG */
+
+static bool
+dhdsdio_chipmatch(uint16 chipid)
+{
+       if (chipid == BCM4325_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM4329_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM4315_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM4319_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM4336_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM4330_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM43237_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM43362_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM4314_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM43242_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM43340_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM43341_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM43143_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM43342_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM4334_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM43239_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM4324_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM4335_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM4339_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM43349_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM4345_CHIP_ID || chipid == BCM43454_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM4350_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM4354_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM4356_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM4358_CHIP_ID)
+               return TRUE;
+       if (chipid == BCM43430_CHIP_ID)
+               return TRUE;
+       if (BCM4349_CHIP(chipid))
+               return TRUE;
+       return FALSE;
+}
+
+static void *
+dhdsdio_probe(uint16 venid, uint16 devid, uint16 bus_no, uint16 slot,
+       uint16 func, uint bustype, void *regsva, osl_t * osh, void *sdh)
+{
+       int ret;
+       dhd_bus_t *bus;
+
+
+       /* Init global variables at run-time, not as part of the declaration.
+        * This is required to support init/de-init of the driver. Initialization
+        * of globals as part of the declaration results in non-deterministic
+        * behavior since the value of the globals may be different on the
+        * first time that the driver is initialized vs subsequent initializations.
+        */
+       dhd_txbound = DHD_TXBOUND;
+       dhd_rxbound = DHD_RXBOUND;
+       dhd_alignctl = TRUE;
+       sd1idle = TRUE;
+       dhd_readahead = TRUE;
+       retrydata = FALSE;
+
+#ifdef DISABLE_FLOW_CONTROL
+       dhd_doflow = FALSE;
+#endif /* DISABLE_FLOW_CONTROL */
+       dhd_dongle_ramsize = 0;
+       dhd_txminmax = DHD_TXMINMAX;
+
+       forcealign = TRUE;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+       DHD_INFO(("%s: venid 0x%04x devid 0x%04x\n", __FUNCTION__, venid, devid));
+
+       /* We make assumptions about address window mappings */
+       ASSERT((uintptr)regsva == SI_ENUM_BASE);
+
+       /* BCMSDH passes venid and devid based on CIS parsing -- but low-power start
+        * means early parse could fail, so here we should get either an ID
+        * we recognize OR (-1) indicating we must request power first.
+        */
+       /* Check the Vendor ID */
+       switch (venid) {
+               case 0x0000:
+               case VENDOR_BROADCOM:
+                       break;
+               default:
+                       DHD_ERROR(("%s: unknown vendor: 0x%04x\n",
+                                  __FUNCTION__, venid));
+                       goto forcereturn;
+       }
+
+       /* Check the Device ID and make sure it's one that we support */
+       switch (devid) {
+               case BCM4325_D11DUAL_ID:                /* 4325 802.11a/g id */
+               case BCM4325_D11G_ID:                   /* 4325 802.11g 2.4Ghz band id */
+               case BCM4325_D11A_ID:                   /* 4325 802.11a 5Ghz band id */
+                       DHD_INFO(("%s: found 4325 Dongle\n", __FUNCTION__));
+                       break;
+               case BCM4329_D11N_ID:           /* 4329 802.11n dualband device */
+               case BCM4329_D11N2G_ID:         /* 4329 802.11n 2.4G device */
+               case BCM4329_D11N5G_ID:         /* 4329 802.11n 5G device */
+               case 0x4329:
+                       DHD_INFO(("%s: found 4329 Dongle\n", __FUNCTION__));
+                       break;
+               case BCM4315_D11DUAL_ID:                /* 4315 802.11a/g id */
+               case BCM4315_D11G_ID:                   /* 4315 802.11g id */
+               case BCM4315_D11A_ID:                   /* 4315 802.11a id */
+                       DHD_INFO(("%s: found 4315 Dongle\n", __FUNCTION__));
+                       break;
+               case BCM4319_D11N_ID:                   /* 4319 802.11n id */
+               case BCM4319_D11N2G_ID:                 /* 4319 802.11n2g id */
+               case BCM4319_D11N5G_ID:                 /* 4319 802.11n5g id */
+                       DHD_INFO(("%s: found 4319 Dongle\n", __FUNCTION__));
+                       break;
+               case 0:
+                       DHD_INFO(("%s: allow device id 0, will check chip internals\n",
+                                 __FUNCTION__));
+                       break;
+
+               default:
+                       DHD_ERROR(("%s: skipping 0x%04x/0x%04x, not a dongle\n",
+                                  __FUNCTION__, venid, devid));
+                       goto forcereturn;
+       }
+
+       if (osh == NULL) {
+               DHD_ERROR(("%s: osh is NULL!\n", __FUNCTION__));
+               goto forcereturn;
+       }
+
+       /* Allocate private bus interface state */
+       if (!(bus = MALLOC(osh, sizeof(dhd_bus_t)))) {
+               DHD_ERROR(("%s: MALLOC of dhd_bus_t failed\n", __FUNCTION__));
+               goto fail;
+       }
+       bzero(bus, sizeof(dhd_bus_t));
+       bus->sdh = sdh;
+       bus->cl_devid = (uint16)devid;
+       bus->bus = DHD_BUS;
+       bus->bus_num = bus_no;
+       bus->slot_num = slot;
+       bus->tx_seq = SDPCM_SEQUENCE_WRAP - 1;
+       bus->usebufpool = FALSE; /* Use bufpool if allocated, else use locally malloced rxbuf */
+
+#if defined(SUPPORT_P2P_GO_PS)
+       init_waitqueue_head(&bus->bus_sleep);
+#endif /* LINUX && SUPPORT_P2P_GO_PS */
+
+       /* attempt to attach to the dongle */
+       if (!(dhdsdio_probe_attach(bus, osh, sdh, regsva, devid))) {
+               DHD_ERROR(("%s: dhdsdio_probe_attach failed\n", __FUNCTION__));
+               goto fail;
+       }
+
+       /* Attach to the dhd/OS/network interface */
+       if (!(bus->dhd = dhd_attach(osh, bus, SDPCM_RESERVE))) {
+               DHD_ERROR(("%s: dhd_attach failed\n", __FUNCTION__));
+               goto fail;
+       }
+
+       /* Allocate buffers */
+       if (!(dhdsdio_probe_malloc(bus, osh, sdh))) {
+               DHD_ERROR(("%s: dhdsdio_probe_malloc failed\n", __FUNCTION__));
+               goto fail;
+       }
+
+       if (!(dhdsdio_probe_init(bus, osh, sdh))) {
+               DHD_ERROR(("%s: dhdsdio_probe_init failed\n", __FUNCTION__));
+               goto fail;
+       }
+
+       if (bus->intr) {
+               /* Register interrupt callback, but mask it (not operational yet). */
+               DHD_INTR(("%s: disable SDIO interrupts (not interested yet)\n", __FUNCTION__));
+               bcmsdh_intr_disable(sdh);
+               if ((ret = bcmsdh_intr_reg(sdh, dhdsdio_isr, bus)) != 0) {
+                       DHD_ERROR(("%s: FAILED: bcmsdh_intr_reg returned %d\n",
+                                  __FUNCTION__, ret));
+                       goto fail;
+               }
+               DHD_INTR(("%s: registered SDIO interrupt function ok\n", __FUNCTION__));
+       } else {
+               DHD_INFO(("%s: SDIO interrupt function is NOT registered due to polling mode\n",
+                          __FUNCTION__));
+       }
+
+       DHD_INFO(("%s: completed!!\n", __FUNCTION__));
+
+       /* if firmware path present try to download and bring up bus */
+       bus->dhd->hang_report  = TRUE;
+       if (dhd_download_fw_on_driverload) {
+               if ((ret = dhd_bus_start(bus->dhd)) != 0) {
+                       DHD_ERROR(("%s: dhd_bus_start failed\n", __FUNCTION__));
+                               goto fail;
+               }
+       }
+       else {
+               /* Set random MAC address during boot time */
+               get_random_bytes(&bus->dhd->mac.octet[3], 3);
+               /* Adding BRCM OUI */
+               bus->dhd->mac.octet[0] = 0;
+               bus->dhd->mac.octet[1] = 0x90;
+               bus->dhd->mac.octet[2] = 0x4C;
+       }
+       /* Ok, have the per-port tell the stack we're open for business */
+       if (dhd_register_if(bus->dhd, 0, TRUE) != 0) {
+               DHD_ERROR(("%s: Net attach failed!!\n", __FUNCTION__));
+               goto fail;
+       }
+
+#ifdef BCMHOST_XTAL_PU_TIME_MOD
+       bcmsdh_reg_write(bus->sdh, 0x18000620, 2, 11);
+#ifdef BCM4330_CHIP
+       bcmsdh_reg_write(bus->sdh, 0x18000628, 4, 0x0000F801);
+#else
+       bcmsdh_reg_write(bus->sdh, 0x18000628, 4, 0x00F80001);
+#endif /* BCM4330_CHIP */
+#endif /* BCMHOST_XTAL_PU_TIME_MOD */
+
+
+       return bus;
+
+fail:
+       dhdsdio_release(bus, osh);
+
+forcereturn:
+
+       return NULL;
+}
+
+static bool
+dhdsdio_probe_attach(struct dhd_bus *bus, osl_t *osh, void *sdh, void *regsva,
+                     uint16 devid)
+{
+       int err = 0;
+       uint8 clkctl = 0;
+
+       bus->alp_only = TRUE;
+       bus->sih = NULL;
+
+       /* Return the window to backplane enumeration space for core access */
+       if (dhdsdio_set_siaddr_window(bus, SI_ENUM_BASE)) {
+               DHD_ERROR(("%s: FAILED to return to SI_ENUM_BASE\n", __FUNCTION__));
+       }
+
+#if defined(DHD_DEBUG) && !defined(CUSTOMER_HW4_DEBUG)
+       DHD_ERROR(("F1 signature read @0x18000000=0x%4x\n",
+               bcmsdh_reg_read(bus->sdh, SI_ENUM_BASE, 4)));
+#endif /* DHD_DEBUG && !CUSTOMER_HW4_DEBUG */
+
+
+       /* Force PLL off until si_attach() programs PLL control regs */
+
+
+
+       bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, DHD_INIT_CLKCTL1, &err);
+       if (!err)
+               clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+
+       if (err || ((clkctl & ~SBSDIO_AVBITS) != DHD_INIT_CLKCTL1)) {
+               DHD_ERROR(("dhdsdio_probe: ChipClkCSR access: err %d wrote 0x%02x read 0x%02x\n",
+                          err, DHD_INIT_CLKCTL1, clkctl));
+               goto fail;
+       }
+
+#ifdef DHD_DEBUG
+       if (DHD_INFO_ON()) {
+               uint fn, numfn;
+               uint8 *cis[SDIOD_MAX_IOFUNCS];
+               int err = 0;
+
+               numfn = bcmsdh_query_iofnum(sdh);
+               ASSERT(numfn <= SDIOD_MAX_IOFUNCS);
+
+               /* Make sure ALP is available before trying to read CIS */
+               SPINWAIT(((clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
+                                                   SBSDIO_FUNC1_CHIPCLKCSR, NULL)),
+                         !SBSDIO_ALPAV(clkctl)), PMU_MAX_TRANSITION_DLY);
+
+               /* Now request ALP be put on the bus */
+               bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+                                DHD_INIT_CLKCTL2, &err);
+               OSL_DELAY(65);
+
+               for (fn = 0; fn <= numfn; fn++) {
+                       if (!(cis[fn] = MALLOC(osh, SBSDIO_CIS_SIZE_LIMIT))) {
+                               DHD_INFO(("dhdsdio_probe: fn %d cis malloc failed\n", fn));
+                               break;
+                       }
+                       bzero(cis[fn], SBSDIO_CIS_SIZE_LIMIT);
+
+                       if ((err = bcmsdh_cis_read(sdh, fn, cis[fn], SBSDIO_CIS_SIZE_LIMIT))) {
+                               DHD_INFO(("dhdsdio_probe: fn %d cis read err %d\n", fn, err));
+                               MFREE(osh, cis[fn], SBSDIO_CIS_SIZE_LIMIT);
+                               break;
+                       }
+                       dhd_dump_cis(fn, cis[fn]);
+               }
+
+               while (fn-- > 0) {
+                       ASSERT(cis[fn]);
+                       MFREE(osh, cis[fn], SBSDIO_CIS_SIZE_LIMIT);
+               }
+
+               if (err) {
+                       DHD_ERROR(("dhdsdio_probe: failure reading or parsing CIS\n"));
+                       goto fail;
+               }
+       }
+#endif /* DHD_DEBUG */
+
+       /* si_attach() will provide an SI handle and scan the backplane */
+       if (!(bus->sih = si_attach((uint)devid, osh, regsva, DHD_BUS, sdh,
+                                  &bus->vars, &bus->varsz))) {
+               DHD_ERROR(("%s: si_attach failed!\n", __FUNCTION__));
+               goto fail;
+       }
+
+#ifdef DHD_DEBUG
+       DHD_ERROR(("F1 signature OK, socitype:0x%x chip:0x%4x rev:0x%x pkg:0x%x\n",
+               bus->sih->socitype, bus->sih->chip, bus->sih->chiprev, bus->sih->chippkg));
+#endif /* DHD_DEBUG */
+
+
+       bcmsdh_chipinfo(sdh, bus->sih->chip, bus->sih->chiprev);
+
+       if (!dhdsdio_chipmatch((uint16)bus->sih->chip)) {
+               DHD_ERROR(("%s: unsupported chip: 0x%04x\n",
+                          __FUNCTION__, bus->sih->chip));
+               goto fail;
+       }
+
+       if (bus->sih->buscorerev >= 12)
+               dhdsdio_clk_kso_init(bus);
+       else
+               bus->kso = TRUE;
+
+       if (CST4330_CHIPMODE_SDIOD(bus->sih->chipst)) {
+       }
+
+       si_sdiod_drive_strength_init(bus->sih, osh, dhd_sdiod_drive_strength);
+
+
+       /* Get info on the ARM and SOCRAM cores... */
+       if (!DHD_NOPMU(bus)) {
+               if ((si_setcore(bus->sih, ARM7S_CORE_ID, 0)) ||
+                   (si_setcore(bus->sih, ARMCM3_CORE_ID, 0)) ||
+                   (si_setcore(bus->sih, ARMCR4_CORE_ID, 0))) {
+                       bus->armrev = si_corerev(bus->sih);
+               } else {
+                       DHD_ERROR(("%s: failed to find ARM core!\n", __FUNCTION__));
+                       goto fail;
+               }
+
+               if (!si_setcore(bus->sih, ARMCR4_CORE_ID, 0)) {
+                       if (!(bus->orig_ramsize = si_socram_size(bus->sih))) {
+                               DHD_ERROR(("%s: failed to find SOCRAM memory!\n", __FUNCTION__));
+                               goto fail;
+                       }
+               } else {
+                       /* cr4 has a different way to find the RAM size from TCM's */
+                       if (!(bus->orig_ramsize = si_tcm_size(bus->sih))) {
+                               DHD_ERROR(("%s: failed to find CR4-TCM memory!\n", __FUNCTION__));
+                               goto fail;
+                       }
+                       /* also populate base address */
+                       switch ((uint16)bus->sih->chip) {
+                       case BCM4335_CHIP_ID:
+                       case BCM4339_CHIP_ID:
+                       case BCM43349_CHIP_ID:
+                               bus->dongle_ram_base = CR4_4335_RAM_BASE;
+                               break;
+                       case BCM4350_CHIP_ID:
+                       case BCM4354_CHIP_ID:
+                       case BCM4356_CHIP_ID:
+                       case BCM4358_CHIP_ID:
+                               bus->dongle_ram_base = CR4_4350_RAM_BASE;
+                               break;
+                       case BCM4360_CHIP_ID:
+                               bus->dongle_ram_base = CR4_4360_RAM_BASE;
+                               break;
+                       case BCM4345_CHIP_ID:
+                       case BCM43454_CHIP_ID:
+                               bus->dongle_ram_base = (bus->sih->chiprev < 6)  /* from 4345C0 */
+                                       ? CR4_4345_LT_C0_RAM_BASE : CR4_4345_GE_C0_RAM_BASE;
+                               break;
+                       case BCM4349_CHIP_GRPID:
+                               /* RAM base changed from 4349c0(revid=9) onwards */
+                               bus->dongle_ram_base = ((bus->sih->chiprev < 9) ?
+                               CR4_4349_RAM_BASE: CR4_4349_RAM_BASE_FROM_REV_9);
+                               break;
+                       default:
+                               bus->dongle_ram_base = 0;
+                               DHD_ERROR(("%s: WARNING: Using default ram base at 0x%x\n",
+                                          __FUNCTION__, bus->dongle_ram_base));
+                       }
+               }
+               bus->ramsize = bus->orig_ramsize;
+               if (dhd_dongle_ramsize)
+                       dhd_dongle_setramsize(bus, dhd_dongle_ramsize);
+
+               DHD_ERROR(("DHD: dongle ram size is set to %d(orig %d) at 0x%x\n",
+                          bus->ramsize, bus->orig_ramsize, bus->dongle_ram_base));
+
+               bus->srmemsize = si_socram_srmem_size(bus->sih);
+       }
+
+       /* ...but normally deal with the SDPCMDEV core */
+       if (!(bus->regs = si_setcore(bus->sih, PCMCIA_CORE_ID, 0)) &&
+           !(bus->regs = si_setcore(bus->sih, SDIOD_CORE_ID, 0))) {
+               DHD_ERROR(("%s: failed to find SDIODEV core!\n", __FUNCTION__));
+               goto fail;
+       }
+       bus->sdpcmrev = si_corerev(bus->sih);
+
+       /* Set core control so an SDIO reset does a backplane reset */
+       OR_REG(osh, &bus->regs->corecontrol, CC_BPRESEN);
+       bus->rxint_mode = SDIO_DEVICE_HMB_RXINT;
+
+       if ((bus->sih->buscoretype == SDIOD_CORE_ID) && (bus->sdpcmrev >= 4) &&
+               (bus->rxint_mode  == SDIO_DEVICE_RXDATAINT_MODE_1))
+       {
+               uint32 val;
+
+               val = R_REG(osh, &bus->regs->corecontrol);
+               val &= ~CC_XMTDATAAVAIL_MODE;
+               val |= CC_XMTDATAAVAIL_CTRL;
+               W_REG(osh, &bus->regs->corecontrol, val);
+       }
+
+
+       pktq_init(&bus->txq, (PRIOMASK + 1), QLEN);
+
+       /* Locate an appropriately-aligned portion of hdrbuf */
+       bus->rxhdr = (uint8 *)ROUNDUP((uintptr)&bus->hdrbuf[0], DHD_SDALIGN);
+
+       /* Set the poll and/or interrupt flags */
+       bus->intr = (bool)dhd_intr;
+       if ((bus->poll = (bool)dhd_poll))
+               bus->pollrate = 1;
+
+       /* Setting default Glom size */
+       bus->txglomsize = SDPCM_DEFGLOM_SIZE;
+
+       return TRUE;
+
+fail:
+       if (bus->sih != NULL) {
+               si_detach(bus->sih);
+               bus->sih = NULL;
+       }
+       return FALSE;
+}
+
+static bool
+dhdsdio_probe_malloc(dhd_bus_t *bus, osl_t *osh, void *sdh)
+{
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (bus->dhd->maxctl) {
+               bus->rxblen = ROUNDUP((bus->dhd->maxctl+SDPCM_HDRLEN), ALIGNMENT) + DHD_SDALIGN;
+               if (!(bus->rxbuf = DHD_OS_PREALLOC(bus->dhd, DHD_PREALLOC_RXBUF, bus->rxblen))) {
+                       DHD_ERROR(("%s: MALLOC of %d-byte rxbuf failed\n",
+                                  __FUNCTION__, bus->rxblen));
+                       goto fail;
+               }
+       }
+       /* Allocate buffer to receive glomed packet */
+       if (!(bus->databuf = DHD_OS_PREALLOC(bus->dhd, DHD_PREALLOC_DATABUF, MAX_DATA_BUF))) {
+               DHD_ERROR(("%s: MALLOC of %d-byte databuf failed\n",
+                       __FUNCTION__, MAX_DATA_BUF));
+               /* release rxbuf which was already located as above */
+               if (!bus->rxblen)
+                       DHD_OS_PREFREE(bus->dhd, bus->rxbuf, bus->rxblen);
+               goto fail;
+       }
+
+       /* Align the buffer */
+       if ((uintptr)bus->databuf % DHD_SDALIGN)
+               bus->dataptr = bus->databuf + (DHD_SDALIGN - ((uintptr)bus->databuf % DHD_SDALIGN));
+       else
+               bus->dataptr = bus->databuf;
+
+       return TRUE;
+
+fail:
+       return FALSE;
+}
+
+static bool
+dhdsdio_probe_init(dhd_bus_t *bus, osl_t *osh, void *sdh)
+{
+       int32 fnum;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       bus->_srenab = FALSE;
+
+#ifdef SDTEST
+       dhdsdio_pktgen_init(bus);
+#endif /* SDTEST */
+
+       /* Disable F2 to clear any intermediate frame state on the dongle */
+       bcmsdh_cfg_write(sdh, SDIO_FUNC_0, SDIOD_CCCR_IOEN, SDIO_FUNC_ENABLE_1, NULL);
+
+       bus->dhd->busstate = DHD_BUS_DOWN;
+       bus->sleeping = FALSE;
+       bus->rxflow = FALSE;
+       bus->prev_rxlim_hit = 0;
+
+       /* Done with backplane-dependent accesses, can drop clock... */
+       bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
+
+       /* ...and initialize clock/power states */
+       bus->clkstate = CLK_SDONLY;
+       bus->idletime = (int32)dhd_idletime;
+       bus->idleclock = DHD_IDLE_ACTIVE;
+
+       /* Query the SD clock speed */
+       if (bcmsdh_iovar_op(sdh, "sd_divisor", NULL, 0,
+                           &bus->sd_divisor, sizeof(int32), FALSE) != BCME_OK) {
+               DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, "sd_divisor"));
+               bus->sd_divisor = -1;
+       } else {
+               DHD_INFO(("%s: Initial value for %s is %d\n",
+                         __FUNCTION__, "sd_divisor", bus->sd_divisor));
+       }
+
+       /* Query the SD bus mode */
+       if (bcmsdh_iovar_op(sdh, "sd_mode", NULL, 0,
+                           &bus->sd_mode, sizeof(int32), FALSE) != BCME_OK) {
+               DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, "sd_mode"));
+               bus->sd_mode = -1;
+       } else {
+               DHD_INFO(("%s: Initial value for %s is %d\n",
+                         __FUNCTION__, "sd_mode", bus->sd_mode));
+       }
+
+       /* Query the F2 block size, set roundup accordingly */
+       fnum = 2;
+       if (bcmsdh_iovar_op(sdh, "sd_blocksize", &fnum, sizeof(int32),
+                           &bus->blocksize, sizeof(int32), FALSE) != BCME_OK) {
+               bus->blocksize = 0;
+               DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, "sd_blocksize"));
+       } else {
+               DHD_INFO(("%s: Initial value for %s is %d\n",
+                         __FUNCTION__, "sd_blocksize", bus->blocksize));
+
+               dhdsdio_tune_fifoparam(bus);
+       }
+       bus->roundup = MIN(max_roundup, bus->blocksize);
+
+#ifdef DHDENABLE_TAILPAD
+       if (bus->pad_pkt)
+               PKTFREE(osh, bus->pad_pkt, FALSE);
+       bus->pad_pkt = PKTGET(osh, SDIO_MAX_BLOCK_SIZE, FALSE);
+       if (bus->pad_pkt == NULL)
+               DHD_ERROR(("failed to allocate padding packet\n"));
+       else {
+               int alignment_offset = 0;
+               uintptr pktprt = (uintptr)PKTDATA(osh, bus->pad_pkt);
+               if (!(pktprt&1) && (pktprt = (pktprt % DHD_SDALIGN)))
+                       PKTPUSH(osh, bus->pad_pkt, alignment_offset);
+               PKTSETNEXT(osh, bus->pad_pkt, NULL);
+       }
+#endif /* DHDENABLE_TAILPAD */
+
+       /* Query if bus module supports packet chaining, default to use if supported */
+       if (bcmsdh_iovar_op(sdh, "sd_rxchain", NULL, 0,
+                           &bus->sd_rxchain, sizeof(int32), FALSE) != BCME_OK) {
+               bus->sd_rxchain = FALSE;
+       } else {
+               DHD_INFO(("%s: bus module (through bcmsdh API) %s chaining\n",
+                         __FUNCTION__, (bus->sd_rxchain ? "supports" : "does not support")));
+       }
+       bus->use_rxchain = (bool)bus->sd_rxchain;
+       bus->txinrx_thres = CUSTOM_TXINRX_THRES;
+       /* TX first in dhdsdio_readframes() */
+       bus->dotxinrx = TRUE;
+
+       return TRUE;
+}
+
+int
+dhd_bus_download_firmware(struct dhd_bus *bus, osl_t *osh,
+                          char *pfw_path, char *pnv_path)
+{
+       int ret;
+
+       bus->fw_path = pfw_path;
+       bus->nv_path = pnv_path;
+
+       ret = dhdsdio_download_firmware(bus, osh, bus->sdh);
+
+
+       return ret;
+}
+
+static int
+dhdsdio_download_firmware(struct dhd_bus *bus, osl_t *osh, void *sdh)
+{
+       int ret;
+
+
+       DHD_TRACE_HW4(("%s: firmware path=%s, nvram path=%s\n",
+               __FUNCTION__, bus->fw_path, bus->nv_path));
+       DHD_OS_WAKE_LOCK(bus->dhd);
+
+       /* Download the firmware */
+       dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+       ret = _dhdsdio_download_firmware(bus);
+
+       dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+
+       DHD_OS_WAKE_UNLOCK(bus->dhd);
+       return ret;
+}
+
+/* Detach and free everything */
+static void
+dhdsdio_release(dhd_bus_t *bus, osl_t *osh)
+{
+       bool dongle_isolation = FALSE;
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (bus) {
+               ASSERT(osh);
+
+               if (bus->dhd) {
+                       dongle_isolation = bus->dhd->dongle_isolation;
+                       dhd_detach(bus->dhd);
+               }
+
+               /* De-register interrupt handler */
+               bcmsdh_intr_disable(bus->sdh);
+               bcmsdh_intr_dereg(bus->sdh);
+
+               if (bus->dhd) {
+                       dhdsdio_release_dongle(bus, osh, dongle_isolation, TRUE);
+                       dhd_free(bus->dhd);
+                       bus->dhd = NULL;
+               }
+
+               dhdsdio_release_malloc(bus, osh);
+
+#ifdef DHD_DEBUG
+               if (bus->console.buf != NULL)
+                       MFREE(osh, bus->console.buf, bus->console.bufsize);
+#endif
+
+#ifdef DHDENABLE_TAILPAD
+               if (bus->pad_pkt)
+                       PKTFREE(osh, bus->pad_pkt, FALSE);
+#endif /* DHDENABLE_TAILPAD */
+
+               MFREE(osh, bus, sizeof(dhd_bus_t));
+       }
+
+       DHD_TRACE(("%s: Disconnected\n", __FUNCTION__));
+}
+
+static void
+dhdsdio_release_malloc(dhd_bus_t *bus, osl_t *osh)
+{
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       if (bus->dhd && bus->dhd->dongle_reset)
+               return;
+
+       if (bus->rxbuf) {
+#ifndef CONFIG_DHD_USE_STATIC_BUF
+               MFREE(osh, bus->rxbuf, bus->rxblen);
+#endif
+               bus->rxctl = bus->rxbuf = NULL;
+               bus->rxlen = 0;
+       }
+
+       if (bus->databuf) {
+#ifndef CONFIG_DHD_USE_STATIC_BUF
+               MFREE(osh, bus->databuf, MAX_DATA_BUF);
+#endif
+               bus->databuf = NULL;
+       }
+
+       if (bus->vars && bus->varsz) {
+               MFREE(osh, bus->vars, bus->varsz);
+               bus->vars = NULL;
+       }
+
+}
+
+
+static void
+dhdsdio_release_dongle(dhd_bus_t *bus, osl_t *osh, bool dongle_isolation, bool reset_flag)
+{
+       DHD_TRACE(("%s: Enter bus->dhd %p bus->dhd->dongle_reset %d \n", __FUNCTION__,
+               bus->dhd, bus->dhd->dongle_reset));
+
+       if ((bus->dhd && bus->dhd->dongle_reset) && reset_flag)
+               return;
+
+       if (bus->sih) {
+#if !defined(BCMLXSDMMC)
+               if (bus->dhd) {
+                       dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+               }
+               if (KSO_ENAB(bus) && (dongle_isolation == FALSE))
+                       si_watchdog(bus->sih, 4);
+#endif /* !defined(BCMLXSDMMC) */
+               if (bus->dhd) {
+                       dhdsdio_clkctl(bus, CLK_NONE, FALSE);
+               }
+               si_detach(bus->sih);
+               bus->sih = NULL;
+               if (bus->vars && bus->varsz)
+                       MFREE(osh, bus->vars, bus->varsz);
+               bus->vars = NULL;
+       }
+
+       DHD_TRACE(("%s: Disconnected\n", __FUNCTION__));
+}
+
+static void
+dhdsdio_disconnect(void *ptr)
+{
+       dhd_bus_t *bus = (dhd_bus_t *)ptr;
+
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+
+
+       if (bus) {
+               ASSERT(bus->dhd);
+               dhdsdio_release(bus, bus->dhd->osh);
+       }
+
+
+
+       DHD_TRACE(("%s: Disconnected\n", __FUNCTION__));
+}
+
+static int
+dhdsdio_suspend(void *context)
+{
+       int ret = 0;
+
+       dhd_bus_t *bus = (dhd_bus_t*)context;
+#ifdef SUPPORT_P2P_GO_PS
+       int wait_time = 0;
+
+       if (bus->idletime > 0) {
+               wait_time = msecs_to_jiffies(bus->idletime * dhd_watchdog_ms);
+       }
+#endif /* SUPPORT_P2P_GO_PS */
+       ret = dhd_os_check_wakelock(bus->dhd);
+#ifdef SUPPORT_P2P_GO_PS
+       if ((!ret) && (bus->dhd->up) && (bus->dhd->op_mode != DHD_FLAG_HOSTAP_MODE)) {
+               if (wait_event_timeout(bus->bus_sleep, bus->sleeping, wait_time) == 0) {
+                       if (!bus->sleeping) {
+                               return 1;
+                       }
+               }
+       }
+#endif /* SUPPORT_P2P_GO_PS */
+       return ret;
+}
+
+static int
+dhdsdio_resume(void *context)
+{
+
+       dhd_bus_t *bus = (dhd_bus_t*)context;
+
+#if defined(OOB_INTR_ONLY)
+       OOB_PARAM_IF(!(bus->dhd->oob_disable)) {
+               if (dhd_os_check_if_up(bus->dhd))
+                       bcmsdh_oob_intr_set(bus->sdh, TRUE);
+       }
+#endif 
+
+       /* Clear KSO bit to fix suspend/resume current draw issue */
+       dhdsdio_clk_kso_enab(bus, FALSE);
+
+       return 0;
+}
+
+
+/* Register/Unregister functions are called by the main DHD entry
+ * point (e.g. module insertion) to link with the bus driver, in
+ * order to look for or await the device.
+ */
+
+static bcmsdh_driver_t dhd_sdio = {
+       dhdsdio_probe,
+       dhdsdio_disconnect,
+       dhdsdio_suspend,
+       dhdsdio_resume
+};
+
+int
+dhd_bus_register(void)
+{
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       return bcmsdh_register(&dhd_sdio);
+}
+
+void
+dhd_bus_unregister(void)
+{
+       DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+       bcmsdh_unregister();
+}
+
+#if defined(BCMLXSDMMC)
+/* Register a dummy SDIO client driver in order to be notified of new SDIO device */
+int dhd_bus_reg_sdio_notify(void* semaphore)
+{
+       return bcmsdh_reg_sdio_notify(semaphore);
+}
+
+void dhd_bus_unreg_sdio_notify(void)
+{
+       bcmsdh_unreg_sdio_notify();
+}
+#endif /* defined(BCMLXSDMMC) */
+
+#ifdef BCMEMBEDIMAGE
+static int
+dhdsdio_download_code_array(struct dhd_bus *bus)
+{
+       int bcmerror = -1;
+       int offset = 0;
+       unsigned char *ularray = NULL;
+
+       DHD_INFO(("%s: download embedded firmware...\n", __FUNCTION__));
+
+       /* Download image */
+       while ((offset + MEMBLOCK) < sizeof(dlarray)) {
+               /* check if CR4 */
+               if (si_setcore(bus->sih, ARMCR4_CORE_ID, 0)) {
+                       /* if address is 0, store the reset instruction to be written in 0 */
+
+                       if (offset == 0) {
+                               bus->resetinstr = *(((uint32*)dlarray));
+                               /* Add start of RAM address to the address given by user */
+                               offset += bus->dongle_ram_base;
+                       }
+               }
+
+               bcmerror = dhdsdio_membytes(bus, TRUE, offset,
+                       (uint8 *) (dlarray + offset), MEMBLOCK);
+               if (bcmerror) {
+                       DHD_ERROR(("%s: error %d on writing %d membytes at 0x%08x\n",
+                               __FUNCTION__, bcmerror, MEMBLOCK, offset));
+                       goto err;
+               }
+
+               offset += MEMBLOCK;
+       }
+
+       if (offset < sizeof(dlarray)) {
+               bcmerror = dhdsdio_membytes(bus, TRUE, offset,
+                       (uint8 *) (dlarray + offset), sizeof(dlarray) - offset);
+               if (bcmerror) {
+                       DHD_ERROR(("%s: error %d on writing %d membytes at 0x%08x\n",
+                               __FUNCTION__, bcmerror, sizeof(dlarray) - offset, offset));
+                       goto err;
+               }
+       }
+
+#ifdef DHD_DEBUG
+       /* Upload and compare the downloaded code */
+       {
+               ularray = MALLOC(bus->dhd->osh, bus->ramsize);
+               /* Upload image to verify downloaded contents. */
+               offset = 0;
+               memset(ularray, 0xaa, bus->ramsize);
+               while ((offset + MEMBLOCK) < sizeof(dlarray)) {
+                       bcmerror = dhdsdio_membytes(bus, FALSE, offset, ularray + offset, MEMBLOCK);
+                       if (bcmerror) {
+                               DHD_ERROR(("%s: error %d on reading %d membytes at 0x%08x\n",
+                                       __FUNCTION__, bcmerror, MEMBLOCK, offset));
+                               goto err;
+                       }
+
+                       offset += MEMBLOCK;
+               }
+
+               if (offset < sizeof(dlarray)) {
+                       bcmerror = dhdsdio_membytes(bus, FALSE, offset,
+                               ularray + offset, sizeof(dlarray) - offset);
+                       if (bcmerror) {
+                               DHD_ERROR(("%s: error %d on reading %d membytes at 0x%08x\n",
+                                       __FUNCTION__, bcmerror, sizeof(dlarray) - offset, offset));
+                               goto err;
+                       }
+               }
+
+               if (memcmp(dlarray, ularray, sizeof(dlarray))) {
+                       DHD_ERROR(("%s: Downloaded image is corrupted (%s, %s, %s).\n",
+                                  __FUNCTION__, dlimagename, dlimagever, dlimagedate));
+                       goto err;
+               } else
+                       DHD_ERROR(("%s: Download, Upload and compare succeeded (%s, %s, %s).\n",
+                                  __FUNCTION__, dlimagename, dlimagever, dlimagedate));
+
+       }
+#endif /* DHD_DEBUG */
+
+err:
+       if (ularray)
+               MFREE(bus->dhd->osh, ularray, bus->ramsize);
+       return bcmerror;
+}
+#endif /* BCMEMBEDIMAGE */
+
+static int
+dhdsdio_download_code_file(struct dhd_bus *bus, char *pfw_path)
+{
+       int bcmerror = -1;
+       int offset = 0;
+       int len;
+       void *image = NULL;
+       uint8 *memblock = NULL, *memptr;
+
+       DHD_INFO(("%s: download firmware %s\n", __FUNCTION__, pfw_path));
+
+       image = dhd_os_open_image(pfw_path);
+       if (image == NULL)
+               goto err;
+
+       memptr = memblock = MALLOC(bus->dhd->osh, MEMBLOCK + DHD_SDALIGN);
+       if (memblock == NULL) {
+               DHD_ERROR(("%s: Failed to allocate memory %d bytes\n", __FUNCTION__, MEMBLOCK));
+               goto err;
+       }
+       if ((uint32)(uintptr)memblock % DHD_SDALIGN)
+               memptr += (DHD_SDALIGN - ((uint32)(uintptr)memblock % DHD_SDALIGN));
+
+       /* Download image */
+       while ((len = dhd_os_get_image_block((char*)memptr, MEMBLOCK, image))) {
+               if (len < 0) {
+                       DHD_ERROR(("%s: dhd_os_get_image_block failed (%d)\n", __FUNCTION__, len));
+                       bcmerror = BCME_ERROR;
+                       goto err;
+               }
+               /* check if CR4 */
+               if (si_setcore(bus->sih, ARMCR4_CORE_ID, 0)) {
+                       /* if address is 0, store the reset instruction to be written in 0 */
+
+                       if (offset == 0) {
+                               bus->resetinstr = *(((uint32*)memptr));
+                               /* Add start of RAM address to the address given by user */
+                               offset += bus->dongle_ram_base;
+                       }
+               }
+
+               bcmerror = dhdsdio_membytes(bus, TRUE, offset, memptr, len);
+               if (bcmerror) {
+                       DHD_ERROR(("%s: error %d on writing %d membytes at 0x%08x\n",
+                               __FUNCTION__, bcmerror, MEMBLOCK, offset));
+                       goto err;
+               }
+
+               offset += MEMBLOCK;
+       }
+
+err:
+       if (memblock)
+               MFREE(bus->dhd->osh, memblock, MEMBLOCK + DHD_SDALIGN);
+
+       if (image)
+               dhd_os_close_image(image);
+
+       return bcmerror;
+}
+
+static int
+dhdsdio_download_nvram(struct dhd_bus *bus)
+{
+       int bcmerror = -1;
+       uint len;
+       void * image = NULL;
+       char * memblock = NULL;
+       char *bufp;
+       char *pnv_path;
+       bool nvram_file_exists;
+
+       pnv_path = bus->nv_path;
+
+       nvram_file_exists = ((pnv_path != NULL) && (pnv_path[0] != '\0'));
+
+       /* For Get nvram from UEFI */
+       if (nvram_file_exists)
+               image = dhd_os_open_image(pnv_path);
+
+       memblock = MALLOC(bus->dhd->osh, MAX_NVRAMBUF_SIZE);
+       if (memblock == NULL) {
+               DHD_ERROR(("%s: Failed to allocate memory %d bytes\n",
+                          __FUNCTION__, MAX_NVRAMBUF_SIZE));
+               goto err;
+       }
+
+       /* For Get nvram from image or UEFI (when image == NULL ) */
+       len = dhd_os_get_image_block(memblock, MAX_NVRAMBUF_SIZE, image);
+
+       if (len > 0 && len < MAX_NVRAMBUF_SIZE) {
+               bufp = (char *)memblock;
+               bufp[len] = 0;
+               len = process_nvram_vars(bufp, len);
+               if (len % 4) {
+                       len += 4 - (len % 4);
+               }
+               bufp += len;
+               *bufp++ = 0;
+               if (len)
+                       bcmerror = dhdsdio_downloadvars(bus, memblock, len + 1);
+               if (bcmerror) {
+                       DHD_ERROR(("%s: error downloading vars: %d\n",
+                                  __FUNCTION__, bcmerror));
+               }
+       }
+       else {
+               DHD_ERROR(("%s: error reading nvram file: %d\n",
+                          __FUNCTION__, len));
+               bcmerror = BCME_SDIO_ERROR;
+       }
+
+err:
+       if (memblock)
+               MFREE(bus->dhd->osh, memblock, MAX_NVRAMBUF_SIZE);
+
+       if (image)
+               dhd_os_close_image(image);
+
+       return bcmerror;
+}
+
+static int
+_dhdsdio_download_firmware(struct dhd_bus *bus)
+{
+       int bcmerror = -1;
+
+       bool embed = FALSE;     /* download embedded firmware */
+       bool dlok = FALSE;      /* download firmware succeeded */
+
+       /* Out immediately if no image to download */
+       if ((bus->fw_path == NULL) || (bus->fw_path[0] == '\0')) {
+#ifdef BCMEMBEDIMAGE
+               embed = TRUE;
+#else
+               return 0;
+#endif
+       }
+
+       /* Keep arm in reset */
+       if (dhdsdio_download_state(bus, TRUE)) {
+               DHD_ERROR(("%s: error placing ARM core in reset\n", __FUNCTION__));
+               goto err;
+       }
+
+       /* External image takes precedence if specified */
+       if ((bus->fw_path != NULL) && (bus->fw_path[0] != '\0')) {
+               if (dhdsdio_download_code_file(bus, bus->fw_path)) {
+                       DHD_ERROR(("%s: dongle image file download failed\n", __FUNCTION__));
+#ifdef BCMEMBEDIMAGE
+                       embed = TRUE;
+#else
+                       goto err;
+#endif
+               }
+               else {
+                       embed = FALSE;
+                       dlok = TRUE;
+               }
+       }
+
+#ifdef BCMEMBEDIMAGE
+       if (embed) {
+               if (dhdsdio_download_code_array(bus)) {
+                       DHD_ERROR(("%s: dongle image array download failed\n", __FUNCTION__));
+                       goto err;
+               }
+               else {
+                       dlok = TRUE;
+               }
+       }
+#else
+       BCM_REFERENCE(embed);
+#endif
+       if (!dlok) {
+               DHD_ERROR(("%s: dongle image download failed\n", __FUNCTION__));
+               goto err;
+       }
+
+       /* External nvram takes precedence if specified */
+       if (dhdsdio_download_nvram(bus)) {
+               DHD_ERROR(("%s: dongle nvram file download failed\n", __FUNCTION__));
+               goto err;
+       }
+
+       /* Take arm out of reset */
+       if (dhdsdio_download_state(bus, FALSE)) {
+               DHD_ERROR(("%s: error getting out of ARM core reset\n", __FUNCTION__));
+               goto err;
+       }
+
+       bcmerror = 0;
+
+err:
+       return bcmerror;
+}
+
+static int
+dhd_bcmsdh_recv_buf(dhd_bus_t *bus, uint32 addr, uint fn, uint flags, uint8 *buf, uint nbytes,
+       void *pkt, bcmsdh_cmplt_fn_t complete, void *handle)
+{
+       int status;
+
+       if (!KSO_ENAB(bus)) {
+               DHD_ERROR(("%s: Device asleep\n", __FUNCTION__));
+               return BCME_NODEVICE;
+       }
+
+       status = bcmsdh_recv_buf(bus->sdh, addr, fn, flags, buf, nbytes, pkt, complete, handle);
+
+       return status;
+}
+
+static int
+dhd_bcmsdh_send_buf(dhd_bus_t *bus, uint32 addr, uint fn, uint flags, uint8 *buf, uint nbytes,
+       void *pkt, bcmsdh_cmplt_fn_t complete, void *handle, int max_retry)
+{
+       int ret;
+       int i = 0;
+       int retries = 0;
+       bcmsdh_info_t *sdh;
+
+       if (!KSO_ENAB(bus)) {
+               DHD_ERROR(("%s: Device asleep\n", __FUNCTION__));
+               return BCME_NODEVICE;
+       }
+
+       sdh = bus->sdh;
+       do {
+               ret = bcmsdh_send_buf(bus->sdh, addr, fn, flags, buf, nbytes,
+                       pkt, complete, handle);
+
+               bus->f2txdata++;
+               ASSERT(ret != BCME_PENDING);
+
+               if (ret == BCME_NODEVICE) {
+                       DHD_ERROR(("%s: Device asleep already\n", __FUNCTION__));
+               } else if (ret < 0) {
+                       /* On failure, abort the command and terminate the frame */
+                       DHD_ERROR(("%s: sdio error %d, abort command and terminate frame.\n",
+                               __FUNCTION__, ret));
+                       bus->tx_sderrs++;
+                       bus->f1regdata++;
+                       bus->dhd->tx_errors++;
+                       bcmsdh_abort(sdh, SDIO_FUNC_2);
+                       bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_FRAMECTRL,
+                               SFC_WF_TERM, NULL);
+                       for (i = 0; i < READ_FRM_CNT_RETRIES; i++) {
+                               uint8 hi, lo;
+                               hi = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_WFRAMEBCHI,
+                                       NULL);
+                               lo = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_WFRAMEBCLO,
+                                       NULL);
+                               bus->f1regdata += 2;
+                               if ((hi == 0) && (lo == 0))
+                                       break;
+                       }
+               }
+       } while ((ret < 0) && retrydata && ++retries < max_retry);
+
+       return ret;
+}
+
+uint8
+dhd_bus_is_ioready(struct dhd_bus *bus)
+{
+       uint8 enable;
+       bcmsdh_info_t *sdh;
+       ASSERT(bus);
+       ASSERT(bus->sih != NULL);
+       enable = (SDIO_FUNC_ENABLE_1 | SDIO_FUNC_ENABLE_2);
+       sdh = bus->sdh;
+       return (enable == bcmsdh_cfg_read(sdh, SDIO_FUNC_0, SDIOD_CCCR_IORDY, NULL));
+}
+
+uint
+dhd_bus_chip(struct dhd_bus *bus)
+{
+       ASSERT(bus->sih != NULL);
+       return bus->sih->chip;
+}
+
+uint
+dhd_bus_chiprev(struct dhd_bus *bus)
+{
+       ASSERT(bus);
+       ASSERT(bus->sih != NULL);
+       return bus->sih->chiprev;
+}
+
+void *
+dhd_bus_pub(struct dhd_bus *bus)
+{
+       return bus->dhd;
+}
+
+void *
+dhd_bus_sih(struct dhd_bus *bus)
+{
+       return (void *)bus->sih;
+}
+
+void *
+dhd_bus_txq(struct dhd_bus *bus)
+{
+       return &bus->txq;
+}
+
+uint
+dhd_bus_hdrlen(struct dhd_bus *bus)
+{
+       return (bus->txglom_enable) ? SDPCM_HDRLEN_TXGLOM : SDPCM_HDRLEN;
+}
+
+void
+dhd_bus_set_dotxinrx(struct dhd_bus *bus, bool val)
+{
+       bus->dotxinrx = val;
+}
+
+int
+dhd_bus_devreset(dhd_pub_t *dhdp, uint8 flag)
+{
+       int bcmerror = 0;
+       dhd_bus_t *bus;
+
+       bus = dhdp->bus;
+
+       if (flag == TRUE) {
+               if (!bus->dhd->dongle_reset) {
+                       dhd_os_sdlock(dhdp);
+                       dhd_os_wd_timer(dhdp, 0);
+#if !defined(IGNORE_ETH0_DOWN)
+                       /* Force flow control as protection when stop come before ifconfig_down */
+                       dhd_txflowcontrol(bus->dhd, ALL_INTERFACES, ON);
+#endif /* !defined(IGNORE_ETH0_DOWN) */
+                       /* Expect app to have torn down any connection before calling */
+                       /* Stop the bus, disable F2 */
+                       dhd_bus_stop(bus, FALSE);
+
+#if defined(OOB_INTR_ONLY)
+                       OOB_PARAM_IF(!(dhdp->oob_disable)) {
+                               /* Clean up any pending IRQ */
+                               dhd_enable_oob_intr(bus, FALSE);
+                               bcmsdh_oob_intr_set(bus->sdh, FALSE);
+                               bcmsdh_oob_intr_unregister(bus->sdh);
+                       }
+#endif 
+
+                       /* Clean tx/rx buffer pointers, detach from the dongle */
+                       dhdsdio_release_dongle(bus, bus->dhd->osh, TRUE, TRUE);
+
+                       bus->dhd->dongle_reset = TRUE;
+                       bus->dhd->up = FALSE;
+                       dhd_txglom_enable(dhdp, FALSE);
+                       dhd_os_sdunlock(dhdp);
+
+                       DHD_TRACE(("%s:  WLAN OFF DONE\n", __FUNCTION__));
+                       /* App can now remove power from device */
+               } else
+                       bcmerror = BCME_SDIO_ERROR;
+       } else {
+               /* App must have restored power to device before calling */
+
+               DHD_TRACE(("\n\n%s: == WLAN ON ==\n", __FUNCTION__));
+
+               if (bus->dhd->dongle_reset) {
+                       /* Turn on WLAN */
+                       dhd_os_sdlock(dhdp);
+                       /* Reset SD client */
+                       bcmsdh_reset(bus->sdh);
+
+                       /* Attempt to re-attach & download */
+                       if (dhdsdio_probe_attach(bus, bus->dhd->osh, bus->sdh,
+                               (uint32 *)SI_ENUM_BASE,
+                               bus->cl_devid)) {
+                               /* Attempt to download binary to the dongle */
+                               if (dhdsdio_probe_init(bus, bus->dhd->osh, bus->sdh) &&
+                                   dhdsdio_download_firmware(bus, bus->dhd->osh, bus->sdh) >= 0) {
+
+                                       /* Re-init bus, enable F2 transfer */
+                                       bcmerror = dhd_bus_init((dhd_pub_t *) bus->dhd, FALSE);
+                                       if (bcmerror == BCME_OK) {
+#if defined(OOB_INTR_ONLY)
+                                               OOB_PARAM_IF(!(dhdp->oob_disable)) {
+                                                       dhd_enable_oob_intr(bus, TRUE);
+                                                       bcmsdh_oob_intr_register(bus->sdh,
+                                                               dhdsdio_isr, bus);
+                                                       bcmsdh_oob_intr_set(bus->sdh, TRUE);
+                                               }
+#endif 
+
+                                               bus->dhd->dongle_reset = FALSE;
+                                               bus->dhd->up = TRUE;
+
+#if !defined(IGNORE_ETH0_DOWN)
+                                               /* Restore flow control  */
+                                               dhd_txflowcontrol(bus->dhd, ALL_INTERFACES, OFF);
+#endif 
+                                               dhd_os_wd_timer(dhdp, dhd_watchdog_ms);
+
+                                               DHD_TRACE(("%s: WLAN ON DONE\n", __FUNCTION__));
+                                       } else {
+                                               dhd_bus_stop(bus, FALSE);
+                                               dhdsdio_release_dongle(bus, bus->dhd->osh,
+                                                       TRUE, FALSE);
+                                       }
+                               } else {
+                                       DHD_ERROR(("%s Failed to download binary to the dongle\n",
+                                               __FUNCTION__));
+                                       if (bus->sih != NULL) {
+                                               si_detach(bus->sih);
+                                               bus->sih = NULL;
+                                       }
+                                       bcmerror = BCME_SDIO_ERROR;
+                               }
+                       } else
+                               bcmerror = BCME_SDIO_ERROR;
+
+                               dhd_os_sdunlock(dhdp);
+               } else {
+                       bcmerror = BCME_SDIO_ERROR;
+                       DHD_INFO(("%s called when dongle is not in reset\n",
+                               __FUNCTION__));
+                       DHD_INFO(("Will call dhd_bus_start instead\n"));
+                       dhd_bus_resume(dhdp, 1);
+                       if ((bcmerror = dhd_bus_start(dhdp)) != 0)
+                               DHD_ERROR(("%s: dhd_bus_start fail with %d\n",
+                                       __FUNCTION__, bcmerror));
+               }
+       }
+       return bcmerror;
+}
+
+int dhd_bus_suspend(dhd_pub_t *dhdpub)
+{
+       return bcmsdh_stop(dhdpub->bus->sdh);
+}
+
+int dhd_bus_resume(dhd_pub_t *dhdpub, int stage)
+{
+       return bcmsdh_start(dhdpub->bus->sdh, stage);
+}
+
+/* Get Chip ID version */
+uint dhd_bus_chip_id(dhd_pub_t *dhdp)
+{
+       dhd_bus_t *bus = dhdp->bus;
+
+       return  bus->sih->chip;
+}
+
+/* Get Chip Rev ID version */
+uint dhd_bus_chiprev_id(dhd_pub_t *dhdp)
+{
+       dhd_bus_t *bus = dhdp->bus;
+
+       return bus->sih->chiprev;
+}
+
+/* Get Chip Pkg ID version */
+uint dhd_bus_chippkg_id(dhd_pub_t *dhdp)
+{
+       dhd_bus_t *bus = dhdp->bus;
+
+       return bus->sih->chippkg;
+}
+
+int dhd_bus_get_ids(struct dhd_bus *bus, uint32 *bus_type, uint32 *bus_num, uint32 *slot_num)
+{
+       *bus_type = bus->bus;
+       *bus_num = bus->bus_num;
+       *slot_num = bus->slot_num;
+       return 0;
+}
+
+int
+dhd_bus_membytes(dhd_pub_t *dhdp, bool set, uint32 address, uint8 *data, uint size)
+{
+       dhd_bus_t *bus;
+
+       bus = dhdp->bus;
+       return dhdsdio_membytes(bus, set, address, data, size);
+}
+
+
+void
+dhd_bus_update_fw_nv_path(struct dhd_bus *bus, char *pfw_path, char *pnv_path)
+{
+       bus->fw_path = pfw_path;
+       bus->nv_path = pnv_path;
+}
+
+int
+dhd_enableOOB(dhd_pub_t *dhd, bool sleep)
+{
+       dhd_bus_t *bus = dhd->bus;
+       sdpcmd_regs_t *regs = bus->regs;
+       uint retries = 0;
+
+       if (sleep) {
+               dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+               /* Tell device to start using OOB wakeup */
+               W_SDREG(SMB_USE_OOB, &regs->tosbmailbox, retries);
+               if (retries > retry_limit) {
+                       DHD_ERROR(("CANNOT SIGNAL CHIP, WILL NOT WAKE UP!!\n"));
+                       return BCME_BUSY;
+               }
+               /* Turn off our contribution to the HT clock request */
+               dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+       } else {
+               /* Make sure the controller has the bus up */
+               dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+               /* Send misc interrupt to indicate OOB not needed */
+               W_SDREG(0, &regs->tosbmailboxdata, retries);
+               if (retries <= retry_limit)
+                       W_SDREG(SMB_DEV_INT, &regs->tosbmailbox, retries);
+
+               if (retries > retry_limit)
+                       DHD_ERROR(("CANNOT SIGNAL CHIP TO CLEAR OOB!!\n"));
+
+               /* Make sure we have SD bus access */
+               dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+       }
+       return BCME_OK;
+}
+
+void
+dhd_bus_pktq_flush(dhd_pub_t *dhdp)
+{
+       dhd_bus_t *bus = dhdp->bus;
+       bool wlfc_enabled = FALSE;
+
+#ifdef PROP_TXSTATUS
+       wlfc_enabled = (dhd_wlfc_cleanup_txq(dhdp, NULL, 0) != WLFC_UNSUPPORTED);
+#endif
+       if (!wlfc_enabled) {
+#ifdef DHDTCPACK_SUPPRESS
+               /* Clean tcp_ack_info_tbl in order to prevent access to flushed pkt,
+                * when there is a newly coming packet from network stack.
+                */
+               dhd_tcpack_info_tbl_clean(bus->dhd);
+#endif /* DHDTCPACK_SUPPRESS */
+               /* Clear the data packet queues */
+               pktq_flush(dhdp->osh, &bus->txq, TRUE, NULL, 0);
+       }
+}
+
+#ifdef BCMSDIO
+int
+dhd_sr_config(dhd_pub_t *dhd, bool on)
+{
+       dhd_bus_t *bus = dhd->bus;
+
+       if (!bus->_srenab)
+               return -1;
+
+       return dhdsdio_clk_devsleep_iovar(bus, on);
+}
+
+uint16
+dhd_get_chipid(dhd_pub_t *dhd)
+{
+       dhd_bus_t *bus = dhd->bus;
+
+       if (bus && bus->sih)
+               return (uint16)bus->sih->chip;
+       else
+               return 0;
+}
+#endif /* BCMSDIO */
+
+#ifdef DEBUGGER
+uint32 dhd_sdio_reg_read(void *h, uint32 addr)
+{
+       uint32 rval;
+       struct dhd_bus *bus = (struct dhd_bus *) h;
+
+       dhd_os_sdlock(bus->dhd);
+
+       BUS_WAKE(bus);
+
+       dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+       rval = bcmsdh_reg_read(bus->sdh, addr, 4);
+
+       dhd_os_sdunlock(bus->dhd);
+
+       return rval;
+}
+
+void dhd_sdio_reg_write(void *h, uint32 addr, uint32 val)
+{
+       struct dhd_bus *bus = (struct dhd_bus *) h;
+
+       dhd_os_sdlock(bus->dhd);
+
+       BUS_WAKE(bus);
+
+       dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+       bcmsdh_reg_write(bus->sdh, addr, 4, val);
+
+       dhd_os_sdunlock(bus->dhd);
+}
+#endif /* DEBUGGER */
+
+
+#ifdef OOB_PARAM
+uint
+dhd_get_oob_disable(struct dhd_bus *bus)
+{
+       return bus->dhd->oob_disable;
+}
+#endif /* OOB_PARAM */
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_wlfc.c b/drivers/net/wireless/bcmdhd_1363/dhd_wlfc.c
new file mode 100644 (file)
index 0000000..6b30c3d
--- /dev/null
@@ -0,0 +1,4510 @@
+/*
+ * DHD PROP_TXSTATUS Module.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_wlfc.c 664810 2017-04-25 05:39:37Z $
+ *
+ */
+
+
+#include <typedefs.h>
+#include <osl.h>
+
+#include <bcmutils.h>
+#include <bcmendian.h>
+
+#include <dngl_stats.h>
+#include <dhd.h>
+
+#include <dhd_bus.h>
+
+#include <dhd_dbg.h>
+
+#ifdef PROP_TXSTATUS /* a form of flow control between host and dongle */
+#include <wlfc_proto.h>
+#include <dhd_wlfc.h>
+#endif
+
+#ifdef DHDTCPACK_SUPPRESS
+#include <dhd_ip.h>
+#endif /* DHDTCPACK_SUPPRESS */
+
+
+/*
+ * wlfc naming and lock rules:
+ *
+ * 1. Private functions name like _dhd_wlfc_XXX, declared as static and avoid wlfc lock operation.
+ * 2. Public functions name like dhd_wlfc_XXX, use wlfc lock if needed.
+ * 3. Non-Proptxstatus module call public functions only and avoid wlfc lock operation.
+ *
+ */
+
+#if defined(DHD_WLFC_THREAD)
+#define WLFC_THREAD_QUICK_RETRY_WAIT_MS    10      /* 10 msec */
+#define WLFC_THREAD_RETRY_WAIT_MS          10000   /* 10 sec */
+#endif /* defined (DHD_WLFC_THREAD) */
+
+
+#ifdef PROP_TXSTATUS
+
+#define DHD_WLFC_QMON_COMPLETE(entry)
+
+#define LIMIT_BORROW
+
+
+/** reordering related */
+
+#if defined(DHD_WLFC_THREAD)
+static void
+_dhd_wlfc_thread_wakeup(dhd_pub_t *dhdp)
+{
+       dhdp->wlfc_thread_go = TRUE;
+       wake_up_interruptible(&dhdp->wlfc_wqhead);
+}
+#endif /* DHD_WLFC_THREAD */
+
+static uint16
+_dhd_wlfc_adjusted_seq(void* p, uint8 current_seq)
+{
+       uint16 seq;
+
+       if (!p) {
+               return 0xffff;
+       }
+
+       seq = WL_TXSTATUS_GET_FREERUNCTR(DHD_PKTTAG_H2DTAG(PKTTAG(p)));
+       if (seq < current_seq) {
+               /* wrap around */
+               seq += 256;
+       }
+
+       return seq;
+}
+
+/**
+ * Enqueue a caller supplied packet on a caller supplied precedence queue, optionally reorder
+ * suppressed packets.
+ *    @param[in] pq       caller supplied packet queue to enqueue the packet on
+ *    @param[in] prec     precedence of the to-be-queued packet
+ *    @param[in] p        transmit packet to enqueue
+ *    @param[in] qHead    if TRUE, enqueue to head instead of tail. Used to maintain d11 seq order.
+ *    @param[in] current_seq
+ *    @param[in] reOrder  reOrder on odd precedence (=suppress queue)
+ */
+static void
+_dhd_wlfc_prec_enque(struct pktq *pq, int prec, void* p, bool qHead,
+       uint8 current_seq, bool reOrder)
+{
+       struct pktq_prec *q;
+       uint16 seq, seq2;
+       void *p2, *p2_prev;
+
+       if (!p)
+               return;
+
+       ASSERT(prec >= 0 && prec < pq->num_prec);
+       ASSERT(PKTLINK(p) == NULL);             /* queueing chains not allowed */
+
+       ASSERT(!pktq_full(pq));
+       ASSERT(!pktq_pfull(pq, prec));
+
+       q = &pq->q[prec];
+
+       PKTSETLINK(p, NULL);
+       if (q->head == NULL) {
+               /* empty queue */
+               q->head = p;
+               q->tail = p;
+       } else {
+               if (reOrder && (prec & 1)) {
+                       seq = _dhd_wlfc_adjusted_seq(p, current_seq);
+                       p2 = qHead ? q->head : q->tail;
+                       seq2 = _dhd_wlfc_adjusted_seq(p2, current_seq);
+
+                       if ((qHead &&((seq+1) > seq2)) || (!qHead && ((seq2+1) > seq))) {
+                               /* need reorder */
+                               p2 = q->head;
+                               p2_prev = NULL;
+                               seq2 = _dhd_wlfc_adjusted_seq(p2, current_seq);
+
+                               while (seq > seq2) {
+                                       p2_prev = p2;
+                                       p2 = PKTLINK(p2);
+                                       if (!p2) {
+                                               break;
+                                       }
+                                       seq2 = _dhd_wlfc_adjusted_seq(p2, current_seq);
+                               }
+
+                               if (p2_prev == NULL) {
+                                       /* insert head */
+                                       PKTSETLINK(p, q->head);
+                                       q->head = p;
+                               } else if (p2 == NULL) {
+                                       /* insert tail */
+                                       PKTSETLINK(p2_prev, p);
+                                       q->tail = p;
+                               } else {
+                                       /* insert after p2_prev */
+                                       PKTSETLINK(p, PKTLINK(p2_prev));
+                                       PKTSETLINK(p2_prev, p);
+                               }
+                               goto exit;
+                       }
+               }
+
+               if (qHead) {
+                       PKTSETLINK(p, q->head);
+                       q->head = p;
+               } else {
+                       PKTSETLINK(q->tail, p);
+                       q->tail = p;
+               }
+       }
+
+exit:
+
+       q->len++;
+       pq->len++;
+
+       if (pq->hi_prec < prec)
+               pq->hi_prec = (uint8)prec;
+} /* _dhd_wlfc_prec_enque */
+
+/**
+ * Create a place to store all packet pointers submitted to the firmware until a status comes back,
+ * suppress or otherwise.
+ *
+ * hang-er: noun, a contrivance on which things are hung, as a hook.
+ */
+/** @deprecated soon */
+static void*
+_dhd_wlfc_hanger_create(dhd_pub_t *dhd, int max_items)
+{
+       int i;
+       wlfc_hanger_t* hanger;
+
+       /* allow only up to a specific size for now */
+       ASSERT(max_items == WLFC_HANGER_MAXITEMS);
+
+       if ((hanger = (wlfc_hanger_t*)DHD_OS_PREALLOC(dhd, DHD_PREALLOC_DHD_WLFC_HANGER,
+               WLFC_HANGER_SIZE(max_items))) == NULL) {
+               return NULL;
+       }
+       memset(hanger, 0, WLFC_HANGER_SIZE(max_items));
+       hanger->max_items = max_items;
+
+       for (i = 0; i < hanger->max_items; i++) {
+               hanger->items[i].state = WLFC_HANGER_ITEM_STATE_FREE;
+       }
+       return hanger;
+}
+
+/** @deprecated soon */
+static int
+_dhd_wlfc_hanger_delete(dhd_pub_t *dhd, void* hanger)
+{
+       wlfc_hanger_t* h = (wlfc_hanger_t*)hanger;
+
+       if (h) {
+               DHD_OS_PREFREE(dhd, h, WLFC_HANGER_SIZE(h->max_items));
+               return BCME_OK;
+       }
+       return BCME_BADARG;
+}
+
+/** @deprecated soon */
+static uint16
+_dhd_wlfc_hanger_get_free_slot(void* hanger)
+{
+       uint32 i;
+       wlfc_hanger_t* h = (wlfc_hanger_t*)hanger;
+
+       if (h) {
+               i = h->slot_pos + 1;
+               if (i == h->max_items) {
+                       i = 0;
+               }
+               while (i != h->slot_pos) {
+                       if (h->items[i].state == WLFC_HANGER_ITEM_STATE_FREE) {
+                               h->slot_pos = i;
+                               return (uint16)i;
+                       }
+                       i++;
+                       if (i == h->max_items)
+                               i = 0;
+               }
+               h->failed_slotfind++;
+       }
+       return WLFC_HANGER_MAXITEMS;
+}
+
+/** @deprecated soon */
+static int
+_dhd_wlfc_hanger_get_genbit(void* hanger, void* pkt, uint32 slot_id, int* gen)
+{
+       int rc = BCME_OK;
+       wlfc_hanger_t* h = (wlfc_hanger_t*)hanger;
+
+       *gen = 0xff;
+
+       /* this packet was not pushed at the time it went to the firmware */
+       if (slot_id == WLFC_HANGER_MAXITEMS)
+               return BCME_NOTFOUND;
+
+       if (h) {
+               if (h->items[slot_id].state != WLFC_HANGER_ITEM_STATE_FREE) {
+                       *gen = h->items[slot_id].gen;
+               }
+               else {
+                       DHD_ERROR(("Error: %s():%d item not used\n",
+                               __FUNCTION__, __LINE__));
+                       rc = BCME_NOTFOUND;
+               }
+
+       } else {
+               rc = BCME_BADARG;
+       }
+
+       return rc;
+}
+
+/** @deprecated soon */
+static int
+_dhd_wlfc_hanger_pushpkt(void* hanger, void* pkt, uint32 slot_id)
+{
+       int rc = BCME_OK;
+       wlfc_hanger_t* h = (wlfc_hanger_t*)hanger;
+
+       if (h && (slot_id < WLFC_HANGER_MAXITEMS)) {
+               if (h->items[slot_id].state == WLFC_HANGER_ITEM_STATE_FREE) {
+                       h->items[slot_id].state = WLFC_HANGER_ITEM_STATE_INUSE;
+                       h->items[slot_id].pkt = pkt;
+                       h->items[slot_id].pkt_state = 0;
+                       h->items[slot_id].pkt_txstatus = 0;
+                       h->pushed++;
+               } else {
+                       h->failed_to_push++;
+                       rc = BCME_NOTFOUND;
+               }
+       } else {
+               rc = BCME_BADARG;
+       }
+
+       return rc;
+}
+
+/** @deprecated soon */
+static int
+_dhd_wlfc_hanger_poppkt(void* hanger, uint32 slot_id, void** pktout, bool remove_from_hanger)
+{
+       int rc = BCME_OK;
+       wlfc_hanger_t* h = (wlfc_hanger_t*)hanger;
+
+       *pktout = NULL;
+
+       /* this packet was not pushed at the time it went to the firmware */
+       if (slot_id == WLFC_HANGER_MAXITEMS)
+               return BCME_NOTFOUND;
+
+       if (h) {
+               if (h->items[slot_id].state != WLFC_HANGER_ITEM_STATE_FREE) {
+                       *pktout = h->items[slot_id].pkt;
+                       if (remove_from_hanger) {
+                               h->items[slot_id].state =
+                                       WLFC_HANGER_ITEM_STATE_FREE;
+                               h->items[slot_id].pkt = NULL;
+                               h->items[slot_id].gen = 0xff;
+                               h->items[slot_id].identifier = 0;
+                               h->popped++;
+                       }
+               } else {
+                       h->failed_to_pop++;
+                       rc = BCME_NOTFOUND;
+               }
+       } else {
+               rc = BCME_BADARG;
+       }
+
+       return rc;
+}
+
+/** @deprecated soon */
+static int
+_dhd_wlfc_hanger_mark_suppressed(void* hanger, uint32 slot_id, uint8 gen)
+{
+       int rc = BCME_OK;
+       wlfc_hanger_t* h = (wlfc_hanger_t*)hanger;
+
+       /* this packet was not pushed at the time it went to the firmware */
+       if (slot_id == WLFC_HANGER_MAXITEMS)
+               return BCME_NOTFOUND;
+       if (h) {
+               h->items[slot_id].gen = gen;
+               if (h->items[slot_id].state == WLFC_HANGER_ITEM_STATE_INUSE) {
+                       h->items[slot_id].state = WLFC_HANGER_ITEM_STATE_INUSE_SUPPRESSED;
+               } else {
+                       rc = BCME_BADARG;
+               }
+       } else {
+               rc = BCME_BADARG;
+       }
+
+       return rc;
+}
+
+/** remove reference of specific packet in hanger */
+/** @deprecated soon */
+static bool
+_dhd_wlfc_hanger_remove_reference(wlfc_hanger_t* h, void* pkt)
+{
+       int i;
+
+       if (!h || !pkt) {
+               return FALSE;
+       }
+
+       i = WL_TXSTATUS_GET_HSLOT(DHD_PKTTAG_H2DTAG(PKTTAG(pkt)));
+
+       if ((i < h->max_items) && (pkt == h->items[i].pkt)) {
+               if (h->items[i].state == WLFC_HANGER_ITEM_STATE_INUSE_SUPPRESSED) {
+                       h->items[i].state = WLFC_HANGER_ITEM_STATE_FREE;
+                       h->items[i].pkt = NULL;
+                       h->items[i].gen = 0xff;
+                       h->items[i].identifier = 0;
+                       return TRUE;
+               } else {
+                       DHD_ERROR(("Error: %s():%d item not suppressed\n",
+                               __FUNCTION__, __LINE__));
+               }
+       }
+
+       return FALSE;
+}
+
+/** afq = At Firmware Queue, queue containing packets pending in the dongle */
+static int
+_dhd_wlfc_enque_afq(athost_wl_status_info_t* ctx, void *p)
+{
+       wlfc_mac_descriptor_t* entry;
+       uint16 entry_idx = WL_TXSTATUS_GET_HSLOT(DHD_PKTTAG_H2DTAG(PKTTAG(p)));
+       uint8 prec = DHD_PKTTAG_FIFO(PKTTAG(p));
+
+       if (entry_idx < WLFC_MAC_DESC_TABLE_SIZE)
+               entry  = &ctx->destination_entries.nodes[entry_idx];
+       else if (entry_idx < (WLFC_MAC_DESC_TABLE_SIZE + WLFC_MAX_IFNUM))
+               entry = &ctx->destination_entries.interfaces[entry_idx - WLFC_MAC_DESC_TABLE_SIZE];
+       else
+               entry = &ctx->destination_entries.other;
+
+       pktq_penq(&entry->afq, prec, p);
+
+       return BCME_OK;
+}
+
+/** afq = At Firmware Queue, queue containing packets pending in the dongle */
+static int
+_dhd_wlfc_deque_afq(athost_wl_status_info_t* ctx, uint16 hslot, uint8 hcnt, uint8 prec,
+       void **pktout)
+{
+       wlfc_mac_descriptor_t *entry;
+       struct pktq *pq;
+       struct pktq_prec *q;
+       void *p, *b;
+
+       if (!ctx) {
+               DHD_ERROR(("%s: ctx(%p), pktout(%p)\n", __FUNCTION__, ctx, pktout));
+               return BCME_BADARG;
+       }
+
+       if (pktout) {
+               *pktout = NULL;
+       }
+
+       ASSERT(hslot < (WLFC_MAC_DESC_TABLE_SIZE + WLFC_MAX_IFNUM + 1));
+
+       if (hslot < WLFC_MAC_DESC_TABLE_SIZE)
+               entry  = &ctx->destination_entries.nodes[hslot];
+       else if (hslot < (WLFC_MAC_DESC_TABLE_SIZE + WLFC_MAX_IFNUM))
+               entry = &ctx->destination_entries.interfaces[hslot - WLFC_MAC_DESC_TABLE_SIZE];
+       else
+               entry = &ctx->destination_entries.other;
+
+       pq = &entry->afq;
+
+       ASSERT(prec < pq->num_prec);
+
+       q = &pq->q[prec];
+
+       b = NULL;
+       p = q->head;
+
+       while (p && (hcnt != WL_TXSTATUS_GET_FREERUNCTR(DHD_PKTTAG_H2DTAG(PKTTAG(p)))))
+       {
+               b = p;
+               p = PKTLINK(p);
+       }
+
+       if (p == NULL) {
+               /* none is matched */
+               if (b) {
+                       DHD_ERROR(("%s: can't find matching seq(%d)\n", __FUNCTION__, hcnt));
+               } else {
+                       DHD_ERROR(("%s: queue is empty\n", __FUNCTION__));
+               }
+
+               return BCME_ERROR;
+       }
+
+       bcm_pkt_validate_chk(p);
+
+       if (!b) {
+               /* head packet is matched */
+               if ((q->head = PKTLINK(p)) == NULL) {
+                       q->tail = NULL;
+               }
+       } else {
+               /* middle packet is matched */
+               DHD_INFO(("%s: out of order, seq(%d), head_seq(%d)\n", __FUNCTION__, hcnt,
+                       WL_TXSTATUS_GET_FREERUNCTR(DHD_PKTTAG_H2DTAG(PKTTAG(q->head)))));
+               ctx->stats.ooo_pkts[prec]++;
+               PKTSETLINK(b, PKTLINK(p));
+               if (PKTLINK(p) == NULL) {
+                       q->tail = b;
+               }
+       }
+
+       q->len--;
+       pq->len--;
+
+       PKTSETLINK(p, NULL);
+
+       if (pktout) {
+               *pktout = p;
+       }
+
+       return BCME_OK;
+} /* _dhd_wlfc_deque_afq */
+
+/**
+ * Flow control information piggy backs on packets, in the form of one or more TLVs. This function
+ * pushes one or more TLVs onto a packet that is going to be sent towards the dongle.
+ *
+ *     @param[in]     ctx
+ *     @param[in/out] packet
+ *     @param[in]     tim_signal TRUE if parameter 'tim_bmp' is valid
+ *     @param[in]     tim_bmp
+ *     @param[in]     mac_handle
+ *     @param[in]     htodtag
+ *     @param[in]     htodseq d11 seqno for seqno reuse, only used if 'seq reuse' was agreed upon
+ *                    earlier between host and firmware.
+ *     @param[in]     skip_wlfc_hdr
+ */
+static int
+_dhd_wlfc_pushheader(athost_wl_status_info_t* ctx, void** packet, bool tim_signal,
+       uint8 tim_bmp, uint8 mac_handle, uint32 htodtag, uint16 htodseq, bool skip_wlfc_hdr)
+{
+       uint32 wl_pktinfo = 0;
+       uint8* wlh;
+       uint8 dataOffset = 0;
+       uint8 fillers;
+       uint8 tim_signal_len = 0;
+       dhd_pub_t *dhdp = (dhd_pub_t *)ctx->dhdp;
+
+       struct bdc_header *h;
+       void *p = *packet;
+
+       if (skip_wlfc_hdr)
+               goto push_bdc_hdr;
+
+       if (tim_signal) {
+               tim_signal_len = TLV_HDR_LEN + WLFC_CTL_VALUE_LEN_PENDING_TRAFFIC_BMP;
+       }
+
+       /* +2 is for Type[1] and Len[1] in TLV, plus TIM signal */
+       dataOffset = WLFC_CTL_VALUE_LEN_PKTTAG + TLV_HDR_LEN + tim_signal_len;
+       if (WLFC_GET_REUSESEQ(dhdp->wlfc_mode)) {
+               dataOffset += WLFC_CTL_VALUE_LEN_SEQ;
+       }
+
+       fillers = ROUNDUP(dataOffset, 4) - dataOffset;
+       dataOffset += fillers;
+
+       PKTPUSH(ctx->osh, p, dataOffset);
+       wlh = (uint8*) PKTDATA(ctx->osh, p);
+
+       wl_pktinfo = htol32(htodtag);
+
+       wlh[TLV_TAG_OFF] = WLFC_CTL_TYPE_PKTTAG;
+       wlh[TLV_LEN_OFF] = WLFC_CTL_VALUE_LEN_PKTTAG;
+       memcpy(&wlh[TLV_HDR_LEN] /* dst */, &wl_pktinfo, sizeof(uint32));
+
+       if (WLFC_GET_REUSESEQ(dhdp->wlfc_mode)) {
+               uint16 wl_seqinfo = htol16(htodseq);
+               wlh[TLV_LEN_OFF] += WLFC_CTL_VALUE_LEN_SEQ;
+               memcpy(&wlh[TLV_HDR_LEN + WLFC_CTL_VALUE_LEN_PKTTAG], &wl_seqinfo,
+                       WLFC_CTL_VALUE_LEN_SEQ);
+       }
+
+       if (tim_signal_len) {
+               wlh[dataOffset - fillers - tim_signal_len ] =
+                       WLFC_CTL_TYPE_PENDING_TRAFFIC_BMP;
+               wlh[dataOffset - fillers - tim_signal_len + 1] =
+                       WLFC_CTL_VALUE_LEN_PENDING_TRAFFIC_BMP;
+               wlh[dataOffset - fillers - tim_signal_len + 2] = mac_handle;
+               wlh[dataOffset - fillers - tim_signal_len + 3] = tim_bmp;
+       }
+       if (fillers)
+               memset(&wlh[dataOffset - fillers], WLFC_CTL_TYPE_FILLER, fillers);
+
+push_bdc_hdr:
+       PKTPUSH(ctx->osh, p, BDC_HEADER_LEN);
+       h = (struct bdc_header *)PKTDATA(ctx->osh, p);
+       h->flags = (BDC_PROTO_VER << BDC_FLAG_VER_SHIFT);
+       if (PKTSUMNEEDED(p))
+               h->flags |= BDC_FLAG_SUM_NEEDED;
+
+
+       h->priority = (PKTPRIO(p) & BDC_PRIORITY_MASK);
+       h->flags2 = 0;
+       h->dataOffset = dataOffset >> 2;
+       BDC_SET_IF_IDX(h, DHD_PKTTAG_IF(PKTTAG(p)));
+       *packet = p;
+       return BCME_OK;
+} /* _dhd_wlfc_pushheader */
+
+/**
+ * Removes (PULLs) flow control related headers from the caller supplied packet, is invoked eg
+ * when a packet is about to be freed.
+ */
+static int
+_dhd_wlfc_pullheader(athost_wl_status_info_t* ctx, void* pktbuf)
+{
+       struct bdc_header *h;
+
+       if (PKTLEN(ctx->osh, pktbuf) < BDC_HEADER_LEN) {
+               DHD_ERROR(("%s: rx data too short (%d < %d)\n", __FUNCTION__,
+                          PKTLEN(ctx->osh, pktbuf), BDC_HEADER_LEN));
+               return BCME_ERROR;
+       }
+       h = (struct bdc_header *)PKTDATA(ctx->osh, pktbuf);
+
+       /* pull BDC header */
+       PKTPULL(ctx->osh, pktbuf, BDC_HEADER_LEN);
+
+       if (PKTLEN(ctx->osh, pktbuf) < (uint)(h->dataOffset << 2)) {
+               DHD_ERROR(("%s: rx data too short (%d < %d)\n", __FUNCTION__,
+                          PKTLEN(ctx->osh, pktbuf), (h->dataOffset << 2)));
+               return BCME_ERROR;
+       }
+
+       /* pull wl-header */
+       PKTPULL(ctx->osh, pktbuf, (h->dataOffset << 2));
+       return BCME_OK;
+}
+
+/**
+ * @param[in/out] p packet
+ */
+static wlfc_mac_descriptor_t*
+_dhd_wlfc_find_table_entry(athost_wl_status_info_t* ctx, void* p)
+{
+       int i;
+       wlfc_mac_descriptor_t* table = ctx->destination_entries.nodes;
+       uint8 ifid = DHD_PKTTAG_IF(PKTTAG(p));
+       uint8* dstn = DHD_PKTTAG_DSTN(PKTTAG(p));
+       wlfc_mac_descriptor_t* entry = DHD_PKTTAG_ENTRY(PKTTAG(p));
+       int iftype = ctx->destination_entries.interfaces[ifid].iftype;
+
+       /* saved one exists, return it */
+       if (entry)
+               return entry;
+
+       /* Multicast destination, STA and P2P clients get the interface entry.
+        * STA/GC gets the Mac Entry for TDLS destinations, TDLS destinations
+        * have their own entry.
+        */
+       if ((iftype == WLC_E_IF_ROLE_STA || ETHER_ISMULTI(dstn) ||
+               iftype == WLC_E_IF_ROLE_P2P_CLIENT) &&
+               (ctx->destination_entries.interfaces[ifid].occupied)) {
+                       entry = &ctx->destination_entries.interfaces[ifid];
+       }
+
+       if (entry && ETHER_ISMULTI(dstn)) {
+               DHD_PKTTAG_SET_ENTRY(PKTTAG(p), entry);
+               return entry;
+       }
+
+       for (i = 0; i < WLFC_MAC_DESC_TABLE_SIZE; i++) {
+               if (table[i].occupied) {
+                       if (table[i].interface_id == ifid) {
+                               if (!memcmp(table[i].ea, dstn, ETHER_ADDR_LEN)) {
+                                       entry = &table[i];
+                                       break;
+                               }
+                       }
+               }
+       }
+
+       if (entry == NULL)
+               entry = &ctx->destination_entries.other;
+
+       DHD_PKTTAG_SET_ENTRY(PKTTAG(p), entry);
+
+       return entry;
+} /* _dhd_wlfc_find_table_entry */
+
+/**
+ * In case a packet must be dropped (because eg the queues are full), various tallies have to be
+ * be updated. Called from several other functions.
+ *     @param[in] dhdp pointer to public DHD structure
+ *     @param[in] prec precedence of the packet
+ *     @param[in] p    the packet to be dropped
+ *     @param[in] bPktInQ TRUE if packet is part of a queue
+ */
+static int
+_dhd_wlfc_prec_drop(dhd_pub_t *dhdp, int prec, void* p, bool bPktInQ)
+{
+       athost_wl_status_info_t* ctx;
+       void *pout = NULL;
+
+       ASSERT(dhdp && p);
+       ASSERT(prec >= 0 && prec <= WLFC_PSQ_PREC_COUNT);
+
+       ctx = (athost_wl_status_info_t*)dhdp->wlfc_state;
+
+       if (!WLFC_GET_AFQ(dhdp->wlfc_mode) && (prec & 1)) {
+               /* suppressed queue, need pop from hanger */
+               _dhd_wlfc_hanger_poppkt(ctx->hanger, WL_TXSTATUS_GET_HSLOT(DHD_PKTTAG_H2DTAG
+                                       (PKTTAG(p))), &pout, TRUE);
+               ASSERT(p == pout);
+       }
+
+       if (!(prec & 1)) {
+#ifdef DHDTCPACK_SUPPRESS
+               /* pkt in delayed q, so fake push BDC header for
+                * dhd_tcpack_check_xmit() and dhd_txcomplete().
+                */
+               _dhd_wlfc_pushheader(ctx, &p, FALSE, 0, 0, 0, 0, TRUE);
+
+               /* This packet is about to be freed, so remove it from tcp_ack_info_tbl
+                * This must be one of...
+                * 1. A pkt already in delayQ is evicted by another pkt with higher precedence
+                * in _dhd_wlfc_prec_enq_with_drop()
+                * 2. A pkt could not be enqueued to delayQ because it is full,
+                * in _dhd_wlfc_enque_delayq().
+                * 3. A pkt could not be enqueued to delayQ because it is full,
+                * in _dhd_wlfc_rollback_packet_toq().
+                */
+               if (dhd_tcpack_check_xmit(dhdp, p) == BCME_ERROR) {
+                       DHD_ERROR(("%s %d: tcpack_suppress ERROR!!!"
+                               " Stop using it\n",
+                               __FUNCTION__, __LINE__));
+                       dhd_tcpack_suppress_set(dhdp, TCPACK_SUP_OFF);
+               }
+#endif /* DHDTCPACK_SUPPRESS */
+       }
+
+       if (bPktInQ) {
+               ctx->pkt_cnt_in_q[DHD_PKTTAG_IF(PKTTAG(p))][prec>>1]--;
+               ctx->pkt_cnt_per_ac[prec>>1]--;
+               ctx->pkt_cnt_in_psq--;
+       }
+
+       ctx->pkt_cnt_in_drv[DHD_PKTTAG_IF(PKTTAG(p))][DHD_PKTTAG_FIFO(PKTTAG(p))]--;
+       ctx->stats.pktout++;
+       ctx->stats.drop_pkts[prec]++;
+
+       dhd_txcomplete(dhdp, p, FALSE);
+       PKTFREE(ctx->osh, p, TRUE);
+
+       return 0;
+} /* _dhd_wlfc_prec_drop */
+
+/**
+ * Called when eg the host handed a new packet over to the driver, or when the dongle reported
+ * that a packet could currently not be transmitted (=suppressed). This function enqueues a transmit
+ * packet in the host driver to be (re)transmitted at a later opportunity.
+ *     @param[in] dhdp pointer to public DHD structure
+ *     @param[in] qHead When TRUE, queue packet at head instead of tail, to preserve d11 sequence
+ */
+static bool
+_dhd_wlfc_prec_enq_with_drop(dhd_pub_t *dhdp, struct pktq *pq, void *pkt, int prec, bool qHead,
+       uint8 current_seq)
+{
+       void *p = NULL;
+       int eprec = -1;         /* precedence to evict from */
+       athost_wl_status_info_t* ctx;
+
+       ASSERT(dhdp && pq && pkt);
+       ASSERT(prec >= 0 && prec < pq->num_prec);
+
+       ctx = (athost_wl_status_info_t*)dhdp->wlfc_state;
+
+       /* Fast case, precedence queue is not full and we are also not
+        * exceeding total queue length
+        */
+       if (!pktq_pfull(pq, prec) && !pktq_full(pq)) {
+               goto exit;
+       }
+
+       /* Determine precedence from which to evict packet, if any */
+       if (pktq_pfull(pq, prec)) {
+               eprec = prec;
+       } else if (pktq_full(pq)) {
+               p = pktq_peek_tail(pq, &eprec);
+               if (!p) {
+                       DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+                       return FALSE;
+               }
+               if ((eprec > prec) || (eprec < 0)) {
+                       if (!pktq_pempty(pq, prec)) {
+                               eprec = prec;
+                       } else {
+                               return FALSE;
+                       }
+               }
+       }
+
+       /* Evict if needed */
+       if (eprec >= 0) {
+               /* Detect queueing to unconfigured precedence */
+               ASSERT(!pktq_pempty(pq, eprec));
+               /* Evict all fragmented frames */
+               dhd_prec_drop_pkts(dhdp, pq, eprec, _dhd_wlfc_prec_drop);
+       }
+
+exit:
+       /* Enqueue */
+       _dhd_wlfc_prec_enque(pq, prec, pkt, qHead, current_seq,
+               WLFC_GET_REORDERSUPP(dhdp->wlfc_mode));
+       ctx->pkt_cnt_in_q[DHD_PKTTAG_IF(PKTTAG(pkt))][prec>>1]++;
+       ctx->pkt_cnt_per_ac[prec>>1]++;
+       ctx->pkt_cnt_in_psq++;
+
+       return TRUE;
+} /* _dhd_wlfc_prec_enq_with_drop */
+
+/**
+ * Called during eg the 'committing' of a transmit packet from the OS layer to a lower layer, in
+ * the event that this 'commit' failed.
+ */
+static int
+_dhd_wlfc_rollback_packet_toq(athost_wl_status_info_t* ctx,
+       void* p, ewlfc_packet_state_t pkt_type, uint32 hslot)
+{
+       /*
+        * put the packet back to the head of queue
+        * - suppressed packet goes back to suppress sub-queue
+        * - pull out the header, if new or delayed packet
+        *
+        * Note: hslot is used only when header removal is done.
+        */
+       wlfc_mac_descriptor_t* entry;
+       int rc = BCME_OK;
+       int prec, fifo_id;
+
+       entry = _dhd_wlfc_find_table_entry(ctx, p);
+       prec = DHD_PKTTAG_FIFO(PKTTAG(p));
+       fifo_id = prec << 1;
+       if (pkt_type == eWLFC_PKTTYPE_SUPPRESSED)
+               fifo_id += 1;
+       if (entry != NULL) {
+               /*
+               if this packet did not count against FIFO credit, it must have
+               taken a requested_credit from the firmware (for pspoll etc.)
+               */
+               if ((prec != AC_COUNT) && !DHD_PKTTAG_CREDITCHECK(PKTTAG(p)))
+                       entry->requested_credit++;
+
+               if (pkt_type == eWLFC_PKTTYPE_DELAYED) {
+                       /* decrement sequence count */
+                       WLFC_DECR_SEQCOUNT(entry, prec);
+                       /* remove header first */
+                       rc = _dhd_wlfc_pullheader(ctx, p);
+                       if (rc != BCME_OK) {
+                               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+                               goto exit;
+                       }
+               }
+
+               if (_dhd_wlfc_prec_enq_with_drop(ctx->dhdp, &entry->psq, p, fifo_id, TRUE,
+                       WLFC_SEQCOUNT(entry, fifo_id>>1))
+                       == FALSE) {
+                       /* enque failed */
+                       DHD_ERROR(("Error: %s():%d, fifo_id(%d)\n",
+                               __FUNCTION__, __LINE__, fifo_id));
+                       rc = BCME_ERROR;
+               }
+       } else {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               rc = BCME_ERROR;
+       }
+
+exit:
+       if (rc != BCME_OK) {
+               ctx->stats.rollback_failed++;
+               _dhd_wlfc_prec_drop(ctx->dhdp, fifo_id, p, FALSE);
+       } else {
+               ctx->stats.rollback++;
+       }
+
+       return rc;
+} /* _dhd_wlfc_rollback_packet_toq */
+
+/** Returns TRUE if host OS -> DHD flow control is allowed on the caller supplied interface */
+static bool
+_dhd_wlfc_allow_fc(athost_wl_status_info_t* ctx, uint8 ifid)
+{
+       int prec, ac_traffic = WLFC_NO_TRAFFIC;
+
+       for (prec = 0; prec < AC_COUNT; prec++) {
+               if (ctx->pkt_cnt_in_drv[ifid][prec] > 0) {
+                       if (ac_traffic == WLFC_NO_TRAFFIC)
+                               ac_traffic = prec + 1;
+                       else if (ac_traffic != (prec + 1))
+                               ac_traffic = WLFC_MULTI_TRAFFIC;
+               }
+       }
+
+       if (ac_traffic >= 1 && ac_traffic <= AC_COUNT) {
+               /* single AC (BE/BK/VI/VO) in queue */
+               if (ctx->allow_fc) {
+                       return TRUE;
+               } else {
+                       uint32 delta;
+                       uint32 curr_t = OSL_SYSUPTIME();
+
+                       if (ctx->fc_defer_timestamp == 0) {
+                               /* first single ac scenario */
+                               ctx->fc_defer_timestamp = curr_t;
+                               return FALSE;
+                       }
+
+                       /* single AC duration, this handles wrap around, e.g. 1 - ~0 = 2. */
+                       delta = curr_t - ctx->fc_defer_timestamp;
+                       if (delta >= WLFC_FC_DEFER_PERIOD_MS) {
+                               ctx->allow_fc = TRUE;
+                       }
+               }
+       } else {
+               /* multiple ACs or BCMC in queue */
+               ctx->allow_fc = FALSE;
+               ctx->fc_defer_timestamp = 0;
+       }
+
+       return ctx->allow_fc;
+} /* _dhd_wlfc_allow_fc */
+
+/**
+ * Starts or stops the flow of transmit packets from the host OS towards the DHD, depending on
+ * low/high watermarks.
+ */
+static void
+_dhd_wlfc_flow_control_check(athost_wl_status_info_t* ctx, struct pktq* pq, uint8 if_id)
+{
+       dhd_pub_t *dhdp;
+
+       ASSERT(ctx);
+
+       dhdp = (dhd_pub_t *)ctx->dhdp;
+       ASSERT(dhdp);
+
+       if (dhdp->skip_fc && dhdp->skip_fc(dhdp))
+               return;
+
+       if ((ctx->hostif_flow_state[if_id] == OFF) && !_dhd_wlfc_allow_fc(ctx, if_id))
+               return;
+
+       if ((pq->len <= WLFC_FLOWCONTROL_LOWATER) && (ctx->hostif_flow_state[if_id] == ON)) {
+               /* start traffic */
+               ctx->hostif_flow_state[if_id] = OFF;
+               /*
+               WLFC_DBGMESG(("qlen:%02d, if:%02d, ->OFF, start traffic %s()\n",
+               pq->len, if_id, __FUNCTION__));
+               */
+               WLFC_DBGMESG(("F"));
+
+               dhd_txflowcontrol(dhdp, if_id, OFF);
+
+               ctx->toggle_host_if = 0;
+       }
+
+       if ((pq->len >= WLFC_FLOWCONTROL_HIWATER) && (ctx->hostif_flow_state[if_id] == OFF)) {
+               /* stop traffic */
+               ctx->hostif_flow_state[if_id] = ON;
+               /*
+               WLFC_DBGMESG(("qlen:%02d, if:%02d, ->ON, stop traffic   %s()\n",
+               pq->len, if_id, __FUNCTION__));
+               */
+               WLFC_DBGMESG(("N"));
+
+               dhd_txflowcontrol(dhdp, if_id, ON);
+
+               ctx->host_ifidx = if_id;
+               ctx->toggle_host_if = 1;
+       }
+
+       return;
+} /* _dhd_wlfc_flow_control_check */
+
+static int
+_dhd_wlfc_send_signalonly_packet(athost_wl_status_info_t* ctx, wlfc_mac_descriptor_t* entry,
+       uint8 ta_bmp)
+{
+       int rc = BCME_OK;
+       void* p = NULL;
+       int dummylen = ((dhd_pub_t *)ctx->dhdp)->hdrlen+ 16;
+       dhd_pub_t *dhdp = (dhd_pub_t *)ctx->dhdp;
+
+       if (dhdp->proptxstatus_txoff) {
+               rc = BCME_NORESOURCE;
+               return rc;
+       }
+
+       /* allocate a dummy packet */
+       p = PKTGET(ctx->osh, dummylen, TRUE);
+       if (p) {
+               PKTPULL(ctx->osh, p, dummylen);
+               DHD_PKTTAG_SET_H2DTAG(PKTTAG(p), 0);
+               _dhd_wlfc_pushheader(ctx, &p, TRUE, ta_bmp, entry->mac_handle, 0, 0, FALSE);
+               DHD_PKTTAG_SETSIGNALONLY(PKTTAG(p), 1);
+               DHD_PKTTAG_WLFCPKT_SET(PKTTAG(p), 1);
+#ifdef PROP_TXSTATUS_DEBUG
+               ctx->stats.signal_only_pkts_sent++;
+#endif
+
+#if defined(BCMPCIE)
+               rc = dhd_bus_txdata(dhdp->bus, p, ctx->host_ifidx);
+#else
+               rc = dhd_bus_txdata(dhdp->bus, p);
+#endif
+               if (rc != BCME_OK) {
+                       _dhd_wlfc_pullheader(ctx, p);
+                       PKTFREE(ctx->osh, p, TRUE);
+               }
+       } else {
+               DHD_ERROR(("%s: couldn't allocate new %d-byte packet\n",
+                          __FUNCTION__, dummylen));
+               rc = BCME_NOMEM;
+               dhdp->tx_pktgetfail++;
+       }
+
+       return rc;
+} /* _dhd_wlfc_send_signalonly_packet */
+
+/**
+ * Called on eg receiving 'mac close' indication from dongle. Updates the per-MAC administration
+ * maintained in caller supplied parameter 'entry'.
+ *
+ *    @param[in/out] entry  administration about a remote MAC entity
+ *    @param[in]     prec   precedence queue for this remote MAC entitity
+ *
+ * Return value: TRUE if traffic availability changed
+ */
+static bool
+_dhd_wlfc_traffic_pending_check(athost_wl_status_info_t* ctx, wlfc_mac_descriptor_t* entry,
+       int prec)
+{
+       bool rc = FALSE;
+
+       if (entry->state == WLFC_STATE_CLOSE) {
+               if ((pktq_plen(&entry->psq, (prec << 1)) == 0) &&
+                       (pktq_plen(&entry->psq, ((prec << 1) + 1)) == 0)) {
+                       /* no packets in both 'normal' and 'suspended' queues */
+                       if (entry->traffic_pending_bmp & NBITVAL(prec)) {
+                               rc = TRUE;
+                               entry->traffic_pending_bmp =
+                                       entry->traffic_pending_bmp & ~ NBITVAL(prec);
+                       }
+               } else {
+                       /* packets are queued in host for transmission to dongle */
+                       if (!(entry->traffic_pending_bmp & NBITVAL(prec))) {
+                               rc = TRUE;
+                               entry->traffic_pending_bmp =
+                                       entry->traffic_pending_bmp | NBITVAL(prec);
+                       }
+               }
+       }
+
+       if (rc) {
+               /* request a TIM update to firmware at the next piggyback opportunity */
+               if (entry->traffic_lastreported_bmp != entry->traffic_pending_bmp) {
+                       entry->send_tim_signal = 1;
+                       _dhd_wlfc_send_signalonly_packet(ctx, entry, entry->traffic_pending_bmp);
+                       entry->traffic_lastreported_bmp = entry->traffic_pending_bmp;
+                       entry->send_tim_signal = 0;
+               } else {
+                       rc = FALSE;
+               }
+       }
+
+       return rc;
+} /* _dhd_wlfc_traffic_pending_check */
+
+/**
+ * Called on receiving a 'd11 suppressed' or 'wl suppressed' tx status from the firmware. Enqueues
+ * the packet to transmit to firmware again at a later opportunity.
+ */
+static int
+_dhd_wlfc_enque_suppressed(athost_wl_status_info_t* ctx, int prec, void* p)
+{
+       wlfc_mac_descriptor_t* entry;
+
+       entry = _dhd_wlfc_find_table_entry(ctx, p);
+       if (entry == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_NOTFOUND;
+       }
+       /*
+       - suppressed packets go to sub_queue[2*prec + 1] AND
+       - delayed packets go to sub_queue[2*prec + 0] to ensure
+       order of delivery.
+       */
+       if (_dhd_wlfc_prec_enq_with_drop(ctx->dhdp, &entry->psq, p, ((prec << 1) + 1), FALSE,
+               WLFC_SEQCOUNT(entry, prec))
+               == FALSE) {
+               ctx->stats.delayq_full_error++;
+               /* WLFC_DBGMESG(("Error: %s():%d\n", __FUNCTION__, __LINE__)); */
+               WLFC_DBGMESG(("s"));
+               return BCME_ERROR;
+       }
+
+       /* A packet has been pushed, update traffic availability bitmap, if applicable */
+       _dhd_wlfc_traffic_pending_check(ctx, entry, prec);
+       _dhd_wlfc_flow_control_check(ctx, &entry->psq, DHD_PKTTAG_IF(PKTTAG(p)));
+       return BCME_OK;
+}
+
+/**
+ * Called when a transmit packet is about to be 'committed' from the OS layer to a lower layer
+ * towards the dongle (eg the DBUS layer). Updates wlfc administration. May modify packet.
+ *
+ *     @param[in/out] ctx    driver specific flow control administration
+ *     @param[in/out] entry  The remote MAC entity for which the packet is destined.
+ *     @param[in/out] packet Packet to send. This function optionally adds TLVs to the packet.
+ *     @param[in] header_needed True if packet is 'new' to flow control
+ *     @param[out] slot Handle to container in which the packet was 'parked'
+ */
+static int
+_dhd_wlfc_pretx_pktprocess(athost_wl_status_info_t* ctx,
+       wlfc_mac_descriptor_t* entry, void** packet, int header_needed, uint32* slot)
+{
+       int rc = BCME_OK;
+       int hslot = WLFC_HANGER_MAXITEMS;
+       bool send_tim_update = FALSE;
+       uint32 htod = 0;
+       uint16 htodseq = 0;
+       uint8 free_ctr;
+       int gen = 0xff;
+       dhd_pub_t *dhdp = (dhd_pub_t *)ctx->dhdp;
+       void * p = *packet;
+
+       *slot = hslot;
+
+       if (entry == NULL) {
+               entry = _dhd_wlfc_find_table_entry(ctx, p);
+       }
+
+       if (entry == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_ERROR;
+       }
+
+       if (entry->send_tim_signal) {
+               /* sends a traffic indication bitmap to the dongle */
+               send_tim_update = TRUE;
+               entry->send_tim_signal = 0;
+               entry->traffic_lastreported_bmp = entry->traffic_pending_bmp;
+       }
+
+       if (header_needed) {
+               if (WLFC_GET_AFQ(dhdp->wlfc_mode)) {
+                       hslot = (uint)(entry - &ctx->destination_entries.nodes[0]);
+               } else {
+                       hslot = _dhd_wlfc_hanger_get_free_slot(ctx->hanger);
+               }
+               gen = entry->generation;
+               free_ctr = WLFC_SEQCOUNT(entry, DHD_PKTTAG_FIFO(PKTTAG(p)));
+       } else {
+               if (WLFC_GET_REUSESEQ(dhdp->wlfc_mode)) {
+                       htodseq = DHD_PKTTAG_H2DSEQ(PKTTAG(p));
+               }
+
+               hslot = WL_TXSTATUS_GET_HSLOT(DHD_PKTTAG_H2DTAG(PKTTAG(p)));
+
+               if (WLFC_GET_REORDERSUPP(dhdp->wlfc_mode)) {
+                       gen = entry->generation;
+               } else if (WLFC_GET_AFQ(dhdp->wlfc_mode)) {
+                       gen = WL_TXSTATUS_GET_GENERATION(DHD_PKTTAG_H2DTAG(PKTTAG(p)));
+               } else {
+                       _dhd_wlfc_hanger_get_genbit(ctx->hanger, p, hslot, &gen);
+               }
+
+               free_ctr = WL_TXSTATUS_GET_FREERUNCTR(DHD_PKTTAG_H2DTAG(PKTTAG(p)));
+               /* remove old header */
+               _dhd_wlfc_pullheader(ctx, p);
+       }
+
+       if (hslot >= WLFC_HANGER_MAXITEMS) {
+               DHD_ERROR(("Error: %s():no hanger slot available\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       WL_TXSTATUS_SET_FREERUNCTR(htod, free_ctr);
+       WL_TXSTATUS_SET_HSLOT(htod, hslot);
+       WL_TXSTATUS_SET_FIFO(htod, DHD_PKTTAG_FIFO(PKTTAG(p)));
+       WL_TXSTATUS_SET_FLAGS(htod, WLFC_PKTFLAG_PKTFROMHOST);
+       WL_TXSTATUS_SET_GENERATION(htod, gen);
+       DHD_PKTTAG_SETPKTDIR(PKTTAG(p), 1);
+
+       if (!DHD_PKTTAG_CREDITCHECK(PKTTAG(p))) {
+               /*
+               Indicate that this packet is being sent in response to an
+               explicit request from the firmware side.
+               */
+               WLFC_PKTFLAG_SET_PKTREQUESTED(htod);
+       } else {
+               WLFC_PKTFLAG_CLR_PKTREQUESTED(htod);
+       }
+
+       rc = _dhd_wlfc_pushheader(ctx, &p, send_tim_update,
+               entry->traffic_lastreported_bmp, entry->mac_handle, htod, htodseq, FALSE);
+       if (rc == BCME_OK) {
+               DHD_PKTTAG_SET_H2DTAG(PKTTAG(p), htod);
+
+               if (!WLFC_GET_AFQ(dhdp->wlfc_mode)) {
+                       wlfc_hanger_t *h = (wlfc_hanger_t*)(ctx->hanger);
+                       if (header_needed) {
+                               /*
+                               a new header was created for this packet.
+                               push to hanger slot and scrub q. Since bus
+                               send succeeded, increment seq number as well.
+                               */
+                               rc = _dhd_wlfc_hanger_pushpkt(ctx->hanger, p, hslot);
+                               if (rc == BCME_OK) {
+#ifdef PROP_TXSTATUS_DEBUG
+                                       h->items[hslot].push_time =
+                                               OSL_SYSUPTIME();
+#endif
+                               } else {
+                                       DHD_ERROR(("%s() hanger_pushpkt() failed, rc: %d\n",
+                                               __FUNCTION__, rc));
+                               }
+                       } else {
+                               /* clear hanger state */
+                               if (((wlfc_hanger_t*)(ctx->hanger))->items[hslot].pkt != p)
+                                       DHD_ERROR(("%s() pkt not match: cur %p, hanger pkt %p\n",
+                                               __FUNCTION__, p, h->items[hslot].pkt));
+                               ASSERT(h->items[hslot].pkt == p);
+                               bcm_object_feature_set(h->items[hslot].pkt,
+                                       BCM_OBJECT_FEATURE_PKT_STATE, 0);
+                               h->items[hslot].pkt_state = 0;
+                               h->items[hslot].pkt_txstatus = 0;
+                               h->items[hslot].state = WLFC_HANGER_ITEM_STATE_INUSE;
+                       }
+               } else if (!WLFC_GET_AFQ(dhdp->wlfc_mode)) {
+                       /* clear hanger state */
+                       ((wlfc_hanger_t*)(ctx->hanger))->items[hslot].pkt_state = 0;
+                       ((wlfc_hanger_t*)(ctx->hanger))->items[hslot].pkt_txstatus = 0;
+               }
+
+               if ((rc == BCME_OK) && header_needed) {
+                       /* increment free running sequence count */
+                       WLFC_INCR_SEQCOUNT(entry, DHD_PKTTAG_FIFO(PKTTAG(p)));
+               }
+       }
+       *slot = hslot;
+       *packet = p;
+       return rc;
+} /* _dhd_wlfc_pretx_pktprocess */
+
+/**
+ * A remote wireless mac may be temporarily 'closed' due to power management. Returns '1' if remote
+ * mac is in the 'open' state, otherwise '0'.
+ */
+static int
+_dhd_wlfc_is_destination_open(athost_wl_status_info_t* ctx,
+       wlfc_mac_descriptor_t* entry, int prec)
+{
+       if (entry->interface_id >= WLFC_MAX_IFNUM) {
+               ASSERT(&ctx->destination_entries.other == entry);
+               return 1;
+       }
+
+       if (ctx->destination_entries.interfaces[entry->interface_id].iftype ==
+               WLC_E_IF_ROLE_P2P_GO) {
+               /* - destination interface is of type p2p GO.
+               For a p2pGO interface, if the destination is OPEN but the interface is
+               CLOSEd, do not send traffic. But if the dstn is CLOSEd while there is
+               destination-specific-credit left send packets. This is because the
+               firmware storing the destination-specific-requested packet in queue.
+               */
+               if ((entry->state == WLFC_STATE_CLOSE) && (entry->requested_credit == 0) &&
+                       (entry->requested_packet == 0)) {
+                       return 0;
+               }
+       }
+
+       /* AP, p2p_go -> unicast desc entry, STA/p2p_cl -> interface desc. entry */
+       if (((entry->state == WLFC_STATE_CLOSE) && (entry->requested_credit == 0) &&
+               (entry->requested_packet == 0)) ||
+               (!(entry->ac_bitmap & (1 << prec)))) {
+               return 0;
+       }
+
+       return 1;
+} /* _dhd_wlfc_is_destination_open */
+
+/**
+ * Dequeues a suppressed or delayed packet from a queue
+ *    @param[in/out] ctx          Driver specific flow control administration
+ *    @param[in]  prec            Precedence of queue to dequeue from
+ *    @param[out] ac_credit_spent Boolean, returns 0 or 1
+ *    @param[out] needs_hdr       Boolean, returns 0 or 1
+ *    @param[out] entry_out       The remote MAC for which the packet is destined
+ *    @param[in]  only_no_credit  If TRUE, searches all entries instead of just the active ones
+ *
+ * Return value: the dequeued packet
+ */
+static void*
+_dhd_wlfc_deque_delayedq(athost_wl_status_info_t* ctx, int prec,
+       uint8* ac_credit_spent, uint8* needs_hdr, wlfc_mac_descriptor_t** entry_out,
+       bool only_no_credit)
+{
+       wlfc_mac_descriptor_t* entry;
+       int total_entries;
+       void* p = NULL;
+       int i;
+       uint8 credit_spent = ((prec == AC_COUNT) && !ctx->bcmc_credit_supported) ? 0 : 1;
+
+       *entry_out = NULL;
+       /* most cases a packet will count against FIFO credit */
+       *ac_credit_spent = credit_spent;
+
+       /* search all entries, include nodes as well as interfaces */
+       if (only_no_credit) {
+               total_entries = ctx->requested_entry_count;
+       } else {
+               total_entries = ctx->active_entry_count;
+       }
+
+       for (i = 0; i < total_entries; i++) {
+               if (only_no_credit) {
+                       entry = ctx->requested_entry[i];
+               } else {
+                       entry = ctx->active_entry_head;
+                       /* move head to ensure fair round-robin */
+                       ctx->active_entry_head = ctx->active_entry_head->next;
+               }
+               ASSERT(entry);
+
+               if (entry->occupied && _dhd_wlfc_is_destination_open(ctx, entry, prec) &&
+                       (entry->transit_count < WL_TXSTATUS_FREERUNCTR_MASK) &&
+                       (!entry->suppressed)) {
+                       *ac_credit_spent = credit_spent;
+                       if (entry->state == WLFC_STATE_CLOSE) {
+                               *ac_credit_spent = 0;
+                       }
+
+                       /* higher precedence will be picked up first,
+                        * i.e. suppressed packets before delayed ones
+                        */
+                       p = pktq_pdeq(&entry->psq, PSQ_SUP_IDX(prec));
+                       *needs_hdr = 0;
+                       if (p == NULL) {
+                               /* De-Q from delay Q */
+                               p = pktq_pdeq(&entry->psq, PSQ_DLY_IDX(prec));
+                               *needs_hdr = 1;
+                       }
+
+                       if (p != NULL) {
+                               bcm_pkt_validate_chk(p);
+                               /* did the packet come from suppress sub-queue? */
+                               if (entry->requested_credit > 0) {
+                                       entry->requested_credit--;
+#ifdef PROP_TXSTATUS_DEBUG
+                                       entry->dstncredit_sent_packets++;
+#endif
+                               } else if (entry->requested_packet > 0) {
+                                       entry->requested_packet--;
+                                       DHD_PKTTAG_SETONETIMEPKTRQST(PKTTAG(p));
+                               }
+
+                               *entry_out = entry;
+                               ctx->pkt_cnt_in_q[DHD_PKTTAG_IF(PKTTAG(p))][prec]--;
+                               ctx->pkt_cnt_per_ac[prec]--;
+                               ctx->pkt_cnt_in_psq--;
+                               _dhd_wlfc_flow_control_check(ctx, &entry->psq,
+                                       DHD_PKTTAG_IF(PKTTAG(p)));
+                               /*
+                                * A packet has been picked up, update traffic availability bitmap,
+                                * if applicable.
+                                */
+                               _dhd_wlfc_traffic_pending_check(ctx, entry, prec);
+                               return p;
+                       }
+               }
+       }
+       return NULL;
+} /* _dhd_wlfc_deque_delayedq */
+
+/** Enqueues caller supplied packet on either a 'suppressed' or 'delayed' queue */
+static int
+_dhd_wlfc_enque_delayq(athost_wl_status_info_t* ctx, void* pktbuf, int prec)
+{
+       wlfc_mac_descriptor_t* entry;
+
+       if (pktbuf != NULL) {
+               entry = _dhd_wlfc_find_table_entry(ctx, pktbuf);
+               if (entry == NULL) {
+                       DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+                       return BCME_ERROR;
+               }
+
+               /*
+               - suppressed packets go to sub_queue[2*prec + 1] AND
+               - delayed packets go to sub_queue[2*prec + 0] to ensure
+               order of delivery.
+               */
+               if (_dhd_wlfc_prec_enq_with_drop(ctx->dhdp, &entry->psq, pktbuf, (prec << 1),
+                       FALSE, WLFC_SEQCOUNT(entry, prec))
+                       == FALSE) {
+                       WLFC_DBGMESG(("D"));
+                       ctx->stats.delayq_full_error++;
+                       return BCME_ERROR;
+               }
+
+
+               /* A packet has been pushed, update traffic availability bitmap, if applicable */
+               _dhd_wlfc_traffic_pending_check(ctx, entry, prec);
+       }
+
+       return BCME_OK;
+} /* _dhd_wlfc_enque_delayq */
+
+/** Returns TRUE if caller supplied packet is destined for caller supplied interface */
+static bool _dhd_wlfc_ifpkt_fn(void* p, void *p_ifid)
+{
+       if (!p || !p_ifid)
+               return FALSE;
+
+       return (DHD_PKTTAG_WLFCPKT(PKTTAG(p))&& (*((uint8 *)p_ifid) == DHD_PKTTAG_IF(PKTTAG(p))));
+}
+
+/** Returns TRUE if caller supplied packet is destined for caller supplied remote MAC */
+static bool _dhd_wlfc_entrypkt_fn(void* p, void *entry)
+{
+       if (!p || !entry)
+               return FALSE;
+
+       return (DHD_PKTTAG_WLFCPKT(PKTTAG(p))&& (entry == DHD_PKTTAG_ENTRY(PKTTAG(p))));
+}
+
+static void
+_dhd_wlfc_return_implied_credit(athost_wl_status_info_t* wlfc, void* pkt)
+{
+       dhd_pub_t *dhdp;
+       bool credit_return = FALSE;
+
+       if (!wlfc || !pkt) {
+               return;
+       }
+
+       dhdp = (dhd_pub_t *)(wlfc->dhdp);
+       if (dhdp && (dhdp->proptxstatus_mode == WLFC_FCMODE_IMPLIED_CREDIT) &&
+               DHD_PKTTAG_CREDITCHECK(PKTTAG(pkt))) {
+               int lender, credit_returned = 0;
+               uint8 fifo_id = DHD_PKTTAG_FIFO(PKTTAG(pkt));
+
+               credit_return = TRUE;
+
+               /* Note that borrower is fifo_id */
+               /* Return credits to highest priority lender first */
+               for (lender = AC_COUNT; lender >= 0; lender--) {
+                       if (wlfc->credits_borrowed[fifo_id][lender] > 0) {
+                               wlfc->FIFO_credit[lender]++;
+                               wlfc->credits_borrowed[fifo_id][lender]--;
+                               credit_returned = 1;
+                               break;
+                       }
+               }
+
+               if (!credit_returned) {
+                       wlfc->FIFO_credit[fifo_id]++;
+               }
+       }
+
+       BCM_REFERENCE(credit_return);
+#if defined(DHD_WLFC_THREAD)
+       if (credit_return) {
+               _dhd_wlfc_thread_wakeup(dhdp);
+       }
+#endif /* defined(DHD_WLFC_THREAD) */
+}
+
+/** Removes and frees a packet from the hanger. Called during eg tx complete. */
+static void
+_dhd_wlfc_hanger_free_pkt(athost_wl_status_info_t* wlfc, uint32 slot_id, uint8 pkt_state,
+       int pkt_txstatus)
+{
+       wlfc_hanger_t* hanger;
+       wlfc_hanger_item_t* item;
+
+       if (!wlfc)
+               return;
+
+       hanger = (wlfc_hanger_t*)wlfc->hanger;
+       if (!hanger)
+               return;
+
+       if (slot_id == WLFC_HANGER_MAXITEMS)
+               return;
+
+       item = &hanger->items[slot_id];
+
+       if (item->pkt) {
+               item->pkt_state |= pkt_state;
+               if (pkt_txstatus != -1)
+                       item->pkt_txstatus = (uint8)pkt_txstatus;
+               bcm_object_feature_set(item->pkt, BCM_OBJECT_FEATURE_PKT_STATE, item->pkt_state);
+               if (item->pkt_state == WLFC_HANGER_PKT_STATE_COMPLETE) {
+                       void *p = NULL;
+                       void *pkt = item->pkt;
+                       uint8 old_state = item->state;
+                       int ret = _dhd_wlfc_hanger_poppkt(wlfc->hanger, slot_id, &p, TRUE);
+                       BCM_REFERENCE(ret);
+                       BCM_REFERENCE(pkt);
+                       ASSERT((ret == BCME_OK) && p && (pkt == p));
+                       if (old_state == WLFC_HANGER_ITEM_STATE_INUSE_SUPPRESSED) {
+                               printf("ERROR: free a suppressed pkt %p state %d pkt_state %d\n",
+                                       pkt, old_state, item->pkt_state);
+                       }
+                       ASSERT(old_state != WLFC_HANGER_ITEM_STATE_INUSE_SUPPRESSED);
+
+                       /* free packet */
+                       wlfc->pkt_cnt_in_drv[DHD_PKTTAG_IF(PKTTAG(p))]
+                               [DHD_PKTTAG_FIFO(PKTTAG(p))]--;
+                       wlfc->stats.pktout++;
+                       dhd_txcomplete((dhd_pub_t *)wlfc->dhdp, p, item->pkt_txstatus);
+                       PKTFREE(wlfc->osh, p, TRUE);
+               }
+       } else {
+               /* free slot */
+               if (item->state == WLFC_HANGER_ITEM_STATE_FREE)
+                       DHD_ERROR(("Error: %s():%d Multiple TXSTATUS or BUSRETURNED: %d (%d)\n",
+                           __FUNCTION__, __LINE__, item->pkt_state, pkt_state));
+               item->state = WLFC_HANGER_ITEM_STATE_FREE;
+       }
+} /* _dhd_wlfc_hanger_free_pkt */
+
+/** Called during eg detach() */
+static void
+_dhd_wlfc_pktq_flush(athost_wl_status_info_t* ctx, struct pktq *pq,
+       bool dir, f_processpkt_t fn, void *arg, q_type_t q_type)
+{
+       int prec;
+       dhd_pub_t *dhdp = (dhd_pub_t *)ctx->dhdp;
+
+       ASSERT(dhdp);
+
+       /* Optimize flush, if pktq len = 0, just return.
+        * pktq len of 0 means pktq's prec q's are all empty.
+        */
+       if (pq->len == 0) {
+               return;
+       }
+
+       for (prec = 0; prec < pq->num_prec; prec++) {
+               struct pktq_prec *q;
+               void *p, *prev = NULL;
+
+               q = &pq->q[prec];
+               p = q->head;
+               while (p) {
+                       bcm_pkt_validate_chk(p);
+                       if (fn == NULL || (*fn)(p, arg)) {
+                               bool head = (p == q->head);
+                               if (head)
+                                       q->head = PKTLINK(p);
+                               else
+                                       PKTSETLINK(prev, PKTLINK(p));
+                               if (q_type == Q_TYPE_PSQ) {
+                                       if (!WLFC_GET_AFQ(dhdp->wlfc_mode) && (prec & 1)) {
+                                               _dhd_wlfc_hanger_remove_reference(ctx->hanger, p);
+                                       }
+                                       ctx->pkt_cnt_in_q[DHD_PKTTAG_IF(PKTTAG(p))][prec>>1]--;
+                                       ctx->pkt_cnt_per_ac[prec>>1]--;
+                                       ctx->pkt_cnt_in_psq--;
+                                       ctx->stats.cleanup_psq_cnt++;
+                                       if (!(prec & 1)) {
+                                               /* pkt in delayed q, so fake push BDC header for
+                                                * dhd_tcpack_check_xmit() and dhd_txcomplete().
+                                                */
+                                               _dhd_wlfc_pushheader(ctx, &p, FALSE, 0, 0,
+                                                       0, 0, TRUE);
+#ifdef DHDTCPACK_SUPPRESS
+                                               if (dhd_tcpack_check_xmit(dhdp, p) == BCME_ERROR) {
+                                                       DHD_ERROR(("%s %d: tcpack_suppress ERROR!!!"
+                                                               " Stop using it\n",
+                                                               __FUNCTION__, __LINE__));
+                                                       dhd_tcpack_suppress_set(dhdp,
+                                                               TCPACK_SUP_OFF);
+                                               }
+#endif /* DHDTCPACK_SUPPRESS */
+                                       }
+                               } else if (q_type == Q_TYPE_AFQ) {
+                                       wlfc_mac_descriptor_t* entry =
+                                               _dhd_wlfc_find_table_entry(ctx, p);
+                                       if (entry->transit_count)
+                                               entry->transit_count--;
+                                       if (entry->suppr_transit_count) {
+                                               entry->suppr_transit_count--;
+                                               if (entry->suppressed &&
+                                                       (!entry->onbus_pkts_count) &&
+                                                       (!entry->suppr_transit_count))
+                                                       entry->suppressed = FALSE;
+                                       }
+                                       _dhd_wlfc_return_implied_credit(ctx, p);
+                                       ctx->stats.cleanup_fw_cnt++;
+                               }
+                               PKTSETLINK(p, NULL);
+                               if (dir) {
+                                       ctx->pkt_cnt_in_drv[DHD_PKTTAG_IF(PKTTAG(p))][prec>>1]--;
+                                       ctx->stats.pktout++;
+                                       dhd_txcomplete(dhdp, p, FALSE);
+                               }
+                               PKTFREE(ctx->osh, p, dir);
+
+                               q->len--;
+                               pq->len--;
+                               p = (head ? q->head : PKTLINK(prev));
+                       } else {
+                               prev = p;
+                               p = PKTLINK(p);
+                       }
+               }
+
+               if (q->head == NULL) {
+                       ASSERT(q->len == 0);
+                       q->tail = NULL;
+               }
+
+       }
+
+       if (fn == NULL)
+               ASSERT(pq->len == 0);
+} /* _dhd_wlfc_pktq_flush */
+
+
+/** !BCMDBUS specific function. Dequeues a packet from the caller supplied queue. */
+static void*
+_dhd_wlfc_pktq_pdeq_with_fn(struct pktq *pq, int prec, f_processpkt_t fn, void *arg)
+{
+       struct pktq_prec *q;
+       void *p, *prev = NULL;
+
+       ASSERT(prec >= 0 && prec < pq->num_prec);
+
+       q = &pq->q[prec];
+       p = q->head;
+
+       while (p) {
+               if (fn == NULL || (*fn)(p, arg)) {
+                       break;
+               } else {
+                       prev = p;
+                       p = PKTLINK(p);
+               }
+       }
+       if (p == NULL)
+               return NULL;
+
+       bcm_pkt_validate_chk(p);
+
+       if (prev == NULL) {
+               if ((q->head = PKTLINK(p)) == NULL) {
+                       q->tail = NULL;
+               }
+       } else {
+               PKTSETLINK(prev, PKTLINK(p));
+               if (q->tail == p) {
+                       q->tail = prev;
+               }
+       }
+
+       q->len--;
+
+       pq->len--;
+
+       PKTSETLINK(p, NULL);
+
+       return p;
+}
+
+/** !BCMDBUS specific function */
+static void
+_dhd_wlfc_cleanup_txq(dhd_pub_t *dhd, f_processpkt_t fn, void *arg)
+{
+       int prec;
+       void *pkt = NULL, *head = NULL, *tail = NULL;
+       struct pktq *txq = (struct pktq *)dhd_bus_txq(dhd->bus);
+       athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+       wlfc_hanger_t* h = (wlfc_hanger_t*)wlfc->hanger;
+       wlfc_mac_descriptor_t* entry;
+
+       dhd_os_sdlock_txq(dhd);
+       for (prec = 0; prec < txq->num_prec; prec++) {
+               while ((pkt = _dhd_wlfc_pktq_pdeq_with_fn(txq, prec, fn, arg))) {
+#ifdef DHDTCPACK_SUPPRESS
+                       if (dhd_tcpack_check_xmit(dhd, pkt) == BCME_ERROR) {
+                               DHD_ERROR(("%s %d: tcpack_suppress ERROR!!! Stop using it\n",
+                                       __FUNCTION__, __LINE__));
+                               dhd_tcpack_suppress_set(dhd, TCPACK_SUP_OFF);
+                       }
+#endif /* DHDTCPACK_SUPPRESS */
+                       if (!head) {
+                               head = pkt;
+                       }
+                       if (tail) {
+                               PKTSETLINK(tail, pkt);
+                       }
+                       tail = pkt;
+               }
+       }
+       dhd_os_sdunlock_txq(dhd);
+
+
+       while ((pkt = head)) {
+               head = PKTLINK(pkt);
+               PKTSETLINK(pkt, NULL);
+               entry = _dhd_wlfc_find_table_entry(wlfc, pkt);
+
+               if (!WLFC_GET_AFQ(dhd->wlfc_mode) &&
+                       !_dhd_wlfc_hanger_remove_reference(h, pkt)) {
+                       DHD_ERROR(("%s: can't find pkt(%p) in hanger, free it anyway\n",
+                               __FUNCTION__, pkt));
+               }
+               if (entry->transit_count)
+                       entry->transit_count--;
+               if (entry->suppr_transit_count) {
+                       entry->suppr_transit_count--;
+                       if (entry->suppressed &&
+                               (!entry->onbus_pkts_count) &&
+                               (!entry->suppr_transit_count))
+                               entry->suppressed = FALSE;
+               }
+               _dhd_wlfc_return_implied_credit(wlfc, pkt);
+               wlfc->pkt_cnt_in_drv[DHD_PKTTAG_IF(PKTTAG(pkt))][DHD_PKTTAG_FIFO(PKTTAG(pkt))]--;
+               wlfc->stats.pktout++;
+               wlfc->stats.cleanup_txq_cnt++;
+               dhd_txcomplete(dhd, pkt, FALSE);
+               PKTFREE(wlfc->osh, pkt, TRUE);
+       }
+} /* _dhd_wlfc_cleanup_txq */
+
+/** called during eg detach */
+void
+_dhd_wlfc_cleanup(dhd_pub_t *dhd, f_processpkt_t fn, void *arg)
+{
+       int i;
+       int total_entries;
+       athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+       wlfc_mac_descriptor_t* table;
+       wlfc_hanger_t* h = (wlfc_hanger_t*)wlfc->hanger;
+
+       wlfc->stats.cleanup_txq_cnt = 0;
+       wlfc->stats.cleanup_psq_cnt = 0;
+       wlfc->stats.cleanup_fw_cnt = 0;
+
+       /*
+       *  flush sequence should be txq -> psq -> hanger/afq, hanger has to be last one
+       */
+       /* flush bus->txq */
+       _dhd_wlfc_cleanup_txq(dhd, fn, arg);
+
+       /* flush psq, search all entries, include nodes as well as interfaces */
+       total_entries = sizeof(wlfc->destination_entries)/sizeof(wlfc_mac_descriptor_t);
+       table = (wlfc_mac_descriptor_t*)&wlfc->destination_entries;
+
+       for (i = 0; i < total_entries; i++) {
+               if (table[i].occupied) {
+                       /* release packets held in PSQ (both delayed and suppressed) */
+                       if (table[i].psq.len) {
+                               WLFC_DBGMESG(("%s(): PSQ[%d].len = %d\n",
+                                       __FUNCTION__, i, table[i].psq.len));
+                               _dhd_wlfc_pktq_flush(wlfc, &table[i].psq, TRUE,
+                                       fn, arg, Q_TYPE_PSQ);
+                       }
+
+                       /* free packets held in AFQ */
+                       if (WLFC_GET_AFQ(dhd->wlfc_mode) && (table[i].afq.len)) {
+                               _dhd_wlfc_pktq_flush(wlfc, &table[i].afq, TRUE,
+                                       fn, arg, Q_TYPE_AFQ);
+                       }
+
+                       if ((fn == NULL) && (&table[i] != &wlfc->destination_entries.other)) {
+                               table[i].occupied = 0;
+                               if (table[i].transit_count || table[i].suppr_transit_count) {
+                                       DHD_ERROR(("%s: table[%d] transit(%d), suppr_tansit(%d)\n",
+                                               __FUNCTION__, i,
+                                               table[i].transit_count,
+                                               table[i].suppr_transit_count));
+                               }
+                       }
+               }
+       }
+
+       /*
+               . flush remained pkt in hanger queue, not in bus->txq nor psq.
+               . the remained pkt was successfully downloaded to dongle already.
+               . hanger slot state cannot be set to free until receive txstatus update.
+       */
+       if (!WLFC_GET_AFQ(dhd->wlfc_mode)) {
+               for (i = 0; i < h->max_items; i++) {
+                       if ((h->items[i].state == WLFC_HANGER_ITEM_STATE_INUSE) ||
+                               (h->items[i].state == WLFC_HANGER_ITEM_STATE_INUSE_SUPPRESSED)) {
+                               if (fn == NULL || (*fn)(h->items[i].pkt, arg)) {
+                                       h->items[i].state = WLFC_HANGER_ITEM_STATE_FLUSHED;
+                               }
+                       }
+               }
+       }
+
+       return;
+} /* _dhd_wlfc_cleanup */
+
+/** Called after eg the dongle signalled a new remote MAC that it connected with to the DHD */
+static int
+_dhd_wlfc_mac_entry_update(athost_wl_status_info_t* ctx, wlfc_mac_descriptor_t* entry,
+       uint8 action, uint8 ifid, uint8 iftype, uint8* ea,
+       f_processpkt_t fn, void *arg)
+{
+       int rc = BCME_OK;
+
+
+       if ((action == eWLFC_MAC_ENTRY_ACTION_ADD) || (action == eWLFC_MAC_ENTRY_ACTION_UPDATE)) {
+               entry->occupied = 1;
+               entry->state = WLFC_STATE_OPEN;
+               entry->requested_credit = 0;
+               entry->interface_id = ifid;
+               entry->iftype = iftype;
+               entry->ac_bitmap = 0xff; /* update this when handling APSD */
+
+               /* for an interface entry we may not care about the MAC address */
+               if (ea != NULL)
+                       memcpy(&entry->ea[0], ea, ETHER_ADDR_LEN);
+
+               if (action == eWLFC_MAC_ENTRY_ACTION_ADD) {
+                       entry->suppressed = FALSE;
+                       entry->transit_count = 0;
+                       entry->suppr_transit_count = 0;
+                       entry->onbus_pkts_count = 0;
+               }
+
+               if (action == eWLFC_MAC_ENTRY_ACTION_ADD) {
+                       dhd_pub_t *dhdp = (dhd_pub_t *)(ctx->dhdp);
+
+                       pktq_init(&entry->psq, WLFC_PSQ_PREC_COUNT, WLFC_PSQ_LEN);
+
+                       if (WLFC_GET_AFQ(dhdp->wlfc_mode)) {
+                               pktq_init(&entry->afq, WLFC_AFQ_PREC_COUNT, WLFC_PSQ_LEN);
+                       }
+
+                       if (entry->next == NULL) {
+                               /* not linked to anywhere, add to tail */
+                               if (ctx->active_entry_head) {
+                                       entry->prev = ctx->active_entry_head->prev;
+                                       ctx->active_entry_head->prev->next = entry;
+                                       ctx->active_entry_head->prev = entry;
+                                       entry->next = ctx->active_entry_head;
+                               } else {
+                                       ASSERT(ctx->active_entry_count == 0);
+                                       entry->prev = entry->next = entry;
+                                       ctx->active_entry_head = entry;
+                               }
+                               ctx->active_entry_count++;
+                       } else {
+                               DHD_ERROR(("%s():%d, entry(%d)\n", __FUNCTION__, __LINE__,
+                                       (int)(entry - &ctx->destination_entries.nodes[0])));
+                       }
+               }
+       } else if (action == eWLFC_MAC_ENTRY_ACTION_DEL) {
+               /* When the entry is deleted, the packets that are queued in the entry must be
+                  cleanup. The cleanup action should be before the occupied is set as 0.
+               */
+               _dhd_wlfc_cleanup(ctx->dhdp, fn, arg);
+               _dhd_wlfc_flow_control_check(ctx, &entry->psq, ifid);
+
+               entry->occupied = 0;
+               entry->state = WLFC_STATE_CLOSE;
+               memset(&entry->ea[0], 0, ETHER_ADDR_LEN);
+
+               if (entry->next) {
+                       /* not floating, remove from Q */
+                       if (ctx->active_entry_count <= 1) {
+                               /* last item */
+                               ctx->active_entry_head = NULL;
+                               ctx->active_entry_count = 0;
+                       } else {
+                               entry->prev->next = entry->next;
+                               entry->next->prev = entry->prev;
+                               if (entry == ctx->active_entry_head) {
+                                       ctx->active_entry_head = entry->next;
+                               }
+                               ctx->active_entry_count--;
+                       }
+                       entry->next = entry->prev = NULL;
+               } else {
+                       DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               }
+       }
+       return rc;
+} /* _dhd_wlfc_mac_entry_update */
+
+
+#ifdef LIMIT_BORROW
+
+/** LIMIT_BORROW specific function */
+static int
+_dhd_wlfc_borrow_credit(athost_wl_status_info_t* ctx, int highest_lender_ac, int borrower_ac,
+       bool bBorrowAll)
+{
+       int lender_ac, borrow_limit = 0;
+       int rc = -1;
+
+       if (ctx == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return -1;
+       }
+
+       /* Borrow from lowest priority available AC (including BC/MC credits) */
+       for (lender_ac = 0; lender_ac <= highest_lender_ac; lender_ac++) {
+               if (!bBorrowAll) {
+                       borrow_limit = ctx->Init_FIFO_credit[lender_ac]/WLFC_BORROW_LIMIT_RATIO;
+               } else {
+                       borrow_limit = 0;
+               }
+
+               if (ctx->FIFO_credit[lender_ac] > borrow_limit) {
+                       ctx->credits_borrowed[borrower_ac][lender_ac]++;
+                       ctx->FIFO_credit[lender_ac]--;
+                       rc = lender_ac;
+                       break;
+               }
+       }
+
+       return rc;
+}
+
+/** LIMIT_BORROW specific function */
+static int _dhd_wlfc_return_credit(athost_wl_status_info_t* ctx, int lender_ac, int borrower_ac)
+{
+       if ((ctx == NULL) || (lender_ac < 0) || (lender_ac > AC_COUNT) ||
+               (borrower_ac < 0) || (borrower_ac > AC_COUNT)) {
+               DHD_ERROR(("Error: %s():%d, ctx(%p), lender_ac(%d), borrower_ac(%d)\n",
+                       __FUNCTION__, __LINE__, ctx, lender_ac, borrower_ac));
+
+               return BCME_BADARG;
+       }
+
+       ctx->credits_borrowed[borrower_ac][lender_ac]--;
+       ctx->FIFO_credit[lender_ac]++;
+
+       return BCME_OK;
+}
+
+#endif /* LIMIT_BORROW */
+
+/**
+ * Called on an interface event (WLC_E_IF) indicated by firmware.
+ *     @param action : eg eWLFC_MAC_ENTRY_ACTION_UPDATE or eWLFC_MAC_ENTRY_ACTION_ADD
+ */
+static int
+_dhd_wlfc_interface_entry_update(void* state,
+       uint8 action, uint8 ifid, uint8 iftype, uint8* ea)
+{
+       athost_wl_status_info_t* ctx = (athost_wl_status_info_t*)state;
+       wlfc_mac_descriptor_t* entry;
+
+       if (ifid >= WLFC_MAX_IFNUM)
+               return BCME_BADARG;
+
+       entry = &ctx->destination_entries.interfaces[ifid];
+
+       return _dhd_wlfc_mac_entry_update(ctx, entry, action, ifid, iftype, ea,
+               _dhd_wlfc_ifpkt_fn, &ifid);
+}
+
+/**
+ * Called eg on receiving a WLC_E_BCMC_CREDIT_SUPPORT event from the dongle (broadcast/multicast
+ * specific)
+ */
+static int
+_dhd_wlfc_BCMCCredit_support_update(void* state)
+{
+       athost_wl_status_info_t* ctx = (athost_wl_status_info_t*)state;
+
+       ctx->bcmc_credit_supported = TRUE;
+       return BCME_OK;
+}
+
+/** Called eg on receiving a WLC_E_FIFO_CREDIT_MAP event from the dongle */
+static int
+_dhd_wlfc_FIFOcreditmap_update(void* state, uint8* credits)
+{
+       athost_wl_status_info_t* ctx = (athost_wl_status_info_t*)state;
+       int i;
+
+       for (i = 0; i <= 4; i++) {
+               if (ctx->Init_FIFO_credit[i] != ctx->FIFO_credit[i]) {
+                       DHD_ERROR(("%s: credit[i] is not returned, (%d %d)\n",
+                               __FUNCTION__, ctx->Init_FIFO_credit[i], ctx->FIFO_credit[i]));
+               }
+       }
+
+       /* update the AC FIFO credit map */
+       ctx->FIFO_credit[0] += (credits[0] - ctx->Init_FIFO_credit[0]);
+       ctx->FIFO_credit[1] += (credits[1] - ctx->Init_FIFO_credit[1]);
+       ctx->FIFO_credit[2] += (credits[2] - ctx->Init_FIFO_credit[2]);
+       ctx->FIFO_credit[3] += (credits[3] - ctx->Init_FIFO_credit[3]);
+       ctx->FIFO_credit[4] += (credits[4] - ctx->Init_FIFO_credit[4]);
+
+       ctx->Init_FIFO_credit[0] = credits[0];
+       ctx->Init_FIFO_credit[1] = credits[1];
+       ctx->Init_FIFO_credit[2] = credits[2];
+       ctx->Init_FIFO_credit[3] = credits[3];
+       ctx->Init_FIFO_credit[4] = credits[4];
+
+       /* credit for ATIM FIFO is not used yet. */
+       ctx->Init_FIFO_credit[5] = ctx->FIFO_credit[5] = 0;
+
+       return BCME_OK;
+}
+
+/**
+ * Called during committing of a transmit packet from the OS DHD layer to the next layer towards
+ * the dongle (eg the DBUS layer). All transmit packets flow via this function to the next layer.
+ *
+ *     @param[in/out] ctx      Driver specific flow control administration
+ *     @param[in] ac           Access Category (QoS) of called supplied packet
+ *     @param[in] commit_info  Contains eg the packet to send
+ *     @param[in] fcommit      Function pointer to transmit function of next software layer
+ *     @param[in] commit_ctx   Opaque context used when calling next layer
+ */
+static int
+_dhd_wlfc_handle_packet_commit(athost_wl_status_info_t* ctx, int ac,
+    dhd_wlfc_commit_info_t *commit_info, f_commitpkt_t fcommit, void* commit_ctx)
+{
+       uint32 hslot;
+       int     rc;
+       dhd_pub_t *dhdp = (dhd_pub_t *)(ctx->dhdp);
+
+       /*
+               if ac_fifo_credit_spent = 0
+
+               This packet will not count against the FIFO credit.
+               To ensure the txstatus corresponding to this packet
+               does not provide an implied credit (default behavior)
+               mark the packet accordingly.
+
+               if ac_fifo_credit_spent = 1
+
+               This is a normal packet and it counts against the FIFO
+               credit count.
+       */
+       DHD_PKTTAG_SETCREDITCHECK(PKTTAG(commit_info->p), commit_info->ac_fifo_credit_spent);
+       rc = _dhd_wlfc_pretx_pktprocess(ctx, commit_info->mac_entry, &commit_info->p,
+            commit_info->needs_hdr, &hslot);
+
+       if (rc == BCME_OK) {
+               rc = fcommit(commit_ctx, commit_info->p);
+               if (rc == BCME_OK) {
+                       uint8 gen = WL_TXSTATUS_GET_GENERATION(
+                               DHD_PKTTAG_H2DTAG(PKTTAG(commit_info->p)));
+                       ctx->stats.pkt2bus++;
+                       if (commit_info->ac_fifo_credit_spent || (ac == AC_COUNT)) {
+                               ctx->stats.send_pkts[ac]++;
+                               WLFC_HOST_FIFO_CREDIT_INC_SENTCTRS(ctx, ac);
+                       }
+
+                       if (gen != commit_info->mac_entry->generation) {
+                               /* will be suppressed back by design */
+                               if (!commit_info->mac_entry->suppressed) {
+                                       commit_info->mac_entry->suppressed = TRUE;
+                               }
+                               commit_info->mac_entry->suppr_transit_count++;
+                       }
+                       commit_info->mac_entry->transit_count++;
+                       commit_info->mac_entry->onbus_pkts_count++;
+               } else if (commit_info->needs_hdr) {
+                       if (!WLFC_GET_AFQ(dhdp->wlfc_mode)) {
+                               void *pout = NULL;
+                               /* pop hanger for delayed packet */
+                               _dhd_wlfc_hanger_poppkt(ctx->hanger, WL_TXSTATUS_GET_HSLOT(
+                                       DHD_PKTTAG_H2DTAG(PKTTAG(commit_info->p))), &pout, TRUE);
+                               ASSERT(commit_info->p == pout);
+                       }
+               }
+       } else {
+               ctx->stats.generic_error++;
+       }
+
+       if (rc != BCME_OK) {
+               /*
+                  pretx pkt process or bus commit has failed, rollback.
+                  - remove wl-header for a delayed packet
+                  - save wl-header header for suppressed packets
+                  - reset credit check flag
+               */
+               _dhd_wlfc_rollback_packet_toq(ctx, commit_info->p, commit_info->pkt_type, hslot);
+               DHD_PKTTAG_SETCREDITCHECK(PKTTAG(commit_info->p), 0);
+       }
+
+       return rc;
+} /* _dhd_wlfc_handle_packet_commit */
+
+/** Returns remote MAC descriptor for caller supplied MAC address */
+static uint8
+_dhd_wlfc_find_mac_desc_id_from_mac(dhd_pub_t *dhdp, uint8 *ea)
+{
+       wlfc_mac_descriptor_t* table =
+               ((athost_wl_status_info_t*)dhdp->wlfc_state)->destination_entries.nodes;
+       uint8 table_index;
+
+       if (ea != NULL) {
+               for (table_index = 0; table_index < WLFC_MAC_DESC_TABLE_SIZE; table_index++) {
+                       if ((memcmp(ea, &table[table_index].ea[0], ETHER_ADDR_LEN) == 0) &&
+                               table[table_index].occupied)
+                               return table_index;
+               }
+       }
+       return WLFC_MAC_DESC_ID_INVALID;
+}
+
+/**
+ * Called when the host receives a WLFC_CTL_TYPE_TXSTATUS event from the dongle, indicating the
+ * status of a frame that the dongle attempted to transmit over the wireless medium.
+ */
+static int
+dhd_wlfc_suppressed_acked_update(dhd_pub_t *dhd, uint16 hslot, uint8 prec, uint8 hcnt)
+{
+       athost_wl_status_info_t* ctx;
+       wlfc_mac_descriptor_t* entry = NULL;
+       struct pktq *pq;
+       struct pktq_prec *q;
+       void *p, *b;
+
+       if (!dhd) {
+               DHD_ERROR(("%s: dhd(%p)\n", __FUNCTION__, dhd));
+               return BCME_BADARG;
+       }
+       ctx = (athost_wl_status_info_t*)dhd->wlfc_state;
+       if (!ctx) {
+               DHD_ERROR(("%s: ctx(%p)\n", __FUNCTION__, ctx));
+               return BCME_ERROR;
+       }
+
+       ASSERT(hslot < (WLFC_MAC_DESC_TABLE_SIZE + WLFC_MAX_IFNUM + 1));
+
+       if (hslot < WLFC_MAC_DESC_TABLE_SIZE)
+               entry  = &ctx->destination_entries.nodes[hslot];
+       else if (hslot < (WLFC_MAC_DESC_TABLE_SIZE + WLFC_MAX_IFNUM))
+               entry = &ctx->destination_entries.interfaces[hslot - WLFC_MAC_DESC_TABLE_SIZE];
+       else
+               entry = &ctx->destination_entries.other;
+
+       pq = &entry->psq;
+
+       ASSERT(((prec << 1) + 1) < pq->num_prec);
+
+       q = &pq->q[((prec << 1) + 1)];
+
+       b = NULL;
+       p = q->head;
+
+       while (p && (hcnt != WL_TXSTATUS_GET_FREERUNCTR(DHD_PKTTAG_H2DTAG(PKTTAG(p))))) {
+               b = p;
+               p = PKTLINK(p);
+       }
+
+       if (p == NULL) {
+               /* none is matched */
+               if (b) {
+                       DHD_ERROR(("%s: can't find matching seq(%d)\n", __FUNCTION__, hcnt));
+               } else {
+                       DHD_ERROR(("%s: queue is empty\n", __FUNCTION__));
+               }
+
+               return BCME_ERROR;
+       }
+
+       if (!b) {
+               /* head packet is matched */
+               if ((q->head = PKTLINK(p)) == NULL) {
+                       q->tail = NULL;
+               }
+       } else {
+               /* middle packet is matched */
+               PKTSETLINK(b, PKTLINK(p));
+               if (PKTLINK(p) == NULL) {
+                       q->tail = b;
+               }
+       }
+
+       q->len--;
+       pq->len--;
+       ctx->pkt_cnt_in_q[DHD_PKTTAG_IF(PKTTAG(p))][prec]--;
+       ctx->pkt_cnt_per_ac[prec]--;
+
+       PKTSETLINK(p, NULL);
+
+       if (WLFC_GET_AFQ(dhd->wlfc_mode)) {
+               _dhd_wlfc_enque_afq(ctx, p);
+       } else {
+               _dhd_wlfc_hanger_pushpkt(ctx->hanger, p, hslot);
+       }
+
+       entry->transit_count++;
+
+       return BCME_OK;
+}
+
+static int
+_dhd_wlfc_compressed_txstatus_update(dhd_pub_t *dhd, uint8* pkt_info, uint8 len, void** p_mac)
+{
+       uint8 status_flag_ori, status_flag;
+       uint32 status;
+       int ret = BCME_OK;
+       int remove_from_hanger_ori, remove_from_hanger = 1;
+       void* pktbuf = NULL;
+       uint8 fifo_id = 0, gen = 0, count = 0, hcnt;
+       uint16 hslot;
+       wlfc_mac_descriptor_t* entry = NULL;
+       athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+       uint16 seq = 0, seq_fromfw = 0, seq_num = 0;
+
+       memcpy(&status, pkt_info, sizeof(uint32));
+       status = ltoh32(status);
+       status_flag = WL_TXSTATUS_GET_FLAGS(status);
+       hcnt = WL_TXSTATUS_GET_FREERUNCTR(status);
+       hslot = WL_TXSTATUS_GET_HSLOT(status);
+       fifo_id = WL_TXSTATUS_GET_FIFO(status);
+       gen = WL_TXSTATUS_GET_GENERATION(status);
+
+       if (WLFC_GET_REUSESEQ(dhd->wlfc_mode)) {
+               memcpy(&seq, pkt_info + WLFC_CTL_VALUE_LEN_TXSTATUS, WLFC_CTL_VALUE_LEN_SEQ);
+               seq = ltoh16(seq);
+               seq_fromfw = WL_SEQ_GET_FROMFW(seq);
+               seq_num = WL_SEQ_GET_NUM(seq);
+       }
+
+       wlfc->stats.txstatus_in += len;
+
+       if (status_flag == WLFC_CTL_PKTFLAG_DISCARD) {
+               wlfc->stats.pkt_freed += len;
+       } else if (status_flag == WLFC_CTL_PKTFLAG_DISCARD_NOACK) {
+               wlfc->stats.pkt_freed += len;
+       } else if (status_flag == WLFC_CTL_PKTFLAG_D11SUPPRESS) {
+               wlfc->stats.d11_suppress += len;
+               remove_from_hanger = 0;
+       } else if (status_flag == WLFC_CTL_PKTFLAG_WLSUPPRESS) {
+               wlfc->stats.wl_suppress += len;
+               remove_from_hanger = 0;
+       } else if (status_flag == WLFC_CTL_PKTFLAG_TOSSED_BYWLC) {
+               wlfc->stats.wlc_tossed_pkts += len;
+       }
+
+       else if (status_flag == WLFC_CTL_PKTFLAG_SUPPRESS_ACKED) {
+               wlfc->stats.pkt_freed += len;
+       }
+
+       if (dhd->proptxstatus_txstatus_ignore) {
+               if (!remove_from_hanger) {
+                       DHD_ERROR(("suppress txstatus: %d\n", status_flag));
+               }
+               return BCME_OK;
+       }
+
+       status_flag_ori = status_flag;
+       remove_from_hanger_ori = remove_from_hanger;
+
+       while (count < len) {
+               if (status_flag == WLFC_CTL_PKTFLAG_SUPPRESS_ACKED) {
+                       dhd_wlfc_suppressed_acked_update(dhd, hslot, fifo_id, hcnt);
+               }
+               if (WLFC_GET_AFQ(dhd->wlfc_mode)) {
+                       ret = _dhd_wlfc_deque_afq(wlfc, hslot, hcnt, fifo_id, &pktbuf);
+               } else {
+                       status_flag = status_flag_ori;
+                       remove_from_hanger = remove_from_hanger_ori;
+                       ret = _dhd_wlfc_hanger_poppkt(wlfc->hanger, hslot, &pktbuf, FALSE);
+                       if (!pktbuf) {
+                               _dhd_wlfc_hanger_free_pkt(wlfc, hslot,
+                                       WLFC_HANGER_PKT_STATE_TXSTATUS, -1);
+                               goto cont;
+                       } else {
+                               wlfc_hanger_t* h = (wlfc_hanger_t*)wlfc->hanger;
+                               if (h->items[hslot].state == WLFC_HANGER_ITEM_STATE_FLUSHED) {
+                                       status_flag = WLFC_CTL_PKTFLAG_DISCARD;
+                                       remove_from_hanger = 1;
+                               }
+                       }
+               }
+
+               if ((ret != BCME_OK) || !pktbuf) {
+                       goto cont;
+               }
+
+               bcm_pkt_validate_chk(pktbuf);
+
+               /* set fifo_id to correct value because not all FW does that */
+               fifo_id = DHD_PKTTAG_FIFO(PKTTAG(pktbuf));
+
+               entry = _dhd_wlfc_find_table_entry(wlfc, pktbuf);
+
+               if (!remove_from_hanger) {
+                       /* this packet was suppressed */
+                       if (!entry->suppressed || (entry->generation != gen)) {
+                               if (!entry->suppressed) {
+                                       entry->suppr_transit_count = entry->transit_count;
+                                       if (p_mac) {
+                                               *p_mac = entry;
+                                       }
+                               } else {
+                                       DHD_ERROR(("gen(%d), entry->generation(%d)\n",
+                                               gen, entry->generation));
+                               }
+                               entry->suppressed = TRUE;
+
+                       }
+                       entry->generation = gen;
+               }
+
+#ifdef PROP_TXSTATUS_DEBUG
+               if (!WLFC_GET_AFQ(dhd->wlfc_mode))
+               {
+                       uint32 new_t = OSL_SYSUPTIME();
+                       uint32 old_t;
+                       uint32 delta;
+                       old_t = ((wlfc_hanger_t*)(wlfc->hanger))->items[hslot].push_time;
+
+
+                       wlfc->stats.latency_sample_count++;
+                       if (new_t > old_t)
+                               delta = new_t - old_t;
+                       else
+                               delta = 0xffffffff + new_t - old_t;
+                       wlfc->stats.total_status_latency += delta;
+                       wlfc->stats.latency_most_recent = delta;
+
+                       wlfc->stats.deltas[wlfc->stats.idx_delta++] = delta;
+                       if (wlfc->stats.idx_delta == sizeof(wlfc->stats.deltas)/sizeof(uint32))
+                               wlfc->stats.idx_delta = 0;
+               }
+#endif /* PROP_TXSTATUS_DEBUG */
+
+               /* pick up the implicit credit from this packet */
+               if (DHD_PKTTAG_CREDITCHECK(PKTTAG(pktbuf))) {
+                       _dhd_wlfc_return_implied_credit(wlfc, pktbuf);
+               } else {
+                       /*
+                       if this packet did not count against FIFO credit, it must have
+                       taken a requested_credit from the destination entry (for pspoll etc.)
+                       */
+                       if (!DHD_PKTTAG_ONETIMEPKTRQST(PKTTAG(pktbuf))) {
+                               entry->requested_credit++;
+#if defined(DHD_WLFC_THREAD)
+                               _dhd_wlfc_thread_wakeup(dhd);
+#endif /* DHD_WLFC_THREAD */
+                       }
+#ifdef PROP_TXSTATUS_DEBUG
+                       entry->dstncredit_acks++;
+#endif
+               }
+
+               if ((status_flag == WLFC_CTL_PKTFLAG_D11SUPPRESS) ||
+                       (status_flag == WLFC_CTL_PKTFLAG_WLSUPPRESS)) {
+                       /* save generation bit inside packet */
+                       WL_TXSTATUS_SET_GENERATION(DHD_PKTTAG_H2DTAG(PKTTAG(pktbuf)), gen);
+
+                       if (WLFC_GET_REUSESEQ(dhd->wlfc_mode)) {
+                               WL_SEQ_SET_FROMDRV(DHD_PKTTAG_H2DSEQ(PKTTAG(pktbuf)), seq_fromfw);
+                               WL_SEQ_SET_NUM(DHD_PKTTAG_H2DSEQ(PKTTAG(pktbuf)), seq_num);
+                       }
+
+                       ret = _dhd_wlfc_enque_suppressed(wlfc, fifo_id, pktbuf);
+                       if (ret != BCME_OK) {
+                               /* delay q is full, drop this packet */
+                               DHD_WLFC_QMON_COMPLETE(entry);
+                               _dhd_wlfc_prec_drop(dhd, (fifo_id << 1) + 1, pktbuf, FALSE);
+                       } else {
+                               if (!WLFC_GET_AFQ(dhd->wlfc_mode)) {
+                                       /* Mark suppressed to avoid a double free
+                                       during wlfc cleanup
+                                       */
+                                       _dhd_wlfc_hanger_mark_suppressed(wlfc->hanger, hslot, gen);
+                               }
+                       }
+               } else {
+
+                       DHD_WLFC_QMON_COMPLETE(entry);
+
+                       if (!WLFC_GET_AFQ(dhd->wlfc_mode)) {
+                               _dhd_wlfc_hanger_free_pkt(wlfc, hslot,
+                                       WLFC_HANGER_PKT_STATE_TXSTATUS, TRUE);
+                       } else {
+                               dhd_txcomplete(dhd, pktbuf, TRUE);
+                               wlfc->pkt_cnt_in_drv[DHD_PKTTAG_IF(PKTTAG(pktbuf))]
+                                       [DHD_PKTTAG_FIFO(PKTTAG(pktbuf))]--;
+                               wlfc->stats.pktout++;
+                               /* free the packet */
+                               PKTFREE(wlfc->osh, pktbuf, TRUE);
+                       }
+               }
+               /* pkt back from firmware side */
+               if (entry->transit_count)
+                       entry->transit_count--;
+               if (entry->suppr_transit_count) {
+                       entry->suppr_transit_count--;
+                       if (entry->suppressed &&
+                               (!entry->onbus_pkts_count) &&
+                               (!entry->suppr_transit_count))
+                               entry->suppressed = FALSE;
+               }
+
+cont:
+               hcnt = (hcnt + 1) & WL_TXSTATUS_FREERUNCTR_MASK;
+               if (!WLFC_GET_AFQ(dhd->wlfc_mode)) {
+                       hslot = (hslot + 1) & WL_TXSTATUS_HSLOT_MASK;
+               }
+
+               if (WLFC_GET_REUSESEQ(dhd->wlfc_mode) && seq_fromfw) {
+                       seq_num = (seq_num + 1) & WL_SEQ_NUM_MASK;
+               }
+
+               count++;
+       }
+
+       return BCME_OK;
+} /* _dhd_wlfc_compressed_txstatus_update */
+
+/**
+ * Called when eg host receives a 'WLFC_CTL_TYPE_FIFO_CREDITBACK' event from the dongle.
+ *    @param[in] credits caller supplied credit that will be added to the host credit.
+ */
+static int
+_dhd_wlfc_fifocreditback_indicate(dhd_pub_t *dhd, uint8* credits)
+{
+       int i;
+       athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+       for (i = 0; i < WLFC_CTL_VALUE_LEN_FIFO_CREDITBACK; i++) {
+#ifdef PROP_TXSTATUS_DEBUG
+               wlfc->stats.fifo_credits_back[i] += credits[i];
+#endif
+
+               /* update FIFO credits */
+               if (dhd->proptxstatus_mode == WLFC_FCMODE_EXPLICIT_CREDIT)
+               {
+                       int lender; /* Note that borrower is i */
+
+                       /* Return credits to highest priority lender first */
+                       for (lender = AC_COUNT; (lender >= 0) && (credits[i] > 0); lender--) {
+                               if (wlfc->credits_borrowed[i][lender] > 0) {
+                                       if (credits[i] >= wlfc->credits_borrowed[i][lender]) {
+                                               credits[i] -=
+                                                       (uint8)wlfc->credits_borrowed[i][lender];
+                                               wlfc->FIFO_credit[lender] +=
+                                                   wlfc->credits_borrowed[i][lender];
+                                               wlfc->credits_borrowed[i][lender] = 0;
+                                       } else {
+                                               wlfc->credits_borrowed[i][lender] -= credits[i];
+                                               wlfc->FIFO_credit[lender] += credits[i];
+                                               credits[i] = 0;
+                                       }
+                               }
+                       }
+
+                       /* If we have more credits left over, these must belong to the AC */
+                       if (credits[i] > 0) {
+                               wlfc->FIFO_credit[i] += credits[i];
+                       }
+
+                       if (wlfc->FIFO_credit[i] > wlfc->Init_FIFO_credit[i]) {
+                               wlfc->FIFO_credit[i] = wlfc->Init_FIFO_credit[i];
+                       }
+               }
+       }
+
+#if defined(DHD_WLFC_THREAD)
+       _dhd_wlfc_thread_wakeup(dhd);
+#endif /* defined(DHD_WLFC_THREAD) */
+
+       return BCME_OK;
+} /* _dhd_wlfc_fifocreditback_indicate */
+
+
+/** !BCMDBUS specific function */
+static void
+_dhd_wlfc_suppress_txq(dhd_pub_t *dhd, f_processpkt_t fn, void *arg)
+{
+       athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+       wlfc_mac_descriptor_t* entry;
+       int prec;
+       void *pkt = NULL, *head = NULL, *tail = NULL;
+       struct pktq *txq = (struct pktq *)dhd_bus_txq(dhd->bus);
+       uint8   results[WLFC_CTL_VALUE_LEN_TXSTATUS+WLFC_CTL_VALUE_LEN_SEQ];
+       uint8 credits[WLFC_CTL_VALUE_LEN_FIFO_CREDITBACK] = {0};
+       uint32 htod = 0;
+       uint16 htodseq = 0;
+       bool bCreditUpdate = FALSE;
+
+       dhd_os_sdlock_txq(dhd);
+       for (prec = 0; prec < txq->num_prec; prec++) {
+               while ((pkt = _dhd_wlfc_pktq_pdeq_with_fn(txq, prec, fn, arg))) {
+                       if (!head) {
+                               head = pkt;
+                       }
+                       if (tail) {
+                               PKTSETLINK(tail, pkt);
+                       }
+                       tail = pkt;
+               }
+       }
+       dhd_os_sdunlock_txq(dhd);
+
+       while ((pkt = head)) {
+               head = PKTLINK(pkt);
+               PKTSETLINK(pkt, NULL);
+
+               entry = _dhd_wlfc_find_table_entry(wlfc, pkt);
+               if (entry) {
+                       if (entry->onbus_pkts_count > 0)
+                               entry->onbus_pkts_count--;
+                       if (entry->suppressed &&
+                               (!entry->onbus_pkts_count) &&
+                               (!entry->suppr_transit_count))
+                               entry->suppressed = FALSE;
+               }
+
+               /* fake a suppression txstatus */
+               htod = DHD_PKTTAG_H2DTAG(PKTTAG(pkt));
+               WL_TXSTATUS_SET_FLAGS(htod, WLFC_CTL_PKTFLAG_WLSUPPRESS);
+               WL_TXSTATUS_SET_GENERATION(htod, entry->generation);
+               htod = htol32(htod);
+               memcpy(results, &htod, WLFC_CTL_VALUE_LEN_TXSTATUS);
+               if (WLFC_GET_REUSESEQ(dhd->wlfc_mode)) {
+                       htodseq = DHD_PKTTAG_H2DSEQ(PKTTAG(pkt));
+                       if (WL_SEQ_GET_FROMDRV(htodseq)) {
+                               WL_SEQ_SET_FROMFW(htodseq, 1);
+                               WL_SEQ_SET_FROMDRV(htodseq, 0);
+                       }
+                       htodseq = htol16(htodseq);
+                       memcpy(results + WLFC_CTL_VALUE_LEN_TXSTATUS, &htodseq,
+                               WLFC_CTL_VALUE_LEN_SEQ);
+               }
+               if (WLFC_GET_AFQ(dhd->wlfc_mode)) {
+                       _dhd_wlfc_enque_afq(wlfc, pkt);
+               }
+               _dhd_wlfc_compressed_txstatus_update(dhd, results, 1, NULL);
+
+               /* fake a fifo credit back */
+               if (DHD_PKTTAG_CREDITCHECK(PKTTAG(pkt))) {
+                       credits[DHD_PKTTAG_FIFO(PKTTAG(pkt))]++;
+                       bCreditUpdate = TRUE;
+               }
+       }
+
+       if (bCreditUpdate) {
+               _dhd_wlfc_fifocreditback_indicate(dhd, credits);
+       }
+} /* _dhd_wlfc_suppress_txq */
+
+static int
+_dhd_wlfc_dbg_senum_check(dhd_pub_t *dhd, uint8 *value)
+{
+       uint32 timestamp;
+
+       (void)dhd;
+
+       bcopy(&value[2], &timestamp, sizeof(uint32));
+       timestamp = ltoh32(timestamp);
+       DHD_INFO(("RXPKT: SEQ: %d, timestamp %d\n", value[1], timestamp));
+       return BCME_OK;
+}
+
+static int
+_dhd_wlfc_rssi_indicate(dhd_pub_t *dhd, uint8* rssi)
+{
+       (void)dhd;
+       (void)rssi;
+       return BCME_OK;
+}
+
+static void
+_dhd_wlfc_add_requested_entry(athost_wl_status_info_t* wlfc, wlfc_mac_descriptor_t* entry)
+{
+       int i;
+
+       if (!wlfc || !entry) {
+               return;
+       }
+
+       for (i = 0; i < wlfc->requested_entry_count; i++) {
+               if (entry == wlfc->requested_entry[i]) {
+                       break;
+               }
+       }
+
+       if (i == wlfc->requested_entry_count) {
+               /* no match entry found */
+               ASSERT(wlfc->requested_entry_count <= (WLFC_MAC_DESC_TABLE_SIZE-1));
+               wlfc->requested_entry[wlfc->requested_entry_count++] = entry;
+       }
+}
+
+/** called on eg receiving 'mac open' event from the dongle. */
+static void
+_dhd_wlfc_remove_requested_entry(athost_wl_status_info_t* wlfc, wlfc_mac_descriptor_t* entry)
+{
+       int i;
+
+       if (!wlfc || !entry) {
+               return;
+       }
+
+       for (i = 0; i < wlfc->requested_entry_count; i++) {
+               if (entry == wlfc->requested_entry[i]) {
+                       break;
+               }
+       }
+
+       if (i < wlfc->requested_entry_count) {
+               /* found */
+               ASSERT(wlfc->requested_entry_count > 0);
+               wlfc->requested_entry_count--;
+               if (i != wlfc->requested_entry_count) {
+                       wlfc->requested_entry[i] =
+                               wlfc->requested_entry[wlfc->requested_entry_count];
+               }
+               wlfc->requested_entry[wlfc->requested_entry_count] = NULL;
+       }
+}
+
+/** called on eg receiving a WLFC_CTL_TYPE_MACDESC_ADD TLV from the dongle */
+static int
+_dhd_wlfc_mac_table_update(dhd_pub_t *dhd, uint8* value, uint8 type)
+{
+       int rc;
+       athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+       wlfc_mac_descriptor_t* table;
+       uint8 existing_index;
+       uint8 table_index;
+       uint8 ifid;
+       uint8* ea;
+
+       WLFC_DBGMESG(("%s(), mac [%02x:%02x:%02x:%02x:%02x:%02x],%s,idx:%d,id:0x%02x\n",
+               __FUNCTION__, value[2], value[3], value[4], value[5], value[6], value[7],
+               ((type == WLFC_CTL_TYPE_MACDESC_ADD) ? "ADD":"DEL"),
+               WLFC_MAC_DESC_GET_LOOKUP_INDEX(value[0]), value[0]));
+
+       table = wlfc->destination_entries.nodes;
+       table_index = WLFC_MAC_DESC_GET_LOOKUP_INDEX(value[0]);
+       ifid = value[1];
+       ea = &value[2];
+
+       _dhd_wlfc_remove_requested_entry(wlfc, &table[table_index]);
+       if (type == WLFC_CTL_TYPE_MACDESC_ADD) {
+               existing_index = _dhd_wlfc_find_mac_desc_id_from_mac(dhd, &value[2]);
+               if ((existing_index != WLFC_MAC_DESC_ID_INVALID) &&
+                       (existing_index != table_index) && table[existing_index].occupied) {
+                       /*
+                       there is an existing different entry, free the old one
+                       and move it to new index if necessary.
+                       */
+                       rc = _dhd_wlfc_mac_entry_update(wlfc, &table[existing_index],
+                               eWLFC_MAC_ENTRY_ACTION_DEL, table[existing_index].interface_id,
+                               table[existing_index].iftype, NULL, _dhd_wlfc_entrypkt_fn,
+                               &table[existing_index]);
+               }
+
+               if (!table[table_index].occupied) {
+                       /* this new MAC entry does not exist, create one */
+                       table[table_index].mac_handle = value[0];
+                       rc = _dhd_wlfc_mac_entry_update(wlfc, &table[table_index],
+                               eWLFC_MAC_ENTRY_ACTION_ADD, ifid,
+                               wlfc->destination_entries.interfaces[ifid].iftype,
+                               ea, NULL, NULL);
+               } else {
+                       /* the space should have been empty, but it's not */
+                       wlfc->stats.mac_update_failed++;
+               }
+       }
+
+       if (type == WLFC_CTL_TYPE_MACDESC_DEL) {
+               if (table[table_index].occupied) {
+                               rc = _dhd_wlfc_mac_entry_update(wlfc, &table[table_index],
+                                       eWLFC_MAC_ENTRY_ACTION_DEL, ifid,
+                                       wlfc->destination_entries.interfaces[ifid].iftype,
+                                       ea, _dhd_wlfc_entrypkt_fn, &table[table_index]);
+               } else {
+                       /* the space should have been occupied, but it's not */
+                       wlfc->stats.mac_update_failed++;
+               }
+       }
+       BCM_REFERENCE(rc);
+       return BCME_OK;
+} /* _dhd_wlfc_mac_table_update */
+
+/** Called on a 'mac open' or 'mac close' event indicated by the dongle */
+static int
+_dhd_wlfc_psmode_update(dhd_pub_t *dhd, uint8* value, uint8 type)
+{
+       /* Handle PS on/off indication */
+       athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+       wlfc_mac_descriptor_t* table;
+       wlfc_mac_descriptor_t* desc; /* a table maps from mac handle to mac descriptor */
+       uint8 mac_handle = value[0];
+       int i;
+
+       table = wlfc->destination_entries.nodes;
+       desc = &table[WLFC_MAC_DESC_GET_LOOKUP_INDEX(mac_handle)];
+       if (desc->occupied) {
+               if (type == WLFC_CTL_TYPE_MAC_OPEN) {
+                       desc->state = WLFC_STATE_OPEN;
+                       desc->ac_bitmap = 0xff;
+                       DHD_WLFC_CTRINC_MAC_OPEN(desc);
+                       desc->requested_credit = 0;
+                       desc->requested_packet = 0;
+                       _dhd_wlfc_remove_requested_entry(wlfc, desc);
+               } else {
+                       desc->state = WLFC_STATE_CLOSE;
+                       DHD_WLFC_CTRINC_MAC_CLOSE(desc);
+                       /* Indicate to firmware if there is any traffic pending. */
+                       for (i = 0; i < AC_COUNT; i++) {
+                               _dhd_wlfc_traffic_pending_check(wlfc, desc, i);
+                       }
+               }
+       } else {
+               wlfc->stats.psmode_update_failed++;
+       }
+
+       return BCME_OK;
+} /* _dhd_wlfc_psmode_update */
+
+/** called upon receiving 'interface open' or 'interface close' event from the dongle */
+static int
+_dhd_wlfc_interface_update(dhd_pub_t *dhd, uint8* value, uint8 type)
+{
+       /* Handle PS on/off indication */
+       athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+       wlfc_mac_descriptor_t* table;
+       uint8 if_id = value[0];
+
+       if (if_id < WLFC_MAX_IFNUM) {
+               table = wlfc->destination_entries.interfaces;
+               if (table[if_id].occupied) {
+                       if (type == WLFC_CTL_TYPE_INTERFACE_OPEN) {
+                               table[if_id].state = WLFC_STATE_OPEN;
+                               /* WLFC_DBGMESG(("INTERFACE[%d] OPEN\n", if_id)); */
+                       } else {
+                               table[if_id].state = WLFC_STATE_CLOSE;
+                               /* WLFC_DBGMESG(("INTERFACE[%d] CLOSE\n", if_id)); */
+                       }
+                       return BCME_OK;
+               }
+       }
+       wlfc->stats.interface_update_failed++;
+
+       return BCME_OK;
+}
+
+/** Called on receiving a WLFC_CTL_TYPE_MAC_REQUEST_CREDIT TLV from the dongle */
+static int
+_dhd_wlfc_credit_request(dhd_pub_t *dhd, uint8* value)
+{
+       athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+       wlfc_mac_descriptor_t* table;
+       wlfc_mac_descriptor_t* desc;
+       uint8 mac_handle;
+       uint8 credit;
+
+       table = wlfc->destination_entries.nodes;
+       mac_handle = value[1];
+       credit = value[0];
+
+       desc = &table[WLFC_MAC_DESC_GET_LOOKUP_INDEX(mac_handle)];
+       if (desc->occupied) {
+               desc->requested_credit = credit;
+
+               desc->ac_bitmap = value[2] & (~(1<<AC_COUNT));
+               _dhd_wlfc_add_requested_entry(wlfc, desc);
+#if defined(DHD_WLFC_THREAD)
+               if (credit) {
+                       _dhd_wlfc_thread_wakeup(dhd);
+               }
+#endif /* DHD_WLFC_THREAD */
+       } else {
+               wlfc->stats.credit_request_failed++;
+       }
+
+       return BCME_OK;
+}
+
+/** Called on receiving a WLFC_CTL_TYPE_MAC_REQUEST_PACKET TLV from the dongle */
+static int
+_dhd_wlfc_packet_request(dhd_pub_t *dhd, uint8* value)
+{
+       athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+       wlfc_mac_descriptor_t* table;
+       wlfc_mac_descriptor_t* desc;
+       uint8 mac_handle;
+       uint8 packet_count;
+
+       table = wlfc->destination_entries.nodes;
+       mac_handle = value[1];
+       packet_count = value[0];
+
+       desc = &table[WLFC_MAC_DESC_GET_LOOKUP_INDEX(mac_handle)];
+       if (desc->occupied) {
+               desc->requested_packet = packet_count;
+
+               desc->ac_bitmap = value[2] & (~(1<<AC_COUNT));
+               _dhd_wlfc_add_requested_entry(wlfc, desc);
+#if defined(DHD_WLFC_THREAD)
+               if (packet_count) {
+                       _dhd_wlfc_thread_wakeup(dhd);
+               }
+#endif /* DHD_WLFC_THREAD */
+       } else {
+               wlfc->stats.packet_request_failed++;
+       }
+
+       return BCME_OK;
+}
+
+/** Called when host receives a WLFC_CTL_TYPE_HOST_REORDER_RXPKTS TLV from the dongle */
+static void
+_dhd_wlfc_reorderinfo_indicate(uint8 *val, uint8 len, uchar *info_buf, uint *info_len)
+{
+       if (info_len) {
+               /* Check copy length to avoid buffer overrun. In case of length exceeding
+                *  WLHOST_REORDERDATA_TOTLEN, return failure instead sending incomplete result
+                *  of length WLHOST_REORDERDATA_TOTLEN
+                */
+               if ((info_buf) && (len <= WLHOST_REORDERDATA_TOTLEN)) {
+                       bcopy(val, info_buf, len);
+                       *info_len = len;
+               } else {
+                       *info_len = 0;
+               }
+       }
+}
+
+/*
+ * public functions
+ */
+
+bool dhd_wlfc_is_supported(dhd_pub_t *dhd)
+{
+       bool rc = TRUE;
+
+       if (dhd == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return FALSE;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       if (!dhd->wlfc_state || (dhd->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+               rc =  FALSE;
+       }
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return rc;
+}
+
+int dhd_wlfc_enable(dhd_pub_t *dhd)
+{
+       int i, rc = BCME_OK;
+       athost_wl_status_info_t* wlfc;
+
+       if (dhd == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       if (!dhd->wlfc_enabled || dhd->wlfc_state) {
+               rc = BCME_OK;
+               goto exit;
+       }
+
+       /* allocate space to track txstatus propagated from firmware */
+       dhd->wlfc_state = DHD_OS_PREALLOC(dhd, DHD_PREALLOC_DHD_WLFC_INFO,
+               sizeof(athost_wl_status_info_t));
+       if (dhd->wlfc_state == NULL) {
+               rc = BCME_NOMEM;
+               goto exit;
+       }
+
+       /* initialize state space */
+       wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+       memset(wlfc, 0, sizeof(athost_wl_status_info_t));
+
+       /* remember osh & dhdp */
+       wlfc->osh = dhd->osh;
+       wlfc->dhdp = dhd;
+
+       if (!WLFC_GET_AFQ(dhd->wlfc_mode)) {
+               wlfc->hanger = _dhd_wlfc_hanger_create(dhd, WLFC_HANGER_MAXITEMS);
+               if (wlfc->hanger == NULL) {
+                       DHD_OS_PREFREE(dhd, dhd->wlfc_state,
+                               sizeof(athost_wl_status_info_t));
+                       dhd->wlfc_state = NULL;
+                       rc = BCME_NOMEM;
+                       goto exit;
+               }
+       }
+
+       dhd->proptxstatus_mode = WLFC_FCMODE_EXPLICIT_CREDIT;
+       /* default to check rx pkt */
+       dhd->wlfc_rxpkt_chk = TRUE;
+       if (dhd->op_mode & DHD_FLAG_IBSS_MODE) {
+               dhd->wlfc_rxpkt_chk = FALSE;
+       }
+
+       /* initialize all interfaces to accept traffic */
+       for (i = 0; i < WLFC_MAX_IFNUM; i++) {
+               wlfc->hostif_flow_state[i] = OFF;
+       }
+
+       _dhd_wlfc_mac_entry_update(wlfc, &wlfc->destination_entries.other,
+               eWLFC_MAC_ENTRY_ACTION_ADD, 0xff, 0, NULL, NULL, NULL);
+
+       wlfc->allow_credit_borrow = 0;
+       wlfc->single_ac = 0;
+       wlfc->single_ac_timestamp = 0;
+
+
+exit:
+       dhd_os_wlfc_unblock(dhd);
+
+       return rc;
+} /* dhd_wlfc_enable */
+
+#ifdef SUPPORT_P2P_GO_PS
+
+/**
+ * Called when the host platform enters a lower power mode, eg right before a system hibernate.
+ * SUPPORT_P2P_GO_PS specific function.
+ */
+int
+dhd_wlfc_suspend(dhd_pub_t *dhd)
+{
+       uint32 tlv = 0;
+
+       DHD_TRACE(("%s: masking wlfc events\n", __FUNCTION__));
+       if (!dhd->wlfc_enabled)
+               return -1;
+
+       if (!dhd_wl_ioctl_get_intiovar(dhd, "tlv", &tlv, WLC_GET_VAR, FALSE, 0))
+               return -1;
+       if ((tlv & (WLFC_FLAGS_RSSI_SIGNALS | WLFC_FLAGS_XONXOFF_SIGNALS)) == 0)
+               return 0;
+       tlv &= ~(WLFC_FLAGS_RSSI_SIGNALS | WLFC_FLAGS_XONXOFF_SIGNALS);
+       if (!dhd_wl_ioctl_set_intiovar(dhd, "tlv", tlv, WLC_SET_VAR, TRUE, 0))
+               return -1;
+
+       return 0;
+}
+
+/**
+ * Called when the host platform resumes from a power management operation, eg resume after a
+ * system hibernate. SUPPORT_P2P_GO_PS specific function.
+ */
+int
+dhd_wlfc_resume(dhd_pub_t *dhd)
+{
+       uint32 tlv = 0;
+
+       DHD_TRACE(("%s: unmasking wlfc events\n", __FUNCTION__));
+       if (!dhd->wlfc_enabled)
+               return -1;
+
+       if (!dhd_wl_ioctl_get_intiovar(dhd, "tlv", &tlv, WLC_GET_VAR, FALSE, 0))
+               return -1;
+       if ((tlv & (WLFC_FLAGS_RSSI_SIGNALS | WLFC_FLAGS_XONXOFF_SIGNALS)) ==
+               (WLFC_FLAGS_RSSI_SIGNALS | WLFC_FLAGS_XONXOFF_SIGNALS))
+               return 0;
+       tlv |= (WLFC_FLAGS_RSSI_SIGNALS | WLFC_FLAGS_XONXOFF_SIGNALS);
+       if (!dhd_wl_ioctl_set_intiovar(dhd, "tlv", tlv, WLC_SET_VAR, TRUE, 0))
+               return -1;
+
+       return 0;
+}
+
+#endif /* SUPPORT_P2P_GO_PS */
+
+/** A flow control header was received from firmware, containing one or more TLVs */
+int
+dhd_wlfc_parse_header_info(dhd_pub_t *dhd, void* pktbuf, int tlv_hdr_len, uchar *reorder_info_buf,
+       uint *reorder_info_len)
+{
+       uint8 type, len;
+       uint8* value;
+       uint8* tmpbuf;
+       uint16 remainder = (uint16)tlv_hdr_len;
+       uint16 processed = 0;
+       athost_wl_status_info_t* wlfc = NULL;
+       void* entry;
+
+       if ((dhd == NULL) || (pktbuf == NULL)) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       if (dhd->proptxstatus_mode != WLFC_ONLY_AMPDU_HOSTREORDER) {
+               if (!dhd->wlfc_state || (dhd->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+                       dhd_os_wlfc_unblock(dhd);
+                       return WLFC_UNSUPPORTED;
+               }
+               wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+       }
+
+       tmpbuf = (uint8*)PKTDATA(dhd->osh, pktbuf);
+
+       if (remainder) {
+               while ((processed < (WLFC_MAX_PENDING_DATALEN * 2)) && (remainder > 0)) {
+                       type = tmpbuf[processed];
+                       if (type == WLFC_CTL_TYPE_FILLER) {
+                               remainder -= 1;
+                               processed += 1;
+                               continue;
+                       }
+
+                       len  = tmpbuf[processed + 1];
+                       value = &tmpbuf[processed + 2];
+
+                       if (remainder < (2 + len))
+                               break;
+
+                       remainder -= 2 + len;
+                       processed += 2 + len;
+                       entry = NULL;
+
+                       DHD_INFO(("%s():%d type %d remainder %d processed %d\n",
+                               __FUNCTION__, __LINE__, type, remainder, processed));
+
+                       if (type == WLFC_CTL_TYPE_HOST_REORDER_RXPKTS)
+                               _dhd_wlfc_reorderinfo_indicate(value, len, reorder_info_buf,
+                                       reorder_info_len);
+
+                       if (wlfc == NULL) {
+                               ASSERT(dhd->proptxstatus_mode == WLFC_ONLY_AMPDU_HOSTREORDER);
+
+                               if (type != WLFC_CTL_TYPE_HOST_REORDER_RXPKTS &&
+                                       type != WLFC_CTL_TYPE_TRANS_ID)
+                                       DHD_INFO(("%s():%d dhd->wlfc_state is NULL yet!"
+                                       " type %d remainder %d processed %d\n",
+                                       __FUNCTION__, __LINE__, type, remainder, processed));
+                               continue;
+                       }
+
+                       if (type == WLFC_CTL_TYPE_TXSTATUS) {
+                               _dhd_wlfc_compressed_txstatus_update(dhd, value, 1, &entry);
+                       } else if (type == WLFC_CTL_TYPE_COMP_TXSTATUS) {
+                               uint8 compcnt_offset = WLFC_CTL_VALUE_LEN_TXSTATUS;
+
+                               if (WLFC_GET_REUSESEQ(dhd->wlfc_mode)) {
+                                       compcnt_offset += WLFC_CTL_VALUE_LEN_SEQ;
+                               }
+                               _dhd_wlfc_compressed_txstatus_update(dhd, value,
+                                       value[compcnt_offset], &entry);
+                       } else if (type == WLFC_CTL_TYPE_FIFO_CREDITBACK) {
+                               _dhd_wlfc_fifocreditback_indicate(dhd, value);
+                       } else if (type == WLFC_CTL_TYPE_RSSI) {
+                               _dhd_wlfc_rssi_indicate(dhd, value);
+                       } else if (type == WLFC_CTL_TYPE_MAC_REQUEST_CREDIT) {
+                               _dhd_wlfc_credit_request(dhd, value);
+                       } else if (type == WLFC_CTL_TYPE_MAC_REQUEST_PACKET) {
+                               _dhd_wlfc_packet_request(dhd, value);
+                       } else if ((type == WLFC_CTL_TYPE_MAC_OPEN) ||
+                               (type == WLFC_CTL_TYPE_MAC_CLOSE)) {
+                               _dhd_wlfc_psmode_update(dhd, value, type);
+                       } else if ((type == WLFC_CTL_TYPE_MACDESC_ADD) ||
+                               (type == WLFC_CTL_TYPE_MACDESC_DEL)) {
+                               _dhd_wlfc_mac_table_update(dhd, value, type);
+                       } else if (type == WLFC_CTL_TYPE_TRANS_ID) {
+                               _dhd_wlfc_dbg_senum_check(dhd, value);
+                       } else if ((type == WLFC_CTL_TYPE_INTERFACE_OPEN) ||
+                               (type == WLFC_CTL_TYPE_INTERFACE_CLOSE)) {
+                               _dhd_wlfc_interface_update(dhd, value, type);
+                       }
+
+                       if (entry && WLFC_GET_REORDERSUPP(dhd->wlfc_mode)) {
+                               /* suppress all packets for this mac entry from bus->txq */
+                               _dhd_wlfc_suppress_txq(dhd, _dhd_wlfc_entrypkt_fn, entry);
+                       }
+               } /* while */
+
+               if (remainder != 0 && wlfc) {
+                       /* trouble..., something is not right */
+                       wlfc->stats.tlv_parse_failed++;
+               }
+       } /* if */
+
+       if (wlfc)
+               wlfc->stats.dhd_hdrpulls++;
+
+       dhd_os_wlfc_unblock(dhd);
+       return BCME_OK;
+} /* dhd_wlfc_parse_header_info */
+
+KERNEL_THREAD_RETURN_TYPE
+dhd_wlfc_transfer_packets(void *data)
+{
+       dhd_pub_t *dhdp = (dhd_pub_t *)data;
+       int ac, single_ac = 0, rc = BCME_OK;
+       dhd_wlfc_commit_info_t  commit_info;
+       athost_wl_status_info_t* ctx;
+       int bus_retry_count = 0;
+       int pkt_send = 0;
+
+       uint8 tx_map = 0; /* packets (send + in queue), Bitmask for 4 ACs + BC/MC */
+       uint8 rx_map = 0; /* received packets, Bitmask for 4 ACs + BC/MC */
+       uint8 packets_map = 0; /* packets in queue, Bitmask for 4 ACs + BC/MC */
+       bool no_credit = FALSE;
+
+       int lender;
+
+#if defined(DHD_WLFC_THREAD)
+       /* wait till someone wakeup me up, will change it at running time */
+       int wait_msec = msecs_to_jiffies(0xFFFFFFFF);
+#endif /* defined(DHD_WLFC_THREAD) */
+
+#if defined(DHD_WLFC_THREAD)
+       while (1) {
+               bus_retry_count = 0;
+               pkt_send = 0;
+               tx_map = 0;
+               rx_map = 0;
+               packets_map = 0;
+               wait_msec = wait_event_interruptible_timeout(dhdp->wlfc_wqhead,
+                       dhdp->wlfc_thread_go, wait_msec);
+               if (kthread_should_stop()) {
+                       break;
+               }
+               dhdp->wlfc_thread_go = FALSE;
+
+               dhd_os_wlfc_block(dhdp);
+#endif /* defined(DHD_WLFC_THREAD) */
+               ctx = (athost_wl_status_info_t*)dhdp->wlfc_state;
+#if defined(DHD_WLFC_THREAD)
+               if (!ctx)
+                       goto exit;
+#endif /* defined(DHD_WLFC_THREAD) */
+
+       memset(&commit_info, 0, sizeof(commit_info));
+
+       /*
+       Commit packets for regular AC traffic. Higher priority first.
+       First, use up FIFO credits available to each AC. Based on distribution
+       and credits left, borrow from other ACs as applicable
+
+       -NOTE:
+       If the bus between the host and firmware is overwhelmed by the
+       traffic from host, it is possible that higher priority traffic
+       starves the lower priority queue. If that occurs often, we may
+       have to employ weighted round-robin or ucode scheme to avoid
+       low priority packet starvation.
+       */
+
+       for (ac = AC_COUNT; ac >= 0; ac--) {
+               if (dhdp->wlfc_rxpkt_chk) {
+                       /* check rx packet */
+                       uint32 curr_t = OSL_SYSUPTIME(), delta;
+
+                       delta = curr_t - ctx->rx_timestamp[ac];
+                       if (delta < WLFC_RX_DETECTION_THRESHOLD_MS) {
+                               rx_map |= (1 << ac);
+                       }
+               }
+
+               if (ctx->pkt_cnt_per_ac[ac] == 0) {
+                       continue;
+               }
+
+               tx_map |= (1 << ac);
+               single_ac = ac + 1;
+               while (FALSE == dhdp->proptxstatus_txoff) {
+                       /* packets from delayQ with less priority are fresh and
+                        * they'd need header and have no MAC entry
+                        */
+                       no_credit = (ctx->FIFO_credit[ac] < 1);
+                       if (dhdp->proptxstatus_credit_ignore ||
+                               ((ac == AC_COUNT) && !ctx->bcmc_credit_supported)) {
+                               no_credit = FALSE;
+                       }
+
+                       lender = -1;
+#ifdef LIMIT_BORROW
+                       if (no_credit && (ac < AC_COUNT) && (tx_map >= rx_map)) {
+                               /* try borrow from lower priority */
+                               lender = _dhd_wlfc_borrow_credit(ctx, ac - 1, ac, FALSE);
+                               if (lender != -1) {
+                                       no_credit = FALSE;
+                               }
+                       }
+#endif
+                       commit_info.needs_hdr = 1;
+                       commit_info.mac_entry = NULL;
+                       commit_info.p = _dhd_wlfc_deque_delayedq(ctx, ac,
+                               &(commit_info.ac_fifo_credit_spent),
+                               &(commit_info.needs_hdr),
+                               &(commit_info.mac_entry),
+                               no_credit);
+                       commit_info.pkt_type = (commit_info.needs_hdr) ? eWLFC_PKTTYPE_DELAYED :
+                               eWLFC_PKTTYPE_SUPPRESSED;
+
+                       if (commit_info.p == NULL) {
+#ifdef LIMIT_BORROW
+                               if (lender != -1) {
+                                       _dhd_wlfc_return_credit(ctx, lender, ac);
+                               }
+#endif
+                               break;
+                       }
+
+                       if (!dhdp->proptxstatus_credit_ignore && (lender == -1)) {
+                               ASSERT(ctx->FIFO_credit[ac] >= commit_info.ac_fifo_credit_spent);
+                       }
+                       /* here we can ensure have credit or no credit needed */
+                       rc = _dhd_wlfc_handle_packet_commit(ctx, ac, &commit_info,
+                               ctx->fcommit, ctx->commit_ctx);
+
+                       /* Bus commits may fail (e.g. flow control); abort after retries */
+                       if (rc == BCME_OK) {
+                               pkt_send++;
+                               if (commit_info.ac_fifo_credit_spent && (lender == -1)) {
+                                       ctx->FIFO_credit[ac]--;
+                               }
+#ifdef LIMIT_BORROW
+                               else if (!commit_info.ac_fifo_credit_spent && (lender != -1)) {
+                                       _dhd_wlfc_return_credit(ctx, lender, ac);
+                               }
+#endif
+                       } else {
+#ifdef LIMIT_BORROW
+                               if (lender != -1) {
+                                       _dhd_wlfc_return_credit(ctx, lender, ac);
+                               }
+#endif
+                               bus_retry_count++;
+                               if (bus_retry_count >= BUS_RETRIES) {
+                                       DHD_ERROR(("%s: bus error %d\n", __FUNCTION__, rc));
+                                       goto exit;
+                               }
+                       }
+               }
+
+               if (ctx->pkt_cnt_per_ac[ac]) {
+                       packets_map |= (1 << ac);
+               }
+       }
+
+       if ((tx_map == 0) || dhdp->proptxstatus_credit_ignore) {
+               /* nothing send out or remain in queue */
+               rc = BCME_OK;
+               goto exit;
+       }
+
+       if (((tx_map & (tx_map - 1)) == 0) && (tx_map >= rx_map)) {
+               /* only one tx ac exist and no higher rx ac */
+               if ((single_ac == ctx->single_ac) && ctx->allow_credit_borrow) {
+                       ac = single_ac - 1;
+               } else {
+                       uint32 delta;
+                       uint32 curr_t = OSL_SYSUPTIME();
+
+                       if (single_ac != ctx->single_ac) {
+                               /* new single ac traffic (first single ac or different single ac) */
+                               ctx->allow_credit_borrow = 0;
+                               ctx->single_ac_timestamp = curr_t;
+                               ctx->single_ac = (uint8)single_ac;
+                               rc = BCME_OK;
+                               goto exit;
+                       }
+                       /* same ac traffic, check if it lasts enough time */
+                       delta = curr_t - ctx->single_ac_timestamp;
+
+                       if (delta >= WLFC_BORROW_DEFER_PERIOD_MS) {
+                               /* wait enough time, can borrow now */
+                               ctx->allow_credit_borrow = 1;
+                               ac = single_ac - 1;
+                       } else {
+                               rc = BCME_OK;
+                               goto exit;
+                       }
+               }
+       } else {
+               /* If we have multiple AC traffic, turn off borrowing, mark time and bail out */
+               ctx->allow_credit_borrow = 0;
+               ctx->single_ac_timestamp = 0;
+               ctx->single_ac = 0;
+               rc = BCME_OK;
+               goto exit;
+       }
+
+       if (packets_map == 0) {
+               /* nothing to send, skip borrow */
+               rc = BCME_OK;
+               goto exit;
+       }
+
+       /* At this point, borrow all credits only for ac */
+       while (FALSE == dhdp->proptxstatus_txoff) {
+#ifdef LIMIT_BORROW
+               if ((lender = _dhd_wlfc_borrow_credit(ctx, AC_COUNT, ac, TRUE)) == -1) {
+                       break;
+               }
+#endif
+               commit_info.p = _dhd_wlfc_deque_delayedq(ctx, ac,
+                       &(commit_info.ac_fifo_credit_spent),
+                       &(commit_info.needs_hdr),
+                       &(commit_info.mac_entry),
+                       FALSE);
+               if (commit_info.p == NULL) {
+                       /* before borrow only one ac exists and now this only ac is empty */
+#ifdef LIMIT_BORROW
+                       _dhd_wlfc_return_credit(ctx, lender, ac);
+#endif
+                       break;
+               }
+
+               commit_info.pkt_type = (commit_info.needs_hdr) ? eWLFC_PKTTYPE_DELAYED :
+                       eWLFC_PKTTYPE_SUPPRESSED;
+
+               rc = _dhd_wlfc_handle_packet_commit(ctx, ac, &commit_info,
+                    ctx->fcommit, ctx->commit_ctx);
+
+               /* Bus commits may fail (e.g. flow control); abort after retries */
+               if (rc == BCME_OK) {
+                       pkt_send++;
+                       if (commit_info.ac_fifo_credit_spent) {
+#ifndef LIMIT_BORROW
+                               ctx->FIFO_credit[ac]--;
+#endif
+                       } else {
+#ifdef LIMIT_BORROW
+                               _dhd_wlfc_return_credit(ctx, lender, ac);
+#endif
+                       }
+               } else {
+#ifdef LIMIT_BORROW
+                       _dhd_wlfc_return_credit(ctx, lender, ac);
+#endif
+                       bus_retry_count++;
+                       if (bus_retry_count >= BUS_RETRIES) {
+                               DHD_ERROR(("%s: bus error %d\n", __FUNCTION__, rc));
+                               goto exit;
+                       }
+               }
+       }
+
+       BCM_REFERENCE(pkt_send);
+
+exit:
+#if defined(DHD_WLFC_THREAD)
+               dhd_os_wlfc_unblock(dhdp);
+               if (ctx && ctx->pkt_cnt_in_psq && pkt_send) {
+                       wait_msec = msecs_to_jiffies(WLFC_THREAD_QUICK_RETRY_WAIT_MS);
+               } else {
+                       wait_msec = msecs_to_jiffies(WLFC_THREAD_RETRY_WAIT_MS);
+               }
+       }
+       return 0;
+#else
+       return rc;
+#endif /* defined(DHD_WLFC_THREAD) */
+}
+
+/**
+ * Enqueues a transmit packet in the next layer towards the dongle, eg the DBUS layer. Called by
+ * eg dhd_sendpkt().
+ *     @param[in] dhdp                  Pointer to public DHD structure
+ *     @param[in] fcommit               Pointer to transmit function of next layer
+ *     @param[in] commit_ctx            Opaque context used when calling next layer
+ *     @param[in] pktbuf                Packet to send
+ *     @param[in] need_toggle_host_if   If TRUE, resets flag ctx->toggle_host_if
+ */
+int
+dhd_wlfc_commit_packets(dhd_pub_t *dhdp, f_commitpkt_t fcommit, void* commit_ctx, void *pktbuf,
+       bool need_toggle_host_if)
+{
+       int rc = BCME_OK;
+       athost_wl_status_info_t* ctx;
+
+#if defined(DHD_WLFC_THREAD)
+       if (!pktbuf)
+               return BCME_OK;
+#endif /* defined(DHD_WLFC_THREAD) */
+
+       if ((dhdp == NULL) || (fcommit == NULL)) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhdp);
+
+       if (!dhdp->wlfc_state || (dhdp->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+               if (pktbuf) {
+                       DHD_PKTTAG_WLFCPKT_SET(PKTTAG(pktbuf), 0);
+               }
+               rc =  WLFC_UNSUPPORTED;
+               goto exit;
+       }
+
+       ctx = (athost_wl_status_info_t*)dhdp->wlfc_state;
+
+
+       if (dhdp->proptxstatus_module_ignore) {
+               if (pktbuf) {
+                       uint32 htod = 0;
+                       WL_TXSTATUS_SET_FLAGS(htod, WLFC_PKTFLAG_PKTFROMHOST);
+                       _dhd_wlfc_pushheader(ctx, &pktbuf, FALSE, 0, 0, htod, 0, FALSE);
+                       if (fcommit(commit_ctx, pktbuf)) {
+                               /* free it if failed, otherwise do it in tx complete cb */
+                               PKTFREE(ctx->osh, pktbuf, TRUE);
+                       }
+                       rc = BCME_OK;
+               }
+               goto exit;
+       }
+
+       if (pktbuf) {
+               int ac = DHD_PKTTAG_FIFO(PKTTAG(pktbuf));
+               ASSERT(ac <= AC_COUNT);
+               DHD_PKTTAG_WLFCPKT_SET(PKTTAG(pktbuf), 1);
+               /* en-queue the packets to respective queue. */
+               rc = _dhd_wlfc_enque_delayq(ctx, pktbuf, ac);
+               if (rc) {
+                       _dhd_wlfc_prec_drop(ctx->dhdp, (ac << 1), pktbuf, FALSE);
+               } else {
+                       ctx->stats.pktin++;
+                       ctx->pkt_cnt_in_drv[DHD_PKTTAG_IF(PKTTAG(pktbuf))][ac]++;
+               }
+       }
+
+       if (!ctx->fcommit) {
+               ctx->fcommit = fcommit;
+       } else {
+               ASSERT(ctx->fcommit == fcommit);
+       }
+       if (!ctx->commit_ctx) {
+               ctx->commit_ctx = commit_ctx;
+       } else {
+               ASSERT(ctx->commit_ctx == commit_ctx);
+       }
+
+#if defined(DHD_WLFC_THREAD)
+       _dhd_wlfc_thread_wakeup(dhdp);
+#else
+       dhd_wlfc_transfer_packets(dhdp);
+#endif /* defined(DHD_WLFC_THREAD) */
+
+exit:
+       dhd_os_wlfc_unblock(dhdp);
+       return rc;
+} /* dhd_wlfc_commit_packets */
+
+/**
+ * Called when the (lower) DBUS layer indicates completion (succesfull or not) of a transmit packet
+ */
+int
+dhd_wlfc_txcomplete(dhd_pub_t *dhd, void *txp, bool success)
+{
+       athost_wl_status_info_t* wlfc;
+       wlfc_mac_descriptor_t *entry;
+       void* pout = NULL;
+       int rtn = BCME_OK;
+       if ((dhd == NULL) || (txp == NULL)) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       bcm_pkt_validate_chk(txp);
+
+       dhd_os_wlfc_block(dhd);
+
+       if (!dhd->wlfc_state || (dhd->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+               rtn = WLFC_UNSUPPORTED;
+               goto EXIT;
+       }
+
+       wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+       if (DHD_PKTTAG_SIGNALONLY(PKTTAG(txp))) {
+#ifdef PROP_TXSTATUS_DEBUG
+               wlfc->stats.signal_only_pkts_freed++;
+#endif
+               /* is this a signal-only packet? */
+               _dhd_wlfc_pullheader(wlfc, txp);
+               PKTFREE(wlfc->osh, txp, TRUE);
+               goto EXIT;
+       }
+
+       entry = _dhd_wlfc_find_table_entry(wlfc, txp);
+       ASSERT(entry);
+
+       if (!success || dhd->proptxstatus_txstatus_ignore) {
+               WLFC_DBGMESG(("At: %s():%d, bus_complete() failure for %p, htod_tag:0x%08x\n",
+                       __FUNCTION__, __LINE__, txp, DHD_PKTTAG_H2DTAG(PKTTAG(txp))));
+               if (!WLFC_GET_AFQ(dhd->wlfc_mode)) {
+                       _dhd_wlfc_hanger_poppkt(wlfc->hanger, WL_TXSTATUS_GET_HSLOT(
+                               DHD_PKTTAG_H2DTAG(PKTTAG(txp))), &pout, TRUE);
+                       ASSERT(txp == pout);
+               }
+
+               /* indicate failure and free the packet */
+               dhd_txcomplete(dhd, txp, success);
+
+               /* return the credit, if necessary */
+               _dhd_wlfc_return_implied_credit(wlfc, txp);
+
+               if (entry->transit_count)
+                       entry->transit_count--;
+               if (entry->suppr_transit_count)
+                       entry->suppr_transit_count--;
+               wlfc->pkt_cnt_in_drv[DHD_PKTTAG_IF(PKTTAG(txp))][DHD_PKTTAG_FIFO(PKTTAG(txp))]--;
+               wlfc->stats.pktout++;
+               PKTFREE(wlfc->osh, txp, TRUE);
+       } else {
+               /* bus confirmed pkt went to firmware side */
+               if (WLFC_GET_AFQ(dhd->wlfc_mode)) {
+                       _dhd_wlfc_enque_afq(wlfc, txp);
+               } else {
+                       int hslot = WL_TXSTATUS_GET_HSLOT(DHD_PKTTAG_H2DTAG(PKTTAG(txp)));
+                       _dhd_wlfc_hanger_free_pkt(wlfc, hslot,
+                               WLFC_HANGER_PKT_STATE_BUSRETURNED, -1);
+               }
+       }
+
+       ASSERT(entry->onbus_pkts_count > 0);
+       if (entry->onbus_pkts_count > 0)
+               entry->onbus_pkts_count--;
+       if (entry->suppressed &&
+               (!entry->onbus_pkts_count) &&
+               (!entry->suppr_transit_count))
+               entry->suppressed = FALSE;
+EXIT:
+       dhd_os_wlfc_unblock(dhd);
+       return rtn;
+} /* dhd_wlfc_txcomplete */
+
+int
+dhd_wlfc_init(dhd_pub_t *dhd)
+{
+       /* enable all signals & indicate host proptxstatus logic is active */
+       uint32 tlv, mode, fw_caps;
+       int ret = 0;
+
+       if (dhd == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+       if (dhd->wlfc_enabled) {
+               DHD_INFO(("%s():%d, Already enabled!\n", __FUNCTION__, __LINE__));
+               dhd_os_wlfc_unblock(dhd);
+               return BCME_OK;
+       }
+       dhd->wlfc_enabled = TRUE;
+       dhd_os_wlfc_unblock(dhd);
+
+       tlv = WLFC_FLAGS_RSSI_SIGNALS |
+               WLFC_FLAGS_XONXOFF_SIGNALS |
+               WLFC_FLAGS_CREDIT_STATUS_SIGNALS |
+               WLFC_FLAGS_HOST_PROPTXSTATUS_ACTIVE |
+               WLFC_FLAGS_HOST_RXRERODER_ACTIVE;
+
+
+       /*
+       try to enable/disable signaling by sending "tlv" iovar. if that fails,
+       fallback to no flow control? Print a message for now.
+       */
+
+       /* enable proptxtstatus signaling by default */
+       if (!dhd_wl_ioctl_set_intiovar(dhd, "tlv", tlv, WLC_SET_VAR, TRUE, 0)) {
+               /*
+               Leaving the message for now, it should be removed after a while; once
+               the tlv situation is stable.
+               */
+               DHD_INFO(("dhd_wlfc_init(): successfully %s bdcv2 tlv signaling, %d\n",
+                       dhd->wlfc_enabled?"enabled":"disabled", tlv));
+       }
+
+       mode = 0;
+
+       /* query caps */
+       ret = dhd_wl_ioctl_get_intiovar(dhd, "wlfc_mode", &fw_caps, WLC_GET_VAR, FALSE, 0);
+
+       if (!ret) {
+               DHD_INFO(("%s: query wlfc_mode succeed, fw_caps=0x%x\n", __FUNCTION__, fw_caps));
+
+               if (WLFC_IS_OLD_DEF(fw_caps)) {
+                       /* enable proptxtstatus v2 by default */
+                       mode = WLFC_MODE_AFQ;
+               } else {
+                       WLFC_SET_AFQ(mode, WLFC_GET_AFQ(fw_caps));
+                       WLFC_SET_REUSESEQ(mode, WLFC_GET_REUSESEQ(fw_caps));
+                       WLFC_SET_REORDERSUPP(mode, WLFC_GET_REORDERSUPP(fw_caps));
+               }
+               ret = dhd_wl_ioctl_set_intiovar(dhd, "wlfc_mode", mode, WLC_SET_VAR, TRUE, 0);
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       dhd->wlfc_mode = 0;
+       if (ret >= 0) {
+               if (WLFC_IS_OLD_DEF(mode)) {
+                       WLFC_SET_AFQ(dhd->wlfc_mode, (mode == WLFC_MODE_AFQ));
+               } else {
+                       dhd->wlfc_mode = mode;
+               }
+       }
+
+       DHD_INFO(("dhd_wlfc_init(): wlfc_mode=0x%x, ret=%d\n", dhd->wlfc_mode, ret));
+
+       dhd_os_wlfc_unblock(dhd);
+
+       if (dhd->plat_init)
+               dhd->plat_init((void *)dhd);
+
+       return BCME_OK;
+} /* dhd_wlfc_init */
+
+/** AMPDU host reorder specific function */
+int
+dhd_wlfc_hostreorder_init(dhd_pub_t *dhd)
+{
+       /* enable only ampdu hostreorder here */
+       uint32 tlv;
+
+       if (dhd == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       DHD_TRACE(("%s():%d Enter\n", __FUNCTION__, __LINE__));
+
+       tlv = WLFC_FLAGS_HOST_RXRERODER_ACTIVE;
+
+       /* enable proptxtstatus signaling by default */
+       if (dhd_wl_ioctl_set_intiovar(dhd, "tlv", tlv, WLC_SET_VAR, TRUE, 0)) {
+               DHD_ERROR(("%s(): failed to enable/disable bdcv2 tlv signaling\n",
+                       __FUNCTION__));
+       } else {
+               /*
+               Leaving the message for now, it should be removed after a while; once
+               the tlv situation is stable.
+               */
+               DHD_ERROR(("%s(): successful bdcv2 tlv signaling, %d\n",
+                       __FUNCTION__, tlv));
+       }
+
+       dhd_os_wlfc_block(dhd);
+       dhd->proptxstatus_mode = WLFC_ONLY_AMPDU_HOSTREORDER;
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+int
+dhd_wlfc_cleanup_txq(dhd_pub_t *dhd, f_processpkt_t fn, void *arg)
+{
+       if (dhd == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       if (!dhd->wlfc_state || (dhd->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+               dhd_os_wlfc_unblock(dhd);
+               return WLFC_UNSUPPORTED;
+       }
+
+       _dhd_wlfc_cleanup_txq(dhd, fn, arg);
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+/** release all packet resources */
+int
+dhd_wlfc_cleanup(dhd_pub_t *dhd, f_processpkt_t fn, void *arg)
+{
+       if (dhd == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       if (!dhd->wlfc_state || (dhd->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+               dhd_os_wlfc_unblock(dhd);
+               return WLFC_UNSUPPORTED;
+       }
+
+       _dhd_wlfc_cleanup(dhd, fn, arg);
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+int
+dhd_wlfc_deinit(dhd_pub_t *dhd)
+{
+       /* cleanup all psq related resources */
+       athost_wl_status_info_t* wlfc;
+       uint32 tlv = 0;
+       uint32 hostreorder = 0;
+
+       if (dhd == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+       if (!dhd->wlfc_enabled) {
+               DHD_ERROR(("%s():%d, Already disabled!\n", __FUNCTION__, __LINE__));
+               dhd_os_wlfc_unblock(dhd);
+               return BCME_OK;
+       }
+
+       dhd->wlfc_enabled = FALSE;
+       dhd_os_wlfc_unblock(dhd);
+
+       /* query ampdu hostreorder */
+       (void) dhd_wl_ioctl_get_intiovar(dhd, "ampdu_hostreorder",
+               &hostreorder, WLC_GET_VAR, FALSE, 0);
+
+       if (hostreorder) {
+               tlv = WLFC_FLAGS_HOST_RXRERODER_ACTIVE;
+               DHD_ERROR(("%s():%d, maintain HOST RXRERODER flag in tvl\n",
+                       __FUNCTION__, __LINE__));
+       }
+
+       /* Disable proptxtstatus signaling for deinit */
+       (void) dhd_wl_ioctl_set_intiovar(dhd, "tlv", tlv, WLC_SET_VAR, TRUE, 0);
+
+       dhd_os_wlfc_block(dhd);
+
+       if (!dhd->wlfc_state || (dhd->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+               dhd_os_wlfc_unblock(dhd);
+               return WLFC_UNSUPPORTED;
+       }
+
+       wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+
+       _dhd_wlfc_cleanup(dhd, NULL, NULL);
+
+       if (!WLFC_GET_AFQ(dhd->wlfc_mode)) {
+               int i;
+               wlfc_hanger_t* h = (wlfc_hanger_t*)wlfc->hanger;
+               for (i = 0; i < h->max_items; i++) {
+                       if (h->items[i].state != WLFC_HANGER_ITEM_STATE_FREE) {
+                               _dhd_wlfc_hanger_free_pkt(wlfc, i,
+                                       WLFC_HANGER_PKT_STATE_COMPLETE, TRUE);
+                       }
+               }
+
+               /* delete hanger */
+               _dhd_wlfc_hanger_delete(dhd, h);
+       }
+
+
+       /* free top structure */
+       DHD_OS_PREFREE(dhd, dhd->wlfc_state,
+               sizeof(athost_wl_status_info_t));
+       dhd->wlfc_state = NULL;
+       dhd->proptxstatus_mode = hostreorder ?
+               WLFC_ONLY_AMPDU_HOSTREORDER : WLFC_FCMODE_NONE;
+
+       dhd_os_wlfc_unblock(dhd);
+
+       if (dhd->plat_deinit)
+               dhd->plat_deinit((void *)dhd);
+       return BCME_OK;
+} /* dhd_wlfc_init */
+
+/**
+ * Called on an interface event (WLC_E_IF) indicated by firmware
+ *     @param[in] dhdp   Pointer to public DHD structure
+ *     @param[in] action eg eWLFC_MAC_ENTRY_ACTION_UPDATE or eWLFC_MAC_ENTRY_ACTION_ADD
+ */
+int dhd_wlfc_interface_event(dhd_pub_t *dhdp, uint8 action, uint8 ifid, uint8 iftype, uint8* ea)
+{
+       int rc;
+
+       if (dhdp == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhdp);
+
+       if (!dhdp->wlfc_state || (dhdp->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+               dhd_os_wlfc_unblock(dhdp);
+               return WLFC_UNSUPPORTED;
+       }
+
+       rc = _dhd_wlfc_interface_entry_update(dhdp->wlfc_state, action, ifid, iftype, ea);
+
+       dhd_os_wlfc_unblock(dhdp);
+       return rc;
+}
+
+/** Called eg on receiving a WLC_E_FIFO_CREDIT_MAP event from the dongle */
+int dhd_wlfc_FIFOcreditmap_event(dhd_pub_t *dhdp, uint8* event_data)
+{
+       int rc;
+
+       if (dhdp == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhdp);
+
+       if (!dhdp->wlfc_state || (dhdp->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+               dhd_os_wlfc_unblock(dhdp);
+               return WLFC_UNSUPPORTED;
+       }
+
+       rc = _dhd_wlfc_FIFOcreditmap_update(dhdp->wlfc_state, event_data);
+
+       dhd_os_wlfc_unblock(dhdp);
+
+       return rc;
+}
+
+/**
+ * Called eg on receiving a WLC_E_BCMC_CREDIT_SUPPORT event from the dongle (broadcast/multicast
+ * specific)
+ */
+int dhd_wlfc_BCMCCredit_support_event(dhd_pub_t *dhdp)
+{
+       int rc;
+
+       if (dhdp == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhdp);
+
+       if (!dhdp->wlfc_state || (dhdp->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+               dhd_os_wlfc_unblock(dhdp);
+               return WLFC_UNSUPPORTED;
+       }
+
+       rc = _dhd_wlfc_BCMCCredit_support_update(dhdp->wlfc_state);
+
+       dhd_os_wlfc_unblock(dhdp);
+       return rc;
+}
+
+/** debug specific function */
+int
+dhd_wlfc_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf)
+{
+       int i;
+       uint8* ea;
+       athost_wl_status_info_t* wlfc;
+       wlfc_hanger_t* h;
+       wlfc_mac_descriptor_t* mac_table;
+       wlfc_mac_descriptor_t* interfaces;
+       char* iftypes[] = {"STA", "AP", "WDS", "p2pGO", "p2pCL"};
+
+       if (!dhdp || !strbuf) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhdp);
+
+       if (!dhdp->wlfc_state || (dhdp->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+               dhd_os_wlfc_unblock(dhdp);
+               return WLFC_UNSUPPORTED;
+       }
+
+       wlfc = (athost_wl_status_info_t*)dhdp->wlfc_state;
+
+       h = (wlfc_hanger_t*)wlfc->hanger;
+       if (h == NULL) {
+               bcm_bprintf(strbuf, "wlfc-hanger not initialized yet\n");
+       }
+
+       mac_table = wlfc->destination_entries.nodes;
+       interfaces = wlfc->destination_entries.interfaces;
+       bcm_bprintf(strbuf, "---- wlfc stats ----\n");
+
+       if (!WLFC_GET_AFQ(dhdp->wlfc_mode)) {
+               h = (wlfc_hanger_t*)wlfc->hanger;
+               if (h == NULL) {
+                       bcm_bprintf(strbuf, "wlfc-hanger not initialized yet\n");
+               } else {
+                       bcm_bprintf(strbuf, "wlfc hanger (pushed,popped,f_push,"
+                               "f_pop,f_slot, pending) = (%d,%d,%d,%d,%d,%d)\n",
+                               h->pushed,
+                               h->popped,
+                               h->failed_to_push,
+                               h->failed_to_pop,
+                               h->failed_slotfind,
+                               (h->pushed - h->popped));
+               }
+       }
+
+       bcm_bprintf(strbuf, "wlfc fail(tlv,credit_rqst,mac_update,psmode_update), "
+               "(dq_full,rollback_fail) = (%d,%d,%d,%d), (%d,%d)\n",
+               wlfc->stats.tlv_parse_failed,
+               wlfc->stats.credit_request_failed,
+               wlfc->stats.mac_update_failed,
+               wlfc->stats.psmode_update_failed,
+               wlfc->stats.delayq_full_error,
+               wlfc->stats.rollback_failed);
+
+       bcm_bprintf(strbuf, "PKTS (init_credit,credit,sent,drop_d,drop_s,outoforder) "
+               "(AC0[%d,%d,%d,%d,%d,%d],AC1[%d,%d,%d,%d,%d,%d],AC2[%d,%d,%d,%d,%d,%d],"
+               "AC3[%d,%d,%d,%d,%d,%d],BC_MC[%d,%d,%d,%d,%d,%d])\n",
+               wlfc->Init_FIFO_credit[0], wlfc->FIFO_credit[0], wlfc->stats.send_pkts[0],
+               wlfc->stats.drop_pkts[0], wlfc->stats.drop_pkts[1], wlfc->stats.ooo_pkts[0],
+               wlfc->Init_FIFO_credit[1], wlfc->FIFO_credit[1], wlfc->stats.send_pkts[1],
+               wlfc->stats.drop_pkts[2], wlfc->stats.drop_pkts[3], wlfc->stats.ooo_pkts[1],
+               wlfc->Init_FIFO_credit[2], wlfc->FIFO_credit[2], wlfc->stats.send_pkts[2],
+               wlfc->stats.drop_pkts[4], wlfc->stats.drop_pkts[5], wlfc->stats.ooo_pkts[2],
+               wlfc->Init_FIFO_credit[3], wlfc->FIFO_credit[3], wlfc->stats.send_pkts[3],
+               wlfc->stats.drop_pkts[6], wlfc->stats.drop_pkts[7], wlfc->stats.ooo_pkts[3],
+               wlfc->Init_FIFO_credit[4], wlfc->FIFO_credit[4], wlfc->stats.send_pkts[4],
+               wlfc->stats.drop_pkts[8], wlfc->stats.drop_pkts[9], wlfc->stats.ooo_pkts[4]);
+
+       bcm_bprintf(strbuf, "\n");
+       for (i = 0; i < WLFC_MAX_IFNUM; i++) {
+               if (interfaces[i].occupied) {
+                       char* iftype_desc;
+
+                       if (interfaces[i].iftype > WLC_E_IF_ROLE_P2P_CLIENT)
+                               iftype_desc = "<Unknown";
+                       else
+                               iftype_desc = iftypes[interfaces[i].iftype];
+
+                       ea = interfaces[i].ea;
+                       bcm_bprintf(strbuf, "INTERFACE[%d].ea = "
+                               "[%02x:%02x:%02x:%02x:%02x:%02x], if:%d, type: %s "
+                               "netif_flow_control:%s\n", i,
+                               ea[0], ea[1], ea[2], ea[3], ea[4], ea[5],
+                               interfaces[i].interface_id,
+                               iftype_desc, ((wlfc->hostif_flow_state[i] == OFF)
+                               ? " OFF":" ON"));
+
+                       bcm_bprintf(strbuf, "INTERFACE[%d].PSQ(len,state,credit),"
+                               "(trans,supp_trans,onbus)"
+                               "= (%d,%s,%d),(%d,%d,%d)\n",
+                               i,
+                               interfaces[i].psq.len,
+                               ((interfaces[i].state ==
+                               WLFC_STATE_OPEN) ? "OPEN":"CLOSE"),
+                               interfaces[i].requested_credit,
+                               interfaces[i].transit_count,
+                               interfaces[i].suppr_transit_count,
+                               interfaces[i].onbus_pkts_count);
+
+                       bcm_bprintf(strbuf, "INTERFACE[%d].PSQ"
+                               "(delay0,sup0,afq0),(delay1,sup1,afq1),(delay2,sup2,afq2),"
+                               "(delay3,sup3,afq3),(delay4,sup4,afq4) = (%d,%d,%d),"
+                               "(%d,%d,%d),(%d,%d,%d),(%d,%d,%d),(%d,%d,%d)\n",
+                               i,
+                               interfaces[i].psq.q[0].len,
+                               interfaces[i].psq.q[1].len,
+                               interfaces[i].afq.q[0].len,
+                               interfaces[i].psq.q[2].len,
+                               interfaces[i].psq.q[3].len,
+                               interfaces[i].afq.q[1].len,
+                               interfaces[i].psq.q[4].len,
+                               interfaces[i].psq.q[5].len,
+                               interfaces[i].afq.q[2].len,
+                               interfaces[i].psq.q[6].len,
+                               interfaces[i].psq.q[7].len,
+                               interfaces[i].afq.q[3].len,
+                               interfaces[i].psq.q[8].len,
+                               interfaces[i].psq.q[9].len,
+                               interfaces[i].afq.q[4].len);
+               }
+       }
+
+       bcm_bprintf(strbuf, "\n");
+       for (i = 0; i < WLFC_MAC_DESC_TABLE_SIZE; i++) {
+               if (mac_table[i].occupied) {
+                       ea = mac_table[i].ea;
+                       bcm_bprintf(strbuf, "MAC_table[%d].ea = "
+                               "[%02x:%02x:%02x:%02x:%02x:%02x], if:%d \n", i,
+                               ea[0], ea[1], ea[2], ea[3], ea[4], ea[5],
+                               mac_table[i].interface_id);
+
+                       bcm_bprintf(strbuf, "MAC_table[%d].PSQ(len,state,credit),"
+                               "(trans,supp_trans,onbus)"
+                               "= (%d,%s,%d),(%d,%d,%d)\n",
+                               i,
+                               mac_table[i].psq.len,
+                               ((mac_table[i].state ==
+                               WLFC_STATE_OPEN) ? " OPEN":"CLOSE"),
+                               mac_table[i].requested_credit,
+                               mac_table[i].transit_count,
+                               mac_table[i].suppr_transit_count,
+                               mac_table[i].onbus_pkts_count);
+#ifdef PROP_TXSTATUS_DEBUG
+                       bcm_bprintf(strbuf, "MAC_table[%d]: (opened, closed) = (%d, %d)\n",
+                               i, mac_table[i].opened_ct, mac_table[i].closed_ct);
+#endif
+                       bcm_bprintf(strbuf, "MAC_table[%d].PSQ"
+                               "(delay0,sup0,afq0),(delay1,sup1,afq1),(delay2,sup2,afq2),"
+                               "(delay3,sup3,afq3),(delay4,sup4,afq4) =(%d,%d,%d),"
+                               "(%d,%d,%d),(%d,%d,%d),(%d,%d,%d),(%d,%d,%d)\n",
+                               i,
+                               mac_table[i].psq.q[0].len,
+                               mac_table[i].psq.q[1].len,
+                               mac_table[i].afq.q[0].len,
+                               mac_table[i].psq.q[2].len,
+                               mac_table[i].psq.q[3].len,
+                               mac_table[i].afq.q[1].len,
+                               mac_table[i].psq.q[4].len,
+                               mac_table[i].psq.q[5].len,
+                               mac_table[i].afq.q[2].len,
+                               mac_table[i].psq.q[6].len,
+                               mac_table[i].psq.q[7].len,
+                               mac_table[i].afq.q[3].len,
+                               mac_table[i].psq.q[8].len,
+                               mac_table[i].psq.q[9].len,
+                               mac_table[i].afq.q[4].len);
+
+               }
+       }
+
+#ifdef PROP_TXSTATUS_DEBUG
+       {
+               int avg;
+               int moving_avg = 0;
+               int moving_samples;
+
+               if (wlfc->stats.latency_sample_count) {
+                       moving_samples = sizeof(wlfc->stats.deltas)/sizeof(uint32);
+
+                       for (i = 0; i < moving_samples; i++)
+                               moving_avg += wlfc->stats.deltas[i];
+                       moving_avg /= moving_samples;
+
+                       avg = (100 * wlfc->stats.total_status_latency) /
+                               wlfc->stats.latency_sample_count;
+                       bcm_bprintf(strbuf, "txstatus latency (average, last, moving[%d]) = "
+                               "(%d.%d, %03d, %03d)\n",
+                               moving_samples, avg/100, (avg - (avg/100)*100),
+                               wlfc->stats.latency_most_recent,
+                               moving_avg);
+               }
+       }
+
+       bcm_bprintf(strbuf, "wlfc- fifo[0-5] credit stats: sent = (%d,%d,%d,%d,%d,%d), "
+               "back = (%d,%d,%d,%d,%d,%d)\n",
+               wlfc->stats.fifo_credits_sent[0],
+               wlfc->stats.fifo_credits_sent[1],
+               wlfc->stats.fifo_credits_sent[2],
+               wlfc->stats.fifo_credits_sent[3],
+               wlfc->stats.fifo_credits_sent[4],
+               wlfc->stats.fifo_credits_sent[5],
+
+               wlfc->stats.fifo_credits_back[0],
+               wlfc->stats.fifo_credits_back[1],
+               wlfc->stats.fifo_credits_back[2],
+               wlfc->stats.fifo_credits_back[3],
+               wlfc->stats.fifo_credits_back[4],
+               wlfc->stats.fifo_credits_back[5]);
+       {
+               uint32 fifo_cr_sent = 0;
+               uint32 fifo_cr_acked = 0;
+               uint32 request_cr_sent = 0;
+               uint32 request_cr_ack = 0;
+               uint32 bc_mc_cr_ack = 0;
+
+               for (i = 0; i < sizeof(wlfc->stats.fifo_credits_sent)/sizeof(uint32); i++) {
+                       fifo_cr_sent += wlfc->stats.fifo_credits_sent[i];
+               }
+
+               for (i = 0; i < sizeof(wlfc->stats.fifo_credits_back)/sizeof(uint32); i++) {
+                       fifo_cr_acked += wlfc->stats.fifo_credits_back[i];
+               }
+
+               for (i = 0; i < WLFC_MAC_DESC_TABLE_SIZE; i++) {
+                       if (wlfc->destination_entries.nodes[i].occupied) {
+                               request_cr_sent +=
+                                       wlfc->destination_entries.nodes[i].dstncredit_sent_packets;
+                       }
+               }
+               for (i = 0; i < WLFC_MAX_IFNUM; i++) {
+                       if (wlfc->destination_entries.interfaces[i].occupied) {
+                               request_cr_sent +=
+                               wlfc->destination_entries.interfaces[i].dstncredit_sent_packets;
+                       }
+               }
+               for (i = 0; i < WLFC_MAC_DESC_TABLE_SIZE; i++) {
+                       if (wlfc->destination_entries.nodes[i].occupied) {
+                               request_cr_ack +=
+                                       wlfc->destination_entries.nodes[i].dstncredit_acks;
+                       }
+               }
+               for (i = 0; i < WLFC_MAX_IFNUM; i++) {
+                       if (wlfc->destination_entries.interfaces[i].occupied) {
+                               request_cr_ack +=
+                                       wlfc->destination_entries.interfaces[i].dstncredit_acks;
+                       }
+               }
+               bcm_bprintf(strbuf, "wlfc- (sent, status) => pq(%d,%d), vq(%d,%d),"
+                       "other:%d, bc_mc:%d, signal-only, (sent,freed): (%d,%d)",
+                       fifo_cr_sent, fifo_cr_acked,
+                       request_cr_sent, request_cr_ack,
+                       wlfc->destination_entries.other.dstncredit_acks,
+                       bc_mc_cr_ack,
+                       wlfc->stats.signal_only_pkts_sent, wlfc->stats.signal_only_pkts_freed);
+       }
+#endif /* PROP_TXSTATUS_DEBUG */
+       bcm_bprintf(strbuf, "\n");
+       bcm_bprintf(strbuf, "wlfc- pkt((in,2bus,txstats,hdrpull,out),(dropped,hdr_only,wlc_tossed)"
+               "(freed,free_err,rollback)) = "
+               "((%d,%d,%d,%d,%d),(%d,%d,%d),(%d,%d,%d))\n",
+               wlfc->stats.pktin,
+               wlfc->stats.pkt2bus,
+               wlfc->stats.txstatus_in,
+               wlfc->stats.dhd_hdrpulls,
+               wlfc->stats.pktout,
+
+               wlfc->stats.pktdropped,
+               wlfc->stats.wlfc_header_only_pkt,
+               wlfc->stats.wlc_tossed_pkts,
+
+               wlfc->stats.pkt_freed,
+               wlfc->stats.pkt_free_err, wlfc->stats.rollback);
+
+       bcm_bprintf(strbuf, "wlfc- suppress((d11,wlc,err),enq(d11,wl,hq,mac?),retx(d11,wlc,hq)) = "
+               "((%d,%d,%d),(%d,%d,%d,%d),(%d,%d,%d))\n",
+               wlfc->stats.d11_suppress,
+               wlfc->stats.wl_suppress,
+               wlfc->stats.bad_suppress,
+
+               wlfc->stats.psq_d11sup_enq,
+               wlfc->stats.psq_wlsup_enq,
+               wlfc->stats.psq_hostq_enq,
+               wlfc->stats.mac_handle_notfound,
+
+               wlfc->stats.psq_d11sup_retx,
+               wlfc->stats.psq_wlsup_retx,
+               wlfc->stats.psq_hostq_retx);
+
+       bcm_bprintf(strbuf, "wlfc- cleanup(txq,psq,fw) = (%d,%d,%d)\n",
+               wlfc->stats.cleanup_txq_cnt,
+               wlfc->stats.cleanup_psq_cnt,
+               wlfc->stats.cleanup_fw_cnt);
+
+       bcm_bprintf(strbuf, "wlfc- generic error: %d\n", wlfc->stats.generic_error);
+
+       for (i = 0; i < WLFC_MAX_IFNUM; i++) {
+               bcm_bprintf(strbuf, "wlfc- if[%d], pkt_cnt_in_q/AC[0-4] = (%d,%d,%d,%d,%d)\n", i,
+                       wlfc->pkt_cnt_in_q[i][0],
+                       wlfc->pkt_cnt_in_q[i][1],
+                       wlfc->pkt_cnt_in_q[i][2],
+                       wlfc->pkt_cnt_in_q[i][3],
+                       wlfc->pkt_cnt_in_q[i][4]);
+       }
+       bcm_bprintf(strbuf, "\n");
+
+       dhd_os_wlfc_unblock(dhdp);
+       return BCME_OK;
+} /* dhd_wlfc_dump */
+
+int dhd_wlfc_clear_counts(dhd_pub_t *dhd)
+{
+       athost_wl_status_info_t* wlfc;
+       wlfc_hanger_t* hanger;
+
+       if (dhd == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       if (!dhd->wlfc_state || (dhd->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+               dhd_os_wlfc_unblock(dhd);
+               return WLFC_UNSUPPORTED;
+       }
+
+       wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+
+       memset(&wlfc->stats, 0, sizeof(athost_wl_stat_counters_t));
+
+       if (!WLFC_GET_AFQ(dhd->wlfc_mode)) {
+               hanger = (wlfc_hanger_t*)wlfc->hanger;
+
+               hanger->pushed = 0;
+               hanger->popped = 0;
+               hanger->failed_slotfind = 0;
+               hanger->failed_to_pop = 0;
+               hanger->failed_to_push = 0;
+       }
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+/** returns TRUE if flow control is enabled */
+int dhd_wlfc_get_enable(dhd_pub_t *dhd, bool *val)
+{
+       if (!dhd || !val) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       *val = dhd->wlfc_enabled;
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+/** Called via an IOVAR */
+int dhd_wlfc_get_mode(dhd_pub_t *dhd, int *val)
+{
+       if (!dhd || !val) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       *val = dhd->wlfc_state ? dhd->proptxstatus_mode : 0;
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+/** Called via an IOVAR */
+int dhd_wlfc_set_mode(dhd_pub_t *dhd, int val)
+{
+       if (!dhd) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       if (dhd->wlfc_state) {
+               dhd->proptxstatus_mode = val & 0xff;
+       }
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+/** Called when rx frame is received from the dongle */
+bool dhd_wlfc_is_header_only_pkt(dhd_pub_t * dhd, void *pktbuf)
+{
+       athost_wl_status_info_t* wlfc;
+       bool rc = FALSE;
+
+       if (dhd == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return FALSE;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       if (!dhd->wlfc_state || (dhd->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+               dhd_os_wlfc_unblock(dhd);
+               return FALSE;
+       }
+
+       wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+
+       if (PKTLEN(wlfc->osh, pktbuf) == 0) {
+               wlfc->stats.wlfc_header_only_pkt++;
+               rc = TRUE;
+       }
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return rc;
+}
+
+int dhd_wlfc_flowcontrol(dhd_pub_t *dhdp, bool state, bool bAcquireLock)
+{
+       if (dhdp == NULL) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       if (bAcquireLock) {
+               dhd_os_wlfc_block(dhdp);
+       }
+
+       if (!dhdp->wlfc_state || (dhdp->proptxstatus_mode == WLFC_FCMODE_NONE) ||
+               dhdp->proptxstatus_module_ignore) {
+               if (bAcquireLock) {
+                       dhd_os_wlfc_unblock(dhdp);
+               }
+               return WLFC_UNSUPPORTED;
+       }
+
+       if (state != dhdp->proptxstatus_txoff) {
+               dhdp->proptxstatus_txoff = state;
+       }
+
+       if (bAcquireLock) {
+               dhd_os_wlfc_unblock(dhdp);
+       }
+
+#if defined(DHD_WLFC_THREAD)
+       _dhd_wlfc_thread_wakeup(dhd);
+#endif /* defined(DHD_WLFC_THREAD) */
+
+       return BCME_OK;
+}
+
+/** Called when eg an rx frame is received from the dongle */
+int dhd_wlfc_save_rxpath_ac_time(dhd_pub_t * dhd, uint8 prio)
+{
+       athost_wl_status_info_t* wlfc;
+       int rx_path_ac = -1;
+
+       if ((dhd == NULL) || (prio >= NUMPRIO)) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       if (!dhd->wlfc_rxpkt_chk) {
+               dhd_os_wlfc_unblock(dhd);
+               return BCME_OK;
+       }
+
+       if (!dhd->wlfc_state || (dhd->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+               dhd_os_wlfc_unblock(dhd);
+               return WLFC_UNSUPPORTED;
+       }
+
+       wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+
+       rx_path_ac = prio2fifo[prio];
+       wlfc->rx_timestamp[rx_path_ac] = OSL_SYSUPTIME();
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+/** called via an IOVAR */
+int dhd_wlfc_get_module_ignore(dhd_pub_t *dhd, int *val)
+{
+       if (!dhd || !val) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       *val = dhd->proptxstatus_module_ignore;
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+/** called via an IOVAR */
+int dhd_wlfc_set_module_ignore(dhd_pub_t *dhd, int val)
+{
+       uint32 tlv = 0;
+       bool bChanged = FALSE;
+
+       if (!dhd) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       if ((bool)val != dhd->proptxstatus_module_ignore) {
+               dhd->proptxstatus_module_ignore = (val != 0);
+               /* force txstatus_ignore sync with proptxstatus_module_ignore */
+               dhd->proptxstatus_txstatus_ignore = dhd->proptxstatus_module_ignore;
+               if (FALSE == dhd->proptxstatus_module_ignore) {
+                       tlv = WLFC_FLAGS_RSSI_SIGNALS |
+                               WLFC_FLAGS_XONXOFF_SIGNALS |
+                               WLFC_FLAGS_CREDIT_STATUS_SIGNALS |
+                               WLFC_FLAGS_HOST_PROPTXSTATUS_ACTIVE;
+               }
+               /* always enable host reorder */
+               tlv |= WLFC_FLAGS_HOST_RXRERODER_ACTIVE;
+               bChanged = TRUE;
+       }
+
+       dhd_os_wlfc_unblock(dhd);
+
+       if (bChanged) {
+               /* select enable proptxtstatus signaling */
+               if (dhd_wl_ioctl_set_intiovar(dhd, "tlv", tlv, WLC_SET_VAR, TRUE, 0)) {
+                       DHD_ERROR(("%s: failed to set bdcv2 tlv signaling to 0x%x\n",
+                               __FUNCTION__, tlv));
+               } else {
+                       DHD_ERROR(("%s: successfully set bdcv2 tlv signaling to 0x%x\n",
+                               __FUNCTION__, tlv));
+               }
+       }
+       return BCME_OK;
+}
+
+/** called via an IOVAR */
+int dhd_wlfc_get_credit_ignore(dhd_pub_t *dhd, int *val)
+{
+       if (!dhd || !val) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       *val = dhd->proptxstatus_credit_ignore;
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+/** called via an IOVAR */
+int dhd_wlfc_set_credit_ignore(dhd_pub_t *dhd, int val)
+{
+       if (!dhd) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       dhd->proptxstatus_credit_ignore = (val != 0);
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+/** called via an IOVAR */
+int dhd_wlfc_get_txstatus_ignore(dhd_pub_t *dhd, int *val)
+{
+       if (!dhd || !val) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       *val = dhd->proptxstatus_txstatus_ignore;
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+/** called via an IOVAR */
+int dhd_wlfc_set_txstatus_ignore(dhd_pub_t *dhd, int val)
+{
+       if (!dhd) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       dhd->proptxstatus_txstatus_ignore = (val != 0);
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+/** called via an IOVAR */
+int dhd_wlfc_get_rxpkt_chk(dhd_pub_t *dhd, int *val)
+{
+       if (!dhd || !val) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       *val = dhd->wlfc_rxpkt_chk;
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+/** called via an IOVAR */
+int dhd_wlfc_set_rxpkt_chk(dhd_pub_t *dhd, int val)
+{
+       if (!dhd) {
+               DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+               return BCME_BADARG;
+       }
+
+       dhd_os_wlfc_block(dhd);
+
+       dhd->wlfc_rxpkt_chk = (val != 0);
+
+       dhd_os_wlfc_unblock(dhd);
+
+       return BCME_OK;
+}
+
+#endif /* PROP_TXSTATUS */
diff --git a/drivers/net/wireless/bcmdhd_1363/dhd_wlfc.h b/drivers/net/wireless/bcmdhd_1363/dhd_wlfc.h
new file mode 100644 (file)
index 0000000..fca5543
--- /dev/null
@@ -0,0 +1,554 @@
+/*
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhd_wlfc.h 557035 2015-05-15 18:48:57Z $
+ *
+ */
+#ifndef __wlfc_host_driver_definitions_h__
+#define __wlfc_host_driver_definitions_h__
+
+
+/* #define OOO_DEBUG */
+
+#define KERNEL_THREAD_RETURN_TYPE int
+
+typedef int (*f_commitpkt_t)(void* ctx, void* p);
+typedef bool (*f_processpkt_t)(void* p, void* arg);
+
+#define WLFC_UNSUPPORTED -9999
+
+#define WLFC_NO_TRAFFIC        -1
+#define WLFC_MULTI_TRAFFIC 0
+
+#define BUS_RETRIES 1  /* # of retries before aborting a bus tx operation */
+
+/** 16 bits will provide an absolute max of 65536 slots */
+#define WLFC_HANGER_MAXITEMS 3072
+
+#define WLFC_HANGER_ITEM_STATE_FREE                    1
+#define WLFC_HANGER_ITEM_STATE_INUSE                   2
+#define WLFC_HANGER_ITEM_STATE_INUSE_SUPPRESSED                3
+#define WLFC_HANGER_ITEM_STATE_FLUSHED                 4
+
+#define WLFC_HANGER_PKT_STATE_TXSTATUS                 1
+#define WLFC_HANGER_PKT_STATE_BUSRETURNED              2
+#define WLFC_HANGER_PKT_STATE_COMPLETE                 \
+       (WLFC_HANGER_PKT_STATE_TXSTATUS | WLFC_HANGER_PKT_STATE_BUSRETURNED)
+
+typedef enum {
+       Q_TYPE_PSQ, /**< Power Save Queue, contains both delayed and suppressed packets */
+       Q_TYPE_AFQ  /**< At Firmware Queue */
+} q_type_t;
+
+typedef enum ewlfc_packet_state {
+       eWLFC_PKTTYPE_NEW,        /**< unused in the code (Jan 2015) */
+       eWLFC_PKTTYPE_DELAYED,    /**< packet did not enter wlfc yet */
+       eWLFC_PKTTYPE_SUPPRESSED, /**< packet entered wlfc and was suppressed by the dongle */
+       eWLFC_PKTTYPE_MAX
+} ewlfc_packet_state_t;
+
+typedef enum ewlfc_mac_entry_action {
+       eWLFC_MAC_ENTRY_ACTION_ADD,
+       eWLFC_MAC_ENTRY_ACTION_DEL,
+       eWLFC_MAC_ENTRY_ACTION_UPDATE,
+       eWLFC_MAC_ENTRY_ACTION_MAX
+} ewlfc_mac_entry_action_t;
+
+typedef struct wlfc_hanger_item {
+       uint8   state;
+       uint8   gen;
+       uint8   pkt_state;     /**< bitmask containing eg WLFC_HANGER_PKT_STATE_TXCOMPLETE */
+       uint8   pkt_txstatus;
+       uint32  identifier;
+       void*   pkt;
+#ifdef PROP_TXSTATUS_DEBUG
+       uint32  push_time;
+#endif
+       struct wlfc_hanger_item *next;
+} wlfc_hanger_item_t;
+
+/** hanger contains packets that have been posted by the dhd to the dongle and are expected back */
+typedef struct wlfc_hanger {
+       int max_items;
+       uint32 pushed;
+       uint32 popped;
+       uint32 failed_to_push;
+       uint32 failed_to_pop;
+       uint32 failed_slotfind;
+       uint32 slot_pos;
+       wlfc_hanger_item_t items[1];
+} wlfc_hanger_t;
+
+#define WLFC_HANGER_SIZE(n)    ((sizeof(wlfc_hanger_t) - \
+       sizeof(wlfc_hanger_item_t)) + ((n)*sizeof(wlfc_hanger_item_t)))
+
+#define WLFC_STATE_OPEN                1       /**< remote MAC is able to receive packets */
+#define WLFC_STATE_CLOSE       2       /**< remote MAC is in power save mode */
+
+#define WLFC_PSQ_PREC_COUNT            ((AC_COUNT + 1) * 2) /**< 2 for each AC traffic and bc/mc */
+#define WLFC_AFQ_PREC_COUNT            (AC_COUNT + 1)
+
+#define WLFC_PSQ_LEN                   2048
+
+#define WLFC_FLOWCONTROL_HIWATER       (2048 - 256)
+#define WLFC_FLOWCONTROL_LOWATER       256
+
+#if (WLFC_FLOWCONTROL_HIWATER >= (WLFC_PSQ_LEN - 256))
+#undef WLFC_FLOWCONTROL_HIWATER
+#define WLFC_FLOWCONTROL_HIWATER       (WLFC_PSQ_LEN - 256)
+#undef WLFC_FLOWCONTROL_LOWATER
+#define WLFC_FLOWCONTROL_LOWATER       (WLFC_FLOWCONTROL_HIWATER / 4)
+#endif
+
+#define WLFC_LOG_BUF_SIZE              (1024*1024)
+
+/** Properties related to a remote MAC entity */
+typedef struct wlfc_mac_descriptor {
+       uint8 occupied;         /**< if 0, this descriptor is unused and thus can be (re)used */
+       uint8 interface_id;
+       uint8 iftype;           /**< eg WLC_E_IF_ROLE_STA */
+       uint8 state;            /**< eg WLFC_STATE_OPEN */
+       uint8 ac_bitmap;        /**< automatic power save delivery (APSD) */
+       uint8 requested_credit;
+       uint8 requested_packet; /**< unit: [number of packets] */
+       uint8 ea[ETHER_ADDR_LEN];
+
+       /** maintain (MAC,AC) based seq count for packets going to the device. As well as bc/mc. */
+       uint8 seq[AC_COUNT + 1];
+       uint8 generation;       /**< toggles between 0 and 1 */
+       struct pktq     psq;    /**< contains both 'delayed' and 'suppressed' packets */
+       /** packets at firmware queue */
+       struct pktq     afq;
+       /** The AC pending bitmap that was reported to the fw at last change */
+       uint8 traffic_lastreported_bmp;
+       /** The new AC pending bitmap */
+       uint8 traffic_pending_bmp;
+       /** 1= send on next opportunity */
+       uint8 send_tim_signal;
+       uint8 mac_handle;          /**< mac handles are assigned by the dongle */
+       /** Number of packets at dongle for this entry. */
+       int transit_count;
+       /** Number of suppression to wait before evict from delayQ */
+       int suppr_transit_count;
+       /** pkt sent to bus but no bus TX complete yet */
+       int onbus_pkts_count;
+       /** flag. TRUE when remote MAC is in suppressed state */
+       uint8 suppressed;
+
+
+#ifdef PROP_TXSTATUS_DEBUG
+       uint32 dstncredit_sent_packets;
+       uint32 dstncredit_acks;
+       uint32 opened_ct;
+       uint32 closed_ct;
+#endif
+       struct wlfc_mac_descriptor* prev;
+       struct wlfc_mac_descriptor* next;
+} wlfc_mac_descriptor_t;
+
+/** A 'commit' is the hand over of a packet from the host OS layer to the layer below (eg DBUS) */
+typedef struct dhd_wlfc_commit_info {
+       uint8                                   needs_hdr;
+       uint8                                   ac_fifo_credit_spent;
+       ewlfc_packet_state_t    pkt_type;
+       wlfc_mac_descriptor_t*  mac_entry;
+       void*                                   p;
+} dhd_wlfc_commit_info_t;
+
+#define WLFC_DECR_SEQCOUNT(entry, prec) do { if (entry->seq[(prec)] == 0) {\
+       entry->seq[prec] = 0xff; } else entry->seq[prec]--;} while (0)
+
+#define WLFC_INCR_SEQCOUNT(entry, prec) entry->seq[(prec)]++
+#define WLFC_SEQCOUNT(entry, prec) entry->seq[(prec)]
+
+typedef struct athost_wl_stat_counters {
+       uint32  pktin;
+       uint32  pktout;
+       uint32  pkt2bus;
+       uint32  pktdropped;
+       uint32  tlv_parse_failed;
+       uint32  rollback;
+       uint32  rollback_failed;
+       uint32  delayq_full_error;
+       uint32  credit_request_failed;
+       uint32  packet_request_failed;
+       uint32  mac_update_failed;
+       uint32  psmode_update_failed;
+       uint32  interface_update_failed;
+       uint32  wlfc_header_only_pkt;
+       uint32  txstatus_in;
+       uint32  d11_suppress;
+       uint32  wl_suppress;
+       uint32  bad_suppress;
+       uint32  pkt_freed;
+       uint32  pkt_free_err;
+       uint32  psq_wlsup_retx;
+       uint32  psq_wlsup_enq;
+       uint32  psq_d11sup_retx;
+       uint32  psq_d11sup_enq;
+       uint32  psq_hostq_retx;
+       uint32  psq_hostq_enq;
+       uint32  mac_handle_notfound;
+       uint32  wlc_tossed_pkts;
+       uint32  dhd_hdrpulls;
+       uint32  generic_error;
+       /* an extra one for bc/mc traffic */
+       uint32  send_pkts[AC_COUNT + 1];
+       uint32  drop_pkts[WLFC_PSQ_PREC_COUNT];
+       uint32  ooo_pkts[AC_COUNT + 1];
+#ifdef PROP_TXSTATUS_DEBUG
+       /** all pkt2bus -> txstatus latency accumulated */
+       uint32  latency_sample_count;
+       uint32  total_status_latency;
+       uint32  latency_most_recent;
+       int     idx_delta;
+       uint32  deltas[10];
+       uint32  fifo_credits_sent[6];
+       uint32  fifo_credits_back[6];
+       uint32  dropped_qfull[6];
+       uint32  signal_only_pkts_sent;
+       uint32  signal_only_pkts_freed;
+#endif
+       uint32  cleanup_txq_cnt;
+       uint32  cleanup_psq_cnt;
+       uint32  cleanup_fw_cnt;
+} athost_wl_stat_counters_t;
+
+#ifdef PROP_TXSTATUS_DEBUG
+#define WLFC_HOST_FIFO_CREDIT_INC_SENTCTRS(ctx, ac) do { \
+       (ctx)->stats.fifo_credits_sent[(ac)]++;} while (0)
+#define WLFC_HOST_FIFO_CREDIT_INC_BACKCTRS(ctx, ac) do { \
+       (ctx)->stats.fifo_credits_back[(ac)]++;} while (0)
+#define WLFC_HOST_FIFO_DROPPEDCTR_INC(ctx, ac) do { \
+       (ctx)->stats.dropped_qfull[(ac)]++;} while (0)
+#else
+#define WLFC_HOST_FIFO_CREDIT_INC_SENTCTRS(ctx, ac) do {} while (0)
+#define WLFC_HOST_FIFO_CREDIT_INC_BACKCTRS(ctx, ac) do {} while (0)
+#define WLFC_HOST_FIFO_DROPPEDCTR_INC(ctx, ac) do {} while (0)
+#endif
+
+#define WLFC_FCMODE_NONE                               0
+#define WLFC_FCMODE_IMPLIED_CREDIT             1
+#define WLFC_FCMODE_EXPLICIT_CREDIT            2
+#define WLFC_ONLY_AMPDU_HOSTREORDER            3
+
+/** Reserved credits ratio when borrowed by hihger priority */
+#define WLFC_BORROW_LIMIT_RATIO                4
+
+/** How long to defer borrowing in milliseconds */
+#define WLFC_BORROW_DEFER_PERIOD_MS 100
+
+/** How long to defer flow control in milliseconds */
+#define WLFC_FC_DEFER_PERIOD_MS 200
+
+/** How long to detect occurance per AC in miliseconds */
+#define WLFC_RX_DETECTION_THRESHOLD_MS 100
+
+/** Mask to represent available ACs (note: BC/MC is ignored) */
+#define WLFC_AC_MASK 0xF
+
+/** flow control specific information, only 1 instance during driver lifetime */
+typedef struct athost_wl_status_info {
+       uint8   last_seqid_to_wlc;
+
+       /** OSL handle */
+       osl_t *osh;
+       /** dhd public struct pointer */
+       void *dhdp;
+
+       f_commitpkt_t fcommit;
+       void* commit_ctx;
+
+       /** statistics */
+       athost_wl_stat_counters_t stats;
+
+       /** incremented on eg receiving a credit map event from the dongle */
+       int             Init_FIFO_credit[AC_COUNT + 2];
+       /** the additional ones are for bc/mc and ATIM FIFO */
+       int             FIFO_credit[AC_COUNT + 2];
+       /** Credit borrow counts for each FIFO from each of the other FIFOs */
+       int             credits_borrowed[AC_COUNT + 2][AC_COUNT + 2];
+
+       /** packet hanger and MAC->handle lookup table */
+       void *hanger;
+
+       struct {
+               /** table for individual nodes */
+               wlfc_mac_descriptor_t   nodes[WLFC_MAC_DESC_TABLE_SIZE];
+               /** table for interfaces */
+               wlfc_mac_descriptor_t   interfaces[WLFC_MAX_IFNUM];
+               /* OS may send packets to unknown (unassociated) destinations */
+               /** A place holder for bc/mc and packets to unknown destinations */
+               wlfc_mac_descriptor_t   other;
+       } destination_entries;
+
+       wlfc_mac_descriptor_t *active_entry_head; /**< a chain of MAC descriptors */
+       int active_entry_count;
+
+       wlfc_mac_descriptor_t *requested_entry[WLFC_MAC_DESC_TABLE_SIZE];
+       int requested_entry_count;
+
+       /* pkt counts for each interface and ac */
+       int     pkt_cnt_in_q[WLFC_MAX_IFNUM][AC_COUNT+1];
+       int     pkt_cnt_per_ac[AC_COUNT+1];
+       int     pkt_cnt_in_drv[WLFC_MAX_IFNUM][AC_COUNT+1];
+       int     pkt_cnt_in_psq;
+       uint8   allow_fc;              /**< Boolean */
+       uint32  fc_defer_timestamp;
+       uint32  rx_timestamp[AC_COUNT+1];
+
+       /** ON/OFF state for flow control to the host network interface */
+       uint8   hostif_flow_state[WLFC_MAX_IFNUM];
+       uint8   host_ifidx;
+
+       /** to flow control an OS interface */
+       uint8   toggle_host_if;
+
+       /** To borrow credits */
+       uint8   allow_credit_borrow;
+
+       /** ac number for the first single ac traffic */
+       uint8   single_ac;
+
+       /** Timestamp for the first single ac traffic */
+       uint32  single_ac_timestamp;
+
+       bool    bcmc_credit_supported;
+
+} athost_wl_status_info_t;
+
+/** Please be mindful that total pkttag space is 32 octets only */
+typedef struct dhd_pkttag {
+
+#ifdef BCM_OBJECT_TRACE
+       /* if use this field, keep it at the first 4 bytes */
+       uint32 sn;
+#endif /* BCM_OBJECT_TRACE */
+
+       /**
+       b[15]  - 1 = wlfc packet
+       b[14:13]  - encryption exemption
+       b[12 ] - 1 = event channel
+       b[11 ] - 1 = this packet was sent in response to one time packet request,
+       do not increment credit on status for this one. [WLFC_CTL_TYPE_MAC_REQUEST_PACKET].
+       b[10 ] - 1 = signal-only-packet to firmware [i.e. nothing to piggyback on]
+       b[9  ] - 1 = packet is host->firmware (transmit direction)
+              - 0 = packet received from firmware (firmware->host)
+       b[8  ] - 1 = packet was sent due to credit_request (pspoll),
+                    packet does not count against FIFO credit.
+              - 0 = normal transaction, packet counts against FIFO credit
+       b[7  ] - 1 = AP, 0 = STA
+       b[6:4] - AC FIFO number
+       b[3:0] - interface index
+       */
+       uint16  if_flags;
+
+       /**
+        * destination MAC address for this packet so that not every module needs to open the packet
+        * to find this
+        */
+       uint8   dstn_ether[ETHER_ADDR_LEN];
+
+       /** This 32-bit goes from host to device for every packet. */
+       uint32  htod_tag;
+
+       /** This 16-bit is original seq number for every suppress packet. */
+       uint16  htod_seq;
+
+       /** This address is mac entry for every packet. */
+       void *entry;
+
+       /** bus specific stuff */
+       union {
+               struct {
+                       void *stuff;
+                       uint32 thing1;
+                       uint32 thing2;
+               } sd;
+
+               struct {
+                       void *bus;
+                       void *urb;
+               } usb;
+       } bus_specific;
+} dhd_pkttag_t;
+
+#define DHD_PKTTAG_WLFCPKT_MASK                        0x1
+#define DHD_PKTTAG_WLFCPKT_SHIFT               15
+#define DHD_PKTTAG_WLFCPKT_SET(tag, value)     ((dhd_pkttag_t*)(tag))->if_flags = \
+       (((dhd_pkttag_t*)(tag))->if_flags & \
+       ~(DHD_PKTTAG_WLFCPKT_MASK << DHD_PKTTAG_WLFCPKT_SHIFT)) | \
+       (((value) & DHD_PKTTAG_WLFCPKT_MASK) << DHD_PKTTAG_WLFCPKT_SHIFT)
+#define DHD_PKTTAG_WLFCPKT(tag)        ((((dhd_pkttag_t*)(tag))->if_flags >> \
+       DHD_PKTTAG_WLFCPKT_SHIFT) & DHD_PKTTAG_WLFCPKT_MASK)
+
+#define DHD_PKTTAG_EXEMPT_MASK                 0x3
+#define DHD_PKTTAG_EXEMPT_SHIFT                        13
+#define DHD_PKTTAG_EXEMPT_SET(tag, value)      ((dhd_pkttag_t*)(tag))->if_flags = \
+       (((dhd_pkttag_t*)(tag))->if_flags & \
+       ~(DHD_PKTTAG_EXEMPT_MASK << DHD_PKTTAG_EXEMPT_SHIFT)) | \
+       (((value) & DHD_PKTTAG_EXEMPT_MASK) << DHD_PKTTAG_EXEMPT_SHIFT)
+#define DHD_PKTTAG_EXEMPT(tag) ((((dhd_pkttag_t*)(tag))->if_flags >> \
+       DHD_PKTTAG_EXEMPT_SHIFT) & DHD_PKTTAG_EXEMPT_MASK)
+
+#define DHD_PKTTAG_EVENT_MASK                  0x1
+#define DHD_PKTTAG_EVENT_SHIFT                 12
+#define DHD_PKTTAG_SETEVENT(tag, event)        ((dhd_pkttag_t*)(tag))->if_flags = \
+       (((dhd_pkttag_t*)(tag))->if_flags & \
+       ~(DHD_PKTTAG_EVENT_MASK << DHD_PKTTAG_EVENT_SHIFT)) | \
+       (((event) & DHD_PKTTAG_EVENT_MASK) << DHD_PKTTAG_EVENT_SHIFT)
+#define DHD_PKTTAG_EVENT(tag)  ((((dhd_pkttag_t*)(tag))->if_flags >> \
+       DHD_PKTTAG_EVENT_SHIFT) & DHD_PKTTAG_EVENT_MASK)
+
+#define DHD_PKTTAG_ONETIMEPKTRQST_MASK         0x1
+#define DHD_PKTTAG_ONETIMEPKTRQST_SHIFT                11
+#define DHD_PKTTAG_SETONETIMEPKTRQST(tag)      ((dhd_pkttag_t*)(tag))->if_flags = \
+       (((dhd_pkttag_t*)(tag))->if_flags & \
+       ~(DHD_PKTTAG_ONETIMEPKTRQST_MASK << DHD_PKTTAG_ONETIMEPKTRQST_SHIFT)) | \
+       (1 << DHD_PKTTAG_ONETIMEPKTRQST_SHIFT)
+#define DHD_PKTTAG_ONETIMEPKTRQST(tag) ((((dhd_pkttag_t*)(tag))->if_flags >> \
+       DHD_PKTTAG_ONETIMEPKTRQST_SHIFT) & DHD_PKTTAG_ONETIMEPKTRQST_MASK)
+
+#define DHD_PKTTAG_SIGNALONLY_MASK             0x1
+#define DHD_PKTTAG_SIGNALONLY_SHIFT            10
+#define DHD_PKTTAG_SETSIGNALONLY(tag, signalonly)      ((dhd_pkttag_t*)(tag))->if_flags = \
+       (((dhd_pkttag_t*)(tag))->if_flags & \
+       ~(DHD_PKTTAG_SIGNALONLY_MASK << DHD_PKTTAG_SIGNALONLY_SHIFT)) | \
+       (((signalonly) & DHD_PKTTAG_SIGNALONLY_MASK) << DHD_PKTTAG_SIGNALONLY_SHIFT)
+#define DHD_PKTTAG_SIGNALONLY(tag)     ((((dhd_pkttag_t*)(tag))->if_flags >> \
+       DHD_PKTTAG_SIGNALONLY_SHIFT) & DHD_PKTTAG_SIGNALONLY_MASK)
+
+#define DHD_PKTTAG_PKTDIR_MASK                 0x1
+#define DHD_PKTTAG_PKTDIR_SHIFT                        9
+#define DHD_PKTTAG_SETPKTDIR(tag, dir) ((dhd_pkttag_t*)(tag))->if_flags = \
+       (((dhd_pkttag_t*)(tag))->if_flags & \
+       ~(DHD_PKTTAG_PKTDIR_MASK << DHD_PKTTAG_PKTDIR_SHIFT)) | \
+       (((dir) & DHD_PKTTAG_PKTDIR_MASK) << DHD_PKTTAG_PKTDIR_SHIFT)
+#define DHD_PKTTAG_PKTDIR(tag) ((((dhd_pkttag_t*)(tag))->if_flags >> \
+       DHD_PKTTAG_PKTDIR_SHIFT) & DHD_PKTTAG_PKTDIR_MASK)
+
+#define DHD_PKTTAG_CREDITCHECK_MASK            0x1
+#define DHD_PKTTAG_CREDITCHECK_SHIFT           8
+#define DHD_PKTTAG_SETCREDITCHECK(tag, check)  ((dhd_pkttag_t*)(tag))->if_flags = \
+       (((dhd_pkttag_t*)(tag))->if_flags & \
+       ~(DHD_PKTTAG_CREDITCHECK_MASK << DHD_PKTTAG_CREDITCHECK_SHIFT)) | \
+       (((check) & DHD_PKTTAG_CREDITCHECK_MASK) << DHD_PKTTAG_CREDITCHECK_SHIFT)
+#define DHD_PKTTAG_CREDITCHECK(tag)    ((((dhd_pkttag_t*)(tag))->if_flags >> \
+       DHD_PKTTAG_CREDITCHECK_SHIFT) & DHD_PKTTAG_CREDITCHECK_MASK)
+
+#define DHD_PKTTAG_IFTYPE_MASK                 0x1
+#define DHD_PKTTAG_IFTYPE_SHIFT                        7
+#define DHD_PKTTAG_SETIFTYPE(tag, isAP)        ((dhd_pkttag_t*)(tag))->if_flags = \
+       (((dhd_pkttag_t*)(tag))->if_flags & \
+       ~(DHD_PKTTAG_IFTYPE_MASK << DHD_PKTTAG_IFTYPE_SHIFT)) | \
+       (((isAP) & DHD_PKTTAG_IFTYPE_MASK) << DHD_PKTTAG_IFTYPE_SHIFT)
+#define DHD_PKTTAG_IFTYPE(tag) ((((dhd_pkttag_t*)(tag))->if_flags >> \
+       DHD_PKTTAG_IFTYPE_SHIFT) & DHD_PKTTAG_IFTYPE_MASK)
+
+#define DHD_PKTTAG_FIFO_MASK                   0x7
+#define DHD_PKTTAG_FIFO_SHIFT                  4
+#define DHD_PKTTAG_SETFIFO(tag, fifo)  ((dhd_pkttag_t*)(tag))->if_flags = \
+       (((dhd_pkttag_t*)(tag))->if_flags & ~(DHD_PKTTAG_FIFO_MASK << DHD_PKTTAG_FIFO_SHIFT)) | \
+       (((fifo) & DHD_PKTTAG_FIFO_MASK) << DHD_PKTTAG_FIFO_SHIFT)
+#define DHD_PKTTAG_FIFO(tag)           ((((dhd_pkttag_t*)(tag))->if_flags >> \
+       DHD_PKTTAG_FIFO_SHIFT) & DHD_PKTTAG_FIFO_MASK)
+
+#define DHD_PKTTAG_IF_MASK                     0xf
+#define DHD_PKTTAG_IF_SHIFT                    0
+#define DHD_PKTTAG_SETIF(tag, if)      ((dhd_pkttag_t*)(tag))->if_flags = \
+       (((dhd_pkttag_t*)(tag))->if_flags & ~(DHD_PKTTAG_IF_MASK << DHD_PKTTAG_IF_SHIFT)) | \
+       (((if) & DHD_PKTTAG_IF_MASK) << DHD_PKTTAG_IF_SHIFT)
+#define DHD_PKTTAG_IF(tag)             ((((dhd_pkttag_t*)(tag))->if_flags >> \
+       DHD_PKTTAG_IF_SHIFT) & DHD_PKTTAG_IF_MASK)
+
+#define DHD_PKTTAG_SETDSTN(tag, dstn_MAC_ea)   memcpy(((dhd_pkttag_t*)((tag)))->dstn_ether, \
+       (dstn_MAC_ea), ETHER_ADDR_LEN)
+#define DHD_PKTTAG_DSTN(tag)   ((dhd_pkttag_t*)(tag))->dstn_ether
+
+#define DHD_PKTTAG_SET_H2DTAG(tag, h2dvalue)   ((dhd_pkttag_t*)(tag))->htod_tag = (h2dvalue)
+#define DHD_PKTTAG_H2DTAG(tag)                 (((dhd_pkttag_t*)(tag))->htod_tag)
+
+#define DHD_PKTTAG_SET_H2DSEQ(tag, seq)                ((dhd_pkttag_t*)(tag))->htod_seq = (seq)
+#define DHD_PKTTAG_H2DSEQ(tag)                 (((dhd_pkttag_t*)(tag))->htod_seq)
+
+#define DHD_PKTTAG_SET_ENTRY(tag, entry)       ((dhd_pkttag_t*)(tag))->entry = (entry)
+#define DHD_PKTTAG_ENTRY(tag)                  (((dhd_pkttag_t*)(tag))->entry)
+
+#define PSQ_SUP_IDX(x) (x * 2 + 1)
+#define PSQ_DLY_IDX(x) (x * 2)
+
+#ifdef PROP_TXSTATUS_DEBUG
+#define DHD_WLFC_CTRINC_MAC_CLOSE(entry)       do { (entry)->closed_ct++; } while (0)
+#define DHD_WLFC_CTRINC_MAC_OPEN(entry)                do { (entry)->opened_ct++; } while (0)
+#else
+#define DHD_WLFC_CTRINC_MAC_CLOSE(entry)       do {} while (0)
+#define DHD_WLFC_CTRINC_MAC_OPEN(entry)                do {} while (0)
+#endif
+
+#ifdef BCM_OBJECT_TRACE
+#define DHD_PKTTAG_SET_SN(tag, val)            ((dhd_pkttag_t*)(tag))->sn = (val)
+#define DHD_PKTTAG_SN(tag)                     (((dhd_pkttag_t*)(tag))->sn)
+#endif /* BCM_OBJECT_TRACE */
+
+/* public functions */
+int dhd_wlfc_parse_header_info(dhd_pub_t *dhd, void* pktbuf, int tlv_hdr_len,
+       uchar *reorder_info_buf, uint *reorder_info_len);
+KERNEL_THREAD_RETURN_TYPE dhd_wlfc_transfer_packets(void *data);
+int dhd_wlfc_commit_packets(dhd_pub_t *dhdp, f_commitpkt_t fcommit,
+       void* commit_ctx, void *pktbuf, bool need_toggle_host_if);
+int dhd_wlfc_txcomplete(dhd_pub_t *dhd, void *txp, bool success);
+int dhd_wlfc_init(dhd_pub_t *dhd);
+#ifdef SUPPORT_P2P_GO_PS
+int dhd_wlfc_suspend(dhd_pub_t *dhd);
+int dhd_wlfc_resume(dhd_pub_t *dhd);
+#endif /* SUPPORT_P2P_GO_PS */
+int dhd_wlfc_hostreorder_init(dhd_pub_t *dhd);
+int dhd_wlfc_cleanup_txq(dhd_pub_t *dhd, f_processpkt_t fn, void *arg);
+int dhd_wlfc_cleanup(dhd_pub_t *dhd, f_processpkt_t fn, void* arg);
+int dhd_wlfc_deinit(dhd_pub_t *dhd);
+int dhd_wlfc_interface_event(dhd_pub_t *dhdp, uint8 action, uint8 ifid, uint8 iftype, uint8* ea);
+int dhd_wlfc_FIFOcreditmap_event(dhd_pub_t *dhdp, uint8* event_data);
+int dhd_wlfc_BCMCCredit_support_event(dhd_pub_t *dhdp);
+int dhd_wlfc_enable(dhd_pub_t *dhdp);
+int dhd_wlfc_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf);
+int dhd_wlfc_clear_counts(dhd_pub_t *dhd);
+int dhd_wlfc_get_enable(dhd_pub_t *dhd, bool *val);
+int dhd_wlfc_get_mode(dhd_pub_t *dhd, int *val);
+int dhd_wlfc_set_mode(dhd_pub_t *dhd, int val);
+bool dhd_wlfc_is_supported(dhd_pub_t *dhd);
+bool dhd_wlfc_is_header_only_pkt(dhd_pub_t * dhd, void *pktbuf);
+int dhd_wlfc_flowcontrol(dhd_pub_t *dhdp, bool state, bool bAcquireLock);
+int dhd_wlfc_save_rxpath_ac_time(dhd_pub_t * dhd, uint8 prio);
+
+int dhd_wlfc_get_module_ignore(dhd_pub_t *dhd, int *val);
+int dhd_wlfc_set_module_ignore(dhd_pub_t *dhd, int val);
+int dhd_wlfc_get_credit_ignore(dhd_pub_t *dhd, int *val);
+int dhd_wlfc_set_credit_ignore(dhd_pub_t *dhd, int val);
+int dhd_wlfc_get_txstatus_ignore(dhd_pub_t *dhd, int *val);
+int dhd_wlfc_set_txstatus_ignore(dhd_pub_t *dhd, int val);
+
+int dhd_wlfc_get_rxpkt_chk(dhd_pub_t *dhd, int *val);
+int dhd_wlfc_set_rxpkt_chk(dhd_pub_t *dhd, int val);
+
+#endif /* __wlfc_host_driver_definitions_h__ */
diff --git a/drivers/net/wireless/bcmdhd_1363/dngl_stats.h b/drivers/net/wireless/bcmdhd_1363/dngl_stats.h
new file mode 100644 (file)
index 0000000..d802354
--- /dev/null
@@ -0,0 +1,324 @@
+/*
+ * Common stats definitions for clients of dongle
+ * ports
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dngl_stats.h 629377 2016-04-05 05:22:34Z $
+ */
+
+#ifndef _dngl_stats_h_
+#define _dngl_stats_h_
+
+#include <proto/ethernet.h>
+#include <proto/802.11.h>
+
+typedef struct {
+       unsigned long   rx_packets;             /* total packets received */
+       unsigned long   tx_packets;             /* total packets transmitted */
+       unsigned long   rx_bytes;               /* total bytes received */
+       unsigned long   tx_bytes;               /* total bytes transmitted */
+       unsigned long   rx_errors;              /* bad packets received */
+       unsigned long   tx_errors;              /* packet transmit problems */
+       unsigned long   rx_dropped;             /* packets dropped by dongle */
+       unsigned long   tx_dropped;             /* packets dropped by dongle */
+       unsigned long   multicast;      /* multicast packets received */
+} dngl_stats_t;
+
+typedef int32 wifi_radio;
+typedef int32 wifi_channel;
+typedef int32 wifi_rssi;
+typedef struct { uint16 version; uint16 length; } ver_len;
+
+typedef enum wifi_channel_width {
+       WIFI_CHAN_WIDTH_20        = 0,
+       WIFI_CHAN_WIDTH_40        = 1,
+       WIFI_CHAN_WIDTH_80        = 2,
+       WIFI_CHAN_WIDTH_160   = 3,
+       WIFI_CHAN_WIDTH_80P80 = 4,
+       WIFI_CHAN_WIDTH_5         = 5,
+       WIFI_CHAN_WIDTH_10        = 6,
+       WIFI_CHAN_WIDTH_INVALID = -1
+} wifi_channel_width_t;
+
+typedef enum {
+       WIFI_DISCONNECTED = 0,
+       WIFI_AUTHENTICATING = 1,
+       WIFI_ASSOCIATING = 2,
+       WIFI_ASSOCIATED = 3,
+       WIFI_EAPOL_STARTED = 4,   /* if done by firmware/driver */
+       WIFI_EAPOL_COMPLETED = 5, /* if done by firmware/driver */
+} wifi_connection_state;
+
+typedef enum {
+       WIFI_ROAMING_IDLE = 0,
+       WIFI_ROAMING_ACTIVE = 1
+} wifi_roam_state;
+
+typedef enum {
+       WIFI_INTERFACE_STA = 0,
+       WIFI_INTERFACE_SOFTAP = 1,
+       WIFI_INTERFACE_IBSS = 2,
+       WIFI_INTERFACE_P2P_CLIENT = 3,
+       WIFI_INTERFACE_P2P_GO = 4,
+       WIFI_INTERFACE_NAN = 5,
+       WIFI_INTERFACE_MESH = 6
+} wifi_interface_mode;
+
+#define WIFI_CAPABILITY_QOS          0x00000001     /* set for QOS association */
+#define WIFI_CAPABILITY_PROTECTED    0x00000002     /* set for protected association (802.11
+                                                    * beacon frame control protected bit set)
+                                                    */
+#define WIFI_CAPABILITY_INTERWORKING 0x00000004     /* set if 802.11 Extended Capabilities
+                                                    * element interworking bit is set
+                                                    */
+#define WIFI_CAPABILITY_HS20         0x00000008     /* set for HS20 association */
+#define WIFI_CAPABILITY_SSID_UTF8    0x00000010     /* set is 802.11 Extended Capabilities
+                                                    * element UTF-8 SSID bit is set
+                                                    */
+#define WIFI_CAPABILITY_COUNTRY      0x00000020     /* set is 802.11 Country Element is present */
+
+typedef struct {
+       wifi_interface_mode mode;     /* interface mode */
+       uint8 mac_addr[6];               /* interface mac address (self) */
+       wifi_connection_state state;  /* connection state (valid for STA, CLI only) */
+       wifi_roam_state roaming;      /* roaming state */
+       uint32 capabilities;             /* WIFI_CAPABILITY_XXX (self) */
+       uint8 ssid[DOT11_MAX_SSID_LEN+1]; /* null terminated SSID */
+       uint8 bssid[ETHER_ADDR_LEN];     /* bssid */
+       uint8 ap_country_str[3];         /* country string advertised by AP */
+       uint8 country_str[3];            /* country string for this association */
+} __attribute__ ((packed)) wifi_interface_info;
+
+typedef wifi_interface_info *wifi_interface_handle;
+
+/* channel information */
+typedef struct {
+       wifi_channel_width_t width;   /* channel width (20, 40, 80, 80+80, 160) */
+       wifi_channel center_freq;   /* primary 20 MHz channel */
+       wifi_channel center_freq0;  /* center frequency (MHz) first segment */
+       wifi_channel center_freq1;  /* center frequency (MHz) second segment */
+} wifi_channel_info;
+
+/* wifi rate */
+typedef struct {
+       uint32 preamble;   /* 0: OFDM, 1:CCK, 2:HT 3:VHT 4..7 reserved */
+       uint32 nss;     /* 0:1x1, 1:2x2, 3:3x3, 4:4x4 */
+       uint32 bw;      /* 0:20MHz, 1:40Mhz, 2:80Mhz, 3:160Mhz */
+       uint32 rateMcsIdx; /* OFDM/CCK rate code would be as per ieee std
+                           * in the units of 0.5mbps
+                           */
+                       /* HT/VHT it would be mcs index */
+       uint32 reserved;   /* reserved */
+       uint32 bitrate;    /* units of 100 Kbps */
+} wifi_rate_v2;
+
+typedef struct {
+       uint32 preamble   :3;   /* 0: OFDM, 1:CCK, 2:HT 3:VHT 4..7 reserved */
+       uint32 nss        :2;   /* 0:1x1, 1:2x2, 3:3x3, 4:4x4 */
+       uint32 bw         :3;   /* 0:20MHz, 1:40Mhz, 2:80Mhz, 3:160Mhz */
+       uint32 rateMcsIdx :8;   /* OFDM/CCK rate code would be as per ieee std
+                                       * in the units of 0.5mbps HT/VHT it would be
+                                       * mcs index
+                                       */
+       uint32 reserved  :16;   /* reserved */
+       uint32 bitrate;         /* units of 100 Kbps */
+} wifi_rate;
+
+
+/* channel statistics */
+typedef struct {
+       wifi_channel_info channel;  /* channel */
+       uint32 on_time;                         /* msecs the radio is awake (32 bits number
+                                        * accruing over time)
+                                        */
+       uint32 cca_busy_time;          /* msecs the CCA register is busy (32 bits number
+                                       * accruing over time)
+                                       */
+} wifi_channel_stat;
+
+/* radio statistics */
+typedef struct {
+       struct {
+               uint16 version;
+               uint16 length;
+       };
+       wifi_radio radio;               /* wifi radio (if multiple radio supported) */
+       uint32 on_time;                    /* msecs the radio is awake (32 bits number
+                                           * accruing over time)
+                                           */
+       uint32 tx_time;                    /* msecs the radio is transmitting (32 bits
+                                           * number accruing over time)
+                                           */
+       uint32 rx_time;                    /* msecs the radio is in active receive (32 bits
+                                           * number accruing over time)
+                                           */
+       uint32 on_time_scan;               /* msecs the radio is awake due to all scan (32 bits
+                                           * number accruing over time)
+                                           */
+       uint32 on_time_nbd;                /* msecs the radio is awake due to NAN (32 bits
+                                           * number accruing over time)
+                                           */
+       uint32 on_time_gscan;              /* msecs the radio is awake due to G?scan (32 bits
+                                           * number accruing over time)
+                                           */
+       uint32 on_time_roam_scan;          /* msecs the radio is awake due to roam?scan (32 bits
+                                           * number accruing over time)
+                                           */
+       uint32 on_time_pno_scan;           /* msecs the radio is awake due to PNO scan (32 bits
+                                           * number accruing over time)
+                                           */
+       uint32 on_time_hs20;               /* msecs the radio is awake due to HS2.0 scans and
+                                           * GAS exchange (32 bits number accruing over time)
+                                           */
+       uint32 num_channels;               /* number of channels */
+       wifi_channel_stat channels[1];   /* channel statistics */
+} wifi_radio_stat;
+
+/* per rate statistics */
+typedef struct {
+       wifi_rate rate;     /* rate information */
+       uint32 tx_mpdu;        /* number of successfully transmitted data pkts (ACK rcvd) */
+       uint32 rx_mpdu;        /* number of received data pkts */
+       uint32 mpdu_lost;      /* number of data packet losses (no ACK) */
+       uint32 retries;        /* total number of data pkt retries */
+       uint32 retries_short;  /* number of short data pkt retries */
+       uint32 retries_long;   /* number of long data pkt retries */
+} wifi_rate_stat;
+
+typedef struct {
+       uint16 version;
+       uint16 length;
+       uint32 tx_mpdu;
+       uint32 rx_mpdu;
+       uint32 mpdu_lost;
+       uint32 retries;
+       uint32 retries_short;
+       uint32 retries_long;
+       wifi_rate_v2 rate;
+} wifi_rate_stat_v2;
+
+
+/* access categories */
+typedef enum {
+       WIFI_AC_VO  = 0,
+       WIFI_AC_VI  = 1,
+       WIFI_AC_BE  = 2,
+       WIFI_AC_BK  = 3,
+       WIFI_AC_MAX = 4
+} wifi_traffic_ac;
+
+/* wifi peer type */
+typedef enum
+{
+       WIFI_PEER_STA,
+       WIFI_PEER_AP,
+       WIFI_PEER_P2P_GO,
+       WIFI_PEER_P2P_CLIENT,
+       WIFI_PEER_NAN,
+       WIFI_PEER_TDLS,
+       WIFI_PEER_INVALID
+} wifi_peer_type;
+
+/* per peer statistics */
+typedef struct {
+       wifi_peer_type type;           /* peer type (AP, TDLS, GO etc.) */
+       uint8 peer_mac_address[6];        /* mac address */
+       uint32 capabilities;              /* peer WIFI_CAPABILITY_XXX */
+       uint32 num_rate;                  /* number of rates */
+       wifi_rate_stat rate_stats[1];   /* per rate statistics, number of entries  = num_rate */
+} wifi_peer_info;
+
+/* per access category statistics */
+typedef struct {
+       wifi_traffic_ac ac;             /* access category (VI, VO, BE, BK) */
+       uint32 tx_mpdu;                    /* number of successfully transmitted unicast data pkts
+                                           * (ACK rcvd)
+                                           */
+       uint32 rx_mpdu;                    /* number of received unicast mpdus */
+       uint32 tx_mcast;                   /* number of succesfully transmitted multicast
+                                           * data packets
+                                           */
+                                          /* STA case: implies ACK received from AP for the
+                                           * unicast packet in which mcast pkt was sent
+                                           */
+       uint32 rx_mcast;                   /* number of received multicast data packets */
+       uint32 rx_ampdu;                   /* number of received unicast a-mpdus */
+       uint32 tx_ampdu;                   /* number of transmitted unicast a-mpdus */
+       uint32 mpdu_lost;                  /* number of data pkt losses (no ACK) */
+       uint32 retries;                    /* total number of data pkt retries */
+       uint32 retries_short;              /* number of short data pkt retries */
+       uint32 retries_long;               /* number of long data pkt retries */
+       uint32 contention_time_min;        /* data pkt min contention time (usecs) */
+       uint32 contention_time_max;        /* data pkt max contention time (usecs) */
+       uint32 contention_time_avg;        /* data pkt avg contention time (usecs) */
+       uint32 contention_num_samples;     /* num of data pkts used for contention statistics */
+} wifi_wmm_ac_stat;
+
+/* interface statistics */
+typedef struct {
+       wifi_interface_handle iface;          /* wifi interface */
+       wifi_interface_info info;             /* current state of the interface */
+       uint32 beacon_rx;                     /* access point beacon received count from
+                                              * connected AP
+                                              */
+       uint64 average_tsf_offset;      /* average beacon offset encountered (beacon_TSF - TBTT)
+                                       * The average_tsf_offset field is used so as to calculate
+                                       * the typical beacon contention time on the channel as well
+                                       * may be used to debug beacon synchronization and related
+                                       * power consumption issue
+                                       */
+       uint32 leaky_ap_detected;       /* indicate that this AP
+                                       * typically leaks packets beyond
+                                       * the driver guard time.
+                                       */
+       uint32 leaky_ap_avg_num_frames_leaked;  /* average number of frame leaked by AP after
+                                       * frame with PM bit set was ACK'ed by AP
+                                       */
+       uint32 leaky_ap_guard_time;             /* guard time currently in force
+                                       * (when implementing IEEE power management
+                                       * based on frame control PM bit), How long
+                                       * driver waits before shutting down the radio and after
+                                       * receiving an ACK for a data frame with PM bit set)
+                                       */
+       uint32 mgmt_rx;                       /* access point mgmt frames received count from
+                                      * connected AP (including Beacon)
+                                      */
+       uint32 mgmt_action_rx;                /* action frames received count */
+       uint32 mgmt_action_tx;                /* action frames transmit count */
+       wifi_rssi rssi_mgmt;                  /* access Point Beacon and Management frames RSSI
+                                              * (averaged)
+                                              */
+       wifi_rssi rssi_data;                  /* access Point Data Frames RSSI (averaged) from
+                                              * connected AP
+                                              */
+       wifi_rssi rssi_ack;                   /* access Point ACK RSSI (averaged) from
+                                              * connected AP
+                                              */
+       wifi_wmm_ac_stat ac[WIFI_AC_MAX];     /* per ac data packet statistics */
+       uint32 num_peers;                        /* number of peers */
+       wifi_peer_info peer_info[1];           /* per peer statistics */
+} wifi_iface_stat;
+
+#endif /* _dngl_stats_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/dngl_wlhdr.h b/drivers/net/wireless/bcmdhd_1363/dngl_wlhdr.h
new file mode 100644 (file)
index 0000000..96da42e
--- /dev/null
@@ -0,0 +1,43 @@
+/*
+ * Dongle WL Header definitions
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dngl_wlhdr.h 514727 2014-11-12 03:02:48Z $
+ */
+
+#ifndef _dngl_wlhdr_h_
+#define _dngl_wlhdr_h_
+
+typedef struct wl_header {
+    uint8   type;           /* Header type */
+    uint8   version;        /* Header version */
+       int8    rssi;                   /* RSSI */
+       uint8   pad;                    /* Unused */
+} wl_header_t;
+
+#define WL_HEADER_LEN   sizeof(wl_header_t)
+#define WL_HEADER_TYPE  0
+#define WL_HEADER_VER   1
+#endif /* _dngl_wlhdr_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/hnd_pktpool.c b/drivers/net/wireless/bcmdhd_1363/hnd_pktpool.c
new file mode 100644 (file)
index 0000000..9025332
--- /dev/null
@@ -0,0 +1,1131 @@
+/*
+ * HND generic packet pool operation primitives
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: hnd_pktpool.c 591285 2015-10-07 11:56:29Z $
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+#include <osl_ext.h>
+#include <bcmutils.h>
+#include <hnd_pktpool.h>
+
+/* mutex macros for thread safe */
+#ifdef HND_PKTPOOL_THREAD_SAFE
+#define HND_PKTPOOL_MUTEX_CREATE(name, mutex)  osl_ext_mutex_create(name, mutex)
+#define HND_PKTPOOL_MUTEX_DELETE(mutex)                osl_ext_mutex_delete(mutex)
+#define HND_PKTPOOL_MUTEX_ACQUIRE(mutex, msec) osl_ext_mutex_acquire(mutex, msec)
+#define HND_PKTPOOL_MUTEX_RELEASE(mutex)       osl_ext_mutex_release(mutex)
+#else
+#define HND_PKTPOOL_MUTEX_CREATE(name, mutex)  OSL_EXT_SUCCESS
+#define HND_PKTPOOL_MUTEX_DELETE(mutex)                OSL_EXT_SUCCESS
+#define HND_PKTPOOL_MUTEX_ACQUIRE(mutex, msec) OSL_EXT_SUCCESS
+#define HND_PKTPOOL_MUTEX_RELEASE(mutex)       OSL_EXT_SUCCESS
+#endif
+
+/* Registry size is one larger than max pools, as slot #0 is reserved */
+#define PKTPOOLREG_RSVD_ID                             (0U)
+#define PKTPOOLREG_RSVD_PTR                            (POOLPTR(0xdeaddead))
+#define PKTPOOLREG_FREE_PTR                            (POOLPTR(NULL))
+
+#define PKTPOOL_REGISTRY_SET(id, pp)   (pktpool_registry_set((id), (pp)))
+#define PKTPOOL_REGISTRY_CMP(id, pp)   (pktpool_registry_cmp((id), (pp)))
+
+/* Tag a registry entry as free for use */
+#define PKTPOOL_REGISTRY_CLR(id)               \
+               PKTPOOL_REGISTRY_SET((id), PKTPOOLREG_FREE_PTR)
+#define PKTPOOL_REGISTRY_ISCLR(id)             \
+               (PKTPOOL_REGISTRY_CMP((id), PKTPOOLREG_FREE_PTR))
+
+/* Tag registry entry 0 as reserved */
+#define PKTPOOL_REGISTRY_RSV()                 \
+               PKTPOOL_REGISTRY_SET(PKTPOOLREG_RSVD_ID, PKTPOOLREG_RSVD_PTR)
+#define PKTPOOL_REGISTRY_ISRSVD()              \
+               (PKTPOOL_REGISTRY_CMP(PKTPOOLREG_RSVD_ID, PKTPOOLREG_RSVD_PTR))
+
+/* Walk all un-reserved entries in registry */
+#define PKTPOOL_REGISTRY_FOREACH(id)   \
+               for ((id) = 1U; (id) <= pktpools_max; (id)++)
+
+enum pktpool_empty_cb_state {
+       EMPTYCB_ENABLED = 0,    /* Enable callback when new packets are added to pool */
+       EMPTYCB_DISABLED,       /* Disable callback when new packets are added to pool */
+       EMPTYCB_SKIPPED         /* Packet was added to pool when callback was disabled */
+};
+
+uint32 pktpools_max = 0U; /* maximum number of pools that may be initialized */
+pktpool_t *pktpools_registry[PKTPOOL_MAXIMUM_ID + 1]; /* Pktpool registry */
+
+/* Register/Deregister a pktpool with registry during pktpool_init/deinit */
+static int pktpool_register(pktpool_t * poolptr);
+static int pktpool_deregister(pktpool_t * poolptr);
+
+/** add declaration */
+static int pktpool_avail_notify(pktpool_t *pktp);
+
+/** accessor functions required when ROMming this file, forced into RAM */
+
+
+pktpool_t *
+BCMRAMFN(get_pktpools_registry)(int id)
+{
+       return pktpools_registry[id];
+}
+
+static void
+BCMRAMFN(pktpool_registry_set)(int id, pktpool_t *pp)
+{
+       pktpools_registry[id] = pp;
+}
+
+static bool
+BCMRAMFN(pktpool_registry_cmp)(int id, pktpool_t *pp)
+{
+       return pktpools_registry[id] == pp;
+}
+
+int /* Construct a pool registry to serve a maximum of total_pools */
+pktpool_attach(osl_t *osh, uint32 total_pools)
+{
+       uint32 poolid;
+
+       if (pktpools_max != 0U) {
+               return BCME_ERROR;
+       }
+
+       ASSERT(total_pools <= PKTPOOL_MAXIMUM_ID);
+
+       /* Initialize registry: reserve slot#0 and tag others as free */
+       PKTPOOL_REGISTRY_RSV();         /* reserve slot#0 */
+
+       PKTPOOL_REGISTRY_FOREACH(poolid) {      /* tag all unreserved entries as free */
+               PKTPOOL_REGISTRY_CLR(poolid);
+       }
+
+       pktpools_max = total_pools;
+
+       return (int)pktpools_max;
+}
+
+int /* Destruct the pool registry. Ascertain all pools were first de-inited */
+pktpool_dettach(osl_t *osh)
+{
+       uint32 poolid;
+
+       if (pktpools_max == 0U) {
+               return BCME_OK;
+       }
+
+       /* Ascertain that no pools are still registered */
+       ASSERT(PKTPOOL_REGISTRY_ISRSVD()); /* assert reserved slot */
+
+       PKTPOOL_REGISTRY_FOREACH(poolid) {      /* ascertain all others are free */
+               ASSERT(PKTPOOL_REGISTRY_ISCLR(poolid));
+       }
+
+       pktpools_max = 0U; /* restore boot state */
+
+       return BCME_OK;
+}
+
+static int     /* Register a pool in a free slot; return the registry slot index */
+pktpool_register(pktpool_t * poolptr)
+{
+       uint32 poolid;
+
+       if (pktpools_max == 0U) {
+               return PKTPOOL_INVALID_ID; /* registry has not yet been constructed */
+       }
+
+       ASSERT(pktpools_max != 0U);
+
+       /* find an empty slot in pktpools_registry */
+       PKTPOOL_REGISTRY_FOREACH(poolid) {
+               if (PKTPOOL_REGISTRY_ISCLR(poolid)) {
+                       PKTPOOL_REGISTRY_SET(poolid, POOLPTR(poolptr)); /* register pool */
+                       return (int)poolid; /* return pool ID */
+               }
+       } /* FOREACH */
+
+       return PKTPOOL_INVALID_ID;      /* error: registry is full */
+}
+
+static int     /* Deregister a pktpool, given the pool pointer; tag slot as free */
+pktpool_deregister(pktpool_t * poolptr)
+{
+       uint32 poolid;
+
+       ASSERT(POOLPTR(poolptr) != POOLPTR(NULL));
+
+       poolid = POOLID(poolptr);
+       ASSERT(poolid <= pktpools_max);
+
+       /* Asertain that a previously registered poolptr is being de-registered */
+       if (PKTPOOL_REGISTRY_CMP(poolid, POOLPTR(poolptr))) {
+               PKTPOOL_REGISTRY_CLR(poolid); /* mark as free */
+       } else {
+               ASSERT(0);
+               return BCME_ERROR; /* mismatch in registry */
+       }
+
+       return BCME_OK;
+}
+
+
+/*
+ * pktpool_init:
+ * User provides a pktpool_t sturcture and specifies the number of packets to
+ * be pre-filled into the pool (pplen). The size of all packets in a pool must
+ * be the same and is specified by plen.
+ * pktpool_init first attempts to register the pool and fetch a unique poolid.
+ * If registration fails, it is considered an BCME_ERR, caused by either the
+ * registry was not pre-created (pktpool_attach) or the registry is full.
+ * If registration succeeds, then the requested number of packets will be filled
+ * into the pool as part of initialization. In the event that there is no
+ * available memory to service the request, then BCME_NOMEM will be returned
+ * along with the count of how many packets were successfully allocated.
+ * In dongle builds, prior to memory reclaimation, one should limit the number
+ * of packets to be allocated during pktpool_init and fill the pool up after
+ * reclaim stage.
+ */
+int
+pktpool_init(osl_t *osh, pktpool_t *pktp, int *pplen, int plen, bool istx, uint8 type)
+{
+       int i, err = BCME_OK;
+       int pktplen;
+       uint8 pktp_id;
+
+       ASSERT(pktp != NULL);
+       ASSERT(osh != NULL);
+       ASSERT(pplen != NULL);
+
+       pktplen = *pplen;
+
+       bzero(pktp, sizeof(pktpool_t));
+
+       /* assign a unique pktpool id */
+       if ((pktp_id = (uint8) pktpool_register(pktp)) == PKTPOOL_INVALID_ID) {
+               return BCME_ERROR;
+       }
+       POOLSETID(pktp, pktp_id);
+
+       pktp->inited = TRUE;
+       pktp->istx = istx ? TRUE : FALSE;
+       pktp->plen = (uint16)plen;
+       pktp->type = type;
+
+       if (HND_PKTPOOL_MUTEX_CREATE("pktpool", &pktp->mutex) != OSL_EXT_SUCCESS) {
+               return BCME_ERROR;
+       }
+
+       pktp->maxlen = PKTPOOL_LEN_MAX;
+       pktplen = LIMIT_TO_MAX(pktplen, pktp->maxlen);
+
+       for (i = 0; i < pktplen; i++) {
+               void *p;
+               p = PKTGET(osh, plen, TRUE);
+
+               if (p == NULL) {
+                       /* Not able to allocate all requested pkts
+                        * so just return what was actually allocated
+                        * We can add to the pool later
+                        */
+                       if (pktp->freelist == NULL) /* pktpool free list is empty */
+                               err = BCME_NOMEM;
+
+                       goto exit;
+               }
+
+               PKTSETPOOL(osh, p, TRUE, pktp); /* Tag packet with pool ID */
+
+               PKTSETFREELIST(p, pktp->freelist); /* insert p at head of free list */
+               pktp->freelist = p;
+
+               pktp->avail++;
+
+#ifdef BCMDBG_POOL
+               pktp->dbg_q[pktp->dbg_qlen++].p = p;
+#endif
+       }
+
+exit:
+       pktp->len = pktp->avail;
+
+       *pplen = pktp->len;
+       return err;
+}
+
+/*
+ * pktpool_deinit:
+ * Prior to freeing a pktpool, all packets must be first freed into the pktpool.
+ * Upon pktpool_deinit, all packets in the free pool will be freed to the heap.
+ * An assert is in place to ensure that there are no packets still lingering
+ * around. Packets freed to a pool after the deinit will cause a memory
+ * corruption as the pktpool_t structure no longer exists.
+ */
+int
+pktpool_deinit(osl_t *osh, pktpool_t *pktp)
+{
+       uint16 freed = 0;
+
+       ASSERT(osh != NULL);
+       ASSERT(pktp != NULL);
+
+#ifdef BCMDBG_POOL
+       {
+               int i;
+               for (i = 0; i <= pktp->len; i++) {
+                       pktp->dbg_q[i].p = NULL;
+               }
+       }
+#endif
+
+       while (pktp->freelist != NULL) {
+               void * p = pktp->freelist;
+
+               pktp->freelist = PKTFREELIST(p); /* unlink head packet from free list */
+               PKTSETFREELIST(p, NULL);
+
+               PKTSETPOOL(osh, p, FALSE, NULL); /* clear pool ID tag in pkt */
+
+               PKTFREE(osh, p, pktp->istx); /* free the packet */
+
+               freed++;
+               ASSERT(freed <= pktp->len);
+       }
+
+       pktp->avail -= freed;
+       ASSERT(pktp->avail == 0);
+
+       pktp->len -= freed;
+
+       pktpool_deregister(pktp); /* release previously acquired unique pool id */
+       POOLSETID(pktp, PKTPOOL_INVALID_ID);
+
+       if (HND_PKTPOOL_MUTEX_DELETE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       pktp->inited = FALSE;
+
+       /* Are there still pending pkts? */
+       ASSERT(pktp->len == 0);
+
+       return 0;
+}
+
+int
+pktpool_fill(osl_t *osh, pktpool_t *pktp, bool minimal)
+{
+       void *p;
+       int err = 0;
+       int len, psize, maxlen;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       ASSERT(pktp->plen != 0);
+
+       maxlen = pktp->maxlen;
+       psize = minimal ? (maxlen >> 2) : maxlen;
+       for (len = (int)pktp->len; len < psize; len++) {
+
+               p = PKTGET(osh, pktp->len, TRUE);
+
+               if (p == NULL) {
+                       err = BCME_NOMEM;
+                       break;
+               }
+
+               if (pktpool_add(pktp, p) != BCME_OK) {
+                       PKTFREE(osh, p, FALSE);
+                       err = BCME_ERROR;
+                       break;
+               }
+       }
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       if (pktp->cbcnt) {
+               if (pktp->empty == FALSE)
+                       pktpool_avail_notify(pktp);
+       }
+
+       return err;
+}
+
+static void *
+pktpool_deq(pktpool_t *pktp)
+{
+       void *p = NULL;
+
+       if (pktp->avail == 0)
+               return NULL;
+
+       ASSERT(pktp->freelist != NULL);
+
+       p = pktp->freelist;  /* dequeue packet from head of pktpool free list */
+       pktp->freelist = PKTFREELIST(p); /* free list points to next packet */
+       PKTSETFREELIST(p, NULL);
+
+       pktp->avail--;
+
+       return p;
+}
+
+static void
+pktpool_enq(pktpool_t *pktp, void *p)
+{
+       ASSERT(p != NULL);
+
+       PKTSETFREELIST(p, pktp->freelist); /* insert at head of pktpool free list */
+       pktp->freelist = p; /* free list points to newly inserted packet */
+
+       pktp->avail++;
+       ASSERT(pktp->avail <= pktp->len);
+}
+
+/* utility for registering host addr fill function called from pciedev */
+int
+/* BCMATTACHFN */
+(pktpool_hostaddr_fill_register)(pktpool_t *pktp, pktpool_cb_extn_t cb, void *arg)
+{
+
+       ASSERT(cb != NULL);
+
+       ASSERT(pktp->cbext.cb == NULL);
+       pktp->cbext.cb = cb;
+       pktp->cbext.arg = arg;
+       return 0;
+}
+
+int
+pktpool_rxcplid_fill_register(pktpool_t *pktp, pktpool_cb_extn_t cb, void *arg)
+{
+
+       ASSERT(cb != NULL);
+
+       if (pktp == NULL)
+               return BCME_ERROR;
+       ASSERT(pktp->rxcplidfn.cb == NULL);
+       pktp->rxcplidfn.cb = cb;
+       pktp->rxcplidfn.arg = arg;
+       return 0;
+}
+/* Callback functions for split rx modes */
+/* when evr host posts rxbuffer, invike dma_rxfill from pciedev layer */
+void
+pktpool_invoke_dmarxfill(pktpool_t *pktp)
+{
+       ASSERT(pktp->dmarxfill.cb);
+       ASSERT(pktp->dmarxfill.arg);
+
+       if (pktp->dmarxfill.cb)
+               pktp->dmarxfill.cb(pktp, pktp->dmarxfill.arg);
+}
+int
+pkpool_haddr_avail_register_cb(pktpool_t *pktp, pktpool_cb_t cb, void *arg)
+{
+
+       ASSERT(cb != NULL);
+
+       pktp->dmarxfill.cb = cb;
+       pktp->dmarxfill.arg = arg;
+
+       return 0;
+}
+/* No BCMATTACHFN as it is used in xdc_enable_ep which is not an attach function */
+int
+pktpool_avail_register(pktpool_t *pktp, pktpool_cb_t cb, void *arg)
+{
+       int err = 0;
+       int i;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       ASSERT(cb != NULL);
+
+       i = pktp->cbcnt;
+       if (i == PKTPOOL_CB_MAX_AVL) {
+               err = BCME_ERROR;
+               goto done;
+       }
+
+       ASSERT(pktp->cbs[i].cb == NULL);
+       pktp->cbs[i].cb = cb;
+       pktp->cbs[i].arg = arg;
+       pktp->cbcnt++;
+
+done:
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       return err;
+}
+
+int
+pktpool_empty_register(pktpool_t *pktp, pktpool_cb_t cb, void *arg)
+{
+       int err = 0;
+       int i;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       ASSERT(cb != NULL);
+
+       i = pktp->ecbcnt;
+       if (i == PKTPOOL_CB_MAX) {
+               err = BCME_ERROR;
+               goto done;
+       }
+
+       ASSERT(pktp->ecbs[i].cb == NULL);
+       pktp->ecbs[i].cb = cb;
+       pktp->ecbs[i].arg = arg;
+       pktp->ecbcnt++;
+
+done:
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       return err;
+}
+
+static int
+pktpool_empty_notify(pktpool_t *pktp)
+{
+       int i;
+
+       pktp->empty = TRUE;
+       for (i = 0; i < pktp->ecbcnt; i++) {
+               ASSERT(pktp->ecbs[i].cb != NULL);
+               pktp->ecbs[i].cb(pktp, pktp->ecbs[i].arg);
+       }
+       pktp->empty = FALSE;
+
+       return 0;
+}
+
+#ifdef BCMDBG_POOL
+int
+pktpool_dbg_register(pktpool_t *pktp, pktpool_cb_t cb, void *arg)
+{
+       int err = 0;
+       int i;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       ASSERT(cb);
+
+       i = pktp->dbg_cbcnt;
+       if (i == PKTPOOL_CB_MAX) {
+               err = BCME_ERROR;
+               goto done;
+       }
+
+       ASSERT(pktp->dbg_cbs[i].cb == NULL);
+       pktp->dbg_cbs[i].cb = cb;
+       pktp->dbg_cbs[i].arg = arg;
+       pktp->dbg_cbcnt++;
+
+done:
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       return err;
+}
+
+int pktpool_dbg_notify(pktpool_t *pktp);
+
+int
+pktpool_dbg_notify(pktpool_t *pktp)
+{
+       int i;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       for (i = 0; i < pktp->dbg_cbcnt; i++) {
+               ASSERT(pktp->dbg_cbs[i].cb);
+               pktp->dbg_cbs[i].cb(pktp, pktp->dbg_cbs[i].arg);
+       }
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       return 0;
+}
+
+int
+pktpool_dbg_dump(pktpool_t *pktp)
+{
+       int i;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       printf("pool len=%d maxlen=%d\n",  pktp->dbg_qlen, pktp->maxlen);
+       for (i = 0; i < pktp->dbg_qlen; i++) {
+               ASSERT(pktp->dbg_q[i].p);
+               printf("%d, p: 0x%x dur:%lu us state:%d\n", i,
+                       pktp->dbg_q[i].p, pktp->dbg_q[i].dur/100, PKTPOOLSTATE(pktp->dbg_q[i].p));
+       }
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       return 0;
+}
+
+int
+pktpool_stats_dump(pktpool_t *pktp, pktpool_stats_t *stats)
+{
+       int i;
+       int state;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       bzero(stats, sizeof(pktpool_stats_t));
+       for (i = 0; i < pktp->dbg_qlen; i++) {
+               ASSERT(pktp->dbg_q[i].p != NULL);
+
+               state = PKTPOOLSTATE(pktp->dbg_q[i].p);
+               switch (state) {
+                       case POOL_TXENQ:
+                               stats->enq++; break;
+                       case POOL_TXDH:
+                               stats->txdh++; break;
+                       case POOL_TXD11:
+                               stats->txd11++; break;
+                       case POOL_RXDH:
+                               stats->rxdh++; break;
+                       case POOL_RXD11:
+                               stats->rxd11++; break;
+                       case POOL_RXFILL:
+                               stats->rxfill++; break;
+                       case POOL_IDLE:
+                               stats->idle++; break;
+               }
+       }
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       return 0;
+}
+
+int
+pktpool_start_trigger(pktpool_t *pktp, void *p)
+{
+       uint32 cycles, i;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       if (!PKTPOOL(OSH_NULL, p))
+               goto done;
+
+       OSL_GETCYCLES(cycles);
+
+       for (i = 0; i < pktp->dbg_qlen; i++) {
+               ASSERT(pktp->dbg_q[i].p != NULL);
+
+               if (pktp->dbg_q[i].p == p) {
+                       pktp->dbg_q[i].cycles = cycles;
+                       break;
+               }
+       }
+
+done:
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       return 0;
+}
+
+int pktpool_stop_trigger(pktpool_t *pktp, void *p);
+int
+pktpool_stop_trigger(pktpool_t *pktp, void *p)
+{
+       uint32 cycles, i;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       if (!PKTPOOL(OSH_NULL, p))
+               goto done;
+
+       OSL_GETCYCLES(cycles);
+
+       for (i = 0; i < pktp->dbg_qlen; i++) {
+               ASSERT(pktp->dbg_q[i].p != NULL);
+
+               if (pktp->dbg_q[i].p == p) {
+                       if (pktp->dbg_q[i].cycles == 0)
+                               break;
+
+                       if (cycles >= pktp->dbg_q[i].cycles)
+                               pktp->dbg_q[i].dur = cycles - pktp->dbg_q[i].cycles;
+                       else
+                               pktp->dbg_q[i].dur =
+                                       (((uint32)-1) - pktp->dbg_q[i].cycles) + cycles + 1;
+
+                       pktp->dbg_q[i].cycles = 0;
+                       break;
+               }
+       }
+
+done:
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       return 0;
+}
+#endif /* BCMDBG_POOL */
+
+int
+pktpool_avail_notify_normal(osl_t *osh, pktpool_t *pktp)
+{
+       ASSERT(pktp);
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       pktp->availcb_excl = NULL;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       return 0;
+}
+
+int
+pktpool_avail_notify_exclusive(osl_t *osh, pktpool_t *pktp, pktpool_cb_t cb)
+{
+       int i;
+       int err;
+
+       ASSERT(pktp);
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       ASSERT(pktp->availcb_excl == NULL);
+       for (i = 0; i < pktp->cbcnt; i++) {
+               if (cb == pktp->cbs[i].cb) {
+                       pktp->availcb_excl = &pktp->cbs[i];
+                       break;
+               }
+       }
+
+       if (pktp->availcb_excl == NULL)
+               err = BCME_ERROR;
+       else
+               err = 0;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       return err;
+}
+
+static int
+pktpool_avail_notify(pktpool_t *pktp)
+{
+       int i, k, idx;
+       int avail;
+
+       ASSERT(pktp);
+       if (pktp->availcb_excl != NULL) {
+               pktp->availcb_excl->cb(pktp, pktp->availcb_excl->arg);
+               return 0;
+       }
+
+       k = pktp->cbcnt - 1;
+       for (i = 0; i < pktp->cbcnt; i++) {
+               avail = pktp->avail;
+
+               if (avail) {
+                       if (pktp->cbtoggle)
+                               idx = i;
+                       else
+                               idx = k--;
+
+                       ASSERT(pktp->cbs[idx].cb != NULL);
+                       pktp->cbs[idx].cb(pktp, pktp->cbs[idx].arg);
+               }
+       }
+
+       /* Alternate between filling from head or tail
+        */
+       pktp->cbtoggle ^= 1;
+
+       return 0;
+}
+
+void *
+pktpool_get(pktpool_t *pktp)
+{
+       void *p;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+
+       p = pktpool_deq(pktp);
+
+       if (p == NULL) {
+               /* Notify and try to reclaim tx pkts */
+               if (pktp->ecbcnt)
+                       pktpool_empty_notify(pktp);
+
+               p = pktpool_deq(pktp);
+               if (p == NULL)
+                       goto done;
+       }
+
+
+done:
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+void
+pktpool_free(pktpool_t *pktp, void *p)
+{
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return;
+
+       ASSERT(p != NULL);
+#ifdef BCMDBG_POOL
+       /* pktpool_stop_trigger(pktp, p); */
+#endif
+
+       pktpool_enq(pktp, p);
+
+       /**
+        * Feed critical DMA with freshly freed packets, to avoid DMA starvation.
+        * If any avail callback functions are registered, send a notification
+        * that a new packet is available in the pool.
+        */
+       if (pktp->cbcnt) {
+               /* To more efficiently use the cpu cycles, callbacks can be temporarily disabled.
+                * This allows to feed on burst basis as opposed to inefficient per-packet basis.
+                */
+               if (pktp->emptycb_disable == EMPTYCB_ENABLED) {
+                       /**
+                        * If the call originated from pktpool_empty_notify, the just freed packet
+                        * is needed in pktpool_get.
+                        * Therefore don't call pktpool_avail_notify.
+                        */
+                       if (pktp->empty == FALSE)
+                               pktpool_avail_notify(pktp);
+               } else {
+                       /**
+                        * The callback is temporarily disabled, log that a packet has been freed.
+                        */
+                       pktp->emptycb_disable = EMPTYCB_SKIPPED;
+               }
+       }
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return;
+}
+
+int
+pktpool_add(pktpool_t *pktp, void *p)
+{
+       int err = 0;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       ASSERT(p != NULL);
+
+       if (pktp->len == pktp->maxlen) {
+               err = BCME_RANGE;
+               goto done;
+       }
+
+       /* pkts in pool have same length */
+       ASSERT(pktp->plen == PKTLEN(OSH_NULL, p));
+       PKTSETPOOL(OSH_NULL, p, TRUE, pktp);
+
+       pktp->len++;
+       pktpool_enq(pktp, p);
+
+#ifdef BCMDBG_POOL
+       pktp->dbg_q[pktp->dbg_qlen++].p = p;
+#endif
+
+done:
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       return err;
+}
+
+/* Force pktpool_setmaxlen () into RAM as it uses a constant
+ * (PKTPOOL_LEN_MAX) that may be changed post tapeout for ROM-based chips.
+ */
+int
+BCMRAMFN(pktpool_setmaxlen)(pktpool_t *pktp, uint16 maxlen)
+{
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_ACQUIRE(&pktp->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       if (maxlen > PKTPOOL_LEN_MAX)
+               maxlen = PKTPOOL_LEN_MAX;
+
+       /* if pool is already beyond maxlen, then just cap it
+        * since we currently do not reduce the pool len
+        * already allocated
+        */
+       pktp->maxlen = (pktp->len > maxlen) ? pktp->len : maxlen;
+
+       /* protect shared resource */
+       if (HND_PKTPOOL_MUTEX_RELEASE(&pktp->mutex) != OSL_EXT_SUCCESS)
+               return BCME_ERROR;
+
+       return pktp->maxlen;
+}
+
+void
+pktpool_emptycb_disable(pktpool_t *pktp, bool disable)
+{
+       ASSERT(pktp);
+
+       /**
+        * To more efficiently use the cpu cycles, callbacks can be temporarily disabled.
+        * If callback is going to be re-enabled, check if any packet got
+        * freed and added back to the pool while callback was disabled.
+        * When this is the case do the callback now, provided that callback functions
+        * are registered and this call did not originate from pktpool_empty_notify.
+        */
+       if ((!disable) && (pktp->cbcnt) && (pktp->empty == FALSE) &&
+               (pktp->emptycb_disable == EMPTYCB_SKIPPED)) {
+                       pktpool_avail_notify(pktp);
+       }
+
+       /* Enable or temporarily disable callback when packet becomes available. */
+       pktp->emptycb_disable = disable ? EMPTYCB_DISABLED : EMPTYCB_ENABLED;
+}
+
+bool
+pktpool_emptycb_disabled(pktpool_t *pktp)
+{
+       ASSERT(pktp);
+       return pktp->emptycb_disable != EMPTYCB_ENABLED;
+}
+
+#ifdef BCMPKTPOOL
+#include <hnd_lbuf.h>
+
+pktpool_t *pktpool_shared = NULL;
+
+#ifdef BCMFRAGPOOL
+pktpool_t *pktpool_shared_lfrag = NULL;
+#endif /* BCMFRAGPOOL */
+
+pktpool_t *pktpool_shared_rxlfrag = NULL;
+
+static osl_t *pktpool_osh = NULL;
+
+void
+hnd_pktpool_init(osl_t *osh)
+{
+       int n;
+
+       /* Construct a packet pool registry before initializing packet pools */
+       n = pktpool_attach(osh, PKTPOOL_MAXIMUM_ID);
+       if (n != PKTPOOL_MAXIMUM_ID) {
+               ASSERT(0);
+               return;
+       }
+
+       pktpool_shared = MALLOCZ(osh, sizeof(pktpool_t));
+       if (pktpool_shared == NULL) {
+               ASSERT(0);
+               goto error1;
+       }
+
+#if defined(BCMFRAGPOOL) && !defined(BCMFRAGPOOL_DISABLED)
+       pktpool_shared_lfrag = MALLOCZ(osh, sizeof(pktpool_t));
+       if (pktpool_shared_lfrag == NULL) {
+               ASSERT(0);
+               goto error2;
+       }
+#endif
+
+#if defined(BCMRXFRAGPOOL) && !defined(BCMRXFRAGPOOL_DISABLED)
+       pktpool_shared_rxlfrag = MALLOCZ(osh, sizeof(pktpool_t));
+       if (pktpool_shared_rxlfrag == NULL) {
+               ASSERT(0);
+               goto error3;
+       }
+#endif
+
+
+       /*
+        * At this early stage, there's not enough memory to allocate all
+        * requested pkts in the shared pool.  Need to add to the pool
+        * after reclaim
+        *
+        * n = NRXBUFPOST + SDPCMD_RXBUFS;
+        *
+        * Initialization of packet pools may fail (BCME_ERROR), if the packet pool
+        * registry is not initialized or the registry is depleted.
+        *
+        * A BCME_NOMEM error only indicates that the requested number of packets
+        * were not filled into the pool.
+        */
+       n = 1;
+       if (pktpool_init(osh, pktpool_shared,
+                        &n, PKTBUFSZ, FALSE, lbuf_basic) == BCME_ERROR) {
+               ASSERT(0);
+               goto error4;
+       }
+       pktpool_setmaxlen(pktpool_shared, SHARED_POOL_LEN);
+
+#if defined(BCMFRAGPOOL) && !defined(BCMFRAGPOOL_DISABLED)
+       n = 1;
+       if (pktpool_init(osh, pktpool_shared_lfrag,
+                        &n, PKTFRAGSZ, TRUE, lbuf_frag) == BCME_ERROR) {
+               ASSERT(0);
+               goto error5;
+       }
+       pktpool_setmaxlen(pktpool_shared_lfrag, SHARED_FRAG_POOL_LEN);
+#endif
+#if defined(BCMRXFRAGPOOL) && !defined(BCMRXFRAGPOOL_DISABLED)
+       n = 1;
+       if (pktpool_init(osh, pktpool_shared_rxlfrag,
+                        &n, PKTRXFRAGSZ, TRUE, lbuf_rxfrag) == BCME_ERROR) {
+               ASSERT(0);
+               goto error6;
+       }
+       pktpool_setmaxlen(pktpool_shared_rxlfrag, SHARED_RXFRAG_POOL_LEN);
+#endif
+
+       pktpool_osh = osh;
+
+       return;
+
+#if defined(BCMRXFRAGPOOL) && !defined(BCMRXFRAGPOOL_DISABLED)
+error6:
+#endif
+
+#if defined(BCMFRAGPOOL) && !defined(BCMFRAGPOOL_DISABLED)
+       pktpool_deinit(osh, pktpool_shared_lfrag);
+error5:
+#endif
+
+#if (defined(BCMRXFRAGPOOL) && !defined(BCMRXFRAGPOOL_DISABLED)) || \
+       (defined(BCMFRAGPOOL) && !defined(BCMFRAGPOOL_DISABLED))
+       pktpool_deinit(osh, pktpool_shared);
+#endif
+
+error4:
+#if defined(BCMRXFRAGPOOL) && !defined(BCMRXFRAGPOOL_DISABLED)
+       hnd_free(pktpool_shared_rxlfrag);
+       pktpool_shared_rxlfrag = (pktpool_t *)NULL;
+error3:
+#endif /* BCMRXFRAGPOOL */
+
+#if defined(BCMFRAGPOOL) && !defined(BCMFRAGPOOL_DISABLED)
+       hnd_free(pktpool_shared_lfrag);
+       pktpool_shared_lfrag = (pktpool_t *)NULL;
+error2:
+#endif /* BCMFRAGPOOL */
+
+       hnd_free(pktpool_shared);
+       pktpool_shared = (pktpool_t *)NULL;
+
+error1:
+       pktpool_dettach(osh);
+}
+
+void
+hnd_pktpool_fill(pktpool_t *pktpool, bool minimal)
+{
+       pktpool_fill(pktpool_osh, pktpool, minimal);
+}
+
+/* refill pktpools after reclaim */
+void
+hnd_pktpool_refill(bool minimal)
+{
+       if (POOL_ENAB(pktpool_shared)) {
+               pktpool_fill(pktpool_osh, pktpool_shared, minimal);
+       }
+/* fragpool reclaim */
+#ifdef BCMFRAGPOOL
+       if (POOL_ENAB(pktpool_shared_lfrag)) {
+               pktpool_fill(pktpool_osh, pktpool_shared_lfrag, minimal);
+       }
+#endif /* BCMFRAGPOOL */
+/* rx fragpool reclaim */
+#ifdef BCMRXFRAGPOOL
+       if (POOL_ENAB(pktpool_shared_rxlfrag)) {
+               pktpool_fill(pktpool_osh, pktpool_shared_rxlfrag, minimal);
+       }
+#endif
+}
+#endif /* BCMPKTPOOL */
diff --git a/drivers/net/wireless/bcmdhd_1363/hnd_pktq.c b/drivers/net/wireless/bcmdhd_1363/hnd_pktq.c
new file mode 100644 (file)
index 0000000..269dd32
--- /dev/null
@@ -0,0 +1,886 @@
+/*
+ * HND generic pktq operation primitives
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: hnd_pktq.c 657686 2016-09-02 06:39:10Z $
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+#include <osl_ext.h>
+#include <bcmutils.h>
+#include <hnd_pktq.h>
+
+/* mutex macros for thread safe */
+#ifdef HND_PKTQ_THREAD_SAFE
+#define HND_PKTQ_MUTEX_CREATE(name, mutex)     osl_ext_mutex_create(name, mutex)
+#define HND_PKTQ_MUTEX_DELETE(mutex)           osl_ext_mutex_delete(mutex)
+#define HND_PKTQ_MUTEX_ACQUIRE(mutex, msec)    osl_ext_mutex_acquire(mutex, msec)
+#define HND_PKTQ_MUTEX_RELEASE(mutex)          osl_ext_mutex_release(mutex)
+#else
+#define HND_PKTQ_MUTEX_CREATE(name, mutex)     OSL_EXT_SUCCESS
+#define HND_PKTQ_MUTEX_DELETE(mutex)           OSL_EXT_SUCCESS
+#define HND_PKTQ_MUTEX_ACQUIRE(mutex, msec)    OSL_EXT_SUCCESS
+#define HND_PKTQ_MUTEX_RELEASE(mutex)          OSL_EXT_SUCCESS
+#endif
+
+/*
+ * osl multiple-precedence packet queue
+ * hi_prec is always >= the number of the highest non-empty precedence
+ */
+void * BCMFASTPATH
+pktq_penq(struct pktq *pq, int prec, void *p)
+{
+       struct pktq_prec *q;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       ASSERT(prec >= 0 && prec < pq->num_prec);
+       ASSERT(PKTLINK(p) == NULL);             /* queueing chains not allowed */
+
+       ASSERT(!pktq_full(pq));
+       ASSERT(!pktq_pfull(pq, prec));
+
+       q = &pq->q[prec];
+
+       if (q->head)
+               PKTSETLINK(q->tail, p);
+       else
+               q->head = p;
+
+       q->tail = p;
+       q->len++;
+
+       pq->len++;
+
+       if (pq->hi_prec < prec)
+               pq->hi_prec = (uint8)prec;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+void * BCMFASTPATH
+pktq_penq_head(struct pktq *pq, int prec, void *p)
+{
+       struct pktq_prec *q;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       ASSERT(prec >= 0 && prec < pq->num_prec);
+       ASSERT(PKTLINK(p) == NULL);             /* queueing chains not allowed */
+
+       ASSERT(!pktq_full(pq));
+       ASSERT(!pktq_pfull(pq, prec));
+
+       q = &pq->q[prec];
+
+       if (q->head == NULL)
+               q->tail = p;
+
+       PKTSETLINK(p, q->head);
+       q->head = p;
+       q->len++;
+
+       pq->len++;
+
+       if (pq->hi_prec < prec)
+               pq->hi_prec = (uint8)prec;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+/*
+ * Append spktq 'list' to the tail of pktq 'pq'
+ */
+void BCMFASTPATH
+pktq_append(struct pktq *pq, int prec, struct spktq *list)
+{
+       struct pktq_prec *q;
+       struct pktq_prec *list_q;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return;
+
+       list_q = &list->q[0];
+
+       /* empty list check */
+       if (list_q->head == NULL)
+               goto done;
+
+       ASSERT(prec >= 0 && prec < pq->num_prec);
+       ASSERT(PKTLINK(list_q->tail) == NULL);         /* terminated list */
+
+       ASSERT(!pktq_full(pq));
+       ASSERT(!pktq_pfull(pq, prec));
+
+       q = &pq->q[prec];
+
+       if (q->head)
+               PKTSETLINK(q->tail, list_q->head);
+       else
+               q->head = list_q->head;
+
+       q->tail = list_q->tail;
+       q->len += list_q->len;
+       pq->len += list_q->len;
+
+       if (pq->hi_prec < prec)
+               pq->hi_prec = (uint8)prec;
+
+       list_q->head = NULL;
+       list_q->tail = NULL;
+       list_q->len = 0;
+       list->len = 0;
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return;
+}
+
+/*
+ * Prepend spktq 'list' to the head of pktq 'pq'
+ */
+void BCMFASTPATH
+pktq_prepend(struct pktq *pq, int prec, struct spktq *list)
+{
+       struct pktq_prec *q;
+       struct pktq_prec *list_q;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return;
+
+       list_q = &list->q[0];
+
+       /* empty list check */
+       if (list_q->head == NULL)
+               goto done;
+
+       ASSERT(prec >= 0 && prec < pq->num_prec);
+       ASSERT(PKTLINK(list_q->tail) == NULL);         /* terminated list */
+
+       ASSERT(!pktq_full(pq));
+       ASSERT(!pktq_pfull(pq, prec));
+
+       q = &pq->q[prec];
+
+       /* set the tail packet of list to point at the former pq head */
+       PKTSETLINK(list_q->tail, q->head);
+       /* the new q head is the head of list */
+       q->head = list_q->head;
+
+       /* If the q tail was non-null, then it stays as is.
+        * If the q tail was null, it is now the tail of list
+        */
+       if (q->tail == NULL) {
+               q->tail = list_q->tail;
+       }
+
+       q->len += list_q->len;
+       pq->len += list_q->len;
+
+       if (pq->hi_prec < prec)
+               pq->hi_prec = (uint8)prec;
+
+       list_q->head = NULL;
+       list_q->tail = NULL;
+       list_q->len = 0;
+       list->len = 0;
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return;
+}
+
+void * BCMFASTPATH
+pktq_pdeq(struct pktq *pq, int prec)
+{
+       struct pktq_prec *q;
+       void *p;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       ASSERT(prec >= 0 && prec < pq->num_prec);
+
+       q = &pq->q[prec];
+
+       if ((p = q->head) == NULL)
+               goto done;
+
+       if ((q->head = PKTLINK(p)) == NULL)
+               q->tail = NULL;
+
+       q->len--;
+
+       pq->len--;
+
+       PKTSETLINK(p, NULL);
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+void * BCMFASTPATH
+pktq_pdeq_prev(struct pktq *pq, int prec, void *prev_p)
+{
+       struct pktq_prec *q;
+       void *p = NULL;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       ASSERT(prec >= 0 && prec < pq->num_prec);
+
+       q = &pq->q[prec];
+
+       if (prev_p == NULL)
+               goto done;
+
+       if ((p = PKTLINK(prev_p)) == NULL)
+               goto done;
+
+       q->len--;
+
+       pq->len--;
+
+       PKTSETLINK(prev_p, PKTLINK(p));
+       PKTSETLINK(p, NULL);
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+void * BCMFASTPATH
+pktq_pdeq_with_fn(struct pktq *pq, int prec, ifpkt_cb_t fn, int arg)
+{
+       struct pktq_prec *q;
+       void *p, *prev = NULL;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       ASSERT(prec >= 0 && prec < pq->num_prec);
+
+       q = &pq->q[prec];
+       p = q->head;
+
+       while (p) {
+               if (fn == NULL || (*fn)(p, arg)) {
+                       break;
+               } else {
+                       prev = p;
+                       p = PKTLINK(p);
+               }
+       }
+       if (p == NULL)
+               goto done;
+
+       if (prev == NULL) {
+               if ((q->head = PKTLINK(p)) == NULL) {
+                       q->tail = NULL;
+               }
+       } else {
+               PKTSETLINK(prev, PKTLINK(p));
+               if (q->tail == p) {
+                       q->tail = prev;
+               }
+       }
+
+       q->len--;
+
+       pq->len--;
+
+       PKTSETLINK(p, NULL);
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+void * BCMFASTPATH
+pktq_pdeq_tail(struct pktq *pq, int prec)
+{
+       struct pktq_prec *q;
+       void *p, *prev;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       ASSERT(prec >= 0 && prec < pq->num_prec);
+
+       q = &pq->q[prec];
+
+       if ((p = q->head) == NULL)
+               goto done;
+
+       for (prev = NULL; p != q->tail; p = PKTLINK(p))
+               prev = p;
+
+       if (prev)
+               PKTSETLINK(prev, NULL);
+       else
+               q->head = NULL;
+
+       q->tail = prev;
+       q->len--;
+
+       pq->len--;
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+void
+pktq_pflush(osl_t *osh, struct pktq *pq, int prec, bool dir, ifpkt_cb_t fn, int arg)
+{
+       struct pktq_prec *q;
+       void *p, *next, *prev = NULL;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return;
+
+       q = &pq->q[prec];
+       p = q->head;
+       while (p) {
+               next = PKTLINK(p);
+               if (fn == NULL || (*fn)(p, arg)) {
+                       bool head = (p == q->head);
+                       if (head)
+                               q->head = next;
+                       else
+                               PKTSETLINK(prev, next);
+                       PKTSETLINK(p, NULL);
+                       PKTFREE(osh, p, dir);
+                       q->len--;
+                       pq->len--;
+               } else {
+                       prev = p;
+               }
+               p = next;
+       }
+
+       q->tail = prev;
+
+       if (q->head == NULL) {
+               ASSERT(q->len == 0);
+               ASSERT(q->tail == NULL);
+       }
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return;
+}
+
+bool BCMFASTPATH
+pktq_pdel(struct pktq *pq, void *pktbuf, int prec)
+{
+       bool ret = FALSE;
+       struct pktq_prec *q;
+       void *p = NULL;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return FALSE;
+
+       ASSERT(prec >= 0 && prec < pq->num_prec);
+
+       /* Should this just assert pktbuf? */
+       if (!pktbuf)
+               goto done;
+
+       q = &pq->q[prec];
+
+       if (q->head == pktbuf) {
+               if ((q->head = PKTLINK(pktbuf)) == NULL)
+                       q->tail = NULL;
+       } else {
+               for (p = q->head; p && PKTLINK(p) != pktbuf; p = PKTLINK(p))
+                       ;
+               if (p == NULL)
+                       goto done;
+
+               PKTSETLINK(p, PKTLINK(pktbuf));
+               if (q->tail == pktbuf)
+                       q->tail = p;
+       }
+
+       q->len--;
+       pq->len--;
+       PKTSETLINK(pktbuf, NULL);
+       ret = TRUE;
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return FALSE;
+
+       return ret;
+}
+
+bool
+pktq_init(struct pktq *pq, int num_prec, int max_len)
+{
+       int prec;
+
+       if (HND_PKTQ_MUTEX_CREATE("pktq", &pq->mutex) != OSL_EXT_SUCCESS)
+               return FALSE;
+
+       ASSERT(num_prec > 0 && num_prec <= PKTQ_MAX_PREC);
+
+       /* pq is variable size; only zero out what's requested */
+       bzero(pq, OFFSETOF(struct pktq, q) + (sizeof(struct pktq_prec) * num_prec));
+
+       pq->num_prec = (uint16)num_prec;
+
+       pq->max = (uint16)max_len;
+
+       for (prec = 0; prec < num_prec; prec++)
+               pq->q[prec].max = pq->max;
+
+       return TRUE;
+}
+
+bool
+pktq_deinit(struct pktq *pq)
+{
+       if (HND_PKTQ_MUTEX_DELETE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return FALSE;
+
+       return TRUE;
+}
+
+void
+pktq_set_max_plen(struct pktq *pq, int prec, int max_len)
+{
+       ASSERT(prec >= 0 && prec < pq->num_prec);
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return;
+
+       if (prec < pq->num_prec)
+               pq->q[prec].max = (uint16)max_len;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return;
+}
+
+void * BCMFASTPATH
+pktq_deq(struct pktq *pq, int *prec_out)
+{
+       struct pktq_prec *q;
+       void *p = NULL;
+       int prec;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       if (pq->len == 0)
+               goto done;
+
+       while ((prec = pq->hi_prec) > 0 && pq->q[prec].head == NULL)
+               pq->hi_prec--;
+
+       q = &pq->q[prec];
+
+       if ((p = q->head) == NULL)
+               goto done;
+
+       if ((q->head = PKTLINK(p)) == NULL)
+               q->tail = NULL;
+
+       q->len--;
+
+       pq->len--;
+
+       if (prec_out)
+               *prec_out = prec;
+
+       PKTSETLINK(p, NULL);
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+void * BCMFASTPATH
+pktq_deq_tail(struct pktq *pq, int *prec_out)
+{
+       struct pktq_prec *q;
+       void *p = NULL, *prev;
+       int prec;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       if (pq->len == 0)
+               goto done;
+
+       for (prec = 0; prec < pq->hi_prec; prec++)
+               if (pq->q[prec].head)
+                       break;
+
+       q = &pq->q[prec];
+
+       if ((p = q->head) == NULL)
+               goto done;
+
+       for (prev = NULL; p != q->tail; p = PKTLINK(p))
+               prev = p;
+
+       if (prev)
+               PKTSETLINK(prev, NULL);
+       else
+               q->head = NULL;
+
+       q->tail = prev;
+       q->len--;
+
+       pq->len--;
+
+       if (prec_out)
+               *prec_out = prec;
+
+       PKTSETLINK(p, NULL);
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+void *
+pktq_peek(struct pktq *pq, int *prec_out)
+{
+       int prec;
+       void *p = NULL;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       if (pq->len == 0)
+               goto done;
+
+       while ((prec = pq->hi_prec) > 0 && pq->q[prec].head == NULL)
+               pq->hi_prec--;
+
+       if (prec_out)
+               *prec_out = prec;
+
+       p = pq->q[prec].head;
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+void *
+pktq_peek_tail(struct pktq *pq, int *prec_out)
+{
+       int prec;
+       void *p = NULL;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       if (pq->len == 0)
+               goto done;
+
+       for (prec = 0; prec < pq->hi_prec; prec++)
+               if (pq->q[prec].head)
+                       break;
+
+       if (prec_out)
+               *prec_out = prec;
+
+       p = pq->q[prec].tail;
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+void
+pktq_flush(osl_t *osh, struct pktq *pq, bool dir, ifpkt_cb_t fn, int arg)
+{
+       int prec;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return;
+
+       /* Optimize flush, if pktq len = 0, just return.
+        * pktq len of 0 means pktq's prec q's are all empty.
+        */
+       if (pq->len == 0)
+               goto done;
+
+       for (prec = 0; prec < pq->num_prec; prec++)
+               pktq_pflush(osh, pq, prec, dir, fn, arg);
+       if (fn == NULL)
+               ASSERT(pq->len == 0);
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return;
+}
+
+/* Return sum of lengths of a specific set of precedences */
+int
+pktq_mlen(struct pktq *pq, uint prec_bmp)
+{
+       int prec, len;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return 0;
+
+       len = 0;
+
+       for (prec = 0; prec <= pq->hi_prec; prec++)
+               if (prec_bmp & (1 << prec))
+                       len += pq->q[prec].len;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return 0;
+
+       return len;
+}
+
+/* Priority peek from a specific set of precedences */
+void * BCMFASTPATH
+pktq_mpeek(struct pktq *pq, uint prec_bmp, int *prec_out)
+{
+       struct pktq_prec *q;
+       void *p = NULL;
+       int prec;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       if (pq->len == 0)
+               goto done;
+
+       while ((prec = pq->hi_prec) > 0 && pq->q[prec].head == NULL)
+               pq->hi_prec--;
+
+       while ((prec_bmp & (1 << prec)) == 0 || pq->q[prec].head == NULL)
+               if (prec-- == 0)
+                       goto done;
+
+       q = &pq->q[prec];
+
+       if ((p = q->head) == NULL)
+               goto done;
+
+       if (prec_out)
+               *prec_out = prec;
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+/* Priority dequeue from a specific set of precedences */
+void * BCMFASTPATH
+pktq_mdeq(struct pktq *pq, uint prec_bmp, int *prec_out)
+{
+       struct pktq_prec *q;
+       void *p = NULL;
+       int prec;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       if (pq->len == 0)
+               goto done;
+
+       while ((prec = pq->hi_prec) > 0 && pq->q[prec].head == NULL)
+               pq->hi_prec--;
+
+       while ((pq->q[prec].head == NULL) || ((prec_bmp & (1 << prec)) == 0))
+               if (prec-- == 0)
+                       goto done;
+
+       q = &pq->q[prec];
+
+       if ((p = q->head) == NULL)
+               goto done;
+
+       if ((q->head = PKTLINK(p)) == NULL)
+               q->tail = NULL;
+
+       q->len--;
+
+       if (prec_out)
+               *prec_out = prec;
+
+       pq->len--;
+
+       PKTSETLINK(p, NULL);
+
+done:
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return NULL;
+
+       return p;
+}
+
+#ifdef HND_PKTQ_THREAD_SAFE
+int
+pktq_pavail(struct pktq *pq, int prec)
+{
+       int ret;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return 0;
+
+       ASSERT(prec >= 0 && prec < pq->num_prec);
+
+       ret = pq->q[prec].max - pq->q[prec].len;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return 0;
+
+       return ret;
+}
+
+bool
+pktq_pfull(struct pktq *pq, int prec)
+{
+       bool ret;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return FALSE;
+
+       ASSERT(prec >= 0 && prec < pq->num_prec);
+
+       ret = pq->q[prec].len >= pq->q[prec].max;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return FALSE;
+
+       return ret;
+}
+
+int
+pktq_avail(struct pktq *pq)
+{
+       int ret;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return 0;
+
+       ret = pq->max - pq->len;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return 0;
+
+       return ret;
+}
+
+bool
+pktq_full(struct pktq *pq)
+{
+       bool ret;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_ACQUIRE(&pq->mutex, OSL_EXT_TIME_FOREVER) != OSL_EXT_SUCCESS)
+               return FALSE;
+
+       ret = pq->len >= pq->max;
+
+       /* protect shared resource */
+       if (HND_PKTQ_MUTEX_RELEASE(&pq->mutex) != OSL_EXT_SUCCESS)
+               return FALSE;
+
+       return ret;
+}
+#endif /* HND_PKTQ_THREAD_SAFE */
diff --git a/drivers/net/wireless/bcmdhd_1363/hndpmu.c b/drivers/net/wireless/bcmdhd_1363/hndpmu.c
new file mode 100644 (file)
index 0000000..2501887
--- /dev/null
@@ -0,0 +1,292 @@
+/*
+ * Misc utility routines for accessing PMU corerev specific features
+ * of the SiliconBackplane-based Broadcom chips.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: hndpmu.c 530092 2015-01-29 04:44:58Z $
+ */
+
+
+/*
+ * Note: this file contains PLL/FLL related functions. A chip can contain multiple PLLs/FLLs.
+ * However, in the context of this file the baseband ('BB') PLL/FLL is referred to.
+ *
+ * Throughout this code, the prefixes 'pmu0_', 'pmu1_' and 'pmu2_' are used.
+ * They refer to different revisions of the PMU (which is at revision 18 @ Apr 25, 2012)
+ * pmu1_ marks the transition from PLL to ADFLL (Digital Frequency Locked Loop). It supports
+ * fractional frequency generation. pmu2_ does not support fractional frequency generation.
+ */
+
+#include <bcm_cfg.h>
+#include <typedefs.h>
+#include <bcmdefs.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <siutils.h>
+#include <bcmdevs.h>
+#include <hndsoc.h>
+#include <sbchipc.h>
+#include <hndpmu.h>
+
+#define        PMU_ERROR(args)
+
+#define        PMU_MSG(args)
+
+/* To check in verbose debugging messages not intended
+ * to be on except on private builds.
+ */
+#define        PMU_NONE(args)
+
+/** contains resource bit positions for a specific chip */
+struct rsc_per_chip_s {
+       uint8 ht_avail;
+       uint8 macphy_clkavail;
+       uint8 ht_start;
+       uint8 otp_pu;
+};
+
+typedef struct rsc_per_chip_s rsc_per_chip_t;
+
+
+/* SDIO Pad drive strength to select value mappings.
+ * The last strength value in each table must be 0 (the tri-state value).
+ */
+typedef struct {
+       uint8 strength;                 /* Pad Drive Strength in mA */
+       uint8 sel;                      /* Chip-specific select value */
+} sdiod_drive_str_t;
+
+/* SDIO Drive Strength to sel value table for PMU Rev 1 */
+static const sdiod_drive_str_t sdiod_drive_strength_tab1[] = {
+       {4, 0x2},
+       {2, 0x3},
+       {1, 0x0},
+       {0, 0x0} };
+
+/* SDIO Drive Strength to sel value table for PMU Rev 2, 3 */
+static const sdiod_drive_str_t sdiod_drive_strength_tab2[] = {
+       {12, 0x7},
+       {10, 0x6},
+       {8, 0x5},
+       {6, 0x4},
+       {4, 0x2},
+       {2, 0x1},
+       {0, 0x0} };
+
+/* SDIO Drive Strength to sel value table for PMU Rev 8 (1.8V) */
+static const sdiod_drive_str_t sdiod_drive_strength_tab3[] = {
+       {32, 0x7},
+       {26, 0x6},
+       {22, 0x5},
+       {16, 0x4},
+       {12, 0x3},
+       {8, 0x2},
+       {4, 0x1},
+       {0, 0x0} };
+
+/* SDIO Drive Strength to sel value table for PMU Rev 11 (1.8v) */
+static const sdiod_drive_str_t sdiod_drive_strength_tab4_1v8[] = {
+       {32, 0x6},
+       {26, 0x7},
+       {22, 0x4},
+       {16, 0x5},
+       {12, 0x2},
+       {8, 0x3},
+       {4, 0x0},
+       {0, 0x1} };
+
+/* SDIO Drive Strength to sel value table for PMU Rev 11 (1.2v) */
+
+/* SDIO Drive Strength to sel value table for PMU Rev 11 (2.5v) */
+
+/* SDIO Drive Strength to sel value table for PMU Rev 13 (1.8v) */
+static const sdiod_drive_str_t sdiod_drive_strength_tab5_1v8[] = {
+       {6, 0x7},
+       {5, 0x6},
+       {4, 0x5},
+       {3, 0x4},
+       {2, 0x2},
+       {1, 0x1},
+       {0, 0x0} };
+
+/* SDIO Drive Strength to sel value table for PMU Rev 13 (3.3v) */
+
+/** SDIO Drive Strength to sel value table for PMU Rev 17 (1.8v) */
+static const sdiod_drive_str_t sdiod_drive_strength_tab6_1v8[] = {
+       {3, 0x3},
+       {2, 0x2},
+       {1, 0x1},
+       {0, 0x0} };
+
+
+/**
+ * SDIO Drive Strength to sel value table for 43143 PMU Rev 17, see Confluence 43143 Toplevel
+ * architecture page, section 'PMU Chip Control 1 Register definition', click link to picture
+ * BCM43143_sel_sdio_signals.jpg. Valid after PMU Chip Control 0 Register, bit31 (override) has
+ * been written '1'.
+ */
+#if !defined(BCM_SDIO_VDDIO) || BCM_SDIO_VDDIO == 33
+
+static const sdiod_drive_str_t sdiod_drive_strength_tab7_3v3[] = {
+       /* note: for 14, 10, 6 and 2mA hw timing is not met according to rtl team */
+       {16, 0x7},
+       {12, 0x5},
+       {8,  0x3},
+       {4,  0x1} }; /* note: 43143 does not support tristate */
+
+#else
+
+static const sdiod_drive_str_t sdiod_drive_strength_tab7_1v8[] = {
+       /* note: for 7, 5, 3 and 1mA hw timing is not met according to rtl team */
+       {8, 0x7},
+       {6, 0x5},
+       {4,  0x3},
+       {2,  0x1} }; /* note: 43143 does not support tristate */
+
+#endif /* BCM_SDIO_VDDIO */
+
+#define SDIOD_DRVSTR_KEY(chip, pmu)    (((chip) << 16) | (pmu))
+
+/**
+ * Balance between stable SDIO operation and power consumption is achieved using this function.
+ * Note that each drive strength table is for a specific VDDIO of the SDIO pads, ideally this
+ * function should read the VDDIO itself to select the correct table. For now it has been solved
+ * with the 'BCM_SDIO_VDDIO' preprocessor constant.
+ *
+ * 'drivestrength': desired pad drive strength in mA. Drive strength of 0 requests tri-state (if
+ *                 hardware supports this), if no hw support drive strength is not programmed.
+ */
+void
+si_sdiod_drive_strength_init(si_t *sih, osl_t *osh, uint32 drivestrength)
+{
+       sdiod_drive_str_t *str_tab = NULL;
+       uint32 str_mask = 0;    /* only alter desired bits in PMU chipcontrol 1 register */
+       uint32 str_shift = 0;
+       uint32 str_ovr_pmuctl = PMU_CHIPCTL0; /* PMU chipcontrol register containing override bit */
+       uint32 str_ovr_pmuval = 0;            /* position of bit within this register */
+       pmuregs_t *pmu;
+       uint origidx;
+
+       if (!(sih->cccaps & CC_CAP_PMU)) {
+               return;
+       }
+
+       /* Remember original core before switch to chipc/pmu */
+       origidx = si_coreidx(sih);
+       if (AOB_ENAB(sih)) {
+               pmu = si_setcore(sih, PMU_CORE_ID, 0);
+       } else {
+               pmu = si_setcoreidx(sih, SI_CC_IDX);
+       }
+       ASSERT(pmu != NULL);
+
+       switch (SDIOD_DRVSTR_KEY(CHIPID(sih->chip), sih->pmurev)) {
+       case SDIOD_DRVSTR_KEY(BCM4325_CHIP_ID, 1):
+               str_tab = (sdiod_drive_str_t *)&sdiod_drive_strength_tab1;
+               str_mask = 0x30000000;
+               str_shift = 28;
+               break;
+       case SDIOD_DRVSTR_KEY(BCM4325_CHIP_ID, 2):
+       case SDIOD_DRVSTR_KEY(BCM4325_CHIP_ID, 3):
+       case SDIOD_DRVSTR_KEY(BCM4315_CHIP_ID, 4):
+               str_tab = (sdiod_drive_str_t *)&sdiod_drive_strength_tab2;
+               str_mask = 0x00003800;
+               str_shift = 11;
+               break;
+       case SDIOD_DRVSTR_KEY(BCM4336_CHIP_ID, 8):
+       case SDIOD_DRVSTR_KEY(BCM4336_CHIP_ID, 11):
+               if (sih->pmurev == 8) {
+                       str_tab = (sdiod_drive_str_t *)&sdiod_drive_strength_tab3;
+               }
+               else if (sih->pmurev == 11) {
+                       str_tab = (sdiod_drive_str_t *)&sdiod_drive_strength_tab4_1v8;
+               }
+               str_mask = 0x00003800;
+               str_shift = 11;
+               break;
+       case SDIOD_DRVSTR_KEY(BCM4330_CHIP_ID, 12):
+               str_tab = (sdiod_drive_str_t *)&sdiod_drive_strength_tab4_1v8;
+               str_mask = 0x00003800;
+               str_shift = 11;
+               break;
+       case SDIOD_DRVSTR_KEY(BCM43362_CHIP_ID, 13):
+               str_tab = (sdiod_drive_str_t *)&sdiod_drive_strength_tab5_1v8;
+               str_mask = 0x00003800;
+               str_shift = 11;
+               break;
+       case SDIOD_DRVSTR_KEY(BCM4334_CHIP_ID, 17):
+               str_tab = (sdiod_drive_str_t *)&sdiod_drive_strength_tab6_1v8;
+               str_mask = 0x00001800;
+               str_shift = 11;
+               break;
+       case SDIOD_DRVSTR_KEY(BCM43143_CHIP_ID, 17):
+#if !defined(BCM_SDIO_VDDIO) || BCM_SDIO_VDDIO == 33
+               if (drivestrength >=  ARRAYLAST(sdiod_drive_strength_tab7_3v3)->strength) {
+                       str_tab = (sdiod_drive_str_t *)&sdiod_drive_strength_tab7_3v3;
+               }
+#else
+               if (drivestrength >=  ARRAYLAST(sdiod_drive_strength_tab7_1v8)->strength) {
+                       str_tab = (sdiod_drive_str_t *)&sdiod_drive_strength_tab7_1v8;
+               }
+#endif /* BCM_SDIO_VDDIO */
+               str_mask = 0x00000007;
+               str_ovr_pmuval = PMU43143_CC0_SDIO_DRSTR_OVR;
+               break;
+       default:
+               PMU_MSG(("No SDIO Drive strength init done for chip %s rev %d pmurev %d\n",
+                        bcm_chipname(
+                        CHIPID(sih->chip), chn, 8), CHIPREV(sih->chiprev), sih->pmurev));
+               break;
+       }
+
+       if (str_tab != NULL) {
+               uint32 cc_data_temp;
+               int i;
+
+               /* Pick the lowest available drive strength equal or greater than the
+                * requested strength.  Drive strength of 0 requests tri-state.
+                */
+               for (i = 0; drivestrength < str_tab[i].strength; i++)
+                       ;
+
+               if (i > 0 && drivestrength > str_tab[i].strength)
+                       i--;
+
+               W_REG(osh, &pmu->chipcontrol_addr, PMU_CHIPCTL1);
+               cc_data_temp = R_REG(osh, &pmu->chipcontrol_data);
+               cc_data_temp &= ~str_mask;
+               cc_data_temp |= str_tab[i].sel << str_shift;
+               W_REG(osh, &pmu->chipcontrol_data, cc_data_temp);
+               if (str_ovr_pmuval) { /* enables the selected drive strength */
+                       W_REG(osh,  &pmu->chipcontrol_addr, str_ovr_pmuctl);
+                       OR_REG(osh, &pmu->chipcontrol_data, str_ovr_pmuval);
+               }
+               PMU_MSG(("SDIO: %dmA drive strength requested; set to %dmA\n",
+                        drivestrength, str_tab[i].strength));
+       }
+
+       /* Return to original core */
+       si_setcoreidx(sih, origidx);
+} /* si_sdiod_drive_strength_init */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/aidmp.h b/drivers/net/wireless/bcmdhd_1363/include/aidmp.h
new file mode 100644 (file)
index 0000000..bd49c98
--- /dev/null
@@ -0,0 +1,402 @@
+/*
+ * Broadcom AMBA Interconnect definitions.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: aidmp.h 514727 2014-11-12 03:02:48Z $
+ */
+
+#ifndef        _AIDMP_H
+#define        _AIDMP_H
+
+/* Manufacturer Ids */
+#define        MFGID_ARM               0x43b
+#define        MFGID_BRCM              0x4bf
+#define        MFGID_MIPS              0x4a7
+
+/* Component Classes */
+#define        CC_SIM                  0
+#define        CC_EROM                 1
+#define        CC_CORESIGHT            9
+#define        CC_VERIF                0xb
+#define        CC_OPTIMO               0xd
+#define        CC_GEN                  0xe
+#define        CC_PRIMECELL            0xf
+
+/* Enumeration ROM registers */
+#define        ER_EROMENTRY            0x000
+#define        ER_REMAPCONTROL         0xe00
+#define        ER_REMAPSELECT          0xe04
+#define        ER_MASTERSELECT         0xe10
+#define        ER_ITCR                 0xf00
+#define        ER_ITIP                 0xf04
+
+/* Erom entries */
+#define        ER_TAG                  0xe
+#define        ER_TAG1                 0x6
+#define        ER_VALID                1
+#define        ER_CI                   0
+#define        ER_MP                   2
+#define        ER_ADD                  4
+#define        ER_END                  0xe
+#define        ER_BAD                  0xffffffff
+#define        ER_SZ_MAX               4096 /* 4KB */
+
+/* EROM CompIdentA */
+#define        CIA_MFG_MASK            0xfff00000
+#define        CIA_MFG_SHIFT           20
+#define        CIA_CID_MASK            0x000fff00
+#define        CIA_CID_SHIFT           8
+#define        CIA_CCL_MASK            0x000000f0
+#define        CIA_CCL_SHIFT           4
+
+/* EROM CompIdentB */
+#define        CIB_REV_MASK            0xff000000
+#define        CIB_REV_SHIFT           24
+#define        CIB_NSW_MASK            0x00f80000
+#define        CIB_NSW_SHIFT           19
+#define        CIB_NMW_MASK            0x0007c000
+#define        CIB_NMW_SHIFT           14
+#define        CIB_NSP_MASK            0x00003e00
+#define        CIB_NSP_SHIFT           9
+#define        CIB_NMP_MASK            0x000001f0
+#define        CIB_NMP_SHIFT           4
+
+/* EROM MasterPortDesc */
+#define        MPD_MUI_MASK            0x0000ff00
+#define        MPD_MUI_SHIFT           8
+#define        MPD_MP_MASK             0x000000f0
+#define        MPD_MP_SHIFT            4
+
+/* EROM AddrDesc */
+#define        AD_ADDR_MASK            0xfffff000
+#define        AD_SP_MASK              0x00000f00
+#define        AD_SP_SHIFT             8
+#define        AD_ST_MASK              0x000000c0
+#define        AD_ST_SHIFT             6
+#define        AD_ST_SLAVE             0x00000000
+#define        AD_ST_BRIDGE            0x00000040
+#define        AD_ST_SWRAP             0x00000080
+#define        AD_ST_MWRAP             0x000000c0
+#define        AD_SZ_MASK              0x00000030
+#define        AD_SZ_SHIFT             4
+#define        AD_SZ_4K                0x00000000
+#define        AD_SZ_8K                0x00000010
+#define        AD_SZ_16K               0x00000020
+#define        AD_SZ_SZD               0x00000030
+#define        AD_AG32                 0x00000008
+#define        AD_ADDR_ALIGN           0x00000fff
+#define        AD_SZ_BASE              0x00001000      /* 4KB */
+
+/* EROM SizeDesc */
+#define        SD_SZ_MASK              0xfffff000
+#define        SD_SG32                 0x00000008
+#define        SD_SZ_ALIGN             0x00000fff
+
+
+#if !defined(_LANGUAGE_ASSEMBLY) && !defined(__ASSEMBLY__)
+
+typedef volatile struct _aidmp {
+       uint32  oobselina30;    /* 0x000 */
+       uint32  oobselina74;    /* 0x004 */
+       uint32  PAD[6];
+       uint32  oobselinb30;    /* 0x020 */
+       uint32  oobselinb74;    /* 0x024 */
+       uint32  PAD[6];
+       uint32  oobselinc30;    /* 0x040 */
+       uint32  oobselinc74;    /* 0x044 */
+       uint32  PAD[6];
+       uint32  oobselind30;    /* 0x060 */
+       uint32  oobselind74;    /* 0x064 */
+       uint32  PAD[38];
+       uint32  oobselouta30;   /* 0x100 */
+       uint32  oobselouta74;   /* 0x104 */
+       uint32  PAD[6];
+       uint32  oobseloutb30;   /* 0x120 */
+       uint32  oobseloutb74;   /* 0x124 */
+       uint32  PAD[6];
+       uint32  oobseloutc30;   /* 0x140 */
+       uint32  oobseloutc74;   /* 0x144 */
+       uint32  PAD[6];
+       uint32  oobseloutd30;   /* 0x160 */
+       uint32  oobseloutd74;   /* 0x164 */
+       uint32  PAD[38];
+       uint32  oobsynca;       /* 0x200 */
+       uint32  oobseloutaen;   /* 0x204 */
+       uint32  PAD[6];
+       uint32  oobsyncb;       /* 0x220 */
+       uint32  oobseloutben;   /* 0x224 */
+       uint32  PAD[6];
+       uint32  oobsyncc;       /* 0x240 */
+       uint32  oobseloutcen;   /* 0x244 */
+       uint32  PAD[6];
+       uint32  oobsyncd;       /* 0x260 */
+       uint32  oobseloutden;   /* 0x264 */
+       uint32  PAD[38];
+       uint32  oobaextwidth;   /* 0x300 */
+       uint32  oobainwidth;    /* 0x304 */
+       uint32  oobaoutwidth;   /* 0x308 */
+       uint32  PAD[5];
+       uint32  oobbextwidth;   /* 0x320 */
+       uint32  oobbinwidth;    /* 0x324 */
+       uint32  oobboutwidth;   /* 0x328 */
+       uint32  PAD[5];
+       uint32  oobcextwidth;   /* 0x340 */
+       uint32  oobcinwidth;    /* 0x344 */
+       uint32  oobcoutwidth;   /* 0x348 */
+       uint32  PAD[5];
+       uint32  oobdextwidth;   /* 0x360 */
+       uint32  oobdinwidth;    /* 0x364 */
+       uint32  oobdoutwidth;   /* 0x368 */
+       uint32  PAD[37];
+       uint32  ioctrlset;      /* 0x400 */
+       uint32  ioctrlclear;    /* 0x404 */
+       uint32  ioctrl;         /* 0x408 */
+       uint32  PAD[61];
+       uint32  iostatus;       /* 0x500 */
+       uint32  PAD[127];
+       uint32  ioctrlwidth;    /* 0x700 */
+       uint32  iostatuswidth;  /* 0x704 */
+       uint32  PAD[62];
+       uint32  resetctrl;      /* 0x800 */
+       uint32  resetstatus;    /* 0x804 */
+       uint32  resetreadid;    /* 0x808 */
+       uint32  resetwriteid;   /* 0x80c */
+       uint32  PAD[60];
+       uint32  errlogctrl;     /* 0x900 */
+       uint32  errlogdone;     /* 0x904 */
+       uint32  errlogstatus;   /* 0x908 */
+       uint32  errlogaddrlo;   /* 0x90c */
+       uint32  errlogaddrhi;   /* 0x910 */
+       uint32  errlogid;       /* 0x914 */
+       uint32  errloguser;     /* 0x918 */
+       uint32  errlogflags;    /* 0x91c */
+       uint32  PAD[56];
+       uint32  intstatus;      /* 0xa00 */
+       uint32  PAD[255];
+       uint32  config;         /* 0xe00 */
+       uint32  PAD[63];
+       uint32  itcr;           /* 0xf00 */
+       uint32  PAD[3];
+       uint32  itipooba;       /* 0xf10 */
+       uint32  itipoobb;       /* 0xf14 */
+       uint32  itipoobc;       /* 0xf18 */
+       uint32  itipoobd;       /* 0xf1c */
+       uint32  PAD[4];
+       uint32  itipoobaout;    /* 0xf30 */
+       uint32  itipoobbout;    /* 0xf34 */
+       uint32  itipoobcout;    /* 0xf38 */
+       uint32  itipoobdout;    /* 0xf3c */
+       uint32  PAD[4];
+       uint32  itopooba;       /* 0xf50 */
+       uint32  itopoobb;       /* 0xf54 */
+       uint32  itopoobc;       /* 0xf58 */
+       uint32  itopoobd;       /* 0xf5c */
+       uint32  PAD[4];
+       uint32  itopoobain;     /* 0xf70 */
+       uint32  itopoobbin;     /* 0xf74 */
+       uint32  itopoobcin;     /* 0xf78 */
+       uint32  itopoobdin;     /* 0xf7c */
+       uint32  PAD[4];
+       uint32  itopreset;      /* 0xf90 */
+       uint32  PAD[15];
+       uint32  peripherialid4; /* 0xfd0 */
+       uint32  peripherialid5; /* 0xfd4 */
+       uint32  peripherialid6; /* 0xfd8 */
+       uint32  peripherialid7; /* 0xfdc */
+       uint32  peripherialid0; /* 0xfe0 */
+       uint32  peripherialid1; /* 0xfe4 */
+       uint32  peripherialid2; /* 0xfe8 */
+       uint32  peripherialid3; /* 0xfec */
+       uint32  componentid0;   /* 0xff0 */
+       uint32  componentid1;   /* 0xff4 */
+       uint32  componentid2;   /* 0xff8 */
+       uint32  componentid3;   /* 0xffc */
+} aidmp_t;
+
+#endif /* !_LANGUAGE_ASSEMBLY && !__ASSEMBLY__ */
+
+/* Out-of-band Router registers */
+#define        OOB_BUSCONFIG           0x020
+#define        OOB_STATUSA             0x100
+#define        OOB_STATUSB             0x104
+#define        OOB_STATUSC             0x108
+#define        OOB_STATUSD             0x10c
+#define        OOB_ENABLEA0            0x200
+#define        OOB_ENABLEA1            0x204
+#define        OOB_ENABLEA2            0x208
+#define        OOB_ENABLEA3            0x20c
+#define        OOB_ENABLEB0            0x280
+#define        OOB_ENABLEB1            0x284
+#define        OOB_ENABLEB2            0x288
+#define        OOB_ENABLEB3            0x28c
+#define        OOB_ENABLEC0            0x300
+#define        OOB_ENABLEC1            0x304
+#define        OOB_ENABLEC2            0x308
+#define        OOB_ENABLEC3            0x30c
+#define        OOB_ENABLED0            0x380
+#define        OOB_ENABLED1            0x384
+#define        OOB_ENABLED2            0x388
+#define        OOB_ENABLED3            0x38c
+#define        OOB_ITCR                0xf00
+#define        OOB_ITIPOOBA            0xf10
+#define        OOB_ITIPOOBB            0xf14
+#define        OOB_ITIPOOBC            0xf18
+#define        OOB_ITIPOOBD            0xf1c
+#define        OOB_ITOPOOBA            0xf30
+#define        OOB_ITOPOOBB            0xf34
+#define        OOB_ITOPOOBC            0xf38
+#define        OOB_ITOPOOBD            0xf3c
+
+/* DMP wrapper registers */
+#define        AI_OOBSELINA30          0x000
+#define        AI_OOBSELINA74          0x004
+#define        AI_OOBSELINB30          0x020
+#define        AI_OOBSELINB74          0x024
+#define        AI_OOBSELINC30          0x040
+#define        AI_OOBSELINC74          0x044
+#define        AI_OOBSELIND30          0x060
+#define        AI_OOBSELIND74          0x064
+#define        AI_OOBSELOUTA30         0x100
+#define        AI_OOBSELOUTA74         0x104
+#define        AI_OOBSELOUTB30         0x120
+#define        AI_OOBSELOUTB74         0x124
+#define        AI_OOBSELOUTC30         0x140
+#define        AI_OOBSELOUTC74         0x144
+#define        AI_OOBSELOUTD30         0x160
+#define        AI_OOBSELOUTD74         0x164
+#define        AI_OOBSYNCA             0x200
+#define        AI_OOBSELOUTAEN         0x204
+#define        AI_OOBSYNCB             0x220
+#define        AI_OOBSELOUTBEN         0x224
+#define        AI_OOBSYNCC             0x240
+#define        AI_OOBSELOUTCEN         0x244
+#define        AI_OOBSYNCD             0x260
+#define        AI_OOBSELOUTDEN         0x264
+#define        AI_OOBAEXTWIDTH         0x300
+#define        AI_OOBAINWIDTH          0x304
+#define        AI_OOBAOUTWIDTH         0x308
+#define        AI_OOBBEXTWIDTH         0x320
+#define        AI_OOBBINWIDTH          0x324
+#define        AI_OOBBOUTWIDTH         0x328
+#define        AI_OOBCEXTWIDTH         0x340
+#define        AI_OOBCINWIDTH          0x344
+#define        AI_OOBCOUTWIDTH         0x348
+#define        AI_OOBDEXTWIDTH         0x360
+#define        AI_OOBDINWIDTH          0x364
+#define        AI_OOBDOUTWIDTH         0x368
+
+
+#define        AI_IOCTRLSET            0x400
+#define        AI_IOCTRLCLEAR          0x404
+#define        AI_IOCTRL               0x408
+#define        AI_IOSTATUS             0x500
+#define        AI_RESETCTRL            0x800
+#define        AI_RESETSTATUS          0x804
+
+#define        AI_IOCTRLWIDTH          0x700
+#define        AI_IOSTATUSWIDTH        0x704
+
+#define        AI_RESETREADID          0x808
+#define        AI_RESETWRITEID         0x80c
+#define        AI_ERRLOGCTRL           0x900
+#define        AI_ERRLOGDONE           0x904
+#define        AI_ERRLOGSTATUS         0x908
+#define        AI_ERRLOGADDRLO         0x90c
+#define        AI_ERRLOGADDRHI         0x910
+#define        AI_ERRLOGID             0x914
+#define        AI_ERRLOGUSER           0x918
+#define        AI_ERRLOGFLAGS          0x91c
+#define        AI_INTSTATUS            0xa00
+#define        AI_CONFIG               0xe00
+#define        AI_ITCR                 0xf00
+#define        AI_ITIPOOBA             0xf10
+#define        AI_ITIPOOBB             0xf14
+#define        AI_ITIPOOBC             0xf18
+#define        AI_ITIPOOBD             0xf1c
+#define        AI_ITIPOOBAOUT          0xf30
+#define        AI_ITIPOOBBOUT          0xf34
+#define        AI_ITIPOOBCOUT          0xf38
+#define        AI_ITIPOOBDOUT          0xf3c
+#define        AI_ITOPOOBA             0xf50
+#define        AI_ITOPOOBB             0xf54
+#define        AI_ITOPOOBC             0xf58
+#define        AI_ITOPOOBD             0xf5c
+#define        AI_ITOPOOBAIN           0xf70
+#define        AI_ITOPOOBBIN           0xf74
+#define        AI_ITOPOOBCIN           0xf78
+#define        AI_ITOPOOBDIN           0xf7c
+#define        AI_ITOPRESET            0xf90
+#define        AI_PERIPHERIALID4       0xfd0
+#define        AI_PERIPHERIALID5       0xfd4
+#define        AI_PERIPHERIALID6       0xfd8
+#define        AI_PERIPHERIALID7       0xfdc
+#define        AI_PERIPHERIALID0       0xfe0
+#define        AI_PERIPHERIALID1       0xfe4
+#define        AI_PERIPHERIALID2       0xfe8
+#define        AI_PERIPHERIALID3       0xfec
+#define        AI_COMPONENTID0         0xff0
+#define        AI_COMPONENTID1         0xff4
+#define        AI_COMPONENTID2         0xff8
+#define        AI_COMPONENTID3         0xffc
+
+/* resetctrl */
+#define        AIRC_RESET              1
+
+/* errlogctrl */
+#define AIELC_TO_EXP_MASK      0x0000001f0             /* backplane timeout exponent */
+#define AIELC_TO_EXP_SHIFT     4
+#define AIELC_TO_ENAB_SHIFT    9                       /* backplane timeout enable */
+
+/* errlogdone */
+#define AIELD_ERRDONE_MASK     0x3
+
+/* errlogstatus */
+#define AIELS_TIMEOUT_MASK     0x3
+
+/* config */
+#define        AICFG_OOB               0x00000020
+#define        AICFG_IOS               0x00000010
+#define        AICFG_IOC               0x00000008
+#define        AICFG_TO                0x00000004
+#define        AICFG_ERRL              0x00000002
+#define        AICFG_RST               0x00000001
+
+/* bit defines for AI_OOBSELOUTB74 reg */
+#define OOB_SEL_OUTEN_B_5      15
+#define OOB_SEL_OUTEN_B_6      23
+
+/* AI_OOBSEL for A/B/C/D, 0-7 */
+#define AI_OOBSEL_MASK         0x1F
+#define AI_OOBSEL_0_SHIFT      0
+#define AI_OOBSEL_1_SHIFT      8
+#define AI_OOBSEL_2_SHIFT      16
+#define AI_OOBSEL_3_SHIFT      24
+#define AI_OOBSEL_4_SHIFT      0
+#define AI_OOBSEL_5_SHIFT      8
+#define AI_OOBSEL_6_SHIFT      16
+#define AI_OOBSEL_7_SHIFT      24
+#define AI_IOCTRL_ENABLE_D11_PME       (1 << 14)
+
+#endif /* _AIDMP_H */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/bcm_cfg.h b/drivers/net/wireless/bcmdhd_1363/include/bcm_cfg.h
new file mode 100644 (file)
index 0000000..12e3cb2
--- /dev/null
@@ -0,0 +1,32 @@
+/*
+ * BCM common config options
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcm_cfg.h 514727 2014-11-12 03:02:48Z $
+ */
+
+#ifndef _bcm_cfg_h_
+#define _bcm_cfg_h_
+#endif /* _bcm_cfg_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/bcm_mpool_pub.h b/drivers/net/wireless/bcmdhd_1363/include/bcm_mpool_pub.h
new file mode 100644 (file)
index 0000000..1e9a3ce
--- /dev/null
@@ -0,0 +1,364 @@
+/*
+ * Memory pools library, Public interface
+ *
+ * API Overview
+ *
+ * This package provides a memory allocation subsystem based on pools of
+ * homogenous objects.
+ *
+ * Instrumentation is available for reporting memory utilization both
+ * on a per-data-structure basis and system wide.
+ *
+ * There are two main types defined in this API.
+ *
+ *    pool manager: A singleton object that acts as a factory for
+ *                  pool allocators. It also is used for global
+ *                  instrumentation, such as reporting all blocks
+ *                  in use across all data structures. The pool manager
+ *                  creates and provides individual memory pools
+ *                  upon request to application code.
+ *
+ *    memory pool:  An object for allocating homogenous memory blocks.
+ *
+ * Global identifiers in this module use the following prefixes:
+ *    bcm_mpm_*     Memory pool manager
+ *    bcm_mp_*      Memory pool
+ *
+ * There are two main types of memory pools:
+ *
+ *    prealloc: The contiguous memory block of objects can either be supplied
+ *              by the client or malloc'ed by the memory manager. The objects are
+ *              allocated out of a block of memory and freed back to the block.
+ *
+ *    heap:     The memory pool allocator uses the heap (malloc/free) for memory.
+ *              In this case, the pool allocator is just providing statistics
+ *              and instrumentation on top of the heap, without modifying the heap
+ *              allocation implementation.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcm_mpool_pub.h 514727 2014-11-12 03:02:48Z $
+ */
+
+#ifndef _BCM_MPOOL_PUB_H
+#define _BCM_MPOOL_PUB_H 1
+
+#include <typedefs.h> /* needed for uint16 */
+
+
+/*
+**************************************************************************
+*
+* Type definitions, handles
+*
+**************************************************************************
+*/
+
+/* Forward declaration of OSL handle. */
+struct osl_info;
+
+/* Forward declaration of string buffer. */
+struct bcmstrbuf;
+
+/*
+ * Opaque type definition for the pool manager handle. This object is used for global
+ * memory pool operations such as obtaining a new pool, deleting a pool, iterating and
+ * instrumentation/debugging.
+ */
+struct bcm_mpm_mgr;
+typedef struct bcm_mpm_mgr *bcm_mpm_mgr_h;
+
+/*
+ * Opaque type definition for an instance of a pool. This handle is used for allocating
+ * and freeing memory through the pool, as well as management/instrumentation on this
+ * specific pool.
+ */
+struct bcm_mp_pool;
+typedef struct bcm_mp_pool *bcm_mp_pool_h;
+
+
+/*
+ * To make instrumentation more readable, every memory
+ * pool must have a readable name. Pool names are up to
+ * 8 bytes including '\0' termination. (7 printable characters.)
+ */
+#define BCM_MP_NAMELEN 8
+
+
+/*
+ * Type definition for pool statistics.
+ */
+typedef struct bcm_mp_stats {
+       char name[BCM_MP_NAMELEN];  /* Name of this pool. */
+       unsigned int objsz;         /* Object size allocated in this pool */
+       uint16 nobj;                /* Total number of objects in this pool */
+       uint16 num_alloc;           /* Number of objects currently allocated */
+       uint16 high_water;          /* Max number of allocated objects. */
+       uint16 failed_alloc;        /* Failed allocations. */
+} bcm_mp_stats_t;
+
+
+/*
+**************************************************************************
+*
+* API Routines on the pool manager.
+*
+**************************************************************************
+*/
+
+/*
+ * bcm_mpm_init() - initialize the whole memory pool system.
+ *
+ * Parameters:
+ *    osh:       INPUT  Operating system handle. Needed for heap memory allocation.
+ *    max_pools: INPUT Maximum number of mempools supported.
+ *    mgr:       OUTPUT The handle is written with the new pools manager object/handle.
+ *
+ * Returns:
+ *    BCME_OK     Object initialized successfully. May be used.
+ *    BCME_NOMEM  Initialization failed due to no memory. Object must not be used.
+ */
+int bcm_mpm_init(struct osl_info *osh, int max_pools, bcm_mpm_mgr_h *mgrp);
+
+
+/*
+ * bcm_mpm_deinit() - de-initialize the whole memory pool system.
+ *
+ * Parameters:
+ *    mgr:     INPUT  Pointer to pool manager handle.
+ *
+ * Returns:
+ *    BCME_OK  Memory pool manager successfully de-initialized.
+ *    other    Indicated error occured during de-initialization.
+ */
+int bcm_mpm_deinit(bcm_mpm_mgr_h *mgrp);
+
+/*
+ * bcm_mpm_create_prealloc_pool() - Create a new pool for fixed size objects. The
+ *                                  pool uses a contiguous block of pre-alloced
+ *                                  memory. The memory block may either be provided
+ *                                  by the client or dynamically allocated by the
+ *                                  pool manager.
+ *
+ * Parameters:
+ *    mgr:      INPUT  The handle to the pool manager
+ *    obj_sz:   INPUT  Size of objects that will be allocated by the new pool
+ *                     Must be >= sizeof(void *).
+ *    nobj:     INPUT  Maximum number of concurrently existing objects to support
+ *    memstart  INPUT  Pointer to the memory to use, or NULL to malloc()
+ *    memsize   INPUT  Number of bytes referenced from memstart (for error checking).
+ *                     Must be 0 if 'memstart' is NULL.
+ *    poolname  INPUT  For instrumentation, the name of the pool
+ *    newp:     OUTPUT The handle for the new pool, if creation is successful
+ *
+ * Returns:
+ *    BCME_OK   Pool created ok.
+ *    other     Pool not created due to indicated error. newpoolp set to NULL.
+ *
+ *
+ */
+int bcm_mpm_create_prealloc_pool(bcm_mpm_mgr_h mgr,
+                                 unsigned int obj_sz,
+                                 int nobj,
+                                 void *memstart,
+                                 unsigned int memsize,
+                                 const char poolname[BCM_MP_NAMELEN],
+                                 bcm_mp_pool_h *newp);
+
+
+/*
+ * bcm_mpm_delete_prealloc_pool() - Delete a memory pool. This should only be called after
+ *                                  all memory objects have been freed back to the pool.
+ *
+ * Parameters:
+ *    mgr:     INPUT The handle to the pools manager
+ *    pool:    INPUT The handle of the  pool to delete
+ *
+ * Returns:
+ *    BCME_OK   Pool deleted ok.
+ *    other     Pool not deleted due to indicated error.
+ *
+ */
+int bcm_mpm_delete_prealloc_pool(bcm_mpm_mgr_h mgr, bcm_mp_pool_h *poolp);
+
+/*
+ * bcm_mpm_create_heap_pool() - Create a new pool for fixed size objects. The memory
+ *                              pool allocator uses the heap (malloc/free) for memory.
+ *                              In this case, the pool allocator is just providing
+ *                              statistics and instrumentation on top of the heap,
+ *                              without modifying the heap allocation implementation.
+ *
+ * Parameters:
+ *    mgr:      INPUT  The handle to the pool manager
+ *    obj_sz:   INPUT  Size of objects that will be allocated by the new pool
+ *    poolname  INPUT  For instrumentation, the name of the pool
+ *    newp:     OUTPUT The handle for the new pool, if creation is successful
+ *
+ * Returns:
+ *    BCME_OK   Pool created ok.
+ *    other     Pool not created due to indicated error. newpoolp set to NULL.
+ *
+ *
+ */
+int bcm_mpm_create_heap_pool(bcm_mpm_mgr_h mgr, unsigned int obj_sz,
+                             const char poolname[BCM_MP_NAMELEN],
+                             bcm_mp_pool_h *newp);
+
+
+/*
+ * bcm_mpm_delete_heap_pool() - Delete a memory pool. This should only be called after
+ *                              all memory objects have been freed back to the pool.
+ *
+ * Parameters:
+ *    mgr:     INPUT The handle to the pools manager
+ *    pool:    INPUT The handle of the  pool to delete
+ *
+ * Returns:
+ *    BCME_OK   Pool deleted ok.
+ *    other     Pool not deleted due to indicated error.
+ *
+ */
+int bcm_mpm_delete_heap_pool(bcm_mpm_mgr_h mgr, bcm_mp_pool_h *poolp);
+
+
+/*
+ * bcm_mpm_stats() - Return stats for all pools
+ *
+ * Parameters:
+ *    mgr:         INPUT   The handle to the pools manager
+ *    stats:       OUTPUT  Array of pool statistics.
+ *    nentries:    MOD     Max elements in 'stats' array on INPUT. Actual number
+ *                         of array elements copied to 'stats' on OUTPUT.
+ *
+ * Returns:
+ *    BCME_OK   Ok
+ *    other     Error getting stats.
+ *
+ */
+int bcm_mpm_stats(bcm_mpm_mgr_h mgr, bcm_mp_stats_t *stats, int *nentries);
+
+
+/*
+ * bcm_mpm_dump() - Display statistics on all pools
+ *
+ * Parameters:
+ *    mgr:     INPUT  The handle to the pools manager
+ *    b:       OUTPUT Output buffer.
+ *
+ * Returns:
+ *    BCME_OK   Ok
+ *    other     Error during dump.
+ *
+ */
+int bcm_mpm_dump(bcm_mpm_mgr_h mgr, struct bcmstrbuf *b);
+
+
+/*
+ * bcm_mpm_get_obj_size() - The size of memory objects may need to be padded to
+ *                          compensate for alignment requirements of the objects.
+ *                          This function provides the padded object size. If clients
+ *                          pre-allocate a memory slab for a memory pool, the
+ *                          padded object size should be used by the client to allocate
+ *                          the memory slab (in order to provide sufficent space for
+ *                          the maximum number of objects).
+ *
+ * Parameters:
+ *    mgr:            INPUT   The handle to the pools manager.
+ *    obj_sz:         INPUT   Input object size.
+ *    padded_obj_sz:  OUTPUT  Padded object size.
+ *
+ * Returns:
+ *    BCME_OK      Ok
+ *    BCME_BADARG  Bad arguments.
+ *
+ */
+int bcm_mpm_get_obj_size(bcm_mpm_mgr_h mgr, unsigned int obj_sz, unsigned int *padded_obj_sz);
+
+
+/*
+***************************************************************************
+*
+* API Routines on a specific pool.
+*
+***************************************************************************
+*/
+
+
+/*
+ * bcm_mp_alloc() - Allocate a memory pool object.
+ *
+ * Parameters:
+ *    pool:    INPUT    The handle to the pool.
+ *
+ * Returns:
+ *    A pointer to the new object. NULL on error.
+ *
+ */
+void* bcm_mp_alloc(bcm_mp_pool_h pool);
+
+/*
+ * bcm_mp_free() - Free a memory pool object.
+ *
+ * Parameters:
+ *    pool:  INPUT   The handle to the pool.
+ *    objp:  INPUT   A pointer to the object to free.
+ *
+ * Returns:
+ *    BCME_OK   Ok
+ *    other     Error during free.
+ *
+ */
+int bcm_mp_free(bcm_mp_pool_h pool, void *objp);
+
+/*
+ * bcm_mp_stats() - Return stats for this pool
+ *
+ * Parameters:
+ *    pool:     INPUT    The handle to the pool
+ *    stats:    OUTPUT   Pool statistics
+ *
+ * Returns:
+ *    BCME_OK   Ok
+ *    other     Error getting statistics.
+ *
+ */
+int bcm_mp_stats(bcm_mp_pool_h pool, bcm_mp_stats_t *stats);
+
+
+/*
+ * bcm_mp_dump() - Dump a pool
+ *
+ * Parameters:
+ *    pool:    INPUT    The handle to the pool
+ *    b        OUTPUT   Output buffer
+ *
+ * Returns:
+ *    BCME_OK   Ok
+ *    other     Error during dump.
+ *
+ */
+int bcm_mp_dump(bcm_mp_pool_h pool, struct bcmstrbuf *b);
+
+
+#endif /* _BCM_MPOOL_PUB_H */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/bcm_ring.h b/drivers/net/wireless/bcmdhd_1363/include/bcm_ring.h
new file mode 100644 (file)
index 0000000..3681c9d
--- /dev/null
@@ -0,0 +1,616 @@
+#ifndef __bcm_ring_included__
+#define __bcm_ring_included__
+
+/*
+ * +----------------------------------------------------------------------------
+ *
+ * bcm_ring.h : Ring context abstraction
+ *
+ * The ring context tracks the WRITE and READ indices where elements may be
+ * produced and consumed respectively. All elements in the ring need to be
+ * fixed size.
+ *
+ * NOTE: A ring of size N, may only hold N-1 elements.
+ *
+ * +----------------------------------------------------------------------------
+ *
+ * API Notes:
+ *
+ * Ring manipulation API allows for:
+ *  Pending operations: Often before some work can be completed, it may be
+ *  desired that several resources are available, e.g. space for production in
+ *  a ring. Approaches such as, #1) reserve resources one by one and return them
+ *  if another required resource is not available, or #2) employ a two pass
+ *  algorithm of first testing whether all resources are available, have a
+ *  an impact on performance critical code. The approach taken here is more akin
+ *  to approach #2, where a test for resource availability essentially also
+ *  provides the index for production in an un-committed state.
+ *  The same approach is taken for the consumer side.
+ *
+ *  - Pending production: Fetch the next index where a ring element may be
+ *    produced. The caller may not commit the WRITE of the element.
+ *  - Pending consumption: Fetch the next index where a ring element may be
+ *    consumed. The caller may not commut the READ of the element.
+ *
+ *  Producer side API:
+ *  - bcm_ring_is_full  : Test whether ring is full
+ *  - bcm_ring_prod     : Fetch index where an element may be produced (commit)
+ *  - bcm_ring_prod_pend: Fetch index where an element may be produced (pending)
+ *  - bcm_ring_prod_done: Commit a previous pending produce fetch
+ *  - bcm_ring_prod_avail: Fetch total number free slots eligible for production
+ *
+ * Consumer side API:
+ *  - bcm_ring_is_empty : Test whether ring is empty
+ *  - bcm_ring_cons     : Fetch index where an element may be consumed (commit)
+ *  - bcm_ring_cons_pend: Fetch index where an element may be consumed (pending)
+ *  - bcm_ring_cons_done: Commit a previous pending consume fetch
+ *  - bcm_ring_cons_avail: Fetch total number elements eligible for consumption
+ *
+ *  - bcm_ring_sync_read: Sync read offset in peer ring, from local ring
+ *  - bcm_ring_sync_write: Sync write offset in peer ring, from local ring
+ *
+ * +----------------------------------------------------------------------------
+ *
+ * Design Notes:
+ * Following items are not tracked in a ring context (design decision)
+ *  - width of a ring element.
+ *  - depth of the ring.
+ *  - base of the buffer, where the elements are stored.
+ *  - count of number of free slots in the ring
+ *
+ * Implementation Notes:
+ *  - When BCM_RING_DEBUG is enabled, need explicit bcm_ring_init().
+ *  - BCM_RING_EMPTY and BCM_RING_FULL are (-1)
+ *
+ * +----------------------------------------------------------------------------
+ *
+ * Usage Notes:
+ * An application may incarnate a ring of some fixed sized elements, by defining
+ *  - a ring data buffer to store the ring elements.
+ *  - depth of the ring (max number of elements managed by ring context).
+ *    Preferrably, depth may be represented as a constant.
+ *  - width of a ring element: to be used in pointer arithmetic with the ring's
+ *    data buffer base and an index to fetch the ring element.
+ *
+ * Use bcm_workq_t to instantiate a pair of workq constructs, one for the
+ * producer and the other for the consumer, both pointing to the same circular
+ * buffer. The producer may operate on it's own local workq and flush the write
+ * index to the consumer. Likewise the consumer may use its local workq and
+ * flush the read index to the producer. This way we do not repeatedly access
+ * the peer's context. The two peers may reside on different CPU cores with a
+ * private L1 data cache.
+ * +----------------------------------------------------------------------------
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcm_ring.h 591283 2015-10-07 11:52:00Z $
+ *
+ * -*- Mode: C; tab-width: 4; indent-tabs-mode: t; c-basic-offset: 4 -*-
+ * vim: set ts=4 noet sw=4 tw=80:
+ *
+ * +----------------------------------------------------------------------------
+ */
+
+#ifdef ____cacheline_aligned
+#define __ring_aligned                      ____cacheline_aligned
+#else
+#define __ring_aligned
+#endif
+
+/* Conditional compile for debug */
+/* #define BCM_RING_DEBUG */
+
+#define BCM_RING_EMPTY                      (-1)
+#define BCM_RING_FULL                       (-1)
+#define BCM_RING_NULL                       ((bcm_ring_t *)NULL)
+
+#if defined(BCM_RING_DEBUG)
+#define RING_ASSERT(exp)                    ASSERT(exp)
+#define BCM_RING_IS_VALID(ring)             (((ring) != BCM_RING_NULL) && \
+                                                ((ring)->self == (ring)))
+#else  /* ! BCM_RING_DEBUG */
+#define RING_ASSERT(exp)                    do {} while (0)
+#define BCM_RING_IS_VALID(ring)             ((ring) != BCM_RING_NULL)
+#endif /* ! BCM_RING_DEBUG */
+
+#define BCM_RING_SIZE_IS_VALID(ring_size)   ((ring_size) > 0)
+
+/*
+ * +----------------------------------------------------------------------------
+ * Ring Context
+ * +----------------------------------------------------------------------------
+ */
+typedef struct bcm_ring {     /* Ring context */
+#if defined(BCM_RING_DEBUG)
+       struct bcm_ring *self;    /* ptr to self for IS VALID test */
+#endif /* BCM_RING_DEBUG */
+       int write __ring_aligned; /* WRITE index in a circular ring */
+       int read  __ring_aligned; /* READ index in a circular ring */
+} bcm_ring_t;
+
+
+static INLINE void bcm_ring_init(bcm_ring_t *ring);
+static INLINE void bcm_ring_copy(bcm_ring_t *to, bcm_ring_t *from);
+static INLINE bool bcm_ring_is_empty(bcm_ring_t *ring);
+
+static INLINE int  __bcm_ring_next_write(bcm_ring_t *ring, const int ring_size);
+
+static INLINE bool __bcm_ring_full(bcm_ring_t *ring, int next_write);
+static INLINE bool bcm_ring_is_full(bcm_ring_t *ring, const int ring_size);
+
+static INLINE void bcm_ring_prod_done(bcm_ring_t *ring, int write);
+static INLINE int  bcm_ring_prod_pend(bcm_ring_t *ring, int *pend_write,
+                                      const int ring_size);
+static INLINE int  bcm_ring_prod(bcm_ring_t *ring, const int ring_size);
+
+static INLINE void bcm_ring_cons_done(bcm_ring_t *ring, int read);
+static INLINE int  bcm_ring_cons_pend(bcm_ring_t *ring, int *pend_read,
+                                      const int ring_size);
+static INLINE int  bcm_ring_cons(bcm_ring_t *ring, const int ring_size);
+
+static INLINE void bcm_ring_sync_read(bcm_ring_t *peer, const bcm_ring_t *self);
+static INLINE void bcm_ring_sync_write(bcm_ring_t *peer, const bcm_ring_t *self);
+
+static INLINE int  bcm_ring_prod_avail(const bcm_ring_t *ring,
+                                       const int ring_size);
+static INLINE int  bcm_ring_cons_avail(const bcm_ring_t *ring,
+                                       const int ring_size);
+static INLINE void bcm_ring_cons_all(bcm_ring_t *ring);
+
+
+/**
+ * bcm_ring_init - initialize a ring context.
+ * @ring: pointer to a ring context
+ */
+static INLINE void
+bcm_ring_init(bcm_ring_t *ring)
+{
+       ASSERT(ring != (bcm_ring_t *)NULL);
+#if defined(BCM_RING_DEBUG)
+       ring->self = ring;
+#endif /* BCM_RING_DEBUG */
+       ring->write = 0;
+       ring->read = 0;
+}
+
+/**
+ * bcm_ring_copy - copy construct a ring
+ * @to: pointer to the new ring context
+ * @from: pointer to orig ring context
+ */
+static INLINE void
+bcm_ring_copy(bcm_ring_t *to, bcm_ring_t *from)
+{
+       bcm_ring_init(to);
+
+       to->write = from->write;
+       to->read  = from->read;
+}
+
+/**
+ * bcm_ring_is_empty - "Boolean" test whether ring is empty.
+ * @ring: pointer to a ring context
+ *
+ * PS. does not return BCM_RING_EMPTY value.
+ */
+static INLINE bool
+bcm_ring_is_empty(bcm_ring_t *ring)
+{
+       RING_ASSERT(BCM_RING_IS_VALID(ring));
+       return (ring->read == ring->write);
+}
+
+
+/**
+ * __bcm_ring_next_write - determine the index where the next write may occur
+ *                         (with wrap-around).
+ * @ring: pointer to a ring context
+ * @ring_size: size of the ring
+ *
+ * PRIVATE INTERNAL USE ONLY.
+ */
+static INLINE int
+__bcm_ring_next_write(bcm_ring_t *ring, const int ring_size)
+{
+       RING_ASSERT(BCM_RING_IS_VALID(ring) && BCM_RING_SIZE_IS_VALID(ring_size));
+       return ((ring->write + 1) % ring_size);
+}
+
+
+/**
+ * __bcm_ring_full - support function for ring full test.
+ * @ring: pointer to a ring context
+ * @next_write: next location in ring where an element is to be produced
+ *
+ * PRIVATE INTERNAL USE ONLY.
+ */
+static INLINE bool
+__bcm_ring_full(bcm_ring_t *ring, int next_write)
+{
+       return (next_write == ring->read);
+}
+
+
+/**
+ * bcm_ring_is_full - "Boolean" test whether a ring is full.
+ * @ring: pointer to a ring context
+ * @ring_size: size of the ring
+ *
+ * PS. does not return BCM_RING_FULL value.
+ */
+static INLINE bool
+bcm_ring_is_full(bcm_ring_t *ring, const int ring_size)
+{
+       int next_write;
+       RING_ASSERT(BCM_RING_IS_VALID(ring) && BCM_RING_SIZE_IS_VALID(ring_size));
+       next_write = __bcm_ring_next_write(ring, ring_size);
+       return __bcm_ring_full(ring, next_write);
+}
+
+
+/**
+ * bcm_ring_prod_done - commit a previously pending index where production
+ * was requested.
+ * @ring: pointer to a ring context
+ * @write: index into ring upto where production was done.
+ * +----------------------------------------------------------------------------
+ */
+static INLINE void
+bcm_ring_prod_done(bcm_ring_t *ring, int write)
+{
+       RING_ASSERT(BCM_RING_IS_VALID(ring));
+       ring->write = write;
+}
+
+
+/**
+ * bcm_ring_prod_pend - Fetch in "pend" mode, the index where an element may be
+ * produced.
+ * @ring: pointer to a ring context
+ * @pend_write: next index, after the returned index
+ * @ring_size: size of the ring
+ */
+static INLINE int
+bcm_ring_prod_pend(bcm_ring_t *ring, int *pend_write, const int ring_size)
+{
+       int rtn;
+       RING_ASSERT(BCM_RING_IS_VALID(ring) && BCM_RING_SIZE_IS_VALID(ring_size));
+       *pend_write = __bcm_ring_next_write(ring, ring_size);
+       if (__bcm_ring_full(ring, *pend_write)) {
+               *pend_write = BCM_RING_FULL;
+               rtn = BCM_RING_FULL;
+       } else {
+               /* production is not committed, caller needs to explicitly commit */
+               rtn = ring->write;
+       }
+       return rtn;
+}
+
+
+/**
+ * bcm_ring_prod - Fetch and "commit" the next index where a ring element may
+ * be produced.
+ * @ring: pointer to a ring context
+ * @ring_size: size of the ring
+ */
+static INLINE int
+bcm_ring_prod(bcm_ring_t *ring, const int ring_size)
+{
+       int next_write, prod_write;
+       RING_ASSERT(BCM_RING_IS_VALID(ring) && BCM_RING_SIZE_IS_VALID(ring_size));
+
+       next_write = __bcm_ring_next_write(ring, ring_size);
+       if (__bcm_ring_full(ring, next_write)) {
+               prod_write = BCM_RING_FULL;
+       } else {
+               prod_write = ring->write;
+               bcm_ring_prod_done(ring, next_write); /* "commit" production */
+       }
+       return prod_write;
+}
+
+
+/**
+ * bcm_ring_cons_done - commit a previously pending read
+ * @ring: pointer to a ring context
+ * @read: index upto which elements have been consumed.
+ */
+static INLINE void
+bcm_ring_cons_done(bcm_ring_t *ring, int read)
+{
+       RING_ASSERT(BCM_RING_IS_VALID(ring));
+       ring->read = read;
+}
+
+
+/**
+ * bcm_ring_cons_pend - fetch in "pend" mode, the next index where a ring
+ * element may be consumed.
+ * @ring: pointer to a ring context
+ * @pend_read: index into ring upto which elements may be consumed.
+ * @ring_size: size of the ring
+ */
+static INLINE int
+bcm_ring_cons_pend(bcm_ring_t *ring, int *pend_read, const int ring_size)
+{
+       int rtn;
+       RING_ASSERT(BCM_RING_IS_VALID(ring) && BCM_RING_SIZE_IS_VALID(ring_size));
+       if (bcm_ring_is_empty(ring)) {
+               *pend_read = BCM_RING_EMPTY;
+               rtn = BCM_RING_EMPTY;
+       } else {
+               *pend_read = (ring->read + 1) % ring_size;
+               /* production is not committed, caller needs to explicitly commit */
+               rtn = ring->read;
+       }
+       return rtn;
+}
+
+
+/**
+ * bcm_ring_cons - fetch and "commit" the next index where a ring element may
+ * be consumed.
+ * @ring: pointer to a ring context
+ * @ring_size: size of the ring
+ */
+static INLINE int
+bcm_ring_cons(bcm_ring_t *ring, const int ring_size)
+{
+       int cons_read;
+       RING_ASSERT(BCM_RING_IS_VALID(ring) && BCM_RING_SIZE_IS_VALID(ring_size));
+       if (bcm_ring_is_empty(ring)) {
+               cons_read = BCM_RING_EMPTY;
+       } else {
+               cons_read = ring->read;
+               ring->read = (ring->read + 1) % ring_size; /* read is committed */
+       }
+       return cons_read;
+}
+
+
+/**
+ * bcm_ring_sync_read - on consumption, update peer's read index.
+ * @peer: pointer to peer's producer ring context
+ * @self: pointer to consumer's ring context
+ */
+static INLINE void
+bcm_ring_sync_read(bcm_ring_t *peer, const bcm_ring_t *self)
+{
+       RING_ASSERT(BCM_RING_IS_VALID(peer));
+       RING_ASSERT(BCM_RING_IS_VALID(self));
+       peer->read = self->read; /* flush read update to peer producer */
+}
+
+
+/**
+ * bcm_ring_sync_write - on consumption, update peer's write index.
+ * @peer: pointer to peer's consumer ring context
+ * @self: pointer to producer's ring context
+ */
+static INLINE void
+bcm_ring_sync_write(bcm_ring_t *peer, const bcm_ring_t *self)
+{
+       RING_ASSERT(BCM_RING_IS_VALID(peer));
+       RING_ASSERT(BCM_RING_IS_VALID(self));
+       peer->write = self->write; /* flush write update to peer consumer */
+}
+
+
+/**
+ * bcm_ring_prod_avail - fetch total number of available empty slots in the
+ * ring for production.
+ * @ring: pointer to a ring context
+ * @ring_size: size of the ring
+ */
+static INLINE int
+bcm_ring_prod_avail(const bcm_ring_t *ring, const int ring_size)
+{
+       int prod_avail;
+       RING_ASSERT(BCM_RING_IS_VALID(ring) && BCM_RING_SIZE_IS_VALID(ring_size));
+       if (ring->write >= ring->read) {
+               prod_avail = (ring_size - (ring->write - ring->read) - 1);
+       } else {
+               prod_avail = (ring->read - (ring->write + 1));
+       }
+       ASSERT(prod_avail < ring_size);
+       return prod_avail;
+}
+
+
+/**
+ * bcm_ring_cons_avail - fetch total number of available elements for consumption.
+ * @ring: pointer to a ring context
+ * @ring_size: size of the ring
+ */
+static INLINE int
+bcm_ring_cons_avail(const bcm_ring_t *ring, const int ring_size)
+{
+       int cons_avail;
+       RING_ASSERT(BCM_RING_IS_VALID(ring) && BCM_RING_SIZE_IS_VALID(ring_size));
+       if (ring->read == ring->write) {
+               cons_avail = 0;
+       } else if (ring->read > ring->write) {
+               cons_avail = ((ring_size - ring->read) + ring->write);
+       } else {
+               cons_avail = ring->write - ring->read;
+       }
+       ASSERT(cons_avail < ring_size);
+       return cons_avail;
+}
+
+
+/**
+ * bcm_ring_cons_all - set ring in state where all elements are consumed.
+ * @ring: pointer to a ring context
+ */
+static INLINE void
+bcm_ring_cons_all(bcm_ring_t *ring)
+{
+       ring->read = ring->write;
+}
+
+
+/**
+ * Work Queue
+ * A work Queue is composed of a ring of work items, of a specified depth.
+ * It HAS-A bcm_ring object, comprising of a RD and WR offset, to implement a
+ * producer/consumer circular ring.
+ */
+
+struct bcm_workq {
+       bcm_ring_t ring;        /* Ring context abstraction */
+       struct bcm_workq *peer; /* Peer workq context */
+       void       *buffer;     /* Buffer storage for work items in workQ */
+       int        ring_size;   /* Depth of workQ */
+} __ring_aligned;
+
+typedef struct bcm_workq bcm_workq_t;
+
+
+/* #define BCM_WORKQ_DEBUG */
+#if defined(BCM_WORKQ_DEBUG)
+#define WORKQ_ASSERT(exp)               ASSERT(exp)
+#else  /* ! BCM_WORKQ_DEBUG */
+#define WORKQ_ASSERT(exp)               do {} while (0)
+#endif /* ! BCM_WORKQ_DEBUG */
+
+#define WORKQ_AUDIT(workq) \
+       WORKQ_ASSERT((workq) != BCM_WORKQ_NULL); \
+       WORKQ_ASSERT(WORKQ_PEER(workq) != BCM_WORKQ_NULL); \
+       WORKQ_ASSERT((workq)->buffer == WORKQ_PEER(workq)->buffer); \
+       WORKQ_ASSERT((workq)->ring_size == WORKQ_PEER(workq)->ring_size);
+
+#define BCM_WORKQ_NULL                  ((bcm_workq_t *)NULL)
+
+#define WORKQ_PEER(workq)               ((workq)->peer)
+#define WORKQ_RING(workq)               (&((workq)->ring))
+#define WORKQ_PEER_RING(workq)          (&((workq)->peer->ring))
+
+#define WORKQ_ELEMENT(__elem_type, __workq, __index) ({ \
+       WORKQ_ASSERT((__workq) != BCM_WORKQ_NULL); \
+       WORKQ_ASSERT((__index) < ((__workq)->ring_size)); \
+       ((__elem_type *)((__workq)->buffer)) + (__index); \
+})
+
+
+static INLINE void bcm_workq_init(bcm_workq_t *workq, bcm_workq_t *workq_peer,
+                                  void *buffer, int ring_size);
+
+static INLINE bool bcm_workq_is_empty(bcm_workq_t *workq_prod);
+
+static INLINE void bcm_workq_prod_sync(bcm_workq_t *workq_prod);
+static INLINE void bcm_workq_cons_sync(bcm_workq_t *workq_cons);
+
+static INLINE void bcm_workq_prod_refresh(bcm_workq_t *workq_prod);
+static INLINE void bcm_workq_cons_refresh(bcm_workq_t *workq_cons);
+
+/**
+ * bcm_workq_init - initialize a workq
+ * @workq: pointer to a workq context
+ * @buffer: pointer to a pre-allocated circular buffer to serve as a ring
+ * @ring_size: size of the ring in terms of max number of elements.
+ */
+static INLINE void
+bcm_workq_init(bcm_workq_t *workq, bcm_workq_t *workq_peer,
+               void *buffer, int ring_size)
+{
+       ASSERT(workq != BCM_WORKQ_NULL);
+       ASSERT(workq_peer != BCM_WORKQ_NULL);
+       ASSERT(buffer != NULL);
+       ASSERT(ring_size > 0);
+
+       WORKQ_PEER(workq) = workq_peer;
+       WORKQ_PEER(workq_peer) = workq;
+
+       bcm_ring_init(WORKQ_RING(workq));
+       bcm_ring_init(WORKQ_RING(workq_peer));
+
+       workq->buffer = workq_peer->buffer = buffer;
+       workq->ring_size = workq_peer->ring_size = ring_size;
+}
+
+/**
+ * bcm_workq_empty - test whether there is work
+ * @workq_prod: producer's workq
+ */
+static INLINE bool
+bcm_workq_is_empty(bcm_workq_t *workq_prod)
+{
+       return bcm_ring_is_empty(WORKQ_RING(workq_prod));
+}
+
+/**
+ * bcm_workq_prod_sync - Commit the producer write index to peer workq's ring
+ * @workq_prod: producer's workq whose write index must be synced to peer
+ */
+static INLINE void
+bcm_workq_prod_sync(bcm_workq_t *workq_prod)
+{
+       WORKQ_AUDIT(workq_prod);
+
+       /* cons::write <--- prod::write */
+       bcm_ring_sync_write(WORKQ_PEER_RING(workq_prod), WORKQ_RING(workq_prod));
+}
+
+/**
+ * bcm_workq_cons_sync - Commit the consumer read index to the peer workq's ring
+ * @workq_cons: consumer's workq whose read index must be synced to peer
+ */
+static INLINE void
+bcm_workq_cons_sync(bcm_workq_t *workq_cons)
+{
+       WORKQ_AUDIT(workq_cons);
+
+       /* prod::read <--- cons::read */
+       bcm_ring_sync_read(WORKQ_PEER_RING(workq_cons), WORKQ_RING(workq_cons));
+}
+
+
+/**
+ * bcm_workq_prod_refresh - Fetch the updated consumer's read index
+ * @workq_prod: producer's workq whose read index must be refreshed from peer
+ */
+static INLINE void
+bcm_workq_prod_refresh(bcm_workq_t *workq_prod)
+{
+       WORKQ_AUDIT(workq_prod);
+
+       /* prod::read <--- cons::read */
+       bcm_ring_sync_read(WORKQ_RING(workq_prod), WORKQ_PEER_RING(workq_prod));
+}
+
+/**
+ * bcm_workq_cons_refresh - Fetch the updated producer's write index
+ * @workq_cons: consumer's workq whose write index must be refreshed from peer
+ */
+static INLINE void
+bcm_workq_cons_refresh(bcm_workq_t *workq_cons)
+{
+       WORKQ_AUDIT(workq_cons);
+
+       /* cons::write <--- prod::write */
+       bcm_ring_sync_write(WORKQ_RING(workq_cons), WORKQ_PEER_RING(workq_cons));
+}
+
+
+#endif /* ! __bcm_ring_h_included__ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/bcmcdc.h b/drivers/net/wireless/bcmdhd_1363/include/bcmcdc.h
new file mode 100644 (file)
index 0000000..a7d3d4a
--- /dev/null
@@ -0,0 +1,135 @@
+/*
+ * CDC network driver ioctl/indication encoding
+ * Broadcom 802.11abg Networking Device Driver
+ *
+ * Definitions subject to change without notice.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmcdc.h 514727 2014-11-12 03:02:48Z $
+ */
+#ifndef _bcmcdc_h_
+#define        _bcmcdc_h_
+#include <proto/ethernet.h>
+
+typedef struct cdc_ioctl {
+       uint32 cmd;      /* ioctl command value */
+       uint32 len;      /* lower 16: output buflen; upper 16: input buflen (excludes header) */
+       uint32 flags;    /* flag defns given below */
+       uint32 status;   /* status code returned from the device */
+} cdc_ioctl_t;
+
+/* Max valid buffer size that can be sent to the dongle */
+#define CDC_MAX_MSG_SIZE   ETHER_MAX_LEN
+
+/* len field is divided into input and output buffer lengths */
+#define CDCL_IOC_OUTLEN_MASK   0x0000FFFF  /* maximum or expected response length, */
+                                          /* excluding IOCTL header */
+#define CDCL_IOC_OUTLEN_SHIFT  0
+#define CDCL_IOC_INLEN_MASK    0xFFFF0000   /* input buffer length, excluding IOCTL header */
+#define CDCL_IOC_INLEN_SHIFT   16
+
+/* CDC flag definitions */
+#define CDCF_IOC_ERROR         0x01    /* 0=success, 1=ioctl cmd failed */
+#define CDCF_IOC_SET           0x02    /* 0=get, 1=set cmd */
+#define CDCF_IOC_OVL_IDX_MASK  0x3c    /* overlay region index mask */
+#define CDCF_IOC_OVL_RSV       0x40    /* 1=reserve this overlay region */
+#define CDCF_IOC_OVL           0x80    /* 1=this ioctl corresponds to an overlay */
+#define CDCF_IOC_ACTION_MASK   0xfe    /* SET/GET, OVL_IDX, OVL_RSV, OVL mask */
+#define CDCF_IOC_ACTION_SHIFT  1       /* SET/GET, OVL_IDX, OVL_RSV, OVL shift */
+#define CDCF_IOC_IF_MASK       0xF000  /* I/F index */
+#define CDCF_IOC_IF_SHIFT      12
+#define CDCF_IOC_ID_MASK       0xFFFF0000      /* used to uniquely id an ioctl req/resp pairing */
+#define CDCF_IOC_ID_SHIFT      16              /* # of bits of shift for ID Mask */
+
+#define CDC_IOC_IF_IDX(flags)  (((flags) & CDCF_IOC_IF_MASK) >> CDCF_IOC_IF_SHIFT)
+#define CDC_IOC_ID(flags)      (((flags) & CDCF_IOC_ID_MASK) >> CDCF_IOC_ID_SHIFT)
+
+#define CDC_GET_IF_IDX(hdr) \
+       ((int)((((hdr)->flags) & CDCF_IOC_IF_MASK) >> CDCF_IOC_IF_SHIFT))
+#define CDC_SET_IF_IDX(hdr, idx) \
+       ((hdr)->flags = (((hdr)->flags & ~CDCF_IOC_IF_MASK) | ((idx) << CDCF_IOC_IF_SHIFT)))
+
+/*
+ * BDC header
+ *
+ *   The BDC header is used on data packets to convey priority across USB.
+ */
+
+struct bdc_header {
+       uint8   flags;                  /* Flags */
+       uint8   priority;               /* 802.1d Priority 0:2 bits, 4:7 USB flow control info */
+       uint8   flags2;
+       uint8   dataOffset;             /* Offset from end of BDC header to packet data, in
+                                        * 4-byte words.  Leaves room for optional headers.
+                                        */
+};
+
+#define        BDC_HEADER_LEN          4
+
+/* flags field bitmap */
+#define BDC_FLAG_80211_PKT     0x01    /* Packet is in 802.11 format (dongle -> host) */
+#define BDC_FLAG_SUM_GOOD      0x04    /* Dongle has verified good RX checksums */
+#define BDC_FLAG_SUM_NEEDED    0x08    /* Dongle needs to do TX checksums: host->device */
+#define BDC_FLAG_EVENT_MSG     0x08    /* Payload contains an event msg: device->host */
+#define BDC_FLAG_VER_MASK      0xf0    /* Protocol version mask */
+#define BDC_FLAG_VER_SHIFT     4       /* Protocol version shift */
+
+/* priority field bitmap */
+#define BDC_PRIORITY_MASK      0x07
+#define BDC_PRIORITY_FC_MASK   0xf0    /* flow control info mask */
+#define BDC_PRIORITY_FC_SHIFT  4       /* flow control info shift */
+
+/* flags2 field bitmap */
+#define BDC_FLAG2_IF_MASK      0x0f    /* interface index (host <-> dongle) */
+#define BDC_FLAG2_IF_SHIFT     0
+#define BDC_FLAG2_FC_FLAG      0x10    /* flag to indicate if pkt contains */
+                                       /* FLOW CONTROL info only */
+
+/* version numbers */
+#define BDC_PROTO_VER_1                1       /* Old Protocol version */
+#define BDC_PROTO_VER          2       /* Protocol version */
+
+/* flags2.if field access macros */
+#define BDC_GET_IF_IDX(hdr) \
+       ((int)((((hdr)->flags2) & BDC_FLAG2_IF_MASK) >> BDC_FLAG2_IF_SHIFT))
+#define BDC_SET_IF_IDX(hdr, idx) \
+       ((hdr)->flags2 = (((hdr)->flags2 & ~BDC_FLAG2_IF_MASK) | ((idx) << BDC_FLAG2_IF_SHIFT)))
+
+#define BDC_FLAG2_PAD_MASK             0xf0
+#define BDC_FLAG_PAD_MASK              0x03
+#define BDC_FLAG2_PAD_SHIFT            2
+#define BDC_FLAG_PAD_SHIFT             0
+#define BDC_FLAG2_PAD_IDX              0x3c
+#define BDC_FLAG_PAD_IDX               0x03
+#define BDC_GET_PAD_LEN(hdr) \
+       ((int)(((((hdr)->flags2) & BDC_FLAG2_PAD_MASK) >> BDC_FLAG2_PAD_SHIFT) | \
+       ((((hdr)->flags) & BDC_FLAG_PAD_MASK) >> BDC_FLAG_PAD_SHIFT)))
+#define BDC_SET_PAD_LEN(hdr, idx) \
+       ((hdr)->flags2 = (((hdr)->flags2 & ~BDC_FLAG2_PAD_MASK) | \
+       (((idx) & BDC_FLAG2_PAD_IDX) << BDC_FLAG2_PAD_SHIFT))); \
+       ((hdr)->flags = (((hdr)->flags & ~BDC_FLAG_PAD_MASK) | \
+       (((idx) & BDC_FLAG_PAD_IDX) << BDC_FLAG_PAD_SHIFT)))
+
+#endif /* _bcmcdc_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/bcmdefs.h b/drivers/net/wireless/bcmdhd_1363/include/bcmdefs.h
new file mode 100644 (file)
index 0000000..764f54f
--- /dev/null
@@ -0,0 +1,382 @@
+/*
+ * Misc system wide definitions
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmdefs.h 601026 2015-11-20 06:53:19Z $
+ */
+
+#ifndef        _bcmdefs_h_
+#define        _bcmdefs_h_
+
+/*
+ * One doesn't need to include this file explicitly, gets included automatically if
+ * typedefs.h is included.
+ */
+
+/* Use BCM_REFERENCE to suppress warnings about intentionally-unused function
+ * arguments or local variables.
+ */
+#define BCM_REFERENCE(data)    ((void)(data))
+
+/* Allow for suppressing unused variable warnings. */
+#ifdef __GNUC__
+#define UNUSED_VAR     __attribute__ ((unused))
+#else
+#define UNUSED_VAR
+#endif
+
+/* Compile-time assert can be used in place of ASSERT if the expression evaluates
+ * to a constant at compile time.
+ */
+#define STATIC_ASSERT(expr) { \
+       /* Make sure the expression is constant. */ \
+       typedef enum { _STATIC_ASSERT_NOT_CONSTANT = (expr) } _static_assert_e UNUSED_VAR; \
+       /* Make sure the expression is true. */ \
+       typedef char STATIC_ASSERT_FAIL[(expr) ? 1 : -1] UNUSED_VAR; \
+}
+
+/* Reclaiming text and data :
+ * The following macros specify special linker sections that can be reclaimed
+ * after a system is considered 'up'.
+ * BCMATTACHFN is also used for detach functions (it's not worth having a BCMDETACHFN,
+ * as in most cases, the attach function calls the detach function to clean up on error).
+ */
+
+#define bcmreclaimed           0
+#define _data  _data
+#define _fn    _fn
+#define BCMPREATTACHDATA(_data)        _data
+#define BCMPREATTACHFN(_fn)    _fn
+#define _data  _data
+#define _fn            _fn
+#define _fn    _fn
+#define        BCMNMIATTACHFN(_fn)     _fn
+#define        BCMNMIATTACHDATA(_data) _data
+#define CONST  const
+
+#undef BCM47XX_CA9
+
+#ifndef BCMFASTPATH
+#define BCMFASTPATH
+#define BCMFASTPATH_HOST
+#endif /* BCMFASTPATH */
+
+
+/* Use the BCMRAMFN() macro to tag functions in source that must be included in RAM (excluded from
+ * ROM). This should eliminate the need to manually specify these functions in the ROM config file.
+ * It should only be used in special cases where the function must be in RAM for *all* ROM-based
+ * chips.
+ */
+       #define BCMRAMFN(_fn)   _fn
+
+#define STATIC static
+
+/* Bus types */
+#define        SI_BUS                  0       /* SOC Interconnect */
+#define        PCI_BUS                 1       /* PCI target */
+#define        PCMCIA_BUS              2       /* PCMCIA target */
+#define SDIO_BUS               3       /* SDIO target */
+#define JTAG_BUS               4       /* JTAG */
+#define USB_BUS                        5       /* USB (does not support R/W REG) */
+#define SPI_BUS                        6       /* gSPI target */
+#define RPC_BUS                        7       /* RPC target */
+
+/* Allows size optimization for single-bus image */
+#ifdef BCMBUSTYPE
+#define BUSTYPE(bus)   (BCMBUSTYPE)
+#else
+#define BUSTYPE(bus)   (bus)
+#endif
+
+/* Allows size optimization for single-backplane image */
+#ifdef BCMCHIPTYPE
+#define CHIPTYPE(bus)  (BCMCHIPTYPE)
+#else
+#define CHIPTYPE(bus)  (bus)
+#endif
+
+
+/* Allows size optimization for SPROM support */
+#if defined(BCMSPROMBUS)
+#define SPROMBUS       (BCMSPROMBUS)
+#elif defined(SI_PCMCIA_SROM)
+#define SPROMBUS       (PCMCIA_BUS)
+#else
+#define SPROMBUS       (PCI_BUS)
+#endif
+
+/* Allows size optimization for single-chip image */
+#ifdef BCMCHIPID
+#define CHIPID(chip)   (BCMCHIPID)
+#else
+#define CHIPID(chip)   (chip)
+#endif
+
+#ifdef BCMCHIPREV
+#define CHIPREV(rev)   (BCMCHIPREV)
+#else
+#define CHIPREV(rev)   (rev)
+#endif
+
+#ifdef BCMPCIEREV
+#define PCIECOREREV(rev)       (BCMPCIEREV)
+#else
+#define PCIECOREREV(rev)       (rev)
+#endif
+
+/* Defines for DMA Address Width - Shared between OSL and HNDDMA */
+#define DMADDR_MASK_32 0x0             /* Address mask for 32-bits */
+#define DMADDR_MASK_30 0xc0000000      /* Address mask for 30-bits */
+#define DMADDR_MASK_26 0xFC000000      /* Address maks for 26-bits */
+#define DMADDR_MASK_0  0xffffffff      /* Address mask for 0-bits (hi-part) */
+
+#define        DMADDRWIDTH_26  26 /* 26-bit addressing capability */
+#define        DMADDRWIDTH_30  30 /* 30-bit addressing capability */
+#define        DMADDRWIDTH_32  32 /* 32-bit addressing capability */
+#define        DMADDRWIDTH_63  63 /* 64-bit addressing capability */
+#define        DMADDRWIDTH_64  64 /* 64-bit addressing capability */
+
+typedef struct {
+       uint32 loaddr;
+       uint32 hiaddr;
+} dma64addr_t;
+
+#define PHYSADDR64HI(_pa) ((_pa).hiaddr)
+#define PHYSADDR64HISET(_pa, _val) \
+       do { \
+               (_pa).hiaddr = (_val);          \
+       } while (0)
+#define PHYSADDR64LO(_pa) ((_pa).loaddr)
+#define PHYSADDR64LOSET(_pa, _val) \
+       do { \
+               (_pa).loaddr = (_val);          \
+       } while (0)
+
+#ifdef BCMDMA64OSL
+typedef dma64addr_t dmaaddr_t;
+#define PHYSADDRHI(_pa) PHYSADDR64HI(_pa)
+#define PHYSADDRHISET(_pa, _val) PHYSADDR64HISET(_pa, _val)
+#define PHYSADDRLO(_pa)  PHYSADDR64LO(_pa)
+#define PHYSADDRLOSET(_pa, _val) PHYSADDR64LOSET(_pa, _val)
+#define PHYSADDRTOULONG(_pa, _ulong) \
+       do { \
+               _ulong = ((unsigned long)(_pa).hiaddr << 32) | ((_pa).loaddr); \
+       } while (0)
+
+#else
+typedef unsigned long dmaaddr_t;
+#define PHYSADDRHI(_pa) (0)
+#define PHYSADDRHISET(_pa, _val)
+#define PHYSADDRLO(_pa) ((_pa))
+#define PHYSADDRLOSET(_pa, _val) \
+       do { \
+               (_pa) = (_val);                 \
+       } while (0)
+#endif /* BCMDMA64OSL */
+#define PHYSADDRISZERO(_pa) (PHYSADDRLO(_pa) == 0 && PHYSADDRHI(_pa) == 0)
+
+/* One physical DMA segment */
+typedef struct  {
+       dmaaddr_t addr;
+       uint32    length;
+} hnddma_seg_t;
+
+#define MAX_DMA_SEGS 8
+
+
+typedef struct {
+       void *oshdmah; /* Opaque handle for OSL to store its information */
+       uint origsize; /* Size of the virtual packet */
+       uint nsegs;
+       hnddma_seg_t segs[MAX_DMA_SEGS];
+} hnddma_seg_map_t;
+
+
+/* packet headroom necessary to accommodate the largest header in the system, (i.e TXOFF).
+ * By doing, we avoid the need  to allocate an extra buffer for the header when bridging to WL.
+ * There is a compile time check in wlc.c which ensure that this value is at least as big
+ * as TXOFF. This value is used in dma_rxfill (hnddma.c).
+ */
+
+#if defined(BCM_RPC_NOCOPY) || defined(BCM_RCP_TXNOCOPY)
+/* add 40 bytes to allow for extra RPC header and info  */
+#define BCMEXTRAHDROOM 260
+#else /* BCM_RPC_NOCOPY || BCM_RPC_TXNOCOPY */
+#define BCMEXTRAHDROOM 204
+#endif /* BCM_RPC_NOCOPY || BCM_RPC_TXNOCOPY */
+
+/* Packet alignment for most efficient SDIO (can change based on platform) */
+#ifndef SDALIGN
+#define SDALIGN        32
+#endif
+
+/* Headroom required for dongle-to-host communication.  Packets allocated
+ * locally in the dongle (e.g. for CDC ioctls or RNDIS messages) should
+ * leave this much room in front for low-level message headers which may
+ * be needed to get across the dongle bus to the host.  (These messages
+ * don't go over the network, so room for the full WL header above would
+ * be a waste.).
+*/
+#define BCMDONGLEHDRSZ 12
+#define BCMDONGLEPADSZ 16
+
+#define BCMDONGLEOVERHEAD      (BCMDONGLEHDRSZ + BCMDONGLEPADSZ)
+
+
+#if defined(NO_BCMDBG_ASSERT)
+# undef BCMDBG_ASSERT
+# undef BCMASSERT_LOG
+#endif
+
+#if defined(BCMASSERT_LOG)
+#define BCMASSERT_SUPPORT
+#endif 
+
+/* Macros for doing definition and get/set of bitfields
+ * Usage example, e.g. a three-bit field (bits 4-6):
+ *    #define <NAME>_M BITFIELD_MASK(3)
+ *    #define <NAME>_S 4
+ * ...
+ *    regval = R_REG(osh, &regs->regfoo);
+ *    field = GFIELD(regval, <NAME>);
+ *    regval = SFIELD(regval, <NAME>, 1);
+ *    W_REG(osh, &regs->regfoo, regval);
+ */
+#define BITFIELD_MASK(width) \
+               (((unsigned)1 << (width)) - 1)
+#define GFIELD(val, field) \
+               (((val) >> field ## _S) & field ## _M)
+#define SFIELD(val, field, bits) \
+               (((val) & (~(field ## _M << field ## _S))) | \
+                ((unsigned)(bits) << field ## _S))
+
+/* define BCMSMALL to remove misc features for memory-constrained environments */
+#ifdef BCMSMALL
+#undef BCMSPACE
+#define bcmspace       FALSE   /* if (bcmspace) code is discarded */
+#else
+#define        BCMSPACE
+#define bcmspace       TRUE    /* if (bcmspace) code is retained */
+#endif
+
+/* Max. nvram variable table size */
+#ifndef MAXSZ_NVRAM_VARS
+#ifdef LARGE_NVRAM_MAXSZ
+#define MAXSZ_NVRAM_VARS       LARGE_NVRAM_MAXSZ
+#else
+/* SROM12 changes */
+#define        MAXSZ_NVRAM_VARS        6144
+#endif /* LARGE_NVRAM_MAXSZ */
+#endif /* !MAXSZ_NVRAM_VARS */
+
+
+
+/* WL_ENAB_RUNTIME_CHECK may be set based upon the #define below (for ROM builds). It may also
+ * be defined via makefiles (e.g. ROM auto abandon unoptimized compiles).
+ */
+
+
+#ifdef BCMLFRAG /* BCMLFRAG support enab macros  */
+       extern bool _bcmlfrag;
+       #if defined(WL_ENAB_RUNTIME_CHECK) || !defined(DONGLEBUILD)
+               #define BCMLFRAG_ENAB() (_bcmlfrag)
+       #elif defined(BCMLFRAG_DISABLED)
+               #define BCMLFRAG_ENAB() (0)
+       #else
+               #define BCMLFRAG_ENAB() (1)
+       #endif
+#else
+       #define BCMLFRAG_ENAB()         (0)
+#endif /* BCMLFRAG_ENAB */
+#define        RXMODE1 1       /* descriptor split */
+#define        RXMODE2 2       /* descriptor split + classification */
+#define        RXMODE3 3       /* fifo split + classification */
+#define        RXMODE4 4       /* fifo split + classification + hdr conversion */
+
+#ifdef BCMSPLITRX /* BCMLFRAG support enab macros  */
+       extern bool _bcmsplitrx;
+       extern uint8 _bcmsplitrx_mode;
+       #if defined(WL_ENAB_RUNTIME_CHECK) || !defined(DONGLEBUILD)
+               #define BCMSPLITRX_ENAB() (_bcmsplitrx)
+               #define BCMSPLITRX_MODE() (_bcmsplitrx_mode)
+       #elif defined(BCMSPLITRX_DISABLED)
+               #define BCMSPLITRX_ENAB()       (0)
+               #define BCMSPLITRX_MODE()       (0)
+       #else
+               #define BCMSPLITRX_ENAB()       (1)
+               #define BCMSPLITRX_MODE() (_bcmsplitrx_mode)
+       #endif
+#else
+       #define BCMSPLITRX_ENAB()               (0)
+       #define BCMSPLITRX_MODE()               (0)
+#endif /* BCMSPLITRX */
+
+#ifdef BCMPCIEDEV /* BCMPCIEDEV support enab macros */
+extern bool _pciedevenab;
+       #if defined(WL_ENAB_RUNTIME_CHECK)
+               #define BCMPCIEDEV_ENAB() (_pciedevenab)
+       #elif defined(BCMPCIEDEV_ENABLED)
+               #define BCMPCIEDEV_ENAB()       1
+       #else
+               #define BCMPCIEDEV_ENAB()       0
+       #endif
+#else
+       #define BCMPCIEDEV_ENAB()       0
+#endif /* BCMPCIEDEV */
+
+#define SPLIT_RXMODE1()        ((BCMSPLITRX_MODE() == RXMODE1))
+#define SPLIT_RXMODE2()        ((BCMSPLITRX_MODE() == RXMODE2))
+#define SPLIT_RXMODE3()        ((BCMSPLITRX_MODE() == RXMODE3))
+#define SPLIT_RXMODE4()        ((BCMSPLITRX_MODE() == RXMODE4))
+
+#define PKT_CLASSIFY() (SPLIT_RXMODE2() || SPLIT_RXMODE3() || SPLIT_RXMODE4())
+#define RXFIFO_SPLIT() (SPLIT_RXMODE3() || SPLIT_RXMODE4())
+#define HDR_CONV()     (SPLIT_RXMODE4())
+
+#define PKT_CLASSIFY_EN(x)     ((PKT_CLASSIFY()) && (PKT_CLASSIFY_FIFO == (x)))
+#ifdef BCM_SPLITBUF
+       extern bool _bcmsplitbuf;
+       #if defined(WL_ENAB_RUNTIME_CHECK) || !defined(DONGLEBUILD)
+               #define BCM_SPLITBUF_ENAB() (_bcmsplitbuf)
+       #elif defined(BCM_SPLITBUF_DISABLED)
+               #define BCM_SPLITBUF_ENAB()     (0)
+       #else
+               #define BCM_SPLITBUF_ENAB()     (1)
+       #endif
+#else
+       #define BCM_SPLITBUF_ENAB()             (0)
+#endif /* BCM_SPLITBUF */
+
+/* Max size for reclaimable NVRAM array */
+#ifdef DL_NVRAM
+#define NVRAM_ARRAY_MAXSIZE    DL_NVRAM
+#else
+#define NVRAM_ARRAY_MAXSIZE    MAXSZ_NVRAM_VARS
+#endif /* DL_NVRAM */
+
+extern uint32 gFWID;
+
+
+#endif /* _bcmdefs_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/bcmdevs.h b/drivers/net/wireless/bcmdhd_1363/include/bcmdevs.h
new file mode 100644 (file)
index 0000000..5051abf
--- /dev/null
@@ -0,0 +1,806 @@
+/*
+ * Broadcom device-specific manifest constants.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmdevs.h 627766 2016-03-28 11:12:28Z $
+ */
+
+#ifndef        _BCMDEVS_H
+#define        _BCMDEVS_H
+
+/* PCI vendor IDs */
+#define        VENDOR_EPIGRAM          0xfeda
+#define        VENDOR_BROADCOM         0x14e4
+#define        VENDOR_3COM             0x10b7
+#define        VENDOR_NETGEAR          0x1385
+#define        VENDOR_DIAMOND          0x1092
+#define        VENDOR_INTEL            0x8086
+#define        VENDOR_DELL             0x1028
+#define        VENDOR_HP               0x103c
+#define        VENDOR_HP_COMPAQ        0x0e11
+#define        VENDOR_APPLE            0x106b
+#define VENDOR_SI_IMAGE                0x1095          /* Silicon Image, used by Arasan SDIO Host */
+#define VENDOR_BUFFALO         0x1154          /* Buffalo vendor id */
+#define VENDOR_TI              0x104c          /* Texas Instruments */
+#define VENDOR_RICOH           0x1180          /* Ricoh */
+#define VENDOR_JMICRON         0x197b
+
+
+/* PCMCIA vendor IDs */
+#define        VENDOR_BROADCOM_PCMCIA  0x02d0
+
+/* SDIO vendor IDs */
+#define        VENDOR_BROADCOM_SDIO    0x00BF
+
+/* DONGLE VID/PIDs */
+#define BCM_DNGL_VID           0x0a5c
+#define BCM_DNGL_BL_PID_4328   0xbd12
+#define BCM_DNGL_BL_PID_4322   0xbd13
+#define BCM_DNGL_BL_PID_4319    0xbd16
+#define BCM_DNGL_BL_PID_43236   0xbd17
+#define BCM_DNGL_BL_PID_4332   0xbd18
+#define BCM_DNGL_BL_PID_4330   0xbd19
+#define BCM_DNGL_BL_PID_4334   0xbd1a
+#define BCM_DNGL_BL_PID_43239   0xbd1b
+#define BCM_DNGL_BL_PID_4324   0xbd1c
+#define BCM_DNGL_BL_PID_4360   0xbd1d
+#define BCM_DNGL_BL_PID_43143  0xbd1e
+#define BCM_DNGL_BL_PID_43242  0xbd1f
+#define BCM_DNGL_BL_PID_43342  0xbd21
+#define BCM_DNGL_BL_PID_4335   0xbd20
+#define BCM_DNGL_BL_PID_43341  0xbd22
+#define BCM_DNGL_BL_PID_4350    0xbd23
+#define BCM_DNGL_BL_PID_4345    0xbd24
+#define BCM_DNGL_BL_PID_4349   0xbd25
+#define BCM_DNGL_BL_PID_4354   0xbd26
+#define BCM_DNGL_BL_PID_43569   0xbd27
+#define BCM_DNGL_BL_PID_43909  0xbd28
+
+#define BCM_DNGL_BDC_PID       0x0bdc
+#define BCM_DNGL_JTAG_PID      0x4a44
+
+/* HW USB BLOCK [CPULESS USB] PIDs */
+#define BCM_HWUSB_PID_43239     43239
+
+/* PCI Device IDs */
+#define        BCM4210_DEVICE_ID       0x1072          /* never used */
+#define        BCM4230_DEVICE_ID       0x1086          /* never used */
+#define        BCM4401_ENET_ID         0x170c          /* 4401b0 production enet cards */
+#define        BCM3352_DEVICE_ID       0x3352          /* bcm3352 device id */
+#define        BCM3360_DEVICE_ID       0x3360          /* bcm3360 device id */
+#define        BCM4211_DEVICE_ID       0x4211
+#define        BCM4231_DEVICE_ID       0x4231
+#define        BCM4303_D11B_ID         0x4303          /* 4303 802.11b */
+#define        BCM4311_D11G_ID         0x4311          /* 4311 802.11b/g id */
+#define        BCM4311_D11DUAL_ID      0x4312          /* 4311 802.11a/b/g id */
+#define        BCM4311_D11A_ID         0x4313          /* 4311 802.11a id */
+#define        BCM4328_D11DUAL_ID      0x4314          /* 4328/4312 802.11a/g id */
+#define        BCM4328_D11G_ID         0x4315          /* 4328/4312 802.11g id */
+#define        BCM4328_D11A_ID         0x4316          /* 4328/4312 802.11a id */
+#define        BCM4318_D11G_ID         0x4318          /* 4318 802.11b/g id */
+#define        BCM4318_D11DUAL_ID      0x4319          /* 4318 802.11a/b/g id */
+#define        BCM4318_D11A_ID         0x431a          /* 4318 802.11a id */
+#define        BCM4325_D11DUAL_ID      0x431b          /* 4325 802.11a/g id */
+#define        BCM4325_D11G_ID         0x431c          /* 4325 802.11g id */
+#define        BCM4325_D11A_ID         0x431d          /* 4325 802.11a id */
+#define        BCM4306_D11G_ID         0x4320          /* 4306 802.11g */
+#define        BCM4306_D11A_ID         0x4321          /* 4306 802.11a */
+#define        BCM4306_UART_ID         0x4322          /* 4306 uart */
+#define        BCM4306_V90_ID          0x4323          /* 4306 v90 codec */
+#define        BCM4306_D11DUAL_ID      0x4324          /* 4306 dual A+B */
+#define        BCM4306_D11G_ID2        0x4325          /* BCM4306_D11G_ID; INF w/loose binding war */
+#define        BCM4321_D11N_ID         0x4328          /* 4321 802.11n dualband id */
+#define        BCM4321_D11N2G_ID       0x4329          /* 4321 802.11n 2.4Ghz band id */
+#define        BCM4321_D11N5G_ID       0x432a          /* 4321 802.11n 5Ghz band id */
+#define BCM4322_D11N_ID                0x432b          /* 4322 802.11n dualband device */
+#define BCM4322_D11N2G_ID      0x432c          /* 4322 802.11n 2.4GHz device */
+#define BCM4322_D11N5G_ID      0x432d          /* 4322 802.11n 5GHz device */
+#define BCM4329_D11N_ID                0x432e          /* 4329 802.11n dualband device */
+#define BCM4329_D11N2G_ID      0x432f          /* 4329 802.11n 2.4G device */
+#define BCM4329_D11N5G_ID      0x4330          /* 4329 802.11n 5G device */
+#define        BCM4315_D11DUAL_ID      0x4334          /* 4315 802.11a/g id */
+#define        BCM4315_D11G_ID         0x4335          /* 4315 802.11g id */
+#define        BCM4315_D11A_ID         0x4336          /* 4315 802.11a id */
+#define BCM4319_D11N_ID                0x4337          /* 4319 802.11n dualband device */
+#define BCM4319_D11N2G_ID      0x4338          /* 4319 802.11n 2.4G device */
+#define BCM4319_D11N5G_ID      0x4339          /* 4319 802.11n 5G device */
+#define BCM43231_D11N2G_ID     0x4340          /* 43231 802.11n 2.4GHz device */
+#define BCM43221_D11N2G_ID     0x4341          /* 43221 802.11n 2.4GHz device */
+#define BCM43222_D11N_ID       0x4350          /* 43222 802.11n dualband device */
+#define BCM43222_D11N2G_ID     0x4351          /* 43222 802.11n 2.4GHz device */
+#define BCM43222_D11N5G_ID     0x4352          /* 43222 802.11n 5GHz device */
+#define BCM43224_D11N_ID       0x4353          /* 43224 802.11n dualband device */
+#define BCM43224_D11N_ID_VEN1  0x0576          /* Vendor specific 43224 802.11n db device */
+#define BCM43226_D11N_ID       0x4354          /* 43226 802.11n dualband device */
+#define BCM43236_D11N_ID       0x4346          /* 43236 802.11n dualband device */
+#define BCM43236_D11N2G_ID     0x4347          /* 43236 802.11n 2.4GHz device */
+#define BCM43236_D11N5G_ID     0x4348          /* 43236 802.11n 5GHz device */
+#define BCM43225_D11N2G_ID     0x4357          /* 43225 802.11n 2.4GHz device */
+#define BCM43421_D11N_ID       0xA99D          /* 43421 802.11n dualband device */
+#define BCM4313_D11N2G_ID      0x4727          /* 4313 802.11n 2.4G device */
+#define BCM4330_D11N_ID         0x4360          /* 4330 802.11n dualband device */
+#define BCM4330_D11N2G_ID       0x4361          /* 4330 802.11n 2.4G device */
+#define BCM4330_D11N5G_ID       0x4362          /* 4330 802.11n 5G device */
+#define BCM4336_D11N_ID                0x4343          /* 4336 802.11n 2.4GHz device */
+#define BCM6362_D11N_ID                0x435f          /* 6362 802.11n dualband device */
+#define BCM6362_D11N2G_ID      0x433f          /* 6362 802.11n 2.4Ghz band id */
+#define BCM6362_D11N5G_ID      0x434f          /* 6362 802.11n 5Ghz band id */
+#define BCM4331_D11N_ID                0x4331          /* 4331 802.11n dualband id */
+#define BCM4331_D11N2G_ID      0x4332          /* 4331 802.11n 2.4Ghz band id */
+#define BCM4331_D11N5G_ID      0x4333          /* 4331 802.11n 5Ghz band id */
+#define BCM43237_D11N_ID       0x4355          /* 43237 802.11n dualband device */
+#define BCM43237_D11N5G_ID     0x4356          /* 43237 802.11n 5GHz device */
+#define BCM43227_D11N2G_ID     0x4358          /* 43228 802.11n 2.4GHz device */
+#define BCM43228_D11N_ID       0x4359          /* 43228 802.11n DualBand device */
+#define BCM43228_D11N5G_ID     0x435a          /* 43228 802.11n 5GHz device */
+#define BCM43362_D11N_ID       0x4363          /* 43362 802.11n 2.4GHz device */
+#define BCM43239_D11N_ID       0x4370          /* 43239 802.11n dualband device */
+#define BCM4324_D11N_ID                0x4374          /* 4324 802.11n dualband device */
+#define BCM43217_D11N2G_ID     0x43a9          /* 43217 802.11n 2.4GHz device */
+#define BCM43131_D11N2G_ID     0x43aa          /* 43131 802.11n 2.4GHz device */
+#define BCM4314_D11N2G_ID      0x4364          /* 4314 802.11n 2.4G device */
+#define BCM43142_D11N2G_ID     0x4365          /* 43142 802.11n 2.4G device */
+#define BCM43143_D11N2G_ID     0x4366          /* 43143 802.11n 2.4G device */
+#define BCM4334_D11N_ID                0x4380          /* 4334 802.11n dualband device */
+#define BCM4334_D11N2G_ID      0x4381          /* 4334 802.11n 2.4G device */
+#define BCM4334_D11N5G_ID      0x4382          /* 4334 802.11n 5G device */
+#define BCM43342_D11N_ID       0x4383          /* 43342 802.11n dualband device */
+#define BCM43342_D11N2G_ID     0x4384          /* 43342 802.11n 2.4G device */
+#define BCM43342_D11N5G_ID     0x4385          /* 43342 802.11n 5G device */
+#define BCM43341_D11N_ID       0x4386          /* 43341 802.11n dualband device */
+#define BCM43341_D11N2G_ID     0x4387          /* 43341 802.11n 2.4G device */
+#define BCM43341_D11N5G_ID     0x4388          /* 43341 802.11n 5G device */
+#define BCM4360_D11AC_ID       0x43a0
+#define BCM4360_D11AC2G_ID     0x43a1
+#define BCM4360_D11AC5G_ID     0x43a2
+#define BCM4345_D11AC_ID       0x43ab          /* 4345 802.11ac dualband device */
+#define BCM4345_D11AC2G_ID     0x43ac          /* 4345 802.11ac 2.4G device */
+#define BCM4345_D11AC5G_ID     0x43ad          /* 4345 802.11ac 5G device */
+#define BCM4335_D11AC_ID       0x43ae
+#define BCM4335_D11AC2G_ID     0x43af
+#define BCM4335_D11AC5G_ID     0x43b0
+#define BCM4352_D11AC_ID       0x43b1          /* 4352 802.11ac dualband device */
+#define BCM4352_D11AC2G_ID     0x43b2          /* 4352 802.11ac 2.4G device */
+#define BCM4352_D11AC5G_ID     0x43b3          /* 4352 802.11ac 5G device */
+#define BCM43602_D11AC_ID      0x43ba          /* ac dualband PCI devid SPROM programmed */
+#define BCM43602_D11AC2G_ID    0x43bb          /* 43602 802.11ac 2.4G device */
+#define BCM43602_D11AC5G_ID    0x43bc          /* 43602 802.11ac 5G device */
+#define BCM4349_D11AC_ID       0x4349          /* 4349 802.11ac dualband device */
+#define BCM4349_D11AC2G_ID     0x43dd          /* 4349 802.11ac 2.4G device */
+#define BCM4349_D11AC5G_ID     0x43de          /* 4349 802.11ac 5G device */
+#define BCM53573_D11AC_ID      0x43b4          /* 53573 802.11ac dualband device */
+#define BCM53573_D11AC2G_ID    0x43b5          /* 53573 802.11ac 2.4G device */
+#define BCM53573_D11AC5G_ID    0x43b6          /* 53573 802.11ac 5G device */
+#define BCM47189_D11AC_ID      0x43c6          /* 47189 802.11ac dualband device */
+#define BCM47189_D11AC2G_ID    0x43c7          /* 47189 802.11ac 2.4G device */
+#define BCM47189_D11AC5G_ID    0x43c8          /* 47189 802.11ac 5G device */
+#define BCM4355_D11AC_ID       0x43dc          /* 4355 802.11ac dualband device */
+#define BCM4355_D11AC2G_ID     0x43fc          /* 4355 802.11ac 2.4G device */
+#define BCM4355_D11AC5G_ID     0x43fd          /* 4355 802.11ac 5G device */
+#define BCM4359_D11AC_ID       0x43ef          /* 4359 802.11ac dualband device */
+#define BCM4359_D11AC2G_ID     0x43fe          /* 4359 802.11ac 2.4G device */
+#define BCM4359_D11AC5G_ID     0x43ff          /* 4359 802.11ac 5G device */
+#define BCM43596_D11AC_ID      0x4415          /* 43596 802.11ac dualband device */
+#define BCM43596_D11AC2G_ID    0x4416          /* 43596 802.11ac 2.4G device */
+#define BCM43596_D11AC5G_ID    0x4417          /* 43596 802.11ac 5G device */
+#define BCM43597_D11AC_ID      0x441c          /* 43597 802.11ac dualband device */
+#define BCM43597_D11AC2G_ID    0x441d          /* 43597 802.11ac 2.4G device */
+#define BCM43597_D11AC5G_ID    0x441e          /* 43597 802.11ac 5G device */
+#define BCM43909_D11AC_ID      0x43d0          /* 43909 802.11ac dualband device */
+#define BCM43909_D11AC2G_ID    0x43d1          /* 43909 802.11ac 2.4G device */
+#define BCM43909_D11AC5G_ID    0x43d2          /* 43909 802.11ac 5G device */
+
+/* PCI Subsystem ID */
+#define BCM943228HMB_SSID_VEN1 0x0607
+#define BCM94313HMGBL_SSID_VEN1        0x0608
+#define BCM94313HMG_SSID_VEN1  0x0609
+#define BCM943142HM_SSID_VEN1  0x0611
+
+#define BCM43143_D11N2G_ID     0x4366          /* 43143 802.11n 2.4G device */
+
+#define BCM43242_D11N_ID       0x4367          /* 43242 802.11n dualband device */
+#define BCM43242_D11N2G_ID     0x4368          /* 43242 802.11n 2.4G device */
+#define BCM43242_D11N5G_ID     0x4369          /* 43242 802.11n 5G device */
+
+#define BCM4350_D11AC_ID       0x43a3
+#define BCM4350_D11AC2G_ID     0x43a4
+#define BCM4350_D11AC5G_ID     0x43a5
+
+#define BCM43556_D11AC_ID      0x43b7
+#define BCM43556_D11AC2G_ID    0x43b8
+#define BCM43556_D11AC5G_ID    0x43b9
+
+#define BCM43558_D11AC_ID      0x43c0
+#define BCM43558_D11AC2G_ID    0x43c1
+#define BCM43558_D11AC5G_ID    0x43c2
+
+#define BCM43566_D11AC_ID      0x43d3
+#define BCM43566_D11AC2G_ID    0x43d4
+#define BCM43566_D11AC5G_ID    0x43d5
+
+#define BCM43568_D11AC_ID      0x43d6
+#define BCM43568_D11AC2G_ID    0x43d7
+#define BCM43568_D11AC5G_ID    0x43d8
+
+#define BCM43569_D11AC_ID      0x43d9
+#define BCM43569_D11AC2G_ID    0x43da
+#define BCM43569_D11AC5G_ID    0x43db
+
+#define BCM43570_D11AC_ID      0x43d9
+#define BCM43570_D11AC2G_ID    0x43da
+#define BCM43570_D11AC5G_ID    0x43db
+
+#define BCM4354_D11AC_ID       0x43df          /* 4354 802.11ac dualband device */
+#define BCM4354_D11AC2G_ID     0x43e0          /* 4354 802.11ac 2.4G device */
+#define BCM4354_D11AC5G_ID     0x43e1          /* 4354 802.11ac 5G device */
+#define BCM43430_D11N2G_ID     0x43e2          /* 43430 802.11n 2.4G device */
+
+
+#define BCM4365_D11AC_ID       0x43ca
+#define BCM4365_D11AC2G_ID     0x43cb
+#define BCM4365_D11AC5G_ID     0x43cc
+
+#define BCM4366_D11AC_ID       0x43c3
+#define BCM4366_D11AC2G_ID     0x43c4
+#define BCM4366_D11AC5G_ID     0x43c5
+
+#define BCM43349_D11N_ID       0x43e6          /* 43349 802.11n dualband id */
+#define BCM43349_D11N2G_ID     0x43e7          /* 43349 802.11n 2.4Ghz band id */
+#define BCM43349_D11N5G_ID     0x43e8          /* 43349 802.11n 5Ghz band id */
+
+#define BCM4358_D11AC_ID        0x43e9          /* 4358 802.11ac dualband device */
+#define BCM4358_D11AC2G_ID      0x43ea          /* 4358 802.11ac 2.4G device */
+#define BCM4358_D11AC5G_ID      0x43eb          /* 4358 802.11ac 5G device */
+
+#define BCM4356_D11AC_ID       0x43ec          /* 4356 802.11ac dualband device */
+#define BCM4356_D11AC2G_ID     0x43ed          /* 4356 802.11ac 2.4G device */
+#define BCM4356_D11AC5G_ID     0x43ee          /* 4356 802.11ac 5G device */
+
+#define        BCMGPRS_UART_ID         0x4333          /* Uart id used by 4306/gprs card */
+#define        BCMGPRS2_UART_ID        0x4344          /* Uart id used by 4306/gprs card */
+#define FPGA_JTAGM_ID          0x43f0          /* FPGA jtagm device id */
+#define BCM_JTAGM_ID           0x43f1          /* BCM jtagm device id */
+#define SDIOH_FPGA_ID          0x43f2          /* sdio host fpga */
+#define BCM_SDIOH_ID           0x43f3          /* BCM sdio host id */
+#define SDIOD_FPGA_ID          0x43f4          /* sdio device fpga */
+#define SPIH_FPGA_ID           0x43f5          /* PCI SPI Host Controller FPGA */
+#define BCM_SPIH_ID            0x43f6          /* Synopsis SPI Host Controller */
+#define MIMO_FPGA_ID           0x43f8          /* FPGA mimo minimacphy device id */
+#define BCM_JTAGM2_ID          0x43f9          /* BCM alternate jtagm device id */
+#define SDHCI_FPGA_ID          0x43fa          /* Standard SDIO Host Controller FPGA */
+#define        BCM4402_ENET_ID         0x4402          /* 4402 enet */
+#define        BCM4402_V90_ID          0x4403          /* 4402 v90 codec */
+#define        BCM4410_DEVICE_ID       0x4410          /* bcm44xx family pci iline */
+#define        BCM4412_DEVICE_ID       0x4412          /* bcm44xx family pci enet */
+#define        BCM4430_DEVICE_ID       0x4430          /* bcm44xx family cardbus iline */
+#define        BCM4432_DEVICE_ID       0x4432          /* bcm44xx family cardbus enet */
+#define        BCM4704_ENET_ID         0x4706          /* 4704 enet (Use 47XX_ENET_ID instead!) */
+#define        BCM4710_DEVICE_ID       0x4710          /* 4710 primary function 0 */
+#define        BCM47XX_AUDIO_ID        0x4711          /* 47xx audio codec */
+#define        BCM47XX_V90_ID          0x4712          /* 47xx v90 codec */
+#define        BCM47XX_ENET_ID         0x4713          /* 47xx enet */
+#define        BCM47XX_EXT_ID          0x4714          /* 47xx external i/f */
+#define        BCM47XX_GMAC_ID         0x4715          /* 47xx Unimac based GbE */
+#define        BCM47XX_USBH_ID         0x4716          /* 47xx usb host */
+#define        BCM47XX_USBD_ID         0x4717          /* 47xx usb device */
+#define        BCM47XX_IPSEC_ID        0x4718          /* 47xx ipsec */
+#define        BCM47XX_ROBO_ID         0x4719          /* 47xx/53xx roboswitch core */
+#define        BCM47XX_USB20H_ID       0x471a          /* 47xx usb 2.0 host */
+#define        BCM47XX_USB20D_ID       0x471b          /* 47xx usb 2.0 device */
+#define        BCM47XX_ATA100_ID       0x471d          /* 47xx parallel ATA */
+#define        BCM47XX_SATAXOR_ID      0x471e          /* 47xx serial ATA & XOR DMA */
+#define        BCM47XX_GIGETH_ID       0x471f          /* 47xx GbE (5700) */
+#define        BCM4712_MIPS_ID         0x4720          /* 4712 base devid */
+#define        BCM4716_DEVICE_ID       0x4722          /* 4716 base devid */
+#define        BCM47XX_USB30H_ID       0x472a          /* 47xx usb 3.0 host */
+#define        BCM47XX_USB30D_ID       0x472b          /* 47xx usb 3.0 device */
+#define BCM47XX_SMBUS_EMU_ID   0x47fe          /* 47xx emulated SMBus device */
+#define        BCM47XX_XOR_EMU_ID      0x47ff          /* 47xx emulated XOR engine */
+#define        EPI41210_DEVICE_ID      0xa0fa          /* bcm4210 */
+#define        EPI41230_DEVICE_ID      0xa10e          /* bcm4230 */
+#define JINVANI_SDIOH_ID       0x4743          /* Jinvani SDIO Gold Host */
+#define BCM27XX_SDIOH_ID       0x2702          /* BCM27xx Standard SDIO Host */
+#define PCIXX21_FLASHMEDIA_ID  0x803b          /* TI PCI xx21 Standard Host Controller */
+#define PCIXX21_SDIOH_ID       0x803c          /* TI PCI xx21 Standard Host Controller */
+#define R5C822_SDIOH_ID                0x0822          /* Ricoh Co Ltd R5C822 SD/SDIO/MMC/MS/MSPro Host */
+#define JMICRON_SDIOH_ID       0x2381          /* JMicron Standard SDIO Host Controller */
+
+/* Chip IDs */
+#define        BCM4306_CHIP_ID         0x4306          /* 4306 chipcommon chipid */
+#define        BCM4311_CHIP_ID         0x4311          /* 4311 PCIe 802.11a/b/g */
+#define        BCM43111_CHIP_ID        43111           /* 43111 chipcommon chipid (OTP chipid) */
+#define        BCM43112_CHIP_ID        43112           /* 43112 chipcommon chipid (OTP chipid) */
+#define        BCM4312_CHIP_ID         0x4312          /* 4312 chipcommon chipid */
+#define BCM4313_CHIP_ID                0x4313          /* 4313 chip id */
+#define        BCM43131_CHIP_ID        43131           /* 43131 chip id (OTP chipid) */
+#define        BCM4315_CHIP_ID         0x4315          /* 4315 chip id */
+#define        BCM4318_CHIP_ID         0x4318          /* 4318 chipcommon chipid */
+#define        BCM4319_CHIP_ID         0x4319          /* 4319 chip id */
+#define        BCM4320_CHIP_ID         0x4320          /* 4320 chipcommon chipid */
+#define        BCM4321_CHIP_ID         0x4321          /* 4321 chipcommon chipid */
+#define        BCM43217_CHIP_ID        43217           /* 43217 chip id (OTP chipid) */
+#define        BCM4322_CHIP_ID         0x4322          /* 4322 chipcommon chipid */
+#define        BCM43221_CHIP_ID        43221           /* 43221 chipcommon chipid (OTP chipid) */
+#define        BCM43222_CHIP_ID        43222           /* 43222 chipcommon chipid */
+#define        BCM43224_CHIP_ID        43224           /* 43224 chipcommon chipid */
+#define        BCM43225_CHIP_ID        43225           /* 43225 chipcommon chipid */
+#define        BCM43227_CHIP_ID        43227           /* 43227 chipcommon chipid */
+#define        BCM43228_CHIP_ID        43228           /* 43228 chipcommon chipid */
+#define        BCM43226_CHIP_ID        43226           /* 43226 chipcommon chipid */
+#define        BCM43231_CHIP_ID        43231           /* 43231 chipcommon chipid (OTP chipid) */
+#define        BCM43234_CHIP_ID        43234           /* 43234 chipcommon chipid */
+#define        BCM43235_CHIP_ID        43235           /* 43235 chipcommon chipid */
+#define        BCM43236_CHIP_ID        43236           /* 43236 chipcommon chipid */
+#define        BCM43237_CHIP_ID        43237           /* 43237 chipcommon chipid */
+#define        BCM43238_CHIP_ID        43238           /* 43238 chipcommon chipid */
+#define        BCM43239_CHIP_ID        43239           /* 43239 chipcommon chipid */
+#define        BCM43420_CHIP_ID        43420           /* 43222 chipcommon chipid (OTP, RBBU) */
+#define        BCM43421_CHIP_ID        43421           /* 43224 chipcommon chipid (OTP, RBBU) */
+#define        BCM43428_CHIP_ID        43428           /* 43228 chipcommon chipid (OTP, RBBU) */
+#define        BCM43431_CHIP_ID        43431           /* 4331  chipcommon chipid (OTP, RBBU) */
+#define        BCM43460_CHIP_ID        43460           /* 4360  chipcommon chipid (OTP, RBBU) */
+#define        BCM4325_CHIP_ID         0x4325          /* 4325 chip id */
+#define        BCM4328_CHIP_ID         0x4328          /* 4328 chip id */
+#define        BCM4329_CHIP_ID         0x4329          /* 4329 chipcommon chipid */
+#define        BCM4331_CHIP_ID         0x4331          /* 4331 chipcommon chipid */
+#define BCM4336_CHIP_ID                0x4336          /* 4336 chipcommon chipid */
+#define BCM43362_CHIP_ID       43362           /* 43362 chipcommon chipid */
+#define BCM4330_CHIP_ID                0x4330          /* 4330 chipcommon chipid */
+#define BCM6362_CHIP_ID                0x6362          /* 6362 chipcommon chipid */
+#define BCM4314_CHIP_ID                0x4314          /* 4314 chipcommon chipid */
+#define BCM43142_CHIP_ID       43142           /* 43142 chipcommon chipid */
+#define BCM43143_CHIP_ID       43143           /* 43143 chipcommon chipid */
+#define        BCM4324_CHIP_ID         0x4324          /* 4324 chipcommon chipid */
+#define        BCM43242_CHIP_ID        43242           /* 43242 chipcommon chipid */
+#define        BCM43243_CHIP_ID        43243           /* 43243 chipcommon chipid */
+#define BCM4334_CHIP_ID                0x4334          /* 4334 chipcommon chipid */
+#define BCM4335_CHIP_ID                0x4335          /* 4335 chipcommon chipid */
+#define BCM4339_CHIP_ID                0x4339          /* 4339 chipcommon chipid */
+#define BCM43349_CHIP_ID       43349                   /* 43349(0xA955) chipcommon chipid */
+#define BCM4360_CHIP_ID                0x4360          /* 4360 chipcommon chipid */
+#define BCM4364_CHIP_ID                0x4364                  /* 4364 chipcommon chipid */
+#define BCM4352_CHIP_ID                0x4352          /* 4352 chipcommon chipid */
+#define BCM43526_CHIP_ID       0xAA06
+#define BCM43340_CHIP_ID       43340           /* 43340 chipcommon chipid */
+#define BCM43341_CHIP_ID       43341           /* 43341 chipcommon chipid */
+#define BCM43342_CHIP_ID       43342           /* 43342 chipcommon chipid */
+#define BCM4350_CHIP_ID                0x4350          /* 4350 chipcommon chipid */
+#define BCM4354_CHIP_ID                0x4354          /* 4354 chipcommon chipid */
+#define BCM4356_CHIP_ID                0x4356          /* 4356 chipcommon chipid */
+#define BCM43556_CHIP_ID       0xAA24          /* 43556 chipcommon chipid */
+#define BCM43558_CHIP_ID       0xAA26          /* 43558 chipcommon chipid */
+#define BCM43566_CHIP_ID       0xAA2E          /* 43566 chipcommon chipid */
+#define BCM43567_CHIP_ID       0xAA2F          /* 43567 chipcommon chipid */
+#define BCM43568_CHIP_ID       0xAA30          /* 43568 chipcommon chipid */
+#define BCM43569_CHIP_ID       0xAA31          /* 43569 chipcommon chipid */
+#define BCM43570_CHIP_ID       0xAA32          /* 43570 chipcommon chipid */
+#define BCM4358_CHIP_ID         0x4358          /* 4358 chipcommon chipid */
+#define        BCM43012_CHIP_ID        0xA804                  /* 43012 chipcommon chipid */
+#define BCM4350_CHIP(chipid)   ((CHIPID(chipid) == BCM4350_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM4354_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM4356_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM43556_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM43558_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM43566_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM43567_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM43568_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM43569_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM43570_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM4358_CHIP_ID)) /* 4350 variations */
+#define BCM4345_CHIP_ID                0x4345          /* 4345 chipcommon chipid */
+#define BCM43454_CHIP_ID       43454           /* 43454 chipcommon chipid */
+#define BCM43455_CHIP_ID    43455       /* 43455 chipcommon chipid */
+#define BCM43457_CHIP_ID    43457       /* 43457 chipcommon chipid */
+#define BCM43458_CHIP_ID    43458       /* 43458 chipcommon chipid */
+#define BCM43430_CHIP_ID       43430           /* 43430 chipcommon chipid */
+#define BCM4349_CHIP_ID                0x4349          /* 4349 chipcommon chipid */
+#define BCM4355_CHIP_ID                0x4355          /* 4355 chipcommon chipid */
+#define BCM4359_CHIP_ID                0x4359          /* 4359 chipcommon chipid */
+#define BCM4349_CHIP(chipid)   ((CHIPID(chipid) == BCM4349_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM4355_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM4359_CHIP_ID))
+
+#define BCM4345_CHIP(chipid)    (CHIPID(chipid) == BCM4345_CHIP_ID || \
+                               CHIPID(chipid) == BCM43454_CHIP_ID || \
+                               CHIPID(chipid) == BCM43455_CHIP_ID || \
+                               CHIPID(chipid) == BCM43457_CHIP_ID || \
+                               CHIPID(chipid) == BCM43458_CHIP_ID)
+
+#define CASE_BCM4345_CHIP   case BCM4345_CHIP_ID: /* fallthrough */ \
+                               case BCM43454_CHIP_ID: /* fallthrough */ \
+                               case BCM43455_CHIP_ID: /* fallthrough */ \
+                               case BCM43457_CHIP_ID: /* fallthrough */ \
+                               case BCM43458_CHIP_ID
+
+#define BCM4349_CHIP_GRPID             BCM4349_CHIP_ID: \
+                                       case BCM4355_CHIP_ID: \
+                                       case BCM4359_CHIP_ID
+
+#define BCM4365_CHIP_ID                0x4365          /* 4365 chipcommon chipid */
+#define BCM4366_CHIP_ID                0x4366          /* 4366 chipcommon chipid */
+
+#define BCM43909_CHIP_ID       0xab85          /* 43909 chipcommon chipid */
+
+#define BCM43602_CHIP_ID       0xaa52          /* 43602 chipcommon chipid */
+#define BCM43462_CHIP_ID       0xa9c6          /* 43462 chipcommon chipid */
+#define BCM43522_CHIP_ID       0xaa02          /* 43522 chipcommon chipid */
+#define BCM43602_CHIP(chipid)  ((CHIPID(chipid) == BCM43602_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM43462_CHIP_ID) || \
+                               (CHIPID(chipid) == BCM43522_CHIP_ID)) /* 43602 variations */
+#define CASE_BCM43602_CHIP             case BCM43602_CHIP_ID: /* fallthrough */ \
+                               case BCM43462_CHIP_ID: /* fallthrough */ \
+                               case BCM43522_CHIP_ID
+
+#define        BCM4342_CHIP_ID         4342            /* 4342 chipcommon chipid (OTP, RBBU) */
+#define        BCM4402_CHIP_ID         0x4402          /* 4402 chipid */
+#define        BCM4704_CHIP_ID         0x4704          /* 4704 chipcommon chipid */
+#define        BCM4706_CHIP_ID         0x5300          /* 4706 chipcommon chipid */
+#define BCM4707_CHIP_ID                53010           /* 4707 chipcommon chipid */
+#define BCM47094_CHIP_ID       53030           /* 47094 chipcommon chipid */
+#define BCM53018_CHIP_ID       53018           /* 53018 chipcommon chipid */
+#define BCM4707_CHIP(chipid)   (((chipid) == BCM4707_CHIP_ID) || \
+                               ((chipid) == BCM53018_CHIP_ID) || \
+                               ((chipid) == BCM47094_CHIP_ID))
+#define        BCM4710_CHIP_ID         0x4710          /* 4710 chipid */
+#define        BCM4712_CHIP_ID         0x4712          /* 4712 chipcommon chipid */
+#define        BCM4716_CHIP_ID         0x4716          /* 4716 chipcommon chipid */
+#define        BCM47162_CHIP_ID        47162           /* 47162 chipcommon chipid */
+#define        BCM4748_CHIP_ID         0x4748          /* 4716 chipcommon chipid (OTP, RBBU) */
+#define        BCM4749_CHIP_ID         0x4749          /* 5357 chipcommon chipid (OTP, RBBU) */
+#define BCM4785_CHIP_ID                0x4785          /* 4785 chipcommon chipid */
+#define        BCM5350_CHIP_ID         0x5350          /* 5350 chipcommon chipid */
+#define        BCM5352_CHIP_ID         0x5352          /* 5352 chipcommon chipid */
+#define        BCM5354_CHIP_ID         0x5354          /* 5354 chipcommon chipid */
+#define BCM5365_CHIP_ID                0x5365          /* 5365 chipcommon chipid */
+#define        BCM5356_CHIP_ID         0x5356          /* 5356 chipcommon chipid */
+#define        BCM5357_CHIP_ID         0x5357          /* 5357 chipcommon chipid */
+#define        BCM53572_CHIP_ID        53572           /* 53572 chipcommon chipid */
+#define        BCM53573_CHIP_ID        53573           /* 53573 chipcommon chipid */
+#define BCM53573_CHIP(chipid)  (CHIPID(chipid) == BCM53573_CHIP_ID)
+#define BCM53573_CHIP_GRPID    BCM53573_CHIP_ID
+
+/* Package IDs */
+#define        BCM4303_PKG_ID          2               /* 4303 package id */
+#define        BCM4309_PKG_ID          1               /* 4309 package id */
+#define        BCM4712LARGE_PKG_ID     0               /* 340pin 4712 package id */
+#define        BCM4712SMALL_PKG_ID     1               /* 200pin 4712 package id */
+#define        BCM4712MID_PKG_ID       2               /* 225pin 4712 package id */
+#define BCM4328USBD11G_PKG_ID  2               /* 4328 802.11g USB package id */
+#define BCM4328USBDUAL_PKG_ID  3               /* 4328 802.11a/g USB package id */
+#define BCM4328SDIOD11G_PKG_ID 4               /* 4328 802.11g SDIO package id */
+#define BCM4328SDIODUAL_PKG_ID 5               /* 4328 802.11a/g SDIO package id */
+#define BCM4329_289PIN_PKG_ID  0               /* 4329 289-pin package id */
+#define BCM4329_182PIN_PKG_ID  1               /* 4329N 182-pin package id */
+#define BCM5354E_PKG_ID                1               /* 5354E package id */
+#define        BCM4716_PKG_ID          8               /* 4716 package id */
+#define        BCM4717_PKG_ID          9               /* 4717 package id */
+#define        BCM4718_PKG_ID          10              /* 4718 package id */
+#define BCM5356_PKG_NONMODE    1               /* 5356 package without nmode suppport */
+#define BCM5358U_PKG_ID                8               /* 5358U package id */
+#define BCM5358_PKG_ID         9               /* 5358 package id */
+#define BCM47186_PKG_ID                10              /* 47186 package id */
+#define BCM5357_PKG_ID         11              /* 5357 package id */
+#define BCM5356U_PKG_ID                12              /* 5356U package id */
+#define BCM53572_PKG_ID                8               /* 53572 package id */
+#define BCM5357C0_PKG_ID       8               /* 5357c0 package id (the same as 53572) */
+#define BCM47188_PKG_ID                9               /* 47188 package id */
+#define BCM5358C0_PKG_ID       0xa             /* 5358c0 package id */
+#define BCM5356C0_PKG_ID       0xb             /* 5356c0 package id */
+#define BCM4331TT_PKG_ID        8              /* 4331 12x12 package id */
+#define BCM4331TN_PKG_ID        9              /* 4331 12x9 package id */
+#define BCM4331TNA0_PKG_ID     0xb             /* 4331 12x9 package id */
+#define BCM47189_PKG_ID                1               /* 47189 package id */
+#define BCM53573_PKG_ID                0               /* 53573 package id */
+#define        BCM4706L_PKG_ID         1               /* 4706L package id */
+
+#define HDLSIM5350_PKG_ID      1               /* HDL simulator package id for a 5350 */
+#define HDLSIM_PKG_ID          14              /* HDL simulator package id */
+#define HWSIM_PKG_ID           15              /* Hardware simulator package id */
+#define BCM43224_FAB_CSM       0x8             /* the chip is manufactured by CSM */
+#define BCM43224_FAB_SMIC      0xa             /* the chip is manufactured by SMIC */
+#define BCM4336_WLBGA_PKG_ID   0x8
+#define BCM4330_WLBGA_PKG_ID   0x0
+#define BCM4314PCIE_ARM_PKG_ID         (8 | 0) /* 4314 QFN PCI package id, bit 3 tie high */
+#define BCM4314SDIO_PKG_ID             (8 | 1) /* 4314 QFN SDIO package id */
+#define BCM4314PCIE_PKG_ID             (8 | 2) /* 4314 QFN PCI (ARM-less) package id */
+#define BCM4314SDIO_ARM_PKG_ID         (8 | 3) /* 4314 QFN SDIO (ARM-less) package id */
+#define BCM4314SDIO_FPBGA_PKG_ID       (8 | 4) /* 4314 FpBGA SDIO package id */
+#define BCM4314DEV_PKG_ID              (8 | 6) /* 4314 Developement package id */
+
+#define BCM4707_PKG_ID         1               /* 4707 package id */
+#define BCM4708_PKG_ID         2               /* 4708 package id */
+#define BCM4709_PKG_ID         0               /* 4709 package id */
+
+#define PCIXX21_FLASHMEDIA0_ID 0x8033          /* TI PCI xx21 Standard Host Controller */
+#define PCIXX21_SDIOH0_ID      0x8034          /* TI PCI xx21 Standard Host Controller */
+
+#define BCM4335_WLCSP_PKG_ID   (0x0)   /* WLCSP Module/Mobile SDIO/HSIC. */
+#define BCM4335_FCBGA_PKG_ID   (0x1)   /* FCBGA PC/Embeded/Media PCIE/SDIO */
+#define BCM4335_WLBGA_PKG_ID   (0x2)   /* WLBGA COB/Mobile SDIO/HSIC. */
+#define BCM4335_FCBGAD_PKG_ID  (0x3)   /* FCBGA Debug Debug/Dev All if's. */
+#define BCM4335_PKG_MASK       (0x3)
+#define BCM43602_12x12_PKG_ID  (0x1)   /* 12x12 pins package, used for e.g. router designs */
+
+/* boardflags */
+#define        BFL_BTC2WIRE            0x00000001  /* old 2wire Bluetooth coexistence, OBSOLETE */
+#define BFL_BTCOEX      0x00000001      /* Board supports BTCOEX */
+#define        BFL_PACTRL              0x00000002  /* Board has gpio 9 controlling the PA */
+#define BFL_AIRLINEMODE        0x00000004  /* Board implements gpio 13 radio disable indication, UNUSED */
+#define        BFL_ADCDIV              0x00000008  /* Board has the rssi ADC divider */
+#define BFL_DIS_256QAM         0x00000008
+#define        BFL_ENETROBO            0x00000010  /* Board has robo switch or core */
+#define        BFL_TSSIAVG             0x00000010  /* TSSI averaging for ACPHY chips */
+#define        BFL_NOPLLDOWN           0x00000020  /* Not ok to power down the chip pll and oscillator */
+#define        BFL_CCKHIPWR            0x00000040  /* Can do high-power CCK transmission */
+#define        BFL_ENETADM             0x00000080  /* Board has ADMtek switch */
+#define        BFL_ENETVLAN            0x00000100  /* Board has VLAN capability */
+#define        BFL_LTECOEX             0x00000200  /* LTE Coex enabled */
+#define BFL_NOPCI              0x00000400  /* Board leaves PCI floating */
+#define BFL_FEM                        0x00000800  /* Board supports the Front End Module */
+#define BFL_EXTLNA             0x00001000  /* Board has an external LNA in 2.4GHz band */
+#define BFL_HGPA               0x00002000  /* Board has a high gain PA */
+#define        BFL_BTC2WIRE_ALTGPIO    0x00004000  /* Board's BTC 2wire is in the alternate gpios */
+#define        BFL_ALTIQ               0x00008000  /* Alternate I/Q settings */
+#define BFL_NOPA               0x00010000  /* Board has no PA */
+#define BFL_RSSIINV            0x00020000  /* Board's RSSI uses positive slope(not TSSI) */
+#define BFL_PAREF              0x00040000  /* Board uses the PARef LDO */
+#define BFL_3TSWITCH           0x00080000  /* Board uses a triple throw switch shared with BT */
+#define BFL_PHASESHIFT         0x00100000  /* Board can support phase shifter */
+#define BFL_BUCKBOOST          0x00200000  /* Power topology uses BUCKBOOST */
+#define BFL_FEM_BT             0x00400000  /* Board has FEM and switch to share antenna w/ BT */
+#define BFL_NOCBUCK            0x00800000  /* Power topology doesn't use CBUCK */
+#define BFL_CCKFAVOREVM                0x01000000  /* Favor CCK EVM over spectral mask */
+#define BFL_PALDO              0x02000000  /* Power topology uses PALDO */
+#define BFL_LNLDO2_2P5         0x04000000  /* Select 2.5V as LNLDO2 output voltage */
+#define BFL_FASTPWR            0x08000000
+#define BFL_UCPWRCTL_MININDX   0x08000000  /* Enforce min power index to avoid FEM damage */
+#define BFL_EXTLNA_5GHz                0x10000000  /* Board has an external LNA in 5GHz band */
+#define BFL_TRSW_1by2          0x20000000  /* Board has 2 TRSW's in 1by2 designs */
+#define BFL_GAINBOOSTA01        0x20000000  /* 5g Gainboost for core0 and core1 */
+#define BFL_LO_TRSW_R_5GHz     0x40000000  /* In 5G do not throw TRSW to T for clipLO gain */
+#define BFL_ELNA_GAINDEF       0x80000000  /* Backoff InitGain based on elna_2g/5g field
+                                            * when this flag is set
+                                            */
+#define BFL_EXTLNA_TX  0x20000000      /* Temp boardflag to indicate to */
+
+/* boardflags2 */
+#define BFL2_RXBB_INT_REG_DIS  0x00000001  /* Board has an external rxbb regulator */
+#define BFL2_APLL_WAR          0x00000002  /* Flag to implement alternative A-band PLL settings */
+#define BFL2_TXPWRCTRL_EN      0x00000004  /* Board permits enabling TX Power Control */
+#define BFL2_2X4_DIV           0x00000008  /* Board supports the 2X4 diversity switch */
+#define BFL2_5G_PWRGAIN                0x00000010  /* Board supports 5G band power gain */
+#define BFL2_PCIEWAR_OVR       0x00000020  /* Board overrides ASPM and Clkreq settings */
+#define BFL2_CAESERS_BRD       0x00000040  /* Board is Caesers brd (unused by sw) */
+#define BFL2_BTC3WIRE          0x00000080  /* Board support legacy 3 wire or 4 wire */
+#define BFL2_BTCLEGACY          0x00000080  /* Board support legacy 3/4 wire, to replace
+                                            * BFL2_BTC3WIRE
+                                            */
+#define BFL2_SKWRKFEM_BRD      0x00000100  /* 4321mcm93 board uses Skyworks FEM */
+#define BFL2_SPUR_WAR          0x00000200  /* Board has a WAR for clock-harmonic spurs */
+#define BFL2_GPLL_WAR          0x00000400  /* Flag to narrow G-band PLL loop b/w */
+#define BFL2_TRISTATE_LED      0x00000800  /* Tri-state the LED */
+#define BFL2_SINGLEANT_CCK     0x00001000  /* Tx CCK pkts on Ant 0 only */
+#define BFL2_2G_SPUR_WAR       0x00002000  /* WAR to reduce and avoid clock-harmonic spurs in 2G */
+#define BFL2_BPHY_ALL_TXCORES  0x00004000  /* Transmit bphy frames using all tx cores */
+#define BFL2_FCC_BANDEDGE_WAR  0x00008000  /* Activates WAR to improve FCC bandedge performance */
+#define BFL2_DAC_SPUR_IMPROVEMENT 0x00008000       /* Reducing DAC Spurs */
+#define BFL2_GPLL_WAR2         0x00010000  /* Flag to widen G-band PLL loop b/w */
+#define BFL2_REDUCED_PA_TURNONTIME 0x00010000  /* Flag to reduce PA turn on Time */
+#define BFL2_IPALVLSHIFT_3P3    0x00020000
+#define BFL2_INTERNDET_TXIQCAL  0x00040000  /* Use internal envelope detector for TX IQCAL */
+#define BFL2_XTALBUFOUTEN       0x00080000  /* Keep the buffered Xtal output from radio on */
+                               /* Most drivers will turn it off without this flag */
+                               /* to save power. */
+
+#define BFL2_ANAPACTRL_2G      0x00100000  /* 2G ext PAs are controlled by analog PA ctrl lines */
+#define BFL2_ANAPACTRL_5G      0x00200000  /* 5G ext PAs are controlled by analog PA ctrl lines */
+#define BFL2_ELNACTRL_TRSW_2G  0x00400000  /* AZW4329: 2G gmode_elna_gain controls TR Switch */
+#define BFL2_BT_SHARE_ANT0     0x00800000  /* share core0 antenna with BT */
+#define BFL2_TEMPSENSE_HIGHER  0x01000000  /* The tempsense threshold can sustain higher value
+                                            * than programmed. The exact delta is decided by
+                                            * driver per chip/boardtype. This can be used
+                                            * when tempsense qualification happens after shipment
+                                            */
+#define BFL2_BTC3WIREONLY       0x02000000  /* standard 3 wire btc only.  4 wire not supported */
+#define BFL2_PWR_NOMINAL       0x04000000  /* 0: power reduction on, 1: no power reduction */
+#define BFL2_EXTLNA_PWRSAVE    0x08000000  /* boardflag to enable ucode to apply power save */
+                                               /* ucode control of eLNA during Tx */
+#define BFL2_4313_RADIOREG     0x10000000
+                                                                          /*  board rework */
+#define BFL2_DYNAMIC_VMID      0x10000000  /* enable dynamic Vmid in idle TSSI CAL for 4331 */
+
+#define BFL2_SDR_EN            0x20000000  /* SDR enabled or disabled */
+#define BFL2_DYNAMIC_VMID      0x10000000  /* boardflag to enable dynamic Vmid idle TSSI CAL */
+#define BFL2_LNA1BYPFORTR2G    0x40000000  /* acphy, enable lna1 bypass for clip gain, 2g */
+#define BFL2_LNA1BYPFORTR5G    0x80000000  /* acphy, enable lna1 bypass for clip gain, 5g */
+
+/* SROM 11 - 11ac boardflag definitions */
+#define BFL_SROM11_BTCOEX  0x00000001  /* Board supports BTCOEX */
+#define BFL_SROM11_WLAN_BT_SH_XTL  0x00000002  /* bluetooth and wlan share same crystal */
+#define BFL_SROM11_EXTLNA      0x00001000  /* Board has an external LNA in 2.4GHz band */
+#define BFL_SROM11_EPA_TURNON_TIME     0x00018000  /* 2 bits for different PA turn on times */
+#define BFL_SROM11_EPA_TURNON_TIME_SHIFT  15
+#define BFL_SROM11_PRECAL_TX_IDX       0x00040000  /* Dedicated TX IQLOCAL IDX values */
+                               /* per subband, as derived from 43602A1 MCH5 */
+#define BFL_SROM11_EXTLNA_5GHz 0x10000000  /* Board has an external LNA in 5GHz band */
+#define BFL_SROM11_GAINBOOSTA01        0x20000000  /* 5g Gainboost for core0 and core1 */
+#define BFL2_SROM11_APLL_WAR   0x00000002  /* Flag to implement alternative A-band PLL settings */
+#define BFL2_SROM11_ANAPACTRL_2G  0x00100000  /* 2G ext PAs are ctrl-ed by analog PA ctrl lines */
+#define BFL2_SROM11_ANAPACTRL_5G  0x00200000  /* 5G ext PAs are ctrl-ed by analog PA ctrl lines */
+#define BFL2_SROM11_SINGLEANT_CCK      0x00001000  /* Tx CCK pkts on Ant 0 only */
+#define BFL2_SROM11_EPA_ON_DURING_TXIQLOCAL    0x00020000  /* Keep ext. PA's on in TX IQLO CAL */
+
+/* boardflags3 */
+#define BFL3_FEMCTRL_SUB         0x00000007  /* acphy, subrevs of femctrl on top of srom_femctrl */
+#define BFL3_RCAL_WAR            0x00000008  /* acphy, rcal war active on this board (4335a0) */
+#define BFL3_TXGAINTBLID         0x00000070  /* acphy, txgain table id */
+#define BFL3_TXGAINTBLID_SHIFT   0x4         /* acphy, txgain table id shift bit */
+#define BFL3_TSSI_DIV_WAR        0x00000080  /* acphy, Seperate paparam for 20/40/80 */
+#define BFL3_TSSI_DIV_WAR_SHIFT          0x7         /* acphy, Seperate paparam for 20/40/80 shift bit */
+#define BFL3_FEMTBL_FROM_NVRAM    0x00000100  /* acphy, femctrl table is read from nvram */
+#define BFL3_FEMTBL_FROM_NVRAM_SHIFT 0x8         /* acphy, femctrl table is read from nvram */
+#define BFL3_AGC_CFG_2G           0x00000200  /* acphy, gain control configuration for 2G */
+#define BFL3_AGC_CFG_5G           0x00000400  /* acphy, gain control configuration for 5G */
+#define BFL3_PPR_BIT_EXT          0x00000800  /* acphy, bit position for 1bit extension for ppr */
+#define BFL3_PPR_BIT_EXT_SHIFT    11          /* acphy, bit shift for 1bit extension for ppr */
+#define BFL3_BBPLL_SPR_MODE_DIS          0x00001000  /* acphy, disables bbpll spur modes */
+#define BFL3_RCAL_OTP_VAL_EN      0x00002000  /* acphy, to read rcal_trim value from otp */
+#define BFL3_2GTXGAINTBL_BLANK   0x00004000  /* acphy, blank the first X ticks of 2g gaintbl */
+#define BFL3_2GTXGAINTBL_BLANK_SHIFT 14       /* acphy, blank the first X ticks of 2g gaintbl */
+#define BFL3_5GTXGAINTBL_BLANK   0x00008000  /* acphy, blank the first X ticks of 5g gaintbl */
+#define BFL3_5GTXGAINTBL_BLANK_SHIFT 15       /* acphy, blank the first X ticks of 5g gaintbl */
+#define BFL3_PHASETRACK_MAX_ALPHABETA    0x00010000  /* acphy, to max out alpha,beta to 511 */
+#define BFL3_PHASETRACK_MAX_ALPHABETA_SHIFT 16       /* acphy, to max out alpha,beta to 511 */
+/* acphy, to use backed off gaintbl for lte-coex */
+#define BFL3_LTECOEX_GAINTBL_EN           0x00060000
+/* acphy, to use backed off gaintbl for lte-coex */
+#define BFL3_LTECOEX_GAINTBL_EN_SHIFT 17
+#define BFL3_5G_SPUR_WAR          0x00080000  /* acphy, enable spur WAR in 5G band */
+#define BFL3_1X1_RSDB_ANT        0x01000000  /* to find if 2-ant RSDB board or 1-ant RSDB board */
+#define BFL3_1X1_RSDB_ANT_SHIFT           24
+
+/* acphy: lpmode2g and lpmode_5g related boardflags */
+#define BFL3_ACPHY_LPMODE_2G     0x00300000  /* bits 20:21 for lpmode_2g choice */
+#define BFL3_ACPHY_LPMODE_2G_SHIFT       20
+
+#define BFL3_ACPHY_LPMODE_5G     0x00C00000  /* bits 22:23 for lpmode_5g choice */
+#define BFL3_ACPHY_LPMODE_5G_SHIFT       22
+
+#define BFL3_EXT_LPO_ISCLOCK      0x02000000  /* External LPO is clock, not x-tal */
+#define BFL3_FORCE_INT_LPO_SEL    0x04000000  /* Force internal lpo */
+#define BFL3_FORCE_EXT_LPO_SEL    0x08000000  /* Force external lpo */
+
+#define BFL3_EN_BRCM_IMPBF        0x10000000  /* acphy, Allow BRCM Implicit TxBF */
+#define BFL3_AVVMID_FROM_NVRAM    0x40000000  /* Read Av Vmid from NVRAM  */
+#define BFL3_VLIN_EN_FROM_NVRAM    0x80000000  /* Read Vlin En from NVRAM  */
+
+#define BFL3_AVVMID_FROM_NVRAM_SHIFT   30   /* Read Av Vmid from NVRAM  */
+#define BFL3_VLIN_EN_FROM_NVRAM_SHIFT   31   /* Enable Vlin  from NVRAM  */
+
+/* boardflags4 for SROM12 */
+#define BFL4_SROM12_4dBPAD      (1 << 0)   /* To distinguigh between normal and 4dB pad board */
+
+
+/* board specific GPIO assignment, gpio 0-3 are also customer-configurable led */
+#define        BOARD_GPIO_BTC3W_IN     0x850   /* bit 4 is RF_ACTIVE, bit 6 is STATUS, bit 11 is PRI */
+#define        BOARD_GPIO_BTC3W_OUT    0x020   /* bit 5 is TX_CONF */
+#define        BOARD_GPIO_BTCMOD_IN    0x010   /* bit 4 is the alternate BT Coexistence Input */
+#define        BOARD_GPIO_BTCMOD_OUT   0x020   /* bit 5 is the alternate BT Coexistence Out */
+#define        BOARD_GPIO_BTC_IN       0x080   /* bit 7 is BT Coexistence Input */
+#define        BOARD_GPIO_BTC_OUT      0x100   /* bit 8 is BT Coexistence Out */
+#define        BOARD_GPIO_PACTRL       0x200   /* bit 9 controls the PA on new 4306 boards */
+#define BOARD_GPIO_12          0x1000  /* gpio 12 */
+#define BOARD_GPIO_13          0x2000  /* gpio 13 */
+#define BOARD_GPIO_BTC4_IN     0x0800  /* gpio 11, coex4, in */
+#define BOARD_GPIO_BTC4_BT     0x2000  /* gpio 12, coex4, bt active */
+#define BOARD_GPIO_BTC4_STAT   0x4000  /* gpio 14, coex4, status */
+#define BOARD_GPIO_BTC4_WLAN   0x8000  /* gpio 15, coex4, wlan active */
+#define        BOARD_GPIO_1_WLAN_PWR   0x02    /* throttle WLAN power on X21 board */
+#define        BOARD_GPIO_2_WLAN_PWR   0x04    /* throttle WLAN power on X29C board */
+#define        BOARD_GPIO_3_WLAN_PWR   0x08    /* throttle WLAN power on X28 board */
+#define        BOARD_GPIO_4_WLAN_PWR   0x10    /* throttle WLAN power on X19 board */
+#define        BOARD_GPIO_13_WLAN_PWR  0x2000  /* throttle WLAN power on X14 board */
+
+#define GPIO_BTC4W_OUT_4312  0x010  /* bit 4 is BT_IODISABLE */
+#define GPIO_BTC4W_OUT_43224  0x020  /* bit 5 is BT_IODISABLE */
+#define GPIO_BTC4W_OUT_43224_SHARED  0x0e0  /* bit 5 is BT_IODISABLE */
+#define GPIO_BTC4W_OUT_43225  0x0e0  /* bit 5 BT_IODISABLE, bit 6 SW_BT, bit 7 SW_WL */
+#define GPIO_BTC4W_OUT_43421  0x020  /* bit 5 is BT_IODISABLE */
+#define GPIO_BTC4W_OUT_4313  0x060  /* bit 5 SW_BT, bit 6 SW_WL */
+#define GPIO_BTC4W_OUT_4331_SHARED  0x010  /* GPIO 4  */
+
+#define        PCI_CFG_GPIO_SCS        0x10    /* PCI config space bit 4 for 4306c0 slow clock source */
+#define PCI_CFG_GPIO_HWRAD     0x20    /* PCI config space GPIO 13 for hw radio disable */
+#define PCI_CFG_GPIO_XTAL      0x40    /* PCI config space GPIO 14 for Xtal power-up */
+#define PCI_CFG_GPIO_PLL       0x80    /* PCI config space GPIO 15 for PLL power-down */
+
+/* power control defines */
+#define PLL_DELAY              150             /* us pll on delay */
+#define FREF_DELAY             200             /* us fref change delay */
+#define MIN_SLOW_CLK           32              /* us Slow clock period */
+#define        XTAL_ON_DELAY           1000            /* us crystal power-on delay */
+
+
+/* 43341 Boards */
+#define BCM943341WLABGS_SSID   0x062d
+
+/* 43342 Boards */
+#define BCM943342FCAGBI_SSID   0x0641
+
+/* 43602 Boards, unclear yet what boards will be created. */
+#define BCM943602RSVD1_SSID    0x06a5
+#define BCM943602RSVD2_SSID    0x06a6
+#define BCM943602X87            0X0133
+#define BCM943602X87P2          0X0143
+#define BCM943602X238           0X0132
+#define BCM943602X238D          0X014A
+
+/* # of GPIO pins */
+#define GPIO_NUMPINS           32
+
+/* These values are used by dhd host driver. */
+#define RDL_RAM_BASE_4319 0x60000000
+#define RDL_RAM_BASE_4329 0x60000000
+#define RDL_RAM_SIZE_4319 0x48000
+#define RDL_RAM_SIZE_4329  0x48000
+#define RDL_RAM_SIZE_43236 0x70000
+#define RDL_RAM_BASE_43236 0x60000000
+#define RDL_RAM_SIZE_4328 0x60000
+#define RDL_RAM_BASE_4328 0x80000000
+#define RDL_RAM_SIZE_4322 0x60000
+#define RDL_RAM_BASE_4322 0x60000000
+#define RDL_RAM_SIZE_4360  0xA0000
+#define RDL_RAM_BASE_4360  0x60000000
+#define RDL_RAM_SIZE_43242  0x90000
+#define RDL_RAM_BASE_43242  0x60000000
+#define RDL_RAM_SIZE_43143  0x70000
+#define RDL_RAM_BASE_43143  0x60000000
+#define RDL_RAM_SIZE_4350  0xC0000
+#define RDL_RAM_BASE_4350  0x180800
+
+/* generic defs for nvram "muxenab" bits
+* Note: these differ for 4335a0. refer bcmchipc.h for specific mux options.
+*/
+#define MUXENAB_UART           0x00000001
+#define MUXENAB_GPIO           0x00000002
+#define MUXENAB_ERCX           0x00000004      /* External Radio BT coex */
+#define MUXENAB_JTAG           0x00000008
+#define MUXENAB_HOST_WAKE      0x00000010      /* configure GPIO for SDIO host_wake */
+#define MUXENAB_I2S_EN         0x00000020
+#define MUXENAB_I2S_MASTER     0x00000040
+#define MUXENAB_I2S_FULL       0x00000080
+#define MUXENAB_SFLASH         0x00000100
+#define MUXENAB_RFSWCTRL0      0x00000200
+#define MUXENAB_RFSWCTRL1      0x00000400
+#define MUXENAB_RFSWCTRL2      0x00000800
+#define MUXENAB_SECI           0x00001000
+#define MUXENAB_BT_LEGACY      0x00002000
+#define MUXENAB_HOST_WAKE1     0x00004000      /* configure alternative GPIO for SDIO host_wake */
+
+/* Boot flags */
+#define FLASH_KERNEL_NFLASH    0x00000001
+#define FLASH_BOOT_NFLASH      0x00000002
+
+#endif /* _BCMDEVS_H */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/bcmendian.h b/drivers/net/wireless/bcmdhd_1363/include/bcmendian.h
new file mode 100644 (file)
index 0000000..00adedf
--- /dev/null
@@ -0,0 +1,332 @@
+/*
+ * Byte order utilities
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ *  $Id: bcmendian.h 514727 2014-11-12 03:02:48Z $
+ *
+ * This file by default provides proper behavior on little-endian architectures.
+ * On big-endian architectures, IL_BIGENDIAN should be defined.
+ */
+
+#ifndef _BCMENDIAN_H_
+#define _BCMENDIAN_H_
+
+#include <typedefs.h>
+
+/* Reverse the bytes in a 16-bit value */
+#define BCMSWAP16(val) \
+       ((uint16)((((uint16)(val) & (uint16)0x00ffU) << 8) | \
+                 (((uint16)(val) & (uint16)0xff00U) >> 8)))
+
+/* Reverse the bytes in a 32-bit value */
+#define BCMSWAP32(val) \
+       ((uint32)((((uint32)(val) & (uint32)0x000000ffU) << 24) | \
+                 (((uint32)(val) & (uint32)0x0000ff00U) <<  8) | \
+                 (((uint32)(val) & (uint32)0x00ff0000U) >>  8) | \
+                 (((uint32)(val) & (uint32)0xff000000U) >> 24)))
+
+/* Reverse the two 16-bit halves of a 32-bit value */
+#define BCMSWAP32BY16(val) \
+       ((uint32)((((uint32)(val) & (uint32)0x0000ffffU) << 16) | \
+                 (((uint32)(val) & (uint32)0xffff0000U) >> 16)))
+
+/* Reverse the bytes in a 64-bit value */
+#define BCMSWAP64(val) \
+       ((uint64)((((uint64)(val) & 0x00000000000000ffULL) << 56) | \
+                 (((uint64)(val) & 0x000000000000ff00ULL) << 40) | \
+                 (((uint64)(val) & 0x0000000000ff0000ULL) << 24) | \
+                 (((uint64)(val) & 0x00000000ff000000ULL) <<  8) | \
+                 (((uint64)(val) & 0x000000ff00000000ULL) >>  8) | \
+                 (((uint64)(val) & 0x0000ff0000000000ULL) >> 24) | \
+                 (((uint64)(val) & 0x00ff000000000000ULL) >> 40) | \
+                 (((uint64)(val) & 0xff00000000000000ULL) >> 56)))
+
+/* Reverse the two 32-bit halves of a 64-bit value */
+#define BCMSWAP64BY32(val) \
+       ((uint64)((((uint64)(val) & 0x00000000ffffffffULL) << 32) | \
+                 (((uint64)(val) & 0xffffffff00000000ULL) >> 32)))
+
+
+/* Byte swapping macros
+ *    Host <=> Network (Big Endian) for 16- and 32-bit values
+ *    Host <=> Little-Endian for 16- and 32-bit values
+ */
+#ifndef hton16
+#define HTON16(i) BCMSWAP16(i)
+#define        hton16(i) bcmswap16(i)
+#define        HTON32(i) BCMSWAP32(i)
+#define        hton32(i) bcmswap32(i)
+#define        NTOH16(i) BCMSWAP16(i)
+#define        ntoh16(i) bcmswap16(i)
+#define        NTOH32(i) BCMSWAP32(i)
+#define        ntoh32(i) bcmswap32(i)
+#define LTOH16(i) (i)
+#define ltoh16(i) (i)
+#define LTOH32(i) (i)
+#define ltoh32(i) (i)
+#define HTOL16(i) (i)
+#define htol16(i) (i)
+#define HTOL32(i) (i)
+#define htol32(i) (i)
+#define HTOL64(i) (i)
+#define htol64(i) (i)
+#endif /* hton16 */
+
+#define ltoh16_buf(buf, i)
+#define htol16_buf(buf, i)
+
+/* Unaligned loads and stores in host byte order */
+#define load32_ua(a)           ltoh32_ua(a)
+#define store32_ua(a, v)       htol32_ua_store(v, a)
+#define load16_ua(a)           ltoh16_ua(a)
+#define store16_ua(a, v)       htol16_ua_store(v, a)
+
+#define _LTOH16_UA(cp) ((cp)[0] | ((cp)[1] << 8))
+#define _LTOH32_UA(cp) ((cp)[0] | ((cp)[1] << 8) | ((cp)[2] << 16) | ((cp)[3] << 24))
+#define _NTOH16_UA(cp) (((cp)[0] << 8) | (cp)[1])
+#define _NTOH32_UA(cp) (((cp)[0] << 24) | ((cp)[1] << 16) | ((cp)[2] << 8) | (cp)[3])
+
+#define ltoh_ua(ptr) \
+       (sizeof(*(ptr)) == sizeof(uint8) ? *(const uint8 *)(ptr) : \
+        sizeof(*(ptr)) == sizeof(uint16) ? _LTOH16_UA((const uint8 *)(ptr)) : \
+        sizeof(*(ptr)) == sizeof(uint32) ? _LTOH32_UA((const uint8 *)(ptr)) : \
+        *(uint8 *)0)
+
+#define ntoh_ua(ptr) \
+       (sizeof(*(ptr)) == sizeof(uint8) ? *(const uint8 *)(ptr) : \
+        sizeof(*(ptr)) == sizeof(uint16) ? _NTOH16_UA((const uint8 *)(ptr)) : \
+        sizeof(*(ptr)) == sizeof(uint32) ? _NTOH32_UA((const uint8 *)(ptr)) : \
+        *(uint8 *)0)
+
+#ifdef __GNUC__
+
+/* GNU macro versions avoid referencing the argument multiple times, while also
+ * avoiding the -fno-inline used in ROM builds.
+ */
+
+#define bcmswap16(val) ({ \
+       uint16 _val = (val); \
+       BCMSWAP16(_val); \
+})
+
+#define bcmswap32(val) ({ \
+       uint32 _val = (val); \
+       BCMSWAP32(_val); \
+})
+
+#define bcmswap64(val) ({ \
+       uint64 _val = (val); \
+       BCMSWAP64(_val); \
+})
+
+#define bcmswap32by16(val) ({ \
+       uint32 _val = (val); \
+       BCMSWAP32BY16(_val); \
+})
+
+#define bcmswap16_buf(buf, len) ({ \
+       uint16 *_buf = (uint16 *)(buf); \
+       uint _wds = (len) / 2; \
+       while (_wds--) { \
+               *_buf = bcmswap16(*_buf); \
+               _buf++; \
+       } \
+})
+
+#define htol16_ua_store(val, bytes) ({ \
+       uint16 _val = (val); \
+       uint8 *_bytes = (uint8 *)(bytes); \
+       _bytes[0] = _val & 0xff; \
+       _bytes[1] = _val >> 8; \
+})
+
+#define htol32_ua_store(val, bytes) ({ \
+       uint32 _val = (val); \
+       uint8 *_bytes = (uint8 *)(bytes); \
+       _bytes[0] = _val & 0xff; \
+       _bytes[1] = (_val >> 8) & 0xff; \
+       _bytes[2] = (_val >> 16) & 0xff; \
+       _bytes[3] = _val >> 24; \
+})
+
+#define hton16_ua_store(val, bytes) ({ \
+       uint16 _val = (val); \
+       uint8 *_bytes = (uint8 *)(bytes); \
+       _bytes[0] = _val >> 8; \
+       _bytes[1] = _val & 0xff; \
+})
+
+#define hton32_ua_store(val, bytes) ({ \
+       uint32 _val = (val); \
+       uint8 *_bytes = (uint8 *)(bytes); \
+       _bytes[0] = _val >> 24; \
+       _bytes[1] = (_val >> 16) & 0xff; \
+       _bytes[2] = (_val >> 8) & 0xff; \
+       _bytes[3] = _val & 0xff; \
+})
+
+#define ltoh16_ua(bytes) ({ \
+       const uint8 *_bytes = (const uint8 *)(bytes); \
+       _LTOH16_UA(_bytes); \
+})
+
+#define ltoh32_ua(bytes) ({ \
+       const uint8 *_bytes = (const uint8 *)(bytes); \
+       _LTOH32_UA(_bytes); \
+})
+
+#define ntoh16_ua(bytes) ({ \
+       const uint8 *_bytes = (const uint8 *)(bytes); \
+       _NTOH16_UA(_bytes); \
+})
+
+#define ntoh32_ua(bytes) ({ \
+       const uint8 *_bytes = (const uint8 *)(bytes); \
+       _NTOH32_UA(_bytes); \
+})
+
+#else /* !__GNUC__ */
+
+/* Inline versions avoid referencing the argument multiple times */
+static INLINE uint16
+bcmswap16(uint16 val)
+{
+       return BCMSWAP16(val);
+}
+
+static INLINE uint32
+bcmswap32(uint32 val)
+{
+       return BCMSWAP32(val);
+}
+
+static INLINE uint64
+bcmswap64(uint64 val)
+{
+       return BCMSWAP64(val);
+}
+
+static INLINE uint32
+bcmswap32by16(uint32 val)
+{
+       return BCMSWAP32BY16(val);
+}
+
+/* Reverse pairs of bytes in a buffer (not for high-performance use) */
+/* buf - start of buffer of shorts to swap */
+/* len  - byte length of buffer */
+static INLINE void
+bcmswap16_buf(uint16 *buf, uint len)
+{
+       len = len / 2;
+
+       while (len--) {
+               *buf = bcmswap16(*buf);
+               buf++;
+       }
+}
+
+/*
+ * Store 16-bit value to unaligned little-endian byte array.
+ */
+static INLINE void
+htol16_ua_store(uint16 val, uint8 *bytes)
+{
+       bytes[0] = val & 0xff;
+       bytes[1] = val >> 8;
+}
+
+/*
+ * Store 32-bit value to unaligned little-endian byte array.
+ */
+static INLINE void
+htol32_ua_store(uint32 val, uint8 *bytes)
+{
+       bytes[0] = val & 0xff;
+       bytes[1] = (val >> 8) & 0xff;
+       bytes[2] = (val >> 16) & 0xff;
+       bytes[3] = val >> 24;
+}
+
+/*
+ * Store 16-bit value to unaligned network-(big-)endian byte array.
+ */
+static INLINE void
+hton16_ua_store(uint16 val, uint8 *bytes)
+{
+       bytes[0] = val >> 8;
+       bytes[1] = val & 0xff;
+}
+
+/*
+ * Store 32-bit value to unaligned network-(big-)endian byte array.
+ */
+static INLINE void
+hton32_ua_store(uint32 val, uint8 *bytes)
+{
+       bytes[0] = val >> 24;
+       bytes[1] = (val >> 16) & 0xff;
+       bytes[2] = (val >> 8) & 0xff;
+       bytes[3] = val & 0xff;
+}
+
+/*
+ * Load 16-bit value from unaligned little-endian byte array.
+ */
+static INLINE uint16
+ltoh16_ua(const void *bytes)
+{
+       return _LTOH16_UA((const uint8 *)bytes);
+}
+
+/*
+ * Load 32-bit value from unaligned little-endian byte array.
+ */
+static INLINE uint32
+ltoh32_ua(const void *bytes)
+{
+       return _LTOH32_UA((const uint8 *)bytes);
+}
+
+/*
+ * Load 16-bit value from unaligned big-(network-)endian byte array.
+ */
+static INLINE uint16
+ntoh16_ua(const void *bytes)
+{
+       return _NTOH16_UA((const uint8 *)bytes);
+}
+
+/*
+ * Load 32-bit value from unaligned big-(network-)endian byte array.
+ */
+static INLINE uint32
+ntoh32_ua(const void *bytes)
+{
+       return _NTOH32_UA((const uint8 *)bytes);
+}
+
+#endif /* !__GNUC__ */
+#endif /* !_BCMENDIAN_H_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/bcmmsgbuf.h b/drivers/net/wireless/bcmdhd_1363/include/bcmmsgbuf.h
new file mode 100644 (file)
index 0000000..ca0bb21
--- /dev/null
@@ -0,0 +1,863 @@
+/*
+ * MSGBUF network driver ioctl/indication encoding
+ * Broadcom 802.11abg Networking Device Driver
+ *
+ * Definitions subject to change without notice.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmmsgbuf.h 541060 2015-03-13 23:28:01Z $
+ */
+#ifndef _bcmmsgbuf_h_
+#define        _bcmmsgbuf_h_
+
+#include <proto/ethernet.h>
+#include <wlioctl.h>
+#include <bcmpcie.h>
+
+#define MSGBUF_MAX_MSG_SIZE   ETHER_MAX_LEN
+
+#define D2H_EPOCH_MODULO               253 /* sequence number wrap */
+#define D2H_EPOCH_INIT_VAL             (D2H_EPOCH_MODULO + 1)
+
+#define H2D_EPOCH_MODULO               253 /* sequence number wrap */
+#define H2D_EPOCH_INIT_VAL             (H2D_EPOCH_MODULO + 1)
+
+#define H2DRING_TXPOST_ITEMSIZE                48
+#define H2DRING_RXPOST_ITEMSIZE                32
+#define H2DRING_CTRL_SUB_ITEMSIZE      40
+#define D2HRING_TXCMPLT_ITEMSIZE       16
+#define D2HRING_RXCMPLT_ITEMSIZE       32
+#define D2HRING_CTRL_CMPLT_ITEMSIZE    24
+
+#define H2DRING_TXPOST_MAX_ITEM                        512
+#define H2DRING_RXPOST_MAX_ITEM                        512
+#define H2DRING_CTRL_SUB_MAX_ITEM              64
+#define D2HRING_TXCMPLT_MAX_ITEM               1024
+#define D2HRING_RXCMPLT_MAX_ITEM               512
+
+#define D2HRING_CTRL_CMPLT_MAX_ITEM            64
+
+enum {
+       DNGL_TO_HOST_MSGBUF,
+       HOST_TO_DNGL_MSGBUF
+};
+
+enum {
+       HOST_TO_DNGL_TXP_DATA,
+       HOST_TO_DNGL_RXP_DATA,
+       HOST_TO_DNGL_CTRL,
+       DNGL_TO_HOST_DATA,
+       DNGL_TO_HOST_CTRL
+};
+
+#define MESSAGE_PAYLOAD(a) (a & MSG_TYPE_INTERNAL_USE_START) ? TRUE : FALSE
+
+#ifdef PCIE_API_REV1
+
+#define BCMMSGBUF_DUMMY_REF(a, b)      do {BCM_REFERENCE((a));BCM_REFERENCE((b));}  while (0)
+
+#define BCMMSGBUF_API_IFIDX(a)         0
+#define BCMMSGBUF_API_SEQNUM(a)                0
+#define BCMMSGBUF_IOCTL_XTID(a)                0
+#define BCMMSGBUF_IOCTL_PKTID(a)       ((a)->cmd_id)
+
+#define BCMMSGBUF_SET_API_IFIDX(a, b)  BCMMSGBUF_DUMMY_REF(a, b)
+#define BCMMSGBUF_SET_API_SEQNUM(a, b) BCMMSGBUF_DUMMY_REF(a, b)
+#define BCMMSGBUF_IOCTL_SET_PKTID(a, b)        (BCMMSGBUF_IOCTL_PKTID(a) = (b))
+#define BCMMSGBUF_IOCTL_SET_XTID(a, b) BCMMSGBUF_DUMMY_REF(a, b)
+
+#else /* PCIE_API_REV1 */
+
+#define BCMMSGBUF_API_IFIDX(a)         ((a)->if_id)
+#define BCMMSGBUF_IOCTL_PKTID(a)       ((a)->pkt_id)
+#define BCMMSGBUF_API_SEQNUM(a)                ((a)->u.seq.seq_no)
+#define BCMMSGBUF_IOCTL_XTID(a)                ((a)->xt_id)
+
+#define BCMMSGBUF_SET_API_IFIDX(a, b)  (BCMMSGBUF_API_IFIDX((a)) = (b))
+#define BCMMSGBUF_SET_API_SEQNUM(a, b) (BCMMSGBUF_API_SEQNUM((a)) = (b))
+#define BCMMSGBUF_IOCTL_SET_PKTID(a, b)        (BCMMSGBUF_IOCTL_PKTID((a)) = (b))
+#define BCMMSGBUF_IOCTL_SET_XTID(a, b) (BCMMSGBUF_IOCTL_XTID((a)) = (b))
+
+#endif /* PCIE_API_REV1 */
+
+/* utility data structures */
+
+union addr64 {
+       struct {
+               uint32 low;
+               uint32 high;
+       };
+       struct {
+               uint32 low_addr;
+               uint32 high_addr;
+       };
+       uint64 u64;
+} DECLSPEC_ALIGN(8);
+
+typedef union addr64 bcm_addr64_t;
+
+/* IOCTL req Hdr */
+/* cmn Msg Hdr */
+typedef struct cmn_msg_hdr {
+       /** message type */
+       uint8 msg_type;
+       /** interface index this is valid for */
+       uint8 if_id;
+       /* flags */
+       uint8 flags;
+       /** sequence number */
+       uint8 epoch;
+       /** packet Identifier for the associated host buffer */
+       uint32 request_id;
+} cmn_msg_hdr_t;
+
+/** message type */
+typedef enum bcmpcie_msgtype {
+       MSG_TYPE_GEN_STATUS             = 0x1,
+       MSG_TYPE_RING_STATUS            = 0x2,
+       MSG_TYPE_FLOW_RING_CREATE       = 0x3,
+       MSG_TYPE_FLOW_RING_CREATE_CMPLT = 0x4,
+       MSG_TYPE_FLOW_RING_DELETE       = 0x5,
+       MSG_TYPE_FLOW_RING_DELETE_CMPLT = 0x6,
+       MSG_TYPE_FLOW_RING_FLUSH        = 0x7,
+       MSG_TYPE_FLOW_RING_FLUSH_CMPLT  = 0x8,
+       MSG_TYPE_IOCTLPTR_REQ           = 0x9,
+       MSG_TYPE_IOCTLPTR_REQ_ACK       = 0xA,
+       MSG_TYPE_IOCTLRESP_BUF_POST     = 0xB,
+       MSG_TYPE_IOCTL_CMPLT            = 0xC,
+       MSG_TYPE_EVENT_BUF_POST         = 0xD,
+       MSG_TYPE_WL_EVENT               = 0xE,
+       MSG_TYPE_TX_POST                = 0xF,
+       MSG_TYPE_TX_STATUS              = 0x10,
+       MSG_TYPE_RXBUF_POST             = 0x11,
+       MSG_TYPE_RX_CMPLT               = 0x12,
+       MSG_TYPE_LPBK_DMAXFER           = 0x13,
+       MSG_TYPE_LPBK_DMAXFER_CMPLT     = 0x14,
+       MSG_TYPE_FLOW_RING_RESUME        = 0x15,
+       MSG_TYPE_FLOW_RING_RESUME_CMPLT = 0x16,
+       MSG_TYPE_FLOW_RING_SUSPEND      = 0x17,
+       MSG_TYPE_FLOW_RING_SUSPEND_CMPLT        = 0x18,
+       MSG_TYPE_INFO_BUF_POST          = 0x19,
+       MSG_TYPE_INFO_BUF_CMPLT         = 0x1A,
+       MSG_TYPE_H2D_RING_CREATE        = 0x1B,
+       MSG_TYPE_D2H_RING_CREATE        = 0x1C,
+       MSG_TYPE_H2D_RING_CREATE_CMPLT  = 0x1D,
+       MSG_TYPE_D2H_RING_CREATE_CMPLT  = 0x1E,
+       MSG_TYPE_H2D_RING_CONFIG        = 0x1F,
+       MSG_TYPE_D2H_RING_CONFIG        = 0x20,
+       MSG_TYPE_H2D_RING_CONFIG_CMPLT  = 0x21,
+       MSG_TYPE_D2H_RING_CONFIG_CMPLT  = 0x22,
+       MSG_TYPE_H2D_MAILBOX_DATA       = 0x23,
+       MSG_TYPE_D2H_MAILBOX_DATA       = 0x24,
+
+       MSG_TYPE_API_MAX_RSVD           = 0x3F
+} bcmpcie_msg_type_t;
+
+typedef enum bcmpcie_msgtype_int {
+       MSG_TYPE_INTERNAL_USE_START     = 0x40,
+       MSG_TYPE_EVENT_PYLD             = 0x41,
+       MSG_TYPE_IOCT_PYLD              = 0x42,
+       MSG_TYPE_RX_PYLD                = 0x43,
+       MSG_TYPE_HOST_FETCH             = 0x44,
+       MSG_TYPE_LPBK_DMAXFER_PYLD      = 0x45,
+       MSG_TYPE_TXMETADATA_PYLD        = 0x46,
+       MSG_TYPE_INDX_UPDATE            = 0x47
+} bcmpcie_msgtype_int_t;
+
+typedef enum bcmpcie_msgtype_u {
+       MSG_TYPE_TX_BATCH_POST          = 0x80,
+       MSG_TYPE_IOCTL_REQ              = 0x81,
+       MSG_TYPE_HOST_EVNT              = 0x82, /* console related */
+       MSG_TYPE_LOOPBACK               = 0x83
+} bcmpcie_msgtype_u_t;
+
+/**
+ * D2H ring host wakeup soft doorbell, override the PCIE doorbell.
+ * Host configures an <32bit address,value> tuple, and dongle uses SBTOPCIE
+ * Transl0 to write specified value to host address.
+ *
+ * Use case: 32bit Address mapped to HW Accelerator Core/Thread Wakeup Register
+ * and value is Core/Thread context. Host will ensure routing the 32bit address
+ * offerred to PCIE to the mapped register.
+ *
+ * D2H_RING_CONFIG_SUBTYPE_SOFT_DOORBELL
+ */
+typedef struct bcmpcie_soft_doorbell {
+       uint32  value;  /* host defined value to be written, eg HW threadid */
+       bcm_addr64_t haddr; /* host address, eg thread wakeup register address */
+       uint16  items;  /* interrupt coalescing: item count before wakeup */
+       uint16  msecs;  /* interrupt coalescing: timeout in millisecs */
+} bcmpcie_soft_doorbell_t;
+
+
+/* if_id */
+#define BCMPCIE_CMNHDR_IFIDX_PHYINTF_SHFT      5
+#define BCMPCIE_CMNHDR_IFIDX_PHYINTF_MAX       0x7
+#define BCMPCIE_CMNHDR_IFIDX_PHYINTF_MASK      \
+       (BCMPCIE_CMNHDR_IFIDX_PHYINTF_MAX << BCMPCIE_CMNHDR_IFIDX_PHYINTF_SHFT)
+#define BCMPCIE_CMNHDR_IFIDX_VIRTINTF_SHFT     0
+#define BCMPCIE_CMNHDR_IFIDX_VIRTINTF_MAX      0x1F
+#define BCMPCIE_CMNHDR_IFIDX_VIRTINTF_MASK     \
+       (BCMPCIE_CMNHDR_IFIDX_PHYINTF_MAX << BCMPCIE_CMNHDR_IFIDX_PHYINTF_SHFT)
+
+/* flags */
+#define BCMPCIE_CMNHDR_FLAGS_DMA_R_IDX         0x1
+#define BCMPCIE_CMNHDR_FLAGS_DMA_R_IDX_INTR    0x2
+#define BCMPCIE_CMNHDR_FLAGS_PHASE_BIT         0x80
+
+
+/* IOCTL request message */
+typedef struct ioctl_req_msg {
+       /** common message header */
+       cmn_msg_hdr_t   cmn_hdr;
+       /** ioctl command type */
+       uint32          cmd;
+       /** ioctl transaction ID, to pair with a ioctl response */
+       uint16          trans_id;
+       /** input arguments buffer len */
+       uint16          input_buf_len;
+       /** expected output len */
+       uint16          output_buf_len;
+       /** to align the host address on 8 byte boundary */
+       uint16          rsvd[3];
+       /** always align on 8 byte boundary */
+       bcm_addr64_t    host_input_buf_addr;
+       /* rsvd */
+       uint32          rsvd1[2];
+} ioctl_req_msg_t;
+
+/** buffer post messages for device to use to return IOCTL responses, Events */
+typedef struct ioctl_resp_evt_buf_post_msg {
+       /** common message header */
+       cmn_msg_hdr_t   cmn_hdr;
+       /** length of the host buffer supplied */
+       uint16          host_buf_len;
+       /** to align the host address on 8 byte boundary */
+       uint16          reserved[3];
+       /** always align on 8 byte boundary */
+       bcm_addr64_t    host_buf_addr;
+       uint32          rsvd[4];
+} ioctl_resp_evt_buf_post_msg_t;
+
+
+typedef struct pcie_dma_xfer_params {
+       /** common message header */
+       cmn_msg_hdr_t   cmn_hdr;
+
+       /** always align on 8 byte boundary */
+       bcm_addr64_t    host_input_buf_addr;
+
+       /** always align on 8 byte boundary */
+       bcm_addr64_t    host_ouput_buf_addr;
+
+       /** length of transfer */
+       uint32          xfer_len;
+       /** delay before doing the src txfer */
+       uint32          srcdelay;
+       /** delay before doing the dest txfer */
+       uint32          destdelay;
+       uint32          rsvd;
+} pcie_dma_xfer_params_t;
+
+/** Complete msgbuf hdr for flow ring update from host to dongle */
+typedef struct tx_flowring_create_request {
+       cmn_msg_hdr_t   msg;
+       uint8   da[ETHER_ADDR_LEN];
+       uint8   sa[ETHER_ADDR_LEN];
+       uint8   tid;
+       uint8   if_flags;
+       uint16  flow_ring_id;
+       uint8   tc;
+       uint8   priority;
+       uint16  int_vector;
+       uint16  max_items;
+       uint16  len_item;
+       bcm_addr64_t flow_ring_ptr;
+} tx_flowring_create_request_t;
+
+typedef struct tx_flowring_delete_request {
+       cmn_msg_hdr_t   msg;
+       uint16  flow_ring_id;
+       uint16  reason;
+       uint32  rsvd[7];
+} tx_flowring_delete_request_t;
+
+typedef struct tx_flowring_flush_request {
+       cmn_msg_hdr_t   msg;
+       uint16  flow_ring_id;
+       uint16  reason;
+       uint32  rsvd[7];
+} tx_flowring_flush_request_t;
+
+/** Subtypes for ring_config_req control message */
+typedef enum ring_config_subtype {
+       /** Default D2H PCIE doorbell override using ring_config_req msg */
+       D2H_RING_CONFIG_SUBTYPE_SOFT_DOORBELL = 1, /* Software doorbell */
+       D2H_RING_CONFIG_SUBTYPE_MSI_DOORBELL = 2   /* MSI configuration */
+} ring_config_subtype_t;
+
+typedef struct ring_config_req {
+       cmn_msg_hdr_t   msg;
+       uint16  subtype;
+       uint16  ring_id;
+       uint32  rsvd;
+       union {
+               uint32  data[6];
+               /** D2H_RING_CONFIG_SUBTYPE_SOFT_DOORBELL */
+               bcmpcie_soft_doorbell_t soft_doorbell;
+       };
+} ring_config_req_t;
+
+typedef union ctrl_submit_item {
+       ioctl_req_msg_t                 ioctl_req;
+       ioctl_resp_evt_buf_post_msg_t   resp_buf_post;
+       pcie_dma_xfer_params_t          dma_xfer;
+       tx_flowring_create_request_t    flow_create;
+       tx_flowring_delete_request_t    flow_delete;
+       tx_flowring_flush_request_t     flow_flush;
+       ring_config_req_t               ring_config_req;
+       unsigned char                   check[H2DRING_CTRL_SUB_ITEMSIZE];
+} ctrl_submit_item_t;
+
+/** Control Completion messages (20 bytes) */
+typedef struct compl_msg_hdr {
+       /** status for the completion */
+       int16   status;
+       /** submisison flow ring id which generated this status */
+       uint16  flow_ring_id;
+} compl_msg_hdr_t;
+
+/** XOR checksum or a magic number to audit DMA done */
+typedef uint32 dma_done_t;
+
+/* completion header status codes */
+#define        BCMPCIE_SUCCESS                 0
+#define BCMPCIE_NOTFOUND               1
+#define BCMPCIE_NOMEM                  2
+#define BCMPCIE_BADOPTION              3
+#define BCMPCIE_RING_IN_USE            4
+#define BCMPCIE_RING_ID_INVALID                5
+#define BCMPCIE_PKT_FLUSH              6
+#define BCMPCIE_NO_EVENT_BUF           7
+#define BCMPCIE_NO_RX_BUF              8
+#define BCMPCIE_NO_IOCTLRESP_BUF       9
+#define BCMPCIE_MAX_IOCTLRESP_BUF      10
+#define BCMPCIE_MAX_EVENT_BUF          11
+
+/** IOCTL completion response */
+typedef struct ioctl_compl_resp_msg {
+       /** common message header */
+       cmn_msg_hdr_t           cmn_hdr;
+       /** completion message header */
+       compl_msg_hdr_t         compl_hdr;
+       /** response buffer len where a host buffer is involved */
+       uint16                  resp_len;
+       /** transaction id to pair with a request */
+       uint16                  trans_id;
+       /** cmd id */
+       uint32                  cmd;
+       /** XOR checksum or a magic number to audit DMA done */
+       dma_done_t              marker;
+} ioctl_comp_resp_msg_t;
+
+/** IOCTL request acknowledgement */
+typedef struct ioctl_req_ack_msg {
+       /** common message header */
+       cmn_msg_hdr_t           cmn_hdr;
+       /** completion message header */
+       compl_msg_hdr_t         compl_hdr;
+       /** cmd id */
+       uint32                  cmd;
+       uint32                  rsvd;
+       /** XOR checksum or a magic number to audit DMA done */
+       dma_done_t              marker;
+} ioctl_req_ack_msg_t;
+
+/** WL event message: send from device to host */
+typedef struct wlevent_req_msg {
+       /** common message header */
+       cmn_msg_hdr_t           cmn_hdr;
+       /** completion message header */
+       compl_msg_hdr_t         compl_hdr;
+       /** event data len valid with the event buffer */
+       uint16                  event_data_len;
+       /** sequence number */
+       uint16                  seqnum;
+       /** rsvd        */
+       uint32                  rsvd;
+       /** XOR checksum or a magic number to audit DMA done */
+       dma_done_t              marker;
+} wlevent_req_msg_t;
+
+/** dma xfer complete message */
+typedef struct pcie_dmaxfer_cmplt {
+       /** common message header */
+       cmn_msg_hdr_t           cmn_hdr;
+       /** completion message header */
+       compl_msg_hdr_t         compl_hdr;
+       uint32                  rsvd[2];
+       /** XOR checksum or a magic number to audit DMA done */
+       dma_done_t              marker;
+} pcie_dmaxfer_cmplt_t;
+
+/** general status message */
+typedef struct pcie_gen_status {
+       /** common message header */
+       cmn_msg_hdr_t           cmn_hdr;
+       /** completion message header */
+       compl_msg_hdr_t         compl_hdr;
+       uint32                  rsvd[2];
+       /** XOR checksum or a magic number to audit DMA done */
+       dma_done_t              marker;
+} pcie_gen_status_t;
+
+/** ring status message */
+typedef struct pcie_ring_status {
+       /** common message header */
+       cmn_msg_hdr_t           cmn_hdr;
+       /** completion message header */
+       compl_msg_hdr_t         compl_hdr;
+       /** message which firmware couldn't decode */
+       uint16                  write_idx;
+       uint16                  rsvd[3];
+       /** XOR checksum or a magic number to audit DMA done */
+       dma_done_t              marker;
+} pcie_ring_status_t;
+
+typedef struct tx_flowring_create_response {
+       cmn_msg_hdr_t           msg;
+       compl_msg_hdr_t         cmplt;
+       uint32                  rsvd[2];
+       /** XOR checksum or a magic number to audit DMA done */
+       dma_done_t              marker;
+} tx_flowring_create_response_t;
+
+typedef struct tx_flowring_delete_response {
+       cmn_msg_hdr_t           msg;
+       compl_msg_hdr_t         cmplt;
+       uint32                  rsvd[2];
+       /** XOR checksum or a magic number to audit DMA done */
+       dma_done_t              marker;
+} tx_flowring_delete_response_t;
+
+typedef struct tx_flowring_flush_response {
+       cmn_msg_hdr_t           msg;
+       compl_msg_hdr_t         cmplt;
+       uint32                  rsvd[2];
+       /** XOR checksum or a magic number to audit DMA done */
+       dma_done_t              marker;
+} tx_flowring_flush_response_t;
+
+/** Common layout of all d2h control messages */
+typedef struct ctrl_compl_msg {
+       /** common message header */
+       cmn_msg_hdr_t       cmn_hdr;
+       /** completion message header */
+       compl_msg_hdr_t     compl_hdr;
+       uint32          rsvd[2];
+       /** XOR checksum or a magic number to audit DMA done */
+       dma_done_t      marker;
+} ctrl_compl_msg_t;
+
+typedef struct ring_config_resp {
+       /** common message header */
+       cmn_msg_hdr_t       cmn_hdr;
+       /** completion message header */
+       compl_msg_hdr_t     compl_hdr;
+       uint32          rsvd[2];
+       /** XOR checksum or a magic number to audit DMA done */
+       dma_done_t      marker;
+} ring_config_resp_t;
+
+typedef union ctrl_completion_item {
+       ioctl_comp_resp_msg_t           ioctl_resp;
+       wlevent_req_msg_t               event;
+       ioctl_req_ack_msg_t             ioct_ack;
+       pcie_dmaxfer_cmplt_t            pcie_xfer_cmplt;
+       pcie_gen_status_t               pcie_gen_status;
+       pcie_ring_status_t              pcie_ring_status;
+       tx_flowring_create_response_t   txfl_create_resp;
+       tx_flowring_delete_response_t   txfl_delete_resp;
+       tx_flowring_flush_response_t    txfl_flush_resp;
+       ctrl_compl_msg_t                ctrl_compl;
+       ring_config_resp_t              ring_config_resp;
+       unsigned char           check[D2HRING_CTRL_CMPLT_ITEMSIZE];
+} ctrl_completion_item_t;
+
+/** H2D Rxpost ring work items */
+typedef struct host_rxbuf_post {
+       /** common message header */
+       cmn_msg_hdr_t   cmn_hdr;
+       /** provided meta data buffer len */
+       uint16          metadata_buf_len;
+       /** provided data buffer len to receive data */
+       uint16          data_buf_len;
+       /** alignment to make the host buffers start on 8 byte boundary */
+       uint32          rsvd;
+       /** provided meta data buffer */
+       bcm_addr64_t    metadata_buf_addr;
+       /** provided data buffer to receive data */
+       bcm_addr64_t    data_buf_addr;
+} host_rxbuf_post_t;
+
+typedef union rxbuf_submit_item {
+       host_rxbuf_post_t       rxpost;
+       unsigned char           check[H2DRING_RXPOST_ITEMSIZE];
+} rxbuf_submit_item_t;
+
+
+/** D2H Rxcompletion ring work items */
+typedef struct host_rxbuf_cmpl {
+       /** common message header */
+       cmn_msg_hdr_t   cmn_hdr;
+       /** completion message header */
+       compl_msg_hdr_t compl_hdr;
+       /**  filled up meta data len */
+       uint16          metadata_len;
+       /** filled up buffer len to receive data */
+       uint16          data_len;
+       /** offset in the host rx buffer where the data starts */
+       uint16          data_offset;
+       /** offset in the host rx buffer where the data starts */
+       uint16          flags;
+       /** rx status */
+       uint32          rx_status_0;
+       uint32          rx_status_1;
+       /** XOR checksum or a magic number to audit DMA done */
+       dma_done_t      marker;
+} host_rxbuf_cmpl_t;
+
+typedef union rxbuf_complete_item {
+       host_rxbuf_cmpl_t       rxcmpl;
+       unsigned char           check[D2HRING_RXCMPLT_ITEMSIZE];
+} rxbuf_complete_item_t;
+
+
+typedef struct host_txbuf_post {
+       /** common message header */
+       cmn_msg_hdr_t   cmn_hdr;
+       /** eth header */
+       uint8           txhdr[ETHER_HDR_LEN];
+       /** flags */
+       uint8           flags;
+       /** number of segments */
+       uint8           seg_cnt;
+
+       /** provided meta data buffer for txstatus */
+       bcm_addr64_t    metadata_buf_addr;
+       /** provided data buffer to receive data */
+       bcm_addr64_t    data_buf_addr;
+       /** provided meta data buffer len */
+       uint16          metadata_buf_len;
+       /** provided data buffer len to receive data */
+       uint16          data_len;
+       /** XOR checksum or a magic number to audit DMA done */
+       dma_done_t      marker;
+} host_txbuf_post_t;
+
+#define BCMPCIE_PKT_FLAGS_FRAME_802_3  0x01
+#define BCMPCIE_PKT_FLAGS_FRAME_802_11 0x02
+
+#define BCMPCIE_PKT_FLAGS_FRAME_EXEMPT_MASK    0x03    /* Exempt uses 2 bits */
+#define BCMPCIE_PKT_FLAGS_FRAME_EXEMPT_SHIFT   0x02    /* needs to be shifted past other bits */
+
+
+#define BCMPCIE_PKT_FLAGS_PRIO_SHIFT           5
+#define BCMPCIE_PKT_FLAGS_PRIO_MASK            (7 << BCMPCIE_PKT_FLAGS_PRIO_SHIFT)
+
+/* These are added to fix up compile issues */
+#define BCMPCIE_TXPOST_FLAGS_FRAME_802_3       BCMPCIE_PKT_FLAGS_FRAME_802_3
+#define BCMPCIE_TXPOST_FLAGS_FRAME_802_11      BCMPCIE_PKT_FLAGS_FRAME_802_11
+#define BCMPCIE_TXPOST_FLAGS_PRIO_SHIFT                BCMPCIE_PKT_FLAGS_PRIO_SHIFT
+#define BCMPCIE_TXPOST_FLAGS_PRIO_MASK         BCMPCIE_PKT_FLAGS_PRIO_MASK
+
+/** H2D Txpost ring work items */
+typedef union txbuf_submit_item {
+       host_txbuf_post_t       txpost;
+       unsigned char           check[H2DRING_TXPOST_ITEMSIZE];
+} txbuf_submit_item_t;
+
+/** D2H Txcompletion ring work items */
+typedef struct host_txbuf_cmpl {
+       /** common message header */
+       cmn_msg_hdr_t   cmn_hdr;
+       /** completion message header */
+       compl_msg_hdr_t compl_hdr;
+       union {
+               struct {
+                       /** provided meta data len */
+                       uint16  metadata_len;
+                       /** WLAN side txstatus */
+                       uint16  tx_status;
+               };
+               /** XOR checksum or a magic number to audit DMA done */
+               dma_done_t      marker;
+       };
+} host_txbuf_cmpl_t;
+
+typedef union txbuf_complete_item {
+       host_txbuf_cmpl_t       txcmpl;
+       unsigned char           check[D2HRING_TXCMPLT_ITEMSIZE];
+} txbuf_complete_item_t;
+
+#define BCMPCIE_D2H_METADATA_HDRLEN    4
+#define BCMPCIE_D2H_METADATA_MINLEN    (BCMPCIE_D2H_METADATA_HDRLEN + 4)
+
+/** ret buf struct */
+typedef struct ret_buf_ptr {
+       uint32 low_addr;
+       uint32 high_addr;
+} ret_buf_t;
+
+
+#ifdef PCIE_API_REV1
+
+/* ioctl specific hdr */
+typedef struct ioctl_hdr {
+       uint16          cmd;
+       uint16          retbuf_len;
+       uint32          cmd_id;
+} ioctl_hdr_t;
+
+typedef struct ioctlptr_hdr {
+       uint16          cmd;
+       uint16          retbuf_len;
+       uint16          buflen;
+       uint16          rsvd;
+       uint32          cmd_id;
+} ioctlptr_hdr_t;
+
+#else /* PCIE_API_REV1 */
+
+typedef struct ioctl_req_hdr {
+       uint32          pkt_id; /**< Packet ID */
+       uint32          cmd;    /**< IOCTL ID */
+       uint16          retbuf_len;
+       uint16          buflen;
+       uint16          xt_id;  /**< transaction ID */
+       uint16          rsvd[1];
+} ioctl_req_hdr_t;
+
+#endif /* PCIE_API_REV1 */
+
+
+/** Complete msgbuf hdr for ioctl from host to dongle */
+typedef struct ioct_reqst_hdr {
+       cmn_msg_hdr_t msg;
+#ifdef PCIE_API_REV1
+       ioctl_hdr_t ioct_hdr;
+#else
+       ioctl_req_hdr_t ioct_hdr;
+#endif
+       ret_buf_t ret_buf;
+} ioct_reqst_hdr_t;
+
+typedef struct ioctptr_reqst_hdr {
+       cmn_msg_hdr_t msg;
+#ifdef PCIE_API_REV1
+       ioctlptr_hdr_t ioct_hdr;
+#else
+       ioctl_req_hdr_t ioct_hdr;
+#endif
+       ret_buf_t ret_buf;
+       ret_buf_t ioct_buf;
+} ioctptr_reqst_hdr_t;
+
+/** ioctl response header */
+typedef struct ioct_resp_hdr {
+       cmn_msg_hdr_t   msg;
+#ifdef PCIE_API_REV1
+       uint32  cmd_id;
+#else
+       uint32  pkt_id;
+#endif
+       uint32  status;
+       uint32  ret_len;
+       uint32  inline_data;
+#ifdef PCIE_API_REV1
+#else
+       uint16  xt_id;  /**< transaction ID */
+       uint16  rsvd[1];
+#endif
+} ioct_resp_hdr_t;
+
+/* ioct resp header used in dongle */
+/* ret buf hdr will be stripped off inside dongle itself */
+typedef struct msgbuf_ioctl_resp {
+       ioct_resp_hdr_t ioct_hdr;
+       ret_buf_t       ret_buf;        /**< ret buf pointers */
+} msgbuf_ioct_resp_t;
+
+/** WL event hdr info */
+typedef struct wl_event_hdr {
+       cmn_msg_hdr_t   msg;
+       uint16 event;
+       uint8 flags;
+       uint8 rsvd;
+       uint16 retbuf_len;
+       uint16 rsvd1;
+       uint32 rxbufid;
+} wl_event_hdr_t;
+
+#define TXDESCR_FLOWID_PCIELPBK_1      0xFF
+#define TXDESCR_FLOWID_PCIELPBK_2      0xFE
+
+typedef struct txbatch_lenptr_tup {
+       uint32 pktid;
+       uint16 pktlen;
+       uint16 rsvd;
+       ret_buf_t       ret_buf;        /**< ret buf pointers */
+} txbatch_lenptr_tup_t;
+
+typedef struct txbatch_cmn_msghdr {
+       cmn_msg_hdr_t   msg;
+       uint8 priority;
+       uint8 hdrlen;
+       uint8 pktcnt;
+       uint8 flowid;
+       uint8 txhdr[ETHER_HDR_LEN];
+       uint16 rsvd;
+} txbatch_cmn_msghdr_t;
+
+typedef struct txbatch_msghdr {
+       txbatch_cmn_msghdr_t txcmn;
+       txbatch_lenptr_tup_t tx_tup[0]; /**< Based on packet count */
+} txbatch_msghdr_t;
+
+/* TX desc posting header */
+typedef struct tx_lenptr_tup {
+       uint16 pktlen;
+       uint16 rsvd;
+       ret_buf_t       ret_buf;        /**< ret buf pointers */
+} tx_lenptr_tup_t;
+
+typedef struct txdescr_cmn_msghdr {
+       cmn_msg_hdr_t   msg;
+       uint8 priority;
+       uint8 hdrlen;
+       uint8 descrcnt;
+       uint8 flowid;
+       uint32 pktid;
+} txdescr_cmn_msghdr_t;
+
+typedef struct txdescr_msghdr {
+       txdescr_cmn_msghdr_t txcmn;
+       uint8 txhdr[ETHER_HDR_LEN];
+       uint16 rsvd;
+       tx_lenptr_tup_t tx_tup[0];      /**< Based on descriptor count */
+} txdescr_msghdr_t;
+
+/** Tx status header info */
+typedef struct txstatus_hdr {
+       cmn_msg_hdr_t   msg;
+       uint32 pktid;
+} txstatus_hdr_t;
+
+/** RX bufid-len-ptr tuple */
+typedef struct rx_lenptr_tup {
+       uint32 rxbufid;
+       uint16 len;
+       uint16 rsvd2;
+       ret_buf_t       ret_buf;        /**< ret buf pointers */
+} rx_lenptr_tup_t;
+
+/** Rx descr Post hdr info */
+typedef struct rxdesc_msghdr {
+       cmn_msg_hdr_t   msg;
+       uint16 rsvd0;
+       uint8 rsvd1;
+       uint8 descnt;
+       rx_lenptr_tup_t rx_tup[0];
+} rxdesc_msghdr_t;
+
+/** RX complete tuples */
+typedef struct rxcmplt_tup {
+       uint16 retbuf_len;
+       uint16 data_offset;
+       uint32 rxstatus0;
+       uint32 rxstatus1;
+       uint32 rxbufid;
+} rxcmplt_tup_t;
+
+/** RX complete messge hdr */
+typedef struct rxcmplt_hdr {
+       cmn_msg_hdr_t   msg;
+       uint16 rsvd0;
+       uint16 rxcmpltcnt;
+       rxcmplt_tup_t rx_tup[0];
+} rxcmplt_hdr_t;
+
+typedef struct hostevent_hdr {
+       cmn_msg_hdr_t   msg;
+       uint32 evnt_pyld;
+} hostevent_hdr_t;
+
+typedef struct dma_xfer_params {
+       uint32 src_physaddr_hi;
+       uint32 src_physaddr_lo;
+       uint32 dest_physaddr_hi;
+       uint32 dest_physaddr_lo;
+       uint32 len;
+       uint32 srcdelay;
+       uint32 destdelay;
+} dma_xfer_params_t;
+
+enum {
+       HOST_EVENT_CONS_CMD = 1
+};
+
+/* defines for flags */
+#define MSGBUF_IOC_ACTION_MASK 0x1
+
+#define MAX_SUSPEND_REQ 15
+
+typedef struct tx_idle_flowring_suspend_request {
+       cmn_msg_hdr_t   msg;
+       uint16  ring_id[MAX_SUSPEND_REQ];      /**< ring Id's */
+       uint16  num;    /**< number of flowid's to suspend */
+} tx_idle_flowring_suspend_request_t;
+
+typedef struct tx_idle_flowring_suspend_response {
+       cmn_msg_hdr_t   msg;
+       compl_msg_hdr_t cmplt;
+       uint32                  rsvd[2];
+       dma_done_t              marker;
+} tx_idle_flowring_suspend_response_t;
+
+typedef struct tx_idle_flowring_resume_request {
+       cmn_msg_hdr_t   msg;
+       uint16  flow_ring_id;
+       uint16  reason;
+       uint32  rsvd[7];
+} tx_idle_flowring_resume_request_t;
+
+typedef struct tx_idle_flowring_resume_response {
+       cmn_msg_hdr_t   msg;
+       compl_msg_hdr_t cmplt;
+       uint32                  rsvd[2];
+       dma_done_t              marker;
+} tx_idle_flowring_resume_response_t;
+
+#endif /* _bcmmsgbuf_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/bcmnvram.h b/drivers/net/wireless/bcmdhd_1363/include/bcmnvram.h
new file mode 100644 (file)
index 0000000..7f6c51b
--- /dev/null
@@ -0,0 +1,310 @@
+/*
+ * NVRAM variable manipulation
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmnvram.h 514727 2014-11-12 03:02:48Z $
+ */
+
+#ifndef _bcmnvram_h_
+#define _bcmnvram_h_
+
+#ifndef _LANGUAGE_ASSEMBLY
+
+#include <typedefs.h>
+#include <bcmdefs.h>
+
+struct nvram_header {
+       uint32 magic;
+       uint32 len;
+       uint32 crc_ver_init;    /* 0:7 crc, 8:15 ver, 16:31 sdram_init */
+       uint32 config_refresh;  /* 0:15 sdram_config, 16:31 sdram_refresh */
+       uint32 config_ncdl;     /* ncdl values for memc */
+};
+
+struct nvram_tuple {
+       char *name;
+       char *value;
+       struct nvram_tuple *next;
+};
+
+/*
+ * Get default value for an NVRAM variable
+ */
+extern char *nvram_default_get(const char *name);
+/*
+ * validate/restore all per-interface related variables
+ */
+extern void nvram_validate_all(char *prefix, bool restore);
+
+/*
+ * restore specific per-interface variable
+ */
+extern void nvram_restore_var(char *prefix, char *name);
+
+/*
+ * Initialize NVRAM access. May be unnecessary or undefined on certain
+ * platforms.
+ */
+extern int nvram_init(void *sih);
+extern int nvram_deinit(void *sih);
+
+
+/*
+ * Append a chunk of nvram variables to the global list
+ */
+extern int nvram_append(void *si, char *vars, uint varsz);
+
+extern void nvram_get_global_vars(char **varlst, uint *varsz);
+
+
+/*
+ * Check for reset button press for restoring factory defaults.
+ */
+extern int nvram_reset(void *sih);
+
+/*
+ * Disable NVRAM access. May be unnecessary or undefined on certain
+ * platforms.
+ */
+extern void nvram_exit(void *sih);
+
+/*
+ * Get the value of an NVRAM variable. The pointer returned may be
+ * invalid after a set.
+ * @param      name    name of variable to get
+ * @return     value of variable or NULL if undefined
+ */
+extern char * nvram_get(const char *name);
+
+/*
+ * Get the value of an NVRAM variable. The pointer returned may be
+ * invalid after a set.
+ * @param      name    name of variable to get
+ * @param      bit     bit value to get
+ * @return     value of variable or NULL if undefined
+ */
+extern char * nvram_get_bitflag(const char *name, const int bit);
+
+/*
+ * Read the reset GPIO value from the nvram and set the GPIO
+ * as input
+ */
+extern int nvram_resetgpio_init(void *sih);
+
+/*
+ * Get the value of an NVRAM variable.
+ * @param      name    name of variable to get
+ * @return     value of variable or NUL if undefined
+ */
+static INLINE char *
+nvram_safe_get(const char *name)
+{
+       char *p = nvram_get(name);
+       return p ? p : "";
+}
+
+/*
+ * Match an NVRAM variable.
+ * @param      name    name of variable to match
+ * @param      match   value to compare against value of variable
+ * @return     TRUE if variable is defined and its value is string equal
+ *             to match or FALSE otherwise
+ */
+static INLINE int
+nvram_match(const char *name, const char *match)
+{
+       const char *value = nvram_get(name);
+       return (value && !strcmp(value, match));
+}
+
+/*
+ * Match an NVRAM variable.
+ * @param      name    name of variable to match
+ * @param      bit     bit value to get
+ * @param      match   value to compare against value of variable
+ * @return     TRUE if variable is defined and its value is string equal
+ *             to match or FALSE otherwise
+ */
+static INLINE int
+nvram_match_bitflag(const char *name, const int bit, const char *match)
+{
+       const char *value = nvram_get_bitflag(name, bit);
+       return (value && !strcmp(value, match));
+}
+
+/*
+ * Inversely match an NVRAM variable.
+ * @param      name    name of variable to match
+ * @param      match   value to compare against value of variable
+ * @return     TRUE if variable is defined and its value is not string
+ *             equal to invmatch or FALSE otherwise
+ */
+static INLINE int
+nvram_invmatch(const char *name, const char *invmatch)
+{
+       const char *value = nvram_get(name);
+       return (value && strcmp(value, invmatch));
+}
+
+/*
+ * Set the value of an NVRAM variable. The name and value strings are
+ * copied into private storage. Pointers to previously set values
+ * may become invalid. The new value may be immediately
+ * retrieved but will not be permanently stored until a commit.
+ * @param      name    name of variable to set
+ * @param      value   value of variable
+ * @return     0 on success and errno on failure
+ */
+extern int nvram_set(const char *name, const char *value);
+
+/*
+ * Set the value of an NVRAM variable. The name and value strings are
+ * copied into private storage. Pointers to previously set values
+ * may become invalid. The new value may be immediately
+ * retrieved but will not be permanently stored until a commit.
+ * @param      name    name of variable to set
+ * @param      bit     bit value to set
+ * @param      value   value of variable
+ * @return     0 on success and errno on failure
+ */
+extern int nvram_set_bitflag(const char *name, const int bit, const int value);
+/*
+ * Unset an NVRAM variable. Pointers to previously set values
+ * remain valid until a set.
+ * @param      name    name of variable to unset
+ * @return     0 on success and errno on failure
+ * NOTE: use nvram_commit to commit this change to flash.
+ */
+extern int nvram_unset(const char *name);
+
+/*
+ * Commit NVRAM variables to permanent storage. All pointers to values
+ * may be invalid after a commit.
+ * NVRAM values are undefined after a commit.
+ * @param   nvram_corrupt    true to corrupt nvram, false otherwise.
+ * @return     0 on success and errno on failure
+ */
+extern int nvram_commit_internal(bool nvram_corrupt);
+
+/*
+ * Commit NVRAM variables to permanent storage. All pointers to values
+ * may be invalid after a commit.
+ * NVRAM values are undefined after a commit.
+ * @return     0 on success and errno on failure
+ */
+extern int nvram_commit(void);
+
+/*
+ * Get all NVRAM variables (format name=value\0 ... \0\0).
+ * @param      buf     buffer to store variables
+ * @param      count   size of buffer in bytes
+ * @return     0 on success and errno on failure
+ */
+extern int nvram_getall(char *nvram_buf, int count);
+
+/*
+ * returns the crc value of the nvram
+ * @param      nvh     nvram header pointer
+ */
+uint8 nvram_calc_crc(struct nvram_header * nvh);
+
+extern int nvram_space;
+#endif /* _LANGUAGE_ASSEMBLY */
+
+/* The NVRAM version number stored as an NVRAM variable */
+#define NVRAM_SOFTWARE_VERSION "1"
+
+#define NVRAM_MAGIC            0x48534C46      /* 'FLSH' */
+#define NVRAM_CLEAR_MAGIC      0x0
+#define NVRAM_INVALID_MAGIC    0xFFFFFFFF
+#define NVRAM_VERSION          1
+#define NVRAM_HEADER_SIZE      20
+/* This definition is for precommit staging, and will be removed */
+#define NVRAM_SPACE            0x8000
+/* For CFE builds this gets passed in thru the makefile */
+#ifndef MAX_NVRAM_SPACE
+#define MAX_NVRAM_SPACE                0x10000
+#endif
+#define DEF_NVRAM_SPACE                0x8000
+#define ROM_ENVRAM_SPACE       0x1000
+#define NVRAM_LZMA_MAGIC       0x4c5a4d41      /* 'LZMA' */
+
+#define NVRAM_MAX_VALUE_LEN 255
+#define NVRAM_MAX_PARAM_LEN 64
+
+#define NVRAM_CRC_START_POSITION       9 /* magic, len, crc8 to be skipped */
+#define NVRAM_CRC_VER_MASK     0xffffff00 /* for crc_ver_init */
+
+/* Offsets to embedded nvram area */
+#define NVRAM_START_COMPRESSED 0x400
+#define NVRAM_START            0x1000
+
+#define BCM_JUMBO_NVRAM_DELIMIT '\n'
+#define BCM_JUMBO_START "Broadcom Jumbo Nvram file"
+
+
+#if (defined(FAILSAFE_UPGRADE) || defined(CONFIG_FAILSAFE_UPGRADE) || \
+       defined(__CONFIG_FAILSAFE_UPGRADE_SUPPORT__))
+#define IMAGE_SIZE "image_size"
+#define BOOTPARTITION "bootpartition"
+#define IMAGE_BOOT BOOTPARTITION
+#define PARTIALBOOTS "partialboots"
+#define MAXPARTIALBOOTS "maxpartialboots"
+#define IMAGE_1ST_FLASH_TRX "flash0.trx"
+#define IMAGE_1ST_FLASH_OS "flash0.os"
+#define IMAGE_2ND_FLASH_TRX "flash0.trx2"
+#define IMAGE_2ND_FLASH_OS "flash0.os2"
+#define IMAGE_FIRST_OFFSET "image_first_offset"
+#define IMAGE_SECOND_OFFSET "image_second_offset"
+#define LINUX_FIRST "linux"
+#define LINUX_SECOND "linux2"
+#endif
+
+#if (defined(DUAL_IMAGE) || defined(CONFIG_DUAL_IMAGE) || \
+       defined(__CONFIG_DUAL_IMAGE_FLASH_SUPPORT__))
+/* Shared by all: CFE, Linux Kernel, and Ap */
+#define IMAGE_BOOT "image_boot"
+#define BOOTPARTITION IMAGE_BOOT
+/* CFE variables */
+#define IMAGE_1ST_FLASH_TRX "flash0.trx"
+#define IMAGE_1ST_FLASH_OS "flash0.os"
+#define IMAGE_2ND_FLASH_TRX "flash0.trx2"
+#define IMAGE_2ND_FLASH_OS "flash0.os2"
+#define IMAGE_SIZE "image_size"
+
+/* CFE and Linux Kernel shared variables */
+#define IMAGE_FIRST_OFFSET "image_first_offset"
+#define IMAGE_SECOND_OFFSET "image_second_offset"
+
+/* Linux application variables */
+#define LINUX_FIRST "linux"
+#define LINUX_SECOND "linux2"
+#define POLICY_TOGGLE "toggle"
+#define LINUX_PART_TO_FLASH "linux_to_flash"
+#define LINUX_FLASH_POLICY "linux_flash_policy"
+
+#endif /* defined(DUAL_IMAGE||CONFIG_DUAL_IMAGE)||__CONFIG_DUAL_IMAGE_FLASH_SUPPORT__ */
+
+#endif /* _bcmnvram_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/bcmpcie.h b/drivers/net/wireless/bcmdhd_1363/include/bcmpcie.h
new file mode 100644 (file)
index 0000000..b75b301
--- /dev/null
@@ -0,0 +1,318 @@
+/*
+ * Broadcom PCIE
+ * Software-specific definitions shared between device and host side
+ * Explains the shared area between host and dongle
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmpcie.h 604490 2015-12-07 15:48:45Z $
+ */
+
+
+#ifndef        _bcmpcie_h_
+#define        _bcmpcie_h_
+
+#include <bcmutils.h>
+
+#define ADDR_64(x)                     (x.addr)
+#define HIGH_ADDR_32(x)     ((uint32) (((sh_addr_t) x).high_addr))
+#define LOW_ADDR_32(x)      ((uint32) (((sh_addr_t) x).low_addr))
+
+typedef struct {
+       uint32 low_addr;
+       uint32 high_addr;
+} sh_addr_t;
+
+
+/* May be overridden by 43xxxxx-roml.mk */
+#if !defined(BCMPCIE_MAX_TX_FLOWS)
+#define BCMPCIE_MAX_TX_FLOWS   40
+#endif /* ! BCMPCIE_MAX_TX_FLOWS */
+
+/**
+ * Feature flags enabled in dongle. Advertised by dongle to DHD via the PCIe Shared structure that
+ * is located in device memory.
+ */
+#define PCIE_SHARED_VERSION            0x00005
+#define PCIE_SHARED_VERSION_MASK       0x000FF
+#define PCIE_SHARED_ASSERT_BUILT       0x00100
+#define PCIE_SHARED_ASSERT             0x00200
+#define PCIE_SHARED_TRAP               0x00400
+#define PCIE_SHARED_IN_BRPT            0x00800
+#define PCIE_SHARED_SET_BRPT           0x01000
+#define PCIE_SHARED_PENDING_BRPT       0x02000
+#define PCIE_SHARED_TXPUSH_SPRT                0x04000
+#define PCIE_SHARED_EVT_SEQNUM         0x08000
+#define PCIE_SHARED_DMA_INDEX          0x10000
+
+/**
+ * There are host types where a device interrupt can 'race ahead' of data written by the device into
+ * host memory. The dongle can avoid this condition using a variety of techniques (read barrier,
+ * using PCIe Message Signalled Interrupts, or by using the PCIE_DMA_INDEX feature). Unfortunately
+ * these techniques have drawbacks on router platforms. For these platforms, it was decided to not
+ * avoid the condition, but to detect the condition instead and act on it.
+ * D2H M2M DMA Complete Sync mechanism: Modulo-253-SeqNum or XORCSUM
+ */
+#define PCIE_SHARED_D2H_SYNC_SEQNUM     0x20000
+#define PCIE_SHARED_D2H_SYNC_XORCSUM    0x40000
+#define PCIE_SHARED_D2H_SYNC_MODE_MASK \
+       (PCIE_SHARED_D2H_SYNC_SEQNUM | PCIE_SHARED_D2H_SYNC_XORCSUM)
+#define PCIE_SHARED_IDLE_FLOW_RING             0x80000
+#define PCIE_SHARED_2BYTE_INDICES       0x100000
+
+
+#define PCIE_SHARED_D2H_MAGIC          0xFEDCBA09
+#define PCIE_SHARED_H2D_MAGIC          0x12345678
+
+/**
+ * Message rings convey messages between host and device. They are unidirectional, and are located
+ * in host memory.
+ *
+ * This is the minimal set of message rings, known as 'common message rings':
+ */
+#define BCMPCIE_H2D_MSGRING_CONTROL_SUBMIT             0
+#define BCMPCIE_H2D_MSGRING_RXPOST_SUBMIT              1
+#define BCMPCIE_D2H_MSGRING_CONTROL_COMPLETE           2
+#define BCMPCIE_D2H_MSGRING_TX_COMPLETE                        3
+#define BCMPCIE_D2H_MSGRING_RX_COMPLETE                        4
+#define BCMPCIE_COMMON_MSGRING_MAX_ID                  4
+
+#define BCMPCIE_H2D_COMMON_MSGRINGS                    2
+#define BCMPCIE_D2H_COMMON_MSGRINGS                    3
+#define BCMPCIE_COMMON_MSGRINGS                                5
+
+#define BCMPCIE_H2D_MSGRINGS(max_tx_flows) \
+       (BCMPCIE_H2D_COMMON_MSGRINGS + (max_tx_flows))
+
+/**
+ * H2D and D2H, WR and RD index, are maintained in the following arrays:
+ * - Array of all H2D WR Indices
+ * - Array of all H2D RD Indices
+ * - Array of all D2H WR Indices
+ * - Array of all D2H RD Indices
+ *
+ * The offset of the WR or RD indexes (for common rings) in these arrays are
+ * listed below. Arrays ARE NOT indexed by a ring's id.
+ *
+ * D2H common rings WR and RD index start from 0, even though their ringids
+ * start from BCMPCIE_H2D_COMMON_MSGRINGS
+ */
+
+#define BCMPCIE_H2D_RING_IDX(h2d_ring_id) (h2d_ring_id)
+
+enum h2dring_idx {
+       /* H2D common rings */
+       BCMPCIE_H2D_MSGRING_CONTROL_SUBMIT_IDX =
+               BCMPCIE_H2D_RING_IDX(BCMPCIE_H2D_MSGRING_CONTROL_SUBMIT),
+       BCMPCIE_H2D_MSGRING_RXPOST_SUBMIT_IDX =
+               BCMPCIE_H2D_RING_IDX(BCMPCIE_H2D_MSGRING_RXPOST_SUBMIT),
+
+       /* First TxPost's WR or RD index starts after all H2D common rings */
+       BCMPCIE_H2D_MSGRING_TXFLOW_IDX_START =
+               BCMPCIE_H2D_RING_IDX(BCMPCIE_H2D_COMMON_MSGRINGS)
+};
+
+#define BCMPCIE_D2H_RING_IDX(d2h_ring_id) \
+       ((d2h_ring_id) - BCMPCIE_H2D_COMMON_MSGRINGS)
+
+enum d2hring_idx {
+       /* D2H Common Rings */
+       BCMPCIE_D2H_MSGRING_CONTROL_COMPLETE_IDX =
+               BCMPCIE_D2H_RING_IDX(BCMPCIE_D2H_MSGRING_CONTROL_COMPLETE),
+       BCMPCIE_D2H_MSGRING_TX_COMPLETE_IDX =
+               BCMPCIE_D2H_RING_IDX(BCMPCIE_D2H_MSGRING_TX_COMPLETE),
+       BCMPCIE_D2H_MSGRING_RX_COMPLETE_IDX =
+               BCMPCIE_D2H_RING_IDX(BCMPCIE_D2H_MSGRING_RX_COMPLETE)
+};
+
+/**
+ * Macros for managing arrays of RD WR indices:
+ * rw_index_sz:
+ *    - in dongle, rw_index_sz is known at compile time
+ *    - in host/DHD, rw_index_sz is derived from advertized pci_shared flags
+ *
+ *  ring_idx: See h2dring_idx and d2hring_idx
+ */
+
+/** Offset of a RD or WR index in H2D or D2H indices array */
+#define BCMPCIE_RW_INDEX_OFFSET(rw_index_sz, ring_idx) \
+       ((rw_index_sz) * (ring_idx))
+
+/** Fetch the address of RD or WR index in H2D or D2H indices array */
+#define BCMPCIE_RW_INDEX_ADDR(indices_array_base, rw_index_sz, ring_idx) \
+       (void *)((uint32)(indices_array_base) + \
+       BCMPCIE_RW_INDEX_OFFSET((rw_index_sz), (ring_idx)))
+
+/** H2D DMA Indices array size: given max flow rings */
+#define BCMPCIE_H2D_RW_INDEX_ARRAY_SZ(rw_index_sz, max_tx_flows) \
+       ((rw_index_sz) * BCMPCIE_H2D_MSGRINGS(max_tx_flows))
+
+/** D2H DMA Indices array size */
+#define BCMPCIE_D2H_RW_INDEX_ARRAY_SZ(rw_index_sz) \
+       ((rw_index_sz) * BCMPCIE_D2H_COMMON_MSGRINGS)
+
+/**
+ * This type is used by a 'message buffer' (which is a FIFO for messages). Message buffers are used
+ * for host<->device communication and are instantiated on both sides. ring_mem_t is instantiated
+ * both in host as well as device memory.
+ */
+typedef struct ring_mem {
+       uint16          idx;       /* ring id */
+       uint8           type;
+       uint8           rsvd;
+       uint16          max_item;  /* Max number of items in flow ring */
+       uint16          len_items; /* Items are fixed size. Length in bytes of one item */
+       sh_addr_t       base_addr; /* 64 bits address, either in host or device memory */
+} ring_mem_t;
+
+
+/**
+ * Per flow ring, information is maintained in device memory, e.g. at what address the ringmem and
+ * ringstate are located. The flow ring itself can be instantiated in either host or device memory.
+ *
+ * Perhaps this type should be renamed to make clear that it resides in device memory only.
+ */
+typedef struct ring_info {
+       uint32          ringmem_ptr; /* ring mem location in dongle memory */
+
+       /* Following arrays are indexed using h2dring_idx and d2hring_idx, and not
+        * by a ringid.
+        */
+
+       /* 32bit ptr to arrays of WR or RD indices for all rings in dongle memory */
+       uint32          h2d_w_idx_ptr; /* Array of all H2D ring's WR indices */
+       uint32          h2d_r_idx_ptr; /* Array of all H2D ring's RD indices */
+       uint32          d2h_w_idx_ptr; /* Array of all D2H ring's WR indices */
+       uint32          d2h_r_idx_ptr; /* Array of all D2H ring's RD indices */
+
+       /* PCIE_DMA_INDEX feature: Dongle uses mem2mem DMA to sync arrays in host.
+        * Host may directly fetch WR and RD indices from these host-side arrays.
+        *
+        * 64bit ptr to arrays of WR or RD indices for all rings in host memory.
+        */
+       sh_addr_t       h2d_w_idx_hostaddr; /* Array of all H2D ring's WR indices */
+       sh_addr_t       h2d_r_idx_hostaddr; /* Array of all H2D ring's RD indices */
+       sh_addr_t       d2h_w_idx_hostaddr; /* Array of all D2H ring's WR indices */
+       sh_addr_t       d2h_r_idx_hostaddr; /* Array of all D2H ring's RD indices */
+
+       uint16          max_sub_queues; /* maximum number of H2D rings: common + flow */
+       uint16          rsvd;
+} ring_info_t;
+
+/**
+ * A structure located in TCM that is shared between host and device, primarily used during
+ * initialization.
+ */
+typedef struct {
+       /** shared area version captured at flags 7:0 */
+       uint32  flags;
+
+       uint32  trap_addr;
+       uint32  assert_exp_addr;
+       uint32  assert_file_addr;
+       uint32  assert_line;
+       uint32  console_addr;           /**< Address of hnd_cons_t */
+
+       uint32  msgtrace_addr;
+
+       uint32  fwid;
+
+       /* Used for debug/flow control */
+       uint16  total_lfrag_pkt_cnt;
+       uint16  max_host_rxbufs; /* rsvd in spec */
+
+       uint32 dma_rxoffset; /* rsvd in spec */
+
+       /** these will be used for sleep request/ack, d3 req/ack */
+       uint32  h2d_mb_data_ptr;
+       uint32  d2h_mb_data_ptr;
+
+       /* information pertinent to host IPC/msgbuf channels */
+       /** location in the TCM memory which has the ring_info */
+       uint32  rings_info_ptr;
+
+       /** block of host memory for the scratch buffer */
+       uint32          host_dma_scratch_buffer_len;
+       sh_addr_t       host_dma_scratch_buffer;
+
+       /** block of host memory for the dongle to push the status into */
+       uint32          device_rings_stsblk_len;
+       sh_addr_t       device_rings_stsblk;
+
+       uint32  buzzz;  /* BUZZZ state format strings and trace buffer */
+
+} pciedev_shared_t;
+
+extern pciedev_shared_t pciedev_shared;
+
+/**
+ * Mailboxes notify a remote party that an event took place, using interrupts. They use hardware
+ * support.
+ */
+
+/* H2D mail box Data */
+#define H2D_HOST_D3_INFORM     0x00000001
+#define H2D_HOST_DS_ACK                0x00000002
+#define H2D_HOST_DS_NAK                0x00000004
+#define H2D_HOST_CONS_INT      0x80000000      /**< h2d int for console cmds  */
+#define H2D_FW_TRAP                    0x20000000      /**< dump HW reg info for Livelock issue */
+#define H2D_HOST_D0_INFORM_IN_USE      0x00000008
+#define H2D_HOST_D0_INFORM     0x00000010
+
+/* D2H mail box Data */
+#define D2H_DEV_D3_ACK         0x00000001
+#define D2H_DEV_DS_ENTER_REQ   0x00000002
+#define D2H_DEV_DS_EXIT_NOTE   0x00000004
+#define D2H_DEV_FWHALT         0x10000000
+#define D2H_DEV_MB_MASK                (D2H_DEV_D3_ACK | D2H_DEV_DS_ENTER_REQ | \
+                               D2H_DEV_DS_EXIT_NOTE | D2H_DEV_FWHALT)
+#define D2H_DEV_MB_INVALIDATED(x)      ((!x) || (x & ~D2H_DEV_MB_MASK))
+
+/** These macro's operate on type 'inuse_lclbuf_pool_t' and are used by firmware only */
+#define NEXTTXP(i, d)           ((((i)+1) >= (d)) ? 0 : ((i)+1))
+#define NTXPACTIVE(r, w, d)     (((r) <= (w)) ? ((w)-(r)) : ((d)-(r)+(w)))
+#define NTXPAVAIL(r, w, d)      (((d) - NTXPACTIVE((r), (w), (d))) > 1)
+
+/* Function can be used to notify host of FW halt */
+#define READ_AVAIL_SPACE(w, r, d)              \
+                       ((w >= r) ? (w - r) : (d - r))
+
+#define WRITE_SPACE_AVAIL_CONTINUOUS(r, w, d)          ((w >= r) ? (d - w) : (r - w))
+#define WRITE_SPACE_AVAIL(r, w, d)     (d - (NTXPACTIVE(r, w, d)) - 1)
+#define CHECK_WRITE_SPACE(r, w, d)     \
+               MIN(WRITE_SPACE_AVAIL(r, w, d), WRITE_SPACE_AVAIL_CONTINUOUS(r, w, d))
+
+
+#define WRT_PEND(x)    ((x)->wr_pending)
+#define DNGL_RING_WPTR(msgbuf)         (*((msgbuf)->tcm_rs_w_ptr))
+#define BCMMSGBUF_RING_SET_W_PTR(msgbuf, a)    (DNGL_RING_WPTR(msgbuf) = (a))
+
+#define DNGL_RING_RPTR(msgbuf)         (*((msgbuf)->tcm_rs_r_ptr))
+#define BCMMSGBUF_RING_SET_R_PTR(msgbuf, a)    (DNGL_RING_RPTR(msgbuf) = (a))
+
+#define RING_START_PTR(x)      ((x)->ringmem->base_addr.low_addr)
+#define RING_MAX_ITEM(x)       ((x)->ringmem->max_item)
+#define RING_LEN_ITEMS(x)      ((x)->ringmem->len_items)
+
+#endif /* _bcmpcie_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/bcmpcispi.h b/drivers/net/wireless/bcmdhd_1363/include/bcmpcispi.h
new file mode 100644 (file)
index 0000000..b3502ea
--- /dev/null
@@ -0,0 +1,184 @@
+/*
+ * Broadcom PCI-SPI Host Controller Register Definitions
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmpcispi.h 514727 2014-11-12 03:02:48Z $
+ */
+#ifndef        _BCM_PCI_SPI_H
+#define        _BCM_PCI_SPI_H
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define        _PADLINE(line)  pad ## line
+#define        _XSTR(line)     _PADLINE(line)
+#define        PAD             _XSTR(__LINE__)
+#endif /* PAD */
+
+
+typedef volatile struct {
+       uint32 spih_ctrl;               /* 0x00 SPI Control Register */
+       uint32 spih_stat;               /* 0x04 SPI Status Register */
+       uint32 spih_data;               /* 0x08 SPI Data Register, 32-bits wide */
+       uint32 spih_ext;                /* 0x0C SPI Extension Register */
+       uint32 PAD[4];                  /* 0x10-0x1F PADDING */
+
+       uint32 spih_gpio_ctrl;          /* 0x20 SPI GPIO Control Register */
+       uint32 spih_gpio_data;          /* 0x24 SPI GPIO Data Register */
+       uint32 PAD[6];                  /* 0x28-0x3F PADDING */
+
+       uint32 spih_int_edge;           /* 0x40 SPI Interrupt Edge Register (0=Level, 1=Edge) */
+       uint32 spih_int_pol;            /* 0x44 SPI Interrupt Polarity Register (0=Active Low, */
+                                                       /* 1=Active High) */
+       uint32 spih_int_mask;           /* 0x48 SPI Interrupt Mask */
+       uint32 spih_int_status;         /* 0x4C SPI Interrupt Status */
+       uint32 PAD[4];                  /* 0x50-0x5F PADDING */
+
+       uint32 spih_hex_disp;           /* 0x60 SPI 4-digit hex display value */
+       uint32 spih_current_ma;         /* 0x64 SPI SD card current consumption in mA */
+       uint32 PAD[1];                  /* 0x68 PADDING */
+       uint32 spih_disp_sel;           /* 0x6c SPI 4-digit hex display mode select (1=current) */
+       uint32 PAD[4];                  /* 0x70-0x7F PADDING */
+       uint32 PAD[8];                  /* 0x80-0x9F PADDING */
+       uint32 PAD[8];                  /* 0xA0-0xBF PADDING */
+       uint32 spih_pll_ctrl;   /* 0xC0 PLL Control Register */
+       uint32 spih_pll_status; /* 0xC4 PLL Status Register */
+       uint32 spih_xtal_freq;  /* 0xC8 External Clock Frequency in units of 10000Hz */
+       uint32 spih_clk_count;  /* 0xCC External Clock Count Register */
+
+} spih_regs_t;
+
+typedef volatile struct {
+       uint32 cfg_space[0x40];         /* 0x000-0x0FF PCI Configuration Space (Read Only) */
+       uint32 P_IMG_CTRL0;             /* 0x100 PCI Image0 Control Register */
+
+       uint32 P_BA0;                   /* 0x104 32 R/W PCI Image0 Base Address register */
+       uint32 P_AM0;                   /* 0x108 32 R/W PCI Image0 Address Mask register */
+       uint32 P_TA0;                   /* 0x10C 32 R/W PCI Image0 Translation Address register */
+       uint32 P_IMG_CTRL1;             /* 0x110 32 R/W PCI Image1 Control register */
+       uint32 P_BA1;                   /* 0x114 32 R/W PCI Image1 Base Address register */
+       uint32 P_AM1;                   /* 0x118 32 R/W PCI Image1 Address Mask register */
+       uint32 P_TA1;                   /* 0x11C 32 R/W PCI Image1 Translation Address register */
+       uint32 P_IMG_CTRL2;             /* 0x120 32 R/W PCI Image2 Control register */
+       uint32 P_BA2;                   /* 0x124 32 R/W PCI Image2 Base Address register */
+       uint32 P_AM2;                   /* 0x128 32 R/W PCI Image2 Address Mask register */
+       uint32 P_TA2;                   /* 0x12C 32 R/W PCI Image2 Translation Address register */
+       uint32 P_IMG_CTRL3;             /* 0x130 32 R/W PCI Image3 Control register */
+       uint32 P_BA3;                   /* 0x134 32 R/W PCI Image3 Base Address register */
+       uint32 P_AM3;                   /* 0x138 32 R/W PCI Image3 Address Mask register */
+       uint32 P_TA3;                   /* 0x13C 32 R/W PCI Image3 Translation Address register */
+       uint32 P_IMG_CTRL4;             /* 0x140 32 R/W PCI Image4 Control register */
+       uint32 P_BA4;                   /* 0x144 32 R/W PCI Image4 Base Address register */
+       uint32 P_AM4;                   /* 0x148 32 R/W PCI Image4 Address Mask register */
+       uint32 P_TA4;                   /* 0x14C 32 R/W PCI Image4 Translation Address register */
+       uint32 P_IMG_CTRL5;             /* 0x150 32 R/W PCI Image5 Control register */
+       uint32 P_BA5;                   /* 0x154 32 R/W PCI Image5 Base Address register */
+       uint32 P_AM5;                   /* 0x158 32 R/W PCI Image5 Address Mask register */
+       uint32 P_TA5;                   /* 0x15C 32 R/W PCI Image5 Translation Address register */
+       uint32 P_ERR_CS;                /* 0x160 32 R/W PCI Error Control and Status register */
+       uint32 P_ERR_ADDR;              /* 0x164 32 R PCI Erroneous Address register */
+       uint32 P_ERR_DATA;              /* 0x168 32 R PCI Erroneous Data register */
+
+       uint32 PAD[5];                  /* 0x16C-0x17F PADDING */
+
+       uint32 WB_CONF_SPC_BAR;         /* 0x180 32 R WISHBONE Configuration Space Base Address */
+       uint32 W_IMG_CTRL1;             /* 0x184 32 R/W WISHBONE Image1 Control register */
+       uint32 W_BA1;                   /* 0x188 32 R/W WISHBONE Image1 Base Address register */
+       uint32 W_AM1;                   /* 0x18C 32 R/W WISHBONE Image1 Address Mask register */
+       uint32 W_TA1;                   /* 0x190 32 R/W WISHBONE Image1 Translation Address reg */
+       uint32 W_IMG_CTRL2;             /* 0x194 32 R/W WISHBONE Image2 Control register */
+       uint32 W_BA2;                   /* 0x198 32 R/W WISHBONE Image2 Base Address register */
+       uint32 W_AM2;                   /* 0x19C 32 R/W WISHBONE Image2 Address Mask register */
+       uint32 W_TA2;                   /* 0x1A0 32 R/W WISHBONE Image2 Translation Address reg */
+       uint32 W_IMG_CTRL3;             /* 0x1A4 32 R/W WISHBONE Image3 Control register */
+       uint32 W_BA3;                   /* 0x1A8 32 R/W WISHBONE Image3 Base Address register */
+       uint32 W_AM3;                   /* 0x1AC 32 R/W WISHBONE Image3 Address Mask register */
+       uint32 W_TA3;                   /* 0x1B0 32 R/W WISHBONE Image3 Translation Address reg */
+       uint32 W_IMG_CTRL4;             /* 0x1B4 32 R/W WISHBONE Image4 Control register */
+       uint32 W_BA4;                   /* 0x1B8 32 R/W WISHBONE Image4 Base Address register */
+       uint32 W_AM4;                   /* 0x1BC 32 R/W WISHBONE Image4 Address Mask register */
+       uint32 W_TA4;                   /* 0x1C0 32 R/W WISHBONE Image4 Translation Address reg */
+       uint32 W_IMG_CTRL5;             /* 0x1C4 32 R/W WISHBONE Image5 Control register */
+       uint32 W_BA5;                   /* 0x1C8 32 R/W WISHBONE Image5 Base Address register */
+       uint32 W_AM5;                   /* 0x1CC 32 R/W WISHBONE Image5 Address Mask register */
+       uint32 W_TA5;                   /* 0x1D0 32 R/W WISHBONE Image5 Translation Address reg */
+       uint32 W_ERR_CS;                /* 0x1D4 32 R/W WISHBONE Error Control and Status reg */
+       uint32 W_ERR_ADDR;              /* 0x1D8 32 R WISHBONE Erroneous Address register */
+       uint32 W_ERR_DATA;              /* 0x1DC 32 R WISHBONE Erroneous Data register */
+       uint32 CNF_ADDR;                /* 0x1E0 32 R/W Configuration Cycle register */
+       uint32 CNF_DATA;                /* 0x1E4 32 R/W Configuration Cycle Generation Data reg */
+
+       uint32 INT_ACK;                 /* 0x1E8 32 R Interrupt Acknowledge register */
+       uint32 ICR;                     /* 0x1EC 32 R/W Interrupt Control register */
+       uint32 ISR;                     /* 0x1F0 32 R/W Interrupt Status register */
+} spih_pciregs_t;
+
+/*
+ * PCI Core interrupt enable and status bit definitions.
+ */
+
+/* PCI Core ICR Register bit definitions */
+#define PCI_INT_PROP_EN                (1 << 0)        /* Interrupt Propagation Enable */
+#define PCI_WB_ERR_INT_EN      (1 << 1)        /* Wishbone Error Interrupt Enable */
+#define PCI_PCI_ERR_INT_EN     (1 << 2)        /* PCI Error Interrupt Enable */
+#define PCI_PAR_ERR_INT_EN     (1 << 3)        /* Parity Error Interrupt Enable */
+#define PCI_SYS_ERR_INT_EN     (1 << 4)        /* System Error Interrupt Enable */
+#define PCI_SOFTWARE_RESET     (1U << 31)      /* Software reset of the PCI Core. */
+
+
+/* PCI Core ISR Register bit definitions */
+#define PCI_INT_PROP_ST                (1 << 0)        /* Interrupt Propagation Status */
+#define PCI_WB_ERR_INT_ST      (1 << 1)        /* Wishbone Error Interrupt Status */
+#define PCI_PCI_ERR_INT_ST     (1 << 2)        /* PCI Error Interrupt Status */
+#define PCI_PAR_ERR_INT_ST     (1 << 3)        /* Parity Error Interrupt Status */
+#define PCI_SYS_ERR_INT_ST     (1 << 4)        /* System Error Interrupt Status */
+
+
+/* Registers on the Wishbone bus */
+#define SPIH_CTLR_INTR         (1 << 0)        /* SPI Host Controller Core Interrupt */
+#define SPIH_DEV_INTR          (1 << 1)        /* SPI Device Interrupt */
+#define SPIH_WFIFO_INTR                (1 << 2)        /* SPI Tx FIFO Empty Intr (FPGA Rev >= 8) */
+
+/* GPIO Bit definitions */
+#define SPIH_CS                        (1 << 0)        /* SPI Chip Select (active low) */
+#define SPIH_SLOT_POWER                (1 << 1)        /* SD Card Slot Power Enable */
+#define SPIH_CARD_DETECT       (1 << 2)        /* SD Card Detect */
+
+/* SPI Status Register Bit definitions */
+#define SPIH_STATE_MASK                0x30            /* SPI Transfer State Machine state mask */
+#define SPIH_STATE_SHIFT       4               /* SPI Transfer State Machine state shift */
+#define SPIH_WFFULL            (1 << 3)        /* SPI Write FIFO Full */
+#define SPIH_WFEMPTY           (1 << 2)        /* SPI Write FIFO Empty */
+#define SPIH_RFFULL            (1 << 1)        /* SPI Read FIFO Full */
+#define SPIH_RFEMPTY           (1 << 0)        /* SPI Read FIFO Empty */
+
+#define SPIH_EXT_CLK           (1U << 31)      /* Use External Clock as PLL Clock source. */
+
+#define SPIH_PLL_NO_CLK                (1 << 1)        /* Set to 1 if the PLL's input clock is lost. */
+#define SPIH_PLL_LOCKED                (1 << 3)        /* Set to 1 when the PLL is locked. */
+
+/* Spin bit loop bound check */
+#define SPI_SPIN_BOUND         0xf4240         /* 1 million */
+
+#endif /* _BCM_PCI_SPI_H */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/bcmperf.h b/drivers/net/wireless/bcmdhd_1363/include/bcmperf.h
new file mode 100644 (file)
index 0000000..09e607f
--- /dev/null
@@ -0,0 +1,39 @@
+/*
+ * Performance counters software interface.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmperf.h 514727 2014-11-12 03:02:48Z $
+ */
+/* essai */
+#ifndef _BCMPERF_H_
+#define _BCMPERF_H_
+/* get cache hits and misses */
+#define BCMPERF_ENABLE_INSTRCOUNT()
+#define BCMPERF_ENABLE_ICACHE_MISS()
+#define BCMPERF_ENABLE_ICACHE_HIT()
+#define        BCMPERF_GETICACHE_MISS(x)       ((x) = 0)
+#define        BCMPERF_GETICACHE_HIT(x)        ((x) = 0)
+#define        BCMPERF_GETINSTRCOUNT(x)        ((x) = 0)
+#endif /* _BCMPERF_H_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/bcmsdbus.h b/drivers/net/wireless/bcmdhd_1363/include/bcmsdbus.h
new file mode 100644 (file)
index 0000000..88635f1
--- /dev/null
@@ -0,0 +1,146 @@
+/*
+ * Definitions for API from sdio common code (bcmsdh) to individual
+ * host controller drivers.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmsdbus.h 514727 2014-11-12 03:02:48Z $
+ */
+
+#ifndef        _sdio_api_h_
+#define        _sdio_api_h_
+
+
+#define SDIOH_API_RC_SUCCESS                          (0x00)
+#define SDIOH_API_RC_FAIL                            (0x01)
+#define SDIOH_API_SUCCESS(status) (status == 0)
+
+#define SDIOH_READ              0      /* Read request */
+#define SDIOH_WRITE             1      /* Write request */
+
+#define SDIOH_DATA_FIX          0      /* Fixed addressing */
+#define SDIOH_DATA_INC          1      /* Incremental addressing */
+
+#define SDIOH_CMD_TYPE_NORMAL   0       /* Normal command */
+#define SDIOH_CMD_TYPE_APPEND   1       /* Append command */
+#define SDIOH_CMD_TYPE_CUTTHRU  2       /* Cut-through command */
+
+#define SDIOH_DATA_PIO          0       /* PIO mode */
+#define SDIOH_DATA_DMA          1       /* DMA mode */
+
+/* Max number of glommed pkts */
+#ifdef CUSTOM_MAX_TXGLOM_SIZE
+#define SDPCM_MAXGLOM_SIZE  CUSTOM_MAX_TXGLOM_SIZE
+#else
+#define SDPCM_MAXGLOM_SIZE     40
+#endif /* CUSTOM_MAX_TXGLOM_SIZE */
+
+#define SDPCM_TXGLOM_CPY 0                     /* SDIO 2.0 should use copy mode */
+#define SDPCM_TXGLOM_MDESC     1               /* SDIO 3.0 should use multi-desc mode */
+
+#ifdef CUSTOM_DEF_TXGLOM_SIZE
+#define SDPCM_DEFGLOM_SIZE  CUSTOM_DEF_TXGLOM_SIZE
+#else
+#define SDPCM_DEFGLOM_SIZE SDPCM_MAXGLOM_SIZE
+#endif /* CUSTOM_DEF_TXGLOM_SIZE */
+
+#if SDPCM_DEFGLOM_SIZE > SDPCM_MAXGLOM_SIZE
+#warning "SDPCM_DEFGLOM_SIZE cannot be higher than SDPCM_MAXGLOM_SIZE!!"
+#undef SDPCM_DEFGLOM_SIZE
+#define SDPCM_DEFGLOM_SIZE SDPCM_MAXGLOM_SIZE
+#endif
+
+typedef int SDIOH_API_RC;
+
+/* SDio Host structure */
+typedef struct sdioh_info sdioh_info_t;
+
+/* callback function, taking one arg */
+typedef void (*sdioh_cb_fn_t)(void *);
+
+extern SDIOH_API_RC sdioh_interrupt_register(sdioh_info_t *si, sdioh_cb_fn_t fn, void *argh);
+extern SDIOH_API_RC sdioh_interrupt_deregister(sdioh_info_t *si);
+
+/* query whether SD interrupt is enabled or not */
+extern SDIOH_API_RC sdioh_interrupt_query(sdioh_info_t *si, bool *onoff);
+
+/* enable or disable SD interrupt */
+extern SDIOH_API_RC sdioh_interrupt_set(sdioh_info_t *si, bool enable_disable);
+
+#if defined(DHD_DEBUG)
+extern bool sdioh_interrupt_pending(sdioh_info_t *si);
+#endif
+
+/* read or write one byte using cmd52 */
+extern SDIOH_API_RC sdioh_request_byte(sdioh_info_t *si, uint rw, uint fnc, uint addr, uint8 *byte);
+
+/* read or write 2/4 bytes using cmd53 */
+extern SDIOH_API_RC sdioh_request_word(sdioh_info_t *si, uint cmd_type, uint rw, uint fnc,
+       uint addr, uint32 *word, uint nbyte);
+
+/* read or write any buffer using cmd53 */
+extern SDIOH_API_RC sdioh_request_buffer(sdioh_info_t *si, uint pio_dma, uint fix_inc,
+       uint rw, uint fnc_num, uint32 addr, uint regwidth, uint32 buflen, uint8 *buffer,
+       void *pkt);
+
+/* get cis data */
+extern SDIOH_API_RC sdioh_cis_read(sdioh_info_t *si, uint fuc, uint8 *cis, uint32 length);
+
+extern SDIOH_API_RC sdioh_cfg_read(sdioh_info_t *si, uint fuc, uint32 addr, uint8 *data);
+extern SDIOH_API_RC sdioh_cfg_write(sdioh_info_t *si, uint fuc, uint32 addr, uint8 *data);
+
+/* query number of io functions */
+extern uint sdioh_query_iofnum(sdioh_info_t *si);
+
+/* handle iovars */
+extern int sdioh_iovar_op(sdioh_info_t *si, const char *name,
+                          void *params, int plen, void *arg, int len, bool set);
+
+/* Issue abort to the specified function and clear controller as needed */
+extern int sdioh_abort(sdioh_info_t *si, uint fnc);
+
+/* Start and Stop SDIO without re-enumerating the SD card. */
+extern int sdioh_start(sdioh_info_t *si, int stage);
+extern int sdioh_stop(sdioh_info_t *si);
+
+/* Wait system lock free */
+extern int sdioh_waitlockfree(sdioh_info_t *si);
+
+/* Reset and re-initialize the device */
+extern int sdioh_sdio_reset(sdioh_info_t *si);
+
+
+
+#if defined(BCMSDIOH_STD)
+       #define SDIOH_SLEEP_ENABLED
+#endif
+extern SDIOH_API_RC sdioh_sleep(sdioh_info_t *si, bool enab);
+
+/* GPIO support */
+extern SDIOH_API_RC sdioh_gpio_init(sdioh_info_t *sd);
+extern bool sdioh_gpioin(sdioh_info_t *sd, uint32 gpio);
+extern SDIOH_API_RC sdioh_gpioouten(sdioh_info_t *sd, uint32 gpio);
+extern SDIOH_API_RC sdioh_gpioout(sdioh_info_t *sd, uint32 gpio, bool enab);
+
+#endif /* _sdio_api_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/bcmsdh.h b/drivers/net/wireless/bcmdhd_1363/include/bcmsdh.h
new file mode 100644 (file)
index 0000000..17d33c6
--- /dev/null
@@ -0,0 +1,255 @@
+/*
+ * SDIO host client driver interface of Broadcom HNBU
+ *     export functions to client drivers
+ *     abstract OS and BUS specific details of SDIO
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmsdh.h 662741 2016-11-08 09:37:17Z $
+ */
+
+/**
+ * @file bcmsdh.h
+ */
+
+#ifndef        _bcmsdh_h_
+#define        _bcmsdh_h_
+
+#define BCMSDH_ERROR_VAL       0x0001 /* Error */
+#define BCMSDH_INFO_VAL                0x0002 /* Info */
+extern const uint bcmsdh_msglevel;
+
+#define BCMSDH_ERROR(x)
+#define BCMSDH_INFO(x)
+
+#if defined(BCMSDIO) && (defined(BCMSDIOH_STD) || defined(BCMSDIOH_BCM) || \
+       defined(BCMSDIOH_SPI))
+#define BCMSDH_ADAPTER
+#endif /* BCMSDIO && (BCMSDIOH_STD || BCMSDIOH_BCM || BCMSDIOH_SPI) */
+
+/* forward declarations */
+typedef struct bcmsdh_info bcmsdh_info_t;
+typedef void (*bcmsdh_cb_fn_t)(void *);
+
+extern bcmsdh_info_t *bcmsdh_attach(osl_t *osh, void *sdioh, ulong *regsva);
+/**
+ * BCMSDH API context
+ */
+struct bcmsdh_info
+{
+       bool    init_success;   /* underlying driver successfully attached */
+       void    *sdioh;         /* handler for sdioh */
+       uint32  vendevid;       /* Target Vendor and Device ID on SD bus */
+       osl_t   *osh;
+       bool    regfail;        /* Save status of last reg_read/reg_write call */
+       uint32  sbwad;          /* Save backplane window address */
+       void    *os_cxt;        /* Pointer to per-OS private data */
+};
+
+/* Detach - freeup resources allocated in attach */
+extern int bcmsdh_detach(osl_t *osh, void *sdh);
+
+/* Query if SD device interrupts are enabled */
+extern bool bcmsdh_intr_query(void *sdh);
+
+/* Enable/disable SD interrupt */
+extern int bcmsdh_intr_enable(void *sdh);
+extern int bcmsdh_intr_disable(void *sdh);
+
+/* Register/deregister device interrupt handler. */
+extern int bcmsdh_intr_reg(void *sdh, bcmsdh_cb_fn_t fn, void *argh);
+extern int bcmsdh_intr_dereg(void *sdh);
+/* Enable/disable SD card interrupt forward */
+extern void bcmsdh_intr_forward(void *sdh, bool pass);
+
+#if defined(DHD_DEBUG)
+/* Query pending interrupt status from the host controller */
+extern bool bcmsdh_intr_pending(void *sdh);
+#endif
+
+/* Register a callback to be called if and when bcmsdh detects
+ * device removal. No-op in the case of non-removable/hardwired devices.
+ */
+extern int bcmsdh_devremove_reg(void *sdh, bcmsdh_cb_fn_t fn, void *argh);
+
+/* Access SDIO address space (e.g. CCCR) using CMD52 (single-byte interface).
+ *   fn:   function number
+ *   addr: unmodified SDIO-space address
+ *   data: data byte to write
+ *   err:  pointer to error code (or NULL)
+ */
+extern uint8 bcmsdh_cfg_read(void *sdh, uint func, uint32 addr, int *err);
+extern void bcmsdh_cfg_write(void *sdh, uint func, uint32 addr, uint8 data, int *err);
+
+/* Read/Write 4bytes from/to cfg space */
+extern uint32 bcmsdh_cfg_read_word(void *sdh, uint fnc_num, uint32 addr, int *err);
+extern void bcmsdh_cfg_write_word(void *sdh, uint fnc_num, uint32 addr, uint32 data, int *err);
+
+/* Read CIS content for specified function.
+ *   fn:     function whose CIS is being requested (0 is common CIS)
+ *   cis:    pointer to memory location to place results
+ *   length: number of bytes to read
+ * Internally, this routine uses the values from the cis base regs (0x9-0xB)
+ * to form an SDIO-space address to read the data from.
+ */
+extern int bcmsdh_cis_read(void *sdh, uint func, uint8 *cis, uint length);
+
+/* Synchronous access to device (client) core registers via CMD53 to F1.
+ *   addr: backplane address (i.e. >= regsva from attach)
+ *   size: register width in bytes (2 or 4)
+ *   data: data for register write
+ */
+extern uint32 bcmsdh_reg_read(void *sdh, uint32 addr, uint size);
+extern uint32 bcmsdh_reg_write(void *sdh, uint32 addr, uint size, uint32 data);
+
+/* set sb address window */
+extern int bcmsdhsdio_set_sbaddr_window(void *sdh, uint32 address, bool force_set);
+
+/* Indicate if last reg read/write failed */
+extern bool bcmsdh_regfail(void *sdh);
+
+/* Buffer transfer to/from device (client) core via cmd53.
+ *   fn:       function number
+ *   addr:     backplane address (i.e. >= regsva from attach)
+ *   flags:    backplane width, address increment, sync/async
+ *   buf:      pointer to memory data buffer
+ *   nbytes:   number of bytes to transfer to/from buf
+ *   pkt:      pointer to packet associated with buf (if any)
+ *   complete: callback function for command completion (async only)
+ *   handle:   handle for completion callback (first arg in callback)
+ * Returns 0 or error code.
+ * NOTE: Async operation is not currently supported.
+ */
+typedef void (*bcmsdh_cmplt_fn_t)(void *handle, int status, bool sync_waiting);
+extern int bcmsdh_send_buf(void *sdh, uint32 addr, uint fn, uint flags,
+                           uint8 *buf, uint nbytes, void *pkt,
+                           bcmsdh_cmplt_fn_t complete_fn, void *handle);
+extern int bcmsdh_recv_buf(void *sdh, uint32 addr, uint fn, uint flags,
+                           uint8 *buf, uint nbytes, void *pkt,
+                           bcmsdh_cmplt_fn_t complete_fn, void *handle);
+
+extern void bcmsdh_glom_post(void *sdh, uint8 *frame, void *pkt, uint len);
+extern void bcmsdh_glom_clear(void *sdh);
+extern uint bcmsdh_set_mode(void *sdh, uint mode);
+extern bool bcmsdh_glom_enabled(void);
+/* Flags bits */
+#define SDIO_REQ_4BYTE 0x1     /* Four-byte target (backplane) width (vs. two-byte) */
+#define SDIO_REQ_FIXED 0x2     /* Fixed address (FIFO) (vs. incrementing address) */
+#define SDIO_REQ_ASYNC 0x4     /* Async request (vs. sync request) */
+#define SDIO_BYTE_MODE 0x8     /* Byte mode request(non-block mode) */
+
+/* Pending (non-error) return code */
+#define BCME_PENDING   1
+
+/* Read/write to memory block (F1, no FIFO) via CMD53 (sync only).
+ *   rw:       read or write (0/1)
+ *   addr:     direct SDIO address
+ *   buf:      pointer to memory data buffer
+ *   nbytes:   number of bytes to transfer to/from buf
+ * Returns 0 or error code.
+ */
+extern int bcmsdh_rwdata(void *sdh, uint rw, uint32 addr, uint8 *buf, uint nbytes);
+
+/* Issue an abort to the specified function */
+extern int bcmsdh_abort(void *sdh, uint fn);
+
+/* Start SDIO Host Controller communication */
+extern int bcmsdh_start(void *sdh, int stage);
+
+/* Stop SDIO Host Controller communication */
+extern int bcmsdh_stop(void *sdh);
+
+/* Wait system lock free */
+extern int bcmsdh_waitlockfree(void *sdh);
+
+/* Returns the "Device ID" of target device on the SDIO bus. */
+extern int bcmsdh_query_device(void *sdh);
+
+/* Returns the number of IO functions reported by the device */
+extern uint bcmsdh_query_iofnum(void *sdh);
+
+/* Miscellaneous knob tweaker. */
+extern int bcmsdh_iovar_op(void *sdh, const char *name,
+                           void *params, int plen, void *arg, int len, bool set);
+
+/* Reset and reinitialize the device */
+extern int bcmsdh_reset(bcmsdh_info_t *sdh);
+
+/* helper functions */
+
+/* callback functions */
+typedef struct {
+       /* probe the device */
+       void *(*probe)(uint16 vend_id, uint16 dev_id, uint16 bus, uint16 slot,
+                       uint16 func, uint bustype, void * regsva, osl_t * osh,
+                       void * param);
+       /* remove the device */
+       void (*remove)(void *context);
+       /* can we suspend now */
+       int (*suspend)(void *context);
+       /* resume from suspend */
+       int (*resume)(void *context);
+} bcmsdh_driver_t;
+
+/* platform specific/high level functions */
+extern int bcmsdh_register(bcmsdh_driver_t *driver);
+extern void bcmsdh_unregister(void);
+extern bool bcmsdh_chipmatch(uint16 vendor, uint16 device);
+extern void bcmsdh_device_remove(void * sdh);
+
+extern int bcmsdh_reg_sdio_notify(void* semaphore);
+extern void bcmsdh_unreg_sdio_notify(void);
+
+#if defined(OOB_INTR_ONLY)
+extern int bcmsdh_oob_intr_register(bcmsdh_info_t *bcmsdh, bcmsdh_cb_fn_t oob_irq_handler,
+       void* oob_irq_handler_context);
+extern void bcmsdh_oob_intr_unregister(bcmsdh_info_t *sdh);
+extern void bcmsdh_oob_intr_set(bcmsdh_info_t *sdh, bool enable);
+#endif 
+extern void bcmsdh_dev_pm_stay_awake(bcmsdh_info_t *sdh);
+extern void bcmsdh_dev_relax(bcmsdh_info_t *sdh);
+extern bool bcmsdh_dev_pm_enabled(bcmsdh_info_t *sdh);
+
+int bcmsdh_suspend(bcmsdh_info_t *bcmsdh);
+int bcmsdh_resume(bcmsdh_info_t *bcmsdh);
+
+/* Function to pass device-status bits to DHD. */
+extern uint32 bcmsdh_get_dstatus(void *sdh);
+
+/* Function to return current window addr */
+extern uint32 bcmsdh_cur_sbwad(void *sdh);
+
+/* Function to pass chipid and rev to lower layers for controlling pr's */
+extern void bcmsdh_chipinfo(void *sdh, uint32 chip, uint32 chiprev);
+
+
+extern int bcmsdh_sleep(void *sdh, bool enab);
+
+/* GPIO support */
+extern int bcmsdh_gpio_init(void *sd);
+extern bool bcmsdh_gpioin(void *sd, uint32 gpio);
+extern int bcmsdh_gpioouten(void *sd, uint32 gpio);
+extern int bcmsdh_gpioout(void *sd, uint32 gpio, bool enab);
+
+#endif /* _bcmsdh_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/bcmsdh_sdmmc.h b/drivers/net/wireless/bcmdhd_1363/include/bcmsdh_sdmmc.h
new file mode 100644 (file)
index 0000000..102c05c
--- /dev/null
@@ -0,0 +1,119 @@
+/*
+ * BCMSDH Function Driver for the native SDIO/MMC driver in the Linux Kernel
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Proprietary,Open:>>
+ *
+ * $Id: bcmsdh_sdmmc.h 662770 2016-11-11 02:02:03Z $
+ */
+
+#ifndef __BCMSDH_SDMMC_H__
+#define __BCMSDH_SDMMC_H__
+
+#define sd_err(x)      do { if (sd_msglevel & SDH_ERROR_VAL) printf x; } while (0)
+#define sd_trace(x)
+#define sd_info(x)
+#define sd_debug(x)
+#define sd_data(x)
+#define sd_ctrl(x)
+
+#define sd_sync_dma(sd, read, nbytes)
+#define sd_init_dma(sd)
+#define sd_ack_intr(sd)
+#define sd_wakeup(sd);
+
+#define sd_log(x)
+
+#define SDIOH_ASSERT(exp) \
+       do { if (!(exp)) \
+               printf("!!!ASSERT fail: file %s lines %d", __FILE__, __LINE__); \
+       } while (0)
+
+#define BLOCK_SIZE_4318 64
+#define BLOCK_SIZE_4328 512
+
+/* internal return code */
+#define SUCCESS        0
+#define ERROR  1
+
+/* private bus modes */
+#define SDIOH_MODE_SD4         2
+#define CLIENT_INTR                    0x100   /* Get rid of this! */
+#define SDIOH_SDMMC_MAX_SG_ENTRIES     (SDPCM_MAXGLOM_SIZE+2)
+
+struct sdioh_info {
+       osl_t           *osh;                   /* osh handler */
+       void            *bcmsdh;                /* upper layer handle */
+       bool            client_intr_enabled;    /* interrupt connnected flag */
+       bool            intr_handler_valid;     /* client driver interrupt handler valid */
+       sdioh_cb_fn_t   intr_handler;           /* registered interrupt handler */
+       void            *intr_handler_arg;      /* argument to call interrupt handler */
+       uint16          intmask;                /* Current active interrupts */
+
+       int             intrcount;              /* Client interrupts */
+       bool            sd_use_dma;             /* DMA on CMD53 */
+       bool            sd_blockmode;           /* sd_blockmode == FALSE => 64 Byte Cmd 53s. */
+                                               /*  Must be on for sd_multiblock to be effective */
+       bool            use_client_ints;        /* If this is false, make sure to restore */
+       int             sd_mode;                /* SD1/SD4/SPI */
+       int             client_block_size[SDIOD_MAX_IOFUNCS];           /* Blocksize */
+       uint8           num_funcs;              /* Supported funcs on client */
+       uint32          com_cis_ptr;
+       uint32          func_cis_ptr[SDIOD_MAX_IOFUNCS];
+       bool            use_rxchain;
+       struct scatterlist      sg_list[SDIOH_SDMMC_MAX_SG_ENTRIES];
+       struct sdio_func        fake_func0;
+       struct sdio_func        *func[SDIOD_MAX_IOFUNCS];
+
+};
+
+/************************************************************
+ * Internal interfaces: per-port references into bcmsdh_sdmmc.c
+ */
+
+/* Global message bits */
+extern uint sd_msglevel;
+
+/* OS-independent interrupt handler */
+extern bool check_client_intr(sdioh_info_t *sd);
+
+/* Core interrupt enable/disable of device interrupts */
+extern void sdioh_sdmmc_devintr_on(sdioh_info_t *sd);
+extern void sdioh_sdmmc_devintr_off(sdioh_info_t *sd);
+
+
+/**************************************************************
+ * Internal interfaces: bcmsdh_sdmmc.c references to per-port code
+ */
+
+/* Register mapping routines */
+extern uint32 *sdioh_sdmmc_reg_map(osl_t *osh, int32 addr, int size);
+extern void sdioh_sdmmc_reg_unmap(osl_t *osh, int32 addr, int size);
+
+/* Interrupt (de)registration routines */
+extern int sdioh_sdmmc_register_irq(sdioh_info_t *sd, uint irq);
+extern void sdioh_sdmmc_free_irq(uint irq, sdioh_info_t *sd);
+
+extern sdioh_info_t *sdioh_attach(osl_t *osh, struct sdio_func *func);
+extern SDIOH_API_RC sdioh_detach(osl_t *osh, sdioh_info_t *sd);
+#endif /* __BCMSDH_SDMMC_H__ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/bcmsdpcm.h b/drivers/net/wireless/bcmdhd_1363/include/bcmsdpcm.h
new file mode 100644 (file)
index 0000000..78f212a
--- /dev/null
@@ -0,0 +1,281 @@
+/*
+ * Broadcom SDIO/PCMCIA
+ * Software-specific definitions shared between device and host side
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmsdpcm.h 514727 2014-11-12 03:02:48Z $
+ */
+
+#ifndef        _bcmsdpcm_h_
+#define        _bcmsdpcm_h_
+
+/*
+ * Software allocation of To SB Mailbox resources
+ */
+
+/* intstatus bits */
+#define I_SMB_NAK      I_SMB_SW0       /* To SB Mailbox Frame NAK */
+#define I_SMB_INT_ACK  I_SMB_SW1       /* To SB Mailbox Host Interrupt ACK */
+#define I_SMB_USE_OOB  I_SMB_SW2       /* To SB Mailbox Use OOB Wakeup */
+#define I_SMB_DEV_INT  I_SMB_SW3       /* To SB Mailbox Miscellaneous Interrupt */
+
+#define I_TOSBMAIL      (I_SMB_NAK | I_SMB_INT_ACK | I_SMB_USE_OOB | I_SMB_DEV_INT)
+
+/* tosbmailbox bits corresponding to intstatus bits */
+#define SMB_NAK                (1 << 0)        /* To SB Mailbox Frame NAK */
+#define SMB_INT_ACK    (1 << 1)        /* To SB Mailbox Host Interrupt ACK */
+#define SMB_USE_OOB    (1 << 2)        /* To SB Mailbox Use OOB Wakeup */
+#define SMB_DEV_INT    (1 << 3)        /* To SB Mailbox Miscellaneous Interrupt */
+#define SMB_MASK       0x0000000f      /* To SB Mailbox Mask */
+
+/* tosbmailboxdata */
+#define SMB_DATA_VERSION_MASK  0x00ff0000      /* host protocol version (sent with F2 enable) */
+#define SMB_DATA_VERSION_SHIFT 16              /* host protocol version (sent with F2 enable) */
+
+/*
+ * Software allocation of To Host Mailbox resources
+ */
+
+/* intstatus bits */
+#define I_HMB_FC_STATE I_HMB_SW0       /* To Host Mailbox Flow Control State */
+#define I_HMB_FC_CHANGE        I_HMB_SW1       /* To Host Mailbox Flow Control State Changed */
+#define I_HMB_FRAME_IND        I_HMB_SW2       /* To Host Mailbox Frame Indication */
+#define I_HMB_HOST_INT I_HMB_SW3       /* To Host Mailbox Miscellaneous Interrupt */
+
+#define I_TOHOSTMAIL    (I_HMB_FC_CHANGE | I_HMB_FRAME_IND | I_HMB_HOST_INT)
+
+/* tohostmailbox bits corresponding to intstatus bits */
+#define HMB_FC_ON      (1 << 0)        /* To Host Mailbox Flow Control State */
+#define HMB_FC_CHANGE  (1 << 1)        /* To Host Mailbox Flow Control State Changed */
+#define HMB_FRAME_IND  (1 << 2)        /* To Host Mailbox Frame Indication */
+#define HMB_HOST_INT   (1 << 3)        /* To Host Mailbox Miscellaneous Interrupt */
+#define HMB_MASK       0x0000000f      /* To Host Mailbox Mask */
+
+/* tohostmailboxdata */
+#define HMB_DATA_NAKHANDLED    0x01    /* we're ready to retransmit NAK'd frame to host */
+#define HMB_DATA_DEVREADY      0x02    /* we're ready to to talk to host after enable */
+#define HMB_DATA_FC            0x04    /* per prio flowcontrol update flag to host */
+#define HMB_DATA_FWREADY       0x08    /* firmware is ready for protocol activity */
+#define HMB_DATA_FWHALT                0x10    /* firmware has halted operation */
+
+#define HMB_DATA_FCDATA_MASK   0xff000000      /* per prio flowcontrol data */
+#define HMB_DATA_FCDATA_SHIFT  24              /* per prio flowcontrol data */
+
+#define HMB_DATA_VERSION_MASK  0x00ff0000      /* device protocol version (with devready) */
+#define HMB_DATA_VERSION_SHIFT 16              /* device protocol version (with devready) */
+
+/*
+ * Software-defined protocol header
+ */
+
+/* Current protocol version */
+#define SDPCM_PROT_VERSION     4
+
+/* SW frame header */
+#define SDPCM_SEQUENCE_MASK            0x000000ff      /* Sequence Number Mask */
+#define SDPCM_PACKET_SEQUENCE(p) (((uint8 *)p)[0] & 0xff) /* p starts w/SW Header */
+
+#define SDPCM_CHANNEL_MASK             0x00000f00      /* Channel Number Mask */
+#define SDPCM_CHANNEL_SHIFT            8               /* Channel Number Shift */
+#define SDPCM_PACKET_CHANNEL(p) (((uint8 *)p)[1] & 0x0f) /* p starts w/SW Header */
+
+#define SDPCM_FLAGS_MASK               0x0000f000      /* Mask of flag bits */
+#define SDPCM_FLAGS_SHIFT              12              /* Flag bits shift */
+#define SDPCM_PACKET_FLAGS(p) ((((uint8 *)p)[1] & 0xf0) >> 4) /* p starts w/SW Header */
+
+/* Next Read Len: lookahead length of next frame, in 16-byte units (rounded up) */
+#define SDPCM_NEXTLEN_MASK             0x00ff0000      /* Next Read Len Mask */
+#define SDPCM_NEXTLEN_SHIFT            16              /* Next Read Len Shift */
+#define SDPCM_NEXTLEN_VALUE(p) ((((uint8 *)p)[2] & 0xff) << 4) /* p starts w/SW Header */
+#define SDPCM_NEXTLEN_OFFSET           2
+
+/* Data Offset from SOF (HW Tag, SW Tag, Pad) */
+#define SDPCM_DOFFSET_OFFSET           3               /* Data Offset */
+#define SDPCM_DOFFSET_VALUE(p)                 (((uint8 *)p)[SDPCM_DOFFSET_OFFSET] & 0xff)
+#define SDPCM_DOFFSET_MASK             0xff000000
+#define SDPCM_DOFFSET_SHIFT            24
+
+#define SDPCM_FCMASK_OFFSET            4               /* Flow control */
+#define SDPCM_FCMASK_VALUE(p)          (((uint8 *)p)[SDPCM_FCMASK_OFFSET ] & 0xff)
+#define SDPCM_WINDOW_OFFSET            5               /* Credit based fc */
+#define SDPCM_WINDOW_VALUE(p)          (((uint8 *)p)[SDPCM_WINDOW_OFFSET] & 0xff)
+#define SDPCM_VERSION_OFFSET           6               /* Version # */
+#define SDPCM_VERSION_VALUE(p)         (((uint8 *)p)[SDPCM_VERSION_OFFSET] & 0xff)
+#define SDPCM_UNUSED_OFFSET            7               /* Spare */
+#define SDPCM_UNUSED_VALUE(p)          (((uint8 *)p)[SDPCM_UNUSED_OFFSET] & 0xff)
+
+#define SDPCM_SWHEADER_LEN     8       /* SW header is 64 bits */
+
+/* logical channel numbers */
+#define SDPCM_CONTROL_CHANNEL  0       /* Control Request/Response Channel Id */
+#define SDPCM_EVENT_CHANNEL    1       /* Asyc Event Indication Channel Id */
+#define SDPCM_DATA_CHANNEL     2       /* Data Xmit/Recv Channel Id */
+#define SDPCM_GLOM_CHANNEL     3       /* For coalesced packets (superframes) */
+#define SDPCM_TEST_CHANNEL     15      /* Reserved for test/debug packets */
+#define SDPCM_MAX_CHANNEL      15
+
+#define SDPCM_SEQUENCE_WRAP    256     /* wrap-around val for eight-bit frame seq number */
+
+#define SDPCM_FLAG_RESVD0      0x01
+#define SDPCM_FLAG_RESVD1      0x02
+#define SDPCM_FLAG_GSPI_TXENAB 0x04
+#define SDPCM_FLAG_GLOMDESC    0x08    /* Superframe descriptor mask */
+
+/* For GLOM_CHANNEL frames, use a flag to indicate descriptor frame */
+#define SDPCM_GLOMDESC_FLAG    (SDPCM_FLAG_GLOMDESC << SDPCM_FLAGS_SHIFT)
+
+#define SDPCM_GLOMDESC(p)      (((uint8 *)p)[1] & 0x80)
+
+/* For TEST_CHANNEL packets, define another 4-byte header */
+#define SDPCM_TEST_HDRLEN              4       /* Generally: Cmd(1), Ext(1), Len(2);
+                                                * Semantics of Ext byte depend on command.
+                                                * Len is current or requested frame length, not
+                                                * including test header; sent little-endian.
+                                                */
+#define SDPCM_TEST_PKT_CNT_FLD_LEN     4       /* Packet count filed legth */
+#define SDPCM_TEST_DISCARD             0x01    /* Receiver discards. Ext is a pattern id. */
+#define SDPCM_TEST_ECHOREQ             0x02    /* Echo request. Ext is a pattern id. */
+#define SDPCM_TEST_ECHORSP             0x03    /* Echo response. Ext is a pattern id. */
+#define SDPCM_TEST_BURST               0x04    /* Receiver to send a burst. Ext is a frame count
+                                                * (Backward compatabilty) Set frame count in a
+                                                * 4 byte filed adjacent to the HDR
+                                                */
+#define SDPCM_TEST_SEND                        0x05    /* Receiver sets send mode. Ext is boolean on/off
+                                                * Set frame count in a 4 byte filed adjacent to
+                                                * the HDR
+                                                */
+
+/* Handy macro for filling in datagen packets with a pattern */
+#define SDPCM_TEST_FILL(byteno, id)    ((uint8)(id + byteno))
+
+/*
+ * Software counters (first part matches hardware counters)
+ */
+
+typedef volatile struct {
+       uint32 cmd52rd;         /* Cmd52RdCount, SDIO: cmd52 reads */
+       uint32 cmd52wr;         /* Cmd52WrCount, SDIO: cmd52 writes */
+       uint32 cmd53rd;         /* Cmd53RdCount, SDIO: cmd53 reads */
+       uint32 cmd53wr;         /* Cmd53WrCount, SDIO: cmd53 writes */
+       uint32 abort;           /* AbortCount, SDIO: aborts */
+       uint32 datacrcerror;    /* DataCrcErrorCount, SDIO: frames w/CRC error */
+       uint32 rdoutofsync;     /* RdOutOfSyncCount, SDIO/PCMCIA: Rd Frm out of sync */
+       uint32 wroutofsync;     /* RdOutOfSyncCount, SDIO/PCMCIA: Wr Frm out of sync */
+       uint32 writebusy;       /* WriteBusyCount, SDIO: device asserted "busy" */
+       uint32 readwait;        /* ReadWaitCount, SDIO: no data ready for a read cmd */
+       uint32 readterm;        /* ReadTermCount, SDIO: read frame termination cmds */
+       uint32 writeterm;       /* WriteTermCount, SDIO: write frames termination cmds */
+       uint32 rxdescuflo;      /* receive descriptor underflows */
+       uint32 rxfifooflo;      /* receive fifo overflows */
+       uint32 txfifouflo;      /* transmit fifo underflows */
+       uint32 runt;            /* runt (too short) frames recv'd from bus */
+       uint32 badlen;          /* frame's rxh len does not match its hw tag len */
+       uint32 badcksum;        /* frame's hw tag chksum doesn't agree with len value */
+       uint32 seqbreak;        /* break in sequence # space from one rx frame to the next */
+       uint32 rxfcrc;          /* frame rx header indicates crc error */
+       uint32 rxfwoos;         /* frame rx header indicates write out of sync */
+       uint32 rxfwft;          /* frame rx header indicates write frame termination */
+       uint32 rxfabort;        /* frame rx header indicates frame aborted */
+       uint32 woosint;         /* write out of sync interrupt */
+       uint32 roosint;         /* read out of sync interrupt */
+       uint32 rftermint;       /* read frame terminate interrupt */
+       uint32 wftermint;       /* write frame terminate interrupt */
+} sdpcmd_cnt_t;
+
+/*
+ * Register Access Macros
+ */
+
+#define SDIODREV_IS(var, val)  ((var) == (val))
+#define SDIODREV_GE(var, val)  ((var) >= (val))
+#define SDIODREV_GT(var, val)  ((var) > (val))
+#define SDIODREV_LT(var, val)  ((var) < (val))
+#define SDIODREV_LE(var, val)  ((var) <= (val))
+
+#define SDIODDMAREG32(h, dir, chnl) \
+       ((dir) == DMA_TX ? \
+        (void *)(uintptr)&((h)->regs->dma.sdiod32.dma32regs[chnl].xmt) : \
+        (void *)(uintptr)&((h)->regs->dma.sdiod32.dma32regs[chnl].rcv))
+
+#define SDIODDMAREG64(h, dir, chnl) \
+       ((dir) == DMA_TX ? \
+        (void *)(uintptr)&((h)->regs->dma.sdiod64.dma64regs[chnl].xmt) : \
+        (void *)(uintptr)&((h)->regs->dma.sdiod64.dma64regs[chnl].rcv))
+
+#define SDIODDMAREG(h, dir, chnl) \
+       (SDIODREV_LT((h)->corerev, 1) ? \
+        SDIODDMAREG32((h), (dir), (chnl)) : \
+        SDIODDMAREG64((h), (dir), (chnl)))
+
+#define PCMDDMAREG(h, dir, chnl) \
+       ((dir) == DMA_TX ? \
+        (void *)(uintptr)&((h)->regs->dma.pcm32.dmaregs.xmt) : \
+        (void *)(uintptr)&((h)->regs->dma.pcm32.dmaregs.rcv))
+
+#define SDPCMDMAREG(h, dir, chnl, coreid) \
+       ((coreid) == SDIOD_CORE_ID ? \
+        SDIODDMAREG(h, dir, chnl) : \
+        PCMDDMAREG(h, dir, chnl))
+
+#define SDIODFIFOREG(h, corerev) \
+       (SDIODREV_LT((corerev), 1) ? \
+        ((dma32diag_t *)(uintptr)&((h)->regs->dma.sdiod32.dmafifo)) : \
+        ((dma32diag_t *)(uintptr)&((h)->regs->dma.sdiod64.dmafifo)))
+
+#define PCMDFIFOREG(h) \
+       ((dma32diag_t *)(uintptr)&((h)->regs->dma.pcm32.dmafifo))
+
+#define SDPCMFIFOREG(h, coreid, corerev) \
+       ((coreid) == SDIOD_CORE_ID ? \
+        SDIODFIFOREG(h, corerev) : \
+        PCMDFIFOREG(h))
+
+/*
+ * Shared structure between dongle and the host.
+ * The structure contains pointers to trap or assert information.
+ */
+#define SDPCM_SHARED_VERSION       0x0001
+#define SDPCM_SHARED_VERSION_MASK  0x00FF
+#define SDPCM_SHARED_ASSERT_BUILT  0x0100
+#define SDPCM_SHARED_ASSERT        0x0200
+#define SDPCM_SHARED_TRAP          0x0400
+#define SDPCM_SHARED_IN_BRPT       0x0800
+#define SDPCM_SHARED_SET_BRPT      0x1000
+#define SDPCM_SHARED_PENDING_BRPT  0x2000
+
+typedef struct {
+       uint32  flags;
+       uint32  trap_addr;
+       uint32  assert_exp_addr;
+       uint32  assert_file_addr;
+       uint32  assert_line;
+       uint32  console_addr;           /* Address of hnd_cons_t */
+       uint32  msgtrace_addr;
+       uint32  fwid;
+} sdpcm_shared_t;
+
+extern sdpcm_shared_t sdpcm_shared;
+
+#endif /* _bcmsdpcm_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/bcmsdspi.h b/drivers/net/wireless/bcmdhd_1363/include/bcmsdspi.h
new file mode 100644 (file)
index 0000000..537876c
--- /dev/null
@@ -0,0 +1,138 @@
+/*
+ * SD-SPI Protocol Conversion - BCMSDH->SPI Translation Layer
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmsdspi.h 514727 2014-11-12 03:02:48Z $
+ */
+#ifndef        _BCM_SD_SPI_H
+#define        _BCM_SD_SPI_H
+
+/* global msglevel for debug messages - bitvals come from sdiovar.h */
+
+#define sd_err(x)
+#define sd_trace(x)
+#define sd_info(x)
+#define sd_debug(x)
+#define sd_data(x)
+#define sd_ctrl(x)
+
+#define sd_log(x)
+
+#define SDIOH_ASSERT(exp) \
+       do { if (!(exp)) \
+               printf("!!!ASSERT fail: file %s lines %d", __FILE__, __LINE__); \
+       } while (0)
+
+#define BLOCK_SIZE_4318 64
+#define BLOCK_SIZE_4328 512
+
+/* internal return code */
+#define SUCCESS        0
+#undef ERROR
+#define ERROR  1
+
+/* private bus modes */
+#define SDIOH_MODE_SPI         0
+
+#define USE_BLOCKMODE          0x2     /* Block mode can be single block or multi */
+#define USE_MULTIBLOCK         0x4
+
+struct sdioh_info {
+       uint cfg_bar;                           /* pci cfg address for bar */
+       uint32 caps;                            /* cached value of capabilities reg */
+       uint            bar0;                   /* BAR0 for PCI Device */
+       osl_t           *osh;                   /* osh handler */
+       void            *controller;    /* Pointer to SPI Controller's private data struct */
+
+       uint            lockcount;              /* nest count of sdspi_lock() calls */
+       bool            client_intr_enabled;    /* interrupt connnected flag */
+       bool            intr_handler_valid;     /* client driver interrupt handler valid */
+       sdioh_cb_fn_t   intr_handler;           /* registered interrupt handler */
+       void            *intr_handler_arg;      /* argument to call interrupt handler */
+       bool            initialized;            /* card initialized */
+       uint32          target_dev;             /* Target device ID */
+       uint32          intmask;                /* Current active interrupts */
+       void            *sdos_info;             /* Pointer to per-OS private data */
+
+       uint32          controller_type;        /* Host controller type */
+       uint8           version;                /* Host Controller Spec Compliance Version */
+       uint            irq;                    /* Client irq */
+       uint32          intrcount;              /* Client interrupts */
+       uint32          local_intrcount;        /* Controller interrupts */
+       bool            host_init_done;         /* Controller initted */
+       bool            card_init_done;         /* Client SDIO interface initted */
+       bool            polled_mode;            /* polling for command completion */
+
+       bool            sd_use_dma;             /* DMA on CMD53 */
+       bool            sd_blockmode;           /* sd_blockmode == FALSE => 64 Byte Cmd 53s. */
+                                               /*  Must be on for sd_multiblock to be effective */
+       bool            use_client_ints;        /* If this is false, make sure to restore */
+       bool            got_hcint;              /* Host Controller interrupt. */
+                                               /*  polling hack in wl_linux.c:wl_timer() */
+       int             adapter_slot;           /* Maybe dealing with multiple slots/controllers */
+       int             sd_mode;                /* SD1/SD4/SPI */
+       int             client_block_size[SDIOD_MAX_IOFUNCS];           /* Blocksize */
+       uint32          data_xfer_count;        /* Current register transfer size */
+       uint32          cmd53_wr_data;          /* Used to pass CMD53 write data */
+       uint32          card_response;          /* Used to pass back response status byte */
+       uint32          card_rsp_data;          /* Used to pass back response data word */
+       uint16          card_rca;               /* Current Address */
+       uint8           num_funcs;              /* Supported funcs on client */
+       uint32          com_cis_ptr;
+       uint32          func_cis_ptr[SDIOD_MAX_IOFUNCS];
+       void            *dma_buf;
+       ulong           dma_phys;
+       int             r_cnt;                  /* rx count */
+       int             t_cnt;                  /* tx_count */
+};
+
+/************************************************************
+ * Internal interfaces: per-port references into bcmsdspi.c
+ */
+
+/* Global message bits */
+extern uint sd_msglevel;
+
+/**************************************************************
+ * Internal interfaces: bcmsdspi.c references to per-port code
+ */
+
+/* Register mapping routines */
+extern uint32 *spi_reg_map(osl_t *osh, uintptr addr, int size);
+extern void spi_reg_unmap(osl_t *osh, uintptr addr, int size);
+
+/* Interrupt (de)registration routines */
+extern int spi_register_irq(sdioh_info_t *sd, uint irq);
+extern void spi_free_irq(uint irq, sdioh_info_t *sd);
+
+/* OS-specific interrupt wrappers (atomic interrupt enable/disable) */
+extern void spi_lock(sdioh_info_t *sd);
+extern void spi_unlock(sdioh_info_t *sd);
+
+/* Allocate/init/free per-OS private data */
+extern int spi_osinit(sdioh_info_t *sd);
+extern void spi_osfree(sdioh_info_t *sd);
+
+#endif /* _BCM_SD_SPI_H */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/bcmsdstd.h b/drivers/net/wireless/bcmdhd_1363/include/bcmsdstd.h
new file mode 100644 (file)
index 0000000..ff3b0d1
--- /dev/null
@@ -0,0 +1,285 @@
+/*
+ *  'Standard' SDIO HOST CONTROLLER driver
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmsdstd.h 514727 2014-11-12 03:02:48Z $
+ */
+#ifndef        _BCM_SD_STD_H
+#define        _BCM_SD_STD_H
+
+/* global msglevel for debug messages - bitvals come from sdiovar.h */
+#define sd_err(x)      do { if (sd_msglevel & SDH_ERROR_VAL) printf x; } while (0)
+#define sd_trace(x)
+#define sd_info(x)
+#define sd_debug(x)
+#define sd_data(x)
+#define sd_ctrl(x)
+#define sd_dma(x)
+
+#define sd_sync_dma(sd, read, nbytes)
+#define sd_init_dma(sd)
+#define sd_ack_intr(sd)
+#define sd_wakeup(sd);
+/* Allocate/init/free per-OS private data */
+extern int sdstd_osinit(sdioh_info_t *sd);
+extern void sdstd_osfree(sdioh_info_t *sd);
+
+#define sd_log(x)
+
+#define SDIOH_ASSERT(exp) \
+       do { if (!(exp)) \
+               printf("!!!ASSERT fail: file %s lines %d", __FILE__, __LINE__); \
+       } while (0)
+
+#define BLOCK_SIZE_4318 64
+#define BLOCK_SIZE_4328 512
+
+/* internal return code */
+#define SUCCESS        0
+#define ERROR  1
+
+/* private bus modes */
+#define SDIOH_MODE_SPI         0
+#define SDIOH_MODE_SD1         1
+#define SDIOH_MODE_SD4         2
+
+#define MAX_SLOTS 6    /* For PCI: Only 6 BAR entries => 6 slots */
+#define SDIOH_REG_WINSZ        0x100 /* Number of registers in Standard Host Controller */
+
+#define SDIOH_TYPE_ARASAN_HDK  1
+#define SDIOH_TYPE_BCM27XX     2
+#define SDIOH_TYPE_TI_PCIXX21  4       /* TI PCIxx21 Standard Host Controller */
+#define SDIOH_TYPE_RICOH_R5C822        5       /* Ricoh Co Ltd R5C822 SD/SDIO/MMC/MS/MSPro Host Adapter */
+#define SDIOH_TYPE_JMICRON     6       /* JMicron Standard SDIO Host Controller */
+
+/* For linux, allow yielding for dongle */
+#define BCMSDYIELD
+
+/* Expected card status value for CMD7 */
+#define SDIOH_CMD7_EXP_STATUS   0x00001E00
+
+#define RETRIES_LARGE 100000
+#define sdstd_os_yield(sd)     do {} while (0)
+#define RETRIES_SMALL 100
+
+
+#define USE_BLOCKMODE          0x2     /* Block mode can be single block or multi */
+#define USE_MULTIBLOCK         0x4
+
+#define USE_FIFO               0x8     /* Fifo vs non-fifo */
+
+#define CLIENT_INTR            0x100   /* Get rid of this! */
+
+#define HC_INTR_RETUNING       0x1000
+
+
+#ifdef BCMSDIOH_TXGLOM
+/* Total glom pkt can not exceed 64K
+ * need one more slot for glom padding packet
+ */
+#define SDIOH_MAXGLOM_SIZE     (40+1)
+
+typedef struct glom_buf {
+       uint32 count;                           /* Total number of pkts queued */
+       void *dma_buf_arr[SDIOH_MAXGLOM_SIZE];  /* Frame address */
+       ulong dma_phys_arr[SDIOH_MAXGLOM_SIZE]; /* DMA_MAPed address of frames */
+       uint16 nbytes[SDIOH_MAXGLOM_SIZE];      /* Size of each frame */
+} glom_buf_t;
+#endif
+
+struct sdioh_info {
+       uint cfg_bar;                           /* pci cfg address for bar */
+       uint32 caps;                            /* cached value of capabilities reg */
+       uint32 curr_caps;                       /* max current capabilities reg */
+
+       osl_t           *osh;                   /* osh handler */
+       volatile char   *mem_space;             /* pci device memory va */
+       uint            lockcount;              /* nest count of sdstd_lock() calls */
+       bool            client_intr_enabled;    /* interrupt connnected flag */
+       bool            intr_handler_valid;     /* client driver interrupt handler valid */
+       sdioh_cb_fn_t   intr_handler;           /* registered interrupt handler */
+       void            *intr_handler_arg;      /* argument to call interrupt handler */
+       bool            initialized;            /* card initialized */
+       uint            target_dev;             /* Target device ID */
+       uint16          intmask;                /* Current active interrupts */
+       void            *sdos_info;             /* Pointer to per-OS private data */
+       void            *bcmsdh;                /* handler to upper layer stack (bcmsdh) */
+
+       uint32          controller_type;        /* Host controller type */
+       uint8           version;                /* Host Controller Spec Compliance Version */
+       uint            irq;                    /* Client irq */
+       int             intrcount;              /* Client interrupts */
+       int             local_intrcount;        /* Controller interrupts */
+       bool            host_init_done;         /* Controller initted */
+       bool            card_init_done;         /* Client SDIO interface initted */
+       bool            polled_mode;            /* polling for command completion */
+
+       bool            sd_blockmode;           /* sd_blockmode == FALSE => 64 Byte Cmd 53s. */
+                                               /*  Must be on for sd_multiblock to be effective */
+       bool            use_client_ints;        /* If this is false, make sure to restore */
+                                               /*  polling hack in wl_linux.c:wl_timer() */
+       int             adapter_slot;           /* Maybe dealing with multiple slots/controllers */
+       int             sd_mode;                /* SD1/SD4/SPI */
+       int             client_block_size[SDIOD_MAX_IOFUNCS];           /* Blocksize */
+       uint32          data_xfer_count;        /* Current transfer */
+       uint16          card_rca;               /* Current Address */
+       int8            sd_dma_mode;            /* DMA Mode (PIO, SDMA, ... ADMA2) on CMD53 */
+       uint8           num_funcs;              /* Supported funcs on client */
+       uint32          com_cis_ptr;
+       uint32          func_cis_ptr[SDIOD_MAX_IOFUNCS];
+       void            *dma_buf;               /* DMA Buffer virtual address */
+       ulong           dma_phys;               /* DMA Buffer physical address */
+       void            *adma2_dscr_buf;        /* ADMA2 Descriptor Buffer virtual address */
+       ulong           adma2_dscr_phys;        /* ADMA2 Descriptor Buffer physical address */
+
+       /* adjustments needed to make the dma align properly */
+       void            *dma_start_buf;
+       ulong           dma_start_phys;
+       uint            alloced_dma_size;
+       void            *adma2_dscr_start_buf;
+       ulong           adma2_dscr_start_phys;
+       uint            alloced_adma2_dscr_size;
+
+       int             r_cnt;                  /* rx count */
+       int             t_cnt;                  /* tx_count */
+       bool            got_hcint;              /* local interrupt flag */
+       uint16          last_intrstatus;        /* to cache intrstatus */
+       int     host_UHSISupported;             /* whether UHSI is supported for HC. */
+       int     card_UHSI_voltage_Supported;    /* whether UHSI is supported for
+                                                * Card in terms of Voltage [1.8 or 3.3].
+                                                */
+       int     global_UHSI_Supp;       /* type of UHSI support in both host and card.
+                                        * HOST_SDR_UNSUPP: capabilities not supported/matched
+                                        * HOST_SDR_12_25: SDR12 and SDR25 supported
+                                        * HOST_SDR_50_104_DDR: one of SDR50/SDR104 or DDR50 supptd
+                                        */
+       volatile int    sd3_dat_state;          /* data transfer state used for retuning check */
+       volatile int    sd3_tun_state;          /* tuning state used for retuning check */
+       bool    sd3_tuning_reqd;        /* tuning requirement parameter */
+       uint32  caps3;                  /* cached value of 32 MSbits capabilities reg (SDIO 3.0) */
+#ifdef BCMSDIOH_TXGLOM
+       glom_buf_t glom_info;           /* pkt information used for glomming */
+       uint    txglom_mode;            /* Txglom mode: 0 - copy, 1 - multi-descriptor */
+#endif
+};
+
+#define DMA_MODE_NONE  0
+#define DMA_MODE_SDMA  1
+#define DMA_MODE_ADMA1 2
+#define DMA_MODE_ADMA2 3
+#define DMA_MODE_ADMA2_64 4
+#define DMA_MODE_AUTO  -1
+
+#define USE_DMA(sd)            ((bool)((sd->sd_dma_mode > 0) ? TRUE : FALSE))
+
+/* States for Tuning and corr data */
+#define TUNING_IDLE                    0
+#define TUNING_START                   1
+#define TUNING_START_AFTER_DAT         2
+#define TUNING_ONGOING                         3
+
+#define DATA_TRANSFER_IDLE             0
+#define DATA_TRANSFER_ONGOING  1
+
+#define CHECK_TUNING_PRE_DATA  1
+#define CHECK_TUNING_POST_DATA 2
+
+
+#ifdef DHD_DEBUG
+#define SD_DHD_DISABLE_PERIODIC_TUNING 0x01
+#define SD_DHD_ENABLE_PERIODIC_TUNING  0x00
+#endif
+
+
+/************************************************************
+ * Internal interfaces: per-port references into bcmsdstd.c
+ */
+
+/* Global message bits */
+extern uint sd_msglevel;
+
+/* OS-independent interrupt handler */
+extern bool check_client_intr(sdioh_info_t *sd);
+
+/* Core interrupt enable/disable of device interrupts */
+extern void sdstd_devintr_on(sdioh_info_t *sd);
+extern void sdstd_devintr_off(sdioh_info_t *sd);
+
+/* Enable/disable interrupts for local controller events */
+extern void sdstd_intrs_on(sdioh_info_t *sd, uint16 norm, uint16 err);
+extern void sdstd_intrs_off(sdioh_info_t *sd, uint16 norm, uint16 err);
+
+/* Wait for specified interrupt and error bits to be set */
+extern void sdstd_spinbits(sdioh_info_t *sd, uint16 norm, uint16 err);
+
+
+/**************************************************************
+ * Internal interfaces: bcmsdstd.c references to per-port code
+ */
+
+/* Register mapping routines */
+extern uint32 *sdstd_reg_map(osl_t *osh, ulong addr, int size);
+extern void sdstd_reg_unmap(osl_t *osh, ulong addr, int size);
+
+/* Interrupt (de)registration routines */
+extern int sdstd_register_irq(sdioh_info_t *sd, uint irq);
+extern void sdstd_free_irq(uint irq, sdioh_info_t *sd);
+
+/* OS-specific interrupt wrappers (atomic interrupt enable/disable) */
+extern void sdstd_lock(sdioh_info_t *sd);
+extern void sdstd_unlock(sdioh_info_t *sd);
+extern void sdstd_waitlockfree(sdioh_info_t *sd);
+
+/* OS-specific wrappers for safe concurrent register access */
+extern void sdstd_os_lock_irqsave(sdioh_info_t *sd, ulong* flags);
+extern void sdstd_os_unlock_irqrestore(sdioh_info_t *sd, ulong* flags);
+
+/* OS-specific wait-for-interrupt-or-status */
+extern int sdstd_waitbits(sdioh_info_t *sd, uint16 norm, uint16 err, bool yield, uint16 *bits);
+
+/* used by bcmsdstd_linux [implemented in sdstd] */
+extern void sdstd_3_enable_retuning_int(sdioh_info_t *sd);
+extern void sdstd_3_disable_retuning_int(sdioh_info_t *sd);
+extern bool sdstd_3_is_retuning_int_set(sdioh_info_t *sd);
+extern void sdstd_3_check_and_do_tuning(sdioh_info_t *sd, int tuning_param);
+extern bool sdstd_3_check_and_set_retuning(sdioh_info_t *sd);
+extern int sdstd_3_get_tune_state(sdioh_info_t *sd);
+extern int sdstd_3_get_data_state(sdioh_info_t *sd);
+extern void sdstd_3_set_tune_state(sdioh_info_t *sd, int state);
+extern void sdstd_3_set_data_state(sdioh_info_t *sd, int state);
+extern uint8 sdstd_3_get_tuning_exp(sdioh_info_t *sd);
+extern uint32 sdstd_3_get_uhsi_clkmode(sdioh_info_t *sd);
+extern int sdstd_3_clk_tuning(sdioh_info_t *sd, uint32 sd3ClkMode);
+
+/* used by sdstd [implemented in bcmsdstd_linux/ndis] */
+extern void sdstd_3_start_tuning(sdioh_info_t *sd);
+extern void sdstd_3_osinit_tuning(sdioh_info_t *sd);
+extern void sdstd_3_osclean_tuning(sdioh_info_t *sd);
+
+extern void sdstd_enable_disable_periodic_timer(sdioh_info_t * sd, uint val);
+
+extern sdioh_info_t *sdioh_attach(osl_t *osh, void *bar0, uint irq);
+extern SDIOH_API_RC sdioh_detach(osl_t *osh, sdioh_info_t *sd);
+#endif /* _BCM_SD_STD_H */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/bcmspi.h b/drivers/net/wireless/bcmdhd_1363/include/bcmspi.h
new file mode 100644 (file)
index 0000000..9b4bd2d
--- /dev/null
@@ -0,0 +1,43 @@
+/*
+ * Broadcom SPI Low-Level Hardware Driver API
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmspi.h 514727 2014-11-12 03:02:48Z $
+ */
+#ifndef        _BCM_SPI_H
+#define        _BCM_SPI_H
+
+extern void spi_devintr_off(sdioh_info_t *sd);
+extern void spi_devintr_on(sdioh_info_t *sd);
+extern bool spi_start_clock(sdioh_info_t *sd, uint16 new_sd_divisor);
+extern bool spi_controller_highspeed_mode(sdioh_info_t *sd, bool hsmode);
+extern bool spi_check_client_intr(sdioh_info_t *sd, int *is_dev_intr);
+extern bool spi_hw_attach(sdioh_info_t *sd);
+extern bool spi_hw_detach(sdioh_info_t *sd);
+extern void spi_sendrecv(sdioh_info_t *sd, uint8 *msg_out, uint8 *msg_in, int msglen);
+extern void spi_spinbits(sdioh_info_t *sd);
+extern void spi_waitbits(sdioh_info_t *sd, bool yield);
+
+#endif /* _BCM_SPI_H */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/bcmspibrcm.h b/drivers/net/wireless/bcmdhd_1363/include/bcmspibrcm.h
new file mode 100644 (file)
index 0000000..e9735ff
--- /dev/null
@@ -0,0 +1,165 @@
+/*
+ * SD-SPI Protocol Conversion - BCMSDH->gSPI Translation Layer
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmspibrcm.h 514727 2014-11-12 03:02:48Z $
+ */
+#ifndef        _BCM_SPI_BRCM_H
+#define        _BCM_SPI_BRCM_H
+
+#ifndef SPI_MAX_IOFUNCS
+/* Maximum number of I/O funcs */
+#define SPI_MAX_IOFUNCS                4
+#endif
+/* global msglevel for debug messages - bitvals come from sdiovar.h */
+
+#if defined(DHD_DEBUG)
+#define sd_err(x)      do { if (sd_msglevel & SDH_ERROR_VAL) printf x; } while (0)
+#define sd_trace(x)    do { if (sd_msglevel & SDH_TRACE_VAL) printf x; } while (0)
+#define sd_info(x)     do { if (sd_msglevel & SDH_INFO_VAL)  printf x; } while (0)
+#define sd_debug(x)    do { if (sd_msglevel & SDH_DEBUG_VAL) printf x; } while (0)
+#define sd_data(x)     do { if (sd_msglevel & SDH_DATA_VAL)  printf x; } while (0)
+#define sd_ctrl(x)     do { if (sd_msglevel & SDH_CTRL_VAL)  printf x; } while (0)
+#else
+#define sd_err(x)
+#define sd_trace(x)
+#define sd_info(x)
+#define sd_debug(x)
+#define sd_data(x)
+#define sd_ctrl(x)
+#endif
+
+#define sd_log(x)
+
+#define SDIOH_ASSERT(exp) \
+       do { if (!(exp)) \
+               printf("!!!ASSERT fail: file %s lines %d", __FILE__, __LINE__); \
+       } while (0)
+
+#define BLOCK_SIZE_F1          64
+#define BLOCK_SIZE_F2          2048
+#define BLOCK_SIZE_F3          2048
+
+/* internal return code */
+#define SUCCESS        0
+#undef ERROR
+#define ERROR  1
+#define ERROR_UF       2
+#define ERROR_OF       3
+
+/* private bus modes */
+#define SDIOH_MODE_SPI         0
+
+#define USE_BLOCKMODE          0x2     /* Block mode can be single block or multi */
+#define USE_MULTIBLOCK         0x4
+
+struct sdioh_info {
+       uint            cfg_bar;                /* pci cfg address for bar */
+       uint32          caps;                   /* cached value of capabilities reg */
+       void            *bar0;                  /* BAR0 for PCI Device */
+       osl_t           *osh;                   /* osh handler */
+       void            *controller;    /* Pointer to SPI Controller's private data struct */
+       uint            lockcount;              /* nest count of spi_lock() calls */
+       bool            client_intr_enabled;    /* interrupt connnected flag */
+       bool            intr_handler_valid;     /* client driver interrupt handler valid */
+       sdioh_cb_fn_t   intr_handler;           /* registered interrupt handler */
+       void            *intr_handler_arg;      /* argument to call interrupt handler */
+       bool            initialized;            /* card initialized */
+       uint32          target_dev;             /* Target device ID */
+       uint32          intmask;                /* Current active interrupts */
+       void            *sdos_info;             /* Pointer to per-OS private data */
+       uint32          controller_type;        /* Host controller type */
+       uint8           version;                /* Host Controller Spec Compliance Version */
+       uint            irq;                    /* Client irq */
+       uint32          intrcount;              /* Client interrupts */
+       uint32          local_intrcount;        /* Controller interrupts */
+       bool            host_init_done;         /* Controller initted */
+       bool            card_init_done;         /* Client SDIO interface initted */
+       bool            polled_mode;            /* polling for command completion */
+
+       bool            sd_use_dma;             /* DMA on CMD53 */
+       bool            sd_blockmode;           /* sd_blockmode == FALSE => 64 Byte Cmd 53s. */
+                                               /*  Must be on for sd_multiblock to be effective */
+       bool            use_client_ints;        /* If this is false, make sure to restore */
+                                               /*  polling hack in wl_linux.c:wl_timer() */
+       int             adapter_slot;           /* Maybe dealing with multiple slots/controllers */
+       int             sd_mode;                /* SD1/SD4/SPI */
+       int             client_block_size[SPI_MAX_IOFUNCS];             /* Blocksize */
+       uint32          data_xfer_count;        /* Current transfer */
+       uint16          card_rca;               /* Current Address */
+       uint8           num_funcs;              /* Supported funcs on client */
+       uint32          card_dstatus;           /* 32bit device status */
+       uint32          com_cis_ptr;
+       uint32          func_cis_ptr[SPI_MAX_IOFUNCS];
+       void            *dma_buf;
+       ulong           dma_phys;
+       int             r_cnt;                  /* rx count */
+       int             t_cnt;                  /* tx_count */
+       uint32          wordlen;                        /* host processor 16/32bits */
+       uint32          prev_fun;
+       uint32          chip;
+       uint32          chiprev;
+       bool            resp_delay_all;
+       bool            dwordmode;
+       bool            resp_delay_new;
+
+       struct spierrstats_t spierrstats;
+};
+
+/************************************************************
+ * Internal interfaces: per-port references into bcmspibrcm.c
+ */
+
+/* Global message bits */
+extern uint sd_msglevel;
+
+/**************************************************************
+ * Internal interfaces: bcmspibrcm.c references to per-port code
+ */
+
+/* Interrupt (de)registration routines */
+extern int spi_register_irq(sdioh_info_t *sd, uint irq);
+extern void spi_free_irq(uint irq, sdioh_info_t *sd);
+
+/* OS-specific interrupt wrappers (atomic interrupt enable/disable) */
+extern void spi_lock(sdioh_info_t *sd);
+extern void spi_unlock(sdioh_info_t *sd);
+
+/* Allocate/init/free per-OS private data */
+extern int spi_osinit(sdioh_info_t *sd);
+extern void spi_osfree(sdioh_info_t *sd);
+
+#define SPI_RW_FLAG_M                  BITFIELD_MASK(1)        /* Bit [31] - R/W Command Bit */
+#define SPI_RW_FLAG_S                  31
+#define SPI_ACCESS_M                   BITFIELD_MASK(1)        /* Bit [30] - Fixed/Incr Access */
+#define SPI_ACCESS_S                   30
+#define SPI_FUNCTION_M                 BITFIELD_MASK(2)        /* Bit [29:28] - Function Number */
+#define SPI_FUNCTION_S                 28
+#define SPI_REG_ADDR_M                 BITFIELD_MASK(17)       /* Bit [27:11] - Address */
+#define SPI_REG_ADDR_S                 11
+#define SPI_LEN_M                      BITFIELD_MASK(11)       /* Bit [10:0] - Packet length */
+#define SPI_LEN_S                      0
+
+#endif /* _BCM_SPI_BRCM_H */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/bcmsrom_fmt.h b/drivers/net/wireless/bcmdhd_1363/include/bcmsrom_fmt.h
new file mode 100644 (file)
index 0000000..2eabfaf
--- /dev/null
@@ -0,0 +1,965 @@
+/*
+ * SROM format definition.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmsrom_fmt.h 553280 2015-04-29 07:55:29Z $
+ */
+
+#ifndef        _bcmsrom_fmt_h_
+#define        _bcmsrom_fmt_h_
+
+#define SROM_MAXREV            13      /* max revision supported by driver */
+
+/* Maximum srom: 12 Kilobits == 1536 bytes */
+
+#define        SROM_MAX                1536
+#define SROM_MAXW              594
+
+#ifdef LARGE_NVRAM_MAXSZ
+#define VARS_MAX                LARGE_NVRAM_MAXSZ
+#else
+#define VARS_MAX                4096
+#endif /* LARGE_NVRAM_MAXSZ */
+
+/* PCI fields */
+#define PCI_F0DEVID            48
+
+
+#define        SROM_WORDS              64
+
+#define SROM3_SWRGN_OFF                28      /* s/w region offset in words */
+
+#define        SROM_SSID               2
+#define        SROM_SVID               3
+
+#define        SROM_WL1LHMAXP          29
+
+#define        SROM_WL1LPAB0           30
+#define        SROM_WL1LPAB1           31
+#define        SROM_WL1LPAB2           32
+
+#define        SROM_WL1HPAB0           33
+#define        SROM_WL1HPAB1           34
+#define        SROM_WL1HPAB2           35
+
+#define        SROM_MACHI_IL0          36
+#define        SROM_MACMID_IL0         37
+#define        SROM_MACLO_IL0          38
+#define        SROM_MACHI_ET0          39
+#define        SROM_MACMID_ET0         40
+#define        SROM_MACLO_ET0          41
+#define        SROM_MACHI_ET1          42
+#define        SROM_MACMID_ET1         43
+#define        SROM_MACLO_ET1          44
+#define        SROM3_MACHI             37
+#define        SROM3_MACMID            38
+#define        SROM3_MACLO             39
+
+#define        SROM_BXARSSI2G          40
+#define        SROM_BXARSSI5G          41
+
+#define        SROM_TRI52G             42
+#define        SROM_TRI5GHL            43
+
+#define        SROM_RXPO52G            45
+
+#define        SROM2_ENETPHY           45
+
+#define        SROM_AABREV             46
+/* Fields in AABREV */
+#define        SROM_BR_MASK            0x00ff
+#define        SROM_CC_MASK            0x0f00
+#define        SROM_CC_SHIFT           8
+#define        SROM_AA0_MASK           0x3000
+#define        SROM_AA0_SHIFT          12
+#define        SROM_AA1_MASK           0xc000
+#define        SROM_AA1_SHIFT          14
+
+#define        SROM_WL0PAB0            47
+#define        SROM_WL0PAB1            48
+#define        SROM_WL0PAB2            49
+
+#define        SROM_LEDBH10            50
+#define        SROM_LEDBH32            51
+
+#define        SROM_WL10MAXP           52
+
+#define        SROM_WL1PAB0            53
+#define        SROM_WL1PAB1            54
+#define        SROM_WL1PAB2            55
+
+#define        SROM_ITT                56
+
+#define        SROM_BFL                57
+#define        SROM_BFL2               28
+#define        SROM3_BFL2              61
+
+#define        SROM_AG10               58
+
+#define        SROM_CCODE              59
+
+#define        SROM_OPO                60
+
+#define        SROM3_LEDDC             62
+
+#define        SROM_CRCREV             63
+
+/* SROM Rev 4: Reallocate the software part of the srom to accomodate
+ * MIMO features. It assumes up to two PCIE functions and 440 bytes
+ * of useable srom i.e. the useable storage in chips with OTP that
+ * implements hardware redundancy.
+ */
+
+#define        SROM4_WORDS             220
+
+#define        SROM4_SIGN              32
+#define        SROM4_SIGNATURE         0x5372
+
+#define        SROM4_BREV              33
+
+#define        SROM4_BFL0              34
+#define        SROM4_BFL1              35
+#define        SROM4_BFL2              36
+#define        SROM4_BFL3              37
+#define        SROM5_BFL0              37
+#define        SROM5_BFL1              38
+#define        SROM5_BFL2              39
+#define        SROM5_BFL3              40
+
+#define        SROM4_MACHI             38
+#define        SROM4_MACMID            39
+#define        SROM4_MACLO             40
+#define        SROM5_MACHI             41
+#define        SROM5_MACMID            42
+#define        SROM5_MACLO             43
+
+#define        SROM4_CCODE             41
+#define        SROM4_REGREV            42
+#define        SROM5_CCODE             34
+#define        SROM5_REGREV            35
+
+#define        SROM4_LEDBH10           43
+#define        SROM4_LEDBH32           44
+#define        SROM5_LEDBH10           59
+#define        SROM5_LEDBH32           60
+
+#define        SROM4_LEDDC             45
+#define        SROM5_LEDDC             45
+
+#define        SROM4_AA                46
+#define        SROM4_AA2G_MASK         0x00ff
+#define        SROM4_AA2G_SHIFT        0
+#define        SROM4_AA5G_MASK         0xff00
+#define        SROM4_AA5G_SHIFT        8
+
+#define        SROM4_AG10              47
+#define        SROM4_AG32              48
+
+#define        SROM4_TXPID2G           49
+#define        SROM4_TXPID5G           51
+#define        SROM4_TXPID5GL          53
+#define        SROM4_TXPID5GH          55
+
+#define SROM4_TXRXC            61
+#define SROM4_TXCHAIN_MASK     0x000f
+#define SROM4_TXCHAIN_SHIFT    0
+#define SROM4_RXCHAIN_MASK     0x00f0
+#define SROM4_RXCHAIN_SHIFT    4
+#define SROM4_SWITCH_MASK      0xff00
+#define SROM4_SWITCH_SHIFT     8
+
+
+/* Per-path fields */
+#define        MAX_PATH_SROM           4
+#define        SROM4_PATH0             64
+#define        SROM4_PATH1             87
+#define        SROM4_PATH2             110
+#define        SROM4_PATH3             133
+
+#define        SROM4_2G_ITT_MAXP       0
+#define        SROM4_2G_PA             1
+#define        SROM4_5G_ITT_MAXP       5
+#define        SROM4_5GLH_MAXP         6
+#define        SROM4_5G_PA             7
+#define        SROM4_5GL_PA            11
+#define        SROM4_5GH_PA            15
+
+/* Fields in the ITT_MAXP and 5GLH_MAXP words */
+#define        B2G_MAXP_MASK           0xff
+#define        B2G_ITT_SHIFT           8
+#define        B5G_MAXP_MASK           0xff
+#define        B5G_ITT_SHIFT           8
+#define        B5GH_MAXP_MASK          0xff
+#define        B5GL_MAXP_SHIFT         8
+
+/* All the miriad power offsets */
+#define        SROM4_2G_CCKPO          156
+#define        SROM4_2G_OFDMPO         157
+#define        SROM4_5G_OFDMPO         159
+#define        SROM4_5GL_OFDMPO        161
+#define        SROM4_5GH_OFDMPO        163
+#define        SROM4_2G_MCSPO          165
+#define        SROM4_5G_MCSPO          173
+#define        SROM4_5GL_MCSPO         181
+#define        SROM4_5GH_MCSPO         189
+#define        SROM4_CDDPO             197
+#define        SROM4_STBCPO            198
+#define        SROM4_BW40PO            199
+#define        SROM4_BWDUPPO           200
+
+#define        SROM4_CRCREV            219
+
+
+/* SROM Rev 8: Make space for a 48word hardware header for PCIe rev >= 6.
+ * This is acombined srom for both MIMO and SISO boards, usable in
+ * the .130 4Kilobit OTP with hardware redundancy.
+ */
+
+#define        SROM8_SIGN              64
+
+#define        SROM8_BREV              65
+
+#define        SROM8_BFL0              66
+#define        SROM8_BFL1              67
+#define        SROM8_BFL2              68
+#define        SROM8_BFL3              69
+
+#define        SROM8_MACHI             70
+#define        SROM8_MACMID            71
+#define        SROM8_MACLO             72
+
+#define        SROM8_CCODE             73
+#define        SROM8_REGREV            74
+
+#define        SROM8_LEDBH10           75
+#define        SROM8_LEDBH32           76
+
+#define        SROM8_LEDDC             77
+
+#define        SROM8_AA                78
+
+#define        SROM8_AG10              79
+#define        SROM8_AG32              80
+
+#define        SROM8_TXRXC             81
+
+#define        SROM8_BXARSSI2G         82
+#define        SROM8_BXARSSI5G         83
+#define        SROM8_TRI52G            84
+#define        SROM8_TRI5GHL           85
+#define        SROM8_RXPO52G           86
+
+#define SROM8_FEM2G            87
+#define SROM8_FEM5G            88
+#define SROM8_FEM_ANTSWLUT_MASK                0xf800
+#define SROM8_FEM_ANTSWLUT_SHIFT       11
+#define SROM8_FEM_TR_ISO_MASK          0x0700
+#define SROM8_FEM_TR_ISO_SHIFT         8
+#define SROM8_FEM_PDET_RANGE_MASK      0x00f8
+#define SROM8_FEM_PDET_RANGE_SHIFT     3
+#define SROM8_FEM_EXTPA_GAIN_MASK      0x0006
+#define SROM8_FEM_EXTPA_GAIN_SHIFT     1
+#define SROM8_FEM_TSSIPOS_MASK         0x0001
+#define SROM8_FEM_TSSIPOS_SHIFT                0
+
+#define SROM8_THERMAL          89
+
+/* Temp sense related entries */
+#define SROM8_MPWR_RAWTS               90
+#define SROM8_TS_SLP_OPT_CORRX 91
+/* FOC: freiquency offset correction, HWIQ: H/W IOCAL enable, IQSWP: IQ CAL swap disable */
+#define SROM8_FOC_HWIQ_IQSWP   92
+
+#define SROM8_EXTLNAGAIN        93
+
+/* Temperature delta for PHY calibration */
+#define SROM8_PHYCAL_TEMPDELTA 94
+
+/* Measured power 1 & 2, 0-13 bits at offset 95, MSB 2 bits are unused for now. */
+#define SROM8_MPWR_1_AND_2     95
+
+
+/* Per-path offsets & fields */
+#define        SROM8_PATH0             96
+#define        SROM8_PATH1             112
+#define        SROM8_PATH2             128
+#define        SROM8_PATH3             144
+
+#define        SROM8_2G_ITT_MAXP       0
+#define        SROM8_2G_PA             1
+#define        SROM8_5G_ITT_MAXP       4
+#define        SROM8_5GLH_MAXP         5
+#define        SROM8_5G_PA             6
+#define        SROM8_5GL_PA            9
+#define        SROM8_5GH_PA            12
+
+/* All the miriad power offsets */
+#define        SROM8_2G_CCKPO          160
+
+#define        SROM8_2G_OFDMPO         161
+#define        SROM8_5G_OFDMPO         163
+#define        SROM8_5GL_OFDMPO        165
+#define        SROM8_5GH_OFDMPO        167
+
+#define        SROM8_2G_MCSPO          169
+#define        SROM8_5G_MCSPO          177
+#define        SROM8_5GL_MCSPO         185
+#define        SROM8_5GH_MCSPO         193
+
+#define        SROM8_CDDPO             201
+#define        SROM8_STBCPO            202
+#define        SROM8_BW40PO            203
+#define        SROM8_BWDUPPO           204
+
+/* SISO PA parameters are in the path0 spaces */
+#define        SROM8_SISO              96
+
+/* Legacy names for SISO PA paramters */
+#define        SROM8_W0_ITTMAXP        (SROM8_SISO + SROM8_2G_ITT_MAXP)
+#define        SROM8_W0_PAB0           (SROM8_SISO + SROM8_2G_PA)
+#define        SROM8_W0_PAB1           (SROM8_SISO + SROM8_2G_PA + 1)
+#define        SROM8_W0_PAB2           (SROM8_SISO + SROM8_2G_PA + 2)
+#define        SROM8_W1_ITTMAXP        (SROM8_SISO + SROM8_5G_ITT_MAXP)
+#define        SROM8_W1_MAXP_LCHC      (SROM8_SISO + SROM8_5GLH_MAXP)
+#define        SROM8_W1_PAB0           (SROM8_SISO + SROM8_5G_PA)
+#define        SROM8_W1_PAB1           (SROM8_SISO + SROM8_5G_PA + 1)
+#define        SROM8_W1_PAB2           (SROM8_SISO + SROM8_5G_PA + 2)
+#define        SROM8_W1_PAB0_LC        (SROM8_SISO + SROM8_5GL_PA)
+#define        SROM8_W1_PAB1_LC        (SROM8_SISO + SROM8_5GL_PA + 1)
+#define        SROM8_W1_PAB2_LC        (SROM8_SISO + SROM8_5GL_PA + 2)
+#define        SROM8_W1_PAB0_HC        (SROM8_SISO + SROM8_5GH_PA)
+#define        SROM8_W1_PAB1_HC        (SROM8_SISO + SROM8_5GH_PA + 1)
+#define        SROM8_W1_PAB2_HC        (SROM8_SISO + SROM8_5GH_PA + 2)
+
+#define        SROM8_CRCREV            219
+
+/* SROM REV 9 */
+#define SROM9_2GPO_CCKBW20     160
+#define SROM9_2GPO_CCKBW20UL   161
+#define SROM9_2GPO_LOFDMBW20   162
+#define SROM9_2GPO_LOFDMBW20UL 164
+
+#define SROM9_5GLPO_LOFDMBW20  166
+#define SROM9_5GLPO_LOFDMBW20UL        168
+#define SROM9_5GMPO_LOFDMBW20  170
+#define SROM9_5GMPO_LOFDMBW20UL        172
+#define SROM9_5GHPO_LOFDMBW20  174
+#define SROM9_5GHPO_LOFDMBW20UL        176
+
+#define SROM9_2GPO_MCSBW20     178
+#define SROM9_2GPO_MCSBW20UL   180
+#define SROM9_2GPO_MCSBW40     182
+
+#define SROM9_5GLPO_MCSBW20    184
+#define SROM9_5GLPO_MCSBW20UL  186
+#define SROM9_5GLPO_MCSBW40    188
+#define SROM9_5GMPO_MCSBW20    190
+#define SROM9_5GMPO_MCSBW20UL  192
+#define SROM9_5GMPO_MCSBW40    194
+#define SROM9_5GHPO_MCSBW20    196
+#define SROM9_5GHPO_MCSBW20UL  198
+#define SROM9_5GHPO_MCSBW40    200
+
+#define SROM9_PO_MCS32         202
+#define SROM9_PO_LOFDM40DUP    203
+#define SROM9_EU_EDCRSTH       204
+#define SROM10_EU_EDCRSTH      204
+#define SROM8_RXGAINERR_2G     205
+#define SROM8_RXGAINERR_5GL    206
+#define SROM8_RXGAINERR_5GM    207
+#define SROM8_RXGAINERR_5GH    208
+#define SROM8_RXGAINERR_5GU    209
+#define SROM8_SUBBAND_PPR      210
+#define SROM8_PCIEINGRESS_WAR  211
+#define SROM8_EU_EDCRSTH       212
+#define SROM9_SAR              212
+
+#define SROM8_NOISELVL_2G      213
+#define SROM8_NOISELVL_5GL     214
+#define SROM8_NOISELVL_5GM     215
+#define SROM8_NOISELVL_5GH     216
+#define SROM8_NOISELVL_5GU     217
+#define SROM8_NOISECALOFFSET   218
+
+#define SROM9_REV_CRC          219
+
+#define SROM10_CCKPWROFFSET    218
+#define SROM10_SIGN            219
+#define SROM10_SWCTRLMAP_2G    220
+#define SROM10_CRCREV          229
+
+#define        SROM10_WORDS            230
+#define        SROM10_SIGNATURE        SROM4_SIGNATURE
+
+
+/* SROM REV 11 */
+#define SROM11_BREV                    65
+
+#define SROM11_BFL0                    66
+#define SROM11_BFL1                    67
+#define SROM11_BFL2                    68
+#define SROM11_BFL3                    69
+#define SROM11_BFL4                    70
+#define SROM11_BFL5                    71
+
+#define SROM11_MACHI                   72
+#define SROM11_MACMID                  73
+#define SROM11_MACLO                   74
+
+#define SROM11_CCODE                   75
+#define SROM11_REGREV                  76
+
+#define SROM11_LEDBH10                 77
+#define SROM11_LEDBH32                 78
+
+#define SROM11_LEDDC                   79
+
+#define SROM11_AA                      80
+
+#define SROM11_AGBG10                  81
+#define SROM11_AGBG2A0                 82
+#define SROM11_AGA21                   83
+
+#define SROM11_TXRXC                   84
+
+#define SROM11_FEM_CFG1                        85
+#define SROM11_FEM_CFG2                        86
+
+/* Masks and offsets for FEM_CFG */
+#define SROM11_FEMCTRL_MASK            0xf800
+#define SROM11_FEMCTRL_SHIFT           11
+#define SROM11_PAPDCAP_MASK            0x0400
+#define SROM11_PAPDCAP_SHIFT           10
+#define SROM11_TWORANGETSSI_MASK       0x0200
+#define SROM11_TWORANGETSSI_SHIFT      9
+#define SROM11_PDGAIN_MASK             0x01f0
+#define SROM11_PDGAIN_SHIFT            4
+#define SROM11_EPAGAIN_MASK            0x000e
+#define SROM11_EPAGAIN_SHIFT           1
+#define SROM11_TSSIPOSSLOPE_MASK       0x0001
+#define SROM11_TSSIPOSSLOPE_SHIFT      0
+#define SROM11_GAINCTRLSPH_MASK                0xf800
+#define SROM11_GAINCTRLSPH_SHIFT       11
+
+#define SROM11_THERMAL                 87
+#define SROM11_MPWR_RAWTS              88
+#define SROM11_TS_SLP_OPT_CORRX                89
+#define SROM11_XTAL_FREQ               90
+#define SROM11_5GB0_4080_W0_A1          91
+#define SROM11_PHYCAL_TEMPDELTA        92
+#define SROM11_MPWR_1_AND_2            93
+#define SROM11_5GB0_4080_W1_A1          94
+#define SROM11_TSSIFLOOR_2G            95
+#define SROM11_TSSIFLOOR_5GL           96
+#define SROM11_TSSIFLOOR_5GM           97
+#define SROM11_TSSIFLOOR_5GH           98
+#define SROM11_TSSIFLOOR_5GU           99
+
+/* Masks and offsets for Thermal parameters */
+#define SROM11_TEMPS_PERIOD_MASK       0xf0
+#define SROM11_TEMPS_PERIOD_SHIFT      4
+#define SROM11_TEMPS_HYSTERESIS_MASK   0x0f
+#define SROM11_TEMPS_HYSTERESIS_SHIFT  0
+#define SROM11_TEMPCORRX_MASK          0xfc
+#define SROM11_TEMPCORRX_SHIFT         2
+#define SROM11_TEMPSENSE_OPTION_MASK   0x3
+#define SROM11_TEMPSENSE_OPTION_SHIFT  0
+
+#define SROM11_PDOFF_2G_40M_A0_MASK     0x000f
+#define SROM11_PDOFF_2G_40M_A0_SHIFT    0
+#define SROM11_PDOFF_2G_40M_A1_MASK     0x00f0
+#define SROM11_PDOFF_2G_40M_A1_SHIFT    4
+#define SROM11_PDOFF_2G_40M_A2_MASK     0x0f00
+#define SROM11_PDOFF_2G_40M_A2_SHIFT    8
+#define SROM11_PDOFF_2G_40M_VALID_MASK  0x8000
+#define SROM11_PDOFF_2G_40M_VALID_SHIFT 15
+
+#define SROM11_PDOFF_2G_40M            100
+#define SROM11_PDOFF_40M_A0            101
+#define SROM11_PDOFF_40M_A1            102
+#define SROM11_PDOFF_40M_A2            103
+#define SROM11_5GB0_4080_W2_A1          103
+#define SROM11_PDOFF_80M_A0            104
+#define SROM11_PDOFF_80M_A1            105
+#define SROM11_PDOFF_80M_A2            106
+#define SROM11_5GB1_4080_W0_A1          106
+
+#define SROM11_SUBBAND5GVER            107
+
+/* Per-path fields and offset */
+#define        MAX_PATH_SROM_11                3
+#define SROM11_PATH0                   108
+#define SROM11_PATH1                   128
+#define SROM11_PATH2                   148
+
+#define        SROM11_2G_MAXP                  0
+#define SROM11_5GB1_4080_PA             0
+#define        SROM11_2G_PA                    1
+#define SROM11_5GB2_4080_PA             2
+#define        SROM11_RXGAINS1                 4
+#define        SROM11_RXGAINS                  5
+#define SROM11_5GB3_4080_PA             5
+#define        SROM11_5GB1B0_MAXP              6
+#define        SROM11_5GB3B2_MAXP              7
+#define        SROM11_5GB0_PA                  8
+#define        SROM11_5GB1_PA                  11
+#define        SROM11_5GB2_PA                  14
+#define        SROM11_5GB3_PA                  17
+
+/* Masks and offsets for rxgains */
+#define SROM11_RXGAINS5GTRELNABYPA_MASK                0x8000
+#define SROM11_RXGAINS5GTRELNABYPA_SHIFT       15
+#define SROM11_RXGAINS5GTRISOA_MASK            0x7800
+#define SROM11_RXGAINS5GTRISOA_SHIFT           11
+#define SROM11_RXGAINS5GELNAGAINA_MASK         0x0700
+#define SROM11_RXGAINS5GELNAGAINA_SHIFT                8
+#define SROM11_RXGAINS2GTRELNABYPA_MASK                0x0080
+#define SROM11_RXGAINS2GTRELNABYPA_SHIFT       7
+#define SROM11_RXGAINS2GTRISOA_MASK            0x0078
+#define SROM11_RXGAINS2GTRISOA_SHIFT           3
+#define SROM11_RXGAINS2GELNAGAINA_MASK         0x0007
+#define SROM11_RXGAINS2GELNAGAINA_SHIFT                0
+#define SROM11_RXGAINS5GHTRELNABYPA_MASK       0x8000
+#define SROM11_RXGAINS5GHTRELNABYPA_SHIFT      15
+#define SROM11_RXGAINS5GHTRISOA_MASK           0x7800
+#define SROM11_RXGAINS5GHTRISOA_SHIFT          11
+#define SROM11_RXGAINS5GHELNAGAINA_MASK                0x0700
+#define SROM11_RXGAINS5GHELNAGAINA_SHIFT       8
+#define SROM11_RXGAINS5GMTRELNABYPA_MASK       0x0080
+#define SROM11_RXGAINS5GMTRELNABYPA_SHIFT      7
+#define SROM11_RXGAINS5GMTRISOA_MASK           0x0078
+#define SROM11_RXGAINS5GMTRISOA_SHIFT          3
+#define SROM11_RXGAINS5GMELNAGAINA_MASK                0x0007
+#define SROM11_RXGAINS5GMELNAGAINA_SHIFT       0
+
+/* Power per rate */
+#define SROM11_CCKBW202GPO             168
+#define SROM11_CCKBW20UL2GPO           169
+#define SROM11_MCSBW202GPO             170
+#define SROM11_MCSBW202GPO_1           171
+#define SROM11_MCSBW402GPO             172
+#define SROM11_MCSBW402GPO_1           173
+#define SROM11_DOT11AGOFDMHRBW202GPO   174
+#define SROM11_OFDMLRBW202GPO          175
+
+#define SROM11_MCSBW205GLPO            176
+#define SROM11_MCSBW205GLPO_1          177
+#define SROM11_MCSBW405GLPO            178
+#define SROM11_MCSBW405GLPO_1          179
+#define SROM11_MCSBW805GLPO            180
+#define SROM11_MCSBW805GLPO_1          181
+#define SROM11_RPCAL_2G                        182
+#define SROM11_RPCAL_5GL               183
+#define SROM11_MCSBW205GMPO            184
+#define SROM11_MCSBW205GMPO_1          185
+#define SROM11_MCSBW405GMPO            186
+#define SROM11_MCSBW405GMPO_1          187
+#define SROM11_MCSBW805GMPO            188
+#define SROM11_MCSBW805GMPO_1          189
+#define SROM11_RPCAL_5GM               190
+#define SROM11_RPCAL_5GH               191
+#define SROM11_MCSBW205GHPO            192
+#define SROM11_MCSBW205GHPO_1          193
+#define SROM11_MCSBW405GHPO            194
+#define SROM11_MCSBW405GHPO_1          195
+#define SROM11_MCSBW805GHPO            196
+#define SROM11_MCSBW805GHPO_1          197
+#define SROM11_RPCAL_5GU               198
+#define SROM11_PDOFF_2G_CCK            199
+#define SROM11_MCSLR5GLPO              200
+#define SROM11_MCSLR5GMPO              201
+#define SROM11_MCSLR5GHPO              202
+
+#define SROM11_SB20IN40HRPO            203
+#define SROM11_SB20IN80AND160HR5GLPO   204
+#define SROM11_SB40AND80HR5GLPO                205
+#define SROM11_SB20IN80AND160HR5GMPO   206
+#define SROM11_SB40AND80HR5GMPO                207
+#define SROM11_SB20IN80AND160HR5GHPO   208
+#define SROM11_SB40AND80HR5GHPO                209
+#define SROM11_SB20IN40LRPO            210
+#define SROM11_SB20IN80AND160LR5GLPO   211
+#define SROM11_SB40AND80LR5GLPO                212
+#define SROM11_TXIDXCAP2G               212
+#define SROM11_SB20IN80AND160LR5GMPO   213
+#define SROM11_SB40AND80LR5GMPO                214
+#define SROM11_TXIDXCAP5G               214
+#define SROM11_SB20IN80AND160LR5GHPO   215
+#define SROM11_SB40AND80LR5GHPO                216
+
+#define SROM11_DOT11AGDUPHRPO          217
+#define SROM11_DOT11AGDUPLRPO          218
+
+/* MISC */
+#define SROM11_PCIEINGRESS_WAR         220
+#define SROM11_SAR                     221
+
+#define SROM11_NOISELVL_2G             222
+#define SROM11_NOISELVL_5GL            223
+#define SROM11_NOISELVL_5GM            224
+#define SROM11_NOISELVL_5GH            225
+#define SROM11_NOISELVL_5GU            226
+
+#define SROM11_RXGAINERR_2G            227
+#define SROM11_RXGAINERR_5GL           228
+#define SROM11_RXGAINERR_5GM           229
+#define SROM11_RXGAINERR_5GH           230
+#define SROM11_RXGAINERR_5GU           231
+
+#define SROM11_EU_EDCRSTH              232
+#define SROM12_EU_EDCRSTH              232
+
+#define SROM11_SIGN                    64
+#define SROM11_CRCREV                  233
+
+#define        SROM11_WORDS                            234
+#define        SROM11_SIGNATURE                0x0634
+
+
+/* SROM REV 12 */
+#define SROM12_SIGN                     64
+#define SROM12_WORDS                   512
+#define SROM12_SIGNATURE               0x8888
+#define SROM12_CRCREV                  511
+
+#define SROM12_BFL6                            486
+#define SROM12_BFL7                            487
+
+#define SROM12_MCSBW205GX1PO           234
+#define SROM12_MCSBW205GX1PO_1         235
+#define SROM12_MCSBW405GX1PO           236
+#define SROM12_MCSBW405GX1PO_1         237
+#define SROM12_MCSBW805GX1PO           238
+#define SROM12_MCSBW805GX1PO_1         239
+#define SROM12_MCSLR5GX1PO                     240
+#define SROM12_SB40AND80LR5GX1PO               241
+#define SROM12_SB20IN80AND160LR5GX1PO  242
+#define SROM12_SB20IN80AND160HR5GX1PO  243
+#define SROM12_SB40AND80HR5GX1PO               244
+
+#define SROM12_MCSBW205GX2PO           245
+#define SROM12_MCSBW205GX2PO_1         246
+#define SROM12_MCSBW405GX2PO           247
+#define SROM12_MCSBW405GX2PO_1         248
+#define SROM12_MCSBW805GX2PO           249
+#define SROM12_MCSBW805GX2PO_1         250
+#define SROM12_MCSLR5GX2PO                     251
+#define SROM12_SB40AND80LR5GX2PO       252
+#define SROM12_SB20IN80AND160LR5GX2PO  253
+#define SROM12_SB20IN80AND160HR5GX2PO  254
+#define SROM12_SB40AND80HR5GX2PO               255
+
+/* MISC */
+#define        SROM12_RXGAINS10                        483
+#define        SROM12_RXGAINS11                        484
+#define        SROM12_RXGAINS12                        485
+
+/* Per-path fields and offset */
+#define        MAX_PATH_SROM_12                        3
+#define SROM12_PATH0                           256
+#define SROM12_PATH1                           328
+#define SROM12_PATH2                           400
+
+#define        SROM12_5GB42G_MAXP                              0
+#define SROM12_2GB0_PA                                 1
+#define SROM12_2GB0_PA_W0                              1
+#define SROM12_2GB0_PA_W1                              2
+#define SROM12_2GB0_PA_W2                              3
+#define SROM12_2GB0_PA_W3                              4
+
+#define        SROM12_RXGAINS                                  5
+#define        SROM12_5GB1B0_MAXP                              6
+#define        SROM12_5GB3B2_MAXP                              7
+
+#define SROM12_5GB0_PA                                 8
+#define SROM12_5GB0_PA_W0                              8
+#define SROM12_5GB0_PA_W1                              9
+#define SROM12_5GB0_PA_W2                              10
+#define SROM12_5GB0_PA_W3                              11
+
+#define SROM12_5GB1_PA                                 12
+#define SROM12_5GB1_PA_W0                              12
+#define SROM12_5GB1_PA_W1                              13
+#define SROM12_5GB1_PA_W2                              14
+#define SROM12_5GB1_PA_W3                              15
+
+#define SROM12_5GB2_PA                                 16
+#define SROM12_5GB2_PA_W0                              16
+#define SROM12_5GB2_PA_W1                              17
+#define SROM12_5GB2_PA_W2                              18
+#define SROM12_5GB2_PA_W3                              19
+
+#define SROM12_5GB3_PA                                 20
+#define SROM12_5GB3_PA_W0                              20
+#define SROM12_5GB3_PA_W1                              21
+#define SROM12_5GB3_PA_W2                              22
+#define SROM12_5GB3_PA_W3                              23
+
+#define SROM12_5GB4_PA                                 24
+#define SROM12_5GB4_PA_W0                              24
+#define SROM12_5GB4_PA_W1                              25
+#define SROM12_5GB4_PA_W2                              26
+#define SROM12_5GB4_PA_W3                              27
+
+#define SROM12_2G40B0_PA                               28
+#define SROM12_2G40B0_PA_W0                            28
+#define SROM12_2G40B0_PA_W1                            29
+#define SROM12_2G40B0_PA_W2                            30
+#define SROM12_2G40B0_PA_W3                            31
+
+#define SROM12_5G40B0_PA                               32
+#define SROM12_5G40B0_PA_W0                            32
+#define SROM12_5G40B0_PA_W1                            33
+#define SROM12_5G40B0_PA_W2                            34
+#define SROM12_5G40B0_PA_W3                            35
+
+#define SROM12_5G40B1_PA                               36
+#define SROM12_5G40B1_PA_W0                            36
+#define SROM12_5G40B1_PA_W1                            37
+#define SROM12_5G40B1_PA_W2                            38
+#define SROM12_5G40B1_PA_W3                            39
+
+#define SROM12_5G40B2_PA                               40
+#define SROM12_5G40B2_PA_W0                            40
+#define SROM12_5G40B2_PA_W1                            41
+#define SROM12_5G40B2_PA_W2                            42
+#define SROM12_5G40B2_PA_W3                            43
+
+#define SROM12_5G40B3_PA                               44
+#define SROM12_5G40B3_PA_W0                            44
+#define SROM12_5G40B3_PA_W1                            45
+#define SROM12_5G40B3_PA_W2                            46
+#define SROM12_5G40B3_PA_W3                            47
+
+#define SROM12_5G40B4_PA                               48
+#define SROM12_5G40B4_PA_W0                            48
+#define SROM12_5G40B4_PA_W1                            49
+#define SROM12_5G40B4_PA_W2                            50
+#define SROM12_5G40B4_PA_W3                            51
+
+#define SROM12_5G80B0_PA                               52
+#define SROM12_5G80B0_PA_W0                            52
+#define SROM12_5G80B0_PA_W1                            53
+#define SROM12_5G80B0_PA_W2                            54
+#define SROM12_5G80B0_PA_W3                            55
+
+#define SROM12_5G80B1_PA                               56
+#define SROM12_5G80B1_PA_W0                            56
+#define SROM12_5G80B1_PA_W1                            57
+#define SROM12_5G80B1_PA_W2                            58
+#define SROM12_5G80B1_PA_W3                            59
+
+#define SROM12_5G80B2_PA                               60
+#define SROM12_5G80B2_PA_W0                            60
+#define SROM12_5G80B2_PA_W1                            61
+#define SROM12_5G80B2_PA_W2                            62
+#define SROM12_5G80B2_PA_W3                            63
+
+#define SROM12_5G80B3_PA                               64
+#define SROM12_5G80B3_PA_W0                            64
+#define SROM12_5G80B3_PA_W1                            65
+#define SROM12_5G80B3_PA_W2                            66
+#define SROM12_5G80B3_PA_W3                            67
+
+#define SROM12_5G80B4_PA                               68
+#define SROM12_5G80B4_PA_W0                            68
+#define SROM12_5G80B4_PA_W1                            69
+#define SROM12_5G80B4_PA_W2                            70
+#define SROM12_5G80B4_PA_W3                            71
+
+/* PD offset */
+#define SROM12_PDOFF_2G_CCK                            472
+
+#define SROM12_PDOFF_20in40M_5G_B0             473
+#define SROM12_PDOFF_20in40M_5G_B1             474
+#define SROM12_PDOFF_20in40M_5G_B2             475
+#define SROM12_PDOFF_20in40M_5G_B3             476
+#define SROM12_PDOFF_20in40M_5G_B4             477
+
+#define SROM12_PDOFF_40in80M_5G_B0             478
+#define SROM12_PDOFF_40in80M_5G_B1             479
+#define SROM12_PDOFF_40in80M_5G_B2             480
+#define SROM12_PDOFF_40in80M_5G_B3             481
+#define SROM12_PDOFF_40in80M_5G_B4             482
+
+#define SROM12_PDOFF_20in80M_5G_B0             488
+#define SROM12_PDOFF_20in80M_5G_B1             489
+#define SROM12_PDOFF_20in80M_5G_B2             490
+#define SROM12_PDOFF_20in80M_5G_B3             491
+#define SROM12_PDOFF_20in80M_5G_B4             492
+
+#define SROM13_PDOFFSET20IN40M5GCORE3           98
+#define SROM13_PDOFFSET20IN40M5GCORE3_1         99
+#define SROM13_PDOFFSET20IN80M5GCORE3           510
+#define SROM13_PDOFFSET20IN80M5GCORE3_1         511
+#define SROM13_PDOFFSET40IN80M5GCORE3           105
+#define SROM13_PDOFFSET40IN80M5GCORE3_1         106
+
+#define SROM13_PDOFFSET20IN40M2G                94
+#define SROM13_PDOFFSET20IN40M2GCORE3           95
+
+#define SROM12_GPDN_L                          91  /* GPIO pull down bits [15:0]  */
+#define SROM12_GPDN_H                          233 /* GPIO pull down bits [31:16] */
+
+#define SROM13_SIGN                     64
+#define SROM13_WORDS                    590
+#define SROM13_SIGNATURE                0x4d55
+#define SROM13_CRCREV                   589
+
+
+/* Per-path fields and offset */
+#define MAX_PATH_SROM_13                        4
+#define SROM13_PATH0                            256
+#define SROM13_PATH1                            328
+#define SROM13_PATH2                            400
+#define SROM13_PATH3                            512
+#define SROM13_RXGAINS                         5
+
+#define SROM13_XTALFREQ                 90
+
+#define SROM13_PDOFFSET20IN40M2G        94
+#define SROM13_PDOFFSET20IN40M2GCORE3   95
+#define SROM13_SB20IN40HRLRPOX          96
+
+#define SROM13_RXGAINS1CORE3            97
+
+#define SROM13_PDOFFSET20IN40M5GCORE3   98
+#define SROM13_PDOFFSET20IN40M5GCORE3_1 99
+
+#define SROM13_ANTGAIN_BANDBGA          100
+
+#define SROM13_RXGAINS2CORE0            101
+#define SROM13_RXGAINS2CORE1            102
+#define SROM13_RXGAINS2CORE2            103
+#define SROM13_RXGAINS2CORE3            104
+
+#define SROM13_PDOFFSET40IN80M5GCORE3   105
+#define SROM13_PDOFFSET40IN80M5GCORE3_1 106
+
+/* power per rate */
+#define SROM13_MCS1024QAM2GPO           108
+#define SROM13_MCS1024QAM5GLPO          109
+#define SROM13_MCS1024QAM5GLPO_1        110
+#define SROM13_MCS1024QAM5GMPO          111
+#define SROM13_MCS1024QAM5GMPO_1        112
+#define SROM13_MCS1024QAM5GHPO          113
+#define SROM13_MCS1024QAM5GHPO_1        114
+#define SROM13_MCS1024QAM5GX1PO         115
+#define SROM13_MCS1024QAM5GX1PO_1       116
+#define SROM13_MCS1024QAM5GX2PO         117
+#define SROM13_MCS1024QAM5GX2PO_1       118
+
+#define SROM13_MCSBW1605GLPO            119
+#define SROM13_MCSBW1605GLPO_1          120
+#define SROM13_MCSBW1605GMPO            121
+#define SROM13_MCSBW1605GMPO_1          122
+#define SROM13_MCSBW1605GHPO            123
+#define SROM13_MCSBW1605GHPO_1          124
+
+#define SROM13_MCSBW1605GX1PO           125
+#define SROM13_MCSBW1605GX1PO_1         126
+#define SROM13_MCSBW1605GX2PO           127
+#define SROM13_MCSBW1605GX2PO_1         128
+
+#define SROM13_ULBPPROFFS5GB0          129
+#define SROM13_ULBPPROFFS5GB1           130
+#define SROM13_ULBPPROFFS5GB2           131
+#define SROM13_ULBPPROFFS5GB3           132
+#define SROM13_ULBPPROFFS5GB4           133
+#define SROM13_ULBPPROFFS2G            134
+
+#define SROM13_MCS8POEXP                135
+#define SROM13_MCS8POEXP_1              136
+#define SROM13_MCS9POEXP                137
+#define SROM13_MCS9POEXP_1              138
+#define SROM13_MCS10POEXP               139
+#define SROM13_MCS10POEXP_1             140
+#define SROM13_MCS11POEXP               141
+#define SROM13_MCS11POEXP_1             142
+#define SROM13_ULBPDOFFS5GB0A0         143
+#define SROM13_ULBPDOFFS5GB0A1          144
+#define SROM13_ULBPDOFFS5GB0A2          145
+#define SROM13_ULBPDOFFS5GB0A3          146
+#define SROM13_ULBPDOFFS5GB1A0          147
+#define SROM13_ULBPDOFFS5GB1A1          148
+#define SROM13_ULBPDOFFS5GB1A2          149
+#define SROM13_ULBPDOFFS5GB1A3          150
+#define SROM13_ULBPDOFFS5GB2A0          151
+#define SROM13_ULBPDOFFS5GB2A1          152
+#define SROM13_ULBPDOFFS5GB2A2          153
+#define SROM13_ULBPDOFFS5GB2A3          154
+#define SROM13_ULBPDOFFS5GB3A0          155
+#define SROM13_ULBPDOFFS5GB3A1          156
+#define SROM13_ULBPDOFFS5GB3A2          157
+#define SROM13_ULBPDOFFS5GB3A3          158
+#define SROM13_ULBPDOFFS5GB4A0          159
+#define SROM13_ULBPDOFFS5GB4A1          160
+#define SROM13_ULBPDOFFS5GB4A2          161
+#define SROM13_ULBPDOFFS5GB4A3          162
+#define SROM13_ULBPDOFFS2GA0           163
+#define SROM13_ULBPDOFFS2GA1           164
+#define SROM13_ULBPDOFFS2GA2           165
+#define SROM13_ULBPDOFFS2GA3           166
+
+#define SROM13_RPCAL5GB4                199
+
+#define SROM13_EU_EDCRSTH               232
+
+#define SROM13_SWCTRLMAP4_CFG                  493
+#define SROM13_SWCTRLMAP4_TX2G_FEM3TO0         494
+#define SROM13_SWCTRLMAP4_RX2G_FEM3TO0         495
+#define SROM13_SWCTRLMAP4_RXBYP2G_FEM3TO0      496
+#define SROM13_SWCTRLMAP4_MISC2G_FEM3TO0       497
+#define SROM13_SWCTRLMAP4_TX5G_FEM3TO0         498
+#define SROM13_SWCTRLMAP4_RX5G_FEM3TO0         499
+#define SROM13_SWCTRLMAP4_RXBYP5G_FEM3TO0      500
+#define SROM13_SWCTRLMAP4_MISC5G_FEM3TO0       501
+#define SROM13_SWCTRLMAP4_TX2G_FEM7TO4         502
+#define SROM13_SWCTRLMAP4_RX2G_FEM7TO4         503
+#define SROM13_SWCTRLMAP4_RXBYP2G_FEM7TO4      504
+#define SROM13_SWCTRLMAP4_MISC2G_FEM7TO4       505
+#define SROM13_SWCTRLMAP4_TX5G_FEM7TO4         506
+#define SROM13_SWCTRLMAP4_RX5G_FEM7TO4         507
+#define SROM13_SWCTRLMAP4_RXBYP5G_FEM7TO4      508
+#define SROM13_SWCTRLMAP4_MISC5G_FEM7TO4       509
+
+#define SROM13_PDOFFSET20IN80M5GCORE3   510
+#define SROM13_PDOFFSET20IN80M5GCORE3_1 511
+
+#define SROM13_NOISELVLCORE3            584
+#define SROM13_NOISELVLCORE3_1          585
+#define SROM13_RXGAINERRCORE3           586
+#define SROM13_RXGAINERRCORE3_1         587
+
+
+typedef struct {
+       uint8 tssipos;          /* TSSI positive slope, 1: positive, 0: negative */
+       uint8 extpagain;        /* Ext PA gain-type: full-gain: 0, pa-lite: 1, no_pa: 2 */
+       uint8 pdetrange;        /* support 32 combinations of different Pdet dynamic ranges */
+       uint8 triso;            /* TR switch isolation */
+       uint8 antswctrllut;     /* antswctrl lookup table configuration: 32 possible choices */
+} srom_fem_t;
+
+#endif /* _bcmsrom_fmt_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/bcmsrom_tbl.h b/drivers/net/wireless/bcmdhd_1363/include/bcmsrom_tbl.h
new file mode 100644 (file)
index 0000000..acc9b91
--- /dev/null
@@ -0,0 +1,1400 @@
+/*
+ * Table that encodes the srom formats for PCI/PCIe NICs.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmsrom_tbl.h 553564 2015-04-30 06:19:30Z $
+ */
+
+#ifndef        _bcmsrom_tbl_h_
+#define        _bcmsrom_tbl_h_
+
+#include "sbpcmcia.h"
+#include "wlioctl.h"
+#include <bcmsrom_fmt.h>
+
+typedef struct {
+       const char *name;
+       uint32  revmask;
+       uint32  flags;
+       uint16  off;
+       uint16  mask;
+} sromvar_t;
+
+#define SRFL_MORE      1               /* value continues as described by the next entry */
+#define        SRFL_NOFFS      2               /* value bits can't be all one's */
+#define        SRFL_PRHEX      4               /* value is in hexdecimal format */
+#define        SRFL_PRSIGN     8               /* value is in signed decimal format */
+#define        SRFL_CCODE      0x10            /* value is in country code format */
+#define        SRFL_ETHADDR    0x20            /* value is an Ethernet address */
+#define SRFL_LEDDC     0x40            /* value is an LED duty cycle */
+#define SRFL_NOVAR     0x80            /* do not generate a nvram param, entry is for mfgc */
+#define SRFL_ARRAY     0x100           /* value is in an array. All elements EXCEPT FOR THE LAST
+                                        * ONE in the array should have this flag set.
+                                        */
+
+
+#define SROM_DEVID_PCIE        48
+
+/**
+ * Assumptions:
+ * - Ethernet address spans across 3 consecutive words
+ *
+ * Table rules:
+ * - Add multiple entries next to each other if a value spans across multiple words
+ *   (even multiple fields in the same word) with each entry except the last having
+ *   it's SRFL_MORE bit set.
+ * - Ethernet address entry does not follow above rule and must not have SRFL_MORE
+ *   bit set. Its SRFL_ETHADDR bit implies it takes multiple words.
+ * - The last entry's name field must be NULL to indicate the end of the table. Other
+ *   entries must have non-NULL name.
+ */
+static const sromvar_t pci_sromvars[] = {
+/*     name            revmask         flags           off                     mask */
+#if defined(CABLECPE)
+       {"devid",       0xffffff00,     SRFL_PRHEX,     PCI_F0DEVID,            0xffff},
+#elif defined(BCMPCIEDEV) && defined(BCMPCIEDEV_ENABLED)
+       {"devid",       0xffffff00,     SRFL_PRHEX, SROM_DEVID_PCIE,            0xffff},
+#else
+       {"devid",       0xffffff00,     SRFL_PRHEX|SRFL_NOVAR,  PCI_F0DEVID,    0xffff},
+#endif 
+       {"boardrev",    0x0000000e,     SRFL_PRHEX,     SROM_AABREV,            SROM_BR_MASK},
+       {"boardrev",    0x000000f0,     SRFL_PRHEX,     SROM4_BREV,             0xffff},
+       {"boardrev",    0xffffff00,     SRFL_PRHEX,     SROM8_BREV,             0xffff},
+       {"boardflags",  0x00000002,     SRFL_PRHEX,     SROM_BFL,               0xffff},
+       {"boardflags",  0x00000004,     SRFL_PRHEX|SRFL_MORE,   SROM_BFL,       0xffff},
+       {"",            0,              0,              SROM_BFL2,              0xffff},
+       {"boardflags",  0x00000008,     SRFL_PRHEX|SRFL_MORE,   SROM_BFL,       0xffff},
+       {"",            0,              0,              SROM3_BFL2,             0xffff},
+       {"boardflags",  0x00000010,     SRFL_PRHEX|SRFL_MORE,   SROM4_BFL0,     0xffff},
+       {"",            0,              0,              SROM4_BFL1,             0xffff},
+       {"boardflags",  0x000000e0,     SRFL_PRHEX|SRFL_MORE,   SROM5_BFL0,     0xffff},
+       {"",            0,              0,              SROM5_BFL1,             0xffff},
+       {"boardflags",  0xffffff00,     SRFL_PRHEX|SRFL_MORE,   SROM8_BFL0,     0xffff},
+       {"",            0,              0,              SROM8_BFL1,             0xffff},
+       {"boardflags2", 0x00000010,     SRFL_PRHEX|SRFL_MORE,   SROM4_BFL2,     0xffff},
+       {"",            0,              0,              SROM4_BFL3,             0xffff},
+       {"boardflags2", 0x000000e0,     SRFL_PRHEX|SRFL_MORE,   SROM5_BFL2,     0xffff},
+       {"",            0,              0,              SROM5_BFL3,             0xffff},
+       {"boardflags2", 0xffffff00,     SRFL_PRHEX|SRFL_MORE,   SROM8_BFL2,     0xffff},
+       {"",            0,              0,              SROM8_BFL3,             0xffff},
+       {"boardtype",   0xfffffffc,     SRFL_PRHEX,     SROM_SSID,              0xffff},
+       {"subvid",      0xfffffffc,     SRFL_PRHEX,     SROM_SVID,              0xffff},
+       {"boardnum",    0x00000006,     0,              SROM_MACLO_IL0,         0xffff},
+       {"boardnum",    0x00000008,     0,              SROM3_MACLO,            0xffff},
+       {"boardnum",    0x00000010,     0,              SROM4_MACLO,            0xffff},
+       {"boardnum",    0x000000e0,     0,              SROM5_MACLO,            0xffff},
+       {"boardnum",    0x00000700,     0,              SROM8_MACLO,            0xffff},
+       {"cc",          0x00000002,     0,              SROM_AABREV,            SROM_CC_MASK},
+       {"regrev",      0x00000008,     0,              SROM_OPO,               0xff00},
+       {"regrev",      0x00000010,     0,              SROM4_REGREV,           0x00ff},
+       {"regrev",      0x000000e0,     0,              SROM5_REGREV,           0x00ff},
+       {"regrev",      0x00000700,     0,              SROM8_REGREV,           0x00ff},
+       {"ledbh0",      0x0000000e,     SRFL_NOFFS,     SROM_LEDBH10,           0x00ff},
+       {"ledbh1",      0x0000000e,     SRFL_NOFFS,     SROM_LEDBH10,           0xff00},
+       {"ledbh2",      0x0000000e,     SRFL_NOFFS,     SROM_LEDBH32,           0x00ff},
+       {"ledbh3",      0x0000000e,     SRFL_NOFFS,     SROM_LEDBH32,           0xff00},
+       {"ledbh0",      0x00000010,     SRFL_NOFFS,     SROM4_LEDBH10,          0x00ff},
+       {"ledbh1",      0x00000010,     SRFL_NOFFS,     SROM4_LEDBH10,          0xff00},
+       {"ledbh2",      0x00000010,     SRFL_NOFFS,     SROM4_LEDBH32,          0x00ff},
+       {"ledbh3",      0x00000010,     SRFL_NOFFS,     SROM4_LEDBH32,          0xff00},
+       {"ledbh0",      0x000000e0,     SRFL_NOFFS,     SROM5_LEDBH10,          0x00ff},
+       {"ledbh1",      0x000000e0,     SRFL_NOFFS,     SROM5_LEDBH10,          0xff00},
+       {"ledbh2",      0x000000e0,     SRFL_NOFFS,     SROM5_LEDBH32,          0x00ff},
+       {"ledbh3",      0x000000e0,     SRFL_NOFFS,     SROM5_LEDBH32,          0xff00},
+       {"ledbh0",      0x00000700,     SRFL_NOFFS,     SROM8_LEDBH10,          0x00ff},
+       {"ledbh1",      0x00000700,     SRFL_NOFFS,     SROM8_LEDBH10,          0xff00},
+       {"ledbh2",      0x00000700,     SRFL_NOFFS,     SROM8_LEDBH32,          0x00ff},
+       {"ledbh3",      0x00000700,     SRFL_NOFFS,     SROM8_LEDBH32,          0xff00},
+       {"pa0b0",       0x0000000e,     SRFL_PRHEX,     SROM_WL0PAB0,           0xffff},
+       {"pa0b1",       0x0000000e,     SRFL_PRHEX,     SROM_WL0PAB1,           0xffff},
+       {"pa0b2",       0x0000000e,     SRFL_PRHEX,     SROM_WL0PAB2,           0xffff},
+       {"pa0itssit",   0x0000000e,     0,              SROM_ITT,               0x00ff},
+       {"pa0maxpwr",   0x0000000e,     0,              SROM_WL10MAXP,          0x00ff},
+       {"pa0b0",       0x00000700,     SRFL_PRHEX,     SROM8_W0_PAB0,          0xffff},
+       {"pa0b1",       0x00000700,     SRFL_PRHEX,     SROM8_W0_PAB1,          0xffff},
+       {"pa0b2",       0x00000700,     SRFL_PRHEX,     SROM8_W0_PAB2,          0xffff},
+       {"pa0itssit",   0x00000700,     0,              SROM8_W0_ITTMAXP,       0xff00},
+       {"pa0maxpwr",   0x00000700,     0,              SROM8_W0_ITTMAXP,       0x00ff},
+       {"opo",         0x0000000c,     0,              SROM_OPO,               0x00ff},
+       {"opo",         0x00000700,     0,              SROM8_2G_OFDMPO,        0x00ff},
+       {"aa2g",        0x0000000e,     0,              SROM_AABREV,            SROM_AA0_MASK},
+       {"aa2g",        0x000000f0,     0,              SROM4_AA,               0x00ff},
+       {"aa2g",        0x00000700,     0,              SROM8_AA,               0x00ff},
+       {"aa5g",        0x0000000e,     0,              SROM_AABREV,            SROM_AA1_MASK},
+       {"aa5g",        0x000000f0,     0,              SROM4_AA,               0xff00},
+       {"aa5g",        0x00000700,     0,              SROM8_AA,               0xff00},
+       {"ag0",         0x0000000e,     0,              SROM_AG10,              0x00ff},
+       {"ag1",         0x0000000e,     0,              SROM_AG10,              0xff00},
+       {"ag0",         0x000000f0,     0,              SROM4_AG10,             0x00ff},
+       {"ag1",         0x000000f0,     0,              SROM4_AG10,             0xff00},
+       {"ag2",         0x000000f0,     0,              SROM4_AG32,             0x00ff},
+       {"ag3",         0x000000f0,     0,              SROM4_AG32,             0xff00},
+       {"ag0",         0x00000700,     0,              SROM8_AG10,             0x00ff},
+       {"ag1",         0x00000700,     0,              SROM8_AG10,             0xff00},
+       {"ag2",         0x00000700,     0,              SROM8_AG32,             0x00ff},
+       {"ag3",         0x00000700,     0,              SROM8_AG32,             0xff00},
+       {"pa1b0",       0x0000000e,     SRFL_PRHEX,     SROM_WL1PAB0,           0xffff},
+       {"pa1b1",       0x0000000e,     SRFL_PRHEX,     SROM_WL1PAB1,           0xffff},
+       {"pa1b2",       0x0000000e,     SRFL_PRHEX,     SROM_WL1PAB2,           0xffff},
+       {"pa1lob0",     0x0000000c,     SRFL_PRHEX,     SROM_WL1LPAB0,          0xffff},
+       {"pa1lob1",     0x0000000c,     SRFL_PRHEX,     SROM_WL1LPAB1,          0xffff},
+       {"pa1lob2",     0x0000000c,     SRFL_PRHEX,     SROM_WL1LPAB2,          0xffff},
+       {"pa1hib0",     0x0000000c,     SRFL_PRHEX,     SROM_WL1HPAB0,          0xffff},
+       {"pa1hib1",     0x0000000c,     SRFL_PRHEX,     SROM_WL1HPAB1,          0xffff},
+       {"pa1hib2",     0x0000000c,     SRFL_PRHEX,     SROM_WL1HPAB2,          0xffff},
+       {"pa1itssit",   0x0000000e,     0,              SROM_ITT,               0xff00},
+       {"pa1maxpwr",   0x0000000e,     0,              SROM_WL10MAXP,          0xff00},
+       {"pa1lomaxpwr", 0x0000000c,     0,              SROM_WL1LHMAXP,         0xff00},
+       {"pa1himaxpwr", 0x0000000c,     0,              SROM_WL1LHMAXP,         0x00ff},
+       {"pa1b0",       0x00000700,     SRFL_PRHEX,     SROM8_W1_PAB0,          0xffff},
+       {"pa1b1",       0x00000700,     SRFL_PRHEX,     SROM8_W1_PAB1,          0xffff},
+       {"pa1b2",       0x00000700,     SRFL_PRHEX,     SROM8_W1_PAB2,          0xffff},
+       {"pa1lob0",     0x00000700,     SRFL_PRHEX,     SROM8_W1_PAB0_LC,       0xffff},
+       {"pa1lob1",     0x00000700,     SRFL_PRHEX,     SROM8_W1_PAB1_LC,       0xffff},
+       {"pa1lob2",     0x00000700,     SRFL_PRHEX,     SROM8_W1_PAB2_LC,       0xffff},
+       {"pa1hib0",     0x00000700,     SRFL_PRHEX,     SROM8_W1_PAB0_HC,       0xffff},
+       {"pa1hib1",     0x00000700,     SRFL_PRHEX,     SROM8_W1_PAB1_HC,       0xffff},
+       {"pa1hib2",     0x00000700,     SRFL_PRHEX,     SROM8_W1_PAB2_HC,       0xffff},
+       {"pa1itssit",   0x00000700,     0,              SROM8_W1_ITTMAXP,       0xff00},
+       {"pa1maxpwr",   0x00000700,     0,              SROM8_W1_ITTMAXP,       0x00ff},
+       {"pa1lomaxpwr", 0x00000700,     0,              SROM8_W1_MAXP_LCHC,     0xff00},
+       {"pa1himaxpwr", 0x00000700,     0,              SROM8_W1_MAXP_LCHC,     0x00ff},
+       {"bxa2g",       0x00000008,     0,              SROM_BXARSSI2G,         0x1800},
+       {"rssisav2g",   0x00000008,     0,              SROM_BXARSSI2G,         0x0700},
+       {"rssismc2g",   0x00000008,     0,              SROM_BXARSSI2G,         0x00f0},
+       {"rssismf2g",   0x00000008,     0,              SROM_BXARSSI2G,         0x000f},
+       {"bxa2g",       0x00000700,     0,              SROM8_BXARSSI2G,        0x1800},
+       {"rssisav2g",   0x00000700,     0,              SROM8_BXARSSI2G,        0x0700},
+       {"rssismc2g",   0x00000700,     0,              SROM8_BXARSSI2G,        0x00f0},
+       {"rssismf2g",   0x00000700,     0,              SROM8_BXARSSI2G,        0x000f},
+       {"bxa5g",       0x00000008,     0,              SROM_BXARSSI5G,         0x1800},
+       {"rssisav5g",   0x00000008,     0,              SROM_BXARSSI5G,         0x0700},
+       {"rssismc5g",   0x00000008,     0,              SROM_BXARSSI5G,         0x00f0},
+       {"rssismf5g",   0x00000008,     0,              SROM_BXARSSI5G,         0x000f},
+       {"bxa5g",       0x00000700,     0,              SROM8_BXARSSI5G,        0x1800},
+       {"rssisav5g",   0x00000700,     0,              SROM8_BXARSSI5G,        0x0700},
+       {"rssismc5g",   0x00000700,     0,              SROM8_BXARSSI5G,        0x00f0},
+       {"rssismf5g",   0x00000700,     0,              SROM8_BXARSSI5G,        0x000f},
+       {"tri2g",       0x00000008,     0,              SROM_TRI52G,            0x00ff},
+       {"tri5g",       0x00000008,     0,              SROM_TRI52G,            0xff00},
+       {"tri5gl",      0x00000008,     0,              SROM_TRI5GHL,           0x00ff},
+       {"tri5gh",      0x00000008,     0,              SROM_TRI5GHL,           0xff00},
+       {"tri2g",       0x00000700,     0,              SROM8_TRI52G,           0x00ff},
+       {"tri5g",       0x00000700,     0,              SROM8_TRI52G,           0xff00},
+       {"tri5gl",      0x00000700,     0,              SROM8_TRI5GHL,          0x00ff},
+       {"tri5gh",      0x00000700,     0,              SROM8_TRI5GHL,          0xff00},
+       {"rxpo2g",      0x00000008,     SRFL_PRSIGN,    SROM_RXPO52G,           0x00ff},
+       {"rxpo5g",      0x00000008,     SRFL_PRSIGN,    SROM_RXPO52G,           0xff00},
+       {"rxpo2g",      0x00000700,     SRFL_PRSIGN,    SROM8_RXPO52G,          0x00ff},
+       {"rxpo5g",      0x00000700,     SRFL_PRSIGN,    SROM8_RXPO52G,          0xff00},
+       {"txchain",     0x000000f0,     SRFL_NOFFS,     SROM4_TXRXC,            SROM4_TXCHAIN_MASK},
+       {"rxchain",     0x000000f0,     SRFL_NOFFS,     SROM4_TXRXC,            SROM4_RXCHAIN_MASK},
+       {"antswitch",   0x000000f0,     SRFL_NOFFS,     SROM4_TXRXC,            SROM4_SWITCH_MASK},
+       {"txchain",     0x00000700,     SRFL_NOFFS,     SROM8_TXRXC,            SROM4_TXCHAIN_MASK},
+       {"rxchain",     0x00000700,     SRFL_NOFFS,     SROM8_TXRXC,            SROM4_RXCHAIN_MASK},
+       {"antswitch",   0x00000700,     SRFL_NOFFS,     SROM8_TXRXC,            SROM4_SWITCH_MASK},
+       {"tssipos2g",   0x00000700,     0,              SROM8_FEM2G,    SROM8_FEM_TSSIPOS_MASK},
+       {"extpagain2g", 0x00000700,     0,              SROM8_FEM2G,    SROM8_FEM_EXTPA_GAIN_MASK},
+       {"pdetrange2g", 0x00000700,     0,              SROM8_FEM2G,    SROM8_FEM_PDET_RANGE_MASK},
+       {"triso2g",     0x00000700,     0,              SROM8_FEM2G,    SROM8_FEM_TR_ISO_MASK},
+       {"antswctl2g",  0x00000700,     0,              SROM8_FEM2G,    SROM8_FEM_ANTSWLUT_MASK},
+       {"tssipos5g",   0x00000700,     0,              SROM8_FEM5G,    SROM8_FEM_TSSIPOS_MASK},
+       {"extpagain5g", 0x00000700,     0,              SROM8_FEM5G,    SROM8_FEM_EXTPA_GAIN_MASK},
+       {"pdetrange5g", 0x00000700,     0,              SROM8_FEM5G,    SROM8_FEM_PDET_RANGE_MASK},
+       {"triso5g",     0x00000700,     0,              SROM8_FEM5G,    SROM8_FEM_TR_ISO_MASK},
+       {"antswctl5g",  0x00000700,     0,              SROM8_FEM5G,    SROM8_FEM_ANTSWLUT_MASK},
+       {"txpid2ga0",   0x000000f0,     0,              SROM4_TXPID2G,          0x00ff},
+       {"txpid2ga1",   0x000000f0,     0,              SROM4_TXPID2G,          0xff00},
+       {"txpid2ga2",   0x000000f0,     0,              SROM4_TXPID2G + 1,      0x00ff},
+       {"txpid2ga3",   0x000000f0,     0,              SROM4_TXPID2G + 1,      0xff00},
+       {"txpid5ga0",   0x000000f0,     0,              SROM4_TXPID5G,          0x00ff},
+       {"txpid5ga1",   0x000000f0,     0,              SROM4_TXPID5G,          0xff00},
+       {"txpid5ga2",   0x000000f0,     0,              SROM4_TXPID5G + 1,      0x00ff},
+       {"txpid5ga3",   0x000000f0,     0,              SROM4_TXPID5G + 1,      0xff00},
+       {"txpid5gla0",  0x000000f0,     0,              SROM4_TXPID5GL,         0x00ff},
+       {"txpid5gla1",  0x000000f0,     0,              SROM4_TXPID5GL,         0xff00},
+       {"txpid5gla2",  0x000000f0,     0,              SROM4_TXPID5GL + 1,     0x00ff},
+       {"txpid5gla3",  0x000000f0,     0,              SROM4_TXPID5GL + 1,     0xff00},
+       {"txpid5gha0",  0x000000f0,     0,              SROM4_TXPID5GH,         0x00ff},
+       {"txpid5gha1",  0x000000f0,     0,              SROM4_TXPID5GH,         0xff00},
+       {"txpid5gha2",  0x000000f0,     0,              SROM4_TXPID5GH + 1,     0x00ff},
+       {"txpid5gha3",  0x000000f0,     0,              SROM4_TXPID5GH + 1,     0xff00},
+
+       {"ccode",       0x0000000f,     SRFL_CCODE,     SROM_CCODE,             0xffff},
+       {"ccode",       0x00000010,     SRFL_CCODE,     SROM4_CCODE,            0xffff},
+       {"ccode",       0x000000e0,     SRFL_CCODE,     SROM5_CCODE,            0xffff},
+       {"ccode",       0x00000700,     SRFL_CCODE,     SROM8_CCODE,            0xffff},
+       {"macaddr",     0x00000700,     SRFL_ETHADDR,   SROM8_MACHI,            0xffff},
+       {"macaddr",     0x000000e0,     SRFL_ETHADDR,   SROM5_MACHI,            0xffff},
+       {"macaddr",     0x00000010,     SRFL_ETHADDR,   SROM4_MACHI,            0xffff},
+       {"macaddr",     0x00000008,     SRFL_ETHADDR,   SROM3_MACHI,            0xffff},
+       {"il0macaddr",  0x00000007,     SRFL_ETHADDR,   SROM_MACHI_IL0,         0xffff},
+       {"et1macaddr",  0x00000007,     SRFL_ETHADDR,   SROM_MACHI_ET1,         0xffff},
+       {"leddc",       0x00000700,     SRFL_NOFFS|SRFL_LEDDC,  SROM8_LEDDC,    0xffff},
+       {"leddc",       0x000000e0,     SRFL_NOFFS|SRFL_LEDDC,  SROM5_LEDDC,    0xffff},
+       {"leddc",       0x00000010,     SRFL_NOFFS|SRFL_LEDDC,  SROM4_LEDDC,    0xffff},
+       {"leddc",       0x00000008,     SRFL_NOFFS|SRFL_LEDDC,  SROM3_LEDDC,    0xffff},
+
+       {"tempthresh",  0x00000700,     0,              SROM8_THERMAL,          0xff00},
+       {"tempoffset",  0x00000700,     0,              SROM8_THERMAL,          0x00ff},
+       {"rawtempsense", 0x00000700,    SRFL_PRHEX,     SROM8_MPWR_RAWTS,       0x01ff},
+       {"measpower",   0x00000700,     SRFL_PRHEX,     SROM8_MPWR_RAWTS,       0xfe00},
+       {"tempsense_slope",     0x00000700,     SRFL_PRHEX,     SROM8_TS_SLP_OPT_CORRX, 0x00ff},
+       {"tempcorrx",   0x00000700,     SRFL_PRHEX,     SROM8_TS_SLP_OPT_CORRX, 0xfc00},
+       {"tempsense_option",    0x00000700,     SRFL_PRHEX,     SROM8_TS_SLP_OPT_CORRX, 0x0300},
+       {"freqoffset_corr",     0x00000700,     SRFL_PRHEX,     SROM8_FOC_HWIQ_IQSWP,   0x000f},
+       {"iqcal_swp_dis",       0x00000700,     SRFL_PRHEX,     SROM8_FOC_HWIQ_IQSWP,   0x0010},
+       {"hw_iqcal_en", 0x00000700,     SRFL_PRHEX,     SROM8_FOC_HWIQ_IQSWP,   0x0020},
+       {"elna2g",      0x00000700,     0,              SROM8_EXTLNAGAIN,       0x00ff},
+       {"elna5g",      0x00000700,     0,              SROM8_EXTLNAGAIN,       0xff00},
+       {"phycal_tempdelta",    0x00000700,     0,      SROM8_PHYCAL_TEMPDELTA, 0x00ff},
+       {"temps_period",        0x00000700,     0,      SROM8_PHYCAL_TEMPDELTA, 0x0f00},
+       {"temps_hysteresis",    0x00000700,     0,      SROM8_PHYCAL_TEMPDELTA, 0xf000},
+       {"measpower1", 0x00000700,      SRFL_PRHEX, SROM8_MPWR_1_AND_2,         0x007f},
+       {"measpower2",  0x00000700,     SRFL_PRHEX, SROM8_MPWR_1_AND_2,         0x3f80},
+
+       {"cck2gpo",     0x000000f0,     0,              SROM4_2G_CCKPO,         0xffff},
+       {"cck2gpo",     0x00000100,     0,              SROM8_2G_CCKPO,         0xffff},
+       {"ofdm2gpo",    0x000000f0,     SRFL_MORE,      SROM4_2G_OFDMPO,        0xffff},
+       {"",            0,              0,              SROM4_2G_OFDMPO + 1,    0xffff},
+       {"ofdm5gpo",    0x000000f0,     SRFL_MORE,      SROM4_5G_OFDMPO,        0xffff},
+       {"",            0,              0,              SROM4_5G_OFDMPO + 1,    0xffff},
+       {"ofdm5glpo",   0x000000f0,     SRFL_MORE,      SROM4_5GL_OFDMPO,       0xffff},
+       {"",            0,              0,              SROM4_5GL_OFDMPO + 1,   0xffff},
+       {"ofdm5ghpo",   0x000000f0,     SRFL_MORE,      SROM4_5GH_OFDMPO,       0xffff},
+       {"",            0,              0,              SROM4_5GH_OFDMPO + 1,   0xffff},
+       {"ofdm2gpo",    0x00000100,     SRFL_MORE,      SROM8_2G_OFDMPO,        0xffff},
+       {"",            0,              0,              SROM8_2G_OFDMPO + 1,    0xffff},
+       {"ofdm5gpo",    0x00000100,     SRFL_MORE,      SROM8_5G_OFDMPO,        0xffff},
+       {"",            0,              0,              SROM8_5G_OFDMPO + 1,    0xffff},
+       {"ofdm5glpo",   0x00000100,     SRFL_MORE,      SROM8_5GL_OFDMPO,       0xffff},
+       {"",            0,              0,              SROM8_5GL_OFDMPO + 1,   0xffff},
+       {"ofdm5ghpo",   0x00000100,     SRFL_MORE,      SROM8_5GH_OFDMPO,       0xffff},
+       {"",            0,              0,              SROM8_5GH_OFDMPO + 1,   0xffff},
+       {"mcs2gpo0",    0x000000f0,     0,              SROM4_2G_MCSPO,         0xffff},
+       {"mcs2gpo1",    0x000000f0,     0,              SROM4_2G_MCSPO + 1,     0xffff},
+       {"mcs2gpo2",    0x000000f0,     0,              SROM4_2G_MCSPO + 2,     0xffff},
+       {"mcs2gpo3",    0x000000f0,     0,              SROM4_2G_MCSPO + 3,     0xffff},
+       {"mcs2gpo4",    0x000000f0,     0,              SROM4_2G_MCSPO + 4,     0xffff},
+       {"mcs2gpo5",    0x000000f0,     0,              SROM4_2G_MCSPO + 5,     0xffff},
+       {"mcs2gpo6",    0x000000f0,     0,              SROM4_2G_MCSPO + 6,     0xffff},
+       {"mcs2gpo7",    0x000000f0,     0,              SROM4_2G_MCSPO + 7,     0xffff},
+       {"mcs5gpo0",    0x000000f0,     0,              SROM4_5G_MCSPO,         0xffff},
+       {"mcs5gpo1",    0x000000f0,     0,              SROM4_5G_MCSPO + 1,     0xffff},
+       {"mcs5gpo2",    0x000000f0,     0,              SROM4_5G_MCSPO + 2,     0xffff},
+       {"mcs5gpo3",    0x000000f0,     0,              SROM4_5G_MCSPO + 3,     0xffff},
+       {"mcs5gpo4",    0x000000f0,     0,              SROM4_5G_MCSPO + 4,     0xffff},
+       {"mcs5gpo5",    0x000000f0,     0,              SROM4_5G_MCSPO + 5,     0xffff},
+       {"mcs5gpo6",    0x000000f0,     0,              SROM4_5G_MCSPO + 6,     0xffff},
+       {"mcs5gpo7",    0x000000f0,     0,              SROM4_5G_MCSPO + 7,     0xffff},
+       {"mcs5glpo0",   0x000000f0,     0,              SROM4_5GL_MCSPO,        0xffff},
+       {"mcs5glpo1",   0x000000f0,     0,              SROM4_5GL_MCSPO + 1,    0xffff},
+       {"mcs5glpo2",   0x000000f0,     0,              SROM4_5GL_MCSPO + 2,    0xffff},
+       {"mcs5glpo3",   0x000000f0,     0,              SROM4_5GL_MCSPO + 3,    0xffff},
+       {"mcs5glpo4",   0x000000f0,     0,              SROM4_5GL_MCSPO + 4,    0xffff},
+       {"mcs5glpo5",   0x000000f0,     0,              SROM4_5GL_MCSPO + 5,    0xffff},
+       {"mcs5glpo6",   0x000000f0,     0,              SROM4_5GL_MCSPO + 6,    0xffff},
+       {"mcs5glpo7",   0x000000f0,     0,              SROM4_5GL_MCSPO + 7,    0xffff},
+       {"mcs5ghpo0",   0x000000f0,     0,              SROM4_5GH_MCSPO,        0xffff},
+       {"mcs5ghpo1",   0x000000f0,     0,              SROM4_5GH_MCSPO + 1,    0xffff},
+       {"mcs5ghpo2",   0x000000f0,     0,              SROM4_5GH_MCSPO + 2,    0xffff},
+       {"mcs5ghpo3",   0x000000f0,     0,              SROM4_5GH_MCSPO + 3,    0xffff},
+       {"mcs5ghpo4",   0x000000f0,     0,              SROM4_5GH_MCSPO + 4,    0xffff},
+       {"mcs5ghpo5",   0x000000f0,     0,              SROM4_5GH_MCSPO + 5,    0xffff},
+       {"mcs5ghpo6",   0x000000f0,     0,              SROM4_5GH_MCSPO + 6,    0xffff},
+       {"mcs5ghpo7",   0x000000f0,     0,              SROM4_5GH_MCSPO + 7,    0xffff},
+       {"mcs2gpo0",    0x00000100,     0,              SROM8_2G_MCSPO,         0xffff},
+       {"mcs2gpo1",    0x00000100,     0,              SROM8_2G_MCSPO + 1,     0xffff},
+       {"mcs2gpo2",    0x00000100,     0,              SROM8_2G_MCSPO + 2,     0xffff},
+       {"mcs2gpo3",    0x00000100,     0,              SROM8_2G_MCSPO + 3,     0xffff},
+       {"mcs2gpo4",    0x00000100,     0,              SROM8_2G_MCSPO + 4,     0xffff},
+       {"mcs2gpo5",    0x00000100,     0,              SROM8_2G_MCSPO + 5,     0xffff},
+       {"mcs2gpo6",    0x00000100,     0,              SROM8_2G_MCSPO + 6,     0xffff},
+       {"mcs2gpo7",    0x00000100,     0,              SROM8_2G_MCSPO + 7,     0xffff},
+       {"mcs5gpo0",    0x00000100,     0,              SROM8_5G_MCSPO,         0xffff},
+       {"mcs5gpo1",    0x00000100,     0,              SROM8_5G_MCSPO + 1,     0xffff},
+       {"mcs5gpo2",    0x00000100,     0,              SROM8_5G_MCSPO + 2,     0xffff},
+       {"mcs5gpo3",    0x00000100,     0,              SROM8_5G_MCSPO + 3,     0xffff},
+       {"mcs5gpo4",    0x00000100,     0,              SROM8_5G_MCSPO + 4,     0xffff},
+       {"mcs5gpo5",    0x00000100,     0,              SROM8_5G_MCSPO + 5,     0xffff},
+       {"mcs5gpo6",    0x00000100,     0,              SROM8_5G_MCSPO + 6,     0xffff},
+       {"mcs5gpo7",    0x00000100,     0,              SROM8_5G_MCSPO + 7,     0xffff},
+       {"mcs5glpo0",   0x00000100,     0,              SROM8_5GL_MCSPO,        0xffff},
+       {"mcs5glpo1",   0x00000100,     0,              SROM8_5GL_MCSPO + 1,    0xffff},
+       {"mcs5glpo2",   0x00000100,     0,              SROM8_5GL_MCSPO + 2,    0xffff},
+       {"mcs5glpo3",   0x00000100,     0,              SROM8_5GL_MCSPO + 3,    0xffff},
+       {"mcs5glpo4",   0x00000100,     0,              SROM8_5GL_MCSPO + 4,    0xffff},
+       {"mcs5glpo5",   0x00000100,     0,              SROM8_5GL_MCSPO + 5,    0xffff},
+       {"mcs5glpo6",   0x00000100,     0,              SROM8_5GL_MCSPO + 6,    0xffff},
+       {"mcs5glpo7",   0x00000100,     0,              SROM8_5GL_MCSPO + 7,    0xffff},
+       {"mcs5ghpo0",   0x00000100,     0,              SROM8_5GH_MCSPO,        0xffff},
+       {"mcs5ghpo1",   0x00000100,     0,              SROM8_5GH_MCSPO + 1,    0xffff},
+       {"mcs5ghpo2",   0x00000100,     0,              SROM8_5GH_MCSPO + 2,    0xffff},
+       {"mcs5ghpo3",   0x00000100,     0,              SROM8_5GH_MCSPO + 3,    0xffff},
+       {"mcs5ghpo4",   0x00000100,     0,              SROM8_5GH_MCSPO + 4,    0xffff},
+       {"mcs5ghpo5",   0x00000100,     0,              SROM8_5GH_MCSPO + 5,    0xffff},
+       {"mcs5ghpo6",   0x00000100,     0,              SROM8_5GH_MCSPO + 6,    0xffff},
+       {"mcs5ghpo7",   0x00000100,     0,              SROM8_5GH_MCSPO + 7,    0xffff},
+       {"cddpo",       0x000000f0,     0,              SROM4_CDDPO,            0xffff},
+       {"stbcpo",      0x000000f0,     0,              SROM4_STBCPO,           0xffff},
+       {"bw40po",      0x000000f0,     0,              SROM4_BW40PO,           0xffff},
+       {"bwduppo",     0x000000f0,     0,              SROM4_BWDUPPO,          0xffff},
+       {"cddpo",       0x00000100,     0,              SROM8_CDDPO,            0xffff},
+       {"stbcpo",      0x00000100,     0,              SROM8_STBCPO,           0xffff},
+       {"bw40po",      0x00000100,     0,              SROM8_BW40PO,           0xffff},
+       {"bwduppo",     0x00000100,     0,              SROM8_BWDUPPO,          0xffff},
+
+       /* power per rate from sromrev 9 */
+       {"cckbw202gpo",         0x00000600,     0,      SROM9_2GPO_CCKBW20,             0xffff},
+       {"cckbw20ul2gpo",       0x00000600,     0,      SROM9_2GPO_CCKBW20UL,           0xffff},
+       {"legofdmbw202gpo",     0x00000600,     SRFL_MORE, SROM9_2GPO_LOFDMBW20,        0xffff},
+       {"",                    0,              0,      SROM9_2GPO_LOFDMBW20 + 1,       0xffff},
+       {"legofdmbw20ul2gpo",   0x00000600,     SRFL_MORE, SROM9_2GPO_LOFDMBW20UL,      0xffff},
+       {"",                    0,              0,      SROM9_2GPO_LOFDMBW20UL + 1,     0xffff},
+       {"legofdmbw205glpo",    0x00000600,     SRFL_MORE, SROM9_5GLPO_LOFDMBW20,       0xffff},
+       {"",                    0,              0,      SROM9_5GLPO_LOFDMBW20 + 1,      0xffff},
+       {"legofdmbw20ul5glpo",  0x00000600,     SRFL_MORE, SROM9_5GLPO_LOFDMBW20UL,     0xffff},
+       {"",                    0,              0,      SROM9_5GLPO_LOFDMBW20UL + 1,    0xffff},
+       {"legofdmbw205gmpo",    0x00000600,     SRFL_MORE, SROM9_5GMPO_LOFDMBW20,       0xffff},
+       {"",                    0,              0,      SROM9_5GMPO_LOFDMBW20 + 1,      0xffff},
+       {"legofdmbw20ul5gmpo",  0x00000600,     SRFL_MORE, SROM9_5GMPO_LOFDMBW20UL,     0xffff},
+       {"",                    0,              0,      SROM9_5GMPO_LOFDMBW20UL + 1,    0xffff},
+       {"legofdmbw205ghpo",    0x00000600,     SRFL_MORE, SROM9_5GHPO_LOFDMBW20,       0xffff},
+       {"",                    0,              0,      SROM9_5GHPO_LOFDMBW20 + 1,      0xffff},
+       {"legofdmbw20ul5ghpo",  0x00000600,     SRFL_MORE, SROM9_5GHPO_LOFDMBW20UL,     0xffff},
+       {"",                    0,              0,      SROM9_5GHPO_LOFDMBW20UL + 1,    0xffff},
+       {"mcsbw202gpo",         0x00000600,     SRFL_MORE, SROM9_2GPO_MCSBW20,          0xffff},
+       {"",                    0,              0,      SROM9_2GPO_MCSBW20 + 1,         0xffff},
+       {"mcsbw20ul2gpo",       0x00000600,     SRFL_MORE, SROM9_2GPO_MCSBW20UL,        0xffff},
+       {"",                    0,              0,      SROM9_2GPO_MCSBW20UL + 1,       0xffff},
+       {"mcsbw402gpo",         0x00000600,     SRFL_MORE, SROM9_2GPO_MCSBW40,          0xffff},
+       {"",                    0,              0,      SROM9_2GPO_MCSBW40 + 1,         0xffff},
+       {"mcsbw205glpo",        0x00000600,     SRFL_MORE, SROM9_5GLPO_MCSBW20,         0xffff},
+       {"",                    0,              0,      SROM9_5GLPO_MCSBW20 + 1,        0xffff},
+       {"mcsbw20ul5glpo",      0x00000600,     SRFL_MORE, SROM9_5GLPO_MCSBW20UL,       0xffff},
+       {"",                    0,              0,      SROM9_5GLPO_MCSBW20UL + 1,      0xffff},
+       {"mcsbw405glpo",        0x00000600,     SRFL_MORE, SROM9_5GLPO_MCSBW40,         0xffff},
+       {"",                    0,              0,      SROM9_5GLPO_MCSBW40 + 1,        0xffff},
+       {"mcsbw205gmpo",        0x00000600,     SRFL_MORE, SROM9_5GMPO_MCSBW20,         0xffff},
+       {"",                    0,              0,      SROM9_5GMPO_MCSBW20 + 1,        0xffff},
+       {"mcsbw20ul5gmpo",      0x00000600,     SRFL_MORE, SROM9_5GMPO_MCSBW20UL,       0xffff},
+       {"",                    0,              0,      SROM9_5GMPO_MCSBW20UL + 1,      0xffff},
+       {"mcsbw405gmpo",        0x00000600,     SRFL_MORE, SROM9_5GMPO_MCSBW40,         0xffff},
+       {"",                    0,              0,      SROM9_5GMPO_MCSBW40 + 1,        0xffff},
+       {"mcsbw205ghpo",        0x00000600,     SRFL_MORE, SROM9_5GHPO_MCSBW20,         0xffff},
+       {"",                    0,              0,      SROM9_5GHPO_MCSBW20 + 1,        0xffff},
+       {"mcsbw20ul5ghpo",      0x00000600,     SRFL_MORE, SROM9_5GHPO_MCSBW20UL,       0xffff},
+       {"",                    0,              0,      SROM9_5GHPO_MCSBW20UL + 1,      0xffff},
+       {"mcsbw405ghpo",        0x00000600,     SRFL_MORE, SROM9_5GHPO_MCSBW40,         0xffff},
+       {"",                    0,              0,      SROM9_5GHPO_MCSBW40 + 1,        0xffff},
+       {"mcs32po",             0x00000600,     0,      SROM9_PO_MCS32,                 0xffff},
+       {"legofdm40duppo",      0x00000600,     0,      SROM9_PO_LOFDM40DUP,    0xffff},
+       {"pcieingress_war",     0x00000700,     0,      SROM8_PCIEINGRESS_WAR,  0xf},
+       {"eu_edthresh2g",       0x00000100,     0,      SROM8_EU_EDCRSTH,               0x00ff},
+       {"eu_edthresh5g",       0x00000100,     0,      SROM8_EU_EDCRSTH,               0xff00},
+       {"eu_edthresh2g",       0x00000200,     0,      SROM9_EU_EDCRSTH,               0x00ff},
+       {"eu_edthresh5g",       0x00000200,     0,      SROM9_EU_EDCRSTH,               0xff00},
+       {"rxgainerr2ga0",       0x00000700,     0,      SROM8_RXGAINERR_2G,             0x003f},
+       {"rxgainerr2ga0",       0x00000700,     0,      SROM8_RXGAINERR_2G,             0x003f},
+       {"rxgainerr2ga1",       0x00000700,     0,      SROM8_RXGAINERR_2G,             0x07c0},
+       {"rxgainerr2ga2",       0x00000700,     0,      SROM8_RXGAINERR_2G,             0xf800},
+       {"rxgainerr5gla0",      0x00000700,     0,      SROM8_RXGAINERR_5GL,    0x003f},
+       {"rxgainerr5gla1",      0x00000700,     0,      SROM8_RXGAINERR_5GL,    0x07c0},
+       {"rxgainerr5gla2",      0x00000700,     0,      SROM8_RXGAINERR_5GL,    0xf800},
+       {"rxgainerr5gma0",      0x00000700,     0,      SROM8_RXGAINERR_5GM,    0x003f},
+       {"rxgainerr5gma1",      0x00000700,     0,      SROM8_RXGAINERR_5GM,    0x07c0},
+       {"rxgainerr5gma2",      0x00000700,     0,      SROM8_RXGAINERR_5GM,    0xf800},
+       {"rxgainerr5gha0",      0x00000700,     0,      SROM8_RXGAINERR_5GH,    0x003f},
+       {"rxgainerr5gha1",      0x00000700,     0,      SROM8_RXGAINERR_5GH,    0x07c0},
+       {"rxgainerr5gha2",      0x00000700,     0,      SROM8_RXGAINERR_5GH,    0xf800},
+       {"rxgainerr5gua0",      0x00000700,     0,      SROM8_RXGAINERR_5GU,    0x003f},
+       {"rxgainerr5gua1",      0x00000700,     0,      SROM8_RXGAINERR_5GU,    0x07c0},
+       {"rxgainerr5gua2",      0x00000700,     0,      SROM8_RXGAINERR_5GU,    0xf800},
+       {"sar2g",               0x00000600,     0,      SROM9_SAR,              0x00ff},
+       {"sar5g",           0x00000600, 0,      SROM9_SAR,                  0xff00},
+       {"noiselvl2ga0",        0x00000700,     0,      SROM8_NOISELVL_2G,              0x001f},
+       {"noiselvl2ga1",        0x00000700,     0,      SROM8_NOISELVL_2G,              0x03e0},
+       {"noiselvl2ga2",        0x00000700,     0,      SROM8_NOISELVL_2G,              0x7c00},
+       {"noiselvl5gla0",       0x00000700,     0,      SROM8_NOISELVL_5GL,             0x001f},
+       {"noiselvl5gla1",       0x00000700,     0,      SROM8_NOISELVL_5GL,             0x03e0},
+       {"noiselvl5gla2",       0x00000700,     0,      SROM8_NOISELVL_5GL,             0x7c00},
+       {"noiselvl5gma0",       0x00000700,     0,      SROM8_NOISELVL_5GM,             0x001f},
+       {"noiselvl5gma1",       0x00000700,     0,      SROM8_NOISELVL_5GM,             0x03e0},
+       {"noiselvl5gma2",       0x00000700,     0,      SROM8_NOISELVL_5GM,             0x7c00},
+       {"noiselvl5gha0",       0x00000700,     0,      SROM8_NOISELVL_5GH,             0x001f},
+       {"noiselvl5gha1",       0x00000700,     0,      SROM8_NOISELVL_5GH,             0x03e0},
+       {"noiselvl5gha2",       0x00000700,     0,      SROM8_NOISELVL_5GH,             0x7c00},
+       {"noiselvl5gua0",       0x00000700,     0,      SROM8_NOISELVL_5GU,             0x001f},
+       {"noiselvl5gua1",       0x00000700,     0,      SROM8_NOISELVL_5GU,             0x03e0},
+       {"noiselvl5gua2",       0x00000700,     0,      SROM8_NOISELVL_5GU,             0x7c00},
+       {"noisecaloffset",      0x00000300,     0,      SROM8_NOISECALOFFSET,           0x00ff},
+       {"noisecaloffset5g",    0x00000300,     0,      SROM8_NOISECALOFFSET,           0xff00},
+       {"subband5gver",        0x00000700,     0,      SROM8_SUBBAND_PPR,              0x7},
+
+       {"cckPwrOffset",        0x00000400,     0,      SROM10_CCKPWROFFSET,            0xffff},
+       {"eu_edthresh2g",       0x00000400,     0,      SROM10_EU_EDCRSTH,              0x00ff},
+       {"eu_edthresh5g",       0x00000400,     0,      SROM10_EU_EDCRSTH,              0xff00},
+       /* swctrlmap_2g array, note that the last element doesn't have SRFL_ARRAY flag set */
+       {"swctrlmap_2g", 0x00000400, SRFL_MORE|SRFL_PRHEX|SRFL_ARRAY, SROM10_SWCTRLMAP_2G, 0xffff},
+       {"",    0x00000400, SRFL_ARRAY, SROM10_SWCTRLMAP_2G + 1,                        0xffff},
+       {"",    0x00000400, SRFL_MORE|SRFL_PRHEX|SRFL_ARRAY, SROM10_SWCTRLMAP_2G + 2,   0xffff},
+       {"",    0x00000400, SRFL_ARRAY, SROM10_SWCTRLMAP_2G + 3,                        0xffff},
+       {"",    0x00000400, SRFL_MORE|SRFL_PRHEX|SRFL_ARRAY, SROM10_SWCTRLMAP_2G + 4,   0xffff},
+       {"",    0x00000400, SRFL_ARRAY, SROM10_SWCTRLMAP_2G + 5,                        0xffff},
+       {"",    0x00000400, SRFL_MORE|SRFL_PRHEX|SRFL_ARRAY, SROM10_SWCTRLMAP_2G + 6,   0xffff},
+       {"",    0x00000400, SRFL_ARRAY, SROM10_SWCTRLMAP_2G + 7,                        0xffff},
+       {"",    0x00000400, SRFL_PRHEX, SROM10_SWCTRLMAP_2G + 8,                        0xffff},
+
+       /* sromrev 11 */
+       {"boardflags3", 0xfffff800,     SRFL_PRHEX|SRFL_MORE,   SROM11_BFL4,    0xffff},
+       {"",            0,              0,                      SROM11_BFL5,    0xffff},
+       {"boardnum",    0xfffff800,     0,                      SROM11_MACLO,   0xffff},
+       {"macaddr",     0xfffff800,     SRFL_ETHADDR,           SROM11_MACHI,   0xffff},
+       {"ccode",       0xfffff800,     SRFL_CCODE,             SROM11_CCODE,   0xffff},
+       {"regrev",      0xfffff800,     0,                      SROM11_REGREV,  0x00ff},
+       {"ledbh0",      0xfffff800,     SRFL_NOFFS,             SROM11_LEDBH10, 0x00ff},
+       {"ledbh1",      0xfffff800,     SRFL_NOFFS,             SROM11_LEDBH10, 0xff00},
+       {"ledbh2",      0xfffff800,     SRFL_NOFFS,             SROM11_LEDBH32, 0x00ff},
+       {"ledbh3",      0xfffff800,     SRFL_NOFFS,             SROM11_LEDBH32, 0xff00},
+       {"leddc",       0xfffff800,     SRFL_NOFFS|SRFL_LEDDC,  SROM11_LEDDC,   0xffff},
+       {"aa2g",        0xfffff800,     0,                      SROM11_AA,      0x00ff},
+       {"aa5g",        0xfffff800,     0,                      SROM11_AA,      0xff00},
+       {"agbg0",       0xfffff800,     0,                      SROM11_AGBG10,  0xff00},
+       {"agbg1",       0xfffff800,     0,                      SROM11_AGBG10,  0x00ff},
+       {"agbg2",       0xfffff800,     0,                      SROM11_AGBG2A0, 0xff00},
+       {"aga0",        0xfffff800,     0,                      SROM11_AGBG2A0, 0x00ff},
+       {"aga1",        0xfffff800,     0,                      SROM11_AGA21,   0xff00},
+       {"aga2",        0xfffff800,     0,                      SROM11_AGA21,   0x00ff},
+       {"txchain",     0xfffff800,     SRFL_NOFFS,     SROM11_TXRXC,   SROM4_TXCHAIN_MASK},
+       {"rxchain",     0xfffff800,     SRFL_NOFFS,     SROM11_TXRXC,   SROM4_RXCHAIN_MASK},
+       {"antswitch",   0xfffff800,     SRFL_NOFFS,     SROM11_TXRXC,   SROM4_SWITCH_MASK},
+
+       {"tssiposslope2g",      0xfffff800,     0,              SROM11_FEM_CFG1,        0x0001},
+       {"epagain2g",           0xfffff800,     0,              SROM11_FEM_CFG1,        0x000e},
+       {"pdgain2g",            0xfffff800,     0,              SROM11_FEM_CFG1,        0x01f0},
+       {"tworangetssi2g",      0xfffff800,     0,              SROM11_FEM_CFG1,        0x0200},
+       {"papdcap2g",           0xfffff800,     0,              SROM11_FEM_CFG1,        0x0400},
+       {"femctrl",             0xfffff800,     0,              SROM11_FEM_CFG1,        0xf800},
+
+       {"tssiposslope5g",      0xfffff800,     0,              SROM11_FEM_CFG2,        0x0001},
+       {"epagain5g",           0xfffff800,     0,              SROM11_FEM_CFG2,        0x000e},
+       {"pdgain5g",            0xfffff800,     0,              SROM11_FEM_CFG2,        0x01f0},
+       {"tworangetssi5g",      0xfffff800,     0,              SROM11_FEM_CFG2,        0x0200},
+       {"papdcap5g",           0xfffff800,     0,              SROM11_FEM_CFG2,        0x0400},
+       {"gainctrlsph",         0xfffff800,     0,              SROM11_FEM_CFG2,        0xf800},
+
+       {"tempthresh",          0xfffff800,     0,              SROM11_THERMAL,         0xff00},
+       {"tempoffset",          0xfffff800,     0,              SROM11_THERMAL,         0x00ff},
+       {"rawtempsense",        0xfffff800,     SRFL_PRHEX,     SROM11_MPWR_RAWTS,      0x01ff},
+       {"measpower",           0xfffff800,     SRFL_PRHEX,     SROM11_MPWR_RAWTS,      0xfe00},
+       {"tempsense_slope",     0xfffff800,     SRFL_PRHEX,     SROM11_TS_SLP_OPT_CORRX, 0x00ff},
+       {"tempcorrx",           0xfffff800,     SRFL_PRHEX,     SROM11_TS_SLP_OPT_CORRX, 0xfc00},
+       {"tempsense_option",    0xfffff800,     SRFL_PRHEX,     SROM11_TS_SLP_OPT_CORRX, 0x0300},
+       {"xtalfreq",            0xfffff800,     0,              SROM11_XTAL_FREQ,       0xffff},
+       /* Special PA Params for 4350 5G Band, 40/80 MHz BW Ant #1 */
+       {"pa5gbw4080a1", 0xfffff800,    SRFL_PRHEX | SRFL_ARRAY, SROM11_5GB0_4080_W0_A1, 0xffff},
+       {"", 0xfffff800, SRFL_PRHEX | SRFL_ARRAY, SROM11_5GB0_4080_W1_A1,                 0xffff},
+       {"", 0xfffff800, SRFL_PRHEX | SRFL_ARRAY, SROM11_5GB0_4080_W2_A1,                 0xffff},
+       {"", 0xfffff800, SRFL_PRHEX | SRFL_ARRAY, SROM11_5GB1_4080_W0_A1,                 0xffff},
+       {"", 0xfffff800, SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 + SROM11_5GB1_4080_PA,     0xffff},
+       {"", 0xfffff800, SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 + SROM11_5GB1_4080_PA + 1, 0xffff},
+       {"", 0xfffff800, SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 + SROM11_5GB2_4080_PA,     0xffff},
+       {"", 0xfffff800, SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 + SROM11_5GB2_4080_PA + 1, 0xffff},
+       {"", 0xfffff800, SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 + SROM11_5GB2_4080_PA + 2, 0xffff},
+       {"", 0xfffff800, SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 + SROM11_5GB3_4080_PA,     0xffff},
+       {"", 0xfffff800, SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 + SROM11_5GB3_4080_PA + 1, 0xffff},
+       {"", 0xfffff800, SRFL_PRHEX,              SROM11_PATH2 + SROM11_5GB3_4080_PA + 2, 0xffff},
+       {"phycal_tempdelta",    0xfffff800,     0,              SROM11_PHYCAL_TEMPDELTA, 0x00ff},
+       {"temps_period",        0xfffff800,     0,              SROM11_PHYCAL_TEMPDELTA, 0x0f00},
+       {"temps_hysteresis",    0xfffff800,     0,              SROM11_PHYCAL_TEMPDELTA, 0xf000},
+       {"measpower1",          0xfffff800,     SRFL_PRHEX,     SROM11_MPWR_1_AND_2,    0x007f},
+       {"measpower2",          0xfffff800,     SRFL_PRHEX,     SROM11_MPWR_1_AND_2,    0x3f80},
+       {"tssifloor2g",         0xfffff800,     SRFL_PRHEX,     SROM11_TSSIFLOOR_2G,    0x03ff},
+       {"tssifloor5g", 0xfffff800,     SRFL_PRHEX | SRFL_ARRAY, SROM11_TSSIFLOOR_5GL,  0x03ff},
+       {"",            0xfffff800,     SRFL_PRHEX | SRFL_ARRAY, SROM11_TSSIFLOOR_5GM,  0x03ff},
+       {"",            0xfffff800,     SRFL_PRHEX | SRFL_ARRAY, SROM11_TSSIFLOOR_5GH,  0x03ff},
+       {"",            0xfffff800,     SRFL_PRHEX,             SROM11_TSSIFLOOR_5GU,   0x03ff},
+       {"pdoffset2g40ma0",     0xfffff800, 0,      SROM11_PDOFF_2G_40M,    0x000f},
+       {"pdoffset2g40ma1",     0xfffff800, 0,      SROM11_PDOFF_2G_40M,    0x00f0},
+       {"pdoffset2g40ma2",     0xfffff800, 0,      SROM11_PDOFF_2G_40M,    0x0f00},
+       {"pdoffset2g40mvalid",  0xfffff800, 0,      SROM11_PDOFF_2G_40M,    0x8000},
+       {"pdoffset40ma0",       0xfffff800,     0,              SROM11_PDOFF_40M_A0,    0xffff},
+       {"pdoffset40ma1",       0xfffff800,     0,              SROM11_PDOFF_40M_A1,    0xffff},
+       {"pdoffset40ma2",       0xfffff800,     0,              SROM11_PDOFF_40M_A2,    0xffff},
+       {"pdoffset80ma0",       0xfffff800,     0,              SROM11_PDOFF_80M_A0,    0xffff},
+       {"pdoffset80ma1",       0xfffff800,     0,              SROM11_PDOFF_80M_A1,    0xffff},
+       {"pdoffset80ma2",       0xfffff800,     0,              SROM11_PDOFF_80M_A2,    0xffff},
+
+       {"subband5gver",        0xfffff800,     SRFL_PRHEX,     SROM11_SUBBAND5GVER,    0xffff},
+       {"paparambwver",        0xfffff800,     0,              SROM11_MCSLR5GLPO,      0xf000},
+       {"rx5ggainwar",         0xfffff800,     0,              SROM11_MCSLR5GMPO,      0x2000},
+       /* Special PA Params for 4350 5G Band, 40/80 MHz BW Ant #0 */
+       {"pa5gbw4080a0", 0xfffff800, SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 +SROM11_5GB0_PA, 0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 + SROM11_5GB0_PA + 1, 0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 + SROM11_5GB0_PA + 2, 0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 + SROM11_5GB1_PA,     0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 + SROM11_5GB1_PA + 1, 0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 + SROM11_5GB1_PA + 2, 0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 + SROM11_5GB2_PA,     0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 + SROM11_5GB2_PA + 1, 0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 + SROM11_5GB2_PA + 2, 0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 + SROM11_5GB3_PA,     0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 + SROM11_5GB3_PA + 1, 0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX,              SROM11_PATH2 + SROM11_5GB3_PA + 2, 0xffff},
+       /* Special PA Params for 4335 5G Band, 40 MHz BW */
+       {"pa5gbw40a0", 0xfffff800, SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH1 + SROM11_5GB0_PA, 0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH1 + SROM11_5GB0_PA + 1, 0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH1 + SROM11_5GB0_PA + 2, 0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH1 + SROM11_5GB1_PA,     0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH1 + SROM11_5GB1_PA + 1, 0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH1 + SROM11_5GB1_PA + 2, 0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH1 + SROM11_5GB2_PA,     0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH1 + SROM11_5GB2_PA + 1, 0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH1 + SROM11_5GB2_PA + 2, 0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH1 + SROM11_5GB3_PA,     0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH1 + SROM11_5GB3_PA + 1, 0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX,              SROM11_PATH1 + SROM11_5GB3_PA + 2, 0xffff},
+       /* Special PA Params for 4335 5G Band, 80 MHz BW */
+       {"pa5gbw80a0", 0xfffff800, SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 + SROM11_5GB0_PA, 0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 + SROM11_5GB0_PA + 1, 0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 + SROM11_5GB0_PA + 2, 0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 + SROM11_5GB1_PA,     0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 + SROM11_5GB1_PA + 1, 0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 + SROM11_5GB1_PA + 2, 0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 + SROM11_5GB2_PA,     0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 + SROM11_5GB2_PA + 1, 0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 + SROM11_5GB2_PA + 2, 0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 + SROM11_5GB3_PA,     0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH2 + SROM11_5GB3_PA + 1, 0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX,              SROM11_PATH2 + SROM11_5GB3_PA + 2, 0xffff},
+       /* Special PA Params for 4335 2G Band, CCK */
+       {"pa2gccka0", 0xfffff800, SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH1 + SROM11_2G_PA, 0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX | SRFL_ARRAY, SROM11_PATH1 + SROM11_2G_PA + 1, 0xffff},
+       {"", 0xfffff800,        SRFL_PRHEX,              SROM11_PATH1 + SROM11_2G_PA + 2, 0xffff},
+
+       /* power per rate */
+       {"cckbw202gpo",         0xfffff800,     0,              SROM11_CCKBW202GPO,     0xffff},
+       {"cckbw20ul2gpo",       0xfffff800,     0,              SROM11_CCKBW20UL2GPO,   0xffff},
+       {"mcsbw202gpo",         0xfffff800,     SRFL_MORE,      SROM11_MCSBW202GPO,     0xffff},
+       {"",                    0xfffff800,     0,              SROM11_MCSBW202GPO_1,   0xffff},
+       {"mcsbw402gpo",         0xfffff800,     SRFL_MORE,      SROM11_MCSBW402GPO,     0xffff},
+       {"",                    0xfffff800,     0,              SROM11_MCSBW402GPO_1,   0xffff},
+       {"dot11agofdmhrbw202gpo", 0xfffff800,   0,      SROM11_DOT11AGOFDMHRBW202GPO,   0xffff},
+       {"ofdmlrbw202gpo",      0xfffff800,     0,              SROM11_OFDMLRBW202GPO,  0xffff},
+       {"mcsbw205glpo",        0xfffff800,     SRFL_MORE,      SROM11_MCSBW205GLPO,    0xffff},
+       {"",                    0xfffff800,     0,              SROM11_MCSBW205GLPO_1,  0xffff},
+       {"mcsbw405glpo",        0xfffff800,     SRFL_MORE,      SROM11_MCSBW405GLPO,    0xffff},
+       {"",                    0xfffff800,     0,              SROM11_MCSBW405GLPO_1,  0xffff},
+       {"mcsbw805glpo",        0xfffff800,     SRFL_MORE,      SROM11_MCSBW805GLPO,    0xffff},
+       {"",                    0xfffff800,     0,              SROM11_MCSBW805GLPO_1,  0xffff},
+       {"mcsbw205gmpo",        0xfffff800,     SRFL_MORE,      SROM11_MCSBW205GMPO,    0xffff},
+       {"",                    0xfffff800,     0,              SROM11_MCSBW205GMPO_1,  0xffff},
+       {"mcsbw405gmpo",        0xfffff800,     SRFL_MORE,      SROM11_MCSBW405GMPO,    0xffff},
+       {"",                    0xfffff800,     0,              SROM11_MCSBW405GMPO_1,  0xffff},
+       {"mcsbw805gmpo",        0xfffff800,     SRFL_MORE,      SROM11_MCSBW805GMPO,    0xffff},
+       {"",                    0xfffff800,     0,              SROM11_MCSBW805GMPO_1,  0xffff},
+       {"mcsbw205ghpo",        0xfffff800,     SRFL_MORE,      SROM11_MCSBW205GHPO,    0xffff},
+       {"",                    0xfffff800,     0,              SROM11_MCSBW205GHPO_1,  0xffff},
+       {"mcsbw405ghpo",        0xfffff800,     SRFL_MORE,      SROM11_MCSBW405GHPO,    0xffff},
+       {"",                    0xfffff800,     0,              SROM11_MCSBW405GHPO_1,  0xffff},
+       {"mcsbw805ghpo",        0xfffff800,     SRFL_MORE,      SROM11_MCSBW805GHPO,    0xffff},
+       {"",                    0xfffff800,     0,              SROM11_MCSBW805GHPO_1,  0xffff},
+       {"mcslr5glpo",          0xfffff800,     0,              SROM11_MCSLR5GLPO,      0x0fff},
+       {"mcslr5gmpo",          0xfffff800,     0,              SROM11_MCSLR5GMPO,      0xffff},
+       {"mcslr5ghpo",          0xfffff800,     0,              SROM11_MCSLR5GHPO,      0xffff},
+       {"sb20in40hrpo",        0xfffff800,     0,      SROM11_SB20IN40HRPO,            0xffff},
+       {"sb20in80and160hr5glpo", 0xfffff800,   0,      SROM11_SB20IN80AND160HR5GLPO,   0xffff},
+       {"sb40and80hr5glpo",      0xfffff800,   0,      SROM11_SB40AND80HR5GLPO,        0xffff},
+       {"sb20in80and160hr5gmpo", 0xfffff800,   0,      SROM11_SB20IN80AND160HR5GMPO,   0xffff},
+       {"sb40and80hr5gmpo",      0xfffff800,   0,      SROM11_SB40AND80HR5GMPO,        0xffff},
+       {"sb20in80and160hr5ghpo", 0xfffff800,   0,      SROM11_SB20IN80AND160HR5GHPO,   0xffff},
+       {"sb40and80hr5ghpo",      0xfffff800,   0,      SROM11_SB40AND80HR5GHPO,        0xffff},
+       {"sb20in40lrpo",          0xfffff800,   0,      SROM11_SB20IN40LRPO,            0xffff},
+       {"sb20in80and160lr5glpo", 0xfffff800,   0,      SROM11_SB20IN80AND160LR5GLPO,   0xffff},
+       {"sb40and80lr5glpo",      0xfffff800,   0,      SROM11_SB40AND80LR5GLPO,        0xffff},
+       {"sb20in80and160lr5gmpo", 0xfffff800,   0,      SROM11_SB20IN80AND160LR5GMPO,   0xffff},
+       {"sb40and80lr5gmpo",      0xfffff800,   0,      SROM11_SB40AND80LR5GMPO,        0xffff},
+       {"sb20in80and160lr5ghpo", 0xfffff800,   0,      SROM11_SB20IN80AND160LR5GHPO,   0xffff},
+       {"sb40and80lr5ghpo",      0xfffff800,   0,      SROM11_SB40AND80LR5GHPO,        0xffff},
+       {"dot11agduphrpo",        0xfffff800,   0,      SROM11_DOT11AGDUPHRPO,          0xffff},
+       {"dot11agduplrpo",        0xfffff800,   0,      SROM11_DOT11AGDUPLRPO,          0xffff},
+
+       /* Misc */
+       {"sar2g",               0xfffff800,     0,      SROM11_SAR,             0x00ff},
+       {"sar5g",               0xfffff800,     0,      SROM11_SAR,             0xff00},
+
+       {"noiselvl2ga0",        0xfffff800,     0,              SROM11_NOISELVL_2G,     0x001f},
+       {"noiselvl2ga1",        0xfffff800,     0,              SROM11_NOISELVL_2G,     0x03e0},
+       {"noiselvl2ga2",        0xfffff800,     0,              SROM11_NOISELVL_2G,     0x7c00},
+       {"noiselvl5ga0",        0xfffff800,     SRFL_ARRAY,     SROM11_NOISELVL_5GL,    0x001f},
+       {"",                    0xfffff800,     SRFL_ARRAY,     SROM11_NOISELVL_5GM,    0x001f},
+       {"",                    0xfffff800,     SRFL_ARRAY,     SROM11_NOISELVL_5GH,    0x001f},
+       {"",                    0xfffff800,     0,              SROM11_NOISELVL_5GU,    0x001f},
+       {"noiselvl5ga1",        0xfffff800,     SRFL_ARRAY,     SROM11_NOISELVL_5GL,    0x03e0},
+       {"",                    0xfffff800,     SRFL_ARRAY,     SROM11_NOISELVL_5GM,    0x03e0},
+       {"",                    0xfffff800,     SRFL_ARRAY,     SROM11_NOISELVL_5GH,    0x03e0},
+       {"",                    0xfffff800,     0,              SROM11_NOISELVL_5GU,    0x03e0},
+       {"noiselvl5ga2",        0xfffff800,     SRFL_ARRAY,     SROM11_NOISELVL_5GL,    0x7c00},
+       {"",                    0xfffff800,     SRFL_ARRAY,     SROM11_NOISELVL_5GM,    0x7c00},
+       {"",                    0xfffff800,     SRFL_ARRAY,     SROM11_NOISELVL_5GH,    0x7c00},
+       {"",                    0xfffff800,     0,              SROM11_NOISELVL_5GU,    0x7c00},
+       {"eu_edthresh2g",       0x00000800,     0,              SROM11_EU_EDCRSTH,      0x00ff},
+       {"eu_edthresh5g",       0x00000800,     0,              SROM11_EU_EDCRSTH,      0xff00},
+
+       {"rxgainerr2ga0",       0xfffff800,     0,              SROM11_RXGAINERR_2G,    0x003f},
+       {"rxgainerr2ga1",       0xfffff800,     0,              SROM11_RXGAINERR_2G,    0x07c0},
+       {"rxgainerr2ga2",       0xfffff800,     0,              SROM11_RXGAINERR_2G,    0xf800},
+       {"rxgainerr5ga0",       0xfffff800,     SRFL_ARRAY,     SROM11_RXGAINERR_5GL,   0x003f},
+       {"",                    0xfffff800,     SRFL_ARRAY,     SROM11_RXGAINERR_5GM,   0x003f},
+       {"",                    0xfffff800,     SRFL_ARRAY,     SROM11_RXGAINERR_5GH,   0x003f},
+       {"",                    0xfffff800,     0,              SROM11_RXGAINERR_5GU,   0x003f},
+       {"rxgainerr5ga1",       0xfffff800,     SRFL_ARRAY,     SROM11_RXGAINERR_5GL,   0x07c0},
+       {"",                    0xfffff800,     SRFL_ARRAY,     SROM11_RXGAINERR_5GM,   0x07c0},
+       {"",                    0xfffff800,     SRFL_ARRAY,     SROM11_RXGAINERR_5GH,   0x07c0},
+       {"",                    0xfffff800,     0,              SROM11_RXGAINERR_5GU,   0x07c0},
+       {"rxgainerr5ga2",       0xfffff800,     SRFL_ARRAY,     SROM11_RXGAINERR_5GL,   0xf800},
+       {"",                    0xfffff800,     SRFL_ARRAY,     SROM11_RXGAINERR_5GM,   0xf800},
+       {"",                    0xfffff800,     SRFL_ARRAY,     SROM11_RXGAINERR_5GH,   0xf800},
+       {"",                    0xfffff800,     0,              SROM11_RXGAINERR_5GU,   0xf800},
+       {"rpcal2g",             0xfffff800,     0,              SROM11_RPCAL_2G,        0xffff},
+       {"rpcal5gb0",           0xfffff800,     0,              SROM11_RPCAL_5GL,       0xffff},
+       {"rpcal5gb1",           0xfffff800,     0,              SROM11_RPCAL_5GM,       0xffff},
+       {"rpcal5gb2",           0xfffff800,     0,              SROM11_RPCAL_5GH,       0xffff},
+       {"rpcal5gb3",           0xfffff800,     0,              SROM11_RPCAL_5GU,       0xffff},
+       {"txidxcap2g",          0xfffff800,     0,              SROM11_TXIDXCAP2G,      0x0ff0},
+       {"txidxcap5g",          0xfffff800,     0,              SROM11_TXIDXCAP5G,      0x0ff0},
+       {"pdoffsetcckma0",      0xfffff800,     0,              SROM11_PDOFF_2G_CCK,    0x000f},
+       {"pdoffsetcckma1",      0xfffff800,     0,              SROM11_PDOFF_2G_CCK,    0x00f0},
+       {"pdoffsetcckma2",      0xfffff800,     0,              SROM11_PDOFF_2G_CCK,    0x0f00},
+
+       /* sromrev 12 */
+       {"boardflags4",         0xfffff000,     SRFL_PRHEX|SRFL_MORE,   SROM12_BFL6,    0xffff},
+       {"",    0,      0,                      SROM12_BFL7,    0xffff},
+       {"pdoffsetcck",         0xfffff000,     0,      SROM12_PDOFF_2G_CCK,       0xffff},
+       {"pdoffset20in40m5gb0", 0xfffff000,     0,      SROM12_PDOFF_20in40M_5G_B0,    0xffff},
+       {"pdoffset20in40m5gb1", 0xfffff000,     0,      SROM12_PDOFF_20in40M_5G_B1,    0xffff},
+       {"pdoffset20in40m5gb2", 0xfffff000,     0,      SROM12_PDOFF_20in40M_5G_B2,    0xffff},
+       {"pdoffset20in40m5gb3", 0xfffff000,     0,      SROM12_PDOFF_20in40M_5G_B3,    0xffff},
+       {"pdoffset20in40m5gb4", 0xfffff000,     0,      SROM12_PDOFF_20in40M_5G_B4,    0xffff},
+       {"pdoffset40in80m5gb0", 0xfffff000,     0,      SROM12_PDOFF_40in80M_5G_B0,    0xffff},
+       {"pdoffset40in80m5gb1", 0xfffff000,     0,      SROM12_PDOFF_40in80M_5G_B1,    0xffff},
+       {"pdoffset40in80m5gb2", 0xfffff000,     0,      SROM12_PDOFF_40in80M_5G_B2,    0xffff},
+       {"pdoffset40in80m5gb3", 0xfffff000,     0,      SROM12_PDOFF_40in80M_5G_B3,    0xffff},
+       {"pdoffset40in80m5gb4", 0xfffff000,     0,      SROM12_PDOFF_40in80M_5G_B4,    0xffff},
+       {"pdoffset20in80m5gb0", 0xfffff000,     0,      SROM12_PDOFF_20in80M_5G_B0,    0xffff},
+       {"pdoffset20in80m5gb1", 0xfffff000,     0,      SROM12_PDOFF_20in80M_5G_B1,    0xffff},
+       {"pdoffset20in80m5gb2", 0xfffff000,     0,      SROM12_PDOFF_20in80M_5G_B2,    0xffff},
+       {"pdoffset20in80m5gb3", 0xfffff000,     0,      SROM12_PDOFF_20in80M_5G_B3,    0xffff},
+       {"pdoffset20in80m5gb4", 0xfffff000,     0,      SROM12_PDOFF_20in80M_5G_B4,    0xffff},
+
+       {"pdoffset20in40m5gcore3",   0xffffe000, 0,     SROM13_PDOFFSET20IN40M5GCORE3,   0xffff},
+       {"pdoffset20in40m5gcore3_1", 0xffffe000, 0,     SROM13_PDOFFSET20IN40M5GCORE3_1, 0xffff},
+       {"pdoffset20in80m5gcore3",   0xffffe000, 0,     SROM13_PDOFFSET20IN80M5GCORE3,   0xffff},
+       {"pdoffset20in80m5gcore3_1", 0xffffe000, 0,     SROM13_PDOFFSET20IN80M5GCORE3_1, 0xffff},
+       {"pdoffset40in80m5gcore3",   0xffffe000, 0,     SROM13_PDOFFSET40IN80M5GCORE3,   0xffff},
+       {"pdoffset40in80m5gcore3_1", 0xffffe000, 0,     SROM13_PDOFFSET40IN80M5GCORE3_1, 0xffff},
+
+       {"pdoffset20in40m2g",        0xffffe000, 0,     SROM13_PDOFFSET20IN40M2G,        0xffff},
+       {"pdoffset20in40m2gcore3",   0xffffe000, 0,     SROM13_PDOFFSET20IN40M2GCORE3,   0xffff},
+
+       /* power per rate */
+       {"mcsbw205gx1po",       0xfffff000,     SRFL_MORE,      SROM12_MCSBW205GX1PO,   0xffff},
+       {"",                    0xfffff000,     0,              SROM12_MCSBW205GX1PO_1, 0xffff},
+       {"mcsbw405gx1po",       0xfffff000,     SRFL_MORE,      SROM12_MCSBW405GX1PO,   0xffff},
+       {"",                    0xfffff000,     0,              SROM12_MCSBW405GX1PO_1, 0xffff},
+       {"mcsbw805gx1po",       0xfffff000,     SRFL_MORE,      SROM12_MCSBW805GX1PO,   0xffff},
+       {"",                    0xfffff000,     0,              SROM12_MCSBW805GX1PO_1, 0xffff},
+       {"mcsbw205gx2po",       0xfffff000,     SRFL_MORE,      SROM12_MCSBW205GX2PO,   0xffff},
+       {"",                    0xfffff000,     0,              SROM12_MCSBW205GX2PO_1, 0xffff},
+       {"mcsbw405gx2po",       0xfffff000,     SRFL_MORE,      SROM12_MCSBW405GX2PO,   0xffff},
+       {"",                    0xfffff000,     0,              SROM12_MCSBW405GX2PO_1, 0xffff},
+       {"mcsbw805gx2po",       0xfffff000,     SRFL_MORE,      SROM12_MCSBW805GX2PO,   0xffff},
+       {"",                    0xfffff000,     0,              SROM12_MCSBW805GX2PO_1, 0xffff},
+
+       {"sb20in80and160hr5gx1po", 0xfffff000,  0,      SROM12_SB20IN80AND160HR5GX1PO,  0xffff},
+       {"sb40and80hr5gx1po",     0xfffff000,   0,      SROM12_SB40AND80HR5GX1PO,       0xffff},
+       {"sb20in80and160lr5gx1po", 0xfffff000,  0,      SROM12_SB20IN80AND160LR5GX1PO,  0xffff},
+       {"sb40and80hr5gx1po",     0xfffff000,   0,      SROM12_SB40AND80HR5GX1PO,       0xffff},
+       {"sb20in80and160hr5gx2po", 0xfffff000,  0,      SROM12_SB20IN80AND160HR5GX2PO,  0xffff},
+       {"sb40and80hr5gx2po",     0xfffff000,   0,      SROM12_SB40AND80HR5GX2PO,       0xffff},
+       {"sb20in80and160lr5gx2po", 0xfffff000,  0,      SROM12_SB20IN80AND160LR5GX2PO,  0xffff},
+       {"sb40and80hr5gx2po",     0xfffff000,   0,      SROM12_SB40AND80HR5GX2PO,       0xffff},
+
+       {"rxgains5gmelnagaina0",        0xfffff000,     0,       SROM12_RXGAINS10,      0x0007},
+       {"rxgains5gmelnagaina1",        0xfffff000,     0,       SROM12_RXGAINS11,      0x0007},
+       {"rxgains5gmelnagaina2",        0xfffff000,     0,       SROM12_RXGAINS12,      0x0007},
+       {"rxgains5gmtrisoa0",   0xfffff000,     0,       SROM12_RXGAINS10,      0x0078},
+       {"rxgains5gmtrisoa1",   0xfffff000,     0,       SROM12_RXGAINS11,      0x0078},
+       {"rxgains5gmtrisoa2",   0xfffff000,     0,       SROM12_RXGAINS12,      0x0078},
+       {"rxgains5gmtrelnabypa0", 0xfffff000,   0,       SROM12_RXGAINS10,      0x0080},
+       {"rxgains5gmtrelnabypa1", 0xfffff000,   0,       SROM12_RXGAINS11,      0x0080},
+       {"rxgains5gmtrelnabypa2", 0xfffff000,   0,       SROM12_RXGAINS12,      0x0080},
+       {"rxgains5ghelnagaina0",        0xfffff000,     0,       SROM12_RXGAINS10,      0x0700},
+       {"rxgains5ghelnagaina1",        0xfffff000,     0,       SROM12_RXGAINS11,      0x0700},
+       {"rxgains5ghelnagaina2",        0xfffff000,     0,       SROM12_RXGAINS12,      0x0700},
+       {"rxgains5ghtrisoa0",   0xfffff000,     0,       SROM12_RXGAINS10,      0x7800},
+       {"rxgains5ghtrisoa1",   0xfffff000,     0,       SROM12_RXGAINS11,      0x7800},
+       {"rxgains5ghtrisoa2",   0xfffff000,     0,       SROM12_RXGAINS12,      0x7800},
+       {"rxgains5ghtrelnabypa0", 0xfffff000,   0,       SROM12_RXGAINS10,      0x8000},
+       {"rxgains5ghtrelnabypa1", 0xfffff000,   0,       SROM12_RXGAINS11,      0x8000},
+       {"rxgains5ghtrelnabypa2", 0xfffff000,   0,       SROM12_RXGAINS12,      0x8000},
+       {"eu_edthresh2g",       0x00001000,     0,       SROM12_EU_EDCRSTH,     0x00ff},
+       {"eu_edthresh5g",       0x00001000,     0,       SROM12_EU_EDCRSTH,     0xff00},
+
+       {"gpdn",                0xfffff000,     SRFL_PRHEX|SRFL_MORE,   SROM12_GPDN_L,  0xffff},
+       {"",                    0,              0,                      SROM12_GPDN_H,  0xffff},
+
+       {"eu_edthresh2g",       0x00002000,     0,       SROM13_EU_EDCRSTH,     0x00ff},
+       {"eu_edthresh5g",       0x00002000,     0,       SROM13_EU_EDCRSTH,     0xff00},
+
+       {"agbg3",       0xffffe000,     0,              SROM13_ANTGAIN_BANDBGA, 0xff00},
+       {"aga3",        0xffffe000,     0,              SROM13_ANTGAIN_BANDBGA, 0x00ff},
+       {"noiselvl2ga3",        0xffffe000,     0,              SROM13_NOISELVLCORE3,   0x001f},
+       {"noiselvl5ga3",        0xffffe000,     SRFL_ARRAY,     SROM13_NOISELVLCORE3,   0x03e0},
+       {"",                    0xffffe000,     SRFL_ARRAY,     SROM13_NOISELVLCORE3,   0x7c00},
+       {"",                    0xffffe000,     SRFL_ARRAY,     SROM13_NOISELVLCORE3_1, 0x001f},
+       {"",                    0xffffe000,     0,              SROM13_NOISELVLCORE3_1, 0x03e0},
+       {"rxgainerr2ga3",       0xffffe000,     0,              SROM13_RXGAINERRCORE3,  0x001f},
+       {"rxgainerr5ga3",       0xffffe000,     SRFL_ARRAY,     SROM13_RXGAINERRCORE3,  0x03e0},
+       {"",                    0xffffe000,     SRFL_ARRAY,     SROM13_RXGAINERRCORE3,  0x7c00},
+       {"",                    0xffffe000,     SRFL_ARRAY,     SROM13_RXGAINERRCORE3_1, 0x001f},
+       {"",                    0xffffe000,     0,              SROM13_RXGAINERRCORE3_1, 0x03e0},
+       {"rxgains5gmelnagaina3",        0xffffe000,     0,       SROM13_RXGAINS1CORE3,  0x0007},
+       {"rxgains5gmtrisoa3",   0xffffe000,     0,       SROM13_RXGAINS1CORE3,  0x0078},
+       {"rxgains5gmtrelnabypa3", 0xffffe000,   0,       SROM13_RXGAINS1CORE3,  0x0080},
+       {"rxgains5ghelnagaina3",        0xffffe000,     0,       SROM13_RXGAINS1CORE3,  0x0700},
+       {"rxgains5ghtrisoa3",   0xffffe000,     0,       SROM13_RXGAINS1CORE3,  0x7800},
+       {"rxgains5ghtrelnabypa3", 0xffffe000,   0,       SROM13_RXGAINS1CORE3,  0x8000},
+
+       /* power per rate */
+       {"mcs1024qam2gpo",      0xffffe000,     0,           SROM13_MCS1024QAM2GPO,     0xffff},
+       {"mcs1024qam5glpo",     0xffffe000,     SRFL_MORE,   SROM13_MCS1024QAM5GLPO,    0xffff},
+       {"",                    0xffffe000,     0,           SROM13_MCS1024QAM5GLPO_1,  0xffff},
+       {"mcs1024qam5gmpo",     0xffffe000,     SRFL_MORE,   SROM13_MCS1024QAM5GMPO,    0xffff},
+       {"",                    0xffffe000,     0,           SROM13_MCS1024QAM5GMPO_1,  0xffff},
+       {"mcs1024qam5ghpo",     0xffffe000,     SRFL_MORE,   SROM13_MCS1024QAM5GHPO,    0xffff},
+       {"",                    0xffffe000,     0,           SROM13_MCS1024QAM5GHPO_1,  0xffff},
+       {"mcs1024qam5gx1po",    0xffffe000,     SRFL_MORE,   SROM13_MCS1024QAM5GX1PO,   0xffff},
+       {"",                    0xffffe000,     0,           SROM13_MCS1024QAM5GX1PO_1, 0xffff},
+       {"mcs1024qam5gx2po",    0xffffe000,     SRFL_MORE,   SROM13_MCS1024QAM5GX2PO,   0xffff},
+       {"",                    0xffffe000,     0,           SROM13_MCS1024QAM5GX2PO_1, 0xffff},
+
+       {"mcsbw1605glpo",       0xffffe000,     SRFL_MORE,      SROM13_MCSBW1605GLPO,   0xffff},
+       {"",                    0xffffe000,     0,              SROM13_MCSBW1605GLPO_1, 0xffff},
+       {"mcsbw1605gmpo",       0xffffe000,     SRFL_MORE,      SROM13_MCSBW1605GMPO,   0xffff},
+       {"",                    0xffffe000,     0,              SROM13_MCSBW1605GMPO_1, 0xffff},
+       {"mcsbw1605ghpo",       0xffffe000,     SRFL_MORE,      SROM13_MCSBW1605GHPO,   0xffff},
+       {"",                    0xffffe000,     0,              SROM13_MCSBW1605GHPO_1, 0xffff},
+       {"mcsbw1605gx1po",      0xffffe000,     SRFL_MORE,      SROM13_MCSBW1605GX1PO,  0xffff},
+       {"",                    0xffffe000,     0,      SROM13_MCSBW1605GX1PO_1,        0xffff},
+       {"mcsbw1605gx2po",      0xffffe000,     SRFL_MORE,      SROM13_MCSBW1605GX2PO,  0xffff},
+       {"",                    0xffffe000,     0,      SROM13_MCSBW1605GX2PO_1,        0xffff},
+
+       {"ulbpproffs2g",        0xffffe000,     0,      SROM13_ULBPPROFFS2G,            0xffff},
+
+       {"mcs8poexp",           0xffffe000,     SRFL_MORE,    SROM13_MCS8POEXP,         0xffff},
+       {"",                    0xffffe000,     0,            SROM13_MCS8POEXP_1,       0xffff},
+       {"mcs9poexp",           0xffffe000,     SRFL_MORE,    SROM13_MCS9POEXP,         0xffff},
+       {"",                    0xffffe000,     0,            SROM13_MCS9POEXP_1,       0xffff},
+       {"mcs10poexp",          0xffffe000,     SRFL_MORE,    SROM13_MCS10POEXP,        0xffff},
+       {"",                    0xffffe000,     0,            SROM13_MCS10POEXP_1,      0xffff},
+       {"mcs11poexp",          0xffffe000,     SRFL_MORE,    SROM13_MCS11POEXP,        0xffff},
+       {"",                    0xffffe000,     0,            SROM13_MCS11POEXP_1,      0xffff},
+
+       {"ulbpdoffs5gb0a0",     0xffffe000,     0,      SROM13_ULBPDOFFS5GB0A0,         0xffff},
+       {"ulbpdoffs5gb0a1",     0xffffe000,     0,      SROM13_ULBPDOFFS5GB0A1,         0xffff},
+       {"ulbpdoffs5gb0a2",     0xffffe000,     0,      SROM13_ULBPDOFFS5GB0A2,         0xffff},
+       {"ulbpdoffs5gb0a3",     0xffffe000,     0,      SROM13_ULBPDOFFS5GB0A3,         0xffff},
+       {"ulbpdoffs5gb1a0",     0xffffe000,     0,      SROM13_ULBPDOFFS5GB1A0,         0xffff},
+       {"ulbpdoffs5gb1a1",     0xffffe000,     0,      SROM13_ULBPDOFFS5GB1A1,         0xffff},
+       {"ulbpdoffs5gb1a2",     0xffffe000,     0,      SROM13_ULBPDOFFS5GB1A2,         0xffff},
+       {"ulbpdoffs5gb1a3",     0xffffe000,     0,      SROM13_ULBPDOFFS5GB1A3,         0xffff},
+       {"ulbpdoffs5gb2a0",     0xffffe000,     0,      SROM13_ULBPDOFFS5GB2A0,         0xffff},
+       {"ulbpdoffs5gb2a1",     0xffffe000,     0,      SROM13_ULBPDOFFS5GB2A1,         0xffff},
+       {"ulbpdoffs5gb2a2",     0xffffe000,     0,      SROM13_ULBPDOFFS5GB2A2,         0xffff},
+       {"ulbpdoffs5gb2a3",     0xffffe000,     0,      SROM13_ULBPDOFFS5GB2A3,         0xffff},
+       {"ulbpdoffs5gb3a0",     0xffffe000,     0,      SROM13_ULBPDOFFS5GB3A0,         0xffff},
+       {"ulbpdoffs5gb3a1",     0xffffe000,     0,      SROM13_ULBPDOFFS5GB3A1,         0xffff},
+       {"ulbpdoffs5gb3a2",     0xffffe000,     0,      SROM13_ULBPDOFFS5GB3A2,         0xffff},
+       {"ulbpdoffs5gb3a3",     0xffffe000,     0,      SROM13_ULBPDOFFS5GB3A3,         0xffff},
+       {"ulbpdoffs5gb4a0",     0xffffe000,     0,      SROM13_ULBPDOFFS5GB4A0,         0xffff},
+       {"ulbpdoffs5gb4a1",     0xffffe000,     0,      SROM13_ULBPDOFFS5GB4A1,         0xffff},
+       {"ulbpdoffs5gb4a2",     0xffffe000,     0,      SROM13_ULBPDOFFS5GB4A2,         0xffff},
+       {"ulbpdoffs5gb4a3",     0xffffe000,     0,      SROM13_ULBPDOFFS5GB4A3,         0xffff},
+       {"ulbpdoffs2ga0",       0xffffe000,     0,      SROM13_ULBPDOFFS2GA0,           0xffff},
+       {"ulbpdoffs2ga1",       0xffffe000,     0,      SROM13_ULBPDOFFS2GA1,           0xffff},
+       {"ulbpdoffs2ga2",       0xffffe000,     0,      SROM13_ULBPDOFFS2GA2,           0xffff},
+       {"ulbpdoffs2ga3",       0xffffe000,     0,      SROM13_ULBPDOFFS2GA3,           0xffff},
+
+       {"rpcal5gb4",           0xffffe000,     0,      SROM13_RPCAL5GB4,               0xffff},
+
+       {"sb20in40hrlrpox",     0xffffe000,     0,       SROM13_SB20IN40HRLRPOX,        0xffff},
+
+       {"pdoffset20in40m2g",   0xffffe000,     0,      SROM13_PDOFFSET20IN40M2G,       0xffff},
+       {"pdoffset20in40m2gcore3", 0xffffe000,  0,      SROM13_PDOFFSET20IN40M2GCORE3,  0xffff},
+
+       {"pdoffset20in40m5gcore3", 0xffffe000, SRFL_MORE, SROM13_PDOFFSET20IN40M5GCORE3, 0xffff},
+       {"",                    0xffffe000,     0,  SROM13_PDOFFSET20IN40M5GCORE3_1,   0xffff},
+       {"pdoffset40in80m5gcore3", 0xffffe000, SRFL_MORE, SROM13_PDOFFSET40IN80M5GCORE3, 0xffff},
+       {"",                    0xffffe000,     0,  SROM13_PDOFFSET40IN80M5GCORE3_1,   0xffff},
+       {"pdoffset20in80m5gcore3", 0xffffe000, SRFL_MORE, SROM13_PDOFFSET20IN80M5GCORE3, 0xffff},
+       {"",                    0xffffe000,     0,  SROM13_PDOFFSET20IN80M5GCORE3_1,   0xffff},
+
+       {"swctrlmap4_cfg",      0xffffe000,     0,      SROM13_SWCTRLMAP4_CFG,          0xffff},
+       {"swctrlmap4_TX2g_fem3to0", 0xffffe000, 0,      SROM13_SWCTRLMAP4_TX2G_FEM3TO0, 0xffff},
+       {"swctrlmap4_RX2g_fem3to0", 0xffffe000, 0,      SROM13_SWCTRLMAP4_RX2G_FEM3TO0, 0xffff},
+       {"swctrlmap4_RXByp2g_fem3to0", 0xffffe000, 0, SROM13_SWCTRLMAP4_RXBYP2G_FEM3TO0, 0xffff},
+       {"swctrlmap4_misc2g_fem3to0", 0xffffe000, 0,  SROM13_SWCTRLMAP4_MISC2G_FEM3TO0, 0xffff},
+       {"swctrlmap4_TX5g_fem3to0", 0xffffe000, 0,      SROM13_SWCTRLMAP4_TX5G_FEM3TO0, 0xffff},
+       {"swctrlmap4_RX5g_fem3to0", 0xffffe000, 0,      SROM13_SWCTRLMAP4_RX5G_FEM3TO0, 0xffff},
+       {"swctrlmap4_RXByp5g_fem3to0", 0xffffe000, 0, SROM13_SWCTRLMAP4_RXBYP5G_FEM3TO0, 0xffff},
+       {"swctrlmap4_misc5g_fem3to0", 0xffffe000, 0,  SROM13_SWCTRLMAP4_MISC5G_FEM3TO0, 0xffff},
+       {"swctrlmap4_TX2g_fem7to4", 0xffffe000, 0,      SROM13_SWCTRLMAP4_TX2G_FEM7TO4, 0xffff},
+       {"swctrlmap4_RX2g_fem7to4", 0xffffe000, 0,      SROM13_SWCTRLMAP4_RX2G_FEM7TO4, 0xffff},
+       {"swctrlmap4_RXByp2g_fem7to4", 0xffffe000, 0, SROM13_SWCTRLMAP4_RXBYP2G_FEM7TO4, 0xffff},
+       {"swctrlmap4_misc2g_fem7to4", 0xffffe000, 0,  SROM13_SWCTRLMAP4_MISC2G_FEM7TO4, 0xffff},
+       {"swctrlmap4_TX5g_fem7to4", 0xffffe000, 0,      SROM13_SWCTRLMAP4_TX5G_FEM7TO4, 0xffff},
+       {"swctrlmap4_RX5g_fem7to4", 0xffffe000, 0,      SROM13_SWCTRLMAP4_RX5G_FEM7TO4, 0xffff},
+       {"swctrlmap4_RXByp5g_fem7to4", 0xffffe000, 0, SROM13_SWCTRLMAP4_RXBYP5G_FEM7TO4, 0xffff},
+       {"swctrlmap4_misc5g_fem7to4", 0xffffe000, 0,  SROM13_SWCTRLMAP4_MISC5G_FEM7TO4, 0xffff},
+       {NULL,          0,              0,              0,                      0}
+};
+
+static const sromvar_t perpath_pci_sromvars[] = {
+       {"maxp2ga",     0x000000f0,     0,              SROM4_2G_ITT_MAXP,      0x00ff},
+       {"itt2ga",      0x000000f0,     0,              SROM4_2G_ITT_MAXP,      0xff00},
+       {"itt5ga",      0x000000f0,     0,              SROM4_5G_ITT_MAXP,      0xff00},
+       {"pa2gw0a",     0x000000f0,     SRFL_PRHEX,     SROM4_2G_PA,            0xffff},
+       {"pa2gw1a",     0x000000f0,     SRFL_PRHEX,     SROM4_2G_PA + 1,        0xffff},
+       {"pa2gw2a",     0x000000f0,     SRFL_PRHEX,     SROM4_2G_PA + 2,        0xffff},
+       {"pa2gw3a",     0x000000f0,     SRFL_PRHEX,     SROM4_2G_PA + 3,        0xffff},
+       {"maxp5ga",     0x000000f0,     0,              SROM4_5G_ITT_MAXP,      0x00ff},
+       {"maxp5gha",    0x000000f0,     0,              SROM4_5GLH_MAXP,        0x00ff},
+       {"maxp5gla",    0x000000f0,     0,              SROM4_5GLH_MAXP,        0xff00},
+       {"pa5gw0a",     0x000000f0,     SRFL_PRHEX,     SROM4_5G_PA,            0xffff},
+       {"pa5gw1a",     0x000000f0,     SRFL_PRHEX,     SROM4_5G_PA + 1,        0xffff},
+       {"pa5gw2a",     0x000000f0,     SRFL_PRHEX,     SROM4_5G_PA + 2,        0xffff},
+       {"pa5gw3a",     0x000000f0,     SRFL_PRHEX,     SROM4_5G_PA + 3,        0xffff},
+       {"pa5glw0a",    0x000000f0,     SRFL_PRHEX,     SROM4_5GL_PA,           0xffff},
+       {"pa5glw1a",    0x000000f0,     SRFL_PRHEX,     SROM4_5GL_PA + 1,       0xffff},
+       {"pa5glw2a",    0x000000f0,     SRFL_PRHEX,     SROM4_5GL_PA + 2,       0xffff},
+       {"pa5glw3a",    0x000000f0,     SRFL_PRHEX,     SROM4_5GL_PA + 3,       0xffff},
+       {"pa5ghw0a",    0x000000f0,     SRFL_PRHEX,     SROM4_5GH_PA,           0xffff},
+       {"pa5ghw1a",    0x000000f0,     SRFL_PRHEX,     SROM4_5GH_PA + 1,       0xffff},
+       {"pa5ghw2a",    0x000000f0,     SRFL_PRHEX,     SROM4_5GH_PA + 2,       0xffff},
+       {"pa5ghw3a",    0x000000f0,     SRFL_PRHEX,     SROM4_5GH_PA + 3,       0xffff},
+       {"maxp2ga",     0x00000700,     0,              SROM8_2G_ITT_MAXP,      0x00ff},
+       {"itt2ga",      0x00000700,     0,              SROM8_2G_ITT_MAXP,      0xff00},
+       {"itt5ga",      0x00000700,     0,              SROM8_5G_ITT_MAXP,      0xff00},
+       {"pa2gw0a",     0x00000700,     SRFL_PRHEX,     SROM8_2G_PA,            0xffff},
+       {"pa2gw1a",     0x00000700,     SRFL_PRHEX,     SROM8_2G_PA + 1,        0xffff},
+       {"pa2gw2a",     0x00000700,     SRFL_PRHEX,     SROM8_2G_PA + 2,        0xffff},
+       {"maxp5ga",     0x00000700,     0,              SROM8_5G_ITT_MAXP,      0x00ff},
+       {"maxp5gha",    0x00000700,     0,              SROM8_5GLH_MAXP,        0x00ff},
+       {"maxp5gla",    0x00000700,     0,              SROM8_5GLH_MAXP,        0xff00},
+       {"pa5gw0a",     0x00000700,     SRFL_PRHEX,     SROM8_5G_PA,            0xffff},
+       {"pa5gw1a",     0x00000700,     SRFL_PRHEX,     SROM8_5G_PA + 1,        0xffff},
+       {"pa5gw2a",     0x00000700,     SRFL_PRHEX,     SROM8_5G_PA + 2,        0xffff},
+       {"pa5glw0a",    0x00000700,     SRFL_PRHEX,     SROM8_5GL_PA,           0xffff},
+       {"pa5glw1a",    0x00000700,     SRFL_PRHEX,     SROM8_5GL_PA + 1,       0xffff},
+       {"pa5glw2a",    0x00000700,     SRFL_PRHEX,     SROM8_5GL_PA + 2,       0xffff},
+       {"pa5ghw0a",    0x00000700,     SRFL_PRHEX,     SROM8_5GH_PA,           0xffff},
+       {"pa5ghw1a",    0x00000700,     SRFL_PRHEX,     SROM8_5GH_PA + 1,       0xffff},
+       {"pa5ghw2a",    0x00000700,     SRFL_PRHEX,     SROM8_5GH_PA + 2,       0xffff},
+
+       /* sromrev 11 */
+       {"maxp2ga",     0xfffff800,     0,                       SROM11_2G_MAXP,        0x00ff},
+       {"pa2ga",       0x00000800,     SRFL_PRHEX | SRFL_ARRAY, SROM11_2G_PA,          0xffff},
+       {"",            0x00000800,     SRFL_PRHEX | SRFL_ARRAY, SROM11_2G_PA + 1,      0xffff},
+       {"",            0x00000800,     SRFL_PRHEX,              SROM11_2G_PA + 2,      0xffff},
+       {"rxgains5gmelnagaina", 0x00000800,     0,               SROM11_RXGAINS1,       0x0007},
+       {"rxgains5gmtrisoa",    0x00000800,     0,               SROM11_RXGAINS1,       0x0078},
+       {"rxgains5gmtrelnabypa", 0x00000800,    0,               SROM11_RXGAINS1,       0x0080},
+       {"rxgains5ghelnagaina", 0x00000800,     0,               SROM11_RXGAINS1,       0x0700},
+       {"rxgains5ghtrisoa",    0x00000800,     0,               SROM11_RXGAINS1,       0x7800},
+       {"rxgains5ghtrelnabypa", 0x00000800,    0,               SROM11_RXGAINS1,       0x8000},
+       {"rxgains2gelnagaina",  0x00000800,     0,               SROM11_RXGAINS,        0x0007},
+       {"rxgains2gtrisoa",     0x00000800,     0,               SROM11_RXGAINS,        0x0078},
+       {"rxgains2gtrelnabypa", 0x00000800,     0,               SROM11_RXGAINS,        0x0080},
+       {"rxgains5gelnagaina",  0x00000800,     0,               SROM11_RXGAINS,        0x0700},
+       {"rxgains5gtrisoa",     0x00000800,     0,               SROM11_RXGAINS,        0x7800},
+       {"rxgains5gtrelnabypa", 0x00000800,     0,               SROM11_RXGAINS,        0x8000},
+       {"maxp5ga",     0x00000800,     SRFL_ARRAY,              SROM11_5GB1B0_MAXP,    0x00ff},
+       {"",            0x00000800,     SRFL_ARRAY,              SROM11_5GB1B0_MAXP,    0xff00},
+       {"",            0x00000800,     SRFL_ARRAY,              SROM11_5GB3B2_MAXP,    0x00ff},
+       {"",            0x00000800,     0,                       SROM11_5GB3B2_MAXP,    0xff00},
+       {"pa5ga",       0x00000800,     SRFL_PRHEX | SRFL_ARRAY, SROM11_5GB0_PA,        0xffff},
+       {"",            0x00000800,     SRFL_PRHEX | SRFL_ARRAY, SROM11_5GB0_PA + 1,    0xffff},
+       {"",            0x00000800,     SRFL_PRHEX | SRFL_ARRAY, SROM11_5GB0_PA + 2,    0xffff},
+       {"",            0x00000800,     SRFL_PRHEX | SRFL_ARRAY, SROM11_5GB1_PA,        0xffff},
+       {"",            0x00000800,     SRFL_PRHEX | SRFL_ARRAY, SROM11_5GB1_PA + 1,    0xffff},
+       {"",            0x00000800,     SRFL_PRHEX | SRFL_ARRAY, SROM11_5GB1_PA + 2,    0xffff},
+       {"",            0x00000800,     SRFL_PRHEX | SRFL_ARRAY, SROM11_5GB2_PA,        0xffff},
+       {"",            0x00000800,     SRFL_PRHEX | SRFL_ARRAY, SROM11_5GB2_PA + 1,    0xffff},
+       {"",            0x00000800,     SRFL_PRHEX | SRFL_ARRAY, SROM11_5GB2_PA + 2,    0xffff},
+       {"",            0x00000800,     SRFL_PRHEX | SRFL_ARRAY, SROM11_5GB3_PA,        0xffff},
+       {"",            0x00000800,     SRFL_PRHEX | SRFL_ARRAY, SROM11_5GB3_PA + 1,    0xffff},
+       {"",            0x00000800,     SRFL_PRHEX,              SROM11_5GB3_PA + 2,    0xffff},
+
+       /* sromrev 12 */
+       {"maxp5gb4a",   0xfffff000,     0,               SROM12_5GB42G_MAXP,    0x00ff00},
+       {"pa2ga",       0xfffff000,     SRFL_PRHEX | SRFL_ARRAY,  SROM12_2GB0_PA_W0,    0x00ffff},
+       {"",    0xfffff000,     SRFL_PRHEX | SRFL_ARRAY,          SROM12_2GB0_PA_W1,    0x00ffff},
+       {"",    0xfffff000,     SRFL_PRHEX | SRFL_ARRAY,          SROM12_2GB0_PA_W2,    0x00ffff},
+       {"",    0xfffff000,     SRFL_PRHEX,              SROM12_2GB0_PA_W3,     0x00ffff},
+
+       {"pa2g40a",     0xfffff000,     SRFL_PRHEX | SRFL_ARRAY,  SROM12_2G40B0_PA_W0,  0x00ffff},
+       {"",    0xfffff000,     SRFL_PRHEX | SRFL_ARRAY,          SROM12_2G40B0_PA_W1,  0x00ffff},
+       {"",    0xfffff000,     SRFL_PRHEX | SRFL_ARRAY,          SROM12_2G40B0_PA_W2,  0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX,          SROM12_2G40B0_PA_W3,   0x00ffff},
+       {"maxp5gb0a",   0xfffff000, 0,       SROM12_5GB1B0_MAXP,        0x00ff},
+       {"maxp5gb1a",   0xfffff000, 0,       SROM12_5GB1B0_MAXP,        0x00ff00},
+       {"maxp5gb2a",   0xfffff000, 0,       SROM12_5GB3B2_MAXP,        0x00ff},
+       {"maxp5gb3a",   0xfffff000, 0,       SROM12_5GB3B2_MAXP,        0x00ff00},
+
+       {"pa5ga",   0xfffff000, SRFL_PRHEX | SRFL_ARRAY,   SROM12_5GB0_PA_W0,           0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5GB0_PA_W1,         0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5GB0_PA_W2,         0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5GB0_PA_W3,         0x00ffff},
+
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5GB1_PA_W0,         0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5GB1_PA_W1,         0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5GB1_PA_W2,         0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5GB1_PA_W3,         0x00ffff},
+
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5GB2_PA_W0,         0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5GB2_PA_W1,         0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5GB2_PA_W2,         0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5GB2_PA_W3,         0x00ffff},
+
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5GB3_PA_W0,         0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5GB3_PA_W1,         0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5GB3_PA_W2,         0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5GB3_PA_W3,         0x00ffff},
+
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5GB4_PA_W0,         0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5GB4_PA_W1,         0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5GB4_PA_W2,         0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX,                    SROM12_5GB4_PA_W3,           0x00ffff},
+
+       {"pa5g40a",     0xfffff000, SRFL_PRHEX | SRFL_ARRAY, SROM12_5G40B0_PA_W0,       0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5G40B0_PA_W1,       0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5G40B0_PA_W2,       0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5G40B0_PA_W3,       0x00ffff},
+
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5G40B1_PA_W0,       0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5G40B1_PA_W1,       0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5G40B1_PA_W2,       0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5G40B1_PA_W3,       0x00ffff},
+
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5G40B2_PA_W0,       0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5G40B2_PA_W1,       0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5G40B2_PA_W2,       0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5G40B2_PA_W3,       0x00ffff},
+
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5G40B3_PA_W0,       0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5G40B3_PA_W1,       0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5G40B3_PA_W2,       0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5G40B3_PA_W3,       0x00ffff},
+
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5G40B4_PA_W0,       0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5G40B4_PA_W1,       0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,         SROM12_5G40B4_PA_W2,       0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX,                      SROM12_5G40B4_PA_W3,       0x00ffff},
+
+       {"pa5g80a",     0xfffff000, SRFL_PRHEX | SRFL_ARRAY,     SROM12_5G80B0_PA_W0,   0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,             SROM12_5G80B0_PA_W1,   0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,             SROM12_5G80B0_PA_W2,   0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,             SROM12_5G80B0_PA_W3,   0x00ffff},
+
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,             SROM12_5G80B1_PA_W0,   0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,             SROM12_5G80B1_PA_W1,   0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,             SROM12_5G80B1_PA_W2,   0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,             SROM12_5G80B1_PA_W3,   0x00ffff},
+
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,             SROM12_5G80B2_PA_W0,   0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,             SROM12_5G80B2_PA_W1,   0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,             SROM12_5G80B2_PA_W2,   0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,             SROM12_5G80B2_PA_W3,   0x00ffff},
+
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,             SROM12_5G80B3_PA_W0,   0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,             SROM12_5G80B3_PA_W1,   0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,             SROM12_5G80B3_PA_W2,   0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,             SROM12_5G80B3_PA_W3,   0x00ffff},
+
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,             SROM12_5G80B4_PA_W0,   0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,             SROM12_5G80B4_PA_W1,   0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX | SRFL_ARRAY,             SROM12_5G80B4_PA_W2,   0x00ffff},
+       {"",    0xfffff000, SRFL_PRHEX,                          SROM12_5G80B4_PA_W3,   0x00ffff},
+       /* sromrev 13 */
+       {"rxgains2gelnagaina",   0xffffe000,     0,       SROM13_RXGAINS,  0x0007},
+       {"rxgains2gtrisoa",     0xffffe000,     0,       SROM13_RXGAINS,  0x0078},
+       {"rxgains2gtrelnabypa", 0xffffe000,     0,       SROM13_RXGAINS,  0x0080},
+       {"rxgains5gelnagaina",  0xffffe000,     0,       SROM13_RXGAINS,  0x0700},
+       {"rxgains5gtrisoa",     0xffffe000,     0,       SROM13_RXGAINS,  0x7800},
+       {"rxgains5gtrelnabypa", 0xffffe000,     0,       SROM13_RXGAINS,  0x8000},
+       {NULL,          0,              0,              0,                      0}
+};
+
+#if !(defined(PHY_TYPE_HT) && defined(PHY_TYPE_N))
+#define        PHY_TYPE_HT             7       /* HT-Phy value */
+#define        PHY_TYPE_N              4       /* N-Phy value */
+#endif /* !(defined(PHY_TYPE_HT) && defined(PHY_TYPE_N)) */
+#if !defined(PHY_TYPE_AC)
+#define        PHY_TYPE_AC             11      /* AC-Phy value */
+#endif /* !defined(PHY_TYPE_AC) */
+#if !defined(PHY_TYPE_LCN20)
+#define        PHY_TYPE_LCN20          12      /* LCN20-Phy value */
+#endif /* !defined(PHY_TYPE_LCN20) */
+#if !defined(PHY_TYPE_NULL)
+#define        PHY_TYPE_NULL           0xf     /* Invalid Phy value */
+#endif /* !defined(PHY_TYPE_NULL) */
+
+typedef struct {
+       uint16  phy_type;
+       uint16  bandrange;
+       uint16  chain;
+       const char *vars;
+} pavars_t;
+
+static const pavars_t pavars[] = {
+       /* HTPHY */
+       {PHY_TYPE_HT, WL_CHAN_FREQ_RANGE_2G,  0, "pa2gw0a0 pa2gw1a0 pa2gw2a0"},
+       {PHY_TYPE_HT, WL_CHAN_FREQ_RANGE_2G,  1, "pa2gw0a1 pa2gw1a1 pa2gw2a1"},
+       {PHY_TYPE_HT, WL_CHAN_FREQ_RANGE_2G,  2, "pa2gw0a2 pa2gw1a2 pa2gw2a2"},
+       {PHY_TYPE_HT, WL_CHAN_FREQ_RANGE_5G_BAND0, 0, "pa5glw0a0 pa5glw1a0 pa5glw2a0"},
+       {PHY_TYPE_HT, WL_CHAN_FREQ_RANGE_5G_BAND0, 1, "pa5glw0a1 pa5glw1a1 pa5glw2a1"},
+       {PHY_TYPE_HT, WL_CHAN_FREQ_RANGE_5G_BAND0, 2, "pa5glw0a2 pa5glw1a2 pa5glw2a2"},
+       {PHY_TYPE_HT, WL_CHAN_FREQ_RANGE_5G_BAND1, 0, "pa5gw0a0 pa5gw1a0 pa5gw2a0"},
+       {PHY_TYPE_HT, WL_CHAN_FREQ_RANGE_5G_BAND1, 1, "pa5gw0a1 pa5gw1a1 pa5gw2a1"},
+       {PHY_TYPE_HT, WL_CHAN_FREQ_RANGE_5G_BAND1, 2, "pa5gw0a2 pa5gw1a2 pa5gw2a2"},
+       {PHY_TYPE_HT, WL_CHAN_FREQ_RANGE_5G_BAND2, 0, "pa5ghw0a0 pa5ghw1a0 pa5ghw2a0"},
+       {PHY_TYPE_HT, WL_CHAN_FREQ_RANGE_5G_BAND2, 1, "pa5ghw0a1 pa5ghw1a1 pa5ghw2a1"},
+       {PHY_TYPE_HT, WL_CHAN_FREQ_RANGE_5G_BAND2, 2, "pa5ghw0a2 pa5ghw1a2 pa5ghw2a2"},
+       {PHY_TYPE_HT, WL_CHAN_FREQ_RANGE_5G_BAND3, 0, "pa5gw0a3 pa5gw1a3 pa5gw2a3"},
+       {PHY_TYPE_HT, WL_CHAN_FREQ_RANGE_5G_BAND3, 1,  "pa5glw0a3 pa5glw1a3 pa5glw2a3"},
+       {PHY_TYPE_HT, WL_CHAN_FREQ_RANGE_5G_BAND3, 2, "pa5ghw0a3 pa5ghw1a3 pa5ghw2a3"},
+       /* NPHY */
+       {PHY_TYPE_N, WL_CHAN_FREQ_RANGE_2G,  0, "pa2gw0a0 pa2gw1a0 pa2gw2a0"},
+       {PHY_TYPE_N, WL_CHAN_FREQ_RANGE_2G,  1, "pa2gw0a1 pa2gw1a1 pa2gw2a1"},
+       {PHY_TYPE_N, WL_CHAN_FREQ_RANGE_5G_BAND0, 0, "pa5glw0a0 pa5glw1a0 pa5glw2a0"},
+       {PHY_TYPE_N, WL_CHAN_FREQ_RANGE_5G_BAND0, 1, "pa5glw0a1 pa5glw1a1 pa5glw2a1"},
+       {PHY_TYPE_N, WL_CHAN_FREQ_RANGE_5G_BAND1, 0, "pa5gw0a0 pa5gw1a0 pa5gw2a0"},
+       {PHY_TYPE_N, WL_CHAN_FREQ_RANGE_5G_BAND1, 1, "pa5gw0a1 pa5gw1a1 pa5gw2a1"},
+       {PHY_TYPE_N, WL_CHAN_FREQ_RANGE_5G_BAND2, 0, "pa5ghw0a0 pa5ghw1a0 pa5ghw2a0"},
+       {PHY_TYPE_N, WL_CHAN_FREQ_RANGE_5G_BAND2, 1, "pa5ghw0a1 pa5ghw1a1 pa5ghw2a1"},
+       /* ACPHY */
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_2G,  0, "pa2ga0"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_2G,  1, "pa2ga1"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_2G,  2, "pa2ga2"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_4BAND,  0, "pa5ga0"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_4BAND,  1, "pa5ga1"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_4BAND,  2, "pa5ga2"},
+       /* LCN20PHY */
+       {PHY_TYPE_LCN20, WL_CHAN_FREQ_RANGE_2G,  0, "pa2ga0"},
+       {PHY_TYPE_NULL, 0, 0, ""}
+};
+
+
+static const pavars_t pavars_SROM12[] = {
+       /* ACPHY */
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_2G,  0, "pa2ga0"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_2G,  1, "pa2ga1"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_2G,  2, "pa2ga2"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_2G_40,  0, "pa2g40a0"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_2G_40,  1, "pa2g40a1"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_2G_40,  2, "pa2g40a2"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_5BAND,  0, "pa5ga0"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_5BAND,  1, "pa5ga1"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_5BAND,  2, "pa5ga2"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_5BAND_40,  0, "pa5g40a0"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_5BAND_40,  1, "pa5g40a1"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_5BAND_40,  2, "pa5g40a2"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_5BAND_80,  0, "pa5g80a0"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_5BAND_80,  1, "pa5g80a1"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_5BAND_80,  2, "pa5g80a2"},
+       {PHY_TYPE_NULL, 0, 0, ""}
+};
+
+static const pavars_t pavars_SROM13[] = {
+       /* ACPHY */
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_2G,  0, "pa2ga0"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_2G,  1, "pa2ga1"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_2G,  2, "pa2ga2"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_2G,  3, "pa2ga3"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_2G_40,  0, "pa2g40a0"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_2G_40,  1, "pa2g40a1"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_2G_40,  2, "pa2g40a2"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_2G_40,  3, "pa2g40a3"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_5BAND,  0, "pa5ga0"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_5BAND,  1, "pa5ga1"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_5BAND,  2, "pa5ga2"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_5BAND,  3, "pa5ga3"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_5BAND_40,  0, "pa5g40a0"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_5BAND_40,  1, "pa5g40a1"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_5BAND_40,  2, "pa5g40a2"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_5BAND_40,  3, "pa5g40a3"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_5BAND_80,  0, "pa5g80a0"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_5BAND_80,  1, "pa5g80a1"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_5BAND_80,  2, "pa5g80a2"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_5BAND_80,  3, "pa5g80a3"},
+       {PHY_TYPE_NULL, 0, 0, ""}
+};
+
+/* pavars table when paparambwver is 1 */
+static const pavars_t pavars_bwver_1[] = {
+       /* ACPHY */
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_2G,  0, "pa2ga0"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_2G,  1, "pa2gccka0"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_2G,  1, "pa2ga2"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_4BAND,  0, "pa5ga0"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_4BAND,  1, "pa5gbw40a0"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_4BAND,  2, "pa5gbw80a0"},
+       {PHY_TYPE_NULL, 0, 0, ""}
+};
+
+/* pavars table when paparambwver is 2 */
+static const pavars_t pavars_bwver_2[] = {
+       /* ACPHY */
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_2G,  0, "pa2ga0"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_2G,  1, "pa2ga1"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_4BAND,  0, "pa5ga0"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_4BAND,  1, "pa5ga1"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_4BAND,  2, "pa5gbw4080a0"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_4BAND,  3, "pa5gbw4080a1"},
+       {PHY_TYPE_NULL, 0, 0, ""}
+};
+
+/* pavars table when paparambwver is 3 */
+static const pavars_t pavars_bwver_3[] = {
+       /* ACPHY */
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_2G,  0, "pa2ga0"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_2G,  1, "pa2ga1"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_2G,  2, "pa2gccka0"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_2G,  3, "pa2gccka1"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_4BAND,  0, "pa5ga0"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_4BAND,  1, "pa5ga1"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_4BAND,  2, "pa5gbw4080a0"},
+       {PHY_TYPE_AC, WL_CHAN_FREQ_RANGE_5G_4BAND,  3, "pa5gbw4080a1"},
+       {PHY_TYPE_NULL, 0, 0, ""}
+};
+
+typedef struct {
+       uint16  phy_type;
+       uint16  bandrange;
+       const char *vars;
+} povars_t;
+
+static const povars_t povars[] = {
+       /* NPHY */
+       {PHY_TYPE_N, WL_CHAN_FREQ_RANGE_2G,  "mcs2gpo0 mcs2gpo1 mcs2gpo2 mcs2gpo3 "
+       "mcs2gpo4 mcs2gpo5 mcs2gpo6 mcs2gpo7"},
+       {PHY_TYPE_N, WL_CHAN_FREQ_RANGE_5GL, "mcs5glpo0 mcs5glpo1 mcs5glpo2 mcs5glpo3 "
+       "mcs5glpo4 mcs5glpo5 mcs5glpo6 mcs5glpo7"},
+       {PHY_TYPE_N, WL_CHAN_FREQ_RANGE_5GM, "mcs5gpo0 mcs5gpo1 mcs5gpo2 mcs5gpo3 "
+       "mcs5gpo4 mcs5gpo5 mcs5gpo6 mcs5gpo7"},
+       {PHY_TYPE_N, WL_CHAN_FREQ_RANGE_5GH, "mcs5ghpo0 mcs5ghpo1 mcs5ghpo2 mcs5ghpo3 "
+       "mcs5ghpo4 mcs5ghpo5 mcs5ghpo6 mcs5ghpo7"},
+       {PHY_TYPE_NULL, 0, ""}
+};
+
+typedef struct {
+       uint8   tag;            /* Broadcom subtag name */
+       uint32  revmask;        /* Supported cis_sromrev bitmask. Some of the parameters in
+                                * different tuples have the same name. Therefore, the MFGc tool
+                                * needs to know which tuple to generate when seeing these
+                                * parameters (given that we know sromrev from user input, like the
+                                * nvram file).
+                                */
+       uint8   len;            /* Length field of the tuple, note that it includes the
+                                * subtag name (1 byte): 1 + tuple content length
+                                */
+       const char *params;
+} cis_tuple_t;
+
+#define OTP_RAW                (0xff - 1)      /* Reserved tuple number for wrvar Raw input */
+#define OTP_VERS_1     (0xff - 2)      /* CISTPL_VERS_1 */
+#define OTP_MANFID     (0xff - 3)      /* CISTPL_MANFID */
+#define OTP_RAW1       (0xff - 4)      /* Like RAW, but comes first */
+
+/** this array is used by CIS creating/writing applications */
+static const cis_tuple_t cis_hnbuvars[] = {
+/*       tag                   revmask   len  params */
+       {OTP_RAW1,              0xffffffff, 0, ""},     /* special case */
+       {OTP_VERS_1,    0xffffffff, 0, "smanf sproductname"},   /* special case (non BRCM tuple) */
+       {OTP_MANFID,    0xffffffff, 4, "2manfid 2prodid"},      /* special case (non BRCM tuple) */
+       /* Unified OTP: tupple to embed USB manfid inside SDIO CIS */
+       {HNBU_UMANFID,          0xffffffff, 8, "8usbmanfid"},
+       {HNBU_SROMREV,          0xffffffff, 2, "1sromrev"},
+       /* NOTE: subdevid is also written to boardtype.
+        *       Need to write HNBU_BOARDTYPE to change it if it is different.
+        */
+       {HNBU_CHIPID,           0xffffffff, 11, "2vendid 2devid 2chiprev 2subvendid 2subdevid"},
+       {HNBU_BOARDREV,         0xffffffff, 3, "2boardrev"},
+       {HNBU_PAPARMS,          0xffffffff, 10, "2pa0b0 2pa0b1 2pa0b2 1pa0itssit 1pa0maxpwr 1opo"},
+       {HNBU_AA,               0xffffffff, 3, "1aa2g 1aa5g"},
+       {HNBU_AA,               0xffffffff, 3, "1aa0 1aa1"}, /* backward compatibility */
+       {HNBU_AG,               0xffffffff, 5, "1ag0 1ag1 1ag2 1ag3"},
+       {HNBU_BOARDFLAGS,       0xffffffff, 21, "4boardflags 4boardflags2 4boardflags3 "
+       "4boardflags4 4boardflags5 "},
+       {HNBU_LEDS,             0xffffffff, 17, "1ledbh0 1ledbh1 1ledbh2 1ledbh3 1ledbh4 1ledbh5 "
+       "1ledbh6 1ledbh7 1ledbh8 1ledbh9 1ledbh10 1ledbh11 1ledbh12 1ledbh13 1ledbh14 1ledbh15"},
+       {HNBU_CCODE,            0xffffffff, 4, "2ccode 1cctl"},
+       {HNBU_CCKPO,            0xffffffff, 3, "2cckpo"},
+       {HNBU_OFDMPO,           0xffffffff, 5, "4ofdmpo"},
+       {HNBU_PAPARMS5G,        0xffffffff, 23, "2pa1b0 2pa1b1 2pa1b2 2pa1lob0 2pa1lob1 2pa1lob2 "
+       "2pa1hib0 2pa1hib1 2pa1hib2 1pa1itssit "
+       "1pa1maxpwr 1pa1lomaxpwr 1pa1himaxpwr"},
+       {HNBU_RDLID,            0xffffffff, 3, "2rdlid"},
+       {HNBU_RSSISMBXA2G, 0xffffffff, 3, "0rssismf2g 0rssismc2g "
+       "0rssisav2g 0bxa2g"}, /* special case */
+       {HNBU_RSSISMBXA5G, 0xffffffff, 3, "0rssismf5g 0rssismc5g "
+       "0rssisav5g 0bxa5g"}, /* special case */
+       {HNBU_XTALFREQ,         0xffffffff, 5, "4xtalfreq"},
+       {HNBU_TRI2G,            0xffffffff, 2, "1tri2g"},
+       {HNBU_TRI5G,            0xffffffff, 4, "1tri5gl 1tri5g 1tri5gh"},
+       {HNBU_RXPO2G,           0xffffffff, 2, "1rxpo2g"},
+       {HNBU_RXPO5G,           0xffffffff, 2, "1rxpo5g"},
+       {HNBU_BOARDNUM,         0xffffffff, 3, "2boardnum"},
+       {HNBU_MACADDR,          0xffffffff, 7, "6macaddr"},     /* special case */
+       {HNBU_RDLSN,            0xffffffff, 3, "2rdlsn"},
+       {HNBU_BOARDTYPE,        0xffffffff, 3, "2boardtype"},
+       {HNBU_LEDDC,            0xffffffff, 3, "2leddc"},
+       {HNBU_RDLRNDIS,         0xffffffff, 2, "1rdlndis"},
+       {HNBU_CHAINSWITCH,      0xffffffff, 5, "1txchain 1rxchain 2antswitch"},
+       {HNBU_REGREV,           0xffffffff, 2, "1regrev"},
+       {HNBU_FEM,              0x000007fe, 5, "0antswctl2g 0triso2g 0pdetrange2g 0extpagain2g "
+       "0tssipos2g 0antswctl5g 0triso5g 0pdetrange5g 0extpagain5g 0tssipos5g"}, /* special case */
+       {HNBU_PAPARMS_C0,       0x000007fe, 31, "1maxp2ga0 1itt2ga0 2pa2gw0a0 2pa2gw1a0 "
+       "2pa2gw2a0 1maxp5ga0 1itt5ga0 1maxp5gha0 1maxp5gla0 2pa5gw0a0 2pa5gw1a0 2pa5gw2a0 "
+       "2pa5glw0a0 2pa5glw1a0 2pa5glw2a0 2pa5ghw0a0 2pa5ghw1a0 2pa5ghw2a0"},
+       {HNBU_PAPARMS_C1,       0x000007fe, 31, "1maxp2ga1 1itt2ga1 2pa2gw0a1 2pa2gw1a1 "
+       "2pa2gw2a1 1maxp5ga1 1itt5ga1 1maxp5gha1 1maxp5gla1 2pa5gw0a1 2pa5gw1a1 2pa5gw2a1 "
+       "2pa5glw0a1 2pa5glw1a1 2pa5glw2a1 2pa5ghw0a1 2pa5ghw1a1 2pa5ghw2a1"},
+       {HNBU_PO_CCKOFDM,       0xffffffff, 19, "2cck2gpo 4ofdm2gpo 4ofdm5gpo 4ofdm5glpo "
+       "4ofdm5ghpo"},
+       {HNBU_PO_MCS2G,         0xffffffff, 17, "2mcs2gpo0 2mcs2gpo1 2mcs2gpo2 2mcs2gpo3 "
+       "2mcs2gpo4 2mcs2gpo5 2mcs2gpo6 2mcs2gpo7"},
+       {HNBU_PO_MCS5GM,        0xffffffff, 17, "2mcs5gpo0 2mcs5gpo1 2mcs5gpo2 2mcs5gpo3 "
+       "2mcs5gpo4 2mcs5gpo5 2mcs5gpo6 2mcs5gpo7"},
+       {HNBU_PO_MCS5GLH,       0xffffffff, 33, "2mcs5glpo0 2mcs5glpo1 2mcs5glpo2 2mcs5glpo3 "
+       "2mcs5glpo4 2mcs5glpo5 2mcs5glpo6 2mcs5glpo7 "
+       "2mcs5ghpo0 2mcs5ghpo1 2mcs5ghpo2 2mcs5ghpo3 "
+       "2mcs5ghpo4 2mcs5ghpo5 2mcs5ghpo6 2mcs5ghpo7"},
+       {HNBU_CCKFILTTYPE,      0xffffffff, 2, "1cckdigfilttype"},
+       {HNBU_PO_CDD,           0xffffffff, 3, "2cddpo"},
+       {HNBU_PO_STBC,          0xffffffff, 3, "2stbcpo"},
+       {HNBU_PO_40M,           0xffffffff, 3, "2bw40po"},
+       {HNBU_PO_40MDUP,        0xffffffff, 3, "2bwduppo"},
+       {HNBU_RDLRWU,           0xffffffff, 2, "1rdlrwu"},
+       {HNBU_WPS,              0xffffffff, 3, "1wpsgpio 1wpsled"},
+       {HNBU_USBFS,            0xffffffff, 2, "1usbfs"},
+       {HNBU_ELNA2G,           0xffffffff, 2, "1elna2g"},
+       {HNBU_ELNA5G,           0xffffffff, 2, "1elna5g"},
+       {HNBU_CUSTOM1,          0xffffffff, 5, "4customvar1"},
+       {OTP_RAW,               0xffffffff, 0, ""},     /* special case */
+       {HNBU_OFDMPO5G,         0xffffffff, 13, "4ofdm5gpo 4ofdm5glpo 4ofdm5ghpo"},
+       {HNBU_USBEPNUM,         0xffffffff, 3, "2usbepnum"},
+       {HNBU_CCKBW202GPO,      0xffffffff, 7, "2cckbw202gpo 2cckbw20ul2gpo 2cckbw20in802gpo"},
+       {HNBU_LEGOFDMBW202GPO,  0xffffffff, 9, "4legofdmbw202gpo 4legofdmbw20ul2gpo"},
+       {HNBU_LEGOFDMBW205GPO,  0xffffffff, 25, "4legofdmbw205glpo 4legofdmbw20ul5glpo "
+       "4legofdmbw205gmpo 4legofdmbw20ul5gmpo 4legofdmbw205ghpo 4legofdmbw20ul5ghpo"},
+       {HNBU_MCS2GPO,  0xffffffff, 17, "4mcsbw202gpo 4mcsbw20ul2gpo 4mcsbw402gpo 4mcsbw802gpo"},
+       {HNBU_MCS5GLPO, 0xffffffff, 13, "4mcsbw205glpo 4mcsbw20ul5glpo 4mcsbw405glpo"},
+       {HNBU_MCS5GMPO, 0xffffffff, 13, "4mcsbw205gmpo 4mcsbw20ul5gmpo 4mcsbw405gmpo"},
+       {HNBU_MCS5GHPO, 0xffffffff, 13, "4mcsbw205ghpo 4mcsbw20ul5ghpo 4mcsbw405ghpo"},
+       {HNBU_MCS32PO,  0xffffffff, 3,  "2mcs32po"},
+       {HNBU_LEG40DUPPO,       0xffffffff, 3,  "2legofdm40duppo"},
+       {HNBU_TEMPTHRESH,       0xffffffff, 7,  "1tempthresh 0temps_period 0temps_hysteresis "
+       "1tempoffset 1tempsense_slope 0tempcorrx 0tempsense_option "
+       "1phycal_tempdelta"}, /* special case */
+       {HNBU_MUXENAB,          0xffffffff, 2,  "1muxenab"},
+       {HNBU_FEM_CFG,          0xfffff800, 5,  "0femctrl 0papdcap2g 0tworangetssi2g 0pdgain2g "
+       "0epagain2g 0tssiposslope2g 0gainctrlsph 0papdcap5g 0tworangetssi5g 0pdgain5g 0epagain5g "
+       "0tssiposslope5g"}, /* special case */
+       {HNBU_ACPA_C0,          0xfffff800, 39, "2subband5gver 2maxp2ga0 2*3pa2ga0 "
+       "1*4maxp5ga0 2*12pa5ga0"},
+       {HNBU_ACPA_C1,          0xfffff800, 37, "2maxp2ga1 2*3pa2ga1 1*4maxp5ga1 2*12pa5ga1"},
+       {HNBU_ACPA_C2,          0xfffff800, 37, "2maxp2ga2 2*3pa2ga2 1*4maxp5ga2 2*12pa5ga2"},
+       {HNBU_MEAS_PWR,         0xfffff800, 5,  "1measpower 1measpower1 1measpower2 2rawtempsense"},
+       {HNBU_PDOFF,            0xfffff800, 13, "2pdoffset40ma0 2pdoffset40ma1 2pdoffset40ma2 "
+       "2pdoffset80ma0 2pdoffset80ma1 2pdoffset80ma2"},
+       {HNBU_ACPPR_2GPO,       0xfffff800, 13, "2dot11agofdmhrbw202gpo 2ofdmlrbw202gpo "
+       "2sb20in40dot11agofdm2gpo 2sb20in80dot11agofdm2gpo 2sb20in40ofdmlrbw202gpo "
+       "2sb20in80ofdmlrbw202gpo"},
+       {HNBU_ACPPR_5GPO,       0xfffff800, 59, "4mcsbw805glpo 4mcsbw1605glpo 4mcsbw805gmpo "
+       "4mcsbw1605gmpo 4mcsbw805ghpo 4mcsbw1605ghpo 2mcslr5glpo 2mcslr5gmpo 2mcslr5ghpo "
+       "4mcsbw80p805glpo 4mcsbw80p805gmpo 4mcsbw80p805ghpo 4mcsbw80p805gx1po 2mcslr5gx1po "
+       "2mcslr5g80p80po 4mcsbw805gx1po 4mcsbw1605gx1po"},
+       {HNBU_MCS5Gx1PO,        0xfffff800, 9,  "4mcsbw205gx1po 4mcsbw405gx1po"},
+       {HNBU_ACPPR_SBPO,       0xfffff800, 49, "2sb20in40hrpo 2sb20in80and160hr5glpo "
+       "2sb40and80hr5glpo 2sb20in80and160hr5gmpo 2sb40and80hr5gmpo 2sb20in80and160hr5ghpo "
+       "2sb40and80hr5ghpo 2sb20in40lrpo 2sb20in80and160lr5glpo 2sb40and80lr5glpo "
+       "2sb20in80and160lr5gmpo 2sb40and80lr5gmpo 2sb20in80and160lr5ghpo 2sb40and80lr5ghpo "
+       "4dot11agduphrpo 4dot11agduplrpo 2sb20in40and80hrpo 2sb20in40and80lrpo "
+       "2sb20in80and160hr5gx1po 2sb20in80and160lr5gx1po 2sb40and80hr5gx1po 2sb40and80lr5gx1po "
+       },
+       {HNBU_ACPPR_SB8080_PO, 0xfffff800, 23, "2sb2040and80in80p80hr5glpo "
+       "2sb2040and80in80p80lr5glpo 2sb2040and80in80p80hr5gmpo "
+       "2sb2040and80in80p80lr5gmpo 2sb2040and80in80p80hr5ghpo 2sb2040and80in80p80lr5ghpo "
+       "2sb2040and80in80p80hr5gx1po 2sb2040and80in80p80lr5gx1po 2sb20in80p80hr5gpo "
+       "2sb20in80p80lr5gpo 2dot11agduppo"},
+       {HNBU_NOISELVL,         0xfffff800, 16, "1noiselvl2ga0 1noiselvl2ga1 1noiselvl2ga2 "
+       "1*4noiselvl5ga0 1*4noiselvl5ga1 1*4noiselvl5ga2"},
+       {HNBU_RXGAIN_ERR,       0xfffff800, 16, "1rxgainerr2ga0 1rxgainerr2ga1 1rxgainerr2ga2 "
+       "1*4rxgainerr5ga0 1*4rxgainerr5ga1 1*4rxgainerr5ga2"},
+       {HNBU_AGBGA,            0xfffff800, 7, "1agbg0 1agbg1 1agbg2 1aga0 1aga1 1aga2"},
+       {HNBU_USBDESC_COMPOSITE, 0xffffffff, 3, "2usbdesc_composite"},
+       {HNBU_UUID,             0xffffffff, 17, "16uuid"},
+       {HNBU_WOWLGPIO,         0xffffffff, 2,  "1wowl_gpio"},
+       {HNBU_ACRXGAINS_C0,     0xfffff800, 5, "0rxgains5gtrelnabypa0 0rxgains5gtrisoa0 "
+       "0rxgains5gelnagaina0 0rxgains2gtrelnabypa0 0rxgains2gtrisoa0 0rxgains2gelnagaina0 "
+       "0rxgains5ghtrelnabypa0 0rxgains5ghtrisoa0 0rxgains5ghelnagaina0 0rxgains5gmtrelnabypa0 "
+       "0rxgains5gmtrisoa0 0rxgains5gmelnagaina0"},    /* special case */
+       {HNBU_ACRXGAINS_C1,     0xfffff800, 5, "0rxgains5gtrelnabypa1 0rxgains5gtrisoa1 "
+       "0rxgains5gelnagaina1 0rxgains2gtrelnabypa1 0rxgains2gtrisoa1 0rxgains2gelnagaina1 "
+       "0rxgains5ghtrelnabypa1 0rxgains5ghtrisoa1 0rxgains5ghelnagaina1 0rxgains5gmtrelnabypa1 "
+       "0rxgains5gmtrisoa1 0rxgains5gmelnagaina1"},    /* special case */
+       {HNBU_ACRXGAINS_C2,     0xfffff800, 5, "0rxgains5gtrelnabypa2 0rxgains5gtrisoa2 "
+       "0rxgains5gelnagaina2 0rxgains2gtrelnabypa2 0rxgains2gtrisoa2 0rxgains2gelnagaina2 "
+       "0rxgains5ghtrelnabypa2 0rxgains5ghtrisoa2 0rxgains5ghelnagaina2 0rxgains5gmtrelnabypa2 "
+       "0rxgains5gmtrisoa2 0rxgains5gmelnagaina2"},    /* special case */
+       {HNBU_TXDUTY,           0xfffff800, 9,  "2tx_duty_cycle_ofdm_40_5g "
+       "2tx_duty_cycle_thresh_40_5g 2tx_duty_cycle_ofdm_80_5g 2tx_duty_cycle_thresh_80_5g"},
+       {HNBU_PDOFF_2G,         0xfffff800, 3,  "0pdoffset2g40ma0 0pdoffset2g40ma1 "
+       "0pdoffset2g40ma2 0pdoffset2g40mvalid"},
+       {HNBU_ACPA_CCK,         0xfffff800, 7,  "2*3pa2gccka0"},
+       {HNBU_ACPA_40,          0xfffff800, 25, "2*12pa5gbw40a0"},
+       {HNBU_ACPA_80,          0xfffff800, 25, "2*12pa5gbw80a0"},
+       {HNBU_ACPA_4080,        0xfffff800, 49, "2*12pa5gbw4080a0 2*12pa5gbw4080a1"},
+       {HNBU_SUBBAND5GVER,     0xfffff800, 3,  "2subband5gver"},
+       {HNBU_PAPARAMBWVER,     0xfffff800, 2,  "1paparambwver"},
+       {HNBU_TXBFRPCALS,  0xfffff800, 11,
+       "2rpcal2g 2rpcal5gb0 2rpcal5gb1 2rpcal5gb2 2rpcal5gb3"}, /* txbf rpcalvars */
+       {HNBU_GPIO_PULL_DOWN,   0xffffffff, 5, "4gpdn"},
+       {0xFF,                  0xffffffff, 0, ""}
+};
+
+#endif /* _bcmsrom_tbl_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/bcmutils.h b/drivers/net/wireless/bcmdhd_1363/include/bcmutils.h
new file mode 100644 (file)
index 0000000..e750f30
--- /dev/null
@@ -0,0 +1,1304 @@
+/*
+ * Misc useful os-independent macros and functions.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmutils.h 665091 2017-05-19 06:11:53Z $
+ */
+
+#ifndef        _bcmutils_h_
+#define        _bcmutils_h_
+
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+#define bcm_strncpy_s(dst, noOfElements, src, count)    strncpy((dst), (src), (count))
+#define bcm_strncat_s(dst, noOfElements, src, count)    strncat((dst), (src), (count))
+#define bcm_snprintf_s snprintf
+#define bcm_sprintf_s snprintf
+
+/*
+ * #define bcm_strcpy_s(dst, count, src)            strncpy((dst), (src), (count))
+ * Use bcm_strcpy_s instead as it is a safer option
+ * bcm_strcat_s: Use bcm_strncat_s as a safer option
+ *
+ */
+
+/* ctype replacement */
+#define _BCM_U 0x01    /* upper */
+#define _BCM_L 0x02    /* lower */
+#define _BCM_D 0x04    /* digit */
+#define _BCM_C 0x08    /* cntrl */
+#define _BCM_P 0x10    /* punct */
+#define _BCM_S 0x20    /* white space (space/lf/tab) */
+#define _BCM_X 0x40    /* hex digit */
+#define _BCM_SP        0x80    /* hard space (0x20) */
+
+extern const unsigned char bcm_ctype[];
+#define bcm_ismask(x)  (bcm_ctype[(int)(unsigned char)(x)])
+
+#define bcm_isalnum(c) ((bcm_ismask(c)&(_BCM_U|_BCM_L|_BCM_D)) != 0)
+#define bcm_isalpha(c) ((bcm_ismask(c)&(_BCM_U|_BCM_L)) != 0)
+#define bcm_iscntrl(c) ((bcm_ismask(c)&(_BCM_C)) != 0)
+#define bcm_isdigit(c) ((bcm_ismask(c)&(_BCM_D)) != 0)
+#define bcm_isgraph(c) ((bcm_ismask(c)&(_BCM_P|_BCM_U|_BCM_L|_BCM_D)) != 0)
+#define bcm_islower(c) ((bcm_ismask(c)&(_BCM_L)) != 0)
+#define bcm_isprint(c) ((bcm_ismask(c)&(_BCM_P|_BCM_U|_BCM_L|_BCM_D|_BCM_SP)) != 0)
+#define bcm_ispunct(c) ((bcm_ismask(c)&(_BCM_P)) != 0)
+#define bcm_isspace(c) ((bcm_ismask(c)&(_BCM_S)) != 0)
+#define bcm_isupper(c) ((bcm_ismask(c)&(_BCM_U)) != 0)
+#define bcm_isxdigit(c)        ((bcm_ismask(c)&(_BCM_D|_BCM_X)) != 0)
+#define bcm_tolower(c) (bcm_isupper((c)) ? ((c) + 'a' - 'A') : (c))
+#define bcm_toupper(c) (bcm_islower((c)) ? ((c) + 'A' - 'a') : (c))
+
+#define CIRCULAR_ARRAY_FULL(rd_idx, wr_idx, max) ((wr_idx + 1)%max == rd_idx)
+
+#define KB(bytes)      (((bytes) + 1023) / 1024)
+
+/* Buffer structure for collecting string-formatted data
+* using bcm_bprintf() API.
+* Use bcm_binit() to initialize before use
+*/
+
+struct bcmstrbuf {
+       char *buf;      /* pointer to current position in origbuf */
+       unsigned int size;      /* current (residual) size in bytes */
+       char *origbuf;  /* unmodified pointer to orignal buffer */
+       unsigned int origsize;  /* unmodified orignal buffer size in bytes */
+};
+
+#define BCMSTRBUF_LEN(b)       (b->size)
+#define BCMSTRBUF_BUF(b)       (b->buf)
+
+/* ** driver-only section ** */
+#ifdef BCMDRIVER
+#include <osl.h>
+#include <hnd_pktq.h>
+#include <hnd_pktpool.h>
+
+#define GPIO_PIN_NOTDEFINED    0x20    /* Pin not defined */
+
+/*
+ * Spin at most 'us' microseconds while 'exp' is true.
+ * Caller should explicitly test 'exp' when this completes
+ * and take appropriate error action if 'exp' is still true.
+ */
+#ifndef SPINWAIT_POLL_PERIOD
+#define SPINWAIT_POLL_PERIOD   10
+#endif
+
+#define SPINWAIT(exp, us) { \
+       uint countdown = (us) + (SPINWAIT_POLL_PERIOD - 1); \
+       while ((exp) && (countdown >= SPINWAIT_POLL_PERIOD)) { \
+               OSL_DELAY(SPINWAIT_POLL_PERIOD); \
+               countdown -= SPINWAIT_POLL_PERIOD; \
+       } \
+}
+
+/* forward definition of ether_addr structure used by some function prototypes */
+
+struct ether_addr;
+
+extern int ether_isbcast(const void *ea);
+extern int ether_isnulladdr(const void *ea);
+
+#define BCM_MAC_RXCPL_IDX_BITS                 12
+#define BCM_MAX_RXCPL_IDX_INVALID              0
+#define BCM_MAC_RXCPL_IFIDX_BITS               3
+#define BCM_MAC_RXCPL_DOT11_BITS               1
+#define BCM_MAX_RXCPL_IFIDX                    ((1 << BCM_MAC_RXCPL_IFIDX_BITS) - 1)
+#define BCM_MAC_RXCPL_FLAG_BITS                        4
+#define BCM_RXCPL_FLAGS_IN_TRANSIT             0x1
+#define BCM_RXCPL_FLAGS_FIRST_IN_FLUSHLIST     0x2
+#define BCM_RXCPL_FLAGS_RXCPLVALID             0x4
+#define BCM_RXCPL_FLAGS_RSVD                   0x8
+
+#define BCM_RXCPL_SET_IN_TRANSIT(a)    ((a)->rxcpl_id.flags |= BCM_RXCPL_FLAGS_IN_TRANSIT)
+#define BCM_RXCPL_CLR_IN_TRANSIT(a)    ((a)->rxcpl_id.flags &= ~BCM_RXCPL_FLAGS_IN_TRANSIT)
+#define BCM_RXCPL_IN_TRANSIT(a)                ((a)->rxcpl_id.flags & BCM_RXCPL_FLAGS_IN_TRANSIT)
+
+#define BCM_RXCPL_SET_FRST_IN_FLUSH(a) ((a)->rxcpl_id.flags |= BCM_RXCPL_FLAGS_FIRST_IN_FLUSHLIST)
+#define BCM_RXCPL_CLR_FRST_IN_FLUSH(a) ((a)->rxcpl_id.flags &= ~BCM_RXCPL_FLAGS_FIRST_IN_FLUSHLIST)
+#define BCM_RXCPL_FRST_IN_FLUSH(a)     ((a)->rxcpl_id.flags & BCM_RXCPL_FLAGS_FIRST_IN_FLUSHLIST)
+
+#define BCM_RXCPL_SET_VALID_INFO(a)    ((a)->rxcpl_id.flags |= BCM_RXCPL_FLAGS_RXCPLVALID)
+#define BCM_RXCPL_CLR_VALID_INFO(a)    ((a)->rxcpl_id.flags &= ~BCM_RXCPL_FLAGS_RXCPLVALID)
+#define BCM_RXCPL_VALID_INFO(a) (((a)->rxcpl_id.flags & BCM_RXCPL_FLAGS_RXCPLVALID) ? TRUE : FALSE)
+
+#define UP_TABLE_MAX   ((IPV4_TOS_DSCP_MASK >> IPV4_TOS_DSCP_SHIFT) + 1)       /* 64 max */
+
+struct reorder_rxcpl_id_list {
+       uint16 head;
+       uint16 tail;
+       uint32 cnt;
+};
+
+typedef struct rxcpl_id {
+       uint32          idx : BCM_MAC_RXCPL_IDX_BITS;
+       uint32          next_idx : BCM_MAC_RXCPL_IDX_BITS;
+       uint32          ifidx : BCM_MAC_RXCPL_IFIDX_BITS;
+       uint32          dot11 : BCM_MAC_RXCPL_DOT11_BITS;
+       uint32          flags : BCM_MAC_RXCPL_FLAG_BITS;
+} rxcpl_idx_id_t;
+
+typedef struct rxcpl_data_len {
+       uint32          metadata_len_w : 6;
+       uint32          dataoffset: 10;
+       uint32          datalen : 16;
+} rxcpl_data_len_t;
+
+typedef struct rxcpl_info {
+       rxcpl_idx_id_t          rxcpl_id;
+       uint32          host_pktref;
+       union {
+               rxcpl_data_len_t        rxcpl_len;
+               struct rxcpl_info       *free_next;
+       };
+} rxcpl_info_t;
+
+/* rx completion list */
+typedef struct bcm_rxcplid_list {
+       uint32                  max;
+       uint32                  avail;
+       rxcpl_info_t            *rxcpl_ptr;
+       rxcpl_info_t            *free_list;
+} bcm_rxcplid_list_t;
+
+extern bool bcm_alloc_rxcplid_list(osl_t *osh, uint32 max);
+extern rxcpl_info_t * bcm_alloc_rxcplinfo(void);
+extern void bcm_free_rxcplinfo(rxcpl_info_t *ptr);
+extern void bcm_chain_rxcplid(uint16 first,  uint16 next);
+extern rxcpl_info_t *bcm_id2rxcplinfo(uint16 id);
+extern uint16 bcm_rxcplinfo2id(rxcpl_info_t *ptr);
+extern rxcpl_info_t *bcm_rxcpllist_end(rxcpl_info_t *ptr, uint32 *count);
+
+/* externs */
+/* packet */
+extern uint pktcopy(osl_t *osh, void *p, uint offset, int len, uchar *buf);
+extern uint pktfrombuf(osl_t *osh, void *p, uint offset, int len, uchar *buf);
+extern uint pkttotlen(osl_t *osh, void *p);
+extern void *pktlast(osl_t *osh, void *p);
+extern uint pktsegcnt(osl_t *osh, void *p);
+extern uint pktsegcnt_war(osl_t *osh, void *p);
+extern uint8 *pktdataoffset(osl_t *osh, void *p,  uint offset);
+extern void *pktoffset(osl_t *osh, void *p,  uint offset);
+
+/* Get priority from a packet and pass it back in scb (or equiv) */
+#define        PKTPRIO_VDSCP   0x100           /* DSCP prio found after VLAN tag */
+#define        PKTPRIO_VLAN    0x200           /* VLAN prio found */
+#define        PKTPRIO_UPD     0x400           /* DSCP used to update VLAN prio */
+#define        PKTPRIO_DSCP    0x800           /* DSCP prio found */
+
+/* DSCP type definitions (RFC4594) */
+/* AF1x: High-Throughput Data (RFC2597) */
+#define DSCP_AF11      0x0A
+#define DSCP_AF12      0x0C
+#define DSCP_AF13      0x0E
+/* AF2x: Low-Latency Data (RFC2597) */
+#define DSCP_AF21      0x12
+#define DSCP_AF22      0x14
+#define DSCP_AF23      0x16
+/* AF3x: Multimedia Streaming (RFC2597) */
+#define DSCP_AF31      0x1A
+#define DSCP_AF32      0x1C
+#define DSCP_AF33      0x1E
+/* EF: Telephony (RFC3246) */
+#define DSCP_EF                0x2E
+
+extern uint pktsetprio(void *pkt, bool update_vtag);
+extern uint pktsetprio_qms(void *pkt, uint8* up_table, bool update_vtag);
+extern bool pktgetdscp(uint8 *pktdata, uint pktlen, uint8 *dscp);
+
+/* string */
+extern int bcm_atoi(const char *s);
+extern ulong bcm_strtoul(const char *cp, char **endp, uint base);
+extern char *bcmstrstr(const char *haystack, const char *needle);
+extern char *bcmstrnstr(const char *s, uint s_len, const char *substr, uint substr_len);
+extern char *bcmstrcat(char *dest, const char *src);
+extern char *bcmstrncat(char *dest, const char *src, uint size);
+extern ulong wchar2ascii(char *abuf, ushort *wbuf, ushort wbuflen, ulong abuflen);
+extern int bcm_atoicrc(const char *p, int *crc);
+extern void wipedates(const char *cp, int size);
+char* bcmstrtok(char **string, const char *delimiters, char *tokdelim);
+int bcmstricmp(const char *s1, const char *s2);
+int bcmstrnicmp(const char* s1, const char* s2, int cnt);
+
+
+/* ethernet address */
+extern char *bcm_ether_ntoa(const struct ether_addr *ea, char *buf);
+extern int bcm_ether_atoe(const char *p, struct ether_addr *ea);
+
+/* ip address */
+struct ipv4_addr;
+extern char *bcm_ip_ntoa(struct ipv4_addr *ia, char *buf);
+extern char *bcm_ipv6_ntoa(void *ipv6, char *buf);
+extern int bcm_atoipv4(const char *p, struct ipv4_addr *ip);
+
+/* delay */
+extern void bcm_mdelay(uint ms);
+/* variable access */
+#define NVRAM_RECLAIM_CHECK(name)
+
+extern char *getvar(char *vars, const char *name);
+extern int getintvar(char *vars, const char *name);
+extern int getintvararray(char *vars, const char *name, int index);
+extern int getintvararraysize(char *vars, const char *name);
+extern uint getgpiopin(char *vars, char *pin_name, uint def_pin);
+#define bcm_perf_enable()
+#define bcmstats(fmt)
+#define        bcmlog(fmt, a1, a2)
+#define        bcmdumplog(buf, size)   *buf = '\0'
+#define        bcmdumplogent(buf, idx) -1
+
+#define TSF_TICKS_PER_MS       1000
+#define TS_ENTER               0xdeadbeef      /* Timestamp profiling enter */
+#define TS_EXIT                        0xbeefcafe      /* Timestamp profiling exit */
+
+#define bcmtslog(tstamp, fmt, a1, a2)
+#define bcmprinttslogs()
+#define bcmprinttstamp(us)
+#define bcmdumptslog(b)
+
+extern char *bcm_nvram_vars(uint *length);
+extern int bcm_nvram_cache(void *sih);
+
+/* Support for sharing code across in-driver iovar implementations.
+ * The intent is that a driver use this structure to map iovar names
+ * to its (private) iovar identifiers, and the lookup function to
+ * find the entry.  Macros are provided to map ids and get/set actions
+ * into a single number space for a switch statement.
+ */
+
+/* iovar structure */
+typedef struct bcm_iovar {
+       const char *name;       /* name for lookup and display */
+       uint16 varid;           /* id for switch */
+       uint16 flags;           /* driver-specific flag bits */
+       uint16 type;            /* base type of argument */
+       uint16 minlen;          /* min length for buffer vars */
+} bcm_iovar_t;
+
+/* varid definitions are per-driver, may use these get/set bits */
+
+/* IOVar action bits for id mapping */
+#define IOV_GET 0 /* Get an iovar */
+#define IOV_SET 1 /* Set an iovar */
+
+/* Varid to actionid mapping */
+#define IOV_GVAL(id)           ((id) * 2)
+#define IOV_SVAL(id)           ((id) * 2 + IOV_SET)
+#define IOV_ISSET(actionid)    ((actionid & IOV_SET) == IOV_SET)
+#define IOV_ID(actionid)       (actionid >> 1)
+
+/* flags are per-driver based on driver attributes */
+
+extern const bcm_iovar_t *bcm_iovar_lookup(const bcm_iovar_t *table, const char *name);
+extern int bcm_iovar_lencheck(const bcm_iovar_t *table, void *arg, int len, bool set);
+#if defined(WLTINYDUMP) || defined(WLMSG_INFORM) || defined(WLMSG_ASSOC) || \
+       defined(WLMSG_PRPKT) || defined(WLMSG_WSEC)
+extern int bcm_format_ssid(char* buf, const uchar ssid[], uint ssid_len);
+#endif 
+#endif /* BCMDRIVER */
+
+/* Base type definitions */
+#define IOVT_VOID      0       /* no value (implictly set only) */
+#define IOVT_BOOL      1       /* any value ok (zero/nonzero) */
+#define IOVT_INT8      2       /* integer values are range-checked */
+#define IOVT_UINT8     3       /* unsigned int 8 bits */
+#define IOVT_INT16     4       /* int 16 bits */
+#define IOVT_UINT16    5       /* unsigned int 16 bits */
+#define IOVT_INT32     6       /* int 32 bits */
+#define IOVT_UINT32    7       /* unsigned int 32 bits */
+#define IOVT_BUFFER    8       /* buffer is size-checked as per minlen */
+#define BCM_IOVT_VALID(type) (((unsigned int)(type)) <= IOVT_BUFFER)
+
+/* Initializer for IOV type strings */
+#define BCM_IOV_TYPE_INIT { \
+       "void", \
+       "bool", \
+       "int8", \
+       "uint8", \
+       "int16", \
+       "uint16", \
+       "int32", \
+       "uint32", \
+       "buffer", \
+       "" }
+
+#define BCM_IOVT_IS_INT(type) (\
+       (type == IOVT_BOOL) || \
+       (type == IOVT_INT8) || \
+       (type == IOVT_UINT8) || \
+       (type == IOVT_INT16) || \
+       (type == IOVT_UINT16) || \
+       (type == IOVT_INT32) || \
+       (type == IOVT_UINT32))
+
+/* ** driver/apps-shared section ** */
+
+#define BCME_STRLEN            64      /* Max string length for BCM errors */
+#define VALID_BCMERROR(e)  ((e <= 0) && (e >= BCME_LAST))
+
+
+/*
+ * error codes could be added but the defined ones shouldn't be changed/deleted
+ * these error codes are exposed to the user code
+ * when ever a new error code is added to this list
+ * please update errorstring table with the related error string and
+ * update osl files with os specific errorcode map
+*/
+
+#define BCME_OK                                0       /* Success */
+#define BCME_ERROR                     -1      /* Error generic */
+#define BCME_BADARG                    -2      /* Bad Argument */
+#define BCME_BADOPTION                 -3      /* Bad option */
+#define BCME_NOTUP                     -4      /* Not up */
+#define BCME_NOTDOWN                   -5      /* Not down */
+#define BCME_NOTAP                     -6      /* Not AP */
+#define BCME_NOTSTA                    -7      /* Not STA  */
+#define BCME_BADKEYIDX                 -8      /* BAD Key Index */
+#define BCME_RADIOOFF                  -9      /* Radio Off */
+#define BCME_NOTBANDLOCKED             -10     /* Not  band locked */
+#define BCME_NOCLK                     -11     /* No Clock */
+#define BCME_BADRATESET                        -12     /* BAD Rate valueset */
+#define BCME_BADBAND                   -13     /* BAD Band */
+#define BCME_BUFTOOSHORT               -14     /* Buffer too short */
+#define BCME_BUFTOOLONG                        -15     /* Buffer too long */
+#define BCME_BUSY                      -16     /* Busy */
+#define BCME_NOTASSOCIATED             -17     /* Not Associated */
+#define BCME_BADSSIDLEN                        -18     /* Bad SSID len */
+#define BCME_OUTOFRANGECHAN            -19     /* Out of Range Channel */
+#define BCME_BADCHAN                   -20     /* Bad Channel */
+#define BCME_BADADDR                   -21     /* Bad Address */
+#define BCME_NORESOURCE                        -22     /* Not Enough Resources */
+#define BCME_UNSUPPORTED               -23     /* Unsupported */
+#define BCME_BADLEN                    -24     /* Bad length */
+#define BCME_NOTREADY                  -25     /* Not Ready */
+#define BCME_EPERM                     -26     /* Not Permitted */
+#define BCME_NOMEM                     -27     /* No Memory */
+#define BCME_ASSOCIATED                        -28     /* Associated */
+#define BCME_RANGE                     -29     /* Not In Range */
+#define BCME_NOTFOUND                  -30     /* Not Found */
+#define BCME_WME_NOT_ENABLED           -31     /* WME Not Enabled */
+#define BCME_TSPEC_NOTFOUND            -32     /* TSPEC Not Found */
+#define BCME_ACM_NOTSUPPORTED          -33     /* ACM Not Supported */
+#define BCME_NOT_WME_ASSOCIATION       -34     /* Not WME Association */
+#define BCME_SDIO_ERROR                        -35     /* SDIO Bus Error */
+#define BCME_DONGLE_DOWN               -36     /* Dongle Not Accessible */
+#define BCME_VERSION                   -37     /* Incorrect version */
+#define BCME_TXFAIL                    -38     /* TX failure */
+#define BCME_RXFAIL                    -39     /* RX failure */
+#define BCME_NODEVICE                  -40     /* Device not present */
+#define BCME_NMODE_DISABLED            -41     /* NMODE disabled */
+#define BCME_NONRESIDENT               -42 /* access to nonresident overlay */
+#define BCME_SCANREJECT                        -43     /* reject scan request */
+#define BCME_USAGE_ERROR                -44     /* WLCMD usage error */
+#define BCME_IOCTL_ERROR                -45     /* WLCMD ioctl error */
+#define BCME_SERIAL_PORT_ERR            -46     /* RWL serial port error */
+#define BCME_DISABLED                  -47     /* Disabled in this build */
+#define BCME_DECERR                            -48             /* Decrypt error */
+#define BCME_ENCERR                            -49             /* Encrypt error */
+#define BCME_MICERR                            -50             /* Integrity/MIC error */
+#define BCME_REPLAY                            -51             /* Replay */
+#define BCME_IE_NOTFOUND               -52             /* IE not found */
+#define BCME_DATA_NOTFOUND             -53             /* Complete data not found in buffer */
+#define BCME_LAST                      BCME_DATA_NOTFOUND
+
+#define BCME_NOTENABLED BCME_DISABLED
+
+/* These are collection of BCME Error strings */
+#define BCMERRSTRINGTABLE {            \
+       "OK",                           \
+       "Undefined error",              \
+       "Bad Argument",                 \
+       "Bad Option",                   \
+       "Not up",                       \
+       "Not down",                     \
+       "Not AP",                       \
+       "Not STA",                      \
+       "Bad Key Index",                \
+       "Radio Off",                    \
+       "Not band locked",              \
+       "No clock",                     \
+       "Bad Rate valueset",            \
+       "Bad Band",                     \
+       "Buffer too short",             \
+       "Buffer too long",              \
+       "Busy",                         \
+       "Not Associated",               \
+       "Bad SSID len",                 \
+       "Out of Range Channel",         \
+       "Bad Channel",                  \
+       "Bad Address",                  \
+       "Not Enough Resources",         \
+       "Unsupported",                  \
+       "Bad length",                   \
+       "Not Ready",                    \
+       "Not Permitted",                \
+       "No Memory",                    \
+       "Associated",                   \
+       "Not In Range",                 \
+       "Not Found",                    \
+       "WME Not Enabled",              \
+       "TSPEC Not Found",              \
+       "ACM Not Supported",            \
+       "Not WME Association",          \
+       "SDIO Bus Error",               \
+       "Dongle Not Accessible",        \
+       "Incorrect version",            \
+       "TX Failure",                   \
+       "RX Failure",                   \
+       "Device Not Present",           \
+       "NMODE Disabled",               \
+       "Nonresident overlay access", \
+       "Scan Rejected",                \
+       "WLCMD usage error",            \
+       "WLCMD ioctl error",            \
+       "RWL serial port error",        \
+       "Disabled",                     \
+       "Decrypt error", \
+       "Encrypt error", \
+       "MIC error", \
+       "Replay", \
+       "IE not found", \
+       "Data not found", \
+}
+
+#ifndef ABS
+#define        ABS(a)                  (((a) < 0) ? -(a) : (a))
+#endif /* ABS */
+
+#ifndef MIN
+#define        MIN(a, b)               (((a) < (b)) ? (a) : (b))
+#endif /* MIN */
+
+#ifndef MAX
+#define        MAX(a, b)               (((a) > (b)) ? (a) : (b))
+#endif /* MAX */
+
+/* limit to [min, max] */
+#ifndef LIMIT_TO_RANGE
+#define LIMIT_TO_RANGE(x, min, max) \
+       ((x) < (min) ? (min) : ((x) > (max) ? (max) : (x)))
+#endif /* LIMIT_TO_RANGE */
+
+/* limit to  max */
+#ifndef LIMIT_TO_MAX
+#define LIMIT_TO_MAX(x, max) \
+       (((x) > (max) ? (max) : (x)))
+#endif /* LIMIT_TO_MAX */
+
+/* limit to min */
+#ifndef LIMIT_TO_MIN
+#define LIMIT_TO_MIN(x, min) \
+       (((x) < (min) ? (min) : (x)))
+#endif /* LIMIT_TO_MIN */
+
+#define DELTA(curr, prev) ((curr) > (prev) ? ((curr) - (prev)) : \
+       (0xffffffff - (prev) + (curr) + 1))
+#define CEIL(x, y)             (((x) + ((y) - 1)) / (y))
+#define ROUNDUP(x, y)          ((((x) + ((y) - 1)) / (y)) * (y))
+#define ROUNDDN(p, align)      ((p) & ~((align) - 1))
+#define        ISALIGNED(a, x)         (((uintptr)(a) & ((x) - 1)) == 0)
+#define ALIGN_ADDR(addr, boundary) (void *)(((uintptr)(addr) + (boundary) - 1) \
+                                                & ~((boundary) - 1))
+#define ALIGN_SIZE(size, boundary) (((size) + (boundary) - 1) \
+                                                & ~((boundary) - 1))
+#define        ISPOWEROF2(x)           ((((x) - 1) & (x)) == 0)
+#define VALID_MASK(mask)       !((mask) & ((mask) + 1))
+
+#ifndef OFFSETOF
+#ifdef __ARMCC_VERSION
+/*
+ * The ARM RVCT compiler complains when using OFFSETOF where a constant
+ * expression is expected, such as an initializer for a static object.
+ * offsetof from the runtime library doesn't have that problem.
+ */
+#include <stddef.h>
+#define        OFFSETOF(type, member)  offsetof(type, member)
+#else
+#  if ((__GNUC__ >= 4) && (__GNUC_MINOR__ >= 8))
+/* GCC 4.8+ complains when using our OFFSETOF macro in array length declarations. */
+#    define    OFFSETOF(type, member)  __builtin_offsetof(type, member)
+#  else
+#    define    OFFSETOF(type, member)  ((uint)(uintptr)&((type *)0)->member)
+#  endif /* GCC 4.8 or newer */
+#endif /* __ARMCC_VERSION */
+#endif /* OFFSETOF */
+
+#ifndef ARRAYSIZE
+#define ARRAYSIZE(a)           (sizeof(a) / sizeof(a[0]))
+#endif
+
+#ifndef ARRAYLAST /* returns pointer to last array element */
+#define ARRAYLAST(a)           (&a[ARRAYSIZE(a)-1])
+#endif
+
+/* Reference a function; used to prevent a static function from being optimized out */
+extern void *_bcmutils_dummy_fn;
+#define REFERENCE_FUNCTION(f)  (_bcmutils_dummy_fn = (void *)(f))
+
+/* bit map related macros */
+#ifndef setbit
+#ifndef NBBY           /* the BSD family defines NBBY */
+#define        NBBY    8       /* 8 bits per byte */
+#endif /* #ifndef NBBY */
+#ifdef BCMUTILS_BIT_MACROS_USE_FUNCS
+extern void setbit(void *array, uint bit);
+extern void clrbit(void *array, uint bit);
+extern bool isset(const void *array, uint bit);
+extern bool isclr(const void *array, uint bit);
+#else
+#define        setbit(a, i)    (((uint8 *)a)[(i) / NBBY] |= 1 << ((i) % NBBY))
+#define        clrbit(a, i)    (((uint8 *)a)[(i) / NBBY] &= ~(1 << ((i) % NBBY)))
+#define        isset(a, i)     (((const uint8 *)a)[(i) / NBBY] & (1 << ((i) % NBBY)))
+#define        isclr(a, i)     ((((const uint8 *)a)[(i) / NBBY] & (1 << ((i) % NBBY))) == 0)
+#endif
+#endif /* setbit */
+extern void set_bitrange(void *array, uint start, uint end, uint maxbit);
+
+#define        isbitset(a, i)  (((a) & (1 << (i))) != 0)
+
+#define        NBITS(type)     (sizeof(type) * 8)
+#define NBITVAL(nbits) (1 << (nbits))
+#define MAXBITVAL(nbits)       ((1 << (nbits)) - 1)
+#define        NBITMASK(nbits) MAXBITVAL(nbits)
+#define MAXNBVAL(nbyte)        MAXBITVAL((nbyte) * 8)
+
+extern void bcm_bitprint32(const uint32 u32);
+
+/*
+ * ----------------------------------------------------------------------------
+ * Multiword map of 2bits, nibbles
+ * setbit2 setbit4 (void *ptr, uint32 ix, uint32 val)
+ * getbit2 getbit4 (void *ptr, uint32 ix)
+ * ----------------------------------------------------------------------------
+ */
+
+#define DECLARE_MAP_API(NB, RSH, LSH, OFF, MSK)                     \
+static INLINE void setbit##NB(void *ptr, uint32 ix, uint32 val)     \
+{                                                                   \
+       uint32 *addr = (uint32 *)ptr;                                   \
+       uint32 *a = addr + (ix >> RSH); /* (ix / 2^RSH) */              \
+       uint32 pos = (ix & OFF) << LSH; /* (ix % 2^RSH) * 2^LSH */      \
+       uint32 mask = (MSK << pos);                                     \
+       uint32 tmp = *a & ~mask;                                        \
+       *a = tmp | (val << pos);                                        \
+}                                                                   \
+static INLINE uint32 getbit##NB(void *ptr, uint32 ix)               \
+{                                                                   \
+       uint32 *addr = (uint32 *)ptr;                                   \
+       uint32 *a = addr + (ix >> RSH);                                 \
+       uint32 pos = (ix & OFF) << LSH;                                 \
+       return ((*a >> pos) & MSK);                                     \
+}
+
+DECLARE_MAP_API(2, 4, 1, 15U, 0x0003) /* setbit2() and getbit2() */
+DECLARE_MAP_API(4, 3, 2, 7U, 0x000F) /* setbit4() and getbit4() */
+DECLARE_MAP_API(8, 2, 3, 3U, 0x00FF) /* setbit8() and getbit8() */
+
+/* basic mux operation - can be optimized on several architectures */
+#define MUX(pred, true, false) ((pred) ? (true) : (false))
+
+/* modulo inc/dec - assumes x E [0, bound - 1] */
+#define MODDEC(x, bound) MUX((x) == 0, (bound) - 1, (x) - 1)
+#define MODINC(x, bound) MUX((x) == (bound) - 1, 0, (x) + 1)
+
+/* modulo inc/dec, bound = 2^k */
+#define MODDEC_POW2(x, bound) (((x) - 1) & ((bound) - 1))
+#define MODINC_POW2(x, bound) (((x) + 1) & ((bound) - 1))
+
+/* modulo add/sub - assumes x, y E [0, bound - 1] */
+#define MODADD(x, y, bound) \
+    MUX((x) + (y) >= (bound), (x) + (y) - (bound), (x) + (y))
+#define MODSUB(x, y, bound) \
+    MUX(((int)(x)) - ((int)(y)) < 0, (x) - (y) + (bound), (x) - (y))
+
+/* module add/sub, bound = 2^k */
+#define MODADD_POW2(x, y, bound) (((x) + (y)) & ((bound) - 1))
+#define MODSUB_POW2(x, y, bound) (((x) - (y)) & ((bound) - 1))
+
+/* crc defines */
+#define CRC8_INIT_VALUE  0xff          /* Initial CRC8 checksum value */
+#define CRC8_GOOD_VALUE  0x9f          /* Good final CRC8 checksum value */
+#define CRC16_INIT_VALUE 0xffff                /* Initial CRC16 checksum value */
+#define CRC16_GOOD_VALUE 0xf0b8                /* Good final CRC16 checksum value */
+#define CRC32_INIT_VALUE 0xffffffff    /* Initial CRC32 checksum value */
+#define CRC32_GOOD_VALUE 0xdebb20e3    /* Good final CRC32 checksum value */
+
+/* use for direct output of MAC address in printf etc */
+#define MACF                           "%02x:%02x:%02x:%02x:%02x:%02x"
+#define ETHERP_TO_MACF(ea)     ((struct ether_addr *) (ea))->octet[0], \
+                                                       ((struct ether_addr *) (ea))->octet[1], \
+                                                       ((struct ether_addr *) (ea))->octet[2], \
+                                                       ((struct ether_addr *) (ea))->octet[3], \
+                                                       ((struct ether_addr *) (ea))->octet[4], \
+                                                       ((struct ether_addr *) (ea))->octet[5]
+
+#define ETHER_TO_MACF(ea)      (ea).octet[0], \
+                                                       (ea).octet[1], \
+                                                       (ea).octet[2], \
+                                                       (ea).octet[3], \
+                                                       (ea).octet[4], \
+                                                       (ea).octet[5]
+#if !defined(SIMPLE_MAC_PRINT)
+#define MACDBG "%02x:%02x:%02x:%02x:%02x:%02x"
+#define MAC2STRDBG(ea) (ea)[0], (ea)[1], (ea)[2], (ea)[3], (ea)[4], (ea)[5]
+#else
+#define MACDBG                         "%02x:%02x:%02x"
+#define MAC2STRDBG(ea) (ea)[0], (ea)[4], (ea)[5]
+#endif /* SIMPLE_MAC_PRINT */
+
+/* bcm_format_flags() bit description structure */
+typedef struct bcm_bit_desc {
+       uint32  bit;
+       const char* name;
+} bcm_bit_desc_t;
+
+/* bcm_format_field */
+typedef struct bcm_bit_desc_ex {
+       uint32 mask;
+       const bcm_bit_desc_t *bitfield;
+} bcm_bit_desc_ex_t;
+
+/* buffer length for ethernet address from bcm_ether_ntoa() */
+#define ETHER_ADDR_STR_LEN     18      /* 18-bytes of Ethernet address buffer length */
+
+static INLINE uint32 /* 32bit word aligned xor-32 */
+bcm_compute_xor32(volatile uint32 *u32_val, int num_u32)
+{
+       int idx;
+       uint32 xor32 = 0;
+       for (idx = 0; idx < num_u32; idx++)
+               xor32 ^= *(u32_val + idx);
+       return xor32;
+}
+
+/* crypto utility function */
+/* 128-bit xor: *dst = *src1 xor *src2. dst1, src1 and src2 may have any alignment */
+static INLINE void
+xor_128bit_block(const uint8 *src1, const uint8 *src2, uint8 *dst)
+{
+       if (
+#ifdef __i386__
+           1 ||
+#endif
+           (((uintptr)src1 | (uintptr)src2 | (uintptr)dst) & 3) == 0) {
+               /* ARM CM3 rel time: 1229 (727 if alignment check could be omitted) */
+               /* x86 supports unaligned.  This version runs 6x-9x faster on x86. */
+               ((uint32 *)dst)[0] = ((const uint32 *)src1)[0] ^ ((const uint32 *)src2)[0];
+               ((uint32 *)dst)[1] = ((const uint32 *)src1)[1] ^ ((const uint32 *)src2)[1];
+               ((uint32 *)dst)[2] = ((const uint32 *)src1)[2] ^ ((const uint32 *)src2)[2];
+               ((uint32 *)dst)[3] = ((const uint32 *)src1)[3] ^ ((const uint32 *)src2)[3];
+       } else {
+               /* ARM CM3 rel time: 4668 (4191 if alignment check could be omitted) */
+               int k;
+               for (k = 0; k < 16; k++)
+                       dst[k] = src1[k] ^ src2[k];
+       }
+}
+
+/* externs */
+/* crc */
+extern uint8 hndcrc8(uint8 *p, uint nbytes, uint8 crc);
+extern uint16 hndcrc16(uint8 *p, uint nbytes, uint16 crc);
+extern uint32 hndcrc32(uint8 *p, uint nbytes, uint32 crc);
+
+/* format/print */
+#if defined(DHD_DEBUG) || defined(WLMSG_PRHDRS) || defined(WLMSG_PRPKT) || \
+       defined(WLMSG_ASSOC)
+/* print out the value a field has: fields may have 1-32 bits and may hold any value */
+extern int bcm_format_field(const bcm_bit_desc_ex_t *bd, uint32 field, char* buf, int len);
+/* print out which bits in flags are set */
+extern int bcm_format_flags(const bcm_bit_desc_t *bd, uint32 flags, char* buf, int len);
+#endif
+
+extern int bcm_format_hex(char *str, const void *bytes, int len);
+
+extern const char *bcm_crypto_algo_name(uint algo);
+extern char *bcm_chipname(uint chipid, char *buf, uint len);
+extern char *bcm_brev_str(uint32 brev, char *buf);
+extern void printbig(char *buf);
+extern void prhex(const char *msg, uchar *buf, uint len);
+
+/* IE parsing */
+
+/* packing is required if struct is passed across the bus */
+#include <packed_section_start.h>
+/* tag_ID/length/value_buffer tuple */
+typedef struct bcm_tlv {
+       uint8   id;
+       uint8   len;
+       uint8   data[1];
+} bcm_tlv_t;
+
+/* bcm tlv w/ 16 bit id/len */
+typedef BWL_PRE_PACKED_STRUCT struct bcm_xtlv {
+       uint16  id;
+       uint16  len;
+       uint8   data[1];
+} BWL_POST_PACKED_STRUCT bcm_xtlv_t;
+#include <packed_section_end.h>
+
+
+/* descriptor of xtlv data src or dst  */
+typedef struct {
+       uint16  type;
+       uint16  len;
+       void    *ptr; /* ptr to memory location */
+} xtlv_desc_t;
+
+/* xtlv options */
+#define BCM_XTLV_OPTION_NONE   0x0000
+#define BCM_XTLV_OPTION_ALIGN32        0x0001
+
+typedef uint16 bcm_xtlv_opts_t;
+struct bcm_xtlvbuf {
+       bcm_xtlv_opts_t opts;
+       uint16 size;
+       uint8 *head; /* point to head of buffer */
+       uint8 *buf; /* current position of buffer */
+       /* allocated buffer may follow, but not necessarily */
+};
+typedef struct bcm_xtlvbuf bcm_xtlvbuf_t;
+
+#define BCM_TLV_MAX_DATA_SIZE (255)
+#define BCM_XTLV_MAX_DATA_SIZE (65535)
+#define BCM_TLV_HDR_SIZE (OFFSETOF(bcm_tlv_t, data))
+
+#define BCM_XTLV_HDR_SIZE (OFFSETOF(bcm_xtlv_t, data))
+/* LEN only stores the value's length without padding */
+#define BCM_XTLV_LEN(elt) ltoh16_ua(&(elt->len))
+#define BCM_XTLV_ID(elt) ltoh16_ua(&(elt->id))
+/* entire size of the XTLV including header, data, and optional padding */
+#define BCM_XTLV_SIZE(elt, opts) bcm_xtlv_size(elt, opts)
+#define bcm_valid_xtlv(elt, buflen, opts) (elt && ((int)(buflen) >= (int)BCM_XTLV_SIZE(elt, opts)))
+
+/* Check that bcm_tlv_t fits into the given buflen */
+#define bcm_valid_tlv(elt, buflen) (\
+        ((int)(buflen) >= (int)BCM_TLV_HDR_SIZE) && \
+        ((int)(buflen) >= (int)(BCM_TLV_HDR_SIZE + (elt)->len)))
+
+
+extern bcm_tlv_t *bcm_next_tlv(bcm_tlv_t *elt, int *buflen);
+extern bcm_tlv_t *bcm_parse_tlvs(void *buf, int buflen, uint key);
+extern bcm_tlv_t *bcm_parse_tlvs_min_bodylen(void *buf, int buflen, uint key, int min_bodylen);
+
+extern bcm_tlv_t *bcm_parse_ordered_tlvs(void *buf, int buflen, uint key);
+
+extern bcm_tlv_t *bcm_find_vendor_ie(void *tlvs, int tlvs_len, const char *voui, uint8 *type,
+       int type_len);
+
+extern uint8 *bcm_write_tlv(int type, const void *data, int datalen, uint8 *dst);
+extern uint8 *bcm_write_tlv_safe(int type, const void *data, int datalen, uint8 *dst,
+       int dst_maxlen);
+
+extern uint8 *bcm_copy_tlv(const void *src, uint8 *dst);
+extern uint8 *bcm_copy_tlv_safe(const void *src, uint8 *dst, int dst_maxlen);
+
+/* xtlv */
+
+/* return the next xtlv element, and update buffer len (remaining). Buffer length
+ * updated includes padding as specified by options
+ */
+extern bcm_xtlv_t *bcm_next_xtlv(bcm_xtlv_t *elt, int *buflen, bcm_xtlv_opts_t opts);
+
+/* initialize an xtlv buffer. Use options specified for packing/unpacking using
+ * the buffer. Caller is responsible for allocating both buffers.
+ */
+extern int bcm_xtlv_buf_init(bcm_xtlvbuf_t *tlv_buf, uint8 *buf, uint16 len,
+       bcm_xtlv_opts_t opts);
+
+extern uint16 bcm_xtlv_buf_len(struct bcm_xtlvbuf *tbuf);
+extern uint16 bcm_xtlv_buf_rlen(struct bcm_xtlvbuf *tbuf);
+extern uint8 *bcm_xtlv_buf(struct bcm_xtlvbuf *tbuf);
+extern uint8 *bcm_xtlv_head(struct bcm_xtlvbuf *tbuf);
+extern int bcm_xtlv_put_data(bcm_xtlvbuf_t *tbuf, uint16 type, const void *data, uint16 dlen);
+extern int bcm_xtlv_put_8(bcm_xtlvbuf_t *tbuf, uint16 type, const int8 data);
+extern int bcm_xtlv_put_16(bcm_xtlvbuf_t *tbuf, uint16 type, const int16 data);
+extern int bcm_xtlv_put_32(bcm_xtlvbuf_t *tbuf, uint16 type, const int32 data);
+extern int bcm_unpack_xtlv_entry(uint8 **buf, uint16 xpct_type, uint16 xpct_len,
+       void *dst, bcm_xtlv_opts_t opts);
+extern int bcm_pack_xtlv_entry(uint8 **buf, uint16 *buflen, uint16 type, uint16 len,
+       void *src, bcm_xtlv_opts_t opts);
+extern int bcm_xtlv_size(const bcm_xtlv_t *elt, bcm_xtlv_opts_t opts);
+
+/* callback for unpacking xtlv from a buffer into context. */
+typedef int (bcm_xtlv_unpack_cbfn_t)(void *ctx, uint8 *buf, uint16 type, uint16 len);
+
+/* unpack a tlv buffer using buffer, options, and callback */
+extern int bcm_unpack_xtlv_buf(void *ctx, uint8 *buf, uint16 buflen,
+       bcm_xtlv_opts_t opts, bcm_xtlv_unpack_cbfn_t *cbfn);
+
+/* unpack a set of tlvs from the buffer using provided xtlv desc */
+extern int bcm_unpack_xtlv_buf_to_mem(void *buf, int *buflen, xtlv_desc_t *items,
+       bcm_xtlv_opts_t opts);
+
+/* pack a set of tlvs into buffer using provided xtlv desc */
+extern int bcm_pack_xtlv_buf_from_mem(void **buf, uint16 *buflen, xtlv_desc_t *items,
+       bcm_xtlv_opts_t opts);
+
+/* return data pointer of a given ID from xtlv buffer
+ * xtlv data length is given to *datalen_out, if the pointer is valid
+ */
+extern void *bcm_get_data_from_xtlv_buf(uint8 *tlv_buf, uint16 buflen, uint16 id,
+       uint16 *datalen_out, bcm_xtlv_opts_t opts);
+
+/* callback to return next tlv id and len to pack, if there is more tlvs to come and
+ * options e.g. alignment
+ */
+typedef bool (*bcm_pack_xtlv_next_info_cbfn_t)(void *ctx, uint16 *tlv_id, uint16 *tlv_len);
+
+/* callback to pack the tlv into length validated buffer */
+typedef void (*bcm_pack_xtlv_pack_next_cbfn_t)(void *ctx,
+       uint16 tlv_id, uint16 tlv_len, uint8* buf);
+
+/* pack a set of tlvs into buffer using get_next to interate */
+int bcm_pack_xtlv_buf(void *ctx, void *tlv_buf, uint16 buflen,
+       bcm_xtlv_opts_t opts, bcm_pack_xtlv_next_info_cbfn_t get_next,
+       bcm_pack_xtlv_pack_next_cbfn_t pack_next, int *outlen);
+
+/* bcmerror */
+extern const char *bcmerrorstr(int bcmerror);
+
+/* multi-bool data type: set of bools, mbool is true if any is set */
+typedef uint32 mbool;
+#define mboolset(mb, bit)              ((mb) |= (bit))         /* set one bool */
+#define mboolclr(mb, bit)              ((mb) &= ~(bit))        /* clear one bool */
+#define mboolisset(mb, bit)            (((mb) & (bit)) != 0)   /* TRUE if one bool is set */
+#define        mboolmaskset(mb, mask, val)     ((mb) = (((mb) & ~(mask)) | (val)))
+
+/* generic datastruct to help dump routines */
+struct fielddesc {
+       const char *nameandfmt;
+       uint32 offset;
+       uint32 len;
+};
+
+extern void bcm_binit(struct bcmstrbuf *b, char *buf, uint size);
+extern void bcm_bprhex(struct bcmstrbuf *b, const char *msg, bool newline,
+       const uint8 *buf, int len);
+
+extern void bcm_inc_bytes(uchar *num, int num_bytes, uint8 amount);
+extern int bcm_cmp_bytes(const uchar *arg1, const uchar *arg2, uint8 nbytes);
+extern void bcm_print_bytes(const char *name, const uchar *cdata, int len);
+
+typedef  uint32 (*bcmutl_rdreg_rtn)(void *arg0, uint arg1, uint32 offset);
+extern uint bcmdumpfields(bcmutl_rdreg_rtn func_ptr, void *arg0, uint arg1, struct fielddesc *str,
+                          char *buf, uint32 bufsize);
+extern uint bcm_bitcount(uint8 *bitmap, uint bytelength);
+
+extern int bcm_bprintf(struct bcmstrbuf *b, const char *fmt, ...);
+
+/* power conversion */
+extern uint16 bcm_qdbm_to_mw(uint8 qdbm);
+extern uint8 bcm_mw_to_qdbm(uint16 mw);
+extern uint bcm_mkiovar(const char *name, char *data, uint datalen, char *buf, uint len);
+
+unsigned int process_nvram_vars(char *varbuf, unsigned int len);
+
+/* trace any object allocation / free, with / without features (flags) set to the object */
+
+#define BCM_OBJDBG_ADD           1
+#define BCM_OBJDBG_REMOVE        2
+#define BCM_OBJDBG_ADD_PKT       3
+
+/* object feature: set or clear flags */
+#define BCM_OBJECT_FEATURE_FLAG       1
+#define BCM_OBJECT_FEATURE_PKT_STATE  2
+/* object feature: flag bits */
+#define BCM_OBJECT_FEATURE_0     (1 << 0)
+#define BCM_OBJECT_FEATURE_1     (1 << 1)
+#define BCM_OBJECT_FEATURE_2     (1 << 2)
+/* object feature: clear flag bits field set with this flag */
+#define BCM_OBJECT_FEATURE_CLEAR (1 << 31)
+#ifdef BCM_OBJECT_TRACE
+#define bcm_pkt_validate_chk(obj)      do { \
+       void * pkttag; \
+       bcm_object_trace_chk(obj, 0, 0, \
+               __FUNCTION__, __LINE__); \
+       if ((pkttag = PKTTAG(obj))) { \
+               bcm_object_trace_chk(obj, 1, DHD_PKTTAG_SN(pkttag), \
+                       __FUNCTION__, __LINE__); \
+       } \
+} while (0)
+extern void bcm_object_trace_opr(void *obj, uint32 opt, const char *caller, int line);
+extern void bcm_object_trace_upd(void *obj, void *obj_new);
+extern void bcm_object_trace_chk(void *obj, uint32 chksn, uint32 sn,
+       const char *caller, int line);
+extern void bcm_object_feature_set(void *obj, uint32 type, uint32 value);
+extern int  bcm_object_feature_get(void *obj, uint32 type, uint32 value);
+extern void bcm_object_trace_init(void);
+extern void bcm_object_trace_deinit(void);
+#else
+#define bcm_pkt_validate_chk(obj)
+#define bcm_object_trace_opr(a, b, c, d)
+#define bcm_object_trace_upd(a, b)
+#define bcm_object_trace_chk(a, b, c, d, e)
+#define bcm_object_feature_set(a, b, c)
+#define bcm_object_feature_get(a, b, c)
+#define bcm_object_trace_init()
+#define bcm_object_trace_deinit()
+#endif /* BCM_OBJECT_TRACE */
+
+/* calculate a * b + c */
+extern void bcm_uint64_multiple_add(uint32* r_high, uint32* r_low, uint32 a, uint32 b, uint32 c);
+/* calculate a / b */
+extern void bcm_uint64_divide(uint32* r, uint32 a_high, uint32 a_low, uint32 b);
+
+
+/* Public domain bit twiddling hacks/utilities: Sean Eron Anderson */
+
+/* Table driven count set bits. */
+static const uint8 /* Table only for use by bcm_cntsetbits */
+_CSBTBL[256] =
+{
+#      define B2(n)    n,     n + 1,     n + 1,     n + 2
+#      define B4(n) B2(n), B2(n + 1), B2(n + 1), B2(n + 2)
+#      define B6(n) B4(n), B4(n + 1), B4(n + 1), B4(n + 2)
+       B6(0), B6(0 + 1), B6(0 + 1), B6(0 + 2)
+};
+
+static INLINE uint32 /* Uses table _CSBTBL for fast counting of 1's in a u32 */
+bcm_cntsetbits(const uint32 u32arg)
+{
+       /* function local scope declaration of const _CSBTBL[] */
+       const uint8 * p = (const uint8 *)&u32arg;
+       return (_CSBTBL[p[0]] + _CSBTBL[p[1]] + _CSBTBL[p[2]] + _CSBTBL[p[3]]);
+}
+
+
+static INLINE int /* C equivalent count of leading 0's in a u32 */
+C_bcm_count_leading_zeros(uint32 u32arg)
+{
+       int shifts = 0;
+       while (u32arg) {
+               shifts++; u32arg >>= 1;
+       }
+       return (32U - shifts);
+}
+
+#ifdef BCMDRIVER
+/*
+ * Assembly instructions: Count Leading Zeros
+ * "clz"       : MIPS, ARM
+ * "cntlzw"    : PowerPC
+ * "BSF"       : x86
+ * "lzcnt"     : AMD, SPARC
+ */
+
+#if defined(__arm__)
+#if defined(__ARM_ARCH_7M__) /* Cortex M3 */
+#define __USE_ASM_CLZ__
+#endif /* __ARM_ARCH_7M__ */
+#if defined(__ARM_ARCH_7R__) /* Cortex R4 */
+#define __USE_ASM_CLZ__
+#endif /* __ARM_ARCH_7R__ */
+#endif /* __arm__ */
+
+static INLINE int
+bcm_count_leading_zeros(uint32 u32arg)
+{
+#if defined(__USE_ASM_CLZ__)
+       int zeros;
+       __asm__ volatile("clz    %0, %1 \n" : "=r" (zeros) : "r"  (u32arg));
+       return zeros;
+#else  /* C equivalent */
+       return C_bcm_count_leading_zeros(u32arg);
+#endif  /* C equivalent */
+}
+
+/*
+ * Macro to count leading zeroes
+ *
+ */
+#if defined(__GNUC__)
+#define CLZ(x) __builtin_clzl(x)
+#elif defined(__arm__)
+#define CLZ(x) __clz(x)
+#else
+#define CLZ(x) bcm_count_leading_zeros(x)
+#endif /* __GNUC__ */
+
+/* INTERFACE: Multiword bitmap based small id allocator. */
+struct bcm_mwbmap;     /* forward declaration for use as an opaque mwbmap handle */
+
+#define BCM_MWBMAP_INVALID_HDL ((struct bcm_mwbmap *)NULL)
+#define BCM_MWBMAP_INVALID_IDX ((uint32)(~0U))
+
+/* Incarnate a multiword bitmap based small index allocator */
+extern struct bcm_mwbmap * bcm_mwbmap_init(osl_t * osh, uint32 items_max);
+
+/* Free up the multiword bitmap index allocator */
+extern void bcm_mwbmap_fini(osl_t * osh, struct bcm_mwbmap * mwbmap_hdl);
+
+/* Allocate a unique small index using a multiword bitmap index allocator */
+extern uint32 bcm_mwbmap_alloc(struct bcm_mwbmap * mwbmap_hdl);
+
+/* Force an index at a specified position to be in use */
+extern void bcm_mwbmap_force(struct bcm_mwbmap * mwbmap_hdl, uint32 bitix);
+
+/* Free a previously allocated index back into the multiword bitmap allocator */
+extern void bcm_mwbmap_free(struct bcm_mwbmap * mwbmap_hdl, uint32 bitix);
+
+/* Fetch the toal number of free indices in the multiword bitmap allocator */
+extern uint32 bcm_mwbmap_free_cnt(struct bcm_mwbmap * mwbmap_hdl);
+
+/* Determine whether an index is inuse or free */
+extern bool bcm_mwbmap_isfree(struct bcm_mwbmap * mwbmap_hdl, uint32 bitix);
+
+/* Debug dump a multiword bitmap allocator */
+extern void bcm_mwbmap_show(struct bcm_mwbmap * mwbmap_hdl);
+
+extern void bcm_mwbmap_audit(struct bcm_mwbmap * mwbmap_hdl);
+/* End - Multiword bitmap based small Id allocator. */
+
+
+/* INTERFACE: Simple unique 16bit Id Allocator using a stack implementation. */
+
+#define ID16_INVALID                ((uint16)(~0))
+#define ID16_UNDEFINED              (ID16_INVALID)
+
+/*
+ * Construct a 16bit id allocator, managing 16bit ids in the range:
+ *    [start_val16 .. start_val16+total_ids)
+ * Note: start_val16 is inclusive.
+ * Returns an opaque handle to the 16bit id allocator.
+ */
+extern void * id16_map_init(osl_t *osh, uint16 total_ids, uint16 start_val16);
+extern void * id16_map_fini(osl_t *osh, void * id16_map_hndl);
+extern void id16_map_clear(void * id16_map_hndl, uint16 total_ids, uint16 start_val16);
+
+/* Allocate a unique 16bit id */
+extern uint16 id16_map_alloc(void * id16_map_hndl);
+
+/* Free a 16bit id value into the id16 allocator */
+extern void id16_map_free(void * id16_map_hndl, uint16 val16);
+
+/* Get the number of failures encountered during id allocation. */
+extern uint32 id16_map_failures(void * id16_map_hndl);
+
+/* Audit the 16bit id allocator state. */
+extern bool id16_map_audit(void * id16_map_hndl);
+/* End - Simple 16bit Id Allocator. */
+#endif /* BCMDRIVER */
+
+extern void bcm_uint64_right_shift(uint32* r, uint32 a_high, uint32 a_low, uint32 b);
+
+void bcm_add_64(uint32* r_hi, uint32* r_lo, uint32 offset);
+void bcm_sub_64(uint32* r_hi, uint32* r_lo, uint32 offset);
+
+/* calculate checksum for ip header, tcp / udp header / data */
+uint16 bcm_ip_cksum(uint8 *buf, uint32 len, uint32 sum);
+
+#ifndef _dll_t_
+#define _dll_t_
+/*
+ * -----------------------------------------------------------------------------
+ *                      Double Linked List Macros
+ * -----------------------------------------------------------------------------
+ *
+ * All dll operations must be performed on a pre-initialized node.
+ * Inserting an uninitialized node into a list effectively initialized it.
+ *
+ * When a node is deleted from a list, you may initialize it to avoid corruption
+ * incurred by double deletion. You may skip initialization if the node is
+ * immediately inserted into another list.
+ *
+ * By placing a dll_t element at the start of a struct, you may cast a dll_t *
+ * to the struct or vice versa.
+ *
+ * Example of declaring an initializing someList and inserting nodeA, nodeB
+ *
+ *     typedef struct item {
+ *         dll_t node;
+ *         int someData;
+ *     } Item_t;
+ *     Item_t nodeA, nodeB, nodeC;
+ *     nodeA.someData = 11111, nodeB.someData = 22222, nodeC.someData = 33333;
+ *
+ *     dll_t someList;
+ *     dll_init(&someList);
+ *
+ *     dll_append(&someList, (dll_t *) &nodeA);
+ *     dll_prepend(&someList, &nodeB.node);
+ *     dll_insert((dll_t *)&nodeC, &nodeA.node);
+ *
+ *     dll_delete((dll_t *) &nodeB);
+ *
+ * Example of a for loop to walk someList of node_p
+ *
+ *   extern void mydisplay(Item_t * item_p);
+ *
+ *   dll_t * item_p, * next_p;
+ *   for (item_p = dll_head_p(&someList); ! dll_end(&someList, item_p);
+ *        item_p = next_p)
+ *   {
+ *       next_p = dll_next_p(item_p);
+ *       ... use item_p at will, including removing it from list ...
+ *       mydisplay((PItem_t)item_p);
+ *   }
+ *
+ * -----------------------------------------------------------------------------
+ */
+typedef struct dll {
+       struct dll * next_p;
+       struct dll * prev_p;
+} dll_t;
+
+static INLINE void
+dll_init(dll_t *node_p)
+{
+       node_p->next_p = node_p;
+       node_p->prev_p = node_p;
+}
+/* dll macros returing a pointer to dll_t */
+
+static INLINE dll_t *
+dll_head_p(dll_t *list_p)
+{
+       return list_p->next_p;
+}
+
+
+static INLINE dll_t *
+dll_tail_p(dll_t *list_p)
+{
+       return (list_p)->prev_p;
+}
+
+
+static INLINE dll_t *
+dll_next_p(dll_t *node_p)
+{
+       return (node_p)->next_p;
+}
+
+
+static INLINE dll_t *
+dll_prev_p(dll_t *node_p)
+{
+       return (node_p)->prev_p;
+}
+
+
+static INLINE bool
+dll_empty(dll_t *list_p)
+{
+       return ((list_p)->next_p == (list_p));
+}
+
+
+static INLINE bool
+dll_end(dll_t *list_p, dll_t * node_p)
+{
+       return (list_p == node_p);
+}
+
+
+/* inserts the node new_p "after" the node at_p */
+static INLINE void
+dll_insert(dll_t *new_p, dll_t * at_p)
+{
+       new_p->next_p = at_p->next_p;
+       new_p->prev_p = at_p;
+       at_p->next_p = new_p;
+       (new_p->next_p)->prev_p = new_p;
+}
+
+static INLINE void
+dll_append(dll_t *list_p, dll_t *node_p)
+{
+       dll_insert(node_p, dll_tail_p(list_p));
+}
+
+static INLINE void
+dll_prepend(dll_t *list_p, dll_t *node_p)
+{
+       dll_insert(node_p, list_p);
+}
+
+
+/* deletes a node from any list that it "may" be in, if at all. */
+static INLINE void
+dll_delete(dll_t *node_p)
+{
+       node_p->prev_p->next_p = node_p->next_p;
+       node_p->next_p->prev_p = node_p->prev_p;
+}
+#endif  /* ! defined(_dll_t_) */
+
+/* Elements managed in a double linked list */
+
+typedef struct dll_pool {
+       dll_t       free_list;
+       uint16      free_count;
+       uint16      elems_max;
+       uint16      elem_size;
+       dll_t       elements[1];
+} dll_pool_t;
+
+dll_pool_t * dll_pool_init(void * osh, uint16 elems_max, uint16 elem_size);
+void * dll_pool_alloc(dll_pool_t * dll_pool_p);
+void dll_pool_free(dll_pool_t * dll_pool_p, void * elem_p);
+void dll_pool_free_tail(dll_pool_t * dll_pool_p, void * elem_p);
+typedef void (* dll_elem_dump)(void * elem_p);
+void dll_pool_detach(void * osh, dll_pool_t * pool, uint16 elems_max, uint16 elem_size);
+
+#ifdef __cplusplus
+       }
+#endif
+
+/* #define DEBUG_COUNTER */
+#ifdef DEBUG_COUNTER
+#define CNTR_TBL_MAX 10
+typedef struct _counter_tbl_t {
+       char name[16];                          /* name of this counter table */
+       uint32 prev_log_print;          /* Internal use. Timestamp of the previous log print */
+       uint log_print_interval;        /* Desired interval to print logs in ms */
+       uint needed_cnt;                        /* How many counters need to be used */
+       uint32 cnt[CNTR_TBL_MAX];               /* Counting entries to increase at desired places */
+       bool enabled;                           /* Whether to enable printing log */
+} counter_tbl_t;
+
+
+void counter_printlog(counter_tbl_t *ctr_tbl);
+#endif /* DEBUG_COUNTER */
+
+/* Given a number 'n' returns 'm' that is next larger power of 2 after n */
+static INLINE uint32 next_larger_power2(uint32 num)
+{
+       num--;
+       num |= (num >> 1);
+       num |= (num >> 2);
+       num |= (num >> 4);
+       num |= (num >> 8);
+       num |= (num >> 16);
+       return (num + 1);
+}
+
+#endif /* _bcmutils_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/brcm_nl80211.h b/drivers/net/wireless/bcmdhd_1363/include/brcm_nl80211.h
new file mode 100644 (file)
index 0000000..43d6660
--- /dev/null
@@ -0,0 +1,68 @@
+/*
+ * Definitions for nl80211 vendor command/event access to host driver
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: brcm_nl80211.h 556083 2015-05-12 14:03:00Z $
+ *
+ */
+
+#ifndef _brcm_nl80211_h_
+#define _brcm_nl80211_h_
+
+#define OUI_BRCM  0x001018
+
+enum wl_vendor_subcmd {
+       BRCM_VENDOR_SCMD_UNSPEC,
+       BRCM_VENDOR_SCMD_PRIV_STR,
+       BRCM_VENDOR_SCMD_BCM_STR
+};
+
+
+struct bcm_nlmsg_hdr {
+       uint cmd;       /* common ioctl definition */
+       int len;        /* expected return buffer length */
+       uint offset;    /* user buffer offset */
+       uint set;       /* get or set request optional */
+       uint magic;     /* magic number for verification */
+};
+
+enum bcmnl_attrs {
+       BCM_NLATTR_UNSPEC,
+
+       BCM_NLATTR_LEN,
+       BCM_NLATTR_DATA,
+
+       __BCM_NLATTR_AFTER_LAST,
+       BCM_NLATTR_MAX = __BCM_NLATTR_AFTER_LAST - 1
+};
+
+struct nl_prv_data {
+       int err;                        /* return result */
+       void *data;                     /* ioctl return buffer pointer */
+       uint len;                       /* ioctl return buffer length */
+       struct bcm_nlmsg_hdr *nlioc;    /* bcm_nlmsg_hdr header pointer */
+};
+
+#endif /* _brcm_nl80211_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/dbus.h b/drivers/net/wireless/bcmdhd_1363/include/dbus.h
new file mode 100644 (file)
index 0000000..de60a31
--- /dev/null
@@ -0,0 +1,591 @@
+/*
+ * Dongle BUS interface Abstraction layer
+ *   target serial buses like USB, SDIO, SPI, etc.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dbus.h 553311 2015-04-29 10:23:08Z $
+ */
+
+#ifndef __DBUS_H__
+#define __DBUS_H__
+
+#include "typedefs.h"
+
+#define DBUSTRACE(args)
+#define DBUSERR(args)
+#define DBUSINFO(args)
+#define DBUSDBGLOCK(args)
+
+enum {
+       DBUS_OK = 0,
+       DBUS_ERR = -200,
+       DBUS_ERR_TIMEOUT,
+       DBUS_ERR_DISCONNECT,
+       DBUS_ERR_NODEVICE,
+       DBUS_ERR_UNSUPPORTED,
+       DBUS_ERR_PENDING,
+       DBUS_ERR_NOMEM,
+       DBUS_ERR_TXFAIL,
+       DBUS_ERR_TXTIMEOUT,
+       DBUS_ERR_TXDROP,
+       DBUS_ERR_RXFAIL,
+       DBUS_ERR_RXDROP,
+       DBUS_ERR_TXCTLFAIL,
+       DBUS_ERR_RXCTLFAIL,
+       DBUS_ERR_REG_PARAM,
+       DBUS_STATUS_CANCELLED,
+       DBUS_ERR_NVRAM,
+       DBUS_JUMBO_NOMATCH,
+       DBUS_JUMBO_BAD_FORMAT,
+       DBUS_NVRAM_NONTXT,
+       DBUS_ERR_RXZLP
+};
+
+#define BCM_OTP_SIZE_43236  84 /* number of 16 bit values */
+#define BCM_OTP_SW_RGN_43236   24  /* start offset of SW config region */
+#define BCM_OTP_ADDR_43236 0x18000800 /* address of otp base */
+
+#define ERR_CBMASK_TXFAIL              0x00000001
+#define ERR_CBMASK_RXFAIL              0x00000002
+#define ERR_CBMASK_ALL                 0xFFFFFFFF
+
+#define DBUS_CBCTL_WRITE                       0
+#define DBUS_CBCTL_READ                                1
+#if defined(INTR_EP_ENABLE)
+#define DBUS_CBINTR_POLL                       2
+#endif /* defined(INTR_EP_ENABLE) */
+
+#define DBUS_TX_RETRY_LIMIT            3               /* retries for failed txirb */
+#define DBUS_TX_TIMEOUT_INTERVAL       250             /* timeout for txirb complete, in ms */
+
+#define DBUS_BUFFER_SIZE_TX    32000
+#define DBUS_BUFFER_SIZE_RX    24000
+
+#define DBUS_BUFFER_SIZE_TX_NOAGG      2048
+#define DBUS_BUFFER_SIZE_RX_NOAGG      2048
+
+/** DBUS types */
+enum {
+       DBUS_USB,
+       DBUS_SDIO,
+       DBUS_SPI,
+       DBUS_UNKNOWN
+};
+
+enum dbus_state {
+       DBUS_STATE_DL_PENDING,
+       DBUS_STATE_DL_DONE,
+       DBUS_STATE_UP,
+       DBUS_STATE_DOWN,
+       DBUS_STATE_PNP_FWDL,
+       DBUS_STATE_DISCONNECT,
+       DBUS_STATE_SLEEP,
+       DBUS_STATE_DL_NEEDED
+};
+
+enum dbus_pnp_state {
+       DBUS_PNP_DISCONNECT,
+       DBUS_PNP_SLEEP,
+       DBUS_PNP_RESUME
+};
+
+enum dbus_file {
+    DBUS_FIRMWARE,
+    DBUS_NVFILE
+};
+
+typedef enum _DEVICE_SPEED {
+       INVALID_SPEED = -1,
+       LOW_SPEED     =  1,     /**< USB 1.1: 1.5 Mbps */
+       FULL_SPEED,             /**< USB 1.1: 12  Mbps */
+       HIGH_SPEED,             /**< USB 2.0: 480 Mbps */
+       SUPER_SPEED,            /**< USB 3.0: 4.8 Gbps */
+} DEVICE_SPEED;
+
+typedef struct {
+       int bustype;
+       int vid;
+       int pid;
+       int devid;
+       int chiprev; /**< chip revsion number */
+       int mtu;
+       int nchan; /**< Data Channels */
+       int has_2nd_bulk_in_ep;
+} dbus_attrib_t;
+
+/* FIX: Account for errors related to DBUS;
+ * Let upper layer account for packets/bytes
+ */
+typedef struct {
+       uint32 rx_errors;
+       uint32 tx_errors;
+       uint32 rx_dropped;
+       uint32 tx_dropped;
+} dbus_stats_t;
+
+/**
+ * Configurable BUS parameters
+ */
+enum {
+       DBUS_CONFIG_ID_RXCTL_DEFERRES = 1,
+       DBUS_CONFIG_ID_AGGR_LIMIT
+};
+
+typedef struct {
+       uint32 config_id;
+       union {
+               bool rxctl_deferrespok;
+               struct {
+                       int maxrxsf;
+                       int maxrxsize;
+                       int maxtxsf;
+                       int maxtxsize;
+               } aggr_param;
+       };
+} dbus_config_t;
+
+/**
+ * External Download Info
+ */
+typedef struct dbus_extdl {
+       uint8 *fw;
+       int fwlen;
+       uint8 *vars;
+       int varslen;
+} dbus_extdl_t;
+
+struct dbus_callbacks;
+struct exec_parms;
+
+typedef void *(*probe_cb_t)(void *arg, const char *desc, uint32 bustype, uint32 hdrlen);
+typedef void (*disconnect_cb_t)(void *arg);
+typedef void *(*exec_cb_t)(struct exec_parms *args);
+
+/** Client callbacks registered during dbus_attach() */
+typedef struct dbus_callbacks {
+       void (*send_complete)(void *cbarg, void *info, int status);
+       void (*recv_buf)(void *cbarg, uint8 *buf, int len);
+       void (*recv_pkt)(void *cbarg, void *pkt);
+       void (*txflowcontrol)(void *cbarg, bool onoff);
+       void (*errhandler)(void *cbarg, int err);
+       void (*ctl_complete)(void *cbarg, int type, int status);
+       void (*state_change)(void *cbarg, int state);
+       void *(*pktget)(void *cbarg, uint len, bool send);
+       void (*pktfree)(void *cbarg, void *p, bool send);
+} dbus_callbacks_t;
+
+struct dbus_pub;
+struct bcmstrbuf;
+struct dbus_irb;
+struct dbus_irb_rx;
+struct dbus_irb_tx;
+struct dbus_intf_callbacks;
+
+typedef struct {
+       void* (*attach)(struct dbus_pub *pub, void *cbarg, struct dbus_intf_callbacks *cbs);
+       void (*detach)(struct dbus_pub *pub, void *bus);
+
+       int (*up)(void *bus);
+       int (*down)(void *bus);
+       int (*send_irb)(void *bus, struct dbus_irb_tx *txirb);
+       int (*recv_irb)(void *bus, struct dbus_irb_rx *rxirb);
+       int (*cancel_irb)(void *bus, struct dbus_irb_tx *txirb);
+       int (*send_ctl)(void *bus, uint8 *buf, int len);
+       int (*recv_ctl)(void *bus, uint8 *buf, int len);
+       int (*get_stats)(void *bus, dbus_stats_t *stats);
+       int (*get_attrib)(void *bus, dbus_attrib_t *attrib);
+
+       int (*pnp)(void *bus, int evnt);
+       int (*remove)(void *bus);
+       int (*resume)(void *bus);
+       int (*suspend)(void *bus);
+       int (*stop)(void *bus);
+       int (*reset)(void *bus);
+
+       /* Access to bus buffers directly */
+       void *(*pktget)(void *bus, int len);
+       void (*pktfree)(void *bus, void *pkt);
+
+       int  (*iovar_op)(void *bus, const char *name, void *params, int plen, void *arg, int len,
+               bool set);
+       void (*dump)(void *bus, struct bcmstrbuf *strbuf);
+       int  (*set_config)(void *bus, dbus_config_t *config);
+       int  (*get_config)(void *bus, dbus_config_t *config);
+
+       bool (*device_exists)(void *bus);
+       bool (*dlneeded)(void *bus);
+       int  (*dlstart)(void *bus, uint8 *fw, int len);
+       int  (*dlrun)(void *bus);
+       bool (*recv_needed)(void *bus);
+
+       void *(*exec_rxlock)(void *bus, exec_cb_t func, struct exec_parms *args);
+       void *(*exec_txlock)(void *bus, exec_cb_t func, struct exec_parms *args);
+
+       int (*tx_timer_init)(void *bus);
+       int (*tx_timer_start)(void *bus, uint timeout);
+       int (*tx_timer_stop)(void *bus);
+
+       int (*sched_dpc)(void *bus);
+       int (*lock)(void *bus);
+       int (*unlock)(void *bus);
+       int (*sched_probe_cb)(void *bus);
+
+       int (*shutdown)(void *bus);
+
+       int (*recv_stop)(void *bus);
+       int (*recv_resume)(void *bus);
+
+       int (*recv_irb_from_ep)(void *bus, struct dbus_irb_rx *rxirb, uint ep_idx);
+
+       int (*readreg)(void *bus, uint32 regaddr, int datalen, uint32 *value);
+
+       /* Add from the bottom */
+} dbus_intf_t;
+
+typedef struct dbus_pub {
+       struct osl_info *osh;
+       dbus_stats_t stats;
+       dbus_attrib_t attrib;
+       enum dbus_state busstate;
+       DEVICE_SPEED device_speed;
+       int ntxq, nrxq, rxsize;
+       void *bus;
+       struct shared_info *sh;
+    void *dev_info;
+} dbus_pub_t;
+
+#define BUS_INFO(bus, type) (((type *) bus)->pub->bus)
+
+#define        ALIGNED_LOCAL_VARIABLE(var, align)                                      \
+       uint8   buffer[SDALIGN+64];                                             \
+       uint8   *var = (uint8 *)(((uintptr)&buffer[0]) & ~(align-1)) + align;
+
+/*
+ * Public Bus Function Interface
+ */
+
+/*
+ * FIX: Is there better way to pass OS/Host handles to DBUS but still
+ *      maintain common interface for all OS??
+ * Under NDIS, param1 needs to be MiniportHandle
+ *  For NDIS60, param2 is WdfDevice
+ * Under Linux, param1 and param2 are NULL;
+ */
+extern int dbus_register(int vid, int pid, probe_cb_t prcb, disconnect_cb_t discb, void *prarg,
+       void *param1, void *param2);
+extern int dbus_deregister(void);
+
+extern dbus_pub_t *dbus_attach(struct osl_info *osh, int rxsize, int nrxq, int ntxq,
+       void *cbarg, dbus_callbacks_t *cbs, dbus_extdl_t *extdl, struct shared_info *sh);
+extern void dbus_detach(dbus_pub_t *pub);
+
+extern int dbus_download_firmware(dbus_pub_t *pub);
+extern int dbus_up(dbus_pub_t *pub);
+extern int dbus_down(dbus_pub_t *pub);
+extern int dbus_stop(dbus_pub_t *pub);
+extern int dbus_shutdown(dbus_pub_t *pub);
+extern void dbus_flowctrl_rx(dbus_pub_t *pub, bool on);
+
+extern int dbus_send_txdata(dbus_pub_t *dbus, void *pktbuf);
+extern int dbus_send_buf(dbus_pub_t *pub, uint8 *buf, int len, void *info);
+extern int dbus_send_pkt(dbus_pub_t *pub, void *pkt, void *info);
+extern int dbus_send_ctl(dbus_pub_t *pub, uint8 *buf, int len);
+extern int dbus_recv_ctl(dbus_pub_t *pub, uint8 *buf, int len);
+extern int dbus_recv_bulk(dbus_pub_t *pub, uint32 ep_idx);
+extern int dbus_poll_intr(dbus_pub_t *pub);
+extern int dbus_get_stats(dbus_pub_t *pub, dbus_stats_t *stats);
+extern int dbus_get_attrib(dbus_pub_t *pub, dbus_attrib_t *attrib);
+extern int dbus_get_device_speed(dbus_pub_t *pub);
+extern int dbus_set_config(dbus_pub_t *pub, dbus_config_t *config);
+extern int dbus_get_config(dbus_pub_t *pub, dbus_config_t *config);
+extern void * dbus_get_devinfo(dbus_pub_t *pub);
+
+extern void *dbus_pktget(dbus_pub_t *pub, int len);
+extern void dbus_pktfree(dbus_pub_t *pub, void* pkt);
+
+extern int dbus_set_errmask(dbus_pub_t *pub, uint32 mask);
+extern int dbus_pnp_sleep(dbus_pub_t *pub);
+extern int dbus_pnp_resume(dbus_pub_t *pub, int *fw_reload);
+extern int dbus_pnp_disconnect(dbus_pub_t *pub);
+
+extern int dbus_iovar_op(dbus_pub_t *pub, const char *name,
+       void *params, int plen, void *arg, int len, bool set);
+
+extern void *dhd_dbus_txq(const dbus_pub_t *pub);
+extern uint dhd_dbus_hdrlen(const dbus_pub_t *pub);
+
+/*
+ * Private Common Bus Interface
+ */
+
+/** IO Request Block (IRB) */
+typedef struct dbus_irb {
+       struct dbus_irb *next;  /**< it's casted from dbus_irb_tx or dbus_irb_rx struct */
+} dbus_irb_t;
+
+typedef struct dbus_irb_rx {
+       struct dbus_irb irb; /* Must be first */
+       uint8 *buf;
+       int buf_len;
+       int actual_len;
+       void *pkt;
+       void *info;
+       void *arg;
+} dbus_irb_rx_t;
+
+typedef struct dbus_irb_tx {
+       struct dbus_irb irb;    /** Must be first */
+       uint8 *buf;             /** mutually exclusive with struct member 'pkt' */
+       int len;                /** length of field 'buf' */
+       void *pkt;              /** mutually exclusive with struct member 'buf' */
+       int retry_count;
+       void *info;
+       void *arg;
+       void *send_buf;         /**< linear  bufffer for LINUX when aggreagtion is enabled */
+} dbus_irb_tx_t;
+
+/**
+ * DBUS interface callbacks are different from user callbacks
+ * so, internally, different info can be passed to upper layer
+ */
+typedef struct dbus_intf_callbacks {
+       void (*send_irb_timeout)(void *cbarg, dbus_irb_tx_t *txirb);
+       void (*send_irb_complete)(void *cbarg, dbus_irb_tx_t *txirb, int status);
+       void (*recv_irb_complete)(void *cbarg, dbus_irb_rx_t *rxirb, int status);
+       void (*errhandler)(void *cbarg, int err);
+       void (*ctl_complete)(void *cbarg, int type, int status);
+       void (*state_change)(void *cbarg, int state);
+       bool (*isr)(void *cbarg, bool *wantdpc);
+       bool (*dpc)(void *cbarg, bool bounded);
+       void (*watchdog)(void *cbarg);
+       void *(*pktget)(void *cbarg, uint len, bool send);
+       void (*pktfree)(void *cbarg, void *p, bool send);
+       struct dbus_irb* (*getirb)(void *cbarg, bool send);
+       void (*rxerr_indicate)(void *cbarg, bool on);
+} dbus_intf_callbacks_t;
+
+/*
+ * Porting: To support new bus, port these functions below
+ */
+
+/*
+ * Bus specific Interface
+ * Implemented by dbus_usb.c/dbus_sdio.c
+ */
+extern int dbus_bus_register(int vid, int pid, probe_cb_t prcb, disconnect_cb_t discb, void *prarg,
+       dbus_intf_t **intf, void *param1, void *param2);
+extern int dbus_bus_deregister(void);
+extern void dbus_bus_fw_get(void *bus, uint8 **fw, int *fwlen, int *decomp);
+
+/*
+ * Bus-specific and OS-specific Interface
+ * Implemented by dbus_usb_[linux/ndis].c/dbus_sdio_[linux/ndis].c
+ */
+extern int dbus_bus_osl_register(int vid, int pid, probe_cb_t prcb, disconnect_cb_t discb,
+       void *prarg, dbus_intf_t **intf, void *param1, void *param2);
+extern int dbus_bus_osl_deregister(void);
+
+/*
+ * Bus-specific, OS-specific, HW-specific Interface
+ * Mainly for SDIO Host HW controller
+ */
+extern int dbus_bus_osl_hw_register(int vid, int pid, probe_cb_t prcb, disconnect_cb_t discb,
+       void *prarg, dbus_intf_t **intf);
+extern int dbus_bus_osl_hw_deregister(void);
+
+extern uint usbdev_bulkin_eps(void);
+#if defined(BCM_REQUEST_FW)
+extern void *dbus_get_fw_nvfile(int devid, int chiprev, uint8 **fw, int *fwlen, int type,
+  uint16 boardtype, uint16 boardrev);
+extern void dbus_release_fw_nvfile(void *firmware);
+#endif  /* #if defined(BCM_REQUEST_FW) */
+
+
+#if defined(EHCI_FASTPATH_TX) || defined(EHCI_FASTPATH_RX)
+
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+       /* Backward compatibility */
+       typedef unsigned int gfp_t;
+
+       #define dma_pool pci_pool
+       #define dma_pool_create(name, dev, size, align, alloc) \
+               pci_pool_create(name, dev, size, align, alloc, GFP_DMA | GFP_ATOMIC)
+       #define dma_pool_destroy(pool) pci_pool_destroy(pool)
+       #define dma_pool_alloc(pool, flags, handle) pci_pool_alloc(pool, flags, handle)
+       #define dma_pool_free(pool, vaddr, addr) pci_pool_free(pool, vaddr, addr)
+
+       #define dma_map_single(dev, addr, size, dir)    pci_map_single(dev, addr, size, dir)
+       #define dma_unmap_single(dev, hnd, size, dir)   pci_unmap_single(dev, hnd, size, dir)
+       #define DMA_FROM_DEVICE PCI_DMA_FROMDEVICE
+       #define DMA_TO_DEVICE PCI_DMA_TODEVICE
+#endif /* (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0)) */
+
+/* Availability of these functions varies (when present, they have two arguments) */
+#ifndef hc32_to_cpu
+       #define hc32_to_cpu(x)  le32_to_cpu(x)
+       #define cpu_to_hc32(x)  cpu_to_le32(x)
+       typedef unsigned int __hc32;
+#else
+       #error Two-argument functions needed
+#endif
+
+/* Private USB opcode base */
+#define EHCI_FASTPATH          0x31
+#define        EHCI_SET_EP_BYPASS      EHCI_FASTPATH
+#define        EHCI_SET_BYPASS_CB      (EHCI_FASTPATH + 1)
+#define        EHCI_SET_BYPASS_DEV     (EHCI_FASTPATH + 2)
+#define        EHCI_DUMP_STATE         (EHCI_FASTPATH + 3)
+#define        EHCI_SET_BYPASS_POOL    (EHCI_FASTPATH + 4)
+#define        EHCI_CLR_EP_BYPASS      (EHCI_FASTPATH + 5)
+
+/*
+ * EHCI QTD structure (hardware and extension)
+ * NOTE that is does not need to (and does not) match its kernel counterpart
+ */
+#define EHCI_QTD_NBUFFERS       5
+#define EHCI_QTD_ALIGN         32
+#define EHCI_BULK_PACKET_SIZE  512
+#define EHCI_QTD_XACTERR_MAX   32
+
+struct ehci_qtd {
+       /* Hardware map */
+       volatile uint32_t       qtd_next;
+       volatile uint32_t       qtd_altnext;
+       volatile uint32_t       qtd_status;
+#define        EHCI_QTD_GET_BYTES(x)   (((x)>>16) & 0x7fff)
+#define        EHCI_QTD_IOC            0x00008000
+#define        EHCI_QTD_GET_CERR(x)    (((x)>>10) & 0x3)
+#define EHCI_QTD_SET_CERR(x)    ((x) << 10)
+#define        EHCI_QTD_GET_PID(x)     (((x)>>8) & 0x3)
+#define EHCI_QTD_SET_PID(x)     ((x) <<  8)
+#define EHCI_QTD_ACTIVE         0x80
+#define EHCI_QTD_HALTED         0x40
+#define EHCI_QTD_BUFERR         0x20
+#define EHCI_QTD_BABBLE         0x10
+#define EHCI_QTD_XACTERR        0x08
+#define EHCI_QTD_MISSEDMICRO    0x04
+       volatile uint32_t       qtd_buffer[EHCI_QTD_NBUFFERS];
+       volatile uint32_t       qtd_buffer_hi[EHCI_QTD_NBUFFERS];
+
+       /* Implementation extension */
+       dma_addr_t              qtd_self;               /**< own hardware address */
+       struct ehci_qtd         *obj_next;              /**< software link to the next QTD */
+       void                    *rpc;                   /**< pointer to the rpc buffer */
+       size_t                  length;                 /**< length of the data in the buffer */
+       void                    *buff;                  /**< pointer to the reassembly buffer */
+       int                     xacterrs;               /**< retry counter for qtd xact error */
+} __attribute__ ((aligned(EHCI_QTD_ALIGN)));
+
+#define        EHCI_NULL       __constant_cpu_to_le32(1) /* HW null pointer shall be odd */
+
+#define SHORT_READ_Q(token) (EHCI_QTD_GET_BYTES(token) != 0 && EHCI_QTD_GET_PID(token) == 1)
+
+/**
+ * Queue Head
+ * NOTE This structure is slightly different from the one in the kernel; but needs to stay
+ * compatible.
+ */
+struct ehci_qh {
+       /* Hardware map */
+       volatile uint32_t       qh_link;
+       volatile uint32_t       qh_endp;
+       volatile uint32_t       qh_endphub;
+       volatile uint32_t       qh_curqtd;
+
+       /* QTD overlay */
+       volatile uint32_t       ow_next;
+       volatile uint32_t       ow_altnext;
+       volatile uint32_t       ow_status;
+       volatile uint32_t       ow_buffer [EHCI_QTD_NBUFFERS];
+       volatile uint32_t       ow_buffer_hi [EHCI_QTD_NBUFFERS];
+
+       /* Extension (should match the kernel layout) */
+       dma_addr_t              unused0;
+       void                    *unused1;
+       struct list_head        unused2;
+       struct ehci_qtd         *dummy;
+       struct ehci_qh          *unused3;
+
+       struct ehci_hcd         *unused4;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+       struct kref             unused5;
+       unsigned                unused6;
+
+       uint8_t                 unused7;
+
+       /* periodic schedule info */
+       uint8_t                 unused8;
+       uint8_t                 unused9;
+       uint8_t                 unused10;
+       uint16_t                unused11;
+       uint16_t                unused12;
+       uint16_t                unused13;
+       struct usb_device       *unused14;
+#else
+       unsigned                unused5;
+
+       u8                      unused6;
+
+       /* periodic schedule info */
+       u8                      unused7;
+       u8                      unused8;
+       u8                      unused9;
+       unsigned short          unused10;
+       unsigned short          unused11;
+#define NO_FRAME ((unsigned short)~0)
+#ifdef EHCI_QUIRK_FIX
+       struct usb_device       *unused12;
+#endif /* EHCI_QUIRK_FIX */
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)) */
+       struct ehci_qtd         *first_qtd;
+               /* Link to the first QTD; this is an optimized equivalent of the qtd_list field */
+               /* NOTE that ehci_qh in ehci.h shall reserve this word */
+} __attribute__ ((aligned(EHCI_QTD_ALIGN)));
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+/** The corresponding structure in the kernel is used to get the QH */
+struct hcd_dev {       /* usb_device.hcpriv points to this */
+       struct list_head        unused0;
+       struct list_head        unused1;
+
+       /* array of QH pointers */
+       void                    *ep[32];
+};
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)) */
+
+int optimize_qtd_fill_with_rpc(const dbus_pub_t *pub,  int epn, struct ehci_qtd *qtd, void *rpc,
+       int token, int len);
+int optimize_qtd_fill_with_data(const dbus_pub_t *pub, int epn, struct ehci_qtd *qtd, void *data,
+       int token, int len);
+int optimize_submit_async(struct ehci_qtd *qtd, int epn);
+void inline optimize_ehci_qtd_init(struct ehci_qtd *qtd, dma_addr_t dma);
+struct ehci_qtd *optimize_ehci_qtd_alloc(gfp_t flags);
+void optimize_ehci_qtd_free(struct ehci_qtd *qtd);
+void optimize_submit_rx_request(const dbus_pub_t *pub, int epn, struct ehci_qtd *qtd_in, void *buf);
+#endif /* EHCI_FASTPATH_TX || EHCI_FASTPATH_RX */
+
+void  dbus_flowctrl_tx(void *dbi, bool on);
+#endif /* __DBUS_H__ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/devctrl_if/wlioctl_defs.h b/drivers/net/wireless/bcmdhd_1363/include/devctrl_if/wlioctl_defs.h
new file mode 100644 (file)
index 0000000..ca9e332
--- /dev/null
@@ -0,0 +1,2211 @@
+/*
+ * Custom OID/ioctl definitions for
+ * Broadcom 802.11abg Networking Device Driver
+ *
+ * Definitions subject to change without notice.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: wlioctl_defs.h 655604 2016-08-22 16:49:21Z $
+ */
+
+
+#ifndef wlioctl_defs_h
+#define wlioctl_defs_h
+
+
+
+
+/* All builds use the new 11ac ratespec/chanspec */
+#undef  D11AC_IOTYPES
+#define D11AC_IOTYPES
+
+/* WL_RSPEC defines for rate information */
+#define WL_RSPEC_RATE_MASK      0x000000FF      /* rate or HT MCS value */
+#define WL_RSPEC_VHT_MCS_MASK   0x0000000F      /* VHT MCS value */
+#define WL_RSPEC_VHT_NSS_MASK   0x000000F0      /* VHT Nss value */
+#define WL_RSPEC_VHT_NSS_SHIFT  4               /* VHT Nss value shift */
+#define WL_RSPEC_TXEXP_MASK     0x00000300
+#define WL_RSPEC_TXEXP_SHIFT    8
+#define WL_RSPEC_BW_MASK        0x00070000      /* bandwidth mask */
+#define WL_RSPEC_BW_SHIFT       16              /* bandwidth shift */
+#define WL_RSPEC_STBC           0x00100000      /* STBC encoding, Nsts = 2 x Nss */
+#define WL_RSPEC_TXBF           0x00200000      /* bit indicates TXBF mode */
+#define WL_RSPEC_LDPC           0x00400000      /* bit indicates adv coding in use */
+#define WL_RSPEC_SGI            0x00800000      /* Short GI mode */
+#define WL_RSPEC_ENCODING_MASK  0x03000000      /* Encoding of Rate/MCS field */
+#define WL_RSPEC_OVERRIDE_RATE  0x40000000      /* bit indicate to override mcs only */
+#define WL_RSPEC_OVERRIDE_MODE  0x80000000      /* bit indicates override both rate & mode */
+
+/* WL_RSPEC_ENCODING field defs */
+#define WL_RSPEC_ENCODE_RATE    0x00000000      /* Legacy rate is stored in RSPEC_RATE_MASK */
+#define WL_RSPEC_ENCODE_HT      0x01000000      /* HT MCS is stored in RSPEC_RATE_MASK */
+#define WL_RSPEC_ENCODE_VHT     0x02000000      /* VHT MCS and Nss is stored in RSPEC_RATE_MASK */
+
+/* WL_RSPEC_BW field defs */
+#define WL_RSPEC_BW_UNSPECIFIED 0
+#define WL_RSPEC_BW_20MHZ       0x00010000
+#define WL_RSPEC_BW_40MHZ       0x00020000
+#define WL_RSPEC_BW_80MHZ       0x00030000
+#define WL_RSPEC_BW_160MHZ      0x00040000
+#define WL_RSPEC_BW_10MHZ      0x00050000
+#define WL_RSPEC_BW_5MHZ       0x00060000
+#define WL_RSPEC_BW_2P5MHZ      0x00070000
+
+/* Legacy defines for the nrate iovar */
+#define OLD_NRATE_MCS_INUSE         0x00000080 /* MSC in use,indicates b0-6 holds an mcs */
+#define OLD_NRATE_RATE_MASK         0x0000007f /* rate/mcs value */
+#define OLD_NRATE_STF_MASK          0x0000ff00 /* stf mode mask: siso, cdd, stbc, sdm */
+#define OLD_NRATE_STF_SHIFT         8          /* stf mode shift */
+#define OLD_NRATE_OVERRIDE          0x80000000 /* bit indicates override both rate & mode */
+#define OLD_NRATE_OVERRIDE_MCS_ONLY 0x40000000 /* bit indicate to override mcs only */
+#define OLD_NRATE_SGI               0x00800000 /* sgi mode */
+#define OLD_NRATE_LDPC_CODING       0x00400000 /* bit indicates adv coding in use */
+
+#define OLD_NRATE_STF_SISO     0               /* stf mode SISO */
+#define OLD_NRATE_STF_CDD      1               /* stf mode CDD */
+#define OLD_NRATE_STF_STBC     2               /* stf mode STBC */
+#define OLD_NRATE_STF_SDM      3               /* stf mode SDM */
+
+#define HIGHEST_SINGLE_STREAM_MCS      7 /* MCS values greater than this enable multiple streams */
+#define WLC_11N_N_PROP_MCS     6
+#define WLC_11N_FIRST_PROP_MCS 87
+#define WLC_11N_LAST_PROP_MCS  102
+
+#define MAX_CCA_CHANNELS 38    /* Max number of 20 Mhz wide channels */
+#define MAX_CCA_SECS   60      /* CCA keeps this many seconds history */
+
+#define IBSS_MED        15     /* Mediom in-bss congestion percentage */
+#define IBSS_HI         25     /* Hi in-bss congestion percentage */
+#define OBSS_MED        12
+#define OBSS_HI         25
+#define INTERFER_MED    5
+#define INTERFER_HI     10
+
+#define  CCA_FLAG_2G_ONLY              0x01    /* Return a channel from 2.4 Ghz band */
+#define  CCA_FLAG_5G_ONLY              0x02    /* Return a channel from 2.4 Ghz band */
+#define  CCA_FLAG_IGNORE_DURATION      0x04    /* Ignore dwell time for each channel */
+#define  CCA_FLAGS_PREFER_1_6_11       0x10
+#define  CCA_FLAG_IGNORE_INTERFER      0x20 /* do not exlude channel based on interfer level */
+
+#define CCA_ERRNO_BAND                 1       /* After filtering for band pref, no choices left */
+#define CCA_ERRNO_DURATION     2       /* After filtering for duration, no choices left */
+#define CCA_ERRNO_PREF_CHAN    3       /* After filtering for chan pref, no choices left */
+#define CCA_ERRNO_INTERFER     4       /* After filtering for interference, no choices left */
+#define CCA_ERRNO_TOO_FEW      5       /* Only 1 channel was input */
+
+#define WL_STA_AID(a)          ((a) &~ 0xc000)
+
+/* Flags for sta_info_t indicating properties of STA */
+#define WL_STA_BRCM            0x00000001      /* Running a Broadcom driver */
+#define WL_STA_WME             0x00000002      /* WMM association */
+#define WL_STA_NONERP          0x00000004      /* No ERP */
+#define WL_STA_AUTHE           0x00000008      /* Authenticated */
+#define WL_STA_ASSOC           0x00000010      /* Associated */
+#define WL_STA_AUTHO           0x00000020      /* Authorized */
+#define WL_STA_WDS             0x00000040      /* Wireless Distribution System */
+#define WL_STA_WDS_LINKUP      0x00000080      /* WDS traffic/probes flowing properly */
+#define WL_STA_PS              0x00000100      /* STA is in power save mode from AP's viewpoint */
+#define WL_STA_APSD_BE         0x00000200      /* APSD delv/trigger for AC_BE is default enabled */
+#define WL_STA_APSD_BK         0x00000400      /* APSD delv/trigger for AC_BK is default enabled */
+#define WL_STA_APSD_VI         0x00000800      /* APSD delv/trigger for AC_VI is default enabled */
+#define WL_STA_APSD_VO         0x00001000      /* APSD delv/trigger for AC_VO is default enabled */
+#define WL_STA_N_CAP           0x00002000      /* STA 802.11n capable */
+#define WL_STA_SCBSTATS                0x00004000      /* Per STA debug stats */
+#define WL_STA_AMPDU_CAP       0x00008000      /* STA AMPDU capable */
+#define WL_STA_AMSDU_CAP       0x00010000      /* STA AMSDU capable */
+#define WL_STA_MIMO_PS         0x00020000      /* mimo ps mode is enabled */
+#define WL_STA_MIMO_RTS                0x00040000      /* send rts in mimo ps mode */
+#define WL_STA_RIFS_CAP                0x00080000      /* rifs enabled */
+#define WL_STA_VHT_CAP         0x00100000      /* STA VHT(11ac) capable */
+#define WL_STA_WPS             0x00200000      /* WPS state */
+#define WL_STA_DWDS_CAP                0x01000000      /* DWDS CAP */
+#define WL_STA_DWDS            0x02000000      /* DWDS active */
+#define WL_WDS_LINKUP          WL_STA_WDS_LINKUP       /* deprecated */
+
+/* STA HT cap fields */
+#define WL_STA_CAP_LDPC_CODING         0x0001  /* Support for rx of LDPC coded pkts */
+#define WL_STA_CAP_40MHZ               0x0002  /* FALSE:20Mhz, TRUE:20/40MHZ supported */
+#define WL_STA_CAP_MIMO_PS_MASK                0x000C  /* Mimo PS mask */
+#define WL_STA_CAP_MIMO_PS_SHIFT       0x0002  /* Mimo PS shift */
+#define WL_STA_CAP_MIMO_PS_OFF         0x0003  /* Mimo PS, no restriction */
+#define WL_STA_CAP_MIMO_PS_RTS         0x0001  /* Mimo PS, send RTS/CTS around MIMO frames */
+#define WL_STA_CAP_MIMO_PS_ON          0x0000  /* Mimo PS, MIMO disallowed */
+#define WL_STA_CAP_GF                  0x0010  /* Greenfield preamble support */
+#define WL_STA_CAP_SHORT_GI_20         0x0020  /* 20MHZ short guard interval support */
+#define WL_STA_CAP_SHORT_GI_40         0x0040  /* 40Mhz short guard interval support */
+#define WL_STA_CAP_TX_STBC             0x0080  /* Tx STBC support */
+#define WL_STA_CAP_RX_STBC_MASK                0x0300  /* Rx STBC mask */
+#define WL_STA_CAP_RX_STBC_SHIFT       8       /* Rx STBC shift */
+#define WL_STA_CAP_DELAYED_BA          0x0400  /* delayed BA support */
+#define WL_STA_CAP_MAX_AMSDU           0x0800  /* Max AMSDU size in bytes , 0=3839, 1=7935 */
+#define WL_STA_CAP_DSSS_CCK            0x1000  /* DSSS/CCK supported by the BSS */
+#define WL_STA_CAP_PSMP                        0x2000  /* Power Save Multi Poll support */
+#define WL_STA_CAP_40MHZ_INTOLERANT    0x4000  /* 40MHz Intolerant */
+#define WL_STA_CAP_LSIG_TXOP           0x8000  /* L-SIG TXOP protection support */
+
+#define WL_STA_CAP_RX_STBC_NO          0x0     /* no rx STBC support */
+#define WL_STA_CAP_RX_STBC_ONE_STREAM  0x1     /* rx STBC support of 1 spatial stream */
+#define WL_STA_CAP_RX_STBC_TWO_STREAM  0x2     /* rx STBC support of 1-2 spatial streams */
+#define WL_STA_CAP_RX_STBC_THREE_STREAM        0x3     /* rx STBC support of 1-3 spatial streams */
+
+/* scb vht flags */
+#define WL_STA_VHT_LDPCCAP     0x0001
+#define WL_STA_SGI80           0x0002
+#define WL_STA_SGI160          0x0004
+#define WL_STA_VHT_TX_STBCCAP  0x0008
+#define WL_STA_VHT_RX_STBCCAP  0x0010
+#define WL_STA_SU_BEAMFORMER   0x0020
+#define WL_STA_SU_BEAMFORMEE   0x0040
+#define WL_STA_MU_BEAMFORMER   0x0080
+#define WL_STA_MU_BEAMFORMEE   0x0100
+#define WL_STA_VHT_TXOP_PS     0x0200
+#define WL_STA_HTC_VHT_CAP     0x0400
+
+/* Values for TX Filter override mode */
+#define WLC_TXFILTER_OVERRIDE_DISABLED  0
+#define WLC_TXFILTER_OVERRIDE_ENABLED   1
+
+#define WL_IOCTL_ACTION_GET            0x0
+#define WL_IOCTL_ACTION_SET            0x1
+#define WL_IOCTL_ACTION_OVL_IDX_MASK   0x1e
+#define WL_IOCTL_ACTION_OVL_RSV                0x20
+#define WL_IOCTL_ACTION_OVL            0x40
+#define WL_IOCTL_ACTION_MASK           0x7e
+#define WL_IOCTL_ACTION_OVL_SHIFT      1
+
+/* For WLC_SET_INFRA ioctl & infra_configuration iovar SET/GET operations */
+#define WL_BSSTYPE_INDEP 0
+#define WL_BSSTYPE_INFRA 1
+#define WL_BSSTYPE_ANY   2     /* deprecated */
+#define WL_BSSTYPE_MESH  3
+/* Bitmask for scan_type */
+#define WL_SCANFLAGS_PASSIVE   0x01    /* force passive scan */
+#define WL_SCANFLAGS_RESERVED  0x02    /* Reserved */
+#define WL_SCANFLAGS_PROHIBITED        0x04    /* allow scanning prohibited channels */
+#define WL_SCANFLAGS_OFFCHAN   0x08    /* allow scanning/reporting off-channel APs */
+#define WL_SCANFLAGS_HOTSPOT   0x10    /* automatic ANQP to hotspot APs */
+#define WL_SCANFLAGS_SWTCHAN   0x20    /* Force channel switch for differerent bandwidth */
+#define WL_SCANFLAGS_FORCE_PARALLEL 0x40 /* Force parallel scan even when actcb_fn_t is on.
+                                         * by default parallel scan will be disabled if actcb_fn_t
+                                         * is provided.
+                                         */
+#define WL_SCANFLAGS_SISO      0x40    /* Use 1 RX chain for scanning */
+#define WL_SCANFLAGS_MIMO      0x80    /* Force MIMO scanning */
+
+/* wl_iscan_results status values */
+#define WL_SCAN_RESULTS_SUCCESS        0
+#define WL_SCAN_RESULTS_PARTIAL        1
+#define WL_SCAN_RESULTS_PENDING        2
+#define WL_SCAN_RESULTS_ABORTED        3
+#define WL_SCAN_RESULTS_NO_MEM  4
+
+#define SCANOL_ENABLED                 (1 << 0)
+#define SCANOL_BCAST_SSID              (1 << 1)
+#define SCANOL_NOTIFY_BCAST_SSID       (1 << 2)
+#define SCANOL_RESULTS_PER_CYCLE       (1 << 3)
+
+/* scan times in milliseconds */
+#define SCANOL_HOME_TIME               45      /* for home channel processing */
+#define SCANOL_ASSOC_TIME              20      /* dwell on a channel while associated */
+#define SCANOL_UNASSOC_TIME            40      /* dwell on a channel while unassociated */
+#define SCANOL_PASSIVE_TIME            110     /* listen on a channelfor passive scan */
+#define SCANOL_AWAY_LIMIT              100     /* max time to be away from home channel */
+#define SCANOL_IDLE_REST_TIME          40
+#define SCANOL_IDLE_REST_MULTIPLIER    0
+#define SCANOL_ACTIVE_REST_TIME                20
+#define SCANOL_ACTIVE_REST_MULTIPLIER  0
+#define SCANOL_CYCLE_IDLE_REST_TIME    300000  /* Idle Rest Time between Scan Cycle (msec) */
+#define SCANOL_CYCLE_IDLE_REST_MULTIPLIER      0       /* Idle Rest Time Multiplier */
+#define SCANOL_CYCLE_ACTIVE_REST_TIME  200
+#define SCANOL_CYCLE_ACTIVE_REST_MULTIPLIER    0
+#define SCANOL_MAX_REST_TIME           3600000 /* max rest time between scan cycle (msec) */
+#define SCANOL_CYCLE_DEFAULT           0       /* default for Max Scan Cycle, 0 = forever */
+#define SCANOL_CYCLE_MAX               864000  /* Max Scan Cycle */
+                                               /* 10 sec/scan cycle => 100 days */
+#define SCANOL_NPROBES                 2       /* for Active scan; send n probes on each channel */
+#define SCANOL_NPROBES_MAX             5       /* for Active scan; send n probes on each channel */
+#define SCANOL_SCAN_START_DLY          10      /* delay start of offload scan (sec) */
+#define SCANOL_SCAN_START_DLY_MAX      240     /* delay start of offload scan (sec) */
+#define SCANOL_MULTIPLIER_MAX          10      /* Max Multiplier */
+#define SCANOL_UNASSOC_TIME_MAX                100     /* max dwell on a channel while unassociated */
+#define SCANOL_PASSIVE_TIME_MAX                500     /* max listen on a channel for passive scan */
+#define SCANOL_SSID_MAX                        16      /* max supported preferred SSID */
+
+/* masks for channel and ssid count */
+#define WL_SCAN_PARAMS_COUNT_MASK 0x0000ffff
+#define WL_SCAN_PARAMS_NSSID_SHIFT 16
+
+#define WL_SCAN_ACTION_START      1
+#define WL_SCAN_ACTION_CONTINUE   2
+#define WL_SCAN_ACTION_ABORT      3
+
+#define ANTENNA_NUM_1  1               /* total number of antennas to be used */
+#define ANTENNA_NUM_2  2
+#define ANTENNA_NUM_3  3
+#define ANTENNA_NUM_4  4
+
+#define ANT_SELCFG_AUTO                0x80    /* bit indicates antenna sel AUTO */
+#define ANT_SELCFG_MASK                0x33    /* antenna configuration mask */
+#define ANT_SELCFG_TX_UNICAST  0       /* unicast tx antenna configuration */
+#define ANT_SELCFG_RX_UNICAST  1       /* unicast rx antenna configuration */
+#define ANT_SELCFG_TX_DEF      2       /* default tx antenna configuration */
+#define ANT_SELCFG_RX_DEF      3       /* default rx antenna configuration */
+
+/* interference source detection and identification mode */
+#define ITFR_MODE_DISABLE      0       /* disable feature */
+#define ITFR_MODE_MANUAL_ENABLE        1       /* enable manual detection */
+#define ITFR_MODE_AUTO_ENABLE  2       /* enable auto detection */
+
+/* bit definitions for flags in interference source report */
+#define ITFR_INTERFERENCED     1       /* interference detected */
+#define ITFR_HOME_CHANNEL      2       /* home channel has interference */
+#define ITFR_NOISY_ENVIRONMENT 4       /* noisy environemnt so feature stopped */
+
+#define WL_NUM_RPI_BINS                8
+#define WL_RM_TYPE_BASIC       1
+#define WL_RM_TYPE_CCA         2
+#define WL_RM_TYPE_RPI         3
+#define WL_RM_TYPE_ABORT       -1      /* ABORT any in-progress RM request */
+
+#define WL_RM_FLAG_PARALLEL    (1<<0)
+
+#define WL_RM_FLAG_LATE                (1<<1)
+#define WL_RM_FLAG_INCAPABLE   (1<<2)
+#define WL_RM_FLAG_REFUSED     (1<<3)
+
+/* flags */
+#define WLC_ASSOC_REQ_IS_REASSOC 0x01 /* assoc req was actually a reassoc */
+
+#define WLC_CIS_DEFAULT        0       /* built-in default */
+#define WLC_CIS_SROM   1       /* source is sprom */
+#define WLC_CIS_OTP    2       /* source is otp */
+
+/* PCL - Power Control Loop */
+/* current gain setting is replaced by user input */
+#define WL_ATTEN_APP_INPUT_PCL_OFF     0       /* turn off PCL, apply supplied input */
+#define WL_ATTEN_PCL_ON                        1       /* turn on PCL */
+/* current gain setting is maintained */
+#define WL_ATTEN_PCL_OFF               2       /* turn off PCL. */
+
+/* defines used by poweridx iovar - it controls power in a-band */
+/* current gain setting is maintained */
+#define WL_PWRIDX_PCL_OFF      -2      /* turn off PCL.  */
+#define WL_PWRIDX_PCL_ON       -1      /* turn on PCL */
+#define WL_PWRIDX_LOWER_LIMIT  -2      /* lower limit */
+#define WL_PWRIDX_UPPER_LIMIT  63      /* upper limit */
+/* value >= 0 causes
+ *     - input to be set to that value
+ *     - PCL to be off
+ */
+
+#define BCM_MAC_STATUS_INDICATION      (0x40010200L)
+
+/* Values for TX Filter override mode */
+#define WLC_TXFILTER_OVERRIDE_DISABLED  0
+#define WLC_TXFILTER_OVERRIDE_ENABLED   1
+
+/* magic pattern used for mismatch driver and wl */
+#define WL_TXFIFO_SZ_MAGIC     0xa5a5
+
+/* check this magic number */
+#define WLC_IOCTL_MAGIC                0x14e46c77
+
+
+/* bss_info_cap_t flags */
+#define WL_BSS_FLAGS_FROM_BEACON       0x01    /* bss_info derived from beacon */
+#define WL_BSS_FLAGS_FROM_CACHE                0x02    /* bss_info collected from cache */
+#define WL_BSS_FLAGS_RSSI_ONCHANNEL    0x04    /* rssi info received on channel (vs offchannel) */
+#define WL_BSS_FLAGS_HS20              0x08    /* hotspot 2.0 capable */
+#define WL_BSS_FLAGS_RSSI_INVALID      0x10    /* BSS contains invalid RSSI */
+#define WL_BSS_FLAGS_RSSI_INACCURATE   0x20    /* BSS contains inaccurate RSSI */
+#define WL_BSS_FLAGS_SNR_INVALID       0x40    /* BSS contains invalid SNR */
+#define WL_BSS_FLAGS_NF_INVALID                0x80    /* BSS contains invalid noise floor */
+
+/* bit definitions for bcnflags in wl_bss_info */
+#define WL_BSS_BCNFLAGS_INTERWORK_PRESENT      0x01 /* beacon had IE, accessnet valid */
+#define WL_BSS_BCNFLAGS_INTERWORK_PRESENT_VALID 0x02 /* on indicates support for this API */
+
+/* bssinfo flag for nbss_cap */
+#define VHT_BI_SGI_80MHZ                       0x00000100
+#define VHT_BI_80MHZ                       0x00000200
+#define VHT_BI_160MHZ                      0x00000400
+#define VHT_BI_8080MHZ                     0x00000800
+
+/* reference to wl_ioctl_t struct used by usermode driver */
+#define ioctl_subtype  set             /* subtype param */
+#define ioctl_pid      used            /* pid param */
+#define ioctl_status   needed          /* status param */
+
+
+/* Enumerate crypto algorithms */
+#define        CRYPTO_ALGO_OFF                 0
+#define        CRYPTO_ALGO_WEP1                1
+#define        CRYPTO_ALGO_TKIP                2
+#define        CRYPTO_ALGO_WEP128              3
+#define CRYPTO_ALGO_AES_CCM            4
+#define CRYPTO_ALGO_AES_OCB_MSDU       5
+#define CRYPTO_ALGO_AES_OCB_MPDU       6
+#if !defined(BCMEXTCCX)
+#define CRYPTO_ALGO_NALG               7
+#else
+#define CRYPTO_ALGO_CKIP               7
+#define CRYPTO_ALGO_CKIP_MMH   8
+#define CRYPTO_ALGO_WEP_MMH            9
+#define CRYPTO_ALGO_NALG               10
+#endif 
+
+#define CRYPTO_ALGO_SMS4               11
+#define CRYPTO_ALGO_PMK                        12      /* for 802.1x supp to set PMK before 4-way */
+#define CRYPTO_ALGO_BIP                        13  /* 802.11w BIP (aes cmac) */
+
+#define CRYPTO_ALGO_AES_GCM     14  /* 128 bit GCM */
+#define CRYPTO_ALGO_AES_CCM256  15  /* 256 bit CCM */
+#define CRYPTO_ALGO_AES_GCM256  16  /* 256 bit GCM */
+#define CRYPTO_ALGO_BIP_CMAC256 17  /* 256 bit BIP CMAC */
+#define CRYPTO_ALGO_BIP_GMAC    18  /* 128 bit BIP GMAC */
+#define CRYPTO_ALGO_BIP_GMAC256 19  /* 256 bit BIP GMAC */
+
+#define CRYPTO_ALGO_NONE        CRYPTO_ALGO_OFF
+
+/* algo bit vector */
+#define KEY_ALGO_MASK(_algo)   (1 << _algo)
+
+#if defined(BCMEXTCCX)
+#define KEY_ALGO_MASK_CCX              (KEY_ALGO_MASK(CRYPTO_ALGO_CKIP) | \
+                                       KEY_ALGO_MASK(CRYPTO_ALGO_CKIP_MMH) | \
+                                       KEY_ALGO_MASK(CRYPTO_ALGO_WEP_MMH))
+#endif 
+
+#define KEY_ALGO_MASK_WEP              (KEY_ALGO_MASK(CRYPTO_ALGO_WEP1) | \
+                                       KEY_ALGO_MASK(CRYPTO_ALGO_WEP128) | \
+                                       KEY_ALGO_MASK(CRYPTO_ALGO_NALG))
+
+#define KEY_ALGO_MASK_AES              (KEY_ALGO_MASK(CRYPTO_ALGO_AES_CCM) | \
+                                       KEY_ALGO_MASK(CRYPTO_ALGO_AES_CCM256) | \
+                                       KEY_ALGO_MASK(CRYPTO_ALGO_AES_GCM) | \
+                                       KEY_ALGO_MASK(CRYPTO_ALGO_AES_GCM256))
+#define KEY_ALGO_MASK_TKIP             (KEY_ALGO_MASK(CRYPTO_ALGO_TKIP))
+#define KEY_ALGO_MASK_WAPI             (KEY_ALGO_MASK(CRYPTO_ALGO_SMS4))
+
+#define WSEC_GEN_MIC_ERROR     0x0001
+#define WSEC_GEN_REPLAY                0x0002
+#define WSEC_GEN_ICV_ERROR     0x0004
+#define WSEC_GEN_MFP_ACT_ERROR 0x0008
+#define WSEC_GEN_MFP_DISASSOC_ERROR    0x0010
+#define WSEC_GEN_MFP_DEAUTH_ERROR      0x0020
+
+#define WL_SOFT_KEY    (1 << 0)        /* Indicates this key is using soft encrypt */
+#define WL_PRIMARY_KEY (1 << 1)        /* Indicates this key is the primary (ie tx) key */
+#if defined(BCMEXTCCX)
+#define WL_CKIP_KP     (1 << 4)        /* CMIC */
+#define WL_CKIP_MMH    (1 << 5)        /* CKIP */
+#else
+#define WL_KF_RES_4    (1 << 4)        /* Reserved for backward compat */
+#define WL_KF_RES_5    (1 << 5)        /* Reserved for backward compat */
+#endif 
+#define WL_IBSS_PEER_GROUP_KEY (1 << 6)        /* Indicates a group key for a IBSS PEER */
+
+/* wireless security bitvec */
+#define WEP_ENABLED            0x0001
+#define TKIP_ENABLED           0x0002
+#define AES_ENABLED            0x0004
+#define WSEC_SWFLAG            0x0008
+#define SES_OW_ENABLED         0x0040  /* to go into transition mode without setting wep */
+#ifdef BCMWAPI_WPI
+#define SMS4_ENABLED           0x0100
+#endif /* BCMWAPI_WPI */
+
+#define WSEC_WEP_ENABLED(wsec) ((wsec) & WEP_ENABLED)
+#define WSEC_TKIP_ENABLED(wsec)        ((wsec) & TKIP_ENABLED)
+#define WSEC_AES_ENABLED(wsec) ((wsec) & AES_ENABLED)
+
+#ifdef BCMWAPI_WPI
+#define WSEC_ENABLED(wsec)     ((wsec) & (WEP_ENABLED | TKIP_ENABLED | AES_ENABLED | SMS4_ENABLED))
+#else /* BCMWAPI_WPI */
+#define WSEC_ENABLED(wsec)     ((wsec) & (WEP_ENABLED | TKIP_ENABLED | AES_ENABLED))
+#endif /* BCMWAPI_WPI */
+
+#define WSEC_SES_OW_ENABLED(wsec)      ((wsec) & SES_OW_ENABLED)
+#ifdef BCMWAPI_WAI
+#define WSEC_SMS4_ENABLED(wsec)        ((wsec) & SMS4_ENABLED)
+#endif /* BCMWAPI_WAI */
+
+
+/* Following macros are not used any more. Just kept here to
+ * avoid build issue in BISON/CARIBOU branch
+ */
+#define MFP_CAPABLE            0x0200
+#define MFP_REQUIRED   0x0400
+#define MFP_SHA256             0x0800 /* a special configuration for STA for WIFI test tool */
+
+/* WPA authentication mode bitvec */
+#define WPA_AUTH_DISABLED      0x0000  /* Legacy (i.e., non-WPA) */
+#define WPA_AUTH_NONE          0x0001  /* none (IBSS) */
+#define WPA_AUTH_UNSPECIFIED   0x0002  /* over 802.1x */
+#define WPA_AUTH_PSK           0x0004  /* Pre-shared key */
+#if defined(BCMEXTCCX)
+#define WPA_AUTH_CCKM          0x0008  /* CCKM */
+#define WPA2_AUTH_CCKM         0x0010  /* CCKM2 */
+#endif 
+/* #define WPA_AUTH_8021X 0x0020 */    /* 802.1x, reserved */
+#define WPA2_AUTH_UNSPECIFIED  0x0040  /* over 802.1x */
+#define WPA2_AUTH_PSK          0x0080  /* Pre-shared key */
+#define BRCM_AUTH_PSK           0x0100  /* BRCM specific PSK */
+#define BRCM_AUTH_DPT          0x0200  /* DPT PSK without group keys */
+#if defined(BCMWAPI_WAI) || defined(BCMWAPI_WPI)
+#define WPA_AUTH_WAPI           0x0400
+#define WAPI_AUTH_NONE         WPA_AUTH_NONE   /* none (IBSS) */
+#define WAPI_AUTH_UNSPECIFIED  0x0400  /* over AS */
+#define WAPI_AUTH_PSK          0x0800  /* Pre-shared key */
+#endif /* BCMWAPI_WAI || BCMWAPI_WPI */
+#define WPA2_AUTH_1X_SHA256    0x1000  /* 1X with SHA256 key derivation */
+#define WPA2_AUTH_TPK          0x2000  /* TDLS Peer Key */
+#define WPA2_AUTH_FT           0x4000  /* Fast Transition. */
+#define WPA2_AUTH_PSK_SHA256   0x8000  /* PSK with SHA256 key derivation */
+/* WPA2_AUTH_SHA256 not used anymore. Just kept here to avoid build issue in DINGO */
+#define WPA2_AUTH_SHA256       0x8000
+#define WPA_AUTH_PFN_ANY       0xffffffff      /* for PFN, match only ssid */
+
+/* pmkid */
+#define        MAXPMKID                16
+
+/* SROM12 changes */
+#define        WLC_IOCTL_MAXLEN                8192    /* max length ioctl buffer required */
+
+
+#define        WLC_IOCTL_SMLEN                 256     /* "small" length ioctl buffer required */
+#define WLC_IOCTL_MEDLEN               1536    /* "med" length ioctl buffer required */
+#if defined(LCNCONF) || defined(LCN40CONF) || defined(LCN20CONF)
+#define WLC_SAMPLECOLLECT_MAXLEN       8192    /* Max Sample Collect buffer */
+#else
+#define WLC_SAMPLECOLLECT_MAXLEN       10240   /* Max Sample Collect buffer for two cores */
+#endif
+#define WLC_SAMPLECOLLECT_MAXLEN_LCN40  8192
+
+/* common ioctl definitions */
+#define WLC_GET_MAGIC                          0
+#define WLC_GET_VERSION                                1
+#define WLC_UP                                 2
+#define WLC_DOWN                               3
+#define WLC_GET_LOOP                           4
+#define WLC_SET_LOOP                           5
+#define WLC_DUMP                               6
+#define WLC_GET_MSGLEVEL                       7
+#define WLC_SET_MSGLEVEL                       8
+#define WLC_GET_PROMISC                                9
+#define WLC_SET_PROMISC                                10
+/* #define WLC_OVERLAY_IOCTL                   11 */ /* not supported */
+#define WLC_GET_RATE                           12
+#define WLC_GET_MAX_RATE                       13
+#define WLC_GET_INSTANCE                       14
+/* #define WLC_GET_FRAG                                15 */ /* no longer supported */
+/* #define WLC_SET_FRAG                                16 */ /* no longer supported */
+/* #define WLC_GET_RTS                         17 */ /* no longer supported */
+/* #define WLC_SET_RTS                         18 */ /* no longer supported */
+#define WLC_GET_INFRA                          19
+#define WLC_SET_INFRA                          20
+#define WLC_GET_AUTH                           21
+#define WLC_SET_AUTH                           22
+#define WLC_GET_BSSID                          23
+#define WLC_SET_BSSID                          24
+#define WLC_GET_SSID                           25
+#define WLC_SET_SSID                           26
+#define WLC_RESTART                            27
+#define WLC_TERMINATED                         28
+/* #define WLC_DUMP_SCB                                28 */ /* no longer supported */
+#define WLC_GET_CHANNEL                                29
+#define WLC_SET_CHANNEL                                30
+#define WLC_GET_SRL                            31
+#define WLC_SET_SRL                            32
+#define WLC_GET_LRL                            33
+#define WLC_SET_LRL                            34
+#define WLC_GET_PLCPHDR                                35
+#define WLC_SET_PLCPHDR                                36
+#define WLC_GET_RADIO                          37
+#define WLC_SET_RADIO                          38
+#define WLC_GET_PHYTYPE                                39
+#define WLC_DUMP_RATE                          40
+#define WLC_SET_RATE_PARAMS                    41
+#define WLC_GET_FIXRATE                                42
+#define WLC_SET_FIXRATE                                43
+/* #define WLC_GET_WEP                         42 */ /* no longer supported */
+/* #define WLC_SET_WEP                         43 */ /* no longer supported */
+#define WLC_GET_KEY                            44
+#define WLC_SET_KEY                            45
+#define WLC_GET_REGULATORY                     46
+#define WLC_SET_REGULATORY                     47
+#define WLC_GET_PASSIVE_SCAN                   48
+#define WLC_SET_PASSIVE_SCAN                   49
+#define WLC_SCAN                               50
+#define WLC_SCAN_RESULTS                       51
+#define WLC_DISASSOC                           52
+#define WLC_REASSOC                            53
+#define WLC_GET_ROAM_TRIGGER                   54
+#define WLC_SET_ROAM_TRIGGER                   55
+#define WLC_GET_ROAM_DELTA                     56
+#define WLC_SET_ROAM_DELTA                     57
+#define WLC_GET_ROAM_SCAN_PERIOD               58
+#define WLC_SET_ROAM_SCAN_PERIOD               59
+#define WLC_EVM                                        60      /* diag */
+#define WLC_GET_TXANT                          61
+#define WLC_SET_TXANT                          62
+#define WLC_GET_ANTDIV                         63
+#define WLC_SET_ANTDIV                         64
+/* #define WLC_GET_TXPWR                       65 */ /* no longer supported */
+/* #define WLC_SET_TXPWR                       66 */ /* no longer supported */
+#define WLC_GET_CLOSED                         67
+#define WLC_SET_CLOSED                         68
+#define WLC_GET_MACLIST                                69
+#define WLC_SET_MACLIST                                70
+#define WLC_GET_RATESET                                71
+#define WLC_SET_RATESET                                72
+/* #define WLC_GET_LOCALE                      73 */ /* no longer supported */
+#define WLC_LONGTRAIN                          74
+#define WLC_GET_BCNPRD                         75
+#define WLC_SET_BCNPRD                         76
+#define WLC_GET_DTIMPRD                                77
+#define WLC_SET_DTIMPRD                                78
+#define WLC_GET_SROM                           79
+#define WLC_SET_SROM                           80
+#define WLC_GET_WEP_RESTRICT                   81
+#define WLC_SET_WEP_RESTRICT                   82
+#define WLC_GET_COUNTRY                                83
+#define WLC_SET_COUNTRY                                84
+#define WLC_GET_PM                             85
+#define WLC_SET_PM                             86
+#define WLC_GET_WAKE                           87
+#define WLC_SET_WAKE                           88
+/* #define WLC_GET_D11CNTS                     89 */ /* -> "counters" iovar */
+#define WLC_GET_FORCELINK                      90      /* ndis only */
+#define WLC_SET_FORCELINK                      91      /* ndis only */
+#define WLC_FREQ_ACCURACY                      92      /* diag */
+#define WLC_CARRIER_SUPPRESS                   93      /* diag */
+#define WLC_GET_PHYREG                         94
+#define WLC_SET_PHYREG                         95
+#define WLC_GET_RADIOREG                       96
+#define WLC_SET_RADIOREG                       97
+#define WLC_GET_REVINFO                                98
+#define WLC_GET_UCANTDIV                       99
+#define WLC_SET_UCANTDIV                       100
+#define WLC_R_REG                              101
+#define WLC_W_REG                              102
+/* #define WLC_DIAG_LOOPBACK                   103     old tray diag */
+/* #define WLC_RESET_D11CNTS                   104 */ /* -> "reset_d11cnts" iovar */
+#define WLC_GET_MACMODE                                105
+#define WLC_SET_MACMODE                                106
+#define WLC_GET_MONITOR                                107
+#define WLC_SET_MONITOR                                108
+#define WLC_GET_GMODE                          109
+#define WLC_SET_GMODE                          110
+#define WLC_GET_LEGACY_ERP                     111
+#define WLC_SET_LEGACY_ERP                     112
+#define WLC_GET_RX_ANT                         113
+#define WLC_GET_CURR_RATESET                   114     /* current rateset */
+#define WLC_GET_SCANSUPPRESS                   115
+#define WLC_SET_SCANSUPPRESS                   116
+#define WLC_GET_AP                             117
+#define WLC_SET_AP                             118
+#define WLC_GET_EAP_RESTRICT                   119
+#define WLC_SET_EAP_RESTRICT                   120
+#define WLC_SCB_AUTHORIZE                      121
+#define WLC_SCB_DEAUTHORIZE                    122
+#define WLC_GET_WDSLIST                                123
+#define WLC_SET_WDSLIST                                124
+#define WLC_GET_ATIM                           125
+#define WLC_SET_ATIM                           126
+#define WLC_GET_RSSI                           127
+#define WLC_GET_PHYANTDIV                      128
+#define WLC_SET_PHYANTDIV                      129
+#define WLC_AP_RX_ONLY                         130
+#define WLC_GET_TX_PATH_PWR                    131
+#define WLC_SET_TX_PATH_PWR                    132
+#define WLC_GET_WSEC                           133
+#define WLC_SET_WSEC                           134
+#define WLC_GET_PHY_NOISE                      135
+#define WLC_GET_BSS_INFO                       136
+#define WLC_GET_PKTCNTS                                137
+#define WLC_GET_LAZYWDS                                138
+#define WLC_SET_LAZYWDS                                139
+#define WLC_GET_BANDLIST                       140
+
+#define WLC_GET_BAND                           141
+#define WLC_SET_BAND                           142
+#define WLC_SCB_DEAUTHENTICATE                 143
+#define WLC_GET_SHORTSLOT                      144
+#define WLC_GET_SHORTSLOT_OVERRIDE             145
+#define WLC_SET_SHORTSLOT_OVERRIDE             146
+#define WLC_GET_SHORTSLOT_RESTRICT             147
+#define WLC_SET_SHORTSLOT_RESTRICT             148
+#define WLC_GET_GMODE_PROTECTION               149
+#define WLC_GET_GMODE_PROTECTION_OVERRIDE      150
+#define WLC_SET_GMODE_PROTECTION_OVERRIDE      151
+#define WLC_UPGRADE                            152
+/* #define WLC_GET_MRATE                       153 */ /* no longer supported */
+/* #define WLC_SET_MRATE                       154 */ /* no longer supported */
+#define WLC_GET_IGNORE_BCNS                    155
+#define WLC_SET_IGNORE_BCNS                    156
+#define WLC_GET_SCB_TIMEOUT                    157
+#define WLC_SET_SCB_TIMEOUT                    158
+#define WLC_GET_ASSOCLIST                      159
+#define WLC_GET_CLK                            160
+#define WLC_SET_CLK                            161
+#define WLC_GET_UP                             162
+#define WLC_OUT                                        163
+#define WLC_GET_WPA_AUTH                       164
+#define WLC_SET_WPA_AUTH                       165
+#define WLC_GET_UCFLAGS                                166
+#define WLC_SET_UCFLAGS                                167
+#define WLC_GET_PWRIDX                         168
+#define WLC_SET_PWRIDX                         169
+#define WLC_GET_TSSI                           170
+#define WLC_GET_SUP_RATESET_OVERRIDE           171
+#define WLC_SET_SUP_RATESET_OVERRIDE           172
+/* #define WLC_SET_FAST_TIMER                  173 */ /* no longer supported */
+/* #define WLC_GET_FAST_TIMER                  174 */ /* no longer supported */
+/* #define WLC_SET_SLOW_TIMER                  175 */ /* no longer supported */
+/* #define WLC_GET_SLOW_TIMER                  176 */ /* no longer supported */
+/* #define WLC_DUMP_PHYREGS                    177 */ /* no longer supported */
+#define WLC_GET_PROTECTION_CONTROL             178
+#define WLC_SET_PROTECTION_CONTROL             179
+#define WLC_GET_PHYLIST                                180
+#define WLC_ENCRYPT_STRENGTH                   181     /* ndis only */
+#define WLC_DECRYPT_STATUS                     182     /* ndis only */
+#define WLC_GET_KEY_SEQ                                183
+#define WLC_GET_SCAN_CHANNEL_TIME              184
+#define WLC_SET_SCAN_CHANNEL_TIME              185
+#define WLC_GET_SCAN_UNASSOC_TIME              186
+#define WLC_SET_SCAN_UNASSOC_TIME              187
+#define WLC_GET_SCAN_HOME_TIME                 188
+#define WLC_SET_SCAN_HOME_TIME                 189
+#define WLC_GET_SCAN_NPROBES                   190
+#define WLC_SET_SCAN_NPROBES                   191
+#define WLC_GET_PRB_RESP_TIMEOUT               192
+#define WLC_SET_PRB_RESP_TIMEOUT               193
+#define WLC_GET_ATTEN                          194
+#define WLC_SET_ATTEN                          195
+#define WLC_GET_SHMEM                          196     /* diag */
+#define WLC_SET_SHMEM                          197     /* diag */
+/* #define WLC_GET_GMODE_PROTECTION_CTS                198 */ /* no longer supported */
+/* #define WLC_SET_GMODE_PROTECTION_CTS                199 */ /* no longer supported */
+#define WLC_SET_WSEC_TEST                      200
+#define WLC_SCB_DEAUTHENTICATE_FOR_REASON      201
+#define WLC_TKIP_COUNTERMEASURES               202
+#define WLC_GET_PIOMODE                                203
+#define WLC_SET_PIOMODE                                204
+#define WLC_SET_ASSOC_PREFER                   205
+#define WLC_GET_ASSOC_PREFER                   206
+#define WLC_SET_ROAM_PREFER                    207
+#define WLC_GET_ROAM_PREFER                    208
+#define WLC_SET_LED                            209
+#define WLC_GET_LED                            210
+#define WLC_GET_INTERFERENCE_MODE              211
+#define WLC_SET_INTERFERENCE_MODE              212
+#define WLC_GET_CHANNEL_QA                     213
+#define WLC_START_CHANNEL_QA                   214
+#define WLC_GET_CHANNEL_SEL                    215
+#define WLC_START_CHANNEL_SEL                  216
+#define WLC_GET_VALID_CHANNELS                 217
+#define WLC_GET_FAKEFRAG                       218
+#define WLC_SET_FAKEFRAG                       219
+#define WLC_GET_PWROUT_PERCENTAGE              220
+#define WLC_SET_PWROUT_PERCENTAGE              221
+#define WLC_SET_BAD_FRAME_PREEMPT              222
+#define WLC_GET_BAD_FRAME_PREEMPT              223
+#define WLC_SET_LEAP_LIST                      224
+#define WLC_GET_LEAP_LIST                      225
+#define WLC_GET_CWMIN                          226
+#define WLC_SET_CWMIN                          227
+#define WLC_GET_CWMAX                          228
+#define WLC_SET_CWMAX                          229
+#define WLC_GET_WET                            230
+#define WLC_SET_WET                            231
+#define WLC_GET_PUB                            232
+/* #define WLC_SET_GLACIAL_TIMER               233 */ /* no longer supported */
+/* #define WLC_GET_GLACIAL_TIMER               234 */ /* no longer supported */
+#define WLC_GET_KEY_PRIMARY                    235
+#define WLC_SET_KEY_PRIMARY                    236
+
+
+/* #define WLC_DUMP_RADIOREGS                  237 */ /* no longer supported */
+#define WLC_GET_ACI_ARGS                       238
+#define WLC_SET_ACI_ARGS                       239
+#define WLC_UNSET_CALLBACK                     240
+#define WLC_SET_CALLBACK                       241
+#define WLC_GET_RADAR                          242
+#define WLC_SET_RADAR                          243
+#define WLC_SET_SPECT_MANAGMENT                        244
+#define WLC_GET_SPECT_MANAGMENT                        245
+#define WLC_WDS_GET_REMOTE_HWADDR              246     /* handled in wl_linux.c/wl_vx.c */
+#define WLC_WDS_GET_WPA_SUP                    247
+#define WLC_SET_CS_SCAN_TIMER                  248
+#define WLC_GET_CS_SCAN_TIMER                  249
+#define WLC_MEASURE_REQUEST                    250
+#define WLC_INIT                               251
+#define WLC_SEND_QUIET                         252
+#define WLC_KEEPALIVE                  253
+#define WLC_SEND_PWR_CONSTRAINT                        254
+#define WLC_UPGRADE_STATUS                     255
+#define WLC_CURRENT_PWR                                256
+#define WLC_GET_SCAN_PASSIVE_TIME              257
+#define WLC_SET_SCAN_PASSIVE_TIME              258
+#define WLC_LEGACY_LINK_BEHAVIOR               259
+#define WLC_GET_CHANNELS_IN_COUNTRY            260
+#define WLC_GET_COUNTRY_LIST                   261
+#define WLC_GET_VAR                            262     /* get value of named variable */
+#define WLC_SET_VAR                            263     /* set named variable to value */
+#define WLC_NVRAM_GET                          264     /* deprecated */
+#define WLC_NVRAM_SET                          265
+#define WLC_NVRAM_DUMP                         266
+#define WLC_REBOOT                             267
+#define WLC_SET_WSEC_PMK                       268
+#define WLC_GET_AUTH_MODE                      269
+#define WLC_SET_AUTH_MODE                      270
+#define WLC_GET_WAKEENTRY                      271
+#define WLC_SET_WAKEENTRY                      272
+#define WLC_NDCONFIG_ITEM                      273     /* currently handled in wl_oid.c */
+#define WLC_NVOTPW                             274
+#define WLC_OTPW                               275
+#define WLC_IOV_BLOCK_GET                      276
+#define WLC_IOV_MODULES_GET                    277
+#define WLC_SOFT_RESET                         278
+#define WLC_GET_ALLOW_MODE                     279
+#define WLC_SET_ALLOW_MODE                     280
+#define WLC_GET_DESIRED_BSSID                  281
+#define WLC_SET_DESIRED_BSSID                  282
+#define        WLC_DISASSOC_MYAP                       283
+#define WLC_GET_NBANDS                         284     /* for Dongle EXT_STA support */
+#define WLC_GET_BANDSTATES                     285     /* for Dongle EXT_STA support */
+#define WLC_GET_WLC_BSS_INFO                   286     /* for Dongle EXT_STA support */
+#define WLC_GET_ASSOC_INFO                     287     /* for Dongle EXT_STA support */
+#define WLC_GET_OID_PHY                                288     /* for Dongle EXT_STA support */
+#define WLC_SET_OID_PHY                                289     /* for Dongle EXT_STA support */
+#define WLC_SET_ASSOC_TIME                     290     /* for Dongle EXT_STA support */
+#define WLC_GET_DESIRED_SSID                   291     /* for Dongle EXT_STA support */
+#define WLC_GET_CHANSPEC                       292     /* for Dongle EXT_STA support */
+#define WLC_GET_ASSOC_STATE                    293     /* for Dongle EXT_STA support */
+#define WLC_SET_PHY_STATE                      294     /* for Dongle EXT_STA support */
+#define WLC_GET_SCAN_PENDING                   295     /* for Dongle EXT_STA support */
+#define WLC_GET_SCANREQ_PENDING                        296     /* for Dongle EXT_STA support */
+#define WLC_GET_PREV_ROAM_REASON               297     /* for Dongle EXT_STA support */
+#define WLC_SET_PREV_ROAM_REASON               298     /* for Dongle EXT_STA support */
+#define WLC_GET_BANDSTATES_PI                  299     /* for Dongle EXT_STA support */
+#define WLC_GET_PHY_STATE                      300     /* for Dongle EXT_STA support */
+#define WLC_GET_BSS_WPA_RSN                    301     /* for Dongle EXT_STA support */
+#define WLC_GET_BSS_WPA2_RSN                   302     /* for Dongle EXT_STA support */
+#define WLC_GET_BSS_BCN_TS                     303     /* for Dongle EXT_STA support */
+#define WLC_GET_INT_DISASSOC                   304     /* for Dongle EXT_STA support */
+#define WLC_SET_NUM_PEERS                      305     /* for Dongle EXT_STA support */
+#define WLC_GET_NUM_BSS                                306     /* for Dongle EXT_STA support */
+#define WLC_PHY_SAMPLE_COLLECT                 307     /* phy sample collect mode */
+/* #define WLC_UM_PRIV                         308 */  /* Deprecated: usermode driver */
+#define WLC_GET_CMD                            309
+/* #define WLC_LAST                            310 */  /* Never used - can be reused */
+#define WLC_SET_INTERFERENCE_OVERRIDE_MODE     311     /* set inter mode override */
+#define WLC_GET_INTERFERENCE_OVERRIDE_MODE     312     /* get inter mode override */
+/* #define WLC_GET_WAI_RESTRICT        313 */
+/* #define WLC_SET_WAI_RESTRICT        314 */
+/* #define WLC_SET_WAI_REKEY   315 */
+#define WLC_SET_NAT_CONFIG                     316     /* for configuring NAT filter driver */
+#define WLC_GET_NAT_STATE                      317
+#define WLC_GET_TXBF_RATESET                   318
+#define WLC_SET_TXBF_RATESET                   319
+#define WLC_SCAN_CQ                            320
+#define WLC_GET_RSSI_QDB                       321 /* qdB portion of the RSSI */
+#define WLC_DUMP_RATESET                       322
+#define WLC_ECHO                               323
+#define WLC_LAST                               324
+#ifndef EPICTRL_COOKIE
+#define EPICTRL_COOKIE         0xABADCEDE
+#endif
+
+/* vx wlc ioctl's offset */
+#define CMN_IOCTL_OFF 0x180
+
+/*
+ * custom OID support
+ *
+ * 0xFF - implementation specific OID
+ * 0xE4 - first byte of Broadcom PCI vendor ID
+ * 0x14 - second byte of Broadcom PCI vendor ID
+ * 0xXX - the custom OID number
+ */
+
+/* begin 0x1f values beyond the start of the ET driver range. */
+#define WL_OID_BASE            0xFFE41420
+
+/* NDIS overrides */
+#define OID_WL_GETINSTANCE     (WL_OID_BASE + WLC_GET_INSTANCE)
+#define OID_WL_GET_FORCELINK   (WL_OID_BASE + WLC_GET_FORCELINK)
+#define OID_WL_SET_FORCELINK   (WL_OID_BASE + WLC_SET_FORCELINK)
+#define        OID_WL_ENCRYPT_STRENGTH (WL_OID_BASE + WLC_ENCRYPT_STRENGTH)
+#define OID_WL_DECRYPT_STATUS  (WL_OID_BASE + WLC_DECRYPT_STATUS)
+#define OID_LEGACY_LINK_BEHAVIOR (WL_OID_BASE + WLC_LEGACY_LINK_BEHAVIOR)
+#define OID_WL_NDCONFIG_ITEM   (WL_OID_BASE + WLC_NDCONFIG_ITEM)
+
+/* EXT_STA Dongle suuport */
+#define OID_STA_CHANSPEC       (WL_OID_BASE + WLC_GET_CHANSPEC)
+#define OID_STA_NBANDS         (WL_OID_BASE + WLC_GET_NBANDS)
+#define OID_STA_GET_PHY                (WL_OID_BASE + WLC_GET_OID_PHY)
+#define OID_STA_SET_PHY                (WL_OID_BASE + WLC_SET_OID_PHY)
+#define OID_STA_ASSOC_TIME     (WL_OID_BASE + WLC_SET_ASSOC_TIME)
+#define OID_STA_DESIRED_SSID   (WL_OID_BASE + WLC_GET_DESIRED_SSID)
+#define OID_STA_SET_PHY_STATE  (WL_OID_BASE + WLC_SET_PHY_STATE)
+#define OID_STA_SCAN_PENDING   (WL_OID_BASE + WLC_GET_SCAN_PENDING)
+#define OID_STA_SCANREQ_PENDING (WL_OID_BASE + WLC_GET_SCANREQ_PENDING)
+#define OID_STA_GET_ROAM_REASON (WL_OID_BASE + WLC_GET_PREV_ROAM_REASON)
+#define OID_STA_SET_ROAM_REASON (WL_OID_BASE + WLC_SET_PREV_ROAM_REASON)
+#define OID_STA_GET_PHY_STATE  (WL_OID_BASE + WLC_GET_PHY_STATE)
+#define OID_STA_INT_DISASSOC   (WL_OID_BASE + WLC_GET_INT_DISASSOC)
+#define OID_STA_SET_NUM_PEERS  (WL_OID_BASE + WLC_SET_NUM_PEERS)
+#define OID_STA_GET_NUM_BSS    (WL_OID_BASE + WLC_GET_NUM_BSS)
+
+/* NAT filter driver support */
+#define OID_NAT_SET_CONFIG     (WL_OID_BASE + WLC_SET_NAT_CONFIG)
+#define OID_NAT_GET_STATE      (WL_OID_BASE + WLC_GET_NAT_STATE)
+
+#define WL_DECRYPT_STATUS_SUCCESS      1
+#define WL_DECRYPT_STATUS_FAILURE      2
+#define WL_DECRYPT_STATUS_UNKNOWN      3
+
+/* allows user-mode app to poll the status of USB image upgrade */
+#define WLC_UPGRADE_SUCCESS                    0
+#define WLC_UPGRADE_PENDING                    1
+
+/* WLC_GET_AUTH, WLC_SET_AUTH values */
+#define WL_AUTH_OPEN_SYSTEM            0       /* d11 open authentication */
+#define WL_AUTH_SHARED_KEY             1       /* d11 shared authentication */
+#define WL_AUTH_OPEN_SHARED            2       /* try open, then shared if open failed w/rc 13 */
+
+/* a large TX Power as an init value to factor out of MIN() calculations,
+ * keep low enough to fit in an int8, units are .25 dBm
+ */
+#define WLC_TXPWR_MAX          (127)   /* ~32 dBm = 1,500 mW */
+
+/* "diag" iovar argument and error code */
+#define WL_DIAG_INTERRUPT                      1       /* d11 loopback interrupt test */
+#define WL_DIAG_LOOPBACK                       2       /* d11 loopback data test */
+#define WL_DIAG_MEMORY                         3       /* d11 memory test */
+#define WL_DIAG_LED                            4       /* LED test */
+#define WL_DIAG_REG                            5       /* d11/phy register test */
+#define WL_DIAG_SROM                           6       /* srom read/crc test */
+#define WL_DIAG_DMA                            7       /* DMA test */
+#define WL_DIAG_LOOPBACK_EXT                   8       /* enhenced d11 loopback data test */
+
+#define WL_DIAGERR_SUCCESS                     0
+#define WL_DIAGERR_FAIL_TO_RUN                 1       /* unable to run requested diag */
+#define WL_DIAGERR_NOT_SUPPORTED               2       /* diag requested is not supported */
+#define WL_DIAGERR_INTERRUPT_FAIL              3       /* loopback interrupt test failed */
+#define WL_DIAGERR_LOOPBACK_FAIL               4       /* loopback data test failed */
+#define WL_DIAGERR_SROM_FAIL                   5       /* srom read failed */
+#define WL_DIAGERR_SROM_BADCRC                 6       /* srom crc failed */
+#define WL_DIAGERR_REG_FAIL                    7       /* d11/phy register test failed */
+#define WL_DIAGERR_MEMORY_FAIL                 8       /* d11 memory test failed */
+#define WL_DIAGERR_NOMEM                       9       /* diag test failed due to no memory */
+#define WL_DIAGERR_DMA_FAIL                    10      /* DMA test failed */
+
+#define WL_DIAGERR_MEMORY_TIMEOUT              11      /* d11 memory test didn't finish in time */
+#define WL_DIAGERR_MEMORY_BADPATTERN           12      /* d11 memory test result in bad pattern */
+
+/* band types */
+#define        WLC_BAND_AUTO           0       /* auto-select */
+#define        WLC_BAND_5G             1       /* 5 Ghz */
+#define        WLC_BAND_2G             2       /* 2.4 Ghz */
+#define        WLC_BAND_ALL            3       /* all bands */
+#define WLC_BAND_INVALID       -1      /* Invalid band */
+
+/* band range returned by band_range iovar */
+#define WL_CHAN_FREQ_RANGE_2G      0
+#define WL_CHAN_FREQ_RANGE_5GL     1
+#define WL_CHAN_FREQ_RANGE_5GM     2
+#define WL_CHAN_FREQ_RANGE_5GH     3
+
+#define WL_CHAN_FREQ_RANGE_5GLL_5BAND    4
+#define WL_CHAN_FREQ_RANGE_5GLH_5BAND    5
+#define WL_CHAN_FREQ_RANGE_5GML_5BAND    6
+#define WL_CHAN_FREQ_RANGE_5GMH_5BAND    7
+#define WL_CHAN_FREQ_RANGE_5GH_5BAND     8
+
+#define WL_CHAN_FREQ_RANGE_5G_BAND0     1
+#define WL_CHAN_FREQ_RANGE_5G_BAND1     2
+#define WL_CHAN_FREQ_RANGE_5G_BAND2     3
+#define WL_CHAN_FREQ_RANGE_5G_BAND3     4
+#define WL_CHAN_FREQ_RANGE_5G_4BAND     5
+
+/* SROM12 */
+#define WL_CHAN_FREQ_RANGE_5G_BAND4 5
+#define WL_CHAN_FREQ_RANGE_2G_40 6
+#define WL_CHAN_FREQ_RANGE_5G_BAND0_40 7
+#define WL_CHAN_FREQ_RANGE_5G_BAND1_40 8
+#define WL_CHAN_FREQ_RANGE_5G_BAND2_40 9
+#define WL_CHAN_FREQ_RANGE_5G_BAND3_40 10
+#define WL_CHAN_FREQ_RANGE_5G_BAND4_40 11
+#define WL_CHAN_FREQ_RANGE_5G_BAND0_80 12
+#define WL_CHAN_FREQ_RANGE_5G_BAND1_80 13
+#define WL_CHAN_FREQ_RANGE_5G_BAND2_80 14
+#define WL_CHAN_FREQ_RANGE_5G_BAND3_80 15
+#define WL_CHAN_FREQ_RANGE_5G_BAND4_80 16
+
+#define WL_CHAN_FREQ_RANGE_5G_5BAND    18
+#define WL_CHAN_FREQ_RANGE_5G_5BAND_40 19
+#define WL_CHAN_FREQ_RANGE_5G_5BAND_80 20
+
+#define WLC_MACMODE_DISABLED   0       /* MAC list disabled */
+#define WLC_MACMODE_DENY       1       /* Deny specified (i.e. allow unspecified) */
+#define WLC_MACMODE_ALLOW      2       /* Allow specified (i.e. deny unspecified) */
+
+/*
+ * 54g modes (basic bits may still be overridden)
+ *
+ * GMODE_LEGACY_B                      Rateset: 1b, 2b, 5.5, 11
+ *                                     Preamble: Long
+ *                                     Shortslot: Off
+ * GMODE_AUTO                          Rateset: 1b, 2b, 5.5b, 11b, 18, 24, 36, 54
+ *                                     Extended Rateset: 6, 9, 12, 48
+ *                                     Preamble: Long
+ *                                     Shortslot: Auto
+ * GMODE_ONLY                          Rateset: 1b, 2b, 5.5b, 11b, 18, 24b, 36, 54
+ *                                     Extended Rateset: 6b, 9, 12b, 48
+ *                                     Preamble: Short required
+ *                                     Shortslot: Auto
+ * GMODE_B_DEFERRED                    Rateset: 1b, 2b, 5.5b, 11b, 18, 24, 36, 54
+ *                                     Extended Rateset: 6, 9, 12, 48
+ *                                     Preamble: Long
+ *                                     Shortslot: On
+ * GMODE_PERFORMANCE                   Rateset: 1b, 2b, 5.5b, 6b, 9, 11b, 12b, 18, 24b, 36, 48, 54
+ *                                     Preamble: Short required
+ *                                     Shortslot: On and required
+ * GMODE_LRS                           Rateset: 1b, 2b, 5.5b, 11b
+ *                                     Extended Rateset: 6, 9, 12, 18, 24, 36, 48, 54
+ *                                     Preamble: Long
+ *                                     Shortslot: Auto
+ */
+#define GMODE_LEGACY_B         0
+#define GMODE_AUTO             1
+#define GMODE_ONLY             2
+#define GMODE_B_DEFERRED       3
+#define GMODE_PERFORMANCE      4
+#define GMODE_LRS              5
+#define GMODE_MAX              6
+
+/* values for PLCPHdr_override */
+#define WLC_PLCP_AUTO  -1
+#define WLC_PLCP_SHORT 0
+#define WLC_PLCP_LONG  1
+
+/* values for g_protection_override and n_protection_override */
+#define WLC_PROTECTION_AUTO            -1
+#define WLC_PROTECTION_OFF             0
+#define WLC_PROTECTION_ON              1
+#define WLC_PROTECTION_MMHDR_ONLY      2
+#define WLC_PROTECTION_CTS_ONLY                3
+
+/* values for g_protection_control and n_protection_control */
+#define WLC_PROTECTION_CTL_OFF         0
+#define WLC_PROTECTION_CTL_LOCAL       1
+#define WLC_PROTECTION_CTL_OVERLAP     2
+
+/* values for n_protection */
+#define WLC_N_PROTECTION_OFF           0
+#define WLC_N_PROTECTION_OPTIONAL      1
+#define WLC_N_PROTECTION_20IN40                2
+#define WLC_N_PROTECTION_MIXEDMODE     3
+
+/* values for n_preamble_type */
+#define WLC_N_PREAMBLE_MIXEDMODE       0
+#define WLC_N_PREAMBLE_GF              1
+#define WLC_N_PREAMBLE_GF_BRCM          2
+
+/* values for band specific 40MHz capabilities (deprecated) */
+#define WLC_N_BW_20ALL                 0
+#define WLC_N_BW_40ALL                 1
+#define WLC_N_BW_20IN2G_40IN5G         2
+
+#define WLC_BW_20MHZ_BIT               (1<<0)
+#define WLC_BW_40MHZ_BIT               (1<<1)
+#define WLC_BW_80MHZ_BIT               (1<<2)
+#define WLC_BW_160MHZ_BIT              (1<<3)
+#define WLC_BW_10MHZ_BIT               (1<<4)
+#define WLC_BW_5MHZ_BIT                        (1<<5)
+#define WLC_BW_2P5MHZ_BIT              (1<<6)
+/* Bandwidth capabilities */
+#define WLC_BW_CAP_20MHZ               (WLC_BW_20MHZ_BIT)
+#define WLC_BW_CAP_40MHZ               (WLC_BW_40MHZ_BIT|WLC_BW_20MHZ_BIT)
+#define WLC_BW_CAP_80MHZ               (WLC_BW_80MHZ_BIT|WLC_BW_40MHZ_BIT|WLC_BW_20MHZ_BIT)
+#define WLC_BW_CAP_160MHZ              (WLC_BW_160MHZ_BIT|WLC_BW_80MHZ_BIT| \
+       WLC_BW_40MHZ_BIT|WLC_BW_20MHZ_BIT)
+#define WLC_BW_CAP_2P5MHZ              (WLC_BW_2P5MHZ_BIT)
+#define WLC_BW_CAP_5MHZ                        (WLC_BW_5MHZ_BIT)
+#define WLC_BW_CAP_10MHZ               (WLC_BW_10MHZ_BIT)
+#define WLC_BW_CAP_UNRESTRICTED                0xFF
+
+#define WL_BW_CAP_20MHZ(bw_cap)        (((bw_cap) & WLC_BW_20MHZ_BIT) ? TRUE : FALSE)
+#define WL_BW_CAP_40MHZ(bw_cap)        (((bw_cap) & WLC_BW_40MHZ_BIT) ? TRUE : FALSE)
+#define WL_BW_CAP_80MHZ(bw_cap)        (((bw_cap) & WLC_BW_80MHZ_BIT) ? TRUE : FALSE)
+#define WL_BW_CAP_160MHZ(bw_cap)(((bw_cap) & WLC_BW_160MHZ_BIT) ? TRUE : FALSE)
+#define WL_BW_CAP_2P5MHZ(bw_cap)(((bw_cap) & WLC_BW_2P5MHZ_BIT) ? TRUE : FALSE)
+#define WL_BW_CAP_5MHZ(bw_cap) (((bw_cap) & WLC_BW_5MHZ_BIT) ? TRUE : FALSE)
+#define WL_BW_CAP_10MHZ(bw_cap)        (((bw_cap) & WLC_BW_10MHZ_BIT) ? TRUE : FALSE)
+/* values to force tx/rx chain */
+#define WLC_N_TXRX_CHAIN0              0
+#define WLC_N_TXRX_CHAIN1              1
+
+/* bitflags for SGI support (sgi_rx iovar) */
+#define WLC_N_SGI_20                   0x01
+#define WLC_N_SGI_40                   0x02
+#define WLC_VHT_SGI_80                 0x04
+#define WLC_VHT_SGI_160                        0x08
+
+/* when sgi_tx==WLC_SGI_ALL, bypass rate selection, enable sgi for all mcs */
+#define WLC_SGI_ALL                            0x02
+
+#define LISTEN_INTERVAL                        10
+/* interference mitigation options */
+#define        INTERFERE_OVRRIDE_OFF   -1      /* interference override off */
+#define        INTERFERE_NONE  0       /* off */
+#define        NON_WLAN        1       /* foreign/non 802.11 interference, no auto detect */
+#define        WLAN_MANUAL     2       /* ACI: no auto detection */
+#define        WLAN_AUTO       3       /* ACI: auto detect */
+#define        WLAN_AUTO_W_NOISE       4       /* ACI: auto - detect and non 802.11 interference */
+#define AUTO_ACTIVE    (1 << 7) /* Auto is currently active */
+
+/* interfernece mode bit-masks (ACPHY) */
+#define ACPHY_ACI_GLITCHBASED_DESENSE 1   /* bit 0 */
+#define ACPHY_ACI_HWACI_PKTGAINLMT 2      /* bit 1 */
+#define ACPHY_ACI_W2NB_PKTGAINLMT 4       /* bit 2 */
+#define ACPHY_ACI_PREEMPTION 8            /* bit 3 */
+#define ACPHY_HWACI_MITIGATION 16         /* bit 4 */
+#define ACPHY_LPD_PREEMPTION 32           /* bit 5 */
+#define ACPHY_HWOBSS_MITIGATION 64        /* bit 6 */
+#define ACPHY_ACI_MAX_MODE 127
+
+/* AP environment */
+#define AP_ENV_DETECT_NOT_USED         0 /* We aren't using AP environment detection */
+#define AP_ENV_DENSE                   1 /* "Corporate" or other AP dense environment */
+#define AP_ENV_SPARSE                  2 /* "Home" or other sparse environment */
+#define AP_ENV_INDETERMINATE           3 /* AP environment hasn't been identified */
+
+#define TRIGGER_NOW                            0
+#define TRIGGER_CRS                            0x01
+#define TRIGGER_CRSDEASSERT                    0x02
+#define TRIGGER_GOODFCS                                0x04
+#define TRIGGER_BADFCS                         0x08
+#define TRIGGER_BADPLCP                                0x10
+#define TRIGGER_CRSGLITCH                      0x20
+
+#define        WL_SAMPLEDATA_HEADER_TYPE       1
+#define WL_SAMPLEDATA_HEADER_SIZE      80      /* sample collect header size (bytes) */
+#define        WL_SAMPLEDATA_TYPE              2
+#define        WL_SAMPLEDATA_SEQ               0xff    /* sequence # */
+#define        WL_SAMPLEDATA_MORE_DATA         0x100   /* more data mask */
+
+/* WL_OTA START */
+#define WL_OTA_ARG_PARSE_BLK_SIZE      1200
+#define WL_OTA_TEST_MAX_NUM_RATE       30
+#define WL_OTA_TEST_MAX_NUM_SEQ                100
+#define WL_OTA_TEST_MAX_NUM_RSSI       85
+#define WL_THRESHOLD_LO_BAND   70      /* range from 5250MHz - 5350MHz */
+
+/* radar iovar SET defines */
+#define WL_RADAR_DETECTOR_OFF          0       /* radar detector off */
+#define WL_RADAR_DETECTOR_ON           1       /* radar detector on */
+#define WL_RADAR_SIMULATED             2       /* force radar detector to declare
+                                                * detection once
+                                                */
+#define WL_RADAR_SIMULATED_SC          3       /* force radar detector to declare
+                                                * detection once on scan core
+                                                * if available and active
+                                                */
+#define WL_RSSI_ANT_VERSION    1       /* current version of wl_rssi_ant_t */
+#define WL_ANT_RX_MAX          2       /* max 2 receive antennas */
+#define WL_ANT_HT_RX_MAX       4       /* max 4 receive antennas/cores */
+#define WL_ANT_IDX_1           0       /* antenna index 1 */
+#define WL_ANT_IDX_2           1       /* antenna index 2 */
+
+#ifndef WL_RSSI_ANT_MAX
+#define WL_RSSI_ANT_MAX                4       /* max possible rx antennas */
+#elif WL_RSSI_ANT_MAX != 4
+#error "WL_RSSI_ANT_MAX does not match"
+#endif
+
+/* dfs_status iovar-related defines */
+
+/* cac - channel availability check,
+ * ism - in-service monitoring
+ * csa - channel switching announcement
+ */
+
+/* cac state values */
+#define WL_DFS_CACSTATE_IDLE           0       /* state for operating in non-radar channel */
+#define        WL_DFS_CACSTATE_PREISM_CAC      1       /* CAC in progress */
+#define WL_DFS_CACSTATE_ISM            2       /* ISM in progress */
+#define WL_DFS_CACSTATE_CSA            3       /* csa */
+#define WL_DFS_CACSTATE_POSTISM_CAC    4       /* ISM CAC */
+#define WL_DFS_CACSTATE_PREISM_OOC     5       /* PREISM OOC */
+#define WL_DFS_CACSTATE_POSTISM_OOC    6       /* POSTISM OOC */
+#define WL_DFS_CACSTATES               7       /* this many states exist */
+
+/* Defines used with channel_bandwidth for curpower */
+#define WL_BW_20MHZ            0
+#define WL_BW_40MHZ            1
+#define WL_BW_80MHZ            2
+#define WL_BW_160MHZ           3
+#define WL_BW_8080MHZ          4
+#define WL_BW_2P5MHZ           5
+#define WL_BW_5MHZ             6
+#define WL_BW_10MHZ            7
+
+/* tx_power_t.flags bits */
+#define WL_TX_POWER_F_ENABLED  1
+#define WL_TX_POWER_F_HW               2
+#define WL_TX_POWER_F_MIMO             4
+#define WL_TX_POWER_F_SISO             8
+#define WL_TX_POWER_F_HT               0x10
+#define WL_TX_POWER_F_VHT              0x20
+#define WL_TX_POWER_F_OPENLOOP         0x40
+#define WL_TX_POWER_F_PROP11NRATES     0x80
+#define WL_TX_POWER_F_UNIT_QDBM                0x100
+/* Message levels */
+#define WL_ERROR_VAL           0x00000001
+#define WL_TRACE_VAL           0x00000002
+#define WL_PRHDRS_VAL          0x00000004
+#define WL_PRPKT_VAL           0x00000008
+#define WL_INFORM_VAL          0x00000010
+#define WL_TMP_VAL             0x00000020
+#define WL_OID_VAL             0x00000040
+#define WL_RATE_VAL            0x00000080
+#define WL_ASSOC_VAL           0x00000100
+#define WL_PRUSR_VAL           0x00000200
+#define WL_PS_VAL              0x00000400
+#define WL_TXPWR_VAL           0x00000000      /* retired in TOT on 6/10/2009 */
+#define WL_MODE_SWITCH_VAL     0x00000800 /* Using retired TXPWR val */
+#define WL_PORT_VAL            0x00001000
+#define WL_DUAL_VAL            0x00002000
+#define WL_WSEC_VAL            0x00004000
+#define WL_WSEC_DUMP_VAL       0x00008000
+#define WL_LOG_VAL             0x00010000
+#define WL_NRSSI_VAL           0x00000000      /* retired in TOT on 6/10/2009 */
+#define WL_BCNTRIM_VAL         0x00020000      /* Using retired NRSSI VAL */
+#define WL_LOFT_VAL            0x00000000      /* retired in TOT on 6/10/2009 */
+#define WL_PFN_VAL             0x00040000 /* Using retired LOFT_VAL */
+#define WL_REGULATORY_VAL      0x00080000
+#define WL_CSA_VAL             0x00080000  /* Reusing REGULATORY_VAL due to lackof bits */
+#define WL_TAF_VAL             0x00100000
+#define WL_RADAR_VAL           0x00000000      /* retired in TOT on 6/10/2009 */
+#define WL_WDI_VAL             0x00200000      /* Using retired WL_RADAR_VAL VAL */
+#define WL_MPC_VAL             0x00400000
+#define WL_APSTA_VAL           0x00800000
+#define WL_DFS_VAL             0x01000000
+#define WL_BA_VAL              0x00000000      /* retired in TOT on 6/14/2010 */
+#define WL_MUMIMO_VAL          0x02000000      /* Using retired WL_BA_VAL */
+#define WL_ACI_VAL             0x04000000
+#define WL_PRMAC_VAL           0x04000000
+#define WL_MBSS_VAL            0x04000000
+#define WL_CAC_VAL             0x08000000
+#define WL_AMSDU_VAL           0x10000000
+#define WL_AMPDU_VAL           0x20000000
+#define WL_FFPLD_VAL           0x40000000
+#define WL_ROAM_EXP_VAL                0x80000000
+
+/* wl_msg_level is full. For new bits take the next one and AND with
+ * wl_msg_level2 in wl_dbg.h
+ */
+#define WL_DPT_VAL             0x00000001
+/* re-using WL_DPT_VAL */
+/* re-using WL_MESH_VAL */
+#define WL_NATOE_VAL           0x00000001
+#define WL_MESH_VAL            0x00000001
+#define WL_SCAN_VAL            0x00000002
+#define WL_WOWL_VAL            0x00000004
+#define WL_COEX_VAL            0x00000008
+#define WL_RTDC_VAL            0x00000010
+#define WL_PROTO_VAL           0x00000020
+#define WL_BTA_VAL             0x00000040
+#define WL_CHANINT_VAL         0x00000080
+#define WL_WMF_VAL             0x00000100
+#define WL_P2P_VAL             0x00000200
+#define WL_ITFR_VAL            0x00000400
+#define WL_MCHAN_VAL           0x00000800
+#define WL_TDLS_VAL            0x00001000
+#define WL_MCNX_VAL            0x00002000
+#define WL_PROT_VAL            0x00004000
+#define WL_PSTA_VAL            0x00008000
+#define WL_TSO_VAL             0x00010000
+#define WL_TRF_MGMT_VAL                0x00020000
+#define WL_LPC_VAL             0x00040000
+#define WL_L2FILTER_VAL                0x00080000
+#define WL_TXBF_VAL            0x00100000
+#define WL_P2PO_VAL            0x00200000
+#define WL_TBTT_VAL            0x00400000
+#define WL_FBT_VAL             0x00800000
+#define WL_RRM_VAL             0x00800000 /* reuse */
+#define WL_MQ_VAL              0x01000000
+
+/* This level is currently used in Phoenix2 only */
+#define WL_SRSCAN_VAL          0x02000000
+
+#define WL_WNM_VAL             0x04000000
+/* re-using WL_WNM_VAL for MBO */
+#define WL_MBO_VAL             0x04000000
+#define WL_PWRSEL_VAL          0x10000000
+#define WL_NET_DETECT_VAL      0x20000000
+#define WL_PCIE_VAL            0x40000000
+#define WL_PMDUR_VAL   0x80000000
+
+
+/* use top-bit for WL_TIME_STAMP_VAL because this is a modifier
+ * rather than a message-type of its own
+ */
+#define WL_TIMESTAMP_VAL        0x80000000
+
+/* max # of leds supported by GPIO (gpio pin# == led index#) */
+#define        WL_LED_NUMGPIO          32      /* gpio 0-31 */
+
+/* led per-pin behaviors */
+#define        WL_LED_OFF              0               /* always off */
+#define        WL_LED_ON               1               /* always on */
+#define        WL_LED_ACTIVITY         2               /* activity */
+#define        WL_LED_RADIO            3               /* radio enabled */
+#define        WL_LED_ARADIO           4               /* 5  Ghz radio enabled */
+#define        WL_LED_BRADIO           5               /* 2.4Ghz radio enabled */
+#define        WL_LED_BGMODE           6               /* on if gmode, off if bmode */
+#define        WL_LED_WI1              7
+#define        WL_LED_WI2              8
+#define        WL_LED_WI3              9
+#define        WL_LED_ASSOC            10              /* associated state indicator */
+#define        WL_LED_INACTIVE         11              /* null behavior (clears default behavior) */
+#define        WL_LED_ASSOCACT         12              /* on when associated; blink fast for activity */
+#define WL_LED_WI4             13
+#define WL_LED_WI5             14
+#define        WL_LED_BLINKSLOW        15              /* blink slow */
+#define        WL_LED_BLINKMED         16              /* blink med */
+#define        WL_LED_BLINKFAST        17              /* blink fast */
+#define        WL_LED_BLINKCUSTOM      18              /* blink custom */
+#define        WL_LED_BLINKPERIODIC    19              /* blink periodic (custom 1000ms / off 400ms) */
+#define WL_LED_ASSOC_WITH_SEC  20              /* when connected with security */
+                                               /* keep on for 300 sec */
+#define WL_LED_START_OFF       21              /* off upon boot, could be turned on later */
+#define WL_LED_WI6             22
+#define WL_LED_WI7             23
+#define WL_LED_WI8             24
+#define        WL_LED_NUMBEHAVIOR      25
+
+/* led behavior numeric value format */
+#define        WL_LED_BEH_MASK         0x3f            /* behavior mask */
+#define        WL_LED_PMU_OVERRIDE     0x40            /* need to set PMU Override bit for the GPIO */
+#define        WL_LED_AL_MASK          0x80            /* activelow (polarity) bit */
+
+/* number of bytes needed to define a proper bit mask for MAC event reporting */
+#define BCMIO_ROUNDUP(x, y)    ((((x) + ((y) - 1)) / (y)) * (y))
+#define BCMIO_NBBY             8
+#define WL_EVENTING_MASK_LEN   16
+
+#define WL_EVENTING_MASK_EXT_LEN \
+    MAX(WL_EVENTING_MASK_LEN, (ROUNDUP(WLC_E_LAST, NBBY)/NBBY))
+
+/* join preference types */
+#define WL_JOIN_PREF_RSSI      1       /* by RSSI */
+#define WL_JOIN_PREF_WPA       2       /* by akm and ciphers */
+#define WL_JOIN_PREF_BAND      3       /* by 802.11 band */
+#define WL_JOIN_PREF_RSSI_DELTA        4       /* by 802.11 band only if RSSI delta condition matches */
+#define WL_JOIN_PREF_TRANS_PREF        5       /* defined by requesting AP */
+
+/* band preference */
+#define WLJP_BAND_ASSOC_PREF   255     /* use what WLC_SET_ASSOC_PREFER ioctl specifies */
+
+/* any multicast cipher suite */
+#define WL_WPA_ACP_MCS_ANY     "\x00\x00\x00\x00"
+
+/* 802.11h measurement types */
+#define WLC_MEASURE_TPC                        1
+#define WLC_MEASURE_CHANNEL_BASIC      2
+#define WLC_MEASURE_CHANNEL_CCA                3
+#define WLC_MEASURE_CHANNEL_RPI                4
+
+/* regulatory enforcement levels */
+#define SPECT_MNGMT_OFF                        0               /* both 11h and 11d disabled */
+#define SPECT_MNGMT_LOOSE_11H          1               /* allow non-11h APs in scan lists */
+#define SPECT_MNGMT_STRICT_11H         2               /* prune out non-11h APs from scan list */
+#define SPECT_MNGMT_STRICT_11D         3               /* switch to 802.11D mode */
+/* SPECT_MNGMT_LOOSE_11H_D - same as SPECT_MNGMT_LOOSE with the exception that Country IE
+ * adoption is done regardless of capability spectrum_management
+ */
+#define SPECT_MNGMT_LOOSE_11H_D                4               /* operation defined above */
+
+/* bit position in per_chan_info; these depend on current country/regulatory domain */
+#define WL_CHAN_VALID_HW               (1 << 0)        /* valid with current HW */
+#define WL_CHAN_VALID_SW               (1 << 1)        /* valid with current country setting */
+#define WL_CHAN_BAND_5G                        (1 << 2)        /* 5GHz-band channel */
+#define WL_CHAN_RADAR                  (1 << 3)        /* radar sensitive channel */
+#define WL_CHAN_INACTIVE               (1 << 4)        /* temporarily inactive due to radar */
+#define WL_CHAN_PASSIVE                        (1 << 5)        /* channel is in passive mode */
+#define WL_CHAN_RESTRICTED             (1 << 6)        /* restricted use channel */
+#define WL_CHAN_RADAR_EU_WEATHER       (1 << 7)        /* EU Radar weather channel. Implies an
+                                                        * EU Radar channel.
+                                                        */
+/* following definition is for precommit; will be removed once wl, acsd switch to the new def */
+#define WL_CHAN_WEATHER_RADAR          WL_CHAN_RADAR_EU_WEATHER
+
+/* BTC mode used by "btc_mode" iovar */
+#define        WL_BTC_DISABLE          0       /* disable BT coexistence */
+#define WL_BTC_FULLTDM      1  /* full TDM COEX */
+#define WL_BTC_ENABLE       1  /* full TDM COEX to maintain backward compatiblity */
+#define WL_BTC_PREMPT      2    /* full TDM COEX with preemption */
+#define WL_BTC_LITE        3   /* light weight coex for large isolation platform */
+#define WL_BTC_PARALLEL                4   /* BT and WLAN run in parallel with separate antenna  */
+#define WL_BTC_HYBRID          5   /* hybrid coex, only ack is allowed to transmit in BT slot */
+#define WL_BTC_DEFAULT         8       /* set the default mode for the device */
+#define WL_INF_BTC_DISABLE      0
+#define WL_INF_BTC_ENABLE       1
+#define WL_INF_BTC_AUTO         3
+
+/* BTC wire used by "btc_wire" iovar */
+#define        WL_BTC_DEFWIRE          0       /* use default wire setting */
+#define WL_BTC_2WIRE           2       /* use 2-wire BTC */
+#define WL_BTC_3WIRE           3       /* use 3-wire BTC */
+#define WL_BTC_4WIRE           4       /* use 4-wire BTC */
+
+/* BTC flags: BTC configuration that can be set by host */
+#define WL_BTC_FLAG_PREMPT               (1 << 0)
+#define WL_BTC_FLAG_BT_DEF               (1 << 1)
+#define WL_BTC_FLAG_ACTIVE_PROT          (1 << 2)
+#define WL_BTC_FLAG_SIM_RSP              (1 << 3)
+#define WL_BTC_FLAG_PS_PROTECT           (1 << 4)
+#define WL_BTC_FLAG_SIM_TX_LP           (1 << 5)
+#define WL_BTC_FLAG_ECI                  (1 << 6)
+#define WL_BTC_FLAG_LIGHT                (1 << 7)
+#define WL_BTC_FLAG_PARALLEL             (1 << 8)
+
+/* maximum channels returned by the get valid channels iovar */
+#define WL_NUMCHANNELS         64
+
+/* max number of chanspecs (used by the iovar to calc. buf space) */
+#ifdef WL11AC_80P80
+#define WL_NUMCHANSPECS 206
+#else
+#define WL_NUMCHANSPECS 110
+#endif
+
+/* WDS link local endpoint WPA role */
+#define WL_WDS_WPA_ROLE_AUTH   0       /* authenticator */
+#define WL_WDS_WPA_ROLE_SUP    1       /* supplicant */
+#define WL_WDS_WPA_ROLE_AUTO   255     /* auto, based on mac addr value */
+
+/* Base offset values */
+#define WL_PKT_FILTER_BASE_PKT   0
+#define WL_PKT_FILTER_BASE_END   1
+#define WL_PKT_FILTER_BASE_D11_H 2 /* May be removed */
+#define WL_PKT_FILTER_BASE_D11_D 3 /* May be removed */
+#define WL_PKT_FILTER_BASE_ETH_H 4
+#define WL_PKT_FILTER_BASE_ETH_D 5
+#define WL_PKT_FILTER_BASE_ARP_H 6
+#define WL_PKT_FILTER_BASE_ARP_D 7 /* May be removed */
+#define WL_PKT_FILTER_BASE_IP4_H 8
+#define WL_PKT_FILTER_BASE_IP4_D 9
+#define WL_PKT_FILTER_BASE_IP6_H 10
+#define WL_PKT_FILTER_BASE_IP6_D 11
+#define WL_PKT_FILTER_BASE_TCP_H 12
+#define WL_PKT_FILTER_BASE_TCP_D 13 /* May be removed */
+#define WL_PKT_FILTER_BASE_UDP_H 14
+#define WL_PKT_FILTER_BASE_UDP_D 15
+#define WL_PKT_FILTER_BASE_IP6_P 16
+#define WL_PKT_FILTER_BASE_COUNT 17 /* May be removed */
+
+/* String mapping for bases that may be used by applications or debug */
+#define WL_PKT_FILTER_BASE_NAMES \
+       { "START", WL_PKT_FILTER_BASE_PKT },   \
+       { "END",   WL_PKT_FILTER_BASE_END },   \
+       { "ETH_H", WL_PKT_FILTER_BASE_ETH_H }, \
+       { "ETH_D", WL_PKT_FILTER_BASE_ETH_D }, \
+       { "D11_H", WL_PKT_FILTER_BASE_D11_H }, \
+       { "D11_D", WL_PKT_FILTER_BASE_D11_D }, \
+       { "ARP_H", WL_PKT_FILTER_BASE_ARP_H }, \
+       { "IP4_H", WL_PKT_FILTER_BASE_IP4_H }, \
+       { "IP4_D", WL_PKT_FILTER_BASE_IP4_D }, \
+       { "IP6_H", WL_PKT_FILTER_BASE_IP6_H }, \
+       { "IP6_D", WL_PKT_FILTER_BASE_IP6_D }, \
+       { "IP6_P", WL_PKT_FILTER_BASE_IP6_P }, \
+       { "TCP_H", WL_PKT_FILTER_BASE_TCP_H }, \
+       { "TCP_D", WL_PKT_FILTER_BASE_TCP_D }, \
+       { "UDP_H", WL_PKT_FILTER_BASE_UDP_H }, \
+       { "UDP_D", WL_PKT_FILTER_BASE_UDP_D }
+
+/* Flags for a pattern list element */
+#define WL_PKT_FILTER_MFLAG_NEG 0x0001
+
+/*
+ * Packet engine interface
+ */
+
+#define WL_PKTENG_PER_TX_START                 0x01
+#define WL_PKTENG_PER_TX_STOP                  0x02
+#define WL_PKTENG_PER_RX_START                 0x04
+#define WL_PKTENG_PER_RX_WITH_ACK_START                0x05
+#define WL_PKTENG_PER_TX_WITH_ACK_START                0x06
+#define WL_PKTENG_PER_RX_STOP                  0x08
+#define WL_PKTENG_PER_MASK                     0xff
+
+#define WL_PKTENG_SYNCHRONOUS                  0x100   /* synchronous flag */
+#define WL_PKTENG_SYNCHRONOUS_UNBLK            0x200   /* synchronous unblock flag */
+#ifdef PKTENG_LONGPKTSZ
+/* max pktsz limit for pkteng */
+#define WL_PKTENG_MAXPKTSZ                             PKTENG_LONGPKTSZ
+#else
+#define WL_PKTENG_MAXPKTSZ                             16384
+#endif
+
+#define NUM_80211b_RATES       4
+#define NUM_80211ag_RATES      8
+#define NUM_80211n_RATES       32
+#define NUM_80211_RATES                (NUM_80211b_RATES+NUM_80211ag_RATES+NUM_80211n_RATES)
+
+/*
+ * WOWL capability/override settings
+ */
+#define WL_WOWL_MAGIC           (1 << 0)    /* Wakeup on Magic packet */
+#define WL_WOWL_NET             (1 << 1)    /* Wakeup on Netpattern */
+#define WL_WOWL_DIS             (1 << 2)    /* Wakeup on loss-of-link due to Disassoc/Deauth */
+#define WL_WOWL_RETR            (1 << 3)    /* Wakeup on retrograde TSF */
+#define WL_WOWL_BCN             (1 << 4)    /* Wakeup on loss of beacon */
+#define WL_WOWL_TST             (1 << 5)    /* Wakeup after test */
+#define WL_WOWL_M1              (1 << 6)    /* Wakeup after PTK refresh */
+#define WL_WOWL_EAPID           (1 << 7)    /* Wakeup after receipt of EAP-Identity Req */
+#define WL_WOWL_PME_GPIO        (1 << 8)    /* Wakeind via PME(0) or GPIO(1) */
+#define WL_WOWL_ULP_BAILOUT     (1 << 8)    /* wakeind via unknown pkt by basic ULP-offloads -
+ * WL_WOWL_ULP_BAILOUT - same as WL_WOWL_PME_GPIO used only for DONGLE BUILDS
+ */
+#define WL_WOWL_NEEDTKIP1       (1 << 9)    /* need tkip phase 1 key to be updated by the driver */
+#define WL_WOWL_GTK_FAILURE     (1 << 10)   /* enable wakeup if GTK fails */
+#define WL_WOWL_EXTMAGPAT       (1 << 11)   /* support extended magic packets */
+#define WL_WOWL_ARPOFFLOAD      (1 << 12)   /* support ARP/NS/keepalive offloading */
+#define WL_WOWL_WPA2            (1 << 13)   /* read protocol version for EAPOL frames */
+#define WL_WOWL_KEYROT          (1 << 14)   /* If the bit is set, use key rotaton */
+#define WL_WOWL_BCAST           (1 << 15)   /* If the bit is set, frm received was bcast frame */
+#define WL_WOWL_SCANOL          (1 << 16)   /* If the bit is set, scan offload is enabled */
+#define WL_WOWL_TCPKEEP_TIME    (1 << 17)   /* Wakeup on tcpkeep alive timeout */
+#define WL_WOWL_MDNS_CONFLICT   (1 << 18)   /* Wakeup on mDNS Conflict Resolution */
+#define WL_WOWL_MDNS_SERVICE    (1 << 19)   /* Wakeup on mDNS Service Connect */
+#define WL_WOWL_TCPKEEP_DATA    (1 << 20)   /* tcp keepalive got data */
+#define WL_WOWL_FW_HALT         (1 << 21)   /* Firmware died in wowl mode */
+#define WL_WOWL_ENAB_HWRADIO    (1 << 22)   /* Enable detection of radio button changes */
+#define WL_WOWL_MIC_FAIL        (1 << 23)   /* Offloads detected MIC failure(s) */
+#define WL_WOWL_UNASSOC         (1 << 24)   /* Wakeup in Unassociated state (Net/Magic Pattern) */
+#define WL_WOWL_SECURE          (1 << 25)   /* Wakeup if received matched secured pattern */
+#define WL_WOWL_EXCESS_WAKE     (1 << 26)   /* Excess wake */
+#define WL_WOWL_LINKDOWN        (1 << 31)   /* Link Down indication in WoWL mode */
+
+#define WL_WOWL_TCPKEEP         (1 << 20)   /* temp copy to satisfy automerger */
+#define MAGIC_PKT_MINLEN 102    /* Magic pkt min length is 6 * 0xFF + 16 * ETHER_ADDR_LEN */
+
+#define WOWL_PATTEN_TYPE_ARP   (1 << 0)        /* ARP offload Pattern */
+#define WOWL_PATTEN_TYPE_NA    (1 << 1)        /* NA offload Pattern */
+
+#define MAGIC_PKT_MINLEN       102    /* Magic pkt min length is 6 * 0xFF + 16 * ETHER_ADDR_LEN */
+#define MAGIC_PKT_NUM_MAC_ADDRS        16
+
+/* Overlap BSS Scan parameters default, minimum, maximum */
+#define WLC_OBSS_SCAN_PASSIVE_DWELL_DEFAULT            20      /* unit TU */
+#define WLC_OBSS_SCAN_PASSIVE_DWELL_MIN                        5       /* unit TU */
+#define WLC_OBSS_SCAN_PASSIVE_DWELL_MAX                        1000    /* unit TU */
+#define WLC_OBSS_SCAN_ACTIVE_DWELL_DEFAULT             10      /* unit TU */
+#define WLC_OBSS_SCAN_ACTIVE_DWELL_MIN                 10      /* unit TU */
+#define WLC_OBSS_SCAN_ACTIVE_DWELL_MAX                 1000    /* unit TU */
+#define WLC_OBSS_SCAN_WIDTHSCAN_INTERVAL_DEFAULT       300     /* unit Sec */
+#define WLC_OBSS_SCAN_WIDTHSCAN_INTERVAL_MIN           10      /* unit Sec */
+#define WLC_OBSS_SCAN_WIDTHSCAN_INTERVAL_MAX           900     /* unit Sec */
+#define WLC_OBSS_SCAN_CHANWIDTH_TRANSITION_DLY_DEFAULT 5
+#define WLC_OBSS_SCAN_CHANWIDTH_TRANSITION_DLY_MIN     5
+#define WLC_OBSS_SCAN_CHANWIDTH_TRANSITION_DLY_MAX     100
+#define WLC_OBSS_SCAN_PASSIVE_TOTAL_PER_CHANNEL_DEFAULT        200     /* unit TU */
+#define WLC_OBSS_SCAN_PASSIVE_TOTAL_PER_CHANNEL_MIN    200     /* unit TU */
+#define WLC_OBSS_SCAN_PASSIVE_TOTAL_PER_CHANNEL_MAX    10000   /* unit TU */
+#define WLC_OBSS_SCAN_ACTIVE_TOTAL_PER_CHANNEL_DEFAULT 20      /* unit TU */
+#define WLC_OBSS_SCAN_ACTIVE_TOTAL_PER_CHANNEL_MIN     20      /* unit TU */
+#define WLC_OBSS_SCAN_ACTIVE_TOTAL_PER_CHANNEL_MAX     10000   /* unit TU */
+#define WLC_OBSS_SCAN_ACTIVITY_THRESHOLD_DEFAULT       25      /* unit percent */
+#define WLC_OBSS_SCAN_ACTIVITY_THRESHOLD_MIN           0       /* unit percent */
+#define WLC_OBSS_SCAN_ACTIVITY_THRESHOLD_MAX           100     /* unit percent */
+
+#define WL_MIN_NUM_OBSS_SCAN_ARG 7     /* minimum number of arguments required for OBSS Scan */
+
+#define WL_COEX_INFO_MASK              0x07
+#define WL_COEX_INFO_REQ               0x01
+#define        WL_COEX_40MHZ_INTOLERANT        0x02
+#define        WL_COEX_WIDTH20                 0x04
+
+#define        WLC_RSSI_INVALID         0      /* invalid RSSI value */
+
+#define MAX_RSSI_LEVELS 8
+
+/* **** EXTLOG **** */
+#define EXTLOG_CUR_VER         0x0100
+
+#define MAX_ARGSTR_LEN         18 /* At least big enough for storing ETHER_ADDR_STR_LEN */
+
+/* log modules (bitmap) */
+#define LOG_MODULE_COMMON      0x0001
+#define LOG_MODULE_ASSOC       0x0002
+#define LOG_MODULE_EVENT       0x0004
+#define LOG_MODULE_MAX         3                       /* Update when adding module */
+
+/* log levels */
+#define WL_LOG_LEVEL_DISABLE   0
+#define WL_LOG_LEVEL_ERR       1
+#define WL_LOG_LEVEL_WARN      2
+#define WL_LOG_LEVEL_INFO      3
+#define WL_LOG_LEVEL_MAX       WL_LOG_LEVEL_INFO       /* Update when adding level */
+
+/* flag */
+#define LOG_FLAG_EVENT         1
+
+/* log arg_type */
+#define LOG_ARGTYPE_NULL       0
+#define LOG_ARGTYPE_STR                1       /* %s */
+#define LOG_ARGTYPE_INT                2       /* %d */
+#define LOG_ARGTYPE_INT_STR    3       /* %d...%s */
+#define LOG_ARGTYPE_STR_INT    4       /* %s...%d */
+
+/* 802.11 Mgmt Packet flags */
+#define VNDR_IE_BEACON_FLAG    0x1
+#define VNDR_IE_PRBRSP_FLAG    0x2
+#define VNDR_IE_ASSOCRSP_FLAG  0x4
+#define VNDR_IE_AUTHRSP_FLAG   0x8
+#define VNDR_IE_PRBREQ_FLAG    0x10
+#define VNDR_IE_ASSOCREQ_FLAG  0x20
+#define VNDR_IE_IWAPID_FLAG    0x40 /* vendor IE in IW advertisement protocol ID field */
+#define VNDR_IE_AUTHREQ_FLAG   0x80
+#define VNDR_IE_CUSTOM_FLAG    0x100 /* allow custom IE id */
+
+#if defined(WLP2P)
+/* P2P Action Frames flags (spec ordered) */
+#define VNDR_IE_GONREQ_FLAG     0x001000
+#define VNDR_IE_GONRSP_FLAG     0x002000
+#define VNDR_IE_GONCFM_FLAG     0x004000
+#define VNDR_IE_INVREQ_FLAG     0x008000
+#define VNDR_IE_INVRSP_FLAG     0x010000
+#define VNDR_IE_DISREQ_FLAG     0x020000
+#define VNDR_IE_DISRSP_FLAG     0x040000
+#define VNDR_IE_PRDREQ_FLAG     0x080000
+#define VNDR_IE_PRDRSP_FLAG     0x100000
+
+#define VNDR_IE_P2PAF_SHIFT    12
+#endif /* WLP2P */
+
+/* channel interference measurement (chanim) related defines */
+
+/* chanim mode */
+#define CHANIM_DISABLE 0       /* disabled */
+#define CHANIM_DETECT  1       /* detection only */
+#define CHANIM_EXT             2       /* external state machine */
+#define CHANIM_ACT             3       /* full internal state machine, detect + act */
+#define CHANIM_MODE_MAX 4
+
+/* define for apcs reason code */
+#define APCS_INIT              0
+#define APCS_IOCTL             1
+#define APCS_CHANIM            2
+#define APCS_CSTIMER           3
+#define APCS_BTA               4
+#define APCS_TXDLY             5
+#define APCS_NONACSD           6
+#define APCS_DFS_REENTRY       7
+#define APCS_TXFAIL            8
+#define APCS_MAX               9
+
+/* number of ACS record entries */
+#define CHANIM_ACS_RECORD                      10
+
+/* CHANIM */
+#define CCASTATS_TXDUR  0
+#define CCASTATS_INBSS  1
+#define CCASTATS_OBSS   2
+#define CCASTATS_NOCTG  3
+#define CCASTATS_NOPKT  4
+#define CCASTATS_DOZE   5
+#define CCASTATS_TXOP  6
+#define CCASTATS_GDTXDUR        7
+#define CCASTATS_BDTXDUR        8
+
+#ifndef WLCHANIM_V2
+#define CCASTATS_MAX    9
+#else /* WLCHANIM_V2 */
+#define CCASTATS_MYRX      9
+#define CCASTATS_MAX    10
+#endif /* WLCHANIM_V2 */
+
+#define WL_CHANIM_COUNT_ALL    0xff
+#define WL_CHANIM_COUNT_ONE    0x1
+
+/* ap tpc modes */
+#define        AP_TPC_OFF              0
+#define        AP_TPC_BSS_PWR          1       /* BSS power control */
+#define AP_TPC_AP_PWR          2       /* AP power control */
+#define        AP_TPC_AP_BSS_PWR       3       /* Both AP and BSS power control */
+#define AP_TPC_MAX_LINK_MARGIN 127
+
+/* ap tpc modes */
+#define        AP_TPC_OFF              0
+#define        AP_TPC_BSS_PWR          1       /* BSS power control */
+#define AP_TPC_AP_PWR          2       /* AP power control */
+#define        AP_TPC_AP_BSS_PWR       3       /* Both AP and BSS power control */
+#define AP_TPC_MAX_LINK_MARGIN 127
+
+/* state */
+#define WL_P2P_DISC_ST_SCAN    0
+#define WL_P2P_DISC_ST_LISTEN  1
+#define WL_P2P_DISC_ST_SEARCH  2
+
+/* i/f type */
+#define WL_P2P_IF_CLIENT       0
+#define WL_P2P_IF_GO           1
+#define WL_P2P_IF_DYNBCN_GO    2
+#define WL_P2P_IF_DEV          3
+
+/* count */
+#define WL_P2P_SCHED_RSVD      0
+#define WL_P2P_SCHED_REPEAT    255     /* anything > 255 will be treated as 255 */
+
+#define WL_P2P_SCHED_FIXED_LEN         3
+
+/* schedule type */
+#define WL_P2P_SCHED_TYPE_ABS          0       /* Scheduled Absence */
+#define WL_P2P_SCHED_TYPE_REQ_ABS      1       /* Requested Absence */
+
+/* schedule action during absence periods (for WL_P2P_SCHED_ABS type) */
+#define WL_P2P_SCHED_ACTION_NONE       0       /* no action */
+#define WL_P2P_SCHED_ACTION_DOZE       1       /* doze */
+/* schedule option - WL_P2P_SCHED_TYPE_REQ_ABS */
+#define WL_P2P_SCHED_ACTION_GOOFF      2       /* turn off GO beacon/prbrsp functions */
+/* schedule option - WL_P2P_SCHED_TYPE_XXX */
+#define WL_P2P_SCHED_ACTION_RESET      255     /* reset */
+
+/* schedule option - WL_P2P_SCHED_TYPE_ABS */
+#define WL_P2P_SCHED_OPTION_NORMAL     0       /* normal start/interval/duration/count */
+#define WL_P2P_SCHED_OPTION_BCNPCT     1       /* percentage of beacon interval */
+/* schedule option - WL_P2P_SCHED_TYPE_REQ_ABS */
+#define WL_P2P_SCHED_OPTION_TSFOFS     2       /* normal start/internal/duration/count with
+                                                * start being an offset of the 'current' TSF
+                                                */
+
+/* feature flags */
+#define WL_P2P_FEAT_GO_CSA     (1 << 0)        /* GO moves with the STA using CSA method */
+#define WL_P2P_FEAT_GO_NOLEGACY        (1 << 1)        /* GO does not probe respond to non-p2p probe
+                                                * requests
+                                                */
+#define WL_P2P_FEAT_RESTRICT_DEV_RESP (1 << 2) /* Restrict p2p dev interface from responding */
+
+/* n-mode support capability */
+/* 2x2 includes both 1x1 & 2x2 devices
+ * reserved #define 2 for future when we want to separate 1x1 & 2x2 and
+ * control it independently
+ */
+#define WL_11N_2x2                     1
+#define WL_11N_3x3                     3
+#define WL_11N_4x4                     4
+
+/* define 11n feature disable flags */
+#define WLFEATURE_DISABLE_11N          0x00000001
+#define WLFEATURE_DISABLE_11N_STBC_TX  0x00000002
+#define WLFEATURE_DISABLE_11N_STBC_RX  0x00000004
+#define WLFEATURE_DISABLE_11N_SGI_TX   0x00000008
+#define WLFEATURE_DISABLE_11N_SGI_RX   0x00000010
+#define WLFEATURE_DISABLE_11N_AMPDU_TX 0x00000020
+#define WLFEATURE_DISABLE_11N_AMPDU_RX 0x00000040
+#define WLFEATURE_DISABLE_11N_GF       0x00000080
+
+/* Proxy STA modes */
+#define PSTA_MODE_DISABLED             0
+#define PSTA_MODE_PROXY                        1
+#define PSTA_MODE_REPEATER             2
+
+/* op code in nat_cfg */
+#define NAT_OP_ENABLE          1       /* enable NAT on given interface */
+#define NAT_OP_DISABLE         2       /* disable NAT on given interface */
+#define NAT_OP_DISABLE_ALL     3       /* disable NAT on all interfaces */
+
+/* NAT state */
+#define NAT_STATE_ENABLED      1       /* NAT is enabled */
+#define NAT_STATE_DISABLED     2       /* NAT is disabled */
+
+#define CHANNEL_5G_LOW_START   36      /* 5G low (36..48) CDD enable/disable bit mask */
+#define CHANNEL_5G_MID_START   52      /* 5G mid (52..64) CDD enable/disable bit mask */
+#define CHANNEL_5G_HIGH_START  100     /* 5G high (100..140) CDD enable/disable bit mask */
+#define CHANNEL_5G_UPPER_START 149     /* 5G upper (149..161) CDD enable/disable bit mask */
+
+/* D0 Coalescing */
+#define IPV4_ARP_FILTER                0x0001
+#define IPV4_NETBT_FILTER      0x0002
+#define IPV4_LLMNR_FILTER      0x0004
+#define IPV4_SSDP_FILTER       0x0008
+#define IPV4_WSD_FILTER                0x0010
+#define IPV6_NETBT_FILTER      0x0200
+#define IPV6_LLMNR_FILTER      0x0400
+#define IPV6_SSDP_FILTER       0x0800
+#define IPV6_WSD_FILTER                0x1000
+
+/* Network Offload Engine */
+#define NWOE_OL_ENABLE         0x00000001
+
+/*
+ * Traffic management structures/defines.
+ */
+
+/* Traffic management bandwidth parameters */
+#define TRF_MGMT_MAX_PRIORITIES                 3
+
+#define TRF_MGMT_FLAG_ADD_DSCP                  0x0001  /* Add DSCP to IP TOS field */
+#define TRF_MGMT_FLAG_DISABLE_SHAPING           0x0002  /* Don't shape traffic */
+#define TRF_MGMT_FLAG_MANAGE_LOCAL_TRAFFIC      0x0008  /* Manage traffic over our local subnet */
+#define TRF_MGMT_FLAG_FILTER_ON_MACADDR         0x0010  /* filter on MAC address */
+#define TRF_MGMT_FLAG_NO_RX                     0x0020  /* do not apply fiters to rx packets */
+
+#define TRF_FILTER_MAC_ADDR              0x0001 /* L2 filter use dst mac address for filtering */
+#define TRF_FILTER_IP_ADDR               0x0002 /* L3 filter use ip ddress for filtering */
+#define TRF_FILTER_L4                    0x0004 /* L4 filter use tcp/udp for filtering */
+#define TRF_FILTER_DWM                   0x0008 /* L3 filter use DSCP for filtering */
+#define TRF_FILTER_FAVORED               0x0010 /* Tag the packet FAVORED */
+
+/* WNM/NPS subfeatures mask */
+#define WL_WNM_BSSTRANS                0x00000001
+#define WL_WNM_PROXYARP                0x00000002
+#define WL_WNM_MAXIDLE         0x00000004
+#define WL_WNM_TIMBC           0x00000008
+#define WL_WNM_TFS             0x00000010
+#define WL_WNM_SLEEP           0x00000020
+#define WL_WNM_DMS             0x00000040
+#define WL_WNM_FMS             0x00000080
+#define WL_WNM_NOTIF           0x00000100
+#define WL_WNM_WBTEXT  0x00000200
+#define WL_WNM_MAX             0x00000400
+#ifdef WLWNM_BRCM
+#define BRCM_WNM_FEATURE_SET\
+                                       (WL_WNM_PROXYARP | \
+                                       WL_WNM_SLEEP | \
+                                       WL_WNM_FMS | \
+                                       WL_WNM_TFS | \
+                                       WL_WNM_TIMBC | \
+                                       WL_WNM_BSSTRANS | \
+                                       WL_WNM_DMS | \
+                                       WL_WNM_NOTIF | \
+                                       0)
+#endif /* WLWNM_BRCM */
+#ifndef ETHER_MAX_DATA
+#define ETHER_MAX_DATA 1500
+#endif /* ETHER_MAX_DATA */
+
+/* Different discovery modes for dpt */
+#define        DPT_DISCOVERY_MANUAL    0x01    /* manual discovery mode */
+#define        DPT_DISCOVERY_AUTO      0x02    /* auto discovery mode */
+#define        DPT_DISCOVERY_SCAN      0x04    /* scan-based discovery mode */
+
+/* different path selection values */
+#define DPT_PATHSEL_AUTO       0       /* auto mode for path selection */
+#define DPT_PATHSEL_DIRECT     1       /* always use direct DPT path */
+#define DPT_PATHSEL_APPATH     2       /* always use AP path */
+
+/* different ops for deny list */
+#define DPT_DENY_LIST_ADD      1       /* add to dpt deny list */
+#define DPT_DENY_LIST_REMOVE   2       /* remove from dpt deny list */
+
+/* different ops for manual end point */
+#define DPT_MANUAL_EP_CREATE   1       /* create manual dpt endpoint */
+#define DPT_MANUAL_EP_MODIFY   2       /* modify manual dpt endpoint */
+#define DPT_MANUAL_EP_DELETE   3       /* delete manual dpt endpoint */
+
+/* flags to indicate DPT status */
+#define        DPT_STATUS_ACTIVE       0x01    /* link active (though may be suspended) */
+#define        DPT_STATUS_AES          0x02    /* link secured through AES encryption */
+#define        DPT_STATUS_FAILED       0x04    /* DPT link failed */
+
+#ifdef WLTDLS
+/* different ops for manual end point */
+#define TDLS_MANUAL_EP_CREATE  1       /* create manual dpt endpoint */
+#define TDLS_MANUAL_EP_MODIFY  2       /* modify manual dpt endpoint */
+#define TDLS_MANUAL_EP_DELETE  3       /* delete manual dpt endpoint */
+#define TDLS_MANUAL_EP_PM              4       /*  put dpt endpoint in PM mode */
+#define TDLS_MANUAL_EP_WAKE            5       /* wake up dpt endpoint from PM */
+#define TDLS_MANUAL_EP_DISCOVERY       6       /* discover if endpoint is TDLS capable */
+#define TDLS_MANUAL_EP_CHSW            7       /* channel switch */
+#define TDLS_MANUAL_EP_WFD_TPQ 8       /* WiFi-Display Tunneled Probe reQuest */
+
+/* modes */
+#define TDLS_WFD_IE_TX                 0
+#define TDLS_WFD_IE_RX                 1
+#define TDLS_WFD_PROBE_IE_TX   2
+#define TDLS_WFD_PROBE_IE_RX   3
+#endif /* WLTDLS */
+
+/* define for flag */
+#define TSPEC_PENDING          0       /* TSPEC pending */
+#define TSPEC_ACCEPTED         1       /* TSPEC accepted */
+#define TSPEC_REJECTED         2       /* TSPEC rejected */
+#define TSPEC_UNKNOWN          3       /* TSPEC unknown */
+#define TSPEC_STATUS_MASK      7       /* TSPEC status mask */
+
+
+/* Software feature flag defines used by wlfeatureflag */
+#ifdef WLAFTERBURNER
+#define WL_SWFL_ABBFL       0x0001 /* Allow Afterburner on systems w/o hardware BFL */
+#define WL_SWFL_ABENCORE    0x0002 /* Allow AB on non-4318E chips */
+#endif /* WLAFTERBURNER */
+#define WL_SWFL_NOHWRADIO      0x0004
+#define WL_SWFL_FLOWCONTROL     0x0008 /* Enable backpressure to OS stack */
+#define WL_SWFL_WLBSSSORT      0x0010 /* Per-port supports sorting of BSS */
+
+#define WL_LIFETIME_MAX 0xFFFF /* Max value in ms */
+
+#define CSA_BROADCAST_ACTION_FRAME     0       /* csa broadcast action frame */
+#define CSA_UNICAST_ACTION_FRAME         1 /* csa unicast action frame */
+
+/* Roaming trigger definitions for WLC_SET_ROAM_TRIGGER.
+ *
+ * (-100 < value < 0)   value is used directly as a roaming trigger in dBm
+ * (0 <= value) value specifies a logical roaming trigger level from
+ *                      the list below
+ *
+ * WLC_GET_ROAM_TRIGGER always returns roaming trigger value in dBm, never
+ * the logical roam trigger value.
+ */
+#define WLC_ROAM_TRIGGER_DEFAULT       0 /* default roaming trigger */
+#define WLC_ROAM_TRIGGER_BANDWIDTH     1 /* optimize for bandwidth roaming trigger */
+#define WLC_ROAM_TRIGGER_DISTANCE      2 /* optimize for distance roaming trigger */
+#define WLC_ROAM_TRIGGER_AUTO          3 /* auto-detect environment */
+#define WLC_ROAM_TRIGGER_MAX_VALUE     3 /* max. valid value */
+
+#define WLC_ROAM_NEVER_ROAM_TRIGGER    (-100) /* Avoid Roaming by setting a large value */
+
+/* Preferred Network Offload (PNO, formerly PFN) defines */
+#define WPA_AUTH_PFN_ANY       0xffffffff      /* for PFN, match only ssid */
+
+#define SORT_CRITERIA_BIT              0
+#define AUTO_NET_SWITCH_BIT            1
+#define ENABLE_BKGRD_SCAN_BIT          2
+#define IMMEDIATE_SCAN_BIT             3
+#define        AUTO_CONNECT_BIT                4
+#define        ENABLE_BD_SCAN_BIT              5
+#define ENABLE_ADAPTSCAN_BIT           6
+#define IMMEDIATE_EVENT_BIT            8
+#define SUPPRESS_SSID_BIT              9
+#define ENABLE_NET_OFFLOAD_BIT         10
+/* report found/lost events for SSID and BSSID networks seperately */
+#define REPORT_SEPERATELY_BIT          11
+#define BESTN_BSSID_ONLY_BIT           12
+
+#define SORT_CRITERIA_MASK             0x0001
+#define AUTO_NET_SWITCH_MASK           0x0002
+#define ENABLE_BKGRD_SCAN_MASK         0x0004
+#define IMMEDIATE_SCAN_MASK            0x0008
+#define        AUTO_CONNECT_MASK               0x0010
+
+#define ENABLE_BD_SCAN_MASK            0x0020
+#define ENABLE_ADAPTSCAN_MASK          0x00c0
+#define IMMEDIATE_EVENT_MASK           0x0100
+#define SUPPRESS_SSID_MASK             0x0200
+#define ENABLE_NET_OFFLOAD_MASK                0x0400
+/* report found/lost events for SSID and BSSID networks seperately */
+#define REPORT_SEPERATELY_MASK         0x0800
+#define BESTN_BSSID_ONLY_MASK          0x1000
+
+#define PFN_VERSION                    2
+#ifdef PFN_SCANRESULT_2
+#define PFN_SCANRESULT_VERSION         2
+#else
+#define PFN_SCANRESULT_VERSION         1
+#endif /* PFN_SCANRESULT_2 */
+#ifndef MAX_PFN_LIST_COUNT
+#define MAX_PFN_LIST_COUNT             16
+#endif /* MAX_PFN_LIST_COUNT */
+
+#define PFN_COMPLETE                   1
+#define PFN_INCOMPLETE                 0
+
+#define DEFAULT_BESTN                  2
+#define DEFAULT_MSCAN                  0
+#define DEFAULT_REPEAT                 10
+#define DEFAULT_EXP                            2
+
+#define PFN_PARTIAL_SCAN_BIT           0
+#define PFN_PARTIAL_SCAN_MASK          1
+
+#define WL_PFN_SUPPRESSFOUND_MASK      0x08
+#define WL_PFN_SUPPRESSLOST_MASK       0x10
+#define WL_PFN_SSID_A_BAND_TRIG                0x20
+#define WL_PFN_SSID_BG_BAND_TRIG       0x40
+#define WL_PFN_SSID_IMPRECISE_MATCH    0x80
+#define WL_PFN_SSID_SAME_NETWORK       0x10000
+#define WL_PFN_SUPPRESS_AGING_MASK     0x20000
+#define WL_PFN_FLUSH_ALL_SSIDS         0x40000
+#define WL_PFN_RSSI_MASK               0xff00
+#define WL_PFN_RSSI_SHIFT              8
+
+#define WL_PFN_REPORT_ALLNET    0
+#define WL_PFN_REPORT_SSIDNET   1
+#define WL_PFN_REPORT_BSSIDNET  2
+
+#define WL_PFN_CFG_FLAGS_PROHIBITED    0x00000001      /* Accept and use prohibited channels */
+#define WL_PFN_CFG_FLAGS_HISTORY_OFF   0x00000002      /* Scan history suppressed */
+
+#define WL_PFN_HIDDEN_BIT              2
+#define PNO_SCAN_MAX_FW                        508*1000        /* max time scan time in msec */
+#define PNO_SCAN_MAX_FW_SEC            PNO_SCAN_MAX_FW/1000 /* max time scan time in SEC */
+#define PNO_SCAN_MIN_FW_SEC            10                      /* min time scan time in SEC */
+#define WL_PFN_HIDDEN_MASK             0x4
+#define MAX_SSID_WHITELIST_NUM         4
+#define MAX_BSSID_PREF_LIST_NUM        32
+#define MAX_BSSID_BLACKLIST_NUM        32
+
+#ifndef BESTN_MAX
+#define BESTN_MAX                      10
+#endif
+
+#ifndef MSCAN_MAX
+#define MSCAN_MAX                      32
+#endif
+
+/* TCP Checksum Offload error injection for testing */
+#define TOE_ERRTEST_TX_CSUM    0x00000001
+#define TOE_ERRTEST_RX_CSUM    0x00000002
+#define TOE_ERRTEST_RX_CSUM2   0x00000004
+
+/* ARP Offload feature flags for arp_ol iovar */
+#define ARP_OL_AGENT           0x00000001
+#define ARP_OL_SNOOP           0x00000002
+#define ARP_OL_HOST_AUTO_REPLY 0x00000004
+#define ARP_OL_PEER_AUTO_REPLY 0x00000008
+
+/* ARP Offload error injection */
+#define ARP_ERRTEST_REPLY_PEER 0x1
+#define ARP_ERRTEST_REPLY_HOST 0x2
+
+#define ARP_MULTIHOMING_MAX    8       /* Maximum local host IP addresses */
+#define ND_MULTIHOMING_MAX 10  /* Maximum local host IP addresses */
+#define ND_REQUEST_MAX         5       /* Max set of offload params */
+/* AOAC wake event flag */
+#define WAKE_EVENT_NLO_DISCOVERY_BIT           1
+#define WAKE_EVENT_AP_ASSOCIATION_LOST_BIT     2
+#define WAKE_EVENT_GTK_HANDSHAKE_ERROR_BIT 4
+#define WAKE_EVENT_4WAY_HANDSHAKE_REQUEST_BIT 8
+#define WAKE_EVENT_NET_PACKET_BIT 0x10
+
+#define MAX_NUM_WOL_PATTERN    22 /* LOGO requirements min 22 */
+
+
+/* Packet filter operation mode */
+/* True: 1; False: 0 */
+#define PKT_FILTER_MODE_FORWARD_ON_MATCH               1
+/* Enable and disable pkt_filter as a whole */
+#define PKT_FILTER_MODE_DISABLE                                        2
+/* Cache first matched rx pkt(be queried by host later) */
+#define PKT_FILTER_MODE_PKT_CACHE_ON_MATCH             4
+/* If pkt_filter is enabled and no filter is set, don't forward anything */
+#define PKT_FILTER_MODE_PKT_FORWARD_OFF_DEFAULT 8
+
+#ifdef DONGLEOVERLAYS
+#define OVERLAY_IDX_MASK               0x000000ff
+#define OVERLAY_IDX_SHIFT              0
+#define OVERLAY_FLAGS_MASK             0xffffff00
+#define OVERLAY_FLAGS_SHIFT            8
+/* overlay written to device memory immediately after loading the base image */
+#define OVERLAY_FLAG_POSTLOAD  0x100
+/* defer overlay download until the device responds w/WLC_E_OVL_DOWNLOAD event */
+#define OVERLAY_FLAG_DEFER_DL  0x200
+/* overlay downloaded prior to the host going to sleep */
+#define OVERLAY_FLAG_PRESLEEP  0x400
+#define OVERLAY_DOWNLOAD_CHUNKSIZE     1024
+#endif /* DONGLEOVERLAYS */
+
+/* reuse two number in the sc/rc space */
+#define        SMFS_CODE_MALFORMED 0xFFFE
+#define SMFS_CODE_IGNORED      0xFFFD
+
+/* RFAWARE def */
+#define BCM_ACTION_RFAWARE             0x77
+#define BCM_ACTION_RFAWARE_DCS  0x01
+
+/* DCS reason code define */
+#define BCM_DCS_IOVAR          0x1
+#define BCM_DCS_UNKNOWN                0xFF
+
+#ifdef PROP_TXSTATUS
+/* Bit definitions for tlv iovar */
+/*
+ * enable RSSI signals:
+ * WLFC_CTL_TYPE_RSSI
+ */
+#define WLFC_FLAGS_RSSI_SIGNALS                        0x0001
+
+/* enable (if/mac_open, if/mac_close,, mac_add, mac_del) signals:
+ *
+ * WLFC_CTL_TYPE_MAC_OPEN
+ * WLFC_CTL_TYPE_MAC_CLOSE
+ *
+ * WLFC_CTL_TYPE_INTERFACE_OPEN
+ * WLFC_CTL_TYPE_INTERFACE_CLOSE
+ *
+ * WLFC_CTL_TYPE_MACDESC_ADD
+ * WLFC_CTL_TYPE_MACDESC_DEL
+ *
+ */
+#define WLFC_FLAGS_XONXOFF_SIGNALS             0x0002
+
+/* enable (status, fifo_credit, mac_credit) signals
+ * WLFC_CTL_TYPE_MAC_REQUEST_CREDIT
+ * WLFC_CTL_TYPE_TXSTATUS
+ * WLFC_CTL_TYPE_FIFO_CREDITBACK
+ */
+#define WLFC_FLAGS_CREDIT_STATUS_SIGNALS       0x0004
+
+#define WLFC_FLAGS_HOST_PROPTXSTATUS_ACTIVE    0x0008
+#define WLFC_FLAGS_PSQ_GENERATIONFSM_ENABLE    0x0010
+#define WLFC_FLAGS_PSQ_ZERO_BUFFER_ENABLE      0x0020
+#define WLFC_FLAGS_HOST_RXRERODER_ACTIVE       0x0040
+#define WLFC_FLAGS_PKT_STAMP_SIGNALS           0x0080
+
+#endif /* PROP_TXSTATUS */
+
+#define WL_TIMBC_STATUS_AP_UNKNOWN     255     /* AP status for internal use only */
+
+#define WL_DFRTS_LOGIC_OFF     0       /* Feature is disabled */
+#define WL_DFRTS_LOGIC_OR      1       /* OR all non-zero threshold conditions */
+#define WL_DFRTS_LOGIC_AND     2       /* AND all non-zero threshold conditions */
+
+/* Definitions for Reliable Multicast */
+#define WL_RELMCAST_MAX_CLIENT         32
+#define WL_RELMCAST_FLAG_INBLACKLIST   1
+#define WL_RELMCAST_FLAG_ACTIVEACKER   2
+#define WL_RELMCAST_FLAG_RELMCAST      4
+
+/* structures for proximity detection device role */
+#define WL_PROXD_MODE_DISABLE  0
+#define WL_PROXD_MODE_NEUTRAL  1
+#define WL_PROXD_MODE_INITIATOR        2
+#define WL_PROXD_MODE_TARGET   3
+#define WL_PROXD_RANDOM_WAKEUP 0x8000
+
+
+#ifdef NET_DETECT
+#define NET_DETECT_MAX_WAKE_DATA_SIZE  2048
+#define NET_DETECT_MAX_PROFILES                16
+#define NET_DETECT_MAX_CHANNELS                50
+#endif /* NET_DETECT */
+
+
+/* Bit masks for radio disabled status - returned by WL_GET_RADIO */
+#define WL_RADIO_SW_DISABLE            (1<<0)
+#define WL_RADIO_HW_DISABLE            (1<<1)
+#define WL_RADIO_MPC_DISABLE           (1<<2)
+#define WL_RADIO_COUNTRY_DISABLE       (1<<3)  /* some countries don't support any channel */
+#define WL_RADIO_PERCORE_DISABLE       (1<<4)  /* Radio diable per core for DVT */
+
+#define        WL_SPURAVOID_OFF        0
+#define        WL_SPURAVOID_ON1        1
+#define        WL_SPURAVOID_ON2        2
+
+
+#define WL_4335_SPURAVOID_ON1  1
+#define WL_4335_SPURAVOID_ON2  2
+#define WL_4335_SPURAVOID_ON3  3
+#define WL_4335_SPURAVOID_ON4  4
+#define WL_4335_SPURAVOID_ON5  5
+#define WL_4335_SPURAVOID_ON6  6
+#define WL_4335_SPURAVOID_ON7  7
+#define WL_4335_SPURAVOID_ON8  8
+#define WL_4335_SPURAVOID_ON9  9
+
+/* Override bit for WLC_SET_TXPWR.  if set, ignore other level limits */
+#define WL_TXPWR_OVERRIDE      (1U<<31)
+#define WL_TXPWR_2G            (1U<<30)
+#define WL_TXPWR_5G            (1U<<29)
+#define WL_TXPWR_NEG   (1U<<28)
+
+#define WL_TXPWR_MASK          (~(0x7<<29))
+#define WL_TXPWR_CORE_MAX      (3)
+#define WL_TXPWR_CORE0_MASK    (0x000000FF)
+#define WL_TXPWR_CORE0_SHIFT   (0)
+#define WL_TXPWR_CORE1_MASK    (0x0000FF00)
+#define WL_TXPWR_CORE1_SHIFT   (8)
+#define WL_TXPWR_CORE2_MASK    (0x00FF0000)
+#define WL_TXPWR_CORE2_SHIFT   (16)
+
+/* phy types (returned by WLC_GET_PHYTPE) */
+#define        WLC_PHY_TYPE_A          0
+#define        WLC_PHY_TYPE_B          1
+#define        WLC_PHY_TYPE_G          2
+#define        WLC_PHY_TYPE_N          4
+#define        WLC_PHY_TYPE_LP         5
+#define        WLC_PHY_TYPE_SSN        6
+#define        WLC_PHY_TYPE_HT         7
+#define        WLC_PHY_TYPE_LCN        8
+#define        WLC_PHY_TYPE_LCN40      10
+#define WLC_PHY_TYPE_AC                11
+#define        WLC_PHY_TYPE_LCN20      12
+#define        WLC_PHY_TYPE_NULL       0xf
+
+/* Values for PM */
+#define PM_OFF 0
+#define PM_MAX 1
+#define PM_FAST 2
+#define PM_FORCE_OFF 3         /* use this bit to force PM off even bt is active */
+
+#define WL_WME_CNT_VERSION     1       /* current version of wl_wme_cnt_t */
+
+/* fbt_cap: FBT assoc / reassoc modes. */
+#define WLC_FBT_CAP_DRV_4WAY_AND_REASSOC  1 /* Driver 4-way handshake & reassoc (WLFBT). */
+
+/* monitor_promisc_level bits */
+#define WL_MONPROMISC_PROMISC 0x0001
+#define WL_MONPROMISC_CTRL 0x0002
+#define WL_MONPROMISC_FCS 0x0004
+
+/* TCP Checksum Offload defines */
+#define TOE_TX_CSUM_OL         0x00000001
+#define TOE_RX_CSUM_OL         0x00000002
+
+/* Wi-Fi Display Services (WFDS) */
+#define WL_P2P_SOCIAL_CHANNELS_MAX  WL_NUMCHANNELS
+#define MAX_WFDS_SEEK_SVC 4    /* Max # of wfds services to seek */
+#define MAX_WFDS_ADVERT_SVC 4  /* Max # of wfds services to advertise */
+#define MAX_WFDS_SVC_NAME_LEN 200      /* maximum service_name length */
+#define MAX_WFDS_ADV_SVC_INFO_LEN 65000        /* maximum adv service_info length */
+#define P2P_WFDS_HASH_LEN 6            /* Length of a WFDS service hash */
+#define MAX_WFDS_SEEK_SVC_INFO_LEN 255 /* maximum seek service_info req length */
+#define MAX_WFDS_SEEK_SVC_NAME_LEN 200 /* maximum service_name length */
+
+/* ap_isolate bitmaps */
+#define AP_ISOLATE_DISABLED            0x0
+#define AP_ISOLATE_SENDUP_ALL          0x01
+#define AP_ISOLATE_SENDUP_MCAST                0x02
+
+/* Type values for the wl_pwrstats_t data field */
+#define WL_PWRSTATS_TYPE_PHY           0 /**< struct wl_pwr_phy_stats */
+#define WL_PWRSTATS_TYPE_SCAN          1 /**< struct wl_pwr_scan_stats */
+#define WL_PWRSTATS_TYPE_USB_HSIC      2 /**< struct wl_pwr_usb_hsic_stats */
+#define WL_PWRSTATS_TYPE_PM_AWAKE1     3 /**< struct wl_pwr_pm_awake_stats_v1 */
+#define WL_PWRSTATS_TYPE_CONNECTION    4 /* struct wl_pwr_connect_stats; assoc and key-exch time */
+#define WL_PWRSTATS_TYPE_PCIE          6 /**< struct wl_pwr_pcie_stats */
+#define WL_PWRSTATS_TYPE_PM_AWAKE2     7 /**< struct wl_pwr_pm_awake_stats_v2 */
+#define WL_PWRSTATS_TYPE_SDIO          8 /* struct wl_pwr_sdio_stats */
+#define WL_PWRSTATS_TYPE_MIMO_PS_METRICS 9 /* struct wl_mimo_meas_metrics_t */
+
+#endif /* wlioctl_defs_h */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/dhdioctl.h b/drivers/net/wireless/bcmdhd_1363/include/dhdioctl.h
new file mode 100644 (file)
index 0000000..561550f
--- /dev/null
@@ -0,0 +1,142 @@
+/*
+ * Definitions for ioctls to access DHD iovars.
+ * Based on wlioctl.h (for Broadcom 802.11abg driver).
+ * (Moves towards generic ioctls for BCM drivers/iovars.)
+ *
+ * Definitions subject to change without notice.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: dhdioctl.h 585723 2015-09-11 06:26:37Z $
+ */
+
+#ifndef _dhdioctl_h_
+#define        _dhdioctl_h_
+
+#include <typedefs.h>
+
+
+/* require default structure packing */
+#define BWL_DEFAULT_PACKING
+#include <packed_section_start.h>
+
+
+/* Linux network driver ioctl encoding */
+typedef struct dhd_ioctl {
+       uint cmd;       /* common ioctl definition */
+       void *buf;      /* pointer to user buffer */
+       uint len;       /* length of user buffer */
+       bool set;       /* get or set request (optional) */
+       uint used;      /* bytes read or written (optional) */
+       uint needed;    /* bytes needed (optional) */
+       uint driver;    /* to identify target driver */
+} dhd_ioctl_t;
+
+/* Underlying BUS definition */
+enum {
+       BUS_TYPE_USB = 0, /* for USB dongles */
+       BUS_TYPE_SDIO, /* for SDIO dongles */
+       BUS_TYPE_PCIE /* for PCIE dongles */
+};
+
+/* per-driver magic numbers */
+#define DHD_IOCTL_MAGIC                0x00444944
+
+/* bump this number if you change the ioctl interface */
+#define DHD_IOCTL_VERSION      1
+
+#define        DHD_IOCTL_MAXLEN        8192            /* max length ioctl buffer required */
+#define        DHD_IOCTL_SMLEN         256             /* "small" length ioctl buffer required */
+
+/* common ioctl definitions */
+#define DHD_GET_MAGIC                          0
+#define DHD_GET_VERSION                                1
+#define DHD_GET_VAR                            2
+#define DHD_SET_VAR                            3
+
+/* message levels */
+#define DHD_ERROR_VAL  0x0001
+#define DHD_TRACE_VAL  0x0002
+#define DHD_INFO_VAL   0x0004
+#define DHD_DATA_VAL   0x0008
+#define DHD_CTL_VAL    0x0010
+#define DHD_TIMER_VAL  0x0020
+#define DHD_HDRS_VAL   0x0040
+#define DHD_BYTES_VAL  0x0080
+#define DHD_INTR_VAL   0x0100
+#define DHD_LOG_VAL    0x0200
+#define DHD_GLOM_VAL   0x0400
+#define DHD_EVENT_VAL  0x0800
+#define DHD_BTA_VAL    0x1000
+#define DHD_ISCAN_VAL  0x2000
+#define DHD_ARPOE_VAL  0x4000
+#define DHD_REORDER_VAL        0x8000
+#define DHD_WL_VAL             0x10000
+#define DHD_NOCHECKDIED_VAL            0x20000 /* UTF WAR */
+#define DHD_WL_VAL2            0x40000
+#define DHD_PNO_VAL            0x80000
+#define DHD_MSGTRACE_VAL       0x100000
+#define DHD_FWLOG_VAL          0x400000
+#define DHD_RTT_VAL            0x200000
+#define DHD_IOV_INFO_VAL       0x800000
+
+#ifdef SDTEST
+/* For pktgen iovar */
+typedef struct dhd_pktgen {
+       uint version;           /* To allow structure change tracking */
+       uint freq;              /* Max ticks between tx/rx attempts */
+       uint count;             /* Test packets to send/rcv each attempt */
+       uint print;             /* Print counts every <print> attempts */
+       uint total;             /* Total packets (or bursts) */
+       uint minlen;            /* Minimum length of packets to send */
+       uint maxlen;            /* Maximum length of packets to send */
+       uint numsent;           /* Count of test packets sent */
+       uint numrcvd;           /* Count of test packets received */
+       uint numfail;           /* Count of test send failures */
+       uint mode;              /* Test mode (type of test packets) */
+       uint stop;              /* Stop after this many tx failures */
+} dhd_pktgen_t;
+
+/* Version in case structure changes */
+#define DHD_PKTGEN_VERSION 2
+
+/* Type of test packets to use */
+#define DHD_PKTGEN_ECHO                1 /* Send echo requests */
+#define DHD_PKTGEN_SEND        2 /* Send discard packets */
+#define DHD_PKTGEN_RXBURST     3 /* Request dongle send N packets */
+#define DHD_PKTGEN_RECV                4 /* Continuous rx from continuous tx dongle */
+#endif /* SDTEST */
+
+/* Enter idle immediately (no timeout) */
+#define DHD_IDLE_IMMEDIATE     (-1)
+
+/* Values for idleclock iovar: other values are the sd_divisor to use when idle */
+#define DHD_IDLE_ACTIVE        0       /* Do not request any SD clock change when idle */
+#define DHD_IDLE_STOP   (-1)   /* Request SD clock be stopped (and use SD1 mode) */
+
+
+/* require default structure packing */
+#include <packed_section_end.h>
+
+#endif /* _dhdioctl_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/epivers.h b/drivers/net/wireless/bcmdhd_1363/include/epivers.h
new file mode 100644 (file)
index 0000000..39690c3
--- /dev/null
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: epivers.h.in,v 13.33 2010-09-08 22:08:53 $
+ *
+*/
+
+#ifndef _epivers_h_
+#define _epivers_h_
+
+#define        EPI_MAJOR_VERSION       1
+
+#define        EPI_MINOR_VERSION       363
+
+#define        EPI_RC_NUMBER           22
+
+#define        EPI_INCREMENTAL_NUMBER  0
+
+#define        EPI_BUILD_NUMBER        0
+
+#define        EPI_VERSION             1, 363, 22, 0
+
+#define        EPI_VERSION_NUM         0x0116b160
+
+#define EPI_VERSION_DEV                1.363.22
+
+/* Driver Version String, ASCII, 32 chars max */
+#define        EPI_VERSION_STR         "1.363.22 (r)"
+
+#endif /* _epivers_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/event_log.h b/drivers/net/wireless/bcmdhd_1363/include/event_log.h
new file mode 100644 (file)
index 0000000..82f0c90
--- /dev/null
@@ -0,0 +1,349 @@
+/*
+ * EVENT_LOG system definitions
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: event_log.h 591285 2015-10-07 11:56:29Z $
+ */
+
+#ifndef _EVENT_LOG_H_
+#define _EVENT_LOG_H_
+
+#include <typedefs.h>
+#include <proto/event_log_set.h>
+#include <proto/event_log_tag.h>
+
+/* logstrs header */
+#define LOGSTRS_MAGIC   0x4C4F4753
+#define LOGSTRS_VERSION 0x1
+
+/* We make sure that the block size will fit in a single packet
+ *  (allowing for a bit of overhead on each packet
+ */
+#define EVENT_LOG_MAX_BLOCK_SIZE       1400
+#define EVENT_LOG_WL_BLOCK_SIZE                0x200
+#define EVENT_LOG_PSM_BLOCK_SIZE       0x200
+#define EVENT_LOG_BUS_BLOCK_SIZE       0x200
+#define EVENT_LOG_ERROR_BLOCK_SIZE     0x200
+
+/*
+ * There are multiple levels of objects define here:
+ *   event_log_set - a set of buffers
+ *   event log groups - every event log call is part of just one.  All
+ *                      event log calls in a group are handled the
+ *                      same way.  Each event log group is associated
+ *                      with an event log set or is off.
+ */
+
+#ifndef __ASSEMBLER__
+
+/* On the external system where the dumper is we need to make sure
+ * that these types are the same size as they are on the ARM the
+ * produced them
+ */
+#ifdef EVENT_LOG_DUMPER
+#define _EL_BLOCK_PTR uint32
+#define _EL_TYPE_PTR uint32
+#define _EL_SET_PTR uint32
+#define _EL_TOP_PTR uint32
+#else
+#define _EL_BLOCK_PTR struct event_log_block *
+#define _EL_TYPE_PTR uint32 *
+#define _EL_SET_PTR struct event_log_set **
+#define _EL_TOP_PTR struct event_log_top *
+#endif /* EVENT_LOG_DUMPER */
+
+/* Event log sets (a logical circurlar buffer) consist of one or more
+ * event_log_blocks.  The blocks themselves form a logical circular
+ * list.  The log entries are placed in each event_log_block until it
+ * is full.  Logging continues with the next event_log_block in the
+ * event_set until the last event_log_block is reached and then
+ * logging starts over with the first event_log_block in the
+ * event_set.
+ */
+typedef struct event_log_block {
+       _EL_BLOCK_PTR next_block;
+       _EL_BLOCK_PTR prev_block;
+       _EL_TYPE_PTR end_ptr;
+
+       /* Start of packet sent for log tracing */
+       uint16 pktlen;                  /* Size of rest of block */
+       uint16 count;                   /* Logtrace counter */
+       uint32 timestamp;               /* Timestamp at start of use */
+       uint32 event_logs;
+} event_log_block_t;
+
+/* There can be multiple event_sets with each logging a set of
+ * associated events (i.e, "fast" and "slow" events).
+ */
+typedef struct event_log_set {
+       _EL_BLOCK_PTR first_block;      /* Pointer to first event_log block */
+       _EL_BLOCK_PTR last_block;       /* Pointer to last event_log block */
+       _EL_BLOCK_PTR logtrace_block;   /* next block traced */
+       _EL_BLOCK_PTR cur_block;        /* Pointer to current event_log block */
+       _EL_TYPE_PTR cur_ptr;           /* Current event_log pointer */
+       uint32 blockcount;              /* Number of blocks */
+       uint16 logtrace_count;          /* Last count for logtrace */
+       uint16 blockfill_count;         /* Fill count for logtrace */
+       uint32 timestamp;               /* Last timestamp event */
+       uint32 cyclecount;              /* Cycles at last timestamp event */
+} event_log_set_t;
+
+/* Top data structure for access to everything else */
+typedef struct event_log_top {
+       uint32 magic;
+#define EVENT_LOG_TOP_MAGIC 0x474C8669 /* 'EVLG' */
+       uint32 version;
+#define EVENT_LOG_VERSION 1
+       uint32 num_sets;
+       uint32 logstrs_size;            /* Size of lognums + logstrs area */
+       uint32 timestamp;               /* Last timestamp event */
+       uint32 cyclecount;              /* Cycles at last timestamp event */
+       _EL_SET_PTR sets;               /* Ptr to array of <num_sets> set ptrs */
+} event_log_top_t;
+
+/* Data structure of Keeping the Header from logstrs.bin */
+typedef struct {
+       uint32 logstrs_size;    /* Size of the file */
+       uint32 rom_lognums_offset; /* Offset to the ROM lognum */
+       uint32 ram_lognums_offset; /* Offset to the RAM lognum */
+       uint32 rom_logstrs_offset; /* Offset to the ROM logstr */
+       uint32 ram_logstrs_offset; /* Offset to the RAM logstr */
+       /* Keep version and magic last since "header" is appended to the end of logstrs file. */
+       uint32 version;            /* Header version */
+       uint32 log_magic;       /* MAGIC number for verification 'LOGS' */
+} logstr_header_t;
+
+/*
+ * Use the following macros for generating log events.
+ *
+ * The FAST versions check the enable of the tag before evaluating the arguments and calling the
+ * event_log function.  This adds 5 instructions.  The COMPACT versions evaluate the arguments
+ * and call the event_log function unconditionally.  The event_log function will then skip logging
+ * if this tag is disabled.
+ *
+ * To support easy usage of existing debugging (e.g. msglevel) via macro re-definition there are
+ * two variants of these macros to help.
+ *
+ * First there are the CAST versions.  The event_log function normally logs uint32 values or else
+ * they have to be cast to uint32.  The CAST versions blindly cast for you so you don't have to edit
+ * any existing code.
+ *
+ * Second there are the PAREN_ARGS versions.  These expect the logging format string and arguments
+ * to be enclosed in parentheses.  This allows us to make the following mapping of an existing
+ * msglevel macro:
+ *  #define WL_ERROR(args)   EVENT_LOG_CAST_PAREN_ARGS(EVENT_LOG_TAG_WL_ERROR, args)
+ *
+ * The versions of the macros without FAST or COMPACT in their name are just synonyms for the
+ * COMPACT versions.
+ *
+ * You should use the COMPACT macro (or its synonym) in cases where there is some preceding logic
+ * that prevents the execution of the macro, e.g. WL_ERROR by definition rarely gets executed.
+ * Use the FAST macro in performance sensitive paths. The key concept here is that you should be
+ * assuming that your macro usage is compiled into ROM and can't be changed ... so choose wisely.
+ *
+ */
+
+#ifndef EVENT_LOG_DUMPER
+
+#ifndef EVENT_LOG_COMPILE
+
+/* Null define if no tracing */
+#define EVENT_LOG(format, ...)
+#define EVENT_LOG_FAST(tag, fmt, ...)
+#define EVENT_LOG_COMPACT(tag, fmt, ...)
+
+#define EVENT_LOG_CAST(tag, fmt, ...)
+#define EVENT_LOG_FAST_CAST(tag, fmt, ...)
+#define EVENT_LOG_COMPACT_CAST(tag, fmt, ...)
+
+#define EVENT_LOG_CAST_PAREN_ARGS(tag, pargs)
+#define EVENT_LOG_FAST_CAST_PAREN_ARGS(tag, pargs)
+#define EVENT_LOG_COMPACT_CAST_PAREN_ARGS(tag, pargs)
+
+#define EVENT_LOG_IS_LOG_ON(tag)       0
+
+#else  /* EVENT_LOG_COMPILE */
+
+/* The first few are special because they can be done more efficiently
+ * this way and they are the common case.  Once there are too many
+ * parameters the code size starts to be an issue and a loop is better
+ */
+#define _EVENT_LOG0(tag, fmt_num)                      \
+       event_log0(tag, fmt_num)
+#define _EVENT_LOG1(tag, fmt_num, t1)                  \
+       event_log1(tag, fmt_num, t1)
+#define _EVENT_LOG2(tag, fmt_num, t1, t2)              \
+       event_log2(tag, fmt_num, t1, t2)
+#define _EVENT_LOG3(tag, fmt_num, t1, t2, t3)          \
+       event_log3(tag, fmt_num, t1, t2, t3)
+#define _EVENT_LOG4(tag, fmt_num, t1, t2, t3, t4)      \
+       event_log4(tag, fmt_num, t1, t2, t3, t4)
+
+/* The rest call the generic routine that takes a count */
+#define _EVENT_LOG5(tag, fmt_num, ...) event_logn(5, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG6(tag, fmt_num, ...) event_logn(6, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG7(tag, fmt_num, ...) event_logn(7, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG8(tag, fmt_num, ...) event_logn(8, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG9(tag, fmt_num, ...) event_logn(9, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOGA(tag, fmt_num, ...) event_logn(10, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOGB(tag, fmt_num, ...) event_logn(11, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOGC(tag, fmt_num, ...) event_logn(12, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOGD(tag, fmt_num, ...) event_logn(13, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOGE(tag, fmt_num, ...) event_logn(14, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOGF(tag, fmt_num, ...) event_logn(15, tag, fmt_num, __VA_ARGS__)
+
+
+/* Casting  low level macros */
+#define _EVENT_LOG_CAST0(tag, fmt_num)                 \
+       event_log0(tag, fmt_num)
+#define _EVENT_LOG_CAST1(tag, fmt_num, t1)             \
+       event_log1(tag, fmt_num, (uint32)(t1))
+#define _EVENT_LOG_CAST2(tag, fmt_num, t1, t2)         \
+       event_log2(tag, fmt_num, (uint32)(t1), (uint32)(t2))
+#define _EVENT_LOG_CAST3(tag, fmt_num, t1, t2, t3)     \
+       event_log3(tag, fmt_num, (uint32)(t1), (uint32)(t2), (uint32)(t3))
+#define _EVENT_LOG_CAST4(tag, fmt_num, t1, t2, t3, t4) \
+       event_log4(tag, fmt_num, (uint32)(t1), (uint32)(t2), (uint32)(t3), (uint32)(t4))
+
+/* The rest call the generic routine that takes a count */
+#define _EVENT_LOG_CAST5(tag, fmt_num, ...) _EVENT_LOG5(tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG_CAST6(tag, fmt_num, ...) _EVENT_LOG6(tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG_CAST7(tag, fmt_num, ...) _EVENT_LOG7(tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG_CAST8(tag, fmt_num, ...) _EVENT_LOG8(tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG_CAST9(tag, fmt_num, ...) _EVENT_LOG9(tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG_CASTA(tag, fmt_num, ...) _EVENT_LOGA(tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG_CASTB(tag, fmt_num, ...) _EVENT_LOGB(tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG_CASTC(tag, fmt_num, ...) _EVENT_LOGC(tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG_CASTD(tag, fmt_num, ...) _EVENT_LOGD(tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG_CASTE(tag, fmt_num, ...) _EVENT_LOGE(tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG_CASTF(tag, fmt_num, ...) _EVENT_LOGF(tag, fmt_num, __VA_ARGS__)
+
+/* Hack to make the proper routine call when variadic macros get
+ * passed.  Note the max of 15 arguments.  More than that can't be
+ * handled by the event_log entries anyways so best to catch it at compile
+ * time
+ */
+
+#define _EVENT_LOG_VA_NUM_ARGS(F, _1, _2, _3, _4, _5, _6, _7, _8, _9,  \
+                              _A, _B, _C, _D, _E, _F, N, ...) F ## N
+
+/* cast = _EVENT_LOG for no casting
+ * cast = _EVENT_LOG_CAST for casting of fmt arguments to uint32.
+ *        Only first 4 arguments are casted to uint32. event_logn() is called
+ *        if more than 4 arguments are present. This function internally assumes
+ *        all arguments are uint32
+ */
+#define _EVENT_LOG(cast, tag, fmt, ...)                                        \
+       static char logstr[] __attribute__ ((section(".logstrs"))) = fmt; \
+       static uint32 fmtnum __attribute__ ((section(".lognums"))) = (uint32) &logstr; \
+       _EVENT_LOG_VA_NUM_ARGS(cast, ##__VA_ARGS__,                     \
+                              F, E, D, C, B, A, 9, 8,                  \
+                              7, 6, 5, 4, 3, 2, 1, 0)                  \
+       (tag, (int) &fmtnum , ## __VA_ARGS__)
+
+
+#define EVENT_LOG_FAST(tag, fmt, ...)                                  \
+       do {                                                            \
+               if (event_log_tag_sets != NULL) {                       \
+                       uint8 tag_flag = *(event_log_tag_sets + tag);   \
+                       if (tag_flag != 0) {                            \
+                               _EVENT_LOG(_EVENT_LOG, tag, fmt , ## __VA_ARGS__);      \
+                       }                                               \
+               }                                                       \
+       } while (0)
+
+#define EVENT_LOG_COMPACT(tag, fmt, ...)                               \
+       do {                                                            \
+               _EVENT_LOG(_EVENT_LOG, tag, fmt , ## __VA_ARGS__);      \
+       } while (0)
+
+/* Event log macro with casting to uint32 of arguments */
+#define EVENT_LOG_FAST_CAST(tag, fmt, ...)                             \
+       do {                                                            \
+               if (event_log_tag_sets != NULL) {                       \
+                       uint8 tag_flag = *(event_log_tag_sets + tag);   \
+                       if (tag_flag != 0) {                            \
+                               _EVENT_LOG(_EVENT_LOG_CAST, tag, fmt , ## __VA_ARGS__); \
+                       }                                               \
+               }                                                       \
+       } while (0)
+
+#define EVENT_LOG_COMPACT_CAST(tag, fmt, ...)                          \
+       do {                                                            \
+               _EVENT_LOG(_EVENT_LOG_CAST, tag, fmt , ## __VA_ARGS__); \
+       } while (0)
+
+
+#define EVENT_LOG(tag, fmt, ...) EVENT_LOG_COMPACT(tag, fmt , ## __VA_ARGS__)
+
+#define EVENT_LOG_CAST(tag, fmt, ...) EVENT_LOG_COMPACT_CAST(tag, fmt , ## __VA_ARGS__)
+
+#define _EVENT_LOG_REMOVE_PAREN(...) __VA_ARGS__
+#define EVENT_LOG_REMOVE_PAREN(args) _EVENT_LOG_REMOVE_PAREN args
+
+#define EVENT_LOG_CAST_PAREN_ARGS(tag, pargs)                          \
+               EVENT_LOG_CAST(tag, EVENT_LOG_REMOVE_PAREN(pargs))
+
+#define EVENT_LOG_FAST_CAST_PAREN_ARGS(tag, pargs)                     \
+               EVENT_LOG_FAST_CAST(tag, EVENT_LOG_REMOVE_PAREN(pargs))
+
+#define EVENT_LOG_COMPACT_CAST_PAREN_ARGS(tag, pargs)                  \
+               EVENT_LOG_COMPACT_CAST(tag, EVENT_LOG_REMOVE_PAREN(pargs))
+
+
+#define EVENT_LOG_IS_LOG_ON(tag) (*(event_log_tag_sets + (tag)) & EVENT_LOG_TAG_FLAG_LOG)
+
+#define EVENT_DUMP     event_log_buffer
+
+extern uint8 *event_log_tag_sets;
+
+#include <siutils.h>
+
+extern int event_log_init(si_t *sih);
+extern int event_log_set_init(si_t *sih, int set_num, int size);
+extern int event_log_set_expand(si_t *sih, int set_num, int size);
+extern int event_log_set_shrink(si_t *sih, int set_num, int size);
+extern int event_log_tag_start(int tag, int set_num, int flags);
+extern int event_log_tag_stop(int tag);
+extern int event_log_get(int set_num, int buflen, void *buf);
+extern uint8 * event_log_next_logtrace(int set_num);
+
+extern void event_log0(int tag, int fmtNum);
+extern void event_log1(int tag, int fmtNum, uint32 t1);
+extern void event_log2(int tag, int fmtNum, uint32 t1, uint32 t2);
+extern void event_log3(int tag, int fmtNum, uint32 t1, uint32 t2, uint32 t3);
+extern void event_log4(int tag, int fmtNum, uint32 t1, uint32 t2, uint32 t3, uint32 t4);
+extern void event_logn(int num_args, int tag, int fmtNum, ...);
+
+extern void event_log_time_sync(uint32 ms);
+extern void event_log_buffer(int tag, uint8 *buf, int size);
+
+#endif /* EVENT_LOG_DUMPER */
+
+#endif /* EVENT_LOG_COMPILE */
+
+#endif /* __ASSEMBLER__ */
+
+#endif /* _EVENT_LOG_H */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/hnd_armtrap.h b/drivers/net/wireless/bcmdhd_1363/include/hnd_armtrap.h
new file mode 100644 (file)
index 0000000..e9ee8ff
--- /dev/null
@@ -0,0 +1,92 @@
+/*
+ * HND arm trap handling.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: hnd_armtrap.h 514727 2014-11-12 03:02:48Z $
+ */
+
+#ifndef        _hnd_armtrap_h_
+#define        _hnd_armtrap_h_
+
+
+/* ARM trap handling */
+
+/* Trap types defined by ARM (see arminc.h) */
+
+/* Trap locations in lo memory */
+#define        TRAP_STRIDE     4
+#define FIRST_TRAP     TR_RST
+#define LAST_TRAP      (TR_FIQ * TRAP_STRIDE)
+
+#if defined(__ARM_ARCH_4T__)
+#define        MAX_TRAP_TYPE   (TR_FIQ + 1)
+#elif defined(__ARM_ARCH_7M__)
+#define        MAX_TRAP_TYPE   (TR_ISR + ARMCM3_NUMINTS)
+#endif /* __ARM_ARCH_7M__ */
+
+/* The trap structure is defined here as offsets for assembly */
+#define        TR_TYPE         0x00
+#define        TR_EPC          0x04
+#define        TR_CPSR         0x08
+#define        TR_SPSR         0x0c
+#define        TR_REGS         0x10
+#define        TR_REG(n)       (TR_REGS + (n) * 4)
+#define        TR_SP           TR_REG(13)
+#define        TR_LR           TR_REG(14)
+#define        TR_PC           TR_REG(15)
+
+#define        TRAP_T_SIZE     80
+#define ASSERT_TRAP_SVC_NUMBER 255
+
+#ifndef        _LANGUAGE_ASSEMBLY
+
+#include <typedefs.h>
+
+typedef struct _trap_struct {
+       uint32          type;
+       uint32          epc;
+       uint32          cpsr;
+       uint32          spsr;
+       uint32          r0;     /* a1 */
+       uint32          r1;     /* a2 */
+       uint32          r2;     /* a3 */
+       uint32          r3;     /* a4 */
+       uint32          r4;     /* v1 */
+       uint32          r5;     /* v2 */
+       uint32          r6;     /* v3 */
+       uint32          r7;     /* v4 */
+       uint32          r8;     /* v5 */
+       uint32          r9;     /* sb/v6 */
+       uint32          r10;    /* sl/v7 */
+       uint32          r11;    /* fp/v8 */
+       uint32          r12;    /* ip */
+       uint32          r13;    /* sp */
+       uint32          r14;    /* lr */
+       uint32          pc;     /* r15 */
+} trap_t;
+
+#endif /* !_LANGUAGE_ASSEMBLY */
+
+#endif /* _hnd_armtrap_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/hnd_cons.h b/drivers/net/wireless/bcmdhd_1363/include/hnd_cons.h
new file mode 100644 (file)
index 0000000..7b2b90a
--- /dev/null
@@ -0,0 +1,80 @@
+/*
+ * Console support for RTE - for host use only.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: hnd_cons.h 514727 2014-11-12 03:02:48Z $
+ */
+#ifndef        _hnd_cons_h_
+#define        _hnd_cons_h_
+
+#include <typedefs.h>
+#include <siutils.h>
+
+#define CBUF_LEN       (128)
+
+#define LOG_BUF_LEN    1024
+
+#ifdef BOOTLOADER_CONSOLE_OUTPUT
+#undef RWL_MAX_DATA_LEN
+#undef CBUF_LEN
+#undef LOG_BUF_LEN
+#define RWL_MAX_DATA_LEN (4 * 1024 + 8)
+#define CBUF_LEN       (RWL_MAX_DATA_LEN + 64)
+#define LOG_BUF_LEN (16 * 1024)
+#endif
+
+typedef struct {
+       uint32          buf;            /* Can't be pointer on (64-bit) hosts */
+       uint            buf_size;
+       uint            idx;
+       uint            out_idx;        /* output index */
+} hnd_log_t;
+
+typedef struct {
+       /* Virtual UART
+        *   When there is no UART (e.g. Quickturn), the host should write a complete
+        *   input line directly into cbuf and then write the length into vcons_in.
+        *   This may also be used when there is a real UART (at risk of conflicting with
+        *   the real UART).  vcons_out is currently unused.
+        */
+       volatile uint   vcons_in;
+       volatile uint   vcons_out;
+
+       /* Output (logging) buffer
+        *   Console output is written to a ring buffer log_buf at index log_idx.
+        *   The host may read the output when it sees log_idx advance.
+        *   Output will be lost if the output wraps around faster than the host polls.
+        */
+       hnd_log_t       log;
+
+       /* Console input line buffer
+        *   Characters are read one at a time into cbuf until <CR> is received, then
+        *   the buffer is processed as a command line.  Also used for virtual UART.
+        */
+       uint            cbuf_idx;
+       char            cbuf[CBUF_LEN];
+} hnd_cons_t;
+
+#endif /* _hnd_cons_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/hnd_pktpool.h b/drivers/net/wireless/bcmdhd_1363/include/hnd_pktpool.h
new file mode 100644 (file)
index 0000000..1b8c9be
--- /dev/null
@@ -0,0 +1,225 @@
+/*
+ * HND generic packet pool operation primitives
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: hnd_pktpool.h 591285 2015-10-07 11:56:29Z $
+ */
+
+#ifndef _hnd_pktpool_h_
+#define _hnd_pktpool_h_
+
+#include <osl_ext.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* mutex macros for thread safe */
+#ifdef HND_PKTPOOL_THREAD_SAFE
+#define HND_PKTPOOL_MUTEX_DECL(mutex)          OSL_EXT_MUTEX_DECL(mutex)
+#else
+#define HND_PKTPOOL_MUTEX_DECL(mutex)
+#endif
+
+#ifdef BCMPKTPOOL
+#define POOL_ENAB(pool)                ((pool) && (pool)->inited)
+#else /* BCMPKTPOOL */
+#define POOL_ENAB(bus)         0
+#endif /* BCMPKTPOOL */
+
+#ifndef PKTPOOL_LEN_MAX
+#define PKTPOOL_LEN_MAX                40
+#endif /* PKTPOOL_LEN_MAX */
+#define PKTPOOL_CB_MAX         3
+#define PKTPOOL_CB_MAX_AVL     4
+
+
+/* forward declaration */
+struct pktpool;
+
+typedef void (*pktpool_cb_t)(struct pktpool *pool, void *arg);
+typedef struct {
+       pktpool_cb_t cb;
+       void *arg;
+} pktpool_cbinfo_t;
+
+/** PCIe SPLITRX related: call back fn extension to populate host address in pool pkt */
+typedef int (*pktpool_cb_extn_t)(struct pktpool *pool, void *arg1, void* pkt, bool arg2);
+typedef struct {
+       pktpool_cb_extn_t cb;
+       void *arg;
+} pktpool_cbextn_info_t;
+
+
+#ifdef BCMDBG_POOL
+/* pkt pool debug states */
+#define POOL_IDLE      0
+#define POOL_RXFILL    1
+#define POOL_RXDH      2
+#define POOL_RXD11     3
+#define POOL_TXDH      4
+#define POOL_TXD11     5
+#define POOL_AMPDU     6
+#define POOL_TXENQ     7
+
+typedef struct {
+       void *p;
+       uint32 cycles;
+       uint32 dur;
+} pktpool_dbg_t;
+
+typedef struct {
+       uint8 txdh;     /* tx to host */
+       uint8 txd11;    /* tx to d11 */
+       uint8 enq;      /* waiting in q */
+       uint8 rxdh;     /* rx from host */
+       uint8 rxd11;    /* rx from d11 */
+       uint8 rxfill;   /* dma_rxfill */
+       uint8 idle;     /* avail in pool */
+} pktpool_stats_t;
+#endif /* BCMDBG_POOL */
+
+typedef struct pktpool {
+       bool inited;            /**< pktpool_init was successful */
+       uint8 type;             /**< type of lbuf: basic, frag, etc */
+       uint8 id;               /**< pktpool ID:  index in registry */
+       bool istx;              /**< direction: transmit or receive data path */
+       HND_PKTPOOL_MUTEX_DECL(mutex)   /**< thread-safe mutex */
+
+       void * freelist;        /**< free list: see PKTNEXTFREE(), PKTSETNEXTFREE() */
+       uint16 avail;           /**< number of packets in pool's free list */
+       uint16 len;             /**< number of packets managed by pool */
+       uint16 maxlen;          /**< maximum size of pool <= PKTPOOL_LEN_MAX */
+       uint16 plen;            /**< size of pkt buffer, excluding lbuf|lbuf_frag */
+
+       bool empty;
+       uint8 cbtoggle;
+       uint8 cbcnt;
+       uint8 ecbcnt;
+       uint8 emptycb_disable;  /**< Value of type enum pktpool_empty_cb_state */
+       pktpool_cbinfo_t *availcb_excl;
+       pktpool_cbinfo_t cbs[PKTPOOL_CB_MAX_AVL];
+       pktpool_cbinfo_t ecbs[PKTPOOL_CB_MAX];
+       pktpool_cbextn_info_t cbext;    /**< PCIe SPLITRX related */
+       pktpool_cbextn_info_t rxcplidfn;
+#ifdef BCMDBG_POOL
+       uint8 dbg_cbcnt;
+       pktpool_cbinfo_t dbg_cbs[PKTPOOL_CB_MAX];
+       uint16 dbg_qlen;
+       pktpool_dbg_t dbg_q[PKTPOOL_LEN_MAX + 1];
+#endif
+       pktpool_cbinfo_t dmarxfill;
+} pktpool_t;
+
+
+pktpool_t *get_pktpools_registry(int id);
+
+/* Incarnate a pktpool registry. On success returns total_pools. */
+extern int pktpool_attach(osl_t *osh, uint32 total_pools);
+extern int pktpool_dettach(osl_t *osh); /* Relinquish registry */
+
+extern int pktpool_init(osl_t *osh, pktpool_t *pktp, int *pktplen, int plen, bool istx, uint8 type);
+extern int pktpool_deinit(osl_t *osh, pktpool_t *pktp);
+extern int pktpool_fill(osl_t *osh, pktpool_t *pktp, bool minimal);
+extern void* pktpool_get(pktpool_t *pktp);
+extern void pktpool_free(pktpool_t *pktp, void *p);
+extern int pktpool_add(pktpool_t *pktp, void *p);
+extern int pktpool_avail_notify_normal(osl_t *osh, pktpool_t *pktp);
+extern int pktpool_avail_notify_exclusive(osl_t *osh, pktpool_t *pktp, pktpool_cb_t cb);
+extern int pktpool_avail_register(pktpool_t *pktp, pktpool_cb_t cb, void *arg);
+extern int pktpool_empty_register(pktpool_t *pktp, pktpool_cb_t cb, void *arg);
+extern int pktpool_setmaxlen(pktpool_t *pktp, uint16 maxlen);
+extern int pktpool_setmaxlen_strict(osl_t *osh, pktpool_t *pktp, uint16 maxlen);
+extern void pktpool_emptycb_disable(pktpool_t *pktp, bool disable);
+extern bool pktpool_emptycb_disabled(pktpool_t *pktp);
+extern int pktpool_hostaddr_fill_register(pktpool_t *pktp, pktpool_cb_extn_t cb, void *arg1);
+extern int pktpool_rxcplid_fill_register(pktpool_t *pktp, pktpool_cb_extn_t cb, void *arg);
+extern void pktpool_invoke_dmarxfill(pktpool_t *pktp);
+extern int pkpool_haddr_avail_register_cb(pktpool_t *pktp, pktpool_cb_t cb, void *arg);
+
+#define POOLPTR(pp)         ((pktpool_t *)(pp))
+#define POOLID(pp)          (POOLPTR(pp)->id)
+
+#define POOLSETID(pp, ppid) (POOLPTR(pp)->id = (ppid))
+
+#define pktpool_len(pp)     (POOLPTR(pp)->len)
+#define pktpool_avail(pp)   (POOLPTR(pp)->avail)
+#define pktpool_plen(pp)    (POOLPTR(pp)->plen)
+#define pktpool_maxlen(pp)  (POOLPTR(pp)->maxlen)
+
+
+/*
+ * ----------------------------------------------------------------------------
+ * A pool ID is assigned with a pkt pool during pool initialization. This is
+ * done by maintaining a registry of all initialized pools, and the registry
+ * index at which the pool is registered is used as the pool's unique ID.
+ * ID 0 is reserved and is used to signify an invalid pool ID.
+ * All packets henceforth allocated from a pool will be tagged with the pool's
+ * unique ID. Packets allocated from the heap will use the reserved ID = 0.
+ * Packets with non-zero pool id signify that they were allocated from a pool.
+ * A maximum of 15 pools are supported, allowing a 4bit pool ID to be used
+ * in place of a 32bit pool pointer in each packet.
+ * ----------------------------------------------------------------------------
+ */
+#define PKTPOOL_INVALID_ID          (0)
+#define PKTPOOL_MAXIMUM_ID          (15)
+
+/* Registry of pktpool(s) */
+/* Pool ID to/from Pool Pointer converters */
+#define PKTPOOL_ID2PTR(id)          (get_pktpools_registry(id))
+#define PKTPOOL_PTR2ID(pp)          (POOLID(pp))
+
+#ifdef BCMDBG_POOL
+extern int pktpool_dbg_register(pktpool_t *pktp, pktpool_cb_t cb, void *arg);
+extern int pktpool_start_trigger(pktpool_t *pktp, void *p);
+extern int pktpool_dbg_dump(pktpool_t *pktp);
+extern int pktpool_dbg_notify(pktpool_t *pktp);
+extern int pktpool_stats_dump(pktpool_t *pktp, pktpool_stats_t *stats);
+#endif /* BCMDBG_POOL */
+
+#ifdef BCMPKTPOOL
+#define SHARED_POOL            (pktpool_shared)
+extern pktpool_t *pktpool_shared;
+#ifdef BCMFRAGPOOL
+#define SHARED_FRAG_POOL       (pktpool_shared_lfrag)
+extern pktpool_t *pktpool_shared_lfrag;
+#endif
+
+/** PCIe SPLITRX related */
+#define SHARED_RXFRAG_POOL     (pktpool_shared_rxlfrag)
+extern pktpool_t *pktpool_shared_rxlfrag;
+
+void hnd_pktpool_init(osl_t *osh);
+void hnd_pktpool_fill(pktpool_t *pktpool, bool minimal);
+void hnd_pktpool_refill(bool minimal);
+#else /* BCMPKTPOOL */
+#define SHARED_POOL            ((struct pktpool *)NULL)
+#endif /* BCMPKTPOOL */
+
+#ifdef __cplusplus
+       }
+#endif
+
+#endif /* _hnd_pktpool_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/hnd_pktq.h b/drivers/net/wireless/bcmdhd_1363/include/hnd_pktq.h
new file mode 100644 (file)
index 0000000..82146f9
--- /dev/null
@@ -0,0 +1,214 @@
+/*
+ * HND generic pktq operation primitives
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: hnd_pktq.h 591283 2015-10-07 11:52:00Z $
+ */
+
+#ifndef _hnd_pktq_h_
+#define _hnd_pktq_h_
+
+#include <osl_ext.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* mutex macros for thread safe */
+#ifdef HND_PKTQ_THREAD_SAFE
+#define HND_PKTQ_MUTEX_DECL(mutex)             OSL_EXT_MUTEX_DECL(mutex)
+#else
+#define HND_PKTQ_MUTEX_DECL(mutex)
+#endif
+
+/* osl multi-precedence packet queue */
+#define PKTQ_LEN_MAX            0xFFFF  /* Max uint16 65535 packets */
+#ifndef PKTQ_LEN_DEFAULT
+#define PKTQ_LEN_DEFAULT        128    /* Max 128 packets */
+#endif
+#ifndef PKTQ_MAX_PREC
+#define PKTQ_MAX_PREC           16     /* Maximum precedence levels */
+#endif
+
+typedef struct pktq_prec {
+       void *head;     /**< first packet to dequeue */
+       void *tail;     /**< last packet to dequeue */
+       uint16 len;     /**< number of queued packets */
+       uint16 max;     /**< maximum number of queued packets */
+} pktq_prec_t;
+
+#ifdef PKTQ_LOG
+typedef struct {
+       uint32 requested;    /**< packets requested to be stored */
+       uint32 stored;       /**< packets stored */
+       uint32 saved;        /**< packets saved,
+                                   because a lowest priority queue has given away one packet
+                             */
+       uint32 selfsaved;    /**< packets saved,
+                                   because an older packet from the same queue has been dropped
+                             */
+       uint32 full_dropped; /**< packets dropped,
+                                   because pktq is full with higher precedence packets
+                             */
+       uint32 dropped;      /**< packets dropped because pktq per that precedence is full */
+       uint32 sacrificed;   /**< packets dropped,
+                                   in order to save one from a queue of a highest priority
+                             */
+       uint32 busy;         /**< packets droped because of hardware/transmission error */
+       uint32 retry;        /**< packets re-sent because they were not received */
+       uint32 ps_retry;     /**< packets retried again prior to moving power save mode */
+       uint32 suppress;     /**< packets which were suppressed and not transmitted */
+       uint32 retry_drop;   /**< packets finally dropped after retry limit */
+       uint32 max_avail;    /**< the high-water mark of the queue capacity for packets -
+                                   goes to zero as queue fills
+                             */
+       uint32 max_used;     /**< the high-water mark of the queue utilisation for packets -
+                                                       increases with use ('inverse' of max_avail)
+                                         */
+       uint32 queue_capacity; /**< the maximum capacity of the queue */
+       uint32 rtsfail;        /**< count of rts attempts that failed to receive cts */
+       uint32 acked;          /**< count of packets sent (acked) successfully */
+       uint32 txrate_succ;    /**< running total of phy rate of packets sent successfully */
+       uint32 txrate_main;    /**< running totoal of primary phy rate of all packets */
+       uint32 throughput;     /**< actual data transferred successfully */
+       uint32 airtime;        /**< cumulative total medium access delay in useconds */
+       uint32  _logtime;      /**< timestamp of last counter clear  */
+} pktq_counters_t;
+
+typedef struct {
+       uint32                  _prec_log;
+       pktq_counters_t*        _prec_cnt[PKTQ_MAX_PREC];     /**< Counters per queue  */
+} pktq_log_t;
+#endif /* PKTQ_LOG */
+
+
+#define PKTQ_COMMON    \
+       uint16 num_prec;        /**< number of precedences in use */                    \
+       uint16 hi_prec;         /**< rapid dequeue hint (>= highest non-empty prec) */  \
+       uint16 max;             /**< total max packets */                                       \
+       uint16 len;             /**< total number of packets */
+
+/* multi-priority pkt queue */
+struct pktq {
+       PKTQ_COMMON
+       /* q array must be last since # of elements can be either PKTQ_MAX_PREC or 1 */
+       struct pktq_prec q[PKTQ_MAX_PREC];
+       HND_PKTQ_MUTEX_DECL(mutex)
+#ifdef PKTQ_LOG
+       pktq_log_t*      pktqlog;
+#endif
+};
+
+/* simple, non-priority pkt queue */
+struct spktq {
+       PKTQ_COMMON
+       /* q array must be last since # of elements can be either PKTQ_MAX_PREC or 1 */
+       struct pktq_prec q[1];
+       HND_PKTQ_MUTEX_DECL(mutex)
+};
+
+#define PKTQ_PREC_ITER(pq, prec)        for (prec = (pq)->num_prec - 1; prec >= 0; prec--)
+
+/* fn(pkt, arg).  return true if pkt belongs to if */
+typedef bool (*ifpkt_cb_t)(void*, int);
+
+/* operations on a specific precedence in packet queue */
+
+#define pktq_psetmax(pq, prec, _max)   ((pq)->q[prec].max = (_max))
+#define pktq_pmax(pq, prec)            ((pq)->q[prec].max)
+#define pktq_plen(pq, prec)            ((pq)->q[prec].len)
+#define pktq_pempty(pq, prec)          ((pq)->q[prec].len == 0)
+#define pktq_ppeek(pq, prec)           ((pq)->q[prec].head)
+#define pktq_ppeek_tail(pq, prec)      ((pq)->q[prec].tail)
+#ifdef HND_PKTQ_THREAD_SAFE
+extern int pktq_pavail(struct pktq *pq, int prec);
+extern bool pktq_pfull(struct pktq *pq, int prec);
+#else
+#define pktq_pavail(pq, prec)  ((pq)->q[prec].max - (pq)->q[prec].len)
+#define pktq_pfull(pq, prec)   ((pq)->q[prec].len >= (pq)->q[prec].max)
+#endif /* HND_PKTQ_THREAD_SAFE */
+
+extern void  pktq_append(struct pktq *pq, int prec, struct spktq *list);
+extern void  pktq_prepend(struct pktq *pq, int prec, struct spktq *list);
+
+extern void *pktq_penq(struct pktq *pq, int prec, void *p);
+extern void *pktq_penq_head(struct pktq *pq, int prec, void *p);
+extern void *pktq_pdeq(struct pktq *pq, int prec);
+extern void *pktq_pdeq_prev(struct pktq *pq, int prec, void *prev_p);
+extern void *pktq_pdeq_with_fn(struct pktq *pq, int prec, ifpkt_cb_t fn, int arg);
+extern void *pktq_pdeq_tail(struct pktq *pq, int prec);
+/* Empty the queue at particular precedence level */
+extern void pktq_pflush(osl_t *osh, struct pktq *pq, int prec, bool dir,
+       ifpkt_cb_t fn, int arg);
+/* Remove a specified packet from its queue */
+extern bool pktq_pdel(struct pktq *pq, void *p, int prec);
+
+/* operations on a set of precedences in packet queue */
+
+extern int pktq_mlen(struct pktq *pq, uint prec_bmp);
+extern void *pktq_mdeq(struct pktq *pq, uint prec_bmp, int *prec_out);
+extern void *pktq_mpeek(struct pktq *pq, uint prec_bmp, int *prec_out);
+
+/* operations on packet queue as a whole */
+
+#define pktq_len(pq)           ((int)(pq)->len)
+#define pktq_max(pq)           ((int)(pq)->max)
+#define pktq_empty(pq)         ((pq)->len == 0)
+#ifdef HND_PKTQ_THREAD_SAFE
+extern int pktq_avail(struct pktq *pq);
+extern bool pktq_full(struct pktq *pq);
+#else
+#define pktq_avail(pq)         ((int)((pq)->max - (pq)->len))
+#define pktq_full(pq)          ((pq)->len >= (pq)->max)
+#endif /* HND_PKTQ_THREAD_SAFE */
+
+/* operations for single precedence queues */
+#define pktenq(pq, p)          pktq_penq(((struct pktq *)(void *)pq), 0, (p))
+#define pktenq_head(pq, p)     pktq_penq_head(((struct pktq *)(void *)pq), 0, (p))
+#define pktdeq(pq)             pktq_pdeq(((struct pktq *)(void *)pq), 0)
+#define pktdeq_tail(pq)                pktq_pdeq_tail(((struct pktq *)(void *)pq), 0)
+#define pktqflush(osh, pq)     pktq_flush(osh, ((struct pktq *)(void *)pq), TRUE, NULL, 0)
+#define pktqinit(pq, len)      pktq_init(((struct pktq *)(void *)pq), 1, len)
+#define pktqdeinit(pq)         pktq_deinit((struct pktq *)(void *)pq)
+#define pktqavail(pq)          pktq_avail((struct pktq *)(void *)pq)
+#define pktqfull(pq)           pktq_full((struct pktq *)(void *)pq)
+
+extern bool pktq_init(struct pktq *pq, int num_prec, int max_len);
+extern bool pktq_deinit(struct pktq *pq);
+
+extern void pktq_set_max_plen(struct pktq *pq, int prec, int max_len);
+
+/* prec_out may be NULL if caller is not interested in return value */
+extern void *pktq_deq(struct pktq *pq, int *prec_out);
+extern void *pktq_deq_tail(struct pktq *pq, int *prec_out);
+extern void *pktq_peek(struct pktq *pq, int *prec_out);
+extern void *pktq_peek_tail(struct pktq *pq, int *prec_out);
+extern void pktq_flush(osl_t *osh, struct pktq *pq, bool dir, ifpkt_cb_t fn, int arg);
+
+#ifdef __cplusplus
+       }
+#endif
+
+#endif /* _hnd_pktq_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/hndpmu.h b/drivers/net/wireless/bcmdhd_1363/include/hndpmu.h
new file mode 100644 (file)
index 0000000..d9c2774
--- /dev/null
@@ -0,0 +1,45 @@
+/*
+ * HND SiliconBackplane PMU support.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: hndpmu.h 530150 2015-01-29 08:43:40Z $
+ */
+
+#ifndef _hndpmu_h_
+#define _hndpmu_h_
+
+#include <typedefs.h>
+#include <osl_decl.h>
+#include <siutils.h>
+
+
+extern void si_pmu_otp_power(si_t *sih, osl_t *osh, bool on, uint32* min_res_mask);
+extern void si_sdiod_drive_strength_init(si_t *sih, osl_t *osh, uint32 drivestrength);
+
+extern void si_pmu_minresmask_htavail_set(si_t *sih, osl_t *osh, bool set_clear);
+extern void si_pmu_slow_clk_reinit(si_t *sih, osl_t *osh);
+extern void si_pmu_avbtimer_enable(si_t *sih, osl_t *osh, bool set_flag);
+
+#endif /* _hndpmu_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/hndsoc.h b/drivers/net/wireless/bcmdhd_1363/include/hndsoc.h
new file mode 100644 (file)
index 0000000..aa32105
--- /dev/null
@@ -0,0 +1,315 @@
+/*
+ * Broadcom HND chip & on-chip-interconnect-related definitions.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: hndsoc.h 517544 2014-11-26 00:40:42Z $
+ */
+
+#ifndef        _HNDSOC_H
+#define        _HNDSOC_H
+
+/* Include the soci specific files */
+#include <sbconfig.h>
+#include <aidmp.h>
+
+/*
+ * SOC Interconnect Address Map.
+ * All regions may not exist on all chips.
+ */
+#define SI_SDRAM_BASE          0x00000000      /* Physical SDRAM */
+#define SI_PCI_MEM             0x08000000      /* Host Mode sb2pcitranslation0 (64 MB) */
+#define SI_PCI_MEM_SZ          (64 * 1024 * 1024)
+#define SI_PCI_CFG             0x0c000000      /* Host Mode sb2pcitranslation1 (64 MB) */
+#define        SI_SDRAM_SWAPPED        0x10000000      /* Byteswapped Physical SDRAM */
+#define SI_SDRAM_R2            0x80000000      /* Region 2 for sdram (512 MB) */
+
+#define SI_ENUM_BASE           0x18000000      /* Enumeration space base */
+
+#define SI_WRAP_BASE           0x18100000      /* Wrapper space base */
+#define SI_CORE_SIZE           0x1000          /* each core gets 4Kbytes for registers */
+
+#ifndef SI_MAXCORES
+#define        SI_MAXCORES             32              /* NorthStar has more cores */
+#endif /* SI_MAXCORES */
+
+#define        SI_MAXBR                4               /* Max bridges (this is arbitrary, for software
+                                        * convenience and could be changed if we
+                                        * make any larger chips
+                                        */
+
+#define        SI_FASTRAM              0x19000000      /* On-chip RAM on chips that also have DDR */
+#define        SI_FASTRAM_SWAPPED      0x19800000
+
+#define        SI_FLASH2               0x1c000000      /* Flash Region 2 (region 1 shadowed here) */
+#define        SI_FLASH2_SZ            0x02000000      /* Size of Flash Region 2 */
+#define        SI_ARMCM3_ROM           0x1e000000      /* ARM Cortex-M3 ROM */
+#define        SI_FLASH1               0x1fc00000      /* MIPS Flash Region 1 */
+#define        SI_FLASH1_SZ            0x00400000      /* MIPS Size of Flash Region 1 */
+#define        SI_FLASH_WINDOW         0x01000000      /* Flash XIP Window */
+
+#define SI_NS_NANDFLASH                0x1c000000      /* NorthStar NAND flash base */
+#define SI_NS_NORFLASH         0x1e000000      /* NorthStar NOR flash base */
+#define SI_NS_ROM              0xfffd0000      /* NorthStar ROM */
+#define        SI_NS_FLASH_WINDOW      0x02000000      /* Flash XIP Window */
+
+#define        SI_ARM7S_ROM            0x20000000      /* ARM7TDMI-S ROM */
+#define        SI_ARMCR4_ROM           0x000f0000      /* ARM Cortex-R4 ROM */
+#define        SI_ARMCM3_SRAM2         0x60000000      /* ARM Cortex-M3 SRAM Region 2 */
+#define        SI_ARM7S_SRAM2          0x80000000      /* ARM7TDMI-S SRAM Region 2 */
+#define        SI_ARMCA7_ROM           0x00000000      /* ARM Cortex-A7 ROM */
+#define        SI_ARMCA7_RAM           0x00200000      /* ARM Cortex-A7 RAM */
+#define        SI_ARM_FLASH1           0xffff0000      /* ARM Flash Region 1 */
+#define        SI_ARM_FLASH1_SZ        0x00010000      /* ARM Size of Flash Region 1 */
+
+#define SI_SFLASH              0x14000000
+#define SI_PCI_DMA             0x40000000      /* Client Mode sb2pcitranslation2 (1 GB) */
+#define SI_PCI_DMA2            0x80000000      /* Client Mode sb2pcitranslation2 (1 GB) */
+#define SI_PCI_DMA_SZ          0x40000000      /* Client Mode sb2pcitranslation2 size in bytes */
+#define SI_PCIE_DMA_L32                0x00000000      /* PCIE Client Mode sb2pcitranslation2
+                                                * (2 ZettaBytes), low 32 bits
+                                                */
+#define SI_PCIE_DMA_H32                0x80000000      /* PCIE Client Mode sb2pcitranslation2
+                                                * (2 ZettaBytes), high 32 bits
+                                                */
+
+#define SI_BCM53573_NANDFLASH  0x30000000      /* 53573 NAND flash base */
+#define SI_BCM53573_NORFLASH   0x1c000000      /* 53573 NOR flash base */
+
+#define        SI_BCM53573_NORFLASH_WINDOW     0x01000000      /* only support 16M direct access for
+                                                        * 3-byte address modes in spi flash
+                                                        */
+#define        SI_BCM53573_BOOTDEV_MASK        0x3
+#define        SI_BCM53573_BOOTDEV_NOR         0x0
+
+#define        SI_BCM53573_DDRTYPE_MASK        0x10
+#define        SI_BCM53573_DDRTYPE_DDR3        0x10
+
+/* APB bridge code */
+#define        APB_BRIDGE_ID           0x135           /* APB Bridge 0, 1, etc. */
+
+/* core codes */
+#define        NODEV_CORE_ID           0x700           /* Invalid coreid */
+#define        CC_CORE_ID              0x800           /* chipcommon core */
+#define        ILINE20_CORE_ID         0x801           /* iline20 core */
+#define        SRAM_CORE_ID            0x802           /* sram core */
+#define        SDRAM_CORE_ID           0x803           /* sdram core */
+#define        PCI_CORE_ID             0x804           /* pci core */
+#define        MIPS_CORE_ID            0x805           /* mips core */
+#define        ENET_CORE_ID            0x806           /* enet mac core */
+#define        CODEC_CORE_ID           0x807           /* v90 codec core */
+#define        USB_CORE_ID             0x808           /* usb 1.1 host/device core */
+#define        ADSL_CORE_ID            0x809           /* ADSL core */
+#define        ILINE100_CORE_ID        0x80a           /* iline100 core */
+#define        IPSEC_CORE_ID           0x80b           /* ipsec core */
+#define        UTOPIA_CORE_ID          0x80c           /* utopia core */
+#define        PCMCIA_CORE_ID          0x80d           /* pcmcia core */
+#define        SOCRAM_CORE_ID          0x80e           /* internal memory core */
+#define        MEMC_CORE_ID            0x80f           /* memc sdram core */
+#define        OFDM_CORE_ID            0x810           /* OFDM phy core */
+#define        EXTIF_CORE_ID           0x811           /* external interface core */
+#define        D11_CORE_ID             0x812           /* 802.11 MAC core */
+#define        APHY_CORE_ID            0x813           /* 802.11a phy core */
+#define        BPHY_CORE_ID            0x814           /* 802.11b phy core */
+#define        GPHY_CORE_ID            0x815           /* 802.11g phy core */
+#define        MIPS33_CORE_ID          0x816           /* mips3302 core */
+#define        USB11H_CORE_ID          0x817           /* usb 1.1 host core */
+#define        USB11D_CORE_ID          0x818           /* usb 1.1 device core */
+#define        USB20H_CORE_ID          0x819           /* usb 2.0 host core */
+#define        USB20D_CORE_ID          0x81a           /* usb 2.0 device core */
+#define        SDIOH_CORE_ID           0x81b           /* sdio host core */
+#define        ROBO_CORE_ID            0x81c           /* roboswitch core */
+#define        ATA100_CORE_ID          0x81d           /* parallel ATA core */
+#define        SATAXOR_CORE_ID         0x81e           /* serial ATA & XOR DMA core */
+#define        GIGETH_CORE_ID          0x81f           /* gigabit ethernet core */
+#define        PCIE_CORE_ID            0x820           /* pci express core */
+#define        NPHY_CORE_ID            0x821           /* 802.11n 2x2 phy core */
+#define        SRAMC_CORE_ID           0x822           /* SRAM controller core */
+#define        MINIMAC_CORE_ID         0x823           /* MINI MAC/phy core */
+#define        ARM11_CORE_ID           0x824           /* ARM 1176 core */
+#define        ARM7S_CORE_ID           0x825           /* ARM7tdmi-s core */
+#define        LPPHY_CORE_ID           0x826           /* 802.11a/b/g phy core */
+#define        PMU_CORE_ID             0x827           /* PMU core */
+#define        SSNPHY_CORE_ID          0x828           /* 802.11n single-stream phy core */
+#define        SDIOD_CORE_ID           0x829           /* SDIO device core */
+#define        ARMCM3_CORE_ID          0x82a           /* ARM Cortex M3 core */
+#define        HTPHY_CORE_ID           0x82b           /* 802.11n 4x4 phy core */
+#define        MIPS74K_CORE_ID         0x82c           /* mips 74k core */
+#define        GMAC_CORE_ID            0x82d           /* Gigabit MAC core */
+#define        DMEMC_CORE_ID           0x82e           /* DDR1/2 memory controller core */
+#define        PCIERC_CORE_ID          0x82f           /* PCIE Root Complex core */
+#define        OCP_CORE_ID             0x830           /* OCP2OCP bridge core */
+#define        SC_CORE_ID              0x831           /* shared common core */
+#define        AHB_CORE_ID             0x832           /* OCP2AHB bridge core */
+#define        SPIH_CORE_ID            0x833           /* SPI host core */
+#define        I2S_CORE_ID             0x834           /* I2S core */
+#define        DMEMS_CORE_ID           0x835           /* SDR/DDR1 memory controller core */
+#define        DEF_SHIM_COMP           0x837           /* SHIM component in ubus/6362 */
+
+#define ACPHY_CORE_ID          0x83b           /* Dot11 ACPHY */
+#define PCIE2_CORE_ID          0x83c           /* pci express Gen2 core */
+#define USB30D_CORE_ID         0x83d           /* usb 3.0 device core */
+#define ARMCR4_CORE_ID         0x83e           /* ARM CR4 CPU */
+#define GCI_CORE_ID            0x840           /* GCI Core */
+#define M2MDMA_CORE_ID          0x844           /* memory to memory dma */
+#define CMEM_CORE_ID           0x846           /* CNDS DDR2/3 memory controller */
+#define ARMCA7_CORE_ID         0x847           /* ARM CA7 CPU */
+#define SYSMEM_CORE_ID         0x849           /* System memory core */
+#define APB_BRIDGE_CORE_ID     0x135           /* APB bridge core ID */
+#define AXI_CORE_ID            0x301           /* AXI/GPV core ID */
+#define EROM_CORE_ID           0x366           /* EROM core ID */
+#define OOB_ROUTER_CORE_ID     0x367           /* OOB router core ID */
+#define DEF_AI_COMP            0xfff           /* Default component, in ai chips it maps all
+                                                * unused address ranges
+                                                */
+
+#define CC_4706_CORE_ID                0x500           /* chipcommon core */
+#define NS_PCIEG2_CORE_ID      0x501           /* PCIE Gen 2 core */
+#define NS_DMA_CORE_ID         0x502           /* DMA core */
+#define NS_SDIO3_CORE_ID       0x503           /* SDIO3 core */
+#define NS_USB20_CORE_ID       0x504           /* USB2.0 core */
+#define NS_USB30_CORE_ID       0x505           /* USB3.0 core */
+#define NS_A9JTAG_CORE_ID      0x506           /* ARM Cortex A9 JTAG core */
+#define NS_DDR23_CORE_ID       0x507           /* Denali DDR2/DDR3 memory controller */
+#define NS_ROM_CORE_ID         0x508           /* ROM core */
+#define NS_NAND_CORE_ID                0x509           /* NAND flash controller core */
+#define NS_QSPI_CORE_ID                0x50a           /* SPI flash controller core */
+#define NS_CCB_CORE_ID         0x50b           /* ChipcommonB core */
+#define SOCRAM_4706_CORE_ID    0x50e           /* internal memory core */
+#define NS_SOCRAM_CORE_ID      SOCRAM_4706_CORE_ID
+#define        ARMCA9_CORE_ID          0x510           /* ARM Cortex A9 core (ihost) */
+#define        NS_IHOST_CORE_ID        ARMCA9_CORE_ID  /* ARM Cortex A9 core (ihost) */
+#define GMAC_COMMON_4706_CORE_ID       0x5dc           /* Gigabit MAC core */
+#define GMAC_4706_CORE_ID      0x52d           /* Gigabit MAC core */
+#define AMEMC_CORE_ID          0x52e           /* DDR1/2 memory controller core */
+#define ALTA_CORE_ID           0x534           /* I2S core */
+#define DDR23_PHY_CORE_ID      0x5dd
+
+#define SI_PCI1_MEM     0x40000000  /* Host Mode sb2pcitranslation0 (64 MB) */
+#define SI_PCI1_CFG     0x44000000  /* Host Mode sb2pcitranslation1 (64 MB) */
+#define SI_PCIE1_DMA_H32               0xc0000000      /* PCIE Client Mode sb2pcitranslation2
+                                                * (2 ZettaBytes), high 32 bits
+                                                */
+#define CC_4706B0_CORE_REV     0x8000001f              /* chipcommon core */
+#define SOCRAM_4706B0_CORE_REV 0x80000005              /* internal memory core */
+#define GMAC_4706B0_CORE_REV   0x80000000              /* Gigabit MAC core */
+#define NS_PCIEG2_CORE_REV_B0  0x7             /* NS-B0 PCIE Gen 2 core rev */
+
+/* There are TWO constants on all HND chips: SI_ENUM_BASE above,
+ * and chipcommon being the first core:
+ */
+#define        SI_CC_IDX               0
+/* SOC Interconnect types (aka chip types) */
+#define        SOCI_SB                 0
+#define        SOCI_AI                 1
+#define        SOCI_UBUS               2
+#define        SOCI_NAI                3
+
+/* Common core control flags */
+#define        SICF_BIST_EN            0x8000
+#define        SICF_PME_EN             0x4000
+#define        SICF_CORE_BITS          0x3ffc
+#define        SICF_FGC                0x0002
+#define        SICF_CLOCK_EN           0x0001
+
+/* Common core status flags */
+#define        SISF_BIST_DONE          0x8000
+#define        SISF_BIST_ERROR         0x4000
+#define        SISF_GATED_CLK          0x2000
+#define        SISF_DMA64              0x1000
+#define        SISF_CORE_BITS          0x0fff
+
+/* Norstar core status flags */
+#define SISF_NS_BOOTDEV_MASK   0x0003  /* ROM core */
+#define SISF_NS_BOOTDEV_NOR    0x0000  /* ROM core */
+#define SISF_NS_BOOTDEV_NAND   0x0001  /* ROM core */
+#define SISF_NS_BOOTDEV_ROM    0x0002  /* ROM core */
+#define SISF_NS_BOOTDEV_OFFLOAD        0x0003  /* ROM core */
+#define SISF_NS_SKUVEC_MASK    0x000c  /* ROM core */
+
+/* A register that is common to all cores to
+ * communicate w/PMU regarding clock control.
+ */
+#define SI_CLK_CTL_ST          0x1e0           /* clock control and status */
+#define SI_PWR_CTL_ST          0x1e8           /* For memory clock gating */
+
+/* clk_ctl_st register */
+#define        CCS_FORCEALP            0x00000001      /* force ALP request */
+#define        CCS_FORCEHT             0x00000002      /* force HT request */
+#define        CCS_FORCEILP            0x00000004      /* force ILP request */
+#define        CCS_ALPAREQ             0x00000008      /* ALP Avail Request */
+#define        CCS_HTAREQ              0x00000010      /* HT Avail Request */
+#define        CCS_FORCEHWREQOFF       0x00000020      /* Force HW Clock Request Off */
+#define CCS_HQCLKREQ           0x00000040      /* HQ Clock Required */
+#define CCS_USBCLKREQ          0x00000100      /* USB Clock Req */
+#define CCS_SECICLKREQ         0x00000100      /* SECI Clock Req */
+#define CCS_ARMFASTCLOCKREQ    0x00000100      /* ARM CR4/CA7 fast clock request */
+#define CCS_AVBCLKREQ          0x00000400      /* AVB Clock enable request */
+#define CCS_ERSRC_REQ_MASK     0x00000700      /* external resource requests */
+#define CCS_ERSRC_REQ_SHIFT    8
+#define        CCS_ALPAVAIL            0x00010000      /* ALP is available */
+#define        CCS_HTAVAIL             0x00020000      /* HT is available */
+#define CCS_BP_ON_APL          0x00040000      /* RO: Backplane is running on ALP clock */
+#define CCS_BP_ON_HT           0x00080000      /* RO: Backplane is running on HT clock */
+#define CCS_ARMFASTCLOCKSTATUS 0x01000000      /* Fast CPU clock is running */
+#define CCS_ERSRC_STS_MASK     0x07000000      /* external resource status */
+#define CCS_ERSRC_STS_SHIFT    24
+
+#define        CCS0_HTAVAIL            0x00010000      /* HT avail in chipc and pcmcia on 4328a0 */
+#define        CCS0_ALPAVAIL           0x00020000      /* ALP avail in chipc and pcmcia on 4328a0 */
+
+/* Not really related to SOC Interconnect, but a couple of software
+ * conventions for the use the flash space:
+ */
+
+/* Minumum amount of flash we support */
+#define FLASH_MIN              0x00020000      /* Minimum flash size */
+
+/* A boot/binary may have an embedded block that describes its size  */
+#define        BISZ_OFFSET             0x3e0           /* At this offset into the binary */
+#define        BISZ_MAGIC              0x4249535a      /* Marked with this value: 'BISZ' */
+#define        BISZ_MAGIC_IDX          0               /* Word 0: magic */
+#define        BISZ_TXTST_IDX          1               /*      1: text start */
+#define        BISZ_TXTEND_IDX         2               /*      2: text end */
+#define        BISZ_DATAST_IDX         3               /*      3: data start */
+#define        BISZ_DATAEND_IDX        4               /*      4: data end */
+#define        BISZ_BSSST_IDX          5               /*      5: bss start */
+#define        BISZ_BSSEND_IDX         6               /*      6: bss end */
+#define BISZ_SIZE              7               /* descriptor size in 32-bit integers */
+
+/* Boot/Kernel related defintion and functions */
+#define        SOC_BOOTDEV_ROM         0x00000001
+#define        SOC_BOOTDEV_PFLASH      0x00000002
+#define        SOC_BOOTDEV_SFLASH      0x00000004
+#define        SOC_BOOTDEV_NANDFLASH   0x00000008
+
+#define        SOC_KNLDEV_NORFLASH     0x00000002
+#define        SOC_KNLDEV_NANDFLASH    0x00000004
+
+#if !defined(_LANGUAGE_ASSEMBLY) && !defined(__ASSEMBLY__)
+int soc_boot_dev(void *sih);
+int soc_knl_dev(void *sih);
+#endif /* !defined(_LANGUAGE_ASSEMBLY) && !defined(__ASSEMBLY__) */
+
+#endif /* _HNDSOC_H */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/linux_osl.h b/drivers/net/wireless/bcmdhd_1363/include/linux_osl.h
new file mode 100644 (file)
index 0000000..cf95c53
--- /dev/null
@@ -0,0 +1,1088 @@
+/*
+ * Linux OS Independent Layer
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: linux_osl.h 601764 2015-11-24 03:47:41Z $
+ */
+
+#ifndef _linux_osl_h_
+#define _linux_osl_h_
+
+#include <typedefs.h>
+#define DECLSPEC_ALIGN(x)      __attribute__ ((aligned(x)))
+
+/* Linux Kernel: File Operations: start */
+extern void * osl_os_open_image(char * filename);
+extern int osl_os_get_image_block(char * buf, int len, void * image);
+extern void osl_os_close_image(void * image);
+extern int osl_os_image_size(void *image);
+/* Linux Kernel: File Operations: end */
+
+#ifdef BCMDRIVER
+
+/* OSL initialization */
+#ifdef SHARED_OSL_CMN
+extern osl_t *osl_attach(void *pdev, uint bustype, bool pkttag, void **osh_cmn);
+#else
+extern osl_t *osl_attach(void *pdev, uint bustype, bool pkttag);
+#endif /* SHARED_OSL_CMN */
+
+extern void osl_detach(osl_t *osh);
+extern int osl_static_mem_init(osl_t *osh, void *adapter);
+extern int osl_static_mem_deinit(osl_t *osh, void *adapter);
+extern void osl_set_bus_handle(osl_t *osh, void *bus_handle);
+extern void* osl_get_bus_handle(osl_t *osh);
+
+/* Global ASSERT type */
+extern uint32 g_assert_type;
+
+/* ASSERT */
+#if defined(BCMASSERT_LOG)
+       #define ASSERT(exp) \
+         do { if (!(exp)) osl_assert(#exp, __FILE__, __LINE__); } while (0)
+extern void osl_assert(const char *exp, const char *file, int line);
+#else
+       #ifdef __GNUC__
+               #define GCC_VERSION \
+                       (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__)
+               #if GCC_VERSION > 30100
+                       #define ASSERT(exp)     do {} while (0)
+               #else
+                       /* ASSERT could cause segmentation fault on GCC3.1, use empty instead */
+                       #define ASSERT(exp)
+               #endif /* GCC_VERSION > 30100 */
+       #endif /* __GNUC__ */
+#endif 
+
+/* bcm_prefetch_32B */
+static inline void bcm_prefetch_32B(const uint8 *addr, const int cachelines_32B)
+{
+}
+
+/* microsecond delay */
+#define        OSL_DELAY(usec)         osl_delay(usec)
+extern void osl_delay(uint usec);
+
+#define OSL_SLEEP(ms)                  osl_sleep(ms)
+extern void osl_sleep(uint ms);
+
+#define        OSL_PCMCIA_READ_ATTR(osh, offset, buf, size) \
+       osl_pcmcia_read_attr((osh), (offset), (buf), (size))
+#define        OSL_PCMCIA_WRITE_ATTR(osh, offset, buf, size) \
+       osl_pcmcia_write_attr((osh), (offset), (buf), (size))
+extern void osl_pcmcia_read_attr(osl_t *osh, uint offset, void *buf, int size);
+extern void osl_pcmcia_write_attr(osl_t *osh, uint offset, void *buf, int size);
+
+/* PCI configuration space access macros */
+#define        OSL_PCI_READ_CONFIG(osh, offset, size) \
+       osl_pci_read_config((osh), (offset), (size))
+#define        OSL_PCI_WRITE_CONFIG(osh, offset, size, val) \
+       osl_pci_write_config((osh), (offset), (size), (val))
+extern uint32 osl_pci_read_config(osl_t *osh, uint offset, uint size);
+extern void osl_pci_write_config(osl_t *osh, uint offset, uint size, uint val);
+
+/* PCI device bus # and slot # */
+#define OSL_PCI_BUS(osh)       osl_pci_bus(osh)
+#define OSL_PCI_SLOT(osh)      osl_pci_slot(osh)
+#define OSL_PCIE_DOMAIN(osh)   osl_pcie_domain(osh)
+#define OSL_PCIE_BUS(osh)      osl_pcie_bus(osh)
+extern uint osl_pci_bus(osl_t *osh);
+extern uint osl_pci_slot(osl_t *osh);
+extern uint osl_pcie_domain(osl_t *osh);
+extern uint osl_pcie_bus(osl_t *osh);
+extern struct pci_dev *osl_pci_device(osl_t *osh);
+
+#define OSL_ACP_COHERENCE              (1<<1L)
+
+/* Pkttag flag should be part of public information */
+typedef struct {
+       bool pkttag;
+       bool mmbus;             /**< Bus supports memory-mapped register accesses */
+       pktfree_cb_fn_t tx_fn;  /**< Callback function for PKTFREE */
+       void *tx_ctx;           /**< Context to the callback function */
+       void    *unused[3];
+} osl_pubinfo_t;
+
+extern void osl_flag_set(osl_t *osh, uint32 mask);
+extern bool osl_is_flag_set(osl_t *osh, uint32 mask);
+
+#define PKTFREESETCB(osh, _tx_fn, _tx_ctx)             \
+       do {                                            \
+          ((osl_pubinfo_t*)osh)->tx_fn = _tx_fn;       \
+          ((osl_pubinfo_t*)osh)->tx_ctx = _tx_ctx;     \
+       } while (0)
+
+
+/* host/bus architecture-specific byte swap */
+#define BUS_SWAP32(v)          (v)
+       #define MALLOC(osh, size)       osl_malloc((osh), (size))
+       #define MALLOCZ(osh, size)      osl_mallocz((osh), (size))
+       #define MFREE(osh, addr, size)  osl_mfree((osh), (addr), (size))
+       #define MALLOCED(osh)           osl_malloced((osh))
+       #define MEMORY_LEFTOVER(osh) osl_check_memleak(osh)
+       extern void *osl_malloc(osl_t *osh, uint size);
+       extern void *osl_mallocz(osl_t *osh, uint size);
+       extern void osl_mfree(osl_t *osh, void *addr, uint size);
+       extern uint osl_malloced(osl_t *osh);
+       extern uint osl_check_memleak(osl_t *osh);
+
+
+#define        MALLOC_FAILED(osh)      osl_malloc_failed((osh))
+extern uint osl_malloc_failed(osl_t *osh);
+
+/* allocate/free shared (dma-able) consistent memory */
+#define        DMA_CONSISTENT_ALIGN    osl_dma_consistent_align()
+#define        DMA_ALLOC_CONSISTENT(osh, size, align, tot, pap, dmah) \
+       osl_dma_alloc_consistent((osh), (size), (align), (tot), (pap))
+#define        DMA_FREE_CONSISTENT(osh, va, size, pa, dmah) \
+       osl_dma_free_consistent((osh), (void*)(va), (size), (pa))
+
+#define        DMA_ALLOC_CONSISTENT_FORCE32(osh, size, align, tot, pap, dmah) \
+       osl_dma_alloc_consistent((osh), (size), (align), (tot), (pap))
+#define        DMA_FREE_CONSISTENT_FORCE32(osh, va, size, pa, dmah) \
+       osl_dma_free_consistent((osh), (void*)(va), (size), (pa))
+
+extern uint osl_dma_consistent_align(void);
+extern void *osl_dma_alloc_consistent(osl_t *osh, uint size, uint16 align,
+       uint *tot, dmaaddr_t *pap);
+extern void osl_dma_free_consistent(osl_t *osh, void *va, uint size, dmaaddr_t pa);
+
+/* map/unmap direction */
+#define        DMA_TX  1       /* TX direction for DMA */
+#define        DMA_RX  2       /* RX direction for DMA */
+
+/* map/unmap shared (dma-able) memory */
+#define        DMA_UNMAP(osh, pa, size, direction, p, dmah) \
+       osl_dma_unmap((osh), (pa), (size), (direction))
+extern dmaaddr_t osl_dma_map(osl_t *osh, void *va, uint size, int direction, void *p,
+       hnddma_seg_map_t *txp_dmah);
+extern void osl_dma_unmap(osl_t *osh, dmaaddr_t pa, uint size, int direction);
+
+/* API for DMA addressing capability */
+#define OSL_DMADDRWIDTH(osh, addrwidth) ({BCM_REFERENCE(osh); BCM_REFERENCE(addrwidth);})
+
+#define OSL_SMP_WMB()  smp_wmb()
+
+/* API for CPU relax */
+extern void osl_cpu_relax(void);
+#define OSL_CPU_RELAX() osl_cpu_relax()
+
+#if (!defined(DHD_USE_COHERENT_MEM_FOR_RING) && defined(__ARM_ARCH_7A__)) || \
+       (defined(STBLINUX) && defined(__ARM_ARCH_7A__)) || (defined(CONFIG_ARCH_MSM8996) || \
+       defined(CONFIG_SOC_EXYNOS8890))
+       extern void osl_cache_flush(void *va, uint size);
+       extern void osl_cache_inv(void *va, uint size);
+       extern void osl_prefetch(const void *ptr);
+       #define OSL_CACHE_FLUSH(va, len)        osl_cache_flush((void *) va, len)
+       #define OSL_CACHE_INV(va, len)          osl_cache_inv((void *) va, len)
+       #define OSL_PREFETCH(ptr)                       osl_prefetch(ptr)
+#ifdef __ARM_ARCH_7A__
+       extern int osl_arch_is_coherent(void);
+       #define OSL_ARCH_IS_COHERENT()          osl_arch_is_coherent()
+       extern int osl_acp_war_enab(void);
+       #define OSL_ACP_WAR_ENAB()                      osl_acp_war_enab()
+#else
+       #define OSL_ARCH_IS_COHERENT()          NULL
+       #define OSL_ACP_WAR_ENAB()                      NULL
+#endif /* __ARM_ARCH_7A__ */
+#else
+       #define OSL_CACHE_FLUSH(va, len)        BCM_REFERENCE(va)
+       #define OSL_CACHE_INV(va, len)          BCM_REFERENCE(va)
+       #define OSL_PREFETCH(ptr)               BCM_REFERENCE(ptr)
+
+       #define OSL_ARCH_IS_COHERENT()          NULL
+       #define OSL_ACP_WAR_ENAB()                      NULL
+#endif 
+
+/* register access macros */
+#if defined(BCMSDIO)
+       #include <bcmsdh.h>
+       #define OSL_WRITE_REG(osh, r, v) (bcmsdh_reg_write(osl_get_bus_handle(osh), \
+               (uintptr)(r), sizeof(*(r)), (v)))
+       #define OSL_READ_REG(osh, r) (bcmsdh_reg_read(osl_get_bus_handle(osh), \
+               (uintptr)(r), sizeof(*(r))))
+#endif 
+
+#if defined(BCMSDIO)
+       #define SELECT_BUS_WRITE(osh, mmap_op, bus_op) if (((osl_pubinfo_t*)(osh))->mmbus) \
+               mmap_op else bus_op
+       #define SELECT_BUS_READ(osh, mmap_op, bus_op) (((osl_pubinfo_t*)(osh))->mmbus) ? \
+               mmap_op : bus_op
+#else
+       #define SELECT_BUS_WRITE(osh, mmap_op, bus_op) ({BCM_REFERENCE(osh); mmap_op;})
+       #define SELECT_BUS_READ(osh, mmap_op, bus_op) ({BCM_REFERENCE(osh); mmap_op;})
+#endif 
+
+#define OSL_ERROR(bcmerror)    osl_error(bcmerror)
+extern int osl_error(int bcmerror);
+
+/* the largest reasonable packet buffer driver uses for ethernet MTU in bytes */
+#define        PKTBUFSZ        2048   /* largest reasonable packet buffer, driver uses for ethernet MTU */
+
+#define OSH_NULL   NULL
+
+/*
+ * BINOSL selects the slightly slower function-call-based binary compatible osl.
+ * Macros expand to calls to functions defined in linux_osl.c .
+ */
+#include <linuxver.h>           /* use current 2.4.x calling conventions */
+#include <linux/kernel.h>       /* for vsn/printf's */
+#include <linux/string.h>       /* for mem*, str* */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 4, 29)
+#define OSL_SYSUPTIME()                ((uint32)jiffies_to_msecs(jiffies))
+#else
+#define OSL_SYSUPTIME()                ((uint32)jiffies * (1000 / HZ))
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 4, 29) */
+#define        printf(fmt, args...)    printk(fmt , ## args)
+#include <linux/kernel.h>      /* for vsn/printf's */
+#include <linux/string.h>      /* for mem*, str* */
+/* bcopy's: Linux kernel doesn't provide these (anymore) */
+#define        bcopy(src, dst, len)    memcpy((dst), (src), (len))
+#define        bcmp(b1, b2, len)       memcmp((b1), (b2), (len))
+#define        bzero(b, len)           memset((b), '\0', (len))
+
+/* register access macros */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 1)) && defined(CONFIG_64BIT) && \
+       defined(CONFIG_X86)
+#define R_REG(osh, r) (\
+       SELECT_BUS_READ(osh, \
+               ({ \
+                       __typeof(*(r)) __osl_v; \
+                       switch (sizeof(*(r))) { \
+                               case sizeof(uint8):     __osl_v = \
+                                       readb((volatile uint8*)(r)); break; \
+                               case sizeof(uint16):    __osl_v = \
+                                       readw((volatile uint16*)(r)); break; \
+                               case sizeof(uint32):    __osl_v = \
+                                       readl((volatile uint32*)(r)); break; \
+                               case sizeof(uint64):    __osl_v = \
+                                       readq((volatile uint64*)(r)); break;  \
+                       } \
+                       __osl_v; \
+               }), \
+               OSL_READ_REG(osh, r)) \
+)
+#else
+#define R_REG(osh, r) (\
+       SELECT_BUS_READ(osh, \
+               ({ \
+                       __typeof(*(r)) __osl_v; \
+                       switch (sizeof(*(r))) { \
+                               case sizeof(uint8):     __osl_v = \
+                                       readb((volatile uint8*)(r)); break; \
+                               case sizeof(uint16):    __osl_v = \
+                                       readw((volatile uint16*)(r)); break; \
+                               case sizeof(uint32):    __osl_v = \
+                                       readl((volatile uint32*)(r)); break; \
+                       } \
+                       __osl_v; \
+               }), \
+               OSL_READ_REG(osh, r)) \
+)
+#endif /* KERNEL_VERSION(3, 11, 1)) && defined(CONFIG_64BIT) && defined(CONFIG_X86) */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 1)) && defined(CONFIG_64BIT) && \
+       defined(CONFIG_X86)
+#define W_REG(osh, r, v) do { \
+       SELECT_BUS_WRITE(osh, \
+               switch (sizeof(*(r))) { \
+                       case sizeof(uint8):     writeb((uint8)(v), (volatile uint8*)(r)); break; \
+                       case sizeof(uint16):    writew((uint16)(v), (volatile uint16*)(r)); break; \
+                       case sizeof(uint32):    writel((uint32)(v), (volatile uint32*)(r)); break; \
+                       case sizeof(uint64):    writeq((uint64)(v), (volatile uint64*)(r)); break; \
+               }, \
+               (OSL_WRITE_REG(osh, r, v))); \
+       } while (0)
+#else
+#define W_REG(osh, r, v) do { \
+       SELECT_BUS_WRITE(osh, \
+               switch (sizeof(*(r))) { \
+                       case sizeof(uint8):     writeb((uint8)(v), (volatile uint8*)(r)); break; \
+                       case sizeof(uint16):    writew((uint16)(v), (volatile uint16*)(r)); break; \
+                       case sizeof(uint32):    writel((uint32)(v), (volatile uint32*)(r)); break; \
+               }, \
+               (OSL_WRITE_REG(osh, r, v))); \
+       } while (0)
+#endif  /* KERNEL_VERSION(3, 11, 1)) && defined(CONFIG_64BIT) && defined(CONFIG_X86) */
+
+#define        AND_REG(osh, r, v)              W_REG(osh, (r), R_REG(osh, r) & (v))
+#define        OR_REG(osh, r, v)               W_REG(osh, (r), R_REG(osh, r) | (v))
+
+/* bcopy, bcmp, and bzero functions */
+#define        bcopy(src, dst, len)    memcpy((dst), (src), (len))
+#define        bcmp(b1, b2, len)       memcmp((b1), (b2), (len))
+#define        bzero(b, len)           memset((b), '\0', (len))
+
+/* uncached/cached virtual address */
+#define OSL_UNCACHED(va)       ((void *)va)
+#define OSL_CACHED(va)         ((void *)va)
+
+#define OSL_PREF_RANGE_LD(va, sz) BCM_REFERENCE(va)
+#define OSL_PREF_RANGE_ST(va, sz) BCM_REFERENCE(va)
+
+/* get processor cycle count */
+#if defined(__i386__)
+#define        OSL_GETCYCLES(x)        rdtscl((x))
+#else
+#define OSL_GETCYCLES(x)       ((x) = 0)
+#endif 
+
+/* dereference an address that may cause a bus exception */
+#define        BUSPROBE(val, addr)     ({ (val) = R_REG(NULL, (addr)); 0; })
+
+/* map/unmap physical to virtual I/O */
+#if !defined(CONFIG_MMC_MSM7X00A)
+#define        REG_MAP(pa, size)       ioremap_nocache((unsigned long)(pa), (unsigned long)(size))
+#else
+#define REG_MAP(pa, size)       (void *)(0)
+#endif /* !defined(CONFIG_MMC_MSM7X00A */
+#define        REG_UNMAP(va)           iounmap((va))
+
+/* shared (dma-able) memory access macros */
+#define        R_SM(r)                 *(r)
+#define        W_SM(r, v)              (*(r) = (v))
+#define        BZERO_SM(r, len)        memset((r), '\0', (len))
+
+/* Because the non BINOSL implemenation of the PKT OSL routines are macros (for
+ * performance reasons),  we need the Linux headers.
+ */
+#include <linuxver.h>          /* use current 2.4.x calling conventions */
+
+/* packet primitives */
+#ifdef BCMDBG_CTRACE
+#define        PKTGET(osh, len, send)          osl_pktget((osh), (len), __LINE__, __FILE__)
+#define        PKTDUP(osh, skb)                osl_pktdup((osh), (skb), __LINE__, __FILE__)
+#else
+#ifdef BCM_OBJECT_TRACE
+#define        PKTGET(osh, len, send)          osl_pktget((osh), (len), __LINE__, __FUNCTION__)
+#define        PKTDUP(osh, skb)                osl_pktdup((osh), (skb), __LINE__, __FUNCTION__)
+#else
+#define        PKTGET(osh, len, send)          osl_pktget((osh), (len))
+#define        PKTDUP(osh, skb)                osl_pktdup((osh), (skb))
+#endif /* BCM_OBJECT_TRACE */
+#endif /* BCMDBG_CTRACE */
+#define PKTLIST_DUMP(osh, buf)         BCM_REFERENCE(osh)
+#define PKTDBG_TRACE(osh, pkt, bit)    BCM_REFERENCE(osh)
+#if defined(BCM_OBJECT_TRACE)
+#define        PKTFREE(osh, skb, send)         osl_pktfree((osh), (skb), (send), __LINE__, __FUNCTION__)
+#else
+#define        PKTFREE(osh, skb, send)         osl_pktfree((osh), (skb), (send))
+#endif /* BCM_OBJECT_TRACE */
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+#define        PKTGET_STATIC(osh, len, send)           osl_pktget_static((osh), (len))
+#define        PKTFREE_STATIC(osh, skb, send)          osl_pktfree_static((osh), (skb), (send))
+#else
+#define        PKTGET_STATIC   PKTGET
+#define        PKTFREE_STATIC  PKTFREE
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+#define        PKTDATA(osh, skb)               ({BCM_REFERENCE(osh); (((struct sk_buff*)(skb))->data);})
+#define        PKTLEN(osh, skb)                ({BCM_REFERENCE(osh); (((struct sk_buff*)(skb))->len);})
+#define PKTHEADROOM(osh, skb)          (PKTDATA(osh, skb)-(((struct sk_buff*)(skb))->head))
+#define PKTEXPHEADROOM(osh, skb, b)    \
+       ({ \
+        BCM_REFERENCE(osh); \
+        skb_realloc_headroom((struct sk_buff*)(skb), (b)); \
+        })
+#define PKTTAILROOM(osh, skb)          \
+       ({ \
+        BCM_REFERENCE(osh); \
+        skb_tailroom((struct sk_buff*)(skb)); \
+        })
+#define PKTPADTAILROOM(osh, skb, padlen) \
+       ({ \
+        BCM_REFERENCE(osh); \
+        skb_pad((struct sk_buff*)(skb), (padlen)); \
+        })
+#define        PKTNEXT(osh, skb)               ({BCM_REFERENCE(osh); (((struct sk_buff*)(skb))->next);})
+#define        PKTSETNEXT(osh, skb, x)         \
+       ({ \
+        BCM_REFERENCE(osh); \
+        (((struct sk_buff*)(skb))->next = (struct sk_buff*)(x)); \
+        })
+#define        PKTSETLEN(osh, skb, len)        \
+       ({ \
+        BCM_REFERENCE(osh); \
+        __skb_trim((struct sk_buff*)(skb), (len)); \
+        })
+#define        PKTPUSH(osh, skb, bytes)        \
+       ({ \
+        BCM_REFERENCE(osh); \
+        skb_push((struct sk_buff*)(skb), (bytes)); \
+        })
+#define        PKTPULL(osh, skb, bytes)        \
+       ({ \
+        BCM_REFERENCE(osh); \
+        skb_pull((struct sk_buff*)(skb), (bytes)); \
+        })
+#define        PKTTAG(skb)                     ((void*)(((struct sk_buff*)(skb))->cb))
+#define PKTSETPOOL(osh, skb, x, y)     BCM_REFERENCE(osh)
+#define        PKTPOOL(osh, skb)               ({BCM_REFERENCE(osh); BCM_REFERENCE(skb); FALSE;})
+#define PKTFREELIST(skb)        PKTLINK(skb)
+#define PKTSETFREELIST(skb, x)  PKTSETLINK((skb), (x))
+#define PKTPTR(skb)             (skb)
+#define PKTID(skb)              ({BCM_REFERENCE(skb); 0;})
+#define PKTSETID(skb, id)       ({BCM_REFERENCE(skb); BCM_REFERENCE(id);})
+#define PKTSHRINK(osh, m)              ({BCM_REFERENCE(osh); m;})
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0)) && defined(TSQ_MULTIPLIER)
+#define PKTORPHAN(skb)          osl_pkt_orphan_partial(skb)
+extern void osl_pkt_orphan_partial(struct sk_buff *skb);
+#else
+#define PKTORPHAN(skb)          ({BCM_REFERENCE(skb); 0;})
+#endif /* LINUX VERSION >= 3.6 */
+
+
+#ifdef BCMDBG_CTRACE
+#define        DEL_CTRACE(zosh, zskb) { \
+       unsigned long zflags; \
+       spin_lock_irqsave(&(zosh)->ctrace_lock, zflags); \
+       list_del(&(zskb)->ctrace_list); \
+       (zosh)->ctrace_num--; \
+       (zskb)->ctrace_start = 0; \
+       (zskb)->ctrace_count = 0; \
+       spin_unlock_irqrestore(&(zosh)->ctrace_lock, zflags); \
+}
+
+#define        UPDATE_CTRACE(zskb, zfile, zline) { \
+       struct sk_buff *_zskb = (struct sk_buff *)(zskb); \
+       if (_zskb->ctrace_count < CTRACE_NUM) { \
+               _zskb->func[_zskb->ctrace_count] = zfile; \
+               _zskb->line[_zskb->ctrace_count] = zline; \
+               _zskb->ctrace_count++; \
+       } \
+       else { \
+               _zskb->func[_zskb->ctrace_start] = zfile; \
+               _zskb->line[_zskb->ctrace_start] = zline; \
+               _zskb->ctrace_start++; \
+               if (_zskb->ctrace_start >= CTRACE_NUM) \
+                       _zskb->ctrace_start = 0; \
+       } \
+}
+
+#define        ADD_CTRACE(zosh, zskb, zfile, zline) { \
+       unsigned long zflags; \
+       spin_lock_irqsave(&(zosh)->ctrace_lock, zflags); \
+       list_add(&(zskb)->ctrace_list, &(zosh)->ctrace_list); \
+       (zosh)->ctrace_num++; \
+       UPDATE_CTRACE(zskb, zfile, zline); \
+       spin_unlock_irqrestore(&(zosh)->ctrace_lock, zflags); \
+}
+
+#define PKTCALLER(zskb)        UPDATE_CTRACE((struct sk_buff *)zskb, (char *)__FUNCTION__, __LINE__)
+#endif /* BCMDBG_CTRACE */
+
+#ifdef CTFPOOL
+#define        CTFPOOL_REFILL_THRESH   3
+typedef struct ctfpool {
+       void            *head;
+       spinlock_t      lock;
+       uint            max_obj;
+       uint            curr_obj;
+       uint            obj_size;
+       uint            refills;
+       uint            fast_allocs;
+       uint            fast_frees;
+       uint            slow_allocs;
+} ctfpool_t;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
+#define        FASTBUF (1 << 0)
+#define        PKTSETFAST(osh, skb)    \
+       ({ \
+        BCM_REFERENCE(osh); \
+        ((((struct sk_buff*)(skb))->pktc_flags) |= FASTBUF); \
+        })
+#define        PKTCLRFAST(osh, skb)    \
+       ({ \
+        BCM_REFERENCE(osh); \
+        ((((struct sk_buff*)(skb))->pktc_flags) &= (~FASTBUF)); \
+        })
+#define        PKTISFAST(osh, skb)     \
+       ({ \
+        BCM_REFERENCE(osh); \
+        ((((struct sk_buff*)(skb))->pktc_flags) & FASTBUF); \
+        })
+#define        PKTFAST(osh, skb)       (((struct sk_buff*)(skb))->pktc_flags)
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 22)
+#define        FASTBUF (1 << 16)
+#define        PKTSETFAST(osh, skb)    \
+       ({ \
+        BCM_REFERENCE(osh); \
+        ((((struct sk_buff*)(skb))->mac_len) |= FASTBUF); \
+        })
+#define        PKTCLRFAST(osh, skb)    \
+       ({ \
+        BCM_REFERENCE(osh); \
+        ((((struct sk_buff*)(skb))->mac_len) &= (~FASTBUF)); \
+        })
+#define        PKTISFAST(osh, skb)     \
+       ({ \
+        BCM_REFERENCE(osh); \
+        ((((struct sk_buff*)(skb))->mac_len) & FASTBUF); \
+        })
+#define        PKTFAST(osh, skb)       (((struct sk_buff*)(skb))->mac_len)
+#else
+#define        FASTBUF (1 << 0)
+#define        PKTSETFAST(osh, skb)    \
+       ({ \
+        BCM_REFERENCE(osh); \
+        ((((struct sk_buff*)(skb))->__unused) |= FASTBUF); \
+        })
+#define        PKTCLRFAST(osh, skb)    \
+       ({ \
+        BCM_REFERENCE(osh); \
+        ((((struct sk_buff*)(skb))->__unused) &= (~FASTBUF)); \
+        })
+#define        PKTISFAST(osh, skb)     \
+       ({ \
+        BCM_REFERENCE(osh); \
+        ((((struct sk_buff*)(skb))->__unused) & FASTBUF); \
+        })
+#define        PKTFAST(osh, skb)       (((struct sk_buff*)(skb))->__unused)
+#endif /* 2.6.22 */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 22)
+#define        CTFPOOLPTR(osh, skb)    (((struct sk_buff*)(skb))->ctfpool)
+#define        CTFPOOLHEAD(osh, skb)   (((ctfpool_t *)((struct sk_buff*)(skb))->ctfpool)->head)
+#else
+#define        CTFPOOLPTR(osh, skb)    (((struct sk_buff*)(skb))->sk)
+#define        CTFPOOLHEAD(osh, skb)   (((ctfpool_t *)((struct sk_buff*)(skb))->sk)->head)
+#endif
+
+extern void *osl_ctfpool_add(osl_t *osh);
+extern void osl_ctfpool_replenish(osl_t *osh, uint thresh);
+extern int32 osl_ctfpool_init(osl_t *osh, uint numobj, uint size);
+extern void osl_ctfpool_cleanup(osl_t *osh);
+extern void osl_ctfpool_stats(osl_t *osh, void *b);
+#else /* CTFPOOL */
+#define        PKTSETFAST(osh, skb)    ({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define        PKTCLRFAST(osh, skb)    ({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define        PKTISFAST(osh, skb)     ({BCM_REFERENCE(osh); BCM_REFERENCE(skb); FALSE;})
+#endif /* CTFPOOL */
+
+#define        PKTSETCTF(osh, skb)     ({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define        PKTCLRCTF(osh, skb)     ({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define        PKTISCTF(osh, skb)      ({BCM_REFERENCE(osh); BCM_REFERENCE(skb); FALSE;})
+
+#ifdef HNDCTF
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
+#define        SKIPCT  (1 << 2)
+#define        CHAINED (1 << 3)
+#define        PKTSETSKIPCT(osh, skb)  \
+       ({ \
+        BCM_REFERENCE(osh); \
+        (((struct sk_buff*)(skb))->pktc_flags |= SKIPCT); \
+        })
+#define        PKTCLRSKIPCT(osh, skb)  \
+       ({ \
+        BCM_REFERENCE(osh); \
+        (((struct sk_buff*)(skb))->pktc_flags &= (~SKIPCT)); \
+        })
+#define        PKTSKIPCT(osh, skb)     \
+       ({ \
+        BCM_REFERENCE(osh); \
+        (((struct sk_buff*)(skb))->pktc_flags & SKIPCT); \
+        })
+#define        PKTSETCHAINED(osh, skb) \
+       ({ \
+        BCM_REFERENCE(osh); \
+        (((struct sk_buff*)(skb))->pktc_flags |= CHAINED); \
+        })
+#define        PKTCLRCHAINED(osh, skb) \
+       ({ \
+        BCM_REFERENCE(osh); \
+        (((struct sk_buff*)(skb))->pktc_flags &= (~CHAINED)); \
+        })
+#define        PKTISCHAINED(skb)       (((struct sk_buff*)(skb))->pktc_flags & CHAINED)
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 22)
+#define        SKIPCT  (1 << 18)
+#define        CHAINED (1 << 19)
+#define        PKTSETSKIPCT(osh, skb)  \
+       ({ \
+        BCM_REFERENCE(osh); \
+        (((struct sk_buff*)(skb))->mac_len |= SKIPCT); \
+        })
+#define        PKTCLRSKIPCT(osh, skb)  \
+       ({ \
+        BCM_REFERENCE(osh); \
+        (((struct sk_buff*)(skb))->mac_len &= (~SKIPCT)); \
+        })
+#define        PKTSKIPCT(osh, skb)     \
+       ({ \
+        BCM_REFERENCE(osh); \
+        (((struct sk_buff*)(skb))->mac_len & SKIPCT); \
+        })
+#define        PKTSETCHAINED(osh, skb) \
+       ({ \
+        BCM_REFERENCE(osh); \
+        (((struct sk_buff*)(skb))->mac_len |= CHAINED); \
+        })
+#define        PKTCLRCHAINED(osh, skb) \
+       ({ \
+        BCM_REFERENCE(osh); \
+        (((struct sk_buff*)(skb))->mac_len &= (~CHAINED)); \
+        })
+#define        PKTISCHAINED(skb)       (((struct sk_buff*)(skb))->mac_len & CHAINED)
+#else /* 2.6.22 */
+#define        SKIPCT  (1 << 2)
+#define        CHAINED (1 << 3)
+#define        PKTSETSKIPCT(osh, skb)  \
+       ({ \
+        BCM_REFERENCE(osh); \
+        (((struct sk_buff*)(skb))->__unused |= SKIPCT); \
+        })
+#define        PKTCLRSKIPCT(osh, skb)  \
+       ({ \
+        BCM_REFERENCE(osh); \
+        (((struct sk_buff*)(skb))->__unused &= (~SKIPCT)); \
+        })
+#define        PKTSKIPCT(osh, skb)     \
+       ({ \
+        BCM_REFERENCE(osh); \
+        (((struct sk_buff*)(skb))->__unused & SKIPCT); \
+        })
+#define        PKTSETCHAINED(osh, skb) \
+       ({ \
+        BCM_REFERENCE(osh); \
+        (((struct sk_buff*)(skb))->__unused |= CHAINED); \
+        })
+#define        PKTCLRCHAINED(osh, skb) \
+       ({ \
+        BCM_REFERENCE(osh); \
+        (((struct sk_buff*)(skb))->__unused &= (~CHAINED)); \
+        })
+#define        PKTISCHAINED(skb)       (((struct sk_buff*)(skb))->__unused & CHAINED)
+#endif /* 2.6.22 */
+typedef struct ctf_mark {
+       uint32  value;
+}      ctf_mark_t;
+#define CTF_MARK(m)                            (m.value)
+#else /* HNDCTF */
+#define        PKTSETSKIPCT(osh, skb)  ({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define        PKTCLRSKIPCT(osh, skb)  ({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define        PKTSKIPCT(osh, skb)     ({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define CTF_MARK(m)            ({BCM_REFERENCE(m); 0;})
+#endif /* HNDCTF */
+
+#if defined(BCM_GMAC3)
+
+/** pktalloced accounting in devices using GMAC Bulk Forwarding to DHD */
+
+/* Account for packets delivered to downstream forwarder by GMAC interface. */
+extern void osl_pkt_tofwder(osl_t *osh, void *skbs, int skb_cnt);
+#define PKTTOFWDER(osh, skbs, skb_cnt)  \
+       osl_pkt_tofwder(((osl_t *)osh), (void *)(skbs), (skb_cnt))
+
+/* Account for packets received from downstream forwarder. */
+#if defined(BCMDBG_CTRACE) /* pkt logging */
+extern void osl_pkt_frmfwder(osl_t *osh, void *skbs, int skb_cnt,
+                             int line, char *file);
+#define PKTFRMFWDER(osh, skbs, skb_cnt) \
+       osl_pkt_frmfwder(((osl_t *)osh), (void *)(skbs), (skb_cnt), \
+                        __LINE__, __FILE__)
+#else  /* ! (BCMDBG_PKT || BCMDBG_CTRACE) */
+extern void osl_pkt_frmfwder(osl_t *osh, void *skbs, int skb_cnt);
+#define PKTFRMFWDER(osh, skbs, skb_cnt) \
+       osl_pkt_frmfwder(((osl_t *)osh), (void *)(skbs), (skb_cnt))
+#endif 
+
+
+/** GMAC Forwarded packet tagging for reduced cache flush/invalidate.
+ * In FWDERBUF tagged packet, only FWDER_PKTMAPSZ amount of data would have
+ * been accessed in the GMAC forwarder. This may be used to limit the number of
+ * cachelines that need to be flushed or invalidated.
+ * Packets sent to the DHD from a GMAC forwarder will be tagged w/ FWDERBUF.
+ * DHD may clear the FWDERBUF tag, if more than FWDER_PKTMAPSZ was accessed.
+ * Likewise, a debug print of a packet payload in say the ethernet driver needs
+ * to be accompanied with a clear of the FWDERBUF tag.
+ */
+
+/** Forwarded packets, have a HWRXOFF sized rx header (etc.h) */
+#define FWDER_HWRXOFF       (30)
+
+/** Maximum amount of a pktadat that a downstream forwarder (GMAC) may have
+ * read into the L1 cache (not dirty). This may be used in reduced cache ops.
+ *
+ * Max 56: ET HWRXOFF[30] + BRCMHdr[4] + EtherHdr[14] + VlanHdr[4] + IP[4]
+ */
+#define FWDER_PKTMAPSZ      (FWDER_HWRXOFF + 4 + 14 + 4 + 4)
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
+
+#define FWDERBUF            (1 << 4)
+#define PKTSETFWDERBUF(osh, skb) \
+       ({ \
+        BCM_REFERENCE(osh); \
+        (((struct sk_buff*)(skb))->pktc_flags |= FWDERBUF); \
+        })
+#define PKTCLRFWDERBUF(osh, skb) \
+       ({ \
+        BCM_REFERENCE(osh); \
+        (((struct sk_buff*)(skb))->pktc_flags &= (~FWDERBUF)); \
+        })
+#define PKTISFWDERBUF(osh, skb) \
+       ({ \
+        BCM_REFERENCE(osh); \
+        (((struct sk_buff*)(skb))->pktc_flags & FWDERBUF); \
+        })
+
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 22)
+
+#define FWDERBUF               (1 << 20)
+#define PKTSETFWDERBUF(osh, skb) \
+       ({ \
+        BCM_REFERENCE(osh); \
+        (((struct sk_buff*)(skb))->mac_len |= FWDERBUF); \
+        })
+#define PKTCLRFWDERBUF(osh, skb)  \
+       ({ \
+        BCM_REFERENCE(osh); \
+        (((struct sk_buff*)(skb))->mac_len &= (~FWDERBUF)); \
+        })
+#define PKTISFWDERBUF(osh, skb) \
+       ({ \
+        BCM_REFERENCE(osh); \
+        (((struct sk_buff*)(skb))->mac_len & FWDERBUF); \
+        })
+
+#else /* 2.6.22 */
+
+#define FWDERBUF            (1 << 4)
+#define PKTSETFWDERBUF(osh, skb)  \
+       ({ \
+        BCM_REFERENCE(osh); \
+        (((struct sk_buff*)(skb))->__unused |= FWDERBUF); \
+        })
+#define PKTCLRFWDERBUF(osh, skb)  \
+       ({ \
+        BCM_REFERENCE(osh); \
+        (((struct sk_buff*)(skb))->__unused &= (~FWDERBUF)); \
+        })
+#define PKTISFWDERBUF(osh, skb) \
+       ({ \
+        BCM_REFERENCE(osh); \
+        (((struct sk_buff*)(skb))->__unused & FWDERBUF); \
+        })
+
+#endif /* 2.6.22 */
+
+#else  /* ! BCM_GMAC3 */
+
+#define PKTSETFWDERBUF(osh, skb)  ({ BCM_REFERENCE(osh); BCM_REFERENCE(skb); })
+#define PKTCLRFWDERBUF(osh, skb)  ({ BCM_REFERENCE(osh); BCM_REFERENCE(skb); })
+#define PKTISFWDERBUF(osh, skb)   ({ BCM_REFERENCE(osh); BCM_REFERENCE(skb); FALSE;})
+
+#endif /* ! BCM_GMAC3 */
+
+
+#ifdef HNDCTF
+/* For broadstream iqos */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
+#define        TOBR            (1 << 5)
+#define        PKTSETTOBR(osh, skb)    \
+       ({ \
+        BCM_REFERENCE(osh); \
+        (((struct sk_buff*)(skb))->pktc_flags |= TOBR); \
+        })
+#define        PKTCLRTOBR(osh, skb)    \
+       ({ \
+        BCM_REFERENCE(osh); \
+        (((struct sk_buff*)(skb))->pktc_flags &= (~TOBR)); \
+        })
+#define        PKTISTOBR(skb)  (((struct sk_buff*)(skb))->pktc_flags & TOBR)
+#define        PKTSETCTFIPCTXIF(skb, ifp)      (((struct sk_buff*)(skb))->ctf_ipc_txif = ifp)
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 22)
+#define        PKTSETTOBR(osh, skb)    ({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define        PKTCLRTOBR(osh, skb)    ({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define        PKTISTOBR(skb)  ({BCM_REFERENCE(skb); FALSE;})
+#define        PKTSETCTFIPCTXIF(skb, ifp)      ({BCM_REFERENCE(skb); BCM_REFERENCE(ifp);})
+#else /* 2.6.22 */
+#define        PKTSETTOBR(osh, skb)    ({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define        PKTCLRTOBR(osh, skb)    ({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define        PKTISTOBR(skb)  ({BCM_REFERENCE(skb); FALSE;})
+#define        PKTSETCTFIPCTXIF(skb, ifp)      ({BCM_REFERENCE(skb); BCM_REFERENCE(ifp);})
+#endif /* 2.6.22 */
+#else /* HNDCTF */
+#define        PKTSETTOBR(osh, skb)    ({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define        PKTCLRTOBR(osh, skb)    ({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define        PKTISTOBR(skb)  ({BCM_REFERENCE(skb); FALSE;})
+#endif /* HNDCTF */
+
+
+#ifdef BCMFA
+#ifdef BCMFA_HW_HASH
+#define PKTSETFAHIDX(skb, idx) (((struct sk_buff*)(skb))->napt_idx = idx)
+#else
+#define PKTSETFAHIDX(skb, idx) ({BCM_REFERENCE(skb); BCM_REFERENCE(idx);})
+#endif /* BCMFA_SW_HASH */
+#define PKTGETFAHIDX(skb)      (((struct sk_buff*)(skb))->napt_idx)
+#define PKTSETFADEV(skb, imp)  (((struct sk_buff*)(skb))->dev = imp)
+#define PKTSETRXDEV(skb)       (((struct sk_buff*)(skb))->rxdev = ((struct sk_buff*)(skb))->dev)
+
+#define        AUX_TCP_FIN_RST (1 << 0)
+#define        AUX_FREED       (1 << 1)
+#define PKTSETFAAUX(skb)       (((struct sk_buff*)(skb))->napt_flags |= AUX_TCP_FIN_RST)
+#define        PKTCLRFAAUX(skb)        (((struct sk_buff*)(skb))->napt_flags &= (~AUX_TCP_FIN_RST))
+#define        PKTISFAAUX(skb)         (((struct sk_buff*)(skb))->napt_flags & AUX_TCP_FIN_RST)
+#define PKTSETFAFREED(skb)     (((struct sk_buff*)(skb))->napt_flags |= AUX_FREED)
+#define        PKTCLRFAFREED(skb)      (((struct sk_buff*)(skb))->napt_flags &= (~AUX_FREED))
+#define        PKTISFAFREED(skb)       (((struct sk_buff*)(skb))->napt_flags & AUX_FREED)
+#define        PKTISFABRIDGED(skb)     PKTISFAAUX(skb)
+#else
+#define        PKTISFAAUX(skb)         ({BCM_REFERENCE(skb); FALSE;})
+#define        PKTISFABRIDGED(skb)     ({BCM_REFERENCE(skb); FALSE;})
+#define        PKTISFAFREED(skb)       ({BCM_REFERENCE(skb); FALSE;})
+
+#define        PKTCLRFAAUX(skb)        BCM_REFERENCE(skb)
+#define PKTSETFAFREED(skb)     BCM_REFERENCE(skb)
+#define        PKTCLRFAFREED(skb)      BCM_REFERENCE(skb)
+#endif /* BCMFA */
+
+#if defined(BCM_OBJECT_TRACE)
+extern void osl_pktfree(osl_t *osh, void *skb, bool send, int line, const char *caller);
+#else
+extern void osl_pktfree(osl_t *osh, void *skb, bool send);
+#endif /* BCM_OBJECT_TRACE */
+extern void *osl_pktget_static(osl_t *osh, uint len);
+extern void osl_pktfree_static(osl_t *osh, void *skb, bool send);
+extern void osl_pktclone(osl_t *osh, void **pkt);
+
+#ifdef BCMDBG_CTRACE
+#define PKT_CTRACE_DUMP(osh, b)        osl_ctrace_dump((osh), (b))
+extern void *osl_pktget(osl_t *osh, uint len, int line, char *file);
+extern void *osl_pkt_frmnative(osl_t *osh, void *skb, int line, char *file);
+extern int osl_pkt_is_frmnative(osl_t *osh, struct sk_buff *pkt);
+extern void *osl_pktdup(osl_t *osh, void *skb, int line, char *file);
+struct bcmstrbuf;
+extern void osl_ctrace_dump(osl_t *osh, struct bcmstrbuf *b);
+#else
+#ifdef BCM_OBJECT_TRACE
+extern void *osl_pktget(osl_t *osh, uint len, int line, const char *caller);
+extern void *osl_pktdup(osl_t *osh, void *skb, int line, const char *caller);
+#else
+extern void *osl_pktget(osl_t *osh, uint len);
+extern void *osl_pktdup(osl_t *osh, void *skb);
+#endif /* BCM_OBJECT_TRACE */
+extern void *osl_pkt_frmnative(osl_t *osh, void *skb);
+#endif /* BCMDBG_CTRACE */
+extern struct sk_buff *osl_pkt_tonative(osl_t *osh, void *pkt);
+#ifdef BCMDBG_CTRACE
+#define PKTFRMNATIVE(osh, skb)  osl_pkt_frmnative(((osl_t *)osh), \
+                               (struct sk_buff*)(skb), __LINE__, __FILE__)
+#define        PKTISFRMNATIVE(osh, skb) osl_pkt_is_frmnative((osl_t *)(osh), (struct sk_buff *)(skb))
+#else
+#define PKTFRMNATIVE(osh, skb) osl_pkt_frmnative(((osl_t *)osh), (struct sk_buff*)(skb))
+#endif /* BCMDBG_CTRACE */
+#define PKTTONATIVE(osh, pkt)          osl_pkt_tonative((osl_t *)(osh), (pkt))
+
+#define        PKTLINK(skb)                    (((struct sk_buff*)(skb))->prev)
+#define        PKTSETLINK(skb, x)              (((struct sk_buff*)(skb))->prev = (struct sk_buff*)(x))
+#define        PKTPRIO(skb)                    (((struct sk_buff*)(skb))->priority)
+#define        PKTSETPRIO(skb, x)              (((struct sk_buff*)(skb))->priority = (x))
+#define PKTSUMNEEDED(skb)              (((struct sk_buff*)(skb))->ip_summed == CHECKSUM_HW)
+#define PKTSETSUMGOOD(skb, x)          (((struct sk_buff*)(skb))->ip_summed = \
+                                               ((x) ? CHECKSUM_UNNECESSARY : CHECKSUM_NONE))
+/* PKTSETSUMNEEDED and PKTSUMGOOD are not possible because skb->ip_summed is overloaded */
+#define PKTSHARED(skb)                  (((struct sk_buff*)(skb))->cloned)
+
+#ifdef CONFIG_NF_CONNTRACK_MARK
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+#define PKTMARK(p)                     (((struct sk_buff *)(p))->mark)
+#define PKTSETMARK(p, m)               ((struct sk_buff *)(p))->mark = (m)
+#else /* !2.6.0 */
+#define PKTMARK(p)                     (((struct sk_buff *)(p))->nfmark)
+#define PKTSETMARK(p, m)               ((struct sk_buff *)(p))->nfmark = (m)
+#endif /* 2.6.0 */
+#else /* CONFIG_NF_CONNTRACK_MARK */
+#define PKTMARK(p)                     0
+#define PKTSETMARK(p, m)
+#endif /* CONFIG_NF_CONNTRACK_MARK */
+
+#define PKTALLOCED(osh)                osl_pktalloced(osh)
+extern uint osl_pktalloced(osl_t *osh);
+
+#define OSL_RAND()             osl_rand()
+extern uint32 osl_rand(void);
+
+#define        DMA_MAP(osh, va, size, direction, p, dmah) \
+       osl_dma_map((osh), (va), (size), (direction), (p), (dmah))
+
+#ifdef PKTC
+/* Use 8 bytes of skb tstamp field to store below info */
+struct chain_node {
+       struct sk_buff  *link;
+       unsigned int    flags:3, pkts:9, bytes:20;
+};
+
+#define CHAIN_NODE(skb)                ((struct chain_node*)(((struct sk_buff*)skb)->pktc_cb))
+
+#define        PKTCSETATTR(s, f, p, b) ({CHAIN_NODE(s)->flags = (f); CHAIN_NODE(s)->pkts = (p); \
+                                CHAIN_NODE(s)->bytes = (b);})
+#define        PKTCCLRATTR(s)          ({CHAIN_NODE(s)->flags = CHAIN_NODE(s)->pkts = \
+                                CHAIN_NODE(s)->bytes = 0;})
+#define        PKTCGETATTR(s)          (CHAIN_NODE(s)->flags << 29 | CHAIN_NODE(s)->pkts << 20 | \
+                                CHAIN_NODE(s)->bytes)
+#define        PKTCCNT(skb)            (CHAIN_NODE(skb)->pkts)
+#define        PKTCLEN(skb)            (CHAIN_NODE(skb)->bytes)
+#define        PKTCGETFLAGS(skb)       (CHAIN_NODE(skb)->flags)
+#define        PKTCSETFLAGS(skb, f)    (CHAIN_NODE(skb)->flags = (f))
+#define        PKTCCLRFLAGS(skb)       (CHAIN_NODE(skb)->flags = 0)
+#define        PKTCFLAGS(skb)          (CHAIN_NODE(skb)->flags)
+#define        PKTCSETCNT(skb, c)      (CHAIN_NODE(skb)->pkts = (c))
+#define        PKTCINCRCNT(skb)        (CHAIN_NODE(skb)->pkts++)
+#define        PKTCADDCNT(skb, c)      (CHAIN_NODE(skb)->pkts += (c))
+#define        PKTCSETLEN(skb, l)      (CHAIN_NODE(skb)->bytes = (l))
+#define        PKTCADDLEN(skb, l)      (CHAIN_NODE(skb)->bytes += (l))
+#define        PKTCSETFLAG(skb, fb)    (CHAIN_NODE(skb)->flags |= (fb))
+#define        PKTCCLRFLAG(skb, fb)    (CHAIN_NODE(skb)->flags &= ~(fb))
+#define        PKTCLINK(skb)           (CHAIN_NODE(skb)->link)
+#define        PKTSETCLINK(skb, x)     (CHAIN_NODE(skb)->link = (struct sk_buff*)(x))
+#define FOREACH_CHAINED_PKT(skb, nskb) \
+       for (; (skb) != NULL; (skb) = (nskb)) \
+               if ((nskb) = (PKTISCHAINED(skb) ? PKTCLINK(skb) : NULL), \
+                   PKTSETCLINK((skb), NULL), 1)
+#define        PKTCFREE(osh, skb, send) \
+do { \
+       void *nskb; \
+       ASSERT((skb) != NULL); \
+       FOREACH_CHAINED_PKT((skb), nskb) { \
+               PKTCLRCHAINED((osh), (skb)); \
+               PKTCCLRFLAGS((skb)); \
+               PKTFREE((osh), (skb), (send)); \
+       } \
+} while (0)
+#define PKTCENQTAIL(h, t, p) \
+do { \
+       if ((t) == NULL) { \
+               (h) = (t) = (p); \
+       } else { \
+               PKTSETCLINK((t), (p)); \
+               (t) = (p); \
+       } \
+} while (0)
+#endif /* PKTC */
+
+#else /* ! BCMDRIVER */
+
+
+/* ASSERT */
+       #define ASSERT(exp)     do {} while (0)
+
+/* MALLOC and MFREE */
+#define MALLOC(o, l) malloc(l)
+#define MFREE(o, p, l) free(p)
+#include <stdlib.h>
+
+/* str* and mem* functions */
+#include <string.h>
+
+/* *printf functions */
+#include <stdio.h>
+
+/* bcopy, bcmp, and bzero */
+extern void bcopy(const void *src, void *dst, size_t len);
+extern int bcmp(const void *b1, const void *b2, size_t len);
+extern void bzero(void *b, size_t len);
+#endif /* ! BCMDRIVER */
+
+typedef struct sec_cma_info {
+       struct sec_mem_elem *sec_alloc_list;
+       struct sec_mem_elem *sec_alloc_list_tail;
+} sec_cma_info_t;
+
+/* Current STB 7445D1 doesn't use ACP and it is non-coherrent.
+ * Adding these dummy values for build apss only
+ * When we revisit need to change these.
+ */
+#if defined(STBLINUX)
+
+#if defined(__ARM_ARCH_7A__)
+#define ACP_WAR_ENAB() 0
+#define ACP_WIN_LIMIT 1
+#define arch_is_coherent() 0
+#endif /* __ARM_ARCH_7A__ */
+
+#endif /* STBLINUX */
+
+#ifdef BCM_SECURE_DMA
+
+#define        SECURE_DMA_MAP(osh, va, size, direction, p, dmah, pcma, offset) \
+       osl_sec_dma_map((osh), (va), (size), (direction), (p), (dmah), (pcma), (offset))
+#define        SECURE_DMA_DD_MAP(osh, va, size, direction, p, dmah) \
+       osl_sec_dma_dd_map((osh), (va), (size), (direction), (p), (dmah))
+#define        SECURE_DMA_MAP_TXMETA(osh, va, size, direction, p, dmah, pcma) \
+       osl_sec_dma_map_txmeta((osh), (va), (size), (direction), (p), (dmah), (pcma))
+#define        SECURE_DMA_UNMAP(osh, pa, size, direction, p, dmah, pcma, offset) \
+       osl_sec_dma_unmap((osh), (pa), (size), (direction), (p), (dmah), (pcma), (offset))
+#define        SECURE_DMA_UNMAP_ALL(osh, pcma) \
+       osl_sec_dma_unmap_all((osh), (pcma))
+#if defined(__ARM_ARCH_7A__)
+#define CMA_BUFSIZE_4K 4096
+#define CMA_BUFSIZE_2K 2048
+#define CMA_BUFSIZE_512        512
+
+#define        CMA_BUFNUM              2048
+#define SEC_CMA_COHERENT_BLK 0x8000 /* 32768 */
+#define SEC_CMA_COHERENT_MAX 32
+#define CMA_DMA_DESC_MEMBLOCK  (SEC_CMA_COHERENT_BLK * SEC_CMA_COHERENT_MAX)
+#define CMA_DMA_DATA_MEMBLOCK  (CMA_BUFSIZE_4K*CMA_BUFNUM)
+#define        CMA_MEMBLOCK            (CMA_DMA_DESC_MEMBLOCK + CMA_DMA_DATA_MEMBLOCK)
+#define CONT_ARMREGION 0x02            /* Region CMA */
+#else
+#define CONT_MIPREGION 0x00            /* To access the MIPs mem, Not yet... */
+#endif /* !defined __ARM_ARCH_7A__ */
+
+#define SEC_DMA_ALIGN  (1<<16)
+typedef struct sec_mem_elem {
+       size_t                  size;
+       int                             direction;
+       phys_addr_t             pa_cma;     /**< physical  address */
+       void                    *va;        /**< virtual address of driver pkt */
+       dma_addr_t              dma_handle; /**< bus address assign by linux */
+       void                    *vac;       /**< virtual address of cma buffer */
+       struct  sec_mem_elem    *next;
+} sec_mem_elem_t;
+
+extern dma_addr_t osl_sec_dma_map(osl_t *osh, void *va, uint size, int direction, void *p,
+       hnddma_seg_map_t *dmah, void *ptr_cma_info, uint offset);
+extern dma_addr_t osl_sec_dma_dd_map(osl_t *osh, void *va, uint size, int direction, void *p,
+       hnddma_seg_map_t *dmah);
+extern dma_addr_t osl_sec_dma_map_txmeta(osl_t *osh, void *va, uint size,
+  int direction, void *p, hnddma_seg_map_t *dmah, void *ptr_cma_info);
+extern void osl_sec_dma_unmap(osl_t *osh, dma_addr_t dma_handle, uint size, int direction,
+       void *p, hnddma_seg_map_t *map, void *ptr_cma_info, uint offset);
+extern void osl_sec_dma_unmap_all(osl_t *osh, void *ptr_cma_info);
+
+#endif /* BCM_SECURE_DMA */
+
+typedef struct sk_buff_head PKT_LIST;
+#define PKTLIST_INIT(x)                skb_queue_head_init((x))
+#define PKTLIST_ENQ(x, y)      skb_queue_head((struct sk_buff_head *)(x), (struct sk_buff *)(y))
+#define PKTLIST_DEQ(x)         skb_dequeue((struct sk_buff_head *)(x))
+#define PKTLIST_UNLINK(x, y)   skb_unlink((struct sk_buff *)(y), (struct sk_buff_head *)(x))
+#define PKTLIST_FINI(x)                skb_queue_purge((struct sk_buff_head *)(x))
+
+#endif /* _linux_osl_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/linuxver.h b/drivers/net/wireless/bcmdhd_1363/include/linuxver.h
new file mode 100644 (file)
index 0000000..83deb79
--- /dev/null
@@ -0,0 +1,774 @@
+/*
+ * Linux-specific abstractions to gain some independence from linux kernel versions.
+ * Pave over some 2.2 versus 2.4 versus 2.6 kernel differences.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: linuxver.h 604758 2015-12-08 12:01:08Z $
+ */
+
+#ifndef _linuxver_h_
+#define _linuxver_h_
+
+#if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 6)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wunused-but-set-variable"
+#pragma GCC diagnostic ignored "-Wunused-but-set-parameter"
+#endif
+
+#include <typedefs.h>
+#include <linux/version.h>
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+#include <linux/config.h>
+#else
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 33))
+#include <generated/autoconf.h>
+#else
+#include <linux/autoconf.h>
+#endif
+#endif /* (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0)) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 1, 0))
+#include <linux/kconfig.h>
+#endif
+#include <linux/module.h>
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 0))
+/* __NO_VERSION__ must be defined for all linkables except one in 2.2 */
+#ifdef __UNDEF_NO_VERSION__
+#undef __NO_VERSION__
+#else
+#define __NO_VERSION__
+#endif
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 0) */
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 5, 0)
+#define module_param(_name_, _type_, _perm_)   MODULE_PARM(_name_, "i")
+#define module_param_string(_name_, _string_, _size_, _perm_) \
+               MODULE_PARM(_string_, "c" __MODULE_STRING(_size_))
+#endif
+
+/* linux/malloc.h is deprecated, use linux/slab.h instead. */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 9))
+#include <linux/malloc.h>
+#else
+#include <linux/slab.h>
+#endif
+
+#include <linux/types.h>
+#include <linux/init.h>
+#include <linux/mm.h>
+#include <linux/string.h>
+#include <linux/pci.h>
+#include <linux/interrupt.h>
+#include <linux/kthread.h>
+#include <linux/netdevice.h>
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+#include <linux/semaphore.h>
+#else
+#include <asm/semaphore.h>
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28))
+#undef IP_TOS
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28)) */
+#include <asm/io.h>
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 5, 41))
+#include <linux/workqueue.h>
+#else
+#include <linux/tqueue.h>
+#ifndef work_struct
+#define work_struct tq_struct
+#endif
+#ifndef INIT_WORK
+#define INIT_WORK(_work, _func, _data) INIT_TQUEUE((_work), (_func), (_data))
+#endif
+#ifndef schedule_work
+#define schedule_work(_work) schedule_task((_work))
+#endif
+#ifndef flush_scheduled_work
+#define flush_scheduled_work() flush_scheduled_tasks()
+#endif
+#endif /* LINUX_VERSION_CODE > KERNEL_VERSION(2, 5, 41) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0))
+#define DAEMONIZE(a)   do { \
+               allow_signal(SIGKILL);  \
+               allow_signal(SIGTERM);  \
+       } while (0)
+#elif ((LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)) && \
+       (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)))
+#define DAEMONIZE(a) daemonize(a); \
+       allow_signal(SIGKILL); \
+       allow_signal(SIGTERM);
+#else /* Linux 2.4 (w/o preemption patch) */
+#define RAISE_RX_SOFTIRQ() \
+       cpu_raise_softirq(smp_processor_id(), NET_RX_SOFTIRQ)
+#define DAEMONIZE(a) daemonize(); \
+       do { if (a) \
+               strncpy(current->comm, a, MIN(sizeof(current->comm), (strlen(a)))); \
+       } while (0);
+#endif /* LINUX_VERSION_CODE  */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19)
+#define        MY_INIT_WORK(_work, _func)      INIT_WORK(_work, _func)
+#else
+#define        MY_INIT_WORK(_work, _func)      INIT_WORK(_work, _func, _work)
+#if !(LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 18) && defined(RHEL_MAJOR) && \
+       (RHEL_MAJOR == 5))
+/* Exclude RHEL 5 */
+typedef void (*work_func_t)(void *work);
+#endif
+#endif /* >= 2.6.20 */
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+/* Some distributions have their own 2.6.x compatibility layers */
+#ifndef IRQ_NONE
+typedef void irqreturn_t;
+#define IRQ_NONE
+#define IRQ_HANDLED
+#define IRQ_RETVAL(x)
+#endif
+#else
+typedef irqreturn_t(*FN_ISR) (int irq, void *dev_id, struct pt_regs *ptregs);
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0) */
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18)
+#define IRQF_SHARED    SA_SHIRQ
+#endif /* < 2.6.18 */
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 17)
+#ifdef CONFIG_NET_RADIO
+#define        CONFIG_WIRELESS_EXT
+#endif
+#endif /* < 2.6.17 */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 5, 67)
+#define MOD_INC_USE_COUNT
+#define MOD_DEC_USE_COUNT
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 5, 67) */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 32)
+#include <linux/sched.h>
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 32) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0))
+#include <linux/sched/rt.h>
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0) */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 29)
+#include <net/lib80211.h>
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 29)
+#include <linux/ieee80211.h>
+#else
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 14)
+#include <net/ieee80211.h>
+#endif
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 30) */
+
+
+#ifndef __exit
+#define __exit
+#endif
+#ifndef __devexit
+#define __devexit
+#endif
+#ifndef __devinit
+#  if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0))
+#    define __devinit  __init
+#  else
+/* All devices are hotpluggable since linux 3.8.0 */
+#    define __devinit
+#  endif
+#endif /* !__devinit */
+#ifndef __devinitdata
+#define __devinitdata
+#endif
+#ifndef __devexit_p
+#define __devexit_p(x) x
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 0))
+
+#define pci_get_drvdata(dev)           (dev)->sysdata
+#define pci_set_drvdata(dev, value)    (dev)->sysdata = (value)
+
+/*
+ * New-style (2.4.x) PCI/hot-pluggable PCI/CardBus registration
+ */
+
+struct pci_device_id {
+       unsigned int vendor, device;            /* Vendor and device ID or PCI_ANY_ID */
+       unsigned int subvendor, subdevice;      /* Subsystem ID's or PCI_ANY_ID */
+       unsigned int class, class_mask;         /* (class,subclass,prog-if) triplet */
+       unsigned long driver_data;              /* Data private to the driver */
+};
+
+struct pci_driver {
+       struct list_head node;
+       char *name;
+       const struct pci_device_id *id_table;   /* NULL if wants all devices */
+       int (*probe)(struct pci_dev *dev,
+                    const struct pci_device_id *id); /* New device inserted */
+       void (*remove)(struct pci_dev *dev);    /* Device removed (NULL if not a hot-plug
+                                                * capable driver)
+                                                */
+       void (*suspend)(struct pci_dev *dev);   /* Device suspended */
+       void (*resume)(struct pci_dev *dev);    /* Device woken up */
+};
+
+#define MODULE_DEVICE_TABLE(type, name)
+#define PCI_ANY_ID (~0)
+
+/* compatpci.c */
+#define pci_module_init pci_register_driver
+extern int pci_register_driver(struct pci_driver *drv);
+extern void pci_unregister_driver(struct pci_driver *drv);
+
+#endif /* PCI registration */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 18))
+#define pci_module_init pci_register_driver
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 2, 18))
+#ifdef MODULE
+#define module_init(x) int init_module(void) { return x(); }
+#define module_exit(x) void cleanup_module(void) { x(); }
+#else
+#define module_init(x) __initcall(x);
+#define module_exit(x) __exitcall(x);
+#endif
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2, 2, 18) */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 31)
+#define WL_USE_NETDEV_OPS
+#else
+#undef WL_USE_NETDEV_OPS
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 31)) && defined(CONFIG_RFKILL)
+#define WL_CONFIG_RFKILL
+#else
+#undef WL_CONFIG_RFKILL
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 48))
+#define list_for_each(pos, head) \
+       for (pos = (head)->next; pos != (head); pos = pos->next)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 13))
+#define pci_resource_start(dev, bar)   ((dev)->base_address[(bar)])
+#elif (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 44))
+#define pci_resource_start(dev, bar)   ((dev)->resource[(bar)].start)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 23))
+#define pci_enable_device(dev) do { } while (0)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 14))
+#define net_device device
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 42))
+
+/*
+ * DMA mapping
+ *
+ * See linux/Documentation/DMA-mapping.txt
+ */
+
+#ifndef PCI_DMA_TODEVICE
+#define        PCI_DMA_TODEVICE        1
+#define        PCI_DMA_FROMDEVICE      2
+#endif
+
+typedef u32 dma_addr_t;
+
+/* Pure 2^n version of get_order */
+static inline int get_order(unsigned long size)
+{
+       int order;
+
+       size = (size-1) >> (PAGE_SHIFT-1);
+       order = -1;
+       do {
+               size >>= 1;
+               order++;
+       } while (size);
+       return order;
+}
+
+static inline void *pci_alloc_consistent(struct pci_dev *hwdev, size_t size,
+                                         dma_addr_t *dma_handle)
+{
+       void *ret;
+       int gfp = GFP_ATOMIC | GFP_DMA;
+
+       ret = (void *)__get_free_pages(gfp, get_order(size));
+
+       if (ret != NULL) {
+               memset(ret, 0, size);
+               *dma_handle = virt_to_bus(ret);
+       }
+       return ret;
+}
+static inline void pci_free_consistent(struct pci_dev *hwdev, size_t size,
+                                       void *vaddr, dma_addr_t dma_handle)
+{
+       free_pages((unsigned long)vaddr, get_order(size));
+}
+#define pci_map_single(cookie, address, size, dir)     virt_to_bus(address)
+#define pci_unmap_single(cookie, address, size, dir)
+
+#endif /* DMA mapping */
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 43))
+
+#define dev_kfree_skb_any(a)           dev_kfree_skb(a)
+#define netif_down(dev)                        do { (dev)->start = 0; } while (0)
+
+/* pcmcia-cs provides its own netdevice compatibility layer */
+#ifndef _COMPAT_NETDEVICE_H
+
+/*
+ * SoftNet
+ *
+ * For pre-softnet kernels we need to tell the upper layer not to
+ * re-enter start_xmit() while we are in there. However softnet
+ * guarantees not to enter while we are in there so there is no need
+ * to do the netif_stop_queue() dance unless the transmit queue really
+ * gets stuck. This should also improve performance according to tests
+ * done by Aman Singla.
+ */
+
+#define dev_kfree_skb_irq(a)   dev_kfree_skb(a)
+#define netif_wake_queue(dev) \
+               do { clear_bit(0, &(dev)->tbusy); mark_bh(NET_BH); } while (0)
+#define netif_stop_queue(dev)  set_bit(0, &(dev)->tbusy)
+
+static inline void netif_start_queue(struct net_device *dev)
+{
+       dev->tbusy = 0;
+       dev->interrupt = 0;
+       dev->start = 1;
+}
+
+#define netif_queue_stopped(dev)       (dev)->tbusy
+#define netif_running(dev)             (dev)->start
+
+#endif /* _COMPAT_NETDEVICE_H */
+
+#define netif_device_attach(dev)       netif_start_queue(dev)
+#define netif_device_detach(dev)       netif_stop_queue(dev)
+
+/* 2.4.x renamed bottom halves to tasklets */
+#define tasklet_struct                         tq_struct
+static inline void tasklet_schedule(struct tasklet_struct *tasklet)
+{
+       queue_task(tasklet, &tq_immediate);
+       mark_bh(IMMEDIATE_BH);
+}
+
+static inline void tasklet_init(struct tasklet_struct *tasklet,
+                                void (*func)(unsigned long),
+                                unsigned long data)
+{
+       tasklet->next = NULL;
+       tasklet->sync = 0;
+       tasklet->routine = (void (*)(void *))func;
+       tasklet->data = (void *)data;
+}
+#define tasklet_kill(tasklet)  { do {} while (0); }
+
+/* 2.4.x introduced del_timer_sync() */
+#define del_timer_sync(timer) del_timer(timer)
+
+#else
+
+#define netif_down(dev)
+
+#endif /* SoftNet */
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 3))
+
+/*
+ * Emit code to initialise a tq_struct's routine and data pointers
+ */
+#define PREPARE_TQUEUE(_tq, _routine, _data)                   \
+       do {                                                    \
+               (_tq)->routine = _routine;                      \
+               (_tq)->data = _data;                            \
+       } while (0)
+
+/*
+ * Emit code to initialise all of a tq_struct
+ */
+#define INIT_TQUEUE(_tq, _routine, _data)                      \
+       do {                                                    \
+               INIT_LIST_HEAD(&(_tq)->list);                   \
+               (_tq)->sync = 0;                                \
+               PREPARE_TQUEUE((_tq), (_routine), (_data));     \
+       } while (0)
+
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 3) */
+
+/* Power management related macro & routines */
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 9)
+#define        PCI_SAVE_STATE(a, b)    pci_save_state(a)
+#define        PCI_RESTORE_STATE(a, b) pci_restore_state(a)
+#else
+#define        PCI_SAVE_STATE(a, b)    pci_save_state(a, b)
+#define        PCI_RESTORE_STATE(a, b) pci_restore_state(a, b)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 6))
+static inline int
+pci_save_state(struct pci_dev *dev, u32 *buffer)
+{
+       int i;
+       if (buffer) {
+               for (i = 0; i < 16; i++)
+                       pci_read_config_dword(dev, i * 4, &buffer[i]);
+       }
+       return 0;
+}
+
+static inline int
+pci_restore_state(struct pci_dev *dev, u32 *buffer)
+{
+       int i;
+
+       if (buffer) {
+               for (i = 0; i < 16; i++)
+                       pci_write_config_dword(dev, i * 4, buffer[i]);
+       }
+       /*
+        * otherwise, write the context information we know from bootup.
+        * This works around a problem where warm-booting from Windows
+        * combined with a D3(hot)->D0 transition causes PCI config
+        * header data to be forgotten.
+        */
+       else {
+               for (i = 0; i < 6; i ++)
+                       pci_write_config_dword(dev,
+                                              PCI_BASE_ADDRESS_0 + (i * 4),
+                                              pci_resource_start(dev, i));
+               pci_write_config_byte(dev, PCI_INTERRUPT_LINE, dev->irq);
+       }
+       return 0;
+}
+#endif /* PCI power management */
+
+/* Old cp0 access macros deprecated in 2.4.19 */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 19))
+#define read_c0_count() read_32bit_cp0_register(CP0_COUNT)
+#endif
+
+/* Module refcount handled internally in 2.6.x */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 24))
+#ifndef SET_MODULE_OWNER
+#define SET_MODULE_OWNER(dev)          do {} while (0)
+#define OLD_MOD_INC_USE_COUNT          MOD_INC_USE_COUNT
+#define OLD_MOD_DEC_USE_COUNT          MOD_DEC_USE_COUNT
+#else
+#define OLD_MOD_INC_USE_COUNT          do {} while (0)
+#define OLD_MOD_DEC_USE_COUNT          do {} while (0)
+#endif
+#else /* LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 24) */
+#ifndef SET_MODULE_OWNER
+#define SET_MODULE_OWNER(dev)          do {} while (0)
+#endif
+#ifndef MOD_INC_USE_COUNT
+#define MOD_INC_USE_COUNT                      do {} while (0)
+#endif
+#ifndef MOD_DEC_USE_COUNT
+#define MOD_DEC_USE_COUNT                      do {} while (0)
+#endif
+#define OLD_MOD_INC_USE_COUNT          MOD_INC_USE_COUNT
+#define OLD_MOD_DEC_USE_COUNT          MOD_DEC_USE_COUNT
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 24) */
+
+#ifndef SET_NETDEV_DEV
+#define SET_NETDEV_DEV(net, pdev)      do {} while (0)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 1, 0))
+#ifndef HAVE_FREE_NETDEV
+#define free_netdev(dev)               kfree(dev)
+#endif
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(3, 1, 0) */
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+/* struct packet_type redefined in 2.6.x */
+#define af_packet_priv                 data
+#endif
+
+/* suspend args */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 11)
+#define DRV_SUSPEND_STATE_TYPE pm_message_t
+#else
+#define DRV_SUSPEND_STATE_TYPE uint32
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19)
+#define CHECKSUM_HW    CHECKSUM_PARTIAL
+#endif
+
+typedef struct {
+       void    *parent;  /* some external entity that the thread supposed to work for */
+       char    *proc_name;
+       struct  task_struct *p_task;
+       long    thr_pid;
+       int             prio; /* priority */
+       struct  semaphore sema;
+       int     terminated;
+       struct  completion completed;
+       spinlock_t      spinlock;
+       int             up_cnt;
+} tsk_ctl_t;
+
+
+/* requires  tsk_ctl_t tsk  argument, the caller's priv data is passed in owner ptr */
+/* note this macro assumes there may be only one context waiting on thread's completion */
+#ifdef DHD_DEBUG
+#define DBG_THR(x) printk x
+#else
+#define DBG_THR(x)
+#endif
+
+static inline bool binary_sema_down(tsk_ctl_t *tsk)
+{
+       if (down_interruptible(&tsk->sema) == 0) {
+               unsigned long flags = 0;
+               spin_lock_irqsave(&tsk->spinlock, flags);
+               if (tsk->up_cnt == 1)
+                       tsk->up_cnt--;
+               else {
+                       DBG_THR(("dhd_dpc_thread: Unexpected up_cnt %d\n", tsk->up_cnt));
+               }
+               spin_unlock_irqrestore(&tsk->spinlock, flags);
+               return false;
+       } else
+               return true;
+}
+
+static inline bool binary_sema_up(tsk_ctl_t *tsk)
+{
+       bool sem_up = false;
+       unsigned long flags = 0;
+
+       spin_lock_irqsave(&tsk->spinlock, flags);
+       if (tsk->up_cnt == 0) {
+               tsk->up_cnt++;
+               sem_up = true;
+       } else if (tsk->up_cnt == 1) {
+               /* dhd_sched_dpc: dpc is alread up! */
+       } else
+               DBG_THR(("dhd_sched_dpc: unexpected up cnt %d!\n", tsk->up_cnt));
+
+       spin_unlock_irqrestore(&tsk->spinlock, flags);
+
+       if (sem_up)
+               up(&tsk->sema);
+
+       return sem_up;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+#define SMP_RD_BARRIER_DEPENDS(x) smp_read_barrier_depends(x)
+#else
+#define SMP_RD_BARRIER_DEPENDS(x) smp_rmb(x)
+#endif
+
+#define PROC_START(thread_func, owner, tsk_ctl, flags, name) \
+{ \
+       sema_init(&((tsk_ctl)->sema), 0); \
+       init_completion(&((tsk_ctl)->completed)); \
+       (tsk_ctl)->parent = owner; \
+       (tsk_ctl)->proc_name = name;  \
+       (tsk_ctl)->terminated = FALSE; \
+       (tsk_ctl)->p_task  = kthread_run(thread_func, tsk_ctl, (char*)name); \
+       if (IS_ERR((tsk_ctl)->p_task)) { \
+               (tsk_ctl)->thr_pid = DHD_PID_KT_INVALID; \
+               DBG_THR(("%s(): thread:%s:%lx failed\n", __FUNCTION__, \
+                       (tsk_ctl)->proc_name, (tsk_ctl)->thr_pid)); \
+       } else { \
+               (tsk_ctl)->thr_pid = (tsk_ctl)->p_task->pid; \
+               spin_lock_init(&((tsk_ctl)->spinlock)); \
+               DBG_THR(("%s(): thread:%s:%lx started\n", __FUNCTION__, \
+                       (tsk_ctl)->proc_name, (tsk_ctl)->thr_pid)); \
+       } \
+}
+
+#define PROC_STOP(tsk_ctl) \
+{ \
+       (tsk_ctl)->terminated = TRUE; \
+       smp_wmb(); \
+       up(&((tsk_ctl)->sema)); \
+       wait_for_completion(&((tsk_ctl)->completed)); \
+       DBG_THR(("%s(): thread:%s:%lx terminated OK\n", __FUNCTION__, \
+                        (tsk_ctl)->proc_name, (tsk_ctl)->thr_pid)); \
+       (tsk_ctl)->thr_pid = -1; \
+}
+
+/*  ----------------------- */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 31))
+#define KILL_PROC(nr, sig) \
+{ \
+struct task_struct *tsk; \
+struct pid *pid;    \
+pid = find_get_pid((pid_t)nr);    \
+tsk = pid_task(pid, PIDTYPE_PID);    \
+if (tsk) send_sig(sig, tsk, 1); \
+}
+#else
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && (LINUX_VERSION_CODE <= \
+       KERNEL_VERSION(2, 6, 30))
+#define KILL_PROC(pid, sig) \
+{ \
+       struct task_struct *tsk; \
+       tsk = find_task_by_vpid(pid); \
+       if (tsk) send_sig(sig, tsk, 1); \
+}
+#else
+#define KILL_PROC(pid, sig) \
+{ \
+       kill_proc(pid, sig, 1); \
+}
+#endif
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 31) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+#include <linux/time.h>
+#include <linux/wait.h>
+#else
+#include <linux/sched.h>
+
+#define __wait_event_interruptible_timeout(wq, condition, ret)         \
+do {                                                                   \
+       wait_queue_t __wait;                                            \
+       init_waitqueue_entry(&__wait, current);                         \
+                                                                       \
+       add_wait_queue(&wq, &__wait);                                   \
+       for (;;) {                                                      \
+               set_current_state(TASK_INTERRUPTIBLE);                  \
+               if (condition)                                          \
+                       break;                                          \
+               if (!signal_pending(current)) {                         \
+                       ret = schedule_timeout(ret);                    \
+                       if (!ret)                                       \
+                               break;                                  \
+                       continue;                                       \
+               }                                                       \
+               ret = -ERESTARTSYS;                                     \
+               break;                                                  \
+       }                                                               \
+       current->state = TASK_RUNNING;                                  \
+       remove_wait_queue(&wq, &__wait);                                \
+} while (0)
+
+#define wait_event_interruptible_timeout(wq, condition, timeout)       \
+({                                                                     \
+       long __ret = timeout;                                           \
+       if (!(condition))                                               \
+               __wait_event_interruptible_timeout(wq, condition, __ret); \
+       __ret;                                                          \
+})
+
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)) */
+
+/*
+For < 2.6.24, wl creates its own netdev but doesn't
+align the priv area like the genuine alloc_netdev().
+Since netdev_priv() always gives us the aligned address, it will
+not match our unaligned address for < 2.6.24
+*/
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 24))
+#define DEV_PRIV(dev)  (dev->priv)
+#else
+#define DEV_PRIV(dev)  netdev_priv(dev)
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 20)
+#define WL_ISR(i, d, p)         wl_isr((i), (d))
+#else
+#define WL_ISR(i, d, p)         wl_isr((i), (d), (p))
+#endif  /* < 2.6.20 */
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+#define netdev_priv(dev) dev->priv
+#endif /* (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0)) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+#define CAN_SLEEP()    ((!in_atomic() && !irqs_disabled()))
+#else
+#define CAN_SLEEP()    (FALSE)
+#endif
+
+#define KMALLOC_FLAG (CAN_SLEEP() ? GFP_KERNEL: GFP_ATOMIC)
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0))
+#define RANDOM32       prandom_u32
+#else
+#define RANDOM32       random32
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0))
+#define SRANDOM32(entropy)     prandom_seed(entropy)
+#else
+#define SRANDOM32(entropy)     srandom32(entropy)
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0) */
+
+/*
+ * Overide latest kfifo functions with
+ * older version to work on older kernels
+ */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 33)) && !defined(WL_COMPAT_WIRELESS)
+#define kfifo_in_spinlocked(a, b, c, d)                kfifo_put(a, (u8 *)b, c)
+#define kfifo_out_spinlocked(a, b, c, d)       kfifo_get(a, (u8 *)b, c)
+#define kfifo_esize(a)                         1
+#elif (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 32)) && \
+       (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 36)) &&      !defined(WL_COMPAT_WIRELESS)
+#define kfifo_in_spinlocked(a, b, c, d)                kfifo_in_locked(a, b, c, d)
+#define kfifo_out_spinlocked(a, b, c, d)       kfifo_out_locked(a, b, c, d)
+#define kfifo_esize(a)                         1
+#endif /* (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 33)) */
+
+#if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 6)
+#pragma GCC diagnostic pop
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 9, 0))
+static inline struct inode *file_inode(const struct file *f)
+{
+       return f->f_dentry->d_inode;
+}
+#endif /* (LINUX_VERSION_CODE < KERNEL_VERSION(3, 9, 0)) */
+
+#endif /* _linuxver_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/miniopt.h b/drivers/net/wireless/bcmdhd_1363/include/miniopt.h
new file mode 100644 (file)
index 0000000..6722351
--- /dev/null
@@ -0,0 +1,83 @@
+/*
+ * Command line options parser.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: miniopt.h 514727 2014-11-12 03:02:48Z $
+ */
+
+
+#ifndef MINI_OPT_H
+#define MINI_OPT_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* ---- Include Files ---------------------------------------------------- */
+
+
+/* ---- Constants and Types ---------------------------------------------- */
+
+#define MINIOPT_MAXKEY 128     /* Max options */
+typedef struct miniopt {
+
+       /* These are persistent after miniopt_init() */
+       const char* name;               /* name for prompt in error strings */
+       const char* flags;              /* option chars that take no args */
+       bool longflags;         /* long options may be flags */
+       bool opt_end;           /* at end of options (passed a "--") */
+
+       /* These are per-call to miniopt() */
+
+       int consumed;           /* number of argv entries cosumed in
+                                * the most recent call to miniopt()
+                                */
+       bool positional;
+       bool good_int;          /* 'val' member is the result of a sucessful
+                                * strtol conversion of the option value
+                                */
+       char opt;
+       char key[MINIOPT_MAXKEY];
+       char* valstr;           /* positional param, or value for the option,
+                                * or null if the option had
+                                * no accompanying value
+                                */
+       uint uval;              /* strtol translation of valstr */
+       int  val;               /* strtol translation of valstr */
+} miniopt_t;
+
+void miniopt_init(miniopt_t *t, const char* name, const char* flags, bool longflags);
+int miniopt(miniopt_t *t, char **argv);
+
+
+/* ---- Variable Externs ------------------------------------------------- */
+/* ---- Function Prototypes ---------------------------------------------- */
+
+
+#ifdef __cplusplus
+       }
+#endif
+
+#endif  /* MINI_OPT_H  */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/msgtrace.h b/drivers/net/wireless/bcmdhd_1363/include/msgtrace.h
new file mode 100644 (file)
index 0000000..00e2b0f
--- /dev/null
@@ -0,0 +1,81 @@
+/*
+ * Trace messages sent over HBUS
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: msgtrace.h 514727 2014-11-12 03:02:48Z $
+ */
+
+#ifndef        _MSGTRACE_H
+#define        _MSGTRACE_H
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+/* for osl_t */
+#include <osl_decl.h>
+#define MSGTRACE_VERSION 1
+
+/* Message trace header */
+typedef BWL_PRE_PACKED_STRUCT struct msgtrace_hdr {
+       uint8   version;
+       uint8   trace_type;
+#define MSGTRACE_HDR_TYPE_MSG 0
+#define MSGTRACE_HDR_TYPE_LOG 1
+       uint16  len;    /* Len of the trace */
+       uint32  seqnum; /* Sequence number of message. Useful if the messsage has been lost
+                        * because of DMA error or a bus reset (ex: SDIO Func2)
+                        */
+       /* Msgtrace type  only */
+       uint32  discarded_bytes;  /* Number of discarded bytes because of trace overflow  */
+       uint32  discarded_printf; /* Number of discarded printf because of trace overflow */
+} BWL_POST_PACKED_STRUCT msgtrace_hdr_t;
+
+#define MSGTRACE_HDRLEN        sizeof(msgtrace_hdr_t)
+
+/* The hbus driver generates traces when sending a trace message. This causes endless traces.
+ * This flag must be set to TRUE in any hbus traces. The flag is reset in the function msgtrace_put.
+ * This prevents endless traces but generates hasardous lost of traces only in bus device code.
+ * It is recommendat to set this flag in macro SD_TRACE but not in SD_ERROR for avoiding missing
+ * hbus error traces. hbus error trace should not generates endless traces.
+ */
+extern bool msgtrace_hbus_trace;
+
+typedef void (*msgtrace_func_send_t)(void *hdl1, void *hdl2, uint8 *hdr,
+                                     uint16 hdrlen, uint8 *buf, uint16 buflen);
+extern void msgtrace_start(void);
+extern void msgtrace_stop(void);
+extern int msgtrace_sent(void);
+extern void msgtrace_put(char *buf, int count);
+extern void msgtrace_init(void *hdl1, void *hdl2, msgtrace_func_send_t func_send);
+extern bool msgtrace_event_enabled(void);
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _MSGTRACE_H */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/osl.h b/drivers/net/wireless/bcmdhd_1363/include/osl.h
new file mode 100644 (file)
index 0000000..bd08e8a
--- /dev/null
@@ -0,0 +1,178 @@
+/*
+ * OS Abstraction Layer
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: osl.h 526460 2015-01-14 08:25:24Z $
+ */
+
+#ifndef _osl_h_
+#define _osl_h_
+
+#include <osl_decl.h>
+
+#define OSL_PKTTAG_SZ  32 /* Size of PktTag */
+
+/* Drivers use PKTFREESETCB to register a callback function when a packet is freed by OSL */
+typedef void (*pktfree_cb_fn_t)(void *ctx, void *pkt, unsigned int status);
+
+/* Drivers use REGOPSSET() to register register read/write funcitons */
+typedef unsigned int (*osl_rreg_fn_t)(void *ctx, volatile void *reg, unsigned int size);
+typedef void  (*osl_wreg_fn_t)(void *ctx, volatile void *reg, unsigned int val, unsigned int size);
+
+
+
+#if defined(WL_UNITTEST)
+#include <utest_osl.h>
+#else
+#include <linux_osl.h>
+#endif 
+
+#ifndef PKTDBG_TRACE
+#define PKTDBG_TRACE(osh, pkt, bit)    BCM_REFERENCE(osh)
+#endif
+
+#define PKTCTFMAP(osh, p)              BCM_REFERENCE(osh)
+
+/* --------------------------------------------------------------------------
+** Register manipulation macros.
+*/
+
+#define        SET_REG(osh, r, mask, val)      W_REG((osh), (r), ((R_REG((osh), r) & ~(mask)) | (val)))
+
+#ifndef AND_REG
+#define AND_REG(osh, r, v)             W_REG(osh, (r), R_REG(osh, r) & (v))
+#endif   /* !AND_REG */
+
+#ifndef OR_REG
+#define OR_REG(osh, r, v)              W_REG(osh, (r), R_REG(osh, r) | (v))
+#endif   /* !OR_REG */
+
+#if !defined(OSL_SYSUPTIME)
+#define OSL_SYSUPTIME() (0)
+#define OSL_SYSUPTIME_SUPPORT FALSE
+#else
+#define OSL_SYSUPTIME_SUPPORT TRUE
+#endif /* OSL_SYSUPTIME */
+
+#ifndef OSL_SYS_HALT
+#define OSL_SYS_HALT() do {} while (0)
+#endif
+
+#ifndef OSL_MEM_AVAIL
+#define OSL_MEM_AVAIL()        (0xffffffff)
+#endif
+
+#if !defined(PKTC) && !defined(PKTC_DONGLE)
+#define        PKTCGETATTR(skb)        (0)
+#define        PKTCSETATTR(skb, f, p, b) BCM_REFERENCE(skb)
+#define        PKTCCLRATTR(skb)        BCM_REFERENCE(skb)
+#define        PKTCCNT(skb)            (1)
+#define        PKTCLEN(skb)            PKTLEN(NULL, skb)
+#define        PKTCGETFLAGS(skb)       (0)
+#define        PKTCSETFLAGS(skb, f)    BCM_REFERENCE(skb)
+#define        PKTCCLRFLAGS(skb)       BCM_REFERENCE(skb)
+#define        PKTCFLAGS(skb)          (0)
+#define        PKTCSETCNT(skb, c)      BCM_REFERENCE(skb)
+#define        PKTCINCRCNT(skb)        BCM_REFERENCE(skb)
+#define        PKTCADDCNT(skb, c)      BCM_REFERENCE(skb)
+#define        PKTCSETLEN(skb, l)      BCM_REFERENCE(skb)
+#define        PKTCADDLEN(skb, l)      BCM_REFERENCE(skb)
+#define        PKTCSETFLAG(skb, fb)    BCM_REFERENCE(skb)
+#define        PKTCCLRFLAG(skb, fb)    BCM_REFERENCE(skb)
+#define        PKTCLINK(skb)           NULL
+#define        PKTSETCLINK(skb, x)     BCM_REFERENCE(skb)
+#define FOREACH_CHAINED_PKT(skb, nskb) \
+       for ((nskb) = NULL; (skb) != NULL; (skb) = (nskb))
+#define        PKTCFREE                PKTFREE
+#define PKTCENQTAIL(h, t, p) \
+do { \
+       if ((t) == NULL) { \
+               (h) = (t) = (p); \
+       } \
+} while (0)
+#endif /* !linux || !PKTC */
+
+#if !defined(HNDCTF) && !defined(PKTC_TX_DONGLE)
+#define PKTSETCHAINED(osh, skb)                BCM_REFERENCE(osh)
+#define PKTCLRCHAINED(osh, skb)                BCM_REFERENCE(osh)
+#define PKTISCHAINED(skb)              FALSE
+#endif
+
+/* Lbuf with fraglist */
+#define PKTFRAGPKTID(osh, lb)          (0)
+#define PKTSETFRAGPKTID(osh, lb, id)   BCM_REFERENCE(osh)
+#define PKTFRAGTOTNUM(osh, lb)         (0)
+#define PKTSETFRAGTOTNUM(osh, lb, tot) BCM_REFERENCE(osh)
+#define PKTFRAGTOTLEN(osh, lb)         (0)
+#define PKTSETFRAGTOTLEN(osh, lb, len) BCM_REFERENCE(osh)
+#define PKTIFINDEX(osh, lb)            (0)
+#define PKTSETIFINDEX(osh, lb, idx)    BCM_REFERENCE(osh)
+#define        PKTGETLF(osh, len, send, lbuf_type)     (0)
+
+/* in rx path, reuse totlen as used len */
+#define PKTFRAGUSEDLEN(osh, lb)                        (0)
+#define PKTSETFRAGUSEDLEN(osh, lb, len)                BCM_REFERENCE(osh)
+
+#define PKTFRAGLEN(osh, lb, ix)                        (0)
+#define PKTSETFRAGLEN(osh, lb, ix, len)                BCM_REFERENCE(osh)
+#define PKTFRAGDATA_LO(osh, lb, ix)            (0)
+#define PKTSETFRAGDATA_LO(osh, lb, ix, addr)   BCM_REFERENCE(osh)
+#define PKTFRAGDATA_HI(osh, lb, ix)            (0)
+#define PKTSETFRAGDATA_HI(osh, lb, ix, addr)   BCM_REFERENCE(osh)
+
+/* RX FRAG */
+#define PKTISRXFRAG(osh, lb)           (0)
+#define PKTSETRXFRAG(osh, lb)          BCM_REFERENCE(osh)
+#define PKTRESETRXFRAG(osh, lb)                BCM_REFERENCE(osh)
+
+/* TX FRAG */
+#define PKTISTXFRAG(osh, lb)           (0)
+#define PKTSETTXFRAG(osh, lb)          BCM_REFERENCE(osh)
+
+/* Need Rx completion used for AMPDU reordering */
+#define PKTNEEDRXCPL(osh, lb)           (TRUE)
+#define PKTSETNORXCPL(osh, lb)          BCM_REFERENCE(osh)
+#define PKTRESETNORXCPL(osh, lb)        BCM_REFERENCE(osh)
+
+#define PKTISFRAG(osh, lb)             (0)
+#define PKTFRAGISCHAINED(osh, i)       (0)
+/* TRIM Tail bytes from lfrag */
+#define PKTFRAG_TRIM_TAILBYTES(osh, p, len, type)      PKTSETLEN(osh, p, PKTLEN(osh, p) - len)
+
+#ifdef BCM_SECURE_DMA
+#define SECURE_DMA_ENAB(osh) (1)
+#else
+
+#define SECURE_DMA_ENAB(osh) (0)
+#define        SECURE_DMA_MAP(osh, va, size, direction, p, dmah, pcma, offset) ((dmaaddr_t) {(0)})
+#define        SECURE_DMA_DD_MAP(osh, va, size, direction, p, dmah) 0
+#define        SECURE_DMA_MAP_TXMETA(osh, va, size, direction, p, dmah, pcma) ((dmaaddr_t) {(0)})
+#define        SECURE_DMA_UNMAP(osh, pa, size, direction, p, dmah, pcma, offset)
+#define        SECURE_DMA_UNMAP_ALL(osh, pcma)
+
+#endif
+
+
+#endif /* _osl_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/osl_decl.h b/drivers/net/wireless/bcmdhd_1363/include/osl_decl.h
new file mode 100644 (file)
index 0000000..d859b8c
--- /dev/null
@@ -0,0 +1,37 @@
+/*
+ * osl forward declarations
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: osl_decl.h 591283 2015-10-07 11:52:00Z $
+ */
+
+#ifndef _osl_decl_h_
+#define _osl_decl_h_
+
+/* osl handle type forward declaration */
+typedef struct osl_info osl_t;
+typedef struct osl_dmainfo osldma_t;
+extern unsigned int lmtest; /* low memory test */
+#endif
diff --git a/drivers/net/wireless/bcmdhd_1363/include/osl_ext.h b/drivers/net/wireless/bcmdhd_1363/include/osl_ext.h
new file mode 100644 (file)
index 0000000..13d59b6
--- /dev/null
@@ -0,0 +1,697 @@
+/*
+ * OS Abstraction Layer Extension - the APIs defined by the "extension" API
+ * are only supported by a subset of all operating systems.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: osl_ext.h 514727 2014-11-12 03:02:48Z $
+ */
+
+#ifndef _osl_ext_h_
+#define _osl_ext_h_
+
+
+/* ---- Include Files ---------------------------------------------------- */
+
+#if defined(TARGETOS_symbian)
+       #include <e32def.h>
+       #include <symbian_osl_ext.h>
+#elif defined(THREADX)
+       #include <threadx_osl_ext.h>
+#else
+       #define OSL_EXT_DISABLED
+#endif
+
+/* Include base operating system abstraction. */
+#include <osl.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* ---- Constants and Types ---------------------------------------------- */
+
+/* -----------------------------------------------------------------------
+ * Generic OS types.
+ */
+typedef enum osl_ext_status_t
+{
+       OSL_EXT_SUCCESS,
+       OSL_EXT_ERROR,
+       OSL_EXT_TIMEOUT
+
+} osl_ext_status_t;
+#define OSL_EXT_STATUS_DECL(status)    osl_ext_status_t status;
+
+#define OSL_EXT_TIME_FOREVER ((osl_ext_time_ms_t)(-1))
+typedef unsigned int osl_ext_time_ms_t;
+
+typedef unsigned int osl_ext_event_bits_t;
+
+typedef unsigned int osl_ext_interrupt_state_t;
+
+/* -----------------------------------------------------------------------
+ * Timers.
+ */
+typedef enum
+{
+       /* One-shot timer. */
+       OSL_EXT_TIMER_MODE_ONCE,
+
+       /* Periodic timer. */
+       OSL_EXT_TIMER_MODE_REPEAT
+
+} osl_ext_timer_mode_t;
+
+/* User registered callback and parameter to invoke when timer expires. */
+typedef void* osl_ext_timer_arg_t;
+typedef void (*osl_ext_timer_callback)(osl_ext_timer_arg_t arg);
+
+
+/* -----------------------------------------------------------------------
+ * Tasks.
+ */
+
+/* Task entry argument. */
+typedef void* osl_ext_task_arg_t;
+
+/* Task entry function. */
+typedef void (*osl_ext_task_entry)(osl_ext_task_arg_t arg);
+
+/* Abstract task priority levels. */
+typedef enum
+{
+       OSL_EXT_TASK_IDLE_PRIORITY,
+       OSL_EXT_TASK_LOW_PRIORITY,
+       OSL_EXT_TASK_LOW_NORMAL_PRIORITY,
+       OSL_EXT_TASK_NORMAL_PRIORITY,
+       OSL_EXT_TASK_HIGH_NORMAL_PRIORITY,
+       OSL_EXT_TASK_HIGHEST_PRIORITY,
+       OSL_EXT_TASK_TIME_CRITICAL_PRIORITY,
+
+       /* This must be last. */
+       OSL_EXT_TASK_NUM_PRIORITES
+} osl_ext_task_priority_t;
+
+
+#ifndef OSL_EXT_DISABLED
+
+/* ---- Variable Externs ------------------------------------------------- */
+/* ---- Function Prototypes ---------------------------------------------- */
+
+
+/* --------------------------------------------------------------------------
+** Semaphore
+*/
+
+/****************************************************************************
+* Function:   osl_ext_sem_create
+*
+* Purpose:    Creates a counting semaphore object, which can subsequently be
+*             used for thread notification.
+*
+* Parameters: name     (in)  Name to assign to the semaphore (must be unique).
+*             init_cnt (in)  Initial count that the semaphore should have.
+*             sem      (out) Newly created semaphore.
+*
+* Returns:    OSL_EXT_SUCCESS if the semaphore was created successfully, or an
+*             error code if the semaphore could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_sem_create(char *name, int init_cnt, osl_ext_sem_t *sem);
+
+/****************************************************************************
+* Function:   osl_ext_sem_delete
+*
+* Purpose:    Destroys a previously created semaphore object.
+*
+* Parameters: sem (mod) Semaphore object to destroy.
+*
+* Returns:    OSL_EXT_SUCCESS if the semaphore was deleted successfully, or an
+*             error code if the semaphore could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_sem_delete(osl_ext_sem_t *sem);
+
+/****************************************************************************
+* Function:   osl_ext_sem_give
+*
+* Purpose:    Increments the count associated with the semaphore. This will
+*             cause one thread blocked on a take to wake up.
+*
+* Parameters: sem (mod) Semaphore object to give.
+*
+* Returns:    OSL_EXT_SUCCESS if the semaphore was given successfully, or an
+*             error code if the semaphore could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_sem_give(osl_ext_sem_t *sem);
+
+/****************************************************************************
+* Function:   osl_ext_sem_take
+*
+* Purpose:    Decrements the count associated with the semaphore. If the count
+*             is less than zero, then the calling task will become blocked until
+*             another thread does a give on the semaphore. This function will only
+*             block the calling thread for timeout_msec milliseconds, before
+*             returning with OSL_EXT_TIMEOUT.
+*
+* Parameters: sem          (mod) Semaphore object to take.
+*             timeout_msec (in)  Number of milliseconds to wait for the
+*                                semaphore to enter a state where it can be
+*                                taken.
+*
+* Returns:    OSL_EXT_SUCCESS if the semaphore was taken successfully, or an
+*             error code if the semaphore could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_sem_take(osl_ext_sem_t *sem, osl_ext_time_ms_t timeout_msec);
+
+
+/* --------------------------------------------------------------------------
+** Mutex
+*/
+
+/****************************************************************************
+* Function:   osl_ext_mutex_create
+*
+* Purpose:    Creates a mutex object, which can subsequently be used to control
+*             mutually exclusion of resources.
+*
+* Parameters: name  (in)  Name to assign to the mutex (must be unique).
+*             mutex (out) Mutex object to initialize.
+*
+* Returns:    OSL_EXT_SUCCESS if the mutex was created successfully, or an
+*             error code if the mutex could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_mutex_create(char *name, osl_ext_mutex_t *mutex);
+
+/****************************************************************************
+* Function:   osl_ext_mutex_delete
+*
+* Purpose:    Destroys a previously created mutex object.
+*
+* Parameters: mutex (mod) Mutex object to destroy.
+*
+* Returns:    OSL_EXT_SUCCESS if the mutex was deleted successfully, or an
+*             error code if the mutex could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_mutex_delete(osl_ext_mutex_t *mutex);
+
+/****************************************************************************
+* Function:   osl_ext_mutex_acquire
+*
+* Purpose:    Acquires the indicated mutual exclusion object. If the object is
+*             currently acquired by another task, then this function will wait
+*             for timeout_msec milli-seconds before returning with OSL_EXT_TIMEOUT.
+*
+* Parameters: mutex        (mod) Mutex object to acquire.
+*             timeout_msec (in)  Number of milliseconds to wait for the mutex.
+*
+* Returns:    OSL_EXT_SUCCESS if the mutex was acquired successfully, or an
+*             error code if the mutex could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_mutex_acquire(osl_ext_mutex_t *mutex, osl_ext_time_ms_t timeout_msec);
+
+/****************************************************************************
+* Function:   osl_ext_mutex_release
+*
+* Purpose:    Releases the indicated mutual exclusion object. This makes it
+*             available for another task to acquire.
+*
+* Parameters: mutex (mod) Mutex object to release.
+*
+* Returns:    OSL_EXT_SUCCESS if the mutex was released successfully, or an
+*             error code if the mutex could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_mutex_release(osl_ext_mutex_t *mutex);
+
+
+/* --------------------------------------------------------------------------
+** Timers
+*/
+
+/****************************************************************************
+* Function:   osl_ext_timer_create
+*
+* Purpose:    Creates a timer object.
+*
+* Parameters: name (in)         Name of timer.
+*             timeout_msec (in) Invoke callback after this number of milliseconds.
+*             mode (in)         One-shot or periodic timer.
+*             func (in)         Callback function to invoke on timer expiry.
+*             arg (in)          Argument to callback function.
+*             timer (out)       Timer object to create.
+*
+* Note: The function callback occurs in interrupt context. The application is
+*       required to provide context switch for the callback if required.
+*
+* Returns:    OSL_EXT_SUCCESS if the timer was created successfully, or an
+*             error code if the timer could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t
+osl_ext_timer_create(char *name, osl_ext_time_ms_t timeout_msec, osl_ext_timer_mode_t mode,
+                 osl_ext_timer_callback func, osl_ext_timer_arg_t arg, osl_ext_timer_t *timer);
+
+/****************************************************************************
+* Function:   osl_ext_timer_delete
+*
+* Purpose:    Destroys a previously created timer object.
+*
+* Parameters: timer (mod) Timer object to destroy.
+*
+* Returns:    OSL_EXT_SUCCESS if the timer was created successfully, or an
+*             error code if the timer could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_timer_delete(osl_ext_timer_t *timer);
+
+/****************************************************************************
+* Function:   osl_ext_timer_start
+*
+* Purpose:    Start a previously created timer object.
+*
+* Parameters: timer (in)        Timer object.
+*             timeout_msec (in) Invoke callback after this number of milliseconds.
+*             mode (in)         One-shot or periodic timer.
+*
+* Returns:    OSL_EXT_SUCCESS if the timer was created successfully, or an
+*             error code if the timer could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t
+osl_ext_timer_start(osl_ext_timer_t *timer,
+       osl_ext_time_ms_t timeout_msec, osl_ext_timer_mode_t mode);
+
+/****************************************************************************
+* Function:   osl_ext_timer_stop
+*
+* Purpose:    Stop a previously created timer object.
+*
+* Parameters: timer (in)        Timer object.
+*
+* Returns:    OSL_EXT_SUCCESS if the timer was created successfully, or an
+*             error code if the timer could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t
+osl_ext_timer_stop(osl_ext_timer_t *timer);
+
+/****************************************************************************
+* Function:   osl_ext_time_get
+*
+* Purpose:    Returns incrementing time counter.
+*
+* Parameters: None.
+*
+* Returns:    Returns incrementing time counter in msec.
+*****************************************************************************
+*/
+osl_ext_time_ms_t osl_ext_time_get(void);
+
+/* --------------------------------------------------------------------------
+** Tasks
+*/
+
+/****************************************************************************
+* Function:   osl_ext_task_create
+*
+* Purpose:    Create a task.
+*
+* Parameters: name       (in)  Pointer to task string descriptor.
+*             stack      (in)  Pointer to stack. NULL to allocate.
+*             stack_size (in)  Stack size - in bytes.
+*             priority   (in)  Abstract task priority.
+*             func       (in)  A pointer to the task entry point function.
+*             arg        (in)  Value passed into task entry point function.
+*             task       (out) Task to create.
+*
+* Returns:    OSL_EXT_SUCCESS if the task was created successfully, or an
+*             error code if the task could not be created.
+*****************************************************************************
+*/
+
+#define osl_ext_task_create(name, stack, stack_size, priority, func, arg, task) \
+          osl_ext_task_create_ex((name), (stack), (stack_size), (priority), 0, (func), \
+          (arg), (task))
+
+osl_ext_status_t osl_ext_task_create_ex(char* name,
+       void *stack, unsigned int stack_size, osl_ext_task_priority_t priority,
+       osl_ext_time_ms_t timslice_msec, osl_ext_task_entry func, osl_ext_task_arg_t arg,
+       osl_ext_task_t *task);
+
+/****************************************************************************
+* Function:   osl_ext_task_delete
+*
+* Purpose:    Destroy a task.
+*
+* Parameters: task (mod) Task to destroy.
+*
+* Returns:    OSL_EXT_SUCCESS if the task was created successfully, or an
+*             error code if the task could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_task_delete(osl_ext_task_t *task);
+
+
+/****************************************************************************
+* Function:   osl_ext_task_is_running
+*
+* Purpose:    Returns current running task.
+*
+* Parameters: None.
+*
+* Returns:    osl_ext_task_t of current running task.
+*****************************************************************************
+*/
+osl_ext_task_t *osl_ext_task_current(void);
+
+
+/****************************************************************************
+* Function:   osl_ext_task_yield
+*
+* Purpose:    Yield the CPU to other tasks of the same priority that are
+*             ready-to-run.
+*
+* Parameters: None.
+*
+* Returns:    OSL_EXT_SUCCESS if successful, else error code.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_task_yield(void);
+
+
+/****************************************************************************
+* Function:   osl_ext_task_enable_stack_check
+*
+* Purpose:    Enable task stack checking.
+*
+* Parameters: None.
+*
+* Returns:    OSL_EXT_SUCCESS if successful, else error code.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_task_enable_stack_check(void);
+
+
+/* --------------------------------------------------------------------------
+** Queue
+*/
+
+/****************************************************************************
+* Function:   osl_ext_queue_create
+*
+* Purpose:    Create a queue.
+*
+* Parameters: name     (in)  Name to assign to the queue (must be unique).
+*             buffer   (in)  Queue buffer. NULL to allocate.
+*             size     (in)  Size of the queue.
+*             queue    (out) Newly created queue.
+*
+* Returns:    OSL_EXT_SUCCESS if the queue was created successfully, or an
+*             error code if the queue could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_queue_create(char *name,
+       void *queue_buffer, unsigned int queue_size,
+       osl_ext_queue_t *queue);
+
+/****************************************************************************
+* Function:   osl_ext_queue_delete
+*
+* Purpose:    Destroys a previously created queue object.
+*
+* Parameters: queue    (mod) Queue object to destroy.
+*
+* Returns:    OSL_EXT_SUCCESS if the queue was deleted successfully, or an
+*             error code if the queue could not be deleteed.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_queue_delete(osl_ext_queue_t *queue);
+
+/****************************************************************************
+* Function:   osl_ext_queue_send
+*
+* Purpose:    Send/add data to the queue. This function will not block the
+*             calling thread if the queue is full.
+*
+* Parameters: queue    (mod) Queue object.
+*             data     (in)  Data pointer to be queued.
+*
+* Returns:    OSL_EXT_SUCCESS if the data was queued successfully, or an
+*             error code if the data could not be queued.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_queue_send(osl_ext_queue_t *queue, void *data);
+
+/****************************************************************************
+* Function:   osl_ext_queue_send_synchronous
+*
+* Purpose:    Send/add data to the queue. This function will block the
+*             calling thread until the data is dequeued.
+*
+* Parameters: queue    (mod) Queue object.
+*             data     (in)  Data pointer to be queued.
+*
+* Returns:    OSL_EXT_SUCCESS if the data was queued successfully, or an
+*             error code if the data could not be queued.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_queue_send_synchronous(osl_ext_queue_t *queue, void *data);
+
+/****************************************************************************
+* Function:   osl_ext_queue_receive
+*
+* Purpose:    Receive/remove data from the queue. This function will only
+*             block the calling thread for timeout_msec milliseconds, before
+*             returning with OSL_EXT_TIMEOUT.
+*
+* Parameters: queue        (mod) Queue object.
+*             timeout_msec (in)  Number of milliseconds to wait for the
+*                                data from the queue.
+*             data         (out) Data pointer received/removed from the queue.
+*
+* Returns:    OSL_EXT_SUCCESS if the data was dequeued successfully, or an
+*             error code if the data could not be dequeued.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_queue_receive(osl_ext_queue_t *queue,
+                 osl_ext_time_ms_t timeout_msec, void **data);
+
+/****************************************************************************
+* Function:   osl_ext_queue_count
+*
+* Purpose:    Returns the number of items in the queue.
+*
+* Parameters: queue        (mod) Queue object.
+*             count        (out) Data pointer received/removed from the queue.
+*
+* Returns:    OSL_EXT_SUCCESS if the count was returned successfully, or an
+*             error code if the count is invalid.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_queue_count(osl_ext_queue_t *queue, int *count);
+
+
+/* --------------------------------------------------------------------------
+** Event
+*/
+
+/****************************************************************************
+* Function:   osl_ext_event_create
+*
+* Purpose:    Creates a event object, which can subsequently be used to
+*             notify and trigger tasks.
+*
+* Parameters: name  (in)  Name to assign to the event (must be unique).
+*             event (out) Event object to initialize.
+*
+* Returns:    OSL_EXT_SUCCESS if the event was created successfully, or an
+*             error code if the event could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_event_create(char *name, osl_ext_event_t *event);
+
+/****************************************************************************
+* Function:   osl_ext_event_delete
+*
+* Purpose:    Destroys a previously created event object.
+*
+* Parameters: event (mod) Event object to destroy.
+*
+* Returns:    OSL_EXT_SUCCESS if the event was created successfully, or an
+*             error code if the event could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_event_delete(osl_ext_event_t *event);
+
+/****************************************************************************
+* Function:   osl_ext_event_get
+*
+* Purpose:    Get event from specified event object.
+*
+* Parameters: event        (mod) Event object to get.
+*             requested    (in)  Requested event to get.
+*             timeout_msec (in)  Number of milliseconds to wait for the event.
+*             event_bits   (out) Event bits retrieved.
+*
+* Returns:    OSL_EXT_SUCCESS if the event was created successfully, or an
+*             error code if the event could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_event_get(osl_ext_event_t *event,
+       osl_ext_event_bits_t requested, osl_ext_time_ms_t timeout_msec,
+       osl_ext_event_bits_t *event_bits);
+
+/****************************************************************************
+* Function:   osl_ext_event_set
+*
+* Purpose:    Set event of specified event object.
+*
+* Parameters: event      (mod) Event object to set.
+*             event_bits (in)  Event bits to set.
+*
+* Returns:    OSL_EXT_SUCCESS if the event was created successfully, or an
+*             error code if the event could not be created.
+*****************************************************************************
+*/
+osl_ext_status_t osl_ext_event_set(osl_ext_event_t *event,
+       osl_ext_event_bits_t event_bits);
+
+
+/* --------------------------------------------------------------------------
+** Interrupt
+*/
+
+/****************************************************************************
+* Function:   osl_ext_interrupt_disable
+*
+* Purpose:    Disable CPU interrupt.
+*
+* Parameters: None.
+*
+* Returns:    The interrupt state before disable for restoring interrupt.
+*****************************************************************************
+*/
+osl_ext_interrupt_state_t osl_ext_interrupt_disable(void);
+
+
+/****************************************************************************
+* Function:   osl_ext_interrupt_restore
+*
+* Purpose:    Restore CPU interrupt state.
+*
+* Parameters: state (in)  Interrupt state to restore returned from
+*                         osl_ext_interrupt_disable().
+*
+* Returns:   None.
+*****************************************************************************
+*/
+void osl_ext_interrupt_restore(osl_ext_interrupt_state_t state);
+
+#else
+
+/* ---- Constants and Types ---------------------------------------------- */
+
+/* Semaphore. */
+#define osl_ext_sem_t
+#define OSL_EXT_SEM_DECL(sem)
+
+/* Mutex. */
+#define osl_ext_mutex_t
+#define OSL_EXT_MUTEX_DECL(mutex)
+
+/* Timer. */
+#define osl_ext_timer_t
+#define OSL_EXT_TIMER_DECL(timer)
+
+/* Task. */
+#define osl_ext_task_t void
+#define OSL_EXT_TASK_DECL(task)
+
+/* Queue. */
+#define osl_ext_queue_t
+#define OSL_EXT_QUEUE_DECL(queue)
+
+/* Event. */
+#define osl_ext_event_t
+#define OSL_EXT_EVENT_DECL(event)
+
+/* ---- Variable Externs ------------------------------------------------- */
+/* ---- Function Prototypes ---------------------------------------------- */
+
+#define osl_ext_sem_create(name, init_cnt, sem)                (OSL_EXT_SUCCESS)
+#define osl_ext_sem_delete(sem)                                (OSL_EXT_SUCCESS)
+#define osl_ext_sem_give(sem)                          (OSL_EXT_SUCCESS)
+#define osl_ext_sem_take(sem, timeout_msec)            (OSL_EXT_SUCCESS)
+
+#define osl_ext_mutex_create(name, mutex)              (OSL_EXT_SUCCESS)
+#define osl_ext_mutex_delete(mutex)                    (OSL_EXT_SUCCESS)
+#define osl_ext_mutex_acquire(mutex, timeout_msec)     (OSL_EXT_SUCCESS)
+#define osl_ext_mutex_release(mutex)                   (OSL_EXT_SUCCESS)
+
+#define osl_ext_timer_create(name, timeout_msec, mode, func, arg, timer) \
+       (OSL_EXT_SUCCESS)
+#define osl_ext_timer_delete(timer)                    (OSL_EXT_SUCCESS)
+#define osl_ext_timer_start(timer, timeout_msec, mode) (OSL_EXT_SUCCESS)
+#define osl_ext_timer_stop(timer)                      (OSL_EXT_SUCCESS)
+#define osl_ext_time_get()                             (0)
+
+#define osl_ext_task_create(name, stack, stack_size, priority, func, arg, task) \
+       (OSL_EXT_SUCCESS)
+#define osl_ext_task_delete(task)                      (OSL_EXT_SUCCESS)
+#define osl_ext_task_current()                         (NULL)
+#define osl_ext_task_yield()                           (OSL_EXT_SUCCESS)
+#define osl_ext_task_enable_stack_check()              (OSL_EXT_SUCCESS)
+
+#define osl_ext_queue_create(name, queue_buffer, queue_size, queue) \
+       (OSL_EXT_SUCCESS)
+#define osl_ext_queue_delete(queue)                    (OSL_EXT_SUCCESS)
+#define osl_ext_queue_send(queue, data)                        (OSL_EXT_SUCCESS)
+#define osl_ext_queue_send_synchronous(queue, data)    (OSL_EXT_SUCCESS)
+#define osl_ext_queue_receive(queue, timeout_msec, data) \
+       (OSL_EXT_SUCCESS)
+#define osl_ext_queue_count(queue, count)              (OSL_EXT_SUCCESS)
+
+#define osl_ext_event_create(name, event)              (OSL_EXT_SUCCESS)
+#define osl_ext_event_delete(event)                    (OSL_EXT_SUCCESS)
+#define osl_ext_event_get(event, requested, timeout_msec, event_bits) \
+       (OSL_EXT_SUCCESS)
+#define osl_ext_event_set(event, event_bits)           (OSL_EXT_SUCCESS)
+
+#define osl_ext_interrupt_disable(void)
+#define osl_ext_interrupt_restore(state)
+
+#endif /* OSL_EXT_DISABLED */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _osl_ext_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/packed_section_end.h b/drivers/net/wireless/bcmdhd_1363/include/packed_section_end.h
new file mode 100644 (file)
index 0000000..4827c70
--- /dev/null
@@ -0,0 +1,63 @@
+/*
+ * Declare directives for structure packing. No padding will be provided
+ * between the members of packed structures, and therefore, there is no
+ * guarantee that structure members will be aligned.
+ *
+ * Declaring packed structures is compiler specific. In order to handle all
+ * cases, packed structures should be delared as:
+ *
+ * #include <packed_section_start.h>
+ *
+ * typedef BWL_PRE_PACKED_STRUCT struct foobar_t {
+ *    some_struct_members;
+ * } BWL_POST_PACKED_STRUCT foobar_t;
+ *
+ * #include <packed_section_end.h>
+ *
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: packed_section_end.h 514727 2014-11-12 03:02:48Z $
+ */
+
+
+/* Error check - BWL_PACKED_SECTION is defined in packed_section_start.h
+ * and undefined in packed_section_end.h. If it is NOT defined at this
+ * point, then there is a missing include of packed_section_start.h.
+ */
+#ifdef BWL_PACKED_SECTION
+       #undef BWL_PACKED_SECTION
+#else
+       #error "BWL_PACKED_SECTION is NOT defined!"
+#endif
+
+
+
+
+/* Compiler-specific directives for structure packing are declared in
+ * packed_section_start.h. This marks the end of the structure packing section,
+ * so, undef them here.
+ */
+#undef BWL_PRE_PACKED_STRUCT
+#undef BWL_POST_PACKED_STRUCT
diff --git a/drivers/net/wireless/bcmdhd_1363/include/packed_section_start.h b/drivers/net/wireless/bcmdhd_1363/include/packed_section_start.h
new file mode 100644 (file)
index 0000000..9beb45d
--- /dev/null
@@ -0,0 +1,67 @@
+/*
+ * Declare directives for structure packing. No padding will be provided
+ * between the members of packed structures, and therefore, there is no
+ * guarantee that structure members will be aligned.
+ *
+ * Declaring packed structures is compiler specific. In order to handle all
+ * cases, packed structures should be delared as:
+ *
+ * #include <packed_section_start.h>
+ *
+ * typedef BWL_PRE_PACKED_STRUCT struct foobar_t {
+ *    some_struct_members;
+ * } BWL_POST_PACKED_STRUCT foobar_t;
+ *
+ * #include <packed_section_end.h>
+ *
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: packed_section_start.h 514727 2014-11-12 03:02:48Z $
+ */
+
+
+/* Error check - BWL_PACKED_SECTION is defined in packed_section_start.h
+ * and undefined in packed_section_end.h. If it is already defined at this
+ * point, then there is a missing include of packed_section_end.h.
+ */
+#ifdef BWL_PACKED_SECTION
+       #error "BWL_PACKED_SECTION is already defined!"
+#else
+       #define BWL_PACKED_SECTION
+#endif
+
+
+
+
+/* Declare compiler-specific directives for structure packing. */
+#if defined(__GNUC__) || defined(__lint)
+       #define BWL_PRE_PACKED_STRUCT
+       #define BWL_POST_PACKED_STRUCT  __attribute__ ((packed))
+#elif defined(__CC_ARM)
+       #define BWL_PRE_PACKED_STRUCT   __packed
+       #define BWL_POST_PACKED_STRUCT
+#else
+       #error "Unknown compiler!"
+#endif
diff --git a/drivers/net/wireless/bcmdhd_1363/include/pcicfg.h b/drivers/net/wireless/bcmdhd_1363/include/pcicfg.h
new file mode 100644 (file)
index 0000000..e467203
--- /dev/null
@@ -0,0 +1,260 @@
+/*
+ * pcicfg.h: PCI configuration constants and structures.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: pcicfg.h 514727 2014-11-12 03:02:48Z $
+ */
+
+#ifndef        _h_pcicfg_
+#define        _h_pcicfg_
+
+
+/* pci config status reg has a bit to indicate that capability ptr is present */
+
+#define PCI_CAPPTR_PRESENT     0x0010
+
+/* A structure for the config registers is nice, but in most
+ * systems the config space is not memory mapped, so we need
+ * field offsetts. :-(
+ */
+#define        PCI_CFG_VID             0
+#define        PCI_CFG_DID             2
+#define        PCI_CFG_CMD             4
+#define        PCI_CFG_STAT            6
+#define        PCI_CFG_REV             8
+#define        PCI_CFG_PROGIF          9
+#define        PCI_CFG_SUBCL           0xa
+#define        PCI_CFG_BASECL          0xb
+#define        PCI_CFG_CLSZ            0xc
+#define        PCI_CFG_LATTIM          0xd
+#define        PCI_CFG_HDR             0xe
+#define        PCI_CFG_BIST            0xf
+#define        PCI_CFG_BAR0            0x10
+#define        PCI_CFG_BAR1            0x14
+#define        PCI_CFG_BAR2            0x18
+#define        PCI_CFG_BAR3            0x1c
+#define        PCI_CFG_BAR4            0x20
+#define        PCI_CFG_BAR5            0x24
+#define        PCI_CFG_CIS             0x28
+#define        PCI_CFG_SVID            0x2c
+#define        PCI_CFG_SSID            0x2e
+#define        PCI_CFG_ROMBAR          0x30
+#define PCI_CFG_CAPPTR         0x34
+#define        PCI_CFG_INT             0x3c
+#define        PCI_CFG_PIN             0x3d
+#define        PCI_CFG_MINGNT          0x3e
+#define        PCI_CFG_MAXLAT          0x3f
+#define        PCI_CFG_DEVCTRL         0xd8
+
+
+/* PCI CAPABILITY DEFINES */
+#define PCI_CAP_POWERMGMTCAP_ID                0x01
+#define PCI_CAP_MSICAP_ID              0x05
+#define PCI_CAP_VENDSPEC_ID            0x09
+#define PCI_CAP_PCIECAP_ID             0x10
+
+/* Data structure to define the Message Signalled Interrupt facility
+ * Valid for PCI and PCIE configurations
+ */
+typedef struct _pciconfig_cap_msi {
+       uint8   capID;
+       uint8   nextptr;
+       uint16  msgctrl;
+       uint32  msgaddr;
+} pciconfig_cap_msi;
+#define MSI_ENABLE     0x1             /* bit 0 of msgctrl */
+
+/* Data structure to define the Power managment facility
+ * Valid for PCI and PCIE configurations
+ */
+typedef struct _pciconfig_cap_pwrmgmt {
+       uint8   capID;
+       uint8   nextptr;
+       uint16  pme_cap;
+       uint16  pme_sts_ctrl;
+       uint8   pme_bridge_ext;
+       uint8   data;
+} pciconfig_cap_pwrmgmt;
+
+#define PME_CAP_PM_STATES (0x1f << 27) /* Bits 31:27 states that can generate PME */
+#define PME_CSR_OFFSET     0x4         /* 4-bytes offset */
+#define PME_CSR_PME_EN   (1 << 8)      /* Bit 8 Enable generating of PME */
+#define PME_CSR_PME_STAT  (1 << 15)    /* Bit 15 PME got asserted */
+
+/* Data structure to define the PCIE capability */
+typedef struct _pciconfig_cap_pcie {
+       uint8   capID;
+       uint8   nextptr;
+       uint16  pcie_cap;
+       uint32  dev_cap;
+       uint16  dev_ctrl;
+       uint16  dev_status;
+       uint32  link_cap;
+       uint16  link_ctrl;
+       uint16  link_status;
+       uint32  slot_cap;
+       uint16  slot_ctrl;
+       uint16  slot_status;
+       uint16  root_ctrl;
+       uint16  root_cap;
+       uint32  root_status;
+} pciconfig_cap_pcie;
+
+/* PCIE Enhanced CAPABILITY DEFINES */
+#define PCIE_EXTCFG_OFFSET     0x100
+#define PCIE_ADVERRREP_CAPID   0x0001
+#define PCIE_VC_CAPID          0x0002
+#define PCIE_DEVSNUM_CAPID     0x0003
+#define PCIE_PWRBUDGET_CAPID   0x0004
+
+/* PCIE Extended configuration */
+#define PCIE_ADV_CORR_ERR_MASK 0x114
+#define CORR_ERR_RE    (1 << 0) /* Receiver  */
+#define CORR_ERR_BT    (1 << 6) /* Bad TLP  */
+#define CORR_ERR_BD    (1 << 7) /* Bad DLLP */
+#define CORR_ERR_RR    (1 << 8) /* REPLAY_NUM rollover */
+#define CORR_ERR_RT    (1 << 12) /* Reply timer timeout */
+#define ALL_CORR_ERRORS (CORR_ERR_RE | CORR_ERR_BT | CORR_ERR_BD | \
+                        CORR_ERR_RR | CORR_ERR_RT)
+
+/* PCIE Root Control Register bits (Host mode only) */
+#define        PCIE_RC_CORR_SERR_EN            0x0001
+#define        PCIE_RC_NONFATAL_SERR_EN        0x0002
+#define        PCIE_RC_FATAL_SERR_EN           0x0004
+#define        PCIE_RC_PME_INT_EN              0x0008
+#define        PCIE_RC_CRS_EN                  0x0010
+
+/* PCIE Root Capability Register bits (Host mode only) */
+#define        PCIE_RC_CRS_VISIBILITY          0x0001
+
+/* Header to define the PCIE specific capabilities in the extended config space */
+typedef struct _pcie_enhanced_caphdr {
+       uint16  capID;
+       uint16  cap_ver : 4;
+       uint16  next_ptr : 12;
+} pcie_enhanced_caphdr;
+
+
+#define        PCI_BAR0_WIN            0x80    /* backplane addres space accessed by BAR0 */
+#define        PCI_BAR1_WIN            0x84    /* backplane addres space accessed by BAR1 */
+#define        PCI_SPROM_CONTROL       0x88    /* sprom property control */
+#define        PCI_BAR1_CONTROL        0x8c    /* BAR1 region burst control */
+#define        PCI_INT_STATUS          0x90    /* PCI and other cores interrupts */
+#define        PCI_INT_MASK            0x94    /* mask of PCI and other cores interrupts */
+#define PCI_TO_SB_MB           0x98    /* signal backplane interrupts */
+#define PCI_BACKPLANE_ADDR     0xa0    /* address an arbitrary location on the system backplane */
+#define PCI_BACKPLANE_DATA     0xa4    /* data at the location specified by above address */
+#define        PCI_CLK_CTL_ST          0xa8    /* pci config space clock control/status (>=rev14) */
+#define        PCI_BAR0_WIN2           0xac    /* backplane addres space accessed by second 4KB of BAR0 */
+#define        PCI_GPIO_IN             0xb0    /* pci config space gpio input (>=rev3) */
+#define        PCI_GPIO_OUT            0xb4    /* pci config space gpio output (>=rev3) */
+#define        PCI_GPIO_OUTEN          0xb8    /* pci config space gpio output enable (>=rev3) */
+#define        PCI_L1SS_CTRL2          0x24c   /* The L1 PM Substates Control register */
+
+/* Private Registers */
+#define        PCI_STAT_CTRL           0xa80
+#define        PCI_L0_EVENTCNT         0xa84
+#define        PCI_L0_STATETMR         0xa88
+#define        PCI_L1_EVENTCNT         0xa8c
+#define        PCI_L1_STATETMR         0xa90
+#define        PCI_L1_1_EVENTCNT       0xa94
+#define        PCI_L1_1_STATETMR       0xa98
+#define        PCI_L1_2_EVENTCNT       0xa9c
+#define        PCI_L1_2_STATETMR       0xaa0
+#define        PCI_L2_EVENTCNT         0xaa4
+#define        PCI_L2_STATETMR         0xaa8
+
+#define        PCI_PMCR_REFUP          0x1814  /* Trefup time */
+#define        PCI_PMCR_REFUP_EXT      0x1818  /* Trefup extend Max */
+#define PCI_TPOWER_SCALE_MASK 0x3
+#define PCI_TPOWER_SCALE_SHIFT 3 /* 0:1 is scale and 2 is rsvd */
+
+
+#define        PCI_BAR0_SHADOW_OFFSET  (2 * 1024)      /* bar0 + 2K accesses sprom shadow (in pci core) */
+#define        PCI_BAR0_SPROM_OFFSET   (4 * 1024)      /* bar0 + 4K accesses external sprom */
+#define        PCI_BAR0_PCIREGS_OFFSET (6 * 1024)      /* bar0 + 6K accesses pci core registers */
+#define        PCI_BAR0_PCISBR_OFFSET  (4 * 1024)      /* pci core SB registers are at the end of the
+                                                * 8KB window, so their address is the "regular"
+                                                * address plus 4K
+                                                */
+/*
+ * PCIE GEN2 changed some of the above locations for
+ * Bar0WrapperBase, SecondaryBAR0Window and SecondaryBAR0WrapperBase
+ * BAR0 maps 32K of register space
+*/
+#define PCIE2_BAR0_WIN2                0x70 /* backplane addres space accessed by second 4KB of BAR0 */
+#define PCIE2_BAR0_CORE2_WIN   0x74 /* backplane addres space accessed by second 4KB of BAR0 */
+#define PCIE2_BAR0_CORE2_WIN2  0x78 /* backplane addres space accessed by second 4KB of BAR0 */
+
+#define PCI_BAR0_WINSZ         (16 * 1024)     /* bar0 window size Match with corerev 13 */
+/* On pci corerev >= 13 and all pcie, the bar0 is now 16KB and it maps: */
+#define        PCI_16KB0_PCIREGS_OFFSET (8 * 1024)     /* bar0 + 8K accesses pci/pcie core registers */
+#define        PCI_16KB0_CCREGS_OFFSET (12 * 1024)     /* bar0 + 12K accesses chipc core registers */
+#define PCI_16KBB0_WINSZ       (16 * 1024)     /* bar0 window size */
+#define PCI_SECOND_BAR0_OFFSET (16 * 1024)     /* secondary  bar 0 window */
+
+
+/* Header types */
+#define        PCI_HEADER_MULTI        0x80
+#define        PCI_HEADER_MASK         0x7f
+typedef enum {
+       PCI_HEADER_NORMAL,
+       PCI_HEADER_BRIDGE,
+       PCI_HEADER_CARDBUS
+} pci_header_types;
+
+#define PCI_CONFIG_SPACE_SIZE  256
+
+#define DWORD_ALIGN(x)  (x & ~(0x03))
+#define BYTE_POS(x) (x & 0x3)
+#define WORD_POS(x) (x & 0x1)
+
+#define BYTE_SHIFT(x)  (8 * BYTE_POS(x))
+#define WORD_SHIFT(x)  (16 * WORD_POS(x))
+
+#define BYTE_VAL(a, x) ((a >> BYTE_SHIFT(x)) & 0xFF)
+#define WORD_VAL(a, x) ((a >> WORD_SHIFT(x)) & 0xFFFF)
+
+#define read_pci_cfg_byte(a) \
+       (BYTE_VAL(OSL_PCI_READ_CONFIG(osh, DWORD_ALIGN(a), 4), a) & 0xff)
+
+#define read_pci_cfg_word(a) \
+       (WORD_VAL(OSL_PCI_READ_CONFIG(osh, DWORD_ALIGN(a), 4), a) & 0xffff)
+
+#define write_pci_cfg_byte(a, val) do { \
+       uint32 tmpval; \
+       tmpval = (OSL_PCI_READ_CONFIG(osh, DWORD_ALIGN(a), 4) & ~0xFF << BYTE_POS(a)) | \
+               val << BYTE_POS(a); \
+       OSL_PCI_WRITE_CONFIG(osh, DWORD_ALIGN(a), 4, tmpval); \
+       } while (0)
+
+#define write_pci_cfg_word(a, val) do { \
+       uint32 tmpval; \
+       tmpval = (OSL_PCI_READ_CONFIG(osh, DWORD_ALIGN(a), 4) & ~0xFFFF << WORD_POS(a)) | \
+               val << WORD_POS(a); \
+       OSL_PCI_WRITE_CONFIG(osh, DWORD_ALIGN(a), 4, tmpval); \
+       } while (0)
+
+#endif /* _h_pcicfg_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/pcie_core.h b/drivers/net/wireless/bcmdhd_1363/include/pcie_core.h
new file mode 100644 (file)
index 0000000..5ea5d75
--- /dev/null
@@ -0,0 +1,652 @@
+/*
+ * BCM43XX PCIE core hardware definitions.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: pcie_core.h 514727 2014-11-12 03:02:48Z $
+ */
+#ifndef        _PCIE_CORE_H
+#define        _PCIE_CORE_H
+
+#include <sbhnddma.h>
+#include <siutils.h>
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define        _PADLINE(line)  pad ## line
+#define        _XSTR(line)     _PADLINE(line)
+#define        PAD             _XSTR(__LINE__)
+#endif
+
+/* PCIE Enumeration space offsets */
+#define  PCIE_CORE_CONFIG_OFFSET       0x0
+#define  PCIE_FUNC0_CONFIG_OFFSET      0x400
+#define  PCIE_FUNC1_CONFIG_OFFSET      0x500
+#define  PCIE_FUNC2_CONFIG_OFFSET      0x600
+#define  PCIE_FUNC3_CONFIG_OFFSET      0x700
+#define  PCIE_SPROM_SHADOW_OFFSET      0x800
+#define  PCIE_SBCONFIG_OFFSET          0xE00
+
+
+#define PCIEDEV_MAX_DMAS                       4
+
+/* PCIE Bar0 Address Mapping. Each function maps 16KB config space */
+#define PCIE_DEV_BAR0_SIZE             0x4000
+#define PCIE_BAR0_WINMAPCORE_OFFSET    0x0
+#define PCIE_BAR0_EXTSPROM_OFFSET      0x1000
+#define PCIE_BAR0_PCIECORE_OFFSET      0x2000
+#define PCIE_BAR0_CCCOREREG_OFFSET     0x3000
+
+/* different register spaces to access thr'u pcie indirect access */
+#define PCIE_CONFIGREGS        1               /* Access to config space */
+#define PCIE_PCIEREGS          2               /* Access to pcie registers */
+
+/* dma regs to control the flow between host2dev and dev2host  */
+typedef struct pcie_devdmaregs {
+       dma64regs_t     tx;
+       uint32          PAD[2];
+       dma64regs_t     rx;
+       uint32          PAD[2];
+} pcie_devdmaregs_t;
+
+#define PCIE_DB_HOST2DEV_0             0x1
+#define PCIE_DB_HOST2DEV_1             0x2
+#define PCIE_DB_DEV2HOST_0             0x3
+#define PCIE_DB_DEV2HOST_1             0x4
+
+/* door bell register sets */
+typedef struct pcie_doorbell {
+       uint32          host2dev_0;
+       uint32          host2dev_1;
+       uint32          dev2host_0;
+       uint32          dev2host_1;
+} pcie_doorbell_t;
+
+/* SB side: PCIE core and host control registers */
+typedef struct sbpcieregs {
+       uint32 control;         /* host mode only */
+       uint32 iocstatus;       /* PCIE2: iostatus */
+       uint32 PAD[1];
+       uint32 biststatus;      /* bist Status: 0x00C */
+       uint32 gpiosel;         /* PCIE gpio sel: 0x010 */
+       uint32 gpioouten;       /* PCIE gpio outen: 0x14 */
+       uint32 PAD[2];
+       uint32 intstatus;       /* Interrupt status: 0x20 */
+       uint32 intmask;         /* Interrupt mask: 0x24 */
+       uint32 sbtopcimailbox;  /* sb to pcie mailbox: 0x028 */
+       uint32 obffcontrol;     /* PCIE2: 0x2C */
+       uint32 obffintstatus;   /* PCIE2: 0x30 */
+       uint32 obffdatastatus;  /* PCIE2: 0x34 */
+       uint32 PAD[2];
+       uint32 errlog;          /* PCIE2: 0x40 */
+       uint32 errlogaddr;      /* PCIE2: 0x44 */
+       uint32 mailboxint;      /* PCIE2: 0x48 */
+       uint32 mailboxintmsk; /* PCIE2: 0x4c */
+       uint32 ltrspacing;      /* PCIE2: 0x50 */
+       uint32 ltrhysteresiscnt;        /* PCIE2: 0x54 */
+       uint32 PAD[42];
+
+       uint32 sbtopcie0;       /* sb to pcie translation 0: 0x100 */
+       uint32 sbtopcie1;       /* sb to pcie translation 1: 0x104 */
+       uint32 sbtopcie2;       /* sb to pcie translation 2: 0x108 */
+       uint32 PAD[5];
+
+       /* pcie core supports in direct access to config space */
+       uint32 configaddr;      /* pcie config space access: Address field: 0x120 */
+       uint32 configdata;      /* pcie config space access: Data field: 0x124 */
+       union {
+               struct {
+                       /* mdio access to serdes */
+                       uint32 mdiocontrol;     /* controls the mdio access: 0x128 */
+                       uint32 mdiodata;        /* Data to the mdio access: 0x12c */
+                       /* pcie protocol phy/dllp/tlp register indirect access mechanism */
+                       uint32 pcieindaddr; /* indirect access to the internal register: 0x130 */
+                       uint32 pcieinddata;     /* Data to/from the internal regsiter: 0x134 */
+                       uint32 clkreqenctrl;    /* >= rev 6, Clkreq rdma control : 0x138 */
+                       uint32 PAD[177];
+               } pcie1;
+               struct {
+                       /* mdio access to serdes */
+                       uint32 mdiocontrol;     /* controls the mdio access: 0x128 */
+                       uint32 mdiowrdata;      /* write data to mdio 0x12C */
+                       uint32 mdiorddata;      /* read data to mdio 0x130 */
+                       uint32  PAD[3];         /* 0x134-0x138-0x13c */
+                       /* door bell registers available from gen2 rev5 onwards */
+                       pcie_doorbell_t    dbls[PCIEDEV_MAX_DMAS]; /* 0x140 - 0x17F */
+                       uint32  dataintf;       /* 0x180 */
+                       uint32  PAD[1];         /* 0x184 */
+                       uint32  d2h_intrlazy_0; /* 0x188 */
+                       uint32  h2d_intrlazy_0; /* 0x18c */
+                       uint32  h2d_intstat_0;  /* 0x190 */
+                       uint32  h2d_intmask_0;  /* 0x194 */
+                       uint32  d2h_intstat_0;  /* 0x198 */
+                       uint32  d2h_intmask_0;  /* 0x19c */
+                       uint32  ltr_state;      /* 0x1A0 */
+                       uint32  pwr_int_status; /* 0x1A4 */
+                       uint32  pwr_int_mask;   /* 0x1A8 */
+                       uint32  PAD[13];        /* 0x1AC - 0x1DF */
+                       uint32  clk_ctl_st;     /* 0x1E0 */
+                       uint32  PAD[7];         /* 0x1E4 - 0x1FF */
+                       pcie_devdmaregs_t  h2d0_dmaregs; /* 0x200 - 0x23c */
+                       pcie_devdmaregs_t  d2h0_dmaregs; /* 0x240 - 0x27c */
+                       pcie_devdmaregs_t  h2d1_dmaregs; /* 0x280 - 0x2bc */
+                       pcie_devdmaregs_t  d2h1_dmaregs; /* 0x2c0 - 0x2fc */
+                       pcie_devdmaregs_t  h2d2_dmaregs; /* 0x300 - 0x33c */
+                       pcie_devdmaregs_t  d2h2_dmaregs; /* 0x340 - 0x37c */
+                       pcie_devdmaregs_t  h2d3_dmaregs; /* 0x380 - 0x3bc */
+                       pcie_devdmaregs_t  d2h3_dmaregs; /* 0x3c0 - 0x3fc */
+               } pcie2;
+       } u;
+       uint32 pciecfg[4][64];  /* 0x400 - 0x7FF, PCIE Cfg Space */
+       uint16 sprom[64];       /* SPROM shadow Area */
+} sbpcieregs_t;
+
+/* PCI control */
+#define PCIE_RST_OE    0x01    /* When set, drives PCI_RESET out to pin */
+#define PCIE_RST       0x02    /* Value driven out to pin */
+#define PCIE_SPERST    0x04    /* SurvivePeRst */
+#define PCIE_DISABLE_L1CLK_GATING      0x10
+#define PCIE_DLYPERST  0x100   /* Delay PeRst to CoE Core */
+#define PCIE_DISSPROMLD        0x200   /* DisableSpromLoadOnPerst */
+#define PCIE_WakeModeL2        0x1000  /* Wake on L2 */
+#define PCIE_PipeIddqDisable0  0x8000  /* Disable assertion of pcie_pipe_iddq during L1.2 and L2 */
+#define PCIE_PipeIddqDisable1  0x10000 /* Disable assertion of pcie_pipe_iddq during L2 */
+
+#define        PCIE_CFGADDR    0x120   /* offsetof(configaddr) */
+#define        PCIE_CFGDATA    0x124   /* offsetof(configdata) */
+
+/* Interrupt status/mask */
+#define PCIE_INTA      0x01    /* PCIE INTA message is received */
+#define PCIE_INTB      0x02    /* PCIE INTB message is received */
+#define PCIE_INTFATAL  0x04    /* PCIE INTFATAL message is received */
+#define PCIE_INTNFATAL 0x08    /* PCIE INTNONFATAL message is received */
+#define PCIE_INTCORR   0x10    /* PCIE INTCORR message is received */
+#define PCIE_INTPME    0x20    /* PCIE INTPME message is received */
+#define PCIE_PERST     0x40    /* PCIE Reset Interrupt */
+
+#define PCIE_INT_MB_FN0_0 0x0100 /* PCIE to SB Mailbox int Fn0.0 is received */
+#define PCIE_INT_MB_FN0_1 0x0200 /* PCIE to SB Mailbox int Fn0.1 is received */
+#define PCIE_INT_MB_FN1_0 0x0400 /* PCIE to SB Mailbox int Fn1.0 is received */
+#define PCIE_INT_MB_FN1_1 0x0800 /* PCIE to SB Mailbox int Fn1.1 is received */
+#define PCIE_INT_MB_FN2_0 0x1000 /* PCIE to SB Mailbox int Fn2.0 is received */
+#define PCIE_INT_MB_FN2_1 0x2000 /* PCIE to SB Mailbox int Fn2.1 is received */
+#define PCIE_INT_MB_FN3_0 0x4000 /* PCIE to SB Mailbox int Fn3.0 is received */
+#define PCIE_INT_MB_FN3_1 0x8000 /* PCIE to SB Mailbox int Fn3.1 is received */
+
+/* PCIE MailboxInt/MailboxIntMask register */
+#define PCIE_MB_TOSB_FN0_0     0x0001 /* write to assert PCIEtoSB Mailbox interrupt */
+#define PCIE_MB_TOSB_FN0_1     0x0002
+#define PCIE_MB_TOSB_FN1_0     0x0004
+#define PCIE_MB_TOSB_FN1_1     0x0008
+#define PCIE_MB_TOSB_FN2_0     0x0010
+#define PCIE_MB_TOSB_FN2_1     0x0020
+#define PCIE_MB_TOSB_FN3_0     0x0040
+#define PCIE_MB_TOSB_FN3_1     0x0080
+#define PCIE_MB_TOPCIE_FN0_0   0x0100 /* int status/mask for SBtoPCIE Mailbox interrupts */
+#define PCIE_MB_TOPCIE_FN0_1   0x0200
+#define PCIE_MB_TOPCIE_FN1_0   0x0400
+#define PCIE_MB_TOPCIE_FN1_1   0x0800
+#define PCIE_MB_TOPCIE_FN2_0   0x1000
+#define PCIE_MB_TOPCIE_FN2_1   0x2000
+#define PCIE_MB_TOPCIE_FN3_0   0x4000
+#define PCIE_MB_TOPCIE_FN3_1   0x8000
+#define        PCIE_MB_TOPCIE_D2H0_DB0 0x10000
+#define        PCIE_MB_TOPCIE_D2H0_DB1 0x20000
+#define        PCIE_MB_TOPCIE_D2H1_DB0 0x40000
+#define        PCIE_MB_TOPCIE_D2H1_DB1 0x80000
+#define        PCIE_MB_TOPCIE_D2H2_DB0 0x100000
+#define        PCIE_MB_TOPCIE_D2H2_DB1 0x200000
+#define        PCIE_MB_TOPCIE_D2H3_DB0 0x400000
+#define        PCIE_MB_TOPCIE_D2H3_DB1 0x800000
+
+#define PCIE_MB_D2H_MB_MASK            \
+       (PCIE_MB_TOPCIE_D2H0_DB0 | PCIE_MB_TOPCIE_D2H0_DB1 |    \
+       PCIE_MB_TOPCIE_D2H1_DB0  | PCIE_MB_TOPCIE_D2H1_DB1 |    \
+       PCIE_MB_TOPCIE_D2H2_DB0  | PCIE_MB_TOPCIE_D2H2_DB1 |    \
+       PCIE_MB_TOPCIE_D2H3_DB0  | PCIE_MB_TOPCIE_D2H3_DB1)
+
+/* SB to PCIE translation masks */
+#define SBTOPCIE0_MASK 0xfc000000
+#define SBTOPCIE1_MASK 0xfc000000
+#define SBTOPCIE2_MASK 0xc0000000
+
+/* Access type bits (0:1) */
+#define SBTOPCIE_MEM   0
+#define SBTOPCIE_IO    1
+#define SBTOPCIE_CFG0  2
+#define SBTOPCIE_CFG1  3
+
+/* Prefetch enable bit 2 */
+#define SBTOPCIE_PF            4
+
+/* Write Burst enable for memory write bit 3 */
+#define SBTOPCIE_WR_BURST      8
+
+/* config access */
+#define CONFIGADDR_FUNC_MASK   0x7000
+#define CONFIGADDR_FUNC_SHF    12
+#define CONFIGADDR_REG_MASK    0x0FFF
+#define CONFIGADDR_REG_SHF     0
+
+#define PCIE_CONFIG_INDADDR(f, r)      ((((f) & CONFIGADDR_FUNC_MASK) << CONFIGADDR_FUNC_SHF) | \
+                                        (((r) & CONFIGADDR_REG_MASK) << CONFIGADDR_REG_SHF))
+
+/* PCIE protocol regs Indirect Address */
+#define PCIEADDR_PROT_MASK     0x300
+#define PCIEADDR_PROT_SHF      8
+#define PCIEADDR_PL_TLP                0
+#define PCIEADDR_PL_DLLP       1
+#define PCIEADDR_PL_PLP                2
+
+/* PCIE protocol PHY diagnostic registers */
+#define        PCIE_PLP_MODEREG                0x200 /* Mode */
+#define        PCIE_PLP_STATUSREG              0x204 /* Status */
+#define PCIE_PLP_LTSSMCTRLREG          0x208 /* LTSSM control */
+#define PCIE_PLP_LTLINKNUMREG          0x20c /* Link Training Link number */
+#define PCIE_PLP_LTLANENUMREG          0x210 /* Link Training Lane number */
+#define PCIE_PLP_LTNFTSREG             0x214 /* Link Training N_FTS */
+#define PCIE_PLP_ATTNREG               0x218 /* Attention */
+#define PCIE_PLP_ATTNMASKREG           0x21C /* Attention Mask */
+#define PCIE_PLP_RXERRCTR              0x220 /* Rx Error */
+#define PCIE_PLP_RXFRMERRCTR           0x224 /* Rx Framing Error */
+#define PCIE_PLP_RXERRTHRESHREG                0x228 /* Rx Error threshold */
+#define PCIE_PLP_TESTCTRLREG           0x22C /* Test Control reg */
+#define PCIE_PLP_SERDESCTRLOVRDREG     0x230 /* SERDES Control Override */
+#define PCIE_PLP_TIMINGOVRDREG         0x234 /* Timing param override */
+#define PCIE_PLP_RXTXSMDIAGREG         0x238 /* RXTX State Machine Diag */
+#define PCIE_PLP_LTSSMDIAGREG          0x23C /* LTSSM State Machine Diag */
+
+/* PCIE protocol DLLP diagnostic registers */
+#define PCIE_DLLP_LCREG                        0x100 /* Link Control */
+#define PCIE_DLLP_LSREG                        0x104 /* Link Status */
+#define PCIE_DLLP_LAREG                        0x108 /* Link Attention */
+#define PCIE_DLLP_LAMASKREG            0x10C /* Link Attention Mask */
+#define PCIE_DLLP_NEXTTXSEQNUMREG      0x110 /* Next Tx Seq Num */
+#define PCIE_DLLP_ACKEDTXSEQNUMREG     0x114 /* Acked Tx Seq Num */
+#define PCIE_DLLP_PURGEDTXSEQNUMREG    0x118 /* Purged Tx Seq Num */
+#define PCIE_DLLP_RXSEQNUMREG          0x11C /* Rx Sequence Number */
+#define PCIE_DLLP_LRREG                        0x120 /* Link Replay */
+#define PCIE_DLLP_LACKTOREG            0x124 /* Link Ack Timeout */
+#define PCIE_DLLP_PMTHRESHREG          0x128 /* Power Management Threshold */
+#define PCIE_DLLP_RTRYWPREG            0x12C /* Retry buffer write ptr */
+#define PCIE_DLLP_RTRYRPREG            0x130 /* Retry buffer Read ptr */
+#define PCIE_DLLP_RTRYPPREG            0x134 /* Retry buffer Purged ptr */
+#define PCIE_DLLP_RTRRWREG             0x138 /* Retry buffer Read/Write */
+#define PCIE_DLLP_ECTHRESHREG          0x13C /* Error Count Threshold */
+#define PCIE_DLLP_TLPERRCTRREG         0x140 /* TLP Error Counter */
+#define PCIE_DLLP_ERRCTRREG            0x144 /* Error Counter */
+#define PCIE_DLLP_NAKRXCTRREG          0x148 /* NAK Received Counter */
+#define PCIE_DLLP_TESTREG              0x14C /* Test */
+#define PCIE_DLLP_PKTBIST              0x150 /* Packet BIST */
+#define PCIE_DLLP_PCIE11               0x154 /* DLLP PCIE 1.1 reg */
+
+#define PCIE_DLLP_LSREG_LINKUP         (1 << 16)
+
+/* PCIE protocol TLP diagnostic registers */
+#define PCIE_TLP_CONFIGREG             0x000 /* Configuration */
+#define PCIE_TLP_WORKAROUNDSREG                0x004 /* TLP Workarounds */
+#define PCIE_TLP_WRDMAUPPER            0x010 /* Write DMA Upper Address */
+#define PCIE_TLP_WRDMALOWER            0x014 /* Write DMA Lower Address */
+#define PCIE_TLP_WRDMAREQ_LBEREG       0x018 /* Write DMA Len/ByteEn Req */
+#define PCIE_TLP_RDDMAUPPER            0x01C /* Read DMA Upper Address */
+#define PCIE_TLP_RDDMALOWER            0x020 /* Read DMA Lower Address */
+#define PCIE_TLP_RDDMALENREG           0x024 /* Read DMA Len Req */
+#define PCIE_TLP_MSIDMAUPPER           0x028 /* MSI DMA Upper Address */
+#define PCIE_TLP_MSIDMALOWER           0x02C /* MSI DMA Lower Address */
+#define PCIE_TLP_MSIDMALENREG          0x030 /* MSI DMA Len Req */
+#define PCIE_TLP_SLVREQLENREG          0x034 /* Slave Request Len */
+#define PCIE_TLP_FCINPUTSREQ           0x038 /* Flow Control Inputs */
+#define PCIE_TLP_TXSMGRSREQ            0x03C /* Tx StateMachine and Gated Req */
+#define PCIE_TLP_ADRACKCNTARBLEN       0x040 /* Address Ack XferCnt and ARB Len */
+#define PCIE_TLP_DMACPLHDR0            0x044 /* DMA Completion Hdr 0 */
+#define PCIE_TLP_DMACPLHDR1            0x048 /* DMA Completion Hdr 1 */
+#define PCIE_TLP_DMACPLHDR2            0x04C /* DMA Completion Hdr 2 */
+#define PCIE_TLP_DMACPLMISC0           0x050 /* DMA Completion Misc0 */
+#define PCIE_TLP_DMACPLMISC1           0x054 /* DMA Completion Misc1 */
+#define PCIE_TLP_DMACPLMISC2           0x058 /* DMA Completion Misc2 */
+#define PCIE_TLP_SPTCTRLLEN            0x05C /* Split Controller Req len */
+#define PCIE_TLP_SPTCTRLMSIC0          0x060 /* Split Controller Misc 0 */
+#define PCIE_TLP_SPTCTRLMSIC1          0x064 /* Split Controller Misc 1 */
+#define PCIE_TLP_BUSDEVFUNC            0x068 /* Bus/Device/Func */
+#define PCIE_TLP_RESETCTR              0x06C /* Reset Counter */
+#define PCIE_TLP_RTRYBUF               0x070 /* Retry Buffer value */
+#define PCIE_TLP_TGTDEBUG1             0x074 /* Target Debug Reg1 */
+#define PCIE_TLP_TGTDEBUG2             0x078 /* Target Debug Reg2 */
+#define PCIE_TLP_TGTDEBUG3             0x07C /* Target Debug Reg3 */
+#define PCIE_TLP_TGTDEBUG4             0x080 /* Target Debug Reg4 */
+
+/* PCIE2 MDIO register offsets */
+#define PCIE2_MDIO_CONTROL    0x128
+#define PCIE2_MDIO_WR_DATA    0x12C
+#define PCIE2_MDIO_RD_DATA    0x130
+
+
+/* MDIO control */
+#define MDIOCTL_DIVISOR_MASK           0x7f    /* clock to be used on MDIO */
+#define MDIOCTL_DIVISOR_VAL            0x2
+#define MDIOCTL_PREAM_EN               0x80    /* Enable preamble sequnce */
+#define MDIOCTL_ACCESS_DONE            0x100   /* Tranaction complete */
+
+/* MDIO Data */
+#define MDIODATA_MASK                  0x0000ffff      /* data 2 bytes */
+#define MDIODATA_TA                    0x00020000      /* Turnaround */
+#define MDIODATA_REGADDR_SHF_OLD       18              /* Regaddr shift (rev < 10) */
+#define MDIODATA_REGADDR_MASK_OLD      0x003c0000      /* Regaddr Mask (rev < 10) */
+#define MDIODATA_DEVADDR_SHF_OLD       22              /* Physmedia devaddr shift (rev < 10) */
+#define MDIODATA_DEVADDR_MASK_OLD      0x0fc00000      /* Physmedia devaddr Mask (rev < 10) */
+#define MDIODATA_REGADDR_SHF           18              /* Regaddr shift */
+#define MDIODATA_REGADDR_MASK          0x007c0000      /* Regaddr Mask */
+#define MDIODATA_DEVADDR_SHF           23              /* Physmedia devaddr shift */
+#define MDIODATA_DEVADDR_MASK          0x0f800000      /* Physmedia devaddr Mask */
+#define MDIODATA_WRITE                 0x10000000      /* write Transaction */
+#define MDIODATA_READ                  0x20000000      /* Read Transaction */
+#define MDIODATA_START                 0x40000000      /* start of Transaction */
+
+#define MDIODATA_DEV_ADDR              0x0             /* dev address for serdes */
+#define        MDIODATA_BLK_ADDR               0x1F            /* blk address for serdes */
+
+/* MDIO control/wrData/rdData register defines for PCIE Gen 2 */
+#define MDIOCTL2_DIVISOR_MASK          0x7f    /* clock to be used on MDIO */
+#define MDIOCTL2_DIVISOR_VAL           0x2
+#define MDIOCTL2_REGADDR_SHF           8               /* Regaddr shift */
+#define MDIOCTL2_REGADDR_MASK          0x00FFFF00      /* Regaddr Mask */
+#define MDIOCTL2_DEVADDR_SHF           24              /* Physmedia devaddr shift */
+#define MDIOCTL2_DEVADDR_MASK          0x0f000000      /* Physmedia devaddr Mask */
+#define MDIOCTL2_SLAVE_BYPASS          0x10000000      /* IP slave bypass */
+#define MDIOCTL2_READ                  0x20000000      /* IP slave bypass */
+
+#define MDIODATA2_DONE                 0x80000000      /* rd/wr transaction done */
+#define MDIODATA2_MASK                 0x7FFFFFFF      /* rd/wr transaction data */
+#define MDIODATA2_DEVADDR_SHF          4               /* Physmedia devaddr shift */
+
+
+/* MDIO devices (SERDES modules)
+ *  unlike old pcie cores (rev < 10), rev10 pcie serde organizes registers into a few blocks.
+ *  two layers mapping (blockidx, register offset) is required
+ */
+#define MDIO_DEV_IEEE0         0x000
+#define MDIO_DEV_IEEE1         0x001
+#define MDIO_DEV_BLK0          0x800
+#define MDIO_DEV_BLK1          0x801
+#define MDIO_DEV_BLK2          0x802
+#define MDIO_DEV_BLK3          0x803
+#define MDIO_DEV_BLK4          0x804
+#define MDIO_DEV_TXPLL         0x808   /* TXPLL register block idx */
+#define MDIO_DEV_TXCTRL0       0x820
+#define MDIO_DEV_SERDESID      0x831
+#define MDIO_DEV_RXCTRL0       0x840
+
+
+/* XgxsBlk1_A Register Offsets */
+#define BLK1_PWR_MGMT0         0x16
+#define BLK1_PWR_MGMT1         0x17
+#define BLK1_PWR_MGMT2         0x18
+#define BLK1_PWR_MGMT3         0x19
+#define BLK1_PWR_MGMT4         0x1A
+
+/* serdes regs (rev < 10) */
+#define MDIODATA_DEV_PLL                       0x1d    /* SERDES PLL Dev */
+#define MDIODATA_DEV_TX                        0x1e    /* SERDES TX Dev */
+#define MDIODATA_DEV_RX                        0x1f    /* SERDES RX Dev */
+       /* SERDES RX registers */
+#define SERDES_RX_CTRL                 1       /* Rx cntrl */
+#define SERDES_RX_TIMER1               2       /* Rx Timer1 */
+#define SERDES_RX_CDR                  6       /* CDR */
+#define SERDES_RX_CDRBW                        7       /* CDR BW */
+
+       /* SERDES RX control register */
+#define SERDES_RX_CTRL_FORCE           0x80    /* rxpolarity_force */
+#define SERDES_RX_CTRL_POLARITY                0x40    /* rxpolarity_value */
+
+       /* SERDES PLL registers */
+#define SERDES_PLL_CTRL                 1       /* PLL control reg */
+#define PLL_CTRL_FREQDET_EN             0x4000  /* bit 14 is FREQDET on */
+
+/* Power management threshold */
+#define PCIE_L0THRESHOLDTIME_MASK       0xFF00 /* bits 0 - 7 */
+#define PCIE_L1THRESHOLDTIME_MASK       0xFF00 /* bits 8 - 15 */
+#define PCIE_L1THRESHOLDTIME_SHIFT      8      /* PCIE_L1THRESHOLDTIME_SHIFT */
+#define PCIE_L1THRESHOLD_WARVAL         0x72   /* WAR value */
+#define PCIE_ASPMTIMER_EXTEND          0x01000000      /* > rev7: enable extend ASPM timer */
+
+/* SPROM offsets */
+#define SRSH_ASPM_OFFSET               4       /* word 4 */
+#define SRSH_ASPM_ENB                  0x18    /* bit 3, 4 */
+#define SRSH_ASPM_L1_ENB               0x10    /* bit 4 */
+#define SRSH_ASPM_L0s_ENB              0x8     /* bit 3 */
+#define SRSH_PCIE_MISC_CONFIG          5       /* word 5 */
+#define SRSH_L23READY_EXIT_NOPERST     0x8000  /* bit 15 */
+#define SRSH_CLKREQ_OFFSET_REV5                20      /* word 20 for srom rev <= 5 */
+#define SRSH_CLKREQ_OFFSET_REV8                52      /* word 52 for srom rev 8 */
+#define SRSH_CLKREQ_ENB                        0x0800  /* bit 11 */
+#define SRSH_BD_OFFSET                  6       /* word 6 */
+#define SRSH_AUTOINIT_OFFSET            18      /* auto initialization enable */
+
+/* Linkcontrol reg offset in PCIE Cap */
+#define PCIE_CAP_LINKCTRL_OFFSET       16      /* linkctrl offset in pcie cap */
+#define PCIE_CAP_LCREG_ASPML0s         0x01    /* ASPM L0s in linkctrl */
+#define PCIE_CAP_LCREG_ASPML1          0x02    /* ASPM L1 in linkctrl */
+#define PCIE_CLKREQ_ENAB               0x100   /* CLKREQ Enab in linkctrl */
+#define PCIE_LINKSPEED_MASK            0xF0000 /* bits 0 - 3 of high word */
+#define PCIE_LINKSPEED_SHIFT           16      /* PCIE_LINKSPEED_SHIFT */
+
+/* Devcontrol reg offset in PCIE Cap */
+#define PCIE_CAP_DEVCTRL_OFFSET                8       /* devctrl offset in pcie cap */
+#define PCIE_CAP_DEVCTRL_MRRS_MASK     0x7000  /* Max read request size mask */
+#define PCIE_CAP_DEVCTRL_MRRS_SHIFT    12      /* Max read request size shift */
+#define PCIE_CAP_DEVCTRL_MRRS_128B     0       /* 128 Byte */
+#define PCIE_CAP_DEVCTRL_MRRS_256B     1       /* 256 Byte */
+#define PCIE_CAP_DEVCTRL_MRRS_512B     2       /* 512 Byte */
+#define PCIE_CAP_DEVCTRL_MRRS_1024B    3       /* 1024 Byte */
+#define PCIE_CAP_DEVCTRL_MPS_MASK      0x00e0  /* Max payload size mask */
+#define PCIE_CAP_DEVCTRL_MPS_SHIFT     5       /* Max payload size shift */
+#define PCIE_CAP_DEVCTRL_MPS_128B      0       /* 128 Byte */
+#define PCIE_CAP_DEVCTRL_MPS_256B      1       /* 256 Byte */
+#define PCIE_CAP_DEVCTRL_MPS_512B      2       /* 512 Byte */
+#define PCIE_CAP_DEVCTRL_MPS_1024B     3       /* 1024 Byte */
+
+#define PCIE_ASPM_ENAB                 3       /* ASPM L0s & L1 in linkctrl */
+#define PCIE_ASPM_L1_ENAB              2       /* ASPM L0s & L1 in linkctrl */
+#define PCIE_ASPM_L0s_ENAB             1       /* ASPM L0s & L1 in linkctrl */
+#define PCIE_ASPM_DISAB                        0       /* ASPM L0s & L1 in linkctrl */
+
+#define PCIE_ASPM_L11_ENAB             8       /* ASPM L1.1 in PML1_sub_control2 */
+#define PCIE_ASPM_L12_ENAB             4       /* ASPM L1.2 in PML1_sub_control2 */
+
+/* Devcontrol2 reg offset in PCIE Cap */
+#define PCIE_CAP_DEVCTRL2_OFFSET       0x28    /* devctrl2 offset in pcie cap */
+#define PCIE_CAP_DEVCTRL2_LTR_ENAB_MASK        0x400   /* Latency Tolerance Reporting Enable */
+#define PCIE_CAP_DEVCTRL2_OBFF_ENAB_SHIFT 13   /* Enable OBFF mechanism, select signaling method */
+#define PCIE_CAP_DEVCTRL2_OBFF_ENAB_MASK 0x6000        /* Enable OBFF mechanism, select signaling method */
+
+/* LTR registers in PCIE Cap */
+#define PCIE_LTR0_REG_OFFSET   0x844   /* ltr0_reg offset in pcie cap */
+#define PCIE_LTR1_REG_OFFSET   0x848   /* ltr1_reg offset in pcie cap */
+#define PCIE_LTR2_REG_OFFSET   0x84c   /* ltr2_reg offset in pcie cap */
+#define PCIE_LTR0_REG_DEFAULT_60       0x883c883c      /* active latency default to 60usec */
+#define PCIE_LTR0_REG_DEFAULT_150      0x88968896      /* active latency default to 150usec */
+#define PCIE_LTR1_REG_DEFAULT          0x88648864      /* idle latency default to 100usec */
+#define PCIE_LTR2_REG_DEFAULT          0x90039003      /* sleep latency default to 3msec */
+
+/* Status reg PCIE_PLP_STATUSREG */
+#define PCIE_PLP_POLARITYINV_STAT      0x10
+
+
+/* PCIE BRCM Vendor CAP REVID reg  bits */
+#define BRCMCAP_PCIEREV_CT_MASK                        0xF00
+#define BRCMCAP_PCIEREV_CT_SHIFT               8
+#define BRCMCAP_PCIEREV_REVID_MASK             0xFF
+#define BRCMCAP_PCIEREV_REVID_SHIFT            0
+
+#define PCIE_REVREG_CT_PCIE1           0
+#define PCIE_REVREG_CT_PCIE2           1
+
+/* PCIE GEN2 specific defines */
+/* PCIE BRCM Vendor Cap offsets w.r.t to vendor cap ptr */
+#define PCIE2R0_BRCMCAP_REVID_OFFSET           4
+#define PCIE2R0_BRCMCAP_BAR0_WIN0_WRAP_OFFSET  8
+#define PCIE2R0_BRCMCAP_BAR0_WIN2_OFFSET       12
+#define PCIE2R0_BRCMCAP_BAR0_WIN2_WRAP_OFFSET  16
+#define PCIE2R0_BRCMCAP_BAR0_WIN_OFFSET                20
+#define PCIE2R0_BRCMCAP_BAR1_WIN_OFFSET                24
+#define PCIE2R0_BRCMCAP_SPROM_CTRL_OFFSET      28
+#define PCIE2R0_BRCMCAP_BAR2_WIN_OFFSET                32
+#define PCIE2R0_BRCMCAP_INTSTATUS_OFFSET       36
+#define PCIE2R0_BRCMCAP_INTMASK_OFFSET         40
+#define PCIE2R0_BRCMCAP_PCIE2SB_MB_OFFSET      44
+#define PCIE2R0_BRCMCAP_BPADDR_OFFSET          48
+#define PCIE2R0_BRCMCAP_BPDATA_OFFSET          52
+#define PCIE2R0_BRCMCAP_CLKCTLSTS_OFFSET       56
+
+/* definition of configuration space registers of PCIe gen2
+ * http://hwnbu-twiki.sj.broadcom.com/twiki/pub/Mwgroup/CurrentPcieGen2ProgramGuide/pcie_ep.htm
+ */
+#define PCIECFGREG_STATUS_CMD          0x4
+#define PCIECFGREG_PM_CSR              0x4C
+#define PCIECFGREG_MSI_CAP             0x58
+#define PCIECFGREG_MSI_ADDR_L          0x5C
+#define PCIECFGREG_MSI_ADDR_H          0x60
+#define PCIECFGREG_MSI_DATA            0x64
+#define PCIECFGREG_LINK_STATUS_CTRL    0xBC
+#define PCIECFGREG_LINK_STATUS_CTRL2   0xDC
+#define PCIECFGREG_RBAR_CTRL           0x228
+#define PCIECFGREG_PML1_SUB_CTRL1      0x248
+#define PCIECFGREG_REG_BAR2_CONFIG     0x4E0
+#define PCIECFGREG_REG_BAR3_CONFIG     0x4F4
+#define PCIECFGREG_PDL_CTRL1           0x1004
+#define PCIECFGREG_PDL_IDDQ            0x1814
+#define PCIECFGREG_REG_PHY_CTL7                0x181c
+
+/* PCIECFGREG_PML1_SUB_CTRL1 Bit Definition */
+#define PCI_PM_L1_2_ENA_MASK           0x00000001      /* PCI-PM L1.2 Enabled */
+#define PCI_PM_L1_1_ENA_MASK           0x00000002      /* PCI-PM L1.1 Enabled */
+#define ASPM_L1_2_ENA_MASK             0x00000004      /* ASPM L1.2 Enabled */
+#define ASPM_L1_1_ENA_MASK             0x00000008      /* ASPM L1.1 Enabled */
+
+/* PCIe gen2 mailbox interrupt masks */
+#define I_MB    0x3
+#define I_BIT0  0x1
+#define I_BIT1  0x2
+
+/* PCIE gen2 config regs */
+#define PCIIntstatus   0x090
+#define PCIIntmask     0x094
+#define PCISBMbx       0x98
+
+/* enumeration Core regs */
+#define PCIH2D_MailBox  0x140
+#define PCIH2D_DB1 0x144
+#define PCID2H_MailBox  0x148
+#define PCIMailBoxInt  0x48
+#define PCIMailBoxMask 0x4C
+
+#define I_F0_B0         (0x1 << 8) /* Mail box interrupt Function 0 interrupt, bit 0 */
+#define I_F0_B1         (0x1 << 9) /* Mail box interrupt Function 0 interrupt, bit 1 */
+
+#define PCIECFGREG_DEVCONTROL  0xB4
+#define PCIECFGREG_DEVCONTROL_MRRS_SHFT        12
+#define PCIECFGREG_DEVCONTROL_MRRS_MASK        (0x7 << PCIECFGREG_DEVCONTROL_MRRS_SHFT)
+
+/* SROM hardware region */
+#define SROM_OFFSET_BAR1_CTRL  52
+
+#define BAR1_ENC_SIZE_MASK     0x000e
+#define BAR1_ENC_SIZE_SHIFT    1
+
+#define BAR1_ENC_SIZE_1M       0
+#define BAR1_ENC_SIZE_2M       1
+#define BAR1_ENC_SIZE_4M       2
+
+#define PCIEGEN2_CAP_DEVSTSCTRL2_OFFSET                0xD4
+#define PCIEGEN2_CAP_DEVSTSCTRL2_LTRENAB       0x400
+
+/*
+ * Latency Tolerance Reporting (LTR) states
+ * Active has the least tolerant latency requirement
+ * Sleep is most tolerant
+ */
+#define LTR_ACTIVE                             2
+#define LTR_ACTIVE_IDLE                                1
+#define LTR_SLEEP                              0
+#define LTR_FINAL_MASK                         0x300
+#define LTR_FINAL_SHIFT                                8
+
+/* pwrinstatus, pwrintmask regs */
+#define PCIEGEN2_PWRINT_D0_STATE_SHIFT         0
+#define PCIEGEN2_PWRINT_D1_STATE_SHIFT         1
+#define PCIEGEN2_PWRINT_D2_STATE_SHIFT         2
+#define PCIEGEN2_PWRINT_D3_STATE_SHIFT         3
+#define PCIEGEN2_PWRINT_L0_LINK_SHIFT          4
+#define PCIEGEN2_PWRINT_L0s_LINK_SHIFT         5
+#define PCIEGEN2_PWRINT_L1_LINK_SHIFT          6
+#define PCIEGEN2_PWRINT_L2_L3_LINK_SHIFT       7
+#define PCIEGEN2_PWRINT_OBFF_CHANGE_SHIFT      8
+
+#define PCIEGEN2_PWRINT_D0_STATE_MASK          (1 << PCIEGEN2_PWRINT_D0_STATE_SHIFT)
+#define PCIEGEN2_PWRINT_D1_STATE_MASK          (1 << PCIEGEN2_PWRINT_D1_STATE_SHIFT)
+#define PCIEGEN2_PWRINT_D2_STATE_MASK          (1 << PCIEGEN2_PWRINT_D2_STATE_SHIFT)
+#define PCIEGEN2_PWRINT_D3_STATE_MASK          (1 << PCIEGEN2_PWRINT_D3_STATE_SHIFT)
+#define PCIEGEN2_PWRINT_L0_LINK_MASK           (1 << PCIEGEN2_PWRINT_L0_LINK_SHIFT)
+#define PCIEGEN2_PWRINT_L0s_LINK_MASK          (1 << PCIEGEN2_PWRINT_L0s_LINK_SHIFT)
+#define PCIEGEN2_PWRINT_L1_LINK_MASK           (1 << PCIEGEN2_PWRINT_L1_LINK_SHIFT)
+#define PCIEGEN2_PWRINT_L2_L3_LINK_MASK                (1 << PCIEGEN2_PWRINT_L2_L3_LINK_SHIFT)
+#define PCIEGEN2_PWRINT_OBFF_CHANGE_MASK       (1 << PCIEGEN2_PWRINT_OBFF_CHANGE_SHIFT)
+
+/* sbtopcie mail box */
+#define SBTOPCIE_MB_FUNC0_SHIFT 8
+#define SBTOPCIE_MB_FUNC1_SHIFT 10
+#define SBTOPCIE_MB_FUNC2_SHIFT 12
+#define SBTOPCIE_MB_FUNC3_SHIFT 14
+
+/* pcieiocstatus */
+#define PCIEGEN2_IOC_D0_STATE_SHIFT            8
+#define PCIEGEN2_IOC_D1_STATE_SHIFT            9
+#define PCIEGEN2_IOC_D2_STATE_SHIFT            10
+#define PCIEGEN2_IOC_D3_STATE_SHIFT            11
+#define PCIEGEN2_IOC_L0_LINK_SHIFT             12
+#define PCIEGEN2_IOC_L1_LINK_SHIFT             13
+#define PCIEGEN2_IOC_L1L2_LINK_SHIFT           14
+#define PCIEGEN2_IOC_L2_L3_LINK_SHIFT          15
+
+#define PCIEGEN2_IOC_D0_STATE_MASK             (1 << PCIEGEN2_IOC_D0_STATE_SHIFT)
+#define PCIEGEN2_IOC_D1_STATE_MASK             (1 << PCIEGEN2_IOC_D1_STATE_SHIFT)
+#define PCIEGEN2_IOC_D2_STATE_MASK             (1 << PCIEGEN2_IOC_D2_STATE_SHIFT)
+#define PCIEGEN2_IOC_D3_STATE_MASK             (1 << PCIEGEN2_IOC_D3_STATE_SHIFT)
+#define PCIEGEN2_IOC_L0_LINK_MASK              (1 << PCIEGEN2_IOC_L0_LINK_SHIFT)
+#define PCIEGEN2_IOC_L1_LINK_MASK              (1 << PCIEGEN2_IOC_L1_LINK_SHIFT)
+#define PCIEGEN2_IOC_L1L2_LINK_MASK            (1 << PCIEGEN2_IOC_L1L2_LINK_SHIFT)
+#define PCIEGEN2_IOC_L2_L3_LINK_MASK           (1 << PCIEGEN2_IOC_L2_L3_LINK_SHIFT)
+
+/* stat_ctrl */
+#define PCIE_STAT_CTRL_RESET           0x1
+#define PCIE_STAT_CTRL_ENABLE          0x2
+#define PCIE_STAT_CTRL_INTENABLE       0x4
+#define PCIE_STAT_CTRL_INTSTATUS       0x8
+
+#ifdef BCMDRIVER
+void pcie_watchdog_reset(osl_t *osh, si_t *sih, sbpcieregs_t *sbpcieregs);
+void pcie_serdes_iddqdisable(osl_t *osh, si_t *sih, sbpcieregs_t *sbpcieregs);
+#endif /* BCMDRIVER */
+
+#endif /* _PCIE_CORE_H */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/proto/802.11.h b/drivers/net/wireless/bcmdhd_1363/include/proto/802.11.h
new file mode 100644 (file)
index 0000000..4fdccb3
--- /dev/null
@@ -0,0 +1,4936 @@
+/*
+ * Fundamental types and constants relating to 802.11
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: 802.11.h 654127 2016-08-11 06:56:35Z $
+ */
+
+#ifndef _802_11_H_
+#define _802_11_H_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+#ifndef _NET_ETHERNET_H_
+#include <proto/ethernet.h>
+#endif
+
+#include <proto/wpa.h>
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+
+#define DOT11_TU_TO_US                 1024    /* 802.11 Time Unit is 1024 microseconds */
+
+/* Generic 802.11 frame constants */
+#define DOT11_A3_HDR_LEN               24      /* d11 header length with A3 */
+#define DOT11_A4_HDR_LEN               30      /* d11 header length with A4 */
+#define DOT11_MAC_HDR_LEN              DOT11_A3_HDR_LEN        /* MAC header length */
+#define DOT11_FCS_LEN                  4       /* d11 FCS length */
+#define DOT11_ICV_LEN                  4       /* d11 ICV length */
+#define DOT11_ICV_AES_LEN              8       /* d11 ICV/AES length */
+#define DOT11_QOS_LEN                  2       /* d11 QoS length */
+#define DOT11_HTC_LEN                  4       /* d11 HT Control field length */
+
+#define DOT11_KEY_INDEX_SHIFT          6       /* d11 key index shift */
+#define DOT11_IV_LEN                   4       /* d11 IV length */
+#define DOT11_IV_TKIP_LEN              8       /* d11 IV TKIP length */
+#define DOT11_IV_AES_OCB_LEN           4       /* d11 IV/AES/OCB length */
+#define DOT11_IV_AES_CCM_LEN           8       /* d11 IV/AES/CCM length */
+#define DOT11_IV_MAX_LEN               8       /* maximum iv len for any encryption */
+
+/* Includes MIC */
+#define DOT11_MAX_MPDU_BODY_LEN                2304    /* max MPDU body length */
+/* A4 header + QoS + CCMP + PDU + ICV + FCS = 2352 */
+#define DOT11_MAX_MPDU_LEN             (DOT11_A4_HDR_LEN + \
+                                        DOT11_QOS_LEN + \
+                                        DOT11_IV_AES_CCM_LEN + \
+                                        DOT11_MAX_MPDU_BODY_LEN + \
+                                        DOT11_ICV_LEN + \
+                                        DOT11_FCS_LEN) /* d11 max MPDU length */
+
+#define DOT11_MAX_SSID_LEN             32      /* d11 max ssid length */
+
+/* dot11RTSThreshold */
+#define DOT11_DEFAULT_RTS_LEN          2347    /* d11 default RTS length */
+#define DOT11_MAX_RTS_LEN              2347    /* d11 max RTS length */
+
+/* dot11FragmentationThreshold */
+#define DOT11_MIN_FRAG_LEN             256     /* d11 min fragmentation length */
+#define DOT11_MAX_FRAG_LEN             2346    /* Max frag is also limited by aMPDUMaxLength
+                                               * of the attached PHY
+                                               */
+#define DOT11_DEFAULT_FRAG_LEN         2346    /* d11 default fragmentation length */
+
+/* dot11BeaconPeriod */
+#define DOT11_MIN_BEACON_PERIOD                1       /* d11 min beacon period */
+#define DOT11_MAX_BEACON_PERIOD                0xFFFF  /* d11 max beacon period */
+
+/* dot11DTIMPeriod */
+#define DOT11_MIN_DTIM_PERIOD          1       /* d11 min DTIM period */
+#define DOT11_MAX_DTIM_PERIOD          0xFF    /* d11 max DTIM period */
+
+/** 802.2 LLC/SNAP header used by 802.11 per 802.1H */
+#define DOT11_LLC_SNAP_HDR_LEN         8       /* d11 LLC/SNAP header length */
+/* minimum LLC header length; DSAP, SSAP, 8 bit Control (unnumbered) */
+#define DOT11_LLC_HDR_LEN_MIN          3
+#define DOT11_OUI_LEN                  3       /* d11 OUI length */
+BWL_PRE_PACKED_STRUCT struct dot11_llc_snap_header {
+       uint8   dsap;                           /* always 0xAA */
+       uint8   ssap;                           /* always 0xAA */
+       uint8   ctl;                            /* always 0x03 */
+       uint8   oui[DOT11_OUI_LEN];             /* RFC1042: 0x00 0x00 0x00
+                                                * Bridge-Tunnel: 0x00 0x00 0xF8
+                                                */
+       uint16  type;                           /* ethertype */
+} BWL_POST_PACKED_STRUCT;
+
+/* RFC1042 header used by 802.11 per 802.1H */
+#define RFC1042_HDR_LEN        (ETHER_HDR_LEN + DOT11_LLC_SNAP_HDR_LEN)        /* RCF1042 header length */
+
+/* Generic 802.11 MAC header */
+/**
+ * N.B.: This struct reflects the full 4 address 802.11 MAC header.
+ *              The fields are defined such that the shorter 1, 2, and 3
+ *              address headers just use the first k fields.
+ */
+BWL_PRE_PACKED_STRUCT struct dot11_header {
+       uint16                  fc;             /* frame control */
+       uint16                  durid;          /* duration/ID */
+       struct ether_addr       a1;             /* address 1 */
+       struct ether_addr       a2;             /* address 2 */
+       struct ether_addr       a3;             /* address 3 */
+       uint16                  seq;            /* sequence control */
+       struct ether_addr       a4;             /* address 4 */
+} BWL_POST_PACKED_STRUCT;
+
+/* Control frames */
+
+BWL_PRE_PACKED_STRUCT struct dot11_rts_frame {
+       uint16                  fc;             /* frame control */
+       uint16                  durid;          /* duration/ID */
+       struct ether_addr       ra;             /* receiver address */
+       struct ether_addr       ta;             /* transmitter address */
+} BWL_POST_PACKED_STRUCT;
+#define        DOT11_RTS_LEN           16              /* d11 RTS frame length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_cts_frame {
+       uint16                  fc;             /* frame control */
+       uint16                  durid;          /* duration/ID */
+       struct ether_addr       ra;             /* receiver address */
+} BWL_POST_PACKED_STRUCT;
+#define        DOT11_CTS_LEN           10              /* d11 CTS frame length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_ack_frame {
+       uint16                  fc;             /* frame control */
+       uint16                  durid;          /* duration/ID */
+       struct ether_addr       ra;             /* receiver address */
+} BWL_POST_PACKED_STRUCT;
+#define        DOT11_ACK_LEN           10              /* d11 ACK frame length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_ps_poll_frame {
+       uint16                  fc;             /* frame control */
+       uint16                  durid;          /* AID */
+       struct ether_addr       bssid;          /* receiver address, STA in AP */
+       struct ether_addr       ta;             /* transmitter address */
+} BWL_POST_PACKED_STRUCT;
+#define        DOT11_PS_POLL_LEN       16              /* d11 PS poll frame length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_cf_end_frame {
+       uint16                  fc;             /* frame control */
+       uint16                  durid;          /* duration/ID */
+       struct ether_addr       ra;             /* receiver address */
+       struct ether_addr       bssid;          /* transmitter address, STA in AP */
+} BWL_POST_PACKED_STRUCT;
+#define        DOT11_CS_END_LEN        16              /* d11 CF-END frame length */
+
+/**
+ * RWL wifi protocol: The Vendor Specific Action frame is defined for vendor-specific signaling
+ *  category+OUI+vendor specific content ( this can be variable)
+ */
+BWL_PRE_PACKED_STRUCT struct dot11_action_wifi_vendor_specific {
+       uint8   category;
+       uint8   OUI[3];
+       uint8   type;
+       uint8   subtype;
+       uint8   data[1040];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_action_wifi_vendor_specific dot11_action_wifi_vendor_specific_t;
+
+/** generic vendor specific action frame with variable length */
+BWL_PRE_PACKED_STRUCT struct dot11_action_vs_frmhdr {
+       uint8   category;
+       uint8   OUI[3];
+       uint8   type;
+       uint8   subtype;
+       uint8   data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_action_vs_frmhdr dot11_action_vs_frmhdr_t;
+
+#define DOT11_ACTION_VS_HDR_LEN        6
+
+#define BCM_ACTION_OUI_BYTE0   0x00
+#define BCM_ACTION_OUI_BYTE1   0x90
+#define BCM_ACTION_OUI_BYTE2   0x4c
+
+/* BA/BAR Control parameters */
+#define DOT11_BA_CTL_POLICY_NORMAL     0x0000  /* normal ack */
+#define DOT11_BA_CTL_POLICY_NOACK      0x0001  /* no ack */
+#define DOT11_BA_CTL_POLICY_MASK       0x0001  /* ack policy mask */
+
+#define DOT11_BA_CTL_MTID              0x0002  /* multi tid BA */
+#define DOT11_BA_CTL_COMPRESSED                0x0004  /* compressed bitmap */
+
+#define DOT11_BA_CTL_NUMMSDU_MASK      0x0FC0  /* num msdu in bitmap mask */
+#define DOT11_BA_CTL_NUMMSDU_SHIFT     6       /* num msdu in bitmap shift */
+
+#define DOT11_BA_CTL_TID_MASK          0xF000  /* tid mask */
+#define DOT11_BA_CTL_TID_SHIFT         12      /* tid shift */
+
+/** control frame header (BA/BAR) */
+BWL_PRE_PACKED_STRUCT struct dot11_ctl_header {
+       uint16                  fc;             /* frame control */
+       uint16                  durid;          /* duration/ID */
+       struct ether_addr       ra;             /* receiver address */
+       struct ether_addr       ta;             /* transmitter address */
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_CTL_HDR_LEN      16              /* control frame hdr len */
+
+/** BAR frame payload */
+BWL_PRE_PACKED_STRUCT struct dot11_bar {
+       uint16                  bar_control;    /* BAR Control */
+       uint16                  seqnum;         /* Starting Sequence control */
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_BAR_LEN          4               /* BAR frame payload length */
+
+#define DOT11_BA_BITMAP_LEN    128             /* bitmap length */
+#define DOT11_BA_CMP_BITMAP_LEN        8               /* compressed bitmap length */
+/** BA frame payload */
+BWL_PRE_PACKED_STRUCT struct dot11_ba {
+       uint16                  ba_control;     /* BA Control */
+       uint16                  seqnum;         /* Starting Sequence control */
+       uint8                   bitmap[DOT11_BA_BITMAP_LEN];    /* Block Ack Bitmap */
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_BA_LEN           4               /* BA frame payload len (wo bitmap) */
+
+/** Management frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_management_header {
+       uint16                  fc;             /* frame control */
+       uint16                  durid;          /* duration/ID */
+       struct ether_addr       da;             /* receiver address */
+       struct ether_addr       sa;             /* transmitter address */
+       struct ether_addr       bssid;          /* BSS ID */
+       uint16                  seq;            /* sequence control */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_management_header dot11_management_header_t;
+#define        DOT11_MGMT_HDR_LEN      24              /* d11 management header length */
+
+/* Management frame payloads */
+
+BWL_PRE_PACKED_STRUCT struct dot11_bcn_prb {
+       uint32                  timestamp[2];
+       uint16                  beacon_interval;
+       uint16                  capability;
+} BWL_POST_PACKED_STRUCT;
+#define        DOT11_BCN_PRB_LEN       12              /* 802.11 beacon/probe frame fixed length */
+#define        DOT11_BCN_PRB_FIXED_LEN 12              /* 802.11 beacon/probe frame fixed length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_auth {
+       uint16                  alg;            /* algorithm */
+       uint16                  seq;            /* sequence control */
+       uint16                  status;         /* status code */
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_AUTH_FIXED_LEN   6               /* length of auth frame without challenge IE */
+
+BWL_PRE_PACKED_STRUCT struct dot11_assoc_req {
+       uint16                  capability;     /* capability information */
+       uint16                  listen;         /* listen interval */
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_ASSOC_REQ_FIXED_LEN      4       /* length of assoc frame without info elts */
+
+BWL_PRE_PACKED_STRUCT struct dot11_reassoc_req {
+       uint16                  capability;     /* capability information */
+       uint16                  listen;         /* listen interval */
+       struct ether_addr       ap;             /* Current AP address */
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_REASSOC_REQ_FIXED_LEN    10      /* length of assoc frame without info elts */
+
+BWL_PRE_PACKED_STRUCT struct dot11_assoc_resp {
+       uint16                  capability;     /* capability information */
+       uint16                  status;         /* status code */
+       uint16                  aid;            /* association ID */
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_ASSOC_RESP_FIXED_LEN     6       /* length of assoc resp frame without info elts */
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_measure {
+       uint8   category;
+       uint8   action;
+       uint8   token;
+       uint8   data[1];
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_ACTION_MEASURE_LEN       3       /* d11 action measurement header length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_ht_ch_width {
+       uint8   category;
+       uint8   action;
+       uint8   ch_width;
+} BWL_POST_PACKED_STRUCT;
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_ht_mimops {
+       uint8   category;
+       uint8   action;
+       uint8   control;
+} BWL_POST_PACKED_STRUCT;
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_sa_query {
+       uint8   category;
+       uint8   action;
+       uint16  id;
+} BWL_POST_PACKED_STRUCT;
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_vht_oper_mode {
+       uint8   category;
+       uint8   action;
+       uint8   mode;
+} BWL_POST_PACKED_STRUCT;
+
+/* These lengths assume 64 MU groups, as specified in 802.11ac-2013 */
+#define DOT11_ACTION_GID_MEMBERSHIP_LEN  8    /* bytes */
+#define DOT11_ACTION_GID_USER_POS_LEN   16    /* bytes */
+BWL_PRE_PACKED_STRUCT struct dot11_action_group_id {
+       uint8   category;
+       uint8   action;
+       uint8   membership_status[DOT11_ACTION_GID_MEMBERSHIP_LEN];
+       uint8   user_position[DOT11_ACTION_GID_USER_POS_LEN];
+} BWL_POST_PACKED_STRUCT;
+
+#define SM_PWRSAVE_ENABLE      1
+#define SM_PWRSAVE_MODE                2
+
+/* ************* 802.11h related definitions. ************* */
+BWL_PRE_PACKED_STRUCT struct dot11_power_cnst {
+       uint8 id;
+       uint8 len;
+       uint8 power;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_power_cnst dot11_power_cnst_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_power_cap {
+       int8 min;
+       int8 max;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_power_cap dot11_power_cap_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_tpc_rep {
+       uint8 id;
+       uint8 len;
+       uint8 tx_pwr;
+       uint8 margin;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tpc_rep dot11_tpc_rep_t;
+#define DOT11_MNG_IE_TPC_REPORT_LEN    2       /* length of IE data, not including 2 byte header */
+
+BWL_PRE_PACKED_STRUCT struct dot11_supp_channels {
+       uint8 id;
+       uint8 len;
+       uint8 first_channel;
+       uint8 num_channels;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_supp_channels dot11_supp_channels_t;
+
+/**
+ * Extension Channel Offset IE: 802.11n-D1.0 spec. added sideband
+ * offset for 40MHz operation.  The possible 3 values are:
+ * 1 = above control channel
+ * 3 = below control channel
+ * 0 = no extension channel
+ */
+BWL_PRE_PACKED_STRUCT struct dot11_extch {
+       uint8   id;             /* IE ID, 62, DOT11_MNG_EXT_CHANNEL_OFFSET */
+       uint8   len;            /* IE length */
+       uint8   extch;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_extch dot11_extch_ie_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_brcm_extch {
+       uint8   id;             /* IE ID, 221, DOT11_MNG_PROPR_ID */
+       uint8   len;            /* IE length */
+       uint8   oui[3];
+       uint8   type;           /* type indicates what follows */
+       uint8   extch;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_brcm_extch dot11_brcm_extch_ie_t;
+
+#define BRCM_EXTCH_IE_LEN      5
+#define BRCM_EXTCH_IE_TYPE     53      /* 802.11n ID not yet assigned */
+#define DOT11_EXTCH_IE_LEN     1
+#define DOT11_EXT_CH_MASK      0x03    /* extension channel mask */
+#define DOT11_EXT_CH_UPPER     0x01    /* ext. ch. on upper sb */
+#define DOT11_EXT_CH_LOWER     0x03    /* ext. ch. on lower sb */
+#define DOT11_EXT_CH_NONE      0x00    /* no extension ch.  */
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_frmhdr {
+       uint8   category;
+       uint8   action;
+       uint8   data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_action_frmhdr dot11_action_frmhdr_t;
+#define DOT11_ACTION_FRMHDR_LEN        2
+
+/** CSA IE data structure */
+BWL_PRE_PACKED_STRUCT struct dot11_channel_switch {
+       uint8 id;       /* id DOT11_MNG_CHANNEL_SWITCH_ID */
+       uint8 len;      /* length of IE */
+       uint8 mode;     /* mode 0 or 1 */
+       uint8 channel;  /* channel switch to */
+       uint8 count;    /* number of beacons before switching */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_channel_switch dot11_chan_switch_ie_t;
+
+#define DOT11_SWITCH_IE_LEN    3       /* length of IE data, not including 2 byte header */
+/* CSA mode - 802.11h-2003 $7.3.2.20 */
+#define DOT11_CSA_MODE_ADVISORY                0       /* no DOT11_CSA_MODE_NO_TX restriction imposed */
+#define DOT11_CSA_MODE_NO_TX           1       /* no transmission upon receiving CSA frame. */
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_switch_channel {
+       uint8   category;
+       uint8   action;
+       dot11_chan_switch_ie_t chan_switch_ie;  /* for switch IE */
+       dot11_brcm_extch_ie_t extch_ie;         /* extension channel offset */
+} BWL_POST_PACKED_STRUCT;
+
+BWL_PRE_PACKED_STRUCT struct dot11_csa_body {
+       uint8 mode;     /* mode 0 or 1 */
+       uint8 reg;      /* regulatory class */
+       uint8 channel;  /* channel switch to */
+       uint8 count;    /* number of beacons before switching */
+} BWL_POST_PACKED_STRUCT;
+
+/** 11n Extended Channel Switch IE data structure */
+BWL_PRE_PACKED_STRUCT struct dot11_ext_csa {
+       uint8 id;       /* id DOT11_MNG_EXT_CHANNEL_SWITCH_ID */
+       uint8 len;      /* length of IE */
+       struct dot11_csa_body b;        /* body of the ie */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ext_csa dot11_ext_csa_ie_t;
+#define DOT11_EXT_CSA_IE_LEN   4       /* length of extended channel switch IE body */
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_ext_csa {
+       uint8   category;
+       uint8   action;
+       dot11_ext_csa_ie_t chan_switch_ie;      /* for switch IE */
+} BWL_POST_PACKED_STRUCT;
+
+BWL_PRE_PACKED_STRUCT struct dot11y_action_ext_csa {
+       uint8   category;
+       uint8   action;
+       struct dot11_csa_body b;        /* body of the ie */
+} BWL_POST_PACKED_STRUCT;
+
+/**  Wide Bandwidth Channel Switch IE data structure */
+BWL_PRE_PACKED_STRUCT struct dot11_wide_bw_channel_switch {
+       uint8 id;                               /* id DOT11_MNG_WIDE_BW_CHANNEL_SWITCH_ID */
+       uint8 len;                              /* length of IE */
+       uint8 channel_width;                    /* new channel width */
+       uint8 center_frequency_segment_0;       /* center frequency segment 0 */
+       uint8 center_frequency_segment_1;       /* center frequency segment 1 */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_wide_bw_channel_switch dot11_wide_bw_chan_switch_ie_t;
+
+#define DOT11_WIDE_BW_SWITCH_IE_LEN     3       /* length of IE data, not including 2 byte header */
+
+/** Channel Switch Wrapper IE data structure */
+BWL_PRE_PACKED_STRUCT struct dot11_channel_switch_wrapper {
+       uint8 id;                               /* id DOT11_MNG_WIDE_BW_CHANNEL_SWITCH_ID */
+       uint8 len;                              /* length of IE */
+       dot11_wide_bw_chan_switch_ie_t wb_chan_switch_ie;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_channel_switch_wrapper dot11_chan_switch_wrapper_ie_t;
+
+typedef enum wide_bw_chan_width {
+       WIDE_BW_CHAN_WIDTH_20   = 0,
+       WIDE_BW_CHAN_WIDTH_40   = 1,
+       WIDE_BW_CHAN_WIDTH_80   = 2,
+       WIDE_BW_CHAN_WIDTH_160  = 3,
+       WIDE_BW_CHAN_WIDTH_80_80        = 4
+} wide_bw_chan_width_t;
+
+/**  Wide Bandwidth Channel IE data structure */
+BWL_PRE_PACKED_STRUCT struct dot11_wide_bw_channel {
+       uint8 id;                               /* id DOT11_MNG_WIDE_BW_CHANNEL_ID */
+       uint8 len;                              /* length of IE */
+       uint8 channel_width;                    /* channel width */
+       uint8 center_frequency_segment_0;       /* center frequency segment 0 */
+       uint8 center_frequency_segment_1;       /* center frequency segment 1 */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_wide_bw_channel dot11_wide_bw_chan_ie_t;
+
+#define DOT11_WIDE_BW_IE_LEN     3       /* length of IE data, not including 2 byte header */
+/** VHT Transmit Power Envelope IE data structure */
+BWL_PRE_PACKED_STRUCT struct dot11_vht_transmit_power_envelope {
+       uint8 id;                               /* id DOT11_MNG_WIDE_BW_CHANNEL_SWITCH_ID */
+       uint8 len;                              /* length of IE */
+       uint8 transmit_power_info;
+       uint8 local_max_transmit_power_20;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_vht_transmit_power_envelope dot11_vht_transmit_power_envelope_ie_t;
+
+/* vht transmit power envelope IE length depends on channel width */
+#define DOT11_VHT_TRANSMIT_PWR_ENVELOPE_IE_LEN_40MHZ   1
+#define DOT11_VHT_TRANSMIT_PWR_ENVELOPE_IE_LEN_80MHZ   2
+#define DOT11_VHT_TRANSMIT_PWR_ENVELOPE_IE_LEN_160MHZ  3
+
+BWL_PRE_PACKED_STRUCT struct dot11_obss_coex {
+       uint8   id;
+       uint8   len;
+       uint8   info;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_obss_coex dot11_obss_coex_t;
+#define DOT11_OBSS_COEXINFO_LEN        1       /* length of OBSS Coexistence INFO IE */
+
+#define        DOT11_OBSS_COEX_INFO_REQ                0x01
+#define        DOT11_OBSS_COEX_40MHZ_INTOLERANT        0x02
+#define        DOT11_OBSS_COEX_20MHZ_WIDTH_REQ 0x04
+
+BWL_PRE_PACKED_STRUCT struct dot11_obss_chanlist {
+       uint8   id;
+       uint8   len;
+       uint8   regclass;
+       uint8   chanlist[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_obss_chanlist dot11_obss_chanlist_t;
+#define DOT11_OBSS_CHANLIST_FIXED_LEN  1       /* fixed length of regclass */
+
+BWL_PRE_PACKED_STRUCT struct dot11_extcap_ie {
+       uint8 id;
+       uint8 len;
+       uint8 cap[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_extcap_ie dot11_extcap_ie_t;
+
+#define DOT11_EXTCAP_LEN_COEX  1
+#define DOT11_EXTCAP_LEN_BT    3
+#define DOT11_EXTCAP_LEN_IW    4
+#define DOT11_EXTCAP_LEN_SI    6
+
+#define DOT11_EXTCAP_LEN_TDLS  5
+#define DOT11_11AC_EXTCAP_LEN_TDLS     8
+
+#define DOT11_EXTCAP_LEN_FMS                   2
+#define DOT11_EXTCAP_LEN_PROXY_ARP             2
+#define DOT11_EXTCAP_LEN_TFS                   3
+#define DOT11_EXTCAP_LEN_WNM_SLEEP             3
+#define DOT11_EXTCAP_LEN_TIMBC                 3
+#define DOT11_EXTCAP_LEN_BSSTRANS              3
+#define DOT11_EXTCAP_LEN_DMS                   4
+#define DOT11_EXTCAP_LEN_WNM_NOTIFICATION      6
+#define DOT11_EXTCAP_LEN_TDLS_WBW              8
+#define DOT11_EXTCAP_LEN_OPMODE_NOTIFICATION   8
+
+/* TDLS Capabilities */
+#define DOT11_TDLS_CAP_TDLS                    37              /* TDLS support */
+#define DOT11_TDLS_CAP_PU_BUFFER_STA   28              /* TDLS Peer U-APSD buffer STA support */
+#define DOT11_TDLS_CAP_PEER_PSM                20              /* TDLS Peer PSM support */
+#define DOT11_TDLS_CAP_CH_SW                   30              /* TDLS Channel switch */
+#define DOT11_TDLS_CAP_PROH                    38              /* TDLS prohibited */
+#define DOT11_TDLS_CAP_CH_SW_PROH              39              /* TDLS Channel switch prohibited */
+#define DOT11_TDLS_CAP_TDLS_WIDER_BW   61      /* TDLS Wider Band-Width */
+
+#define TDLS_CAP_MAX_BIT               39              /* TDLS max bit defined in ext cap */
+
+/* 802.11h/802.11k Measurement Request/Report IEs */
+/* Measurement Type field */
+#define DOT11_MEASURE_TYPE_BASIC       0   /* d11 measurement basic type */
+#define DOT11_MEASURE_TYPE_CCA                 1   /* d11 measurement CCA type */
+#define DOT11_MEASURE_TYPE_RPI         2   /* d11 measurement RPI type */
+#define DOT11_MEASURE_TYPE_CHLOAD      3   /* d11 measurement Channel Load type */
+#define DOT11_MEASURE_TYPE_NOISE       4   /* d11 measurement Noise Histogram type */
+#define DOT11_MEASURE_TYPE_BEACON      5   /* d11 measurement Beacon type */
+#define DOT11_MEASURE_TYPE_FRAME       6   /* d11 measurement Frame type */
+#define DOT11_MEASURE_TYPE_STAT                7   /* d11 measurement STA Statistics type */
+#define DOT11_MEASURE_TYPE_LCI         8   /* d11 measurement LCI type */
+#define DOT11_MEASURE_TYPE_TXSTREAM    9   /* d11 measurement TX Stream type */
+#define DOT11_MEASURE_TYPE_MCDIAGS     10  /* d11 measurement multicast diagnostics */
+#define DOT11_MEASURE_TYPE_CIVICLOC    11  /* d11 measurement location civic */
+#define DOT11_MEASURE_TYPE_LOC_ID      12  /* d11 measurement location identifier */
+#define DOT11_MEASURE_TYPE_DIRCHANQ    13  /* d11 measurement dir channel quality */
+#define DOT11_MEASURE_TYPE_DIRMEAS     14  /* d11 measurement directional */
+#define DOT11_MEASURE_TYPE_DIRSTATS    15  /* d11 measurement directional stats */
+#define DOT11_MEASURE_TYPE_FTMRANGE    16  /* d11 measurement Fine Timing */
+#define DOT11_MEASURE_TYPE_PAUSE       255     /* d11 measurement pause type */
+
+/* Measurement Request Modes */
+#define DOT11_MEASURE_MODE_PARALLEL    (1<<0)  /* d11 measurement parallel */
+#define DOT11_MEASURE_MODE_ENABLE      (1<<1)  /* d11 measurement enable */
+#define DOT11_MEASURE_MODE_REQUEST     (1<<2)  /* d11 measurement request */
+#define DOT11_MEASURE_MODE_REPORT      (1<<3)  /* d11 measurement report */
+#define DOT11_MEASURE_MODE_DUR         (1<<4)  /* d11 measurement dur mandatory */
+/* Measurement Report Modes */
+#define DOT11_MEASURE_MODE_LATE        (1<<0)  /* d11 measurement late */
+#define DOT11_MEASURE_MODE_INCAPABLE   (1<<1)  /* d11 measurement incapable */
+#define DOT11_MEASURE_MODE_REFUSED     (1<<2)  /* d11 measurement refuse */
+/* Basic Measurement Map bits */
+#define DOT11_MEASURE_BASIC_MAP_BSS    ((uint8)(1<<0)) /* d11 measurement basic map BSS */
+#define DOT11_MEASURE_BASIC_MAP_OFDM   ((uint8)(1<<1)) /* d11 measurement map OFDM */
+#define DOT11_MEASURE_BASIC_MAP_UKNOWN ((uint8)(1<<2)) /* d11 measurement map unknown */
+#define DOT11_MEASURE_BASIC_MAP_RADAR  ((uint8)(1<<3)) /* d11 measurement map radar */
+#define DOT11_MEASURE_BASIC_MAP_UNMEAS ((uint8)(1<<4)) /* d11 measurement map unmeasuremnt */
+
+BWL_PRE_PACKED_STRUCT struct dot11_meas_req {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       uint8 channel;
+       uint8 start_time[8];
+       uint16 duration;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_meas_req dot11_meas_req_t;
+#define DOT11_MNG_IE_MREQ_LEN 14       /* d11 measurement request IE length */
+/* length of Measure Request IE data not including variable len */
+#define DOT11_MNG_IE_MREQ_FIXED_LEN 3  /* d11 measurement request IE fixed length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_meas_req_loc {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       BWL_PRE_PACKED_STRUCT union
+       {
+               BWL_PRE_PACKED_STRUCT struct {
+                       uint8 subject;
+                       uint8 data[1];
+               } BWL_POST_PACKED_STRUCT lci;
+               BWL_PRE_PACKED_STRUCT struct {
+                       uint8 subject;
+                       uint8 type;  /* type of civic location */
+                       uint8 siu;   /* service interval units */
+                       uint16 si; /* service interval */
+                       uint8 data[1];
+               } BWL_POST_PACKED_STRUCT civic;
+               BWL_PRE_PACKED_STRUCT struct {
+                       uint8 subject;
+                       uint8 siu;   /* service interval units */
+                       uint16 si; /* service interval */
+                       uint8 data[1];
+               } BWL_POST_PACKED_STRUCT locid;
+               BWL_PRE_PACKED_STRUCT struct {
+                       uint16 max_init_delay;          /* maximum random initial delay */
+                       uint8 min_ap_count;
+                       uint8 data[1];
+               } BWL_POST_PACKED_STRUCT ftm_range;
+       } BWL_POST_PACKED_STRUCT req;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_meas_req_loc dot11_meas_req_loc_t;
+#define DOT11_MNG_IE_MREQ_MIN_LEN           4  /* d11 measurement report IE length */
+#define DOT11_MNG_IE_MREQ_LCI_FIXED_LEN     4  /* d11 measurement report IE length */
+#define DOT11_MNG_IE_MREQ_CIVIC_FIXED_LEN   8  /* d11 measurement report IE length */
+#define DOT11_MNG_IE_MREQ_FRNG_FIXED_LEN    6  /* d11 measurement report IE length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_lci_subelement {
+       uint8 subelement;
+       uint8 length;
+       uint8 lci_data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_lci_subelement dot11_lci_subelement_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_civic_subelement {
+       uint8 type;  /* type of civic location */
+       uint8 subelement;
+       uint8 length;
+       uint8 civic_data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_civic_subelement dot11_civic_subelement_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_meas_rep {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       BWL_PRE_PACKED_STRUCT union
+       {
+               BWL_PRE_PACKED_STRUCT struct {
+                       uint8 channel;
+                       uint8 start_time[8];
+                       uint16 duration;
+                       uint8 map;
+               } BWL_POST_PACKED_STRUCT basic;
+               BWL_PRE_PACKED_STRUCT struct {
+                       uint8 subelement;
+                       uint8 length;
+                       uint8 data[1];
+               } BWL_POST_PACKED_STRUCT lci;
+               BWL_PRE_PACKED_STRUCT struct {
+                       uint8 type;  /* type of civic location */
+                       uint8 subelement;
+                       uint8 length;
+                       uint8 data[1];
+               } BWL_POST_PACKED_STRUCT civic;
+               BWL_PRE_PACKED_STRUCT struct {
+                       uint8 exp_tsf[8];
+                       uint8 subelement;
+                       uint8 length;
+                       uint8 data[1];
+               } BWL_POST_PACKED_STRUCT locid;
+               BWL_PRE_PACKED_STRUCT struct {
+                       uint8 entry_count;
+                       uint8 data[1];
+               } BWL_POST_PACKED_STRUCT ftm_range;
+               uint8 data[1];
+       } BWL_POST_PACKED_STRUCT rep;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_meas_rep dot11_meas_rep_t;
+#define DOT11_MNG_IE_MREP_MIN_LEN           5  /* d11 measurement report IE length */
+#define DOT11_MNG_IE_MREP_LCI_FIXED_LEN     5  /* d11 measurement report IE length */
+#define DOT11_MNG_IE_MREP_CIVIC_FIXED_LEN   6  /* d11 measurement report IE length */
+#define DOT11_MNG_IE_MREP_LOCID_FIXED_LEN   13 /* d11 measurement report IE length */
+#define DOT11_MNG_IE_MREP_BASIC_FIXED_LEN   15 /* d11 measurement report IE length */
+#define DOT11_MNG_IE_MREP_FRNG_FIXED_LEN    4
+
+/* length of Measure Report IE data not including variable len */
+#define DOT11_MNG_IE_MREP_FIXED_LEN    3       /* d11 measurement response IE fixed length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_meas_rep_basic {
+       uint8 channel;
+       uint8 start_time[8];
+       uint16 duration;
+       uint8 map;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_meas_rep_basic dot11_meas_rep_basic_t;
+#define DOT11_MEASURE_BASIC_REP_LEN    12      /* d11 measurement basic report length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_quiet {
+       uint8 id;
+       uint8 len;
+       uint8 count;    /* TBTTs until beacon interval in quiet starts */
+       uint8 period;   /* Beacon intervals between periodic quiet periods ? */
+       uint16 duration;        /* Length of quiet period, in TU's */
+       uint16 offset;  /* TU's offset from TBTT in Count field */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_quiet dot11_quiet_t;
+
+BWL_PRE_PACKED_STRUCT struct chan_map_tuple {
+       uint8 channel;
+       uint8 map;
+} BWL_POST_PACKED_STRUCT;
+typedef struct chan_map_tuple chan_map_tuple_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_ibss_dfs {
+       uint8 id;
+       uint8 len;
+       uint8 eaddr[ETHER_ADDR_LEN];
+       uint8 interval;
+       chan_map_tuple_t map[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ibss_dfs dot11_ibss_dfs_t;
+
+/* WME Elements */
+#define WME_OUI                        "\x00\x50\xf2"  /* WME OUI */
+#define WME_OUI_LEN            3
+#define WME_OUI_TYPE           2       /* WME type */
+#define WME_TYPE               2       /* WME type, deprecated */
+#define WME_SUBTYPE_IE         0       /* Information Element */
+#define WME_SUBTYPE_PARAM_IE   1       /* Parameter Element */
+#define WME_SUBTYPE_TSPEC      2       /* Traffic Specification */
+#define WME_VER                        1       /* WME version */
+
+/* WME Access Category Indices (ACIs) */
+#define AC_BE                  0       /* Best Effort */
+#define AC_BK                  1       /* Background */
+#define AC_VI                  2       /* Video */
+#define AC_VO                  3       /* Voice */
+#define AC_COUNT               4       /* number of ACs */
+
+typedef uint8 ac_bitmap_t;     /* AC bitmap of (1 << AC_xx) */
+
+#define AC_BITMAP_NONE         0x0     /* No ACs */
+#define AC_BITMAP_ALL          0xf     /* All ACs */
+#define AC_BITMAP_TST(ab, ac)  (((ab) & (1 << (ac))) != 0)
+#define AC_BITMAP_SET(ab, ac)  (((ab) |= (1 << (ac))))
+#define AC_BITMAP_RESET(ab, ac) (((ab) &= ~(1 << (ac))))
+
+/* Management PKT Lifetime indices */
+/* Removing flag checks 'BCMINTERNAL || WLTEST'
+ * while merging MERGE BIS120RC4 to DINGO2
+ */
+#define MGMT_ALL               0xffff
+#define MGMT_AUTH_LT   FC_SUBTYPE_AUTH
+#define MGMT_ASSOC_LT  FC_SUBTYPE_ASSOC_REQ
+
+/** WME Information Element (IE) */
+BWL_PRE_PACKED_STRUCT struct wme_ie {
+       uint8 oui[3];
+       uint8 type;
+       uint8 subtype;
+       uint8 version;
+       uint8 qosinfo;
+} BWL_POST_PACKED_STRUCT;
+typedef struct wme_ie wme_ie_t;
+#define WME_IE_LEN 7   /* WME IE length */
+
+BWL_PRE_PACKED_STRUCT struct edcf_acparam {
+       uint8   ACI;
+       uint8   ECW;
+       uint16  TXOP;           /* stored in network order (ls octet first) */
+} BWL_POST_PACKED_STRUCT;
+typedef struct edcf_acparam edcf_acparam_t;
+
+/** WME Parameter Element (PE) */
+BWL_PRE_PACKED_STRUCT struct wme_param_ie {
+       uint8 oui[3];
+       uint8 type;
+       uint8 subtype;
+       uint8 version;
+       uint8 qosinfo;
+       uint8 rsvd;
+       edcf_acparam_t acparam[AC_COUNT];
+} BWL_POST_PACKED_STRUCT;
+typedef struct wme_param_ie wme_param_ie_t;
+#define WME_PARAM_IE_LEN            24          /* WME Parameter IE length */
+
+/* QoS Info field for IE as sent from AP */
+#define WME_QI_AP_APSD_MASK         0x80        /* U-APSD Supported mask */
+#define WME_QI_AP_APSD_SHIFT        7           /* U-APSD Supported shift */
+#define WME_QI_AP_COUNT_MASK        0x0f        /* Parameter set count mask */
+#define WME_QI_AP_COUNT_SHIFT       0           /* Parameter set count shift */
+
+/* QoS Info field for IE as sent from STA */
+#define WME_QI_STA_MAXSPLEN_MASK    0x60        /* Max Service Period Length mask */
+#define WME_QI_STA_MAXSPLEN_SHIFT   5           /* Max Service Period Length shift */
+#define WME_QI_STA_APSD_ALL_MASK    0xf         /* APSD all AC bits mask */
+#define WME_QI_STA_APSD_ALL_SHIFT   0           /* APSD all AC bits shift */
+#define WME_QI_STA_APSD_BE_MASK     0x8         /* APSD AC_BE mask */
+#define WME_QI_STA_APSD_BE_SHIFT    3           /* APSD AC_BE shift */
+#define WME_QI_STA_APSD_BK_MASK     0x4         /* APSD AC_BK mask */
+#define WME_QI_STA_APSD_BK_SHIFT    2           /* APSD AC_BK shift */
+#define WME_QI_STA_APSD_VI_MASK     0x2         /* APSD AC_VI mask */
+#define WME_QI_STA_APSD_VI_SHIFT    1           /* APSD AC_VI shift */
+#define WME_QI_STA_APSD_VO_MASK     0x1         /* APSD AC_VO mask */
+#define WME_QI_STA_APSD_VO_SHIFT    0           /* APSD AC_VO shift */
+
+/* ACI */
+#define EDCF_AIFSN_MIN               1           /* AIFSN minimum value */
+#define EDCF_AIFSN_MAX               15          /* AIFSN maximum value */
+#define EDCF_AIFSN_MASK              0x0f        /* AIFSN mask */
+#define EDCF_ACM_MASK                0x10        /* ACM mask */
+#define EDCF_ACI_MASK                0x60        /* ACI mask */
+#define EDCF_ACI_SHIFT               5           /* ACI shift */
+#define EDCF_AIFSN_SHIFT             12          /* 4 MSB(0xFFF) in ifs_ctl for AC idx */
+
+/* ECW */
+#define EDCF_ECW_MIN                 0           /* cwmin/cwmax exponent minimum value */
+#define EDCF_ECW_MAX                 15          /* cwmin/cwmax exponent maximum value */
+#define EDCF_ECW2CW(exp)             ((1 << (exp)) - 1)
+#define EDCF_ECWMIN_MASK             0x0f        /* cwmin exponent form mask */
+#define EDCF_ECWMAX_MASK             0xf0        /* cwmax exponent form mask */
+#define EDCF_ECWMAX_SHIFT            4           /* cwmax exponent form shift */
+
+/* TXOP */
+#define EDCF_TXOP_MIN                0           /* TXOP minimum value */
+#define EDCF_TXOP_MAX                65535       /* TXOP maximum value */
+#define EDCF_TXOP2USEC(txop)         ((txop) << 5)
+
+/* Default BE ACI value for non-WME connection STA */
+#define NON_EDCF_AC_BE_ACI_STA          0x02
+
+/* Default EDCF parameters that AP advertises for STA to use; WMM draft Table 12 */
+#define EDCF_AC_BE_ACI_STA           0x03      /* STA ACI value for best effort AC */
+#define EDCF_AC_BE_ECW_STA           0xA4      /* STA ECW value for best effort AC */
+#define EDCF_AC_BE_TXOP_STA          0x0000    /* STA TXOP value for best effort AC */
+#define EDCF_AC_BK_ACI_STA           0x27      /* STA ACI value for background AC */
+#define EDCF_AC_BK_ECW_STA           0xA4      /* STA ECW value for background AC */
+#define EDCF_AC_BK_TXOP_STA          0x0000    /* STA TXOP value for background AC */
+#define EDCF_AC_VI_ACI_STA           0x42      /* STA ACI value for video AC */
+#define EDCF_AC_VI_ECW_STA           0x43      /* STA ECW value for video AC */
+#define EDCF_AC_VI_TXOP_STA          0x005e    /* STA TXOP value for video AC */
+#define EDCF_AC_VO_ACI_STA           0x62      /* STA ACI value for audio AC */
+#define EDCF_AC_VO_ECW_STA           0x32      /* STA ECW value for audio AC */
+#define EDCF_AC_VO_TXOP_STA          0x002f    /* STA TXOP value for audio AC */
+
+/* Default EDCF parameters that AP uses; WMM draft Table 14 */
+#define EDCF_AC_BE_ACI_AP            0x03      /* AP ACI value for best effort AC */
+#define EDCF_AC_BE_ECW_AP            0x64      /* AP ECW value for best effort AC */
+#define EDCF_AC_BE_TXOP_AP           0x0000    /* AP TXOP value for best effort AC */
+#define EDCF_AC_BK_ACI_AP            0x27      /* AP ACI value for background AC */
+#define EDCF_AC_BK_ECW_AP            0xA4      /* AP ECW value for background AC */
+#define EDCF_AC_BK_TXOP_AP           0x0000    /* AP TXOP value for background AC */
+#define EDCF_AC_VI_ACI_AP            0x41      /* AP ACI value for video AC */
+#define EDCF_AC_VI_ECW_AP            0x43      /* AP ECW value for video AC */
+#define EDCF_AC_VI_TXOP_AP           0x005e    /* AP TXOP value for video AC */
+#define EDCF_AC_VO_ACI_AP            0x61      /* AP ACI value for audio AC */
+#define EDCF_AC_VO_ECW_AP            0x32      /* AP ECW value for audio AC */
+#define EDCF_AC_VO_TXOP_AP           0x002f    /* AP TXOP value for audio AC */
+
+/** EDCA Parameter IE */
+BWL_PRE_PACKED_STRUCT struct edca_param_ie {
+       uint8 qosinfo;
+       uint8 rsvd;
+       edcf_acparam_t acparam[AC_COUNT];
+} BWL_POST_PACKED_STRUCT;
+typedef struct edca_param_ie edca_param_ie_t;
+#define EDCA_PARAM_IE_LEN            18          /* EDCA Parameter IE length */
+
+/** QoS Capability IE */
+BWL_PRE_PACKED_STRUCT struct qos_cap_ie {
+       uint8 qosinfo;
+} BWL_POST_PACKED_STRUCT;
+typedef struct qos_cap_ie qos_cap_ie_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_qbss_load_ie {
+       uint8 id;                       /* 11, DOT11_MNG_QBSS_LOAD_ID */
+       uint8 length;
+       uint16 station_count;           /* total number of STAs associated */
+       uint8 channel_utilization;      /* % of time, normalized to 255, QAP sensed medium busy */
+       uint16 aac;                     /* available admission capacity */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_qbss_load_ie dot11_qbss_load_ie_t;
+#define BSS_LOAD_IE_SIZE       7       /* BSS load IE size */
+
+#define WLC_QBSS_LOAD_CHAN_FREE_MAX    0xff    /* max for channel free score */
+
+/* nom_msdu_size */
+#define FIXED_MSDU_SIZE 0x8000         /* MSDU size is fixed */
+#define MSDU_SIZE_MASK 0x7fff          /* (Nominal or fixed) MSDU size */
+
+/* surplus_bandwidth */
+/* Represented as 3 bits of integer, binary point, 13 bits fraction */
+#define        INTEGER_SHIFT   13      /* integer shift */
+#define FRACTION_MASK  0x1FFF  /* fraction mask */
+
+/** Management Notification Frame */
+BWL_PRE_PACKED_STRUCT struct dot11_management_notification {
+       uint8 category;                 /* DOT11_ACTION_NOTIFICATION */
+       uint8 action;
+       uint8 token;
+       uint8 status;
+       uint8 data[1];                  /* Elements */
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_MGMT_NOTIFICATION_LEN 4  /* Fixed length */
+
+/** Timeout Interval IE */
+BWL_PRE_PACKED_STRUCT struct ti_ie {
+       uint8 ti_type;
+       uint32 ti_val;
+} BWL_POST_PACKED_STRUCT;
+typedef struct ti_ie ti_ie_t;
+#define TI_TYPE_REASSOC_DEADLINE       1
+#define TI_TYPE_KEY_LIFETIME           2
+
+/* WME Action Codes */
+#define WME_ADDTS_REQUEST      0       /* WME ADDTS request */
+#define WME_ADDTS_RESPONSE     1       /* WME ADDTS response */
+#define WME_DELTS_REQUEST      2       /* WME DELTS request */
+
+/* WME Setup Response Status Codes */
+#define WME_ADMISSION_ACCEPTED         0       /* WME admission accepted */
+#define WME_INVALID_PARAMETERS         1       /* WME invalide parameters */
+#define WME_ADMISSION_REFUSED          3       /* WME admission refused */
+
+/* Macro to take a pointer to a beacon or probe response
+ * body and return the char* pointer to the SSID info element
+ */
+#define BCN_PRB_SSID(body) ((char*)(body) + DOT11_BCN_PRB_LEN)
+
+/* Authentication frame payload constants */
+#define DOT11_OPEN_SYSTEM      0       /* d11 open authentication */
+#define DOT11_SHARED_KEY       1       /* d11 shared authentication */
+#define DOT11_FAST_BSS         2       /* d11 fast bss authentication */
+#define DOT11_CHALLENGE_LEN    128     /* d11 challenge text length */
+
+/* Frame control macros */
+#define FC_PVER_MASK           0x3     /* PVER mask */
+#define FC_PVER_SHIFT          0       /* PVER shift */
+#define FC_TYPE_MASK           0xC     /* type mask */
+#define FC_TYPE_SHIFT          2       /* type shift */
+#define FC_SUBTYPE_MASK                0xF0    /* subtype mask */
+#define FC_SUBTYPE_SHIFT       4       /* subtype shift */
+#define FC_TODS                        0x100   /* to DS */
+#define FC_TODS_SHIFT          8       /* to DS shift */
+#define FC_FROMDS              0x200   /* from DS */
+#define FC_FROMDS_SHIFT                9       /* from DS shift */
+#define FC_MOREFRAG            0x400   /* more frag. */
+#define FC_MOREFRAG_SHIFT      10      /* more frag. shift */
+#define FC_RETRY               0x800   /* retry */
+#define FC_RETRY_SHIFT         11      /* retry shift */
+#define FC_PM                  0x1000  /* PM */
+#define FC_PM_SHIFT            12      /* PM shift */
+#define FC_MOREDATA            0x2000  /* more data */
+#define FC_MOREDATA_SHIFT      13      /* more data shift */
+#define FC_WEP                 0x4000  /* WEP */
+#define FC_WEP_SHIFT           14      /* WEP shift */
+#define FC_ORDER               0x8000  /* order */
+#define FC_ORDER_SHIFT         15      /* order shift */
+
+/* sequence control macros */
+#define SEQNUM_SHIFT           4       /* seq. number shift */
+#define SEQNUM_MAX             0x1000  /* max seqnum + 1 */
+#define FRAGNUM_MASK           0xF     /* frag. number mask */
+
+/* Frame Control type/subtype defs */
+
+/* FC Types */
+#define FC_TYPE_MNG            0       /* management type */
+#define FC_TYPE_CTL            1       /* control type */
+#define FC_TYPE_DATA           2       /* data type */
+
+/* Management Subtypes */
+#define FC_SUBTYPE_ASSOC_REQ           0       /* assoc. request */
+#define FC_SUBTYPE_ASSOC_RESP          1       /* assoc. response */
+#define FC_SUBTYPE_REASSOC_REQ         2       /* reassoc. request */
+#define FC_SUBTYPE_REASSOC_RESP                3       /* reassoc. response */
+#define FC_SUBTYPE_PROBE_REQ           4       /* probe request */
+#define FC_SUBTYPE_PROBE_RESP          5       /* probe response */
+#define FC_SUBTYPE_BEACON              8       /* beacon */
+#define FC_SUBTYPE_ATIM                        9       /* ATIM */
+#define FC_SUBTYPE_DISASSOC            10      /* disassoc. */
+#define FC_SUBTYPE_AUTH                        11      /* authentication */
+#define FC_SUBTYPE_DEAUTH              12      /* de-authentication */
+#define FC_SUBTYPE_ACTION              13      /* action */
+#define FC_SUBTYPE_ACTION_NOACK                14      /* action no-ack */
+
+/* Control Subtypes */
+#define FC_SUBTYPE_CTL_WRAPPER         7       /* Control Wrapper */
+#define FC_SUBTYPE_BLOCKACK_REQ                8       /* Block Ack Req */
+#define FC_SUBTYPE_BLOCKACK            9       /* Block Ack */
+#define FC_SUBTYPE_PS_POLL             10      /* PS poll */
+#define FC_SUBTYPE_RTS                 11      /* RTS */
+#define FC_SUBTYPE_CTS                 12      /* CTS */
+#define FC_SUBTYPE_ACK                 13      /* ACK */
+#define FC_SUBTYPE_CF_END              14      /* CF-END */
+#define FC_SUBTYPE_CF_END_ACK          15      /* CF-END ACK */
+
+/* Data Subtypes */
+#define FC_SUBTYPE_DATA                        0       /* Data */
+#define FC_SUBTYPE_DATA_CF_ACK         1       /* Data + CF-ACK */
+#define FC_SUBTYPE_DATA_CF_POLL                2       /* Data + CF-Poll */
+#define FC_SUBTYPE_DATA_CF_ACK_POLL    3       /* Data + CF-Ack + CF-Poll */
+#define FC_SUBTYPE_NULL                        4       /* Null */
+#define FC_SUBTYPE_CF_ACK              5       /* CF-Ack */
+#define FC_SUBTYPE_CF_POLL             6       /* CF-Poll */
+#define FC_SUBTYPE_CF_ACK_POLL         7       /* CF-Ack + CF-Poll */
+#define FC_SUBTYPE_QOS_DATA            8       /* QoS Data */
+#define FC_SUBTYPE_QOS_DATA_CF_ACK     9       /* QoS Data + CF-Ack */
+#define FC_SUBTYPE_QOS_DATA_CF_POLL    10      /* QoS Data + CF-Poll */
+#define FC_SUBTYPE_QOS_DATA_CF_ACK_POLL        11      /* QoS Data + CF-Ack + CF-Poll */
+#define FC_SUBTYPE_QOS_NULL            12      /* QoS Null */
+#define FC_SUBTYPE_QOS_CF_POLL         14      /* QoS CF-Poll */
+#define FC_SUBTYPE_QOS_CF_ACK_POLL     15      /* QoS CF-Ack + CF-Poll */
+
+/* Data Subtype Groups */
+#define FC_SUBTYPE_ANY_QOS(s)          (((s) & 8) != 0)
+#define FC_SUBTYPE_ANY_NULL(s)         (((s) & 4) != 0)
+#define FC_SUBTYPE_ANY_CF_POLL(s)      (((s) & 2) != 0)
+#define FC_SUBTYPE_ANY_CF_ACK(s)       (((s) & 1) != 0)
+#define FC_SUBTYPE_ANY_PSPOLL(s)       (((s) & 10) != 0)
+
+/* Type/Subtype Combos */
+#define FC_KIND_MASK           (FC_TYPE_MASK | FC_SUBTYPE_MASK)        /* FC kind mask */
+
+#define FC_KIND(t, s)  (((t) << FC_TYPE_SHIFT) | ((s) << FC_SUBTYPE_SHIFT))    /* FC kind */
+
+#define FC_SUBTYPE(fc) (((fc) & FC_SUBTYPE_MASK) >> FC_SUBTYPE_SHIFT)  /* Subtype from FC */
+#define FC_TYPE(fc)    (((fc) & FC_TYPE_MASK) >> FC_TYPE_SHIFT)        /* Type from FC */
+
+#define FC_ASSOC_REQ   FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ASSOC_REQ)      /* assoc. request */
+#define FC_ASSOC_RESP  FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ASSOC_RESP)     /* assoc. response */
+#define FC_REASSOC_REQ FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_REASSOC_REQ)    /* reassoc. request */
+#define FC_REASSOC_RESP        FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_REASSOC_RESP)   /* reassoc. response */
+#define FC_PROBE_REQ   FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_PROBE_REQ)      /* probe request */
+#define FC_PROBE_RESP  FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_PROBE_RESP)     /* probe response */
+#define FC_BEACON      FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_BEACON)         /* beacon */
+#define FC_ATIM                FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ATIM)           /* ATIM */
+#define FC_DISASSOC    FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_DISASSOC)       /* disassoc */
+#define FC_AUTH                FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_AUTH)           /* authentication */
+#define FC_DEAUTH      FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_DEAUTH)         /* deauthentication */
+#define FC_ACTION      FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ACTION)         /* action */
+#define FC_ACTION_NOACK        FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ACTION_NOACK)   /* action no-ack */
+
+#define FC_CTL_WRAPPER FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CTL_WRAPPER)    /* Control Wrapper */
+#define FC_BLOCKACK_REQ        FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_BLOCKACK_REQ)   /* Block Ack Req */
+#define FC_BLOCKACK    FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_BLOCKACK)       /* Block Ack */
+#define FC_PS_POLL     FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_PS_POLL)        /* PS poll */
+#define FC_RTS         FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_RTS)            /* RTS */
+#define FC_CTS         FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CTS)            /* CTS */
+#define FC_ACK         FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_ACK)            /* ACK */
+#define FC_CF_END      FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CF_END)         /* CF-END */
+#define FC_CF_END_ACK  FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CF_END_ACK)     /* CF-END ACK */
+
+#define FC_DATA                FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_DATA)          /* data */
+#define FC_NULL_DATA   FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_NULL)          /* null data */
+#define FC_DATA_CF_ACK FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_DATA_CF_ACK)   /* data CF ACK */
+#define FC_QOS_DATA    FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_QOS_DATA)      /* QoS data */
+#define FC_QOS_NULL    FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_QOS_NULL)      /* QoS null */
+
+/* QoS Control Field */
+
+/* 802.1D Priority */
+#define QOS_PRIO_SHIFT         0       /* QoS priority shift */
+#define QOS_PRIO_MASK          0x0007  /* QoS priority mask */
+#define QOS_PRIO(qos)          (((qos) & QOS_PRIO_MASK) >> QOS_PRIO_SHIFT)     /* QoS priority */
+
+/* Traffic Identifier */
+#define QOS_TID_SHIFT          0       /* QoS TID shift */
+#define QOS_TID_MASK           0x000f  /* QoS TID mask */
+#define QOS_TID(qos)           (((qos) & QOS_TID_MASK) >> QOS_TID_SHIFT)       /* QoS TID */
+
+/* End of Service Period (U-APSD) */
+#define QOS_EOSP_SHIFT         4       /* QoS End of Service Period shift */
+#define QOS_EOSP_MASK          0x0010  /* QoS End of Service Period mask */
+#define QOS_EOSP(qos)          (((qos) & QOS_EOSP_MASK) >> QOS_EOSP_SHIFT)     /* Qos EOSP */
+
+/* Ack Policy */
+#define QOS_ACK_NORMAL_ACK     0       /* Normal Ack */
+#define QOS_ACK_NO_ACK         1       /* No Ack (eg mcast) */
+#define QOS_ACK_NO_EXP_ACK     2       /* No Explicit Ack */
+#define QOS_ACK_BLOCK_ACK      3       /* Block Ack */
+#define QOS_ACK_SHIFT          5       /* QoS ACK shift */
+#define QOS_ACK_MASK           0x0060  /* QoS ACK mask */
+#define QOS_ACK(qos)           (((qos) & QOS_ACK_MASK) >> QOS_ACK_SHIFT)       /* QoS ACK */
+
+/* A-MSDU flag */
+#define QOS_AMSDU_SHIFT                7       /* AMSDU shift */
+#define QOS_AMSDU_MASK         0x0080  /* AMSDU mask */
+
+/* Management Frames */
+
+/* Management Frame Constants */
+
+/* Fixed fields */
+#define DOT11_MNG_AUTH_ALGO_LEN                2       /* d11 management auth. algo. length */
+#define DOT11_MNG_AUTH_SEQ_LEN         2       /* d11 management auth. seq. length */
+#define DOT11_MNG_BEACON_INT_LEN       2       /* d11 management beacon interval length */
+#define DOT11_MNG_CAP_LEN              2       /* d11 management cap. length */
+#define DOT11_MNG_AP_ADDR_LEN          6       /* d11 management AP address length */
+#define DOT11_MNG_LISTEN_INT_LEN       2       /* d11 management listen interval length */
+#define DOT11_MNG_REASON_LEN           2       /* d11 management reason length */
+#define DOT11_MNG_AID_LEN              2       /* d11 management AID length */
+#define DOT11_MNG_STATUS_LEN           2       /* d11 management status length */
+#define DOT11_MNG_TIMESTAMP_LEN                8       /* d11 management timestamp length */
+
+/* DUR/ID field in assoc resp is 0xc000 | AID */
+#define DOT11_AID_MASK                 0x3fff  /* d11 AID mask */
+
+/* Reason Codes */
+#define DOT11_RC_RESERVED              0       /* d11 RC reserved */
+#define DOT11_RC_UNSPECIFIED           1       /* Unspecified reason */
+#define DOT11_RC_AUTH_INVAL            2       /* Previous authentication no longer valid */
+#define DOT11_RC_DEAUTH_LEAVING                3       /* Deauthenticated because sending station
+                                                * is leaving (or has left) IBSS or ESS
+                                                */
+#define DOT11_RC_INACTIVITY            4       /* Disassociated due to inactivity */
+#define DOT11_RC_BUSY                  5       /* Disassociated because AP is unable to handle
+                                                * all currently associated stations
+                                                */
+#define DOT11_RC_INVAL_CLASS_2         6       /* Class 2 frame received from
+                                                * nonauthenticated station
+                                                */
+#define DOT11_RC_INVAL_CLASS_3         7       /* Class 3 frame received from
+                                                *  nonassociated station
+                                                */
+#define DOT11_RC_DISASSOC_LEAVING      8       /* Disassociated because sending station is
+                                                * leaving (or has left) BSS
+                                                */
+#define DOT11_RC_NOT_AUTH              9       /* Station requesting (re)association is not
+                                                * authenticated with responding station
+                                                */
+#define DOT11_RC_BAD_PC                        10      /* Unacceptable power capability element */
+#define DOT11_RC_BAD_CHANNELS          11      /* Unacceptable supported channels element */
+
+/* 12 is unused by STA but could be used by AP/GO */
+#define DOT11_RC_DISASSOC_BTM          12      /* Disassociated due to BSS Transition Magmt */
+
+
+/* 32-39 are QSTA specific reasons added in 11e */
+#define DOT11_RC_UNSPECIFIED_QOS       32      /* unspecified QoS-related reason */
+#define DOT11_RC_INSUFFCIENT_BW                33      /* QAP lacks sufficient bandwidth */
+#define DOT11_RC_EXCESSIVE_FRAMES      34      /* excessive number of frames need ack */
+#define DOT11_RC_TX_OUTSIDE_TXOP       35      /* transmitting outside the limits of txop */
+#define DOT11_RC_LEAVING_QBSS          36      /* QSTA is leaving the QBSS (or restting) */
+#define DOT11_RC_BAD_MECHANISM         37      /* does not want to use the mechanism */
+#define DOT11_RC_SETUP_NEEDED          38      /* mechanism needs a setup */
+#define DOT11_RC_TIMEOUT               39      /* timeout */
+
+#define DOT11_RC_MESH_PEERING_CANCELLED                52
+#define DOT11_RC_MESH_MAX_PEERS                        53
+#define DOT11_RC_MESH_CONFIG_POLICY_VIOLN      54
+#define DOT11_RC_MESH_CLOSE_RECVD              55
+#define DOT11_RC_MESH_MAX_RETRIES              56
+#define DOT11_RC_MESH_CONFIRM_TIMEOUT          57
+#define DOT11_RC_MESH_INVALID_GTK              58
+#define DOT11_RC_MESH_INCONSISTENT_PARAMS      59
+
+#define DOT11_RC_MESH_INVALID_SEC_CAP          60
+#define DOT11_RC_MESH_PATHERR_NOPROXYINFO      61
+#define DOT11_RC_MESH_PATHERR_NOFWINFO         62
+#define DOT11_RC_MESH_PATHERR_DSTUNREACH       63
+#define DOT11_RC_MESH_MBSSMAC_EXISTS           64
+#define DOT11_RC_MESH_CHANSWITCH_REGREQ                65
+#define DOT11_RC_MESH_CHANSWITCH_UNSPEC                66
+
+#define DOT11_RC_MAX                   66      /* Reason codes > 66 are reserved */
+
+#define DOT11_RC_TDLS_PEER_UNREACH     25
+#define DOT11_RC_TDLS_DOWN_UNSPECIFIED 26
+
+/* Status Codes */
+#define DOT11_SC_SUCCESS               0       /* Successful */
+#define DOT11_SC_FAILURE               1       /* Unspecified failure */
+#define DOT11_SC_TDLS_WAKEUP_SCH_ALT 2 /* TDLS wakeup schedule rejected but alternative  */
+                                       /* schedule provided */
+#define DOT11_SC_TDLS_WAKEUP_SCH_REJ 3 /* TDLS wakeup schedule rejected */
+#define DOT11_SC_TDLS_SEC_DISABLED     5       /* TDLS Security disabled */
+#define DOT11_SC_LIFETIME_REJ          6       /* Unacceptable lifetime */
+#define DOT11_SC_NOT_SAME_BSS          7       /* Not in same BSS */
+#define DOT11_SC_CAP_MISMATCH          10      /* Cannot support all requested
+                                                * capabilities in the Capability
+                                                * Information field
+                                                */
+#define DOT11_SC_REASSOC_FAIL          11      /* Reassociation denied due to inability
+                                                * to confirm that association exists
+                                                */
+#define DOT11_SC_ASSOC_FAIL            12      /* Association denied due to reason
+                                                * outside the scope of this standard
+                                                */
+#define DOT11_SC_AUTH_MISMATCH         13      /* Responding station does not support
+                                                * the specified authentication
+                                                * algorithm
+                                                */
+#define DOT11_SC_AUTH_SEQ              14      /* Received an Authentication frame
+                                                * with authentication transaction
+                                                * sequence number out of expected
+                                                * sequence
+                                                */
+#define DOT11_SC_AUTH_CHALLENGE_FAIL   15      /* Authentication rejected because of
+                                                * challenge failure
+                                                */
+#define DOT11_SC_AUTH_TIMEOUT          16      /* Authentication rejected due to timeout
+                                                * waiting for next frame in sequence
+                                                */
+#define DOT11_SC_ASSOC_BUSY_FAIL       17      /* Association denied because AP is
+                                                * unable to handle additional
+                                                * associated stations
+                                                */
+#define DOT11_SC_ASSOC_RATE_MISMATCH   18      /* Association denied due to requesting
+                                                * station not supporting all of the
+                                                * data rates in the BSSBasicRateSet
+                                                * parameter
+                                                */
+#define DOT11_SC_ASSOC_SHORT_REQUIRED  19      /* Association denied due to requesting
+                                                * station not supporting the Short
+                                                * Preamble option
+                                                */
+#define DOT11_SC_ASSOC_PBCC_REQUIRED   20      /* Association denied due to requesting
+                                                * station not supporting the PBCC
+                                                * Modulation option
+                                                */
+#define DOT11_SC_ASSOC_AGILITY_REQUIRED        21      /* Association denied due to requesting
+                                                * station not supporting the Channel
+                                                * Agility option
+                                                */
+#define DOT11_SC_ASSOC_SPECTRUM_REQUIRED       22      /* Association denied because Spectrum
+                                                        * Management capability is required.
+                                                        */
+#define DOT11_SC_ASSOC_BAD_POWER_CAP   23      /* Association denied because the info
+                                                * in the Power Cap element is
+                                                * unacceptable.
+                                                */
+#define DOT11_SC_ASSOC_BAD_SUP_CHANNELS        24      /* Association denied because the info
+                                                * in the Supported Channel element is
+                                                * unacceptable
+                                                */
+#define DOT11_SC_ASSOC_SHORTSLOT_REQUIRED      25      /* Association denied due to requesting
+                                                        * station not supporting the Short Slot
+                                                        * Time option
+                                                        */
+#define DOT11_SC_ASSOC_DSSSOFDM_REQUIRED 26    /* Association denied because requesting station
+                                                * does not support the DSSS-OFDM option
+                                                */
+#define DOT11_SC_ASSOC_HT_REQUIRED     27      /* Association denied because the requesting
+                                                * station does not support HT features
+                                                */
+#define DOT11_SC_ASSOC_R0KH_UNREACHABLE        28      /* Association denied due to AP
+                                                * being unable to reach the R0 Key Holder
+                                                */
+#define DOT11_SC_ASSOC_TRY_LATER       30      /* Association denied temporarily, try again later
+                                                */
+#define DOT11_SC_ASSOC_MFP_VIOLATION   31      /* Association denied due to Robust Management
+                                                * frame policy violation
+                                                */
+
+#define        DOT11_SC_DECLINED               37      /* request declined */
+#define        DOT11_SC_INVALID_PARAMS         38      /* One or more params have invalid values */
+#define DOT11_SC_INVALID_PAIRWISE_CIPHER       42 /* invalid pairwise cipher */
+#define        DOT11_SC_INVALID_AKMP           43      /* Association denied due to invalid AKMP */
+#define DOT11_SC_INVALID_RSNIE_CAP     45      /* invalid RSN IE capabilities */
+#define DOT11_SC_DLS_NOT_ALLOWED       48      /* DLS is not allowed in the BSS by policy */
+#define        DOT11_SC_INVALID_PMKID          53      /* Association denied due to invalid PMKID */
+#define        DOT11_SC_INVALID_MDID           54      /* Association denied due to invalid MDID */
+#define        DOT11_SC_INVALID_FTIE           55      /* Association denied due to invalid FTIE */
+
+#define DOT11_SC_ADV_PROTO_NOT_SUPPORTED       59      /* ad proto not supported */
+#define DOT11_SC_NO_OUTSTAND_REQ                       60      /* no outstanding req */
+#define DOT11_SC_RSP_NOT_RX_FROM_SERVER                61      /* no response from server */
+#define DOT11_SC_TIMEOUT                                       62      /* timeout */
+#define DOT11_SC_QUERY_RSP_TOO_LARGE           63      /* query rsp too large */
+#define DOT11_SC_SERVER_UNREACHABLE                    65      /* server unreachable */
+
+#define DOT11_SC_UNEXP_MSG                     70      /* Unexpected message */
+#define DOT11_SC_INVALID_SNONCE                71      /* Invalid SNonce */
+#define DOT11_SC_INVALID_RSNIE         72      /* Invalid contents of RSNIE */
+
+#define DOT11_SC_ANTICLOG_TOCKEN_REQUIRED      76      /* Anti-clogging tocken required */
+#define DOT11_SC_INVALID_FINITE_CYCLIC_GRP     77      /* Invalid contents of RSNIE */
+
+#define DOT11_SC_ASSOC_VHT_REQUIRED    104     /* Association denied because the requesting
+                                                * station does not support VHT features.
+                                                */
+
+#define DOT11_SC_TRANSMIT_FAILURE      79      /* transmission failure */
+
+/* Info Elts, length of INFORMATION portion of Info Elts */
+#define DOT11_MNG_DS_PARAM_LEN                 1       /* d11 management DS parameter length */
+#define DOT11_MNG_IBSS_PARAM_LEN               2       /* d11 management IBSS parameter length */
+
+/* TIM Info element has 3 bytes fixed info in INFORMATION field,
+ * followed by 1 to 251 bytes of Partial Virtual Bitmap
+ */
+#define DOT11_MNG_TIM_FIXED_LEN                        3       /* d11 management TIM fixed length */
+#define DOT11_MNG_TIM_DTIM_COUNT               0       /* d11 management DTIM count */
+#define DOT11_MNG_TIM_DTIM_PERIOD              1       /* d11 management DTIM period */
+#define DOT11_MNG_TIM_BITMAP_CTL               2       /* d11 management TIM BITMAP control  */
+#define DOT11_MNG_TIM_PVB                      3       /* d11 management TIM PVB */
+
+/* TLV defines */
+#define TLV_TAG_OFF            0       /* tag offset */
+#define TLV_LEN_OFF            1       /* length offset */
+#define TLV_HDR_LEN            2       /* header length */
+#define TLV_BODY_OFF           2       /* body offset */
+#define TLV_BODY_LEN_MAX       255     /* max body length */
+
+/* Management Frame Information Element IDs */
+#define DOT11_MNG_SSID_ID                      0       /* d11 management SSID id */
+#define DOT11_MNG_RATES_ID                     1       /* d11 management rates id */
+#define DOT11_MNG_FH_PARMS_ID                  2       /* d11 management FH parameter id */
+#define DOT11_MNG_DS_PARMS_ID                  3       /* d11 management DS parameter id */
+#define DOT11_MNG_CF_PARMS_ID                  4       /* d11 management CF parameter id */
+#define DOT11_MNG_TIM_ID                       5       /* d11 management TIM id */
+#define DOT11_MNG_IBSS_PARMS_ID                        6       /* d11 management IBSS parameter id */
+#define DOT11_MNG_COUNTRY_ID                   7       /* d11 management country id */
+#define DOT11_MNG_HOPPING_PARMS_ID             8       /* d11 management hopping parameter id */
+#define DOT11_MNG_HOPPING_TABLE_ID             9       /* d11 management hopping table id */
+#define DOT11_MNG_FTM_SYNC_INFO_ID             9       /* 11mc D4.3 */
+#define DOT11_MNG_REQUEST_ID                   10      /* d11 management request id */
+#define DOT11_MNG_QBSS_LOAD_ID                         11      /* d11 management QBSS Load id */
+#define DOT11_MNG_EDCA_PARAM_ID                        12      /* 11E EDCA Parameter id */
+#define DOT11_MNG_TSPEC_ID                     13      /* d11 management TSPEC id */
+#define DOT11_MNG_TCLAS_ID                     14      /* d11 management TCLAS id */
+#define DOT11_MNG_CHALLENGE_ID                 16      /* d11 management chanllenge id */
+#define DOT11_MNG_PWR_CONSTRAINT_ID            32      /* 11H PowerConstraint */
+#define DOT11_MNG_PWR_CAP_ID                   33      /* 11H PowerCapability */
+#define DOT11_MNG_TPC_REQUEST_ID               34      /* 11H TPC Request */
+#define DOT11_MNG_TPC_REPORT_ID                        35      /* 11H TPC Report */
+#define DOT11_MNG_SUPP_CHANNELS_ID             36      /* 11H Supported Channels */
+#define DOT11_MNG_CHANNEL_SWITCH_ID            37      /* 11H ChannelSwitch Announcement */
+#define DOT11_MNG_MEASURE_REQUEST_ID           38      /* 11H MeasurementRequest */
+#define DOT11_MNG_MEASURE_REPORT_ID            39      /* 11H MeasurementReport */
+#define DOT11_MNG_QUIET_ID                     40      /* 11H Quiet */
+#define DOT11_MNG_IBSS_DFS_ID                  41      /* 11H IBSS_DFS */
+#define DOT11_MNG_ERP_ID                       42      /* d11 management ERP id */
+#define DOT11_MNG_TS_DELAY_ID                  43      /* d11 management TS Delay id */
+#define DOT11_MNG_TCLAS_PROC_ID                        44      /* d11 management TCLAS processing id */
+#define        DOT11_MNG_HT_CAP                        45      /* d11 mgmt HT cap id */
+#define DOT11_MNG_QOS_CAP_ID                   46      /* 11E QoS Capability id */
+#define DOT11_MNG_NONERP_ID                    47      /* d11 management NON-ERP id */
+#define DOT11_MNG_RSN_ID                       48      /* d11 management RSN id */
+#define DOT11_MNG_EXT_RATES_ID                 50      /* d11 management ext. rates id */
+#define DOT11_MNG_AP_CHREP_ID                  51      /* 11k AP Channel report id */
+#define DOT11_MNG_NEIGHBOR_REP_ID              52      /* 11k & 11v Neighbor report id */
+#define DOT11_MNG_RCPI_ID                      53      /* 11k RCPI */
+#define DOT11_MNG_MDIE_ID                      54      /* 11r Mobility domain id */
+#define DOT11_MNG_FTIE_ID                      55      /* 11r Fast Bss Transition id */
+#define DOT11_MNG_FT_TI_ID                     56      /* 11r Timeout Interval id */
+#define DOT11_MNG_RDE_ID                       57      /* 11r RIC Data Element id */
+#define        DOT11_MNG_REGCLASS_ID                   59      /* d11 management regulatory class id */
+#define DOT11_MNG_EXT_CSA_ID                   60      /* d11 Extended CSA */
+#define        DOT11_MNG_HT_ADD                        61      /* d11 mgmt additional HT info */
+#define        DOT11_MNG_EXT_CHANNEL_OFFSET            62      /* d11 mgmt ext channel offset */
+#define DOT11_MNG_BSS_AVR_ACCESS_DELAY_ID      63      /* 11k bss average access delay */
+#define DOT11_MNG_ANTENNA_ID                   64      /* 11k antenna id */
+#define DOT11_MNG_RSNI_ID                      65      /* 11k RSNI id */
+#define DOT11_MNG_MEASUREMENT_PILOT_TX_ID      66      /* 11k measurement pilot tx info id */
+#define DOT11_MNG_BSS_AVAL_ADMISSION_CAP_ID    67      /* 11k bss aval admission cap id */
+#define DOT11_MNG_BSS_AC_ACCESS_DELAY_ID       68      /* 11k bss AC access delay id */
+#define DOT11_MNG_WAPI_ID                      68      /* d11 management WAPI id */
+#define DOT11_MNG_TIME_ADVERTISE_ID    69      /* 11p time advertisement */
+#define DOT11_MNG_RRM_CAP_ID           70      /* 11k radio measurement capability */
+#define DOT11_MNG_MULTIPLE_BSSID_ID            71      /* 11k multiple BSSID id */
+#define        DOT11_MNG_HT_BSS_COEXINFO_ID            72      /* d11 mgmt OBSS Coexistence INFO */
+#define        DOT11_MNG_HT_BSS_CHANNEL_REPORT_ID      73      /* d11 mgmt OBSS Intolerant Channel list */
+#define        DOT11_MNG_HT_OBSS_ID                    74      /* d11 mgmt OBSS HT info */
+#define DOT11_MNG_MMIE_ID                      76      /* d11 mgmt MIC IE */
+#define DOT11_MNG_FMS_DESCR_ID                 86      /* 11v FMS descriptor */
+#define DOT11_MNG_FMS_REQ_ID                   87      /* 11v FMS request id */
+#define DOT11_MNG_FMS_RESP_ID                  88      /* 11v FMS response id */
+#define DOT11_MNG_BSS_MAX_IDLE_PERIOD_ID       90      /* 11v bss max idle id */
+#define DOT11_MNG_TFS_REQUEST_ID               91      /* 11v tfs request id */
+#define DOT11_MNG_TFS_RESPONSE_ID              92      /* 11v tfs response id */
+#define DOT11_MNG_WNM_SLEEP_MODE_ID            93      /* 11v wnm-sleep mode id */
+#define DOT11_MNG_TIMBC_REQ_ID                 94      /* 11v TIM broadcast request id */
+#define DOT11_MNG_TIMBC_RESP_ID                        95      /* 11v TIM broadcast response id */
+#define DOT11_MNG_CHANNEL_USAGE                        97      /* 11v channel usage */
+#define DOT11_MNG_TIME_ZONE_ID                 98      /* 11v time zone */
+#define DOT11_MNG_DMS_REQUEST_ID               99      /* 11v dms request id */
+#define DOT11_MNG_DMS_RESPONSE_ID              100     /* 11v dms response id */
+#define DOT11_MNG_LINK_IDENTIFIER_ID           101     /* 11z TDLS Link Identifier IE */
+#define DOT11_MNG_WAKEUP_SCHEDULE_ID           102     /* 11z TDLS Wakeup Schedule IE */
+#define DOT11_MNG_CHANNEL_SWITCH_TIMING_ID     104     /* 11z TDLS Channel Switch Timing IE */
+#define DOT11_MNG_PTI_CONTROL_ID               105     /* 11z TDLS PTI Control IE */
+#define DOT11_MNG_PU_BUFFER_STATUS_ID          106     /* 11z TDLS PU Buffer Status IE */
+#define DOT11_MNG_INTERWORKING_ID              107     /* 11u interworking */
+#define DOT11_MNG_ADVERTISEMENT_ID             108     /* 11u advertisement protocol */
+#define DOT11_MNG_EXP_BW_REQ_ID                        109     /* 11u expedited bandwith request */
+#define DOT11_MNG_QOS_MAP_ID                   110     /* 11u QoS map set */
+#define DOT11_MNG_ROAM_CONSORT_ID              111     /* 11u roaming consortium */
+#define DOT11_MNG_EMERGCY_ALERT_ID             112     /* 11u emergency alert identifier */
+#define DOT11_MNG_MESH_CONFIG                  113     /* Mesh Configuration */
+#define DOT11_MNG_MESH_ID                      114     /* Mesh ID */
+#define DOT11_MNG_MESH_PEER_MGMT_ID            117     /* Mesh PEER MGMT IE */
+#define DOT11_MNG_EXT_CAP_ID                   127     /* d11 mgmt ext capability */
+#define DOT11_MNG_EXT_PREQ_ID                  130     /* Mesh PREQ IE */
+#define DOT11_MNG_EXT_PREP_ID                  131     /* Mesh PREP IE */
+#define DOT11_MNG_EXT_PERR_ID                  132     /* Mesh PERR IE */
+#define        DOT11_MNG_VHT_CAP_ID                    191     /* d11 mgmt VHT cap id */
+#define        DOT11_MNG_VHT_OPERATION_ID              192     /* d11 mgmt VHT op id */
+#define        DOT11_MNG_EXT_BSSLOAD_ID                193     /* d11 mgmt VHT extended bss load id */
+#define DOT11_MNG_WIDE_BW_CHANNEL_SWITCH_ID    194     /* Wide BW Channel Switch IE */
+#define DOT11_MNG_VHT_TRANSMIT_POWER_ENVELOPE_ID 195   /* VHT transmit Power Envelope IE */
+#define DOT11_MNG_CHANNEL_SWITCH_WRAPPER_ID    196     /* Channel Switch Wrapper IE */
+#define DOT11_MNG_AID_ID                       197     /* Association ID  IE */
+#define        DOT11_MNG_OPER_MODE_NOTIF_ID            199     /* d11 mgmt VHT oper mode notif */
+#define DOT11_MNG_HE_CAP_ID                    201
+#define DOT11_MNG_HE_OP_ID                     202
+#define DOT11_MNG_FTM_PARAMS_ID                        206
+#define DOT11_MNG_TWT_ID                       216     /* 11ah D5.0 */
+#define DOT11_MNG_WPA_ID                       221     /* d11 management WPA id */
+#define DOT11_MNG_PROPR_ID                     221
+/* should start using this one instead of above two */
+#define DOT11_MNG_VS_ID                                221     /* d11 management Vendor Specific IE */
+
+#define DOT11_MNG_ID_EXT_ID                    255     /* Element ID Extension 11mc D4.3 */
+
+#define DOT11_MNG_IE_ID_EXT_MATCH(_ie, _id) (\
+       ((_ie)->id == DOT11_MNG_ID_EXT_ID) && \
+       ((_ie)->len > 0) && \
+       ((_id) == ((uint8 *)(_ie) + TLV_HDR_LEN)[0]))
+
+#define DOT11_MNG_IE_ID_EXT_INIT(_ie, _id, _len) do {\
+               (_ie)->id = DOT11_MNG_ID_EXT_ID; \
+               (_ie)->len = _len; \
+               (_ie)->id_ext = _id; \
+       } while (0)
+
+/* Rate Defines */
+
+/* Valid rates for the Supported Rates and Extended Supported Rates IEs.
+ * Encoding is the rate in 500kbps units, rouding up for fractional values.
+ * 802.11-2012, section 6.5.5.2, DATA_RATE parameter enumerates all the values.
+ * The rate values cover DSSS, HR/DSSS, ERP, and OFDM phy rates.
+ * The defines below do not cover the rates specific to 10MHz, {3, 4.5, 27},
+ * and 5MHz, {1.5, 2.25, 3, 4.5, 13.5}, which are not supported by Broadcom devices.
+ */
+
+#define DOT11_RATE_1M   2       /* 1  Mbps in 500kbps units */
+#define DOT11_RATE_2M   4       /* 2  Mbps in 500kbps units */
+#define DOT11_RATE_5M5  11      /* 5.5 Mbps in 500kbps units */
+#define DOT11_RATE_11M  22      /* 11 Mbps in 500kbps units */
+#define DOT11_RATE_6M   12      /* 6  Mbps in 500kbps units */
+#define DOT11_RATE_9M   18      /* 9  Mbps in 500kbps units */
+#define DOT11_RATE_12M  24      /* 12 Mbps in 500kbps units */
+#define DOT11_RATE_18M  36      /* 18 Mbps in 500kbps units */
+#define DOT11_RATE_24M  48      /* 24 Mbps in 500kbps units */
+#define DOT11_RATE_36M  72      /* 36 Mbps in 500kbps units */
+#define DOT11_RATE_48M  96      /* 48 Mbps in 500kbps units */
+#define DOT11_RATE_54M  108     /* 54 Mbps in 500kbps units */
+#define DOT11_RATE_MAX  108     /* highest rate (54 Mbps) in 500kbps units */
+
+/* Supported Rates and Extended Supported Rates IEs
+ * The supported rates octets are defined a the MSB indicatin a Basic Rate
+ * and bits 0-6 as the rate value
+ */
+#define DOT11_RATE_BASIC                0x80 /* flag for a Basic Rate */
+#define DOT11_RATE_MASK                 0x7F /* mask for numeric part of rate */
+
+/* BSS Membership Selector parameters
+ * 802.11-2012 and 802.11ac_D4.0 sec 8.4.2.3
+ * These selector values are advertised in Supported Rates and Extended Supported Rates IEs
+ * in the supported rates list with the Basic rate bit set.
+ * Constants below include the basic bit.
+ */
+#define DOT11_BSS_MEMBERSHIP_HT         0xFF  /* Basic 0x80 + 127, HT Required to join */
+#define DOT11_BSS_MEMBERSHIP_VHT        0xFE  /* Basic 0x80 + 126, VHT Required to join */
+
+/* ERP info element bit values */
+#define DOT11_MNG_ERP_LEN                      1       /* ERP is currently 1 byte long */
+#define DOT11_MNG_NONERP_PRESENT               0x01    /* NonERP (802.11b) STAs are present
+                                                        *in the BSS
+                                                        */
+#define DOT11_MNG_USE_PROTECTION               0x02    /* Use protection mechanisms for
+                                                        *ERP-OFDM frames
+                                                        */
+#define DOT11_MNG_BARKER_PREAMBLE              0x04    /* Short Preambles: 0 == allowed,
+                                                        * 1 == not allowed
+                                                        */
+/* TS Delay element offset & size */
+#define DOT11_MGN_TS_DELAY_LEN         4       /* length of TS DELAY IE */
+#define TS_DELAY_FIELD_SIZE                    4       /* TS DELAY field size */
+
+/* Capability Information Field */
+#define DOT11_CAP_ESS                          0x0001  /* d11 cap. ESS */
+#define DOT11_CAP_IBSS                         0x0002  /* d11 cap. IBSS */
+#define DOT11_CAP_POLLABLE                     0x0004  /* d11 cap. pollable */
+#define DOT11_CAP_POLL_RQ                      0x0008  /* d11 cap. poll request */
+#define DOT11_CAP_PRIVACY                      0x0010  /* d11 cap. privacy */
+#define DOT11_CAP_SHORT                                0x0020  /* d11 cap. short */
+#define DOT11_CAP_PBCC                         0x0040  /* d11 cap. PBCC */
+#define DOT11_CAP_AGILITY                      0x0080  /* d11 cap. agility */
+#define DOT11_CAP_SPECTRUM                     0x0100  /* d11 cap. spectrum */
+#define DOT11_CAP_QOS                          0x0200  /* d11 cap. qos */
+#define DOT11_CAP_SHORTSLOT                    0x0400  /* d11 cap. shortslot */
+#define DOT11_CAP_APSD                         0x0800  /* d11 cap. apsd */
+#define DOT11_CAP_RRM                          0x1000  /* d11 cap. 11k radio measurement */
+#define DOT11_CAP_CCK_OFDM                     0x2000  /* d11 cap. CCK/OFDM */
+#define DOT11_CAP_DELAY_BA                     0x4000  /* d11 cap. delayed block ack */
+#define DOT11_CAP_IMMEDIATE_BA                 0x8000  /* d11 cap. immediate block ack */
+
+/* Extended capabilities IE bitfields */
+/* 20/40 BSS Coexistence Management support bit position */
+#define DOT11_EXT_CAP_OBSS_COEX_MGMT           0
+/* Extended Channel Switching support bit position */
+#define DOT11_EXT_CAP_EXT_CHAN_SWITCHING       2
+/* scheduled PSMP support bit position */
+#define DOT11_EXT_CAP_SPSMP                    6
+/*  Flexible Multicast Service */
+#define DOT11_EXT_CAP_FMS                      11
+/* proxy ARP service support bit position */
+#define DOT11_EXT_CAP_PROXY_ARP                        12
+/* Civic Location */
+#define DOT11_EXT_CAP_CIVIC_LOC                        14
+/* Geospatial Location */
+#define DOT11_EXT_CAP_LCI                      15
+/* Traffic Filter Service */
+#define DOT11_EXT_CAP_TFS                      16
+/* WNM-Sleep Mode */
+#define DOT11_EXT_CAP_WNM_SLEEP                        17
+/* TIM Broadcast service */
+#define DOT11_EXT_CAP_TIMBC                    18
+/* BSS Transition Management support bit position */
+#define DOT11_EXT_CAP_BSSTRANS_MGMT            19
+/* Direct Multicast Service */
+#define DOT11_EXT_CAP_DMS                      26
+/* Interworking support bit position */
+#define DOT11_EXT_CAP_IW                       31
+/* QoS map support bit position */
+#define DOT11_EXT_CAP_QOS_MAP          32
+/* service Interval granularity bit position and mask */
+#define DOT11_EXT_CAP_SI                       41
+#define DOT11_EXT_CAP_SI_MASK                  0x0E
+/* Location Identifier service */
+#define DOT11_EXT_CAP_IDENT_LOC                        44
+/* WNM notification */
+#define DOT11_EXT_CAP_WNM_NOTIF                        46
+/* Operating mode notification - VHT (11ac D3.0 - 8.4.2.29) */
+#define DOT11_EXT_CAP_OPER_MODE_NOTIF          62
+/* Fine timing measurement - D3.0 */
+#define DOT11_EXT_CAP_FTM_RESPONDER            70
+#define DOT11_EXT_CAP_FTM_INITIATOR            71 /* tentative 11mcd3.0 */
+#ifdef WL_FTM
+#define DOT11_EXT_CAP_MAX_BIT_IDX              95      /* !!!update this please!!! */
+#else
+#define DOT11_EXT_CAP_MAX_BIT_IDX              62      /* !!!update this please!!! */
+#endif
+
+/* extended capability */
+#ifndef DOT11_EXTCAP_LEN_MAX
+#define DOT11_EXTCAP_LEN_MAX ((DOT11_EXT_CAP_MAX_BIT_IDX + 8) >> 3)
+#endif
+
+BWL_PRE_PACKED_STRUCT struct dot11_extcap {
+       uint8 extcap[DOT11_EXTCAP_LEN_MAX];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_extcap dot11_extcap_t;
+
+/* VHT Operating mode bit fields -  (11ac D3.0 - 8.4.1.50) */
+#define DOT11_OPER_MODE_CHANNEL_WIDTH_SHIFT 0
+#define DOT11_OPER_MODE_CHANNEL_WIDTH_MASK 0x3
+#define DOT11_OPER_MODE_RXNSS_SHIFT 4
+#define DOT11_OPER_MODE_RXNSS_MASK 0x70
+#define DOT11_OPER_MODE_RXNSS_TYPE_SHIFT 7
+#define DOT11_OPER_MODE_RXNSS_TYPE_MASK 0x80
+
+#define DOT11_OPER_MODE(type, nss, chanw) (\
+       ((type) << DOT11_OPER_MODE_RXNSS_TYPE_SHIFT &\
+                DOT11_OPER_MODE_RXNSS_TYPE_MASK) |\
+       (((nss) - 1) << DOT11_OPER_MODE_RXNSS_SHIFT & DOT11_OPER_MODE_RXNSS_MASK) |\
+       ((chanw) << DOT11_OPER_MODE_CHANNEL_WIDTH_SHIFT &\
+                DOT11_OPER_MODE_CHANNEL_WIDTH_MASK))
+
+#define DOT11_OPER_MODE_CHANNEL_WIDTH(mode) \
+       (((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK)\
+               >> DOT11_OPER_MODE_CHANNEL_WIDTH_SHIFT)
+#define DOT11_OPER_MODE_RXNSS(mode) \
+       ((((mode) & DOT11_OPER_MODE_RXNSS_MASK)         \
+               >> DOT11_OPER_MODE_RXNSS_SHIFT) + 1)
+#define DOT11_OPER_MODE_RXNSS_TYPE(mode) \
+       (((mode) & DOT11_OPER_MODE_RXNSS_TYPE_MASK)\
+               >> DOT11_OPER_MODE_RXNSS_TYPE_SHIFT)
+
+#define DOT11_OPER_MODE_20MHZ 0
+#define DOT11_OPER_MODE_40MHZ 1
+#define DOT11_OPER_MODE_80MHZ 2
+#define DOT11_OPER_MODE_160MHZ 3
+#define DOT11_OPER_MODE_8080MHZ 3
+
+#define DOT11_OPER_MODE_CHANNEL_WIDTH_20MHZ(mode) (\
+       ((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_20MHZ)
+#define DOT11_OPER_MODE_CHANNEL_WIDTH_40MHZ(mode) (\
+       ((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_40MHZ)
+#define DOT11_OPER_MODE_CHANNEL_WIDTH_80MHZ(mode) (\
+       ((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_80MHZ)
+#define DOT11_OPER_MODE_CHANNEL_WIDTH_160MHZ(mode) (\
+       ((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_160MHZ)
+#define DOT11_OPER_MODE_CHANNEL_WIDTH_8080MHZ(mode) (\
+       ((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_8080MHZ)
+
+/* Operating mode information element 802.11ac D3.0 - 8.4.2.168 */
+BWL_PRE_PACKED_STRUCT struct dot11_oper_mode_notif_ie {
+       uint8 mode;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_oper_mode_notif_ie dot11_oper_mode_notif_ie_t;
+
+#define DOT11_OPER_MODE_NOTIF_IE_LEN 1
+
+/* Extended Capability Information Field */
+#define DOT11_OBSS_COEX_MNG_SUPPORT    0x01    /* 20/40 BSS Coexistence Management support */
+
+/*
+ * Action Frame Constants
+ */
+#define DOT11_ACTION_HDR_LEN           2       /* action frame category + action field */
+#define DOT11_ACTION_CAT_OFF           0       /* category offset */
+#define DOT11_ACTION_ACT_OFF           1       /* action offset */
+
+/* Action Category field (sec 8.4.1.11) */
+#define DOT11_ACTION_CAT_ERR_MASK      0x80    /* category error mask */
+#define DOT11_ACTION_CAT_MASK          0x7F    /* category mask */
+#define DOT11_ACTION_CAT_SPECT_MNG     0       /* category spectrum management */
+#define DOT11_ACTION_CAT_QOS           1       /* category QoS */
+#define DOT11_ACTION_CAT_DLS           2       /* category DLS */
+#define DOT11_ACTION_CAT_BLOCKACK      3       /* category block ack */
+#define DOT11_ACTION_CAT_PUBLIC                4       /* category public */
+#define DOT11_ACTION_CAT_RRM           5       /* category radio measurements */
+#define DOT11_ACTION_CAT_FBT   6       /* category fast bss transition */
+#define DOT11_ACTION_CAT_HT            7       /* category for HT */
+#define        DOT11_ACTION_CAT_SA_QUERY       8       /* security association query */
+#define        DOT11_ACTION_CAT_PDPA           9       /* protected dual of public action */
+#define DOT11_ACTION_CAT_WNM           10      /* category for WNM */
+#define DOT11_ACTION_CAT_UWNM          11      /* category for Unprotected WNM */
+#define DOT11_ACTION_CAT_MESH          13      /* category for Mesh */
+#define DOT11_ACTION_CAT_SELFPROT      15      /* category for Mesh, self protected */
+#define DOT11_ACTION_NOTIFICATION      17
+#define DOT11_ACTION_CAT_VHT           21      /* VHT action */
+#define DOT11_ACTION_CAT_HE            26      /* HE action frame */
+#define DOT11_ACTION_CAT_VSP           126     /* protected vendor specific */
+#define DOT11_ACTION_CAT_VS            127     /* category Vendor Specific */
+
+/* Spectrum Management Action IDs (sec 7.4.1) */
+#define DOT11_SM_ACTION_M_REQ          0       /* d11 action measurement request */
+#define DOT11_SM_ACTION_M_REP          1       /* d11 action measurement response */
+#define DOT11_SM_ACTION_TPC_REQ                2       /* d11 action TPC request */
+#define DOT11_SM_ACTION_TPC_REP                3       /* d11 action TPC response */
+#define DOT11_SM_ACTION_CHANNEL_SWITCH 4       /* d11 action channel switch */
+#define DOT11_SM_ACTION_EXT_CSA                5       /* d11 extened CSA for 11n */
+
+/* QoS action ids */
+#define DOT11_QOS_ACTION_ADDTS_REQ     0       /* d11 action ADDTS request */
+#define DOT11_QOS_ACTION_ADDTS_RESP    1       /* d11 action ADDTS response */
+#define DOT11_QOS_ACTION_DELTS         2       /* d11 action DELTS */
+#define DOT11_QOS_ACTION_SCHEDULE      3       /* d11 action schedule */
+#define DOT11_QOS_ACTION_QOS_MAP       4       /* d11 action QOS map */
+
+/* HT action ids */
+#define DOT11_ACTION_ID_HT_CH_WIDTH    0       /* notify channel width action id */
+#define DOT11_ACTION_ID_HT_MIMO_PS     1       /* mimo ps action id */
+
+/* Public action ids */
+#define DOT11_PUB_ACTION_BSS_COEX_MNG  0       /* 20/40 Coexistence Management action id */
+#define DOT11_PUB_ACTION_CHANNEL_SWITCH        4       /* d11 action channel switch */
+#define DOT11_PUB_ACTION_GAS_CB_REQ    12      /* GAS Comeback Request */
+#define DOT11_PUB_ACTION_FTM_REQ       32              /* FTM request */
+#define DOT11_PUB_ACTION_FTM           33              /* FTM measurement */
+
+/* Block Ack action types */
+#define DOT11_BA_ACTION_ADDBA_REQ      0       /* ADDBA Req action frame type */
+#define DOT11_BA_ACTION_ADDBA_RESP     1       /* ADDBA Resp action frame type */
+#define DOT11_BA_ACTION_DELBA          2       /* DELBA action frame type */
+
+/* ADDBA action parameters */
+#define DOT11_ADDBA_PARAM_AMSDU_SUP    0x0001  /* AMSDU supported under BA */
+#define DOT11_ADDBA_PARAM_POLICY_MASK  0x0002  /* policy mask(ack vs delayed) */
+#define DOT11_ADDBA_PARAM_POLICY_SHIFT 1       /* policy shift */
+#define DOT11_ADDBA_PARAM_TID_MASK     0x003c  /* tid mask */
+#define DOT11_ADDBA_PARAM_TID_SHIFT    2       /* tid shift */
+#define DOT11_ADDBA_PARAM_BSIZE_MASK   0xffc0  /* buffer size mask */
+#define DOT11_ADDBA_PARAM_BSIZE_SHIFT  6       /* buffer size shift */
+
+#define DOT11_ADDBA_POLICY_DELAYED     0       /* delayed BA policy */
+#define DOT11_ADDBA_POLICY_IMMEDIATE   1       /* immediate BA policy */
+
+/* Fast Transition action types */
+#define DOT11_FT_ACTION_FT_RESERVED            0
+#define DOT11_FT_ACTION_FT_REQ                 1       /* FBT request - for over-the-DS FBT */
+#define DOT11_FT_ACTION_FT_RES                 2       /* FBT response - for over-the-DS FBT */
+#define DOT11_FT_ACTION_FT_CON                 3       /* FBT confirm - for OTDS with RRP */
+#define DOT11_FT_ACTION_FT_ACK                 4       /* FBT ack */
+
+/* DLS action types */
+#define DOT11_DLS_ACTION_REQ                   0       /* DLS Request */
+#define DOT11_DLS_ACTION_RESP                  1       /* DLS Response */
+#define DOT11_DLS_ACTION_TD                    2       /* DLS Teardown */
+
+/* Wireless Network Management (WNM) action types */
+#define DOT11_WNM_ACTION_EVENT_REQ             0
+#define DOT11_WNM_ACTION_EVENT_REP             1
+#define DOT11_WNM_ACTION_DIAG_REQ              2
+#define DOT11_WNM_ACTION_DIAG_REP              3
+#define DOT11_WNM_ACTION_LOC_CFG_REQ           4
+#define DOT11_WNM_ACTION_LOC_RFG_RESP          5
+#define DOT11_WNM_ACTION_BSSTRANS_QUERY                6
+#define DOT11_WNM_ACTION_BSSTRANS_REQ          7
+#define DOT11_WNM_ACTION_BSSTRANS_RESP         8
+#define DOT11_WNM_ACTION_FMS_REQ               9
+#define DOT11_WNM_ACTION_FMS_RESP              10
+#define DOT11_WNM_ACTION_COL_INTRFRNCE_REQ     11
+#define DOT11_WNM_ACTION_COL_INTRFRNCE_REP     12
+#define DOT11_WNM_ACTION_TFS_REQ               13
+#define DOT11_WNM_ACTION_TFS_RESP              14
+#define DOT11_WNM_ACTION_TFS_NOTIFY_REQ                15
+#define DOT11_WNM_ACTION_WNM_SLEEP_REQ         16
+#define DOT11_WNM_ACTION_WNM_SLEEP_RESP                17
+#define DOT11_WNM_ACTION_TIMBC_REQ             18
+#define DOT11_WNM_ACTION_TIMBC_RESP            19
+#define DOT11_WNM_ACTION_QOS_TRFC_CAP_UPD      20
+#define DOT11_WNM_ACTION_CHAN_USAGE_REQ                21
+#define DOT11_WNM_ACTION_CHAN_USAGE_RESP       22
+#define DOT11_WNM_ACTION_DMS_REQ               23
+#define DOT11_WNM_ACTION_DMS_RESP              24
+#define DOT11_WNM_ACTION_TMNG_MEASUR_REQ       25
+#define DOT11_WNM_ACTION_NOTFCTN_REQ           26
+#define DOT11_WNM_ACTION_NOTFCTN_RESP          27
+#define DOT11_WNM_ACTION_TFS_NOTIFY_RESP       28
+
+/* Unprotected Wireless Network Management (WNM) action types */
+#define DOT11_UWNM_ACTION_TIM                  0
+#define DOT11_UWNM_ACTION_TIMING_MEASUREMENT   1
+
+#define DOT11_MNG_COUNTRY_ID_LEN 3
+
+/* VHT category action types - 802.11ac D3.0 - 8.5.23.1 */
+#define DOT11_VHT_ACTION_CBF                           0       /* Compressed Beamforming */
+#define DOT11_VHT_ACTION_GID_MGMT                      1       /* Group ID Management */
+#define DOT11_VHT_ACTION_OPER_MODE_NOTIF       2       /* Operating mode notif'n */
+
+/** DLS Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_dls_req {
+       uint8 category;                 /* category of action frame (2) */
+       uint8 action;                           /* DLS action: req (0) */
+       struct ether_addr       da;             /* destination address */
+       struct ether_addr       sa;             /* source address */
+       uint16 cap;                             /* capability */
+       uint16 timeout;                 /* timeout value */
+       uint8 data[1];                          /* IE:support rate, extend support rate, HT cap */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dls_req dot11_dls_req_t;
+#define DOT11_DLS_REQ_LEN 18   /* Fixed length */
+
+/** DLS response frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_dls_resp {
+       uint8 category;                 /* category of action frame (2) */
+       uint8 action;                           /* DLS action: req (0) */
+       uint16 status;                          /* status code field */
+       struct ether_addr       da;             /* destination address */
+       struct ether_addr       sa;             /* source address */
+       uint8 data[1];                          /* optional: capability, rate ... */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dls_resp dot11_dls_resp_t;
+#define DOT11_DLS_RESP_LEN 16  /* Fixed length */
+
+
+/* ************* 802.11v related definitions. ************* */
+
+/** BSS Management Transition Query frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_bsstrans_query {
+       uint8 category;                 /* category of action frame (10) */
+       uint8 action;                   /* WNM action: trans_query (6) */
+       uint8 token;                    /* dialog token */
+       uint8 reason;                   /* transition query reason */
+       uint8 data[1];                  /* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_bsstrans_query dot11_bsstrans_query_t;
+#define DOT11_BSSTRANS_QUERY_LEN 4     /* Fixed length */
+
+/* BTM transition reason */
+#define DOT11_BSSTRANS_REASON_UNSPECIFIED              0
+#define DOT11_BSSTRANS_REASON_EXC_FRAME_LOSS           1
+#define DOT11_BSSTRANS_REASON_EXC_TRAFFIC_DELAY                2
+#define DOT11_BSSTRANS_REASON_INSUFF_QOS_CAPACITY      3
+#define DOT11_BSSTRANS_REASON_FIRST_ASSOC              4
+#define DOT11_BSSTRANS_REASON_LOAD_BALANCING           5
+#define DOT11_BSSTRANS_REASON_BETTER_AP_FOUND          6
+#define DOT11_BSSTRANS_REASON_DEAUTH_RX                        7
+#define DOT11_BSSTRANS_REASON_8021X_EAP_AUTH_FAIL      8
+#define DOT11_BSSTRANS_REASON_4WAY_HANDSHK_FAIL                9
+#define DOT11_BSSTRANS_REASON_MANY_REPLAYCNT_FAIL      10
+#define DOT11_BSSTRANS_REASON_MANY_DATAMIC_FAIL                11
+#define DOT11_BSSTRANS_REASON_EXCEED_MAX_RETRANS       12
+#define DOT11_BSSTRANS_REASON_MANY_BCAST_DISASSOC_RX   13
+#define DOT11_BSSTRANS_REASON_MANY_BCAST_DEAUTH_RX     14
+#define DOT11_BSSTRANS_REASON_PREV_TRANSITION_FAIL     15
+#define DOT11_BSSTRANS_REASON_LOW_RSSI                 16
+#define DOT11_BSSTRANS_REASON_ROAM_FROM_NON_80211      17
+#define DOT11_BSSTRANS_REASON_RX_BTM_REQ               18
+#define DOT11_BSSTRANS_REASON_PREF_LIST_INCLUDED       19
+#define DOT11_BSSTRANS_REASON_LEAVING_ESS              20
+
+/** BSS Management Transition Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_bsstrans_req {
+       uint8 category;                 /* category of action frame (10) */
+       uint8 action;                   /* WNM action: trans_req (7) */
+       uint8 token;                    /* dialog token */
+       uint8 reqmode;                  /* transition request mode */
+       uint16 disassoc_tmr;            /* disassociation timer */
+       uint8 validity_intrvl;          /* validity interval */
+       uint8 data[1];                  /* optional: BSS term duration, ... */
+                                               /* ...session info URL, candidate list */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_bsstrans_req dot11_bsstrans_req_t;
+#define DOT11_BSSTRANS_REQ_LEN 7       /* Fixed length */
+
+/* BSS Mgmt Transition Request Mode Field - 802.11v */
+#define DOT11_BSSTRANS_REQMODE_PREF_LIST_INCL          0x01
+#define DOT11_BSSTRANS_REQMODE_ABRIDGED                        0x02
+#define DOT11_BSSTRANS_REQMODE_DISASSOC_IMMINENT       0x04
+#define DOT11_BSSTRANS_REQMODE_BSS_TERM_INCL           0x08
+#define DOT11_BSSTRANS_REQMODE_ESS_DISASSOC_IMNT       0x10
+
+/** BSS Management transition response frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_bsstrans_resp {
+       uint8 category;                 /* category of action frame (10) */
+       uint8 action;                   /* WNM action: trans_resp (8) */
+       uint8 token;                    /* dialog token */
+       uint8 status;                   /* transition status */
+       uint8 term_delay;               /* validity interval */
+       uint8 data[1];                  /* optional: BSSID target, candidate list */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_bsstrans_resp dot11_bsstrans_resp_t;
+#define DOT11_BSSTRANS_RESP_LEN 5      /* Fixed length */
+
+/* BSS Mgmt Transition Response Status Field */
+#define DOT11_BSSTRANS_RESP_STATUS_ACCEPT                      0
+#define DOT11_BSSTRANS_RESP_STATUS_REJECT                      1
+#define DOT11_BSSTRANS_RESP_STATUS_REJ_INSUFF_BCN              2
+#define DOT11_BSSTRANS_RESP_STATUS_REJ_INSUFF_CAP              3
+#define DOT11_BSSTRANS_RESP_STATUS_REJ_TERM_UNDESIRED          4
+#define DOT11_BSSTRANS_RESP_STATUS_REJ_TERM_DELAY_REQ          5
+#define DOT11_BSSTRANS_RESP_STATUS_REJ_BSS_LIST_PROVIDED       6
+#define DOT11_BSSTRANS_RESP_STATUS_REJ_NO_SUITABLE_BSS         7
+#define DOT11_BSSTRANS_RESP_STATUS_REJ_LEAVING_ESS             8
+
+
+/** BSS Max Idle Period element */
+BWL_PRE_PACKED_STRUCT struct dot11_bss_max_idle_period_ie {
+       uint8 id;                               /* 90, DOT11_MNG_BSS_MAX_IDLE_PERIOD_ID */
+       uint8 len;
+       uint16 max_idle_period;                 /* in unit of 1000 TUs */
+       uint8 idle_opt;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_bss_max_idle_period_ie dot11_bss_max_idle_period_ie_t;
+#define DOT11_BSS_MAX_IDLE_PERIOD_IE_LEN       3       /* bss max idle period IE size */
+#define DOT11_BSS_MAX_IDLE_PERIOD_OPT_PROTECTED        1       /* BSS max idle option */
+
+/** TIM Broadcast request element */
+BWL_PRE_PACKED_STRUCT struct dot11_timbc_req_ie {
+       uint8 id;                               /* 94, DOT11_MNG_TIMBC_REQ_ID */
+       uint8 len;
+       uint8 interval;                         /* in unit of beacon interval */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_timbc_req_ie dot11_timbc_req_ie_t;
+#define DOT11_TIMBC_REQ_IE_LEN         1       /* Fixed length */
+
+/** TIM Broadcast request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_timbc_req {
+       uint8 category;                         /* category of action frame (10) */
+       uint8 action;                           /* WNM action: DOT11_WNM_ACTION_TIMBC_REQ(18) */
+       uint8 token;                            /* dialog token */
+       uint8 data[1];                          /* TIM broadcast request element */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_timbc_req dot11_timbc_req_t;
+#define DOT11_TIMBC_REQ_LEN            3       /* Fixed length */
+
+/** TIM Broadcast response element */
+BWL_PRE_PACKED_STRUCT struct dot11_timbc_resp_ie {
+       uint8 id;                               /* 95, DOT11_MNG_TIM_BROADCAST_RESP_ID */
+       uint8 len;
+       uint8 status;                           /* status of add request */
+       uint8 interval;                         /* in unit of beacon interval */
+       int32 offset;                           /* in unit of ms */
+       uint16 high_rate;                       /* in unit of 0.5 Mb/s */
+       uint16 low_rate;                        /* in unit of 0.5 Mb/s */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_timbc_resp_ie dot11_timbc_resp_ie_t;
+#define DOT11_TIMBC_DENY_RESP_IE_LEN   1       /* Deny. Fixed length */
+#define DOT11_TIMBC_ACCEPT_RESP_IE_LEN 10      /* Accept. Fixed length */
+
+#define DOT11_TIMBC_STATUS_ACCEPT              0
+#define DOT11_TIMBC_STATUS_ACCEPT_TSTAMP       1
+#define DOT11_TIMBC_STATUS_DENY                        2
+#define DOT11_TIMBC_STATUS_OVERRIDDEN          3
+#define DOT11_TIMBC_STATUS_RESERVED            4
+
+/** TIM Broadcast request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_timbc_resp {
+       uint8 category;                 /* category of action frame (10) */
+       uint8 action;                   /* action: DOT11_WNM_ACTION_TIMBC_RESP(19) */
+       uint8 token;                    /* dialog token */
+       uint8 data[1];                  /* TIM broadcast response element */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_timbc_resp dot11_timbc_resp_t;
+#define DOT11_TIMBC_RESP_LEN   3       /* Fixed length */
+
+/** TIM element */
+BWL_PRE_PACKED_STRUCT struct dot11_tim_ie {
+       uint8 id;                       /* 5, DOT11_MNG_TIM_ID   */
+       uint8 len;                      /* 4 - 255 */
+       uint8 dtim_count;               /* DTIM decrementing counter */
+       uint8 dtim_period;              /* DTIM period */
+       uint8 bitmap_control;           /* AID 0 + bitmap offset */
+       uint8 pvb[1];                   /* Partial Virtual Bitmap, variable length */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tim_ie dot11_tim_ie_t;
+#define DOT11_TIM_IE_FIXED_LEN 3       /* Fixed length, without id and len */
+#define DOT11_TIM_IE_FIXED_TOTAL_LEN   5       /* Fixed length, with id and len */
+
+/** TIM Broadcast frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_timbc {
+       uint8 category;                 /* category of action frame (11) */
+       uint8 action;                   /* action: TIM (0) */
+       uint8 check_beacon;             /* need to check-beacon */
+       uint8 tsf[8];                   /* Time Synchronization Function */
+       dot11_tim_ie_t tim_ie;          /* TIM element */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_timbc dot11_timbc_t;
+#define DOT11_TIMBC_HDR_LEN    (sizeof(dot11_timbc_t) - sizeof(dot11_tim_ie_t))
+#define DOT11_TIMBC_FIXED_LEN  (sizeof(dot11_timbc_t) - 1)     /* Fixed length */
+#define DOT11_TIMBC_LEN                        11      /* Fixed length */
+
+/** TCLAS frame classifier type */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_hdr {
+       uint8 type;
+       uint8 mask;
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_fc_hdr dot11_tclas_fc_hdr_t;
+#define DOT11_TCLAS_FC_HDR_LEN         2       /* Fixed length */
+
+#define DOT11_TCLAS_MASK_0             0x1
+#define DOT11_TCLAS_MASK_1             0x2
+#define DOT11_TCLAS_MASK_2             0x4
+#define DOT11_TCLAS_MASK_3             0x8
+#define DOT11_TCLAS_MASK_4             0x10
+#define DOT11_TCLAS_MASK_5             0x20
+#define DOT11_TCLAS_MASK_6             0x40
+#define DOT11_TCLAS_MASK_7             0x80
+
+#define DOT11_TCLAS_FC_0_ETH           0
+#define DOT11_TCLAS_FC_1_IP            1
+#define DOT11_TCLAS_FC_2_8021Q         2
+#define DOT11_TCLAS_FC_3_OFFSET                3
+#define DOT11_TCLAS_FC_4_IP_HIGHER     4
+#define DOT11_TCLAS_FC_5_8021D         5
+
+/** TCLAS frame classifier type 0 parameters for Ethernet */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_0_eth {
+       uint8 type;
+       uint8 mask;
+       uint8 sa[ETHER_ADDR_LEN];
+       uint8 da[ETHER_ADDR_LEN];
+       uint16 eth_type;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_fc_0_eth dot11_tclas_fc_0_eth_t;
+#define DOT11_TCLAS_FC_0_ETH_LEN       16
+
+/** TCLAS frame classifier type 1 parameters for IPV4 */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_1_ipv4 {
+       uint8 type;
+       uint8 mask;
+       uint8 version;
+       uint32 src_ip;
+       uint32 dst_ip;
+       uint16 src_port;
+       uint16 dst_port;
+       uint8 dscp;
+       uint8 protocol;
+       uint8 reserved;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_fc_1_ipv4 dot11_tclas_fc_1_ipv4_t;
+#define DOT11_TCLAS_FC_1_IPV4_LEN      18
+
+/** TCLAS frame classifier type 2 parameters for 802.1Q */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_2_8021q {
+       uint8 type;
+       uint8 mask;
+       uint16 tci;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_fc_2_8021q dot11_tclas_fc_2_8021q_t;
+#define DOT11_TCLAS_FC_2_8021Q_LEN     4
+
+/** TCLAS frame classifier type 3 parameters for filter offset */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_3_filter {
+       uint8 type;
+       uint8 mask;
+       uint16 offset;
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_fc_3_filter dot11_tclas_fc_3_filter_t;
+#define DOT11_TCLAS_FC_3_FILTER_LEN    4
+
+/** TCLAS frame classifier type 4 parameters for IPV4 is the same as TCLAS type 1 */
+typedef struct dot11_tclas_fc_1_ipv4 dot11_tclas_fc_4_ipv4_t;
+#define DOT11_TCLAS_FC_4_IPV4_LEN      DOT11_TCLAS_FC_1_IPV4_LEN
+
+/** TCLAS frame classifier type 4 parameters for IPV6 */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_4_ipv6 {
+       uint8 type;
+       uint8 mask;
+       uint8 version;
+       uint8 saddr[16];
+       uint8 daddr[16];
+       uint16 src_port;
+       uint16 dst_port;
+       uint8 dscp;
+       uint8 nexthdr;
+       uint8 flow_lbl[3];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_fc_4_ipv6 dot11_tclas_fc_4_ipv6_t;
+#define DOT11_TCLAS_FC_4_IPV6_LEN      44
+
+/** TCLAS frame classifier type 5 parameters for 802.1D */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_5_8021d {
+       uint8 type;
+       uint8 mask;
+       uint8 pcp;
+       uint8 cfi;
+       uint16 vid;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_fc_5_8021d dot11_tclas_fc_5_8021d_t;
+#define DOT11_TCLAS_FC_5_8021D_LEN     6
+
+/** TCLAS frame classifier type parameters */
+BWL_PRE_PACKED_STRUCT union dot11_tclas_fc {
+       uint8 data[1];
+       dot11_tclas_fc_hdr_t hdr;
+       dot11_tclas_fc_0_eth_t t0_eth;
+       dot11_tclas_fc_1_ipv4_t t1_ipv4;
+       dot11_tclas_fc_2_8021q_t t2_8021q;
+       dot11_tclas_fc_3_filter_t t3_filter;
+       dot11_tclas_fc_4_ipv4_t t4_ipv4;
+       dot11_tclas_fc_4_ipv6_t t4_ipv6;
+       dot11_tclas_fc_5_8021d_t t5_8021d;
+} BWL_POST_PACKED_STRUCT;
+typedef union dot11_tclas_fc dot11_tclas_fc_t;
+
+#define DOT11_TCLAS_FC_MIN_LEN         4       /* Classifier Type 2 has the min size */
+#define DOT11_TCLAS_FC_MAX_LEN         254
+
+/** TCLAS element */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_ie {
+       uint8 id;                               /* 14, DOT11_MNG_TCLAS_ID */
+       uint8 len;
+       uint8 user_priority;
+       dot11_tclas_fc_t fc;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_ie dot11_tclas_ie_t;
+#define DOT11_TCLAS_IE_LEN             3       /* Fixed length, include id and len */
+
+/** TCLAS processing element */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_proc_ie {
+       uint8 id;                               /* 44, DOT11_MNG_TCLAS_PROC_ID */
+       uint8 len;
+       uint8 process;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_proc_ie dot11_tclas_proc_ie_t;
+#define DOT11_TCLAS_PROC_IE_LEN                3       /* Fixed length, include id and len */
+
+#define DOT11_TCLAS_PROC_MATCHALL      0       /* All high level element need to match */
+#define DOT11_TCLAS_PROC_MATCHONE      1       /* One high level element need to match */
+#define DOT11_TCLAS_PROC_NONMATCH      2       /* Non match to any high level element */
+
+
+/* TSPEC element defined in 802.11 std section 8.4.2.32 - Not supported */
+#define DOT11_TSPEC_IE_LEN             57      /* Fixed length */
+
+/** TFS request element */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_req_ie {
+       uint8 id;                               /* 91, DOT11_MNG_TFS_REQUEST_ID */
+       uint8 len;
+       uint8 tfs_id;
+       uint8 actcode;
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_req_ie dot11_tfs_req_ie_t;
+#define DOT11_TFS_REQ_IE_LEN           2       /* Fixed length, without id and len */
+
+/** TFS request action codes (bitfield) */
+#define DOT11_TFS_ACTCODE_DELETE       1
+#define DOT11_TFS_ACTCODE_NOTIFY       2
+
+/** TFS request subelement IDs */
+#define DOT11_TFS_REQ_TFS_SE_ID                1
+#define DOT11_TFS_REQ_VENDOR_SE_ID     221
+
+/** TFS subelement */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_se {
+       uint8 sub_id;
+       uint8 len;
+       uint8 data[1];                          /* TCLAS element(s) + optional TCLAS proc */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_se dot11_tfs_se_t;
+
+
+/** TFS response element */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_resp_ie {
+       uint8 id;                               /* 92, DOT11_MNG_TFS_RESPONSE_ID */
+       uint8 len;
+       uint8 tfs_id;
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_resp_ie dot11_tfs_resp_ie_t;
+#define DOT11_TFS_RESP_IE_LEN          1       /* Fixed length, without id and len */
+
+/** TFS response subelement IDs (same subelments, but different IDs than in TFS request */
+#define DOT11_TFS_RESP_TFS_STATUS_SE_ID                1
+#define DOT11_TFS_RESP_TFS_SE_ID               2
+#define DOT11_TFS_RESP_VENDOR_SE_ID            221
+
+/** TFS status subelement */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_status_se {
+       uint8 sub_id;                           /* 92, DOT11_MNG_TFS_RESPONSE_ID */
+       uint8 len;
+       uint8 resp_st;
+       uint8 data[1];                          /* Potential dot11_tfs_se_t included */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_status_se dot11_tfs_status_se_t;
+#define DOT11_TFS_STATUS_SE_LEN                        1       /* Fixed length, without id and len */
+
+/* Following Definition should be merged to FMS_TFS macro below */
+/* TFS Response status code. Identical to FMS Element status, without N/A  */
+#define DOT11_TFS_STATUS_ACCEPT                        0
+#define DOT11_TFS_STATUS_DENY_FORMAT           1
+#define DOT11_TFS_STATUS_DENY_RESOURCE         2
+#define DOT11_TFS_STATUS_DENY_POLICY           4
+#define DOT11_TFS_STATUS_DENY_UNSPECIFIED      5
+#define DOT11_TFS_STATUS_ALTPREF_POLICY                7
+#define DOT11_TFS_STATUS_ALTPREF_TCLAS_UNSUPP  14
+
+/* FMS Element Status and TFS Response Status Definition */
+#define DOT11_FMS_TFS_STATUS_ACCEPT            0
+#define DOT11_FMS_TFS_STATUS_DENY_FORMAT       1
+#define DOT11_FMS_TFS_STATUS_DENY_RESOURCE     2
+#define DOT11_FMS_TFS_STATUS_DENY_MULTIPLE_DI  3
+#define DOT11_FMS_TFS_STATUS_DENY_POLICY       4
+#define DOT11_FMS_TFS_STATUS_DENY_UNSPECIFIED  5
+#define DOT11_FMS_TFS_STATUS_ALT_DIFF_DI       6
+#define DOT11_FMS_TFS_STATUS_ALT_POLICY                7
+#define DOT11_FMS_TFS_STATUS_ALT_CHANGE_DI     8
+#define DOT11_FMS_TFS_STATUS_ALT_MCRATE                9
+#define DOT11_FMS_TFS_STATUS_TERM_POLICY       10
+#define DOT11_FMS_TFS_STATUS_TERM_RESOURCE     11
+#define DOT11_FMS_TFS_STATUS_TERM_HIGHER_PRIO  12
+#define DOT11_FMS_TFS_STATUS_ALT_CHANGE_MDI    13
+#define DOT11_FMS_TFS_STATUS_ALT_TCLAS_UNSUPP  14
+
+/** TFS Management Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_req {
+       uint8 category;                         /* category of action frame (10) */
+       uint8 action;                           /* WNM action: TFS request (13) */
+       uint8 token;                            /* dialog token */
+       uint8 data[1];                          /* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_req dot11_tfs_req_t;
+#define DOT11_TFS_REQ_LEN              3       /* Fixed length */
+
+/** TFS Management Response frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_resp {
+       uint8 category;                         /* category of action frame (10) */
+       uint8 action;                           /* WNM action: TFS request (14) */
+       uint8 token;                            /* dialog token */
+       uint8 data[1];                          /* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_resp dot11_tfs_resp_t;
+#define DOT11_TFS_RESP_LEN             3       /* Fixed length */
+
+/** TFS Management Notify frame request header */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_notify_req {
+       uint8 category;                         /* category of action frame (10) */
+       uint8 action;                           /* WNM action: TFS notify request (15) */
+       uint8 tfs_id_cnt;                       /* TFS IDs count */
+       uint8 tfs_id[1];                        /* Array of TFS IDs */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_notify_req dot11_tfs_notify_req_t;
+#define DOT11_TFS_NOTIFY_REQ_LEN       3       /* Fixed length */
+
+/** TFS Management Notify frame response header */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_notify_resp {
+       uint8 category;                         /* category of action frame (10) */
+       uint8 action;                           /* WNM action: TFS notify response (28) */
+       uint8 tfs_id_cnt;                       /* TFS IDs count */
+       uint8 tfs_id[1];                        /* Array of TFS IDs */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_notify_resp dot11_tfs_notify_resp_t;
+#define DOT11_TFS_NOTIFY_RESP_LEN      3       /* Fixed length */
+
+
+/** WNM-Sleep Management Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_req {
+       uint8 category;                         /* category of action frame (10) */
+       uint8 action;                           /* WNM action: wnm-sleep request (16) */
+       uint8 token;                            /* dialog token */
+       uint8 data[1];                          /* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_wnm_sleep_req dot11_wnm_sleep_req_t;
+#define DOT11_WNM_SLEEP_REQ_LEN                3       /* Fixed length */
+
+/** WNM-Sleep Management Response frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_resp {
+       uint8 category;                         /* category of action frame (10) */
+       uint8 action;                           /* WNM action: wnm-sleep request (17) */
+       uint8 token;                            /* dialog token */
+       uint16 key_len;                         /* key data length */
+       uint8 data[1];                          /* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_wnm_sleep_resp dot11_wnm_sleep_resp_t;
+#define DOT11_WNM_SLEEP_RESP_LEN       5       /* Fixed length */
+
+#define DOT11_WNM_SLEEP_SUBELEM_ID_GTK 0
+#define DOT11_WNM_SLEEP_SUBELEM_ID_IGTK        1
+
+BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_subelem_gtk {
+       uint8 sub_id;
+       uint8 len;
+       uint16 key_info;
+       uint8 key_length;
+       uint8 rsc[8];
+       uint8 key[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_wnm_sleep_subelem_gtk dot11_wnm_sleep_subelem_gtk_t;
+#define DOT11_WNM_SLEEP_SUBELEM_GTK_FIXED_LEN  11      /* without sub_id, len, and key */
+#define DOT11_WNM_SLEEP_SUBELEM_GTK_MAX_LEN    43      /* without sub_id and len */
+
+BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_subelem_igtk {
+       uint8 sub_id;
+       uint8 len;
+       uint16 key_id;
+       uint8 pn[6];
+       uint8 key[16];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_wnm_sleep_subelem_igtk dot11_wnm_sleep_subelem_igtk_t;
+#define DOT11_WNM_SLEEP_SUBELEM_IGTK_LEN 24    /* Fixed length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_ie {
+       uint8 id;                               /* 93, DOT11_MNG_WNM_SLEEP_MODE_ID */
+       uint8 len;
+       uint8 act_type;
+       uint8 resp_status;
+       uint16 interval;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_wnm_sleep_ie dot11_wnm_sleep_ie_t;
+#define DOT11_WNM_SLEEP_IE_LEN         4       /* Fixed length */
+
+#define DOT11_WNM_SLEEP_ACT_TYPE_ENTER 0
+#define DOT11_WNM_SLEEP_ACT_TYPE_EXIT  1
+
+#define DOT11_WNM_SLEEP_RESP_ACCEPT    0
+#define DOT11_WNM_SLEEP_RESP_UPDATE    1
+#define DOT11_WNM_SLEEP_RESP_DENY      2
+#define DOT11_WNM_SLEEP_RESP_DENY_TEMP 3
+#define DOT11_WNM_SLEEP_RESP_DENY_KEY  4
+#define DOT11_WNM_SLEEP_RESP_DENY_INUSE        5
+#define DOT11_WNM_SLEEP_RESP_LAST      6
+
+/** DMS Management Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_dms_req {
+       uint8 category;                         /* category of action frame (10) */
+       uint8 action;                           /* WNM action: dms request (23) */
+       uint8 token;                            /* dialog token */
+       uint8 data[1];                          /* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dms_req dot11_dms_req_t;
+#define DOT11_DMS_REQ_LEN              3       /* Fixed length */
+
+/** DMS Management Response frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_dms_resp {
+       uint8 category;                         /* category of action frame (10) */
+       uint8 action;                           /* WNM action: dms request (24) */
+       uint8 token;                            /* dialog token */
+       uint8 data[1];                          /* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dms_resp dot11_dms_resp_t;
+#define DOT11_DMS_RESP_LEN             3       /* Fixed length */
+
+/** DMS request element */
+BWL_PRE_PACKED_STRUCT struct dot11_dms_req_ie {
+       uint8 id;                               /* 99, DOT11_MNG_DMS_REQUEST_ID */
+       uint8 len;
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dms_req_ie dot11_dms_req_ie_t;
+#define DOT11_DMS_REQ_IE_LEN           2       /* Fixed length */
+
+/** DMS response element */
+BWL_PRE_PACKED_STRUCT struct dot11_dms_resp_ie {
+       uint8 id;                               /* 100, DOT11_MNG_DMS_RESPONSE_ID */
+       uint8 len;
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dms_resp_ie dot11_dms_resp_ie_t;
+#define DOT11_DMS_RESP_IE_LEN          2       /* Fixed length */
+
+/** DMS request descriptor */
+BWL_PRE_PACKED_STRUCT struct dot11_dms_req_desc {
+       uint8 dms_id;
+       uint8 len;
+       uint8 type;
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dms_req_desc dot11_dms_req_desc_t;
+#define DOT11_DMS_REQ_DESC_LEN         3       /* Fixed length */
+
+#define DOT11_DMS_REQ_TYPE_ADD         0
+#define DOT11_DMS_REQ_TYPE_REMOVE      1
+#define DOT11_DMS_REQ_TYPE_CHANGE      2
+
+/** DMS response status */
+BWL_PRE_PACKED_STRUCT struct dot11_dms_resp_st {
+       uint8 dms_id;
+       uint8 len;
+       uint8 type;
+       uint16 lsc;
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dms_resp_st dot11_dms_resp_st_t;
+#define DOT11_DMS_RESP_STATUS_LEN      5       /* Fixed length */
+
+#define DOT11_DMS_RESP_TYPE_ACCEPT     0
+#define DOT11_DMS_RESP_TYPE_DENY       1
+#define DOT11_DMS_RESP_TYPE_TERM       2
+
+#define DOT11_DMS_RESP_LSC_UNSUPPORTED 0xFFFF
+
+/** WNM-Notification Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_wnm_notif_req {
+       uint8 category;                         /* category of action frame (10) */
+       uint8 action;                           /* WNM action: Notification request (26) */
+       uint8 token;                            /* dialog token */
+       uint8 type;                                /* type */
+       uint8 data[1];                          /* Sub-elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_wnm_notif_req dot11_wnm_notif_req_t;
+#define DOT11_WNM_NOTIF_REQ_LEN                4       /* Fixed length */
+
+/** FMS Management Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_fms_req {
+       uint8 category;                         /* category of action frame (10) */
+       uint8 action;                           /* WNM action: fms request (9) */
+       uint8 token;                            /* dialog token */
+       uint8 data[1];                          /* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_fms_req dot11_fms_req_t;
+#define DOT11_FMS_REQ_LEN              3       /* Fixed length */
+
+/** FMS Management Response frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_fms_resp {
+       uint8 category;                         /* category of action frame (10) */
+       uint8 action;                           /* WNM action: fms request (10) */
+       uint8 token;                            /* dialog token */
+       uint8 data[1];                          /* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_fms_resp dot11_fms_resp_t;
+#define DOT11_FMS_RESP_LEN             3       /* Fixed length */
+
+/** FMS Descriptor element */
+BWL_PRE_PACKED_STRUCT struct dot11_fms_desc {
+       uint8 id;
+       uint8 len;
+       uint8 num_fms_cnt;
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_fms_desc dot11_fms_desc_t;
+#define DOT11_FMS_DESC_LEN             1       /* Fixed length */
+
+#define DOT11_FMS_CNTR_MAX             0x8
+#define DOT11_FMS_CNTR_ID_MASK         0x7
+#define DOT11_FMS_CNTR_ID_SHIFT                0x0
+#define DOT11_FMS_CNTR_COUNT_MASK      0xf1
+#define DOT11_FMS_CNTR_SHIFT           0x3
+
+/** FMS request element */
+BWL_PRE_PACKED_STRUCT struct dot11_fms_req_ie {
+       uint8 id;
+       uint8 len;
+       uint8 fms_token;                        /* token used to identify fms stream set */
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_fms_req_ie dot11_fms_req_ie_t;
+#define DOT11_FMS_REQ_IE_FIX_LEN               1       /* Fixed length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_rate_id_field {
+       uint8 mask;
+       uint8 mcs_idx;
+       uint16 rate;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rate_id_field dot11_rate_id_field_t;
+#define DOT11_RATE_ID_FIELD_MCS_SEL_MASK       0x7
+#define DOT11_RATE_ID_FIELD_MCS_SEL_OFFSET     0
+#define DOT11_RATE_ID_FIELD_RATETYPE_MASK      0x18
+#define DOT11_RATE_ID_FIELD_RATETYPE_OFFSET    3
+#define DOT11_RATE_ID_FIELD_LEN                sizeof(dot11_rate_id_field_t)
+
+/** FMS request subelements */
+BWL_PRE_PACKED_STRUCT struct dot11_fms_se {
+       uint8 sub_id;
+       uint8 len;
+       uint8 interval;
+       uint8 max_interval;
+       dot11_rate_id_field_t rate;
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_fms_se dot11_fms_se_t;
+#define DOT11_FMS_REQ_SE_LEN           6       /* Fixed length */
+
+#define DOT11_FMS_REQ_SE_ID_FMS                1       /* FMS subelement */
+#define DOT11_FMS_REQ_SE_ID_VS         221     /* Vendor Specific subelement */
+
+/** FMS response element */
+BWL_PRE_PACKED_STRUCT struct dot11_fms_resp_ie {
+       uint8 id;
+       uint8 len;
+       uint8 fms_token;
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_fms_resp_ie dot11_fms_resp_ie_t;
+#define DOT11_FMS_RESP_IE_FIX_LEN              1       /* Fixed length */
+
+/* FMS status subelements */
+#define DOT11_FMS_STATUS_SE_ID_FMS     1       /* FMS Status */
+#define DOT11_FMS_STATUS_SE_ID_TCLAS   2       /* TCLAS Status */
+#define DOT11_FMS_STATUS_SE_ID_VS      221     /* Vendor Specific subelement */
+
+/** FMS status subelement */
+BWL_PRE_PACKED_STRUCT struct dot11_fms_status_se {
+       uint8 sub_id;
+       uint8 len;
+       uint8 status;
+       uint8 interval;
+       uint8 max_interval;
+       uint8 fmsid;
+       uint8 counter;
+       dot11_rate_id_field_t rate;
+       uint8 mcast_addr[ETHER_ADDR_LEN];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_fms_status_se dot11_fms_status_se_t;
+#define DOT11_FMS_STATUS_SE_LEN                15      /* Fixed length */
+
+/** TCLAS status subelement */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_status_se {
+       uint8 sub_id;
+       uint8 len;
+       uint8 fmsid;
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_status_se dot11_tclas_status_se_t;
+#define DOT11_TCLAS_STATUS_SE_LEN              1       /* Fixed length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_addba_req {
+       uint8 category;                         /* category of action frame (3) */
+       uint8 action;                           /* action: addba req */
+       uint8 token;                            /* identifier */
+       uint16 addba_param_set;         /* parameter set */
+       uint16 timeout;                         /* timeout in seconds */
+       uint16 start_seqnum;            /* starting sequence number */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_addba_req dot11_addba_req_t;
+#define DOT11_ADDBA_REQ_LEN            9       /* length of addba req frame */
+
+BWL_PRE_PACKED_STRUCT struct dot11_addba_resp {
+       uint8 category;                         /* category of action frame (3) */
+       uint8 action;                           /* action: addba resp */
+       uint8 token;                            /* identifier */
+       uint16 status;                          /* status of add request */
+       uint16 addba_param_set;                 /* negotiated parameter set */
+       uint16 timeout;                         /* negotiated timeout in seconds */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_addba_resp dot11_addba_resp_t;
+#define DOT11_ADDBA_RESP_LEN           9       /* length of addba resp frame */
+
+/* DELBA action parameters */
+#define DOT11_DELBA_PARAM_INIT_MASK    0x0800  /* initiator mask */
+#define DOT11_DELBA_PARAM_INIT_SHIFT   11      /* initiator shift */
+#define DOT11_DELBA_PARAM_TID_MASK     0xf000  /* tid mask */
+#define DOT11_DELBA_PARAM_TID_SHIFT    12      /* tid shift */
+
+BWL_PRE_PACKED_STRUCT struct dot11_delba {
+       uint8 category;                         /* category of action frame (3) */
+       uint8 action;                           /* action: addba req */
+       uint16 delba_param_set;                 /* paarmeter set */
+       uint16 reason;                          /* reason for dellba */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_delba dot11_delba_t;
+#define DOT11_DELBA_LEN                        6       /* length of delba frame */
+
+/* SA Query action field value */
+#define SA_QUERY_REQUEST               0
+#define SA_QUERY_RESPONSE              1
+
+/* ************* 802.11r related definitions. ************* */
+
+/** Over-the-DS Fast Transition Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_ft_req {
+       uint8 category;                 /* category of action frame (6) */
+       uint8 action;                   /* action: ft req */
+       uint8 sta_addr[ETHER_ADDR_LEN];
+       uint8 tgt_ap_addr[ETHER_ADDR_LEN];
+       uint8 data[1];                  /* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ft_req dot11_ft_req_t;
+#define DOT11_FT_REQ_FIXED_LEN 14
+
+/** Over-the-DS Fast Transition Response frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_ft_res {
+       uint8 category;                 /* category of action frame (6) */
+       uint8 action;                   /* action: ft resp */
+       uint8 sta_addr[ETHER_ADDR_LEN];
+       uint8 tgt_ap_addr[ETHER_ADDR_LEN];
+       uint16 status;                  /* status code */
+       uint8 data[1];                  /* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ft_res dot11_ft_res_t;
+#define DOT11_FT_RES_FIXED_LEN 16
+
+/** RDE RIC Data Element. */
+BWL_PRE_PACKED_STRUCT struct dot11_rde_ie {
+       uint8 id;                       /* 11r, DOT11_MNG_RDE_ID */
+       uint8 length;
+       uint8 rde_id;                   /* RDE identifier. */
+       uint8 rd_count;                 /* Resource Descriptor Count. */
+       uint16 status;                  /* Status Code. */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rde_ie dot11_rde_ie_t;
+
+/* 11r - Size of the RDE (RIC Data Element) IE, including TLV header. */
+#define DOT11_MNG_RDE_IE_LEN sizeof(dot11_rde_ie_t)
+
+
+/* ************* 802.11k related definitions. ************* */
+
+/* Radio measurements enabled capability ie */
+#define DOT11_RRM_CAP_LEN              5       /* length of rrm cap bitmap */
+#define RCPI_IE_LEN 1
+#define RSNI_IE_LEN 1
+BWL_PRE_PACKED_STRUCT struct dot11_rrm_cap_ie {
+       uint8 cap[DOT11_RRM_CAP_LEN];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rrm_cap_ie dot11_rrm_cap_ie_t;
+
+/* Bitmap definitions for cap ie */
+#define DOT11_RRM_CAP_LINK             0
+#define DOT11_RRM_CAP_NEIGHBOR_REPORT  1
+#define DOT11_RRM_CAP_PARALLEL         2
+#define DOT11_RRM_CAP_REPEATED         3
+#define DOT11_RRM_CAP_BCN_PASSIVE      4
+#define DOT11_RRM_CAP_BCN_ACTIVE       5
+#define DOT11_RRM_CAP_BCN_TABLE                6
+#define DOT11_RRM_CAP_BCN_REP_COND     7
+#define DOT11_RRM_CAP_FM               8
+#define DOT11_RRM_CAP_CLM              9
+#define DOT11_RRM_CAP_NHM              10
+#define DOT11_RRM_CAP_SM               11
+#define DOT11_RRM_CAP_LCIM             12
+#define DOT11_RRM_CAP_LCIA             13
+#define DOT11_RRM_CAP_TSCM             14
+#define DOT11_RRM_CAP_TTSCM            15
+#define DOT11_RRM_CAP_AP_CHANREP       16
+#define DOT11_RRM_CAP_RMMIB            17
+/* bit18-bit23, not used for RRM_IOVAR */
+#define DOT11_RRM_CAP_MPC0             24
+#define DOT11_RRM_CAP_MPC1             25
+#define DOT11_RRM_CAP_MPC2             26
+#define DOT11_RRM_CAP_MPTI             27
+#define DOT11_RRM_CAP_NBRTSFO          28
+#define DOT11_RRM_CAP_RCPI             29
+#define DOT11_RRM_CAP_RSNI             30
+#define DOT11_RRM_CAP_BSSAAD           31
+#define DOT11_RRM_CAP_BSSAAC           32
+#define DOT11_RRM_CAP_AI               33
+#define DOT11_RRM_CAP_FTM_RANGE                34
+#define DOT11_RRM_CAP_CIVIC_LOC                35
+#define DOT11_RRM_CAP_IDENT_LOC                36
+#define DOT11_RRM_CAP_LAST             36
+
+#define DOT11_RRM_CAP_MPA_MASK         0x7
+/* Operating Class (formerly "Regulatory Class") definitions */
+#define DOT11_OP_CLASS_NONE                    255
+
+BWL_PRE_PACKED_STRUCT struct do11_ap_chrep {
+       uint8 id;
+       uint8 len;
+       uint8 reg;
+       uint8 chanlist[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct do11_ap_chrep dot11_ap_chrep_t;
+
+/* Radio Measurements action ids */
+#define DOT11_RM_ACTION_RM_REQ         0       /* Radio measurement request */
+#define DOT11_RM_ACTION_RM_REP         1       /* Radio measurement report */
+#define DOT11_RM_ACTION_LM_REQ         2       /* Link measurement request */
+#define DOT11_RM_ACTION_LM_REP         3       /* Link measurement report */
+#define DOT11_RM_ACTION_NR_REQ         4       /* Neighbor report request */
+#define DOT11_RM_ACTION_NR_REP         5       /* Neighbor report response */
+#define DOT11_PUB_ACTION_MP            7       /* Measurement Pilot public action id */
+
+/** Generic radio measurement action frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_rm_action {
+       uint8 category;                         /* category of action frame (5) */
+       uint8 action;                           /* radio measurement action */
+       uint8 token;                            /* dialog token */
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rm_action dot11_rm_action_t;
+#define DOT11_RM_ACTION_LEN 3
+
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq {
+       uint8 category;                         /* category of action frame (5) */
+       uint8 action;                           /* radio measurement action */
+       uint8 token;                            /* dialog token */
+       uint16 reps;                            /* no. of repetitions */
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq dot11_rmreq_t;
+#define DOT11_RMREQ_LEN        5
+
+BWL_PRE_PACKED_STRUCT struct dot11_rm_ie {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rm_ie dot11_rm_ie_t;
+#define DOT11_RM_IE_LEN        5
+
+/* Definitions for "mode" bits in rm req */
+#define DOT11_RMREQ_MODE_PARALLEL      1
+#define DOT11_RMREQ_MODE_ENABLE                2
+#define DOT11_RMREQ_MODE_REQUEST       4
+#define DOT11_RMREQ_MODE_REPORT                8
+#define DOT11_RMREQ_MODE_DURMAND       0x10    /* Duration Mandatory */
+
+/* Definitions for "mode" bits in rm rep */
+#define DOT11_RMREP_MODE_LATE          1
+#define DOT11_RMREP_MODE_INCAPABLE     2
+#define DOT11_RMREP_MODE_REFUSED       4
+
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_bcn {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       uint8 reg;
+       uint8 channel;
+       uint16 interval;
+       uint16 duration;
+       uint8 bcn_mode;
+       struct ether_addr       bssid;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_bcn dot11_rmreq_bcn_t;
+#define DOT11_RMREQ_BCN_LEN    18
+
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_bcn {
+       uint8 reg;
+       uint8 channel;
+       uint32 starttime[2];
+       uint16 duration;
+       uint8 frame_info;
+       uint8 rcpi;
+       uint8 rsni;
+       struct ether_addr       bssid;
+       uint8 antenna_id;
+       uint32 parent_tsf;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_bcn dot11_rmrep_bcn_t;
+#define DOT11_RMREP_BCN_LEN    26
+
+/* Beacon request measurement mode */
+#define DOT11_RMREQ_BCN_PASSIVE        0
+#define DOT11_RMREQ_BCN_ACTIVE 1
+#define DOT11_RMREQ_BCN_TABLE  2
+
+/* Sub-element IDs for Beacon Request */
+#define DOT11_RMREQ_BCN_SSID_ID 0
+#define DOT11_RMREQ_BCN_REPINFO_ID  1
+#define DOT11_RMREQ_BCN_REPDET_ID   2
+#define DOT11_RMREQ_BCN_REQUEST_ID  10
+#define DOT11_RMREQ_BCN_APCHREP_ID  DOT11_MNG_AP_CHREP_ID
+
+/* Reporting Detail element definition */
+#define DOT11_RMREQ_BCN_REPDET_FIXED   0       /* Fixed length fields only */
+#define DOT11_RMREQ_BCN_REPDET_REQUEST 1       /* + requested information elems */
+#define DOT11_RMREQ_BCN_REPDET_ALL     2       /* All fields */
+
+/* Reporting Information (reporting condition) element definition */
+#define DOT11_RMREQ_BCN_REPINFO_LEN    2       /* Beacon Reporting Information length */
+#define DOT11_RMREQ_BCN_REPCOND_DEFAULT        0       /* Report to be issued after each measurement */
+
+/* Sub-element IDs for Beacon Report */
+#define DOT11_RMREP_BCN_FRM_BODY       1
+#define DOT11_RMREP_BCN_FRM_BODY_LEN_MAX       224 /* 802.11k-2008 7.3.2.22.6 */
+
+/* Sub-element IDs for Frame Report */
+#define DOT11_RMREP_FRAME_COUNT_REPORT 1
+
+/* Channel load request */
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_chanload {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       uint8 reg;
+       uint8 channel;
+       uint16 interval;
+       uint16 duration;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_chanload dot11_rmreq_chanload_t;
+#define DOT11_RMREQ_CHANLOAD_LEN       11
+
+/** Channel load report */
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_chanload {
+       uint8 reg;
+       uint8 channel;
+       uint32 starttime[2];
+       uint16 duration;
+       uint8 channel_load;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_chanload dot11_rmrep_chanload_t;
+#define DOT11_RMREP_CHANLOAD_LEN       13
+
+/** Noise histogram request */
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_noise {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       uint8 reg;
+       uint8 channel;
+       uint16 interval;
+       uint16 duration;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_noise dot11_rmreq_noise_t;
+#define DOT11_RMREQ_NOISE_LEN 11
+
+/** Noise histogram report */
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_noise {
+       uint8 reg;
+       uint8 channel;
+       uint32 starttime[2];
+       uint16 duration;
+       uint8 antid;
+       uint8 anpi;
+       uint8 ipi0_dens;
+       uint8 ipi1_dens;
+       uint8 ipi2_dens;
+       uint8 ipi3_dens;
+       uint8 ipi4_dens;
+       uint8 ipi5_dens;
+       uint8 ipi6_dens;
+       uint8 ipi7_dens;
+       uint8 ipi8_dens;
+       uint8 ipi9_dens;
+       uint8 ipi10_dens;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_noise dot11_rmrep_noise_t;
+#define DOT11_RMREP_NOISE_LEN 25
+
+/** Frame request */
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_frame {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       uint8 reg;
+       uint8 channel;
+       uint16 interval;
+       uint16 duration;
+       uint8 req_type;
+       struct ether_addr       ta;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_frame dot11_rmreq_frame_t;
+#define DOT11_RMREQ_FRAME_LEN 18
+
+/** Frame report */
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_frame {
+       uint8 reg;
+       uint8 channel;
+       uint32 starttime[2];
+       uint16 duration;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_frame dot11_rmrep_frame_t;
+#define DOT11_RMREP_FRAME_LEN 12
+
+/** Frame report entry */
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_frmentry {
+       struct ether_addr       ta;
+       struct ether_addr       bssid;
+       uint8 phy_type;
+       uint8 avg_rcpi;
+       uint8 last_rsni;
+       uint8 last_rcpi;
+       uint8 ant_id;
+       uint16 frame_cnt;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_frmentry dot11_rmrep_frmentry_t;
+#define DOT11_RMREP_FRMENTRY_LEN 19
+
+/** STA statistics request */
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_stat {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       struct ether_addr       peer;
+       uint16 interval;
+       uint16 duration;
+       uint8 group_id;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_stat dot11_rmreq_stat_t;
+#define DOT11_RMREQ_STAT_LEN 16
+
+/** STA statistics report */
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_stat {
+       uint16 duration;
+       uint8 group_id;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_stat dot11_rmrep_stat_t;
+
+/* Statistics Group Report: Group IDs */
+enum {
+       DOT11_RRM_STATS_GRP_ID_0 = 0,
+       DOT11_RRM_STATS_GRP_ID_1,
+       DOT11_RRM_STATS_GRP_ID_2,
+       DOT11_RRM_STATS_GRP_ID_3,
+       DOT11_RRM_STATS_GRP_ID_4,
+       DOT11_RRM_STATS_GRP_ID_5,
+       DOT11_RRM_STATS_GRP_ID_6,
+       DOT11_RRM_STATS_GRP_ID_7,
+       DOT11_RRM_STATS_GRP_ID_8,
+       DOT11_RRM_STATS_GRP_ID_9,
+       DOT11_RRM_STATS_GRP_ID_10,
+       DOT11_RRM_STATS_GRP_ID_11,
+       DOT11_RRM_STATS_GRP_ID_12,
+       DOT11_RRM_STATS_GRP_ID_13,
+       DOT11_RRM_STATS_GRP_ID_14,
+       DOT11_RRM_STATS_GRP_ID_15,
+       DOT11_RRM_STATS_GRP_ID_16
+};
+
+/* Statistics Group Report: Group Data length  */
+#define DOT11_RRM_STATS_RPT_LEN_GRP_ID_0       28
+typedef struct rrm_stat_group_0 {
+       uint32  txfrag;
+       uint32  txmulti;
+       uint32  txfail;
+       uint32  rxframe;
+       uint32  rxmulti;
+       uint32  rxbadfcs;
+       uint32  txframe;
+} rrm_stat_group_0_t;
+
+#define DOT11_RRM_STATS_RPT_LEN_GRP_ID_1       24
+typedef struct rrm_stat_group_1 {
+       uint32  txretry;
+       uint32  txretries;
+       uint32  rxdup;
+       uint32  txrts;
+       uint32  rtsfail;
+       uint32  ackfail;
+} rrm_stat_group_1_t;
+
+/* group 2-9 use same qos data structure (tid 0-7), total 52 bytes */
+#define DOT11_RRM_STATS_RPT_LEN_GRP_ID_2_9     52
+typedef struct rrm_stat_group_qos {
+       uint32  txfrag;
+       uint32  txfail;
+       uint32  txretry;
+       uint32  txretries;
+       uint32  rxdup;
+       uint32  txrts;
+       uint32  rtsfail;
+       uint32  ackfail;
+       uint32  rxfrag;
+       uint32  txframe;
+       uint32  txdrop;
+       uint32  rxmpdu;
+       uint32  rxretries;
+} rrm_stat_group_qos_t;
+
+/* dot11BSSAverageAccessDelay Group (only available at an AP): 8 byte */
+#define DOT11_RRM_STATS_RPT_LEN_GRP_ID_10      8
+typedef BWL_PRE_PACKED_STRUCT struct rrm_stat_group_10 {
+       uint8   apavgdelay;
+       uint8   avgdelaybe;
+       uint8   avgdelaybg;
+       uint8   avgdelayvi;
+       uint8   avgdelayvo;
+       uint16  stacount;
+       uint8   chanutil;
+} BWL_POST_PACKED_STRUCT rrm_stat_group_10_t;
+
+/* AMSDU, 40 bytes */
+#define DOT11_RRM_STATS_RPT_LEN_GRP_ID_11      40
+typedef struct rrm_stat_group_11 {
+       uint32  txamsdu;
+       uint32  amsdufail;
+       uint32  amsduretry;
+       uint32  amsduretries;
+       uint32  txamsdubyte_h;
+       uint32  txamsdubyte_l;
+       uint32  amsduackfail;
+       uint32  rxamsdu;
+       uint32  rxamsdubyte_h;
+       uint32  rxamsdubyte_l;
+} rrm_stat_group_11_t;
+
+/* AMPDU, 36 bytes */
+#define DOT11_RRM_STATS_RPT_LEN_GRP_ID_12      36
+typedef struct rrm_stat_group_12 {
+       uint32  txampdu;
+       uint32  txmpdu;
+       uint32  txampdubyte_h;
+       uint32  txampdubyte_l;
+       uint32  rxampdu;
+       uint32  rxmpdu;
+       uint32  rxampdubyte_h;
+       uint32  rxampdubyte_l;
+       uint32  ampducrcfail;
+} rrm_stat_group_12_t;
+
+/* BACK etc, 36 bytes */
+#define DOT11_RRM_STATS_RPT_LEN_GRP_ID_13      36
+typedef struct rrm_stat_group_13 {
+       uint32  rximpbarfail;
+       uint32  rxexpbarfail;
+       uint32  chanwidthsw;
+       uint32  txframe20mhz;
+       uint32  txframe40mhz;
+       uint32  rxframe20mhz;
+       uint32  rxframe40mhz;
+       uint32  psmpgrantdur;
+       uint32  psmpuseddur;
+} rrm_stat_group_13_t;
+
+/* RD Dual CTS etc, 36 bytes */
+#define DOT11_RRM_STATS_RPT_LEN_GRP_ID_14      36
+typedef struct rrm_stat_group_14 {
+       uint32  grantrdgused;
+       uint32  grantrdgunused;
+       uint32  txframeingrantrdg;
+       uint32  txbyteingrantrdg_h;
+       uint32  txbyteingrantrdg_l;
+       uint32  dualcts;
+       uint32  dualctsfail;
+       uint32  rtslsi;
+       uint32  rtslsifail;
+} rrm_stat_group_14_t;
+
+/* bf and STBC etc, 20 bytes */
+#define DOT11_RRM_STATS_RPT_LEN_GRP_ID_15      20
+typedef struct rrm_stat_group_15 {
+       uint32  bfframe;
+       uint32  stbccts;
+       uint32  stbcctsfail;
+       uint32  nonstbccts;
+       uint32  nonstbcctsfail;
+} rrm_stat_group_15_t;
+
+/* RSNA, 28 bytes */
+#define DOT11_RRM_STATS_RPT_LEN_GRP_ID_16      28
+typedef struct rrm_stat_group_16 {
+       uint32  rsnacmacicverr;
+       uint32  rsnacmacreplay;
+       uint32  rsnarobustmgmtccmpreplay;
+       uint32  rsnatkipicverr;
+       uint32  rsnatkipicvreplay;
+       uint32  rsnaccmpdecrypterr;
+       uint32  rsnaccmpreplay;
+} rrm_stat_group_16_t;
+
+/* Transmit stream/category measurement request */
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_tx_stream {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       uint16 interval;
+       uint16 duration;
+       struct ether_addr       peer;
+       uint8 traffic_id;
+       uint8 bin0_range;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_tx_stream dot11_rmreq_tx_stream_t;
+#define DOT11_RMREQ_TXSTREAM_LEN       17
+
+/** Transmit stream/category measurement report */
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_tx_stream {
+       uint32 starttime[2];
+       uint16 duration;
+       struct ether_addr       peer;
+       uint8 traffic_id;
+       uint8 reason;
+       uint32 txmsdu_cnt;
+       uint32 msdu_discarded_cnt;
+       uint32 msdufailed_cnt;
+       uint32 msduretry_cnt;
+       uint32 cfpolls_lost_cnt;
+       uint32 avrqueue_delay;
+       uint32 avrtx_delay;
+       uint8 bin0_range;
+       uint32 bin0;
+       uint32 bin1;
+       uint32 bin2;
+       uint32 bin3;
+       uint32 bin4;
+       uint32 bin5;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_tx_stream dot11_rmrep_tx_stream_t;
+#define DOT11_RMREP_TXSTREAM_LEN       71
+
+typedef struct rrm_tscm {
+       uint32 msdu_tx;
+       uint32 msdu_exp;
+       uint32 msdu_fail;
+       uint32 msdu_retries;
+       uint32 cfpolls_lost;
+       uint32 queue_delay;
+       uint32 tx_delay_sum;
+       uint32 tx_delay_cnt;
+       uint32 bin0_range_us;
+       uint32 bin0;
+       uint32 bin1;
+       uint32 bin2;
+       uint32 bin3;
+       uint32 bin4;
+       uint32 bin5;
+} rrm_tscm_t;
+enum {
+       DOT11_FTM_LOCATION_SUBJ_LOCAL = 0,              /* Where am I? */
+       DOT11_FTM_LOCATION_SUBJ_REMOTE = 1,             /* Where are you? */
+       DOT11_FTM_LOCATION_SUBJ_THIRDPARTY = 2   /* Where is he/she? */
+};
+
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_ftm_lci {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       uint8 subj;
+
+       /* Following 3 fields are unused. Keep for ROM compatibility. */
+       uint8 lat_res;
+       uint8 lon_res;
+       uint8 alt_res;
+
+       /* optional sub-elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_ftm_lci dot11_rmreq_ftm_lci_t;
+#define DOT11_RMREQ_LCI_LEN    9
+
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_ftm_lci {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       uint8 lci_sub_id;
+       uint8 lci_sub_len;
+       /* optional LCI field */
+       /* optional sub-elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_ftm_lci dot11_rmrep_ftm_lci_t;
+
+#define DOT11_FTM_LCI_SUBELEM_ID               0
+#define DOT11_FTM_LCI_SUBELEM_LEN              2
+#define DOT11_FTM_LCI_FIELD_LEN                16
+#define DOT11_FTM_LCI_UNKNOWN_LEN              2
+
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_ftm_civic {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       uint8 subj;
+       uint8 civloc_type;
+       uint8 siu;      /* service interval units */
+       uint16 si;  /* service interval */
+       /* optional sub-elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_ftm_civic dot11_rmreq_ftm_civic_t;
+#define DOT11_RMREQ_CIVIC_LEN  10
+
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_ftm_civic {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       uint8 civloc_type;
+       uint8 civloc_sub_id;
+       uint8 civloc_sub_len;
+       /* optional location civic field */
+       /* optional sub-elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_ftm_civic dot11_rmrep_ftm_civic_t;
+
+#define DOT11_FTM_CIVIC_LOC_TYPE_RFC4776       0
+#define DOT11_FTM_CIVIC_SUBELEM_ID                     0
+#define DOT11_FTM_CIVIC_SUBELEM_LEN            2
+#define DOT11_FTM_CIVIC_LOC_SI_NONE                    0
+#define DOT11_FTM_CIVIC_TYPE_LEN                       1
+#define DOT11_FTM_CIVIC_UNKNOWN_LEN            3
+
+/* Location Identifier measurement request */
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_locid {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       uint8 subj;
+       uint8 siu;
+       uint16 si;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_locid dot11_rmreq_locid_t;
+#define DOT11_RMREQ_LOCID_LEN  9
+
+/* Location Identifier measurement report */
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_locid {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       uint8 exp_tsf[8];
+       uint8 locid_sub_id;
+       uint8 locid_sub_len;
+       /* optional location identifier field */
+       /* optional sub-elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_locid dot11_rmrep_locid_t;
+#define DOT11_LOCID_UNKNOWN_LEN                10
+#define DOT11_LOCID_SUBELEM_ID         0
+
+BWL_PRE_PACKED_STRUCT struct dot11_ftm_range_subel {
+       uint8 id;
+       uint8 len;
+       uint16 max_age;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ftm_range_subel dot11_ftm_range_subel_t;
+#define DOT11_FTM_RANGE_SUBELEM_ID      4
+#define DOT11_FTM_RANGE_SUBELEM_LEN     2
+
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_ftm_range {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       uint16 max_init_delay;          /* maximum random initial delay */
+       uint8 min_ap_count;
+       uint8 data[1];
+       /* neighbor report sub-elements */
+       /* optional sub-elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_ftm_range dot11_rmreq_ftm_range_t;
+#define DOT11_RMREQ_FTM_RANGE_LEN 8
+
+#define DOT11_FTM_RANGE_LEN            3
+BWL_PRE_PACKED_STRUCT struct dot11_ftm_range_entry {
+       uint32 start_tsf;               /* 4 lsb of tsf */
+       struct ether_addr bssid;
+       uint8 range[DOT11_FTM_RANGE_LEN];
+       uint8 max_err[DOT11_FTM_RANGE_LEN];
+       uint8  rsvd;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ftm_range_entry dot11_ftm_range_entry_t;
+#define DOT11_FTM_RANGE_ENTRY_MAX_COUNT   15
+
+enum {
+       DOT11_FTM_RANGE_ERROR_AP_INCAPABLE = 2,
+       DOT11_FTM_RANGE_ERROR_AP_FAILED = 3,
+       DOT11_FTM_RANGE_ERROR_TX_FAILED = 8,
+       DOT11_FTM_RANGE_ERROR_MAX
+};
+
+BWL_PRE_PACKED_STRUCT struct dot11_ftm_range_error_entry {
+       uint32 start_tsf;               /* 4 lsb of tsf */
+       struct ether_addr bssid;
+       uint8  code;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ftm_range_error_entry dot11_ftm_range_error_entry_t;
+#define DOT11_FTM_RANGE_ERROR_ENTRY_MAX_COUNT   11
+
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_ftm_range {
+    uint8 id;
+    uint8 len;
+    uint8 token;
+    uint8 mode;
+    uint8 type;
+    uint8 entry_count;
+    uint8 data[2]; /* includes pad */
+       /*
+       dot11_ftm_range_entry_t entries[entry_count];
+       uint8 error_count;
+       dot11_ftm_error_entry_t errors[error_count];
+        */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_ftm_range dot11_rmrep_ftm_range_t;
+
+#define DOT11_FTM_RANGE_REP_MIN_LEN     6       /* No extra byte for error_count */
+#define DOT11_FTM_RANGE_ENTRY_CNT_MAX   15
+#define DOT11_FTM_RANGE_ERROR_CNT_MAX   11
+#define DOT11_FTM_RANGE_REP_FIXED_LEN   1       /* No extra byte for error_count */
+/** Measurement pause request */
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_pause_time {
+       uint8 id;
+       uint8 len;
+       uint8 token;
+       uint8 mode;
+       uint8 type;
+       uint16 pause_time;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_pause_time dot11_rmreq_pause_time_t;
+#define DOT11_RMREQ_PAUSE_LEN  7
+
+
+/* Neighbor Report subelements ID (11k & 11v) */
+#define DOT11_NGBR_TSF_INFO_SE_ID      1
+#define DOT11_NGBR_CCS_SE_ID           2
+#define DOT11_NGBR_BSSTRANS_PREF_SE_ID 3
+#define DOT11_NGBR_BSS_TERM_DUR_SE_ID  4
+#define DOT11_NGBR_BEARING_SE_ID       5
+#define DOT11_NGBR_WIDE_BW_CHAN_SE_ID  6
+
+/** Neighbor Report, BSS Transition Candidate Preference subelement */
+BWL_PRE_PACKED_STRUCT struct dot11_ngbr_bsstrans_pref_se {
+       uint8 sub_id;
+       uint8 len;
+       uint8 preference;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ngbr_bsstrans_pref_se dot11_ngbr_bsstrans_pref_se_t;
+#define DOT11_NGBR_BSSTRANS_PREF_SE_LEN        1
+
+/** Neighbor Report, BSS Termination Duration subelement */
+BWL_PRE_PACKED_STRUCT struct dot11_ngbr_bss_term_dur_se {
+       uint8 sub_id;
+       uint8 len;
+       uint8 tsf[8];
+       uint16 duration;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ngbr_bss_term_dur_se dot11_ngbr_bss_term_dur_se_t;
+#define DOT11_NGBR_BSS_TERM_DUR_SE_LEN 10
+
+/* Neighbor Report BSSID Information Field */
+#define DOT11_NGBR_BI_REACHABILTY_UNKN 0x0002
+#define DOT11_NGBR_BI_REACHABILTY      0x0003
+#define DOT11_NGBR_BI_SEC              0x0004
+#define DOT11_NGBR_BI_KEY_SCOPE                0x0008
+#define DOT11_NGBR_BI_CAP              0x03f0
+#define DOT11_NGBR_BI_CAP_SPEC_MGMT    0x0010
+#define DOT11_NGBR_BI_CAP_QOS          0x0020
+#define DOT11_NGBR_BI_CAP_APSD         0x0040
+#define DOT11_NGBR_BI_CAP_RDIO_MSMT    0x0080
+#define DOT11_NGBR_BI_CAP_DEL_BA       0x0100
+#define DOT11_NGBR_BI_CAP_IMM_BA       0x0200
+#define DOT11_NGBR_BI_MOBILITY         0x0400
+#define DOT11_NGBR_BI_HT               0x0800
+#define DOT11_NGBR_BI_VHT              0x1000
+#define DOT11_NGBR_BI_FTM              0x2000
+
+/** Neighbor Report element (11k & 11v) */
+BWL_PRE_PACKED_STRUCT struct dot11_neighbor_rep_ie {
+       uint8 id;
+       uint8 len;
+       struct ether_addr bssid;
+       uint32 bssid_info;
+       uint8 reg;              /* Operating class */
+       uint8 channel;
+       uint8 phytype;
+       uint8 data[1];          /* Variable size subelements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_neighbor_rep_ie dot11_neighbor_rep_ie_t;
+#define DOT11_NEIGHBOR_REP_IE_FIXED_LEN        13
+
+
+/* MLME Enumerations */
+#define DOT11_BSSTYPE_INFRASTRUCTURE           0       /* d11 infrastructure */
+#define DOT11_BSSTYPE_INDEPENDENT              1       /* d11 independent */
+#define DOT11_BSSTYPE_ANY                      2       /* d11 any BSS type */
+#define DOT11_BSSTYPE_MESH                     3       /* d11 Mesh */
+#define DOT11_SCANTYPE_ACTIVE                  0       /* d11 scan active */
+#define DOT11_SCANTYPE_PASSIVE                 1       /* d11 scan passive */
+
+/** Link Measurement */
+BWL_PRE_PACKED_STRUCT struct dot11_lmreq {
+       uint8 category;                         /* category of action frame (5) */
+       uint8 action;                           /* radio measurement action */
+       uint8 token;                            /* dialog token */
+       uint8 txpwr;                            /* Transmit Power Used */
+       uint8 maxtxpwr;                         /* Max Transmit Power */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_lmreq dot11_lmreq_t;
+#define DOT11_LMREQ_LEN        5
+
+BWL_PRE_PACKED_STRUCT struct dot11_lmrep {
+       uint8 category;                         /* category of action frame (5) */
+       uint8 action;                           /* radio measurement action */
+       uint8 token;                            /* dialog token */
+       dot11_tpc_rep_t tpc;                    /* TPC element */
+       uint8 rxant;                            /* Receive Antenna ID */
+       uint8 txant;                            /* Transmit Antenna ID */
+       uint8 rcpi;                             /* RCPI */
+       uint8 rsni;                             /* RSNI */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_lmrep dot11_lmrep_t;
+#define DOT11_LMREP_LEN        11
+
+#define DOT11_MP_CAP_SPECTRUM                  0x01    /* d11 cap. spectrum */
+#define DOT11_MP_CAP_SHORTSLOT                 0x02    /* d11 cap. shortslot */
+/* Measurement Pilot */
+BWL_PRE_PACKED_STRUCT struct dot11_mprep {
+       uint8 cap_info;                         /* Condensed capability Info. */
+       uint8 country[2];                               /* Condensed country string */
+       uint8 opclass;                          /* Op. Class */
+       uint8 channel;                          /* Channel */
+       uint8 mp_interval;                      /* Measurement Pilot Interval */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_mprep dot11_mprep_t;
+#define DOT11_MPREP_LEN        6
+
+/* 802.11 BRCM "Compromise" Pre N constants */
+#define PREN_PREAMBLE          24      /* green field preamble time */
+#define PREN_MM_EXT            12      /* extra mixed mode preamble time */
+#define PREN_PREAMBLE_EXT      4       /* extra preamble (multiply by unique_streams-1) */
+
+/* 802.11N PHY constants */
+#define RIFS_11N_TIME          2       /* NPHY RIFS time */
+
+/* 802.11 HT PLCP format 802.11n-2009, sec 20.3.9.4.3
+ * HT-SIG is composed of two 24 bit parts, HT-SIG1 and HT-SIG2
+ */
+/* HT-SIG1 */
+#define HT_SIG1_MCS_MASK        0x00007F
+#define HT_SIG1_CBW             0x000080
+#define HT_SIG1_HT_LENGTH       0xFFFF00
+
+/* HT-SIG2 */
+#define HT_SIG2_SMOOTHING       0x000001
+#define HT_SIG2_NOT_SOUNDING    0x000002
+#define HT_SIG2_RESERVED        0x000004
+#define HT_SIG2_AGGREGATION     0x000008
+#define HT_SIG2_STBC_MASK       0x000030
+#define HT_SIG2_STBC_SHIFT      4
+#define HT_SIG2_FEC_CODING      0x000040
+#define HT_SIG2_SHORT_GI        0x000080
+#define HT_SIG2_ESS_MASK        0x000300
+#define HT_SIG2_ESS_SHIFT       8
+#define HT_SIG2_CRC             0x03FC00
+#define HT_SIG2_TAIL            0x1C0000
+
+/* HT Timing-related parameters (802.11-2012, sec 20.3.6) */
+#define HT_T_LEG_PREAMBLE      16
+#define HT_T_L_SIG              4
+#define HT_T_SIG                8
+#define HT_T_LTF1               4
+#define HT_T_GF_LTF1            8
+#define HT_T_LTFs               4
+#define HT_T_STF                4
+#define HT_T_GF_STF             8
+#define HT_T_SYML               4
+
+#define HT_N_SERVICE           16       /* bits in SERVICE field */
+#define HT_N_TAIL               6       /* tail bits per BCC encoder */
+
+/* 802.11 A PHY constants */
+#define APHY_SLOT_TIME          9       /* APHY slot time */
+#define APHY_SIFS_TIME          16      /* APHY SIFS time */
+#define APHY_DIFS_TIME          (APHY_SIFS_TIME + (2 * APHY_SLOT_TIME))  /* APHY DIFS time */
+#define APHY_PREAMBLE_TIME      16      /* APHY preamble time */
+#define APHY_SIGNAL_TIME        4       /* APHY signal time */
+#define APHY_SYMBOL_TIME        4       /* APHY symbol time */
+#define APHY_SERVICE_NBITS      16      /* APHY service nbits */
+#define APHY_TAIL_NBITS         6       /* APHY tail nbits */
+#define APHY_CWMIN              15      /* APHY cwmin */
+#define APHY_PHYHDR_DUR                20      /* APHY PHY Header Duration */
+
+/* 802.11 B PHY constants */
+#define BPHY_SLOT_TIME          20      /* BPHY slot time */
+#define BPHY_SIFS_TIME          10      /* BPHY SIFS time */
+#define BPHY_DIFS_TIME          50      /* BPHY DIFS time */
+#define BPHY_PLCP_TIME          192     /* BPHY PLCP time */
+#define BPHY_PLCP_SHORT_TIME    96      /* BPHY PLCP short time */
+#define BPHY_CWMIN              31      /* BPHY cwmin */
+#define BPHY_SHORT_PHYHDR_DUR  96      /* BPHY Short PHY Header Duration */
+#define BPHY_LONG_PHYHDR_DUR   192     /* BPHY Long PHY Header Duration */
+
+/* 802.11 G constants */
+#define DOT11_OFDM_SIGNAL_EXTENSION    6       /* d11 OFDM signal extension */
+
+#define PHY_CWMAX              1023    /* PHY cwmax */
+
+#define        DOT11_MAXNUMFRAGS       16      /* max # fragments per MSDU */
+
+/* 802.11 VHT constants */
+
+typedef int vht_group_id_t;
+
+/* for VHT-A1 */
+/* SIG-A1 reserved bits */
+#define VHT_SIGA1_CONST_MASK            0x800004
+
+#define VHT_SIGA1_BW_MASK               0x000003
+#define VHT_SIGA1_20MHZ_VAL             0x000000
+#define VHT_SIGA1_40MHZ_VAL             0x000001
+#define VHT_SIGA1_80MHZ_VAL             0x000002
+#define VHT_SIGA1_160MHZ_VAL            0x000003
+
+#define VHT_SIGA1_STBC                  0x000008
+
+#define VHT_SIGA1_GID_MASK              0x0003f0
+#define VHT_SIGA1_GID_SHIFT             4
+#define VHT_SIGA1_GID_TO_AP             0x00
+#define VHT_SIGA1_GID_NOT_TO_AP         0x3f
+#define VHT_SIGA1_GID_MAX_GID           0x3f
+
+#define VHT_SIGA1_NSTS_SHIFT_MASK_USER0 0x001C00
+#define VHT_SIGA1_NSTS_SHIFT            10
+#define VHT_SIGA1_MAX_USERPOS           3
+
+#define VHT_SIGA1_PARTIAL_AID_MASK      0x3fe000
+#define VHT_SIGA1_PARTIAL_AID_SHIFT     13
+
+#define VHT_SIGA1_TXOP_PS_NOT_ALLOWED   0x400000
+
+/* for VHT-A2 */
+#define VHT_SIGA2_GI_NONE               0x000000
+#define VHT_SIGA2_GI_SHORT              0x000001
+#define VHT_SIGA2_GI_W_MOD10            0x000002
+#define VHT_SIGA2_CODING_LDPC           0x000004
+#define VHT_SIGA2_LDPC_EXTRA_OFDM_SYM   0x000008
+#define VHT_SIGA2_BEAMFORM_ENABLE       0x000100
+#define VHT_SIGA2_MCS_SHIFT             4
+
+#define VHT_SIGA2_B9_RESERVED           0x000200
+#define VHT_SIGA2_TAIL_MASK             0xfc0000
+#define VHT_SIGA2_TAIL_VALUE            0x000000
+
+/* VHT Timing-related parameters (802.11ac D4.0, sec 22.3.6) */
+#define VHT_T_LEG_PREAMBLE      16
+#define VHT_T_L_SIG              4
+#define VHT_T_SIG_A              8
+#define VHT_T_LTF                4
+#define VHT_T_STF                4
+#define VHT_T_SIG_B              4
+#define VHT_T_SYML               4
+
+#define VHT_N_SERVICE           16     /* bits in SERVICE field */
+#define VHT_N_TAIL               6     /* tail bits per BCC encoder */
+
+
+/** dot11Counters Table - 802.11 spec., Annex D */
+typedef struct d11cnt {
+       uint32          txfrag;         /* dot11TransmittedFragmentCount */
+       uint32          txmulti;        /* dot11MulticastTransmittedFrameCount */
+       uint32          txfail;         /* dot11FailedCount */
+       uint32          txretry;        /* dot11RetryCount */
+       uint32          txretrie;       /* dot11MultipleRetryCount */
+       uint32          rxdup;          /* dot11FrameduplicateCount */
+       uint32          txrts;          /* dot11RTSSuccessCount */
+       uint32          txnocts;        /* dot11RTSFailureCount */
+       uint32          txnoack;        /* dot11ACKFailureCount */
+       uint32          rxfrag;         /* dot11ReceivedFragmentCount */
+       uint32          rxmulti;        /* dot11MulticastReceivedFrameCount */
+       uint32          rxcrc;          /* dot11FCSErrorCount */
+       uint32          txfrmsnt;       /* dot11TransmittedFrameCount */
+       uint32          rxundec;        /* dot11WEPUndecryptableCount */
+} d11cnt_t;
+
+#define BRCM_PROP_OUI          "\x00\x90\x4C"
+
+
+#define BRCM_FTM_IE_TYPE                       14
+
+/* #define HT_CAP_IE_TYPE                      51
+ * #define HT_ADD_IE_TYPE                      52
+ * #define BRCM_EXTCH_IE_TYPE          53
+ * #define MEMBER_OF_BRCM_PROP_IE_TYPE 54
+ * #define BRCM_RELMACST_IE_TYPE               55
+ * #define BRCM_EVT_WL_BSS_INFO                64
+ * #define RWL_ACTION_WIFI_FRAG_TYPE   85
+ * #define BTC_INFO_BRCM_PROP_IE_TYPE  90
+ * #define ULB_BRCM_PROP_IE_TYPE       91
+ */
+
+/* Action frame type for RWL */
+#define RWL_WIFI_DEFAULT               0
+#define RWL_WIFI_FIND_MY_PEER          9 /* Used while finding server */
+#define RWL_WIFI_FOUND_PEER            10 /* Server response to the client  */
+#define RWL_ACTION_WIFI_FRAG_TYPE      85 /* Fragment indicator for receiver */
+
+#define PROXD_AF_TYPE                  11 /* Wifi proximity action frame type */
+#define BRCM_RELMACST_AF_TYPE          12 /* RMC action frame type */
+
+/* Action frame type for FTM Initiator Report */
+#define BRCM_FTM_VS_AF_TYPE    14
+enum {
+       BRCM_FTM_VS_INITIATOR_RPT_SUBTYPE = 1,  /* FTM Initiator Report */
+       BRCM_FTM_VS_COLLECT_SUBTYPE = 2,        /* FTM Collect debug protocol */
+};
+
+
+
+
+/* brcm syscap_ie cap */
+#define BRCM_SYSCAP_WET_TUNNEL 0x0100  /* Device with WET_TUNNEL support */
+
+#define BRCM_OUI               "\x00\x10\x18"  /* Broadcom OUI */
+
+/** BRCM info element */
+BWL_PRE_PACKED_STRUCT struct brcm_ie {
+       uint8   id;             /* IE ID, 221, DOT11_MNG_PROPR_ID */
+       uint8   len;            /* IE length */
+       uint8   oui[3];
+       uint8   ver;            /* type/ver of this IE */
+       uint8   assoc;          /* # of assoc STAs */
+       uint8   flags;          /* misc flags */
+       uint8   flags1;         /* misc flags */
+       uint16  amsdu_mtu_pref; /* preferred A-MSDU MTU */
+} BWL_POST_PACKED_STRUCT;
+typedef        struct brcm_ie brcm_ie_t;
+#define BRCM_IE_LEN            11      /* BRCM IE length */
+#define BRCM_IE_VER            2       /* BRCM IE version */
+#define BRCM_IE_LEGACY_AES_VER 1       /* BRCM IE legacy AES version */
+
+/* brcm_ie flags */
+#define        BRF_ABCAP               0x1     /* afterburner is obsolete,  defined for backward compat */
+#define        BRF_ABRQRD              0x2     /* afterburner is obsolete,  defined for backward compat */
+#define        BRF_LZWDS               0x4     /* lazy wds enabled */
+#define        BRF_BLOCKACK            0x8     /* BlockACK capable */
+#define BRF_ABCOUNTER_MASK     0xf0    /* afterburner is obsolete,  defined for backward compat */
+#define BRF_PROP_11N_MCS       0x10    /* re-use afterburner bit */
+#define BRF_MEDIA_CLIENT       0x20    /* re-use afterburner bit to indicate media client device */
+
+#define GET_BRF_PROP_11N_MCS(brcm_ie) \
+       (!((brcm_ie)->flags & BRF_ABCAP) && ((brcm_ie)->flags & BRF_PROP_11N_MCS))
+
+/* brcm_ie flags1 */
+#define        BRF1_AMSDU              0x1     /* A-MSDU capable */
+#define        BRF1_WNM                0x2     /* WNM capable */
+#define BRF1_WMEPS             0x4     /* AP is capable of handling WME + PS w/o APSD */
+#define BRF1_PSOFIX            0x8     /* AP has fixed PS mode out-of-order packets */
+#define        BRF1_RX_LARGE_AGG       0x10    /* device can rx large aggregates */
+#define BRF1_RFAWARE_DCS       0x20    /* RFAWARE dynamic channel selection (DCS) */
+#define BRF1_SOFTAP            0x40    /* Configure as Broadcom SOFTAP */
+#define BRF1_DWDS              0x80    /* DWDS capable */
+
+/** Vendor IE structure */
+BWL_PRE_PACKED_STRUCT struct vndr_ie {
+       uchar id;
+       uchar len;
+       uchar oui [3];
+       uchar data [1];         /* Variable size data */
+} BWL_POST_PACKED_STRUCT;
+typedef struct vndr_ie vndr_ie_t;
+
+#define VNDR_IE_HDR_LEN                2       /* id + len field */
+#define VNDR_IE_MIN_LEN                3       /* size of the oui field */
+#define VNDR_IE_FIXED_LEN      (VNDR_IE_HDR_LEN + VNDR_IE_MIN_LEN)
+
+#define VNDR_IE_MAX_LEN                255     /* vendor IE max length, without ID and len */
+
+/** BRCM PROP DEVICE PRIMARY MAC ADDRESS IE */
+BWL_PRE_PACKED_STRUCT struct member_of_brcm_prop_ie {
+       uchar id;
+       uchar len;
+       uchar oui[3];
+       uint8   type;           /* type indicates what follows */
+       struct ether_addr ea;   /* Device Primary MAC Adrress */
+} BWL_POST_PACKED_STRUCT;
+typedef struct member_of_brcm_prop_ie member_of_brcm_prop_ie_t;
+
+#define MEMBER_OF_BRCM_PROP_IE_LEN             10      /* IE max length */
+#define MEMBER_OF_BRCM_PROP_IE_HDRLEN          (sizeof(member_of_brcm_prop_ie_t))
+#define MEMBER_OF_BRCM_PROP_IE_TYPE            54
+
+/** BRCM Reliable Multicast IE */
+BWL_PRE_PACKED_STRUCT struct relmcast_brcm_prop_ie {
+       uint8 id;
+       uint8 len;
+       uint8 oui[3];
+       uint8 type;           /* type indicates what follows */
+       struct ether_addr ea;   /* The ack sender's MAC Adrress */
+       struct ether_addr mcast_ea;  /* The multicast MAC address */
+       uint8 updtmo; /* time interval(second) for client to send null packet to report its rssi */
+} BWL_POST_PACKED_STRUCT;
+typedef struct relmcast_brcm_prop_ie relmcast_brcm_prop_ie_t;
+
+/* IE length */
+/* BRCM_PROP_IE_LEN = sizeof(relmcast_brcm_prop_ie_t)-((sizeof (id) + sizeof (len)))? */
+#define RELMCAST_BRCM_PROP_IE_LEN      (sizeof(relmcast_brcm_prop_ie_t)-(2*sizeof(uint8)))
+
+#define RELMCAST_BRCM_PROP_IE_TYPE     55
+
+/* BRCM BTC IE */
+BWL_PRE_PACKED_STRUCT struct btc_brcm_prop_ie {
+       uint8 id;
+       uint8 len;
+       uint8 oui[3];
+       uint8 type;           /* type inidicates what follows */
+       uint32 info;
+} BWL_POST_PACKED_STRUCT;
+typedef struct btc_brcm_prop_ie btc_brcm_prop_ie_t;
+
+#define BTC_INFO_BRCM_PROP_IE_TYPE     90
+#define BRCM_BTC_INFO_TYPE_LEN (sizeof(btc_brcm_prop_ie_t) - (2 * sizeof(uint8)))
+
+/* ************* HT definitions. ************* */
+#define MCSSET_LEN     16      /* 16-bits per 8-bit set to give 128-bits bitmap of MCS Index */
+#define MAX_MCS_NUM    (128)   /* max mcs number = 128 */
+
+BWL_PRE_PACKED_STRUCT struct ht_cap_ie {
+       uint16  cap;
+       uint8   params;
+       uint8   supp_mcs[MCSSET_LEN];
+       uint16  ext_htcap;
+       uint32  txbf_cap;
+       uint8   as_cap;
+} BWL_POST_PACKED_STRUCT;
+typedef struct ht_cap_ie ht_cap_ie_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_ht_cap_ie {
+       uint8   id;
+       uint8   len;
+       ht_cap_ie_t ht_cap;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ht_cap_ie dot11_ht_cap_ie_t;
+
+/* CAP IE: HT 1.0 spec. simply stole a 802.11 IE, we use our prop. IE until this is resolved */
+/* the capability IE is primarily used to convey this nodes abilities */
+BWL_PRE_PACKED_STRUCT struct ht_prop_cap_ie {
+       uint8   id;             /* IE ID, 221, DOT11_MNG_PROPR_ID */
+       uint8   len;            /* IE length */
+       uint8   oui[3];
+       uint8   type;           /* type indicates what follows */
+       ht_cap_ie_t cap_ie;
+} BWL_POST_PACKED_STRUCT;
+typedef struct ht_prop_cap_ie ht_prop_cap_ie_t;
+
+#define HT_PROP_IE_OVERHEAD    4       /* overhead bytes for prop oui ie */
+#define HT_CAP_IE_LEN          26      /* HT capability len (based on .11n d2.0) */
+#define HT_CAP_IE_TYPE         51
+
+#define HT_CAP_LDPC_CODING     0x0001  /* Support for rx of LDPC coded pkts */
+#define HT_CAP_40MHZ           0x0002  /* FALSE:20Mhz, TRUE:20/40MHZ supported */
+#define HT_CAP_MIMO_PS_MASK    0x000C  /* Mimo PS mask */
+#define HT_CAP_MIMO_PS_SHIFT   0x0002  /* Mimo PS shift */
+#define HT_CAP_MIMO_PS_OFF     0x0003  /* Mimo PS, no restriction */
+#define HT_CAP_MIMO_PS_RTS     0x0001  /* Mimo PS, send RTS/CTS around MIMO frames */
+#define HT_CAP_MIMO_PS_ON      0x0000  /* Mimo PS, MIMO disallowed */
+#define HT_CAP_GF              0x0010  /* Greenfield preamble support */
+#define HT_CAP_SHORT_GI_20     0x0020  /* 20MHZ short guard interval support */
+#define HT_CAP_SHORT_GI_40     0x0040  /* 40Mhz short guard interval support */
+#define HT_CAP_TX_STBC         0x0080  /* Tx STBC support */
+#define HT_CAP_RX_STBC_MASK    0x0300  /* Rx STBC mask */
+#define HT_CAP_RX_STBC_SHIFT   8       /* Rx STBC shift */
+#define HT_CAP_DELAYED_BA      0x0400  /* delayed BA support */
+#define HT_CAP_MAX_AMSDU       0x0800  /* Max AMSDU size in bytes , 0=3839, 1=7935 */
+
+#define HT_CAP_DSSS_CCK        0x1000  /* DSSS/CCK supported by the BSS */
+#define HT_CAP_PSMP            0x2000  /* Power Save Multi Poll support */
+#define HT_CAP_40MHZ_INTOLERANT 0x4000 /* 40MHz Intolerant */
+#define HT_CAP_LSIG_TXOP       0x8000  /* L-SIG TXOP protection support */
+
+#define HT_CAP_RX_STBC_NO              0x0     /* no rx STBC support */
+#define HT_CAP_RX_STBC_ONE_STREAM      0x1     /* rx STBC support of 1 spatial stream */
+#define HT_CAP_RX_STBC_TWO_STREAM      0x2     /* rx STBC support of 1-2 spatial streams */
+#define HT_CAP_RX_STBC_THREE_STREAM    0x3     /* rx STBC support of 1-3 spatial streams */
+
+
+#define HT_CAP_TXBF_CAP_IMPLICIT_TXBF_RX       0x1
+#define HT_CAP_TXBF_CAP_NDP_RX                 0x8
+#define HT_CAP_TXBF_CAP_NDP_TX                 0x10
+#define HT_CAP_TXBF_CAP_EXPLICIT_CSI           0x100
+#define HT_CAP_TXBF_CAP_EXPLICIT_NC_STEERING   0x200
+#define HT_CAP_TXBF_CAP_EXPLICIT_C_STEERING    0x400
+#define HT_CAP_TXBF_CAP_EXPLICIT_CSI_FB_MASK   0x1800
+#define HT_CAP_TXBF_CAP_EXPLICIT_CSI_FB_SHIFT  11
+#define HT_CAP_TXBF_CAP_EXPLICIT_NC_FB_MASK    0x6000
+#define HT_CAP_TXBF_CAP_EXPLICIT_NC_FB_SHIFT   13
+#define HT_CAP_TXBF_CAP_EXPLICIT_C_FB_MASK     0x18000
+#define HT_CAP_TXBF_CAP_EXPLICIT_C_FB_SHIFT    15
+#define HT_CAP_TXBF_CAP_CSI_BFR_ANT_SHIFT      19
+#define HT_CAP_TXBF_CAP_NC_BFR_ANT_SHIFT       21
+#define HT_CAP_TXBF_CAP_C_BFR_ANT_SHIFT                23
+#define HT_CAP_TXBF_CAP_C_BFR_ANT_MASK         0x1800000
+
+#define HT_CAP_TXBF_CAP_CHAN_ESTIM_SHIFT       27
+#define HT_CAP_TXBF_CAP_CHAN_ESTIM_MASK                0x18000000
+
+#define HT_CAP_TXBF_FB_TYPE_NONE       0
+#define HT_CAP_TXBF_FB_TYPE_DELAYED    1
+#define HT_CAP_TXBF_FB_TYPE_IMMEDIATE  2
+#define HT_CAP_TXBF_FB_TYPE_BOTH       3
+
+#define HT_CAP_TX_BF_CAP_EXPLICIT_CSI_FB_MASK  0x400
+#define HT_CAP_TX_BF_CAP_EXPLICIT_CSI_FB_SHIFT 10
+#define HT_CAP_TX_BF_CAP_EXPLICIT_COMPRESSED_FB_MASK 0x18000
+#define HT_CAP_TX_BF_CAP_EXPLICIT_COMPRESSED_FB_SHIFT 15
+
+#define HT_CAP_MCS_FLAGS_SUPP_BYTE 12 /* byte offset in HT Cap Supported MCS for various flags */
+#define HT_CAP_MCS_RX_8TO15_BYTE_OFFSET                1
+#define HT_CAP_MCS_FLAGS_TX_RX_UNEQUAL              0x02
+#define HT_CAP_MCS_FLAGS_MAX_SPATIAL_STREAM_MASK    0x0C
+
+#define VHT_MAX_MPDU           11454   /* max mpdu size for now (bytes) */
+#define VHT_MPDU_MSDU_DELTA    56              /* Difference in spec - vht mpdu, amsdu len */
+/* Max AMSDU len - per spec */
+#define VHT_MAX_AMSDU          (VHT_MAX_MPDU - VHT_MPDU_MSDU_DELTA)
+
+#define HT_MAX_AMSDU           7935    /* max amsdu size (bytes) per the HT spec */
+#define HT_MIN_AMSDU           3835    /* min amsdu size (bytes) per the HT spec */
+
+#define HT_PARAMS_RX_FACTOR_MASK       0x03    /* ampdu rcv factor mask */
+#define HT_PARAMS_DENSITY_MASK         0x1C    /* ampdu density mask */
+#define HT_PARAMS_DENSITY_SHIFT        2       /* ampdu density shift */
+
+/* HT/AMPDU specific define */
+#define AMPDU_MAX_MPDU_DENSITY  7       /* max mpdu density; in 1/4 usec units */
+#define AMPDU_DENSITY_NONE      0       /* No density requirement */
+#define AMPDU_DENSITY_1over4_US 1       /* 1/4 us density */
+#define AMPDU_DENSITY_1over2_US 2       /* 1/2 us density */
+#define AMPDU_DENSITY_1_US      3       /*   1 us density */
+#define AMPDU_DENSITY_2_US      4       /*   2 us density */
+#define AMPDU_DENSITY_4_US      5       /*   4 us density */
+#define AMPDU_DENSITY_8_US      6       /*   8 us density */
+#define AMPDU_DENSITY_16_US     7       /*  16 us density */
+#define AMPDU_RX_FACTOR_8K      0       /* max rcv ampdu len (8kb) */
+#define AMPDU_RX_FACTOR_16K     1       /* max rcv ampdu len (16kb) */
+#define AMPDU_RX_FACTOR_32K     2       /* max rcv ampdu len (32kb) */
+#define AMPDU_RX_FACTOR_64K     3       /* max rcv ampdu len (64kb) */
+
+/* AMPDU RX factors for VHT rates */
+#define AMPDU_RX_FACTOR_128K    4       /* max rcv ampdu len (128kb) */
+#define AMPDU_RX_FACTOR_256K    5       /* max rcv ampdu len (256kb) */
+#define AMPDU_RX_FACTOR_512K    6       /* max rcv ampdu len (512kb) */
+#define AMPDU_RX_FACTOR_1024K   7       /* max rcv ampdu len (1024kb) */
+
+#define AMPDU_RX_FACTOR_BASE    8*1024  /* ampdu factor base for rx len */
+#define AMPDU_RX_FACTOR_BASE_PWR       13      /* ampdu factor base for rx len in power of 2 */
+
+#define AMPDU_DELIMITER_LEN    4       /* length of ampdu delimiter */
+#define AMPDU_DELIMITER_LEN_MAX        63      /* max length of ampdu delimiter(enforced in HW) */
+
+#define HT_CAP_EXT_PCO                 0x0001
+#define HT_CAP_EXT_PCO_TTIME_MASK      0x0006
+#define HT_CAP_EXT_PCO_TTIME_SHIFT     1
+#define HT_CAP_EXT_MCS_FEEDBACK_MASK   0x0300
+#define HT_CAP_EXT_MCS_FEEDBACK_SHIFT  8
+#define HT_CAP_EXT_HTC                 0x0400
+#define HT_CAP_EXT_RD_RESP             0x0800
+
+/** 'ht_add' is called 'HT Operation' information element in the 802.11 standard */
+BWL_PRE_PACKED_STRUCT struct ht_add_ie {
+       uint8   ctl_ch;                 /* control channel number */
+       uint8   byte1;                  /* ext ch,rec. ch. width, RIFS support */
+       uint16  opmode;                 /* operation mode */
+       uint16  misc_bits;              /* misc bits */
+       uint8   basic_mcs[MCSSET_LEN];  /* required MCS set */
+} BWL_POST_PACKED_STRUCT;
+typedef struct ht_add_ie ht_add_ie_t;
+
+/* ADD IE: HT 1.0 spec. simply stole a 802.11 IE, we use our prop. IE until this is resolved */
+/* the additional IE is primarily used to convey the current BSS configuration */
+BWL_PRE_PACKED_STRUCT struct ht_prop_add_ie {
+       uint8   id;             /* IE ID, 221, DOT11_MNG_PROPR_ID */
+       uint8   len;            /* IE length */
+       uint8   oui[3];
+       uint8   type;           /* indicates what follows */
+       ht_add_ie_t add_ie;
+} BWL_POST_PACKED_STRUCT;
+typedef struct ht_prop_add_ie ht_prop_add_ie_t;
+
+#define HT_ADD_IE_LEN  22
+#define HT_ADD_IE_TYPE 52
+
+/* byte1 defn's */
+#define HT_BW_ANY              0x04    /* set, STA can use 20 or 40MHz */
+#define HT_RIFS_PERMITTED      0x08    /* RIFS allowed */
+
+/* opmode defn's */
+#define HT_OPMODE_MASK         0x0003  /* protection mode mask */
+#define HT_OPMODE_SHIFT                0       /* protection mode shift */
+#define HT_OPMODE_PURE         0x0000  /* protection mode PURE */
+#define HT_OPMODE_OPTIONAL     0x0001  /* protection mode optional */
+#define HT_OPMODE_HT20IN40     0x0002  /* protection mode 20MHz HT in 40MHz BSS */
+#define HT_OPMODE_MIXED        0x0003  /* protection mode Mixed Mode */
+#define HT_OPMODE_NONGF        0x0004  /* protection mode non-GF */
+#define DOT11N_TXBURST         0x0008  /* Tx burst limit */
+#define DOT11N_OBSS_NONHT      0x0010  /* OBSS Non-HT STA present */
+
+/* misc_bites defn's */
+#define HT_BASIC_STBC_MCS      0x007f  /* basic STBC MCS */
+#define HT_DUAL_STBC_PROT      0x0080  /* Dual STBC Protection */
+#define HT_SECOND_BCN          0x0100  /* Secondary beacon support */
+#define HT_LSIG_TXOP           0x0200  /* L-SIG TXOP Protection full support */
+#define HT_PCO_ACTIVE          0x0400  /* PCO active */
+#define HT_PCO_PHASE           0x0800  /* PCO phase */
+#define HT_DUALCTS_PROTECTION  0x0080  /* DUAL CTS protection needed */
+
+/* Tx Burst Limits */
+#define DOT11N_2G_TXBURST_LIMIT        6160    /* 2G band Tx burst limit per 802.11n Draft 1.10 (usec) */
+#define DOT11N_5G_TXBURST_LIMIT        3080    /* 5G band Tx burst limit per 802.11n Draft 1.10 (usec) */
+
+/* Macros for opmode */
+#define GET_HT_OPMODE(add_ie)          ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
+                                       >> HT_OPMODE_SHIFT)
+#define HT_MIXEDMODE_PRESENT(add_ie)   ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
+                                       == HT_OPMODE_MIXED)     /* mixed mode present */
+#define HT_HT20_PRESENT(add_ie)        ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
+                                       == HT_OPMODE_HT20IN40)  /* 20MHz HT present */
+#define HT_OPTIONAL_PRESENT(add_ie)    ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
+                                       == HT_OPMODE_OPTIONAL)  /* Optional protection present */
+#define HT_USE_PROTECTION(add_ie)      (HT_HT20_PRESENT((add_ie)) || \
+                                       HT_MIXEDMODE_PRESENT((add_ie))) /* use protection */
+#define HT_NONGF_PRESENT(add_ie)       ((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_NONGF) \
+                                       == HT_OPMODE_NONGF)     /* non-GF present */
+#define DOT11N_TXBURST_PRESENT(add_ie) ((ltoh16_ua(&add_ie->opmode) & DOT11N_TXBURST) \
+                                       == DOT11N_TXBURST)      /* Tx Burst present */
+#define DOT11N_OBSS_NONHT_PRESENT(add_ie)      ((ltoh16_ua(&add_ie->opmode) & DOT11N_OBSS_NONHT) \
+                                       == DOT11N_OBSS_NONHT)   /* OBSS Non-HT present */
+/* Macros for HT MCS filed access */
+#define HT_CAP_MCS_BITMASK(supp_mcs)                 \
+       ((supp_mcs)[HT_CAP_MCS_RX_8TO15_BYTE_OFFSET])
+#define HT_CAP_MCS_TX_RX_UNEQUAL(supp_mcs)          \
+       ((supp_mcs)[HT_CAP_MCS_FLAGS_SUPP_BYTE] & HT_CAP_MCS_FLAGS_TX_RX_UNEQUAL)
+#define HT_CAP_MCS_TX_STREAM_SUPPORT(supp_mcs)          \
+               ((supp_mcs)[HT_CAP_MCS_FLAGS_SUPP_BYTE] & HT_CAP_MCS_FLAGS_MAX_SPATIAL_STREAM_MASK)
+
+BWL_PRE_PACKED_STRUCT struct obss_params {
+       uint16  passive_dwell;
+       uint16  active_dwell;
+       uint16  bss_widthscan_interval;
+       uint16  passive_total;
+       uint16  active_total;
+       uint16  chanwidth_transition_dly;
+       uint16  activity_threshold;
+} BWL_POST_PACKED_STRUCT;
+typedef struct obss_params obss_params_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_obss_ie {
+       uint8   id;
+       uint8   len;
+       obss_params_t obss_params;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_obss_ie dot11_obss_ie_t;
+#define DOT11_OBSS_SCAN_IE_LEN sizeof(obss_params_t)   /* HT OBSS len (based on 802.11n d3.0) */
+
+/* HT control field */
+#define HT_CTRL_LA_TRQ         0x00000002      /* sounding request */
+#define HT_CTRL_LA_MAI         0x0000003C      /* MCS request or antenna selection indication */
+#define HT_CTRL_LA_MAI_SHIFT   2
+#define HT_CTRL_LA_MAI_MRQ     0x00000004      /* MCS request */
+#define HT_CTRL_LA_MAI_MSI     0x00000038      /* MCS request sequence identifier */
+#define HT_CTRL_LA_MFSI                0x000001C0      /* MFB sequence identifier */
+#define HT_CTRL_LA_MFSI_SHIFT  6
+#define HT_CTRL_LA_MFB_ASELC   0x0000FE00      /* MCS feedback, antenna selection command/data */
+#define HT_CTRL_LA_MFB_ASELC_SH        9
+#define HT_CTRL_LA_ASELC_CMD   0x00000C00      /* ASEL command */
+#define HT_CTRL_LA_ASELC_DATA  0x0000F000      /* ASEL data */
+#define HT_CTRL_CAL_POS                0x00030000      /* Calibration position */
+#define HT_CTRL_CAL_SEQ                0x000C0000      /* Calibration sequence */
+#define HT_CTRL_CSI_STEERING   0x00C00000      /* CSI/Steering */
+#define HT_CTRL_CSI_STEER_SHIFT        22
+#define HT_CTRL_CSI_STEER_NFB  0               /* no fedback required */
+#define HT_CTRL_CSI_STEER_CSI  1               /* CSI, H matrix */
+#define HT_CTRL_CSI_STEER_NCOM 2               /* non-compressed beamforming */
+#define HT_CTRL_CSI_STEER_COM  3               /* compressed beamforming */
+#define HT_CTRL_NDP_ANNOUNCE   0x01000000      /* NDP announcement */
+#define HT_CTRL_AC_CONSTRAINT  0x40000000      /* AC Constraint */
+#define HT_CTRL_RDG_MOREPPDU   0x80000000      /* RDG/More PPDU */
+
+/* ************* VHT definitions. ************* */
+
+/**
+ * VHT Capabilites IE (sec 8.4.2.160)
+ */
+
+BWL_PRE_PACKED_STRUCT struct vht_cap_ie {
+       uint32  vht_cap_info;
+       /* supported MCS set - 64 bit field */
+       uint16  rx_mcs_map;
+       uint16  rx_max_rate;
+       uint16  tx_mcs_map;
+       uint16  tx_max_rate;
+} BWL_POST_PACKED_STRUCT;
+typedef struct vht_cap_ie vht_cap_ie_t;
+
+/* 4B cap_info + 8B supp_mcs */
+#define VHT_CAP_IE_LEN 12
+
+/* VHT Capabilities Info field - 32bit - in VHT Cap IE */
+#define VHT_CAP_INFO_MAX_MPDU_LEN_MASK          0x00000003
+#define VHT_CAP_INFO_SUPP_CHAN_WIDTH_MASK       0x0000000c
+#define VHT_CAP_INFO_LDPC                       0x00000010
+#define VHT_CAP_INFO_SGI_80MHZ                  0x00000020
+#define VHT_CAP_INFO_SGI_160MHZ                 0x00000040
+#define VHT_CAP_INFO_TX_STBC                    0x00000080
+#define VHT_CAP_INFO_RX_STBC_MASK               0x00000700
+#define VHT_CAP_INFO_RX_STBC_SHIFT              8
+#define VHT_CAP_INFO_SU_BEAMFMR                 0x00000800
+#define VHT_CAP_INFO_SU_BEAMFMEE                0x00001000
+#define VHT_CAP_INFO_NUM_BMFMR_ANT_MASK         0x0000e000
+#define VHT_CAP_INFO_NUM_BMFMR_ANT_SHIFT        13
+#define VHT_CAP_INFO_NUM_SOUNDING_DIM_MASK      0x00070000
+#define VHT_CAP_INFO_NUM_SOUNDING_DIM_SHIFT     16
+#define VHT_CAP_INFO_MU_BEAMFMR                 0x00080000
+#define VHT_CAP_INFO_MU_BEAMFMEE                0x00100000
+#define VHT_CAP_INFO_TXOPPS                     0x00200000
+#define VHT_CAP_INFO_HTCVHT                     0x00400000
+#define VHT_CAP_INFO_AMPDU_MAXLEN_EXP_MASK      0x03800000
+#define VHT_CAP_INFO_AMPDU_MAXLEN_EXP_SHIFT     23
+#define VHT_CAP_INFO_LINK_ADAPT_CAP_MASK        0x0c000000
+#define VHT_CAP_INFO_LINK_ADAPT_CAP_SHIFT       26
+
+/* VHT Supported MCS Set - 64-bit - in VHT Cap IE */
+#define VHT_CAP_SUPP_MCS_RX_HIGHEST_RATE_MASK   0x1fff
+#define VHT_CAP_SUPP_MCS_RX_HIGHEST_RATE_SHIFT  0
+#define VHT_CAP_SUPP_CHAN_WIDTH_SHIFT          5
+
+#define VHT_CAP_SUPP_MCS_TX_HIGHEST_RATE_MASK   0x1fff
+#define VHT_CAP_SUPP_MCS_TX_HIGHEST_RATE_SHIFT  0
+
+#define VHT_CAP_MCS_MAP_0_7                     0
+#define VHT_CAP_MCS_MAP_0_8                     1
+#define VHT_CAP_MCS_MAP_0_9                     2
+#define VHT_CAP_MCS_MAP_NONE                    3
+#define VHT_CAP_MCS_MAP_S                       2 /* num bits for 1-stream */
+#define VHT_CAP_MCS_MAP_M                       0x3 /* mask for 1-stream */
+/* assumes VHT_CAP_MCS_MAP_NONE is 3 and 2 bits are used for encoding */
+#define VHT_CAP_MCS_MAP_NONE_ALL                0xffff
+
+/* VHT rates bitmap */
+#define VHT_CAP_MCS_0_7_RATEMAP                0x00ff
+#define VHT_CAP_MCS_0_8_RATEMAP                0x01ff
+#define VHT_CAP_MCS_0_9_RATEMAP                0x03ff
+#define VHT_CAP_MCS_FULL_RATEMAP       VHT_CAP_MCS_0_9_RATEMAP
+
+#define VHT_PROP_MCS_MAP_10_11                   0
+#define VHT_PROP_MCS_MAP_UNUSED1                 1
+#define VHT_PROP_MCS_MAP_UNUSED2                 2
+#define VHT_PROP_MCS_MAP_NONE                    3
+#define VHT_PROP_MCS_MAP_NONE_ALL                0xffff
+
+/* VHT prop rates bitmap */
+#define VHT_PROP_MCS_10_11_RATEMAP     0x0c00
+#define VHT_PROP_MCS_FULL_RATEMAP      VHT_PROP_MCS_10_11_RATEMAP
+
+#if !defined(VHT_CAP_MCS_MAP_0_9_NSS3)
+/* mcsmap with MCS0-9 for Nss = 3 */
+#define VHT_CAP_MCS_MAP_0_9_NSS3 \
+               ((VHT_CAP_MCS_MAP_0_9 << VHT_MCS_MAP_GET_SS_IDX(1)) | \
+                (VHT_CAP_MCS_MAP_0_9 << VHT_MCS_MAP_GET_SS_IDX(2)) | \
+                (VHT_CAP_MCS_MAP_0_9 << VHT_MCS_MAP_GET_SS_IDX(3)))
+#endif /* !VHT_CAP_MCS_MAP_0_9_NSS3 */
+
+#define VHT_CAP_MCS_MAP_NSS_MAX                 8
+
+/* get mcsmap with given mcs for given nss streams */
+#define VHT_CAP_MCS_MAP_CREATE(mcsmap, nss, mcs) \
+       do { \
+               int i; \
+               for (i = 1; i <= nss; i++) { \
+                       VHT_MCS_MAP_SET_MCS_PER_SS(i, mcs, mcsmap); \
+               } \
+       } while (0)
+
+/* Map the mcs code to mcs bit map */
+#define VHT_MCS_CODE_TO_MCS_MAP(mcs_code) \
+       ((mcs_code == VHT_CAP_MCS_MAP_0_7) ? VHT_CAP_MCS_0_7_RATEMAP : \
+        (mcs_code == VHT_CAP_MCS_MAP_0_8) ? VHT_CAP_MCS_0_8_RATEMAP : \
+        (mcs_code == VHT_CAP_MCS_MAP_0_9) ? VHT_CAP_MCS_0_9_RATEMAP : 0)
+
+#define VHT_PROP_MCS_CODE_TO_PROP_MCS_MAP(mcs_code) \
+       ((mcs_code == VHT_PROP_MCS_MAP_10_11) ? VHT_PROP_MCS_10_11_RATEMAP : 0)
+
+/* Map the mcs bit map to mcs code */
+#define VHT_MCS_MAP_TO_MCS_CODE(mcs_map) \
+       ((mcs_map == VHT_CAP_MCS_0_7_RATEMAP) ? VHT_CAP_MCS_MAP_0_7 : \
+        (mcs_map == VHT_CAP_MCS_0_8_RATEMAP) ? VHT_CAP_MCS_MAP_0_8 : \
+        (mcs_map == VHT_CAP_MCS_0_9_RATEMAP) ? VHT_CAP_MCS_MAP_0_9 : VHT_CAP_MCS_MAP_NONE)
+
+#define VHT_PROP_MCS_MAP_TO_PROP_MCS_CODE(mcs_map) \
+       (((mcs_map & 0xc00) == 0xc00)  ? VHT_PROP_MCS_MAP_10_11 : VHT_PROP_MCS_MAP_NONE)
+
+/** VHT Capabilities Supported Channel Width */
+typedef enum vht_cap_chan_width {
+       VHT_CAP_CHAN_WIDTH_SUPPORT_MANDATORY = 0x00,
+       VHT_CAP_CHAN_WIDTH_SUPPORT_160       = 0x04,
+       VHT_CAP_CHAN_WIDTH_SUPPORT_160_8080  = 0x08
+} vht_cap_chan_width_t;
+
+/** VHT Capabilities Supported max MPDU LEN (sec 8.4.2.160.2) */
+typedef enum vht_cap_max_mpdu_len {
+       VHT_CAP_MPDU_MAX_4K     = 0x00,
+       VHT_CAP_MPDU_MAX_8K     = 0x01,
+       VHT_CAP_MPDU_MAX_11K    = 0x02
+} vht_cap_max_mpdu_len_t;
+
+/* Maximum MPDU Length byte counts for the VHT Capabilities advertised limits */
+#define VHT_MPDU_LIMIT_4K        3895
+#define VHT_MPDU_LIMIT_8K        7991
+#define VHT_MPDU_LIMIT_11K      11454
+
+
+/**
+ * VHT Operation IE (sec 8.4.2.161)
+ */
+
+BWL_PRE_PACKED_STRUCT struct vht_op_ie {
+       uint8   chan_width;
+       uint8   chan1;
+       uint8   chan2;
+       uint16  supp_mcs;  /*  same def as above in vht cap */
+} BWL_POST_PACKED_STRUCT;
+typedef struct vht_op_ie vht_op_ie_t;
+
+/* 3B VHT Op info + 2B Basic MCS */
+#define VHT_OP_IE_LEN 5
+
+typedef enum vht_op_chan_width {
+       VHT_OP_CHAN_WIDTH_20_40 = 0,
+       VHT_OP_CHAN_WIDTH_80    = 1,
+       VHT_OP_CHAN_WIDTH_160   = 2,
+       VHT_OP_CHAN_WIDTH_80_80 = 3
+} vht_op_chan_width_t;
+
+/* AID length */
+#define AID_IE_LEN             2
+/**
+ * BRCM vht features IE header
+ * The header if the fixed part of the IE
+ * On the 5GHz band this is the entire IE,
+ * on 2.4GHz the VHT IEs as defined in the 802.11ac
+ * specification follows
+ *
+ *
+ * VHT features rates  bitmap.
+ * Bit0:               5G MCS 0-9 BW 160MHz
+ * Bit1:               5G MCS 0-9 support BW 80MHz
+ * Bit2:               5G MCS 0-9 support BW 20MHz
+ * Bit3:               2.4G MCS 0-9 support BW 20MHz
+ * Bits:4-7    Reserved for future use
+ *
+ */
+#define VHT_FEATURES_IE_TYPE   0x4
+BWL_PRE_PACKED_STRUCT struct vht_features_ie_hdr {
+       uint8 oui[3];
+       uint8 type;             /* type of this IE = 4 */
+       uint8 rate_mask;        /* VHT rate mask */
+} BWL_POST_PACKED_STRUCT;
+typedef struct vht_features_ie_hdr vht_features_ie_hdr_t;
+
+/* Def for rx & tx basic mcs maps - ea ss num has 2 bits of info */
+#define VHT_MCS_MAP_GET_SS_IDX(nss) (((nss)-1) * VHT_CAP_MCS_MAP_S)
+#define VHT_MCS_MAP_GET_MCS_PER_SS(nss, mcsMap) \
+       (((mcsMap) >> VHT_MCS_MAP_GET_SS_IDX(nss)) & VHT_CAP_MCS_MAP_M)
+#define VHT_MCS_MAP_SET_MCS_PER_SS(nss, numMcs, mcsMap) \
+       do { \
+        (mcsMap) &= (~(VHT_CAP_MCS_MAP_M << VHT_MCS_MAP_GET_SS_IDX(nss))); \
+        (mcsMap) |= (((numMcs) & VHT_CAP_MCS_MAP_M) << VHT_MCS_MAP_GET_SS_IDX(nss)); \
+       } while (0)
+#define VHT_MCS_SS_SUPPORTED(nss, mcsMap) \
+                (VHT_MCS_MAP_GET_MCS_PER_SS((nss), (mcsMap)) != VHT_CAP_MCS_MAP_NONE)
+
+/* Get the max ss supported from the mcs map */
+#define VHT_MAX_SS_SUPPORTED(mcsMap) \
+       VHT_MCS_SS_SUPPORTED(8, mcsMap) ? 8 : \
+       VHT_MCS_SS_SUPPORTED(7, mcsMap) ? 7 : \
+       VHT_MCS_SS_SUPPORTED(6, mcsMap) ? 6 : \
+       VHT_MCS_SS_SUPPORTED(5, mcsMap) ? 5 : \
+       VHT_MCS_SS_SUPPORTED(4, mcsMap) ? 4 : \
+       VHT_MCS_SS_SUPPORTED(3, mcsMap) ? 3 : \
+       VHT_MCS_SS_SUPPORTED(2, mcsMap) ? 2 : \
+       VHT_MCS_SS_SUPPORTED(1, mcsMap) ? 1 : 0
+
+/* ************* WPA definitions. ************* */
+#define WPA_OUI                        "\x00\x50\xF2"  /* WPA OUI */
+#define WPA_OUI_LEN            3               /* WPA OUI length */
+#define WPA_OUI_TYPE           1
+#define WPA_VERSION            1               /* WPA version */
+#define WPA2_OUI               "\x00\x0F\xAC"  /* WPA2 OUI */
+#define WPA2_OUI_LEN           3               /* WPA2 OUI length */
+#define WPA2_VERSION           1               /* WPA2 version */
+#define WPA2_VERSION_LEN       2               /* WAP2 version length */
+
+/* ************* WPS definitions. ************* */
+#define WPS_OUI                        "\x00\x50\xF2"  /* WPS OUI */
+#define WPS_OUI_LEN            3               /* WPS OUI length */
+#define WPS_OUI_TYPE           4
+
+/* ************* WFA definitions. ************* */
+
+#ifdef P2P_IE_OVRD
+#define WFA_OUI                        MAC_OUI
+#else
+#define WFA_OUI                        "\x50\x6F\x9A"  /* WFA OUI */
+#endif /* P2P_IE_OVRD */
+#define WFA_OUI_LEN            3               /* WFA OUI length */
+#ifdef P2P_IE_OVRD
+#define WFA_OUI_TYPE_P2P       MAC_OUI_TYPE_P2P
+#else
+#define WFA_OUI_TYPE_TPC       8
+#define WFA_OUI_TYPE_P2P       9
+#endif
+
+#define WFA_OUI_TYPE_TPC       8
+#ifdef WLTDLS
+#define WFA_OUI_TYPE_TPQ       4       /* WFD Tunneled Probe ReQuest */
+#define WFA_OUI_TYPE_TPS       5       /* WFD Tunneled Probe ReSponse */
+#define WFA_OUI_TYPE_WFD       10
+#endif /* WTDLS */
+#define WFA_OUI_TYPE_HS20      0x10
+#define WFA_OUI_TYPE_OSEN      0x12
+#define WFA_OUI_TYPE_NAN       0x13
+#define WFA_OUI_TYPE_MBO       0x16
+#define WFA_OUI_TYPE_MBO_OCE   0x16
+
+/* RSN authenticated key managment suite */
+#define RSN_AKM_NONE           0       /* None (IBSS) */
+#define RSN_AKM_UNSPECIFIED    1       /* Over 802.1x */
+#define RSN_AKM_PSK            2       /* Pre-shared Key */
+#define RSN_AKM_FBT_1X         3       /* Fast Bss transition using 802.1X */
+#define RSN_AKM_FBT_PSK                4       /* Fast Bss transition using Pre-shared Key */
+/* RSN_AKM_MFP_1X and RSN_AKM_MFP_PSK are not used any more
+ * Just kept here to avoid build issue in BISON/CARIBOU branch
+ */
+#define RSN_AKM_MFP_1X         5       /* SHA256 key derivation, using 802.1X */
+#define RSN_AKM_MFP_PSK                6       /* SHA256 key derivation, using Pre-shared Key */
+#define RSN_AKM_SHA256_1X      5       /* SHA256 key derivation, using 802.1X */
+#define RSN_AKM_SHA256_PSK     6       /* SHA256 key derivation, using Pre-shared Key */
+#define RSN_AKM_TPK            7       /* TPK(TDLS Peer Key) handshake */
+
+/* OSEN authenticated key managment suite */
+#define OSEN_AKM_UNSPECIFIED   RSN_AKM_UNSPECIFIED     /* Over 802.1x */
+
+/* Key related defines */
+#define DOT11_MAX_DEFAULT_KEYS 4       /* number of default keys */
+#define DOT11_MAX_IGTK_KEYS            2
+#define DOT11_MAX_KEY_SIZE     32      /* max size of any key */
+#define DOT11_MAX_IV_SIZE      16      /* max size of any IV */
+#define DOT11_EXT_IV_FLAG      (1<<5)  /* flag to indicate IV is > 4 bytes */
+#define DOT11_WPA_KEY_RSC_LEN   8       /* WPA RSC key len */
+
+#define WEP1_KEY_SIZE          5       /* max size of any WEP key */
+#define WEP1_KEY_HEX_SIZE      10      /* size of WEP key in hex. */
+#define WEP128_KEY_SIZE                13      /* max size of any WEP key */
+#define WEP128_KEY_HEX_SIZE    26      /* size of WEP key in hex. */
+#define TKIP_MIC_SIZE          8       /* size of TKIP MIC */
+#define TKIP_EOM_SIZE          7       /* max size of TKIP EOM */
+#define TKIP_EOM_FLAG          0x5a    /* TKIP EOM flag byte */
+#define TKIP_KEY_SIZE          32      /* size of any TKIP key, includs MIC keys */
+#define TKIP_TK_SIZE           16
+#define TKIP_MIC_KEY_SIZE      8
+#define TKIP_MIC_AUTH_TX       16      /* offset to Authenticator MIC TX key */
+#define TKIP_MIC_AUTH_RX       24      /* offset to Authenticator MIC RX key */
+#define TKIP_MIC_SUP_RX                TKIP_MIC_AUTH_TX        /* offset to Supplicant MIC RX key */
+#define TKIP_MIC_SUP_TX                TKIP_MIC_AUTH_RX        /* offset to Supplicant MIC TX key */
+#define AES_KEY_SIZE           16      /* size of AES key */
+#define AES_MIC_SIZE           8       /* size of AES MIC */
+#define BIP_KEY_SIZE           16      /* size of BIP key */
+#define BIP_MIC_SIZE           8   /* sizeof BIP MIC */
+
+#define AES_GCM_MIC_SIZE       16      /* size of MIC for 128-bit GCM - .11adD9 */
+
+#define AES256_KEY_SIZE                32      /* size of AES 256 key - .11acD5 */
+#define AES256_MIC_SIZE                16      /* size of MIC for 256 bit keys, incl BIP */
+
+/* WCN */
+#define WCN_OUI                        "\x00\x50\xf2"  /* WCN OUI */
+#define WCN_TYPE               4       /* WCN type */
+
+#ifdef BCMWAPI_WPI
+#define SMS4_KEY_LEN           16
+#define SMS4_WPI_CBC_MAC_LEN   16
+#endif
+
+/* 802.11r protocol definitions */
+
+/** Mobility Domain IE */
+BWL_PRE_PACKED_STRUCT struct dot11_mdid_ie {
+       uint8 id;
+       uint8 len;
+       uint16 mdid;            /* Mobility Domain Id */
+       uint8 cap;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_mdid_ie dot11_mdid_ie_t;
+
+#define FBT_MDID_CAP_OVERDS    0x01    /* Fast Bss transition over the DS support */
+#define FBT_MDID_CAP_RRP       0x02    /* Resource request protocol support */
+
+/** Fast Bss Transition IE */
+BWL_PRE_PACKED_STRUCT struct dot11_ft_ie {
+       uint8 id;
+       uint8 len;
+       uint16 mic_control;             /* Mic Control */
+       uint8 mic[16];
+       uint8 anonce[32];
+       uint8 snonce[32];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ft_ie dot11_ft_ie_t;
+
+#define TIE_TYPE_RESERVED              0
+#define TIE_TYPE_REASSOC_DEADLINE      1
+#define TIE_TYPE_KEY_LIEFTIME          2
+#define TIE_TYPE_ASSOC_COMEBACK                3
+BWL_PRE_PACKED_STRUCT struct dot11_timeout_ie {
+       uint8 id;
+       uint8 len;
+       uint8 type;             /* timeout interval type */
+       uint32 value;           /* timeout interval value */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_timeout_ie dot11_timeout_ie_t;
+
+/** GTK ie */
+BWL_PRE_PACKED_STRUCT struct dot11_gtk_ie {
+       uint8 id;
+       uint8 len;
+       uint16 key_info;
+       uint8 key_len;
+       uint8 rsc[8];
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_gtk_ie dot11_gtk_ie_t;
+
+/** Management MIC ie */
+BWL_PRE_PACKED_STRUCT struct mmic_ie {
+       uint8   id;                                     /* IE ID: DOT11_MNG_MMIE_ID */
+       uint8   len;                            /* IE length */
+       uint16  key_id;                         /* key id */
+       uint8   ipn[6];                         /* ipn */
+       uint8   mic[16];                        /* mic */
+} BWL_POST_PACKED_STRUCT;
+typedef struct mmic_ie mmic_ie_t;
+
+/* 802.11r-2008, 11A.10.3 - RRB frame format */
+BWL_PRE_PACKED_STRUCT struct dot11_ft_rrb_frame {
+       uint8  frame_type; /* 1 for RRB */
+       uint8  packet_type; /* 0 for Request 1 for Response */
+       uint16 len;
+       uint8  cur_ap_addr[ETHER_ADDR_LEN];
+       uint8  data[1]; /* IEs Received/Sent in FT Action Req/Resp Frame */
+} BWL_POST_PACKED_STRUCT;
+
+typedef struct dot11_ft_rrb_frame dot11_ft_rrb_frame_t;
+
+#define DOT11_FT_RRB_FIXED_LEN 10
+#define DOT11_FT_REMOTE_FRAME_TYPE 1
+#define DOT11_FT_PACKET_REQ 0
+#define DOT11_FT_PACKET_RESP 1
+
+#define BSSID_INVALID           "\x00\x00\x00\x00\x00\x00"
+#define BSSID_BROADCAST         "\xFF\xFF\xFF\xFF\xFF\xFF"
+
+#ifdef BCMWAPI_WAI
+#define WAPI_IE_MIN_LEN        20      /* WAPI IE min length */
+#define WAPI_VERSION           1       /* WAPI version */
+#define WAPI_VERSION_LEN       2       /* WAPI version length */
+#define WAPI_OUI               "\x00\x14\x72"  /* WAPI OUI */
+#define WAPI_OUI_LEN           DOT11_OUI_LEN   /* WAPI OUI length */
+#endif /* BCMWAPI_WAI */
+
+/* ************* WMM Parameter definitions. ************* */
+#define WMM_OUI                        "\x00\x50\xF2"  /* WNN OUI */
+#define WMM_OUI_LEN            3               /* WMM OUI length */
+#define WMM_OUI_TYPE   2               /* WMM OUT type */
+#define WMM_VERSION            1
+#define WMM_VERSION_LEN        1
+
+/* WMM OUI subtype */
+#define WMM_OUI_SUBTYPE_PARAMETER      1
+#define WMM_PARAMETER_IE_LEN           24
+
+/** Link Identifier Element */
+BWL_PRE_PACKED_STRUCT struct link_id_ie {
+       uint8 id;
+       uint8 len;
+       struct ether_addr       bssid;
+       struct ether_addr       tdls_init_mac;
+       struct ether_addr       tdls_resp_mac;
+} BWL_POST_PACKED_STRUCT;
+typedef struct link_id_ie link_id_ie_t;
+#define TDLS_LINK_ID_IE_LEN            18
+
+/** Link Wakeup Schedule Element */
+BWL_PRE_PACKED_STRUCT struct wakeup_sch_ie {
+       uint8 id;
+       uint8 len;
+       uint32 offset;                  /* in ms between TSF0 and start of 1st Awake Window */
+       uint32 interval;                /* in ms bwtween the start of 2 Awake Windows */
+       uint32 awake_win_slots; /* in backof slots, duration of Awake Window */
+       uint32 max_wake_win;    /* in ms, max duration of Awake Window */
+       uint16 idle_cnt;                /* number of consecutive Awake Windows */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wakeup_sch_ie wakeup_sch_ie_t;
+#define TDLS_WAKEUP_SCH_IE_LEN         18
+
+/** Channel Switch Timing Element */
+BWL_PRE_PACKED_STRUCT struct channel_switch_timing_ie {
+       uint8 id;
+       uint8 len;
+       uint16 switch_time;             /* in ms, time to switch channels */
+       uint16 switch_timeout;  /* in ms */
+} BWL_POST_PACKED_STRUCT;
+typedef struct channel_switch_timing_ie channel_switch_timing_ie_t;
+#define TDLS_CHANNEL_SWITCH_TIMING_IE_LEN              4
+
+/** PTI Control Element */
+BWL_PRE_PACKED_STRUCT struct pti_control_ie {
+       uint8 id;
+       uint8 len;
+       uint8 tid;
+       uint16 seq_control;
+} BWL_POST_PACKED_STRUCT;
+typedef struct pti_control_ie pti_control_ie_t;
+#define TDLS_PTI_CONTROL_IE_LEN                3
+
+/** PU Buffer Status Element */
+BWL_PRE_PACKED_STRUCT struct pu_buffer_status_ie {
+       uint8 id;
+       uint8 len;
+       uint8 status;
+} BWL_POST_PACKED_STRUCT;
+typedef struct pu_buffer_status_ie pu_buffer_status_ie_t;
+#define TDLS_PU_BUFFER_STATUS_IE_LEN   1
+#define TDLS_PU_BUFFER_STATUS_AC_BK            1
+#define TDLS_PU_BUFFER_STATUS_AC_BE            2
+#define TDLS_PU_BUFFER_STATUS_AC_VI            4
+#define TDLS_PU_BUFFER_STATUS_AC_VO            8
+
+/* TDLS Action Field Values */
+#define TDLS_SETUP_REQ                         0
+#define TDLS_SETUP_RESP                                1
+#define TDLS_SETUP_CONFIRM                     2
+#define TDLS_TEARDOWN                          3
+#define TDLS_PEER_TRAFFIC_IND                  4
+#define TDLS_CHANNEL_SWITCH_REQ                        5
+#define TDLS_CHANNEL_SWITCH_RESP               6
+#define TDLS_PEER_PSM_REQ                      7
+#define TDLS_PEER_PSM_RESP                     8
+#define TDLS_PEER_TRAFFIC_RESP                 9
+#define TDLS_DISCOVERY_REQ                     10
+
+/* 802.11z TDLS Public Action Frame action field */
+#define TDLS_DISCOVERY_RESP                    14
+
+/* 802.11u GAS action frames */
+#define GAS_REQUEST_ACTION_FRAME                               10
+#define GAS_RESPONSE_ACTION_FRAME                              11
+#define GAS_COMEBACK_REQUEST_ACTION_FRAME              12
+#define GAS_COMEBACK_RESPONSE_ACTION_FRAME             13
+
+/* FTM - fine timing measurement public action frames */
+BWL_PRE_PACKED_STRUCT struct dot11_ftm_req {
+       uint8 category;                         /* category of action frame (4) */
+       uint8 action;                           /* public action (32) */
+       uint8 trigger;                          /* trigger/continue? */
+       /* optional lci, civic loc, ftm params */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ftm_req dot11_ftm_req_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_ftm {
+       uint8 category;                         /* category of action frame (4) */
+       uint8 action;                           /* public action (33) */
+       uint8 dialog;                           /* dialog token */
+       uint8 follow_up;                        /* follow up dialog token */
+       uint8 tod[6];                           /* t1 - last depart timestamp */
+       uint8 toa[6];                           /* t4 - last ack arrival timestamp */
+       uint8 tod_err[2];                       /* t1 error */
+       uint8 toa_err[2];                       /* t4 error */
+       /* optional lci report, civic loc report, ftm params */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ftm dot11_ftm_t;
+
+
+#define DOT11_FTM_ERR_NOT_CONT_OFFSET 1
+#define DOT11_FTM_ERR_NOT_CONT_MASK 0x80
+#define DOT11_FTM_ERR_NOT_CONT_SHIFT 7
+#define DOT11_FTM_ERR_NOT_CONT(_err) (((_err)[DOT11_FTM_ERR_NOT_CONT_OFFSET] & \
+       DOT11_FTM_ERR_NOT_CONT_MASK) >> DOT11_FTM_ERR_NOT_CONT_SHIFT)
+#define DOT11_FTM_ERR_SET_NOT_CONT(_err, _val) do {\
+       uint8 _err2 = (_err)[DOT11_FTM_ERR_NOT_CONT_OFFSET]; \
+       _err2 &= ~DOT11_FTM_ERR_NOT_CONT_MASK; \
+       _err2 |= ((_val) << DOT11_FTM_ERR_NOT_CONT_SHIFT) & DOT11_FTM_ERR_NOT_CONT_MASK; \
+       (_err)[DOT11_FTM_ERR_NOT_CONT_OFFSET] = _err2; \
+} while (0)
+
+#define DOT11_FTM_ERR_MAX_ERR_OFFSET 0
+#define DOT11_FTM_ERR_MAX_ERR_MASK 0x7fff
+#define DOT11_FTM_ERR_MAX_ERR_SHIFT 0
+#define DOT11_FTM_ERR_MAX_ERR(_err) (((((_err)[1] & 0x7f) << 8) | (_err)[0]))
+#define DOT11_FTM_ERR_SET_MAX_ERR(_err, _val) do {\
+       uint16 _val2; \
+       uint16 _not_cont; \
+       _val2 =  (((_val) & DOT11_FTM_ERR_MAX_ERR_MASK) << DOT11_FTM_ERR_MAX_ERR_SHIFT); \
+       _val2 = (_val2 > 0x3fff) ? 0 : _val2; /* not expecting > 16ns error */ \
+       _not_cont = DOT11_FTM_ERR_NOT_CONT(_err); \
+       (_err)[0] = _val2 & 0xff; \
+       (_err)[1] = (_val2 >> 8) & 0xff; \
+       DOT11_FTM_ERR_SET_NOT_CONT(_err, _not_cont); \
+} while (0)
+
+#if defined(DOT11_FTM_ERR_ROM_COMPAT)
+/* incorrect defs - here for ROM compatibiity */
+#undef DOT11_FTM_ERR_NOT_CONT_OFFSET
+#undef DOT11_FTM_ERR_NOT_CONT_MASK
+#undef DOT11_FTM_ERR_NOT_CONT_SHIFT
+#undef DOT11_FTM_ERR_NOT_CONT
+#undef DOT11_FTM_ERR_SET_NOT_CONT
+
+#define DOT11_FTM_ERR_NOT_CONT_OFFSET 0
+#define DOT11_FTM_ERR_NOT_CONT_MASK 0x0001
+#define DOT11_FTM_ERR_NOT_CONT_SHIFT 0
+#define DOT11_FTM_ERR_NOT_CONT(_err) (((_err)[DOT11_FTM_ERR_NOT_CONT_OFFSET] & \
+       DOT11_FTM_ERR_NOT_CONT_MASK) >> DOT11_FTM_ERR_NOT_CONT_SHIFT)
+#define DOT11_FTM_ERR_SET_NOT_CONT(_err, _val) do {\
+       uint8 _err2 = (_err)[DOT11_FTM_ERR_NOT_CONT_OFFSET]; \
+       _err2 &= ~DOT11_FTM_ERR_NOT_CONT_MASK; \
+       _err2 |= ((_val) << DOT11_FTM_ERR_NOT_CONT_SHIFT) & DOT11_FTM_ERR_NOT_CONT_MASK; \
+       (_err)[DOT11_FTM_ERR_NOT_CONT_OFFSET] = _err2; \
+} while (0)
+
+#undef DOT11_FTM_ERR_MAX_ERR_OFFSET
+#undef DOT11_FTM_ERR_MAX_ERR_MASK
+#undef DOT11_FTM_ERR_MAX_ERR_SHIFT
+#undef DOT11_FTM_ERR_MAX_ERR
+#undef DOT11_FTM_ERR_SET_MAX_ERR
+
+#define DOT11_FTM_ERR_MAX_ERR_OFFSET 0
+#define DOT11_FTM_ERR_MAX_ERR_MASK 0xfff7
+#define DOT11_FTM_ERR_MAX_ERR_SHIFT 1
+#define DOT11_FTM_ERR_MAX_ERR(_err) ((((_err)[1] << 7) | (_err)[0]) >> 1)
+#define DOT11_FTM_ERR_SET_MAX_ERR(_err, _val) do {\
+       uint16 _val2; \
+       _val2 =  (((_val) << DOT11_FTM_ERR_MAX_ERR_SHIFT) |\
+                ((_err)[DOT11_FTM_ERR_NOT_CONT_OFFSET] & DOT11_FTM_ERR_NOT_CONT_MASK)); \
+       (_err)[0] = _val2 & 0xff; \
+       (_err)[1] = _val2 >> 8 & 0xff; \
+} while (0)
+#endif /* DOT11_FTM_ERR_ROM_COMPAT */
+
+BWL_PRE_PACKED_STRUCT struct dot11_ftm_params {
+       uint8 id;               /* DOT11_MNG_FTM_PARAM_ID 8.4.2.166 11mcd2.6/2014 - revisit */
+       uint8 len;
+       uint8 info[9];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ftm_params dot11_ftm_params_t;
+#define DOT11_FTM_PARAMS_IE_LEN (sizeof(dot11_ftm_params_t) - 2)
+
+#define FTM_PARAMS_FIELD(_p, _off, _mask, _shift) (((_p)->info[(_off)] & (_mask)) >> (_shift))
+#define FTM_PARAMS_SET_FIELD(_p, _off, _mask, _shift, _val) do {\
+       uint8 _ptmp = (_p)->info[_off] & ~(_mask); \
+       (_p)->info[(_off)] = _ptmp | (((_val) << (_shift)) & (_mask)); \
+} while (0)
+
+#define FTM_PARAMS_STATUS_OFFSET 0
+#define FTM_PARAMS_STATUS_MASK 0x03
+#define FTM_PARAMS_STATUS_SHIFT 0
+#define FTM_PARAMS_STATUS(_p) FTM_PARAMS_FIELD(_p, FTM_PARAMS_STATUS_OFFSET, \
+       FTM_PARAMS_STATUS_MASK, FTM_PARAMS_STATUS_SHIFT)
+#define FTM_PARAMS_SET_STATUS(_p, _status) FTM_PARAMS_SET_FIELD(_p, \
+       FTM_PARAMS_STATUS_OFFSET, FTM_PARAMS_STATUS_MASK, FTM_PARAMS_STATUS_SHIFT, _status)
+
+#define FTM_PARAMS_VALUE_OFFSET 0
+#define FTM_PARAMS_VALUE_MASK 0x7c
+#define FTM_PARAMS_VALUE_SHIFT 2
+#define FTM_PARAMS_VALUE(_p) FTM_PARAMS_FIELD(_p, FTM_PARAMS_VALUE_OFFSET, \
+       FTM_PARAMS_VALUE_MASK, FTM_PARAMS_VALUE_SHIFT)
+#define FTM_PARAMS_SET_VALUE(_p, _value) FTM_PARAMS_SET_FIELD(_p, \
+       FTM_PARAMS_VALUE_OFFSET, FTM_PARAMS_VALUE_MASK, FTM_PARAMS_VALUE_SHIFT, _value)
+#define FTM_PARAMS_MAX_VALUE 32
+
+#define FTM_PARAMS_NBURSTEXP_OFFSET 1
+#define FTM_PARAMS_NBURSTEXP_MASK 0x0f
+#define FTM_PARAMS_NBURSTEXP_SHIFT 0
+#define FTM_PARAMS_NBURSTEXP(_p) FTM_PARAMS_FIELD(_p, FTM_PARAMS_NBURSTEXP_OFFSET, \
+       FTM_PARAMS_NBURSTEXP_MASK, FTM_PARAMS_NBURSTEXP_SHIFT)
+#define FTM_PARAMS_SET_NBURSTEXP(_p, _bexp) FTM_PARAMS_SET_FIELD(_p, \
+       FTM_PARAMS_NBURSTEXP_OFFSET, FTM_PARAMS_NBURSTEXP_MASK, FTM_PARAMS_NBURSTEXP_SHIFT, \
+       _bexp)
+
+#define FTM_PARAMS_NBURST(_p) (1 << FTM_PARAMS_NBURSTEXP(_p))
+
+enum {
+       FTM_PARAMS_NBURSTEXP_NOPREF = 15
+};
+
+enum {
+       FTM_PARAMS_BURSTTMO_NOPREF = 15
+};
+
+#define FTM_PARAMS_BURSTTMO_OFFSET 1
+#define FTM_PARAMS_BURSTTMO_MASK 0xf0
+#define FTM_PARAMS_BURSTTMO_SHIFT 4
+#define FTM_PARAMS_BURSTTMO(_p) FTM_PARAMS_FIELD(_p, FTM_PARAMS_BURSTTMO_OFFSET, \
+       FTM_PARAMS_BURSTTMO_MASK, FTM_PARAMS_BURSTTMO_SHIFT)
+/* set timeout in params using _tmo where timeout = 2^(_tmo) * 250us */
+#define FTM_PARAMS_SET_BURSTTMO(_p, _tmo) FTM_PARAMS_SET_FIELD(_p, \
+       FTM_PARAMS_BURSTTMO_OFFSET, FTM_PARAMS_BURSTTMO_MASK, FTM_PARAMS_BURSTTMO_SHIFT, (_tmo)+2)
+
+#define FTM_PARAMS_BURSTTMO_USEC(_val) ((1 << ((_val)-2)) * 250)
+#define FTM_PARAMS_BURSTTMO_VALID(_val) ((((_val) < 12 && (_val) > 1)) || \
+       (_val) == FTM_PARAMS_BURSTTMO_NOPREF)
+#define FTM_PARAMS_BURSTTMO_MAX_MSEC 128 /* 2^9 * 250us */
+#define FTM_PARAMS_BURSTTMO_MAX_USEC 128000 /* 2^9 * 250us */
+
+#define FTM_PARAMS_MINDELTA_OFFSET 2
+#define FTM_PARAMS_MINDELTA_USEC(_p) ((_p)->info[FTM_PARAMS_MINDELTA_OFFSET] * 100)
+#define FTM_PARAMS_SET_MINDELTA_USEC(_p, _delta) do { \
+       (_p)->info[FTM_PARAMS_MINDELTA_OFFSET] = (_delta) / 100; \
+} while (0)
+
+enum {
+       FTM_PARAMS_MINDELTA_NOPREF = 0
+};
+
+#define FTM_PARAMS_PARTIAL_TSF(_p) ((_p)->info[4] << 8 | (_p)->info[3])
+#define FTM_PARAMS_SET_PARTIAL_TSF(_p, _partial_tsf) do { \
+       (_p)->info[3] = (_partial_tsf) & 0xff; \
+       (_p)->info[4] = ((_partial_tsf) >> 8) & 0xff; \
+} while (0)
+
+#define FTM_PARAMS_PARTIAL_TSF_MASK 0x0000000003fffc00ULL
+#define FTM_PARAMS_PARTIAL_TSF_SHIFT 10
+#define FTM_PARAMS_PARTIAL_TSF_BIT_LEN 16
+#define FTM_PARAMS_PARTIAL_TSF_MAX 0xffff
+
+/* FTM can indicate upto 62k TUs forward and 1k TU backward */
+#define FTM_PARAMS_TSF_FW_HI (63487 << 10)     /* in micro sec */
+#define FTM_PARAMS_TSF_BW_LOW (64512 << 10)    /* in micro sec */
+#define FTM_PARAMS_TSF_BW_HI (65535 << 10)     /* in micro sec */
+#define FTM_PARAMS_TSF_FW_MAX FTM_PARAMS_TSF_FW_HI
+#define FTM_PARAMS_TSF_BW_MAX (FTM_PARAMS_TSF_BW_HI - FTM_PARAMS_TSF_BW_LOW)
+
+#define FTM_PARAMS_PTSFNOPREF_OFFSET 5
+#define FTM_PARAMS_PTSFNOPREF_MASK 0x1
+#define FTM_PARAMS_PTSFNOPREF_SHIFT 0
+#define FTM_PARAMS_PTSFNOPREF(_p) FTM_PARAMS_FIELD(_p, FTM_PARAMS_PTSFNOPREF_OFFSET, \
+       FTM_PARAMS_PTSFNOPREF_MASK, FTM_PARAMS_PTSFNOPREF_SHIFT)
+#define FTM_PARAMS_SET_PTSFNOPREF(_p, _nopref) FTM_PARAMS_SET_FIELD(_p, \
+       FTM_PARAMS_PTSFNOPREF_OFFSET, FTM_PARAMS_PTSFNOPREF_MASK, \
+       FTM_PARAMS_PTSFNOPREF_SHIFT, _nopref)
+
+#define FTM_PARAMS_ASAP_OFFSET 5
+#define FTM_PARAMS_ASAP_MASK 0x4
+#define FTM_PARAMS_ASAP_SHIFT 2
+#define FTM_PARAMS_ASAP(_p) FTM_PARAMS_FIELD(_p, FTM_PARAMS_ASAP_OFFSET, \
+       FTM_PARAMS_ASAP_MASK, FTM_PARAMS_ASAP_SHIFT)
+#define FTM_PARAMS_SET_ASAP(_p, _asap) FTM_PARAMS_SET_FIELD(_p, \
+       FTM_PARAMS_ASAP_OFFSET, FTM_PARAMS_ASAP_MASK, FTM_PARAMS_ASAP_SHIFT, _asap)
+
+/* FTM1 - AKA ASAP Capable */
+#define FTM_PARAMS_FTM1_OFFSET 5
+#define FTM_PARAMS_FTM1_MASK 0x02
+#define FTM_PARAMS_FTM1_SHIFT 1
+#define FTM_PARAMS_FTM1(_p) FTM_PARAMS_FIELD(_p, FTM_PARAMS_FTM1_OFFSET, \
+       FTM_PARAMS_FTM1_MASK, FTM_PARAMS_FTM1_SHIFT)
+#define FTM_PARAMS_SET_FTM1(_p, _ftm1) FTM_PARAMS_SET_FIELD(_p, \
+       FTM_PARAMS_FTM1_OFFSET, FTM_PARAMS_FTM1_MASK, FTM_PARAMS_FTM1_SHIFT, _ftm1)
+
+#define FTM_PARAMS_FTMS_PER_BURST_OFFSET 5
+#define FTM_PARAMS_FTMS_PER_BURST_MASK 0xf8
+#define FTM_PARAMS_FTMS_PER_BURST_SHIFT 3
+#define FTM_PARAMS_FTMS_PER_BURST(_p) FTM_PARAMS_FIELD(_p, FTM_PARAMS_FTMS_PER_BURST_OFFSET, \
+       FTM_PARAMS_FTMS_PER_BURST_MASK, FTM_PARAMS_FTMS_PER_BURST_SHIFT)
+#define FTM_PARAMS_SET_FTMS_PER_BURST(_p, _nftms) FTM_PARAMS_SET_FIELD(_p, \
+       FTM_PARAMS_FTMS_PER_BURST_OFFSET, FTM_PARAMS_FTMS_PER_BURST_MASK, \
+       FTM_PARAMS_FTMS_PER_BURST_SHIFT, _nftms)
+
+enum {
+       FTM_PARAMS_FTMS_PER_BURST_NOPREF = 0
+};
+
+#define FTM_PARAMS_CHAN_INFO_OFFSET 6
+#define FTM_PARAMS_CHAN_INFO_MASK 0xfc
+#define FTM_PARAMS_CHAN_INFO_SHIFT 2
+#define FTM_PARAMS_CHAN_INFO(_p) FTM_PARAMS_FIELD(_p, FTM_PARAMS_CHAN_INFO_OFFSET, \
+       FTM_PARAMS_CHAN_INFO_MASK, FTM_PARAMS_CHAN_INFO_SHIFT)
+#define FTM_PARAMS_SET_CHAN_INFO(_p, _ci) FTM_PARAMS_SET_FIELD(_p, \
+       FTM_PARAMS_CHAN_INFO_OFFSET, FTM_PARAMS_CHAN_INFO_MASK, FTM_PARAMS_CHAN_INFO_SHIFT, _ci)
+
+/* burst period - units of 100ms */
+#define FTM_PARAMS_BURST_PERIOD(_p) (((_p)->info[8] << 8) | (_p)->info[7])
+#define FTM_PARAMS_SET_BURST_PERIOD(_p, _bp) do {\
+       (_p)->info[7] = (_bp) & 0xff; \
+       (_p)->info[8] = ((_bp) >> 8) & 0xff; \
+} while (0)
+
+#define FTM_PARAMS_BURST_PERIOD_MS(_p) (FTM_PARAMS_BURST_PERIOD(_p) * 100)
+
+enum {
+       FTM_PARAMS_BURST_PERIOD_NOPREF = 0
+};
+
+/* FTM status values - last updated from 11mcD4.0 */
+enum {
+       FTM_PARAMS_STATUS_RESERVED      = 0,
+       FTM_PARAMS_STATUS_SUCCESSFUL = 1,
+       FTM_PARAMS_STATUS_INCAPABLE = 2,
+       FTM_PARAMS_STATUS_FAILED = 3,
+       /* Below are obsolte */
+       FTM_PARAMS_STATUS_OVERRIDDEN = 4,
+       FTM_PARAMS_STATUS_ASAP_INCAPABLE = 5,
+       FTM_PARAMS_STATUS_ASAP_FAILED = 6,
+       /* rest are reserved */
+};
+
+enum {
+       FTM_PARAMS_CHAN_INFO_NO_PREF            = 0,
+       FTM_PARAMS_CHAN_INFO_RESERVE1           = 1,
+       FTM_PARAMS_CHAN_INFO_RESERVE2           = 2,
+       FTM_PARAMS_CHAN_INFO_RESERVE3           = 3,
+       FTM_PARAMS_CHAN_INFO_NON_HT_5           = 4,
+       FTM_PARAMS_CHAN_INFO_RESERVE5           = 5,
+       FTM_PARAMS_CHAN_INFO_NON_HT_10          = 6,
+       FTM_PARAMS_CHAN_INFO_RESERVE7           = 7,
+       FTM_PARAMS_CHAN_INFO_NON_HT_20          = 8, /* excludes 2.4G, and High rate DSSS */
+       FTM_PARAMS_CHAN_INFO_HT_MF_20           = 9,
+       FTM_PARAMS_CHAN_INFO_VHT_20             = 10,
+       FTM_PARAMS_CHAN_INFO_HT_MF_40           = 11,
+       FTM_PARAMS_CHAN_INFO_VHT_40             = 12,
+       FTM_PARAMS_CHAN_INFO_VHT_80             = 13,
+       FTM_PARAMS_CHAN_INFO_VHT_80_80          = 14,
+       FTM_PARAMS_CHAN_INFO_VHT_160_2_RFLOS    = 15,
+       FTM_PARAMS_CHAN_INFO_VHT_160            = 16,
+       /* Reserved from 17 - 30 */
+       FTM_PARAMS_CHAN_INFO_DMG_2160           = 31,
+       /* Reserved from 32 - 63 */
+       FTM_PARAMS_CHAN_INFO_MAX                = 63
+};
+
+/* tag_ID/length/value_buffer tuple */
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint8   id;
+       uint8   len;
+       uint8   data[1];
+} BWL_POST_PACKED_STRUCT ftm_vs_tlv_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_ftm_vs_ie {
+       uint8 id;                                               /* DOT11_MNG_VS_ID */
+       uint8 len;                                              /* length following */
+       uint8 oui[3];                                   /* BRCM_PROP_OUI (or Customer) */
+       uint8 sub_type;                                 /* BRCM_FTM_IE_TYPE (or Customer) */
+       uint8 version;
+       ftm_vs_tlv_t    tlvs[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ftm_vs_ie dot11_ftm_vs_ie_t;
+
+/* ftm vs api version */
+#define BCM_FTM_VS_PARAMS_VERSION 0x01
+
+/* ftm vendor specific information tlv types */
+enum {
+       FTM_VS_TLV_NONE = 0,
+       FTM_VS_TLV_REQ_PARAMS = 1,              /* additional request params (in FTM_REQ) */
+       FTM_VS_TLV_MEAS_INFO = 2,               /* measurement information (in FTM_MEAS) */
+       FTM_VS_TLV_SEC_PARAMS = 3,              /* security parameters (in either) */
+       FTM_VS_TLV_SEQ_PARAMS = 4,              /* toast parameters (FTM_REQ, BRCM proprietary) */
+       FTM_VS_TLV_MF_BUF = 5,                  /* multi frame buffer - may span ftm vs ie's */
+       /* add additional types above */
+};
+
+/* the following definitions are *DEPRECATED* and moved to implemenetion files. They
+ * are retained here because previous (May 2016) some branches use them
+ */
+#define FTM_TPK_LEN            16
+#define FTM_RI_RR_BUF_LEN      32
+#define FTM_TPK_RI_RR_LEN      13
+#define FTM_TPK_DIGEST_LEN     32
+#define FTM_TPK_BUFFER_LEN     128
+#define FTM_TPK_RI_PHY_LEN     7
+#define FTM_TPK_RR_PHY_LEN     7
+#define FTM_TPK_DATA_BUFFER_LEN 88
+
+BWL_PRE_PACKED_STRUCT struct dot11_ftm_vs_params {
+       uint8 id;                       /* DOT11_MNG_VS_ID */
+       uint8 len;
+       uint8 oui[3];                   /* Proprietary OUI, BRCM_PROP_OUI */
+       uint8 bcm_vs_id;
+       ftm_vs_tlv_t ftm_tpk_ri_rr[1];          /* ftm_TPK_ri_rr place holder */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ftm_vs_params dot11_ftm_vs_tpk_ri_rr_params_t;
+#define DOT11_FTM_VS_LEN  (sizeof(dot11_ftm_vs_tpk_ri_rr_params_t) - TLV_HDR_LEN)
+/* end *DEPRECATED* ftm definitions */
+
+BWL_PRE_PACKED_STRUCT struct dot11_ftm_sync_info {
+       uint8 id;               /* Extended - 255 11mc D4.3  */
+       uint8 len;
+       uint8 id_ext;
+       uint8 tsf_sync_info[4];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ftm_sync_info dot11_ftm_sync_info_t;
+
+/* ftm tsf sync info ie len - includes id ext */
+#define DOT11_FTM_SYNC_INFO_IE_LEN (sizeof(dot11_ftm_sync_info_t) - TLV_HDR_LEN)
+
+#define DOT11_FTM_IS_SYNC_INFO_IE(_ie) (\
+       DOT11_MNG_IE_ID_EXT_MATCH(_ie, DOT11_MNG_FTM_SYNC_INFO) && \
+       (_ie)->len == DOT11_FTM_SYNC_INFO_IE_LEN)
+
+/* 802.11u interworking access network options */
+#define IW_ANT_MASK                                    0x0f
+#define IW_INTERNET_MASK                               0x10
+#define IW_ASRA_MASK                                   0x20
+#define IW_ESR_MASK                                    0x40
+#define IW_UESA_MASK                                   0x80
+
+/* 802.11u interworking access network type */
+#define IW_ANT_PRIVATE_NETWORK                         0
+#define IW_ANT_PRIVATE_NETWORK_WITH_GUEST              1
+#define IW_ANT_CHARGEABLE_PUBLIC_NETWORK               2
+#define IW_ANT_FREE_PUBLIC_NETWORK                     3
+#define IW_ANT_PERSONAL_DEVICE_NETWORK                 4
+#define IW_ANT_EMERGENCY_SERVICES_NETWORK              5
+#define IW_ANT_TEST_NETWORK                            14
+#define IW_ANT_WILDCARD_NETWORK                                15
+
+#define IW_ANT_LEN                     1
+#define IW_VENUE_LEN                   2
+#define IW_HESSID_LEN                  6
+#define IW_HESSID_OFF                  (IW_ANT_LEN + IW_VENUE_LEN)
+#define IW_MAX_LEN                     (IW_ANT_LEN + IW_VENUE_LEN + IW_HESSID_LEN)
+
+/* 802.11u advertisement protocol */
+#define ADVP_ANQP_PROTOCOL_ID                          0
+#define ADVP_MIH_PROTOCOL_ID                           1
+
+/* 802.11u advertisement protocol masks */
+#define ADVP_QRL_MASK                                  0x7f
+#define ADVP_PAME_BI_MASK                              0x80
+
+/* 802.11u advertisement protocol values */
+#define ADVP_QRL_REQUEST                               0x00
+#define ADVP_QRL_RESPONSE                              0x7f
+#define ADVP_PAME_BI_DEPENDENT                         0x00
+#define ADVP_PAME_BI_INDEPENDENT                       ADVP_PAME_BI_MASK
+
+/* 802.11u ANQP information ID */
+#define ANQP_ID_QUERY_LIST                             256
+#define ANQP_ID_CAPABILITY_LIST                                257
+#define ANQP_ID_VENUE_NAME_INFO                                258
+#define ANQP_ID_EMERGENCY_CALL_NUMBER_INFO             259
+#define ANQP_ID_NETWORK_AUTHENTICATION_TYPE_INFO       260
+#define ANQP_ID_ROAMING_CONSORTIUM_LIST                        261
+#define ANQP_ID_IP_ADDRESS_TYPE_AVAILABILITY_INFO      262
+#define ANQP_ID_NAI_REALM_LIST                         263
+#define ANQP_ID_G3PP_CELLULAR_NETWORK_INFO             264
+#define ANQP_ID_AP_GEOSPATIAL_LOCATION                 265
+#define ANQP_ID_AP_CIVIC_LOCATION                      266
+#define ANQP_ID_AP_LOCATION_PUBLIC_ID_URI              267
+#define ANQP_ID_DOMAIN_NAME_LIST                       268
+#define ANQP_ID_EMERGENCY_ALERT_ID_URI                 269
+#define ANQP_ID_EMERGENCY_NAI                          271
+#define ANQP_ID_VENDOR_SPECIFIC_LIST                   56797
+
+/* 802.11u ANQP OUI */
+#define ANQP_OUI_SUBTYPE                               9
+
+/* 802.11u venue name */
+#define VENUE_LANGUAGE_CODE_SIZE                       3
+#define VENUE_NAME_SIZE                                        255
+
+/* 802.11u venue groups */
+#define VENUE_UNSPECIFIED                              0
+#define VENUE_ASSEMBLY                                 1
+#define VENUE_BUSINESS                                 2
+#define VENUE_EDUCATIONAL                              3
+#define VENUE_FACTORY                                  4
+#define VENUE_INSTITUTIONAL                            5
+#define VENUE_MERCANTILE                               6
+#define VENUE_RESIDENTIAL                              7
+#define VENUE_STORAGE                                  8
+#define VENUE_UTILITY                                  9
+#define VENUE_VEHICULAR                                        10
+#define VENUE_OUTDOOR                                  11
+
+/* 802.11u network authentication type indicator */
+#define NATI_UNSPECIFIED                               -1
+#define NATI_ACCEPTANCE_OF_TERMS_CONDITIONS            0
+#define NATI_ONLINE_ENROLLMENT_SUPPORTED               1
+#define NATI_HTTP_HTTPS_REDIRECTION                    2
+#define NATI_DNS_REDIRECTION                           3
+
+/* 802.11u IP address type availability - IPv6 */
+#define IPA_IPV6_SHIFT                                 0
+#define IPA_IPV6_MASK                                  (0x03 << IPA_IPV6_SHIFT)
+#define        IPA_IPV6_NOT_AVAILABLE                          0x00
+#define IPA_IPV6_AVAILABLE                             0x01
+#define IPA_IPV6_UNKNOWN_AVAILABILITY                  0x02
+
+/* 802.11u IP address type availability - IPv4 */
+#define IPA_IPV4_SHIFT                                 2
+#define IPA_IPV4_MASK                                  (0x3f << IPA_IPV4_SHIFT)
+#define        IPA_IPV4_NOT_AVAILABLE                          0x00
+#define IPA_IPV4_PUBLIC                                        0x01
+#define IPA_IPV4_PORT_RESTRICT                         0x02
+#define IPA_IPV4_SINGLE_NAT                            0x03
+#define IPA_IPV4_DOUBLE_NAT                            0x04
+#define IPA_IPV4_PORT_RESTRICT_SINGLE_NAT              0x05
+#define IPA_IPV4_PORT_RESTRICT_DOUBLE_NAT              0x06
+#define IPA_IPV4_UNKNOWN_AVAILABILITY                  0x07
+
+/* 802.11u NAI realm encoding */
+#define REALM_ENCODING_RFC4282                         0
+#define REALM_ENCODING_UTF8                            1
+
+/* 802.11u IANA EAP method type numbers */
+#define REALM_EAP_TLS                                  13
+#define REALM_EAP_LEAP                                 17
+#define REALM_EAP_SIM                                  18
+#define REALM_EAP_TTLS                                 21
+#define REALM_EAP_AKA                                  23
+#define REALM_EAP_PEAP                                 25
+#define REALM_EAP_FAST                                 43
+#define REALM_EAP_PSK                                  47
+#define REALM_EAP_AKAP                                 50
+#define REALM_EAP_EXPANDED                             254
+
+/* 802.11u authentication ID */
+#define REALM_EXPANDED_EAP                             1
+#define REALM_NON_EAP_INNER_AUTHENTICATION             2
+#define REALM_INNER_AUTHENTICATION_EAP                 3
+#define REALM_EXPANDED_INNER_EAP                       4
+#define REALM_CREDENTIAL                               5
+#define REALM_TUNNELED_EAP_CREDENTIAL                  6
+#define REALM_VENDOR_SPECIFIC_EAP                      221
+
+/* 802.11u non-EAP inner authentication type */
+#define REALM_RESERVED_AUTH                            0
+#define REALM_PAP                                      1
+#define REALM_CHAP                                     2
+#define REALM_MSCHAP                                   3
+#define REALM_MSCHAPV2                                 4
+
+/* 802.11u credential type */
+#define REALM_SIM                                      1
+#define REALM_USIM                                     2
+#define REALM_NFC                                      3
+#define REALM_HARDWARE_TOKEN                           4
+#define REALM_SOFTOKEN                                 5
+#define REALM_CERTIFICATE                              6
+#define REALM_USERNAME_PASSWORD                                7
+#define REALM_SERVER_SIDE                              8
+#define REALM_RESERVED_CRED                            9
+#define REALM_VENDOR_SPECIFIC_CRED                     10
+
+/* 802.11u 3GPP PLMN */
+#define G3PP_GUD_VERSION                               0
+#define G3PP_PLMN_LIST_IE                              0
+
+/** hotspot2.0 indication element (vendor specific) */
+BWL_PRE_PACKED_STRUCT struct hs20_ie {
+       uint8 oui[3];
+       uint8 type;
+       uint8 config;
+} BWL_POST_PACKED_STRUCT;
+typedef struct hs20_ie hs20_ie_t;
+#define HS20_IE_LEN 5  /* HS20 IE length */
+
+/** IEEE 802.11 Annex E */
+typedef enum {
+       DOT11_2GHZ_20MHZ_CLASS_12       = 81,   /* Ch 1-11 */
+       DOT11_5GHZ_20MHZ_CLASS_1        = 115,  /* Ch 36-48 */
+       DOT11_5GHZ_20MHZ_CLASS_2_DFS    = 118,  /* Ch 52-64 */
+       DOT11_5GHZ_20MHZ_CLASS_3        = 124,  /* Ch 149-161 */
+       DOT11_5GHZ_20MHZ_CLASS_4_DFS    = 121,  /* Ch 100-140 */
+       DOT11_5GHZ_20MHZ_CLASS_5        = 125,  /* Ch 149-165 */
+       DOT11_5GHZ_40MHZ_CLASS_22       = 116,  /* Ch 36-44,   lower */
+       DOT11_5GHZ_40MHZ_CLASS_23_DFS   = 119,  /* Ch 52-60,   lower */
+       DOT11_5GHZ_40MHZ_CLASS_24_DFS   = 122,  /* Ch 100-132, lower */
+       DOT11_5GHZ_40MHZ_CLASS_25       = 126,  /* Ch 149-157, lower */
+       DOT11_5GHZ_40MHZ_CLASS_27       = 117,  /* Ch 40-48,   upper */
+       DOT11_5GHZ_40MHZ_CLASS_28_DFS   = 120,  /* Ch 56-64,   upper */
+       DOT11_5GHZ_40MHZ_CLASS_29_DFS   = 123,  /* Ch 104-136, upper */
+       DOT11_5GHZ_40MHZ_CLASS_30       = 127,  /* Ch 153-161, upper */
+       DOT11_2GHZ_40MHZ_CLASS_32       = 83,   /* Ch 1-7,     lower */
+       DOT11_2GHZ_40MHZ_CLASS_33       = 84,   /* Ch 5-11,    upper */
+} dot11_op_class_t;
+
+/* QoS map */
+#define QOS_MAP_FIXED_LENGTH   (8 * 2) /* DSCP ranges fixed with 8 entries */
+
+#define BCM_AIBSS_IE_TYPE 56
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _802_11_H_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/proto/802.11_bta.h b/drivers/net/wireless/bcmdhd_1363/include/proto/802.11_bta.h
new file mode 100644 (file)
index 0000000..981acd8
--- /dev/null
@@ -0,0 +1,48 @@
+/*
+ * BT-AMP (BlueTooth Alternate Mac and Phy) 802.11 PAL (Protocol Adaptation Layer)
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: 802.11_bta.h 518342 2014-12-01 23:21:41Z $
+*/
+
+#ifndef _802_11_BTA_H_
+#define _802_11_BTA_H_
+
+#define BT_SIG_SNAP_MPROT              "\xAA\xAA\x03\x00\x19\x58"
+
+/* BT-AMP 802.11 PAL Protocols */
+#define BTA_PROT_L2CAP                         1
+#define        BTA_PROT_ACTIVITY_REPORT                2
+#define BTA_PROT_SECURITY                      3
+#define BTA_PROT_LINK_SUPERVISION_REQUEST      4
+#define BTA_PROT_LINK_SUPERVISION_REPLY                5
+
+/* BT-AMP 802.11 PAL AMP_ASSOC Type IDs */
+#define BTA_TYPE_ID_MAC_ADDRESS                        1
+#define BTA_TYPE_ID_PREFERRED_CHANNELS         2
+#define BTA_TYPE_ID_CONNECTED_CHANNELS         3
+#define BTA_TYPE_ID_CAPABILITIES               4
+#define BTA_TYPE_ID_VERSION                    5
+#endif /* _802_11_bta_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/proto/802.11e.h b/drivers/net/wireless/bcmdhd_1363/include/proto/802.11e.h
new file mode 100644 (file)
index 0000000..c0ad8e4
--- /dev/null
@@ -0,0 +1,134 @@
+/*
+ * 802.11e protocol header file
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: 802.11e.h 572688 2015-07-20 17:49:21Z $
+ */
+
+#ifndef _802_11e_H_
+#define _802_11e_H_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+/* WME Traffic Specification (TSPEC) element */
+#define WME_TSPEC_HDR_LEN           2           /* WME TSPEC header length */
+#define WME_TSPEC_BODY_OFF          2           /* WME TSPEC body offset */
+
+#define WME_CATEGORY_CODE_OFFSET       0               /* WME Category code offset */
+#define WME_ACTION_CODE_OFFSET         1               /* WME Action code offset */
+#define WME_TOKEN_CODE_OFFSET          2               /* WME Token code offset */
+#define WME_STATUS_CODE_OFFSET         3               /* WME Status code offset */
+
+BWL_PRE_PACKED_STRUCT struct tsinfo {
+       uint8 octets[3];
+} BWL_POST_PACKED_STRUCT;
+
+typedef struct tsinfo tsinfo_t;
+
+/* 802.11e TSPEC IE */
+typedef BWL_PRE_PACKED_STRUCT struct tspec {
+       uint8 oui[DOT11_OUI_LEN];       /* WME_OUI */
+       uint8 type;                                     /* WME_TYPE */
+       uint8 subtype;                          /* WME_SUBTYPE_TSPEC */
+       uint8 version;                          /* WME_VERSION */
+       tsinfo_t tsinfo;                        /* TS Info bit field */
+       uint16 nom_msdu_size;           /* (Nominal or fixed) MSDU Size (bytes) */
+       uint16 max_msdu_size;           /* Maximum MSDU Size (bytes) */
+       uint32 min_srv_interval;        /* Minimum Service Interval (us) */
+       uint32 max_srv_interval;        /* Maximum Service Interval (us) */
+       uint32 inactivity_interval;     /* Inactivity Interval (us) */
+       uint32 suspension_interval; /* Suspension Interval (us) */
+       uint32 srv_start_time;          /* Service Start Time (us) */
+       uint32 min_data_rate;           /* Minimum Data Rate (bps) */
+       uint32 mean_data_rate;          /* Mean Data Rate (bps) */
+       uint32 peak_data_rate;          /* Peak Data Rate (bps) */
+       uint32 max_burst_size;          /* Maximum Burst Size (bytes) */
+       uint32 delay_bound;                     /* Delay Bound (us) */
+       uint32 min_phy_rate;            /* Minimum PHY Rate (bps) */
+       uint16 surplus_bw;                      /* Surplus Bandwidth Allowance (range 1.0-8.0) */
+       uint16 medium_time;                     /* Medium Time (32 us/s periods) */
+} BWL_POST_PACKED_STRUCT tspec_t;
+
+#define WME_TSPEC_LEN  (sizeof(tspec_t))               /* not including 2-bytes of header */
+
+/* ts_info */
+/* 802.1D priority is duplicated - bits 13-11 AND bits 3-1 */
+#define TS_INFO_TID_SHIFT              1       /* TS info. TID shift */
+#define TS_INFO_TID_MASK               (0xf << TS_INFO_TID_SHIFT)      /* TS info. TID mask */
+#define TS_INFO_CONTENTION_SHIFT       7       /* TS info. contention shift */
+#define TS_INFO_CONTENTION_MASK        (0x1 << TS_INFO_CONTENTION_SHIFT) /* TS info. contention mask */
+#define TS_INFO_DIRECTION_SHIFT        5       /* TS info. direction shift */
+#define TS_INFO_DIRECTION_MASK (0x3 << TS_INFO_DIRECTION_SHIFT) /* TS info. direction mask */
+#define TS_INFO_PSB_SHIFT              2               /* TS info. PSB bit Shift */
+#define TS_INFO_PSB_MASK               (1 << TS_INFO_PSB_SHIFT)        /* TS info. PSB mask */
+#define TS_INFO_UPLINK                 (0 << TS_INFO_DIRECTION_SHIFT)  /* TS info. uplink */
+#define TS_INFO_DOWNLINK               (1 << TS_INFO_DIRECTION_SHIFT)  /* TS info. downlink */
+#define TS_INFO_BIDIRECTIONAL  (3 << TS_INFO_DIRECTION_SHIFT)  /* TS info. bidirectional */
+#define TS_INFO_USER_PRIO_SHIFT        3       /* TS info. user priority shift */
+/* TS info. user priority mask */
+#define TS_INFO_USER_PRIO_MASK (0x7 << TS_INFO_USER_PRIO_SHIFT)
+
+/* Macro to get/set bit(s) field in TSINFO */
+#define WLC_CAC_GET_TID(pt)    ((((pt).octets[0]) & TS_INFO_TID_MASK) >> TS_INFO_TID_SHIFT)
+#define WLC_CAC_GET_DIR(pt)    ((((pt).octets[0]) & \
+       TS_INFO_DIRECTION_MASK) >> TS_INFO_DIRECTION_SHIFT)
+#define WLC_CAC_GET_PSB(pt)    ((((pt).octets[1]) & TS_INFO_PSB_MASK) >> TS_INFO_PSB_SHIFT)
+#define WLC_CAC_GET_USER_PRIO(pt)      ((((pt).octets[1]) & \
+       TS_INFO_USER_PRIO_MASK) >> TS_INFO_USER_PRIO_SHIFT)
+
+#define WLC_CAC_SET_TID(pt, id)        ((((pt).octets[0]) & (~TS_INFO_TID_MASK)) | \
+       ((id) << TS_INFO_TID_SHIFT))
+#define WLC_CAC_SET_USER_PRIO(pt, prio)        ((((pt).octets[0]) & (~TS_INFO_USER_PRIO_MASK)) | \
+       ((prio) << TS_INFO_USER_PRIO_SHIFT))
+
+/* 802.11e QBSS Load IE */
+#define QBSS_LOAD_IE_LEN               5       /* QBSS Load IE length */
+#define QBSS_LOAD_AAC_OFF              3       /* AAC offset in IE */
+
+#define CAC_ADDTS_RESP_TIMEOUT         1000    /* default ADDTS response timeout in ms */
+                                               /* DEFVAL dot11ADDTSResponseTimeout = 1s */
+
+/* 802.11e ADDTS status code */
+#define DOT11E_STATUS_ADMISSION_ACCEPTED       0       /* TSPEC Admission accepted status */
+#define DOT11E_STATUS_ADDTS_INVALID_PARAM      1       /* TSPEC invalid parameter status */
+#define DOT11E_STATUS_ADDTS_REFUSED_NSBW       3       /* ADDTS refused (non-sufficient BW) */
+#define DOT11E_STATUS_ADDTS_REFUSED_AWHILE     47      /* ADDTS refused but could retry later */
+
+/* 802.11e DELTS status code */
+#define DOT11E_STATUS_QSTA_LEAVE_QBSS          36      /* STA leave QBSS */
+#define DOT11E_STATUS_END_TS                           37      /* END TS */
+#define DOT11E_STATUS_UNKNOWN_TS                       38      /* UNKNOWN TS */
+#define DOT11E_STATUS_QSTA_REQ_TIMEOUT         39      /* STA ADDTS request timeout */
+
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _802_11e_CAC_H_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/proto/802.1d.h b/drivers/net/wireless/bcmdhd_1363/include/proto/802.1d.h
new file mode 100644 (file)
index 0000000..85fd7e4
--- /dev/null
@@ -0,0 +1,53 @@
+/*
+ * Fundamental types and constants relating to 802.1D
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: 802.1d.h 518342 2014-12-01 23:21:41Z $
+ */
+
+#ifndef _802_1_D_
+#define _802_1_D_
+
+/* 802.1D priority defines */
+#define        PRIO_8021D_NONE         2       /* None = - */
+#define        PRIO_8021D_BK           1       /* BK - Background */
+#define        PRIO_8021D_BE           0       /* BE - Best-effort */
+#define        PRIO_8021D_EE           3       /* EE - Excellent-effort */
+#define        PRIO_8021D_CL           4       /* CL - Controlled Load */
+#define        PRIO_8021D_VI           5       /* Vi - Video */
+#define        PRIO_8021D_VO           6       /* Vo - Voice */
+#define        PRIO_8021D_NC           7       /* NC - Network Control */
+#define        MAXPRIO                 7       /* 0-7 */
+#define NUMPRIO                        (MAXPRIO + 1)
+
+#define ALLPRIO                -1      /* All prioirty */
+
+/* Converts prio to precedence since the numerical value of
+ * PRIO_8021D_BE and PRIO_8021D_NONE are swapped.
+ */
+#define PRIO2PREC(prio) \
+       (((prio) == PRIO_8021D_NONE || (prio) == PRIO_8021D_BE) ? ((prio^2)) : (prio))
+
+#endif /* _802_1_D__ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/proto/802.3.h b/drivers/net/wireless/bcmdhd_1363/include/proto/802.3.h
new file mode 100644 (file)
index 0000000..d834cb7
--- /dev/null
@@ -0,0 +1,55 @@
+/*
+ * Fundamental constants relating to 802.3
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: 802.3.h 518342 2014-12-01 23:21:41Z $
+ */
+
+#ifndef _802_3_h_
+#define _802_3_h_
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+#define SNAP_HDR_LEN   6       /* 802.3 SNAP header length */
+#define DOT3_OUI_LEN   3       /* 802.3 oui length */
+
+BWL_PRE_PACKED_STRUCT struct dot3_mac_llc_snap_header {
+       uint8   ether_dhost[ETHER_ADDR_LEN];    /* dest mac */
+       uint8   ether_shost[ETHER_ADDR_LEN];    /* src mac */
+       uint16  length;                         /* frame length incl header */
+       uint8   dsap;                           /* always 0xAA */
+       uint8   ssap;                           /* always 0xAA */
+       uint8   ctl;                            /* always 0x03 */
+       uint8   oui[DOT3_OUI_LEN];              /* RFC1042: 0x00 0x00 0x00
+                                                * Bridge-Tunnel: 0x00 0x00 0xF8
+                                                */
+       uint16  type;                           /* ethertype */
+} BWL_POST_PACKED_STRUCT;
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* #ifndef _802_3_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/proto/bcmdhcp.h b/drivers/net/wireless/bcmdhd_1363/include/proto/bcmdhcp.h
new file mode 100644 (file)
index 0000000..90d3c01
--- /dev/null
@@ -0,0 +1,92 @@
+/*
+ * Fundamental constants relating to DHCP Protocol
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmdhcp.h 597933 2015-11-06 18:52:06Z $
+ */
+
+#ifndef _bcmdhcp_h_
+#define _bcmdhcp_h_
+
+/* DHCP params */
+#define DHCP_TYPE_OFFSET       0       /* DHCP type (request|reply) offset */
+#define DHCP_TID_OFFSET                4       /* DHCP transition id offset */
+#define DHCP_FLAGS_OFFSET      10      /* DHCP flags offset */
+#define DHCP_CIADDR_OFFSET     12      /* DHCP client IP address offset */
+#define DHCP_YIADDR_OFFSET     16      /* DHCP your IP address offset */
+#define DHCP_GIADDR_OFFSET     24      /* DHCP relay agent IP address offset */
+#define DHCP_CHADDR_OFFSET     28      /* DHCP client h/w address offset */
+#define DHCP_OPT_OFFSET                236     /* DHCP options offset */
+
+#define DHCP_OPT_MSGTYPE       53      /* DHCP message type */
+#define DHCP_OPT_MSGTYPE_REQ   3
+#define DHCP_OPT_MSGTYPE_ACK   5       /* DHCP message type - ACK */
+
+#define DHCP_OPT_CODE_OFFSET   0       /* Option identifier */
+#define DHCP_OPT_LEN_OFFSET    1       /* Option data length */
+#define DHCP_OPT_DATA_OFFSET   2       /* Option data */
+
+#define DHCP_OPT_CODE_CLIENTID 61      /* Option identifier */
+
+#define DHCP_TYPE_REQUEST      1       /* DHCP request (discover|request) */
+#define DHCP_TYPE_REPLY                2       /* DHCP reply (offset|ack) */
+
+#define DHCP_PORT_SERVER       67      /* DHCP server UDP port */
+#define DHCP_PORT_CLIENT       68      /* DHCP client UDP port */
+
+#define DHCP_FLAG_BCAST        0x8000  /* DHCP broadcast flag */
+
+#define DHCP_FLAGS_LEN 2       /* DHCP flags field length */
+
+#define DHCP6_TYPE_SOLICIT     1       /* DHCP6 solicit */
+#define DHCP6_TYPE_ADVERTISE   2       /* DHCP6 advertise */
+#define DHCP6_TYPE_REQUEST     3       /* DHCP6 request */
+#define DHCP6_TYPE_CONFIRM     4       /* DHCP6 confirm */
+#define DHCP6_TYPE_RENEW       5       /* DHCP6 renew */
+#define DHCP6_TYPE_REBIND      6       /* DHCP6 rebind */
+#define DHCP6_TYPE_REPLY       7       /* DHCP6 reply */
+#define DHCP6_TYPE_RELEASE     8       /* DHCP6 release */
+#define DHCP6_TYPE_DECLINE     9       /* DHCP6 decline */
+#define DHCP6_TYPE_RECONFIGURE 10      /* DHCP6 reconfigure */
+#define DHCP6_TYPE_INFOREQ     11      /* DHCP6 information request */
+#define DHCP6_TYPE_RELAYFWD    12      /* DHCP6 relay forward */
+#define DHCP6_TYPE_RELAYREPLY  13      /* DHCP6 relay reply */
+
+#define DHCP6_TYPE_OFFSET      0       /* DHCP6 type offset */
+
+#define        DHCP6_MSG_OPT_OFFSET    4       /* Offset of options in client server messages */
+#define        DHCP6_RELAY_OPT_OFFSET  34      /* Offset of options in relay messages */
+
+#define        DHCP6_OPT_CODE_OFFSET   0       /* Option identifier */
+#define        DHCP6_OPT_LEN_OFFSET    2       /* Option data length */
+#define        DHCP6_OPT_DATA_OFFSET   4       /* Option data */
+
+#define        DHCP6_OPT_CODE_CLIENTID 1       /* DHCP6 CLIENTID option */
+#define        DHCP6_OPT_CODE_SERVERID 2       /* DHCP6 SERVERID option */
+
+#define DHCP6_PORT_SERVER      547     /* DHCP6 server UDP port */
+#define DHCP6_PORT_CLIENT      546     /* DHCP6 client UDP port */
+
+#endif /* #ifndef _bcmdhcp_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/proto/bcmeth.h b/drivers/net/wireless/bcmdhd_1363/include/proto/bcmeth.h
new file mode 100644 (file)
index 0000000..97f8935
--- /dev/null
@@ -0,0 +1,116 @@
+/*
+ * Broadcom Ethernettype  protocol definitions
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmeth.h 565501 2015-06-22 14:29:02Z $
+ */
+
+/*
+ * Broadcom Ethernet protocol defines
+ */
+
+#ifndef _BCMETH_H_
+#define _BCMETH_H_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+/* ETHER_TYPE_BRCM is defined in ethernet.h */
+
+/*
+ * Following the 2byte BRCM ether_type is a 16bit BRCM subtype field
+ * in one of two formats: (only subtypes 32768-65535 are in use now)
+ *
+ * subtypes 0-32767:
+ *     8 bit subtype (0-127)
+ *     8 bit length in bytes (0-255)
+ *
+ * subtypes 32768-65535:
+ *     16 bit big-endian subtype
+ *     16 bit big-endian length in bytes (0-65535)
+ *
+ * length is the number of additional bytes beyond the 4 or 6 byte header
+ *
+ * Reserved values:
+ * 0 reserved
+ * 5-15 reserved for iLine protocol assignments
+ * 17-126 reserved, assignable
+ * 127 reserved
+ * 32768 reserved
+ * 32769-65534 reserved, assignable
+ * 65535 reserved
+ */
+
+/*
+ * While adding the subtypes and their specific processing code make sure
+ * bcmeth_bcm_hdr_t is the first data structure in the user specific data structure definition
+ */
+
+#define        BCMILCP_SUBTYPE_RATE            1
+#define        BCMILCP_SUBTYPE_LINK            2
+#define        BCMILCP_SUBTYPE_CSA             3
+#define        BCMILCP_SUBTYPE_LARQ            4
+#define BCMILCP_SUBTYPE_VENDOR         5
+#define        BCMILCP_SUBTYPE_FLH             17
+
+#define BCMILCP_SUBTYPE_VENDOR_LONG    32769
+#define BCMILCP_SUBTYPE_CERT           32770
+#define BCMILCP_SUBTYPE_SES            32771
+
+
+#define BCMILCP_BCM_SUBTYPE_RESERVED           0
+#define BCMILCP_BCM_SUBTYPE_EVENT              1
+#define BCMILCP_BCM_SUBTYPE_SES                        2
+/*
+ * The EAPOL type is not used anymore. Instead EAPOL messages are now embedded
+ * within BCMILCP_BCM_SUBTYPE_EVENT type messages
+ */
+/* #define BCMILCP_BCM_SUBTYPE_EAPOL           3 */
+#define BCMILCP_BCM_SUBTYPE_DPT                 4
+#define BCMILCP_BCM_SUBTYPE_DNGLEVENT       5
+
+#define BCMILCP_BCM_SUBTYPEHDR_MINLENGTH       8
+#define BCMILCP_BCM_SUBTYPEHDR_VERSION         0
+
+/* These fields are stored in network order */
+typedef BWL_PRE_PACKED_STRUCT struct bcmeth_hdr
+{
+       uint16  subtype;        /* Vendor specific..32769 */
+       uint16  length;
+       uint8   version;        /* Version is 0 */
+       uint8   oui[3];         /* Broadcom OUI */
+       /* user specific Data */
+       uint16  usr_subtype;
+} BWL_POST_PACKED_STRUCT bcmeth_hdr_t;
+
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /*  _BCMETH_H_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/proto/bcmevent.h b/drivers/net/wireless/bcmdhd_1363/include/proto/bcmevent.h
new file mode 100644 (file)
index 0000000..426ee5d
--- /dev/null
@@ -0,0 +1,842 @@
+/*
+ * Broadcom Event  protocol definitions
+ *
+ * Dependencies: proto/bcmeth.h
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmevent.h 660193 2016-09-19 12:56:55Z $
+ *
+ */
+
+/*
+ * Broadcom Ethernet Events protocol defines
+ *
+ */
+
+#ifndef _BCMEVENT_H_
+#define _BCMEVENT_H_
+
+#include <typedefs.h>
+/* #include <ethernet.h> -- TODO: req., excluded to overwhelming coupling (break up ethernet.h) */
+#include <proto/bcmeth.h>
+#if defined(HEALTH_CHECK) || defined(DNGL_EVENT_SUPPORT)
+#include <proto/dnglevent.h>
+#endif /* HEALTH_CHECK || DNGL_EVENT_SUPPORT */
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+#define BCM_EVENT_MSG_VERSION          2       /* wl_event_msg_t struct version */
+#define BCM_MSG_IFNAME_MAX             16      /* max length of interface name */
+
+/* flags */
+#define WLC_EVENT_MSG_LINK             0x01    /* link is up */
+#define WLC_EVENT_MSG_FLUSHTXQ         0x02    /* flush tx queue on MIC error */
+#define WLC_EVENT_MSG_GROUP            0x04    /* group MIC error */
+#define WLC_EVENT_MSG_UNKBSS           0x08    /* unknown source bsscfg */
+#define WLC_EVENT_MSG_UNKIF            0x10    /* unknown source OS i/f */
+
+/* these fields are stored in network order */
+
+/* version 1 */
+typedef BWL_PRE_PACKED_STRUCT struct
+{
+       uint16  version;
+       uint16  flags;                  /* see flags below */
+       uint32  event_type;             /* Message (see below) */
+       uint32  status;                 /* Status code (see below) */
+       uint32  reason;                 /* Reason code (if applicable) */
+       uint32  auth_type;              /* WLC_E_AUTH */
+       uint32  datalen;                /* data buf */
+       struct ether_addr       addr;   /* Station address (if applicable) */
+       char    ifname[BCM_MSG_IFNAME_MAX]; /* name of the packet incoming interface */
+} BWL_POST_PACKED_STRUCT wl_event_msg_v1_t;
+
+/* the current version */
+typedef BWL_PRE_PACKED_STRUCT struct
+{
+       uint16  version;
+       uint16  flags;                  /* see flags below */
+       uint32  event_type;             /* Message (see below) */
+       uint32  status;                 /* Status code (see below) */
+       uint32  reason;                 /* Reason code (if applicable) */
+       uint32  auth_type;              /* WLC_E_AUTH */
+       uint32  datalen;                /* data buf */
+       struct ether_addr       addr;   /* Station address (if applicable) */
+       char    ifname[BCM_MSG_IFNAME_MAX]; /* name of the packet incoming interface */
+       uint8   ifidx;                  /* destination OS i/f index */
+       uint8   bsscfgidx;              /* source bsscfg index */
+} BWL_POST_PACKED_STRUCT wl_event_msg_t;
+
+/* used by driver msgs */
+typedef BWL_PRE_PACKED_STRUCT struct bcm_event {
+       struct ether_header eth;
+       bcmeth_hdr_t            bcm_hdr;
+       wl_event_msg_t          event;
+       /* data portion follows */
+} BWL_POST_PACKED_STRUCT bcm_event_t;
+
+/*
+ * used by host event
+ * note: if additional event types are added, it should go with is_wlc_event_frame() as well.
+ */
+typedef union bcm_event_msg_u {
+       wl_event_msg_t          event;
+#if defined(HEALTH_CHECK) || defined(DNGL_EVENT_SUPPORT)
+       bcm_dngl_event_msg_t    dngl_event;
+#endif /* HEALTH_CHECK || DNGL_EVENT_SUPPORT */
+
+       /* add new event here */
+} bcm_event_msg_u_t;
+
+#define BCM_MSG_LEN    (sizeof(bcm_event_t) - sizeof(bcmeth_hdr_t) - sizeof(struct ether_header))
+
+/* Event messages */
+#define WLC_E_SET_SSID         0       /* indicates status of set SSID */
+#define WLC_E_JOIN             1       /* differentiates join IBSS from found (WLC_E_START) IBSS */
+#define WLC_E_START            2       /* STA founded an IBSS or AP started a BSS */
+#define WLC_E_AUTH             3       /* 802.11 AUTH request */
+#define WLC_E_AUTH_IND         4       /* 802.11 AUTH indication */
+#define WLC_E_DEAUTH           5       /* 802.11 DEAUTH request */
+#define WLC_E_DEAUTH_IND       6       /* 802.11 DEAUTH indication */
+#define WLC_E_ASSOC            7       /* 802.11 ASSOC request */
+#define WLC_E_ASSOC_IND                8       /* 802.11 ASSOC indication */
+#define WLC_E_REASSOC          9       /* 802.11 REASSOC request */
+#define WLC_E_REASSOC_IND      10      /* 802.11 REASSOC indication */
+#define WLC_E_DISASSOC         11      /* 802.11 DISASSOC request */
+#define WLC_E_DISASSOC_IND     12      /* 802.11 DISASSOC indication */
+#define WLC_E_QUIET_START      13      /* 802.11h Quiet period started */
+#define WLC_E_QUIET_END                14      /* 802.11h Quiet period ended */
+#define WLC_E_BEACON_RX                15      /* BEACONS received/lost indication */
+#define WLC_E_LINK             16      /* generic link indication */
+#define WLC_E_MIC_ERROR                17      /* TKIP MIC error occurred */
+#define WLC_E_NDIS_LINK                18      /* NDIS style link indication */
+#define WLC_E_ROAM             19      /* roam complete: indicate status & reason */
+#define WLC_E_TXFAIL           20      /* change in dot11FailedCount (txfail) */
+#define WLC_E_PMKID_CACHE      21      /* WPA2 pmkid cache indication */
+#define WLC_E_RETROGRADE_TSF   22      /* current AP's TSF value went backward */
+#define WLC_E_PRUNE            23      /* AP was pruned from join list for reason */
+#define WLC_E_AUTOAUTH         24      /* report AutoAuth table entry match for join attempt */
+#define WLC_E_EAPOL_MSG                25      /* Event encapsulating an EAPOL message */
+#define WLC_E_SCAN_COMPLETE    26      /* Scan results are ready or scan was aborted */
+#define WLC_E_ADDTS_IND                27      /* indicate to host addts fail/success */
+#define WLC_E_DELTS_IND                28      /* indicate to host delts fail/success */
+#define WLC_E_BCNSENT_IND      29      /* indicate to host of beacon transmit */
+#define WLC_E_BCNRX_MSG                30      /* Send the received beacon up to the host */
+#define WLC_E_BCNLOST_MSG      31      /* indicate to host loss of beacon */
+#define WLC_E_ROAM_PREP                32      /* before attempting to roam association */
+#define WLC_E_PFN_NET_FOUND    33      /* PFN network found event */
+#define WLC_E_PFN_NET_LOST     34      /* PFN network lost event */
+#define WLC_E_RESET_COMPLETE   35
+#define WLC_E_JOIN_START       36
+#define WLC_E_ROAM_START       37      /* roam attempt started: indicate reason */
+#define WLC_E_ASSOC_START      38
+#define WLC_E_IBSS_ASSOC       39
+#define WLC_E_RADIO            40
+#define WLC_E_PSM_WATCHDOG     41      /* PSM microcode watchdog fired */
+#define WLC_E_PROBREQ_MSG       44      /* probe request received */
+#define WLC_E_SCAN_CONFIRM_IND  45
+#define WLC_E_PSK_SUP          46      /* WPA Handshake fail */
+#define WLC_E_COUNTRY_CODE_CHANGED     47
+#define        WLC_E_EXCEEDED_MEDIUM_TIME      48      /* WMMAC excedded medium time */
+#define WLC_E_ICV_ERROR                49      /* WEP ICV error occurred */
+#define WLC_E_UNICAST_DECODE_ERROR     50      /* Unsupported unicast encrypted frame */
+#define WLC_E_MULTICAST_DECODE_ERROR   51      /* Unsupported multicast encrypted frame */
+#define WLC_E_TRACE            52
+#define WLC_E_IF               54      /* I/F change (for dongle host notification) */
+#define WLC_E_P2P_DISC_LISTEN_COMPLETE 55      /* listen state expires */
+#define WLC_E_RSSI             56      /* indicate RSSI change based on configured levels */
+#define WLC_E_PFN_BEST_BATCHING        57      /* PFN best network batching event */
+#define WLC_E_EXTLOG_MSG       58
+#define WLC_E_ACTION_FRAME      59     /* Action frame Rx */
+#define WLC_E_ACTION_FRAME_COMPLETE    60      /* Action frame Tx complete */
+#define WLC_E_PRE_ASSOC_IND    61      /* assoc request received */
+#define WLC_E_PRE_REASSOC_IND  62      /* re-assoc request received */
+#define WLC_E_CHANNEL_ADOPTED  63
+#define WLC_E_AP_STARTED       64      /* AP started */
+#define WLC_E_DFS_AP_STOP      65      /* AP stopped due to DFS */
+#define WLC_E_DFS_AP_RESUME    66      /* AP resumed due to DFS */
+#define WLC_E_WAI_STA_EVENT    67      /* WAI stations event */
+#define WLC_E_WAI_MSG          68      /* event encapsulating an WAI message */
+#define WLC_E_ESCAN_RESULT     69      /* escan result event */
+#define WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE   70      /* action frame off channel complete */
+#define WLC_E_PROBRESP_MSG     71      /* probe response received */
+#define WLC_E_P2P_PROBREQ_MSG  72      /* P2P Probe request received */
+#define WLC_E_DCS_REQUEST      73
+#define WLC_E_FIFO_CREDIT_MAP  74      /* credits for D11 FIFOs. [AC0,AC1,AC2,AC3,BC_MC,ATIM] */
+#define WLC_E_ACTION_FRAME_RX  75      /* Received action frame event WITH
+                                        * wl_event_rx_frame_data_t header
+                                        */
+#define WLC_E_WAKE_EVENT       76      /* Wake Event timer fired, used for wake WLAN test mode */
+#define WLC_E_RM_COMPLETE      77      /* Radio measurement complete */
+#define WLC_E_HTSFSYNC         78      /* Synchronize TSF with the host */
+#define WLC_E_OVERLAY_REQ      79      /* request an overlay IOCTL/iovar from the host */
+#define WLC_E_CSA_COMPLETE_IND         80      /* 802.11 CHANNEL SWITCH ACTION completed */
+#define WLC_E_EXCESS_PM_WAKE_EVENT     81      /* excess PM Wake Event to inform host  */
+#define WLC_E_PFN_SCAN_NONE            82      /* no PFN networks around */
+/* PFN BSSID network found event, conflict/share with  WLC_E_PFN_SCAN_NONE */
+#define WLC_E_PFN_BSSID_NET_FOUND      82
+#define WLC_E_PFN_SCAN_ALLGONE         83      /* last found PFN network gets lost */
+/* PFN BSSID network lost event, conflict/share with WLC_E_PFN_SCAN_ALLGONE */
+#define WLC_E_PFN_BSSID_NET_LOST       83
+#define WLC_E_GTK_PLUMBED              84
+#define WLC_E_ASSOC_IND_NDIS           85      /* 802.11 ASSOC indication for NDIS only */
+#define WLC_E_REASSOC_IND_NDIS         86      /* 802.11 REASSOC indication for NDIS only */
+#define WLC_E_ASSOC_REQ_IE             87
+#define WLC_E_ASSOC_RESP_IE            88
+#define WLC_E_ASSOC_RECREATED          89      /* association recreated on resume */
+#define WLC_E_ACTION_FRAME_RX_NDIS     90      /* rx action frame event for NDIS only */
+#define WLC_E_AUTH_REQ                 91      /* authentication request received */
+#define WLC_E_TDLS_PEER_EVENT          92      /* discovered peer, connected/disconnected peer */
+#define WLC_E_SPEEDY_RECREATE_FAIL     93      /* fast assoc recreation failed */
+#define WLC_E_NATIVE                   94      /* port-specific event and payload (e.g. NDIS) */
+#define WLC_E_PKTDELAY_IND             95      /* event for tx pkt delay suddently jump */
+#define WLC_E_PSTA_PRIMARY_INTF_IND    99      /* psta primary interface indication */
+#define WLC_E_NAN                      100     /* NAN event */
+#define WLC_E_BEACON_FRAME_RX          101
+#define WLC_E_SERVICE_FOUND            102     /* desired service found */
+#define WLC_E_GAS_FRAGMENT_RX          103     /* GAS fragment received */
+#define WLC_E_GAS_COMPLETE             104     /* GAS sessions all complete */
+#define WLC_E_P2PO_ADD_DEVICE          105     /* New device found by p2p offload */
+#define WLC_E_P2PO_DEL_DEVICE          106     /* device has been removed by p2p offload */
+#define WLC_E_WNM_STA_SLEEP            107     /* WNM event to notify STA enter sleep mode */
+#define WLC_E_TXFAIL_THRESH            108     /* Indication of MAC tx failures (exhaustion of
+                                                * 802.11 retries) exceeding threshold(s)
+                                                */
+#define WLC_E_PROXD                    109     /* Proximity Detection event */
+#define WLC_E_IBSS_COALESCE            110     /* IBSS Coalescing */
+#define WLC_E_AIBSS_TXFAIL             110     /* TXFAIL event for AIBSS, re using event 110 */
+#define WLC_E_BSS_LOAD                 114     /* Inform host of beacon bss load */
+#define WLC_E_MIMO_PWR_SAVE            115     /* Inform host MIMO PWR SAVE learning events */
+#define WLC_E_LEAKY_AP_STATS   116 /* Inform host leaky Ap stats events */
+#define WLC_E_ALLOW_CREDIT_BORROW 117  /* Allow or disallow wlfc credit borrowing in DHD */
+#define WLC_E_MSCH                     120     /* Multiple channel scheduler event */
+#define WLC_E_CSA_START_IND            121
+#define WLC_E_CSA_DONE_IND             122
+#define WLC_E_CSA_FAILURE_IND          123
+#define WLC_E_CCA_CHAN_QUAL            124     /* CCA based channel quality report */
+#define WLC_E_BSSID            125     /* to report change in BSSID while roaming */
+#define WLC_E_TX_STAT_ERROR            126     /* tx error indication */
+#define WLC_E_BCMC_CREDIT_SUPPORT      127     /* credit check for BCMC supported */
+#define WLC_E_PEER_TIMEOUT     128 /* silently drop a STA because of inactivity */
+#define WLC_E_BT_WIFI_HANDOVER_REQ     130     /* Handover Request Initiated */
+#define WLC_E_SPW_TXINHIBIT            131     /* Southpaw TxInhibit notification */
+#define WLC_E_FBT_AUTH_REQ_IND         132     /* FBT Authentication Request Indication */
+#define WLC_E_RSSI_LQM                 133     /* Enhancement addition for WLC_E_RSSI */
+#define WLC_E_PFN_GSCAN_FULL_RESULT            134 /* Full probe/beacon (IEs etc) results */
+#define WLC_E_PFN_SWC          135 /* Significant change in rssi of bssids being tracked */
+#define WLC_E_AUTHORIZED       136     /* a STA been authroized for traffic */
+#define WLC_E_PROBREQ_MSG_RX   137 /* probe req with wl_event_rx_frame_data_t header */
+#define WLC_E_PFN_SCAN_COMPLETE        138     /* PFN completed scan of network list */
+#define WLC_E_RMC_EVENT                139     /* RMC Event */
+#define WLC_E_DPSTA_INTF_IND   140     /* DPSTA interface indication */
+#define WLC_E_RRM              141     /* RRM Event */
+#define WLC_E_PFN_SSID_EXT     142     /* SSID EXT event */
+#define WLC_E_ROAM_EXP_EVENT   143     /* Expanded roam event */
+#define WLC_E_ULP                      146     /* ULP entered indication */
+#define WLC_E_MACDBG                   147     /* Ucode debugging event */
+#define WLC_E_RESERVED                 148     /* reserved */
+#define WLC_E_PRE_ASSOC_RSEP_IND       149     /* assoc resp received */
+#define WLC_E_PSK_AUTH                 150     /* PSK AUTH WPA2-PSK 4 WAY Handshake failure */
+#define WLC_E_TKO                      151     /* TCP keepalive offload */
+#define WLC_E_SDB_TRANSITION            152     /* SDB mode-switch event */
+#define WLC_E_NATOE_NFCT               153     /* natoe event */
+#define WLC_E_TEMP_THROTTLE            154     /* Temperature throttling control event */
+#define WLC_E_LINK_QUALITY             155     /* Link quality measurement complete */
+#define WLC_E_BSSTRANS_RESP            156 /* BSS Transition Response received */
+#define WLC_E_HE_TWT_SETUP             157     /* HE TWT Setup Complete event */
+#define WLC_E_NAN_DATA_IND             158     /* NAN 2.0 data indication */
+#define WLC_E_NAN_DATA_CONF            159     /* NAN 2.0 data confirmation */
+#define WLC_E_RADAR_DETECTED           160     /* Radar Detected event */
+#define WLC_E_RANGING_EVENT            161     /* Ranging event */
+#define WLC_E_INVALID_IE               162     /* Received invalid IE */
+#define WLC_E_MODE_SWITCH              163     /* Mode switch event */
+#define WLC_E_PKT_FILTER               164     /* Packet filter event */
+#define WLC_E_DMA_TXFLUSH_COMPLETE             165     /* TxFlush done before changing
+                                                                                       * tx/rxchain
+                                                                                       */
+#define WLC_E_LAST                     166     /* highest val + 1 for range checking */
+#if (WLC_E_LAST > 166)
+#error "WLC_E_LAST: Invalid value for last event; must be <= 165."
+#endif /* WLC_E_LAST */
+
+/* define an API for getting the string name of an event */
+extern const char *bcmevent_get_name(uint event_type);
+extern void wl_event_to_host_order(wl_event_msg_t * evt);
+extern void wl_event_to_network_order(wl_event_msg_t * evt);
+
+/* validate if the event is proper and if valid copy event header to event */
+extern int is_wlc_event_frame(void *pktdata, uint pktlen, uint16 exp_usr_subtype,
+       bcm_event_msg_u_t *out_event);
+
+/* conversion between host and network order for events */
+void wl_event_to_host_order(wl_event_msg_t * evt);
+void wl_event_to_network_order(wl_event_msg_t * evt);
+
+
+/* Event status codes */
+#define WLC_E_STATUS_SUCCESS           0       /* operation was successful */
+#define WLC_E_STATUS_FAIL              1       /* operation failed */
+#define WLC_E_STATUS_TIMEOUT           2       /* operation timed out */
+#define WLC_E_STATUS_NO_NETWORKS       3       /* failed due to no matching network found */
+#define WLC_E_STATUS_ABORT             4       /* operation was aborted */
+#define WLC_E_STATUS_NO_ACK            5       /* protocol failure: packet not ack'd */
+#define WLC_E_STATUS_UNSOLICITED       6       /* AUTH or ASSOC packet was unsolicited */
+#define WLC_E_STATUS_ATTEMPT           7       /* attempt to assoc to an auto auth configuration */
+#define WLC_E_STATUS_PARTIAL           8       /* scan results are incomplete */
+#define WLC_E_STATUS_NEWSCAN           9       /* scan aborted by another scan */
+#define WLC_E_STATUS_NEWASSOC          10      /* scan aborted due to assoc in progress */
+#define WLC_E_STATUS_11HQUIET          11      /* 802.11h quiet period started */
+#define WLC_E_STATUS_SUPPRESS          12      /* user disabled scanning (WLC_SET_SCANSUPPRESS) */
+#define WLC_E_STATUS_NOCHANS           13      /* no allowable channels to scan */
+#define WLC_E_STATUS_CS_ABORT          15      /* abort channel select */
+#define WLC_E_STATUS_ERROR             16      /* request failed due to error */
+#define WLC_E_STATUS_INVALID 0xff  /* Invalid status code to init variables. */
+
+/* 4-way handshake event type */
+#define WLC_E_PSK_AUTH_SUB_EAPOL_START         1       /* EAPOL start */
+#define WLC_E_PSK_AUTH_SUB_EAPOL_DONE          2       /* EAPOL end */
+/* GTK event type */
+#define        WLC_E_PSK_AUTH_SUB_GTK_DONE             3       /* GTK end */
+
+/* 4-way handshake event status code */
+#define WLC_E_STATUS_PSK_AUTH_WPA_TIMOUT       1       /* operation timed out */
+#define WLC_E_STATUS_PSK_AUTH_MIC_WPA_ERR              2       /* MIC error */
+#define WLC_E_STATUS_PSK_AUTH_IE_MISMATCH_ERR          3       /* IE Missmatch error */
+#define WLC_E_STATUS_PSK_AUTH_REPLAY_COUNT_ERR         4
+#define WLC_E_STATUS_PSK_AUTH_PEER_BLACKISTED  5       /* Blaclisted peer */
+#define WLC_E_STATUS_PSK_AUTH_GTK_REKEY_FAIL   6       /* GTK event status code */
+
+/* SDB transition status code */
+#define WLC_E_STATUS_SDB_START          1
+#define WLC_E_STATUS_SDB_COMPLETE       2
+
+/* SDB transition reason code */
+#define WLC_E_REASON_HOST_DIRECT       0
+#define WLC_E_REASON_INFRA_ASSOC       1
+#define WLC_E_REASON_INFRA_ROAM                2
+#define WLC_E_REASON_INFRA_DISASSOC    3
+#define WLC_E_REASON_NO_MODE_CHANGE_NEEDED     4
+
+/* WLC_E_SDB_TRANSITION event data */
+#define WL_MAX_BSSCFG     4
+#define WL_EVENT_SDB_TRANSITION_VER     1
+typedef struct wl_event_sdb_data {
+       uint8 wlunit;           /* Core index */
+       uint8 is_iftype;        /* Interface Type(Station, SoftAP, P2P_GO, P2P_GC */
+       uint16 chanspec;        /* Interface Channel/Chanspec */
+       char ssidbuf[(4 * 32) + 1];     /* SSID_FMT_BUF_LEN: ((4 * DOT11_MAX_SSID_LEN) + 1) */
+} wl_event_sdb_data_t;
+
+typedef struct wl_event_sdb_trans {
+       uint8 version;          /* Event Data Version */
+       uint8 rsdb_mode;
+       uint8 enable_bsscfg;
+       uint8 reserved;
+       struct wl_event_sdb_data values[WL_MAX_BSSCFG];
+} wl_event_sdb_trans_t;
+
+/* roam reason codes */
+#define WLC_E_REASON_INITIAL_ASSOC     0       /* initial assoc */
+#define WLC_E_REASON_LOW_RSSI          1       /* roamed due to low RSSI */
+#define WLC_E_REASON_DEAUTH            2       /* roamed due to DEAUTH indication */
+#define WLC_E_REASON_DISASSOC          3       /* roamed due to DISASSOC indication */
+#define WLC_E_REASON_BCNS_LOST         4       /* roamed due to lost beacons */
+
+#define WLC_E_REASON_FAST_ROAM_FAILED  5       /* roamed due to fast roam failure */
+#define WLC_E_REASON_DIRECTED_ROAM     6       /* roamed due to request by AP */
+#define WLC_E_REASON_TSPEC_REJECTED    7       /* roamed due to TSPEC rejection */
+#define WLC_E_REASON_BETTER_AP         8       /* roamed due to finding better AP */
+#define WLC_E_REASON_MINTXRATE         9       /* roamed because at mintxrate for too long */
+#define WLC_E_REASON_TXFAIL            10      /* We can hear AP, but AP can't hear us */
+/* retained for precommit auto-merging errors; remove once all branches are synced */
+#define WLC_E_REASON_REQUESTED_ROAM    11
+#define WLC_E_REASON_BSSTRANS_REQ      11      /* roamed due to BSS Transition request by AP */
+#define WLC_E_REASON_LOW_RSSI_CU               12 /* roamed due to low RSSI and Channel Usage */
+#define WLC_E_REASON_RADAR_DETECTED    13      /* roamed due to radar detection by STA */
+
+/* prune reason codes */
+#define WLC_E_PRUNE_ENCR_MISMATCH      1       /* encryption mismatch */
+#define WLC_E_PRUNE_BCAST_BSSID                2       /* AP uses a broadcast BSSID */
+#define WLC_E_PRUNE_MAC_DENY           3       /* STA's MAC addr is in AP's MAC deny list */
+#define WLC_E_PRUNE_MAC_NA             4       /* STA's MAC addr is not in AP's MAC allow list */
+#define WLC_E_PRUNE_REG_PASSV          5       /* AP not allowed due to regulatory restriction */
+#define WLC_E_PRUNE_SPCT_MGMT          6       /* AP does not support STA locale spectrum mgmt */
+#define WLC_E_PRUNE_RADAR              7       /* AP is on a radar channel of STA locale */
+#define WLC_E_RSN_MISMATCH             8       /* STA does not support AP's RSN */
+#define WLC_E_PRUNE_NO_COMMON_RATES    9       /* No rates in common with AP */
+#define WLC_E_PRUNE_BASIC_RATES                10      /* STA does not support all basic rates of BSS */
+#define WLC_E_PRUNE_CIPHER_NA          12      /* BSS's cipher not supported */
+#define WLC_E_PRUNE_KNOWN_STA          13      /* AP is already known to us as a STA */
+#define WLC_E_PRUNE_WDS_PEER           15      /* AP is already known to us as a WDS peer */
+#define WLC_E_PRUNE_QBSS_LOAD          16      /* QBSS LOAD - AAC is too low */
+#define WLC_E_PRUNE_HOME_AP            17      /* prune home AP */
+#define WLC_E_PRUNE_AUTH_RESP_MAC      20      /* suppress auth resp by MAC filter */
+
+/* WPA failure reason codes carried in the WLC_E_PSK_SUP event */
+#define WLC_E_SUP_OTHER                        0       /* Other reason */
+#define WLC_E_SUP_DECRYPT_KEY_DATA     1       /* Decryption of key data failed */
+#define WLC_E_SUP_BAD_UCAST_WEP128     2       /* Illegal use of ucast WEP128 */
+#define WLC_E_SUP_BAD_UCAST_WEP40      3       /* Illegal use of ucast WEP40 */
+#define WLC_E_SUP_UNSUP_KEY_LEN                4       /* Unsupported key length */
+#define WLC_E_SUP_PW_KEY_CIPHER                5       /* Unicast cipher mismatch in pairwise key */
+#define WLC_E_SUP_MSG3_TOO_MANY_IE     6       /* WPA IE contains > 1 RSN IE in key msg 3 */
+#define WLC_E_SUP_MSG3_IE_MISMATCH     7       /* WPA IE mismatch in key message 3 */
+#define WLC_E_SUP_NO_INSTALL_FLAG      8       /* INSTALL flag unset in 4-way msg */
+#define WLC_E_SUP_MSG3_NO_GTK          9       /* encapsulated GTK missing from msg 3 */
+#define WLC_E_SUP_GRP_KEY_CIPHER       10      /* Multicast cipher mismatch in group key */
+#define WLC_E_SUP_GRP_MSG1_NO_GTK      11      /* encapsulated GTK missing from group msg 1 */
+#define WLC_E_SUP_GTK_DECRYPT_FAIL     12      /* GTK decrypt failure */
+#define WLC_E_SUP_SEND_FAIL            13      /* message send failure */
+#define WLC_E_SUP_DEAUTH               14      /* received FC_DEAUTH */
+#define WLC_E_SUP_WPA_PSK_TMO          15      /* WPA PSK 4-way handshake timeout */
+#define WLC_E_SUP_WPA_PSK_M1_TMO       16      /* WPA PSK 4-way handshake M1 timeout */
+#define WLC_E_SUP_WPA_PSK_M3_TMO       17      /* WPA PSK 4-way handshake M3 timeout */
+
+
+/* Ucode reason codes carried in the WLC_E_MACDBG event */
+#define WLC_E_MACDBG_LIST_PSM          0       /* Dump list update for PSM registers */
+#define WLC_E_MACDBG_LIST_PSMX         1       /* Dump list update for PSMx registers */
+#define WLC_E_MACDBG_REGALL            2       /* Dump all registers */
+
+/* Event data for events that include frames received over the air */
+/* WLC_E_PROBRESP_MSG
+ * WLC_E_P2P_PROBREQ_MSG
+ * WLC_E_ACTION_FRAME_RX
+ */
+typedef BWL_PRE_PACKED_STRUCT struct wl_event_rx_frame_data {
+       uint16  version;
+       uint16  channel;        /* Matches chanspec_t format from bcmwifi_channels.h */
+       int32   rssi;
+       uint32  mactime;
+       uint32  rate;
+} BWL_POST_PACKED_STRUCT wl_event_rx_frame_data_t;
+
+#define BCM_RX_FRAME_DATA_VERSION 1
+
+/* WLC_E_IF event data */
+typedef struct wl_event_data_if {
+       uint8 ifidx;            /* RTE virtual device index (for dongle) */
+       uint8 opcode;           /* see I/F opcode */
+       uint8 reserved;         /* bit mask (WLC_E_IF_FLAGS_XXX ) */
+       uint8 bssidx;           /* bsscfg index */
+       uint8 role;             /* see I/F role */
+} wl_event_data_if_t;
+
+/* WLC_E_NATOE event data */
+typedef struct wl_event_data_natoe {
+       uint32 natoe_active;
+       uint32 sta_ip;
+       uint16 start_port;
+       uint16 end_port;
+} wl_event_data_natoe_t;
+
+/* opcode in WLC_E_IF event */
+#define WLC_E_IF_ADD           1       /* bsscfg add */
+#define WLC_E_IF_DEL           2       /* bsscfg delete */
+#define WLC_E_IF_CHANGE                3       /* bsscfg role change */
+
+/* I/F role code in WLC_E_IF event */
+#define WLC_E_IF_ROLE_STA              0       /* Infra STA */
+#define WLC_E_IF_ROLE_AP               1       /* Access Point */
+#define WLC_E_IF_ROLE_WDS              2       /* WDS link */
+#define WLC_E_IF_ROLE_P2P_GO           3       /* P2P Group Owner */
+#define WLC_E_IF_ROLE_P2P_CLIENT       4       /* P2P Client */
+#define WLC_E_IF_ROLE_IBSS              8       /* IBSS */
+#define WLC_E_IF_ROLE_NAN              9       /* NAN */
+
+/* WLC_E_RSSI event data */
+typedef struct wl_event_data_rssi {
+       int32 rssi;
+       int32 snr;
+       int32 noise;
+} wl_event_data_rssi_t;
+
+/* WLC_E_IF flag */
+#define WLC_E_IF_FLAGS_BSSCFG_NOIF     0x1     /* no host I/F creation needed */
+
+/* Reason codes for LINK */
+#define WLC_E_LINK_BCN_LOSS     1   /* Link down because of beacon loss */
+#define WLC_E_LINK_DISASSOC     2   /* Link down because of disassoc */
+#define WLC_E_LINK_ASSOC_REC    3   /* Link down because assoc recreate failed */
+#define WLC_E_LINK_BSSCFG_DIS   4   /* Link down due to bsscfg down */
+
+
+/* WLC_E_NDIS_LINK event data */
+typedef BWL_PRE_PACKED_STRUCT struct ndis_link_parms {
+       struct ether_addr peer_mac; /* 6 bytes */
+       uint16 chanspec;            /* 2 bytes */
+       uint32 link_speed;          /* current datarate in units of 500 Kbit/s */
+       uint32 max_link_speed;      /* max possible datarate for link in units of 500 Kbit/s  */
+       int32  rssi;                /* average rssi */
+} BWL_POST_PACKED_STRUCT ndis_link_parms_t;
+
+/* reason codes for WLC_E_OVERLAY_REQ event */
+#define WLC_E_OVL_DOWNLOAD             0       /* overlay download request */
+#define WLC_E_OVL_UPDATE_IND   1       /* device indication of host overlay update */
+
+/* reason codes for WLC_E_TDLS_PEER_EVENT event */
+#define WLC_E_TDLS_PEER_DISCOVERED             0       /* peer is ready to establish TDLS */
+#define WLC_E_TDLS_PEER_CONNECTED              1
+#define WLC_E_TDLS_PEER_DISCONNECTED   2
+
+/* reason codes for WLC_E_RMC_EVENT event */
+#define WLC_E_REASON_RMC_NONE          0
+#define WLC_E_REASON_RMC_AR_LOST               1
+#define WLC_E_REASON_RMC_AR_NO_ACK             2
+
+#ifdef WLTDLS
+/* TDLS Action Category code */
+#define TDLS_AF_CATEGORY               12
+/* Wi-Fi Display (WFD) Vendor Specific Category */
+/* used for WFD Tunneled Probe Request and Response */
+#define TDLS_VENDOR_SPECIFIC           127
+/* TDLS Action Field Values */
+#define TDLS_ACTION_SETUP_REQ          0
+#define TDLS_ACTION_SETUP_RESP         1
+#define TDLS_ACTION_SETUP_CONFIRM      2
+#define TDLS_ACTION_TEARDOWN           3
+#define WLAN_TDLS_SET_PROBE_WFD_IE     11
+#define WLAN_TDLS_SET_SETUP_WFD_IE     12
+#define WLAN_TDLS_SET_WFD_ENABLED      13
+#define WLAN_TDLS_SET_WFD_DISABLED     14
+#endif
+
+/* WLC_E_RANGING_EVENT subtypes */
+#define WLC_E_RANGING_RESULTS  0
+
+
+/* GAS event data */
+typedef BWL_PRE_PACKED_STRUCT struct wl_event_gas {
+       uint16  channel;                /* channel of GAS protocol */
+       uint8   dialog_token;   /* GAS dialog token */
+       uint8   fragment_id;    /* fragment id */
+       uint16  status_code;    /* status code on GAS completion */
+       uint16  data_len;               /* length of data to follow */
+       uint8   data[1];                /* variable length specified by data_len */
+} BWL_POST_PACKED_STRUCT wl_event_gas_t;
+
+/* service discovery TLV */
+typedef BWL_PRE_PACKED_STRUCT struct wl_sd_tlv {
+       uint16  length;                 /* length of response_data */
+       uint8   protocol;               /* service protocol type */
+       uint8   transaction_id;         /* service transaction id */
+       uint8   status_code;            /* status code */
+       uint8   data[1];                /* response data */
+} BWL_POST_PACKED_STRUCT wl_sd_tlv_t;
+
+/* service discovery event data */
+typedef BWL_PRE_PACKED_STRUCT struct wl_event_sd {
+       uint16  channel;                /* channel */
+       uint8   count;                  /* number of tlvs */
+       wl_sd_tlv_t     tlv[1];         /* service discovery TLV */
+} BWL_POST_PACKED_STRUCT wl_event_sd_t;
+
+/* WLC_E_PKT_FILTER event sub-classification codes */
+#define WLC_E_PKT_FILTER_TIMEOUT       1 /* Matching packet not received in last timeout seconds */
+
+/* Note: proxd has a new API (ver 3.0) deprecates the following */
+
+/* Reason codes for WLC_E_PROXD */
+#define WLC_E_PROXD_FOUND              1       /* Found a proximity device */
+#define WLC_E_PROXD_GONE               2       /* Lost a proximity device */
+#define WLC_E_PROXD_START              3       /* used by: target  */
+#define WLC_E_PROXD_STOP               4       /* used by: target   */
+#define WLC_E_PROXD_COMPLETED          5       /* used by: initiator completed */
+#define WLC_E_PROXD_ERROR              6       /* used by both initiator and target */
+#define WLC_E_PROXD_COLLECT_START      7       /* used by: target & initiator */
+#define WLC_E_PROXD_COLLECT_STOP       8       /* used by: target */
+#define WLC_E_PROXD_COLLECT_COMPLETED  9       /* used by: initiator completed */
+#define WLC_E_PROXD_COLLECT_ERROR      10      /* used by both initiator and target */
+#define WLC_E_PROXD_NAN_EVENT          11      /* used by both initiator and target */
+#define WLC_E_PROXD_TS_RESULTS          12      /* used by: initiator completed */
+
+/*  proxd_event data */
+typedef struct ftm_sample {
+       uint32 value;   /* RTT in ns */
+       int8 rssi;      /* RSSI */
+} ftm_sample_t;
+
+typedef struct ts_sample {
+       uint32 t1;
+       uint32 t2;
+       uint32 t3;
+       uint32 t4;
+} ts_sample_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct proxd_event_data {
+       uint16 ver;                     /* version */
+       uint16 mode;                    /* mode: target/initiator */
+       uint16 method;                  /* method: rssi/TOF/AOA */
+       uint8  err_code;                /* error classification */
+       uint8  TOF_type;                /* one way or two way TOF */
+       uint8  OFDM_frame_type;         /* legacy or VHT */
+       uint8  bandwidth;               /* Bandwidth is 20, 40,80, MHZ */
+       struct ether_addr peer_mac;     /* (e.g for tgt:initiator's */
+       uint32 distance;                /* dst to tgt, units meter */
+       uint32 meanrtt;                 /* mean delta */
+       uint32 modertt;                 /* Mode delta */
+       uint32 medianrtt;               /* median RTT */
+       uint32 sdrtt;                   /* Standard deviation of RTT */
+       int32  gdcalcresult;            /* Software or Hardware Kind of redundant, but if */
+                                       /* frame type is VHT, then we should do it by hardware */
+       int16  avg_rssi;                /* avg rssi accroos the ftm frames */
+       int16  validfrmcnt;             /* Firmware's valid frame counts */
+       int32  peer_router_info;        /* Peer router information if available in TLV, */
+                                       /* We will add this field later  */
+       int32 var1;                     /* average of group delay */
+       int32 var2;                     /* average of threshold crossing */
+       int32 var3;                     /* difference between group delay and threshold crossing */
+                                       /* raw Fine Time Measurements (ftm) data */
+       uint16 ftm_unit;                /* ftm cnt resolution in picoseconds , 6250ps - default */
+       uint16 ftm_cnt;                 /*  num of rtd measurments/length in the ftm buffer  */
+       ftm_sample_t ftm_buff[1];       /* 1 ... ftm_cnt  */
+} BWL_POST_PACKED_STRUCT wl_proxd_event_data_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct proxd_event_ts_results {
+       uint16 ver;                     /* version */
+       uint16 mode;                    /* mode: target/initiator */
+       uint16 method;                  /* method: rssi/TOF/AOA */
+       uint8  err_code;                /* error classification */
+       uint8  TOF_type;                /* one way or two way TOF */
+       uint16  ts_cnt;                 /* number of timestamp measurements */
+       ts_sample_t ts_buff[1];         /* Timestamps */
+} BWL_POST_PACKED_STRUCT wl_proxd_event_ts_results_t;
+
+
+/* Video Traffic Interference Monitor Event */
+#define INTFER_EVENT_VERSION           1
+#define INTFER_STREAM_TYPE_NONTCP      1
+#define INTFER_STREAM_TYPE_TCP         2
+#define WLINTFER_STATS_NSMPLS          4
+typedef struct wl_intfer_event {
+       uint16 version;                 /* version */
+       uint16 status;                  /* status */
+       uint8 txfail_histo[WLINTFER_STATS_NSMPLS]; /* txfail histo */
+} wl_intfer_event_t;
+
+#define RRM_EVENT_VERSION              0
+typedef struct wl_rrm_event {
+       int16 version;
+       int16 len;
+       int16 cat;              /* Category */
+       int16 subevent;
+       char payload[1]; /* Measurement payload */
+} wl_rrm_event_t;
+
+
+/* WLC_E_PSTA_PRIMARY_INTF_IND event data */
+typedef struct wl_psta_primary_intf_event {
+       struct ether_addr prim_ea;      /* primary intf ether addr */
+} wl_psta_primary_intf_event_t;
+
+/* WLC_E_DPSTA_INTF_IND event data */
+typedef enum {
+       WL_INTF_PSTA = 1,
+       WL_INTF_DWDS = 2
+} wl_dpsta_intf_type;
+
+typedef struct wl_dpsta_intf_event {
+       wl_dpsta_intf_type intf_type;    /* dwds/psta intf register */
+} wl_dpsta_intf_event_t;
+
+/*  **********  NAN protocol events/subevents  ********** */
+#define NAN_EVENT_BUFFER_SIZE 512 /* max size */
+/* NAN Events sent by firmware */
+typedef enum wl_nan_events {
+       WL_NAN_EVENT_START = 1,         /* NAN cluster started */
+       WL_NAN_EVENT_JOIN = 2,          /* Joined to a NAN cluster */
+       WL_NAN_EVENT_ROLE = 3,  /* Role changed */
+       WL_NAN_EVENT_SCAN_COMPLETE = 4,
+       WL_NAN_EVENT_DISCOVERY_RESULT = 5,
+       WL_NAN_EVENT_REPLIED = 6,
+       WL_NAN_EVENT_TERMINATED = 7,    /* the instance ID will be present in the ev data */
+       WL_NAN_EVENT_RECEIVE = 8,
+       WL_NAN_EVENT_STATUS_CHG = 9,    /* generated on any change in nan_mac status */
+       WL_NAN_EVENT_MERGE = 10,        /* Merged to a NAN cluster */
+       WL_NAN_EVENT_STOP = 11,         /* NAN stopped */
+       WL_NAN_EVENT_P2P = 12,          /* NAN P2P EVENT */
+       WL_NAN_EVENT_WINDOW_BEGIN_P2P = 13, /* Event for begin of P2P further availability window */
+       WL_NAN_EVENT_WINDOW_BEGIN_MESH = 14,
+       WL_NAN_EVENT_WINDOW_BEGIN_IBSS = 15,
+       WL_NAN_EVENT_WINDOW_BEGIN_RANGING = 16,
+       WL_NAN_EVENT_POST_DISC = 17,    /* Event for post discovery data */
+       WL_NAN_EVENT_DATA_IF_ADD = 18,  /* Event for Data IF add */
+       WL_NAN_EVENT_DATA_PEER_ADD = 19, /* Event for peer add */
+       /* nan 2.0 */
+       WL_NAN_EVENT_DATA_IND = 20, /* Will be removed after source code is committed. */
+       WL_NAN_EVENT_PEER_DATAPATH_IND = 20, /* Peer's Datapath request Indication to Host */
+       WL_NAN_EVENT_DATA_CONF = 21, /* Will be removed after source code is committed. */
+       WL_NAN_EVENT_DATAPATH_ESTB = 21, /* Datapath Established to Host */
+       WL_NAN_EVENT_SDF_RX = 22,       /* entire service discovery frame */
+       WL_NAN_EVENT_DATA_END = 23,     /* Will be removed after source code is committed. */
+       WL_NAN_EVENT_DATAPATH_END = 23, /* Data End to Host */
+       WL_NAN_EVENT_BCN_RX = 24,       /* received beacon payload */
+       WL_NAN_EVENT_PEER_DATAPATH_RESP = 25, /* Peer's Data Response indication to Host */
+       WL_NAN_EVENT_PEER_DATAPATH_CONF = 26, /* Peer's Data Confirm indication to Host */
+       WL_NAN_EVENT_INVALID    /* delimiter for max value */
+} nan_app_events_e;
+
+#define IS_NAN_EVT_ON(var, evt) ((var & (1 << (evt-1))) != 0)
+/*  ******************* end of NAN section *************** */
+
+/* WLC_E_ULP event data */
+#define WL_ULP_EVENT_VERSION           1
+#define WL_ULP_DISABLE_CONSOLE         1       /* Disable console message on ULP entry */
+#define WL_ULP_UCODE_DOWNLOAD          2       /* Download ULP ucode file */
+
+typedef struct wl_ulp_event {
+       uint16 version;
+       uint16 ulp_dongle_action;
+} wl_ulp_event_t;
+
+/* TCP keepalive event data */
+typedef BWL_PRE_PACKED_STRUCT struct wl_event_tko {
+       uint8 index;            /* TCP connection index, 0 to max-1 */
+       uint8 pad[3];           /* 4-byte struct alignment */
+} BWL_POST_PACKED_STRUCT wl_event_tko_t;
+
+typedef struct {
+       uint8 radar_type;       /* one of RADAR_TYPE_XXX */
+       uint16 min_pw;          /* minimum pulse-width (usec * 20) */
+       uint16 max_pw;          /* maximum pulse-width (usec * 20) */
+       uint16 min_pri;         /* minimum pulse repetition interval (usec) */
+       uint16 max_pri;         /* maximum pulse repetition interval (usec) */
+       uint16 subband;         /* subband/frequency */
+} radar_detected_event_info_t;
+typedef struct wl_event_radar_detect_data {
+
+       uint32 version;
+       uint16 current_chanspec; /* chanspec on which the radar is recieved */
+       uint16 target_chanspec; /*  Target chanspec after detection of radar on current_chanspec */
+       radar_detected_event_info_t radar_info[2];
+} wl_event_radar_detect_data_t;
+
+
+#define WL_EVENT_MODESW_VER_1                  1
+#define WL_EVENT_MODESW_VER_CURRENT            WL_EVENT_MODESW_VER_1
+
+#define WL_E_MODESW_FLAG_MASK_DEVICE           0x01u /* mask of device: belongs to local or peer */
+#define WL_E_MODESW_FLAG_MASK_FROM             0x02u /* mask of origin: firmware or user */
+#define WL_E_MODESW_FLAG_MASK_STATE            0x0Cu /* mask of state: modesw progress state */
+
+#define WL_E_MODESW_FLAG_DEVICE_LOCAL          0x00u /* flag - device: info is about self/local */
+#define WL_E_MODESW_FLAG_DEVICE_PEER           0x01u /* flag - device: info is about peer */
+
+#define WL_E_MODESW_FLAG_FROM_FIRMWARE         0x00u /* flag - from: request is from firmware */
+#define WL_E_MODESW_FLAG_FROM_USER             0x02u /* flag - from: request is from user/iov */
+
+#define WL_E_MODESW_FLAG_STATE_REQUESTED       0x00u /* flag - state: mode switch request */
+#define WL_E_MODESW_FLAG_STATE_INITIATED       0x04u /* flag - state: switch initiated */
+#define WL_E_MODESW_FLAG_STATE_COMPLETE                0x08u /* flag - state: switch completed/success */
+#define WL_E_MODESW_FLAG_STATE_FAILURE         0x0Cu /* flag - state: failed to switch */
+
+/* Get sizeof *X including variable data's length where X is pointer to wl_event_mode_switch_t */
+#define WL_E_MODESW_SIZE(X) (sizeof(*(X)) + (X)->length)
+
+/* Get variable data's length where X is pointer to wl_event_mode_switch_t */
+#define WL_E_MODESW_DATA_SIZE(X) (((X)->length > sizeof(*(X))) ? ((X)->length - sizeof(*(X))) : 0)
+
+#define WL_E_MODESW_REASON_UNKNOWN             0u /* reason: UNKNOWN */
+#define WL_E_MODESW_REASON_ACSD                        1u /* reason: ACSD (based on events from FW */
+#define WL_E_MODESW_REASON_OBSS_DBS            2u /* reason: OBSS DBS (eg. on interference) */
+#define WL_E_MODESW_REASON_DFS                 3u /* reason: DFS (eg. on subband radar) */
+#define WL_E_MODESW_REASON_DYN160              4u /* reason: DYN160 (160/2x2 - 80/4x4) */
+
+/* event structure for WLC_E_MODE_SWITCH */
+typedef struct {
+       uint16 version;
+       uint16 length;  /* size including 'data' field */
+       uint16 opmode_from;
+       uint16 opmode_to;
+       uint32 flags;   /* bit 0: peer(/local==0);
+                        * bit 1: user(/firmware==0);
+                        * bits 3,2: 00==requested, 01==initiated,
+                        *           10==complete, 11==failure;
+                        * rest: reserved
+                        */
+       uint16 reason;  /* value 0: unknown, 1: ACSD, 2: OBSS_DBS,
+                        *       3: DFS, 4: DYN160, rest: reserved
+                        */
+       uint16 data_offset;     /* offset to 'data' from beginning of this struct.
+                                * fields may be added between data_offset and data
+                                */
+       /* ADD NEW FIELDS HERE */
+       uint8 data[];   /* reason specific data; could be empty */
+} wl_event_mode_switch_t;
+
+/* when reason in WLC_E_MODE_SWITCH is DYN160, data will carry the following structure */
+typedef struct {
+       uint16 trigger;         /* value 0: MU to SU, 1: SU to MU, 2: metric_dyn160, 3:re-/assoc,
+                                *       4: disassoc, 5: rssi, 6: traffic, 7: interference,
+                                *       8: chanim_stats
+                                */
+       struct ether_addr sta_addr;     /* causal STA's MAC address when known */
+       uint16 metric_160_80;           /* latest dyn160 metric */
+       uint8 nss;              /* NSS of the STA */
+       uint8 bw;               /* BW of the STA */
+       int8 rssi;              /* RSSI of the STA */
+       uint8 traffic;          /* internal metric of traffic */
+} wl_event_mode_switch_dyn160;
+
+/* TWT Setup Completion is designed to notify the user of TWT Setup process
+ * status. When 'status' field is value of BCME_OK, the user must check the
+ * 'setup_cmd' field value in 'wl_twt_sdesc_t' structure that at the end of
+ * the event data to see the response from the TWT Responding STA; when
+ * 'status' field is value of BCME_ERROR or non BCME_OK, user must not use
+ * anything from 'wl_twt_sdesc_t' structure as it is the TWT Requesting STA's
+ * own TWT parameter.
+ */
+
+#define WL_TWT_SETUP_CPLT_VER  0
+
+/* TWT Setup Completion event data */
+typedef struct wl_twt_setup_cplt {
+       uint16 version;
+       uint16 length;  /* the byte count of fields from 'dialog' onwards */
+       uint8 dialog;   /* the dialog token user supplied to the TWT setup API */
+       uint8 pad[3];
+       int32 status;
+       /* wl_twt_sdesc_t desc; - defined in wlioctl.h */
+} wl_twt_setup_cplt_t;
+
+#define WL_INVALID_IE_EVENT_VERSION    0
+
+/* Invalid IE Event data */
+typedef struct wl_invalid_ie_event {
+       uint16 version;
+       uint16 len;      /* Length of the invalid IE copy */
+       uint16 type;     /* Type/subtype of the frame which contains the invalid IE */
+       uint16 error;    /* error code of the wrong IE, defined in ie_error_code_t */
+       uint8  ie[];     /* Variable length buffer for the invalid IE copy */
+} wl_invalid_ie_event_t;
+
+typedef enum ie_error_code {
+       IE_ERROR_OUT_OF_RANGE = 0x01
+} ie_error_code_t;
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _BCMEVENT_H_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/proto/bcmip.h b/drivers/net/wireless/bcmdhd_1363/include/proto/bcmip.h
new file mode 100644 (file)
index 0000000..fdfd83c
--- /dev/null
@@ -0,0 +1,249 @@
+/*
+ * Fundamental constants relating to IP Protocol
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmip.h 594480 2015-10-22 03:14:33Z $
+ */
+
+#ifndef _bcmip_h_
+#define _bcmip_h_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+
+/* IPV4 and IPV6 common */
+#define IP_VER_OFFSET          0x0     /* offset to version field */
+#define IP_VER_MASK            0xf0    /* version mask */
+#define IP_VER_SHIFT           4       /* version shift */
+#define IP_VER_4               4       /* version number for IPV4 */
+#define IP_VER_6               6       /* version number for IPV6 */
+
+#define IP_VER(ip_body) \
+       ((((uint8 *)(ip_body))[IP_VER_OFFSET] & IP_VER_MASK) >> IP_VER_SHIFT)
+
+#define IP_PROT_ICMP           0x1     /* ICMP protocol */
+#define IP_PROT_IGMP           0x2     /* IGMP protocol */
+#define IP_PROT_TCP            0x6     /* TCP protocol */
+#define IP_PROT_UDP            0x11    /* UDP protocol type */
+#define IP_PROT_GRE            0x2f    /* GRE protocol type */
+#define IP_PROT_ICMP6           0x3a    /* ICMPv6 protocol type */
+
+/* IPV4 field offsets */
+#define IPV4_VER_HL_OFFSET      0       /* version and ihl byte offset */
+#define IPV4_TOS_OFFSET         1       /* type of service offset */
+#define IPV4_PKTLEN_OFFSET      2       /* packet length offset */
+#define IPV4_PKTFLAG_OFFSET     6       /* more-frag,dont-frag flag offset */
+#define IPV4_PROT_OFFSET        9       /* protocol type offset */
+#define IPV4_CHKSUM_OFFSET      10      /* IP header checksum offset */
+#define IPV4_SRC_IP_OFFSET      12      /* src IP addr offset */
+#define IPV4_DEST_IP_OFFSET     16      /* dest IP addr offset */
+#define IPV4_OPTIONS_OFFSET     20      /* IP options offset */
+#define IPV4_MIN_HEADER_LEN     20      /* Minimum size for an IP header (no options) */
+
+/* IPV4 field decodes */
+#define IPV4_VER_MASK          0xf0    /* IPV4 version mask */
+#define IPV4_VER_SHIFT         4       /* IPV4 version shift */
+
+#define IPV4_HLEN_MASK         0x0f    /* IPV4 header length mask */
+#define IPV4_HLEN(ipv4_body)   (4 * (((uint8 *)(ipv4_body))[IPV4_VER_HL_OFFSET] & IPV4_HLEN_MASK))
+
+#define IPV4_ADDR_LEN          4       /* IPV4 address length */
+
+#define IPV4_ADDR_NULL(a)      ((((uint8 *)(a))[0] | ((uint8 *)(a))[1] | \
+                                 ((uint8 *)(a))[2] | ((uint8 *)(a))[3]) == 0)
+
+#define IPV4_ADDR_BCAST(a)     ((((uint8 *)(a))[0] & ((uint8 *)(a))[1] & \
+                                 ((uint8 *)(a))[2] & ((uint8 *)(a))[3]) == 0xff)
+
+#define        IPV4_TOS_DSCP_MASK      0xfc    /* DiffServ codepoint mask */
+#define        IPV4_TOS_DSCP_SHIFT     2       /* DiffServ codepoint shift */
+
+#define        IPV4_TOS(ipv4_body)     (((uint8 *)(ipv4_body))[IPV4_TOS_OFFSET])
+
+#define        IPV4_TOS_PREC_MASK      0xe0    /* Historical precedence mask */
+#define        IPV4_TOS_PREC_SHIFT     5       /* Historical precedence shift */
+
+#define IPV4_TOS_LOWDELAY      0x10    /* Lowest delay requested */
+#define IPV4_TOS_THROUGHPUT    0x8     /* Best throughput requested */
+#define IPV4_TOS_RELIABILITY   0x4     /* Most reliable delivery requested */
+
+#define IPV4_TOS_ROUTINE        0
+#define IPV4_TOS_PRIORITY       1
+#define IPV4_TOS_IMMEDIATE      2
+#define IPV4_TOS_FLASH          3
+#define IPV4_TOS_FLASHOVERRIDE  4
+#define IPV4_TOS_CRITICAL       5
+#define IPV4_TOS_INETWORK_CTRL  6
+#define IPV4_TOS_NETWORK_CTRL   7
+
+#define IPV4_PROT(ipv4_body)   (((uint8 *)(ipv4_body))[IPV4_PROT_OFFSET])
+
+#define IPV4_FRAG_RESV         0x8000  /* Reserved */
+#define IPV4_FRAG_DONT         0x4000  /* Don't fragment */
+#define IPV4_FRAG_MORE         0x2000  /* More fragments */
+#define IPV4_FRAG_OFFSET_MASK  0x1fff  /* Fragment offset */
+
+#define IPV4_ADDR_STR_LEN      16      /* Max IP address length in string format */
+
+/* IPV4 packet formats */
+BWL_PRE_PACKED_STRUCT struct ipv4_addr {
+       uint8   addr[IPV4_ADDR_LEN];
+} BWL_POST_PACKED_STRUCT;
+
+BWL_PRE_PACKED_STRUCT struct ipv4_hdr {
+       uint8   version_ihl;            /* Version and Internet Header Length */
+       uint8   tos;                    /* Type Of Service */
+       uint16  tot_len;                /* Number of bytes in packet (max 65535) */
+       uint16  id;
+       uint16  frag;                   /* 3 flag bits and fragment offset */
+       uint8   ttl;                    /* Time To Live */
+       uint8   prot;                   /* Protocol */
+       uint16  hdr_chksum;             /* IP header checksum */
+       uint8   src_ip[IPV4_ADDR_LEN];  /* Source IP Address */
+       uint8   dst_ip[IPV4_ADDR_LEN];  /* Destination IP Address */
+} BWL_POST_PACKED_STRUCT;
+
+/* IPV6 field offsets */
+#define IPV6_PAYLOAD_LEN_OFFSET        4       /* payload length offset */
+#define IPV6_NEXT_HDR_OFFSET   6       /* next header/protocol offset */
+#define IPV6_HOP_LIMIT_OFFSET  7       /* hop limit offset */
+#define IPV6_SRC_IP_OFFSET     8       /* src IP addr offset */
+#define IPV6_DEST_IP_OFFSET    24      /* dst IP addr offset */
+
+/* IPV6 field decodes */
+#define IPV6_TRAFFIC_CLASS(ipv6_body) \
+       (((((uint8 *)(ipv6_body))[0] & 0x0f) << 4) | \
+        ((((uint8 *)(ipv6_body))[1] & 0xf0) >> 4))
+
+#define IPV6_FLOW_LABEL(ipv6_body) \
+       (((((uint8 *)(ipv6_body))[1] & 0x0f) << 16) | \
+        (((uint8 *)(ipv6_body))[2] << 8) | \
+        (((uint8 *)(ipv6_body))[3]))
+
+#define IPV6_PAYLOAD_LEN(ipv6_body) \
+       ((((uint8 *)(ipv6_body))[IPV6_PAYLOAD_LEN_OFFSET + 0] << 8) | \
+        ((uint8 *)(ipv6_body))[IPV6_PAYLOAD_LEN_OFFSET + 1])
+
+#define IPV6_NEXT_HDR(ipv6_body) \
+       (((uint8 *)(ipv6_body))[IPV6_NEXT_HDR_OFFSET])
+
+#define IPV6_PROT(ipv6_body)   IPV6_NEXT_HDR(ipv6_body)
+
+#define IPV6_ADDR_LEN          16      /* IPV6 address length */
+
+/* IPV4 TOS or IPV6 Traffic Classifier or 0 */
+#define IP_TOS46(ip_body) \
+       (IP_VER(ip_body) == IP_VER_4 ? IPV4_TOS(ip_body) : \
+        IP_VER(ip_body) == IP_VER_6 ? IPV6_TRAFFIC_CLASS(ip_body) : 0)
+
+#define IP_DSCP46(ip_body) (IP_TOS46(ip_body) >> IPV4_TOS_DSCP_SHIFT);
+
+/* IPV4 or IPV6 Protocol Classifier or 0 */
+#define IP_PROT46(ip_body) \
+       (IP_VER(ip_body) == IP_VER_4 ? IPV4_PROT(ip_body) : \
+        IP_VER(ip_body) == IP_VER_6 ? IPV6_PROT(ip_body) : 0)
+
+/* IPV6 extension headers (options) */
+#define IPV6_EXTHDR_HOP                0
+#define IPV6_EXTHDR_ROUTING    43
+#define IPV6_EXTHDR_FRAGMENT   44
+#define IPV6_EXTHDR_AUTH       51
+#define IPV6_EXTHDR_NONE       59
+#define IPV6_EXTHDR_DEST       60
+
+#define IPV6_EXTHDR(prot)      (((prot) == IPV6_EXTHDR_HOP) || \
+                                ((prot) == IPV6_EXTHDR_ROUTING) || \
+                                ((prot) == IPV6_EXTHDR_FRAGMENT) || \
+                                ((prot) == IPV6_EXTHDR_AUTH) || \
+                                ((prot) == IPV6_EXTHDR_NONE) || \
+                                ((prot) == IPV6_EXTHDR_DEST))
+
+#define IPV6_MIN_HLEN          40
+
+#define IPV6_EXTHDR_LEN(eh)    ((((struct ipv6_exthdr *)(eh))->hdrlen + 1) << 3)
+
+BWL_PRE_PACKED_STRUCT struct ipv6_exthdr {
+       uint8   nexthdr;
+       uint8   hdrlen;
+} BWL_POST_PACKED_STRUCT;
+
+BWL_PRE_PACKED_STRUCT struct ipv6_exthdr_frag {
+       uint8   nexthdr;
+       uint8   rsvd;
+       uint16  frag_off;
+       uint32  ident;
+} BWL_POST_PACKED_STRUCT;
+
+static INLINE int32
+ipv6_exthdr_len(uint8 *h, uint8 *proto)
+{
+       uint16 len = 0, hlen;
+       struct ipv6_exthdr *eh = (struct ipv6_exthdr *)h;
+
+       while (IPV6_EXTHDR(eh->nexthdr)) {
+               if (eh->nexthdr == IPV6_EXTHDR_NONE)
+                       return -1;
+               else if (eh->nexthdr == IPV6_EXTHDR_FRAGMENT)
+                       hlen = 8;
+               else if (eh->nexthdr == IPV6_EXTHDR_AUTH)
+                       hlen = (eh->hdrlen + 2) << 2;
+               else
+                       hlen = IPV6_EXTHDR_LEN(eh);
+
+               len += hlen;
+               eh = (struct ipv6_exthdr *)(h + len);
+       }
+
+       *proto = eh->nexthdr;
+       return len;
+}
+
+#define IPV4_ISMULTI(a) (((a) & 0xf0000000) == 0xe0000000)
+
+#define IPV4_MCAST_TO_ETHER_MCAST(ipv4, ether) \
+{ \
+       ether[0] = 0x01; \
+       ether[1] = 0x00; \
+       ether[2] = 0x5E; \
+       ether[3] = (ipv4 & 0x7f0000) >> 16; \
+       ether[4] = (ipv4 & 0xff00) >> 8; \
+       ether[5] = (ipv4 & 0xff); \
+}
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#define IPV4_ADDR_STR "%d.%d.%d.%d"
+#define IPV4_ADDR_TO_STR(addr) ((uint32)addr & 0xff000000) >> 24, \
+                                                               ((uint32)addr & 0x00ff0000) >> 16, \
+                                                               ((uint32)addr & 0x0000ff00) >> 8, \
+                                                               ((uint32)addr & 0x000000ff)
+
+#endif /* _bcmip_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/proto/bcmipv6.h b/drivers/net/wireless/bcmdhd_1363/include/proto/bcmipv6.h
new file mode 100644 (file)
index 0000000..f446e47
--- /dev/null
@@ -0,0 +1,163 @@
+/*
+ * Fundamental constants relating to Neighbor Discovery Protocol
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmipv6.h 518342 2014-12-01 23:21:41Z $
+ */
+
+#ifndef _bcmipv6_h_
+#define _bcmipv6_h_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+/* Extension headers */
+#define IPV6_EXT_HOP   0
+#define IPV6_EXT_ROUTE 43
+#define IPV6_EXT_FRAG  44
+#define IPV6_EXT_DEST  60
+#define IPV6_EXT_ESEC  50
+#define IPV6_EXT_AUTH  51
+
+/* Minimum size (extension header "word" length) */
+#define IPV6_EXT_WORD  8
+
+/* Offsets for most extension headers */
+#define IPV6_EXT_NEXTHDR       0
+#define IPV6_EXT_HDRLEN                1
+
+/* Constants specific to fragmentation header */
+#define IPV6_FRAG_MORE_MASK    0x0001
+#define IPV6_FRAG_MORE_SHIFT   0
+#define IPV6_FRAG_OFFS_MASK    0xfff8
+#define IPV6_FRAG_OFFS_SHIFT   3
+
+/* For icmpv6 */
+#define ICMPV6_HEADER_TYPE     0x3A
+#define ICMPV6_PKT_TYPE_RA     134
+#define ICMPV6_PKT_TYPE_NS     135
+#define ICMPV6_PKT_TYPE_NA     136
+
+#define ICMPV6_ND_OPT_TYPE_TARGET_MAC  2
+#define ICMPV6_ND_OPT_TYPE_SRC_MAC             1
+
+#define ICMPV6_ND_OPT_LEN_LINKADDR             1
+
+#define ICMPV6_ND_OPT_LEN_LINKADDR             1
+
+#define IPV6_VERSION   6
+#define IPV6_HOP_LIMIT         255
+
+#define IPV6_ADDR_NULL(a)      ((a[0] | a[1] | a[2] | a[3] | a[4] | \
+                                                        a[5] | a[6] | a[7] | a[8] | a[9] | \
+                                                        a[10] | a[11] | a[12] | a[13] | \
+                                                        a[14] | a[15]) == 0)
+
+#define IPV6_ADDR_LOCAL(a)     (((a[0] == 0xfe) && (a[1] & 0x80))? TRUE: FALSE)
+
+/* IPV6 address */
+BWL_PRE_PACKED_STRUCT struct ipv6_addr {
+               uint8           addr[16];
+} BWL_POST_PACKED_STRUCT;
+
+
+/* ICMPV6 Header */
+BWL_PRE_PACKED_STRUCT struct icmp6_hdr {
+       uint8   icmp6_type;
+       uint8   icmp6_code;
+       uint16  icmp6_cksum;
+       BWL_PRE_PACKED_STRUCT union {
+               uint32 reserved;
+               BWL_PRE_PACKED_STRUCT struct nd_advt {
+                       uint32  reserved1:5,
+                               override:1,
+                               solicited:1,
+                               router:1,
+                               reserved2:24;
+               } BWL_POST_PACKED_STRUCT nd_advt;
+       } BWL_POST_PACKED_STRUCT opt;
+} BWL_POST_PACKED_STRUCT;
+
+/* Ipv6 Header Format */
+BWL_PRE_PACKED_STRUCT struct ipv6_hdr {
+       uint8   priority:4,
+               version:4;
+       uint8   flow_lbl[3];
+       uint16  payload_len;
+       uint8   nexthdr;
+       uint8   hop_limit;
+       struct  ipv6_addr       saddr;
+       struct  ipv6_addr       daddr;
+} BWL_POST_PACKED_STRUCT;
+
+/* Neighbor Advertisement/Solicitation Packet Structure */
+BWL_PRE_PACKED_STRUCT struct bcm_nd_msg {
+       struct  icmp6_hdr       icmph;
+       struct  ipv6_addr       target;
+} BWL_POST_PACKED_STRUCT;
+
+
+/* Neighibor Solicitation/Advertisement Optional Structure */
+BWL_PRE_PACKED_STRUCT struct nd_msg_opt {
+       uint8 type;
+       uint8 len;
+       uint8 mac_addr[ETHER_ADDR_LEN];
+} BWL_POST_PACKED_STRUCT;
+
+/* Ipv6 Fragmentation Header */
+BWL_PRE_PACKED_STRUCT struct ipv6_frag {
+       uint8   nexthdr;
+       uint8   reserved;
+       uint16  frag_offset;
+       uint32  ident;
+} BWL_POST_PACKED_STRUCT;
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+static const struct ipv6_addr all_node_ipv6_maddr = {
+                                                                       { 0xff, 0x2, 0, 0,
+                                                                       0, 0, 0, 0,
+                                                                       0, 0, 0, 0,
+                                                                       0, 0, 0, 1
+                                                                       }};
+
+#define IPV6_ISMULTI(a) (a[0] == 0xff)
+
+#define IPV6_MCAST_TO_ETHER_MCAST(ipv6, ether) \
+{ \
+       ether[0] = 0x33; \
+       ether[1] = 0x33; \
+       ether[2] = ipv6[12]; \
+       ether[3] = ipv6[13]; \
+       ether[4] = ipv6[14]; \
+       ether[5] = ipv6[15]; \
+}
+
+#endif /* !defined(_bcmipv6_h_) */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/proto/bcmtcp.h b/drivers/net/wireless/bcmdhd_1363/include/proto/bcmtcp.h
new file mode 100644 (file)
index 0000000..931a1a6
--- /dev/null
@@ -0,0 +1,93 @@
+/*
+ * Fundamental constants relating to TCP Protocol
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmtcp.h 518342 2014-12-01 23:21:41Z $
+ */
+
+#ifndef _bcmtcp_h_
+#define _bcmtcp_h_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+
+#define TCP_SRC_PORT_OFFSET    0       /* TCP source port offset */
+#define TCP_DEST_PORT_OFFSET   2       /* TCP dest port offset */
+#define TCP_SEQ_NUM_OFFSET     4       /* TCP sequence number offset */
+#define TCP_ACK_NUM_OFFSET     8       /* TCP acknowledgement number offset */
+#define TCP_HLEN_OFFSET                12      /* HLEN and reserved bits offset */
+#define TCP_FLAGS_OFFSET       13      /* FLAGS and reserved bits offset */
+#define TCP_CHKSUM_OFFSET      16      /* TCP body checksum offset */
+
+#define TCP_PORT_LEN           2       /* TCP port field length */
+
+/* 8bit TCP flag field */
+#define TCP_FLAG_URG            0x20
+#define TCP_FLAG_ACK            0x10
+#define TCP_FLAG_PSH            0x08
+#define TCP_FLAG_RST            0x04
+#define TCP_FLAG_SYN            0x02
+#define TCP_FLAG_FIN            0x01
+
+#define TCP_HLEN_MASK           0xf000
+#define TCP_HLEN_SHIFT          12
+
+/* These fields are stored in network order */
+BWL_PRE_PACKED_STRUCT struct bcmtcp_hdr
+{
+       uint16  src_port;       /* Source Port Address */
+       uint16  dst_port;       /* Destination Port Address */
+       uint32  seq_num;        /* TCP Sequence Number */
+       uint32  ack_num;        /* TCP Sequence Number */
+       uint16  hdrlen_rsvd_flags;      /* Header length, reserved bits and flags */
+       uint16  tcpwin;         /* TCP window */
+       uint16  chksum;         /* Segment checksum with pseudoheader */
+       uint16  urg_ptr;        /* Points to seq-num of byte following urg data */
+} BWL_POST_PACKED_STRUCT;
+
+#define TCP_MIN_HEADER_LEN 20
+
+#define TCP_HDRLEN_MASK 0xf0
+#define TCP_HDRLEN_SHIFT 4
+#define TCP_HDRLEN(hdrlen) (((hdrlen) & TCP_HDRLEN_MASK) >> TCP_HDRLEN_SHIFT)
+
+#define TCP_FLAGS_MASK  0x1f
+#define TCP_FLAGS(hdrlen) ((hdrlen) & TCP_FLAGS_MASK)
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+/* To address round up by 32bit. */
+#define IS_TCPSEQ_GE(a, b) ((a - b) < NBITVAL(31))             /* a >= b */
+#define IS_TCPSEQ_LE(a, b) ((b - a) < NBITVAL(31))             /* a =< b */
+#define IS_TCPSEQ_GT(a, b) !IS_TCPSEQ_LE(a, b)         /* a > b */
+#define IS_TCPSEQ_LT(a, b) !IS_TCPSEQ_GE(a, b)         /* a < b */
+
+#endif /* #ifndef _bcmtcp_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/proto/bcmudp.h b/drivers/net/wireless/bcmdhd_1363/include/proto/bcmudp.h
new file mode 100644 (file)
index 0000000..ae0e8d1
--- /dev/null
@@ -0,0 +1,61 @@
+/*
+ * Fundamental constants relating to UDP Protocol
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bcmudp.h 597933 2015-11-06 18:52:06Z $
+ */
+
+#ifndef _bcmudp_h_
+#define _bcmudp_h_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+
+/* UDP header */
+#define UDP_DEST_PORT_OFFSET   2       /* UDP dest port offset */
+#define UDP_LEN_OFFSET         4       /* UDP length offset */
+#define UDP_CHKSUM_OFFSET      6       /* UDP body checksum offset */
+
+#define UDP_HDR_LEN    8       /* UDP header length */
+#define UDP_PORT_LEN   2       /* UDP port length */
+
+/* These fields are stored in network order */
+BWL_PRE_PACKED_STRUCT struct bcmudp_hdr
+{
+       uint16  src_port;       /* Source Port Address */
+       uint16  dst_port;       /* Destination Port Address */
+       uint16  len;            /* Number of bytes in datagram including header */
+       uint16  chksum;         /* entire datagram checksum with pseudoheader */
+} BWL_POST_PACKED_STRUCT;
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* #ifndef _bcmudp_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/proto/bt_amp_hci.h b/drivers/net/wireless/bcmdhd_1363/include/proto/bt_amp_hci.h
new file mode 100644 (file)
index 0000000..1a3ccaf
--- /dev/null
@@ -0,0 +1,444 @@
+/*
+ * BT-AMP (BlueTooth Alternate Mac and Phy) HCI (Host/Controller Interface)
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: bt_amp_hci.h 518342 2014-12-01 23:21:41Z $
+*/
+
+#ifndef _bt_amp_hci_h
+#define _bt_amp_hci_h
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+
+/* AMP HCI CMD packet format */
+typedef BWL_PRE_PACKED_STRUCT struct amp_hci_cmd {
+       uint16 opcode;
+       uint8 plen;
+       uint8 parms[1];
+} BWL_POST_PACKED_STRUCT amp_hci_cmd_t;
+
+#define HCI_CMD_PREAMBLE_SIZE          OFFSETOF(amp_hci_cmd_t, parms)
+#define HCI_CMD_DATA_SIZE              255
+
+/* AMP HCI CMD opcode layout */
+#define HCI_CMD_OPCODE(ogf, ocf)       ((((ogf) & 0x3F) << 10) | ((ocf) & 0x03FF))
+#define HCI_CMD_OGF(opcode)            ((uint8)(((opcode) >> 10) & 0x3F))
+#define HCI_CMD_OCF(opcode)            ((opcode) & 0x03FF)
+
+/* AMP HCI command opcodes */
+#define HCI_Read_Failed_Contact_Counter                HCI_CMD_OPCODE(0x05, 0x0001)
+#define HCI_Reset_Failed_Contact_Counter       HCI_CMD_OPCODE(0x05, 0x0002)
+#define HCI_Read_Link_Quality                  HCI_CMD_OPCODE(0x05, 0x0003)
+#define HCI_Read_Local_AMP_Info                        HCI_CMD_OPCODE(0x05, 0x0009)
+#define HCI_Read_Local_AMP_ASSOC               HCI_CMD_OPCODE(0x05, 0x000A)
+#define HCI_Write_Remote_AMP_ASSOC             HCI_CMD_OPCODE(0x05, 0x000B)
+#define HCI_Create_Physical_Link               HCI_CMD_OPCODE(0x01, 0x0035)
+#define HCI_Accept_Physical_Link_Request       HCI_CMD_OPCODE(0x01, 0x0036)
+#define HCI_Disconnect_Physical_Link           HCI_CMD_OPCODE(0x01, 0x0037)
+#define HCI_Create_Logical_Link                        HCI_CMD_OPCODE(0x01, 0x0038)
+#define HCI_Accept_Logical_Link                        HCI_CMD_OPCODE(0x01, 0x0039)
+#define HCI_Disconnect_Logical_Link            HCI_CMD_OPCODE(0x01, 0x003A)
+#define HCI_Logical_Link_Cancel                        HCI_CMD_OPCODE(0x01, 0x003B)
+#define HCI_Flow_Spec_Modify                   HCI_CMD_OPCODE(0x01, 0x003C)
+#define HCI_Write_Flow_Control_Mode            HCI_CMD_OPCODE(0x01, 0x0067)
+#define HCI_Read_Best_Effort_Flush_Timeout     HCI_CMD_OPCODE(0x01, 0x0069)
+#define HCI_Write_Best_Effort_Flush_Timeout    HCI_CMD_OPCODE(0x01, 0x006A)
+#define HCI_Short_Range_Mode                   HCI_CMD_OPCODE(0x01, 0x006B)
+#define HCI_Reset                              HCI_CMD_OPCODE(0x03, 0x0003)
+#define HCI_Read_Connection_Accept_Timeout     HCI_CMD_OPCODE(0x03, 0x0015)
+#define HCI_Write_Connection_Accept_Timeout    HCI_CMD_OPCODE(0x03, 0x0016)
+#define HCI_Read_Link_Supervision_Timeout      HCI_CMD_OPCODE(0x03, 0x0036)
+#define HCI_Write_Link_Supervision_Timeout     HCI_CMD_OPCODE(0x03, 0x0037)
+#define HCI_Enhanced_Flush                     HCI_CMD_OPCODE(0x03, 0x005F)
+#define HCI_Read_Logical_Link_Accept_Timeout   HCI_CMD_OPCODE(0x03, 0x0061)
+#define HCI_Write_Logical_Link_Accept_Timeout  HCI_CMD_OPCODE(0x03, 0x0062)
+#define HCI_Set_Event_Mask_Page_2              HCI_CMD_OPCODE(0x03, 0x0063)
+#define HCI_Read_Location_Data_Command         HCI_CMD_OPCODE(0x03, 0x0064)
+#define HCI_Write_Location_Data_Command                HCI_CMD_OPCODE(0x03, 0x0065)
+#define HCI_Read_Local_Version_Info            HCI_CMD_OPCODE(0x04, 0x0001)
+#define HCI_Read_Local_Supported_Commands      HCI_CMD_OPCODE(0x04, 0x0002)
+#define HCI_Read_Buffer_Size                   HCI_CMD_OPCODE(0x04, 0x0005)
+#define HCI_Read_Data_Block_Size               HCI_CMD_OPCODE(0x04, 0x000A)
+
+/* AMP HCI command parameters */
+typedef BWL_PRE_PACKED_STRUCT struct read_local_cmd_parms {
+       uint8 plh;
+       uint8 offset[2];                        /* length so far */
+       uint8 max_remote[2];
+} BWL_POST_PACKED_STRUCT read_local_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct write_remote_cmd_parms {
+       uint8 plh;
+       uint8 offset[2];
+       uint8 len[2];
+       uint8 frag[1];
+} BWL_POST_PACKED_STRUCT write_remote_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct phy_link_cmd_parms {
+       uint8 plh;
+       uint8 key_length;
+       uint8 key_type;
+       uint8 key[1];
+} BWL_POST_PACKED_STRUCT phy_link_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct dis_phy_link_cmd_parms {
+       uint8 plh;
+       uint8 reason;
+} BWL_POST_PACKED_STRUCT dis_phy_link_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct log_link_cmd_parms {
+       uint8 plh;
+       uint8 txflow[16];
+       uint8 rxflow[16];
+} BWL_POST_PACKED_STRUCT log_link_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct ext_flow_spec {
+       uint8 id;
+       uint8 service_type;
+       uint8 max_sdu[2];
+       uint8 sdu_ia_time[4];
+       uint8 access_latency[4];
+       uint8 flush_timeout[4];
+} BWL_POST_PACKED_STRUCT ext_flow_spec_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct log_link_cancel_cmd_parms {
+       uint8 plh;
+       uint8 tx_fs_ID;
+} BWL_POST_PACKED_STRUCT log_link_cancel_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct flow_spec_mod_cmd_parms {
+       uint8 llh[2];
+       uint8 txflow[16];
+       uint8 rxflow[16];
+} BWL_POST_PACKED_STRUCT flow_spec_mod_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct plh_pad {
+       uint8 plh;
+       uint8 pad;
+} BWL_POST_PACKED_STRUCT plh_pad_t;
+
+typedef BWL_PRE_PACKED_STRUCT union hci_handle {
+       uint16 bredr;
+       plh_pad_t amp;
+} BWL_POST_PACKED_STRUCT hci_handle_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct ls_to_cmd_parms {
+       hci_handle_t handle;
+       uint8 timeout[2];
+} BWL_POST_PACKED_STRUCT ls_to_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct befto_cmd_parms {
+       uint8 llh[2];
+       uint8 befto[4];
+} BWL_POST_PACKED_STRUCT befto_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct srm_cmd_parms {
+       uint8 plh;
+       uint8 srm;
+} BWL_POST_PACKED_STRUCT srm_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct ld_cmd_parms {
+       uint8 ld_aware;
+       uint8 ld[2];
+       uint8 ld_opts;
+       uint8 l_opts;
+} BWL_POST_PACKED_STRUCT ld_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct eflush_cmd_parms {
+       uint8 llh[2];
+       uint8 packet_type;
+} BWL_POST_PACKED_STRUCT eflush_cmd_parms_t;
+
+/* Generic AMP extended flow spec service types */
+#define EFS_SVCTYPE_NO_TRAFFIC         0
+#define EFS_SVCTYPE_BEST_EFFORT                1
+#define EFS_SVCTYPE_GUARANTEED         2
+
+/* AMP HCI event packet format */
+typedef BWL_PRE_PACKED_STRUCT struct amp_hci_event {
+       uint8 ecode;
+       uint8 plen;
+       uint8 parms[1];
+} BWL_POST_PACKED_STRUCT amp_hci_event_t;
+
+#define HCI_EVT_PREAMBLE_SIZE                  OFFSETOF(amp_hci_event_t, parms)
+
+/* AMP HCI event codes */
+#define HCI_Command_Complete                   0x0E
+#define HCI_Command_Status                     0x0F
+#define HCI_Flush_Occurred                     0x11
+#define HCI_Enhanced_Flush_Complete            0x39
+#define HCI_Physical_Link_Complete             0x40
+#define HCI_Channel_Select                     0x41
+#define HCI_Disconnect_Physical_Link_Complete  0x42
+#define HCI_Logical_Link_Complete              0x45
+#define HCI_Disconnect_Logical_Link_Complete   0x46
+#define HCI_Flow_Spec_Modify_Complete          0x47
+#define HCI_Number_of_Completed_Data_Blocks    0x48
+#define HCI_Short_Range_Mode_Change_Complete   0x4C
+#define HCI_Status_Change_Event                        0x4D
+#define HCI_Vendor_Specific                    0xFF
+
+/* AMP HCI event mask bit positions */
+#define HCI_Physical_Link_Complete_Event_Mask                  0x0001
+#define HCI_Channel_Select_Event_Mask                          0x0002
+#define HCI_Disconnect_Physical_Link_Complete_Event_Mask       0x0004
+#define HCI_Logical_Link_Complete_Event_Mask                   0x0020
+#define HCI_Disconnect_Logical_Link_Complete_Event_Mask                0x0040
+#define HCI_Flow_Spec_Modify_Complete_Event_Mask               0x0080
+#define HCI_Number_of_Completed_Data_Blocks_Event_Mask         0x0100
+#define HCI_Short_Range_Mode_Change_Complete_Event_Mask                0x1000
+#define HCI_Status_Change_Event_Mask                           0x2000
+#define HCI_All_Event_Mask                                     0x31e7
+/* AMP HCI event parameters */
+typedef BWL_PRE_PACKED_STRUCT struct cmd_status_parms {
+       uint8 status;
+       uint8 cmdpkts;
+       uint16 opcode;
+} BWL_POST_PACKED_STRUCT cmd_status_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct cmd_complete_parms {
+       uint8 cmdpkts;
+       uint16 opcode;
+       uint8 parms[1];
+} BWL_POST_PACKED_STRUCT cmd_complete_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct flush_occurred_evt_parms {
+       uint16 handle;
+} BWL_POST_PACKED_STRUCT flush_occurred_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct write_remote_evt_parms {
+       uint8 status;
+       uint8 plh;
+} BWL_POST_PACKED_STRUCT write_remote_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct read_local_evt_parms {
+       uint8 status;
+       uint8 plh;
+       uint16 len;
+       uint8 frag[1];
+} BWL_POST_PACKED_STRUCT read_local_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct read_local_info_evt_parms {
+       uint8 status;
+       uint8 AMP_status;
+       uint32 bandwidth;
+       uint32 gbandwidth;
+       uint32 latency;
+       uint32 PDU_size;
+       uint8 ctrl_type;
+       uint16 PAL_cap;
+       uint16 AMP_ASSOC_len;
+       uint32 max_flush_timeout;
+       uint32 be_flush_timeout;
+} BWL_POST_PACKED_STRUCT read_local_info_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct log_link_evt_parms {
+       uint8 status;
+       uint16 llh;
+       uint8 plh;
+       uint8 tx_fs_ID;
+} BWL_POST_PACKED_STRUCT log_link_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct disc_log_link_evt_parms {
+       uint8 status;
+       uint16 llh;
+       uint8 reason;
+} BWL_POST_PACKED_STRUCT disc_log_link_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct log_link_cancel_evt_parms {
+       uint8 status;
+       uint8 plh;
+       uint8 tx_fs_ID;
+} BWL_POST_PACKED_STRUCT log_link_cancel_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct flow_spec_mod_evt_parms {
+       uint8 status;
+       uint16 llh;
+} BWL_POST_PACKED_STRUCT flow_spec_mod_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct phy_link_evt_parms {
+       uint8 status;
+       uint8 plh;
+} BWL_POST_PACKED_STRUCT phy_link_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct dis_phy_link_evt_parms {
+       uint8 status;
+       uint8 plh;
+       uint8 reason;
+} BWL_POST_PACKED_STRUCT dis_phy_link_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct read_ls_to_evt_parms {
+       uint8 status;
+       hci_handle_t handle;
+       uint16 timeout;
+} BWL_POST_PACKED_STRUCT read_ls_to_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct read_lla_ca_to_evt_parms {
+       uint8 status;
+       uint16 timeout;
+} BWL_POST_PACKED_STRUCT read_lla_ca_to_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct read_data_block_size_evt_parms {
+       uint8 status;
+       uint16 ACL_pkt_len;
+       uint16 data_block_len;
+       uint16 data_block_num;
+} BWL_POST_PACKED_STRUCT read_data_block_size_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct data_blocks {
+       uint16 handle;
+       uint16 pkts;
+       uint16 blocks;
+} BWL_POST_PACKED_STRUCT data_blocks_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct num_completed_data_blocks_evt_parms {
+       uint16 num_blocks;
+       uint8 num_handles;
+       data_blocks_t completed[1];
+} BWL_POST_PACKED_STRUCT num_completed_data_blocks_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct befto_evt_parms {
+       uint8 status;
+       uint32 befto;
+} BWL_POST_PACKED_STRUCT befto_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct srm_evt_parms {
+       uint8 status;
+       uint8 plh;
+       uint8 srm;
+} BWL_POST_PACKED_STRUCT srm_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct contact_counter_evt_parms {
+       uint8 status;
+       uint8 llh[2];
+       uint16 counter;
+} BWL_POST_PACKED_STRUCT contact_counter_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct contact_counter_reset_evt_parms {
+       uint8 status;
+       uint8 llh[2];
+} BWL_POST_PACKED_STRUCT contact_counter_reset_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct read_linkq_evt_parms {
+       uint8 status;
+       hci_handle_t handle;
+       uint8 link_quality;
+} BWL_POST_PACKED_STRUCT read_linkq_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct ld_evt_parms {
+       uint8 status;
+       uint8 ld_aware;
+       uint8 ld[2];
+       uint8 ld_opts;
+       uint8 l_opts;
+} BWL_POST_PACKED_STRUCT ld_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct eflush_complete_evt_parms {
+       uint16 handle;
+} BWL_POST_PACKED_STRUCT eflush_complete_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct vendor_specific_evt_parms {
+       uint8 len;
+       uint8 parms[1];
+} BWL_POST_PACKED_STRUCT vendor_specific_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct local_version_info_evt_parms {
+       uint8 status;
+       uint8 hci_version;
+       uint16 hci_revision;
+       uint8 pal_version;
+       uint16 mfg_name;
+       uint16 pal_subversion;
+} BWL_POST_PACKED_STRUCT local_version_info_evt_parms_t;
+
+#define MAX_SUPPORTED_CMD_BYTE 64
+typedef BWL_PRE_PACKED_STRUCT struct local_supported_cmd_evt_parms {
+       uint8 status;
+       uint8 cmd[MAX_SUPPORTED_CMD_BYTE];
+} BWL_POST_PACKED_STRUCT local_supported_cmd_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct status_change_evt_parms {
+       uint8 status;
+       uint8 amp_status;
+} BWL_POST_PACKED_STRUCT status_change_evt_parms_t;
+
+/* AMP HCI error codes */
+#define HCI_SUCCESS                            0x00
+#define HCI_ERR_ILLEGAL_COMMAND                        0x01
+#define HCI_ERR_NO_CONNECTION                  0x02
+#define HCI_ERR_MEMORY_FULL                    0x07
+#define HCI_ERR_CONNECTION_TIMEOUT             0x08
+#define HCI_ERR_MAX_NUM_OF_CONNECTIONS         0x09
+#define HCI_ERR_CONNECTION_EXISTS              0x0B
+#define HCI_ERR_CONNECTION_DISALLOWED          0x0C
+#define HCI_ERR_CONNECTION_ACCEPT_TIMEOUT      0x10
+#define HCI_ERR_UNSUPPORTED_VALUE              0x11
+#define HCI_ERR_ILLEGAL_PARAMETER_FMT          0x12
+#define HCI_ERR_CONN_TERM_BY_LOCAL_HOST                0x16
+#define HCI_ERR_UNSPECIFIED                    0x1F
+#define HCI_ERR_UNIT_KEY_USED                  0x26
+#define HCI_ERR_QOS_REJECTED                   0x2D
+#define HCI_ERR_PARAM_OUT_OF_RANGE             0x30
+#define HCI_ERR_NO_SUITABLE_CHANNEL            0x39
+#define HCI_ERR_CHANNEL_MOVE                   0xFF
+
+/* AMP HCI ACL Data packet format */
+typedef BWL_PRE_PACKED_STRUCT struct amp_hci_ACL_data {
+       uint16  handle;                 /* 12-bit connection handle + 2-bit PB and 2-bit BC flags */
+       uint16  dlen;                   /* data total length */
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT amp_hci_ACL_data_t;
+
+#define HCI_ACL_DATA_PREAMBLE_SIZE     OFFSETOF(amp_hci_ACL_data_t, data)
+
+#define HCI_ACL_DATA_BC_FLAGS          (0x0 << 14)
+#define HCI_ACL_DATA_PB_FLAGS          (0x3 << 12)
+
+#define HCI_ACL_DATA_HANDLE(handle)    ((handle) & 0x0fff)
+#define HCI_ACL_DATA_FLAGS(handle)     ((handle) >> 12)
+
+/* AMP Activity Report packet formats */
+typedef BWL_PRE_PACKED_STRUCT struct amp_hci_activity_report {
+       uint8   ScheduleKnown;
+       uint8   NumReports;
+       uint8   data[1];
+} BWL_POST_PACKED_STRUCT amp_hci_activity_report_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct amp_hci_activity_report_triple {
+       uint32  StartTime;
+       uint32  Duration;
+       uint32  Periodicity;
+} BWL_POST_PACKED_STRUCT amp_hci_activity_report_triple_t;
+
+#define HCI_AR_SCHEDULE_KNOWN          0x01
+
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _bt_amp_hci_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/proto/eapol.h b/drivers/net/wireless/bcmdhd_1363/include/proto/eapol.h
new file mode 100644 (file)
index 0000000..e28496d
--- /dev/null
@@ -0,0 +1,215 @@
+/*
+ * 802.1x EAPOL definitions
+ *
+ * See
+ * IEEE Std 802.1X-2001
+ * IEEE 802.1X RADIUS Usage Guidelines
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: eapol.h 596466 2015-11-02 00:41:50Z $
+ */
+
+#ifndef _eapol_h_
+#define _eapol_h_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+#include <bcmcrypto/aeskeywrap.h>
+
+/* EAPOL for 802.3/Ethernet */
+typedef BWL_PRE_PACKED_STRUCT struct {
+       struct ether_header eth;        /* 802.3/Ethernet header */
+       unsigned char version;          /* EAPOL protocol version */
+       unsigned char type;             /* EAPOL type */
+       unsigned short length;          /* Length of body */
+       unsigned char body[1];          /* Body (optional) */
+} BWL_POST_PACKED_STRUCT eapol_header_t;
+
+#define EAPOL_HEADER_LEN 18
+
+typedef struct {
+       unsigned char version;          /* EAPOL protocol version */
+       unsigned char type;             /* EAPOL type */
+       unsigned short length;          /* Length of body */
+} eapol_hdr_t;
+
+#define EAPOL_HDR_LEN 4
+
+/* EAPOL version */
+#define WPA2_EAPOL_VERSION     2
+#define WPA_EAPOL_VERSION      1
+#define LEAP_EAPOL_VERSION     1
+#define SES_EAPOL_VERSION      1
+
+/* EAPOL types */
+#define EAP_PACKET             0
+#define EAPOL_START            1
+#define EAPOL_LOGOFF           2
+#define EAPOL_KEY              3
+#define EAPOL_ASF              4
+
+/* EAPOL-Key types */
+#define EAPOL_RC4_KEY          1
+#define EAPOL_WPA2_KEY         2       /* 802.11i/WPA2 */
+#define EAPOL_WPA_KEY          254     /* WPA */
+
+/* RC4 EAPOL-Key header field sizes */
+#define EAPOL_KEY_REPLAY_LEN   8
+#define EAPOL_KEY_IV_LEN       16
+#define EAPOL_KEY_SIG_LEN      16
+
+/* RC4 EAPOL-Key */
+typedef BWL_PRE_PACKED_STRUCT struct {
+       unsigned char type;                     /* Key Descriptor Type */
+       unsigned short length;                  /* Key Length (unaligned) */
+       unsigned char replay[EAPOL_KEY_REPLAY_LEN];     /* Replay Counter */
+       unsigned char iv[EAPOL_KEY_IV_LEN];             /* Key IV */
+       unsigned char index;                            /* Key Flags & Index */
+       unsigned char signature[EAPOL_KEY_SIG_LEN];     /* Key Signature */
+       unsigned char key[1];                           /* Key (optional) */
+} BWL_POST_PACKED_STRUCT eapol_key_header_t;
+
+#define EAPOL_KEY_HEADER_LEN   44
+
+/* RC4 EAPOL-Key flags */
+#define EAPOL_KEY_FLAGS_MASK   0x80
+#define EAPOL_KEY_BROADCAST    0
+#define EAPOL_KEY_UNICAST      0x80
+
+/* RC4 EAPOL-Key index */
+#define EAPOL_KEY_INDEX_MASK   0x7f
+
+/* WPA/802.11i/WPA2 EAPOL-Key header field sizes */
+#define EAPOL_WPA_KEY_REPLAY_LEN       8
+#define EAPOL_WPA_KEY_NONCE_LEN                32
+#define EAPOL_WPA_KEY_IV_LEN           16
+#define EAPOL_WPA_KEY_RSC_LEN          8
+#define EAPOL_WPA_KEY_ID_LEN           8
+#define EAPOL_WPA_KEY_MIC_LEN          16
+#define EAPOL_WPA_KEY_DATA_LEN         (EAPOL_WPA_MAX_KEY_SIZE + AKW_BLOCK_LEN)
+#define EAPOL_WPA_MAX_KEY_SIZE         32
+
+/* WPA EAPOL-Key */
+typedef BWL_PRE_PACKED_STRUCT struct {
+       unsigned char type;             /* Key Descriptor Type */
+       unsigned short key_info;        /* Key Information (unaligned) */
+       unsigned short key_len;         /* Key Length (unaligned) */
+       unsigned char replay[EAPOL_WPA_KEY_REPLAY_LEN]; /* Replay Counter */
+       unsigned char nonce[EAPOL_WPA_KEY_NONCE_LEN];   /* Nonce */
+       unsigned char iv[EAPOL_WPA_KEY_IV_LEN];         /* Key IV */
+       unsigned char rsc[EAPOL_WPA_KEY_RSC_LEN];       /* Key RSC */
+       unsigned char id[EAPOL_WPA_KEY_ID_LEN];         /* WPA:Key ID, 802.11i/WPA2: Reserved */
+       unsigned char mic[EAPOL_WPA_KEY_MIC_LEN];       /* Key MIC */
+       unsigned short data_len;                        /* Key Data Length */
+       unsigned char data[EAPOL_WPA_KEY_DATA_LEN];     /* Key data */
+} BWL_POST_PACKED_STRUCT eapol_wpa_key_header_t;
+
+#define EAPOL_WPA_KEY_LEN              95
+
+/* WPA/802.11i/WPA2 KEY KEY_INFO bits */
+#define WPA_KEY_DESC_OSEN      0x0
+#define WPA_KEY_DESC_V1                0x01
+#define WPA_KEY_DESC_V2                0x02
+#define WPA_KEY_DESC_V3                0x03
+#define WPA_KEY_PAIRWISE       0x08
+#define WPA_KEY_INSTALL                0x40
+#define WPA_KEY_ACK            0x80
+#define WPA_KEY_MIC            0x100
+#define WPA_KEY_SECURE         0x200
+#define WPA_KEY_ERROR          0x400
+#define WPA_KEY_REQ            0x800
+
+#define WPA_KEY_DESC_V2_OR_V3 WPA_KEY_DESC_V2
+
+/* WPA-only KEY KEY_INFO bits */
+#define WPA_KEY_INDEX_0                0x00
+#define WPA_KEY_INDEX_1                0x10
+#define WPA_KEY_INDEX_2                0x20
+#define WPA_KEY_INDEX_3                0x30
+#define WPA_KEY_INDEX_MASK     0x30
+#define WPA_KEY_INDEX_SHIFT    0x04
+
+/* 802.11i/WPA2-only KEY KEY_INFO bits */
+#define WPA_KEY_ENCRYPTED_DATA 0x1000
+
+/* Key Data encapsulation */
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint8 type;
+       uint8 length;
+       uint8 oui[3];
+       uint8 subtype;
+       uint8 data[1];
+} BWL_POST_PACKED_STRUCT eapol_wpa2_encap_data_t;
+
+#define EAPOL_WPA2_ENCAP_DATA_HDR_LEN  6
+
+#define WPA2_KEY_DATA_SUBTYPE_GTK      1
+#define WPA2_KEY_DATA_SUBTYPE_STAKEY   2
+#define WPA2_KEY_DATA_SUBTYPE_MAC      3
+#define WPA2_KEY_DATA_SUBTYPE_PMKID    4
+#define WPA2_KEY_DATA_SUBTYPE_IGTK     9
+
+/* GTK encapsulation */
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint8   flags;
+       uint8   reserved;
+       uint8   gtk[EAPOL_WPA_MAX_KEY_SIZE];
+} BWL_POST_PACKED_STRUCT eapol_wpa2_key_gtk_encap_t;
+
+#define EAPOL_WPA2_KEY_GTK_ENCAP_HDR_LEN       2
+
+#define WPA2_GTK_INDEX_MASK    0x03
+#define WPA2_GTK_INDEX_SHIFT   0x00
+
+#define WPA2_GTK_TRANSMIT      0x04
+
+/* IGTK encapsulation */
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint16  key_id;
+       uint8   ipn[6];
+       uint8   key[EAPOL_WPA_MAX_KEY_SIZE];
+} BWL_POST_PACKED_STRUCT eapol_wpa2_key_igtk_encap_t;
+
+#define EAPOL_WPA2_KEY_IGTK_ENCAP_HDR_LEN      8
+
+/* STAKey encapsulation */
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint8   reserved[2];
+       uint8   mac[ETHER_ADDR_LEN];
+       uint8   stakey[EAPOL_WPA_MAX_KEY_SIZE];
+} BWL_POST_PACKED_STRUCT eapol_wpa2_key_stakey_encap_t;
+
+#define WPA2_KEY_DATA_PAD      0xdd
+
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _eapol_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/proto/ethernet.h b/drivers/net/wireless/bcmdhd_1363/include/proto/ethernet.h
new file mode 100644 (file)
index 0000000..d3a2e97
--- /dev/null
@@ -0,0 +1,227 @@
+/*
+ * From FreeBSD 2.2.7: Fundamental constants relating to ethernet.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: ethernet.h 518342 2014-12-01 23:21:41Z $
+ */
+
+#ifndef _NET_ETHERNET_H_       /* use native BSD ethernet.h when available */
+#define _NET_ETHERNET_H_
+
+#ifndef _TYPEDEFS_H_
+#include "typedefs.h"
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+
+/*
+ * The number of bytes in an ethernet (MAC) address.
+ */
+#define        ETHER_ADDR_LEN          6
+
+/*
+ * The number of bytes in the type field.
+ */
+#define        ETHER_TYPE_LEN          2
+
+/*
+ * The number of bytes in the trailing CRC field.
+ */
+#define        ETHER_CRC_LEN           4
+
+/*
+ * The length of the combined header.
+ */
+#define        ETHER_HDR_LEN           (ETHER_ADDR_LEN * 2 + ETHER_TYPE_LEN)
+
+/*
+ * The minimum packet length.
+ */
+#define        ETHER_MIN_LEN           64
+
+/*
+ * The minimum packet user data length.
+ */
+#define        ETHER_MIN_DATA          46
+
+/*
+ * The maximum packet length.
+ */
+#define        ETHER_MAX_LEN           1518
+
+/*
+ * The maximum packet user data length.
+ */
+#define        ETHER_MAX_DATA          1500
+
+/* ether types */
+#define ETHER_TYPE_MIN         0x0600          /* Anything less than MIN is a length */
+#define        ETHER_TYPE_IP           0x0800          /* IP */
+#define ETHER_TYPE_ARP         0x0806          /* ARP */
+#define ETHER_TYPE_8021Q       0x8100          /* 802.1Q */
+#define        ETHER_TYPE_IPV6         0x86dd          /* IPv6 */
+#define        ETHER_TYPE_BRCM         0x886c          /* Broadcom Corp. */
+#define        ETHER_TYPE_802_1X       0x888e          /* 802.1x */
+#define        ETHER_TYPE_802_1X_PREAUTH 0x88c7        /* 802.1x preauthentication */
+#define ETHER_TYPE_WAI         0x88b4          /* WAI */
+#define ETHER_TYPE_89_0D       0x890d          /* 89-0d frame for TDLS */
+#define ETHER_TYPE_RRB         ETHER_TYPE_89_0D  /* RRB 802.11r 2008 */
+
+#define ETHER_TYPE_PPP_SES     0x8864          /* PPPoE Session */
+
+#define ETHER_TYPE_IAPP_L2_UPDATE      0x6     /* IAPP L2 update frame */
+
+/* Broadcom subtype follows ethertype;  First 2 bytes are reserved; Next 2 are subtype; */
+#define        ETHER_BRCM_SUBTYPE_LEN  4       /* Broadcom 4 byte subtype */
+
+/* ether header */
+#define ETHER_DEST_OFFSET      (0 * ETHER_ADDR_LEN)    /* dest address offset */
+#define ETHER_SRC_OFFSET       (1 * ETHER_ADDR_LEN)    /* src address offset */
+#define ETHER_TYPE_OFFSET      (2 * ETHER_ADDR_LEN)    /* ether type offset */
+
+/*
+ * A macro to validate a length with
+ */
+#define        ETHER_IS_VALID_LEN(foo) \
+       ((foo) >= ETHER_MIN_LEN && (foo) <= ETHER_MAX_LEN)
+
+#define ETHER_FILL_MCAST_ADDR_FROM_IP(ea, mgrp_ip) {           \
+               ((uint8 *)ea)[0] = 0x01;                        \
+               ((uint8 *)ea)[1] = 0x00;                        \
+               ((uint8 *)ea)[2] = 0x5e;                        \
+               ((uint8 *)ea)[3] = ((mgrp_ip) >> 16) & 0x7f;    \
+               ((uint8 *)ea)[4] = ((mgrp_ip) >>  8) & 0xff;    \
+               ((uint8 *)ea)[5] = ((mgrp_ip) >>  0) & 0xff;    \
+}
+
+#ifndef __INCif_etherh /* Quick and ugly hack for VxWorks */
+/*
+ * Structure of a 10Mb/s Ethernet header.
+ */
+BWL_PRE_PACKED_STRUCT struct ether_header {
+       uint8   ether_dhost[ETHER_ADDR_LEN];
+       uint8   ether_shost[ETHER_ADDR_LEN];
+       uint16  ether_type;
+} BWL_POST_PACKED_STRUCT;
+
+/*
+ * Structure of a 48-bit Ethernet address.
+ */
+BWL_PRE_PACKED_STRUCT struct   ether_addr {
+       uint8 octet[ETHER_ADDR_LEN];
+} BWL_POST_PACKED_STRUCT;
+#endif /* !__INCif_etherh Quick and ugly hack for VxWorks */
+
+/*
+ * Takes a pointer, set, test, clear, toggle locally admininistered
+ * address bit in the 48-bit Ethernet address.
+ */
+#define ETHER_SET_LOCALADDR(ea)        (((uint8 *)(ea))[0] = (((uint8 *)(ea))[0] | 2))
+#define ETHER_IS_LOCALADDR(ea)         (((uint8 *)(ea))[0] & 2)
+#define ETHER_CLR_LOCALADDR(ea)        (((uint8 *)(ea))[0] = (((uint8 *)(ea))[0] & 0xfd))
+#define ETHER_TOGGLE_LOCALADDR(ea)     (((uint8 *)(ea))[0] = (((uint8 *)(ea))[0] ^ 2))
+
+/* Takes a pointer, marks unicast address bit in the MAC address */
+#define ETHER_SET_UNICAST(ea)  (((uint8 *)(ea))[0] = (((uint8 *)(ea))[0] & ~1))
+
+/*
+ * Takes a pointer, returns true if a 48-bit multicast address
+ * (including broadcast, since it is all ones)
+ */
+#define ETHER_ISMULTI(ea) (((const uint8 *)(ea))[0] & 1)
+
+
+/* compare two ethernet addresses - assumes the pointers can be referenced as shorts */
+#define eacmp(a, b)    ((((const uint16 *)(a))[0] ^ ((const uint16 *)(b))[0]) | \
+                        (((const uint16 *)(a))[1] ^ ((const uint16 *)(b))[1]) | \
+                        (((const uint16 *)(a))[2] ^ ((const uint16 *)(b))[2]))
+
+#define        ether_cmp(a, b) eacmp(a, b)
+
+/* copy an ethernet address - assumes the pointers can be referenced as shorts */
+#define eacopy(s, d) \
+do { \
+       ((uint16 *)(d))[0] = ((const uint16 *)(s))[0]; \
+       ((uint16 *)(d))[1] = ((const uint16 *)(s))[1]; \
+       ((uint16 *)(d))[2] = ((const uint16 *)(s))[2]; \
+} while (0)
+
+#define        ether_copy(s, d) eacopy(s, d)
+
+/* Copy an ethernet address in reverse order */
+#define        ether_rcopy(s, d) \
+do { \
+       ((uint16 *)(d))[2] = ((uint16 *)(s))[2]; \
+       ((uint16 *)(d))[1] = ((uint16 *)(s))[1]; \
+       ((uint16 *)(d))[0] = ((uint16 *)(s))[0]; \
+} while (0)
+
+/* Copy 14B ethernet header: 32bit aligned source and destination. */
+#define ehcopy32(s, d) \
+do { \
+       ((uint32 *)(d))[0] = ((const uint32 *)(s))[0]; \
+       ((uint32 *)(d))[1] = ((const uint32 *)(s))[1]; \
+       ((uint32 *)(d))[2] = ((const uint32 *)(s))[2]; \
+       ((uint16 *)(d))[6] = ((const uint16 *)(s))[6]; \
+} while (0)
+
+
+static const struct ether_addr ether_bcast = {{255, 255, 255, 255, 255, 255}};
+static const struct ether_addr ether_null = {{0, 0, 0, 0, 0, 0}};
+static const struct ether_addr ether_ipv6_mcast = {{0x33, 0x33, 0x00, 0x00, 0x00, 0x01}};
+
+#define ETHER_ISBCAST(ea)      ((((const uint8 *)(ea))[0] &            \
+                                 ((const uint8 *)(ea))[1] &            \
+                                 ((const uint8 *)(ea))[2] &            \
+                                 ((const uint8 *)(ea))[3] &            \
+                                 ((const uint8 *)(ea))[4] &            \
+                                 ((const uint8 *)(ea))[5]) == 0xff)
+#define ETHER_ISNULLADDR(ea)   ((((const uint8 *)(ea))[0] |            \
+                                 ((const uint8 *)(ea))[1] |            \
+                                 ((const uint8 *)(ea))[2] |            \
+                                 ((const uint8 *)(ea))[3] |            \
+                                 ((const uint8 *)(ea))[4] |            \
+                                 ((const uint8 *)(ea))[5]) == 0)
+
+#define ETHER_ISNULLDEST(da)   ((((const uint16 *)(da))[0] |           \
+                                 ((const uint16 *)(da))[1] |           \
+                                 ((const uint16 *)(da))[2]) == 0)
+#define ETHER_ISNULLSRC(sa)    ETHER_ISNULLDEST(sa)
+
+#define ETHER_MOVE_HDR(d, s) \
+do { \
+       struct ether_header t; \
+       t = *(struct ether_header *)(s); \
+       *(struct ether_header *)(d) = t; \
+} while (0)
+
+#define  ETHER_ISUCAST(ea) ((((uint8 *)(ea))[0] & 0x01) == 0)
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _NET_ETHERNET_H_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/proto/event_log_set.h b/drivers/net/wireless/bcmdhd_1363/include/proto/event_log_set.h
new file mode 100644 (file)
index 0000000..3e0a129
--- /dev/null
@@ -0,0 +1,46 @@
+/*
+ * EVENT_LOG system definitions
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: event_log_set.h 585396 2015-09-10 09:04:56Z $
+ */
+
+#ifndef _EVENT_LOG_SET_H_
+#define _EVENT_LOG_SET_H_
+
+/* Set a maximum number of sets here.  It is not dynamic for
+ *  efficiency of the EVENT_LOG calls.
+ */
+#define NUM_EVENT_LOG_SETS 8
+
+/* Define new event log sets here */
+#define EVENT_LOG_SET_BUS      0
+#define EVENT_LOG_SET_WL       1
+#define EVENT_LOG_SET_PSM      2
+#define EVENT_LOG_SET_ERROR    3
+#define EVENT_LOG_SET_MEM_API  4
+#define EVENT_LOG_SET_ECOUNTERS 5      /* Host to instantiate this for ecounters. */
+
+#endif /* _EVENT_LOG_SET_H_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/proto/event_log_tag.h b/drivers/net/wireless/bcmdhd_1363/include/proto/event_log_tag.h
new file mode 100644 (file)
index 0000000..b46372c
--- /dev/null
@@ -0,0 +1,206 @@
+/*
+ * EVENT_LOG system definitions
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: event_log_tag.h 658234 2016-09-07 04:42:39Z $
+ */
+
+#ifndef _EVENT_LOG_TAG_H_
+#define _EVENT_LOG_TAG_H_
+
+#include <typedefs.h>
+
+/* Define new event log tags here */
+#define EVENT_LOG_TAG_NULL     0       /* Special null tag */
+#define EVENT_LOG_TAG_TS       1       /* Special timestamp tag */
+#define EVENT_LOG_TAG_BUS_OOB  2
+#define EVENT_LOG_TAG_BUS_STATE        3
+#define EVENT_LOG_TAG_BUS_PROTO        4
+#define EVENT_LOG_TAG_BUS_CTL  5
+#define EVENT_LOG_TAG_BUS_EVENT        6
+#define EVENT_LOG_TAG_BUS_PKT  7
+#define EVENT_LOG_TAG_BUS_FRAME        8
+#define EVENT_LOG_TAG_BUS_DESC 9
+#define EVENT_LOG_TAG_BUS_SETUP        10
+#define EVENT_LOG_TAG_BUS_MISC 11
+#define EVENT_LOG_TAG_SRSCAN           22
+#define EVENT_LOG_TAG_PWRSTATS_INFO    23
+#define EVENT_LOG_TAG_UCODE_WATCHDOG 26
+#define EVENT_LOG_TAG_UCODE_FIFO 27
+#define EVENT_LOG_TAG_SCAN_TRACE_LOW   28
+#define EVENT_LOG_TAG_SCAN_TRACE_HIGH  29
+#define EVENT_LOG_TAG_SCAN_ERROR       30
+#define EVENT_LOG_TAG_SCAN_WARN        31
+#define EVENT_LOG_TAG_MPF_ERR  32
+#define EVENT_LOG_TAG_MPF_WARN 33
+#define EVENT_LOG_TAG_MPF_INFO 34
+#define EVENT_LOG_TAG_MPF_DEBUG        35
+#define EVENT_LOG_TAG_EVENT_INFO       36
+#define EVENT_LOG_TAG_EVENT_ERR        37
+#define EVENT_LOG_TAG_PWRSTATS_ERROR   38
+#define EVENT_LOG_TAG_EXCESS_PM_ERROR  39
+#define EVENT_LOG_TAG_IOCTL_LOG                        40
+#define EVENT_LOG_TAG_PFN_ERR  41
+#define EVENT_LOG_TAG_PFN_WARN 42
+#define EVENT_LOG_TAG_PFN_INFO 43
+#define EVENT_LOG_TAG_PFN_DEBUG        44
+#define EVENT_LOG_TAG_BEACON_LOG       45
+#define EVENT_LOG_TAG_WNM_BSSTRANS_INFO 46
+#define EVENT_LOG_TAG_TRACE_CHANSW 47
+#define EVENT_LOG_TAG_PCI_ERROR        48
+#define EVENT_LOG_TAG_PCI_TRACE        49
+#define EVENT_LOG_TAG_PCI_WARN 50
+#define EVENT_LOG_TAG_PCI_INFO 51
+#define EVENT_LOG_TAG_PCI_DBG  52
+#define EVENT_LOG_TAG_PCI_DATA  53
+#define EVENT_LOG_TAG_PCI_RING 54
+/* EVENT_LOG_TAG_AWDL_TRACE_RANGING will be removed after wlc_ranging merge from IGUANA
+ * keeping it here to avoid compilation error on trunk
+ */
+#define EVENT_LOG_TAG_AWDL_TRACE_RANGING       55
+#define EVENT_LOG_TAG_RANGING_TRACE    55
+#define EVENT_LOG_TAG_WL_ERROR         56
+#define EVENT_LOG_TAG_PHY_ERROR                57
+#define EVENT_LOG_TAG_OTP_ERROR                58
+#define EVENT_LOG_TAG_NOTIF_ERROR      59
+#define EVENT_LOG_TAG_MPOOL_ERROR      60
+#define EVENT_LOG_TAG_OBJR_ERROR       61
+#define EVENT_LOG_TAG_DMA_ERROR                62
+#define EVENT_LOG_TAG_PMU_ERROR                63
+#define EVENT_LOG_TAG_BSROM_ERROR      64
+#define EVENT_LOG_TAG_SI_ERROR         65
+#define EVENT_LOG_TAG_ROM_PRINTF       66
+#define EVENT_LOG_TAG_RATE_CNT         67
+#define EVENT_LOG_TAG_CTL_MGT_CNT      68
+#define EVENT_LOG_TAG_AMPDU_DUMP       69
+#define EVENT_LOG_TAG_MEM_ALLOC_SUCC   70
+#define EVENT_LOG_TAG_MEM_ALLOC_FAIL   71
+#define EVENT_LOG_TAG_MEM_FREE         72
+#define EVENT_LOG_TAG_WL_ASSOC_LOG     73
+#define EVENT_LOG_TAG_WL_PS_LOG                74
+#define EVENT_LOG_TAG_WL_ROAM_LOG      75
+#define EVENT_LOG_TAG_WL_MPC_LOG       76
+#define EVENT_LOG_TAG_WL_WSEC_LOG      77
+#define EVENT_LOG_TAG_WL_WSEC_DUMP     78
+#define EVENT_LOG_TAG_WL_MCNX_LOG      79
+#define EVENT_LOG_TAG_HEALTH_CHECK_ERROR 80
+#define EVENT_LOG_TAG_HNDRTE_EVENT_ERROR 81
+#define EVENT_LOG_TAG_ECOUNTERS_ERROR  82
+#define EVENT_LOG_TAG_WL_COUNTERS      83
+#define EVENT_LOG_TAG_ECOUNTERS_IPCSTATS       84
+#define EVENT_LOG_TAG_WL_P2P_LOG            85
+#define EVENT_LOG_TAG_SDIO_ERROR               86
+#define EVENT_LOG_TAG_SDIO_TRACE               87
+#define EVENT_LOG_TAG_SDIO_DBG          88
+#define EVENT_LOG_TAG_SDIO_PRHDRS              89
+#define EVENT_LOG_TAG_SDIO_PRPKT               90
+#define EVENT_LOG_TAG_SDIO_INFORM              91
+#define EVENT_LOG_TAG_MIMO_PS_ERROR    92
+#define EVENT_LOG_TAG_MIMO_PS_TRACE    93
+#define EVENT_LOG_TAG_MIMO_PS_INFO     94
+#define EVENT_LOG_TAG_BTCX_STATS       95
+#define EVENT_LOG_TAG_LEAKY_AP_STATS   96
+#define EVENT_LOG_TAG_AWDL_TRACE_ELECTION      97
+#define EVENT_LOG_TAG_MIMO_PS_STATS    98
+#define EVENT_LOG_TAG_PWRSTATS_PHY     99
+#define EVENT_LOG_TAG_PWRSTATS_SCAN    100
+#define EVENT_LOG_TAG_PWRSTATS_AWDL    101
+#define EVENT_LOG_TAG_PWRSTATS_WAKE_V2 102
+#define EVENT_LOG_TAG_LQM              103
+#define EVENT_LOG_TAG_TRACE_WL_INFO    104
+#define EVENT_LOG_TAG_TRACE_BTCOEX_INFO        105
+#define EVENT_LOG_TAG_ECOUNTERS_TIME_DATA      106
+#define EVENT_LOG_TAG_NAN_ERROR                107
+#define EVENT_LOG_TAG_NAN_INFO         108
+#define EVENT_LOG_TAG_NAN_DBG          109
+#define EVENT_LOG_TAG_STF_ARBITRATOR_ERROR     110
+#define EVENT_LOG_TAG_STF_ARBITRATOR_TRACE     111
+#define EVENT_LOG_TAG_STF_ARBITRATOR_WARN      112
+#define EVENT_LOG_TAG_SCAN_SUMMARY             113
+#define EVENT_LOG_TAG_PROXD_SAMPLE_COLLECT     114
+#define EVENT_LOG_TAG_OCL_INFO                 115
+#define EVENT_LOG_TAG_RSDB_PMGR_DEBUG          116
+#define EVENT_LOG_TAG_RSDB_PMGR_ERR            117
+#define EVENT_LOG_TAG_NAT_ERR                   118
+#define EVENT_LOG_TAG_NAT_WARN                  119
+#define EVENT_LOG_TAG_NAT_INFO                  120
+#define EVENT_LOG_TAG_NAT_DEBUG                 121
+#define EVENT_LOG_TAG_STA_INFO                 122
+#define EVENT_LOG_TAG_PROXD_ERROR              123
+#define EVENT_LOG_TAG_PROXD_TRACE              124
+#define EVENT_LOG_TAG_PROXD_INFO               125
+#define EVENT_LOG_TAG_IE_ERROR                 126
+#define EVENT_LOG_TAG_ASSOC_ERROR              127
+#define EVENT_LOG_TAG_SCAN_ERR                 128
+#define EVENT_LOG_TAG_AMSDU_ERROR              129
+#define EVENT_LOG_TAG_AMPDU_ERROR              130
+#define EVENT_LOG_TAG_KM_ERROR                 131
+#define EVENT_LOG_TAG_DFS                      132
+#define EVENT_LOG_TAG_REGULATORY               133
+#define EVENT_LOG_TAG_CSA                      134
+#define EVENT_LOG_TAG_WNM_BSSTRANS_ERR         135
+#define EVENT_LOG_TAG_SUP_INFO                 136
+#define EVENT_LOG_TAG_SUP_ERROR                        137
+#define EVENT_LOG_TAG_CHANCTXT_TRACE           138
+#define EVENT_LOG_TAG_CHANCTXT_INFO            139
+#define EVENT_LOG_TAG_CHANCTXT_ERROR           140
+#define EVENT_LOG_TAG_CHANCTXT_WARN            141
+#define EVENT_LOG_TAG_MSCHPROFILE              142
+#define EVENT_LOG_TAG_4WAYHANDSHAKE            143
+#define EVENT_LOG_TAG_MSCHPROFILE_TLV          144
+#define EVENT_LOG_TAG_AUTH_ERROR               145
+#define EVENT_LOG_TAG_AUTH_INFO                        146
+#define EVENT_LOG_TAG_AUTH_DBG                 147
+
+
+/* EVENT_LOG_TAG_MAX   = Set to the same value of last tag, not last tag + 1 */
+#define EVENT_LOG_TAG_MAX                      147
+/* Note: New event should be added/reserved in trunk before adding it to branches */
+
+
+#define        SD_PRHDRS(i, s, h, p, n, l)
+#define        SD_PRPKT(m, b, n)
+#define        SD_INFORM(args)
+
+/* Flags for tag control */
+#define EVENT_LOG_TAG_FLAG_NONE                0
+#define EVENT_LOG_TAG_FLAG_LOG         0x80
+#define EVENT_LOG_TAG_FLAG_PRINT       0x40
+#define EVENT_LOG_TAG_FLAG_SET_MASK    0x3f
+
+/* Each event log entry has a type.  The type is the LAST word of the
+ * event log.  The printing code walks the event entries in reverse
+ * order to find the first entry.
+ */
+typedef union event_log_hdr {
+       struct {
+               uint8 tag;              /* Event_log entry tag */
+               uint8 count;            /* Count of 4-byte entries */
+               uint16 fmt_num;         /* Format number */
+       };
+       uint32 t;                       /* Type cheat */
+} event_log_hdr_t;
+
+#endif /* _EVENT_LOG_TAG_H_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/proto/p2p.h b/drivers/net/wireless/bcmdhd_1363/include/proto/p2p.h
new file mode 100644 (file)
index 0000000..747265b
--- /dev/null
@@ -0,0 +1,713 @@
+/*
+ * Fundamental types and constants relating to WFA P2P (aka WiFi Direct)
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: p2p.h 536785 2015-02-24 08:35:00Z $
+ */
+
+#ifndef _P2P_H_
+#define _P2P_H_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+#include <wlioctl.h>
+#include <proto/802.11.h>
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+
+/* WiFi P2P OUI values */
+#define P2P_OUI                        WFA_OUI                 /* WiFi P2P OUI */
+#define P2P_VER                        WFA_OUI_TYPE_P2P        /* P2P version: 9=WiFi P2P v1.0 */
+
+#define P2P_IE_ID              0xdd                    /* P2P IE element ID */
+
+/* WiFi P2P IE */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_ie {
+       uint8   id;             /* IE ID: 0xDD */
+       uint8   len;            /* IE length */
+       uint8   OUI[3];         /* WiFi P2P specific OUI: P2P_OUI */
+       uint8   oui_type;       /* Identifies P2P version: P2P_VER */
+       uint8   subelts[1];     /* variable length subelements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_ie wifi_p2p_ie_t;
+
+#define P2P_IE_FIXED_LEN       6
+
+#define P2P_ATTR_ID_OFF                0
+#define P2P_ATTR_LEN_OFF       1
+#define P2P_ATTR_DATA_OFF      3
+
+#define P2P_ATTR_ID_LEN                1       /* ID filed length */
+#define P2P_ATTR_LEN_LEN       2       /* length field length */
+#define P2P_ATTR_HDR_LEN       3 /* ID + 2-byte length field spec 1.02 */
+
+#define P2P_WFDS_HASH_LEN              6
+#define P2P_WFDS_MAX_SVC_NAME_LEN      32
+
+/* P2P IE Subelement IDs from WiFi P2P Technical Spec 1.00 */
+#define P2P_SEID_STATUS                        0       /* Status */
+#define P2P_SEID_MINOR_RC              1       /* Minor Reason Code */
+#define P2P_SEID_P2P_INFO              2       /* P2P Capability (capabilities info) */
+#define P2P_SEID_DEV_ID                        3       /* P2P Device ID */
+#define P2P_SEID_INTENT                        4       /* Group Owner Intent */
+#define P2P_SEID_CFG_TIMEOUT           5       /* Configuration Timeout */
+#define P2P_SEID_CHANNEL               6       /* Listen channel */
+#define P2P_SEID_GRP_BSSID             7       /* P2P Group BSSID */
+#define P2P_SEID_XT_TIMING             8       /* Extended Listen Timing */
+#define P2P_SEID_INTINTADDR            9       /* Intended P2P Interface Address */
+#define P2P_SEID_P2P_MGBTY             10      /* P2P Manageability */
+#define P2P_SEID_CHAN_LIST             11      /* Channel List */
+#define P2P_SEID_ABSENCE               12      /* Notice of Absence */
+#define P2P_SEID_DEV_INFO              13      /* Device Info */
+#define P2P_SEID_GROUP_INFO            14      /* Group Info */
+#define P2P_SEID_GROUP_ID              15      /* Group ID */
+#define P2P_SEID_P2P_IF                        16      /* P2P Interface */
+#define P2P_SEID_OP_CHANNEL            17      /* Operating Channel */
+#define P2P_SEID_INVITE_FLAGS          18      /* Invitation Flags */
+#define P2P_SEID_SERVICE_HASH          21      /* Service hash */
+#define P2P_SEID_SESSION               22      /* Session information */
+#define P2P_SEID_CONNECT_CAP           23      /* Connection capability */
+#define P2P_SEID_ADVERTISE_ID          24      /* Advertisement ID */
+#define P2P_SEID_ADVERTISE_SERVICE     25      /* Advertised service */
+#define P2P_SEID_SESSION_ID            26      /* Session ID */
+#define P2P_SEID_FEATURE_CAP           27      /* Feature capability */
+#define        P2P_SEID_PERSISTENT_GROUP       28      /* Persistent group */
+#define P2P_SEID_SESSION_INFO_RESP     29      /* Session Information Response */
+#define P2P_SEID_VNDR                  221     /* Vendor-specific subelement */
+
+#define P2P_SE_VS_ID_SERVICES  0x1b
+
+
+/* WiFi P2P IE subelement: P2P Capability (capabilities info) */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_info_se_s {
+       uint8   eltId;          /* SE ID: P2P_SEID_P2P_INFO */
+       uint8   len[2];         /* SE length not including eltId, len fields */
+       uint8   dev;            /* Device Capability Bitmap */
+       uint8   group;          /* Group Capability Bitmap */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_info_se_s wifi_p2p_info_se_t;
+
+/* P2P Capability subelement's Device Capability Bitmap bit values */
+#define P2P_CAPSE_DEV_SERVICE_DIS      0x1 /* Service Discovery */
+#define P2P_CAPSE_DEV_CLIENT_DIS       0x2 /* Client Discoverability */
+#define P2P_CAPSE_DEV_CONCURRENT       0x4 /* Concurrent Operation */
+#define P2P_CAPSE_DEV_INFRA_MAN                0x8 /* P2P Infrastructure Managed */
+#define P2P_CAPSE_DEV_LIMIT                    0x10 /* P2P Device Limit */
+#define P2P_CAPSE_INVITE_PROC          0x20 /* P2P Invitation Procedure */
+
+/* P2P Capability subelement's Group Capability Bitmap bit values */
+#define P2P_CAPSE_GRP_OWNER                    0x1 /* P2P Group Owner */
+#define P2P_CAPSE_PERSIST_GRP          0x2 /* Persistent P2P Group */
+#define P2P_CAPSE_GRP_LIMIT                    0x4 /* P2P Group Limit */
+#define P2P_CAPSE_GRP_INTRA_BSS                0x8 /* Intra-BSS Distribution */
+#define P2P_CAPSE_GRP_X_CONNECT                0x10 /* Cross Connection */
+#define P2P_CAPSE_GRP_PERSISTENT       0x20 /* Persistent Reconnect */
+#define P2P_CAPSE_GRP_FORMATION                0x40 /* Group Formation */
+
+
+/* WiFi P2P IE subelement: Group Owner Intent */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_intent_se_s {
+       uint8   eltId;          /* SE ID: P2P_SEID_INTENT */
+       uint8   len[2];         /* SE length not including eltId, len fields */
+       uint8   intent;         /* Intent Value 0...15 (0=legacy 15=master only) */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_intent_se_s wifi_p2p_intent_se_t;
+
+/* WiFi P2P IE subelement: Configuration Timeout */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_cfg_tmo_se_s {
+       uint8   eltId;          /* SE ID: P2P_SEID_CFG_TIMEOUT */
+       uint8   len[2];         /* SE length not including eltId, len fields */
+       uint8   go_tmo;         /* GO config timeout in units of 10 ms */
+       uint8   client_tmo;     /* Client config timeout in units of 10 ms */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_cfg_tmo_se_s wifi_p2p_cfg_tmo_se_t;
+
+/* WiFi P2P IE subelement: Listen Channel */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_listen_channel_se_s {
+       uint8   eltId;          /* SE ID: P2P_SEID_CHANNEL */
+       uint8   len[2];         /* SE length not including eltId, len fields */
+       uint8   country[3];     /* Country String */
+       uint8   op_class;       /* Operating Class */
+       uint8   channel;        /* Channel */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_listen_channel_se_s wifi_p2p_listen_channel_se_t;
+
+/* WiFi P2P IE subelement: P2P Group BSSID */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_grp_bssid_se_s {
+       uint8   eltId;          /* SE ID: P2P_SEID_GRP_BSSID */
+       uint8   len[2];         /* SE length not including eltId, len fields */
+       uint8   mac[6];         /* P2P group bssid */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_grp_bssid_se_s wifi_p2p_grp_bssid_se_t;
+
+/* WiFi P2P IE subelement: P2P Group ID */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_grp_id_se_s {
+       uint8   eltId;          /* SE ID: P2P_SEID_GROUP_ID */
+       uint8   len[2];         /* SE length not including eltId, len fields */
+       uint8   mac[6];         /* P2P device address */
+       uint8   ssid[1];        /* ssid. device id. variable length */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_grp_id_se_s wifi_p2p_grp_id_se_t;
+
+/* WiFi P2P IE subelement: P2P Interface */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_intf_se_s {
+       uint8   eltId;          /* SE ID: P2P_SEID_P2P_IF */
+       uint8   len[2];         /* SE length not including eltId, len fields */
+       uint8   mac[6];         /* P2P device address */
+       uint8   ifaddrs;        /* P2P Interface Address count */
+       uint8   ifaddr[1][6];   /* P2P Interface Address list */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_intf_se_s wifi_p2p_intf_se_t;
+
+/* WiFi P2P IE subelement: Status */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_status_se_s {
+       uint8   eltId;          /* SE ID: P2P_SEID_STATUS */
+       uint8   len[2];         /* SE length not including eltId, len fields */
+       uint8   status;         /* Status Code: P2P_STATSE_* */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_status_se_s wifi_p2p_status_se_t;
+
+/* Status subelement Status Code definitions */
+#define P2P_STATSE_SUCCESS                     0
+                               /* Success */
+#define P2P_STATSE_FAIL_INFO_CURR_UNAVAIL      1
+                               /* Failed, information currently unavailable */
+#define P2P_STATSE_PASSED_UP                   P2P_STATSE_FAIL_INFO_CURR_UNAVAIL
+                               /* Old name for above in P2P spec 1.08 and older */
+#define P2P_STATSE_FAIL_INCOMPAT_PARAMS                2
+                               /* Failed, incompatible parameters */
+#define P2P_STATSE_FAIL_LIMIT_REACHED          3
+                               /* Failed, limit reached */
+#define P2P_STATSE_FAIL_INVALID_PARAMS         4
+                               /* Failed, invalid parameters */
+#define P2P_STATSE_FAIL_UNABLE_TO_ACCOM                5
+                               /* Failed, unable to accomodate request */
+#define P2P_STATSE_FAIL_PROTO_ERROR            6
+                               /* Failed, previous protocol error or disruptive behaviour */
+#define P2P_STATSE_FAIL_NO_COMMON_CHAN         7
+                               /* Failed, no common channels */
+#define P2P_STATSE_FAIL_UNKNOWN_GROUP          8
+                               /* Failed, unknown P2P Group */
+#define P2P_STATSE_FAIL_INTENT                 9
+                               /* Failed, both peers indicated Intent 15 in GO Negotiation */
+#define P2P_STATSE_FAIL_INCOMPAT_PROVIS                10
+                               /* Failed, incompatible provisioning method */
+#define P2P_STATSE_FAIL_USER_REJECT            11
+                               /* Failed, rejected by user */
+#define P2P_STATSE_SUCCESS_USER_ACCEPT         12
+                               /* Success, accepted by user */
+
+/* WiFi P2P IE attribute: Extended Listen Timing */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_ext_se_s {
+       uint8   eltId;          /* ID: P2P_SEID_EXT_TIMING */
+       uint8   len[2];         /* length not including eltId, len fields */
+       uint8   avail[2];       /* availibility period */
+       uint8   interval[2];    /* availibility interval */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_ext_se_s wifi_p2p_ext_se_t;
+
+#define P2P_EXT_MIN    10      /* minimum 10ms */
+
+/* WiFi P2P IE subelement: Intended P2P Interface Address */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_intintad_se_s {
+       uint8   eltId;          /* SE ID: P2P_SEID_INTINTADDR */
+       uint8   len[2];         /* SE length not including eltId, len fields */
+       uint8   mac[6];         /* intended P2P interface MAC address */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_intintad_se_s wifi_p2p_intintad_se_t;
+
+/* WiFi P2P IE subelement: Channel */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_channel_se_s {
+       uint8   eltId;          /* SE ID: P2P_SEID_STATUS */
+       uint8   len[2];         /* SE length not including eltId, len fields */
+       uint8   band;           /* Regulatory Class (band) */
+       uint8   channel;        /* Channel */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_channel_se_s wifi_p2p_channel_se_t;
+
+
+/* Channel Entry structure within the Channel List SE */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_chanlist_entry_s {
+       uint8   band;                                           /* Regulatory Class (band) */
+       uint8   num_channels;                           /* # of channels in the channel list */
+       uint8   channels[WL_NUMCHANNELS];       /* Channel List */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_chanlist_entry_s wifi_p2p_chanlist_entry_t;
+#define WIFI_P2P_CHANLIST_SE_MAX_ENTRIES 2
+
+/* WiFi P2P IE subelement: Channel List */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_chanlist_se_s {
+       uint8   eltId;          /* SE ID: P2P_SEID_CHAN_LIST */
+       uint8   len[2];         /* SE length not including eltId, len fields */
+       uint8   country[3];     /* Country String */
+       uint8   num_entries;    /* # of channel entries */
+       wifi_p2p_chanlist_entry_t       entries[WIFI_P2P_CHANLIST_SE_MAX_ENTRIES];
+                                               /* Channel Entry List */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_chanlist_se_s wifi_p2p_chanlist_se_t;
+
+/* WiFi Primary Device Type structure */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_pri_devtype_s {
+       uint16  cat_id;         /* Category ID */
+       uint8   OUI[3];         /* WFA OUI: 0x0050F2 */
+       uint8   oui_type;       /* WPS_OUI_TYPE */
+       uint16  sub_cat_id;     /* Sub Category ID */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_pri_devtype_s wifi_p2p_pri_devtype_t;
+
+/* WiFi P2P Device Info Sub Element Primary Device Type Sub Category
+ * maximum values for each category
+ */
+#define P2P_DISE_SUBCATEGORY_MINVAL            1
+#define P2P_DISE_CATEGORY_COMPUTER             1
+#define P2P_DISE_SUBCATEGORY_COMPUTER_MAXVAL           8
+#define P2P_DISE_CATEGORY_INPUT_DEVICE         2
+#define P2P_DISE_SUBCATEGORY_INPUT_DEVICE_MAXVAL       9
+#define P2P_DISE_CATEGORY_PRINTER              3
+#define P2P_DISE_SUBCATEGORY_PRINTER_MAXVAL            5
+#define P2P_DISE_CATEGORY_CAMERA               4
+#define P2P_DISE_SUBCATEGORY_CAMERA_MAXVAL             4
+#define P2P_DISE_CATEGORY_STORAGE              5
+#define P2P_DISE_SUBCATEGORY_STORAGE_MAXVAL            1
+#define P2P_DISE_CATEGORY_NETWORK_INFRA                6
+#define P2P_DISE_SUBCATEGORY_NETWORK_INFRA_MAXVAL      4
+#define P2P_DISE_CATEGORY_DISPLAY              7
+#define P2P_DISE_SUBCATEGORY_DISPLAY_MAXVAL            4
+#define P2P_DISE_CATEGORY_MULTIMEDIA           8
+#define P2P_DISE_SUBCATEGORY_MULTIMEDIA_MAXVAL         6
+#define P2P_DISE_CATEGORY_GAMING               9
+#define P2P_DISE_SUBCATEGORY_GAMING_MAXVAL             5
+#define P2P_DISE_CATEGORY_TELEPHONE            10
+#define P2P_DISE_SUBCATEGORY_TELEPHONE_MAXVAL          5
+#define P2P_DISE_CATEGORY_AUDIO                        11
+#define P2P_DISE_SUBCATEGORY_AUDIO_MAXVAL              6
+
+/* WiFi P2P IE's Device Info subelement */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_devinfo_se_s {
+       uint8   eltId;                  /* SE ID: P2P_SEID_DEVINFO */
+       uint8   len[2];                 /* SE length not including eltId, len fields */
+       uint8   mac[6];                 /* P2P Device MAC address */
+       uint16  wps_cfg_meths;          /* Config Methods: reg_prototlv.h WPS_CONFMET_* */
+       uint8   pri_devtype[8];         /* Primary Device Type */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_devinfo_se_s wifi_p2p_devinfo_se_t;
+
+#define P2P_DEV_TYPE_LEN       8
+
+/* WiFi P2P IE's Group Info subelement Client Info Descriptor */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_cid_fixed_s {
+       uint8   len;
+       uint8   devaddr[ETHER_ADDR_LEN];        /* P2P Device Address */
+       uint8   ifaddr[ETHER_ADDR_LEN];         /* P2P Interface Address */
+       uint8   devcap;                         /* Device Capability */
+       uint8   cfg_meths[2];                   /* Config Methods: reg_prototlv.h WPS_CONFMET_* */
+       uint8   pridt[P2P_DEV_TYPE_LEN];        /* Primary Device Type */
+       uint8   secdts;                         /* Number of Secondary Device Types */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_cid_fixed_s wifi_p2p_cid_fixed_t;
+
+/* WiFi P2P IE's Device ID subelement */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_devid_se_s {
+       uint8   eltId;
+       uint8   len[2];
+       struct ether_addr       addr;                   /* P2P Device MAC address */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_devid_se_s wifi_p2p_devid_se_t;
+
+/* WiFi P2P IE subelement: P2P Manageability */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_mgbt_se_s {
+       uint8   eltId;          /* SE ID: P2P_SEID_P2P_MGBTY */
+       uint8   len[2];         /* SE length not including eltId, len fields */
+       uint8   mg_bitmap;      /* manageability bitmap */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_mgbt_se_s wifi_p2p_mgbt_se_t;
+/* mg_bitmap field bit values */
+#define P2P_MGBTSE_P2PDEVMGMT_FLAG   0x1 /* AP supports Managed P2P Device */
+
+/* WiFi P2P IE subelement: Group Info */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_grpinfo_se_s {
+       uint8   eltId;                  /* SE ID: P2P_SEID_GROUP_INFO */
+       uint8   len[2];                 /* SE length not including eltId, len fields */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_grpinfo_se_s wifi_p2p_grpinfo_se_t;
+
+/* WiFi IE subelement: Operating Channel */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_op_channel_se_s {
+       uint8   eltId;          /* SE ID: P2P_SEID_OP_CHANNEL */
+       uint8   len[2];         /* SE length not including eltId, len fields */
+       uint8   country[3];     /* Country String */
+       uint8   op_class;       /* Operating Class */
+       uint8   channel;        /* Channel */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_op_channel_se_s wifi_p2p_op_channel_se_t;
+
+/* WiFi IE subelement: INVITATION FLAGS */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_invite_flags_se_s {
+       uint8   eltId;          /* SE ID: P2P_SEID_INVITE_FLAGS */
+       uint8   len[2];         /* SE length not including eltId, len fields */
+       uint8   flags;          /* Flags */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_invite_flags_se_s wifi_p2p_invite_flags_se_t;
+
+/* WiFi P2P IE subelement: Service Hash */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_serv_hash_se_s {
+       uint8   eltId;                  /* SE ID: P2P_SEID_SERVICE_HASH */
+       uint8   len[2];                 /* SE length not including eltId, len fields
+                                        * in multiple of 6 Bytes
+                                       */
+       uint8   hash[1];                /* Variable length - SHA256 hash of
+                                        * service names (can be more than one hashes)
+                                       */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_serv_hash_se_s wifi_p2p_serv_hash_se_t;
+
+/* WiFi P2P IE subelement: Service Instance Data */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_serv_inst_data_se_s {
+       uint8   eltId;                  /* SE ID: P2P_SEID_SESSION */
+       uint8   len[2];                 /* SE length not including eltId, len */
+       uint8   ssn_info[1];            /* Variable length - Session information as specified by
+                                        * the service layer, type matches serv. name
+                                       */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_serv_inst_data_se_s wifi_p2p_serv_inst_data_se_t;
+
+
+/* WiFi P2P IE subelement: Connection capability */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_conn_cap_data_se_s {
+       uint8   eltId;                  /* SE ID: P2P_SEID_CONNECT_CAP */
+       uint8   len[2];                 /* SE length not including eltId, len */
+       uint8   conn_cap;               /* 1byte capability as specified by the
+                                        * service layer, valid bitmask/values
+                                       */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_conn_cap_data_se_s wifi_p2p_conn_cap_data_se_t;
+
+
+/* WiFi P2P IE subelement: Advertisement ID */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_advt_id_se_s {
+       uint8   eltId;                  /* SE ID: P2P_SEID_ADVERTISE_ID */
+       uint8   len[2];                 /* SE length not including eltId, len fixed 4 Bytes */
+       uint8   advt_id[4];             /* 4byte Advertisement ID of the peer device sent in
+                                        * PROV Disc in Network byte order
+                                       */
+       uint8   advt_mac[6];                    /* P2P device address of the service advertiser */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_advt_id_se_s wifi_p2p_advt_id_se_t;
+
+
+/* WiFi P2P IE subelement: Advertise Service Hash */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_adv_serv_info_s {
+       uint8   advt_id[4];             /* SE Advertise ID for the service */
+       uint16  nw_cfg_method;  /* SE Network Config method for the service */
+       uint8   serv_name_len;  /* SE length of the service name */
+       uint8   serv_name[1];   /* Variable length service name field */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_adv_serv_info_s wifi_p2p_adv_serv_info_t;
+
+
+/* WiFi P2P IE subelement: Advertise Service Hash */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_advt_serv_se_s {
+       uint8   eltId;                  /* SE ID: P2P_SEID_ADVERTISE_SERVICE */
+       uint8   len[2];                 /* SE length not including eltId, len fields mutiple len of
+                                        * wifi_p2p_adv_serv_info_t entries
+                                       */
+       wifi_p2p_adv_serv_info_t        p_advt_serv_info[1]; /* Variable length
+                                                               of multiple instances
+                                                               of the advertise service info
+                                                               */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_advt_serv_se_s wifi_p2p_advt_serv_se_t;
+
+
+/* WiFi P2P IE subelement: Session ID */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_ssn_id_se_s {
+       uint8   eltId;                  /* SE ID: P2P_SEID_SESSION_ID */
+       uint8   len[2];                 /* SE length not including eltId, len fixed 4 Bytes */
+       uint8   ssn_id[4];              /* 4byte Session ID of the peer device sent in
+                                                        * PROV Disc in Network byte order
+                                                        */
+       uint8   ssn_mac[6];             /* P2P device address of the seeker - session mac */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_ssn_id_se_s wifi_p2p_ssn_id_se_t;
+
+
+#define P2P_ADVT_SERV_SE_FIXED_LEN     3       /* Includes only the element ID and len */
+#define P2P_ADVT_SERV_INFO_FIXED_LEN   7       /* Per ADV Service Instance advt_id +
+                                                * nw_config_method + serv_name_len
+                                                */
+
+/* WiFi P2P Action Frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_action_frame {
+       uint8   category;       /* P2P_AF_CATEGORY */
+       uint8   OUI[3];         /* OUI - P2P_OUI */
+       uint8   type;           /* OUI Type - P2P_VER */
+       uint8   subtype;        /* OUI Subtype - P2P_AF_* */
+       uint8   dialog_token;   /* nonzero, identifies req/resp tranaction */
+       uint8   elts[1];        /* Variable length information elements.  Max size =
+                                * ACTION_FRAME_SIZE - sizeof(this structure) - 1
+                                */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_action_frame wifi_p2p_action_frame_t;
+#define P2P_AF_CATEGORY                0x7f
+
+#define P2P_AF_FIXED_LEN       7
+
+/* WiFi P2P Action Frame OUI Subtypes */
+#define P2P_AF_NOTICE_OF_ABSENCE       0       /* Notice of Absence */
+#define P2P_AF_PRESENCE_REQ            1       /* P2P Presence Request */
+#define P2P_AF_PRESENCE_RSP            2       /* P2P Presence Response */
+#define P2P_AF_GO_DISC_REQ             3       /* GO Discoverability Request */
+
+
+/* WiFi P2P Public Action Frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_pub_act_frame {
+       uint8   category;       /* P2P_PUB_AF_CATEGORY */
+       uint8   action;         /* P2P_PUB_AF_ACTION */
+       uint8   oui[3];         /* P2P_OUI */
+       uint8   oui_type;       /* OUI type - P2P_VER */
+       uint8   subtype;        /* OUI subtype - P2P_TYPE_* */
+       uint8   dialog_token;   /* nonzero, identifies req/rsp transaction */
+       uint8   elts[1];        /* Variable length information elements.  Max size =
+                                * ACTION_FRAME_SIZE - sizeof(this structure) - 1
+                                */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_pub_act_frame wifi_p2p_pub_act_frame_t;
+#define P2P_PUB_AF_FIXED_LEN   8
+#define P2P_PUB_AF_CATEGORY    0x04
+#define P2P_PUB_AF_ACTION      0x09
+
+/* WiFi P2P Public Action Frame OUI Subtypes */
+#define P2P_PAF_GON_REQ                0       /* Group Owner Negotiation Req */
+#define P2P_PAF_GON_RSP                1       /* Group Owner Negotiation Rsp */
+#define P2P_PAF_GON_CONF       2       /* Group Owner Negotiation Confirm */
+#define P2P_PAF_INVITE_REQ     3       /* P2P Invitation Request */
+#define P2P_PAF_INVITE_RSP     4       /* P2P Invitation Response */
+#define P2P_PAF_DEVDIS_REQ     5       /* Device Discoverability Request */
+#define P2P_PAF_DEVDIS_RSP     6       /* Device Discoverability Response */
+#define P2P_PAF_PROVDIS_REQ    7       /* Provision Discovery Request */
+#define P2P_PAF_PROVDIS_RSP    8       /* Provision Discovery Response */
+#define P2P_PAF_SUBTYPE_INVALID        255     /* Invalid Subtype */
+
+/* TODO: Stop using these obsolete aliases for P2P_PAF_GON_* */
+#define P2P_TYPE_MNREQ         P2P_PAF_GON_REQ
+#define P2P_TYPE_MNRSP         P2P_PAF_GON_RSP
+#define P2P_TYPE_MNCONF                P2P_PAF_GON_CONF
+
+/* WiFi P2P IE subelement: Notice of Absence */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_noa_desc {
+       uint8   cnt_type;       /* Count/Type */
+       uint32  duration;       /* Duration */
+       uint32  interval;       /* Interval */
+       uint32  start;          /* Start Time */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_noa_desc wifi_p2p_noa_desc_t;
+
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_noa_se {
+       uint8   eltId;          /* Subelement ID */
+       uint8   len[2];         /* Length */
+       uint8   index;          /* Index */
+       uint8   ops_ctw_parms;  /* CTWindow and OppPS Parameters */
+       wifi_p2p_noa_desc_t     desc[1];        /* Notice of Absence Descriptor(s) */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_noa_se wifi_p2p_noa_se_t;
+
+#define P2P_NOA_SE_FIXED_LEN   5
+
+#define P2P_NOA_SE_MAX_DESC    2       /* max NoA descriptors in presence request */
+
+/* cnt_type field values */
+#define P2P_NOA_DESC_CNT_RESERVED      0       /* reserved and should not be used */
+#define P2P_NOA_DESC_CNT_REPEAT                255     /* continuous schedule */
+#define P2P_NOA_DESC_TYPE_PREFERRED    1       /* preferred values */
+#define P2P_NOA_DESC_TYPE_ACCEPTABLE   2       /* acceptable limits */
+
+/* ctw_ops_parms field values */
+#define P2P_NOA_CTW_MASK       0x7f
+#define P2P_NOA_OPS_MASK       0x80
+#define P2P_NOA_OPS_SHIFT      7
+
+#define P2P_CTW_MIN    10      /* minimum 10TU */
+
+/*
+ * P2P Service Discovery related
+ */
+#define        P2PSD_ACTION_CATEGORY           0x04
+                               /* Public action frame */
+#define        P2PSD_ACTION_ID_GAS_IREQ        0x0a
+                               /* Action value for GAS Initial Request AF */
+#define        P2PSD_ACTION_ID_GAS_IRESP       0x0b
+                               /* Action value for GAS Initial Response AF */
+#define        P2PSD_ACTION_ID_GAS_CREQ        0x0c
+                               /* Action value for GAS Comeback Request AF */
+#define        P2PSD_ACTION_ID_GAS_CRESP       0x0d
+                               /* Action value for GAS Comeback Response AF */
+#define P2PSD_AD_EID                           0x6c
+                               /* Advertisement Protocol IE ID */
+#define P2PSD_ADP_TUPLE_QLMT_PAMEBI    0x00
+                               /* Query Response Length Limit 7 bits plus PAME-BI 1 bit */
+#define P2PSD_ADP_PROTO_ID                     0x00
+                               /* Advertisement Protocol ID. Always 0 for P2P SD */
+#define P2PSD_GAS_OUI                          P2P_OUI
+                               /* WFA OUI */
+#define P2PSD_GAS_OUI_SUBTYPE          P2P_VER
+                               /* OUI Subtype for GAS IE */
+#define P2PSD_GAS_NQP_INFOID           0xDDDD
+                               /* NQP Query Info ID: 56797 */
+#define P2PSD_GAS_COMEBACKDEALY                0x00
+                               /* Not used in the Native GAS protocol */
+
+/* Service Protocol Type */
+typedef enum p2psd_svc_protype {
+       SVC_RPOTYPE_ALL = 0,
+       SVC_RPOTYPE_BONJOUR = 1,
+       SVC_RPOTYPE_UPNP = 2,
+       SVC_RPOTYPE_WSD = 3,
+       SVC_RPOTYPE_WFDS = 11,
+       SVC_RPOTYPE_VENDOR = 255
+} p2psd_svc_protype_t;
+
+/* Service Discovery response status code */
+typedef enum {
+       P2PSD_RESP_STATUS_SUCCESS = 0,
+       P2PSD_RESP_STATUS_PROTYPE_NA = 1,
+       P2PSD_RESP_STATUS_DATA_NA = 2,
+       P2PSD_RESP_STATUS_BAD_REQUEST = 3
+} p2psd_resp_status_t;
+
+/* Advertisement Protocol IE tuple field */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_adp_tpl {
+       uint8   llm_pamebi;     /* Query Response Length Limit bit 0-6, set to 0 plus
+                               * Pre-Associated Message Exchange BSSID Independent bit 7, set to 0
+                               */
+       uint8   adp_id;         /* Advertisement Protocol ID: 0 for NQP Native Query Protocol */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_adp_tpl wifi_p2psd_adp_tpl_t;
+
+/* Advertisement Protocol IE */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_adp_ie {
+       uint8   id;             /* IE ID: 0x6c - 108 */
+       uint8   len;    /* IE length */
+       wifi_p2psd_adp_tpl_t adp_tpl;  /* Advertisement Protocol Tuple field. Only one
+                               * tuple is defined for P2P Service Discovery
+                               */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_adp_ie wifi_p2psd_adp_ie_t;
+
+/* NQP Vendor-specific Content */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_nqp_query_vsc {
+       uint8   oui_subtype;    /* OUI Subtype: 0x09 */
+       uint16  svc_updi;               /* Service Update Indicator */
+       uint8   svc_tlvs[1];    /* wifi_p2psd_qreq_tlv_t type for service request,
+                               * wifi_p2psd_qresp_tlv_t type for service response
+                               */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_nqp_query_vsc wifi_p2psd_nqp_query_vsc_t;
+
+/* Service Request TLV */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_qreq_tlv {
+       uint16  len;                    /* Length: 5 plus size of Query Data */
+       uint8   svc_prot;               /* Service Protocol Type */
+       uint8   svc_tscid;              /* Service Transaction ID */
+       uint8   query_data[1];  /* Query Data, passed in from above Layer 2 */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_qreq_tlv wifi_p2psd_qreq_tlv_t;
+
+/* Query Request Frame, defined in generic format, instead of NQP specific */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_qreq_frame {
+       uint16  info_id;        /* Info ID: 0xDDDD */
+       uint16  len;            /* Length of service request TLV, 5 plus the size of request data */
+       uint8   oui[3];         /* WFA OUI: 0x0050F2 */
+       uint8   qreq_vsc[1]; /* Vendor-specific Content: wifi_p2psd_nqp_query_vsc_t type for NQP */
+
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_qreq_frame wifi_p2psd_qreq_frame_t;
+
+/* GAS Initial Request AF body, "elts" in wifi_p2p_pub_act_frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_gas_ireq_frame {
+       wifi_p2psd_adp_ie_t             adp_ie;         /* Advertisement Protocol IE */
+       uint16                                  qreq_len;       /* Query Request Length */
+       uint8   qreq_frm[1];    /* Query Request Frame wifi_p2psd_qreq_frame_t */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_gas_ireq_frame wifi_p2psd_gas_ireq_frame_t;
+
+/* Service Response TLV */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_qresp_tlv {
+       uint16  len;                            /* Length: 5 plus size of Query Data */
+       uint8   svc_prot;                       /* Service Protocol Type */
+       uint8   svc_tscid;                      /* Service Transaction ID */
+       uint8   status;                         /* Value defined in Table 57 of P2P spec. */
+       uint8   query_data[1];          /* Response Data, passed in from above Layer 2 */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_qresp_tlv wifi_p2psd_qresp_tlv_t;
+
+/* Query Response Frame, defined in generic format, instead of NQP specific */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_qresp_frame {
+       uint16  info_id;        /* Info ID: 0xDDDD */
+       uint16  len;            /* Lenth of service response TLV, 6 plus the size of resp data */
+       uint8   oui[3];         /* WFA OUI: 0x0050F2 */
+       uint8   qresp_vsc[1]; /* Vendor-specific Content: wifi_p2psd_qresp_tlv_t type for NQP */
+
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_qresp_frame wifi_p2psd_qresp_frame_t;
+
+/* GAS Initial Response AF body, "elts" in wifi_p2p_pub_act_frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_gas_iresp_frame {
+       uint16  status;                 /* Value defined in Table 7-23 of IEEE P802.11u */
+       uint16  cb_delay;               /* GAS Comeback Delay */
+       wifi_p2psd_adp_ie_t     adp_ie;         /* Advertisement Protocol IE */
+       uint16          qresp_len;      /* Query Response Length */
+       uint8   qresp_frm[1];   /* Query Response Frame wifi_p2psd_qresp_frame_t */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_gas_iresp_frame wifi_p2psd_gas_iresp_frame_t;
+
+/* GAS Comeback Response AF body, "elts" in wifi_p2p_pub_act_frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_gas_cresp_frame {
+       uint16  status;                 /* Value defined in Table 7-23 of IEEE P802.11u */
+       uint8   fragment_id;    /* Fragmentation ID */
+       uint16  cb_delay;               /* GAS Comeback Delay */
+       wifi_p2psd_adp_ie_t     adp_ie;         /* Advertisement Protocol IE */
+       uint16  qresp_len;              /* Query Response Length */
+       uint8   qresp_frm[1];   /* Query Response Frame wifi_p2psd_qresp_frame_t */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_gas_cresp_frame wifi_p2psd_gas_cresp_frame_t;
+
+/* Wi-Fi GAS Public Action Frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_gas_pub_act_frame {
+       uint8   category;               /* 0x04 Public Action Frame */
+       uint8   action;                 /* 0x6c Advertisement Protocol */
+       uint8   dialog_token;   /* nonzero, identifies req/rsp transaction */
+       uint8   query_data[1];  /* Query Data. wifi_p2psd_gas_ireq_frame_t
+                                        * or wifi_p2psd_gas_iresp_frame_t format
+                                        */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_gas_pub_act_frame wifi_p2psd_gas_pub_act_frame_t;
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _P2P_H_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/proto/sdspi.h b/drivers/net/wireless/bcmdhd_1363/include/proto/sdspi.h
new file mode 100644 (file)
index 0000000..ca6e96e
--- /dev/null
@@ -0,0 +1,78 @@
+/*
+ * SD-SPI Protocol Standard
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: sdspi.h 518342 2014-12-01 23:21:41Z $
+ */
+#ifndef        _SD_SPI_H
+#define        _SD_SPI_H
+
+#define SPI_START_M            BITFIELD_MASK(1)        /* Bit [31]     - Start Bit */
+#define SPI_START_S            31
+#define SPI_DIR_M              BITFIELD_MASK(1)        /* Bit [30]     - Direction */
+#define SPI_DIR_S              30
+#define SPI_CMD_INDEX_M                BITFIELD_MASK(6)        /* Bits [29:24] - Command number */
+#define SPI_CMD_INDEX_S                24
+#define SPI_RW_M               BITFIELD_MASK(1)        /* Bit [23]     - Read=0, Write=1 */
+#define SPI_RW_S               23
+#define SPI_FUNC_M             BITFIELD_MASK(3)        /* Bits [22:20] - Function Number */
+#define SPI_FUNC_S             20
+#define SPI_RAW_M              BITFIELD_MASK(1)        /* Bit [19]     - Read After Wr */
+#define SPI_RAW_S              19
+#define SPI_STUFF_M            BITFIELD_MASK(1)        /* Bit [18]     - Stuff bit */
+#define SPI_STUFF_S            18
+#define SPI_BLKMODE_M          BITFIELD_MASK(1)        /* Bit [19]     - Blockmode 1=blk */
+#define SPI_BLKMODE_S          19
+#define SPI_OPCODE_M           BITFIELD_MASK(1)        /* Bit [18]     - OP Code */
+#define SPI_OPCODE_S           18
+#define SPI_ADDR_M             BITFIELD_MASK(17)       /* Bits [17:1]  - Address */
+#define SPI_ADDR_S             1
+#define SPI_STUFF0_M           BITFIELD_MASK(1)        /* Bit [0]      - Stuff bit */
+#define SPI_STUFF0_S           0
+
+#define SPI_RSP_START_M                BITFIELD_MASK(1)        /* Bit [7]      - Start Bit (always 0) */
+#define SPI_RSP_START_S                7
+#define SPI_RSP_PARAM_ERR_M    BITFIELD_MASK(1)        /* Bit [6]      - Parameter Error */
+#define SPI_RSP_PARAM_ERR_S    6
+#define SPI_RSP_RFU5_M         BITFIELD_MASK(1)        /* Bit [5]      - RFU (Always 0) */
+#define SPI_RSP_RFU5_S         5
+#define SPI_RSP_FUNC_ERR_M     BITFIELD_MASK(1)        /* Bit [4]      - Function number error */
+#define SPI_RSP_FUNC_ERR_S     4
+#define SPI_RSP_CRC_ERR_M      BITFIELD_MASK(1)        /* Bit [3]      - COM CRC Error */
+#define SPI_RSP_CRC_ERR_S      3
+#define SPI_RSP_ILL_CMD_M      BITFIELD_MASK(1)        /* Bit [2]      - Illegal Command error */
+#define SPI_RSP_ILL_CMD_S      2
+#define SPI_RSP_RFU1_M         BITFIELD_MASK(1)        /* Bit [1]      - RFU (Always 0) */
+#define SPI_RSP_RFU1_S         1
+#define SPI_RSP_IDLE_M         BITFIELD_MASK(1)        /* Bit [0]      - In idle state */
+#define SPI_RSP_IDLE_S         0
+
+/* SD-SPI Protocol Definitions */
+#define SDSPI_COMMAND_LEN      6       /* Number of bytes in an SD command */
+#define SDSPI_START_BLOCK      0xFE    /* SD Start Block Token */
+#define SDSPI_IDLE_PAD         0xFF    /* SD-SPI idle value for MOSI */
+#define SDSPI_START_BIT_MASK   0x80
+
+#endif /* _SD_SPI_H */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/proto/vlan.h b/drivers/net/wireless/bcmdhd_1363/include/proto/vlan.h
new file mode 100644 (file)
index 0000000..062119d
--- /dev/null
@@ -0,0 +1,98 @@
+/*
+ * 802.1Q VLAN protocol definitions
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: vlan.h 518342 2014-12-01 23:21:41Z $
+ */
+
+#ifndef _vlan_h_
+#define _vlan_h_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+#ifndef         VLAN_VID_MASK
+#define VLAN_VID_MASK          0xfff   /* low 12 bits are vlan id */
+#endif
+
+#define        VLAN_CFI_SHIFT          12      /* canonical format indicator bit */
+#define VLAN_PRI_SHIFT         13      /* user priority */
+
+#define VLAN_PRI_MASK          7       /* 3 bits of priority */
+
+#define        VLAN_TPID_OFFSET        12      /* offset of tag protocol id field */
+#define        VLAN_TCI_OFFSET         14      /* offset of tag ctrl info field */
+
+#define        VLAN_TAG_LEN            4
+#define        VLAN_TAG_OFFSET         (2 * ETHER_ADDR_LEN)    /* offset in Ethernet II packet only */
+
+#define VLAN_TPID              0x8100  /* VLAN ethertype/Tag Protocol ID */
+
+struct vlan_header {
+       uint16  vlan_type;              /* 0x8100 */
+       uint16  vlan_tag;               /* priority, cfi and vid */
+};
+
+struct ethervlan_header {
+       uint8   ether_dhost[ETHER_ADDR_LEN];
+       uint8   ether_shost[ETHER_ADDR_LEN];
+       uint16  vlan_type;              /* 0x8100 */
+       uint16  vlan_tag;               /* priority, cfi and vid */
+       uint16  ether_type;
+};
+
+struct dot3_mac_llc_snapvlan_header {
+       uint8   ether_dhost[ETHER_ADDR_LEN];    /* dest mac */
+       uint8   ether_shost[ETHER_ADDR_LEN];    /* src mac */
+       uint16  length;                         /* frame length incl header */
+       uint8   dsap;                           /* always 0xAA */
+       uint8   ssap;                           /* always 0xAA */
+       uint8   ctl;                            /* always 0x03 */
+       uint8   oui[3];                         /* RFC1042: 0x00 0x00 0x00
+                                                * Bridge-Tunnel: 0x00 0x00 0xF8
+                                                */
+       uint16  vlan_type;                      /* 0x8100 */
+       uint16  vlan_tag;                       /* priority, cfi and vid */
+       uint16  ether_type;                     /* ethertype */
+};
+
+#define        ETHERVLAN_HDR_LEN       (ETHER_HDR_LEN + VLAN_TAG_LEN)
+
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#define ETHERVLAN_MOVE_HDR(d, s) \
+do { \
+       struct ethervlan_header t; \
+       t = *(struct ethervlan_header *)(s); \
+       *(struct ethervlan_header *)(d) = t; \
+} while (0)
+
+#endif /* _vlan_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/proto/wpa.h b/drivers/net/wireless/bcmdhd_1363/include/proto/wpa.h
new file mode 100644 (file)
index 0000000..fc01241
--- /dev/null
@@ -0,0 +1,212 @@
+/*
+ * Fundamental types and constants relating to WPA
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: wpa.h 518342 2014-12-01 23:21:41Z $
+ */
+
+#ifndef _proto_wpa_h_
+#define _proto_wpa_h_
+
+#include <typedefs.h>
+#include <proto/ethernet.h>
+
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+/* Reason Codes */
+
+/* 13 through 23 taken from IEEE Std 802.11i-2004 */
+#define DOT11_RC_INVALID_WPA_IE                13      /* Invalid info. element */
+#define DOT11_RC_MIC_FAILURE           14      /* Michael failure */
+#define DOT11_RC_4WH_TIMEOUT           15      /* 4-way handshake timeout */
+#define DOT11_RC_GTK_UPDATE_TIMEOUT    16      /* Group key update timeout */
+#define DOT11_RC_WPA_IE_MISMATCH       17      /* WPA IE in 4-way handshake differs from
+                                                * (re-)assoc. request/probe response
+                                                */
+#define DOT11_RC_INVALID_MC_CIPHER     18      /* Invalid multicast cipher */
+#define DOT11_RC_INVALID_UC_CIPHER     19      /* Invalid unicast cipher */
+#define DOT11_RC_INVALID_AKMP          20      /* Invalid authenticated key management protocol */
+#define DOT11_RC_BAD_WPA_VERSION       21      /* Unsupported WPA version */
+#define DOT11_RC_INVALID_WPA_CAP       22      /* Invalid WPA IE capabilities */
+#define DOT11_RC_8021X_AUTH_FAIL       23      /* 802.1X authentication failure */
+
+#define WPA2_PMKID_LEN 16
+
+/* WPA IE fixed portion */
+typedef BWL_PRE_PACKED_STRUCT struct
+{
+       uint8 tag;      /* TAG */
+       uint8 length;   /* TAG length */
+       uint8 oui[3];   /* IE OUI */
+       uint8 oui_type; /* OUI type */
+       BWL_PRE_PACKED_STRUCT struct {
+               uint8 low;
+               uint8 high;
+       } BWL_POST_PACKED_STRUCT version;       /* IE version */
+} BWL_POST_PACKED_STRUCT wpa_ie_fixed_t;
+#define WPA_IE_OUITYPE_LEN     4
+#define WPA_IE_FIXED_LEN       8
+#define WPA_IE_TAG_FIXED_LEN   6
+
+#define BIP_OUI_TYPE WPA2_OUI "\x06"
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint8 tag;      /* TAG */
+       uint8 length;   /* TAG length */
+       BWL_PRE_PACKED_STRUCT struct {
+               uint8 low;
+               uint8 high;
+       } BWL_POST_PACKED_STRUCT version;       /* IE version */
+} BWL_POST_PACKED_STRUCT wpa_rsn_ie_fixed_t;
+#define WPA_RSN_IE_FIXED_LEN   4
+#define WPA_RSN_IE_TAG_FIXED_LEN       2
+typedef uint8 wpa_pmkid_t[WPA2_PMKID_LEN];
+
+#define WFA_OSEN_IE_FIXED_LEN  6
+
+/* WPA suite/multicast suite */
+typedef BWL_PRE_PACKED_STRUCT struct
+{
+       uint8 oui[3];
+       uint8 type;
+} BWL_POST_PACKED_STRUCT wpa_suite_t, wpa_suite_mcast_t;
+#define WPA_SUITE_LEN  4
+
+/* WPA unicast suite list/key management suite list */
+typedef BWL_PRE_PACKED_STRUCT struct
+{
+       BWL_PRE_PACKED_STRUCT struct {
+               uint8 low;
+               uint8 high;
+       } BWL_POST_PACKED_STRUCT count;
+       wpa_suite_t list[1];
+} BWL_POST_PACKED_STRUCT wpa_suite_ucast_t, wpa_suite_auth_key_mgmt_t;
+#define WPA_IE_SUITE_COUNT_LEN 2
+typedef BWL_PRE_PACKED_STRUCT struct
+{
+       BWL_PRE_PACKED_STRUCT struct {
+               uint8 low;
+               uint8 high;
+       } BWL_POST_PACKED_STRUCT count;
+       wpa_pmkid_t list[1];
+} BWL_POST_PACKED_STRUCT wpa_pmkid_list_t;
+
+/* WPA cipher suites */
+#define WPA_CIPHER_NONE                0       /* None */
+#define WPA_CIPHER_WEP_40      1       /* WEP (40-bit) */
+#define WPA_CIPHER_TKIP                2       /* TKIP: default for WPA */
+#define WPA_CIPHER_AES_OCB     3       /* AES (OCB) */
+#define WPA_CIPHER_AES_CCM     4       /* AES (CCM) */
+#define WPA_CIPHER_WEP_104     5       /* WEP (104-bit) */
+#define WPA_CIPHER_BIP         6       /* WEP (104-bit) */
+#define WPA_CIPHER_TPK         7       /* Group addressed traffic not allowed */
+
+#ifdef BCMWAPI_WAI
+#define WAPI_CIPHER_NONE       WPA_CIPHER_NONE
+#define WAPI_CIPHER_SMS4       11
+
+#define WAPI_CSE_WPI_SMS4      1
+#endif /* BCMWAPI_WAI */
+
+#define IS_WPA_CIPHER(cipher)  ((cipher) == WPA_CIPHER_NONE || \
+                                (cipher) == WPA_CIPHER_WEP_40 || \
+                                (cipher) == WPA_CIPHER_WEP_104 || \
+                                (cipher) == WPA_CIPHER_TKIP || \
+                                (cipher) == WPA_CIPHER_AES_OCB || \
+                                (cipher) == WPA_CIPHER_AES_CCM || \
+                                (cipher) == WPA_CIPHER_TPK)
+
+#ifdef BCMWAPI_WAI
+#define IS_WAPI_CIPHER(cipher) ((cipher) == WAPI_CIPHER_NONE || \
+                                (cipher) == WAPI_CSE_WPI_SMS4)
+
+/* convert WAPI_CSE_WPI_XXX to WAPI_CIPHER_XXX */
+#define WAPI_CSE_WPI_2_CIPHER(cse) ((cse) == WAPI_CSE_WPI_SMS4 ? \
+                               WAPI_CIPHER_SMS4 : WAPI_CIPHER_NONE)
+
+#define WAPI_CIPHER_2_CSE_WPI(cipher) ((cipher) == WAPI_CIPHER_SMS4 ? \
+                               WAPI_CSE_WPI_SMS4 : WAPI_CIPHER_NONE)
+#endif /* BCMWAPI_WAI */
+
+/* WPA TKIP countermeasures parameters */
+#define WPA_TKIP_CM_DETECT     60      /* multiple MIC failure window (seconds) */
+#define WPA_TKIP_CM_BLOCK      60      /* countermeasures active window (seconds) */
+
+/* RSN IE defines */
+#define RSN_CAP_LEN            2       /* Length of RSN capabilities field (2 octets) */
+
+/* RSN Capabilities defined in 802.11i */
+#define RSN_CAP_PREAUTH                        0x0001
+#define RSN_CAP_NOPAIRWISE             0x0002
+#define RSN_CAP_PTK_REPLAY_CNTR_MASK   0x000C
+#define RSN_CAP_PTK_REPLAY_CNTR_SHIFT  2
+#define RSN_CAP_GTK_REPLAY_CNTR_MASK   0x0030
+#define RSN_CAP_GTK_REPLAY_CNTR_SHIFT  4
+#define RSN_CAP_1_REPLAY_CNTR          0
+#define RSN_CAP_2_REPLAY_CNTRS         1
+#define RSN_CAP_4_REPLAY_CNTRS         2
+#define RSN_CAP_16_REPLAY_CNTRS                3
+#define RSN_CAP_MFPR                   0x0040
+#define RSN_CAP_MFPC                   0x0080
+#define RSN_CAP_SPPC                   0x0400
+#define RSN_CAP_SPPR                   0x0800
+
+/* WPA capabilities defined in 802.11i */
+#define WPA_CAP_4_REPLAY_CNTRS         RSN_CAP_4_REPLAY_CNTRS
+#define WPA_CAP_16_REPLAY_CNTRS                RSN_CAP_16_REPLAY_CNTRS
+#define WPA_CAP_REPLAY_CNTR_SHIFT      RSN_CAP_PTK_REPLAY_CNTR_SHIFT
+#define WPA_CAP_REPLAY_CNTR_MASK       RSN_CAP_PTK_REPLAY_CNTR_MASK
+
+/* WPA capabilities defined in 802.11zD9.0 */
+#define WPA_CAP_PEER_KEY_ENABLE                (0x1 << 1)      /* bit 9 */
+
+/* WPA Specific defines */
+#define WPA_CAP_LEN    RSN_CAP_LEN     /* Length of RSN capabilities in RSN IE (2 octets) */
+#define WPA_PMKID_CNT_LEN      2       /* Length of RSN PMKID count (2 octests) */
+
+#define        WPA_CAP_WPA2_PREAUTH            RSN_CAP_PREAUTH
+
+#define WPA2_PMKID_COUNT_LEN   2
+
+#ifdef BCMWAPI_WAI
+#define WAPI_CAP_PREAUTH               RSN_CAP_PREAUTH
+
+/* Other WAI definition */
+#define WAPI_WAI_REQUEST               0x00F1
+#define WAPI_UNICAST_REKEY             0x00F2
+#define WAPI_STA_AGING                 0x00F3
+#define WAPI_MUTIL_REKEY               0x00F4
+#define WAPI_STA_STATS                 0x00F5
+
+#define WAPI_USK_REKEY_COUNT           0x4000000 /* 0xA00000 */
+#define WAPI_MSK_REKEY_COUNT           0x4000000 /* 0xA00000 */
+#endif /* BCMWAPI_WAI */
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _proto_wpa_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/proto/wps.h b/drivers/net/wireless/bcmdhd_1363/include/proto/wps.h
new file mode 100644 (file)
index 0000000..aa4cc1b
--- /dev/null
@@ -0,0 +1,389 @@
+/*
+ * WPS IE definitions
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id$
+ */
+
+#ifndef _WPS_
+#define _WPS_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Data Element Definitions */
+#define WPS_ID_AP_CHANNEL         0x1001
+#define WPS_ID_ASSOC_STATE        0x1002
+#define WPS_ID_AUTH_TYPE          0x1003
+#define WPS_ID_AUTH_TYPE_FLAGS    0x1004
+#define WPS_ID_AUTHENTICATOR      0x1005
+#define WPS_ID_CONFIG_METHODS     0x1008
+#define WPS_ID_CONFIG_ERROR       0x1009
+#define WPS_ID_CONF_URL4          0x100A
+#define WPS_ID_CONF_URL6          0x100B
+#define WPS_ID_CONN_TYPE          0x100C
+#define WPS_ID_CONN_TYPE_FLAGS    0x100D
+#define WPS_ID_CREDENTIAL         0x100E
+#define WPS_ID_DEVICE_NAME        0x1011
+#define WPS_ID_DEVICE_PWD_ID      0x1012
+#define WPS_ID_E_HASH1            0x1014
+#define WPS_ID_E_HASH2            0x1015
+#define WPS_ID_E_SNONCE1          0x1016
+#define WPS_ID_E_SNONCE2          0x1017
+#define WPS_ID_ENCR_SETTINGS      0x1018
+#define WPS_ID_ENCR_TYPE          0x100F
+#define WPS_ID_ENCR_TYPE_FLAGS    0x1010
+#define WPS_ID_ENROLLEE_NONCE     0x101A
+#define WPS_ID_FEATURE_ID         0x101B
+#define WPS_ID_IDENTITY           0x101C
+#define WPS_ID_IDENTITY_PROOF     0x101D
+#define WPS_ID_KEY_WRAP_AUTH      0x101E
+#define WPS_ID_KEY_IDENTIFIER     0x101F
+#define WPS_ID_MAC_ADDR           0x1020
+#define WPS_ID_MANUFACTURER       0x1021
+#define WPS_ID_MSG_TYPE           0x1022
+#define WPS_ID_MODEL_NAME         0x1023
+#define WPS_ID_MODEL_NUMBER       0x1024
+#define WPS_ID_NW_INDEX           0x1026
+#define WPS_ID_NW_KEY             0x1027
+#define WPS_ID_NW_KEY_INDEX       0x1028
+#define WPS_ID_NEW_DEVICE_NAME    0x1029
+#define WPS_ID_NEW_PWD            0x102A
+#define WPS_ID_OOB_DEV_PWD        0x102C
+#define WPS_ID_OS_VERSION         0x102D
+#define WPS_ID_POWER_LEVEL        0x102F
+#define WPS_ID_PSK_CURRENT        0x1030
+#define WPS_ID_PSK_MAX            0x1031
+#define WPS_ID_PUBLIC_KEY         0x1032
+#define WPS_ID_RADIO_ENABLED      0x1033
+#define WPS_ID_REBOOT             0x1034
+#define WPS_ID_REGISTRAR_CURRENT  0x1035
+#define WPS_ID_REGISTRAR_ESTBLSHD 0x1036
+#define WPS_ID_REGISTRAR_LIST     0x1037
+#define WPS_ID_REGISTRAR_MAX      0x1038
+#define WPS_ID_REGISTRAR_NONCE    0x1039
+#define WPS_ID_REQ_TYPE           0x103A
+#define WPS_ID_RESP_TYPE          0x103B
+#define WPS_ID_RF_BAND            0x103C
+#define WPS_ID_R_HASH1            0x103D
+#define WPS_ID_R_HASH2            0x103E
+#define WPS_ID_R_SNONCE1          0x103F
+#define WPS_ID_R_SNONCE2          0x1040
+#define WPS_ID_SEL_REGISTRAR      0x1041
+#define WPS_ID_SERIAL_NUM         0x1042
+#define WPS_ID_SC_STATE           0x1044
+#define WPS_ID_SSID               0x1045
+#define WPS_ID_TOT_NETWORKS       0x1046
+#define WPS_ID_UUID_E             0x1047
+#define WPS_ID_UUID_R             0x1048
+#define WPS_ID_VENDOR_EXT         0x1049
+#define WPS_ID_VERSION            0x104A
+#define WPS_ID_X509_CERT_REQ      0x104B
+#define WPS_ID_X509_CERT          0x104C
+#define WPS_ID_EAP_IDENTITY       0x104D
+#define WPS_ID_MSG_COUNTER        0x104E
+#define WPS_ID_PUBKEY_HASH        0x104F
+#define WPS_ID_REKEY_KEY          0x1050
+#define WPS_ID_KEY_LIFETIME       0x1051
+#define WPS_ID_PERM_CFG_METHODS   0x1052
+#define WPS_ID_SEL_REG_CFG_METHODS 0x1053
+#define WPS_ID_PRIM_DEV_TYPE      0x1054
+#define WPS_ID_SEC_DEV_TYPE_LIST  0x1055
+#define WPS_ID_PORTABLE_DEVICE    0x1056
+#define WPS_ID_AP_SETUP_LOCKED    0x1057
+#define WPS_ID_APP_LIST           0x1058
+#define WPS_ID_EAP_TYPE           0x1059
+#define WPS_ID_INIT_VECTOR        0x1060
+#define WPS_ID_KEY_PROVIDED_AUTO  0x1061
+#define WPS_ID_8021X_ENABLED      0x1062
+#define WPS_ID_WEP_TRANSMIT_KEY   0x1064
+#define WPS_ID_REQ_DEV_TYPE       0x106A
+
+/* WSC 2.0, WFA Vendor Extension Subelements */
+#define WFA_VENDOR_EXT_ID                 "\x00\x37\x2A"
+#define WPS_WFA_SUBID_VERSION2            0x00
+#define WPS_WFA_SUBID_AUTHORIZED_MACS     0x01
+#define WPS_WFA_SUBID_NW_KEY_SHAREABLE    0x02
+#define WPS_WFA_SUBID_REQ_TO_ENROLL       0x03
+#define WPS_WFA_SUBID_SETTINGS_DELAY_TIME 0x04
+#define WPS_WFA_SUBID_REG_CFG_METHODS     0x05
+
+
+/* WCN-NET Windows Rally Vertical Pairing Vendor Extensions */
+#define MS_VENDOR_EXT_ID           "\x00\x01\x37"
+#define WPS_MS_ID_VPI               0x1001     /* Vertical Pairing Identifier TLV */
+#define WPS_MS_ID_TRANSPORT_UUID    0x1002      /* Transport UUID TLV */
+
+/* Vertical Pairing Identifier TLV Definitions */
+#define WPS_MS_VPI_TRANSPORT_NONE   0x00        /* None */
+#define WPS_MS_VPI_TRANSPORT_DPWS   0x01        /* Devices Profile for Web Services */
+#define WPS_MS_VPI_TRANSPORT_UPNP   0x02        /* uPnP */
+#define WPS_MS_VPI_TRANSPORT_SDNWS  0x03        /* Secure Devices Profile for Web Services */
+#define WPS_MS_VPI_NO_PROFILE_REQ   0x00        /* Wi-Fi profile not requested.
+                                                * Not supported in Windows 7
+                                                */
+#define WPS_MS_VPI_PROFILE_REQ      0x01        /* Wi-Fi profile requested.  */
+
+/* sizes of the fixed size elements */
+#define WPS_ID_AP_CHANNEL_S       2
+#define WPS_ID_ASSOC_STATE_S      2
+#define WPS_ID_AUTH_TYPE_S        2
+#define WPS_ID_AUTH_TYPE_FLAGS_S  2
+#define WPS_ID_AUTHENTICATOR_S    8
+#define WPS_ID_CONFIG_METHODS_S   2
+#define WPS_ID_CONFIG_ERROR_S     2
+#define WPS_ID_CONN_TYPE_S          1
+#define WPS_ID_CONN_TYPE_FLAGS_S    1
+#define WPS_ID_DEVICE_PWD_ID_S      2
+#define WPS_ID_ENCR_TYPE_S          2
+#define WPS_ID_ENCR_TYPE_FLAGS_S    2
+#define WPS_ID_FEATURE_ID_S         4
+#define WPS_ID_MAC_ADDR_S           6
+#define WPS_ID_MSG_TYPE_S           1
+#define WPS_ID_SC_STATE_S           1
+#define WPS_ID_RF_BAND_S            1
+#define WPS_ID_OS_VERSION_S         4
+#define WPS_ID_VERSION_S            1
+#define WPS_ID_SEL_REGISTRAR_S      1
+#define WPS_ID_SEL_REG_CFG_METHODS_S 2
+#define WPS_ID_REQ_TYPE_S           1
+#define WPS_ID_RESP_TYPE_S          1
+#define WPS_ID_AP_SETUP_LOCKED_S    1
+
+/* WSC 2.0, WFA Vendor Extension Subelements */
+#define WPS_WFA_SUBID_VERSION2_S            1
+#define WPS_WFA_SUBID_NW_KEY_SHAREABLE_S    1
+#define WPS_WFA_SUBID_REQ_TO_ENROLL_S       1
+#define WPS_WFA_SUBID_SETTINGS_DELAY_TIME_S 1
+#define WPS_WFA_SUBID_REG_CFG_METHODS_S     2
+
+/* Association states */
+#define WPS_ASSOC_NOT_ASSOCIATED  0
+#define WPS_ASSOC_CONN_SUCCESS    1
+#define WPS_ASSOC_CONFIG_FAIL     2
+#define WPS_ASSOC_ASSOC_FAIL      3
+#define WPS_ASSOC_IP_FAIL         4
+
+/* Authentication types */
+#define WPS_AUTHTYPE_OPEN        0x0001
+#define WPS_AUTHTYPE_WPAPSK      0x0002        /* Deprecated in WSC 2.0 */
+#define WPS_AUTHTYPE_SHARED      0x0004        /* Deprecated in WSC 2.0 */
+#define WPS_AUTHTYPE_WPA         0x0008        /* Deprecated in WSC 2.0 */
+#define WPS_AUTHTYPE_WPA2        0x0010
+#define WPS_AUTHTYPE_WPA2PSK     0x0020
+
+/* Config methods */
+#define WPS_CONFMET_USBA            0x0001     /* Deprecated in WSC 2.0 */
+#define WPS_CONFMET_ETHERNET        0x0002     /* Deprecated in WSC 2.0 */
+#define WPS_CONFMET_LABEL           0x0004
+#define WPS_CONFMET_DISPLAY         0x0008
+#define WPS_CONFMET_EXT_NFC_TOK     0x0010
+#define WPS_CONFMET_INT_NFC_TOK     0x0020
+#define WPS_CONFMET_NFC_INTF        0x0040
+#define WPS_CONFMET_PBC             0x0080
+#define WPS_CONFMET_KEYPAD          0x0100
+/* WSC 2.0 */
+#define WPS_CONFMET_VIRT_PBC        0x0280
+#define WPS_CONFMET_PHY_PBC         0x0480
+#define WPS_CONFMET_VIRT_DISPLAY    0x2008
+#define WPS_CONFMET_PHY_DISPLAY     0x4008
+
+/* WPS error messages */
+#define WPS_ERROR_NO_ERROR                0
+#define WPS_ERROR_OOB_INT_READ_ERR        1
+#define WPS_ERROR_DECRYPT_CRC_FAIL        2
+#define WPS_ERROR_CHAN24_NOT_SUPP         3
+#define WPS_ERROR_CHAN50_NOT_SUPP         4
+#define WPS_ERROR_SIGNAL_WEAK             5    /* Deprecated in WSC 2.0 */
+#define WPS_ERROR_NW_AUTH_FAIL            6    /* Deprecated in WSC 2.0 */
+#define WPS_ERROR_NW_ASSOC_FAIL           7    /* Deprecated in WSC 2.0 */
+#define WPS_ERROR_NO_DHCP_RESP            8    /* Deprecated in WSC 2.0 */
+#define WPS_ERROR_FAILED_DHCP_CONF        9    /* Deprecated in WSC 2.0 */
+#define WPS_ERROR_IP_ADDR_CONFLICT        10   /* Deprecated in WSC 2.0 */
+#define WPS_ERROR_FAIL_CONN_REGISTRAR     11
+#define WPS_ERROR_MULTI_PBC_DETECTED      12
+#define WPS_ERROR_ROGUE_SUSPECTED         13
+#define WPS_ERROR_DEVICE_BUSY             14
+#define WPS_ERROR_SETUP_LOCKED            15
+#define WPS_ERROR_MSG_TIMEOUT             16   /* Deprecated in WSC 2.0 */
+#define WPS_ERROR_REG_SESSION_TIMEOUT     17   /* Deprecated in WSC 2.0 */
+#define WPS_ERROR_DEV_PWD_AUTH_FAIL       18
+#define WPS_ERROR_60GHZ_NOT_SUPPORT       19
+#define WPS_ERROR_PKH_MISMATCH            20   /* Public Key Hash Mismatch */
+
+/* Connection types */
+#define WPS_CONNTYPE_ESS    0x01
+#define WPS_CONNTYPE_IBSS   0x02
+
+/* Device password ID */
+#define WPS_DEVICEPWDID_DEFAULT          0x0000
+#define WPS_DEVICEPWDID_USER_SPEC        0x0001
+#define WPS_DEVICEPWDID_MACHINE_SPEC     0x0002
+#define WPS_DEVICEPWDID_REKEY            0x0003
+#define WPS_DEVICEPWDID_PUSH_BTN         0x0004
+#define WPS_DEVICEPWDID_REG_SPEC         0x0005
+#define WPS_DEVICEPWDID_IBSS             0x0006
+#define WPS_DEVICEPWDID_NFC_CHO          0x0007        /* NFC-Connection-Handover */
+#define WPS_DEVICEPWDID_WFDS             0x0008        /* Wi-Fi Direct Services Specification */
+
+/* Encryption type */
+#define WPS_ENCRTYPE_NONE    0x0001
+#define WPS_ENCRTYPE_WEP     0x0002    /* Deprecated in WSC 2.0 */
+#define WPS_ENCRTYPE_TKIP    0x0004    /* Deprecated in version 2.0. TKIP can only
+                                         * be advertised on the AP when Mixed Mode
+                                         * is enabled (Encryption Type is 0x000c).
+                                         */
+#define WPS_ENCRTYPE_AES     0x0008
+
+
+/* WPS Message Types */
+#define WPS_ID_BEACON            0x01
+#define WPS_ID_PROBE_REQ         0x02
+#define WPS_ID_PROBE_RESP        0x03
+#define WPS_ID_MESSAGE_M1        0x04
+#define WPS_ID_MESSAGE_M2        0x05
+#define WPS_ID_MESSAGE_M2D       0x06
+#define WPS_ID_MESSAGE_M3        0x07
+#define WPS_ID_MESSAGE_M4        0x08
+#define WPS_ID_MESSAGE_M5        0x09
+#define WPS_ID_MESSAGE_M6        0x0A
+#define WPS_ID_MESSAGE_M7        0x0B
+#define WPS_ID_MESSAGE_M8        0x0C
+#define WPS_ID_MESSAGE_ACK       0x0D
+#define WPS_ID_MESSAGE_NACK      0x0E
+#define WPS_ID_MESSAGE_DONE      0x0F
+
+/* WSP private ID for local use */
+#define WPS_PRIVATE_ID_IDENTITY                (WPS_ID_MESSAGE_DONE + 1)
+#define WPS_PRIVATE_ID_WPS_START       (WPS_ID_MESSAGE_DONE + 2)
+#define WPS_PRIVATE_ID_FAILURE         (WPS_ID_MESSAGE_DONE + 3)
+#define WPS_PRIVATE_ID_FRAG            (WPS_ID_MESSAGE_DONE + 4)
+#define WPS_PRIVATE_ID_FRAG_ACK                (WPS_ID_MESSAGE_DONE + 5)
+#define WPS_PRIVATE_ID_EAPOL_START     (WPS_ID_MESSAGE_DONE + 6)
+
+
+/* Device Type categories for primary and secondary device types */
+#define WPS_DEVICE_TYPE_CAT_COMPUTER        1
+#define WPS_DEVICE_TYPE_CAT_INPUT_DEVICE    2
+#define WPS_DEVICE_TYPE_CAT_PRINTER         3
+#define WPS_DEVICE_TYPE_CAT_CAMERA          4
+#define WPS_DEVICE_TYPE_CAT_STORAGE         5
+#define WPS_DEVICE_TYPE_CAT_NW_INFRA        6
+#define WPS_DEVICE_TYPE_CAT_DISPLAYS        7
+#define WPS_DEVICE_TYPE_CAT_MM_DEVICES      8
+#define WPS_DEVICE_TYPE_CAT_GAME_DEVICES    9
+#define WPS_DEVICE_TYPE_CAT_TELEPHONE       10
+#define WPS_DEVICE_TYPE_CAT_AUDIO_DEVICES   11 /* WSC 2.0 */
+
+/* Device Type sub categories for primary and secondary device types */
+#define WPS_DEVICE_TYPE_SUB_CAT_COMP_PC         1
+#define WPS_DEVICE_TYPE_SUB_CAT_COMP_SERVER     2
+#define WPS_DEVICE_TYPE_SUB_CAT_COMP_MEDIA_CTR  3
+#define WPS_DEVICE_TYPE_SUB_CAT_COMP_UM_PC      4      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_COMP_NOTEBOOK   5      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_COMP_DESKTOP    6      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_COMP_MID        7      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_COMP_NETBOOK    8      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_INP_Keyboard    1      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_INP_MOUSE       2      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_INP_JOYSTICK    3      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_INP_TRACKBALL   4      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_INP_GAM_CTRL    5      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_INP_REMOTE      6      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_INP_TOUCHSCREEN 7      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_INP_BIO_READER  8      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_INP_BAR_READER  9      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_PRTR_PRINTER    1
+#define WPS_DEVICE_TYPE_SUB_CAT_PRTR_SCANNER    2
+#define WPS_DEVICE_TYPE_SUB_CAT_PRTR_FAX        3      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_PRTR_COPIER     4      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_PRTR_ALLINONE   5      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_CAM_DGTL_STILL  1
+#define WPS_DEVICE_TYPE_SUB_CAT_CAM_VIDEO_CAM   2      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_CAM_WEB_CAM     3      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_CAM_SECU_CAM    4      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_STOR_NAS        1
+#define WPS_DEVICE_TYPE_SUB_CAT_NW_AP           1
+#define WPS_DEVICE_TYPE_SUB_CAT_NW_ROUTER       2
+#define WPS_DEVICE_TYPE_SUB_CAT_NW_SWITCH       3
+#define WPS_DEVICE_TYPE_SUB_CAT_NW_GATEWAY      4      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_NW_BRIDGE       5      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_DISP_TV         1
+#define WPS_DEVICE_TYPE_SUB_CAT_DISP_PIC_FRAME  2
+#define WPS_DEVICE_TYPE_SUB_CAT_DISP_PROJECTOR  3
+#define WPS_DEVICE_TYPE_SUB_CAT_DISP_MONITOR    4      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_MM_DAR          1
+#define WPS_DEVICE_TYPE_SUB_CAT_MM_PVR          2
+#define WPS_DEVICE_TYPE_SUB_CAT_MM_MCX          3
+#define WPS_DEVICE_TYPE_SUB_CAT_MM_STB          4      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_MM_MS_ME        5      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_MM_PVP          6      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_GAM_XBOX        1
+#define WPS_DEVICE_TYPE_SUB_CAT_GAM_XBOX_360    2
+#define WPS_DEVICE_TYPE_SUB_CAT_GAM_PS          3
+#define WPS_DEVICE_TYPE_SUB_CAT_GAM_GC          4      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_GAM_PGD         5      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_PHONE_WM        1
+#define WPS_DEVICE_TYPE_SUB_CAT_PHONE_PSM       2      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_PHONE_PDM       3      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_PHONE_SSM       4      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_PHONE_SDM       5      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_AUDIO_TUNER     1      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_AUDIO_SPEAKERS  2      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_AUDIO_PMP       3      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_AUDIO_HEADSET   4      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_AUDIO_HPHONE    5      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_AUDIO_MPHONE    6      /* WSC 2.0 */
+#define WPS_DEVICE_TYPE_SUB_CAT_AUDIO_HTS       7      /* WSC 2.0 */
+
+
+/* Device request/response type */
+#define WPS_MSGTYPE_ENROLLEE_INFO_ONLY    0x00
+#define WPS_MSGTYPE_ENROLLEE_OPEN_8021X   0x01
+#define WPS_MSGTYPE_REGISTRAR             0x02
+#define WPS_MSGTYPE_AP_WLAN_MGR           0x03
+
+/* RF Band */
+#define WPS_RFBAND_24GHZ    0x01
+#define WPS_RFBAND_50GHZ    0x02
+
+/* Simple Config state */
+#define WPS_SCSTATE_UNCONFIGURED    0x01
+#define WPS_SCSTATE_CONFIGURED      0x02
+#define WPS_SCSTATE_OFF 11
+
+/* WPS Vendor extension key */
+#define WPS_OUI_HEADER_LEN 2
+#define WPS_OUI_HEADER_SIZE 4
+#define WPS_OUI_FIXED_HEADER_OFF 16
+#define WPS_WFA_SUBID_V2_OFF 3
+#define WPS_WFA_V2_OFF 5
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _WPS_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/rte_ioctl.h b/drivers/net/wireless/bcmdhd_1363/include/rte_ioctl.h
new file mode 100644 (file)
index 0000000..2176c90
--- /dev/null
@@ -0,0 +1,85 @@
+/*
+ * HND Run Time Environment ioctl.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: rte_ioctl.h 514727 2014-11-12 03:02:48Z $
+ */
+
+#ifndef _rte_ioctl_h_
+#define _rte_ioctl_h_
+
+/* RTE IOCTL definitions for generic ether devices */
+#define RTEGHWADDR             0x8901
+#define RTESHWADDR             0x8902
+#define RTEGMTU                        0x8903
+#define RTEGSTATS              0x8904
+#define RTEGALLMULTI           0x8905
+#define RTESALLMULTI           0x8906
+#define RTEGPROMISC            0x8907
+#define RTESPROMISC            0x8908
+#define RTESMULTILIST  0x8909
+#define RTEGUP                 0x890A
+#define RTEGPERMADDR           0x890B
+#define RTEDEVPWRSTCHG         0x890C  /* Device pwr state change for PCIedev */
+#define RTEDEVPMETOGGLE                0x890D  /* Toggle PME# to wake up the host */
+
+#define RTE_IOCTL_QUERY                        0x00
+#define RTE_IOCTL_SET                  0x01
+#define RTE_IOCTL_OVL_IDX_MASK 0x1e
+#define RTE_IOCTL_OVL_RSV              0x20
+#define RTE_IOCTL_OVL                  0x40
+#define RTE_IOCTL_OVL_IDX_SHIFT        1
+
+enum hnd_ioctl_cmd {
+       HND_RTE_DNGL_IS_SS = 1, /* true if device connected at super speed */
+
+       /* PCIEDEV specific wl <--> bus ioctls */
+       BUS_GET_VAR = 2,
+       BUS_SET_VAR = 3,
+       BUS_FLUSH_RXREORDER_Q = 4,
+       BUS_SET_LTR_STATE = 5,
+       BUS_FLUSH_CHAINED_PKTS = 6,
+       BUS_SET_COPY_COUNT = 7
+};
+
+#define SDPCMDEV_SET_MAXTXPKTGLOM      1
+
+typedef struct memuse_info {
+       uint16 ver;                     /* version of this struct */
+       uint16 len;                     /* length in bytes of this structure */
+       uint32 tot;                     /* Total memory */
+       uint32 text_len;        /* Size of Text segment memory */
+       uint32 data_len;        /* Size of Data segment memory */
+       uint32 bss_len;         /* Size of BSS segment memory */
+
+       uint32 arena_size;      /* Total Heap size */
+       uint32 arena_free;      /* Heap memory available or free */
+       uint32 inuse_size;      /* Heap memory currently in use */
+       uint32 inuse_hwm;       /* High watermark of memory - reclaimed memory */
+       uint32 inuse_overhead;  /* tally of allocated mem_t blocks */
+       uint32 inuse_total;     /* Heap in-use + Heap overhead memory  */
+} memuse_info_t;
+
+#endif /* _rte_ioctl_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/sbchipc.h b/drivers/net/wireless/bcmdhd_1363/include/sbchipc.h
new file mode 100644 (file)
index 0000000..ad68de7
--- /dev/null
@@ -0,0 +1,3761 @@
+/*
+ * SiliconBackplane Chipcommon core hardware definitions.
+ *
+ * The chipcommon core provides chip identification, SB control,
+ * JTAG, 0/1/2 UARTs, clock frequency control, a watchdog interrupt timer,
+ * GPIO interface, extbus, and support for serial and parallel flashes.
+ *
+ * $Id: sbchipc.h 574579 2015-07-27 15:36:37Z $
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ */
+
+#ifndef        _SBCHIPC_H
+#define        _SBCHIPC_H
+
+#if !defined(_LANGUAGE_ASSEMBLY) && !defined(__ASSEMBLY__)
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define        _PADLINE(line)  pad ## line
+#define        _XSTR(line)     _PADLINE(line)
+#define        PAD             _XSTR(__LINE__)
+#endif /* PAD */
+
+/**
+ * In chipcommon rev 49 the pmu registers have been moved from chipc to the pmu core if the
+ * 'AOBPresent' bit of 'CoreCapabilitiesExt' is set. If this field is set, the traditional chipc to
+ * [pmu|gci|sreng] register interface is deprecated and removed. These register blocks would instead
+ * be assigned their respective chipc-specific address space and connected to the Always On
+ * Backplane via the APB interface.
+ */
+typedef volatile struct {
+       uint32  PAD[384];
+       uint32  pmucontrol;             /* 0x600 */
+       uint32  pmucapabilities;
+       uint32  pmustatus;
+       uint32  res_state;
+       uint32  res_pending;
+       uint32  pmutimer;
+       uint32  min_res_mask;
+       uint32  max_res_mask;
+       uint32  res_table_sel;
+       uint32  res_dep_mask;
+       uint32  res_updn_timer;
+       uint32  res_timer;
+       uint32  clkstretch;
+       uint32  pmuwatchdog;
+       uint32  gpiosel;                /* 0x638, rev >= 1 */
+       uint32  gpioenable;             /* 0x63c, rev >= 1 */
+       uint32  res_req_timer_sel;
+       uint32  res_req_timer;
+       uint32  res_req_mask;
+       uint32  PAD;
+       uint32  chipcontrol_addr;       /* 0x650 */
+       uint32  chipcontrol_data;       /* 0x654 */
+       uint32  regcontrol_addr;
+       uint32  regcontrol_data;
+       uint32  pllcontrol_addr;
+       uint32  pllcontrol_data;
+       uint32  pmustrapopt;            /* 0x668, corerev >= 28 */
+       uint32  pmu_xtalfreq;           /* 0x66C, pmurev >= 10 */
+       uint32  retention_ctl;          /* 0x670 */
+       uint32  PAD[3];
+       uint32  retention_grpidx;       /* 0x680 */
+       uint32  retention_grpctl;       /* 0x684 */
+       uint32  PAD[20];
+       uint32  pmucontrol_ext;         /* 0x6d8 */
+       uint32  slowclkperiod;          /* 0x6dc */
+       uint32  PAD[8];
+       uint32  pmuintmask0;            /* 0x700 */
+       uint32  pmuintmask1;            /* 0x704 */
+       uint32  PAD[14];
+       uint32  pmuintstatus;           /* 0x740 */
+       uint32  PAD[15];
+       uint32  pmuintctrl0;            /* 0x780 */
+} pmuregs_t;
+
+typedef struct eci_prerev35 {
+       uint32  eci_output;
+       uint32  eci_control;
+       uint32  eci_inputlo;
+       uint32  eci_inputmi;
+       uint32  eci_inputhi;
+       uint32  eci_inputintpolaritylo;
+       uint32  eci_inputintpolaritymi;
+       uint32  eci_inputintpolarityhi;
+       uint32  eci_intmasklo;
+       uint32  eci_intmaskmi;
+       uint32  eci_intmaskhi;
+       uint32  eci_eventlo;
+       uint32  eci_eventmi;
+       uint32  eci_eventhi;
+       uint32  eci_eventmasklo;
+       uint32  eci_eventmaskmi;
+       uint32  eci_eventmaskhi;
+       uint32  PAD[3];
+} eci_prerev35_t;
+
+typedef struct eci_rev35 {
+       uint32  eci_outputlo;
+       uint32  eci_outputhi;
+       uint32  eci_controllo;
+       uint32  eci_controlhi;
+       uint32  eci_inputlo;
+       uint32  eci_inputhi;
+       uint32  eci_inputintpolaritylo;
+       uint32  eci_inputintpolarityhi;
+       uint32  eci_intmasklo;
+       uint32  eci_intmaskhi;
+       uint32  eci_eventlo;
+       uint32  eci_eventhi;
+       uint32  eci_eventmasklo;
+       uint32  eci_eventmaskhi;
+       uint32  eci_auxtx;
+       uint32  eci_auxrx;
+       uint32  eci_datatag;
+       uint32  eci_uartescvalue;
+       uint32  eci_autobaudctr;
+       uint32  eci_uartfifolevel;
+} eci_rev35_t;
+
+typedef struct flash_config {
+       uint32  PAD[19];
+       /* Flash struct configuration registers (0x18c) for BCM4706 (corerev = 31) */
+       uint32 flashstrconfig;
+} flash_config_t;
+
+typedef volatile struct {
+       uint32  chipid;                 /* 0x0 */
+       uint32  capabilities;
+       uint32  corecontrol;            /* corerev >= 1 */
+       uint32  bist;
+
+       /* OTP */
+       uint32  otpstatus;              /* 0x10, corerev >= 10 */
+       uint32  otpcontrol;
+       uint32  otpprog;
+       uint32  otplayout;              /* corerev >= 23 */
+
+       /* Interrupt control */
+       uint32  intstatus;              /* 0x20 */
+       uint32  intmask;
+
+       /* Chip specific regs */
+       uint32  chipcontrol;            /* 0x28, rev >= 11 */
+       uint32  chipstatus;             /* 0x2c, rev >= 11 */
+
+       /* Jtag Master */
+       uint32  jtagcmd;                /* 0x30, rev >= 10 */
+       uint32  jtagir;
+       uint32  jtagdr;
+       uint32  jtagctrl;
+
+       /* serial flash interface registers */
+       uint32  flashcontrol;           /* 0x40 */
+       uint32  flashaddress;
+       uint32  flashdata;
+       uint32  otplayoutextension;     /* rev >= 35 */
+
+       /* Silicon backplane configuration broadcast control */
+       uint32  broadcastaddress;       /* 0x50 */
+       uint32  broadcastdata;
+
+       /* gpio - cleared only by power-on-reset */
+       uint32  gpiopullup;             /* 0x58, corerev >= 20 */
+       uint32  gpiopulldown;           /* 0x5c, corerev >= 20 */
+       uint32  gpioin;                 /* 0x60 */
+       uint32  gpioout;                /* 0x64 */
+       uint32  gpioouten;              /* 0x68 */
+       uint32  gpiocontrol;            /* 0x6C */
+       uint32  gpiointpolarity;        /* 0x70 */
+       uint32  gpiointmask;            /* 0x74 */
+
+       /* GPIO events corerev >= 11 */
+       uint32  gpioevent;
+       uint32  gpioeventintmask;
+
+       /* Watchdog timer */
+       uint32  watchdog;               /* 0x80 */
+
+       /* GPIO events corerev >= 11 */
+       uint32  gpioeventintpolarity;
+
+       /* GPIO based LED powersave registers corerev >= 16 */
+       uint32  gpiotimerval;           /* 0x88 */
+       uint32  gpiotimeroutmask;
+
+       /* clock control */
+       uint32  clockcontrol_n;         /* 0x90 */
+       uint32  clockcontrol_sb;        /* aka m0 */
+       uint32  clockcontrol_pci;       /* aka m1 */
+       uint32  clockcontrol_m2;        /* mii/uart/mipsref */
+       uint32  clockcontrol_m3;        /* cpu */
+       uint32  clkdiv;                 /* corerev >= 3 */
+       uint32  gpiodebugsel;           /* corerev >= 28 */
+       uint32  capabilities_ext;                       /* 0xac  */
+
+       /* pll delay registers (corerev >= 4) */
+       uint32  pll_on_delay;           /* 0xb0 */
+       uint32  fref_sel_delay;
+       uint32  slow_clk_ctl;           /* 5 < corerev < 10 */
+       uint32  PAD;
+
+       /* Instaclock registers (corerev >= 10) */
+       uint32  system_clk_ctl;         /* 0xc0 */
+       uint32  clkstatestretch;
+       uint32  PAD[2];
+
+       /* Indirect backplane access (corerev >= 22) */
+       uint32  bp_addrlow;             /* 0xd0 */
+       uint32  bp_addrhigh;
+       uint32  bp_data;
+       uint32  PAD;
+       uint32  bp_indaccess;
+       /* SPI registers, corerev >= 37 */
+       uint32  gsioctrl;
+       uint32  gsioaddress;
+       uint32  gsiodata;
+
+       /* More clock dividers (corerev >= 32) */
+       uint32  clkdiv2;
+       /* FAB ID (corerev >= 40) */
+       uint32  otpcontrol1;
+       uint32  fabid;                  /* 0xf8 */
+
+       /* In AI chips, pointer to erom */
+       uint32  eromptr;                /* 0xfc */
+
+       /* ExtBus control registers (corerev >= 3) */
+       uint32  pcmcia_config;          /* 0x100 */
+       uint32  pcmcia_memwait;
+       uint32  pcmcia_attrwait;
+       uint32  pcmcia_iowait;
+       uint32  ide_config;
+       uint32  ide_memwait;
+       uint32  ide_attrwait;
+       uint32  ide_iowait;
+       uint32  prog_config;
+       uint32  prog_waitcount;
+       uint32  flash_config;
+       uint32  flash_waitcount;
+       uint32  SECI_config;            /* 0x130 SECI configuration */
+       uint32  SECI_status;
+       uint32  SECI_statusmask;
+       uint32  SECI_rxnibchanged;
+
+       uint32  PAD[20];
+
+       /* SROM interface (corerev >= 32) */
+       uint32  sromcontrol;            /* 0x190 */
+       uint32  sromaddress;
+       uint32  sromdata;
+       uint32  PAD[1];                         /* 0x19C */
+       /* NAND flash registers for BCM4706 (corerev = 31) */
+       uint32  nflashctrl;         /* 0x1a0 */
+       uint32  nflashconf;
+       uint32  nflashcoladdr;
+       uint32  nflashrowaddr;
+       uint32  nflashdata;
+       uint32  nflashwaitcnt0;         /* 0x1b4 */
+       uint32  PAD[2];
+
+       uint32  seci_uart_data;         /* 0x1C0 */
+       uint32  seci_uart_bauddiv;
+       uint32  seci_uart_fcr;
+       uint32  seci_uart_lcr;
+       uint32  seci_uart_mcr;
+       uint32  seci_uart_lsr;
+       uint32  seci_uart_msr;
+       uint32  seci_uart_baudadj;
+       /* Clock control and hardware workarounds (corerev >= 20) */
+       uint32  clk_ctl_st;             /* 0x1e0 */
+       uint32  hw_war;
+       uint32  PAD[70];
+
+       /* UARTs */
+       uint8   uart0data;              /* 0x300 */
+       uint8   uart0imr;
+       uint8   uart0fcr;
+       uint8   uart0lcr;
+       uint8   uart0mcr;
+       uint8   uart0lsr;
+       uint8   uart0msr;
+       uint8   uart0scratch;
+       uint8   PAD[248];               /* corerev >= 1 */
+
+       uint8   uart1data;              /* 0x400 */
+       uint8   uart1imr;
+       uint8   uart1fcr;
+       uint8   uart1lcr;
+       uint8   uart1mcr;
+       uint8   uart1lsr;
+       uint8   uart1msr;
+       uint8   uart1scratch;           /* 0x407 */
+       uint32  PAD[62];
+
+       /* save/restore, corerev >= 48 */
+       uint32  sr_capability;          /* 0x500 */
+       uint32  sr_control0;            /* 0x504 */
+       uint32  sr_control1;            /* 0x508 */
+       uint32  gpio_control;           /* 0x50C */
+       uint32  PAD[60];
+
+       /* PMU registers (corerev >= 20) */
+       /* Note: all timers driven by ILP clock are updated asynchronously to HT/ALP.
+        * The CPU must read them twice, compare, and retry if different.
+        */
+       uint32  pmucontrol;             /* 0x600 */
+       uint32  pmucapabilities;
+       uint32  pmustatus;
+       uint32  res_state;
+       uint32  res_pending;
+       uint32  pmutimer;
+       uint32  min_res_mask;
+       uint32  max_res_mask;
+       uint32  res_table_sel;
+       uint32  res_dep_mask;
+       uint32  res_updn_timer;
+       uint32  res_timer;
+       uint32  clkstretch;
+       uint32  pmuwatchdog;
+       uint32  gpiosel;                /* 0x638, rev >= 1 */
+       uint32  gpioenable;             /* 0x63c, rev >= 1 */
+       uint32  res_req_timer_sel;
+       uint32  res_req_timer;
+       uint32  res_req_mask;
+       uint32  PAD;
+       uint32  chipcontrol_addr;       /* 0x650 */
+       uint32  chipcontrol_data;       /* 0x654 */
+       uint32  regcontrol_addr;
+       uint32  regcontrol_data;
+       uint32  pllcontrol_addr;
+       uint32  pllcontrol_data;
+       uint32  pmustrapopt;            /* 0x668, corerev >= 28 */
+       uint32  pmu_xtalfreq;           /* 0x66C, pmurev >= 10 */
+       uint32  retention_ctl;          /* 0x670 */
+       uint32  PAD[3];
+       uint32  retention_grpidx;       /* 0x680 */
+       uint32  retention_grpctl;       /* 0x684 */
+       uint32  PAD[20];
+       uint32  pmucontrol_ext;         /* 0x6d8 */
+       uint32  slowclkperiod;          /* 0x6dc */
+       uint32  PAD[8];
+       uint32  pmuintmask0;            /* 0x700 */
+       uint32  pmuintmask1;            /* 0x704 */
+       uint32  PAD[14];
+       uint32  pmuintstatus;           /* 0x740 */
+       uint32  PAD[15];
+       uint32  pmuintctrl0;            /* 0x780 */
+       uint32  PAD[31];
+       uint16  sromotp[512];           /* 0x800 */
+#ifdef CCNFLASH_SUPPORT
+       /* Nand flash MLC controller registers (corerev >= 38) */
+       uint32  nand_revision;          /* 0xC00 */
+       uint32  nand_cmd_start;
+       uint32  nand_cmd_addr_x;
+       uint32  nand_cmd_addr;
+       uint32  nand_cmd_end_addr;
+       uint32  nand_cs_nand_select;
+       uint32  nand_cs_nand_xor;
+       uint32  PAD;
+       uint32  nand_spare_rd0;
+       uint32  nand_spare_rd4;
+       uint32  nand_spare_rd8;
+       uint32  nand_spare_rd12;
+       uint32  nand_spare_wr0;
+       uint32  nand_spare_wr4;
+       uint32  nand_spare_wr8;
+       uint32  nand_spare_wr12;
+       uint32  nand_acc_control;
+       uint32  PAD;
+       uint32  nand_config;
+       uint32  PAD;
+       uint32  nand_timing_1;
+       uint32  nand_timing_2;
+       uint32  nand_semaphore;
+       uint32  PAD;
+       uint32  nand_devid;
+       uint32  nand_devid_x;
+       uint32  nand_block_lock_status;
+       uint32  nand_intfc_status;
+       uint32  nand_ecc_corr_addr_x;
+       uint32  nand_ecc_corr_addr;
+       uint32  nand_ecc_unc_addr_x;
+       uint32  nand_ecc_unc_addr;
+       uint32  nand_read_error_count;
+       uint32  nand_corr_stat_threshold;
+       uint32  PAD[2];
+       uint32  nand_read_addr_x;
+       uint32  nand_read_addr;
+       uint32  nand_page_program_addr_x;
+       uint32  nand_page_program_addr;
+       uint32  nand_copy_back_addr_x;
+       uint32  nand_copy_back_addr;
+       uint32  nand_block_erase_addr_x;
+       uint32  nand_block_erase_addr;
+       uint32  nand_inv_read_addr_x;
+       uint32  nand_inv_read_addr;
+       uint32  PAD[2];
+       uint32  nand_blk_wr_protect;
+       uint32  PAD[3];
+       uint32  nand_acc_control_cs1;
+       uint32  nand_config_cs1;
+       uint32  nand_timing_1_cs1;
+       uint32  nand_timing_2_cs1;
+       uint32  PAD[20];
+       uint32  nand_spare_rd16;
+       uint32  nand_spare_rd20;
+       uint32  nand_spare_rd24;
+       uint32  nand_spare_rd28;
+       uint32  nand_cache_addr;
+       uint32  nand_cache_data;
+       uint32  nand_ctrl_config;
+       uint32  nand_ctrl_status;
+#endif /* CCNFLASH_SUPPORT */
+       uint32  gci_corecaps0; /* GCI starting at 0xC00 */
+       uint32  gci_corecaps1;
+       uint32  gci_corecaps2;
+       uint32  gci_corectrl;
+       uint32  gci_corestat; /* 0xC10 */
+       uint32  gci_intstat; /* 0xC14 */
+       uint32  gci_intmask; /* 0xC18 */
+       uint32  gci_wakemask; /* 0xC1C */
+       uint32  gci_levelintstat; /* 0xC20 */
+       uint32  gci_eventintstat; /* 0xC24 */
+       uint32  PAD[6];
+       uint32  gci_indirect_addr; /* 0xC40 */
+       uint32  gci_gpioctl; /* 0xC44 */
+       uint32  gci_gpiostatus;
+       uint32  gci_gpiomask; /* 0xC4C */
+       uint32  PAD;
+       uint32  gci_miscctl; /* 0xC54 */
+       uint32  gci_gpiointmask;
+       uint32  gci_gpiowakemask;
+       uint32  gci_input[32]; /* C60 */
+       uint32  gci_event[32]; /* CE0 */
+       uint32  gci_output[4]; /* D60 */
+       uint32  gci_control_0; /* 0xD70 */
+       uint32  gci_control_1; /* 0xD74 */
+       uint32  gci_intpolreg; /* 0xD78 */
+       uint32  gci_levelintmask; /* 0xD7C */
+       uint32  gci_eventintmask; /* 0xD80 */
+       uint32  PAD[3];
+       uint32  gci_inbandlevelintmask; /* 0xD90 */
+       uint32  gci_inbandeventintmask; /* 0xD94 */
+       uint32  PAD[2];
+       uint32  gci_seciauxtx; /* 0xDA0 */
+       uint32  gci_seciauxrx; /* 0xDA4 */
+       uint32  gci_secitx_datatag; /* 0xDA8 */
+       uint32  gci_secirx_datatag; /* 0xDAC */
+       uint32  gci_secitx_datamask; /* 0xDB0 */
+       uint32  gci_seciusef0tx_reg; /* 0xDB4 */
+       uint32  gci_secif0tx_offset; /* 0xDB8 */
+       uint32  gci_secif0rx_offset; /* 0xDBC */
+       uint32  gci_secif1tx_offset; /* 0xDC0 */
+       uint32  gci_rxfifo_common_ctrl; /* 0xDC4 */
+       uint32  gci_rxfifoctrl; /* 0xDC8 */
+       uint32  gci_uartreadid; /* DCC */
+       uint32  gci_uartescval; /* DD0 */
+       uint32  PAD;
+       uint32  gci_secififolevel; /* DD8 */
+       uint32  gci_seciuartdata; /* DDC */
+       uint32  gci_secibauddiv; /* DE0 */
+       uint32  gci_secifcr; /* DE4 */
+       uint32  gci_secilcr; /* DE8 */
+       uint32  gci_secimcr; /* DEC */
+       uint32  gci_secilsr; /* DF0 */
+       uint32  gci_secimsr; /* DF4 */
+       uint32  gci_baudadj; /* DF8 */
+       uint32  PAD;
+       uint32  gci_chipctrl; /* 0xE00 */
+       uint32  gci_chipsts; /* 0xE04 */
+       uint32  gci_gpioout; /* 0xE08 */
+       uint32  gci_gpioout_read; /* 0xE0C */
+       uint32  gci_mpwaketx; /* 0xE10 */
+       uint32  gci_mpwakedetect; /* 0xE14 */
+       uint32  gci_seciin_ctrl; /* 0xE18 */
+       uint32  gci_seciout_ctrl; /* 0xE1C */
+       uint32  gci_seciin_auxfifo_en; /* 0xE20 */
+       uint32  gci_seciout_txen_txbr; /* 0xE24 */
+       uint32  gci_seciin_rxbrstatus; /* 0xE28 */
+       uint32  gci_seciin_rxerrstatus; /* 0xE2C */
+       uint32  gci_seciin_fcstatus; /* 0xE30 */
+       uint32  gci_seciout_txstatus; /* 0xE34 */
+       uint32  gci_seciout_txbrstatus; /* 0xE38 */
+} chipcregs_t;
+
+#endif /* !_LANGUAGE_ASSEMBLY && !__ASSEMBLY__ */
+
+
+#define        CC_CHIPID               0
+#define        CC_CAPABILITIES         4
+#define        CC_CHIPST               0x2c
+#define        CC_EROMPTR              0xfc
+
+#define        CC_OTPST                0x10
+#define        CC_INTSTATUS            0x20
+#define        CC_INTMASK              0x24
+#define        CC_JTAGCMD              0x30
+#define        CC_JTAGIR               0x34
+#define        CC_JTAGDR               0x38
+#define        CC_JTAGCTRL             0x3c
+#define        CC_GPIOPU               0x58
+#define        CC_GPIOPD               0x5c
+#define        CC_GPIOIN               0x60
+#define        CC_GPIOOUT              0x64
+#define        CC_GPIOOUTEN            0x68
+#define        CC_GPIOCTRL             0x6c
+#define        CC_GPIOPOL              0x70
+#define        CC_GPIOINTM             0x74
+#define        CC_GPIOEVENT            0x78
+#define        CC_GPIOEVENTMASK        0x7c
+#define        CC_WATCHDOG             0x80
+#define        CC_GPIOEVENTPOL         0x84
+#define        CC_CLKC_N               0x90
+#define        CC_CLKC_M0              0x94
+#define        CC_CLKC_M1              0x98
+#define        CC_CLKC_M2              0x9c
+#define        CC_CLKC_M3              0xa0
+#define        CC_CLKDIV               0xa4
+#define        CC_CAP_EXT              0xac
+#define        CC_SYS_CLK_CTL          0xc0
+#define        CC_CLKDIV2              0xf0
+#define        CC_CLK_CTL_ST           SI_CLK_CTL_ST
+#define        PMU_CTL                 0x600
+#define        PMU_CAP                 0x604
+#define        PMU_ST                  0x608
+#define PMU_RES_STATE          0x60c
+#define PMU_RES_PENDING                0x610
+#define PMU_TIMER              0x614
+#define        PMU_MIN_RES_MASK        0x618
+#define        PMU_MAX_RES_MASK        0x61c
+#define CC_CHIPCTL_ADDR         0x650
+#define CC_CHIPCTL_DATA         0x654
+#define PMU_REG_CONTROL_ADDR   0x658
+#define PMU_REG_CONTROL_DATA   0x65C
+#define PMU_PLL_CONTROL_ADDR   0x660
+#define PMU_PLL_CONTROL_DATA   0x664
+#define CC_SROM_CTRL           0x190
+#define        CC_SROM_OTP             0x800           /* SROM/OTP address space */
+#define CC_GCI_INDIRECT_ADDR_REG       0xC40
+#define CC_GCI_CHIP_CTRL_REG   0xE00
+#define CC_GCI_CC_OFFSET_2     2
+#define CC_GCI_CC_OFFSET_5     5
+#define CC_SWD_CTRL            0x380
+#define CC_SWD_REQACK          0x384
+#define CC_SWD_DATA            0x388
+
+
+#define CHIPCTRLREG0 0x0
+#define CHIPCTRLREG1 0x1
+#define CHIPCTRLREG2 0x2
+#define CHIPCTRLREG3 0x3
+#define CHIPCTRLREG4 0x4
+#define CHIPCTRLREG5 0x5
+#define CHIPCTRLREG6 0x6
+#define REGCTRLREG4 0x4
+#define REGCTRLREG5 0x5
+#define REGCTRLREG6 0x6
+#define MINRESMASKREG 0x618
+#define MAXRESMASKREG 0x61c
+#define CHIPCTRLADDR 0x650
+#define CHIPCTRLDATA 0x654
+#define RSRCTABLEADDR 0x620
+#define PMU_RES_DEP_MASK 0x624
+#define RSRCUPDWNTIME 0x628
+#define PMUREG_RESREQ_MASK 0x68c
+#define PMUREG_RESREQ_TIMER 0x688
+#define PMUREG_RESREQ_MASK1 0x6f4
+#define PMUREG_RESREQ_TIMER1 0x6f0
+#define EXT_LPO_AVAIL 0x100
+#define LPO_SEL                                        (1 << 0)
+#define CC_EXT_LPO_PU 0x200000
+#define GC_EXT_LPO_PU 0x2
+#define CC_INT_LPO_PU 0x100000
+#define GC_INT_LPO_PU 0x1
+#define EXT_LPO_SEL 0x8
+#define INT_LPO_SEL 0x4
+#define ENABLE_FINE_CBUCK_CTRL                         (1 << 30)
+#define REGCTRL5_PWM_AUTO_CTRL_MASK            0x007e0000
+#define REGCTRL5_PWM_AUTO_CTRL_SHIFT           17
+#define REGCTRL6_PWM_AUTO_CTRL_MASK            0x3fff0000
+#define REGCTRL6_PWM_AUTO_CTRL_SHIFT           16
+#define CC_BP_IND_ACCESS_START_SHIFT           9
+#define CC_BP_IND_ACCESS_START_MASK            (1 << CC_BP_IND_ACCESS_START_SHIFT)
+#define CC_BP_IND_ACCESS_RDWR_SHIFT            8
+#define CC_BP_IND_ACCESS_RDWR_MASK             (1 << CC_BP_IND_ACCESS_RDWR_SHIFT)
+#define CC_BP_IND_ACCESS_ERROR_SHIFT           10
+#define CC_BP_IND_ACCESS_ERROR_MASK            (1 << CC_BP_IND_ACCESS_ERROR_SHIFT)
+
+#ifdef SR_DEBUG
+#define SUBCORE_POWER_ON 0x0001
+#define PHY_POWER_ON 0x0010
+#define VDDM_POWER_ON 0x0100
+#define MEMLPLDO_POWER_ON 0x1000
+#define SUBCORE_POWER_ON_CHK 0x00040000
+#define PHY_POWER_ON_CHK 0x00080000
+#define VDDM_POWER_ON_CHK 0x00100000
+#define MEMLPLDO_POWER_ON_CHK 0x00200000
+#endif /* SR_DEBUG */
+
+#ifdef CCNFLASH_SUPPORT
+/* NAND flash support */
+#define CC_NAND_REVISION       0xC00
+#define CC_NAND_CMD_START      0xC04
+#define CC_NAND_CMD_ADDR       0xC0C
+#define CC_NAND_SPARE_RD_0     0xC20
+#define CC_NAND_SPARE_RD_4     0xC24
+#define CC_NAND_SPARE_RD_8     0xC28
+#define CC_NAND_SPARE_RD_C     0xC2C
+#define CC_NAND_CONFIG         0xC48
+#define CC_NAND_DEVID          0xC60
+#define CC_NAND_DEVID_EXT      0xC64
+#define CC_NAND_INTFC_STATUS   0xC6C
+#endif /* CCNFLASH_SUPPORT */
+
+/* chipid */
+#define        CID_ID_MASK             0x0000ffff      /**< Chip Id mask */
+#define        CID_REV_MASK            0x000f0000      /**< Chip Revision mask */
+#define        CID_REV_SHIFT           16              /**< Chip Revision shift */
+#define        CID_PKG_MASK            0x00f00000      /**< Package Option mask */
+#define        CID_PKG_SHIFT           20              /**< Package Option shift */
+#define        CID_CC_MASK             0x0f000000      /**< CoreCount (corerev >= 4) */
+#define CID_CC_SHIFT           24
+#define        CID_TYPE_MASK           0xf0000000      /**< Chip Type */
+#define CID_TYPE_SHIFT         28
+
+/* capabilities */
+#define        CC_CAP_UARTS_MASK       0x00000003      /**< Number of UARTs */
+#define CC_CAP_MIPSEB          0x00000004      /**< MIPS is in big-endian mode */
+#define CC_CAP_UCLKSEL         0x00000018      /**< UARTs clock select */
+#define CC_CAP_UINTCLK         0x00000008      /**< UARTs are driven by internal divided clock */
+#define CC_CAP_UARTGPIO                0x00000020      /**< UARTs own GPIOs 15:12 */
+#define CC_CAP_EXTBUS_MASK     0x000000c0      /**< External bus mask */
+#define CC_CAP_EXTBUS_NONE     0x00000000      /**< No ExtBus present */
+#define CC_CAP_EXTBUS_FULL     0x00000040      /**< ExtBus: PCMCIA, IDE & Prog */
+#define CC_CAP_EXTBUS_PROG     0x00000080      /**< ExtBus: ProgIf only */
+#define        CC_CAP_FLASH_MASK       0x00000700      /**< Type of flash */
+#define        CC_CAP_PLL_MASK         0x00038000      /**< Type of PLL */
+#define CC_CAP_PWR_CTL         0x00040000      /**< Power control */
+#define CC_CAP_OTPSIZE         0x00380000      /**< OTP Size (0 = none) */
+#define CC_CAP_OTPSIZE_SHIFT   19              /**< OTP Size shift */
+#define CC_CAP_OTPSIZE_BASE    5               /**< OTP Size base */
+#define CC_CAP_JTAGP           0x00400000      /**< JTAG Master Present */
+#define CC_CAP_ROM             0x00800000      /**< Internal boot rom active */
+#define CC_CAP_BKPLN64         0x08000000      /**< 64-bit backplane */
+#define        CC_CAP_PMU              0x10000000      /**< PMU Present, rev >= 20 */
+#define        CC_CAP_ECI              0x20000000      /**< ECI Present, rev >= 21 */
+#define        CC_CAP_SROM             0x40000000      /**< Srom Present, rev >= 32 */
+#define        CC_CAP_NFLASH           0x80000000      /**< Nand flash present, rev >= 35 */
+
+#define        CC_CAP2_SECI            0x00000001      /**< SECI Present, rev >= 36 */
+#define        CC_CAP2_GSIO            0x00000002      /**< GSIO (spi/i2c) present, rev >= 37 */
+
+/* capabilities extension */
+#define CC_CAP_EXT_SECI_PRESENT        0x00000001      /**< SECI present */
+#define CC_CAP_EXT_GSIO_PRESENT        0x00000002      /**< GSIO present */
+#define CC_CAP_EXT_GCI_PRESENT  0x00000004     /**< GCI present */
+#define CC_CAP_EXT_AOB_PRESENT  0x00000040     /**< AOB present */
+#define CC_CAP_EXT_SWD_PRESENT  0x00000400     /**< SWD present */
+
+/* WL Channel Info to BT via GCI - bits 40 - 47 */
+#define GCI_WL_CHN_INFO_MASK   (0xFF00)
+/* bits [51:48] - reserved for wlan TX pwr index */
+/* bits [55:52] btc mode indication */
+#define GCI_WL_BTC_MODE_SHIFT  (20)
+#define GCI_WL_BTC_MODE_MASK   (0xF << GCI_WL_BTC_MODE_SHIFT)
+#define GCI_WL_ANT_BIT_MASK    (0x00c0)
+#define GCI_WL_ANT_SHIFT_BITS  (6)
+/* PLL type */
+#define PLL_NONE               0x00000000
+#define PLL_TYPE1              0x00010000      /**< 48MHz base, 3 dividers */
+#define PLL_TYPE2              0x00020000      /**< 48MHz, 4 dividers */
+#define PLL_TYPE3              0x00030000      /**< 25MHz, 2 dividers */
+#define PLL_TYPE4              0x00008000      /**< 48MHz, 4 dividers */
+#define PLL_TYPE5              0x00018000      /**< 25MHz, 4 dividers */
+#define PLL_TYPE6              0x00028000      /**< 100/200 or 120/240 only */
+#define PLL_TYPE7              0x00038000      /**< 25MHz, 4 dividers */
+
+/* ILP clock */
+#define        ILP_CLOCK               32000
+
+/* ALP clock on pre-PMU chips */
+#define        ALP_CLOCK               20000000
+
+#ifdef CFG_SIM
+#define NS_ALP_CLOCK           84922
+#define NS_SLOW_ALP_CLOCK      84922
+#define NS_CPU_CLOCK           534500
+#define NS_SLOW_CPU_CLOCK      534500
+#define NS_SI_CLOCK            271750
+#define NS_SLOW_SI_CLOCK       271750
+#define NS_FAST_MEM_CLOCK      271750
+#define NS_MEM_CLOCK           271750
+#define NS_SLOW_MEM_CLOCK      271750
+#else
+#define NS_ALP_CLOCK           125000000
+#define NS_SLOW_ALP_CLOCK      100000000
+#define NS_CPU_CLOCK           1000000000
+#define NS_SLOW_CPU_CLOCK      800000000
+#define NS_SI_CLOCK            250000000
+#define NS_SLOW_SI_CLOCK       200000000
+#define NS_FAST_MEM_CLOCK      800000000
+#define NS_MEM_CLOCK           533000000
+#define NS_SLOW_MEM_CLOCK      400000000
+#endif /* CFG_SIM */
+
+/* HT clock */
+#define        HT_CLOCK                80000000
+
+/* corecontrol */
+#define CC_UARTCLKO            0x00000001      /**< Drive UART with internal clock */
+#define        CC_SE                   0x00000002      /**< sync clk out enable (corerev >= 3) */
+#define CC_ASYNCGPIO   0x00000004      /**< 1=generate GPIO interrupt without backplane clock */
+#define CC_UARTCLKEN           0x00000008      /**< enable UART Clock (corerev > = 21 */
+
+/* retention_ctl */
+#define RCTL_MEM_RET_SLEEP_LOG_SHIFT   29
+#define RCTL_MEM_RET_SLEEP_LOG_MASK    (1 << RCTL_MEM_RET_SLEEP_LOG_SHIFT)
+
+/* 4321 chipcontrol */
+#define CHIPCTRL_4321A0_DEFAULT        0x3a4
+#define CHIPCTRL_4321A1_DEFAULT        0x0a4
+#define CHIPCTRL_4321_PLL_DOWN 0x800000        /**< serdes PLL down override */
+
+/* Fields in the otpstatus register in rev >= 21 */
+#define OTPS_OL_MASK           0x000000ff
+#define OTPS_OL_MFG            0x00000001      /**< manuf row is locked */
+#define OTPS_OL_OR1            0x00000002      /**< otp redundancy row 1 is locked */
+#define OTPS_OL_OR2            0x00000004      /**< otp redundancy row 2 is locked */
+#define OTPS_OL_GU             0x00000008      /**< general use region is locked */
+#define OTPS_GUP_MASK          0x00000f00
+#define OTPS_GUP_SHIFT         8
+#define OTPS_GUP_HW            0x00000100      /**< h/w subregion is programmed */
+#define OTPS_GUP_SW            0x00000200      /**< s/w subregion is programmed */
+#define OTPS_GUP_CI            0x00000400      /**< chipid/pkgopt subregion is programmed */
+#define OTPS_GUP_FUSE          0x00000800      /**< fuse subregion is programmed */
+#define OTPS_READY             0x00001000
+#define OTPS_RV(x)             (1 << (16 + (x)))       /**< redundancy entry valid */
+#define OTPS_RV_MASK           0x0fff0000
+#define OTPS_PROGOK     0x40000000
+
+/* Fields in the otpcontrol register in rev >= 21 */
+#define OTPC_PROGSEL           0x00000001
+#define OTPC_PCOUNT_MASK       0x0000000e
+#define OTPC_PCOUNT_SHIFT      1
+#define OTPC_VSEL_MASK         0x000000f0
+#define OTPC_VSEL_SHIFT                4
+#define OTPC_TMM_MASK          0x00000700
+#define OTPC_TMM_SHIFT         8
+#define OTPC_ODM               0x00000800
+#define OTPC_PROGEN            0x80000000
+
+/* Fields in the 40nm otpcontrol register in rev >= 40 */
+#define OTPC_40NM_PROGSEL_SHIFT        0
+#define OTPC_40NM_PCOUNT_SHIFT 1
+#define OTPC_40NM_PCOUNT_WR    0xA
+#define OTPC_40NM_PCOUNT_V1X   0xB
+#define OTPC_40NM_REGCSEL_SHIFT        5
+#define OTPC_40NM_REGCSEL_DEF  0x4
+#define OTPC_40NM_PROGIN_SHIFT 8
+#define OTPC_40NM_R2X_SHIFT    10
+#define OTPC_40NM_ODM_SHIFT    11
+#define OTPC_40NM_DF_SHIFT     15
+#define OTPC_40NM_VSEL_SHIFT   16
+#define OTPC_40NM_VSEL_WR      0xA
+#define OTPC_40NM_VSEL_V1X     0xA
+#define OTPC_40NM_VSEL_R1X     0x5
+#define OTPC_40NM_COFAIL_SHIFT 30
+
+#define OTPC1_CPCSEL_SHIFT     0
+#define OTPC1_CPCSEL_DEF       6
+#define OTPC1_TM_SHIFT         8
+#define OTPC1_TM_WR            0x84
+#define OTPC1_TM_V1X           0x84
+#define OTPC1_TM_R1X           0x4
+#define OTPC1_CLK_EN_MASK      0x00020000
+#define OTPC1_CLK_DIV_MASK     0x00FC0000
+
+/* Fields in otpprog in rev >= 21 and HND OTP */
+#define OTPP_COL_MASK          0x000000ff
+#define OTPP_COL_SHIFT         0
+#define OTPP_ROW_MASK          0x0000ff00
+#define OTPP_ROW_MASK9         0x0001ff00              /* for ccrev >= 49 */
+#define OTPP_ROW_SHIFT         8
+#define OTPP_OC_MASK           0x0f000000
+#define OTPP_OC_SHIFT          24
+#define OTPP_READERR           0x10000000
+#define OTPP_VALUE_MASK                0x20000000
+#define OTPP_VALUE_SHIFT       29
+#define OTPP_START_BUSY                0x80000000
+#define        OTPP_READ               0x40000000      /* HND OTP */
+
+/* Fields in otplayout register */
+#define OTPL_HWRGN_OFF_MASK    0x00000FFF
+#define OTPL_HWRGN_OFF_SHIFT   0
+#define OTPL_WRAP_REVID_MASK   0x00F80000
+#define OTPL_WRAP_REVID_SHIFT  19
+#define OTPL_WRAP_TYPE_MASK    0x00070000
+#define OTPL_WRAP_TYPE_SHIFT   16
+#define OTPL_WRAP_TYPE_65NM    0
+#define OTPL_WRAP_TYPE_40NM    1
+#define OTPL_ROW_SIZE_MASK     0x0000F000
+#define OTPL_ROW_SIZE_SHIFT    12
+
+/* otplayout reg corerev >= 36 */
+#define OTP_CISFORMAT_NEW      0x80000000
+
+/* Opcodes for OTPP_OC field */
+#define OTPPOC_READ            0
+#define OTPPOC_BIT_PROG                1
+#define OTPPOC_VERIFY          3
+#define OTPPOC_INIT            4
+#define OTPPOC_SET             5
+#define OTPPOC_RESET           6
+#define OTPPOC_OCST            7
+#define OTPPOC_ROW_LOCK                8
+#define OTPPOC_PRESCN_TEST     9
+
+/* Opcodes for OTPP_OC field (40NM) */
+#define OTPPOC_READ_40NM       0
+#define OTPPOC_PROG_ENABLE_40NM 1
+#define OTPPOC_PROG_DISABLE_40NM       2
+#define OTPPOC_VERIFY_40NM     3
+#define OTPPOC_WORD_VERIFY_1_40NM      4
+#define OTPPOC_ROW_LOCK_40NM   5
+#define OTPPOC_STBY_40NM       6
+#define OTPPOC_WAKEUP_40NM     7
+#define OTPPOC_WORD_VERIFY_0_40NM      8
+#define OTPPOC_PRESCN_TEST_40NM 9
+#define OTPPOC_BIT_PROG_40NM   10
+#define OTPPOC_WORDPROG_40NM   11
+#define OTPPOC_BURNIN_40NM     12
+#define OTPPOC_AUTORELOAD_40NM 13
+#define OTPPOC_OVST_READ_40NM  14
+#define OTPPOC_OVST_PROG_40NM  15
+
+/* Fields in otplayoutextension */
+#define OTPLAYOUTEXT_FUSE_MASK 0x3FF
+
+
+/* Jtagm characteristics that appeared at a given corerev */
+#define        JTAGM_CREV_OLD          10      /**< Old command set, 16bit max IR */
+#define        JTAGM_CREV_IRP          22      /**< Able to do pause-ir */
+#define        JTAGM_CREV_RTI          28      /**< Able to do return-to-idle */
+
+/* jtagcmd */
+#define JCMD_START             0x80000000
+#define JCMD_BUSY              0x80000000
+#define JCMD_STATE_MASK                0x60000000
+#define JCMD_STATE_TLR         0x00000000      /**< Test-logic-reset */
+#define JCMD_STATE_PIR         0x20000000      /**< Pause IR */
+#define JCMD_STATE_PDR         0x40000000      /**< Pause DR */
+#define JCMD_STATE_RTI         0x60000000      /**< Run-test-idle */
+#define JCMD0_ACC_MASK         0x0000f000
+#define JCMD0_ACC_IRDR         0x00000000
+#define JCMD0_ACC_DR           0x00001000
+#define JCMD0_ACC_IR           0x00002000
+#define JCMD0_ACC_RESET                0x00003000
+#define JCMD0_ACC_IRPDR                0x00004000
+#define JCMD0_ACC_PDR          0x00005000
+#define JCMD0_IRW_MASK         0x00000f00
+#define JCMD_ACC_MASK          0x000f0000      /**< Changes for corerev 11 */
+#define JCMD_ACC_IRDR          0x00000000
+#define JCMD_ACC_DR            0x00010000
+#define JCMD_ACC_IR            0x00020000
+#define JCMD_ACC_RESET         0x00030000
+#define JCMD_ACC_IRPDR         0x00040000
+#define JCMD_ACC_PDR           0x00050000
+#define JCMD_ACC_PIR           0x00060000
+#define JCMD_ACC_IRDR_I                0x00070000      /**< rev 28: return to run-test-idle */
+#define JCMD_ACC_DR_I          0x00080000      /**< rev 28: return to run-test-idle */
+#define JCMD_IRW_MASK          0x00001f00
+#define JCMD_IRW_SHIFT         8
+#define JCMD_DRW_MASK          0x0000003f
+
+/* jtagctrl */
+#define JCTRL_FORCE_CLK                4               /**< Force clock */
+#define JCTRL_EXT_EN           2               /**< Enable external targets */
+#define JCTRL_EN               1               /**< Enable Jtag master */
+#define JCTRL_TAPSEL_BIT       0x00000008      /**< JtagMasterCtrl tap_sel bit */
+
+/* swdmasterctrl */
+#define SWDCTRL_INT_EN         8               /**< Enable internal targets */
+#define SWDCTRL_FORCE_CLK      4               /**< Force clock */
+#define SWDCTRL_OVJTAG         2               /**< Enable shared SWD/JTAG pins */
+#define SWDCTRL_EN             1               /**< Enable Jtag master */
+
+/* Fields in clkdiv */
+#define        CLKD_SFLASH             0x1f000000
+#define        CLKD_SFLASH_SHIFT       24
+#define        CLKD_OTP                0x000f0000
+#define        CLKD_OTP_SHIFT          16
+#define        CLKD_JTAG               0x00000f00
+#define        CLKD_JTAG_SHIFT         8
+#define        CLKD_UART               0x000000ff
+
+#define        CLKD2_SROM              0x00000003
+#define        CLKD2_SWD               0xf8000000
+#define        CLKD2_SWD_SHIFT         27
+
+/* intstatus/intmask */
+#define        CI_GPIO                 0x00000001      /**< gpio intr */
+#define        CI_EI                   0x00000002      /**< extif intr (corerev >= 3) */
+#define        CI_TEMP                 0x00000004      /**< temp. ctrl intr (corerev >= 15) */
+#define        CI_SIRQ                 0x00000008      /**< serial IRQ intr (corerev >= 15) */
+#define        CI_ECI                  0x00000010      /**< eci intr (corerev >= 21) */
+#define        CI_PMU                  0x00000020      /**< pmu intr (corerev >= 21) */
+#define        CI_UART                 0x00000040      /**< uart intr (corerev >= 21) */
+#define        CI_WDRESET              0x80000000      /**< watchdog reset occurred */
+
+/* slow_clk_ctl */
+#define SCC_SS_MASK            0x00000007      /**< slow clock source mask */
+#define        SCC_SS_LPO              0x00000000      /**< source of slow clock is LPO */
+#define        SCC_SS_XTAL             0x00000001      /**< source of slow clock is crystal */
+#define        SCC_SS_PCI              0x00000002      /**< source of slow clock is PCI */
+#define SCC_LF                 0x00000200      /**< LPOFreqSel, 1: 160Khz, 0: 32KHz */
+#define SCC_LP                 0x00000400      /**< LPOPowerDown, 1: LPO is disabled,
+                                                * 0: LPO is enabled
+                                                */
+#define SCC_FS                 0x00000800 /**< ForceSlowClk, 1: sb/cores running on slow clock,
+                                                * 0: power logic control
+                                                */
+#define SCC_IP                 0x00001000 /**< IgnorePllOffReq, 1/0: power logic ignores/honors
+                                                * PLL clock disable requests from core
+                                                */
+#define SCC_XC                 0x00002000      /**< XtalControlEn, 1/0: power logic does/doesn't
+                                                * disable crystal when appropriate
+                                                */
+#define SCC_XP                 0x00004000      /**< XtalPU (RO), 1/0: crystal running/disabled */
+#define SCC_CD_MASK            0xffff0000      /**< ClockDivider (SlowClk = 1/(4+divisor)) */
+#define SCC_CD_SHIFT           16
+
+/* system_clk_ctl */
+#define        SYCC_IE                 0x00000001      /**< ILPen: Enable Idle Low Power */
+#define        SYCC_AE                 0x00000002      /**< ALPen: Enable Active Low Power */
+#define        SYCC_FP                 0x00000004      /**< ForcePLLOn */
+#define        SYCC_AR                 0x00000008      /**< Force ALP (or HT if ALPen is not set */
+#define        SYCC_HR                 0x00000010      /**< Force HT */
+#define SYCC_CD_MASK           0xffff0000      /**< ClkDiv  (ILP = 1/(4 * (divisor + 1)) */
+#define SYCC_CD_SHIFT          16
+
+/* Indirect backplane access */
+#define        BPIA_BYTEEN             0x0000000f
+#define        BPIA_SZ1                0x00000001
+#define        BPIA_SZ2                0x00000003
+#define        BPIA_SZ4                0x00000007
+#define        BPIA_SZ8                0x0000000f
+#define        BPIA_WRITE              0x00000100
+#define        BPIA_START              0x00000200
+#define        BPIA_BUSY               0x00000200
+#define        BPIA_ERROR              0x00000400
+
+/* pcmcia/prog/flash_config */
+#define        CF_EN                   0x00000001      /**< enable */
+#define        CF_EM_MASK              0x0000000e      /**< mode */
+#define        CF_EM_SHIFT             1
+#define        CF_EM_FLASH             0               /**< flash/asynchronous mode */
+#define        CF_EM_SYNC              2               /**< synchronous mode */
+#define        CF_EM_PCMCIA            4               /**< pcmcia mode */
+#define        CF_DS                   0x00000010      /**< destsize:  0=8bit, 1=16bit */
+#define        CF_BS                   0x00000020      /**< byteswap */
+#define        CF_CD_MASK              0x000000c0      /**< clock divider */
+#define        CF_CD_SHIFT             6
+#define        CF_CD_DIV2              0x00000000      /**< backplane/2 */
+#define        CF_CD_DIV3              0x00000040      /**< backplane/3 */
+#define        CF_CD_DIV4              0x00000080      /**< backplane/4 */
+#define        CF_CE                   0x00000100      /**< clock enable */
+#define        CF_SB                   0x00000200      /**< size/bytestrobe (synch only) */
+
+/* pcmcia_memwait */
+#define        PM_W0_MASK              0x0000003f      /**< waitcount0 */
+#define        PM_W1_MASK              0x00001f00      /**< waitcount1 */
+#define        PM_W1_SHIFT             8
+#define        PM_W2_MASK              0x001f0000      /**< waitcount2 */
+#define        PM_W2_SHIFT             16
+#define        PM_W3_MASK              0x1f000000      /**< waitcount3 */
+#define        PM_W3_SHIFT             24
+
+/* pcmcia_attrwait */
+#define        PA_W0_MASK              0x0000003f      /**< waitcount0 */
+#define        PA_W1_MASK              0x00001f00      /**< waitcount1 */
+#define        PA_W1_SHIFT             8
+#define        PA_W2_MASK              0x001f0000      /**< waitcount2 */
+#define        PA_W2_SHIFT             16
+#define        PA_W3_MASK              0x1f000000      /**< waitcount3 */
+#define        PA_W3_SHIFT             24
+
+/* pcmcia_iowait */
+#define        PI_W0_MASK              0x0000003f      /**< waitcount0 */
+#define        PI_W1_MASK              0x00001f00      /**< waitcount1 */
+#define        PI_W1_SHIFT             8
+#define        PI_W2_MASK              0x001f0000      /**< waitcount2 */
+#define        PI_W2_SHIFT             16
+#define        PI_W3_MASK              0x1f000000      /**< waitcount3 */
+#define        PI_W3_SHIFT             24
+
+/* prog_waitcount */
+#define        PW_W0_MASK              0x0000001f      /**< waitcount0 */
+#define        PW_W1_MASK              0x00001f00      /**< waitcount1 */
+#define        PW_W1_SHIFT             8
+#define        PW_W2_MASK              0x001f0000      /**< waitcount2 */
+#define        PW_W2_SHIFT             16
+#define        PW_W3_MASK              0x1f000000      /**< waitcount3 */
+#define        PW_W3_SHIFT             24
+
+#define PW_W0                  0x0000000c
+#define PW_W1                  0x00000a00
+#define PW_W2                  0x00020000
+#define PW_W3                  0x01000000
+
+/* flash_waitcount */
+#define        FW_W0_MASK              0x0000003f      /**< waitcount0 */
+#define        FW_W1_MASK              0x00001f00      /**< waitcount1 */
+#define        FW_W1_SHIFT             8
+#define        FW_W2_MASK              0x001f0000      /**< waitcount2 */
+#define        FW_W2_SHIFT             16
+#define        FW_W3_MASK              0x1f000000      /**< waitcount3 */
+#define        FW_W3_SHIFT             24
+
+/* When Srom support present, fields in sromcontrol */
+#define        SRC_START               0x80000000
+#define        SRC_BUSY                0x80000000
+#define        SRC_OPCODE              0x60000000
+#define        SRC_OP_READ             0x00000000
+#define        SRC_OP_WRITE            0x20000000
+#define        SRC_OP_WRDIS            0x40000000
+#define        SRC_OP_WREN             0x60000000
+#define        SRC_OTPSEL              0x00000010
+#define SRC_OTPPRESENT         0x00000020
+#define        SRC_LOCK                0x00000008
+#define        SRC_SIZE_MASK           0x00000006
+#define        SRC_SIZE_1K             0x00000000
+#define        SRC_SIZE_4K             0x00000002
+#define        SRC_SIZE_16K            0x00000004
+#define        SRC_SIZE_SHIFT          1
+#define        SRC_PRESENT             0x00000001
+
+/* Fields in pmucontrol */
+#define        PCTL_ILP_DIV_MASK       0xffff0000
+#define        PCTL_ILP_DIV_SHIFT      16
+#define PCTL_LQ_REQ_EN         0x00008000
+#define PCTL_PLL_PLLCTL_UPD    0x00000400      /**< rev 2 */
+#define PCTL_NOILP_ON_WAIT     0x00000200      /**< rev 1 */
+#define        PCTL_HT_REQ_EN          0x00000100
+#define        PCTL_ALP_REQ_EN         0x00000080
+#define        PCTL_XTALFREQ_MASK      0x0000007c
+#define        PCTL_XTALFREQ_SHIFT     2
+#define        PCTL_ILP_DIV_EN         0x00000002
+#define        PCTL_LPO_SEL            0x00000001
+
+/*  Retention Control */
+#define PMU_RCTL_CLK_DIV_SHIFT         0
+#define PMU_RCTL_CHAIN_LEN_SHIFT       12
+#define PMU_RCTL_MACPHY_DISABLE_SHIFT  26
+#define PMU_RCTL_MACPHY_DISABLE_MASK   (1 << 26)
+#define PMU_RCTL_LOGIC_DISABLE_SHIFT   27
+#define PMU_RCTL_LOGIC_DISABLE_MASK    (1 << 27)
+#define PMU_RCTL_MEMSLP_LOG_SHIFT      28
+#define PMU_RCTL_MEMSLP_LOG_MASK       (1 << 28)
+#define PMU_RCTL_MEMRETSLP_LOG_SHIFT   29
+#define PMU_RCTL_MEMRETSLP_LOG_MASK    (1 << 29)
+
+/*  Retention Group Control */
+#define PMU_RCTLGRP_CHAIN_LEN_SHIFT    0
+#define PMU_RCTLGRP_RMODE_ENABLE_SHIFT 14
+#define PMU_RCTLGRP_RMODE_ENABLE_MASK  (1 << 14)
+#define PMU_RCTLGRP_DFT_ENABLE_SHIFT   15
+#define PMU_RCTLGRP_DFT_ENABLE_MASK    (1 << 15)
+#define PMU_RCTLGRP_NSRST_DISABLE_SHIFT        16
+#define PMU_RCTLGRP_NSRST_DISABLE_MASK (1 << 16)
+/*  Retention Group Control special for 4334 */
+#define PMU4334_RCTLGRP_CHAIN_LEN_GRP0 338
+#define PMU4334_RCTLGRP_CHAIN_LEN_GRP1 315
+/*  Retention Group Control special for 43341 */
+#define PMU43341_RCTLGRP_CHAIN_LEN_GRP0        366
+#define PMU43341_RCTLGRP_CHAIN_LEN_GRP1        330
+
+/* Fields in clkstretch */
+#define CSTRETCH_HT            0xffff0000
+#define CSTRETCH_ALP           0x0000ffff
+
+/* gpiotimerval */
+#define GPIO_ONTIME_SHIFT      16
+
+/* clockcontrol_n */
+#define        CN_N1_MASK              0x3f            /**< n1 control */
+#define        CN_N2_MASK              0x3f00          /**< n2 control */
+#define        CN_N2_SHIFT             8
+#define        CN_PLLC_MASK            0xf0000         /**< pll control */
+#define        CN_PLLC_SHIFT           16
+
+/* clockcontrol_sb/pci/uart */
+#define        CC_M1_MASK              0x3f            /**< m1 control */
+#define        CC_M2_MASK              0x3f00          /**< m2 control */
+#define        CC_M2_SHIFT             8
+#define        CC_M3_MASK              0x3f0000        /**< m3 control */
+#define        CC_M3_SHIFT             16
+#define        CC_MC_MASK              0x1f000000      /**< mux control */
+#define        CC_MC_SHIFT             24
+
+/* N3M Clock control magic field values */
+#define        CC_F6_2                 0x02            /**< A factor of 2 in */
+#define        CC_F6_3                 0x03            /**< 6-bit fields like */
+#define        CC_F6_4                 0x05            /**< N1, M1 or M3 */
+#define        CC_F6_5                 0x09
+#define        CC_F6_6                 0x11
+#define        CC_F6_7                 0x21
+
+#define        CC_F5_BIAS              5               /**< 5-bit fields get this added */
+
+#define        CC_MC_BYPASS            0x08
+#define        CC_MC_M1                0x04
+#define        CC_MC_M1M2              0x02
+#define        CC_MC_M1M2M3            0x01
+#define        CC_MC_M1M3              0x11
+
+/* Type 2 Clock control magic field values */
+#define        CC_T2_BIAS              2               /**< n1, n2, m1 & m3 bias */
+#define        CC_T2M2_BIAS            3               /**< m2 bias */
+
+#define        CC_T2MC_M1BYP           1
+#define        CC_T2MC_M2BYP           2
+#define        CC_T2MC_M3BYP           4
+
+/* Type 6 Clock control magic field values */
+#define        CC_T6_MMASK             1               /**< bits of interest in m */
+#define        CC_T6_M0                120000000       /**< sb clock for m = 0 */
+#define        CC_T6_M1                100000000       /**< sb clock for m = 1 */
+#define        SB2MIPS_T6(sb)          (2 * (sb))
+
+/* Common clock base */
+#define        CC_CLOCK_BASE1          24000000        /**< Half the clock freq */
+#define CC_CLOCK_BASE2         12500000        /**< Alternate crystal on some PLLs */
+
+/* Clock control values for 200MHz in 5350 */
+#define        CLKC_5350_N             0x0311
+#define        CLKC_5350_M             0x04020009
+
+/* Flash types in the chipcommon capabilities register */
+#define FLASH_NONE             0x000           /**< No flash */
+#define SFLASH_ST              0x100           /**< ST serial flash */
+#define SFLASH_AT              0x200           /**< Atmel serial flash */
+#define NFLASH                 0x300
+#define        PFLASH                  0x700           /**< Parallel flash */
+#define QSPIFLASH_ST           0x800
+#define QSPIFLASH_AT           0x900
+
+/* Bits in the ExtBus config registers */
+#define        CC_CFG_EN               0x0001          /**< Enable */
+#define        CC_CFG_EM_MASK          0x000e          /**< Extif Mode */
+#define        CC_CFG_EM_ASYNC         0x0000          /**<   Async/Parallel flash */
+#define        CC_CFG_EM_SYNC          0x0002          /**<   Synchronous */
+#define        CC_CFG_EM_PCMCIA        0x0004          /**<   PCMCIA */
+#define        CC_CFG_EM_IDE           0x0006          /**<   IDE */
+#define        CC_CFG_DS               0x0010          /**< Data size, 0=8bit, 1=16bit */
+#define        CC_CFG_CD_MASK          0x00e0          /**< Sync: Clock divisor, rev >= 20 */
+#define        CC_CFG_CE               0x0100          /**< Sync: Clock enable, rev >= 20 */
+#define        CC_CFG_SB               0x0200          /**< Sync: Size/Bytestrobe, rev >= 20 */
+#define        CC_CFG_IS               0x0400          /**< Extif Sync Clk Select, rev >= 20 */
+
+/* ExtBus address space */
+#define        CC_EB_BASE              0x1a000000      /**< Chipc ExtBus base address */
+#define        CC_EB_PCMCIA_MEM        0x1a000000      /**< PCMCIA 0 memory base address */
+#define        CC_EB_PCMCIA_IO         0x1a200000      /**< PCMCIA 0 I/O base address */
+#define        CC_EB_PCMCIA_CFG        0x1a400000      /**< PCMCIA 0 config base address */
+#define        CC_EB_IDE               0x1a800000      /**< IDE memory base */
+#define        CC_EB_PCMCIA1_MEM       0x1a800000      /**< PCMCIA 1 memory base address */
+#define        CC_EB_PCMCIA1_IO        0x1aa00000      /**< PCMCIA 1 I/O base address */
+#define        CC_EB_PCMCIA1_CFG       0x1ac00000      /**< PCMCIA 1 config base address */
+#define        CC_EB_PROGIF            0x1b000000      /**< ProgIF Async/Sync base address */
+
+
+/* Start/busy bit in flashcontrol */
+#define SFLASH_OPCODE          0x000000ff
+#define SFLASH_ACTION          0x00000700
+#define        SFLASH_CS_ACTIVE        0x00001000      /**< Chip Select Active, rev >= 20 */
+#define SFLASH_START           0x80000000
+#define SFLASH_BUSY            SFLASH_START
+
+/* flashcontrol action codes */
+#define        SFLASH_ACT_OPONLY       0x0000          /**< Issue opcode only */
+#define        SFLASH_ACT_OP1D         0x0100          /**< opcode + 1 data byte */
+#define        SFLASH_ACT_OP3A         0x0200          /**< opcode + 3 addr bytes */
+#define        SFLASH_ACT_OP3A1D       0x0300          /**< opcode + 3 addr & 1 data bytes */
+#define        SFLASH_ACT_OP3A4D       0x0400          /**< opcode + 3 addr & 4 data bytes */
+#define        SFLASH_ACT_OP3A4X4D     0x0500          /**< opcode + 3 addr, 4 don't care & 4 data bytes */
+#define        SFLASH_ACT_OP3A1X4D     0x0700          /**< opcode + 3 addr, 1 don't care & 4 data bytes */
+
+/* flashcontrol action+opcodes for ST flashes */
+#define SFLASH_ST_WREN         0x0006          /**< Write Enable */
+#define SFLASH_ST_WRDIS                0x0004          /**< Write Disable */
+#define SFLASH_ST_RDSR         0x0105          /**< Read Status Register */
+#define SFLASH_ST_WRSR         0x0101          /**< Write Status Register */
+#define SFLASH_ST_READ         0x0303          /**< Read Data Bytes */
+#define SFLASH_ST_PP           0x0302          /**< Page Program */
+#define SFLASH_ST_SE           0x02d8          /**< Sector Erase */
+#define SFLASH_ST_BE           0x00c7          /**< Bulk Erase */
+#define SFLASH_ST_DP           0x00b9          /**< Deep Power-down */
+#define SFLASH_ST_RES          0x03ab          /**< Read Electronic Signature */
+#define SFLASH_ST_CSA          0x1000          /**< Keep chip select asserted */
+#define SFLASH_ST_SSE          0x0220          /**< Sub-sector Erase */
+
+#define SFLASH_MXIC_RDID       0x0390          /**< Read Manufacture ID */
+#define SFLASH_MXIC_MFID       0xc2            /**< MXIC Manufacture ID */
+
+/* Status register bits for ST flashes */
+#define SFLASH_ST_WIP          0x01            /**< Write In Progress */
+#define SFLASH_ST_WEL          0x02            /**< Write Enable Latch */
+#define SFLASH_ST_BP_MASK      0x1c            /**< Block Protect */
+#define SFLASH_ST_BP_SHIFT     2
+#define SFLASH_ST_SRWD         0x80            /**< Status Register Write Disable */
+
+/* flashcontrol action+opcodes for Atmel flashes */
+#define SFLASH_AT_READ                         0x07e8
+#define SFLASH_AT_PAGE_READ                    0x07d2
+#define SFLASH_AT_BUF1_READ
+#define SFLASH_AT_BUF2_READ
+#define SFLASH_AT_STATUS                       0x01d7
+#define SFLASH_AT_BUF1_WRITE                   0x0384
+#define SFLASH_AT_BUF2_WRITE                   0x0387
+#define SFLASH_AT_BUF1_ERASE_PROGRAM           0x0283
+#define SFLASH_AT_BUF2_ERASE_PROGRAM           0x0286
+#define SFLASH_AT_BUF1_PROGRAM                 0x0288
+#define SFLASH_AT_BUF2_PROGRAM                 0x0289
+#define SFLASH_AT_PAGE_ERASE                   0x0281
+#define SFLASH_AT_BLOCK_ERASE                  0x0250
+#define SFLASH_AT_BUF1_WRITE_ERASE_PROGRAM     0x0382
+#define SFLASH_AT_BUF2_WRITE_ERASE_PROGRAM     0x0385
+#define SFLASH_AT_BUF1_LOAD                    0x0253
+#define SFLASH_AT_BUF2_LOAD                    0x0255
+#define SFLASH_AT_BUF1_COMPARE                 0x0260
+#define SFLASH_AT_BUF2_COMPARE                 0x0261
+#define SFLASH_AT_BUF1_REPROGRAM               0x0258
+#define SFLASH_AT_BUF2_REPROGRAM               0x0259
+
+/* Status register bits for Atmel flashes */
+#define SFLASH_AT_READY                                0x80
+#define SFLASH_AT_MISMATCH                     0x40
+#define SFLASH_AT_ID_MASK                      0x38
+#define SFLASH_AT_ID_SHIFT                     3
+
+/* SPI register bits, corerev >= 37 */
+#define GSIO_START                     0x80000000
+#define GSIO_BUSY                      GSIO_START
+
+/*
+ * These are the UART port assignments, expressed as offsets from the base
+ * register.  These assignments should hold for any serial port based on
+ * a 8250, 16450, or 16550(A).
+ */
+
+#define UART_RX                0       /**< In:  Receive buffer (DLAB=0) */
+#define UART_TX                0       /**< Out: Transmit buffer (DLAB=0) */
+#define UART_DLL       0       /**< Out: Divisor Latch Low (DLAB=1) */
+#define UART_IER       1       /**< In/Out: Interrupt Enable Register (DLAB=0) */
+#define UART_DLM       1       /**< Out: Divisor Latch High (DLAB=1) */
+#define UART_IIR       2       /**< In: Interrupt Identity Register  */
+#define UART_FCR       2       /**< Out: FIFO Control Register */
+#define UART_LCR       3       /**< Out: Line Control Register */
+#define UART_MCR       4       /**< Out: Modem Control Register */
+#define UART_LSR       5       /**< In:  Line Status Register */
+#define UART_MSR       6       /**< In:  Modem Status Register */
+#define UART_SCR       7       /**< I/O: Scratch Register */
+#define UART_LCR_DLAB  0x80    /**< Divisor latch access bit */
+#define UART_LCR_WLEN8 0x03    /**< Word length: 8 bits */
+#define UART_MCR_OUT2  0x08    /**< MCR GPIO out 2 */
+#define UART_MCR_LOOP  0x10    /**< Enable loopback test mode */
+#define UART_LSR_RX_FIFO       0x80    /**< Receive FIFO error */
+#define UART_LSR_TDHR          0x40    /**< Data-hold-register empty */
+#define UART_LSR_THRE          0x20    /**< Transmit-hold-register empty */
+#define UART_LSR_BREAK         0x10    /**< Break interrupt */
+#define UART_LSR_FRAMING       0x08    /**< Framing error */
+#define UART_LSR_PARITY                0x04    /**< Parity error */
+#define UART_LSR_OVERRUN       0x02    /**< Overrun error */
+#define UART_LSR_RXRDY         0x01    /**< Receiver ready */
+#define UART_FCR_FIFO_ENABLE 1 /**< FIFO control register bit controlling FIFO enable/disable */
+
+/* Interrupt Identity Register (IIR) bits */
+#define UART_IIR_FIFO_MASK     0xc0    /**< IIR FIFO disable/enabled mask */
+#define UART_IIR_INT_MASK      0xf     /**< IIR interrupt ID source */
+#define UART_IIR_MDM_CHG       0x0     /**< Modem status changed */
+#define UART_IIR_NOINT         0x1     /**< No interrupt pending */
+#define UART_IIR_THRE          0x2     /**< THR empty */
+#define UART_IIR_RCVD_DATA     0x4     /**< Received data available */
+#define UART_IIR_RCVR_STATUS   0x6     /**< Receiver status */
+#define UART_IIR_CHAR_TIME     0xc     /**< Character time */
+
+/* Interrupt Enable Register (IER) bits */
+#define UART_IER_PTIME 128     /**< Programmable THRE Interrupt Mode Enable */
+#define UART_IER_EDSSI 8       /**< enable modem status interrupt */
+#define UART_IER_ELSI  4       /**< enable receiver line status interrupt */
+#define UART_IER_ETBEI  2      /**< enable transmitter holding register empty interrupt */
+#define UART_IER_ERBFI 1       /**< enable data available interrupt */
+
+/* pmustatus */
+#define PST_SLOW_WR_PENDING 0x0400
+#define PST_EXTLPOAVAIL        0x0100
+#define PST_WDRESET    0x0080
+#define        PST_INTPEND     0x0040
+#define        PST_SBCLKST     0x0030
+#define        PST_SBCLKST_ILP 0x0010
+#define        PST_SBCLKST_ALP 0x0020
+#define        PST_SBCLKST_HT  0x0030
+#define        PST_ALPAVAIL    0x0008
+#define        PST_HTAVAIL     0x0004
+#define        PST_RESINIT     0x0003
+
+/* pmucapabilities */
+#define PCAP_REV_MASK  0x000000ff
+#define PCAP_RC_MASK   0x00001f00
+#define PCAP_RC_SHIFT  8
+#define PCAP_TC_MASK   0x0001e000
+#define PCAP_TC_SHIFT  13
+#define PCAP_PC_MASK   0x001e0000
+#define PCAP_PC_SHIFT  17
+#define PCAP_VC_MASK   0x01e00000
+#define PCAP_VC_SHIFT  21
+#define PCAP_CC_MASK   0x1e000000
+#define PCAP_CC_SHIFT  25
+#define PCAP5_PC_MASK  0x003e0000      /**< PMU corerev >= 5 */
+#define PCAP5_PC_SHIFT 17
+#define PCAP5_VC_MASK  0x07c00000
+#define PCAP5_VC_SHIFT 22
+#define PCAP5_CC_MASK  0xf8000000
+#define PCAP5_CC_SHIFT 27
+
+/* PMU Resource Request Timer registers */
+/* This is based on PmuRev0 */
+#define        PRRT_TIME_MASK  0x03ff
+#define        PRRT_INTEN      0x0400
+#define        PRRT_REQ_ACTIVE 0x0800
+#define        PRRT_ALP_REQ    0x1000
+#define        PRRT_HT_REQ     0x2000
+#define PRRT_HQ_REQ 0x4000
+
+/* PMU Int Control register bits */
+#define PMU_INTC_ALP_REQ       0x1
+#define PMU_INTC_HT_REQ                0x2
+#define PMU_INTC_HQ_REQ                0x4
+
+/* bit 0 of the PMU interrupt vector is asserted if this mask is enabled */
+#define RSRC_INTR_MASK_TIMER_INT_0 1
+
+/* PMU resource bit position */
+#define PMURES_BIT(bit)        (1 << (bit))
+
+/* PMU resource number limit */
+#define PMURES_MAX_RESNUM      30
+
+/* PMU chip control0 register */
+#define        PMU_CHIPCTL0            0
+#define PMU43143_CC0_SDIO_DRSTR_OVR    (1 << 31) /* sdio drive strength override enable */
+
+/* clock req types */
+#define PMU_CC1_CLKREQ_TYPE_SHIFT      19
+#define PMU_CC1_CLKREQ_TYPE_MASK       (1 << PMU_CC1_CLKREQ_TYPE_SHIFT)
+
+#define CLKREQ_TYPE_CONFIG_OPENDRAIN           0
+#define CLKREQ_TYPE_CONFIG_PUSHPULL            1
+
+/* PMU chip control1 register */
+#define        PMU_CHIPCTL1                    1
+#define        PMU_CC1_RXC_DLL_BYPASS          0x00010000
+#define PMU_CC1_ENABLE_BBPLL_PWR_DOWN  0x00000010
+
+#define PMU_CC1_IF_TYPE_MASK                   0x00000030
+#define PMU_CC1_IF_TYPE_RMII           0x00000000
+#define PMU_CC1_IF_TYPE_MII            0x00000010
+#define PMU_CC1_IF_TYPE_RGMII          0x00000020
+
+#define PMU_CC1_SW_TYPE_MASK           0x000000c0
+#define PMU_CC1_SW_TYPE_EPHY           0x00000000
+#define PMU_CC1_SW_TYPE_EPHYMII        0x00000040
+#define PMU_CC1_SW_TYPE_EPHYRMII       0x00000080
+#define PMU_CC1_SW_TYPE_RGMII          0x000000c0
+
+#define PMU_CC1_ENABLE_CLOSED_LOOP_MASK 0x00000080
+#define PMU_CC1_ENABLE_CLOSED_LOOP      0x00000000
+
+/* PMU chip control2 register */
+#define        PMU_CHIPCTL2            2
+#define PMU_CC2_FORCE_SUBCORE_PWR_SWITCH_ON    (1 << 18)
+#define PMU_CC2_FORCE_PHY_PWR_SWITCH_ON        (1 << 19)
+#define PMU_CC2_FORCE_VDDM_PWR_SWITCH_ON       (1 << 20)
+#define PMU_CC2_FORCE_MEMLPLDO_PWR_SWITCH_ON           (1 << 21)
+#define PMU_CC2_MASK_WL_DEV_WAKE             (1 << 22)
+#define PMU_CC2_INV_GPIO_POLARITY_PMU_WAKE   (1 << 25)
+
+
+/* PMU chip control3 register */
+#define        PMU_CHIPCTL3            3
+#define PMU_CC3_ENABLE_SDIO_WAKEUP_SHIFT  19
+#define PMU_CC3_ENABLE_RF_SHIFT           22
+#define PMU_CC3_RF_DISABLE_IVALUE_SHIFT   23
+
+/* PMU chip control4 register */
+#define PMU_CHIPCTL4                    4
+
+/* 53537 series moved switch_type and gmac_if_type to CC4 [15:14] and [13:12] */
+#define PMU_CC4_IF_TYPE_MASK           0x00003000
+#define PMU_CC4_IF_TYPE_RMII           0x00000000
+#define PMU_CC4_IF_TYPE_MII            0x00001000
+#define PMU_CC4_IF_TYPE_RGMII          0x00002000
+
+#define PMU_CC4_SW_TYPE_MASK           0x0000c000
+#define PMU_CC4_SW_TYPE_EPHY           0x00000000
+#define PMU_CC4_SW_TYPE_EPHYMII                0x00004000
+#define PMU_CC4_SW_TYPE_EPHYRMII       0x00008000
+#define PMU_CC4_SW_TYPE_RGMII          0x0000c000
+
+/* PMU chip control5 register */
+#define PMU_CHIPCTL5                    5
+
+/* PMU chip control6 register */
+#define PMU_CHIPCTL6                    6
+#define PMU_CC6_ENABLE_CLKREQ_WAKEUP    (1 << 4)
+#define PMU_CC6_ENABLE_PMU_WAKEUP_ALP   (1 << 6)
+
+/* PMU chip control7 register */
+#define PMU_CHIPCTL7                           7
+#define PMU_CC7_ENABLE_L2REFCLKPAD_PWRDWN      (1 << 25)
+#define PMU_CC7_ENABLE_MDIO_RESET_WAR          (1 << 27)
+/* 53537 series have gmca1 gmac_if_type in cc7 [7:6](defalut 0b01) */
+#define PMU_CC7_IF_TYPE_MASK           0x000000c0
+#define PMU_CC7_IF_TYPE_RMII           0x00000000
+#define PMU_CC7_IF_TYPE_MII            0x00000040
+#define PMU_CC7_IF_TYPE_RGMII          0x00000080
+
+
+/* PMU corerev and chip specific PLL controls.
+ * PMU<rev>_PLL<num>_XX where <rev> is PMU corerev and <num> is an arbitrary number
+ * to differentiate different PLLs controlled by the same PMU rev.
+ */
+/* pllcontrol registers */
+/* PDIV, div_phy, div_arm, div_adc, dith_sel, ioff, kpd_scale, lsb_sel, mash_sel, lf_c & lf_r */
+#define        PMU0_PLL0_PLLCTL0               0
+#define        PMU0_PLL0_PC0_PDIV_MASK         1
+#define        PMU0_PLL0_PC0_PDIV_FREQ         25000
+#define PMU0_PLL0_PC0_DIV_ARM_MASK     0x00000038
+#define PMU0_PLL0_PC0_DIV_ARM_SHIFT    3
+#define PMU0_PLL0_PC0_DIV_ARM_BASE     8
+
+/* PC0_DIV_ARM for PLLOUT_ARM */
+#define PMU0_PLL0_PC0_DIV_ARM_110MHZ   0
+#define PMU0_PLL0_PC0_DIV_ARM_97_7MHZ  1
+#define PMU0_PLL0_PC0_DIV_ARM_88MHZ    2
+#define PMU0_PLL0_PC0_DIV_ARM_80MHZ    3 /* Default */
+#define PMU0_PLL0_PC0_DIV_ARM_73_3MHZ  4
+#define PMU0_PLL0_PC0_DIV_ARM_67_7MHZ  5
+#define PMU0_PLL0_PC0_DIV_ARM_62_9MHZ  6
+#define PMU0_PLL0_PC0_DIV_ARM_58_6MHZ  7
+
+/* Wildcard base, stop_mod, en_lf_tp, en_cal & lf_r2 */
+#define        PMU0_PLL0_PLLCTL1               1
+#define        PMU0_PLL0_PC1_WILD_INT_MASK     0xf0000000
+#define        PMU0_PLL0_PC1_WILD_INT_SHIFT    28
+#define        PMU0_PLL0_PC1_WILD_FRAC_MASK    0x0fffff00
+#define        PMU0_PLL0_PC1_WILD_FRAC_SHIFT   8
+#define        PMU0_PLL0_PC1_STOP_MOD          0x00000040
+
+/* Wildcard base, vco_calvar, vco_swc, vco_var_selref, vso_ical & vco_sel_avdd */
+#define        PMU0_PLL0_PLLCTL2               2
+#define        PMU0_PLL0_PC2_WILD_INT_MASK     0xf
+#define        PMU0_PLL0_PC2_WILD_INT_SHIFT    4
+
+/* pllcontrol registers */
+/* ndiv_pwrdn, pwrdn_ch<x>, refcomp_pwrdn, dly_ch<x>, p1div, p2div, _bypass_sdmod */
+#define PMU1_PLL0_PLLCTL0              0
+#define PMU1_PLL0_PC0_P1DIV_MASK       0x00f00000
+#define PMU1_PLL0_PC0_P1DIV_SHIFT      20
+#define PMU1_PLL0_PC0_P2DIV_MASK       0x0f000000
+#define PMU1_PLL0_PC0_P2DIV_SHIFT      24
+
+/* m<x>div */
+#define PMU1_PLL0_PLLCTL1              1
+#define PMU1_PLL0_PC1_M1DIV_MASK       0x000000ff
+#define PMU1_PLL0_PC1_M1DIV_SHIFT      0
+#define PMU1_PLL0_PC1_M2DIV_MASK       0x0000ff00
+#define PMU1_PLL0_PC1_M2DIV_SHIFT      8
+#define PMU1_PLL0_PC1_M3DIV_MASK       0x00ff0000
+#define PMU1_PLL0_PC1_M3DIV_SHIFT      16
+#define PMU1_PLL0_PC1_M4DIV_MASK       0xff000000
+#define PMU1_PLL0_PC1_M4DIV_SHIFT      24
+#define PMU1_PLL0_PC1_M4DIV_BY_9       9
+#define PMU1_PLL0_PC1_M4DIV_BY_18      0x12
+#define PMU1_PLL0_PC1_M4DIV_BY_36      0x24
+#define PMU1_PLL0_PC1_M4DIV_BY_60      0x3C
+
+#define DOT11MAC_880MHZ_CLK_DIVISOR_SHIFT 8
+#define DOT11MAC_880MHZ_CLK_DIVISOR_MASK (0xFF << DOT11MAC_880MHZ_CLK_DIVISOR_SHIFT)
+#define DOT11MAC_880MHZ_CLK_DIVISOR_VAL  (0xE << DOT11MAC_880MHZ_CLK_DIVISOR_SHIFT)
+
+/* m<x>div, ndiv_dither_mfb, ndiv_mode, ndiv_int */
+#define PMU1_PLL0_PLLCTL2              2
+#define PMU1_PLL0_PC2_M5DIV_MASK       0x000000ff
+#define PMU1_PLL0_PC2_M5DIV_SHIFT      0
+#define PMU1_PLL0_PC2_M5DIV_BY_12      0xc
+#define PMU1_PLL0_PC2_M5DIV_BY_18      0x12
+#define PMU1_PLL0_PC2_M5DIV_BY_36      0x24
+#define PMU1_PLL0_PC2_M6DIV_MASK       0x0000ff00
+#define PMU1_PLL0_PC2_M6DIV_SHIFT      8
+#define PMU1_PLL0_PC2_M6DIV_BY_18      0x12
+#define PMU1_PLL0_PC2_M6DIV_BY_36      0x24
+#define PMU1_PLL0_PC2_NDIV_MODE_MASK   0x000e0000
+#define PMU1_PLL0_PC2_NDIV_MODE_SHIFT  17
+#define PMU1_PLL0_PC2_NDIV_MODE_MASH   1
+#define PMU1_PLL0_PC2_NDIV_MODE_MFB    2       /**< recommended for 4319 */
+#define PMU1_PLL0_PC2_NDIV_INT_MASK    0x1ff00000
+#define PMU1_PLL0_PC2_NDIV_INT_SHIFT   20
+
+/* ndiv_frac */
+#define PMU1_PLL0_PLLCTL3              3
+#define PMU1_PLL0_PC3_NDIV_FRAC_MASK   0x00ffffff
+#define PMU1_PLL0_PC3_NDIV_FRAC_SHIFT  0
+
+/* pll_ctrl */
+#define PMU1_PLL0_PLLCTL4              4
+
+/* pll_ctrl, vco_rng, clkdrive_ch<x> */
+#define PMU1_PLL0_PLLCTL5              5
+#define PMU1_PLL0_PC5_CLK_DRV_MASK 0xffffff00
+#define PMU1_PLL0_PC5_CLK_DRV_SHIFT 8
+
+#define PMU1_PLL0_PLLCTL6              6
+#define PMU1_PLL0_PLLCTL7              7
+#define PMU1_PLL0_PLLCTL8              8
+
+#define PMU1_PLLCTL8_OPENLOOP_MASK     (1 << 1)
+#define PMU_PLL4350_OPENLOOP_MASK      (1 << 7)
+
+/* PMU rev 2 control words */
+#define PMU2_PHY_PLL_PLLCTL            4
+#define PMU2_SI_PLL_PLLCTL             10
+
+/* PMU rev 2 */
+/* pllcontrol registers */
+/* ndiv_pwrdn, pwrdn_ch<x>, refcomp_pwrdn, dly_ch<x>, p1div, p2div, _bypass_sdmod */
+#define PMU2_PLL_PLLCTL0               0
+#define PMU2_PLL_PC0_P1DIV_MASK        0x00f00000
+#define PMU2_PLL_PC0_P1DIV_SHIFT       20
+#define PMU2_PLL_PC0_P2DIV_MASK        0x0f000000
+#define PMU2_PLL_PC0_P2DIV_SHIFT       24
+
+/* m<x>div */
+#define PMU2_PLL_PLLCTL1               1
+#define PMU2_PLL_PC1_M1DIV_MASK        0x000000ff
+#define PMU2_PLL_PC1_M1DIV_SHIFT       0
+#define PMU2_PLL_PC1_M2DIV_MASK        0x0000ff00
+#define PMU2_PLL_PC1_M2DIV_SHIFT       8
+#define PMU2_PLL_PC1_M3DIV_MASK        0x00ff0000
+#define PMU2_PLL_PC1_M3DIV_SHIFT       16
+#define PMU2_PLL_PC1_M4DIV_MASK        0xff000000
+#define PMU2_PLL_PC1_M4DIV_SHIFT       24
+
+/* m<x>div, ndiv_dither_mfb, ndiv_mode, ndiv_int */
+#define PMU2_PLL_PLLCTL2               2
+#define PMU2_PLL_PC2_M5DIV_MASK        0x000000ff
+#define PMU2_PLL_PC2_M5DIV_SHIFT       0
+#define PMU2_PLL_PC2_M6DIV_MASK        0x0000ff00
+#define PMU2_PLL_PC2_M6DIV_SHIFT       8
+#define PMU2_PLL_PC2_NDIV_MODE_MASK    0x000e0000
+#define PMU2_PLL_PC2_NDIV_MODE_SHIFT   17
+#define PMU2_PLL_PC2_NDIV_INT_MASK     0x1ff00000
+#define PMU2_PLL_PC2_NDIV_INT_SHIFT    20
+
+/* ndiv_frac */
+#define PMU2_PLL_PLLCTL3               3
+#define PMU2_PLL_PC3_NDIV_FRAC_MASK    0x00ffffff
+#define PMU2_PLL_PC3_NDIV_FRAC_SHIFT   0
+
+/* pll_ctrl */
+#define PMU2_PLL_PLLCTL4               4
+
+/* pll_ctrl, vco_rng, clkdrive_ch<x> */
+#define PMU2_PLL_PLLCTL5               5
+#define PMU2_PLL_PC5_CLKDRIVE_CH1_MASK 0x00000f00
+#define PMU2_PLL_PC5_CLKDRIVE_CH1_SHIFT        8
+#define PMU2_PLL_PC5_CLKDRIVE_CH2_MASK 0x0000f000
+#define PMU2_PLL_PC5_CLKDRIVE_CH2_SHIFT        12
+#define PMU2_PLL_PC5_CLKDRIVE_CH3_MASK 0x000f0000
+#define PMU2_PLL_PC5_CLKDRIVE_CH3_SHIFT        16
+#define PMU2_PLL_PC5_CLKDRIVE_CH4_MASK 0x00f00000
+#define PMU2_PLL_PC5_CLKDRIVE_CH4_SHIFT        20
+#define PMU2_PLL_PC5_CLKDRIVE_CH5_MASK 0x0f000000
+#define PMU2_PLL_PC5_CLKDRIVE_CH5_SHIFT        24
+#define PMU2_PLL_PC5_CLKDRIVE_CH6_MASK 0xf0000000
+#define PMU2_PLL_PC5_CLKDRIVE_CH6_SHIFT        28
+
+/* PMU rev 5 (& 6) */
+#define        PMU5_PLL_P1P2_OFF               0
+#define        PMU5_PLL_P1_MASK                0x0f000000
+#define        PMU5_PLL_P1_SHIFT               24
+#define        PMU5_PLL_P2_MASK                0x00f00000
+#define        PMU5_PLL_P2_SHIFT               20
+#define        PMU5_PLL_M14_OFF                1
+#define        PMU5_PLL_MDIV_MASK              0x000000ff
+#define        PMU5_PLL_MDIV_WIDTH             8
+#define        PMU5_PLL_NM5_OFF                2
+#define        PMU5_PLL_NDIV_MASK              0xfff00000
+#define        PMU5_PLL_NDIV_SHIFT             20
+#define        PMU5_PLL_NDIV_MODE_MASK         0x000e0000
+#define        PMU5_PLL_NDIV_MODE_SHIFT        17
+#define        PMU5_PLL_FMAB_OFF               3
+#define        PMU5_PLL_MRAT_MASK              0xf0000000
+#define        PMU5_PLL_MRAT_SHIFT             28
+#define        PMU5_PLL_ABRAT_MASK             0x08000000
+#define        PMU5_PLL_ABRAT_SHIFT            27
+#define        PMU5_PLL_FDIV_MASK              0x07ffffff
+#define        PMU5_PLL_PLLCTL_OFF             4
+#define        PMU5_PLL_PCHI_OFF               5
+#define        PMU5_PLL_PCHI_MASK              0x0000003f
+
+/* pmu XtalFreqRatio */
+#define        PMU_XTALFREQ_REG_ILPCTR_MASK    0x00001FFF
+#define        PMU_XTALFREQ_REG_MEASURE_MASK   0x80000000
+#define        PMU_XTALFREQ_REG_MEASURE_SHIFT  31
+
+/* Divider allocation in 4716/47162/5356/5357 */
+#define        PMU5_MAINPLL_CPU                1
+#define        PMU5_MAINPLL_MEM                2
+#define        PMU5_MAINPLL_SI                 3
+
+/* 4706 PMU */
+#define PMU4706_MAINPLL_PLL0   0
+#define PMU6_4706_PROCPLL_OFF  4       /**< The CPU PLL */
+#define PMU6_4706_PROC_P2DIV_MASK              0x000f0000
+#define PMU6_4706_PROC_P2DIV_SHIFT     16
+#define PMU6_4706_PROC_P1DIV_MASK              0x0000f000
+#define PMU6_4706_PROC_P1DIV_SHIFT     12
+#define PMU6_4706_PROC_NDIV_INT_MASK   0x00000ff8
+#define PMU6_4706_PROC_NDIV_INT_SHIFT  3
+#define PMU6_4706_PROC_NDIV_MODE_MASK          0x00000007
+#define PMU6_4706_PROC_NDIV_MODE_SHIFT 0
+
+#define PMU7_PLL_PLLCTL7                7
+#define PMU7_PLL_CTL7_M4DIV_MASK       0xff000000
+#define PMU7_PLL_CTL7_M4DIV_SHIFT      24
+#define PMU7_PLL_CTL7_M4DIV_BY_6       6
+#define PMU7_PLL_CTL7_M4DIV_BY_12      0xc
+#define PMU7_PLL_CTL7_M4DIV_BY_24      0x18
+#define PMU7_PLL_PLLCTL8                8
+#define PMU7_PLL_CTL8_M5DIV_MASK       0x000000ff
+#define PMU7_PLL_CTL8_M5DIV_SHIFT      0
+#define PMU7_PLL_CTL8_M5DIV_BY_8       8
+#define PMU7_PLL_CTL8_M5DIV_BY_12      0xc
+#define PMU7_PLL_CTL8_M5DIV_BY_24      0x18
+#define PMU7_PLL_CTL8_M6DIV_MASK       0x0000ff00
+#define PMU7_PLL_CTL8_M6DIV_SHIFT      8
+#define PMU7_PLL_CTL8_M6DIV_BY_12      0xc
+#define PMU7_PLL_CTL8_M6DIV_BY_24      0x18
+#define PMU7_PLL_PLLCTL11              11
+#define PMU7_PLL_PLLCTL11_MASK         0xffffff00
+#define PMU7_PLL_PLLCTL11_VAL          0x22222200
+
+/* PMU rev 15 */
+#define PMU15_PLL_PLLCTL0              0
+#define PMU15_PLL_PC0_CLKSEL_MASK      0x00000003
+#define PMU15_PLL_PC0_CLKSEL_SHIFT     0
+#define PMU15_PLL_PC0_FREQTGT_MASK     0x003FFFFC
+#define PMU15_PLL_PC0_FREQTGT_SHIFT    2
+#define PMU15_PLL_PC0_PRESCALE_MASK    0x00C00000
+#define PMU15_PLL_PC0_PRESCALE_SHIFT   22
+#define PMU15_PLL_PC0_KPCTRL_MASK      0x07000000
+#define PMU15_PLL_PC0_KPCTRL_SHIFT     24
+#define PMU15_PLL_PC0_FCNTCTRL_MASK    0x38000000
+#define PMU15_PLL_PC0_FCNTCTRL_SHIFT   27
+#define PMU15_PLL_PC0_FDCMODE_MASK     0x40000000
+#define PMU15_PLL_PC0_FDCMODE_SHIFT    30
+#define PMU15_PLL_PC0_CTRLBIAS_MASK    0x80000000
+#define PMU15_PLL_PC0_CTRLBIAS_SHIFT   31
+
+#define PMU15_PLL_PLLCTL1                      1
+#define PMU15_PLL_PC1_BIAS_CTLM_MASK           0x00000060
+#define PMU15_PLL_PC1_BIAS_CTLM_SHIFT          5
+#define PMU15_PLL_PC1_BIAS_CTLM_RST_MASK       0x00000040
+#define PMU15_PLL_PC1_BIAS_CTLM_RST_SHIFT      6
+#define PMU15_PLL_PC1_BIAS_SS_DIVR_MASK                0x0001FF80
+#define PMU15_PLL_PC1_BIAS_SS_DIVR_SHIFT       7
+#define PMU15_PLL_PC1_BIAS_SS_RSTVAL_MASK      0x03FE0000
+#define PMU15_PLL_PC1_BIAS_SS_RSTVAL_SHIFT     17
+#define PMU15_PLL_PC1_BIAS_INTG_BW_MASK                0x0C000000
+#define PMU15_PLL_PC1_BIAS_INTG_BW_SHIFT       26
+#define PMU15_PLL_PC1_BIAS_INTG_BYP_MASK       0x10000000
+#define PMU15_PLL_PC1_BIAS_INTG_BYP_SHIFT      28
+#define PMU15_PLL_PC1_OPENLP_EN_MASK           0x40000000
+#define PMU15_PLL_PC1_OPENLP_EN_SHIFT          30
+
+#define PMU15_PLL_PLLCTL2                      2
+#define PMU15_PLL_PC2_CTEN_MASK                        0x00000001
+#define PMU15_PLL_PC2_CTEN_SHIFT               0
+
+#define PMU15_PLL_PLLCTL3                      3
+#define PMU15_PLL_PC3_DITHER_EN_MASK           0x00000001
+#define PMU15_PLL_PC3_DITHER_EN_SHIFT          0
+#define PMU15_PLL_PC3_DCOCTLSP_MASK            0xFE000000
+#define PMU15_PLL_PC3_DCOCTLSP_SHIFT           25
+#define PMU15_PLL_PC3_DCOCTLSP_DIV2EN_MASK     0x01
+#define PMU15_PLL_PC3_DCOCTLSP_DIV2EN_SHIFT    0
+#define PMU15_PLL_PC3_DCOCTLSP_CH0EN_MASK      0x02
+#define PMU15_PLL_PC3_DCOCTLSP_CH0EN_SHIFT     1
+#define PMU15_PLL_PC3_DCOCTLSP_CH1EN_MASK      0x04
+#define PMU15_PLL_PC3_DCOCTLSP_CH1EN_SHIFT     2
+#define PMU15_PLL_PC3_DCOCTLSP_CH0SEL_MASK     0x18
+#define PMU15_PLL_PC3_DCOCTLSP_CH0SEL_SHIFT    3
+#define PMU15_PLL_PC3_DCOCTLSP_CH1SEL_MASK     0x60
+#define PMU15_PLL_PC3_DCOCTLSP_CH1SEL_SHIFT    5
+#define PMU15_PLL_PC3_DCOCTLSP_CHSEL_OUTP_DIV1 0
+#define PMU15_PLL_PC3_DCOCTLSP_CHSEL_OUTP_DIV2 1
+#define PMU15_PLL_PC3_DCOCTLSP_CHSEL_OUTP_DIV3 2
+#define PMU15_PLL_PC3_DCOCTLSP_CHSEL_OUTP_DIV5 3
+
+#define PMU15_PLL_PLLCTL4                      4
+#define PMU15_PLL_PC4_FLLCLK1_DIV_MASK         0x00000007
+#define PMU15_PLL_PC4_FLLCLK1_DIV_SHIFT                0
+#define PMU15_PLL_PC4_FLLCLK2_DIV_MASK         0x00000038
+#define PMU15_PLL_PC4_FLLCLK2_DIV_SHIFT                3
+#define PMU15_PLL_PC4_FLLCLK3_DIV_MASK         0x000001C0
+#define PMU15_PLL_PC4_FLLCLK3_DIV_SHIFT                6
+#define PMU15_PLL_PC4_DBGMODE_MASK             0x00000E00
+#define PMU15_PLL_PC4_DBGMODE_SHIFT            9
+#define PMU15_PLL_PC4_FLL480_CTLSP_LK_MASK     0x00001000
+#define PMU15_PLL_PC4_FLL480_CTLSP_LK_SHIFT    12
+#define PMU15_PLL_PC4_FLL480_CTLSP_MASK                0x000FE000
+#define PMU15_PLL_PC4_FLL480_CTLSP_SHIFT       13
+#define PMU15_PLL_PC4_DINPOL_MASK              0x00100000
+#define PMU15_PLL_PC4_DINPOL_SHIFT             20
+#define PMU15_PLL_PC4_CLKOUT_PD_MASK           0x00200000
+#define PMU15_PLL_PC4_CLKOUT_PD_SHIFT          21
+#define PMU15_PLL_PC4_CLKDIV2_PD_MASK          0x00400000
+#define PMU15_PLL_PC4_CLKDIV2_PD_SHIFT         22
+#define PMU15_PLL_PC4_CLKDIV4_PD_MASK          0x00800000
+#define PMU15_PLL_PC4_CLKDIV4_PD_SHIFT         23
+#define PMU15_PLL_PC4_CLKDIV8_PD_MASK          0x01000000
+#define PMU15_PLL_PC4_CLKDIV8_PD_SHIFT         24
+#define PMU15_PLL_PC4_CLKDIV16_PD_MASK         0x02000000
+#define PMU15_PLL_PC4_CLKDIV16_PD_SHIFT                25
+#define PMU15_PLL_PC4_TEST_EN_MASK             0x04000000
+#define PMU15_PLL_PC4_TEST_EN_SHIFT            26
+
+#define PMU15_PLL_PLLCTL5                      5
+#define PMU15_PLL_PC5_FREQTGT_MASK             0x000FFFFF
+#define PMU15_PLL_PC5_FREQTGT_SHIFT            0
+#define PMU15_PLL_PC5_DCOCTLSP_MASK            0x07F00000
+#define PMU15_PLL_PC5_DCOCTLSP_SHIFT           20
+#define PMU15_PLL_PC5_PRESCALE_MASK            0x18000000
+#define PMU15_PLL_PC5_PRESCALE_SHIFT           27
+
+#define PMU15_PLL_PLLCTL6              6
+#define PMU15_PLL_PC6_FREQTGT_MASK     0x000FFFFF
+#define PMU15_PLL_PC6_FREQTGT_SHIFT    0
+#define PMU15_PLL_PC6_DCOCTLSP_MASK    0x07F00000
+#define PMU15_PLL_PC6_DCOCTLSP_SHIFT   20
+#define PMU15_PLL_PC6_PRESCALE_MASK    0x18000000
+#define PMU15_PLL_PC6_PRESCALE_SHIFT   27
+
+#define PMU15_FREQTGT_480_DEFAULT      0x19AB1
+#define PMU15_FREQTGT_492_DEFAULT      0x1A4F5
+#define PMU15_ARM_96MHZ                        96000000        /**< 96 Mhz */
+#define PMU15_ARM_98MHZ                        98400000        /**< 98.4 Mhz */
+#define PMU15_ARM_97MHZ                        97000000        /**< 97 Mhz */
+
+
+#define PMU17_PLLCTL2_NDIVTYPE_MASK            0x00000070
+#define PMU17_PLLCTL2_NDIVTYPE_SHIFT           4
+
+#define PMU17_PLLCTL2_NDIV_MODE_INT            0
+#define PMU17_PLLCTL2_NDIV_MODE_INT1B8         1
+#define PMU17_PLLCTL2_NDIV_MODE_MASH111                2
+#define PMU17_PLLCTL2_NDIV_MODE_MASH111B8      3
+
+#define PMU17_PLLCTL0_BBPLL_PWRDWN             0
+#define PMU17_PLLCTL0_BBPLL_DRST               3
+#define PMU17_PLLCTL0_BBPLL_DISBL_CLK          8
+
+/* PLL usage in 4716/47162 */
+#define        PMU4716_MAINPLL_PLL0            12
+
+/* PLL usage in 4335 */
+#define PMU4335_PLL0_PC2_P1DIV_MASK                    0x000f0000
+#define PMU4335_PLL0_PC2_P1DIV_SHIFT           16
+#define PMU4335_PLL0_PC2_NDIV_INT_MASK         0xff800000
+#define PMU4335_PLL0_PC2_NDIV_INT_SHIFT                23
+#define PMU4335_PLL0_PC1_MDIV2_MASK                    0x0000ff00
+#define PMU4335_PLL0_PC1_MDIV2_SHIFT           8
+
+
+/* PLL usage in 5356/5357 */
+#define        PMU5356_MAINPLL_PLL0            0
+#define        PMU5357_MAINPLL_PLL0            0
+
+/* 4716/47162 resources */
+#define RES4716_PROC_PLL_ON            0x00000040
+#define RES4716_PROC_HT_AVAIL          0x00000080
+
+/* 4716/4717/4718 Chip specific ChipControl register bits */
+#define CCTRL_471X_I2S_PINS_ENABLE     0x0080 /* I2S pins off by default, shared w/ pflash */
+
+/* 5357 Chip specific ChipControl register bits */
+/* 2nd - 32-bit reg */
+#define CCTRL_5357_I2S_PINS_ENABLE     0x00040000 /* I2S pins enable */
+#define CCTRL_5357_I2CSPI_PINS_ENABLE  0x00080000 /* I2C/SPI pins enable */
+
+/* 5354 resources */
+#define RES5354_EXT_SWITCHER_PWM       0       /**< 0x00001 */
+#define RES5354_BB_SWITCHER_PWM                1       /**< 0x00002 */
+#define RES5354_BB_SWITCHER_BURST      2       /**< 0x00004 */
+#define RES5354_BB_EXT_SWITCHER_BURST  3       /**< 0x00008 */
+#define RES5354_ILP_REQUEST            4       /**< 0x00010 */
+#define RES5354_RADIO_SWITCHER_PWM     5       /**< 0x00020 */
+#define RES5354_RADIO_SWITCHER_BURST   6       /**< 0x00040 */
+#define RES5354_ROM_SWITCH             7       /**< 0x00080 */
+#define RES5354_PA_REF_LDO             8       /**< 0x00100 */
+#define RES5354_RADIO_LDO              9       /**< 0x00200 */
+#define RES5354_AFE_LDO                        10      /**< 0x00400 */
+#define RES5354_PLL_LDO                        11      /**< 0x00800 */
+#define RES5354_BG_FILTBYP             12      /**< 0x01000 */
+#define RES5354_TX_FILTBYP             13      /**< 0x02000 */
+#define RES5354_RX_FILTBYP             14      /**< 0x04000 */
+#define RES5354_XTAL_PU                        15      /**< 0x08000 */
+#define RES5354_XTAL_EN                        16      /**< 0x10000 */
+#define RES5354_BB_PLL_FILTBYP         17      /**< 0x20000 */
+#define RES5354_RF_PLL_FILTBYP         18      /**< 0x40000 */
+#define RES5354_BB_PLL_PU              19      /**< 0x80000 */
+
+/* 5357 Chip specific ChipControl register bits */
+#define CCTRL5357_EXTPA                 (1<<14) /* extPA in ChipControl 1, bit 14 */
+#define CCTRL5357_ANT_MUX_2o3          (1<<15) /* 2o3 in ChipControl 1, bit 15 */
+#define CCTRL5357_NFLASH               (1<<16) /* Nandflash in ChipControl 1, bit 16 */
+
+/* 43217 Chip specific ChipControl register bits */
+#define CCTRL43217_EXTPA_C0             (1<<13) /* core0 extPA in ChipControl 1, bit 13 */
+#define CCTRL43217_EXTPA_C1             (1<<8)  /* core1 extPA in ChipControl 1, bit 8 */
+
+/* 43228 Chip specific ChipControl register bits */
+#define CCTRL43228_EXTPA_C0             (1<<14) /* core1 extPA in ChipControl 1, bit 14 */
+#define CCTRL43228_EXTPA_C1             (1<<9)  /* core0 extPA in ChipControl 1, bit 1 */
+
+/* 4328 resources */
+#define RES4328_EXT_SWITCHER_PWM       0       /**< 0x00001 */
+#define RES4328_BB_SWITCHER_PWM                1       /**< 0x00002 */
+#define RES4328_BB_SWITCHER_BURST      2       /**< 0x00004 */
+#define RES4328_BB_EXT_SWITCHER_BURST  3       /**< 0x00008 */
+#define RES4328_ILP_REQUEST            4       /**< 0x00010 */
+#define RES4328_RADIO_SWITCHER_PWM     5       /**< 0x00020 */
+#define RES4328_RADIO_SWITCHER_BURST   6       /**< 0x00040 */
+#define RES4328_ROM_SWITCH             7       /**< 0x00080 */
+#define RES4328_PA_REF_LDO             8       /**< 0x00100 */
+#define RES4328_RADIO_LDO              9       /**< 0x00200 */
+#define RES4328_AFE_LDO                        10      /**< 0x00400 */
+#define RES4328_PLL_LDO                        11      /**< 0x00800 */
+#define RES4328_BG_FILTBYP             12      /**< 0x01000 */
+#define RES4328_TX_FILTBYP             13      /**< 0x02000 */
+#define RES4328_RX_FILTBYP             14      /**< 0x04000 */
+#define RES4328_XTAL_PU                        15      /**< 0x08000 */
+#define RES4328_XTAL_EN                        16      /**< 0x10000 */
+#define RES4328_BB_PLL_FILTBYP         17      /**< 0x20000 */
+#define RES4328_RF_PLL_FILTBYP         18      /**< 0x40000 */
+#define RES4328_BB_PLL_PU              19      /**< 0x80000 */
+
+/* 4325 A0/A1 resources */
+#define RES4325_BUCK_BOOST_BURST       0       /**< 0x00000001 */
+#define RES4325_CBUCK_BURST            1       /**< 0x00000002 */
+#define RES4325_CBUCK_PWM              2       /**< 0x00000004 */
+#define RES4325_CLDO_CBUCK_BURST       3       /**< 0x00000008 */
+#define RES4325_CLDO_CBUCK_PWM         4       /**< 0x00000010 */
+#define RES4325_BUCK_BOOST_PWM         5       /**< 0x00000020 */
+#define RES4325_ILP_REQUEST            6       /**< 0x00000040 */
+#define RES4325_ABUCK_BURST            7       /**< 0x00000080 */
+#define RES4325_ABUCK_PWM              8       /**< 0x00000100 */
+#define RES4325_LNLDO1_PU              9       /**< 0x00000200 */
+#define RES4325_OTP_PU                 10      /**< 0x00000400 */
+#define RES4325_LNLDO3_PU              11      /**< 0x00000800 */
+#define RES4325_LNLDO4_PU              12      /**< 0x00001000 */
+#define RES4325_XTAL_PU                        13      /**< 0x00002000 */
+#define RES4325_ALP_AVAIL              14      /**< 0x00004000 */
+#define RES4325_RX_PWRSW_PU            15      /**< 0x00008000 */
+#define RES4325_TX_PWRSW_PU            16      /**< 0x00010000 */
+#define RES4325_RFPLL_PWRSW_PU         17      /**< 0x00020000 */
+#define RES4325_LOGEN_PWRSW_PU         18      /**< 0x00040000 */
+#define RES4325_AFE_PWRSW_PU           19      /**< 0x00080000 */
+#define RES4325_BBPLL_PWRSW_PU         20      /**< 0x00100000 */
+#define RES4325_HT_AVAIL               21      /**< 0x00200000 */
+
+/* 4325 B0/C0 resources */
+#define RES4325B0_CBUCK_LPOM           1       /**< 0x00000002 */
+#define RES4325B0_CBUCK_BURST          2       /**< 0x00000004 */
+#define RES4325B0_CBUCK_PWM            3       /**< 0x00000008 */
+#define RES4325B0_CLDO_PU              4       /**< 0x00000010 */
+
+/* 4325 C1 resources */
+#define RES4325C1_LNLDO2_PU            12      /**< 0x00001000 */
+
+/* 4325 chip-specific ChipStatus register bits */
+#define CST4325_SPROM_OTP_SEL_MASK     0x00000003
+#define CST4325_DEFCIS_SEL             0       /**< OTP is powered up, use def. CIS, no SPROM */
+#define CST4325_SPROM_SEL              1       /**< OTP is powered up, SPROM is present */
+#define CST4325_OTP_SEL                        2       /**< OTP is powered up, no SPROM */
+#define CST4325_OTP_PWRDN              3       /**< OTP is powered down, SPROM is present */
+#define CST4325_SDIO_USB_MODE_MASK     0x00000004
+#define CST4325_SDIO_USB_MODE_SHIFT    2
+#define CST4325_RCAL_VALID_MASK                0x00000008
+#define CST4325_RCAL_VALID_SHIFT       3
+#define CST4325_RCAL_VALUE_MASK                0x000001f0
+#define CST4325_RCAL_VALUE_SHIFT       4
+#define CST4325_PMUTOP_2B_MASK                 0x00000200      /**< 1 for 2b, 0 for to 2a */
+#define CST4325_PMUTOP_2B_SHIFT        9
+
+#define RES4329_RESERVED0              0       /**< 0x00000001 */
+#define RES4329_CBUCK_LPOM             1       /**< 0x00000002 */
+#define RES4329_CBUCK_BURST            2       /**< 0x00000004 */
+#define RES4329_CBUCK_PWM              3       /**< 0x00000008 */
+#define RES4329_CLDO_PU                        4       /**< 0x00000010 */
+#define RES4329_PALDO_PU               5       /**< 0x00000020 */
+#define RES4329_ILP_REQUEST            6       /**< 0x00000040 */
+#define RES4329_RESERVED7              7       /**< 0x00000080 */
+#define RES4329_RESERVED8              8       /**< 0x00000100 */
+#define RES4329_LNLDO1_PU              9       /**< 0x00000200 */
+#define RES4329_OTP_PU                 10      /**< 0x00000400 */
+#define RES4329_RESERVED11             11      /**< 0x00000800 */
+#define RES4329_LNLDO2_PU              12      /**< 0x00001000 */
+#define RES4329_XTAL_PU                        13      /**< 0x00002000 */
+#define RES4329_ALP_AVAIL              14      /**< 0x00004000 */
+#define RES4329_RX_PWRSW_PU            15      /**< 0x00008000 */
+#define RES4329_TX_PWRSW_PU            16      /**< 0x00010000 */
+#define RES4329_RFPLL_PWRSW_PU         17      /**< 0x00020000 */
+#define RES4329_LOGEN_PWRSW_PU         18      /**< 0x00040000 */
+#define RES4329_AFE_PWRSW_PU           19      /**< 0x00080000 */
+#define RES4329_BBPLL_PWRSW_PU         20      /**< 0x00100000 */
+#define RES4329_HT_AVAIL               21      /**< 0x00200000 */
+
+#define CST4329_SPROM_OTP_SEL_MASK     0x00000003
+#define CST4329_DEFCIS_SEL             0       /**< OTP is powered up, use def. CIS, no SPROM */
+#define CST4329_SPROM_SEL              1       /**< OTP is powered up, SPROM is present */
+#define CST4329_OTP_SEL                        2       /**< OTP is powered up, no SPROM */
+#define CST4329_OTP_PWRDN              3       /**< OTP is powered down, SPROM is present */
+#define CST4329_SPI_SDIO_MODE_MASK     0x00000004
+#define CST4329_SPI_SDIO_MODE_SHIFT    2
+
+/* 4312 chip-specific ChipStatus register bits */
+#define CST4312_SPROM_OTP_SEL_MASK     0x00000003
+#define CST4312_DEFCIS_SEL             0       /**< OTP is powered up, use def. CIS, no SPROM */
+#define CST4312_SPROM_SEL              1       /**< OTP is powered up, SPROM is present */
+#define CST4312_OTP_SEL                        2       /**< OTP is powered up, no SPROM */
+#define CST4312_OTP_BAD                        3       /**< OTP is broken, SPROM is present */
+
+/* 4312 resources (all PMU chips with little memory constraint) */
+#define RES4312_SWITCHER_BURST         0       /**< 0x00000001 */
+#define RES4312_SWITCHER_PWM           1       /**< 0x00000002 */
+#define RES4312_PA_REF_LDO             2       /**< 0x00000004 */
+#define RES4312_CORE_LDO_BURST         3       /**< 0x00000008 */
+#define RES4312_CORE_LDO_PWM           4       /**< 0x00000010 */
+#define RES4312_RADIO_LDO              5       /**< 0x00000020 */
+#define RES4312_ILP_REQUEST            6       /**< 0x00000040 */
+#define RES4312_BG_FILTBYP             7       /**< 0x00000080 */
+#define RES4312_TX_FILTBYP             8       /**< 0x00000100 */
+#define RES4312_RX_FILTBYP             9       /**< 0x00000200 */
+#define RES4312_XTAL_PU                        10      /**< 0x00000400 */
+#define RES4312_ALP_AVAIL              11      /**< 0x00000800 */
+#define RES4312_BB_PLL_FILTBYP         12      /**< 0x00001000 */
+#define RES4312_RF_PLL_FILTBYP         13      /**< 0x00002000 */
+#define RES4312_HT_AVAIL               14      /**< 0x00004000 */
+
+/* 4322 resources */
+#define RES4322_RF_LDO                 0
+#define RES4322_ILP_REQUEST            1
+#define RES4322_XTAL_PU                        2
+#define RES4322_ALP_AVAIL              3
+#define RES4322_SI_PLL_ON              4
+#define RES4322_HT_SI_AVAIL            5
+#define RES4322_PHY_PLL_ON             6
+#define RES4322_HT_PHY_AVAIL           7
+#define RES4322_OTP_PU                 8
+
+/* 4322 chip-specific ChipStatus register bits */
+#define CST4322_XTAL_FREQ_20_40MHZ     0x00000020
+#define CST4322_SPROM_OTP_SEL_MASK     0x000000c0
+#define CST4322_SPROM_OTP_SEL_SHIFT    6
+#define CST4322_NO_SPROM_OTP           0       /**< no OTP, no SPROM */
+#define CST4322_SPROM_PRESENT          1       /**< SPROM is present */
+#define CST4322_OTP_PRESENT            2       /**< OTP is present */
+#define CST4322_PCI_OR_USB             0x00000100
+#define CST4322_BOOT_MASK              0x00000600
+#define CST4322_BOOT_SHIFT             9
+#define CST4322_BOOT_FROM_SRAM         0       /**< boot from SRAM, ARM in reset */
+#define CST4322_BOOT_FROM_ROM          1       /**< boot from ROM */
+#define CST4322_BOOT_FROM_FLASH                2       /**< boot from FLASH */
+#define CST4322_BOOT_FROM_INVALID      3
+#define CST4322_ILP_DIV_EN             0x00000800
+#define CST4322_FLASH_TYPE_MASK                0x00001000
+#define CST4322_FLASH_TYPE_SHIFT       12
+#define CST4322_FLASH_TYPE_SHIFT_ST    0       /**< ST serial FLASH */
+#define CST4322_FLASH_TYPE_SHIFT_ATMEL 1       /**< ATMEL flash */
+#define CST4322_ARM_TAP_SEL            0x00002000
+#define CST4322_RES_INIT_MODE_MASK     0x0000c000
+#define CST4322_RES_INIT_MODE_SHIFT    14
+#define CST4322_RES_INIT_MODE_ILPAVAIL 0       /**< resinitmode: ILP available */
+#define CST4322_RES_INIT_MODE_ILPREQ   1       /**< resinitmode: ILP request */
+#define CST4322_RES_INIT_MODE_ALPAVAIL 2       /**< resinitmode: ALP available */
+#define CST4322_RES_INIT_MODE_HTAVAIL  3       /**< resinitmode: HT available */
+#define CST4322_PCIPLLCLK_GATING       0x00010000
+#define CST4322_CLK_SWITCH_PCI_TO_ALP  0x00020000
+#define CST4322_PCI_CARDBUS_MODE       0x00040000
+
+/* 43224 chip-specific ChipControl register bits */
+#define CCTRL43224_GPIO_TOGGLE          0x8000 /* gpio[3:0] pins as btcoex or s/w gpio */
+#define CCTRL_43224A0_12MA_LED_DRIVE    0x00F000F0 /* 12 mA drive strength */
+#define CCTRL_43224B0_12MA_LED_DRIVE    0xF0    /* 12 mA drive strength for later 43224s */
+
+/* 43236 resources */
+#define RES43236_REGULATOR             0
+#define RES43236_ILP_REQUEST           1
+#define RES43236_XTAL_PU               2
+#define RES43236_ALP_AVAIL             3
+#define RES43236_SI_PLL_ON             4
+#define RES43236_HT_SI_AVAIL           5
+
+/* 43236 chip-specific ChipControl register bits */
+#define CCTRL43236_BT_COEXIST          (1<<0)  /**< 0 disable */
+#define CCTRL43236_SECI                        (1<<1)  /**< 0 SECI is disabled (JATG functional) */
+#define CCTRL43236_EXT_LNA             (1<<2)  /**< 0 disable */
+#define CCTRL43236_ANT_MUX_2o3          (1<<3) /**< 2o3 mux, chipcontrol bit 3 */
+#define CCTRL43236_GSIO                        (1<<4)  /**< 0 disable */
+
+/* 43236 Chip specific ChipStatus register bits */
+#define CST43236_SFLASH_MASK           0x00000040
+#define CST43236_OTP_SEL_MASK          0x00000080
+#define CST43236_OTP_SEL_SHIFT         7
+#define CST43236_HSIC_MASK             0x00000100      /**< USB/HSIC */
+#define CST43236_BP_CLK                        0x00000200      /**< 120/96Mbps */
+#define CST43236_BOOT_MASK             0x00001800
+#define CST43236_BOOT_SHIFT            11
+#define CST43236_BOOT_FROM_SRAM                0       /**< boot from SRAM, ARM in reset */
+#define CST43236_BOOT_FROM_ROM         1       /**< boot from ROM */
+#define CST43236_BOOT_FROM_FLASH       2       /**< boot from FLASH */
+#define CST43236_BOOT_FROM_INVALID     3
+
+/* 43237 resources */
+#define RES43237_REGULATOR             0
+#define RES43237_ILP_REQUEST           1
+#define RES43237_XTAL_PU               2
+#define RES43237_ALP_AVAIL             3
+#define RES43237_SI_PLL_ON             4
+#define RES43237_HT_SI_AVAIL           5
+
+/* 43237 chip-specific ChipControl register bits */
+#define CCTRL43237_BT_COEXIST          (1<<0)  /**< 0 disable */
+#define CCTRL43237_SECI                        (1<<1)  /**< 0 SECI is disabled (JATG functional) */
+#define CCTRL43237_EXT_LNA             (1<<2)  /**< 0 disable */
+#define CCTRL43237_ANT_MUX_2o3          (1<<3) /**< 2o3 mux, chipcontrol bit 3 */
+#define CCTRL43237_GSIO                        (1<<4)  /**< 0 disable */
+
+/* 43237 Chip specific ChipStatus register bits */
+#define CST43237_SFLASH_MASK           0x00000040
+#define CST43237_OTP_SEL_MASK          0x00000080
+#define CST43237_OTP_SEL_SHIFT         7
+#define CST43237_HSIC_MASK             0x00000100      /**< USB/HSIC */
+#define CST43237_BP_CLK                        0x00000200      /**< 120/96Mbps */
+#define CST43237_BOOT_MASK             0x00001800
+#define CST43237_BOOT_SHIFT            11
+#define CST43237_BOOT_FROM_SRAM                0       /**< boot from SRAM, ARM in reset */
+#define CST43237_BOOT_FROM_ROM         1       /**< boot from ROM */
+#define CST43237_BOOT_FROM_FLASH       2       /**< boot from FLASH */
+#define CST43237_BOOT_FROM_INVALID     3
+
+/* 43239 resources */
+#define RES43239_OTP_PU                        9
+#define RES43239_MACPHY_CLKAVAIL       23
+#define RES43239_HT_AVAIL              24
+
+/* 43239 Chip specific ChipStatus register bits */
+#define CST43239_SPROM_MASK                    0x00000002
+#define CST43239_SFLASH_MASK           0x00000004
+#define        CST43239_RES_INIT_MODE_SHIFT    7
+#define        CST43239_RES_INIT_MODE_MASK             0x000001f0
+#define CST43239_CHIPMODE_SDIOD(cs)    ((cs) & (1 << 15))      /**< SDIO || gSPI */
+#define CST43239_CHIPMODE_USB20D(cs)   (~(cs) & (1 << 15))     /**< USB || USBDA */
+#define CST43239_CHIPMODE_SDIO(cs)     (((cs) & (1 << 0)) == 0)        /**< SDIO */
+#define CST43239_CHIPMODE_GSPI(cs)     (((cs) & (1 << 0)) == (1 << 0)) /**< gSPI */
+
+/* 4324 resources */
+/* 43242 use same PMU as 4324 */
+#define RES4324_LPLDO_PU                       0
+#define RES4324_RESET_PULLDN_DIS               1
+#define RES4324_PMU_BG_PU                      2
+#define RES4324_HSIC_LDO_PU                    3
+#define RES4324_CBUCK_LPOM_PU                  4
+#define RES4324_CBUCK_PFM_PU                   5
+#define RES4324_CLDO_PU                                6
+#define RES4324_LPLDO2_LVM                     7
+#define RES4324_LNLDO1_PU                      8
+#define RES4324_LNLDO2_PU                      9
+#define RES4324_LDO3P3_PU                      10
+#define RES4324_OTP_PU                         11
+#define RES4324_XTAL_PU                                12
+#define RES4324_BBPLL_PU                       13
+#define RES4324_LQ_AVAIL                       14
+#define RES4324_WL_CORE_READY                  17
+#define RES4324_ILP_REQ                                18
+#define RES4324_ALP_AVAIL                      19
+#define RES4324_PALDO_PU                       20
+#define RES4324_RADIO_PU                       21
+#define RES4324_SR_CLK_STABLE                  22
+#define RES4324_SR_SAVE_RESTORE                        23
+#define RES4324_SR_PHY_PWRSW                   24
+#define RES4324_SR_PHY_PIC                     25
+#define RES4324_SR_SUBCORE_PWRSW               26
+#define RES4324_SR_SUBCORE_PIC                 27
+#define RES4324_SR_MEM_PM0                     28
+#define RES4324_HT_AVAIL                       29
+#define RES4324_MACPHY_CLKAVAIL                        30
+
+/* 4324 Chip specific ChipStatus register bits */
+#define CST4324_SPROM_MASK                     0x00000080
+#define CST4324_SFLASH_MASK                    0x00400000
+#define        CST4324_RES_INIT_MODE_SHIFT     10
+#define        CST4324_RES_INIT_MODE_MASK      0x00000c00
+#define CST4324_CHIPMODE_MASK          0x7
+#define CST4324_CHIPMODE_SDIOD(cs)     ((~(cs)) & (1 << 2))    /**< SDIO || gSPI */
+#define CST4324_CHIPMODE_USB20D(cs)    (((cs) & CST4324_CHIPMODE_MASK) == 0x6) /**< USB || USBDA */
+
+/* 43242 Chip specific ChipStatus register bits */
+#define CST43242_SFLASH_MASK                    0x00000008
+#define CST43242_SR_HALT                       (1<<25)
+#define CST43242_SR_CHIP_STATUS_2              27 /* bit 27 */
+
+/* 4331 resources */
+#define RES4331_REGULATOR              0
+#define RES4331_ILP_REQUEST            1
+#define RES4331_XTAL_PU                        2
+#define RES4331_ALP_AVAIL              3
+#define RES4331_SI_PLL_ON              4
+#define RES4331_HT_SI_AVAIL            5
+
+/* 4331 chip-specific ChipControl register bits */
+#define CCTRL4331_BT_COEXIST           (1<<0)  /**< 0 disable */
+#define CCTRL4331_SECI                 (1<<1)  /**< 0 SECI is disabled (JATG functional) */
+#define CCTRL4331_EXT_LNA_G            (1<<2)  /**< 0 disable */
+#define CCTRL4331_SPROM_GPIO13_15       (1<<3) /**< sprom/gpio13-15 mux */
+#define CCTRL4331_EXTPA_EN             (1<<4)  /**< 0 ext pa disable, 1 ext pa enabled */
+#define CCTRL4331_GPIOCLK_ON_SPROMCS   (1<<5)  /**< set drive out GPIO_CLK on sprom_cs pin */
+#define CCTRL4331_PCIE_MDIO_ON_SPROMCS (1<<6)  /**< use sprom_cs pin as PCIE mdio interface */
+#define CCTRL4331_EXTPA_ON_GPIO2_5     (1<<7)  /* aband extpa will be at gpio2/5 and sprom_dout */
+#define CCTRL4331_OVR_PIPEAUXCLKEN     (1<<8)  /**< override core control on pipe_AuxClkEnable */
+#define CCTRL4331_OVR_PIPEAUXPWRDOWN   (1<<9)  /**< override core control on pipe_AuxPowerDown */
+#define CCTRL4331_PCIE_AUXCLKEN                (1<<10) /**< pcie_auxclkenable */
+#define CCTRL4331_PCIE_PIPE_PLLDOWN    (1<<11) /**< pcie_pipe_pllpowerdown */
+#define CCTRL4331_EXTPA_EN2            (1<<12) /**< 0 ext pa disable, 1 ext pa enabled */
+#define CCTRL4331_EXT_LNA_A            (1<<13) /**< 0 disable */
+#define CCTRL4331_BT_SHD0_ON_GPIO4     (1<<16) /**< enable bt_shd0 at gpio4 */
+#define CCTRL4331_BT_SHD1_ON_GPIO5     (1<<17) /**< enable bt_shd1 at gpio5 */
+#define CCTRL4331_EXTPA_ANA_EN         (1<<24) /**< 0 ext pa disable, 1 ext pa enabled */
+
+/* 4331 Chip specific ChipStatus register bits */
+#define        CST4331_XTAL_FREQ               0x00000001      /**< crystal frequency 20/40Mhz */
+#define        CST4331_SPROM_OTP_SEL_MASK      0x00000006
+#define        CST4331_SPROM_OTP_SEL_SHIFT     1
+#define        CST4331_SPROM_PRESENT           0x00000002
+#define        CST4331_OTP_PRESENT             0x00000004
+#define        CST4331_LDO_RF                  0x00000008
+#define        CST4331_LDO_PAR                 0x00000010
+
+/* 4315 resource */
+#define RES4315_CBUCK_LPOM             1       /**< 0x00000002 */
+#define RES4315_CBUCK_BURST            2       /**< 0x00000004 */
+#define RES4315_CBUCK_PWM              3       /**< 0x00000008 */
+#define RES4315_CLDO_PU                        4       /**< 0x00000010 */
+#define RES4315_PALDO_PU               5       /**< 0x00000020 */
+#define RES4315_ILP_REQUEST            6       /**< 0x00000040 */
+#define RES4315_LNLDO1_PU              9       /**< 0x00000200 */
+#define RES4315_OTP_PU                 10      /**< 0x00000400 */
+#define RES4315_LNLDO2_PU              12      /**< 0x00001000 */
+#define RES4315_XTAL_PU                        13      /**< 0x00002000 */
+#define RES4315_ALP_AVAIL              14      /**< 0x00004000 */
+#define RES4315_RX_PWRSW_PU            15      /**< 0x00008000 */
+#define RES4315_TX_PWRSW_PU            16      /**< 0x00010000 */
+#define RES4315_RFPLL_PWRSW_PU         17      /**< 0x00020000 */
+#define RES4315_LOGEN_PWRSW_PU         18      /**< 0x00040000 */
+#define RES4315_AFE_PWRSW_PU           19      /**< 0x00080000 */
+#define RES4315_BBPLL_PWRSW_PU         20      /**< 0x00100000 */
+#define RES4315_HT_AVAIL               21      /**< 0x00200000 */
+
+/* 4315 chip-specific ChipStatus register bits */
+#define CST4315_SPROM_OTP_SEL_MASK     0x00000003      /**< gpio [7:6], SDIO CIS selection */
+#define CST4315_DEFCIS_SEL             0x00000000      /**< use default CIS, OTP is powered up */
+#define CST4315_SPROM_SEL              0x00000001      /**< use SPROM, OTP is powered up */
+#define CST4315_OTP_SEL                        0x00000002      /**< use OTP, OTP is powered up */
+#define CST4315_OTP_PWRDN              0x00000003      /**< use SPROM, OTP is powered down */
+#define CST4315_SDIO_MODE              0x00000004      /**< gpio [8], sdio/usb mode */
+#define CST4315_RCAL_VALID             0x00000008
+#define CST4315_RCAL_VALUE_MASK                0x000001f0
+#define CST4315_RCAL_VALUE_SHIFT       4
+#define CST4315_PALDO_EXTPNP           0x00000200 /**< PALDO is configured with external PNP */
+#define CST4315_CBUCK_MODE_MASK                0x00000c00
+#define CST4315_CBUCK_MODE_BURST       0x00000400
+#define CST4315_CBUCK_MODE_LPBURST     0x00000c00
+
+/* 4319 resources */
+#define RES4319_CBUCK_LPOM             1       /**< 0x00000002 */
+#define RES4319_CBUCK_BURST            2       /**< 0x00000004 */
+#define RES4319_CBUCK_PWM              3       /**< 0x00000008 */
+#define RES4319_CLDO_PU                        4       /**< 0x00000010 */
+#define RES4319_PALDO_PU               5       /**< 0x00000020 */
+#define RES4319_ILP_REQUEST            6       /**< 0x00000040 */
+#define RES4319_LNLDO1_PU              9       /**< 0x00000200 */
+#define RES4319_OTP_PU                 10      /**< 0x00000400 */
+#define RES4319_LNLDO2_PU              12      /**< 0x00001000 */
+#define RES4319_XTAL_PU                        13      /**< 0x00002000 */
+#define RES4319_ALP_AVAIL              14      /**< 0x00004000 */
+#define RES4319_RX_PWRSW_PU            15      /**< 0x00008000 */
+#define RES4319_TX_PWRSW_PU            16      /**< 0x00010000 */
+#define RES4319_RFPLL_PWRSW_PU         17      /**< 0x00020000 */
+#define RES4319_LOGEN_PWRSW_PU         18      /**< 0x00040000 */
+#define RES4319_AFE_PWRSW_PU           19      /**< 0x00080000 */
+#define RES4319_BBPLL_PWRSW_PU         20      /**< 0x00100000 */
+#define RES4319_HT_AVAIL               21      /**< 0x00200000 */
+
+/* 4319 chip-specific ChipStatus register bits */
+#define        CST4319_SPI_CPULESSUSB          0x00000001
+#define        CST4319_SPI_CLK_POL             0x00000002
+#define        CST4319_SPI_CLK_PH              0x00000008
+#define        CST4319_SPROM_OTP_SEL_MASK      0x000000c0      /**< gpio [7:6], SDIO CIS selection */
+#define        CST4319_SPROM_OTP_SEL_SHIFT     6
+#define        CST4319_DEFCIS_SEL              0x00000000      /**< use default CIS, OTP is powered up */
+#define        CST4319_SPROM_SEL               0x00000040      /**< use SPROM, OTP is powered up */
+#define        CST4319_OTP_SEL                 0x00000080      /* use OTP, OTP is powered up */
+#define        CST4319_OTP_PWRDN               0x000000c0      /* use SPROM, OTP is powered down */
+#define        CST4319_SDIO_USB_MODE           0x00000100      /**< gpio [8], sdio/usb mode */
+#define        CST4319_REMAP_SEL_MASK          0x00000600
+#define        CST4319_ILPDIV_EN               0x00000800
+#define        CST4319_XTAL_PD_POL             0x00001000
+#define        CST4319_LPO_SEL                 0x00002000
+#define        CST4319_RES_INIT_MODE           0x0000c000
+#define        CST4319_PALDO_EXTPNP            0x00010000 /**< PALDO is configured with external PNP */
+#define        CST4319_CBUCK_MODE_MASK         0x00060000
+#define CST4319_CBUCK_MODE_BURST       0x00020000
+#define CST4319_CBUCK_MODE_LPBURST     0x00060000
+#define        CST4319_RCAL_VALID              0x01000000
+#define        CST4319_RCAL_VALUE_MASK         0x3e000000
+#define        CST4319_RCAL_VALUE_SHIFT        25
+
+#define PMU1_PLL0_CHIPCTL0             0
+#define PMU1_PLL0_CHIPCTL1             1
+#define PMU1_PLL0_CHIPCTL2             2
+#define CCTL_4319USB_XTAL_SEL_MASK     0x00180000
+#define CCTL_4319USB_XTAL_SEL_SHIFT    19
+#define CCTL_4319USB_48MHZ_PLL_SEL     1
+#define CCTL_4319USB_24MHZ_PLL_SEL     2
+
+/* PMU resources for 4336 */
+#define        RES4336_CBUCK_LPOM              0
+#define        RES4336_CBUCK_BURST             1
+#define        RES4336_CBUCK_LP_PWM            2
+#define        RES4336_CBUCK_PWM               3
+#define        RES4336_CLDO_PU                 4
+#define        RES4336_DIS_INT_RESET_PD        5
+#define        RES4336_ILP_REQUEST             6
+#define        RES4336_LNLDO_PU                7
+#define        RES4336_LDO3P3_PU               8
+#define        RES4336_OTP_PU                  9
+#define        RES4336_XTAL_PU                 10
+#define        RES4336_ALP_AVAIL               11
+#define        RES4336_RADIO_PU                12
+#define        RES4336_BG_PU                   13
+#define        RES4336_VREG1p4_PU_PU           14
+#define        RES4336_AFE_PWRSW_PU            15
+#define        RES4336_RX_PWRSW_PU             16
+#define        RES4336_TX_PWRSW_PU             17
+#define        RES4336_BB_PWRSW_PU             18
+#define        RES4336_SYNTH_PWRSW_PU          19
+#define        RES4336_MISC_PWRSW_PU           20
+#define        RES4336_LOGEN_PWRSW_PU          21
+#define        RES4336_BBPLL_PWRSW_PU          22
+#define        RES4336_MACPHY_CLKAVAIL         23
+#define        RES4336_HT_AVAIL                24
+#define        RES4336_RSVD                    25
+
+/* 4336 chip-specific ChipStatus register bits */
+#define        CST4336_SPI_MODE_MASK           0x00000001
+#define        CST4336_SPROM_PRESENT           0x00000002
+#define        CST4336_OTP_PRESENT             0x00000004
+#define        CST4336_ARMREMAP_0              0x00000008
+#define        CST4336_ILPDIV_EN_MASK          0x00000010
+#define        CST4336_ILPDIV_EN_SHIFT         4
+#define        CST4336_XTAL_PD_POL_MASK        0x00000020
+#define        CST4336_XTAL_PD_POL_SHIFT       5
+#define        CST4336_LPO_SEL_MASK            0x00000040
+#define        CST4336_LPO_SEL_SHIFT           6
+#define        CST4336_RES_INIT_MODE_MASK      0x00000180
+#define        CST4336_RES_INIT_MODE_SHIFT     7
+#define        CST4336_CBUCK_MODE_MASK         0x00000600
+#define        CST4336_CBUCK_MODE_SHIFT        9
+
+/* 4336 Chip specific PMU ChipControl register bits */
+#define PCTL_4336_SERIAL_ENAB  (1  << 24)
+
+/* 4330 resources */
+#define        RES4330_CBUCK_LPOM              0
+#define        RES4330_CBUCK_BURST             1
+#define        RES4330_CBUCK_LP_PWM            2
+#define        RES4330_CBUCK_PWM               3
+#define        RES4330_CLDO_PU                 4
+#define        RES4330_DIS_INT_RESET_PD        5
+#define        RES4330_ILP_REQUEST             6
+#define        RES4330_LNLDO_PU                7
+#define        RES4330_LDO3P3_PU               8
+#define        RES4330_OTP_PU                  9
+#define        RES4330_XTAL_PU                 10
+#define        RES4330_ALP_AVAIL               11
+#define        RES4330_RADIO_PU                12
+#define        RES4330_BG_PU                   13
+#define        RES4330_VREG1p4_PU_PU           14
+#define        RES4330_AFE_PWRSW_PU            15
+#define        RES4330_RX_PWRSW_PU             16
+#define        RES4330_TX_PWRSW_PU             17
+#define        RES4330_BB_PWRSW_PU             18
+#define        RES4330_SYNTH_PWRSW_PU          19
+#define        RES4330_MISC_PWRSW_PU           20
+#define        RES4330_LOGEN_PWRSW_PU          21
+#define        RES4330_BBPLL_PWRSW_PU          22
+#define        RES4330_MACPHY_CLKAVAIL         23
+#define        RES4330_HT_AVAIL                24
+#define        RES4330_5gRX_PWRSW_PU           25
+#define        RES4330_5gTX_PWRSW_PU           26
+#define        RES4330_5g_LOGEN_PWRSW_PU       27
+
+/* 4330 chip-specific ChipStatus register bits */
+#define CST4330_CHIPMODE_SDIOD(cs)     (((cs) & 0x7) < 6)      /**< SDIO || gSPI */
+#define CST4330_CHIPMODE_USB20D(cs)    (((cs) & 0x7) >= 6)     /**< USB || USBDA */
+#define CST4330_CHIPMODE_SDIO(cs)      (((cs) & 0x4) == 0)     /**< SDIO */
+#define CST4330_CHIPMODE_GSPI(cs)      (((cs) & 0x6) == 4)     /**< gSPI */
+#define CST4330_CHIPMODE_USB(cs)       (((cs) & 0x7) == 6)     /**< USB packet-oriented */
+#define CST4330_CHIPMODE_USBDA(cs)     (((cs) & 0x7) == 7)     /**< USB Direct Access */
+#define        CST4330_OTP_PRESENT             0x00000010
+#define        CST4330_LPO_AUTODET_EN          0x00000020
+#define        CST4330_ARMREMAP_0              0x00000040
+#define        CST4330_SPROM_PRESENT           0x00000080      /**< takes priority over OTP if both set */
+#define        CST4330_ILPDIV_EN               0x00000100
+#define        CST4330_LPO_SEL                 0x00000200
+#define        CST4330_RES_INIT_MODE_SHIFT     10
+#define        CST4330_RES_INIT_MODE_MASK      0x00000c00
+#define CST4330_CBUCK_MODE_SHIFT       12
+#define CST4330_CBUCK_MODE_MASK                0x00003000
+#define        CST4330_CBUCK_POWER_OK          0x00004000
+#define        CST4330_BB_PLL_LOCKED           0x00008000
+#define SOCDEVRAM_BP_ADDR              0x1E000000
+#define SOCDEVRAM_ARM_ADDR             0x00800000
+
+/* 4330 Chip specific PMU ChipControl register bits */
+#define PCTL_4330_SERIAL_ENAB  (1  << 24)
+
+/* 4330 Chip specific ChipControl register bits */
+#define CCTRL_4330_GPIO_SEL            0x00000001    /* 1=select GPIOs to be muxed out */
+#define CCTRL_4330_ERCX_SEL            0x00000002    /* 1=select ERCX BT coex to be muxed out */
+#define CCTRL_4330_SDIO_HOST_WAKE      0x00000004    /* SDIO: 1=configure GPIO0 for host wake */
+#define CCTRL_4330_JTAG_DISABLE        0x00000008    /* 1=disable JTAG interface on mux'd pins */
+
+#define PMU_VREG0_ADDR                         0
+#define PMU_VREG0_DISABLE_PULLD_BT_SHIFT       2
+#define PMU_VREG0_DISABLE_PULLD_WL_SHIFT       3
+
+#define PMU_VREG4_ADDR                 4
+
+#define PMU_VREG4_CLDO_PWM_SHIFT       4
+#define PMU_VREG4_CLDO_PWM_MASK                0x7
+
+#define PMU_VREG4_LPLDO1_SHIFT         15
+#define PMU_VREG4_LPLDO1_MASK          0x7
+#define PMU_VREG4_LPLDO1_1p20V         0
+#define PMU_VREG4_LPLDO1_1p15V         1
+#define PMU_VREG4_LPLDO1_1p10V         2
+#define PMU_VREG4_LPLDO1_1p25V         3
+#define PMU_VREG4_LPLDO1_1p05V         4
+#define PMU_VREG4_LPLDO1_1p00V         5
+#define PMU_VREG4_LPLDO1_0p95V         6
+#define PMU_VREG4_LPLDO1_0p90V         7
+
+/* 4350/4345 VREG4 settings */
+#define PMU4350_VREG4_LPLDO1_1p10V     0
+#define PMU4350_VREG4_LPLDO1_1p15V     1
+#define PMU4350_VREG4_LPLDO1_1p21V     2
+#define PMU4350_VREG4_LPLDO1_1p24V     3
+#define PMU4350_VREG4_LPLDO1_0p90V     4
+#define PMU4350_VREG4_LPLDO1_0p96V     5
+#define PMU4350_VREG4_LPLDO1_1p01V     6
+#define PMU4350_VREG4_LPLDO1_1p04V     7
+
+#define PMU_VREG4_LPLDO2_LVM_SHIFT     18
+#define PMU_VREG4_LPLDO2_LVM_MASK      0x7
+#define PMU_VREG4_LPLDO2_HVM_SHIFT     21
+#define PMU_VREG4_LPLDO2_HVM_MASK      0x7
+#define PMU_VREG4_LPLDO2_LVM_HVM_MASK  0x3f
+#define PMU_VREG4_LPLDO2_1p00V         0
+#define PMU_VREG4_LPLDO2_1p15V         1
+#define PMU_VREG4_LPLDO2_1p20V         2
+#define PMU_VREG4_LPLDO2_1p10V         3
+#define PMU_VREG4_LPLDO2_0p90V         4       /**< 4 - 7 is 0.90V */
+
+#define PMU_VREG4_HSICLDO_BYPASS_SHIFT 27
+#define PMU_VREG4_HSICLDO_BYPASS_MASK  0x1
+
+#define PMU_VREG5_ADDR                 5
+#define PMU_VREG5_HSICAVDD_PD_SHIFT    6
+#define PMU_VREG5_HSICAVDD_PD_MASK     0x1
+#define PMU_VREG5_HSICDVDD_PD_SHIFT    11
+#define PMU_VREG5_HSICDVDD_PD_MASK     0x1
+
+/* 4334 resources */
+#define RES4334_LPLDO_PU               0
+#define RES4334_RESET_PULLDN_DIS       1
+#define RES4334_PMU_BG_PU              2
+#define RES4334_HSIC_LDO_PU            3
+#define RES4334_CBUCK_LPOM_PU          4
+#define RES4334_CBUCK_PFM_PU           5
+#define RES4334_CLDO_PU                        6
+#define RES4334_LPLDO2_LVM             7
+#define RES4334_LNLDO_PU               8
+#define RES4334_LDO3P3_PU              9
+#define RES4334_OTP_PU                 10
+#define RES4334_XTAL_PU                        11
+#define RES4334_WL_PWRSW_PU            12
+#define RES4334_LQ_AVAIL               13
+#define RES4334_LOGIC_RET              14
+#define RES4334_MEM_SLEEP              15
+#define RES4334_MACPHY_RET             16
+#define RES4334_WL_CORE_READY          17
+#define RES4334_ILP_REQ                        18
+#define RES4334_ALP_AVAIL              19
+#define RES4334_MISC_PWRSW_PU          20
+#define RES4334_SYNTH_PWRSW_PU         21
+#define RES4334_RX_PWRSW_PU            22
+#define RES4334_RADIO_PU               23
+#define RES4334_WL_PMU_PU              24
+#define RES4334_VCO_LDO_PU             25
+#define RES4334_AFE_LDO_PU             26
+#define RES4334_RX_LDO_PU              27
+#define RES4334_TX_LDO_PU              28
+#define RES4334_HT_AVAIL               29
+#define RES4334_MACPHY_CLK_AVAIL       30
+
+/* 4334 chip-specific ChipStatus register bits */
+#define CST4334_CHIPMODE_MASK          7
+#define CST4334_SDIO_MODE              0x00000000
+#define CST4334_SPI_MODE               0x00000004
+#define CST4334_HSIC_MODE              0x00000006
+#define CST4334_BLUSB_MODE             0x00000007
+#define CST4334_CHIPMODE_HSIC(cs)      (((cs) & CST4334_CHIPMODE_MASK) == CST4334_HSIC_MODE)
+#define CST4334_OTP_PRESENT            0x00000010
+#define CST4334_LPO_AUTODET_EN         0x00000020
+#define CST4334_ARMREMAP_0             0x00000040
+#define CST4334_SPROM_PRESENT          0x00000080
+#define CST4334_ILPDIV_EN_MASK         0x00000100
+#define CST4334_ILPDIV_EN_SHIFT                8
+#define CST4334_LPO_SEL_MASK           0x00000200
+#define CST4334_LPO_SEL_SHIFT          9
+#define CST4334_RES_INIT_MODE_MASK     0x00000C00
+#define CST4334_RES_INIT_MODE_SHIFT    10
+
+/* 4334 Chip specific PMU ChipControl register bits */
+#define PCTL_4334_GPIO3_ENAB    (1  << 3)
+
+/* 4334 Chip control */
+#define CCTRL4334_PMU_WAKEUP_GPIO1     (1  << 0)
+#define CCTRL4334_PMU_WAKEUP_HSIC      (1  << 1)
+#define CCTRL4334_PMU_WAKEUP_AOS       (1  << 2)
+#define CCTRL4334_HSIC_WAKE_MODE       (1  << 3)
+#define CCTRL4334_HSIC_INBAND_GPIO1    (1  << 4)
+#define CCTRL4334_HSIC_LDO_PU          (1  << 23)
+
+/* 4334 Chip control 3 */
+#define CCTRL4334_BLOCK_EXTRNL_WAKE            (1  << 4)
+#define CCTRL4334_SAVERESTORE_FIX              (1  << 5)
+
+/* 43341 Chip control 3 */
+#define CCTRL43341_BLOCK_EXTRNL_WAKE           (1  << 13)
+#define CCTRL43341_SAVERESTORE_FIX             (1  << 14)
+#define CCTRL43341_BT_ISO_SEL                  (1  << 16)
+
+/* 4334 Chip specific ChipControl1 register bits */
+#define CCTRL1_4334_GPIO_SEL           (1 << 0)    /* 1=select GPIOs to be muxed out */
+#define CCTRL1_4334_ERCX_SEL           (1 << 1)    /* 1=select ERCX BT coex to be muxed out */
+#define CCTRL1_4334_SDIO_HOST_WAKE (1 << 2)  /* SDIO: 1=configure GPIO0 for host wake */
+#define CCTRL1_4334_JTAG_DISABLE       (1 << 3)    /* 1=disable JTAG interface on mux'd pins */
+#define CCTRL1_4334_UART_ON_4_5        (1 << 28) /**< 1=UART_TX/UART_RX muxed on GPIO_4/5 (4334B0/1) */
+
+/* 4324 Chip specific ChipControl1 register bits */
+#define CCTRL1_4324_GPIO_SEL            (1 << 0)    /* 1=select GPIOs to be muxed out */
+#define CCTRL1_4324_SDIO_HOST_WAKE (1 << 2)  /* SDIO: 1=configure GPIO0 for host wake */
+
+/* 43143 chip-specific ChipStatus register bits based on Confluence documentation */
+/* register contains strap values sampled during POR */
+#define CST43143_REMAP_TO_ROM   (3 << 0)    /* 00=Boot SRAM, 01=Boot ROM, 10=Boot SFLASH */
+#define CST43143_SDIO_EN        (1 << 2)    /* 0 = USB Enab, SDIO pins are GPIO or I2S */
+#define CST43143_SDIO_ISO       (1 << 3)    /* 1 = SDIO isolated */
+#define CST43143_USB_CPU_LESS   (1 << 4)   /* 1 = CPULess mode Enabled */
+#define CST43143_CBUCK_MODE     (3 << 6)   /* Indicates what controller mode CBUCK is in */
+#define CST43143_POK_CBUCK      (1 << 8)   /* 1 = 1.2V CBUCK voltage ready */
+#define CST43143_PMU_OVRSPIKE   (1 << 9)
+#define CST43143_PMU_OVRTEMP    (0xF << 10)
+#define CST43143_SR_FLL_CAL_DONE (1 << 14)
+#define CST43143_USB_PLL_LOCKDET (1 << 15)
+#define CST43143_PMU_PLL_LOCKDET (1 << 16)
+#define CST43143_CHIPMODE_SDIOD(cs)    (((cs) & CST43143_SDIO_EN) != 0) /* SDIO */
+
+/* 43143 Chip specific ChipControl register bits */
+/* 00: SECI is disabled (JATG functional), 01: 2 wire, 10: 4 wire  */
+#define CCTRL_43143_SECI               (1<<0)
+#define CCTRL_43143_BT_LEGACY          (1<<1)
+#define CCTRL_43143_I2S_MODE           (1<<2)  /**< 0: SDIO enabled */
+#define CCTRL_43143_I2S_MASTER         (1<<3)  /**< 0: I2S MCLK input disabled */
+#define CCTRL_43143_I2S_FULL           (1<<4)  /**< 0: I2S SDIN and SPDIF_TX inputs disabled */
+#define CCTRL_43143_GSIO               (1<<5)  /**< 0: sFlash enabled */
+#define CCTRL_43143_RF_SWCTRL_MASK     (7<<6)  /**< 0: disabled */
+#define CCTRL_43143_RF_SWCTRL_0                (1<<6)
+#define CCTRL_43143_RF_SWCTRL_1                (2<<6)
+#define CCTRL_43143_RF_SWCTRL_2                (4<<6)
+#define CCTRL_43143_RF_XSWCTRL         (1<<9)  /**< 0: UART enabled */
+#define CCTRL_43143_HOST_WAKE0         (1<<11) /**< 1: SDIO separate interrupt output from GPIO4 */
+#define CCTRL_43143_HOST_WAKE1         (1<<12) /* 1: SDIO separate interrupt output from GPIO16 */
+
+/* 43143 resources, based on pmu_params.xls V1.19 */
+#define RES43143_EXT_SWITCHER_PWM      0       /**< 0x00001 */
+#define RES43143_XTAL_PU               1       /**< 0x00002 */
+#define RES43143_ILP_REQUEST           2       /**< 0x00004 */
+#define RES43143_ALP_AVAIL             3       /**< 0x00008 */
+#define RES43143_WL_CORE_READY         4       /**< 0x00010 */
+#define RES43143_BBPLL_PWRSW_PU                5       /**< 0x00020 */
+#define RES43143_HT_AVAIL              6       /**< 0x00040 */
+#define RES43143_RADIO_PU              7       /**< 0x00080 */
+#define RES43143_MACPHY_CLK_AVAIL      8       /**< 0x00100 */
+#define RES43143_OTP_PU                        9       /**< 0x00200 */
+#define RES43143_LQ_AVAIL              10      /**< 0x00400 */
+
+#define PMU43143_XTAL_CORE_SIZE_MASK   0x3F
+
+/* 4313 resources */
+#define        RES4313_BB_PU_RSRC              0
+#define        RES4313_ILP_REQ_RSRC            1
+#define        RES4313_XTAL_PU_RSRC            2
+#define        RES4313_ALP_AVAIL_RSRC          3
+#define        RES4313_RADIO_PU_RSRC           4
+#define        RES4313_BG_PU_RSRC              5
+#define        RES4313_VREG1P4_PU_RSRC         6
+#define        RES4313_AFE_PWRSW_RSRC          7
+#define        RES4313_RX_PWRSW_RSRC           8
+#define        RES4313_TX_PWRSW_RSRC           9
+#define        RES4313_BB_PWRSW_RSRC           10
+#define        RES4313_SYNTH_PWRSW_RSRC        11
+#define        RES4313_MISC_PWRSW_RSRC         12
+#define        RES4313_BB_PLL_PWRSW_RSRC       13
+#define        RES4313_HT_AVAIL_RSRC           14
+#define        RES4313_MACPHY_CLK_AVAIL_RSRC   15
+
+/* 4313 chip-specific ChipStatus register bits */
+#define        CST4313_SPROM_PRESENT                   1
+#define        CST4313_OTP_PRESENT                     2
+#define        CST4313_SPROM_OTP_SEL_MASK              0x00000002
+#define        CST4313_SPROM_OTP_SEL_SHIFT             0
+
+/* 4313 Chip specific ChipControl register bits */
+#define CCTRL_4313_12MA_LED_DRIVE    0x00000007    /* 12 mA drive strengh for later 4313 */
+
+/* PMU respources for 4314 */
+#define RES4314_LPLDO_PU               0
+#define RES4314_PMU_SLEEP_DIS          1
+#define RES4314_PMU_BG_PU              2
+#define RES4314_CBUCK_LPOM_PU          3
+#define RES4314_CBUCK_PFM_PU           4
+#define RES4314_CLDO_PU                        5
+#define RES4314_LPLDO2_LVM             6
+#define RES4314_WL_PMU_PU              7
+#define RES4314_LNLDO_PU               8
+#define RES4314_LDO3P3_PU              9
+#define RES4314_OTP_PU                 10
+#define RES4314_XTAL_PU                        11
+#define RES4314_WL_PWRSW_PU            12
+#define RES4314_LQ_AVAIL               13
+#define RES4314_LOGIC_RET              14
+#define RES4314_MEM_SLEEP              15
+#define RES4314_MACPHY_RET             16
+#define RES4314_WL_CORE_READY          17
+#define RES4314_ILP_REQ                        18
+#define RES4314_ALP_AVAIL              19
+#define RES4314_MISC_PWRSW_PU          20
+#define RES4314_SYNTH_PWRSW_PU         21
+#define RES4314_RX_PWRSW_PU            22
+#define RES4314_RADIO_PU               23
+#define RES4314_VCO_LDO_PU             24
+#define RES4314_AFE_LDO_PU             25
+#define RES4314_RX_LDO_PU              26
+#define RES4314_TX_LDO_PU              27
+#define RES4314_HT_AVAIL               28
+#define RES4314_MACPHY_CLK_AVAIL       29
+
+/* 4314 chip-specific ChipStatus register bits */
+#define CST4314_OTP_ENABLED            0x00200000
+
+/* 43228 resources */
+#define RES43228_NOT_USED              0
+#define RES43228_ILP_REQUEST           1
+#define RES43228_XTAL_PU               2
+#define RES43228_ALP_AVAIL             3
+#define RES43228_PLL_EN                        4
+#define RES43228_HT_PHY_AVAIL          5
+
+/* 43228 chipstatus  reg bits */
+#define CST43228_ILP_DIV_EN            0x1
+#define        CST43228_OTP_PRESENT            0x2
+#define        CST43228_SERDES_REFCLK_PADSEL   0x4
+#define        CST43228_SDIO_MODE              0x8
+#define        CST43228_SDIO_OTP_PRESENT       0x10
+#define        CST43228_SDIO_RESET             0x20
+
+/* 4706 chipstatus reg bits */
+#define        CST4706_PKG_OPTION              (1<<0) /* 0: full-featured package 1: low-cost package */
+#define        CST4706_SFLASH_PRESENT  (1<<1) /* 0: parallel, 1: serial flash is present */
+#define        CST4706_SFLASH_TYPE             (1<<2) /* 0: 8b-p/ST-s flash, 1: 16b-p/Atmal-s flash */
+#define        CST4706_MIPS_BENDIAN    (1<<3) /* 0: little,  1: big endian */
+#define        CST4706_PCIE1_DISABLE   (1<<5) /* PCIE1 enable strap pin */
+
+/* 4706 flashstrconfig reg bits */
+#define FLSTRCF4706_MASK               0x000000ff
+#define FLSTRCF4706_SF1                        0x00000001      /**< 2nd serial flash present */
+#define FLSTRCF4706_PF1                        0x00000002      /**< 2nd parallel flash present */
+#define FLSTRCF4706_SF1_TYPE   0x00000004      /**< 2nd serial flash type : 0 : ST, 1 : Atmel */
+#define FLSTRCF4706_NF1                        0x00000008      /**< 2nd NAND flash present */
+#define FLSTRCF4706_1ST_MADDR_SEG_MASK         0x000000f0      /**< Valid value mask */
+#define FLSTRCF4706_1ST_MADDR_SEG_4MB          0x00000010      /**< 4MB */
+#define FLSTRCF4706_1ST_MADDR_SEG_8MB          0x00000020      /**< 8MB */
+#define FLSTRCF4706_1ST_MADDR_SEG_16MB         0x00000030      /**< 16MB */
+#define FLSTRCF4706_1ST_MADDR_SEG_32MB         0x00000040      /**< 32MB */
+#define FLSTRCF4706_1ST_MADDR_SEG_64MB         0x00000050      /**< 64MB */
+#define FLSTRCF4706_1ST_MADDR_SEG_128MB                0x00000060      /**< 128MB */
+#define FLSTRCF4706_1ST_MADDR_SEG_256MB                0x00000070      /**< 256MB */
+
+/* 4360 Chip specific ChipControl register bits */
+#define CCTRL4360_I2C_MODE                     (1 << 0)
+#define CCTRL4360_UART_MODE                    (1 << 1)
+#define CCTRL4360_SECI_MODE                    (1 << 2)
+#define CCTRL4360_BTSWCTRL_MODE                        (1 << 3)
+#define CCTRL4360_DISCRETE_FEMCTRL_MODE                (1 << 4)
+#define CCTRL4360_DIGITAL_PACTRL_MODE          (1 << 5)
+#define CCTRL4360_BTSWCTRL_AND_DIGPA_PRESENT   (1 << 6)
+#define CCTRL4360_EXTRA_GPIO_MODE              (1 << 7)
+#define CCTRL4360_EXTRA_FEMCTRL_MODE           (1 << 8)
+#define CCTRL4360_BT_LGCY_MODE                 (1 << 9)
+#define CCTRL4360_CORE2FEMCTRL4_ON             (1 << 21)
+#define CCTRL4360_SECI_ON_GPIO01               (1 << 24)
+
+/* 4360 Chip specific Regulator Control register bits */
+#define RCTRL4360_RFLDO_PWR_DOWN               (1 << 1)
+
+/* 4360 PMU resources and chip status bits */
+#define RES4360_REGULATOR          0
+#define RES4360_ILP_AVAIL          1
+#define RES4360_ILP_REQ            2
+#define RES4360_XTAL_LDO_PU        3
+#define RES4360_XTAL_PU            4
+#define RES4360_ALP_AVAIL          5
+#define RES4360_BBPLLPWRSW_PU      6
+#define RES4360_HT_AVAIL           7
+#define RES4360_OTP_PU             8
+#define RES4360_AVB_PLL_PWRSW_PU   9
+#define RES4360_PCIE_TL_CLK_AVAIL  10
+
+#define CST4360_XTAL_40MZ                  0x00000001
+#define CST4360_SFLASH                     0x00000002
+#define CST4360_SPROM_PRESENT              0x00000004
+#define CST4360_SFLASH_TYPE                0x00000004
+#define CST4360_OTP_ENABLED                0x00000008
+#define CST4360_REMAP_ROM                  0x00000010
+#define CST4360_RSRC_INIT_MODE_MASK        0x00000060
+#define CST4360_RSRC_INIT_MODE_SHIFT       5
+#define CST4360_ILP_DIVEN                  0x00000080
+#define CST4360_MODE_USB                   0x00000100
+#define CST4360_SPROM_SIZE_MASK            0x00000600
+#define CST4360_SPROM_SIZE_SHIFT           9
+#define CST4360_BBPLL_LOCK                 0x00000800
+#define CST4360_AVBBPLL_LOCK               0x00001000
+#define CST4360_USBBBPLL_LOCK              0x00002000
+#define CST4360_RSRC_INIT_MODE(cs)     ((cs & CST4360_RSRC_INIT_MODE_MASK) >> \
+                                       CST4360_RSRC_INIT_MODE_SHIFT)
+
+#define CCTRL_4360_UART_SEL    0x2
+#define CST4360_RSRC_INIT_MODE(cs)     ((cs & CST4360_RSRC_INIT_MODE_MASK) >> \
+                                       CST4360_RSRC_INIT_MODE_SHIFT)
+
+
+/* 43602 PMU resources based on pmu_params.xls version v0.95 */
+#define RES43602_LPLDO_PU              0
+#define RES43602_REGULATOR             1
+#define RES43602_PMU_SLEEP             2
+#define RES43602_RSVD_3                        3
+#define RES43602_XTALLDO_PU            4
+#define RES43602_SERDES_PU             5
+#define RES43602_BBPLL_PWRSW_PU                6
+#define RES43602_SR_CLK_START          7
+#define RES43602_SR_PHY_PWRSW          8
+#define RES43602_SR_SUBCORE_PWRSW      9
+#define RES43602_XTAL_PU               10
+#define        RES43602_PERST_OVR              11
+#define RES43602_SR_CLK_STABLE         12
+#define RES43602_SR_SAVE_RESTORE       13
+#define RES43602_SR_SLEEP              14
+#define RES43602_LQ_START              15
+#define RES43602_LQ_AVAIL              16
+#define RES43602_WL_CORE_RDY           17
+#define RES43602_ILP_REQ               18
+#define RES43602_ALP_AVAIL             19
+#define RES43602_RADIO_PU              20
+#define RES43602_RFLDO_PU              21
+#define RES43602_HT_START              22
+#define RES43602_HT_AVAIL              23
+#define RES43602_MACPHY_CLKAVAIL       24
+#define RES43602_PARLDO_PU             25
+#define RES43602_RSVD_26               26
+
+/* 43602 chip status bits */
+#define CST43602_SPROM_PRESENT             (1<<1)
+#define CST43602_SPROM_SIZE                (1<<10) /* 0 = 16K, 1 = 4K */
+#define CST43602_BBPLL_LOCK                (1<<11)
+#define CST43602_RF_LDO_OUT_OK             (1<<15) /* RF LDO output OK */
+
+#define PMU43602_CC1_GPIO12_OVRD           (1<<28) /* GPIO12 override */
+
+#define PMU43602_CC2_PCIE_CLKREQ_L_WAKE_EN (1<<1)  /* creates gated_pcie_wake, pmu_wakeup logic */
+#define PMU43602_CC2_PCIE_PERST_L_WAKE_EN  (1<<2)  /* creates gated_pcie_wake, pmu_wakeup logic */
+#define PMU43602_CC2_ENABLE_L2REFCLKPAD_PWRDWN (1<<3)
+#define PMU43602_CC2_PMU_WAKE_ALP_AVAIL_EN (1<<5)  /* enable pmu_wakeup to request for ALP_AVAIL */
+#define PMU43602_CC2_PERST_L_EXTEND_EN     (1<<9)  /* extend perst_l until rsc PERST_OVR comes up */
+#define PMU43602_CC2_FORCE_EXT_LPO         (1<<19) /* 1=ext LPO clock is the final LPO clock */
+#define PMU43602_CC2_XTAL32_SEL            (1<<30) /* 0=ext_clock, 1=xtal */
+
+#define CC_SR1_43602_SR_ASM_ADDR       (0x0)
+
+/* PLL CTL register values for open loop, used during S/R operation */
+#define PMU43602_PLL_CTL6_VAL          0x68000528
+#define PMU43602_PLL_CTL7_VAL          0x6
+
+#define PMU43602_CC3_ARMCR4_DBG_CLK    (1 << 29)
+
+/* 4365 PMU resources */
+#define RES4365_REGULATOR_PU                   0
+#define RES4365_XTALLDO_PU                     1
+#define RES4365_XTAL_PU                                2
+#define RES4365_CPU_PLLLDO_PU                  3
+#define RES4365_CPU_PLL_PU                     4
+#define RES4365_WL_CORE_RDY                    5
+#define RES4365_ILP_REQ                                6
+#define RES4365_ALP_AVAIL                      7
+#define RES4365_HT_AVAIL                       8
+#define RES4365_BB_PLLLDO_PU                   9
+#define RES4365_BB_PLL_PU                      10
+#define RES4365_MINIMU_PU                      11
+#define RES4365_RADIO_PU                       12
+#define RES4365_MACPHY_CLK_AVAIL               13
+
+/* 4349 related */
+#define RES4349_LPLDO_PU                       0
+#define RES4349_BG_PU                          1
+#define RES4349_PMU_SLEEP                      2
+#define RES4349_PALDO3P3_PU                    3
+#define RES4349_CBUCK_LPOM_PU          4
+#define RES4349_CBUCK_PFM_PU           5
+#define RES4349_COLD_START_WAIT                6
+#define RES4349_RSVD_7                         7
+#define RES4349_LNLDO_PU                       8
+#define RES4349_XTALLDO_PU                     9
+#define RES4349_LDO3P3_PU                      10
+#define RES4349_OTP_PU                         11
+#define RES4349_XTAL_PU                                12
+#define RES4349_SR_CLK_START           13
+#define RES4349_LQ_AVAIL                       14
+#define RES4349_LQ_START                       15
+#define RES4349_PERST_OVR                      16
+#define RES4349_WL_CORE_RDY                    17
+#define RES4349_ILP_REQ                                18
+#define RES4349_ALP_AVAIL                      19
+#define RES4349_MINI_PMU                       20
+#define RES4349_RADIO_PU                       21
+#define RES4349_SR_CLK_STABLE          22
+#define RES4349_SR_SAVE_RESTORE                23
+#define RES4349_SR_PHY_PWRSW           24
+#define RES4349_SR_VDDM_PWRSW          25
+#define RES4349_SR_SUBCORE_PWRSW       26
+#define RES4349_SR_SLEEP                       27
+#define RES4349_HT_START                       28
+#define RES4349_HT_AVAIL                       29
+#define RES4349_MACPHY_CLKAVAIL                30
+
+#define CR4_4349_RAM_BASE                      (0x180000)
+#define CR4_4349_RAM_BASE_FROM_REV_9           (0x160000)
+
+/* SR binary offset is at 8K */
+#define CC_SR1_4349_SR_ASM_ADDR                (0x10)
+
+#define CST4349_CHIPMODE_SDIOD(cs)     (((cs) & (1 << 6)) != 0)        /* SDIO */
+#define CST4349_CHIPMODE_PCIE(cs)      (((cs) & (1 << 7)) != 0)        /* PCIE */
+
+#define CST4349_SPROM_PRESENT          0x00000010
+
+#define CC2_4349_VDDM_PWRSW_EN_MASK            (1 << 20)
+#define CC2_4349_VDDM_PWRSW_EN_SHIFT           (20)
+#define CC2_4349_SDIO_AOS_WAKEUP_MASK          (1 << 24)
+#define CC2_4349_SDIO_AOS_WAKEUP_SHIFT         (24)
+
+
+#define CC6_4349_PCIE_CLKREQ_WAKEUP_MASK       (1 << 4)
+#define CC6_4349_PCIE_CLKREQ_WAKEUP_SHIFT      (4)
+#define CC6_4349_PMU_WAKEUP_ALPAVAIL_MASK      (1 << 6)
+#define CC6_4349_PMU_WAKEUP_ALPAVAIL_SHIFT     (6)
+#define CC6_4349_PMU_EN_EXT_PERST_MASK         (1 << 13)
+#define CC6_4349_PMU_ENABLE_L2REFCLKPAD_PWRDWN (1 << 15)
+#define CC6_4349_PMU_EN_MDIO_MASK              (1 << 16)
+#define CC6_4349_PMU_EN_ASSERT_L2_MASK         (1 << 25)
+
+
+
+/* 43430 PMU resources based on pmu_params.xls */
+#define RES43430_LPLDO_PU                              0
+#define RES43430_BG_PU                                 1
+#define RES43430_PMU_SLEEP                             2
+#define RES43430_RSVD_3                                        3
+#define RES43430_CBUCK_LPOM_PU                 4
+#define RES43430_CBUCK_PFM_PU                  5
+#define RES43430_COLD_START_WAIT               6
+#define RES43430_RSVD_7                                        7
+#define RES43430_LNLDO_PU                              8
+#define RES43430_RSVD_9                                        9
+#define RES43430_LDO3P3_PU                             10
+#define RES43430_OTP_PU                                        11
+#define RES43430_XTAL_PU                               12
+#define RES43430_SR_CLK_START                  13
+#define RES43430_LQ_AVAIL                              14
+#define RES43430_LQ_START                              15
+#define RES43430_RSVD_16                               16
+#define RES43430_WL_CORE_RDY                   17
+#define RES43430_ILP_REQ                               18
+#define RES43430_ALP_AVAIL                             19
+#define RES43430_MINI_PMU                              20
+#define RES43430_RADIO_PU                              21
+#define RES43430_SR_CLK_STABLE                 22
+#define RES43430_SR_SAVE_RESTORE               23
+#define RES43430_SR_PHY_PWRSW                  24
+#define RES43430_SR_VDDM_PWRSW                 25
+#define RES43430_SR_SUBCORE_PWRSW              26
+#define RES43430_SR_SLEEP                              27
+#define RES43430_HT_START                              28
+#define RES43430_HT_AVAIL                              29
+#define RES43430_MACPHY_CLK_AVAIL              30
+
+/* 43430 chip status bits */
+#define CST43430_SDIO_MODE                             0x00000001
+#define CST43430_GSPI_MODE                             0x00000002
+#define CST43430_RSRC_INIT_MODE_0              0x00000080
+#define CST43430_RSRC_INIT_MODE_1              0x00000100
+#define CST43430_SEL0_SDIO                             0x00000200
+#define CST43430_SEL1_SDIO                             0x00000400
+#define CST43430_SEL2_SDIO                             0x00000800
+#define CST43430_BBPLL_LOCKED                  0x00001000
+#define CST43430_DBG_INST_DETECT               0x00004000
+#define CST43430_CLB2WL_BT_READY               0x00020000
+#define CST43430_JTAG_MODE                             0x00100000
+#define CST43430_HOST_IFACE                            0x00400000
+#define CST43430_TRIM_EN                               0x00800000
+#define CST43430_DIN_PACKAGE_OPTION            0x10000000
+
+#define PMU_MACCORE_0_RES_REQ_TIMER            0x19000000
+#define PMU_MACCORE_0_RES_REQ_MASK             0x5FF2364F
+
+#define PMU_MACCORE_1_RES_REQ_TIMER            0x19000000
+#define PMU_MACCORE_1_RES_REQ_MASK             0x5FF2364F
+
+/* defines to detect active host interface in use */
+#define CHIP_HOSTIF_PCIEMODE   0x1
+#define CHIP_HOSTIF_USBMODE    0x2
+#define CHIP_HOSTIF_SDIOMODE   0x4
+#define CHIP_HOSTIF_PCIE(sih)  (si_chip_hostif(sih) == CHIP_HOSTIF_PCIEMODE)
+#define CHIP_HOSTIF_USB(sih)   (si_chip_hostif(sih) == CHIP_HOSTIF_USBMODE)
+#define CHIP_HOSTIF_SDIO(sih)  (si_chip_hostif(sih) == CHIP_HOSTIF_SDIOMODE)
+
+/* 4335 resources */
+#define RES4335_LPLDO_PO           0
+#define RES4335_PMU_BG_PU          1
+#define RES4335_PMU_SLEEP          2
+#define RES4335_RSVD_3             3
+#define RES4335_CBUCK_LPOM_PU          4
+#define RES4335_CBUCK_PFM_PU           5
+#define RES4335_RSVD_6             6
+#define RES4335_RSVD_7             7
+#define RES4335_LNLDO_PU           8
+#define RES4335_XTALLDO_PU         9
+#define RES4335_LDO3P3_PU                      10
+#define RES4335_OTP_PU                         11
+#define RES4335_XTAL_PU                                12
+#define RES4335_SR_CLK_START       13
+#define RES4335_LQ_AVAIL                       14
+#define RES4335_LQ_START           15
+#define RES4335_RSVD_16            16
+#define RES4335_WL_CORE_RDY        17
+#define RES4335_ILP_REQ                                18
+#define RES4335_ALP_AVAIL                      19
+#define RES4335_MINI_PMU           20
+#define RES4335_RADIO_PU                       21
+#define RES4335_SR_CLK_STABLE          22
+#define RES4335_SR_SAVE_RESTORE                23
+#define RES4335_SR_PHY_PWRSW           24
+#define RES4335_SR_VDDM_PWRSW      25
+#define RES4335_SR_SUBCORE_PWRSW       26
+#define RES4335_SR_SLEEP           27
+#define RES4335_HT_START           28
+#define RES4335_HT_AVAIL                       29
+#define RES4335_MACPHY_CLKAVAIL                30
+
+/* 4335 Chip specific ChipStatus register bits */
+#define CST4335_SPROM_MASK                     0x00000020
+#define CST4335_SFLASH_MASK                    0x00000040
+#define        CST4335_RES_INIT_MODE_SHIFT     7
+#define        CST4335_RES_INIT_MODE_MASK      0x00000180
+#define CST4335_CHIPMODE_MASK          0xF
+#define CST4335_CHIPMODE_SDIOD(cs)     (((cs) & (1 << 0)) != 0)        /* SDIO */
+#define CST4335_CHIPMODE_GSPI(cs)      (((cs) & (1 << 1)) != 0)        /* gSPI */
+#define CST4335_CHIPMODE_USB20D(cs)    (((cs) & (1 << 2)) != 0)        /**< HSIC || USBDA */
+#define CST4335_CHIPMODE_PCIE(cs)      (((cs) & (1 << 3)) != 0)        /* PCIE */
+
+/* 4335 Chip specific ChipControl1 register bits */
+#define CCTRL1_4335_GPIO_SEL           (1 << 0)    /* 1=select GPIOs to be muxed out */
+#define CCTRL1_4335_SDIO_HOST_WAKE (1 << 2)  /* SDIO: 1=configure GPIO0 for host wake */
+
+/* 4335 Chip specific ChipControl2 register bits */
+#define CCTRL2_4335_AOSBLOCK           (1 << 30)
+#define CCTRL2_4335_PMUWAKE            (1 << 31)
+#define PATCHTBL_SIZE                  (0x800)
+#define CR4_4335_RAM_BASE                    (0x180000)
+#define CR4_4345_LT_C0_RAM_BASE              (0x1b0000)
+#define CR4_4345_GE_C0_RAM_BASE              (0x198000)
+#define CR4_4349_RAM_BASE                    (0x180000)
+#define CR4_4350_RAM_BASE                    (0x180000)
+#define CR4_4360_RAM_BASE                    (0x0)
+#define CR4_43602_RAM_BASE                   (0x180000)
+#define CA7_4365_RAM_BASE                    (0x200000)
+
+
+/* 4335 chip OTP present & OTP select bits. */
+#define SPROM4335_OTP_SELECT   0x00000010
+#define SPROM4335_OTP_PRESENT  0x00000020
+
+/* 4335 GCI specific bits. */
+#define CC4335_GCI_STRAP_OVERRIDE_SFLASH_PRESENT       (1 << 24)
+#define CC4335_GCI_STRAP_OVERRIDE_SFLASH_TYPE  25
+#define CC4335_GCI_FUNC_SEL_PAD_SDIO   0x00707770
+
+/* SFLASH clkdev specific bits. */
+#define CC4335_SFLASH_CLKDIV_MASK      0x1F000000
+#define CC4335_SFLASH_CLKDIV_SHIFT     25
+
+/* 4335 OTP bits for SFLASH. */
+#define CC4335_SROM_OTP_SFLASH 40
+#define CC4335_SROM_OTP_SFLASH_PRESENT 0x1
+#define CC4335_SROM_OTP_SFLASH_TYPE    0x2
+#define CC4335_SROM_OTP_SFLASH_CLKDIV_MASK     0x003C
+#define CC4335_SROM_OTP_SFLASH_CLKDIV_SHIFT    2
+
+
+/* 4335 chip OTP present & OTP select bits. */
+#define SPROM4335_OTP_SELECT   0x00000010
+#define SPROM4335_OTP_PRESENT  0x00000020
+
+/* 4335 GCI specific bits. */
+#define CC4335_GCI_STRAP_OVERRIDE_SFLASH_PRESENT       (1 << 24)
+#define CC4335_GCI_STRAP_OVERRIDE_SFLASH_TYPE  25
+#define CC4335_GCI_FUNC_SEL_PAD_SDIO   0x00707770
+
+/* SFLASH clkdev specific bits. */
+#define CC4335_SFLASH_CLKDIV_MASK      0x1F000000
+#define CC4335_SFLASH_CLKDIV_SHIFT     25
+
+/* 4335 OTP bits for SFLASH. */
+#define CC4335_SROM_OTP_SFLASH 40
+#define CC4335_SROM_OTP_SFLASH_PRESENT 0x1
+#define CC4335_SROM_OTP_SFLASH_TYPE    0x2
+#define CC4335_SROM_OTP_SFLASH_CLKDIV_MASK     0x003C
+#define CC4335_SROM_OTP_SFLASH_CLKDIV_SHIFT    2
+
+/* 4335 resources--END */
+
+/* 4345 Chip specific ChipStatus register bits */
+#define CST4345_SPROM_MASK             0x00000020
+#define CST4345_SFLASH_MASK            0x00000040
+#define CST4345_RES_INIT_MODE_SHIFT    7
+#define CST4345_RES_INIT_MODE_MASK     0x00000180
+#define CST4345_CHIPMODE_MASK          0x4000F
+#define CST4345_CHIPMODE_SDIOD(cs)     (((cs) & (1 << 0)) != 0)        /* SDIO */
+#define CST4345_CHIPMODE_GSPI(cs)      (((cs) & (1 << 1)) != 0)        /* gSPI */
+#define CST4345_CHIPMODE_HSIC(cs)      (((cs) & (1 << 2)) != 0)        /* HSIC */
+#define CST4345_CHIPMODE_PCIE(cs)      (((cs) & (1 << 3)) != 0)        /* PCIE */
+#define CST4345_CHIPMODE_USB20D(cs)    (((cs) & (1 << 18)) != 0)       /* USBDA */
+
+/* 4350 Chipcommon ChipStatus bits */
+#define CST4350_SDIO_MODE              0x00000001
+#define CST4350_HSIC20D_MODE           0x00000002
+#define CST4350_BP_ON_HSIC_CLK         0x00000004
+#define CST4350_PCIE_MODE              0x00000008
+#define CST4350_USB20D_MODE            0x00000010
+#define CST4350_USB30D_MODE            0x00000020
+#define CST4350_SPROM_PRESENT          0x00000040
+#define CST4350_RSRC_INIT_MODE_0       0x00000080
+#define CST4350_RSRC_INIT_MODE_1       0x00000100
+#define CST4350_SEL0_SDIO              0x00000200
+#define CST4350_SEL1_SDIO              0x00000400
+#define CST4350_SDIO_PAD_MODE          0x00000800
+#define CST4350_BBPLL_LOCKED           0x00001000
+#define CST4350_USBPLL_LOCKED          0x00002000
+#define CST4350_LINE_STATE             0x0000C000
+#define CST4350_SERDES_PIPE_PLLLOCK    0x00010000
+#define CST4350_BT_READY               0x00020000
+#define CST4350_SFLASH_PRESENT         0x00040000
+#define CST4350_CPULESS_ENABLE         0x00080000
+#define CST4350_STRAP_HOST_IFC_1       0x00100000
+#define CST4350_STRAP_HOST_IFC_2       0x00200000
+#define CST4350_STRAP_HOST_IFC_3       0x00400000
+#define CST4350_RAW_SPROM_PRESENT      0x00800000
+#define CST4350_APP_CLK_SWITCH_SEL_RDBACK      0x01000000
+#define CST4350_RAW_RSRC_INIT_MODE_0   0x02000000
+#define CST4350_SDIO_PAD_VDDIO         0x04000000
+#define CST4350_GSPI_MODE              0x08000000
+#define CST4350_PACKAGE_OPTION         0xF0000000
+#define CST4350_PACKAGE_SHIFT          28
+
+/* package option for 4350 */
+#define CST4350_PACKAGE_WLCSP          0x0
+#define CST4350_PACKAGE_PCIE           0x1
+#define CST4350_PACKAGE_WLBGA          0x2
+#define CST4350_PACKAGE_DBG            0x3
+#define CST4350_PACKAGE_USB            0x4
+#define CST4350_PACKAGE_USB_HSIC       0x4
+
+#define CST4350_PKG_MODE(cs)   ((cs & CST4350_PACKAGE_OPTION) >> CST4350_PACKAGE_SHIFT)
+
+#define CST4350_PKG_WLCSP(cs)          (CST4350_PKG_MODE(cs) == (CST4350_PACKAGE_WLCSP))
+#define CST4350_PKG_PCIE(cs)           (CST4350_PKG_MODE(cs) == (CST4350_PACKAGE_PCIE))
+#define CST4350_PKG_WLBGA(cs)          (CST4350_PKG_MODE(cs) == (CST4350_PACKAGE_WLBGA))
+#define CST4350_PKG_USB(cs)            (CST4350_PKG_MODE(cs) == (CST4350_PACKAGE_USB))
+#define CST4350_PKG_USB_HSIC(cs)       (CST4350_PKG_MODE(cs) == (CST4350_PACKAGE_USB_HSIC))
+
+/* 4350C0 USB PACKAGE using raw_sprom_present to indicate 40mHz xtal */
+#define CST4350_PKG_USB_40M(cs)                (cs & CST4350_RAW_SPROM_PRESENT)
+
+#define CST4350_CHIPMODE_SDIOD(cs)     (CST4350_IFC_MODE(cs) == (CST4350_IFC_MODE_SDIOD))
+#define CST4350_CHIPMODE_USB20D(cs)    ((CST4350_IFC_MODE(cs)) == (CST4350_IFC_MODE_USB20D))
+#define CST4350_CHIPMODE_HSIC20D(cs)   (CST4350_IFC_MODE(cs) == (CST4350_IFC_MODE_HSIC20D))
+#define CST4350_CHIPMODE_HSIC30D(cs)   (CST4350_IFC_MODE(cs) == (CST4350_IFC_MODE_HSIC30D))
+#define CST4350_CHIPMODE_USB30D(cs)    (CST4350_IFC_MODE(cs) == (CST4350_IFC_MODE_USB30D))
+#define CST4350_CHIPMODE_USB30D_WL(cs) (CST4350_IFC_MODE(cs) == (CST4350_IFC_MODE_USB30D_WL))
+#define CST4350_CHIPMODE_PCIE(cs)      (CST4350_IFC_MODE(cs) == (CST4350_IFC_MODE_PCIE))
+
+/* strap_host_ifc strap value */
+#define CST4350_HOST_IFC_MASK          0x00700000
+#define CST4350_HOST_IFC_SHIFT         20
+
+/* host_ifc raw mode */
+#define CST4350_IFC_MODE_SDIOD                 0x0
+#define CST4350_IFC_MODE_HSIC20D               0x1
+#define CST4350_IFC_MODE_HSIC30D               0x2
+#define CST4350_IFC_MODE_PCIE                  0x3
+#define CST4350_IFC_MODE_USB20D                        0x4
+#define CST4350_IFC_MODE_USB30D                        0x5
+#define CST4350_IFC_MODE_USB30D_WL             0x6
+#define CST4350_IFC_MODE_USB30D_BT             0x7
+
+#define CST4350_IFC_MODE(cs)   ((cs & CST4350_HOST_IFC_MASK) >> CST4350_HOST_IFC_SHIFT)
+
+/* 4350 PMU resources */
+#define RES4350_LPLDO_PU       0
+#define RES4350_PMU_BG_PU      1
+#define RES4350_PMU_SLEEP      2
+#define RES4350_RSVD_3         3
+#define RES4350_CBUCK_LPOM_PU  4
+#define RES4350_CBUCK_PFM_PU   5
+#define RES4350_COLD_START_WAIT        6
+#define RES4350_RSVD_7         7
+#define RES4350_LNLDO_PU       8
+#define RES4350_XTALLDO_PU     9
+#define RES4350_LDO3P3_PU      10
+#define RES4350_OTP_PU         11
+#define RES4350_XTAL_PU                12
+#define RES4350_SR_CLK_START   13
+#define RES4350_LQ_AVAIL       14
+#define RES4350_LQ_START       15
+#define RES4350_PERST_OVR      16
+#define RES4350_WL_CORE_RDY    17
+#define RES4350_ILP_REQ                18
+#define RES4350_ALP_AVAIL      19
+#define RES4350_MINI_PMU       20
+#define RES4350_RADIO_PU       21
+#define RES4350_SR_CLK_STABLE  22
+#define RES4350_SR_SAVE_RESTORE        23
+#define RES4350_SR_PHY_PWRSW   24
+#define RES4350_SR_VDDM_PWRSW  25
+#define RES4350_SR_SUBCORE_PWRSW       26
+#define RES4350_SR_SLEEP       27
+#define RES4350_HT_START       28
+#define RES4350_HT_AVAIL       29
+#define RES4350_MACPHY_CLKAVAIL        30
+
+#define MUXENAB4350_UART_MASK          (0x0000000f)
+#define MUXENAB4350_UART_SHIFT         0
+#define MUXENAB4350_HOSTWAKE_MASK      (0x000000f0)    /**< configure GPIO for SDIO host_wake */
+#define MUXENAB4350_HOSTWAKE_SHIFT     4
+
+
+/* 4350 GCI function sel values */
+#define CC4350_FNSEL_HWDEF             (0)
+#define CC4350_FNSEL_SAMEASPIN         (1)
+#define CC4350_FNSEL_UART              (2)
+#define CC4350_FNSEL_SFLASH            (3)
+#define CC4350_FNSEL_SPROM             (4)
+#define CC4350_FNSEL_I2C               (5)
+#define CC4350_FNSEL_MISC0             (6)
+#define CC4350_FNSEL_GCI               (7)
+#define CC4350_FNSEL_MISC1             (8)
+#define CC4350_FNSEL_MISC2             (9)
+#define CC4350_FNSEL_PWDOG             (10)
+#define CC4350_FNSEL_IND               (12)
+#define CC4350_FNSEL_PDN               (13)
+#define CC4350_FNSEL_PUP               (14)
+#define CC4350_FNSEL_TRISTATE          (15)
+#define CC4350C_FNSEL_UART             (3)
+
+
+/* 4350 GPIO */
+#define CC4350_PIN_GPIO_00             (0)
+#define CC4350_PIN_GPIO_01             (1)
+#define CC4350_PIN_GPIO_02             (2)
+#define CC4350_PIN_GPIO_03             (3)
+#define CC4350_PIN_GPIO_04             (4)
+#define CC4350_PIN_GPIO_05             (5)
+#define CC4350_PIN_GPIO_06             (6)
+#define CC4350_PIN_GPIO_07             (7)
+#define CC4350_PIN_GPIO_08             (8)
+#define CC4350_PIN_GPIO_09             (9)
+#define CC4350_PIN_GPIO_10             (10)
+#define CC4350_PIN_GPIO_11             (11)
+#define CC4350_PIN_GPIO_12             (12)
+#define CC4350_PIN_GPIO_13             (13)
+#define CC4350_PIN_GPIO_14             (14)
+#define CC4350_PIN_GPIO_15             (15)
+
+#define CC4350_RSVD_16_SHIFT           16
+
+#define CC2_4350_PHY_PWRSW_UPTIME_MASK         (0xf << 0)
+#define CC2_4350_PHY_PWRSW_UPTIME_SHIFT                (0)
+#define CC2_4350_VDDM_PWRSW_UPDELAY_MASK       (0xf << 4)
+#define CC2_4350_VDDM_PWRSW_UPDELAY_SHIFT      (4)
+#define CC2_4350_VDDM_PWRSW_UPTIME_MASK                (0xf << 8)
+#define CC2_4350_VDDM_PWRSW_UPTIME_SHIFT       (8)
+#define CC2_4350_SBC_PWRSW_DNDELAY_MASK                (0x3 << 12)
+#define CC2_4350_SBC_PWRSW_DNDELAY_SHIFT       (12)
+#define CC2_4350_PHY_PWRSW_DNDELAY_MASK                (0x3 << 14)
+#define CC2_4350_PHY_PWRSW_DNDELAY_SHIFT       (14)
+#define CC2_4350_VDDM_PWRSW_DNDELAY_MASK       (0x3 << 16)
+#define CC2_4350_VDDM_PWRSW_DNDELAY_SHIFT      (16)
+#define CC2_4350_VDDM_PWRSW_EN_MASK            (1 << 20)
+#define CC2_4350_VDDM_PWRSW_EN_SHIFT           (20)
+#define CC2_4350_MEMLPLDO_PWRSW_EN_MASK                (1 << 21)
+#define CC2_4350_MEMLPLDO_PWRSW_EN_SHIFT       (21)
+#define CC2_4350_SDIO_AOS_WAKEUP_MASK          (1 << 24)
+#define CC2_4350_SDIO_AOS_WAKEUP_SHIFT         (24)
+
+/* Applies to 4335/4350/4345 */
+#define CC3_SR_CLK_SR_MEM_MASK                 (1 << 0)
+#define CC3_SR_CLK_SR_MEM_SHIFT                        (0)
+#define CC3_SR_BIT1_TBD_MASK                   (1 << 1)
+#define CC3_SR_BIT1_TBD_SHIFT                  (1)
+#define CC3_SR_ENGINE_ENABLE_MASK              (1 << 2)
+#define CC3_SR_ENGINE_ENABLE_SHIFT             (2)
+#define CC3_SR_BIT3_TBD_MASK                   (1 << 3)
+#define CC3_SR_BIT3_TBD_SHIFT                  (3)
+#define CC3_SR_MINDIV_FAST_CLK_MASK            (0xF << 4)
+#define CC3_SR_MINDIV_FAST_CLK_SHIFT           (4)
+#define CC3_SR_R23_SR2_RISE_EDGE_TRIG_MASK     (1 << 8)
+#define CC3_SR_R23_SR2_RISE_EDGE_TRIG_SHIFT    (8)
+#define CC3_SR_R23_SR2_FALL_EDGE_TRIG_MASK     (1 << 9)
+#define CC3_SR_R23_SR2_FALL_EDGE_TRIG_SHIFT    (9)
+#define CC3_SR_R23_SR_RISE_EDGE_TRIG_MASK      (1 << 10)
+#define CC3_SR_R23_SR_RISE_EDGE_TRIG_SHIFT     (10)
+#define CC3_SR_R23_SR_FALL_EDGE_TRIG_MASK      (1 << 11)
+#define CC3_SR_R23_SR_FALL_EDGE_TRIG_SHIFT     (11)
+#define CC3_SR_NUM_CLK_HIGH_MASK               (0x7 << 12)
+#define CC3_SR_NUM_CLK_HIGH_SHIFT              (12)
+#define CC3_SR_BIT15_TBD_MASK                  (1 << 15)
+#define CC3_SR_BIT15_TBD_SHIFT                 (15)
+#define CC3_SR_PHY_FUNC_PIC_MASK               (1 << 16)
+#define CC3_SR_PHY_FUNC_PIC_SHIFT              (16)
+#define CC3_SR_BIT17_19_TBD_MASK               (0x7 << 17)
+#define CC3_SR_BIT17_19_TBD_SHIFT              (17)
+#define CC3_SR_CHIP_TRIGGER_1_MASK             (1 << 20)
+#define CC3_SR_CHIP_TRIGGER_1_SHIFT            (20)
+#define CC3_SR_CHIP_TRIGGER_2_MASK             (1 << 21)
+#define CC3_SR_CHIP_TRIGGER_2_SHIFT            (21)
+#define CC3_SR_CHIP_TRIGGER_3_MASK             (1 << 22)
+#define CC3_SR_CHIP_TRIGGER_3_SHIFT            (22)
+#define CC3_SR_CHIP_TRIGGER_4_MASK             (1 << 23)
+#define CC3_SR_CHIP_TRIGGER_4_SHIFT            (23)
+#define CC3_SR_ALLOW_SBC_FUNC_PIC_MASK         (1 << 24)
+#define CC3_SR_ALLOW_SBC_FUNC_PIC_SHIFT                (24)
+#define CC3_SR_BIT25_26_TBD_MASK               (0x3 << 25)
+#define CC3_SR_BIT25_26_TBD_SHIFT              (25)
+#define CC3_SR_ALLOW_SBC_STBY_MASK             (1 << 27)
+#define CC3_SR_ALLOW_SBC_STBY_SHIFT            (27)
+#define CC3_SR_GPIO_MUX_MASK                   (0xF << 28)
+#define CC3_SR_GPIO_MUX_SHIFT                  (28)
+
+/* Applies to 4335/4350/4345 */
+#define CC4_SR_INIT_ADDR_MASK          (0x3FF0000)
+#define        CC4_4350_SR_ASM_ADDR    (0x30)
+#define CC4_4350_C0_SR_ASM_ADDR                (0x0)
+#define        CC4_4335_SR_ASM_ADDR    (0x48)
+#define        CC4_4345_SR_ASM_ADDR    (0x48)
+#define CC4_SR_INIT_ADDR_SHIFT         (16)
+
+#define CC4_4350_EN_SR_CLK_ALP_MASK    (1 << 30)
+#define CC4_4350_EN_SR_CLK_ALP_SHIFT   (30)
+#define CC4_4350_EN_SR_CLK_HT_MASK     (1 << 31)
+#define CC4_4350_EN_SR_CLK_HT_SHIFT    (31)
+
+#define VREG4_4350_MEMLPDO_PU_MASK     (1 << 31)
+#define VREG4_4350_MEMLPDO_PU_SHIFT    31
+
+#define VREG6_4350_SR_EXT_CLKDIR_MASK  (1 << 20)
+#define VREG6_4350_SR_EXT_CLKDIR_SHIFT 20
+#define VREG6_4350_SR_EXT_CLKDIV_MASK  (0x3 << 21)
+#define VREG6_4350_SR_EXT_CLKDIV_SHIFT 21
+#define VREG6_4350_SR_EXT_CLKEN_MASK   (1 << 23)
+#define VREG6_4350_SR_EXT_CLKEN_SHIFT  23
+
+#define CC5_4350_PMU_EN_ASSERT_MASK    (1 << 13)
+#define CC5_4350_PMU_EN_ASSERT_SHIFT   (13)
+
+#define CC6_4350_PCIE_CLKREQ_WAKEUP_MASK       (1 << 4)
+#define CC6_4350_PCIE_CLKREQ_WAKEUP_SHIFT      (4)
+#define CC6_4350_PMU_WAKEUP_ALPAVAIL_MASK      (1 << 6)
+#define CC6_4350_PMU_WAKEUP_ALPAVAIL_SHIFT     (6)
+#define CC6_4350_PMU_EN_EXT_PERST_MASK         (1 << 17)
+#define CC6_4350_PMU_EN_EXT_PERST_SHIFT                (17)
+#define CC6_4350_PMU_EN_WAKEUP_MASK            (1 << 18)
+#define CC6_4350_PMU_EN_WAKEUP_SHIFT           (18)
+
+#define CC7_4350_PMU_EN_ASSERT_L2_MASK (1 << 26)
+#define CC7_4350_PMU_EN_ASSERT_L2_SHIFT        (26)
+#define CC7_4350_PMU_EN_MDIO_MASK      (1 << 27)
+#define CC7_4350_PMU_EN_MDIO_SHIFT     (27)
+
+#define CC6_4345_PMU_EN_PERST_DEASSERT_MASK            (1 << 13)
+#define CC6_4345_PMU_EN_PERST_DEASSERT_SHIF            (13)
+#define CC6_4345_PMU_EN_L2_DEASSERT_MASK               (1 << 14)
+#define CC6_4345_PMU_EN_L2_DEASSERT_SHIF               (14)
+#define CC6_4345_PMU_EN_ASSERT_L2_MASK         (1 << 15)
+#define CC6_4345_PMU_EN_ASSERT_L2_SHIFT                (15)
+#define CC6_4345_PMU_EN_MDIO_MASK              (1 << 24)
+#define CC6_4345_PMU_EN_MDIO_SHIFT             (24)
+
+/* GCI chipcontrol register indices */
+#define CC_GCI_CHIPCTRL_00     (0)
+#define CC_GCI_CHIPCTRL_01     (1)
+#define CC_GCI_CHIPCTRL_02     (2)
+#define CC_GCI_CHIPCTRL_03     (3)
+#define CC_GCI_CHIPCTRL_04     (4)
+#define CC_GCI_CHIPCTRL_05     (5)
+#define CC_GCI_CHIPCTRL_06     (6)
+#define CC_GCI_CHIPCTRL_07     (7)
+#define CC_GCI_CHIPCTRL_08     (8)
+#define CC_GCI_CHIPCTRL_11     (11)
+#define CC_GCI_XTAL_BUFSTRG_NFC (0xff << 12)
+
+#define CC_GCI_06_JTAG_SEL_SHIFT       4
+#define CC_GCI_06_JTAG_SEL_MASK                (1 << 4)
+
+#define CC_GCI_NUMCHIPCTRLREGS(cap1)   ((cap1 & 0xF00) >> 8)
+
+/* 4345 PMU resources */
+#define RES4345_LPLDO_PU               0
+#define RES4345_PMU_BG_PU              1
+#define RES4345_PMU_SLEEP              2
+#define RES4345_HSICLDO_PU             3
+#define RES4345_CBUCK_LPOM_PU          4
+#define RES4345_CBUCK_PFM_PU           5
+#define RES4345_COLD_START_WAIT                6
+#define RES4345_RSVD_7                 7
+#define RES4345_LNLDO_PU               8
+#define RES4345_XTALLDO_PU             9
+#define RES4345_LDO3P3_PU              10
+#define RES4345_OTP_PU                 11
+#define RES4345_XTAL_PU                        12
+#define RES4345_SR_CLK_START           13
+#define RES4345_LQ_AVAIL               14
+#define RES4345_LQ_START               15
+#define RES4345_PERST_OVR              16
+#define RES4345_WL_CORE_RDY            17
+#define RES4345_ILP_REQ                        18
+#define RES4345_ALP_AVAIL              19
+#define RES4345_MINI_PMU               20
+#define RES4345_RADIO_PU               21
+#define RES4345_SR_CLK_STABLE          22
+#define RES4345_SR_SAVE_RESTORE                23
+#define RES4345_SR_PHY_PWRSW           24
+#define RES4345_SR_VDDM_PWRSW          25
+#define RES4345_SR_SUBCORE_PWRSW       26
+#define RES4345_SR_SLEEP               27
+#define RES4345_HT_START               28
+#define RES4345_HT_AVAIL               29
+#define RES4345_MACPHY_CLK_AVAIL       30
+
+/* 4335 pins
+* note: only the values set as default/used are added here.
+*/
+#define CC4335_PIN_GPIO_00             (0)
+#define CC4335_PIN_GPIO_01             (1)
+#define CC4335_PIN_GPIO_02             (2)
+#define CC4335_PIN_GPIO_03             (3)
+#define CC4335_PIN_GPIO_04             (4)
+#define CC4335_PIN_GPIO_05             (5)
+#define CC4335_PIN_GPIO_06             (6)
+#define CC4335_PIN_GPIO_07             (7)
+#define CC4335_PIN_GPIO_08             (8)
+#define CC4335_PIN_GPIO_09             (9)
+#define CC4335_PIN_GPIO_10             (10)
+#define CC4335_PIN_GPIO_11             (11)
+#define CC4335_PIN_GPIO_12             (12)
+#define CC4335_PIN_GPIO_13             (13)
+#define CC4335_PIN_GPIO_14             (14)
+#define CC4335_PIN_GPIO_15             (15)
+#define CC4335_PIN_SDIO_CLK            (16)
+#define CC4335_PIN_SDIO_CMD            (17)
+#define CC4335_PIN_SDIO_DATA0  (18)
+#define CC4335_PIN_SDIO_DATA1  (19)
+#define CC4335_PIN_SDIO_DATA2  (20)
+#define CC4335_PIN_SDIO_DATA3  (21)
+#define CC4335_PIN_RF_SW_CTRL_6        (22)
+#define CC4335_PIN_RF_SW_CTRL_7        (23)
+#define CC4335_PIN_RF_SW_CTRL_8        (24)
+#define CC4335_PIN_RF_SW_CTRL_9        (25)
+/* Last GPIO Pad */
+#define CC4335_PIN_GPIO_LAST   (31)
+
+/* 4335 GCI function sel values
+*/
+#define CC4335_FNSEL_HWDEF             (0)
+#define CC4335_FNSEL_SAMEASPIN (1)
+#define CC4335_FNSEL_GPIO0             (2)
+#define CC4335_FNSEL_GPIO1             (3)
+#define CC4335_FNSEL_GCI0              (4)
+#define CC4335_FNSEL_GCI1              (5)
+#define CC4335_FNSEL_UART              (6)
+#define CC4335_FNSEL_SFLASH            (7)
+#define CC4335_FNSEL_SPROM             (8)
+#define CC4335_FNSEL_MISC0             (9)
+#define CC4335_FNSEL_MISC1             (10)
+#define CC4335_FNSEL_MISC2             (11)
+#define CC4335_FNSEL_IND               (12)
+#define CC4335_FNSEL_PDN               (13)
+#define CC4335_FNSEL_PUP               (14)
+#define CC4335_FNSEL_TRI               (15)
+
+/* GCI Core Control Reg */
+#define        GCI_CORECTRL_SR_MASK    (1 << 0)        /**< SECI block Reset */
+#define        GCI_CORECTRL_RSL_MASK   (1 << 1)        /**< ResetSECILogic */
+#define        GCI_CORECTRL_ES_MASK    (1 << 2)        /**< EnableSECI */
+#define        GCI_CORECTRL_FSL_MASK   (1 << 3)        /**< Force SECI Out Low */
+#define        GCI_CORECTRL_SOM_MASK   (7 << 4)        /**< SECI Op Mode */
+#define        GCI_CORECTRL_US_MASK    (1 << 7)        /**< Update SECI */
+#define        GCI_CORECTRL_BOS_MASK   (1 << 8)        /**< Break On Sleep */
+
+/* 4345 pins
+* note: only the values set as default/used are added here.
+*/
+#define CC4345_PIN_GPIO_00             (0)
+#define CC4345_PIN_GPIO_01             (1)
+#define CC4345_PIN_GPIO_02             (2)
+#define CC4345_PIN_GPIO_03             (3)
+#define CC4345_PIN_GPIO_04             (4)
+#define CC4345_PIN_GPIO_05             (5)
+#define CC4345_PIN_GPIO_06             (6)
+#define CC4345_PIN_GPIO_07             (7)
+#define CC4345_PIN_GPIO_08             (8)
+#define CC4345_PIN_GPIO_09             (9)
+#define CC4345_PIN_GPIO_10             (10)
+#define CC4345_PIN_GPIO_11             (11)
+#define CC4345_PIN_GPIO_12             (12)
+#define CC4345_PIN_GPIO_13             (13)
+#define CC4345_PIN_GPIO_14             (14)
+#define CC4345_PIN_GPIO_15             (15)
+#define CC4345_PIN_GPIO_16             (16)
+#define CC4345_PIN_SDIO_CLK            (17)
+#define CC4345_PIN_SDIO_CMD            (18)
+#define CC4345_PIN_SDIO_DATA0  (19)
+#define CC4345_PIN_SDIO_DATA1  (20)
+#define CC4345_PIN_SDIO_DATA2  (21)
+#define CC4345_PIN_SDIO_DATA3  (22)
+#define CC4345_PIN_RF_SW_CTRL_0        (23)
+#define CC4345_PIN_RF_SW_CTRL_1        (24)
+#define CC4345_PIN_RF_SW_CTRL_2        (25)
+#define CC4345_PIN_RF_SW_CTRL_3        (26)
+#define CC4345_PIN_RF_SW_CTRL_4        (27)
+#define CC4345_PIN_RF_SW_CTRL_5        (28)
+#define CC4345_PIN_RF_SW_CTRL_6        (29)
+#define CC4345_PIN_RF_SW_CTRL_7        (30)
+#define CC4345_PIN_RF_SW_CTRL_8        (31)
+#define CC4345_PIN_RF_SW_CTRL_9        (32)
+
+/* 4345 GCI function sel values
+*/
+#define CC4345_FNSEL_HWDEF             (0)
+#define CC4345_FNSEL_SAMEASPIN         (1)
+#define CC4345_FNSEL_GPIO0             (2)
+#define CC4345_FNSEL_GPIO1             (3)
+#define CC4345_FNSEL_GCI0              (4)
+#define CC4345_FNSEL_GCI1              (5)
+#define CC4345_FNSEL_UART              (6)
+#define CC4345_FNSEL_SFLASH            (7)
+#define CC4345_FNSEL_SPROM             (8)
+#define CC4345_FNSEL_MISC0             (9)
+#define CC4345_FNSEL_MISC1             (10)
+#define CC4345_FNSEL_MISC2             (11)
+#define CC4345_FNSEL_IND               (12)
+#define CC4345_FNSEL_PDN               (13)
+#define CC4345_FNSEL_PUP               (14)
+#define CC4345_FNSEL_TRI               (15)
+
+#define MUXENAB4345_UART_MASK          (0x0000000f)
+#define MUXENAB4345_UART_SHIFT         0
+#define MUXENAB4345_HOSTWAKE_MASK      (0x000000f0)
+#define MUXENAB4345_HOSTWAKE_SHIFT     4
+
+/* 4349 Group (4349, 4355, 4359) GCI AVS function sel values */
+#define CC4349_GRP_GCI_AVS_CTRL_MASK   (0xffe00000)
+#define CC4349_GRP_GCI_AVS_CTRL_SHIFT  (21)
+#define CC4349_GRP_GCI_AVS_CTRL_ENAB   (1 << 5)
+
+/* 4345 GCI AVS function sel values */
+#define CC4345_GCI_AVS_CTRL_MASK   (0xfc)
+#define CC4345_GCI_AVS_CTRL_SHIFT  (2)
+#define CC4345_GCI_AVS_CTRL_ENAB   (1 << 5)
+
+/* GCI GPIO for function sel GCI-0/GCI-1 */
+#define CC_GCI_GPIO_0                  (0)
+#define CC_GCI_GPIO_1                  (1)
+#define CC_GCI_GPIO_2                  (2)
+#define CC_GCI_GPIO_3                  (3)
+#define CC_GCI_GPIO_4                  (4)
+#define CC_GCI_GPIO_5                  (5)
+#define CC_GCI_GPIO_6                  (6)
+#define CC_GCI_GPIO_7                  (7)
+#define CC_GCI_GPIO_8                  (8)
+#define CC_GCI_GPIO_9                  (9)
+#define CC_GCI_GPIO_10                 (10)
+#define CC_GCI_GPIO_11                 (11)
+#define CC_GCI_GPIO_12                 (12)
+#define CC_GCI_GPIO_13                 (13)
+#define CC_GCI_GPIO_14                 (14)
+#define CC_GCI_GPIO_15                 (15)
+
+
+/* indicates Invalid GPIO, e.g. when PAD GPIO doesn't map to GCI GPIO */
+#define CC_GCI_GPIO_INVALID            0xFF
+
+/* find the 4 bit mask given the bit position */
+#define GCIMASK(pos)  (((uint32)0xF) << pos)
+/* get the value which can be used to directly OR with chipcontrol reg */
+#define GCIPOSVAL(val, pos)  ((((uint32)val) << pos) & GCIMASK(pos))
+/* Extract nibble from a given position */
+#define GCIGETNBL(val, pos)    ((val >> pos) & 0xF)
+
+
+/* find the 8 bit mask given the bit position */
+#define GCIMASK_8B(pos)  (((uint32)0xFF) << pos)
+/* get the value which can be used to directly OR with chipcontrol reg */
+#define GCIPOSVAL_8B(val, pos)  ((((uint32)val) << pos) & GCIMASK_8B(pos))
+/* Extract nibble from a given position */
+#define GCIGETNBL_8B(val, pos) ((val >> pos) & 0xFF)
+
+/* find the 4 bit mask given the bit position */
+#define GCIMASK_4B(pos)  (((uint32)0xF) << pos)
+/* get the value which can be used to directly OR with chipcontrol reg */
+#define GCIPOSVAL_4B(val, pos)  ((((uint32)val) << pos) & GCIMASK_4B(pos))
+/* Extract nibble from a given position */
+#define GCIGETNBL_4B(val, pos) ((val >> pos) & 0xF)
+
+
+/* 4335 GCI Intstatus(Mask)/WakeMask Register bits. */
+#define GCI_INTSTATUS_RBI      (1 << 0)        /**< Rx Break Interrupt */
+#define GCI_INTSTATUS_UB       (1 << 1)        /**< UART Break Interrupt */
+#define GCI_INTSTATUS_SPE      (1 << 2)        /**< SECI Parity Error Interrupt */
+#define GCI_INTSTATUS_SFE      (1 << 3)        /**< SECI Framing Error Interrupt */
+#define GCI_INTSTATUS_SRITI    (1 << 9)        /**< SECI Rx Idle Timer Interrupt */
+#define GCI_INTSTATUS_STFF     (1 << 10)       /**< SECI Tx FIFO Full Interrupt */
+#define GCI_INTSTATUS_STFAE    (1 << 11)       /**< SECI Tx FIFO Almost Empty Intr */
+#define GCI_INTSTATUS_SRFAF    (1 << 12)       /**< SECI Rx FIFO Almost Full */
+#define GCI_INTSTATUS_SRFNE    (1 << 14)       /**< SECI Rx FIFO Not Empty */
+#define GCI_INTSTATUS_SRFOF    (1 << 15)       /**< SECI Rx FIFO Not Empty Timeout */
+#define GCI_INTSTATUS_GPIOINT  (1 << 25)       /**< GCIGpioInt */
+#define GCI_INTSTATUS_GPIOWAKE (1 << 26)       /**< GCIGpioWake */
+
+/* 4335 GCI IntMask Register bits. */
+#define GCI_INTMASK_RBI                (1 << 0)        /**< Rx Break Interrupt */
+#define GCI_INTMASK_UB         (1 << 1)        /**< UART Break Interrupt */
+#define GCI_INTMASK_SPE                (1 << 2)        /**< SECI Parity Error Interrupt */
+#define GCI_INTMASK_SFE                (1 << 3)        /**< SECI Framing Error Interrupt */
+#define GCI_INTMASK_SRITI      (1 << 9)        /**< SECI Rx Idle Timer Interrupt */
+#define GCI_INTMASK_STFF       (1 << 10)       /**< SECI Tx FIFO Full Interrupt */
+#define GCI_INTMASK_STFAE      (1 << 11)       /**< SECI Tx FIFO Almost Empty Intr */
+#define GCI_INTMASK_SRFAF      (1 << 12)       /**< SECI Rx FIFO Almost Full */
+#define GCI_INTMASK_SRFNE      (1 << 14)       /**< SECI Rx FIFO Not Empty */
+#define GCI_INTMASK_SRFOF      (1 << 15)       /**< SECI Rx FIFO Not Empty Timeout */
+#define GCI_INTMASK_GPIOINT    (1 << 25)       /**< GCIGpioInt */
+#define GCI_INTMASK_GPIOWAKE   (1 << 26)       /**< GCIGpioWake */
+
+/* 4335 GCI WakeMask Register bits. */
+#define GCI_WAKEMASK_RBI       (1 << 0)        /**< Rx Break Interrupt */
+#define GCI_WAKEMASK_UB                (1 << 1)        /**< UART Break Interrupt */
+#define GCI_WAKEMASK_SPE       (1 << 2)        /**< SECI Parity Error Interrupt */
+#define GCI_WAKEMASK_SFE       (1 << 3)        /**< SECI Framing Error Interrupt */
+#define GCI_WAKE_SRITI         (1 << 9)        /**< SECI Rx Idle Timer Interrupt */
+#define GCI_WAKEMASK_STFF      (1 << 10)       /**< SECI Tx FIFO Full Interrupt */
+#define GCI_WAKEMASK_STFAE     (1 << 11)       /**< SECI Tx FIFO Almost Empty Intr */
+#define GCI_WAKEMASK_SRFAF     (1 << 12)       /**< SECI Rx FIFO Almost Full */
+#define GCI_WAKEMASK_SRFNE     (1 << 14)       /**< SECI Rx FIFO Not Empty */
+#define GCI_WAKEMASK_SRFOF     (1 << 15)       /**< SECI Rx FIFO Not Empty Timeout */
+#define GCI_WAKEMASK_GPIOINT   (1 << 25)       /**< GCIGpioInt */
+#define GCI_WAKEMASK_GPIOWAKE  (1 << 26)       /**< GCIGpioWake */
+
+#define        GCI_WAKE_ON_GCI_GPIO1   1
+#define        GCI_WAKE_ON_GCI_GPIO2   2
+#define        GCI_WAKE_ON_GCI_GPIO3   3
+#define        GCI_WAKE_ON_GCI_GPIO4   4
+#define        GCI_WAKE_ON_GCI_GPIO5   5
+#define        GCI_WAKE_ON_GCI_GPIO6   6
+#define        GCI_WAKE_ON_GCI_GPIO7   7
+#define        GCI_WAKE_ON_GCI_GPIO8   8
+#define        GCI_WAKE_ON_GCI_SECI_IN 9
+
+/* 4335 MUX options. each nibble belongs to a setting. Non-zero value specifies a logic
+* for now only UART for bootloader.
+*/
+#define MUXENAB4335_UART_MASK          (0x0000000f)
+
+#define MUXENAB4335_UART_SHIFT         0
+#define MUXENAB4335_HOSTWAKE_MASK      (0x000000f0)    /**< configure GPIO for SDIO host_wake */
+#define MUXENAB4335_HOSTWAKE_SHIFT     4
+#define MUXENAB4335_GETIX(val, name) \
+       ((((val) & MUXENAB4335_ ## name ## _MASK) >> MUXENAB4335_ ## name ## _SHIFT) - 1)
+
+/*
+* Maximum delay for the PMU state transition in us.
+* This is an upper bound intended for spinwaits etc.
+*/
+#define PMU_MAX_TRANSITION_DLY 15000
+
+/* PMU resource up transition time in ILP cycles */
+#define PMURES_UP_TRANSITION   2
+
+
+/* SECI configuration */
+#define SECI_MODE_UART                 0x0
+#define SECI_MODE_SECI                 0x1
+#define SECI_MODE_LEGACY_3WIRE_BT      0x2
+#define SECI_MODE_LEGACY_3WIRE_WLAN    0x3
+#define SECI_MODE_HALF_SECI            0x4
+
+#define SECI_RESET             (1 << 0)
+#define SECI_RESET_BAR_UART    (1 << 1)
+#define SECI_ENAB_SECI_ECI     (1 << 2)
+#define SECI_ENAB_SECIOUT_DIS  (1 << 3)
+#define SECI_MODE_MASK         0x7
+#define SECI_MODE_SHIFT                4 /* (bits 5, 6, 7) */
+#define SECI_UPD_SECI          (1 << 7)
+
+#define SECI_SLIP_ESC_CHAR     0xDB
+#define SECI_SIGNOFF_0         SECI_SLIP_ESC_CHAR
+#define SECI_SIGNOFF_1     0
+#define SECI_REFRESH_REQ       0xDA
+
+/* seci clk_ctl_st bits */
+#define CLKCTL_STS_SECI_CLK_REQ                (1 << 8)
+#define CLKCTL_STS_SECI_CLK_AVAIL      (1 << 24)
+
+#define SECI_UART_MSR_CTS_STATE                (1 << 0)
+#define SECI_UART_MSR_RTS_STATE                (1 << 1)
+#define SECI_UART_SECI_IN_STATE                (1 << 2)
+#define SECI_UART_SECI_IN2_STATE       (1 << 3)
+
+/* GCI RX FIFO Control Register */
+#define        GCI_RXF_LVL_MASK        (0xFF << 0)
+#define        GCI_RXF_TIMEOUT_MASK    (0xFF << 8)
+
+/* GCI UART Registers' Bit definitions */
+/* Seci Fifo Level Register */
+#define        SECI_TXF_LVL_MASK       (0x3F << 8)
+#define        TXF_AE_LVL_DEFAULT      0x4
+#define        SECI_RXF_LVL_FC_MASK    (0x3F << 16)
+
+/* SeciUARTFCR Bit definitions */
+#define        SECI_UART_FCR_RFR               (1 << 0)
+#define        SECI_UART_FCR_TFR               (1 << 1)
+#define        SECI_UART_FCR_SR                (1 << 2)
+#define        SECI_UART_FCR_THP               (1 << 3)
+#define        SECI_UART_FCR_AB                (1 << 4)
+#define        SECI_UART_FCR_ATOE              (1 << 5)
+#define        SECI_UART_FCR_ARTSOE            (1 << 6)
+#define        SECI_UART_FCR_ABV               (1 << 7)
+#define        SECI_UART_FCR_ALM               (1 << 8)
+
+/* SECI UART LCR register bits */
+#define SECI_UART_LCR_STOP_BITS                (1 << 0) /* 0 - 1bit, 1 - 2bits */
+#define SECI_UART_LCR_PARITY_EN                (1 << 1)
+#define SECI_UART_LCR_PARITY           (1 << 2) /* 0 - odd, 1 - even */
+#define SECI_UART_LCR_RX_EN            (1 << 3)
+#define SECI_UART_LCR_LBRK_CTRL                (1 << 4) /* 1 => SECI_OUT held low */
+#define SECI_UART_LCR_TXO_EN           (1 << 5)
+#define SECI_UART_LCR_RTSO_EN          (1 << 6)
+#define SECI_UART_LCR_SLIPMODE_EN      (1 << 7)
+#define SECI_UART_LCR_RXCRC_CHK                (1 << 8)
+#define SECI_UART_LCR_TXCRC_INV                (1 << 9)
+#define SECI_UART_LCR_TXCRC_LSBF       (1 << 10)
+#define SECI_UART_LCR_TXCRC_EN         (1 << 11)
+#define        SECI_UART_LCR_RXSYNC_EN         (1 << 12)
+
+#define SECI_UART_MCR_TX_EN            (1 << 0)
+#define SECI_UART_MCR_PRTS             (1 << 1)
+#define SECI_UART_MCR_SWFLCTRL_EN      (1 << 2)
+#define SECI_UART_MCR_HIGHRATE_EN      (1 << 3)
+#define SECI_UART_MCR_LOOPBK_EN                (1 << 4)
+#define SECI_UART_MCR_AUTO_RTS         (1 << 5)
+#define SECI_UART_MCR_AUTO_TX_DIS      (1 << 6)
+#define SECI_UART_MCR_BAUD_ADJ_EN      (1 << 7)
+#define SECI_UART_MCR_XONOFF_RPT       (1 << 9)
+
+/* SeciUARTLSR Bit Mask */
+#define        SECI_UART_LSR_RXOVR_MASK        (1 << 0)
+#define        SECI_UART_LSR_RFF_MASK          (1 << 1)
+#define        SECI_UART_LSR_TFNE_MASK         (1 << 2)
+#define        SECI_UART_LSR_TI_MASK           (1 << 3)
+#define        SECI_UART_LSR_TPR_MASK          (1 << 4)
+#define        SECI_UART_LSR_TXHALT_MASK       (1 << 5)
+
+/* SeciUARTMSR Bit Mask */
+#define        SECI_UART_MSR_CTSS_MASK         (1 << 0)
+#define        SECI_UART_MSR_RTSS_MASK         (1 << 1)
+#define        SECI_UART_MSR_SIS_MASK          (1 << 2)
+#define        SECI_UART_MSR_SIS2_MASK         (1 << 3)
+
+/* SeciUARTData Bits */
+#define SECI_UART_DATA_RF_NOT_EMPTY_BIT        (1 << 12)
+#define SECI_UART_DATA_RF_FULL_BIT     (1 << 13)
+#define SECI_UART_DATA_RF_OVRFLOW_BIT  (1 << 14)
+#define        SECI_UART_DATA_FIFO_PTR_MASK    0xFF
+#define        SECI_UART_DATA_RF_RD_PTR_SHIFT  16
+#define        SECI_UART_DATA_RF_WR_PTR_SHIFT  24
+
+/* LTECX: ltecxmux */
+#define LTECX_EXTRACT_MUX(val, idx)    (getbit4(&(val), (idx)))
+
+/* LTECX: ltecxmux MODE */
+#define LTECX_MUX_MODE_IDX             0
+#define LTECX_MUX_MODE_WCI2            0x0
+#define LTECX_MUX_MODE_GPIO            0x1
+
+
+/* LTECX GPIO Information Index */
+#define LTECX_NVRAM_FSYNC_IDX  0
+#define LTECX_NVRAM_LTERX_IDX  1
+#define LTECX_NVRAM_LTETX_IDX  2
+#define LTECX_NVRAM_WLPRIO_IDX 3
+
+/* LTECX WCI2 Information Index */
+#define LTECX_NVRAM_WCI2IN_IDX 0
+#define LTECX_NVRAM_WCI2OUT_IDX        1
+
+/* LTECX: Macros to get GPIO/FNSEL/GCIGPIO */
+#define LTECX_EXTRACT_PADNUM(val, idx) (getbit8(&(val), (idx)))
+#define LTECX_EXTRACT_FNSEL(val, idx)  (getbit4(&(val), (idx)))
+#define LTECX_EXTRACT_GCIGPIO(val, idx)        (getbit4(&(val), (idx)))
+
+/* WLAN channel numbers - used from wifi.h */
+
+/* WLAN BW */
+#define ECI_BW_20   0x0
+#define ECI_BW_25   0x1
+#define ECI_BW_30   0x2
+#define ECI_BW_35   0x3
+#define ECI_BW_40   0x4
+#define ECI_BW_45   0x5
+#define ECI_BW_50   0x6
+#define ECI_BW_ALL  0x7
+
+/* WLAN - number of antenna */
+#define WLAN_NUM_ANT1 TXANT_0
+#define WLAN_NUM_ANT2 TXANT_1
+
+/* otpctrl1 0xF4 */
+#define OTPC_FORCE_PWR_OFF     0x02000000
+/* chipcommon s/r registers introduced with cc rev >= 48 */
+#define CC_SR_CTL0_ENABLE_MASK             0x1
+#define CC_SR_CTL0_ENABLE_SHIFT              0
+#define CC_SR_CTL0_EN_SR_ENG_CLK_SHIFT       1 /* sr_clk to sr_memory enable */
+#define CC_SR_CTL0_RSRC_TRIGGER_SHIFT        2 /* Rising edge resource trigger 0 to sr_engine  */
+#define CC_SR_CTL0_MIN_DIV_SHIFT             6 /* Min division value for fast clk in sr_engine */
+#define CC_SR_CTL0_EN_SBC_STBY_SHIFT        16 /* Allow Subcore mem StandBy? */
+#define CC_SR_CTL0_EN_SR_ALP_CLK_MASK_SHIFT 18
+#define CC_SR_CTL0_EN_SR_HT_CLK_SHIFT       19
+#define CC_SR_CTL0_ALLOW_PIC_SHIFT          20 /* Allow pic to separate power domains */
+#define CC_SR_CTL0_MAX_SR_LQ_CLK_CNT_SHIFT  25
+#define CC_SR_CTL0_EN_MEM_DISABLE_FOR_SLEEP 30
+
+#define CC_SR_CTL1_SR_INIT_MASK             0x3FF
+#define CC_SR_CTL1_SR_INIT_SHIFT            0
+
+#define        ECI_INLO_PKTDUR_MASK    0x000000f0 /* [7:4] - 4 bits */
+#define ECI_INLO_PKTDUR_SHIFT  4
+
+/* gci chip control bits */
+#define GCI_GPIO_CHIPCTRL_ENAB_IN_BIT          0
+#define GCI_GPIO_CHIPCTRL_ENAB_OP_BIT          1
+#define GCI_GPIO_CHIPCTRL_INVERT_BIT           2
+#define GCI_GPIO_CHIPCTRL_PULLUP_BIT           3
+#define GCI_GPIO_CHIPCTRL_PULLDN_BIT           4
+#define GCI_GPIO_CHIPCTRL_ENAB_BTSIG_BIT       5
+#define GCI_GPIO_CHIPCTRL_ENAB_OD_OP_BIT       6
+#define GCI_GPIO_CHIPCTRL_ENAB_EXT_GPIO_BIT    7
+
+/* gci GPIO input status bits */
+#define GCI_GPIO_STS_VALUE_BIT                 0
+#define GCI_GPIO_STS_POS_EDGE_BIT              1
+#define GCI_GPIO_STS_NEG_EDGE_BIT              2
+#define GCI_GPIO_STS_FAST_EDGE_BIT             3
+#define GCI_GPIO_STS_CLEAR                     0xF
+
+#define GCI_GPIO_STS_VALUE     (1 << GCI_GPIO_STS_VALUE_BIT)
+
+#endif /* _SBCHIPC_H */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/sbconfig.h b/drivers/net/wireless/bcmdhd_1363/include/sbconfig.h
new file mode 100644 (file)
index 0000000..ad9c408
--- /dev/null
@@ -0,0 +1,285 @@
+/*
+ * Broadcom SiliconBackplane hardware register definitions.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: sbconfig.h 530150 2015-01-29 08:43:40Z $
+ */
+
+#ifndef        _SBCONFIG_H
+#define        _SBCONFIG_H
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define        _PADLINE(line)  pad ## line
+#define        _XSTR(line)     _PADLINE(line)
+#define        PAD             _XSTR(__LINE__)
+#endif
+
+/* enumeration in SB is based on the premise that cores are contiguos in the
+ * enumeration space.
+ */
+#define SB_BUS_SIZE            0x10000         /**< Each bus gets 64Kbytes for cores */
+#define SB_BUS_BASE(b)         (SI_ENUM_BASE + (b) * SB_BUS_SIZE)
+#define        SB_BUS_MAXCORES         (SB_BUS_SIZE / SI_CORE_SIZE)    /**< Max cores per bus */
+
+/*
+ * Sonics Configuration Space Registers.
+ */
+#define        SBCONFIGOFF             0xf00           /**< core sbconfig regs are top 256bytes of regs */
+#define        SBCONFIGSIZE            256             /**< sizeof (sbconfig_t) */
+
+#define SBIPSFLAG              0x08
+#define SBTPSFLAG              0x18
+#define        SBTMERRLOGA             0x48            /**< sonics >= 2.3 */
+#define        SBTMERRLOG              0x50            /**< sonics >= 2.3 */
+#define SBADMATCH3             0x60
+#define SBADMATCH2             0x68
+#define SBADMATCH1             0x70
+#define SBIMSTATE              0x90
+#define SBINTVEC               0x94
+#define SBTMSTATELOW           0x98
+#define SBTMSTATEHIGH          0x9c
+#define SBBWA0                 0xa0
+#define SBIMCONFIGLOW          0xa8
+#define SBIMCONFIGHIGH         0xac
+#define SBADMATCH0             0xb0
+#define SBTMCONFIGLOW          0xb8
+#define SBTMCONFIGHIGH         0xbc
+#define SBBCONFIG              0xc0
+#define SBBSTATE               0xc8
+#define SBACTCNFG              0xd8
+#define        SBFLAGST                0xe8
+#define SBIDLOW                        0xf8
+#define SBIDHIGH               0xfc
+
+/* All the previous registers are above SBCONFIGOFF, but with Sonics 2.3, we have
+ * a few registers *below* that line. I think it would be very confusing to try
+ * and change the value of SBCONFIGOFF, so I'm definig them as absolute offsets here,
+ */
+
+#define SBIMERRLOGA            0xea8
+#define SBIMERRLOG             0xeb0
+#define SBTMPORTCONNID0                0xed8
+#define SBTMPORTLOCK0          0xef8
+
+#if !defined(_LANGUAGE_ASSEMBLY) && !defined(__ASSEMBLY__)
+
+typedef volatile struct _sbconfig {
+       uint32  PAD[2];
+       uint32  sbipsflag;              /**< initiator port ocp slave flag */
+       uint32  PAD[3];
+       uint32  sbtpsflag;              /**< target port ocp slave flag */
+       uint32  PAD[11];
+       uint32  sbtmerrloga;            /**< (sonics >= 2.3) */
+       uint32  PAD;
+       uint32  sbtmerrlog;             /**< (sonics >= 2.3) */
+       uint32  PAD[3];
+       uint32  sbadmatch3;             /**< address match3 */
+       uint32  PAD;
+       uint32  sbadmatch2;             /**< address match2 */
+       uint32  PAD;
+       uint32  sbadmatch1;             /**< address match1 */
+       uint32  PAD[7];
+       uint32  sbimstate;              /**< initiator agent state */
+       uint32  sbintvec;               /**< interrupt mask */
+       uint32  sbtmstatelow;           /**< target state */
+       uint32  sbtmstatehigh;          /**< target state */
+       uint32  sbbwa0;                 /**< bandwidth allocation table0 */
+       uint32  PAD;
+       uint32  sbimconfiglow;          /**< initiator configuration */
+       uint32  sbimconfighigh;         /**< initiator configuration */
+       uint32  sbadmatch0;             /**< address match0 */
+       uint32  PAD;
+       uint32  sbtmconfiglow;          /**< target configuration */
+       uint32  sbtmconfighigh;         /**< target configuration */
+       uint32  sbbconfig;              /**< broadcast configuration */
+       uint32  PAD;
+       uint32  sbbstate;               /**< broadcast state */
+       uint32  PAD[3];
+       uint32  sbactcnfg;              /**< activate configuration */
+       uint32  PAD[3];
+       uint32  sbflagst;               /**< current sbflags */
+       uint32  PAD[3];
+       uint32  sbidlow;                /**< identification */
+       uint32  sbidhigh;               /**< identification */
+} sbconfig_t;
+
+#endif /* !_LANGUAGE_ASSEMBLY && !__ASSEMBLY__ */
+
+/* sbipsflag */
+#define        SBIPS_INT1_MASK         0x3f            /**< which sbflags get routed to mips interrupt 1 */
+#define        SBIPS_INT1_SHIFT        0
+#define        SBIPS_INT2_MASK         0x3f00          /**< which sbflags get routed to mips interrupt 2 */
+#define        SBIPS_INT2_SHIFT        8
+#define        SBIPS_INT3_MASK         0x3f0000        /**< which sbflags get routed to mips interrupt 3 */
+#define        SBIPS_INT3_SHIFT        16
+#define        SBIPS_INT4_MASK         0x3f000000      /**< which sbflags get routed to mips interrupt 4 */
+#define        SBIPS_INT4_SHIFT        24
+
+/* sbtpsflag */
+#define        SBTPS_NUM0_MASK         0x3f            /**< interrupt sbFlag # generated by this core */
+#define        SBTPS_F0EN0             0x40            /**< interrupt is always sent on the backplane */
+
+/* sbtmerrlog */
+#define        SBTMEL_CM               0x00000007      /**< command */
+#define        SBTMEL_CI               0x0000ff00      /**< connection id */
+#define        SBTMEL_EC               0x0f000000      /**< error code */
+#define        SBTMEL_ME               0x80000000      /**< multiple error */
+
+/* sbimstate */
+#define        SBIM_PC                 0xf             /**< pipecount */
+#define        SBIM_AP_MASK            0x30            /**< arbitration policy */
+#define        SBIM_AP_BOTH            0x00            /**< use both timeslaces and token */
+#define        SBIM_AP_TS              0x10            /**< use timesliaces only */
+#define        SBIM_AP_TK              0x20            /**< use token only */
+#define        SBIM_AP_RSV             0x30            /**< reserved */
+#define        SBIM_IBE                0x20000         /**< inbanderror */
+#define        SBIM_TO                 0x40000         /**< timeout */
+#define        SBIM_BY                 0x01800000      /**< busy (sonics >= 2.3) */
+#define        SBIM_RJ                 0x02000000      /**< reject (sonics >= 2.3) */
+
+/* sbtmstatelow */
+#define        SBTML_RESET             0x0001          /**< reset */
+#define        SBTML_REJ_MASK          0x0006          /**< reject field */
+#define        SBTML_REJ               0x0002          /**< reject */
+#define        SBTML_TMPREJ            0x0004          /**< temporary reject, for error recovery */
+
+#define        SBTML_SICF_SHIFT        16      /**< Shift to locate the SI control flags in sbtml */
+
+/* sbtmstatehigh */
+#define        SBTMH_SERR              0x0001          /**< serror */
+#define        SBTMH_INT               0x0002          /**< interrupt */
+#define        SBTMH_BUSY              0x0004          /**< busy */
+#define        SBTMH_TO                0x0020          /**< timeout (sonics >= 2.3) */
+
+#define        SBTMH_SISF_SHIFT        16              /**< Shift to locate the SI status flags in sbtmh */
+
+/* sbbwa0 */
+#define        SBBWA_TAB0_MASK         0xffff          /**< lookup table 0 */
+#define        SBBWA_TAB1_MASK         0xffff          /**< lookup table 1 */
+#define        SBBWA_TAB1_SHIFT        16
+
+/* sbimconfiglow */
+#define        SBIMCL_STO_MASK         0x7             /**< service timeout */
+#define        SBIMCL_RTO_MASK         0x70            /**< request timeout */
+#define        SBIMCL_RTO_SHIFT        4
+#define        SBIMCL_CID_MASK         0xff0000        /**< connection id */
+#define        SBIMCL_CID_SHIFT        16
+
+/* sbimconfighigh */
+#define        SBIMCH_IEM_MASK         0xc             /**< inband error mode */
+#define        SBIMCH_TEM_MASK         0x30            /**< timeout error mode */
+#define        SBIMCH_TEM_SHIFT        4
+#define        SBIMCH_BEM_MASK         0xc0            /**< bus error mode */
+#define        SBIMCH_BEM_SHIFT        6
+
+/* sbadmatch0 */
+#define        SBAM_TYPE_MASK          0x3             /**< address type */
+#define        SBAM_AD64               0x4             /**< reserved */
+#define        SBAM_ADINT0_MASK        0xf8            /**< type0 size */
+#define        SBAM_ADINT0_SHIFT       3
+#define        SBAM_ADINT1_MASK        0x1f8           /**< type1 size */
+#define        SBAM_ADINT1_SHIFT       3
+#define        SBAM_ADINT2_MASK        0x1f8           /**< type2 size */
+#define        SBAM_ADINT2_SHIFT       3
+#define        SBAM_ADEN               0x400           /**< enable */
+#define        SBAM_ADNEG              0x800           /**< negative decode */
+#define        SBAM_BASE0_MASK         0xffffff00      /**< type0 base address */
+#define        SBAM_BASE0_SHIFT        8
+#define        SBAM_BASE1_MASK         0xfffff000      /**< type1 base address for the core */
+#define        SBAM_BASE1_SHIFT        12
+#define        SBAM_BASE2_MASK         0xffff0000      /**< type2 base address for the core */
+#define        SBAM_BASE2_SHIFT        16
+
+/* sbtmconfiglow */
+#define        SBTMCL_CD_MASK          0xff            /**< clock divide */
+#define        SBTMCL_CO_MASK          0xf800          /**< clock offset */
+#define        SBTMCL_CO_SHIFT         11
+#define        SBTMCL_IF_MASK          0xfc0000        /**< interrupt flags */
+#define        SBTMCL_IF_SHIFT         18
+#define        SBTMCL_IM_MASK          0x3000000       /**< interrupt mode */
+#define        SBTMCL_IM_SHIFT         24
+
+/* sbtmconfighigh */
+#define        SBTMCH_BM_MASK          0x3             /**< busy mode */
+#define        SBTMCH_RM_MASK          0x3             /**< retry mode */
+#define        SBTMCH_RM_SHIFT         2
+#define        SBTMCH_SM_MASK          0x30            /**< stop mode */
+#define        SBTMCH_SM_SHIFT         4
+#define        SBTMCH_EM_MASK          0x300           /**< sb error mode */
+#define        SBTMCH_EM_SHIFT         8
+#define        SBTMCH_IM_MASK          0xc00           /**< int mode */
+#define        SBTMCH_IM_SHIFT         10
+
+/* sbbconfig */
+#define        SBBC_LAT_MASK           0x3             /**< sb latency */
+#define        SBBC_MAX0_MASK          0xf0000         /**< maxccntr0 */
+#define        SBBC_MAX0_SHIFT         16
+#define        SBBC_MAX1_MASK          0xf00000        /**< maxccntr1 */
+#define        SBBC_MAX1_SHIFT         20
+
+/* sbbstate */
+#define        SBBS_SRD                0x1             /**< st reg disable */
+#define        SBBS_HRD                0x2             /**< hold reg disable */
+
+/* sbidlow */
+#define        SBIDL_CS_MASK           0x3             /**< config space */
+#define        SBIDL_AR_MASK           0x38            /**< # address ranges supported */
+#define        SBIDL_AR_SHIFT          3
+#define        SBIDL_SYNCH             0x40            /**< sync */
+#define        SBIDL_INIT              0x80            /**< initiator */
+#define        SBIDL_MINLAT_MASK       0xf00           /**< minimum backplane latency */
+#define        SBIDL_MINLAT_SHIFT      8
+#define        SBIDL_MAXLAT            0xf000          /**< maximum backplane latency */
+#define        SBIDL_MAXLAT_SHIFT      12
+#define        SBIDL_FIRST             0x10000         /**< this initiator is first */
+#define        SBIDL_CW_MASK           0xc0000         /**< cycle counter width */
+#define        SBIDL_CW_SHIFT          18
+#define        SBIDL_TP_MASK           0xf00000        /**< target ports */
+#define        SBIDL_TP_SHIFT          20
+#define        SBIDL_IP_MASK           0xf000000       /**< initiator ports */
+#define        SBIDL_IP_SHIFT          24
+#define        SBIDL_RV_MASK           0xf0000000      /**< sonics backplane revision code */
+#define        SBIDL_RV_SHIFT          28
+#define        SBIDL_RV_2_2            0x00000000      /**< version 2.2 or earlier */
+#define        SBIDL_RV_2_3            0x10000000      /**< version 2.3 */
+
+/* sbidhigh */
+#define        SBIDH_RC_MASK           0x000f          /**< revision code */
+#define        SBIDH_RCE_MASK          0x7000          /**< revision code extension field */
+#define        SBIDH_RCE_SHIFT         8
+#define        SBCOREREV(sbidh) \
+       ((((sbidh) & SBIDH_RCE_MASK) >> SBIDH_RCE_SHIFT) | ((sbidh) & SBIDH_RC_MASK))
+#define        SBIDH_CC_MASK           0x8ff0          /**< core code */
+#define        SBIDH_CC_SHIFT          4
+#define        SBIDH_VC_MASK           0xffff0000      /**< vendor code */
+#define        SBIDH_VC_SHIFT          16
+
+#define        SB_COMMIT               0xfd8           /**< update buffered registers value */
+
+/* vendor codes */
+#define        SB_VEND_BCM             0x4243          /**< Broadcom's SB vendor code */
+
+#endif /* _SBCONFIG_H */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/sbhnddma.h b/drivers/net/wireless/bcmdhd_1363/include/sbhnddma.h
new file mode 100644 (file)
index 0000000..d66a0b6
--- /dev/null
@@ -0,0 +1,420 @@
+/*
+ * Generic Broadcom Home Networking Division (HND) DMA engine HW interface
+ * This supports the following chips: BCM42xx, 44xx, 47xx .
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: sbhnddma.h 530150 2015-01-29 08:43:40Z $
+ */
+
+#ifndef        _sbhnddma_h_
+#define        _sbhnddma_h_
+
+/* DMA structure:
+ *  support two DMA engines: 32 bits address or 64 bit addressing
+ *  basic DMA register set is per channel(transmit or receive)
+ *  a pair of channels is defined for convenience
+ */
+
+
+/* 32 bits addressing */
+
+/** dma registers per channel(xmt or rcv) */
+typedef volatile struct {
+       uint32  control;                /**< enable, et al */
+       uint32  addr;                   /**< descriptor ring base address (4K aligned) */
+       uint32  ptr;                    /**< last descriptor posted to chip */
+       uint32  status;                 /**< current active descriptor, et al */
+} dma32regs_t;
+
+typedef volatile struct {
+       dma32regs_t     xmt;            /**< dma tx channel */
+       dma32regs_t     rcv;            /**< dma rx channel */
+} dma32regp_t;
+
+typedef volatile struct {      /* diag access */
+       uint32  fifoaddr;               /**< diag address */
+       uint32  fifodatalow;            /**< low 32bits of data */
+       uint32  fifodatahigh;           /**< high 32bits of data */
+       uint32  pad;                    /**< reserved */
+} dma32diag_t;
+
+/**
+ * DMA Descriptor
+ * Descriptors are only read by the hardware, never written back.
+ */
+typedef volatile struct {
+       uint32  ctrl;           /**< misc control bits & bufcount */
+       uint32  addr;           /**< data buffer address */
+} dma32dd_t;
+
+/** Each descriptor ring must be 4096byte aligned, and fit within a single 4096byte page. */
+#define        D32RINGALIGN_BITS       12
+#define        D32MAXRINGSZ            (1 << D32RINGALIGN_BITS)
+#define        D32RINGALIGN            (1 << D32RINGALIGN_BITS)
+
+#define        D32MAXDD        (D32MAXRINGSZ / sizeof (dma32dd_t))
+
+/* transmit channel control */
+#define        XC_XE           ((uint32)1 << 0)        /**< transmit enable */
+#define        XC_SE           ((uint32)1 << 1)        /**< transmit suspend request */
+#define        XC_LE           ((uint32)1 << 2)        /**< loopback enable */
+#define        XC_FL           ((uint32)1 << 4)        /**< flush request */
+#define XC_MR_MASK     0x000001C0              /**< Multiple outstanding reads */
+#define XC_MR_SHIFT    6
+#define        XC_PD           ((uint32)1 << 11)       /**< parity check disable */
+#define        XC_AE           ((uint32)3 << 16)       /**< address extension bits */
+#define        XC_AE_SHIFT     16
+#define XC_BL_MASK     0x001C0000              /**< BurstLen bits */
+#define XC_BL_SHIFT    18
+#define XC_PC_MASK     0x00E00000              /**< Prefetch control */
+#define XC_PC_SHIFT    21
+#define XC_PT_MASK     0x03000000              /**< Prefetch threshold */
+#define XC_PT_SHIFT    24
+
+/** Multiple outstanding reads */
+#define DMA_MR_1       0
+#define DMA_MR_2       1
+#define DMA_MR_4       2
+#define DMA_MR_8       3
+#define DMA_MR_12      4
+#define DMA_MR_16      5
+#define DMA_MR_20      6
+#define DMA_MR_32      7
+
+/** DMA Burst Length in bytes */
+#define DMA_BL_16      0
+#define DMA_BL_32      1
+#define DMA_BL_64      2
+#define DMA_BL_128     3
+#define DMA_BL_256     4
+#define DMA_BL_512     5
+#define DMA_BL_1024    6
+
+/** Prefetch control */
+#define DMA_PC_0       0
+#define DMA_PC_4       1
+#define DMA_PC_8       2
+#define DMA_PC_16      3
+/* others: reserved */
+
+/** Prefetch threshold */
+#define DMA_PT_1       0
+#define DMA_PT_2       1
+#define DMA_PT_4       2
+#define DMA_PT_8       3
+
+/* transmit descriptor table pointer */
+#define        XP_LD_MASK      0xfff                   /**< last valid descriptor */
+
+/* transmit channel status */
+#define        XS_CD_MASK      0x0fff                  /**< current descriptor pointer */
+#define        XS_XS_MASK      0xf000                  /**< transmit state */
+#define        XS_XS_SHIFT     12
+#define        XS_XS_DISABLED  0x0000                  /**< disabled */
+#define        XS_XS_ACTIVE    0x1000                  /**< active */
+#define        XS_XS_IDLE      0x2000                  /**< idle wait */
+#define        XS_XS_STOPPED   0x3000                  /**< stopped */
+#define        XS_XS_SUSP      0x4000                  /**< suspend pending */
+#define        XS_XE_MASK      0xf0000                 /**< transmit errors */
+#define        XS_XE_SHIFT     16
+#define        XS_XE_NOERR     0x00000                 /**< no error */
+#define        XS_XE_DPE       0x10000                 /**< descriptor protocol error */
+#define        XS_XE_DFU       0x20000                 /**< data fifo underrun */
+#define        XS_XE_BEBR      0x30000                 /**< bus error on buffer read */
+#define        XS_XE_BEDA      0x40000                 /**< bus error on descriptor access */
+#define        XS_AD_MASK      0xfff00000              /**< active descriptor */
+#define        XS_AD_SHIFT     20
+
+/* receive channel control */
+#define        RC_RE           ((uint32)1 << 0)        /**< receive enable */
+#define        RC_RO_MASK      0xfe                    /**< receive frame offset */
+#define        RC_RO_SHIFT     1
+#define        RC_FM           ((uint32)1 << 8)        /**< direct fifo receive (pio) mode */
+#define        RC_SH           ((uint32)1 << 9)        /**< separate rx header descriptor enable */
+#define        RC_OC           ((uint32)1 << 10)       /**< overflow continue */
+#define        RC_PD           ((uint32)1 << 11)       /**< parity check disable */
+#define        RC_AE           ((uint32)3 << 16)       /**< address extension bits */
+#define        RC_AE_SHIFT     16
+#define RC_BL_MASK     0x001C0000              /**< BurstLen bits */
+#define RC_BL_SHIFT    18
+#define RC_PC_MASK     0x00E00000              /**< Prefetch control */
+#define RC_PC_SHIFT    21
+#define RC_PT_MASK     0x03000000              /**< Prefetch threshold */
+#define RC_PT_SHIFT    24
+
+/* receive descriptor table pointer */
+#define        RP_LD_MASK      0xfff                   /**< last valid descriptor */
+
+/* receive channel status */
+#define        RS_CD_MASK      0x0fff                  /**< current descriptor pointer */
+#define        RS_RS_MASK      0xf000                  /**< receive state */
+#define        RS_RS_SHIFT     12
+#define        RS_RS_DISABLED  0x0000                  /**< disabled */
+#define        RS_RS_ACTIVE    0x1000                  /**< active */
+#define        RS_RS_IDLE      0x2000                  /**< idle wait */
+#define        RS_RS_STOPPED   0x3000                  /**< reserved */
+#define        RS_RE_MASK      0xf0000                 /**< receive errors */
+#define        RS_RE_SHIFT     16
+#define        RS_RE_NOERR     0x00000                 /**< no error */
+#define        RS_RE_DPE       0x10000                 /**< descriptor protocol error */
+#define        RS_RE_DFO       0x20000                 /**< data fifo overflow */
+#define        RS_RE_BEBW      0x30000                 /**< bus error on buffer write */
+#define        RS_RE_BEDA      0x40000                 /**< bus error on descriptor access */
+#define        RS_AD_MASK      0xfff00000              /**< active descriptor */
+#define        RS_AD_SHIFT     20
+
+/* fifoaddr */
+#define        FA_OFF_MASK     0xffff                  /**< offset */
+#define        FA_SEL_MASK     0xf0000                 /**< select */
+#define        FA_SEL_SHIFT    16
+#define        FA_SEL_XDD      0x00000                 /**< transmit dma data */
+#define        FA_SEL_XDP      0x10000                 /**< transmit dma pointers */
+#define        FA_SEL_RDD      0x40000                 /**< receive dma data */
+#define        FA_SEL_RDP      0x50000                 /**< receive dma pointers */
+#define        FA_SEL_XFD      0x80000                 /**< transmit fifo data */
+#define        FA_SEL_XFP      0x90000                 /**< transmit fifo pointers */
+#define        FA_SEL_RFD      0xc0000                 /**< receive fifo data */
+#define        FA_SEL_RFP      0xd0000                 /**< receive fifo pointers */
+#define        FA_SEL_RSD      0xe0000                 /**< receive frame status data */
+#define        FA_SEL_RSP      0xf0000                 /**< receive frame status pointers */
+
+/* descriptor control flags */
+#define        CTRL_BC_MASK    0x00001fff              /**< buffer byte count, real data len must <= 4KB */
+#define        CTRL_AE         ((uint32)3 << 16)       /**< address extension bits */
+#define        CTRL_AE_SHIFT   16
+#define        CTRL_PARITY     ((uint32)3 << 18)       /**< parity bit */
+#define        CTRL_EOT        ((uint32)1 << 28)       /**< end of descriptor table */
+#define        CTRL_IOC        ((uint32)1 << 29)       /**< interrupt on completion */
+#define        CTRL_EOF        ((uint32)1 << 30)       /**< end of frame */
+#define        CTRL_SOF        ((uint32)1 << 31)       /**< start of frame */
+
+/** control flags in the range [27:20] are core-specific and not defined here */
+#define        CTRL_CORE_MASK  0x0ff00000
+
+/* 64 bits addressing */
+
+/** dma registers per channel(xmt or rcv) */
+typedef volatile struct {
+       uint32  control;        /**< enable, et al */
+       uint32  ptr;            /**< last descriptor posted to chip */
+       uint32  addrlow;        /**< descriptor ring base address low 32-bits (8K aligned) */
+       uint32  addrhigh;       /**< descriptor ring base address bits 63:32 (8K aligned) */
+       uint32  status0;        /**< current descriptor, xmt state */
+       uint32  status1;        /**< active descriptor, xmt error */
+} dma64regs_t;
+
+typedef volatile struct {
+       dma64regs_t     tx;             /**< dma64 tx channel */
+       dma64regs_t     rx;             /**< dma64 rx channel */
+} dma64regp_t;
+
+typedef volatile struct {              /**< diag access */
+       uint32  fifoaddr;               /**< diag address */
+       uint32  fifodatalow;            /**< low 32bits of data */
+       uint32  fifodatahigh;           /**< high 32bits of data */
+       uint32  pad;                    /**< reserved */
+} dma64diag_t;
+
+/**
+ * DMA Descriptor
+ * Descriptors are only read by the hardware, never written back.
+ */
+typedef volatile struct {
+       uint32  ctrl1;          /**< misc control bits */
+       uint32  ctrl2;          /**< buffer count and address extension */
+       uint32  addrlow;        /**< memory address of the date buffer, bits 31:0 */
+       uint32  addrhigh;       /**< memory address of the date buffer, bits 63:32 */
+} dma64dd_t;
+
+/**
+ * Each descriptor ring must be 8kB aligned, and fit within a contiguous 8kB physical addresss.
+ */
+#define D64RINGALIGN_BITS      13
+#define        D64MAXRINGSZ            (1 << D64RINGALIGN_BITS)
+#define        D64RINGBOUNDARY         (1 << D64RINGALIGN_BITS)
+
+#define        D64MAXDD        (D64MAXRINGSZ / sizeof (dma64dd_t))
+
+/** for cores with large descriptor ring support, descriptor ring size can be up to 4096 */
+#define        D64MAXDD_LARGE          ((1 << 16) / sizeof (dma64dd_t))
+
+/**
+ * for cores with large descriptor ring support (4k descriptors), descriptor ring cannot cross
+ * 64K boundary
+ */
+#define        D64RINGBOUNDARY_LARGE   (1 << 16)
+
+/*
+ * Default DMA Burstlen values for USBRev >= 12 and SDIORev >= 11.
+ * When this field contains the value N, the burst length is 2**(N + 4) bytes.
+ */
+#define D64_DEF_USBBURSTLEN     2
+#define D64_DEF_SDIOBURSTLEN    1
+
+
+#ifndef D64_USBBURSTLEN
+#define D64_USBBURSTLEN        DMA_BL_64
+#endif
+#ifndef D64_SDIOBURSTLEN
+#define D64_SDIOBURSTLEN       DMA_BL_32
+#endif
+
+/* transmit channel control */
+#define        D64_XC_XE               0x00000001      /**< transmit enable */
+#define        D64_XC_SE               0x00000002      /**< transmit suspend request */
+#define        D64_XC_LE               0x00000004      /**< loopback enable */
+#define        D64_XC_FL               0x00000010      /**< flush request */
+#define D64_XC_MR_MASK         0x000001C0      /**< Multiple outstanding reads */
+#define D64_XC_MR_SHIFT                6
+#define        D64_XC_PD               0x00000800      /**< parity check disable */
+#define        D64_XC_AE               0x00030000      /**< address extension bits */
+#define        D64_XC_AE_SHIFT         16
+#define D64_XC_BL_MASK         0x001C0000      /**< BurstLen bits */
+#define D64_XC_BL_SHIFT                18
+#define D64_XC_PC_MASK         0x00E00000              /**< Prefetch control */
+#define D64_XC_PC_SHIFT                21
+#define D64_XC_PT_MASK         0x03000000              /**< Prefetch threshold */
+#define D64_XC_PT_SHIFT                24
+
+/* transmit descriptor table pointer */
+#define        D64_XP_LD_MASK          0x00001fff      /**< last valid descriptor */
+
+/* transmit channel status */
+#define        D64_XS0_CD_MASK         (di->d64_xs0_cd_mask)   /**< current descriptor pointer */
+#define        D64_XS0_XS_MASK         0xf0000000      /**< transmit state */
+#define        D64_XS0_XS_SHIFT                28
+#define        D64_XS0_XS_DISABLED     0x00000000      /**< disabled */
+#define        D64_XS0_XS_ACTIVE       0x10000000      /**< active */
+#define        D64_XS0_XS_IDLE         0x20000000      /**< idle wait */
+#define        D64_XS0_XS_STOPPED      0x30000000      /**< stopped */
+#define        D64_XS0_XS_SUSP         0x40000000      /**< suspend pending */
+
+#define        D64_XS1_AD_MASK         (di->d64_xs1_ad_mask)   /**< active descriptor */
+#define        D64_XS1_XE_MASK         0xf0000000      /**< transmit errors */
+#define        D64_XS1_XE_SHIFT                28
+#define        D64_XS1_XE_NOERR        0x00000000      /**< no error */
+#define        D64_XS1_XE_DPE          0x10000000      /**< descriptor protocol error */
+#define        D64_XS1_XE_DFU          0x20000000      /**< data fifo underrun */
+#define        D64_XS1_XE_DTE          0x30000000      /**< data transfer error */
+#define        D64_XS1_XE_DESRE        0x40000000      /**< descriptor read error */
+#define        D64_XS1_XE_COREE        0x50000000      /**< core error */
+
+/* receive channel control */
+#define        D64_RC_RE               0x00000001      /**< receive enable */
+#define        D64_RC_RO_MASK          0x000000fe      /**< receive frame offset */
+#define        D64_RC_RO_SHIFT         1
+#define        D64_RC_FM               0x00000100      /**< direct fifo receive (pio) mode */
+#define        D64_RC_SH               0x00000200      /**< separate rx header descriptor enable */
+#define        D64_RC_SHIFT            9       /**< separate rx header descriptor enable */
+#define        D64_RC_OC               0x00000400      /**< overflow continue */
+#define        D64_RC_PD               0x00000800      /**< parity check disable */
+#define D64_RC_SA              0x00002000      /**< select active */
+#define D64_RC_GE              0x00004000      /**< Glom enable */
+#define        D64_RC_AE               0x00030000      /**< address extension bits */
+#define        D64_RC_AE_SHIFT         16
+#define D64_RC_BL_MASK         0x001C0000      /**< BurstLen bits */
+#define D64_RC_BL_SHIFT                18
+#define D64_RC_PC_MASK         0x00E00000      /**< Prefetch control */
+#define D64_RC_PC_SHIFT                21
+#define D64_RC_PT_MASK         0x03000000      /**< Prefetch threshold */
+#define D64_RC_PT_SHIFT                24
+
+/* flags for dma controller */
+#define DMA_CTRL_PEN           (1 << 0)        /**< partity enable */
+#define DMA_CTRL_ROC           (1 << 1)        /**< rx overflow continue */
+#define DMA_CTRL_RXMULTI       (1 << 2)        /**< allow rx scatter to multiple descriptors */
+#define DMA_CTRL_UNFRAMED      (1 << 3)        /**< Unframed Rx/Tx data */
+#define DMA_CTRL_USB_BOUNDRY4KB_WAR (1 << 4)
+#define DMA_CTRL_DMA_AVOIDANCE_WAR (1 << 5)    /**< DMA avoidance WAR for 4331 */
+#define DMA_CTRL_RXSINGLE      (1 << 6)        /**< always single buffer */
+#define DMA_CTRL_SDIO_RXGLOM   (1 << 7)        /**< DMA Rx glome is enabled */
+
+/* receive descriptor table pointer */
+#define        D64_RP_LD_MASK          0x00001fff      /**< last valid descriptor */
+
+/* receive channel status */
+#define        D64_RS0_CD_MASK         (di->d64_rs0_cd_mask)   /**< current descriptor pointer */
+#define        D64_RS0_RS_MASK         0xf0000000      /**< receive state */
+#define        D64_RS0_RS_SHIFT                28
+#define        D64_RS0_RS_DISABLED     0x00000000      /**< disabled */
+#define        D64_RS0_RS_ACTIVE       0x10000000      /**< active */
+#define        D64_RS0_RS_IDLE         0x20000000      /**< idle wait */
+#define        D64_RS0_RS_STOPPED      0x30000000      /**< stopped */
+#define        D64_RS0_RS_SUSP         0x40000000      /**< suspend pending */
+
+#define        D64_RS1_AD_MASK         0x0001ffff      /**< active descriptor */
+#define        D64_RS1_RE_MASK         0xf0000000      /**< receive errors */
+#define        D64_RS1_RE_SHIFT                28
+#define        D64_RS1_RE_NOERR        0x00000000      /**< no error */
+#define        D64_RS1_RE_DPO          0x10000000      /**< descriptor protocol error */
+#define        D64_RS1_RE_DFU          0x20000000      /**< data fifo overflow */
+#define        D64_RS1_RE_DTE          0x30000000      /**< data transfer error */
+#define        D64_RS1_RE_DESRE        0x40000000      /**< descriptor read error */
+#define        D64_RS1_RE_COREE        0x50000000      /**< core error */
+
+/* fifoaddr */
+#define        D64_FA_OFF_MASK         0xffff          /**< offset */
+#define        D64_FA_SEL_MASK         0xf0000         /**< select */
+#define        D64_FA_SEL_SHIFT        16
+#define        D64_FA_SEL_XDD          0x00000         /**< transmit dma data */
+#define        D64_FA_SEL_XDP          0x10000         /**< transmit dma pointers */
+#define        D64_FA_SEL_RDD          0x40000         /**< receive dma data */
+#define        D64_FA_SEL_RDP          0x50000         /**< receive dma pointers */
+#define        D64_FA_SEL_XFD          0x80000         /**< transmit fifo data */
+#define        D64_FA_SEL_XFP          0x90000         /**< transmit fifo pointers */
+#define        D64_FA_SEL_RFD          0xc0000         /**< receive fifo data */
+#define        D64_FA_SEL_RFP          0xd0000         /**< receive fifo pointers */
+#define        D64_FA_SEL_RSD          0xe0000         /**< receive frame status data */
+#define        D64_FA_SEL_RSP          0xf0000         /**< receive frame status pointers */
+
+/* descriptor control flags 1 */
+#define D64_CTRL_COREFLAGS     0x0ff00000              /**< core specific flags */
+#define        D64_CTRL1_NOTPCIE       ((uint32)1 << 18)       /**< buirst size control */
+#define        D64_CTRL1_EOT           ((uint32)1 << 28)       /**< end of descriptor table */
+#define        D64_CTRL1_IOC           ((uint32)1 << 29)       /**< interrupt on completion */
+#define        D64_CTRL1_EOF           ((uint32)1 << 30)       /**< end of frame */
+#define        D64_CTRL1_SOF           ((uint32)1 << 31)       /**< start of frame */
+
+/* descriptor control flags 2 */
+#define        D64_CTRL2_BC_MASK       0x00007fff /**< buffer byte count. real data len must <= 16KB */
+#define        D64_CTRL2_AE            0x00030000 /**< address extension bits */
+#define        D64_CTRL2_AE_SHIFT      16
+#define D64_CTRL2_PARITY       0x00040000      /* parity bit */
+
+/** control flags in the range [27:20] are core-specific and not defined here */
+#define        D64_CTRL_CORE_MASK      0x0ff00000
+
+#define D64_RX_FRM_STS_LEN     0x0000ffff      /**< frame length mask */
+#define D64_RX_FRM_STS_OVFL    0x00800000      /**< RxOverFlow */
+#define D64_RX_FRM_STS_DSCRCNT 0x0f000000 /**< no. of descriptors used - 1, d11corerev >= 22 */
+#define D64_RX_FRM_STS_DATATYPE        0xf0000000      /**< core-dependent data type */
+
+/** receive frame status */
+typedef volatile struct {
+       uint16 len;
+       uint16 flags;
+} dma_rxh_t;
+
+#endif /* _sbhnddma_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/sbpcmcia.h b/drivers/net/wireless/bcmdhd_1363/include/sbpcmcia.h
new file mode 100644 (file)
index 0000000..121d22c
--- /dev/null
@@ -0,0 +1,116 @@
+/*
+ * BCM43XX Sonics SiliconBackplane PCMCIA core hardware definitions.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: sbpcmcia.h 521344 2014-12-17 10:03:55Z $
+ */
+
+#ifndef        _SBPCMCIA_H
+#define        _SBPCMCIA_H
+
+/* All the addresses that are offsets in attribute space are divided
+ * by two to account for the fact that odd bytes are invalid in
+ * attribute space and our read/write routines make the space appear
+ * as if they didn't exist. Still we want to show the original numbers
+ * as documented in the hnd_pcmcia core manual.
+ */
+
+/* PCMCIA Function Configuration Registers */
+#define        PCMCIA_FCR              (0x700 / 2)
+
+#define        FCR0_OFF                0
+#define        FCR1_OFF                (0x40 / 2)
+#define        FCR2_OFF                (0x80 / 2)
+#define        FCR3_OFF                (0xc0 / 2)
+
+#define        PCMCIA_FCR0             (0x700 / 2)
+#define        PCMCIA_FCR1             (0x740 / 2)
+#define        PCMCIA_FCR2             (0x780 / 2)
+#define        PCMCIA_FCR3             (0x7c0 / 2)
+
+/* Standard PCMCIA FCR registers */
+
+#define        PCMCIA_COR              0
+
+#define        COR_RST                 0x80
+#define        COR_LEV                 0x40
+#define        COR_IRQEN               0x04
+#define        COR_BLREN               0x01
+#define        COR_FUNEN               0x01
+
+
+#define        PCICIA_FCSR             (2 / 2)
+#define        PCICIA_PRR              (4 / 2)
+#define        PCICIA_SCR              (6 / 2)
+#define        PCICIA_ESR              (8 / 2)
+
+
+#define PCM_MEMOFF             0x0000
+#define F0_MEMOFF              0x1000
+#define F1_MEMOFF              0x2000
+#define F2_MEMOFF              0x3000
+#define F3_MEMOFF              0x4000
+
+/* Memory base in the function fcr's */
+#define MEM_ADDR0              (0x728 / 2)
+#define MEM_ADDR1              (0x72a / 2)
+#define MEM_ADDR2              (0x72c / 2)
+
+/* PCMCIA base plus Srom access in fcr0: */
+#define PCMCIA_ADDR0           (0x072e / 2)
+#define PCMCIA_ADDR1           (0x0730 / 2)
+#define PCMCIA_ADDR2           (0x0732 / 2)
+
+#define MEM_SEG                        (0x0734 / 2)
+#define SROM_CS                        (0x0736 / 2)
+#define SROM_DATAL             (0x0738 / 2)
+#define SROM_DATAH             (0x073a / 2)
+#define SROM_ADDRL             (0x073c / 2)
+#define SROM_ADDRH             (0x073e / 2)
+#define        SROM_INFO2              (0x0772 / 2)    /* Corerev >= 2 && <= 5 */
+#define        SROM_INFO               (0x07be / 2)    /* Corerev >= 6 */
+
+/*  Values for srom_cs: */
+#define SROM_IDLE              0
+#define SROM_WRITE             1
+#define SROM_READ              2
+#define SROM_WEN               4
+#define SROM_WDS               7
+#define SROM_DONE              8
+
+/* Fields in srom_info: */
+#define        SRI_SZ_MASK             0x03
+#define        SRI_BLANK               0x04
+#define        SRI_OTP                 0x80
+
+
+/* sbtmstatelow */
+#define SBTML_INT_ACK          0x40000         /* ack the sb interrupt */
+#define SBTML_INT_EN           0x20000         /* enable sb interrupt */
+
+/* sbtmstatehigh */
+#define SBTMH_INT_STATUS       0x40000         /* sb interrupt status */
+
+#endif /* _SBPCMCIA_H */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/sbsdio.h b/drivers/net/wireless/bcmdhd_1363/include/sbsdio.h
new file mode 100644 (file)
index 0000000..68707c4
--- /dev/null
@@ -0,0 +1,189 @@
+/*
+ * SDIO device core hardware definitions.
+ * sdio is a portion of the pcmcia core in core rev 3 - rev 8
+ *
+ * SDIO core support 1bit, 4 bit SDIO mode as well as SPI mode.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: sbsdio.h 514727 2014-11-12 03:02:48Z $
+ */
+
+#ifndef        _SBSDIO_H
+#define        _SBSDIO_H
+
+#define SBSDIO_NUM_FUNCTION            3       /* as of sdiod rev 0, supports 3 functions */
+
+/* function 1 miscellaneous registers */
+#define SBSDIO_SPROM_CS                        0x10000         /* sprom command and status */
+#define SBSDIO_SPROM_INFO              0x10001         /* sprom info register */
+#define SBSDIO_SPROM_DATA_LOW          0x10002         /* sprom indirect access data byte 0 */
+#define SBSDIO_SPROM_DATA_HIGH         0x10003         /* sprom indirect access data byte 1 */
+#define SBSDIO_SPROM_ADDR_LOW          0x10004         /* sprom indirect access addr byte 0 */
+#define SBSDIO_SPROM_ADDR_HIGH         0x10005         /* sprom indirect access addr byte 0 */
+#define SBSDIO_CHIP_CTRL_DATA          0x10006         /* xtal_pu (gpio) output */
+#define SBSDIO_CHIP_CTRL_EN            0x10007         /* xtal_pu (gpio) enable */
+#define SBSDIO_WATERMARK               0x10008         /* rev < 7, watermark for sdio device */
+#define SBSDIO_DEVICE_CTL              0x10009         /* control busy signal generation */
+
+/* registers introduced in rev 8, some content (mask/bits) defs in sbsdpcmdev.h */
+#define SBSDIO_FUNC1_SBADDRLOW         0x1000A         /* SB Address Window Low (b15) */
+#define SBSDIO_FUNC1_SBADDRMID         0x1000B         /* SB Address Window Mid (b23:b16) */
+#define SBSDIO_FUNC1_SBADDRHIGH                0x1000C         /* SB Address Window High (b31:b24)    */
+#define SBSDIO_FUNC1_FRAMECTRL         0x1000D         /* Frame Control (frame term/abort) */
+#define SBSDIO_FUNC1_CHIPCLKCSR                0x1000E         /* ChipClockCSR (ALP/HT ctl/status) */
+#define SBSDIO_FUNC1_SDIOPULLUP        0x1000F         /* SdioPullUp (on cmd, d0-d2) */
+#define SBSDIO_FUNC1_WFRAMEBCLO                0x10019         /* Write Frame Byte Count Low */
+#define SBSDIO_FUNC1_WFRAMEBCHI                0x1001A         /* Write Frame Byte Count High */
+#define SBSDIO_FUNC1_RFRAMEBCLO                0x1001B         /* Read Frame Byte Count Low */
+#define SBSDIO_FUNC1_RFRAMEBCHI                0x1001C         /* Read Frame Byte Count High */
+#define SBSDIO_FUNC1_MESBUSYCTRL       0x1001D         /* MesBusyCtl at 0x1001D (rev 11) */
+
+#define SBSDIO_FUNC1_MISC_REG_START    0x10000         /* f1 misc register start */
+#define SBSDIO_FUNC1_MISC_REG_LIMIT    0x1001C         /* f1 misc register end */
+
+/* Sdio Core Rev 12 */
+#define SBSDIO_FUNC1_WAKEUPCTRL                        0x1001E
+#define SBSDIO_FUNC1_WCTRL_ALPWAIT_MASK                0x1
+#define SBSDIO_FUNC1_WCTRL_ALPWAIT_SHIFT       0
+#define SBSDIO_FUNC1_WCTRL_HTWAIT_MASK         0x2
+#define SBSDIO_FUNC1_WCTRL_HTWAIT_SHIFT                1
+#define SBSDIO_FUNC1_SLEEPCSR                  0x1001F
+#define SBSDIO_FUNC1_SLEEPCSR_KSO_MASK         0x1
+#define SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT                0
+#define SBSDIO_FUNC1_SLEEPCSR_KSO_EN           1
+#define SBSDIO_FUNC1_SLEEPCSR_DEVON_MASK       0x2
+#define SBSDIO_FUNC1_SLEEPCSR_DEVON_SHIFT      1
+
+/* SBSDIO_SPROM_CS */
+#define SBSDIO_SPROM_IDLE              0
+#define SBSDIO_SPROM_WRITE             1
+#define SBSDIO_SPROM_READ              2
+#define SBSDIO_SPROM_WEN               4
+#define SBSDIO_SPROM_WDS               7
+#define SBSDIO_SPROM_DONE              8
+
+/* SBSDIO_SPROM_INFO */
+#define SROM_SZ_MASK                   0x03            /* SROM size, 1: 4k, 2: 16k */
+#define SROM_BLANK                     0x04            /* depreciated in corerev 6 */
+#define        SROM_OTP                        0x80            /* OTP present */
+
+/* SBSDIO_CHIP_CTRL */
+#define SBSDIO_CHIP_CTRL_XTAL          0x01            /* or'd with onchip xtal_pu,
+                                                        * 1: power on oscillator
+                                                        * (for 4318 only)
+                                                        */
+/* SBSDIO_WATERMARK */
+#define SBSDIO_WATERMARK_MASK          0x7f            /* number of words - 1 for sd device
+                                                        * to wait before sending data to host
+                                                        */
+
+/* SBSDIO_MESBUSYCTRL */
+/* When RX FIFO has less entries than this & MBE is set
+ * => busy signal is asserted between data blocks.
+*/
+#define SBSDIO_MESBUSYCTRL_MASK                0x7f
+#define SBSDIO_MESBUSYCTRL_ENAB                0x80            /* Enable busy capability for MES access */
+
+/* SBSDIO_DEVICE_CTL */
+#define SBSDIO_DEVCTL_SETBUSY          0x01            /* 1: device will assert busy signal when
+                                                        * receiving CMD53
+                                                        */
+#define SBSDIO_DEVCTL_SPI_INTR_SYNC    0x02            /* 1: assertion of sdio interrupt is
+                                                        * synchronous to the sdio clock
+                                                        */
+#define SBSDIO_DEVCTL_CA_INT_ONLY      0x04            /* 1: mask all interrupts to host
+                                                        * except the chipActive (rev 8)
+                                                        */
+#define SBSDIO_DEVCTL_PADS_ISO         0x08            /* 1: isolate internal sdio signals, put
+                                                        * external pads in tri-state; requires
+                                                        * sdio bus power cycle to clear (rev 9)
+                                                        */
+#define SBSDIO_DEVCTL_EN_F2_BLK_WATERMARK 0x10  /* Enable function 2 tx for each block */
+#define SBSDIO_DEVCTL_F2WM_ENAB                0x10            /* Enable F2 Watermark */
+#define SBSDIO_DEVCTL_NONDAT_PADS_ISO  0x20            /* Isolate sdio clk and cmd (non-data) */
+
+/* SBSDIO_FUNC1_CHIPCLKCSR */
+#define SBSDIO_FORCE_ALP               0x01            /* Force ALP request to backplane */
+#define SBSDIO_FORCE_HT                        0x02            /* Force HT request to backplane */
+#define SBSDIO_FORCE_ILP               0x04            /* Force ILP request to backplane */
+#define SBSDIO_ALP_AVAIL_REQ           0x08            /* Make ALP ready (power up xtal) */
+#define SBSDIO_HT_AVAIL_REQ            0x10            /* Make HT ready (power up PLL) */
+#define SBSDIO_FORCE_HW_CLKREQ_OFF     0x20            /* Squelch clock requests from HW */
+#define SBSDIO_ALP_AVAIL               0x40            /* Status: ALP is ready */
+#define SBSDIO_HT_AVAIL                        0x80            /* Status: HT is ready */
+/* In rev8, actual avail bits followed original docs */
+#define SBSDIO_Rev8_HT_AVAIL           0x40
+#define SBSDIO_Rev8_ALP_AVAIL          0x80
+#define SBSDIO_CSR_MASK                        0x1F
+
+#define SBSDIO_AVBITS                  (SBSDIO_HT_AVAIL | SBSDIO_ALP_AVAIL)
+#define SBSDIO_ALPAV(regval)           ((regval) & SBSDIO_AVBITS)
+#define SBSDIO_HTAV(regval)            (((regval) & SBSDIO_AVBITS) == SBSDIO_AVBITS)
+#define SBSDIO_ALPONLY(regval)         (SBSDIO_ALPAV(regval) && !SBSDIO_HTAV(regval))
+#define SBSDIO_CLKAV(regval, alponly)  (SBSDIO_ALPAV(regval) && \
+                                       (alponly ? 1 : SBSDIO_HTAV(regval)))
+
+/* SBSDIO_FUNC1_SDIOPULLUP */
+#define SBSDIO_PULLUP_D0               0x01            /* Enable D0/MISO pullup */
+#define SBSDIO_PULLUP_D1               0x02            /* Enable D1/INT# pullup */
+#define SBSDIO_PULLUP_D2               0x04            /* Enable D2 pullup */
+#define SBSDIO_PULLUP_CMD              0x08            /* Enable CMD/MOSI pullup */
+#define SBSDIO_PULLUP_ALL              0x0f            /* All valid bits */
+
+/* function 1 OCP space */
+#define SBSDIO_SB_OFT_ADDR_MASK                0x07FFF         /* sb offset addr is <= 15 bits, 32k */
+#define SBSDIO_SB_OFT_ADDR_LIMIT       0x08000
+#define SBSDIO_SB_ACCESS_2_4B_FLAG     0x08000         /* with b15, maps to 32-bit SB access */
+
+/* some duplication with sbsdpcmdev.h here */
+/* valid bits in SBSDIO_FUNC1_SBADDRxxx regs */
+#define SBSDIO_SBADDRLOW_MASK          0x80            /* Valid bits in SBADDRLOW */
+#define SBSDIO_SBADDRMID_MASK          0xff            /* Valid bits in SBADDRMID */
+#define SBSDIO_SBADDRHIGH_MASK         0xffU           /* Valid bits in SBADDRHIGH */
+#define SBSDIO_SBWINDOW_MASK           0xffff8000      /* Address bits from SBADDR regs */
+
+/* direct(mapped) cis space */
+#define SBSDIO_CIS_BASE_COMMON         0x1000          /* MAPPED common CIS address */
+#define SBSDIO_CIS_SIZE_LIMIT          0x200           /* maximum bytes in one CIS */
+#define SBSDIO_OTP_CIS_SIZE_LIMIT       0x078           /* maximum bytes OTP CIS */
+
+#define SBSDIO_CIS_OFT_ADDR_MASK       0x1FFFF         /* cis offset addr is < 17 bits */
+
+#define SBSDIO_CIS_MANFID_TUPLE_LEN    6               /* manfid tuple length, include tuple,
+                                                        * link bytes
+                                                        */
+
+/* indirect cis access (in sprom) */
+#define SBSDIO_SPROM_CIS_OFFSET                0x8             /* 8 control bytes first, CIS starts from
+                                                        * 8th byte
+                                                        */
+
+#define SBSDIO_BYTEMODE_DATALEN_MAX    64              /* sdio byte mode: maximum length of one
+                                                        * data comamnd
+                                                        */
+
+#define SBSDIO_CORE_ADDR_MASK          0x1FFFF         /* sdio core function one address mask */
+
+#endif /* _SBSDIO_H */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/sbsdpcmdev.h b/drivers/net/wireless/bcmdhd_1363/include/sbsdpcmdev.h
new file mode 100644 (file)
index 0000000..8c5fd56
--- /dev/null
@@ -0,0 +1,298 @@
+/*
+ * Broadcom SiliconBackplane SDIO/PCMCIA hardware-specific
+ * device core support
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: sbsdpcmdev.h 514727 2014-11-12 03:02:48Z $
+ */
+
+#ifndef        _sbsdpcmdev_h_
+#define        _sbsdpcmdev_h_
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define        _PADLINE(line)  pad ## line
+#define        _XSTR(line)     _PADLINE(line)
+#define        PAD             _XSTR(__LINE__)
+#endif /* PAD */
+
+
+typedef volatile struct {
+       dma64regs_t     xmt;            /* dma tx */
+       uint32 PAD[2];
+       dma64regs_t     rcv;            /* dma rx */
+       uint32 PAD[2];
+} dma64p_t;
+
+/* dma64 sdiod corerev >= 1 */
+typedef volatile struct {
+       dma64p_t dma64regs[2];
+       dma64diag_t dmafifo;            /* DMA Diagnostic Regs, 0x280-0x28c */
+       uint32 PAD[92];
+} sdiodma64_t;
+
+/* dma32 sdiod corerev == 0 */
+typedef volatile struct {
+       dma32regp_t dma32regs[2];       /* dma tx & rx, 0x200-0x23c */
+       dma32diag_t dmafifo;            /* DMA Diagnostic Regs, 0x240-0x24c */
+       uint32 PAD[108];
+} sdiodma32_t;
+
+/* dma32 regs for pcmcia core */
+typedef volatile struct {
+       dma32regp_t dmaregs;            /* DMA Regs, 0x200-0x21c, rev8 */
+       dma32diag_t dmafifo;            /* DMA Diagnostic Regs, 0x220-0x22c */
+       uint32 PAD[116];
+} pcmdma32_t;
+
+/* core registers */
+typedef volatile struct {
+       uint32 corecontrol;             /* CoreControl, 0x000, rev8 */
+       uint32 corestatus;              /* CoreStatus, 0x004, rev8  */
+       uint32 PAD[1];
+       uint32 biststatus;              /* BistStatus, 0x00c, rev8  */
+
+       /* PCMCIA access */
+       uint16 pcmciamesportaladdr;     /* PcmciaMesPortalAddr, 0x010, rev8   */
+       uint16 PAD[1];
+       uint16 pcmciamesportalmask;     /* PcmciaMesPortalMask, 0x014, rev8   */
+       uint16 PAD[1];
+       uint16 pcmciawrframebc;         /* PcmciaWrFrameBC, 0x018, rev8   */
+       uint16 PAD[1];
+       uint16 pcmciaunderflowtimer;    /* PcmciaUnderflowTimer, 0x01c, rev8   */
+       uint16 PAD[1];
+
+       /* interrupt */
+       uint32 intstatus;               /* IntStatus, 0x020, rev8   */
+       uint32 hostintmask;             /* IntHostMask, 0x024, rev8   */
+       uint32 intmask;                 /* IntSbMask, 0x028, rev8   */
+       uint32 sbintstatus;             /* SBIntStatus, 0x02c, rev8   */
+       uint32 sbintmask;               /* SBIntMask, 0x030, rev8   */
+       uint32 funcintmask;             /* SDIO Function Interrupt Mask, SDIO rev4 */
+       uint32 PAD[2];
+       uint32 tosbmailbox;             /* ToSBMailbox, 0x040, rev8   */
+       uint32 tohostmailbox;           /* ToHostMailbox, 0x044, rev8   */
+       uint32 tosbmailboxdata;         /* ToSbMailboxData, 0x048, rev8   */
+       uint32 tohostmailboxdata;       /* ToHostMailboxData, 0x04c, rev8   */
+
+       /* synchronized access to registers in SDIO clock domain */
+       uint32 sdioaccess;              /* SdioAccess, 0x050, rev8   */
+       uint32 PAD[3];
+
+       /* PCMCIA frame control */
+       uint8 pcmciaframectrl;          /* pcmciaFrameCtrl, 0x060, rev8   */
+       uint8 PAD[3];
+       uint8 pcmciawatermark;          /* pcmciaWaterMark, 0x064, rev8   */
+       uint8 PAD[155];
+
+       /* interrupt batching control */
+       uint32 intrcvlazy;              /* IntRcvLazy, 0x100, rev8 */
+       uint32 PAD[3];
+
+       /* counters */
+       uint32 cmd52rd;                 /* Cmd52RdCount, 0x110, rev8, SDIO: cmd52 reads */
+       uint32 cmd52wr;                 /* Cmd52WrCount, 0x114, rev8, SDIO: cmd52 writes */
+       uint32 cmd53rd;                 /* Cmd53RdCount, 0x118, rev8, SDIO: cmd53 reads */
+       uint32 cmd53wr;                 /* Cmd53WrCount, 0x11c, rev8, SDIO: cmd53 writes */
+       uint32 abort;                   /* AbortCount, 0x120, rev8, SDIO: aborts */
+       uint32 datacrcerror;            /* DataCrcErrorCount, 0x124, rev8, SDIO: frames w/bad CRC */
+       uint32 rdoutofsync;             /* RdOutOfSyncCount, 0x128, rev8, SDIO/PCMCIA: Rd Frm OOS */
+       uint32 wroutofsync;             /* RdOutOfSyncCount, 0x12c, rev8, SDIO/PCMCIA: Wr Frm OOS */
+       uint32 writebusy;               /* WriteBusyCount, 0x130, rev8, SDIO: dev asserted "busy" */
+       uint32 readwait;                /* ReadWaitCount, 0x134, rev8, SDIO: read: no data avail */
+       uint32 readterm;                /* ReadTermCount, 0x138, rev8, SDIO: rd frm terminates */
+       uint32 writeterm;               /* WriteTermCount, 0x13c, rev8, SDIO: wr frm terminates */
+       uint32 PAD[40];
+       uint32 clockctlstatus;          /* ClockCtlStatus, 0x1e0, rev8 */
+       uint32 PAD[7];
+
+       /* DMA engines */
+       volatile union {
+               pcmdma32_t pcm32;
+               sdiodma32_t sdiod32;
+               sdiodma64_t sdiod64;
+       } dma;
+
+       /* SDIO/PCMCIA CIS region */
+       char cis[512];                  /* 512 byte CIS, 0x400-0x5ff, rev6 */
+
+       /* PCMCIA function control registers */
+       char pcmciafcr[256];            /* PCMCIA FCR, 0x600-6ff, rev6 */
+       uint16 PAD[55];
+
+       /* PCMCIA backplane access */
+       uint16 backplanecsr;            /* BackplaneCSR, 0x76E, rev6 */
+       uint16 backplaneaddr0;          /* BackplaneAddr0, 0x770, rev6 */
+       uint16 backplaneaddr1;          /* BackplaneAddr1, 0x772, rev6 */
+       uint16 backplaneaddr2;          /* BackplaneAddr2, 0x774, rev6 */
+       uint16 backplaneaddr3;          /* BackplaneAddr3, 0x776, rev6 */
+       uint16 backplanedata0;          /* BackplaneData0, 0x778, rev6 */
+       uint16 backplanedata1;          /* BackplaneData1, 0x77a, rev6 */
+       uint16 backplanedata2;          /* BackplaneData2, 0x77c, rev6 */
+       uint16 backplanedata3;          /* BackplaneData3, 0x77e, rev6 */
+       uint16 PAD[31];
+
+       /* sprom "size" & "blank" info */
+       uint16 spromstatus;             /* SPROMStatus, 0x7BE, rev2 */
+       uint32 PAD[464];
+
+       /* Sonics SiliconBackplane registers */
+       sbconfig_t sbconfig;            /* SbConfig Regs, 0xf00-0xfff, rev8 */
+} sdpcmd_regs_t;
+
+/* corecontrol */
+#define CC_CISRDY              (1 << 0)        /* CIS Ready */
+#define CC_BPRESEN             (1 << 1)        /* CCCR RES signal causes backplane reset */
+#define CC_F2RDY               (1 << 2)        /* set CCCR IOR2 bit */
+#define CC_CLRPADSISO          (1 << 3)        /* clear SDIO pads isolation bit (rev 11) */
+#define CC_XMTDATAAVAIL_MODE   (1 << 4)        /* data avail generates an interrupt */
+#define CC_XMTDATAAVAIL_CTRL   (1 << 5)        /* data avail interrupt ctrl */
+
+/* corestatus */
+#define CS_PCMCIAMODE  (1 << 0)        /* Device Mode; 0=SDIO, 1=PCMCIA */
+#define CS_SMARTDEV    (1 << 1)        /* 1=smartDev enabled */
+#define CS_F2ENABLED   (1 << 2)        /* 1=host has enabled the device */
+
+#define PCMCIA_MES_PA_MASK     0x7fff  /* PCMCIA Message Portal Address Mask */
+#define PCMCIA_MES_PM_MASK     0x7fff  /* PCMCIA Message Portal Mask Mask */
+#define PCMCIA_WFBC_MASK       0xffff  /* PCMCIA Write Frame Byte Count Mask */
+#define PCMCIA_UT_MASK         0x07ff  /* PCMCIA Underflow Timer Mask */
+
+/* intstatus */
+#define I_SMB_SW0      (1 << 0)        /* To SB Mail S/W interrupt 0 */
+#define I_SMB_SW1      (1 << 1)        /* To SB Mail S/W interrupt 1 */
+#define I_SMB_SW2      (1 << 2)        /* To SB Mail S/W interrupt 2 */
+#define I_SMB_SW3      (1 << 3)        /* To SB Mail S/W interrupt 3 */
+#define I_SMB_SW_MASK  0x0000000f      /* To SB Mail S/W interrupts mask */
+#define I_SMB_SW_SHIFT 0               /* To SB Mail S/W interrupts shift */
+#define I_HMB_SW0      (1 << 4)        /* To Host Mail S/W interrupt 0 */
+#define I_HMB_SW1      (1 << 5)        /* To Host Mail S/W interrupt 1 */
+#define I_HMB_SW2      (1 << 6)        /* To Host Mail S/W interrupt 2 */
+#define I_HMB_SW3      (1 << 7)        /* To Host Mail S/W interrupt 3 */
+#define I_HMB_SW_MASK  0x000000f0      /* To Host Mail S/W interrupts mask */
+#define I_HMB_SW_SHIFT 4               /* To Host Mail S/W interrupts shift */
+#define I_WR_OOSYNC    (1 << 8)        /* Write Frame Out Of Sync */
+#define I_RD_OOSYNC    (1 << 9)        /* Read Frame Out Of Sync */
+#define        I_PC            (1 << 10)       /* descriptor error */
+#define        I_PD            (1 << 11)       /* data error */
+#define        I_DE            (1 << 12)       /* Descriptor protocol Error */
+#define        I_RU            (1 << 13)       /* Receive descriptor Underflow */
+#define        I_RO            (1 << 14)       /* Receive fifo Overflow */
+#define        I_XU            (1 << 15)       /* Transmit fifo Underflow */
+#define        I_RI            (1 << 16)       /* Receive Interrupt */
+#define I_BUSPWR       (1 << 17)       /* SDIO Bus Power Change (rev 9) */
+#define I_XMTDATA_AVAIL (1 << 23)      /* bits in fifo */
+#define        I_XI            (1 << 24)       /* Transmit Interrupt */
+#define I_RF_TERM      (1 << 25)       /* Read Frame Terminate */
+#define I_WF_TERM      (1 << 26)       /* Write Frame Terminate */
+#define I_PCMCIA_XU    (1 << 27)       /* PCMCIA Transmit FIFO Underflow */
+#define I_SBINT                (1 << 28)       /* sbintstatus Interrupt */
+#define I_CHIPACTIVE   (1 << 29)       /* chip transitioned from doze to active state */
+#define I_SRESET       (1 << 30)       /* CCCR RES interrupt */
+#define I_IOE2         (1U << 31)      /* CCCR IOE2 Bit Changed */
+#define        I_ERRORS        (I_PC | I_PD | I_DE | I_RU | I_RO | I_XU)       /* DMA Errors */
+#define I_DMA          (I_RI | I_XI | I_ERRORS)
+
+/* sbintstatus */
+#define I_SB_SERR      (1 << 8)        /* Backplane SError (write) */
+#define I_SB_RESPERR   (1 << 9)        /* Backplane Response Error (read) */
+#define I_SB_SPROMERR  (1 << 10)       /* Error accessing the sprom */
+
+/* sdioaccess */
+#define SDA_DATA_MASK  0x000000ff      /* Read/Write Data Mask */
+#define SDA_ADDR_MASK  0x000fff00      /* Read/Write Address Mask */
+#define SDA_ADDR_SHIFT 8               /* Read/Write Address Shift */
+#define SDA_WRITE      0x01000000      /* Write bit  */
+#define SDA_READ       0x00000000      /* Write bit cleared for Read */
+#define SDA_BUSY       0x80000000      /* Busy bit */
+
+/* sdioaccess-accessible register address spaces */
+#define SDA_CCCR_SPACE         0x000   /* sdioAccess CCCR register space */
+#define SDA_F1_FBR_SPACE       0x100   /* sdioAccess F1 FBR register space */
+#define SDA_F2_FBR_SPACE       0x200   /* sdioAccess F2 FBR register space */
+#define SDA_F1_REG_SPACE       0x300   /* sdioAccess F1 core-specific register space */
+
+/* SDA_F1_REG_SPACE sdioaccess-accessible F1 reg space register offsets */
+#define SDA_CHIPCONTROLDATA    0x006   /* ChipControlData */
+#define SDA_CHIPCONTROLENAB    0x007   /* ChipControlEnable */
+#define SDA_F2WATERMARK                0x008   /* Function 2 Watermark */
+#define SDA_DEVICECONTROL      0x009   /* DeviceControl */
+#define SDA_SBADDRLOW          0x00a   /* SbAddrLow */
+#define SDA_SBADDRMID          0x00b   /* SbAddrMid */
+#define SDA_SBADDRHIGH         0x00c   /* SbAddrHigh */
+#define SDA_FRAMECTRL          0x00d   /* FrameCtrl */
+#define SDA_CHIPCLOCKCSR       0x00e   /* ChipClockCSR */
+#define SDA_SDIOPULLUP         0x00f   /* SdioPullUp */
+#define SDA_SDIOWRFRAMEBCLOW   0x019   /* SdioWrFrameBCLow */
+#define SDA_SDIOWRFRAMEBCHIGH  0x01a   /* SdioWrFrameBCHigh */
+#define SDA_SDIORDFRAMEBCLOW   0x01b   /* SdioRdFrameBCLow */
+#define SDA_SDIORDFRAMEBCHIGH  0x01c   /* SdioRdFrameBCHigh */
+
+/* SDA_F2WATERMARK */
+#define SDA_F2WATERMARK_MASK   0x7f    /* F2Watermark Mask */
+
+/* SDA_SBADDRLOW */
+#define SDA_SBADDRLOW_MASK     0x80    /* SbAddrLow Mask */
+
+/* SDA_SBADDRMID */
+#define SDA_SBADDRMID_MASK     0xff    /* SbAddrMid Mask */
+
+/* SDA_SBADDRHIGH */
+#define SDA_SBADDRHIGH_MASK    0xff    /* SbAddrHigh Mask */
+
+/* SDA_FRAMECTRL */
+#define SFC_RF_TERM    (1 << 0)        /* Read Frame Terminate */
+#define SFC_WF_TERM    (1 << 1)        /* Write Frame Terminate */
+#define SFC_CRC4WOOS   (1 << 2)        /* HW reports CRC error for write out of sync */
+#define SFC_ABORTALL   (1 << 3)        /* Abort cancels all in-progress frames */
+
+/* pcmciaframectrl */
+#define PFC_RF_TERM    (1 << 0)        /* Read Frame Terminate */
+#define PFC_WF_TERM    (1 << 1)        /* Write Frame Terminate */
+
+/* intrcvlazy */
+#define        IRL_TO_MASK     0x00ffffff      /* timeout */
+#define        IRL_FC_MASK     0xff000000      /* frame count */
+#define        IRL_FC_SHIFT    24              /* frame count */
+
+/* rx header */
+typedef volatile struct {
+       uint16 len;
+       uint16 flags;
+} sdpcmd_rxh_t;
+
+/* rx header flags */
+#define RXF_CRC                0x0001          /* CRC error detected */
+#define RXF_WOOS       0x0002          /* write frame out of sync */
+#define RXF_WF_TERM    0x0004          /* write frame terminated */
+#define RXF_ABORT      0x0008          /* write frame aborted */
+#define RXF_DISCARD    (RXF_CRC | RXF_WOOS | RXF_WF_TERM | RXF_ABORT)  /* bad frame */
+
+/* HW frame tag */
+#define SDPCM_FRAMETAG_LEN     4       /* HW frametag: 2 bytes len, 2 bytes check val */
+
+#define SDPCM_HWEXT_LEN        8
+
+#endif /* _sbsdpcmdev_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/sbsocram.h b/drivers/net/wireless/bcmdhd_1363/include/sbsocram.h
new file mode 100644 (file)
index 0000000..e601814
--- /dev/null
@@ -0,0 +1,203 @@
+/*
+ * BCM47XX Sonics SiliconBackplane embedded ram core
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: sbsocram.h 514727 2014-11-12 03:02:48Z $
+ */
+
+#ifndef        _SBSOCRAM_H
+#define        _SBSOCRAM_H
+
+#ifndef _LANGUAGE_ASSEMBLY
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define        _PADLINE(line)  pad ## line
+#define        _XSTR(line)     _PADLINE(line)
+#define        PAD             _XSTR(__LINE__)
+#endif /* PAD */
+
+/* Memcsocram core registers */
+typedef volatile struct sbsocramregs {
+       uint32  coreinfo;
+       uint32  bwalloc;
+       uint32  extracoreinfo;
+       uint32  biststat;
+       uint32  bankidx;
+       uint32  standbyctrl;
+
+       uint32  errlogstatus;   /* rev 6 */
+       uint32  errlogaddr;     /* rev 6 */
+       /* used for patching rev 3 & 5 */
+       uint32  cambankidx;
+       uint32  cambankstandbyctrl;
+       uint32  cambankpatchctrl;
+       uint32  cambankpatchtblbaseaddr;
+       uint32  cambankcmdreg;
+       uint32  cambankdatareg;
+       uint32  cambankmaskreg;
+       uint32  PAD[1];
+       uint32  bankinfo;       /* corev 8 */
+       uint32  bankpda;
+       uint32  PAD[14];
+       uint32  extmemconfig;
+       uint32  extmemparitycsr;
+       uint32  extmemparityerrdata;
+       uint32  extmemparityerrcnt;
+       uint32  extmemwrctrlandsize;
+       uint32  PAD[84];
+       uint32  workaround;
+       uint32  pwrctl;         /* corerev >= 2 */
+       uint32  PAD[133];
+       uint32  sr_control;     /* corerev >= 15 */
+       uint32  sr_status;      /* corerev >= 15 */
+       uint32  sr_address;     /* corerev >= 15 */
+       uint32  sr_data;        /* corerev >= 15 */
+} sbsocramregs_t;
+
+#endif /* _LANGUAGE_ASSEMBLY */
+
+/* Register offsets */
+#define        SR_COREINFO             0x00
+#define        SR_BWALLOC              0x04
+#define        SR_BISTSTAT             0x0c
+#define        SR_BANKINDEX            0x10
+#define        SR_BANKSTBYCTL          0x14
+#define SR_PWRCTL              0x1e8
+
+/* Coreinfo register */
+#define        SRCI_PT_MASK            0x00070000      /* corerev >= 6; port type[18:16] */
+#define        SRCI_PT_SHIFT           16
+/* port types : SRCI_PT_<processorPT>_<backplanePT> */
+#define SRCI_PT_OCP_OCP                0
+#define SRCI_PT_AXI_OCP                1
+#define SRCI_PT_ARM7AHB_OCP    2
+#define SRCI_PT_CM3AHB_OCP     3
+#define SRCI_PT_AXI_AXI                4
+#define SRCI_PT_AHB_AXI                5
+/* corerev >= 3 */
+#define SRCI_LSS_MASK          0x00f00000
+#define SRCI_LSS_SHIFT         20
+#define SRCI_LRS_MASK          0x0f000000
+#define SRCI_LRS_SHIFT         24
+
+/* In corerev 0, the memory size is 2 to the power of the
+ * base plus 16 plus to the contents of the memsize field plus 1.
+ */
+#define        SRCI_MS0_MASK           0xf
+#define SR_MS0_BASE            16
+
+/*
+ * In corerev 1 the bank size is 2 ^ the bank size field plus 14,
+ * the memory size is number of banks times bank size.
+ * The same applies to rom size.
+ */
+#define        SRCI_ROMNB_MASK         0xf000
+#define        SRCI_ROMNB_SHIFT        12
+#define        SRCI_ROMBSZ_MASK        0xf00
+#define        SRCI_ROMBSZ_SHIFT       8
+#define        SRCI_SRNB_MASK          0xf0
+#define        SRCI_SRNB_SHIFT         4
+#define        SRCI_SRBSZ_MASK         0xf
+#define        SRCI_SRBSZ_SHIFT        0
+
+#define SR_BSZ_BASE            14
+
+/* Standby control register */
+#define        SRSC_SBYOVR_MASK        0x80000000
+#define        SRSC_SBYOVR_SHIFT       31
+#define        SRSC_SBYOVRVAL_MASK     0x60000000
+#define        SRSC_SBYOVRVAL_SHIFT    29
+#define        SRSC_SBYEN_MASK         0x01000000      /* rev >= 3 */
+#define        SRSC_SBYEN_SHIFT        24
+
+/* Power control register */
+#define SRPC_PMU_STBYDIS_MASK  0x00000010      /* rev >= 3 */
+#define SRPC_PMU_STBYDIS_SHIFT 4
+#define SRPC_STBYOVRVAL_MASK   0x00000008
+#define SRPC_STBYOVRVAL_SHIFT  3
+#define SRPC_STBYOVR_MASK      0x00000007
+#define SRPC_STBYOVR_SHIFT     0
+
+/* Extra core capability register */
+#define SRECC_NUM_BANKS_MASK   0x000000F0
+#define SRECC_NUM_BANKS_SHIFT  4
+#define SRECC_BANKSIZE_MASK    0x0000000F
+#define SRECC_BANKSIZE_SHIFT   0
+
+#define SRECC_BANKSIZE(value)   (1 << (value))
+
+/* CAM bank patch control */
+#define SRCBPC_PATCHENABLE 0x80000000
+
+#define SRP_ADDRESS   0x0001FFFC
+#define SRP_VALID     0x8000
+
+/* CAM bank command reg */
+#define SRCMD_WRITE  0x00020000
+#define SRCMD_READ   0x00010000
+#define SRCMD_DONE   0x80000000
+
+#define SRCMD_DONE_DLY 1000
+
+/* bankidx and bankinfo reg defines corerev >= 8 */
+#define SOCRAM_BANKINFO_SZMASK         0x7f
+#define SOCRAM_BANKIDX_ROM_MASK                0x100
+
+#define SOCRAM_BANKIDX_MEMTYPE_SHIFT   8
+/* socram bankinfo memtype */
+#define SOCRAM_MEMTYPE_RAM             0
+#define SOCRAM_MEMTYPE_R0M             1
+#define SOCRAM_MEMTYPE_DEVRAM          2
+
+#define        SOCRAM_BANKINFO_REG             0x40
+#define        SOCRAM_BANKIDX_REG              0x10
+#define        SOCRAM_BANKINFO_STDBY_MASK      0x400
+#define        SOCRAM_BANKINFO_STDBY_TIMER     0x800
+
+/* bankinfo rev >= 10 */
+#define SOCRAM_BANKINFO_DEVRAMSEL_SHIFT                13
+#define SOCRAM_BANKINFO_DEVRAMSEL_MASK         0x2000
+#define SOCRAM_BANKINFO_DEVRAMPRO_SHIFT                14
+#define SOCRAM_BANKINFO_DEVRAMPRO_MASK         0x4000
+#define SOCRAM_BANKINFO_SLPSUPP_SHIFT          15
+#define SOCRAM_BANKINFO_SLPSUPP_MASK           0x8000
+#define SOCRAM_BANKINFO_RETNTRAM_SHIFT         16
+#define SOCRAM_BANKINFO_RETNTRAM_MASK          0x00010000
+#define SOCRAM_BANKINFO_PDASZ_SHIFT            17
+#define SOCRAM_BANKINFO_PDASZ_MASK             0x003E0000
+#define SOCRAM_BANKINFO_DEVRAMREMAP_SHIFT      24
+#define SOCRAM_BANKINFO_DEVRAMREMAP_MASK       0x01000000
+
+/* extracoreinfo register */
+#define SOCRAM_DEVRAMBANK_MASK         0xF000
+#define SOCRAM_DEVRAMBANK_SHIFT                12
+
+/* bank info to calculate bank size */
+#define   SOCRAM_BANKINFO_SZBASE          8192
+#define SOCRAM_BANKSIZE_SHIFT         13      /* SOCRAM_BANKINFO_SZBASE */
+
+
+#endif /* _SBSOCRAM_H */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/sbsysmem.h b/drivers/net/wireless/bcmdhd_1363/include/sbsysmem.h
new file mode 100644 (file)
index 0000000..cd62796
--- /dev/null
@@ -0,0 +1,200 @@
+/*
+ * SiliconBackplane System Memory core
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: sbsysmem.h 514727 2014-11-12 03:02:48Z $
+ */
+
+#ifndef        _SBSYSMEM_H
+#define        _SBSYSMEM_H
+
+#ifndef _LANGUAGE_ASSEMBLY
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define        _PADLINE(line)  pad ## line
+#define        _XSTR(line)     _PADLINE(line)
+#define        PAD             _XSTR(__LINE__)
+#endif /* PAD */
+
+/* sysmem core registers */
+typedef volatile struct sysmemregs {
+       uint32  coreinfo;
+       uint32  bwalloc;
+       uint32  extracoreinfo;
+       uint32  biststat;
+       uint32  bankidx;
+       uint32  standbyctrl;
+
+       uint32  errlogstatus;
+       uint32  errlogaddr;
+
+       uint32  cambankidx;
+       uint32  cambankstandbyctrl;
+       uint32  cambankpatchctrl;
+       uint32  cambankpatchtblbaseaddr;
+       uint32  cambankcmdreg;
+       uint32  cambankdatareg;
+       uint32  cambankmaskreg;
+       uint32  PAD[1];
+       uint32  bankinfo;
+       uint32  PAD[15];
+       uint32  extmemconfig;
+       uint32  extmemparitycsr;
+       uint32  extmemparityerrdata;
+       uint32  extmemparityerrcnt;
+       uint32  extmemwrctrlandsize;
+       uint32  PAD[84];
+       uint32  workaround;
+       uint32  pwrctl;
+       uint32  PAD[133];
+       uint32  sr_control;
+       uint32  sr_status;
+       uint32  sr_address;
+       uint32  sr_data;
+} sysmemregs_t;
+
+#endif /* _LANGUAGE_ASSEMBLY */
+
+/* Register offsets */
+#define        SR_COREINFO             0x00
+#define        SR_BWALLOC              0x04
+#define        SR_BISTSTAT             0x0c
+#define        SR_BANKINDEX            0x10
+#define        SR_BANKSTBYCTL          0x14
+#define SR_PWRCTL              0x1e8
+
+/* Coreinfo register */
+#define        SRCI_PT_MASK            0x00070000      /* port type[18:16] */
+#define        SRCI_PT_SHIFT           16
+/* port types : SRCI_PT_<processorPT>_<backplanePT> */
+#define SRCI_PT_OCP_OCP                0
+#define SRCI_PT_AXI_OCP                1
+#define SRCI_PT_ARM7AHB_OCP    2
+#define SRCI_PT_CM3AHB_OCP     3
+#define SRCI_PT_AXI_AXI                4
+#define SRCI_PT_AHB_AXI                5
+
+#define SRCI_LSS_MASK          0x00f00000
+#define SRCI_LSS_SHIFT         20
+#define SRCI_LRS_MASK          0x0f000000
+#define SRCI_LRS_SHIFT         24
+
+/* In corerev 0, the memory size is 2 to the power of the
+ * base plus 16 plus to the contents of the memsize field plus 1.
+ */
+#define        SRCI_MS0_MASK           0xf
+#define SR_MS0_BASE            16
+
+/*
+ * In corerev 1 the bank size is 2 ^ the bank size field plus 14,
+ * the memory size is number of banks times bank size.
+ * The same applies to rom size.
+ */
+#define        SRCI_ROMNB_MASK         0xf000
+#define        SRCI_ROMNB_SHIFT        12
+#define        SRCI_ROMBSZ_MASK        0xf00
+#define        SRCI_ROMBSZ_SHIFT       8
+#define        SRCI_SRNB_MASK          0xf0
+#define        SRCI_SRNB_SHIFT         4
+#define        SRCI_SRBSZ_MASK         0xf
+#define        SRCI_SRBSZ_SHIFT        0
+
+#define SR_BSZ_BASE            14
+
+/* Standby control register */
+#define        SRSC_SBYOVR_MASK        0x80000000
+#define        SRSC_SBYOVR_SHIFT       31
+#define        SRSC_SBYOVRVAL_MASK     0x60000000
+#define        SRSC_SBYOVRVAL_SHIFT    29
+#define        SRSC_SBYEN_MASK         0x01000000
+#define        SRSC_SBYEN_SHIFT        24
+
+/* Power control register */
+#define SRPC_PMU_STBYDIS_MASK  0x00000010
+#define SRPC_PMU_STBYDIS_SHIFT 4
+#define SRPC_STBYOVRVAL_MASK   0x00000008
+#define SRPC_STBYOVRVAL_SHIFT  3
+#define SRPC_STBYOVR_MASK      0x00000007
+#define SRPC_STBYOVR_SHIFT     0
+
+/* Extra core capability register */
+#define SRECC_NUM_BANKS_MASK   0x000000F0
+#define SRECC_NUM_BANKS_SHIFT  4
+#define SRECC_BANKSIZE_MASK    0x0000000F
+#define SRECC_BANKSIZE_SHIFT   0
+
+#define SRECC_BANKSIZE(value)   (1 << (value))
+
+/* CAM bank patch control */
+#define SRCBPC_PATCHENABLE 0x80000000
+
+#define SRP_ADDRESS   0x0001FFFC
+#define SRP_VALID     0x8000
+
+/* CAM bank command reg */
+#define SRCMD_WRITE  0x00020000
+#define SRCMD_READ   0x00010000
+#define SRCMD_DONE   0x80000000
+
+#define SRCMD_DONE_DLY 1000
+
+/* bankidx and bankinfo reg defines */
+#define SYSMEM_BANKINFO_SZMASK         0x7f
+#define SYSMEM_BANKIDX_ROM_MASK                0x100
+
+#define SYSMEM_BANKIDX_MEMTYPE_SHIFT   8
+/* sysmem bankinfo memtype */
+#define SYSMEM_MEMTYPE_RAM             0
+#define SYSMEM_MEMTYPE_R0M             1
+#define SYSMEM_MEMTYPE_DEVRAM          2
+
+#define        SYSMEM_BANKINFO_REG             0x40
+#define        SYSMEM_BANKIDX_REG              0x10
+#define        SYSMEM_BANKINFO_STDBY_MASK      0x400
+#define        SYSMEM_BANKINFO_STDBY_TIMER     0x800
+
+#define SYSMEM_BANKINFO_DEVRAMSEL_SHIFT                13
+#define SYSMEM_BANKINFO_DEVRAMSEL_MASK         0x2000
+#define SYSMEM_BANKINFO_DEVRAMPRO_SHIFT                14
+#define SYSMEM_BANKINFO_DEVRAMPRO_MASK         0x4000
+#define SYSMEM_BANKINFO_SLPSUPP_SHIFT          15
+#define SYSMEM_BANKINFO_SLPSUPP_MASK           0x8000
+#define SYSMEM_BANKINFO_RETNTRAM_SHIFT         16
+#define SYSMEM_BANKINFO_RETNTRAM_MASK          0x00010000
+#define SYSMEM_BANKINFO_PDASZ_SHIFT            17
+#define SYSMEM_BANKINFO_PDASZ_MASK             0x003E0000
+#define SYSMEM_BANKINFO_DEVRAMREMAP_SHIFT      24
+#define SYSMEM_BANKINFO_DEVRAMREMAP_MASK       0x01000000
+
+/* extracoreinfo register */
+#define SYSMEM_DEVRAMBANK_MASK         0xF000
+#define SYSMEM_DEVRAMBANK_SHIFT                12
+
+/* bank info to calculate bank size */
+#define        SYSMEM_BANKINFO_SZBASE          8192
+#define SYSMEM_BANKSIZE_SHIFT          13      /* SYSMEM_BANKINFO_SZBASE */
+
+#endif /* _SBSYSMEM_H */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/sdio.h b/drivers/net/wireless/bcmdhd_1363/include/sdio.h
new file mode 100644 (file)
index 0000000..2bb3366
--- /dev/null
@@ -0,0 +1,625 @@
+/*
+ * SDIO spec header file
+ * Protocol and standard (common) device definitions
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: sdio.h 514727 2014-11-12 03:02:48Z $
+ */
+
+#ifndef        _SDIO_H
+#define        _SDIO_H
+
+#ifdef BCMSDIO
+
+/* CCCR structure for function 0 */
+typedef volatile struct {
+       uint8   cccr_sdio_rev;          /* RO, cccr and sdio revision */
+       uint8   sd_rev;                 /* RO, sd spec revision */
+       uint8   io_en;                  /* I/O enable */
+       uint8   io_rdy;                 /* I/O ready reg */
+       uint8   intr_ctl;               /* Master and per function interrupt enable control */
+       uint8   intr_status;            /* RO, interrupt pending status */
+       uint8   io_abort;               /* read/write abort or reset all functions */
+       uint8   bus_inter;              /* bus interface control */
+       uint8   capability;             /* RO, card capability */
+
+       uint8   cis_base_low;           /* 0x9 RO, common CIS base address, LSB */
+       uint8   cis_base_mid;
+       uint8   cis_base_high;          /* 0xB RO, common CIS base address, MSB */
+
+       /* suspend/resume registers */
+       uint8   bus_suspend;            /* 0xC */
+       uint8   func_select;            /* 0xD */
+       uint8   exec_flag;              /* 0xE */
+       uint8   ready_flag;             /* 0xF */
+
+       uint8   fn0_blk_size[2];        /* 0x10(LSB), 0x11(MSB) */
+
+       uint8   power_control;          /* 0x12 (SDIO version 1.10) */
+
+       uint8   speed_control;          /* 0x13 */
+} sdio_regs_t;
+
+/* SDIO Device CCCR offsets */
+#define SDIOD_CCCR_REV                 0x00
+#define SDIOD_CCCR_SDREV               0x01
+#define SDIOD_CCCR_IOEN                        0x02
+#define SDIOD_CCCR_IORDY               0x03
+#define SDIOD_CCCR_INTEN               0x04
+#define SDIOD_CCCR_INTPEND             0x05
+#define SDIOD_CCCR_IOABORT             0x06
+#define SDIOD_CCCR_BICTRL              0x07
+#define SDIOD_CCCR_CAPABLITIES         0x08
+#define SDIOD_CCCR_CISPTR_0            0x09
+#define SDIOD_CCCR_CISPTR_1            0x0A
+#define SDIOD_CCCR_CISPTR_2            0x0B
+#define SDIOD_CCCR_BUSSUSP             0x0C
+#define SDIOD_CCCR_FUNCSEL             0x0D
+#define SDIOD_CCCR_EXECFLAGS           0x0E
+#define SDIOD_CCCR_RDYFLAGS            0x0F
+#define SDIOD_CCCR_BLKSIZE_0           0x10
+#define SDIOD_CCCR_BLKSIZE_1           0x11
+#define SDIOD_CCCR_POWER_CONTROL       0x12
+#define SDIOD_CCCR_SPEED_CONTROL       0x13
+#define SDIOD_CCCR_UHSI_SUPPORT                0x14
+#define SDIOD_CCCR_DRIVER_STRENGTH     0x15
+#define SDIOD_CCCR_INTR_EXTN           0x16
+
+/* Broadcom extensions (corerev >= 1) */
+#define SDIOD_CCCR_BRCM_CARDCAP                0xf0
+#define SDIOD_CCCR_BRCM_CARDCAP_CMD14_SUPPORT  0x02
+#define SDIOD_CCCR_BRCM_CARDCAP_CMD14_EXT      0x04
+#define SDIOD_CCCR_BRCM_CARDCAP_CMD_NODEC      0x08
+#define SDIOD_CCCR_BRCM_CARDCTL                        0xf1
+#define SDIOD_CCCR_BRCM_SEPINT                 0xf2
+
+/* cccr_sdio_rev */
+#define SDIO_REV_SDIOID_MASK   0xf0    /* SDIO spec revision number */
+#define SDIO_REV_CCCRID_MASK   0x0f    /* CCCR format version number */
+#define SDIO_SPEC_VERSION_3_0  0x40    /* SDIO spec version 3.0 */
+
+/* sd_rev */
+#define SD_REV_PHY_MASK                0x0f    /* SD format version number */
+
+/* io_en */
+#define SDIO_FUNC_ENABLE_1     0x02    /* function 1 I/O enable */
+#define SDIO_FUNC_ENABLE_2     0x04    /* function 2 I/O enable */
+
+/* io_rdys */
+#define SDIO_FUNC_READY_1      0x02    /* function 1 I/O ready */
+#define SDIO_FUNC_READY_2      0x04    /* function 2 I/O ready */
+
+/* intr_ctl */
+#define INTR_CTL_MASTER_EN     0x1     /* interrupt enable master */
+#define INTR_CTL_FUNC1_EN      0x2     /* interrupt enable for function 1 */
+#define INTR_CTL_FUNC2_EN      0x4     /* interrupt enable for function 2 */
+
+/* intr_status */
+#define INTR_STATUS_FUNC1      0x2     /* interrupt pending for function 1 */
+#define INTR_STATUS_FUNC2      0x4     /* interrupt pending for function 2 */
+
+/* io_abort */
+#define IO_ABORT_RESET_ALL     0x08    /* I/O card reset */
+#define IO_ABORT_FUNC_MASK     0x07    /* abort selction: function x */
+
+/* bus_inter */
+#define BUS_CARD_DETECT_DIS    0x80    /* Card Detect disable */
+#define BUS_SPI_CONT_INTR_CAP  0x40    /* support continuous SPI interrupt */
+#define BUS_SPI_CONT_INTR_EN   0x20    /* continuous SPI interrupt enable */
+#define BUS_SD_DATA_WIDTH_MASK 0x03    /* bus width mask */
+#define BUS_SD_DATA_WIDTH_4BIT 0x02    /* bus width 4-bit mode */
+#define BUS_SD_DATA_WIDTH_1BIT 0x00    /* bus width 1-bit mode */
+
+/* capability */
+#define SDIO_CAP_4BLS          0x80    /* 4-bit support for low speed card */
+#define SDIO_CAP_LSC           0x40    /* low speed card */
+#define SDIO_CAP_E4MI          0x20    /* enable interrupt between block of data in 4-bit mode */
+#define SDIO_CAP_S4MI          0x10    /* support interrupt between block of data in 4-bit mode */
+#define SDIO_CAP_SBS           0x08    /* support suspend/resume */
+#define SDIO_CAP_SRW           0x04    /* support read wait */
+#define SDIO_CAP_SMB           0x02    /* support multi-block transfer */
+#define SDIO_CAP_SDC           0x01    /* Support Direct commands during multi-byte transfer */
+
+/* power_control */
+#define SDIO_POWER_SMPC                0x01    /* supports master power control (RO) */
+#define SDIO_POWER_EMPC                0x02    /* enable master power control (allow > 200mA) (RW) */
+
+/* speed_control (control device entry into high-speed clocking mode) */
+#define SDIO_SPEED_SHS         0x01    /* supports high-speed [clocking] mode (RO) */
+#define SDIO_SPEED_EHS         0x02    /* enable high-speed [clocking] mode (RW) */
+#define SDIO_SPEED_UHSI_DDR50     0x08
+
+/* for setting bus speed in card: 0x13h */
+#define SDIO_BUS_SPEED_UHSISEL_M       BITFIELD_MASK(3)
+#define SDIO_BUS_SPEED_UHSISEL_S       1
+
+/* for getting bus speed cap in card: 0x14h */
+#define SDIO_BUS_SPEED_UHSICAP_M       BITFIELD_MASK(3)
+#define SDIO_BUS_SPEED_UHSICAP_S       0
+
+/* for getting driver type CAP in card: 0x15h */
+#define SDIO_BUS_DRVR_TYPE_CAP_M       BITFIELD_MASK(3)
+#define SDIO_BUS_DRVR_TYPE_CAP_S       0
+
+/* for setting driver type selection in card: 0x15h */
+#define SDIO_BUS_DRVR_TYPE_SEL_M       BITFIELD_MASK(2)
+#define SDIO_BUS_DRVR_TYPE_SEL_S       4
+
+/* for getting async int support in card: 0x16h */
+#define SDIO_BUS_ASYNCINT_CAP_M        BITFIELD_MASK(1)
+#define SDIO_BUS_ASYNCINT_CAP_S        0
+
+/* for setting async int selection in card: 0x16h */
+#define SDIO_BUS_ASYNCINT_SEL_M        BITFIELD_MASK(1)
+#define SDIO_BUS_ASYNCINT_SEL_S        1
+
+/* brcm sepint */
+#define SDIO_SEPINT_MASK       0x01    /* route sdpcmdev intr onto separate pad (chip-specific) */
+#define SDIO_SEPINT_OE         0x02    /* 1 asserts output enable for above pad */
+#define SDIO_SEPINT_ACT_HI     0x04    /* use active high interrupt level instead of active low */
+
+/* FBR structure for function 1-7, FBR addresses and register offsets */
+typedef volatile struct {
+       uint8   devctr;                 /* device interface, CSA control */
+       uint8   ext_dev;                /* extended standard I/O device type code */
+       uint8   pwr_sel;                /* power selection support */
+       uint8   PAD[6];                 /* reserved */
+
+       uint8   cis_low;                /* CIS LSB */
+       uint8   cis_mid;
+       uint8   cis_high;               /* CIS MSB */
+       uint8   csa_low;                /* code storage area, LSB */
+       uint8   csa_mid;
+       uint8   csa_high;               /* code storage area, MSB */
+       uint8   csa_dat_win;            /* data access window to function */
+
+       uint8   fnx_blk_size[2];        /* block size, little endian */
+} sdio_fbr_t;
+
+/* Maximum number of I/O funcs */
+#define SDIOD_MAX_FUNCS                        8
+#define SDIOD_MAX_IOFUNCS              7
+
+/* SDIO Device FBR Start Address  */
+#define SDIOD_FBR_STARTADDR            0x100
+
+/* SDIO Device FBR Size */
+#define SDIOD_FBR_SIZE                 0x100
+
+/* Macro to calculate FBR register base */
+#define SDIOD_FBR_BASE(n)              ((n) * 0x100)
+
+/* Function register offsets */
+#define SDIOD_FBR_DEVCTR               0x00    /* basic info for function */
+#define SDIOD_FBR_EXT_DEV              0x01    /* extended I/O device code */
+#define SDIOD_FBR_PWR_SEL              0x02    /* power selection bits */
+
+/* SDIO Function CIS ptr offset */
+#define SDIOD_FBR_CISPTR_0             0x09
+#define SDIOD_FBR_CISPTR_1             0x0A
+#define SDIOD_FBR_CISPTR_2             0x0B
+
+/* Code Storage Area pointer */
+#define SDIOD_FBR_CSA_ADDR_0           0x0C
+#define SDIOD_FBR_CSA_ADDR_1           0x0D
+#define SDIOD_FBR_CSA_ADDR_2           0x0E
+#define SDIOD_FBR_CSA_DATA             0x0F
+
+/* SDIO Function I/O Block Size */
+#define SDIOD_FBR_BLKSIZE_0            0x10
+#define SDIOD_FBR_BLKSIZE_1            0x11
+
+/* devctr */
+#define SDIOD_FBR_DEVCTR_DIC   0x0f    /* device interface code */
+#define SDIOD_FBR_DECVTR_CSA   0x40    /* CSA support flag */
+#define SDIOD_FBR_DEVCTR_CSA_EN        0x80    /* CSA enabled */
+/* interface codes */
+#define SDIOD_DIC_NONE         0       /* SDIO standard interface is not supported */
+#define SDIOD_DIC_UART         1
+#define SDIOD_DIC_BLUETOOTH_A  2
+#define SDIOD_DIC_BLUETOOTH_B  3
+#define SDIOD_DIC_GPS          4
+#define SDIOD_DIC_CAMERA       5
+#define SDIOD_DIC_PHS          6
+#define SDIOD_DIC_WLAN         7
+#define SDIOD_DIC_EXT          0xf     /* extended device interface, read ext_dev register */
+
+/* pwr_sel */
+#define SDIOD_PWR_SEL_SPS      0x01    /* supports power selection */
+#define SDIOD_PWR_SEL_EPS      0x02    /* enable power selection (low-current mode) */
+
+/* misc defines */
+#define SDIO_FUNC_0            0
+#define SDIO_FUNC_1            1
+#define SDIO_FUNC_2            2
+#define SDIO_FUNC_3            3
+#define SDIO_FUNC_4            4
+#define SDIO_FUNC_5            5
+#define SDIO_FUNC_6            6
+#define SDIO_FUNC_7            7
+
+#define SD_CARD_TYPE_UNKNOWN   0       /* bad type or unrecognized */
+#define SD_CARD_TYPE_IO                1       /* IO only card */
+#define SD_CARD_TYPE_MEMORY    2       /* memory only card */
+#define SD_CARD_TYPE_COMBO     3       /* IO and memory combo card */
+
+#define SDIO_MAX_BLOCK_SIZE    2048    /* maximum block size for block mode operation */
+#define SDIO_MIN_BLOCK_SIZE    1       /* minimum block size for block mode operation */
+
+/* Card registers: status bit position */
+#define CARDREG_STATUS_BIT_OUTOFRANGE          31
+#define CARDREG_STATUS_BIT_COMCRCERROR         23
+#define CARDREG_STATUS_BIT_ILLEGALCOMMAND      22
+#define CARDREG_STATUS_BIT_ERROR               19
+#define CARDREG_STATUS_BIT_IOCURRENTSTATE3     12
+#define CARDREG_STATUS_BIT_IOCURRENTSTATE2     11
+#define CARDREG_STATUS_BIT_IOCURRENTSTATE1     10
+#define CARDREG_STATUS_BIT_IOCURRENTSTATE0     9
+#define CARDREG_STATUS_BIT_FUN_NUM_ERROR       4
+
+
+
+#define SD_CMD_GO_IDLE_STATE           0       /* mandatory for SDIO */
+#define SD_CMD_SEND_OPCOND             1
+#define SD_CMD_MMC_SET_RCA             3
+#define SD_CMD_IO_SEND_OP_COND         5       /* mandatory for SDIO */
+#define SD_CMD_SELECT_DESELECT_CARD    7
+#define SD_CMD_SEND_CSD                        9
+#define SD_CMD_SEND_CID                        10
+#define SD_CMD_STOP_TRANSMISSION       12
+#define SD_CMD_SEND_STATUS             13
+#define SD_CMD_GO_INACTIVE_STATE       15
+#define SD_CMD_SET_BLOCKLEN            16
+#define SD_CMD_READ_SINGLE_BLOCK       17
+#define SD_CMD_READ_MULTIPLE_BLOCK     18
+#define SD_CMD_WRITE_BLOCK             24
+#define SD_CMD_WRITE_MULTIPLE_BLOCK    25
+#define SD_CMD_PROGRAM_CSD             27
+#define SD_CMD_SET_WRITE_PROT          28
+#define SD_CMD_CLR_WRITE_PROT          29
+#define SD_CMD_SEND_WRITE_PROT         30
+#define SD_CMD_ERASE_WR_BLK_START      32
+#define SD_CMD_ERASE_WR_BLK_END                33
+#define SD_CMD_ERASE                   38
+#define SD_CMD_LOCK_UNLOCK             42
+#define SD_CMD_IO_RW_DIRECT            52      /* mandatory for SDIO */
+#define SD_CMD_IO_RW_EXTENDED          53      /* mandatory for SDIO */
+#define SD_CMD_APP_CMD                 55
+#define SD_CMD_GEN_CMD                 56
+#define SD_CMD_READ_OCR                        58
+#define SD_CMD_CRC_ON_OFF              59      /* mandatory for SDIO */
+#define SD_ACMD_SD_STATUS              13
+#define SD_ACMD_SEND_NUM_WR_BLOCKS     22
+#define SD_ACMD_SET_WR_BLOCK_ERASE_CNT 23
+#define SD_ACMD_SD_SEND_OP_COND                41
+#define SD_ACMD_SET_CLR_CARD_DETECT    42
+#define SD_ACMD_SEND_SCR               51
+
+/* argument for SD_CMD_IO_RW_DIRECT and SD_CMD_IO_RW_EXTENDED */
+#define SD_IO_OP_READ          0   /* Read_Write: Read */
+#define SD_IO_OP_WRITE         1   /* Read_Write: Write */
+#define SD_IO_RW_NORMAL                0   /* no RAW */
+#define SD_IO_RW_RAW           1   /* RAW */
+#define SD_IO_BYTE_MODE                0   /* Byte Mode */
+#define SD_IO_BLOCK_MODE       1   /* BlockMode */
+#define SD_IO_FIXED_ADDRESS    0   /* fix Address */
+#define SD_IO_INCREMENT_ADDRESS        1   /* IncrementAddress */
+
+/* build SD_CMD_IO_RW_DIRECT Argument */
+#define SDIO_IO_RW_DIRECT_ARG(rw, raw, func, addr, data) \
+       ((((rw) & 1) << 31) | (((func) & 0x7) << 28) | (((raw) & 1) << 27) | \
+        (((addr) & 0x1FFFF) << 9) | ((data) & 0xFF))
+
+/* build SD_CMD_IO_RW_EXTENDED Argument */
+#define SDIO_IO_RW_EXTENDED_ARG(rw, blk, func, addr, inc_addr, count) \
+       ((((rw) & 1) << 31) | (((func) & 0x7) << 28) | (((blk) & 1) << 27) | \
+        (((inc_addr) & 1) << 26) | (((addr) & 0x1FFFF) << 9) | ((count) & 0x1FF))
+
+/* SDIO response parameters */
+#define SD_RSP_NO_NONE                 0
+#define SD_RSP_NO_1                    1
+#define SD_RSP_NO_2                    2
+#define SD_RSP_NO_3                    3
+#define SD_RSP_NO_4                    4
+#define SD_RSP_NO_5                    5
+#define SD_RSP_NO_6                    6
+
+       /* Modified R6 response (to CMD3) */
+#define SD_RSP_MR6_COM_CRC_ERROR       0x8000
+#define SD_RSP_MR6_ILLEGAL_COMMAND     0x4000
+#define SD_RSP_MR6_ERROR               0x2000
+
+       /* Modified R1 in R4 Response (to CMD5) */
+#define SD_RSP_MR1_SBIT                        0x80
+#define SD_RSP_MR1_PARAMETER_ERROR     0x40
+#define SD_RSP_MR1_RFU5                        0x20
+#define SD_RSP_MR1_FUNC_NUM_ERROR      0x10
+#define SD_RSP_MR1_COM_CRC_ERROR       0x08
+#define SD_RSP_MR1_ILLEGAL_COMMAND     0x04
+#define SD_RSP_MR1_RFU1                        0x02
+#define SD_RSP_MR1_IDLE_STATE          0x01
+
+       /* R5 response (to CMD52 and CMD53) */
+#define SD_RSP_R5_COM_CRC_ERROR                0x80
+#define SD_RSP_R5_ILLEGAL_COMMAND      0x40
+#define SD_RSP_R5_IO_CURRENTSTATE1     0x20
+#define SD_RSP_R5_IO_CURRENTSTATE0     0x10
+#define SD_RSP_R5_ERROR                        0x08
+#define SD_RSP_R5_RFU                  0x04
+#define SD_RSP_R5_FUNC_NUM_ERROR       0x02
+#define SD_RSP_R5_OUT_OF_RANGE         0x01
+
+#define SD_RSP_R5_ERRBITS              0xCB
+
+
+/* ------------------------------------------------
+ *  SDIO Commands and responses
+ *
+ *  I/O only commands are:
+ *      CMD0, CMD3, CMD5, CMD7, CMD14, CMD15, CMD52, CMD53
+ * ------------------------------------------------
+ */
+
+/* SDIO Commands */
+#define SDIOH_CMD_0            0
+#define SDIOH_CMD_3            3
+#define SDIOH_CMD_5            5
+#define SDIOH_CMD_7            7
+#define SDIOH_CMD_11           11
+#define SDIOH_CMD_14           14
+#define SDIOH_CMD_15           15
+#define SDIOH_CMD_19           19
+#define SDIOH_CMD_52           52
+#define SDIOH_CMD_53           53
+#define SDIOH_CMD_59           59
+
+/* SDIO Command Responses */
+#define SDIOH_RSP_NONE         0
+#define SDIOH_RSP_R1           1
+#define SDIOH_RSP_R2           2
+#define SDIOH_RSP_R3           3
+#define SDIOH_RSP_R4           4
+#define SDIOH_RSP_R5           5
+#define SDIOH_RSP_R6           6
+
+/*
+ *  SDIO Response Error flags
+ */
+#define SDIOH_RSP5_ERROR_FLAGS 0xCB
+
+/* ------------------------------------------------
+ * SDIO Command structures. I/O only commands are:
+ *
+ *     CMD0, CMD3, CMD5, CMD7, CMD15, CMD52, CMD53
+ * ------------------------------------------------
+ */
+
+#define CMD5_OCR_M             BITFIELD_MASK(24)
+#define CMD5_OCR_S             0
+
+#define CMD5_S18R_M            BITFIELD_MASK(1)
+#define CMD5_S18R_S            24
+
+#define CMD7_RCA_M             BITFIELD_MASK(16)
+#define CMD7_RCA_S             16
+
+#define CMD14_RCA_M            BITFIELD_MASK(16)
+#define CMD14_RCA_S            16
+#define CMD14_SLEEP_M          BITFIELD_MASK(1)
+#define CMD14_SLEEP_S          15
+
+#define CMD_15_RCA_M           BITFIELD_MASK(16)
+#define CMD_15_RCA_S           16
+
+#define CMD52_DATA_M           BITFIELD_MASK(8)  /* Bits [7:0]    - Write Data/Stuff bits of CMD52
+                                                  */
+#define CMD52_DATA_S           0
+#define CMD52_REG_ADDR_M       BITFIELD_MASK(17) /* Bits [25:9]   - register address */
+#define CMD52_REG_ADDR_S       9
+#define CMD52_RAW_M            BITFIELD_MASK(1)  /* Bit  27       - Read after Write flag */
+#define CMD52_RAW_S            27
+#define CMD52_FUNCTION_M       BITFIELD_MASK(3)  /* Bits [30:28]  - Function number */
+#define CMD52_FUNCTION_S       28
+#define CMD52_RW_FLAG_M                BITFIELD_MASK(1)  /* Bit  31       - R/W flag */
+#define CMD52_RW_FLAG_S                31
+
+
+#define CMD53_BYTE_BLK_CNT_M   BITFIELD_MASK(9) /* Bits [8:0]     - Byte/Block Count of CMD53 */
+#define CMD53_BYTE_BLK_CNT_S   0
+#define CMD53_REG_ADDR_M       BITFIELD_MASK(17) /* Bits [25:9]   - register address */
+#define CMD53_REG_ADDR_S       9
+#define CMD53_OP_CODE_M                BITFIELD_MASK(1)  /* Bit  26       - R/W Operation Code */
+#define CMD53_OP_CODE_S                26
+#define CMD53_BLK_MODE_M       BITFIELD_MASK(1)  /* Bit  27       - Block Mode */
+#define CMD53_BLK_MODE_S       27
+#define CMD53_FUNCTION_M       BITFIELD_MASK(3)  /* Bits [30:28]  - Function number */
+#define CMD53_FUNCTION_S       28
+#define CMD53_RW_FLAG_M                BITFIELD_MASK(1)  /* Bit  31       - R/W flag */
+#define CMD53_RW_FLAG_S                31
+
+/* ------------------------------------------------------
+ * SDIO Command Response structures for SD1 and SD4 modes
+ *  -----------------------------------------------------
+ */
+#define RSP4_IO_OCR_M          BITFIELD_MASK(24) /* Bits [23:0]  - Card's OCR Bits [23:0] */
+#define RSP4_IO_OCR_S          0
+
+#define RSP4_S18A_M                    BITFIELD_MASK(1) /* Bits [23:0]  - Card's OCR Bits [23:0] */
+#define RSP4_S18A_S                    24
+
+#define RSP4_STUFF_M           BITFIELD_MASK(3)  /* Bits [26:24] - Stuff bits */
+#define RSP4_STUFF_S           24
+#define RSP4_MEM_PRESENT_M     BITFIELD_MASK(1)  /* Bit  27      - Memory present */
+#define RSP4_MEM_PRESENT_S     27
+#define RSP4_NUM_FUNCS_M       BITFIELD_MASK(3)  /* Bits [30:28] - Number of I/O funcs */
+#define RSP4_NUM_FUNCS_S       28
+#define RSP4_CARD_READY_M      BITFIELD_MASK(1)  /* Bit  31      - SDIO card ready */
+#define RSP4_CARD_READY_S      31
+
+#define RSP6_STATUS_M          BITFIELD_MASK(16) /* Bits [15:0]  - Card status bits [19,22,23,12:0]
+                                                  */
+#define RSP6_STATUS_S          0
+#define RSP6_IO_RCA_M          BITFIELD_MASK(16) /* Bits [31:16] - RCA bits[31-16] */
+#define RSP6_IO_RCA_S          16
+
+#define RSP1_AKE_SEQ_ERROR_M   BITFIELD_MASK(1)  /* Bit 3       - Authentication seq error */
+#define RSP1_AKE_SEQ_ERROR_S   3
+#define RSP1_APP_CMD_M         BITFIELD_MASK(1)  /* Bit 5       - Card expects ACMD */
+#define RSP1_APP_CMD_S         5
+#define RSP1_READY_FOR_DATA_M  BITFIELD_MASK(1)  /* Bit 8       - Ready for data (buff empty) */
+#define RSP1_READY_FOR_DATA_S  8
+#define RSP1_CURR_STATE_M      BITFIELD_MASK(4)  /* Bits [12:9] - State of card
+                                                  * when Cmd was received
+                                                  */
+#define RSP1_CURR_STATE_S      9
+#define RSP1_EARSE_RESET_M     BITFIELD_MASK(1)  /* Bit 13   - Erase seq cleared */
+#define RSP1_EARSE_RESET_S     13
+#define RSP1_CARD_ECC_DISABLE_M        BITFIELD_MASK(1)  /* Bit 14   - Card ECC disabled */
+#define RSP1_CARD_ECC_DISABLE_S        14
+#define RSP1_WP_ERASE_SKIP_M   BITFIELD_MASK(1)  /* Bit 15   - Partial blocks erased due to W/P */
+#define RSP1_WP_ERASE_SKIP_S   15
+#define RSP1_CID_CSD_OVERW_M   BITFIELD_MASK(1)  /* Bit 16   - Illegal write to CID or R/O bits
+                                                  * of CSD
+                                                  */
+#define RSP1_CID_CSD_OVERW_S   16
+#define RSP1_ERROR_M           BITFIELD_MASK(1)  /* Bit 19   - General/Unknown error */
+#define RSP1_ERROR_S           19
+#define RSP1_CC_ERROR_M                BITFIELD_MASK(1)  /* Bit 20   - Internal Card Control error */
+#define RSP1_CC_ERROR_S                20
+#define RSP1_CARD_ECC_FAILED_M BITFIELD_MASK(1)  /* Bit 21   - Card internal ECC failed
+                                                  * to correct data
+                                                  */
+#define RSP1_CARD_ECC_FAILED_S 21
+#define RSP1_ILLEGAL_CMD_M     BITFIELD_MASK(1)  /* Bit 22   - Cmd not legal for the card state */
+#define RSP1_ILLEGAL_CMD_S     22
+#define RSP1_COM_CRC_ERROR_M   BITFIELD_MASK(1)  /* Bit 23   - CRC check of previous command failed
+                                                  */
+#define RSP1_COM_CRC_ERROR_S   23
+#define RSP1_LOCK_UNLOCK_FAIL_M        BITFIELD_MASK(1)  /* Bit 24   - Card lock-unlock Cmd Seq error */
+#define RSP1_LOCK_UNLOCK_FAIL_S        24
+#define RSP1_CARD_LOCKED_M     BITFIELD_MASK(1)  /* Bit 25   - Card locked by the host */
+#define RSP1_CARD_LOCKED_S     25
+#define RSP1_WP_VIOLATION_M    BITFIELD_MASK(1)  /* Bit 26   - Attempt to program
+                                                  * write-protected blocks
+                                                  */
+#define RSP1_WP_VIOLATION_S    26
+#define RSP1_ERASE_PARAM_M     BITFIELD_MASK(1)  /* Bit 27   - Invalid erase blocks */
+#define RSP1_ERASE_PARAM_S     27
+#define RSP1_ERASE_SEQ_ERR_M   BITFIELD_MASK(1)  /* Bit 28   - Erase Cmd seq error */
+#define RSP1_ERASE_SEQ_ERR_S   28
+#define RSP1_BLK_LEN_ERR_M     BITFIELD_MASK(1)  /* Bit 29   - Block length error */
+#define RSP1_BLK_LEN_ERR_S     29
+#define RSP1_ADDR_ERR_M                BITFIELD_MASK(1)  /* Bit 30   - Misaligned address */
+#define RSP1_ADDR_ERR_S                30
+#define RSP1_OUT_OF_RANGE_M    BITFIELD_MASK(1)  /* Bit 31   - Cmd arg was out of range */
+#define RSP1_OUT_OF_RANGE_S    31
+
+
+#define RSP5_DATA_M            BITFIELD_MASK(8)  /* Bits [0:7]   - data */
+#define RSP5_DATA_S            0
+#define RSP5_FLAGS_M           BITFIELD_MASK(8)  /* Bit  [15:8]  - Rsp flags */
+#define RSP5_FLAGS_S           8
+#define RSP5_STUFF_M           BITFIELD_MASK(16) /* Bits [31:16] - Stuff bits */
+#define RSP5_STUFF_S           16
+
+/* ----------------------------------------------
+ * SDIO Command Response structures for SPI mode
+ * ----------------------------------------------
+ */
+#define SPIRSP4_IO_OCR_M       BITFIELD_MASK(16) /* Bits [15:0]    - Card's OCR Bits [23:8] */
+#define SPIRSP4_IO_OCR_S       0
+#define SPIRSP4_STUFF_M                BITFIELD_MASK(3)  /* Bits [18:16]   - Stuff bits */
+#define SPIRSP4_STUFF_S                16
+#define SPIRSP4_MEM_PRESENT_M  BITFIELD_MASK(1)  /* Bit  19        - Memory present */
+#define SPIRSP4_MEM_PRESENT_S  19
+#define SPIRSP4_NUM_FUNCS_M    BITFIELD_MASK(3)  /* Bits [22:20]   - Number of I/O funcs */
+#define SPIRSP4_NUM_FUNCS_S    20
+#define SPIRSP4_CARD_READY_M   BITFIELD_MASK(1)  /* Bit  23        - SDIO card ready */
+#define SPIRSP4_CARD_READY_S   23
+#define SPIRSP4_IDLE_STATE_M   BITFIELD_MASK(1)  /* Bit  24        - idle state */
+#define SPIRSP4_IDLE_STATE_S   24
+#define SPIRSP4_ILLEGAL_CMD_M  BITFIELD_MASK(1)  /* Bit  26        - Illegal Cmd error */
+#define SPIRSP4_ILLEGAL_CMD_S  26
+#define SPIRSP4_COM_CRC_ERROR_M        BITFIELD_MASK(1)  /* Bit  27        - COM CRC error */
+#define SPIRSP4_COM_CRC_ERROR_S        27
+#define SPIRSP4_FUNC_NUM_ERROR_M       BITFIELD_MASK(1)  /* Bit  28        - Function number error
+                                                          */
+#define SPIRSP4_FUNC_NUM_ERROR_S       28
+#define SPIRSP4_PARAM_ERROR_M  BITFIELD_MASK(1)  /* Bit  30        - Parameter Error Bit */
+#define SPIRSP4_PARAM_ERROR_S  30
+#define SPIRSP4_START_BIT_M    BITFIELD_MASK(1)  /* Bit  31        - Start Bit */
+#define SPIRSP4_START_BIT_S    31
+
+#define SPIRSP5_DATA_M                 BITFIELD_MASK(8)  /* Bits [23:16]   - R/W Data */
+#define SPIRSP5_DATA_S                 16
+#define SPIRSP5_IDLE_STATE_M           BITFIELD_MASK(1)  /* Bit  24        - Idle state */
+#define SPIRSP5_IDLE_STATE_S           24
+#define SPIRSP5_ILLEGAL_CMD_M          BITFIELD_MASK(1)  /* Bit  26        - Illegal Cmd error */
+#define SPIRSP5_ILLEGAL_CMD_S          26
+#define SPIRSP5_COM_CRC_ERROR_M                BITFIELD_MASK(1)  /* Bit  27        - COM CRC error */
+#define SPIRSP5_COM_CRC_ERROR_S                27
+#define SPIRSP5_FUNC_NUM_ERROR_M       BITFIELD_MASK(1)  /* Bit  28        - Function number error
+                                                          */
+#define SPIRSP5_FUNC_NUM_ERROR_S       28
+#define SPIRSP5_PARAM_ERROR_M          BITFIELD_MASK(1)  /* Bit  30        - Parameter Error Bit */
+#define SPIRSP5_PARAM_ERROR_S          30
+#define SPIRSP5_START_BIT_M            BITFIELD_MASK(1)  /* Bit  31        - Start Bit */
+#define SPIRSP5_START_BIT_S            31
+
+/* RSP6 card status format; Pg 68 Physical Layer spec v 1.10 */
+#define RSP6STAT_AKE_SEQ_ERROR_M       BITFIELD_MASK(1)  /* Bit 3      - Authentication seq error
+                                                          */
+#define RSP6STAT_AKE_SEQ_ERROR_S       3
+#define RSP6STAT_APP_CMD_M             BITFIELD_MASK(1)  /* Bit 5      - Card expects ACMD */
+#define RSP6STAT_APP_CMD_S             5
+#define RSP6STAT_READY_FOR_DATA_M      BITFIELD_MASK(1)  /* Bit 8      - Ready for data
+                                                          * (buff empty)
+                                                          */
+#define RSP6STAT_READY_FOR_DATA_S      8
+#define RSP6STAT_CURR_STATE_M          BITFIELD_MASK(4)  /* Bits [12:9] - Card state at
+                                                          * Cmd reception
+                                                          */
+#define RSP6STAT_CURR_STATE_S          9
+#define RSP6STAT_ERROR_M               BITFIELD_MASK(1)  /* Bit 13  - General/Unknown error Bit 19
+                                                          */
+#define RSP6STAT_ERROR_S               13
+#define RSP6STAT_ILLEGAL_CMD_M         BITFIELD_MASK(1)  /* Bit 14  - Illegal cmd for
+                                                          * card state Bit 22
+                                                          */
+#define RSP6STAT_ILLEGAL_CMD_S         14
+#define RSP6STAT_COM_CRC_ERROR_M       BITFIELD_MASK(1)  /* Bit 15  - CRC previous command
+                                                          * failed Bit 23
+                                                          */
+#define RSP6STAT_COM_CRC_ERROR_S       15
+
+#define SDIOH_XFER_TYPE_READ    SD_IO_OP_READ
+#define SDIOH_XFER_TYPE_WRITE   SD_IO_OP_WRITE
+
+/* command issue options */
+#define CMD_OPTION_DEFAULT     0
+#define CMD_OPTION_TUNING      1
+
+#endif /* def BCMSDIO */
+#endif /* _SDIO_H */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/sdioh.h b/drivers/net/wireless/bcmdhd_1363/include/sdioh.h
new file mode 100644 (file)
index 0000000..f37c5f6
--- /dev/null
@@ -0,0 +1,448 @@
+/*
+ * SDIO Host Controller Spec header file
+ * Register map and definitions for the Standard Host Controller
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: sdioh.h 514727 2014-11-12 03:02:48Z $
+ */
+
+#ifndef        _SDIOH_H
+#define        _SDIOH_H
+
+#define SD_SysAddr                     0x000
+#define SD_BlockSize                   0x004
+#define SD_BlockCount                  0x006
+#define SD_Arg0                                0x008
+#define SD_Arg1                        0x00A
+#define SD_TransferMode                        0x00C
+#define SD_Command                     0x00E
+#define SD_Response0                   0x010
+#define SD_Response1                   0x012
+#define SD_Response2                   0x014
+#define SD_Response3                   0x016
+#define SD_Response4                   0x018
+#define SD_Response5                   0x01A
+#define SD_Response6                   0x01C
+#define SD_Response7                   0x01E
+#define SD_BufferDataPort0             0x020
+#define SD_BufferDataPort1             0x022
+#define SD_PresentState                        0x024
+#define SD_HostCntrl                   0x028
+#define SD_PwrCntrl                    0x029
+#define SD_BlockGapCntrl               0x02A
+#define SD_WakeupCntrl                         0x02B
+#define SD_ClockCntrl                  0x02C
+#define SD_TimeoutCntrl                0x02E
+#define SD_SoftwareReset               0x02F
+#define SD_IntrStatus                  0x030
+#define SD_ErrorIntrStatus             0x032
+#define SD_IntrStatusEnable            0x034
+#define SD_ErrorIntrStatusEnable       0x036
+#define SD_IntrSignalEnable            0x038
+#define SD_ErrorIntrSignalEnable       0x03A
+#define SD_CMD12ErrorStatus            0x03C
+#define SD_Capabilities                        0x040
+#define SD_Capabilities3               0x044
+#define SD_MaxCurCap                   0x048
+#define SD_MaxCurCap_Reserved          0x04C
+#define SD_ADMA_ErrStatus              0x054
+#define SD_ADMA_SysAddr                        0x58
+#define SD_SlotInterruptStatus         0x0FC
+#define SD_HostControllerVersion       0x0FE
+#define        SD_GPIO_Reg                     0x100
+#define        SD_GPIO_OE                      0x104
+#define        SD_GPIO_Enable                  0x108
+
+/* SD specific registers in PCI config space */
+#define SD_SlotInfo    0x40
+
+/* HC 3.0 specific registers and offsets */
+#define SD3_HostCntrl2                 0x03E
+/* preset regsstart and count */
+#define SD3_PresetValStart             0x060
+#define SD3_PresetValCount             8
+/* preset-indiv regs */
+#define SD3_PresetVal_init             0x060
+#define SD3_PresetVal_default  0x062
+#define SD3_PresetVal_HS               0x064
+#define SD3_PresetVal_SDR12            0x066
+#define SD3_PresetVal_SDR25            0x068
+#define SD3_PresetVal_SDR50            0x06a
+#define SD3_PresetVal_SDR104   0x06c
+#define SD3_PresetVal_DDR50            0x06e
+/* SDIO3.0 Revx specific Registers */
+#define SD3_Tuning_Info_Register 0x0EC
+#define SD3_WL_BT_reset_register 0x0F0
+
+
+/* preset value indices */
+#define SD3_PRESETVAL_INITIAL_IX       0
+#define SD3_PRESETVAL_DESPEED_IX       1
+#define SD3_PRESETVAL_HISPEED_IX       2
+#define SD3_PRESETVAL_SDR12_IX         3
+#define SD3_PRESETVAL_SDR25_IX         4
+#define SD3_PRESETVAL_SDR50_IX         5
+#define SD3_PRESETVAL_SDR104_IX                6
+#define SD3_PRESETVAL_DDR50_IX         7
+
+/* SD_Capabilities reg (0x040) */
+#define CAP_TO_CLKFREQ_M       BITFIELD_MASK(6)
+#define CAP_TO_CLKFREQ_S       0
+#define CAP_TO_CLKUNIT_M       BITFIELD_MASK(1)
+#define CAP_TO_CLKUNIT_S       7
+/* Note: for sdio-2.0 case, this mask has to be 6 bits, but msb 2
+       bits are reserved. going ahead with 8 bits, as it is req for 3.0
+*/
+#define CAP_BASECLK_M          BITFIELD_MASK(8)
+#define CAP_BASECLK_S          8
+#define CAP_MAXBLOCK_M                 BITFIELD_MASK(2)
+#define CAP_MAXBLOCK_S         16
+#define CAP_ADMA2_M            BITFIELD_MASK(1)
+#define CAP_ADMA2_S            19
+#define CAP_ADMA1_M            BITFIELD_MASK(1)
+#define CAP_ADMA1_S            20
+#define CAP_HIGHSPEED_M                BITFIELD_MASK(1)
+#define CAP_HIGHSPEED_S                21
+#define CAP_DMA_M              BITFIELD_MASK(1)
+#define CAP_DMA_S              22
+#define CAP_SUSPEND_M          BITFIELD_MASK(1)
+#define CAP_SUSPEND_S          23
+#define CAP_VOLT_3_3_M         BITFIELD_MASK(1)
+#define CAP_VOLT_3_3_S         24
+#define CAP_VOLT_3_0_M         BITFIELD_MASK(1)
+#define CAP_VOLT_3_0_S         25
+#define CAP_VOLT_1_8_M         BITFIELD_MASK(1)
+#define CAP_VOLT_1_8_S         26
+#define CAP_64BIT_HOST_M       BITFIELD_MASK(1)
+#define CAP_64BIT_HOST_S       28
+
+#define SDIO_OCR_READ_FAIL     (2)
+
+
+#define CAP_ASYNCINT_SUP_M     BITFIELD_MASK(1)
+#define CAP_ASYNCINT_SUP_S     29
+
+#define CAP_SLOTTYPE_M         BITFIELD_MASK(2)
+#define CAP_SLOTTYPE_S         30
+
+#define CAP3_MSBits_OFFSET     (32)
+/* note: following are caps MSB32 bits.
+       So the bits start from 0, instead of 32. that is why
+       CAP3_MSBits_OFFSET is subtracted.
+*/
+#define CAP3_SDR50_SUP_M               BITFIELD_MASK(1)
+#define CAP3_SDR50_SUP_S               (32 - CAP3_MSBits_OFFSET)
+
+#define CAP3_SDR104_SUP_M      BITFIELD_MASK(1)
+#define CAP3_SDR104_SUP_S      (33 - CAP3_MSBits_OFFSET)
+
+#define CAP3_DDR50_SUP_M       BITFIELD_MASK(1)
+#define CAP3_DDR50_SUP_S       (34 - CAP3_MSBits_OFFSET)
+
+/* for knowing the clk caps in a single read */
+#define CAP3_30CLKCAP_M                BITFIELD_MASK(3)
+#define CAP3_30CLKCAP_S                (32 - CAP3_MSBits_OFFSET)
+
+#define CAP3_DRIVTYPE_A_M      BITFIELD_MASK(1)
+#define CAP3_DRIVTYPE_A_S      (36 - CAP3_MSBits_OFFSET)
+
+#define CAP3_DRIVTYPE_C_M      BITFIELD_MASK(1)
+#define CAP3_DRIVTYPE_C_S      (37 - CAP3_MSBits_OFFSET)
+
+#define CAP3_DRIVTYPE_D_M      BITFIELD_MASK(1)
+#define CAP3_DRIVTYPE_D_S      (38 - CAP3_MSBits_OFFSET)
+
+#define CAP3_RETUNING_TC_M     BITFIELD_MASK(4)
+#define CAP3_RETUNING_TC_S     (40 - CAP3_MSBits_OFFSET)
+
+#define CAP3_TUNING_SDR50_M    BITFIELD_MASK(1)
+#define CAP3_TUNING_SDR50_S    (45 - CAP3_MSBits_OFFSET)
+
+#define CAP3_RETUNING_MODES_M  BITFIELD_MASK(2)
+#define CAP3_RETUNING_MODES_S  (46 - CAP3_MSBits_OFFSET)
+
+#define CAP3_CLK_MULT_M                BITFIELD_MASK(8)
+#define CAP3_CLK_MULT_S                (48 - CAP3_MSBits_OFFSET)
+
+#define PRESET_DRIVR_SELECT_M  BITFIELD_MASK(2)
+#define PRESET_DRIVR_SELECT_S  14
+
+#define PRESET_CLK_DIV_M       BITFIELD_MASK(10)
+#define PRESET_CLK_DIV_S       0
+
+/* SD_MaxCurCap reg (0x048) */
+#define CAP_CURR_3_3_M         BITFIELD_MASK(8)
+#define CAP_CURR_3_3_S         0
+#define CAP_CURR_3_0_M         BITFIELD_MASK(8)
+#define CAP_CURR_3_0_S         8
+#define CAP_CURR_1_8_M         BITFIELD_MASK(8)
+#define CAP_CURR_1_8_S         16
+
+/* SD_SysAddr: Offset 0x0000, Size 4 bytes */
+
+/* SD_BlockSize: Offset 0x004, Size 2 bytes */
+#define BLKSZ_BLKSZ_M          BITFIELD_MASK(12)
+#define BLKSZ_BLKSZ_S          0
+#define BLKSZ_BNDRY_M          BITFIELD_MASK(3)
+#define BLKSZ_BNDRY_S          12
+
+/* SD_BlockCount: Offset 0x006, size 2 bytes */
+
+/* SD_Arg0: Offset 0x008, size = 4 bytes  */
+/* SD_TransferMode Offset 0x00C, size = 2 bytes */
+#define XFER_DMA_ENABLE_M      BITFIELD_MASK(1)
+#define XFER_DMA_ENABLE_S      0
+#define XFER_BLK_COUNT_EN_M    BITFIELD_MASK(1)
+#define XFER_BLK_COUNT_EN_S    1
+#define XFER_CMD_12_EN_M       BITFIELD_MASK(1)
+#define XFER_CMD_12_EN_S       2
+#define XFER_DATA_DIRECTION_M  BITFIELD_MASK(1)
+#define XFER_DATA_DIRECTION_S  4
+#define XFER_MULTI_BLOCK_M     BITFIELD_MASK(1)
+#define XFER_MULTI_BLOCK_S     5
+
+/* SD_Command: Offset 0x00E, size = 2 bytes */
+/* resp_type field */
+#define RESP_TYPE_NONE                 0
+#define RESP_TYPE_136                  1
+#define RESP_TYPE_48                   2
+#define RESP_TYPE_48_BUSY      3
+/* type field */
+#define CMD_TYPE_NORMAL                0
+#define CMD_TYPE_SUSPEND       1
+#define CMD_TYPE_RESUME                2
+#define CMD_TYPE_ABORT         3
+
+#define CMD_RESP_TYPE_M                BITFIELD_MASK(2)        /* Bits [0-1]   - Response type */
+#define CMD_RESP_TYPE_S                0
+#define CMD_CRC_EN_M           BITFIELD_MASK(1)        /* Bit 3        - CRC enable */
+#define CMD_CRC_EN_S           3
+#define CMD_INDEX_EN_M         BITFIELD_MASK(1)        /* Bit 4        - Enable index checking */
+#define CMD_INDEX_EN_S         4
+#define CMD_DATA_EN_M          BITFIELD_MASK(1)        /* Bit 5        - Using DAT line */
+#define CMD_DATA_EN_S          5
+#define CMD_TYPE_M             BITFIELD_MASK(2)        /* Bit [6-7]    - Normal, abort, resume, etc
+                                                        */
+#define CMD_TYPE_S             6
+#define CMD_INDEX_M            BITFIELD_MASK(6)        /* Bits [8-13]  - Command number */
+#define CMD_INDEX_S            8
+
+/* SD_BufferDataPort0  : Offset 0x020, size = 2 or 4 bytes */
+/* SD_BufferDataPort1  : Offset 0x022, size = 2 bytes */
+/* SD_PresentState     : Offset 0x024, size = 4 bytes */
+#define PRES_CMD_INHIBIT_M     BITFIELD_MASK(1)        /* Bit 0        May use CMD */
+#define PRES_CMD_INHIBIT_S     0
+#define PRES_DAT_INHIBIT_M     BITFIELD_MASK(1)        /* Bit 1        May use DAT */
+#define PRES_DAT_INHIBIT_S     1
+#define PRES_DAT_BUSY_M                BITFIELD_MASK(1)        /* Bit 2        DAT is busy */
+#define PRES_DAT_BUSY_S                2
+#define PRES_PRESENT_RSVD_M    BITFIELD_MASK(5)        /* Bit [3-7]    rsvd */
+#define PRES_PRESENT_RSVD_S    3
+#define PRES_WRITE_ACTIVE_M    BITFIELD_MASK(1)        /* Bit 8        Write is active */
+#define PRES_WRITE_ACTIVE_S    8
+#define PRES_READ_ACTIVE_M     BITFIELD_MASK(1)        /* Bit 9        Read is active */
+#define PRES_READ_ACTIVE_S     9
+#define PRES_WRITE_DATA_RDY_M  BITFIELD_MASK(1)        /* Bit 10       Write buf is avail */
+#define PRES_WRITE_DATA_RDY_S  10
+#define PRES_READ_DATA_RDY_M   BITFIELD_MASK(1)        /* Bit 11       Read buf data avail */
+#define PRES_READ_DATA_RDY_S   11
+#define PRES_CARD_PRESENT_M    BITFIELD_MASK(1)        /* Bit 16       Card present - debounced */
+#define PRES_CARD_PRESENT_S    16
+#define PRES_CARD_STABLE_M     BITFIELD_MASK(1)        /* Bit 17       Debugging */
+#define PRES_CARD_STABLE_S     17
+#define PRES_CARD_PRESENT_RAW_M        BITFIELD_MASK(1)        /* Bit 18       Not debounced */
+#define PRES_CARD_PRESENT_RAW_S        18
+#define PRES_WRITE_ENABLED_M   BITFIELD_MASK(1)        /* Bit 19       Write protected? */
+#define PRES_WRITE_ENABLED_S   19
+#define PRES_DAT_SIGNAL_M      BITFIELD_MASK(4)        /* Bit [20-23]  Debugging */
+#define PRES_DAT_SIGNAL_S      20
+#define PRES_CMD_SIGNAL_M      BITFIELD_MASK(1)        /* Bit 24       Debugging */
+#define PRES_CMD_SIGNAL_S      24
+
+/* SD_HostCntrl: Offset 0x028, size = 1 bytes */
+#define HOST_LED_M             BITFIELD_MASK(1)        /* Bit 0        LED On/Off */
+#define HOST_LED_S             0
+#define HOST_DATA_WIDTH_M      BITFIELD_MASK(1)        /* Bit 1        4 bit enable */
+#define HOST_DATA_WIDTH_S      1
+#define HOST_HI_SPEED_EN_M     BITFIELD_MASK(1)        /* Bit 2        High speed vs low speed */
+#define HOST_DMA_SEL_S         3
+#define HOST_DMA_SEL_M         BITFIELD_MASK(2)        /* Bit 4:3      DMA Select */
+#define HOST_HI_SPEED_EN_S     2
+
+/* Host Control2: */
+#define HOSTCtrl2_PRESVAL_EN_M BITFIELD_MASK(1)        /* 1 bit */
+#define HOSTCtrl2_PRESVAL_EN_S 15                                      /* bit# */
+
+#define HOSTCtrl2_ASYINT_EN_M  BITFIELD_MASK(1)        /* 1 bit */
+#define HOSTCtrl2_ASYINT_EN_S  14                                      /* bit# */
+
+#define HOSTCtrl2_SAMPCLK_SEL_M        BITFIELD_MASK(1)        /* 1 bit */
+#define HOSTCtrl2_SAMPCLK_SEL_S        7                                       /* bit# */
+
+#define HOSTCtrl2_EXEC_TUNING_M        BITFIELD_MASK(1)        /* 1 bit */
+#define HOSTCtrl2_EXEC_TUNING_S        6                                       /* bit# */
+
+#define HOSTCtrl2_DRIVSTRENGTH_SEL_M   BITFIELD_MASK(2)        /* 2 bit */
+#define HOSTCtrl2_DRIVSTRENGTH_SEL_S   4                                       /* bit# */
+
+#define HOSTCtrl2_1_8SIG_EN_M  BITFIELD_MASK(1)        /* 1 bit */
+#define HOSTCtrl2_1_8SIG_EN_S  3                                       /* bit# */
+
+#define HOSTCtrl2_UHSMODE_SEL_M        BITFIELD_MASK(3)        /* 3 bit */
+#define HOSTCtrl2_UHSMODE_SEL_S        0                                       /* bit# */
+
+#define HOST_CONTR_VER_2               (1)
+#define HOST_CONTR_VER_3               (2)
+
+/* misc defines */
+#define SD1_MODE               0x1     /* SD Host Cntrlr Spec */
+#define SD4_MODE               0x2     /* SD Host Cntrlr Spec */
+
+/* SD_PwrCntrl: Offset 0x029, size = 1 bytes */
+#define PWR_BUS_EN_M           BITFIELD_MASK(1)        /* Bit 0        Power the bus */
+#define PWR_BUS_EN_S           0
+#define PWR_VOLTS_M            BITFIELD_MASK(3)        /* Bit [1-3]    Voltage Select */
+#define PWR_VOLTS_S            1
+
+/* SD_SoftwareReset: Offset 0x02F, size = 1 byte */
+#define SW_RESET_ALL_M         BITFIELD_MASK(1)        /* Bit 0        Reset All */
+#define SW_RESET_ALL_S         0
+#define SW_RESET_CMD_M         BITFIELD_MASK(1)        /* Bit 1        CMD Line Reset */
+#define SW_RESET_CMD_S         1
+#define SW_RESET_DAT_M         BITFIELD_MASK(1)        /* Bit 2        DAT Line Reset */
+#define SW_RESET_DAT_S         2
+
+/* SD_IntrStatus: Offset 0x030, size = 2 bytes */
+/* Defs also serve SD_IntrStatusEnable and SD_IntrSignalEnable */
+#define INTSTAT_CMD_COMPLETE_M         BITFIELD_MASK(1)        /* Bit 0 */
+#define INTSTAT_CMD_COMPLETE_S         0
+#define INTSTAT_XFER_COMPLETE_M                BITFIELD_MASK(1)
+#define INTSTAT_XFER_COMPLETE_S                1
+#define INTSTAT_BLOCK_GAP_EVENT_M      BITFIELD_MASK(1)
+#define INTSTAT_BLOCK_GAP_EVENT_S      2
+#define INTSTAT_DMA_INT_M              BITFIELD_MASK(1)
+#define INTSTAT_DMA_INT_S              3
+#define INTSTAT_BUF_WRITE_READY_M      BITFIELD_MASK(1)
+#define INTSTAT_BUF_WRITE_READY_S      4
+#define INTSTAT_BUF_READ_READY_M       BITFIELD_MASK(1)
+#define INTSTAT_BUF_READ_READY_S       5
+#define INTSTAT_CARD_INSERTION_M       BITFIELD_MASK(1)
+#define INTSTAT_CARD_INSERTION_S       6
+#define INTSTAT_CARD_REMOVAL_M         BITFIELD_MASK(1)
+#define INTSTAT_CARD_REMOVAL_S         7
+#define INTSTAT_CARD_INT_M             BITFIELD_MASK(1)
+#define INTSTAT_CARD_INT_S             8
+#define INTSTAT_RETUNING_INT_M         BITFIELD_MASK(1)        /* Bit 12 */
+#define INTSTAT_RETUNING_INT_S         12
+#define INTSTAT_ERROR_INT_M            BITFIELD_MASK(1)        /* Bit 15 */
+#define INTSTAT_ERROR_INT_S            15
+
+/* SD_ErrorIntrStatus: Offset 0x032, size = 2 bytes */
+/* Defs also serve SD_ErrorIntrStatusEnable and SD_ErrorIntrSignalEnable */
+#define ERRINT_CMD_TIMEOUT_M           BITFIELD_MASK(1)
+#define ERRINT_CMD_TIMEOUT_S           0
+#define ERRINT_CMD_CRC_M               BITFIELD_MASK(1)
+#define ERRINT_CMD_CRC_S               1
+#define ERRINT_CMD_ENDBIT_M            BITFIELD_MASK(1)
+#define ERRINT_CMD_ENDBIT_S            2
+#define ERRINT_CMD_INDEX_M             BITFIELD_MASK(1)
+#define ERRINT_CMD_INDEX_S             3
+#define ERRINT_DATA_TIMEOUT_M          BITFIELD_MASK(1)
+#define ERRINT_DATA_TIMEOUT_S          4
+#define ERRINT_DATA_CRC_M              BITFIELD_MASK(1)
+#define ERRINT_DATA_CRC_S              5
+#define ERRINT_DATA_ENDBIT_M           BITFIELD_MASK(1)
+#define ERRINT_DATA_ENDBIT_S           6
+#define ERRINT_CURRENT_LIMIT_M         BITFIELD_MASK(1)
+#define ERRINT_CURRENT_LIMIT_S         7
+#define ERRINT_AUTO_CMD12_M            BITFIELD_MASK(1)
+#define ERRINT_AUTO_CMD12_S            8
+#define ERRINT_VENDOR_M                        BITFIELD_MASK(4)
+#define ERRINT_VENDOR_S                        12
+#define ERRINT_ADMA_M                  BITFIELD_MASK(1)
+#define ERRINT_ADMA_S                  9
+
+/* Also provide definitions in "normal" form to allow combined masks */
+#define ERRINT_CMD_TIMEOUT_BIT         0x0001
+#define ERRINT_CMD_CRC_BIT             0x0002
+#define ERRINT_CMD_ENDBIT_BIT          0x0004
+#define ERRINT_CMD_INDEX_BIT           0x0008
+#define ERRINT_DATA_TIMEOUT_BIT                0x0010
+#define ERRINT_DATA_CRC_BIT            0x0020
+#define ERRINT_DATA_ENDBIT_BIT         0x0040
+#define ERRINT_CURRENT_LIMIT_BIT       0x0080
+#define ERRINT_AUTO_CMD12_BIT          0x0100
+#define ERRINT_ADMA_BIT                0x0200
+
+/* Masks to select CMD vs. DATA errors */
+#define ERRINT_CMD_ERRS                (ERRINT_CMD_TIMEOUT_BIT | ERRINT_CMD_CRC_BIT |\
+                                ERRINT_CMD_ENDBIT_BIT | ERRINT_CMD_INDEX_BIT)
+#define ERRINT_DATA_ERRS       (ERRINT_DATA_TIMEOUT_BIT | ERRINT_DATA_CRC_BIT |\
+                                ERRINT_DATA_ENDBIT_BIT | ERRINT_ADMA_BIT)
+#define ERRINT_TRANSFER_ERRS   (ERRINT_CMD_ERRS | ERRINT_DATA_ERRS)
+
+/* SD_WakeupCntr_BlockGapCntrl : Offset 0x02A , size = bytes */
+/* SD_ClockCntrl       : Offset 0x02C , size = bytes */
+/* SD_SoftwareReset_TimeoutCntrl       : Offset 0x02E , size = bytes */
+/* SD_IntrStatus       : Offset 0x030 , size = bytes */
+/* SD_ErrorIntrStatus  : Offset 0x032 , size = bytes */
+/* SD_IntrStatusEnable : Offset 0x034 , size = bytes */
+/* SD_ErrorIntrStatusEnable : Offset 0x036 , size = bytes */
+/* SD_IntrSignalEnable : Offset 0x038 , size = bytes */
+/* SD_ErrorIntrSignalEnable : Offset 0x03A , size = bytes */
+/* SD_CMD12ErrorStatus : Offset 0x03C , size = bytes */
+/* SD_Capabilities     : Offset 0x040 , size = bytes */
+/* SD_MaxCurCap                : Offset 0x048 , size = bytes */
+/* SD_MaxCurCap_Reserved: Offset 0x04C , size = bytes */
+/* SD_SlotInterruptStatus: Offset 0x0FC , size = bytes */
+/* SD_HostControllerVersion : Offset 0x0FE , size = bytes */
+
+/* SDIO Host Control Register DMA Mode Definitions */
+#define SDIOH_SDMA_MODE                        0
+#define SDIOH_ADMA1_MODE               1
+#define SDIOH_ADMA2_MODE               2
+#define SDIOH_ADMA2_64_MODE            3
+
+#define ADMA2_ATTRIBUTE_VALID          (1 << 0)        /* ADMA Descriptor line valid */
+#define ADMA2_ATTRIBUTE_END                    (1 << 1)        /* End of Descriptor */
+#define ADMA2_ATTRIBUTE_INT                    (1 << 2)        /* Interrupt when line is done */
+#define ADMA2_ATTRIBUTE_ACT_NOP                (0 << 4)        /* Skip current line, go to next. */
+#define ADMA2_ATTRIBUTE_ACT_RSV                (1 << 4)        /* Same as NOP */
+#define ADMA1_ATTRIBUTE_ACT_SET                (1 << 4)        /* ADMA1 Only - set transfer length */
+#define ADMA2_ATTRIBUTE_ACT_TRAN       (2 << 4)        /* Transfer Data of one descriptor line. */
+#define ADMA2_ATTRIBUTE_ACT_LINK       (3 << 4)        /* Link Descriptor */
+
+/* ADMA2 Descriptor Table Entry for 32-bit Address */
+typedef struct adma2_dscr_32b {
+       uint32 len_attr;
+       uint32 phys_addr;
+} adma2_dscr_32b_t;
+
+/* ADMA1 Descriptor Table Entry */
+typedef struct adma1_dscr {
+       uint32 phys_addr_attr;
+} adma1_dscr_t;
+
+#endif /* _SDIOH_H */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/sdiovar.h b/drivers/net/wireless/bcmdhd_1363/include/sdiovar.h
new file mode 100644 (file)
index 0000000..4f1d82d
--- /dev/null
@@ -0,0 +1,61 @@
+/*
+ * Structure used by apps whose drivers access SDIO drivers.
+ * Pulled out separately so dhdu and wlu can both use it.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: sdiovar.h 514727 2014-11-12 03:02:48Z $
+ */
+
+#ifndef _sdiovar_h_
+#define _sdiovar_h_
+
+#include <typedefs.h>
+
+/* require default structure packing */
+#define BWL_DEFAULT_PACKING
+#include <packed_section_start.h>
+
+typedef struct sdreg {
+       int func;
+       int offset;
+       int value;
+} sdreg_t;
+
+/* Common msglevel constants */
+#define SDH_ERROR_VAL          0x0001  /* Error */
+#define SDH_TRACE_VAL          0x0002  /* Trace */
+#define SDH_INFO_VAL           0x0004  /* Info */
+#define SDH_DEBUG_VAL          0x0008  /* Debug */
+#define SDH_DATA_VAL           0x0010  /* Data */
+#define SDH_CTRL_VAL           0x0020  /* Control Regs */
+#define SDH_LOG_VAL            0x0040  /* Enable bcmlog */
+#define SDH_DMA_VAL            0x0080  /* DMA */
+
+#define NUM_PREV_TRANSACTIONS  16
+
+
+#include <packed_section_end.h>
+
+#endif /* _sdiovar_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/siutils.h b/drivers/net/wireless/bcmdhd_1363/include/siutils.h
new file mode 100644 (file)
index 0000000..335d1fa
--- /dev/null
@@ -0,0 +1,606 @@
+/*
+ * Misc utility routines for accessing the SOC Interconnects
+ * of Broadcom HNBU chips.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: siutils.h 663718 2017-01-30 12:10:57Z $
+ */
+
+#ifndef        _siutils_h_
+#define        _siutils_h_
+
+#ifdef SR_DEBUG
+#include "wlioctl.h"
+#endif /* SR_DEBUG */
+
+
+/**
+ * Data structure to export all chip specific common variables
+ *   public (read-only) portion of siutils handle returned by si_attach()/si_kattach()
+ */
+struct si_pub {
+       uint    socitype;               /**< SOCI_SB, SOCI_AI */
+
+       uint    bustype;                /**< SI_BUS, PCI_BUS */
+       uint    buscoretype;            /**< PCI_CORE_ID, PCIE_CORE_ID, PCMCIA_CORE_ID */
+       uint    buscorerev;             /**< buscore rev */
+       uint    buscoreidx;             /**< buscore index */
+       int     ccrev;                  /**< chip common core rev */
+       uint32  cccaps;                 /**< chip common capabilities */
+       uint32  cccaps_ext;                     /**< chip common capabilities extension */
+       int     pmurev;                 /**< pmu core rev */
+       uint32  pmucaps;                /**< pmu capabilities */
+       uint    boardtype;              /**< board type */
+       uint    boardrev;               /* board rev */
+       uint    boardvendor;            /**< board vendor */
+       uint    boardflags;             /**< board flags */
+       uint    boardflags2;            /**< board flags2 */
+       uint    chip;                   /**< chip number */
+       uint    chiprev;                /**< chip revision */
+       uint    chippkg;                /**< chip package option */
+       uint32  chipst;                 /**< chip status */
+       bool    issim;                  /**< chip is in simulation or emulation */
+       uint    socirev;                /**< SOC interconnect rev */
+       bool    pci_pr32414;
+
+};
+
+/* for HIGH_ONLY driver, the si_t must be writable to allow states sync from BMAC to HIGH driver
+ * for monolithic driver, it is readonly to prevent accident change
+ */
+typedef const struct si_pub si_t;
+
+/*
+ * Many of the routines below take an 'sih' handle as their first arg.
+ * Allocate this by calling si_attach().  Free it by calling si_detach().
+ * At any one time, the sih is logically focused on one particular si core
+ * (the "current core").
+ * Use si_setcore() or si_setcoreidx() to change the association to another core.
+ */
+#define        SI_OSH          NULL    /**< Use for si_kattach when no osh is available */
+
+#define        BADIDX          (SI_MAXCORES + 1)
+
+/* clkctl xtal what flags */
+#define        XTAL                    0x1     /**< primary crystal oscillator (2050) */
+#define        PLL                     0x2     /**< main chip pll */
+
+/* clkctl clk mode */
+#define        CLK_FAST                0       /**< force fast (pll) clock */
+#define        CLK_DYNAMIC             2       /**< enable dynamic clock control */
+
+/* GPIO usage priorities */
+#define GPIO_DRV_PRIORITY      0       /**< Driver */
+#define GPIO_APP_PRIORITY      1       /**< Application */
+#define GPIO_HI_PRIORITY       2       /**< Highest priority. Ignore GPIO reservation */
+
+/* GPIO pull up/down */
+#define GPIO_PULLUP            0
+#define GPIO_PULLDN            1
+
+/* GPIO event regtype */
+#define GPIO_REGEVT            0       /**< GPIO register event */
+#define GPIO_REGEVT_INTMSK     1       /**< GPIO register event int mask */
+#define GPIO_REGEVT_INTPOL     2       /**< GPIO register event int polarity */
+
+/* device path */
+#define SI_DEVPATH_BUFSZ       16      /**< min buffer size in bytes */
+
+/* SI routine enumeration: to be used by update function with multiple hooks */
+#define        SI_DOATTACH     1
+#define SI_PCIDOWN     2       /**< wireless interface is down */
+#define SI_PCIUP       3       /**< wireless interface is up */
+
+#ifdef SR_DEBUG
+#define PMU_RES                31
+#endif /* SR_DEBUG */
+
+#define        ISSIM_ENAB(sih) FALSE
+
+/* PMU clock/power control */
+#if defined(BCMPMUCTL)
+#define PMUCTL_ENAB(sih)       (BCMPMUCTL)
+#else
+#define PMUCTL_ENAB(sih)       ((sih)->cccaps & CC_CAP_PMU)
+#endif
+
+#define AOB_ENAB(sih)  ((sih)->ccrev >= 35 ? \
+                       ((sih)->cccaps_ext & CC_CAP_EXT_AOB_PRESENT) : 0)
+
+/* chipcommon clock/power control (exclusive with PMU's) */
+#if defined(BCMPMUCTL) && BCMPMUCTL
+#define CCCTL_ENAB(sih)                (0)
+#define CCPLL_ENAB(sih)                (0)
+#else
+#define CCCTL_ENAB(sih)                ((sih)->cccaps & CC_CAP_PWR_CTL)
+#define CCPLL_ENAB(sih)                ((sih)->cccaps & CC_CAP_PLL_MASK)
+#endif
+
+typedef void (*gci_gpio_handler_t)(uint32 stat, void *arg);
+
+/* External BT Coex enable mask */
+#define CC_BTCOEX_EN_MASK  0x01
+/* External PA enable mask */
+#define GPIO_CTRL_EPA_EN_MASK 0x40
+/* WL/BT control enable mask */
+#define GPIO_CTRL_5_6_EN_MASK 0x60
+#define GPIO_CTRL_7_6_EN_MASK 0xC0
+#define GPIO_OUT_7_EN_MASK 0x80
+
+
+
+/* CR4 specific defines used by the host driver */
+#define SI_CR4_CAP                     (0x04)
+#define SI_CR4_BANKIDX         (0x40)
+#define SI_CR4_BANKINFO                (0x44)
+#define SI_CR4_BANKPDA         (0x4C)
+
+#define        ARMCR4_TCBBNB_MASK      0xf0
+#define        ARMCR4_TCBBNB_SHIFT     4
+#define        ARMCR4_TCBANB_MASK      0xf
+#define        ARMCR4_TCBANB_SHIFT     0
+
+#define        SICF_CPUHALT            (0x0020)
+#define        ARMCR4_BSZ_MASK         0x3f
+#define        ARMCR4_BSZ_MULT         8192
+#define        SI_BPIND_1BYTE          0x1
+#define        SI_BPIND_2BYTE          0x3
+#define        SI_BPIND_4BYTE          0xF
+#include <osl_decl.h>
+/* === exported functions === */
+extern si_t *si_attach(uint pcidev, osl_t *osh, void *regs, uint bustype,
+                       void *sdh, char **vars, uint *varsz);
+extern si_t *si_kattach(osl_t *osh);
+extern void si_detach(si_t *sih);
+extern bool si_pci_war16165(si_t *sih);
+extern void *
+si_d11_switch_addrbase(si_t *sih, uint coreunit);
+extern uint si_corelist(si_t *sih, uint coreid[]);
+extern uint si_coreid(si_t *sih);
+extern uint si_flag(si_t *sih);
+extern uint si_flag_alt(si_t *sih);
+extern uint si_intflag(si_t *sih);
+extern uint si_coreidx(si_t *sih);
+extern uint si_coreunit(si_t *sih);
+extern uint si_corevendor(si_t *sih);
+extern uint si_corerev(si_t *sih);
+extern void *si_osh(si_t *sih);
+extern void si_setosh(si_t *sih, osl_t *osh);
+extern uint si_backplane_access(si_t *sih, uint addr, uint size,
+       uint *val, bool read);
+extern uint si_corereg(si_t *sih, uint coreidx, uint regoff, uint mask, uint val);
+extern uint si_pmu_corereg(si_t *sih, uint32 idx, uint regoff, uint mask, uint val);
+extern uint32 *si_corereg_addr(si_t *sih, uint coreidx, uint regoff);
+extern void *si_coreregs(si_t *sih);
+extern uint si_wrapperreg(si_t *sih, uint32 offset, uint32 mask, uint32 val);
+extern uint si_core_wrapperreg(si_t *sih, uint32 coreidx, uint32 offset, uint32 mask, uint32 val);
+extern void *si_wrapperregs(si_t *sih);
+extern uint32 si_core_cflags(si_t *sih, uint32 mask, uint32 val);
+extern void si_core_cflags_wo(si_t *sih, uint32 mask, uint32 val);
+extern uint32 si_core_sflags(si_t *sih, uint32 mask, uint32 val);
+extern void si_d11rsdb_core1_alt_reg_clk_dis(si_t *sih);
+extern void si_d11rsdb_core1_alt_reg_clk_en(si_t *sih);
+extern bool si_iscoreup(si_t *sih);
+extern uint si_numcoreunits(si_t *sih, uint coreid);
+extern uint si_numd11coreunits(si_t *sih);
+extern uint si_findcoreidx(si_t *sih, uint coreid, uint coreunit);
+extern void *si_setcoreidx(si_t *sih, uint coreidx);
+extern void *si_setcore(si_t *sih, uint coreid, uint coreunit);
+extern void *si_switch_core(si_t *sih, uint coreid, uint *origidx, uint *intr_val);
+extern void si_restore_core(si_t *sih, uint coreid, uint intr_val);
+extern int si_numaddrspaces(si_t *sih);
+extern uint32 si_addrspace(si_t *sih, uint asidx);
+extern uint32 si_addrspacesize(si_t *sih, uint asidx);
+extern void si_coreaddrspaceX(si_t *sih, uint asidx, uint32 *addr, uint32 *size);
+extern int si_corebist(si_t *sih);
+extern void si_core_reset(si_t *sih, uint32 bits, uint32 resetbits);
+extern void si_core_disable(si_t *sih, uint32 bits);
+extern uint32 si_clock_rate(uint32 pll_type, uint32 n, uint32 m);
+extern uint si_chip_hostif(si_t *sih);
+extern bool si_read_pmu_autopll(si_t *sih);
+extern uint32 si_clock(si_t *sih);
+extern uint32 si_alp_clock(si_t *sih); /* returns [Hz] units */
+extern uint32 si_ilp_clock(si_t *sih); /* returns [Hz] units */
+extern void si_pci_setup(si_t *sih, uint coremask);
+extern void si_pcmcia_init(si_t *sih);
+extern void si_setint(si_t *sih, int siflag);
+extern bool si_backplane64(si_t *sih);
+extern void si_register_intr_callback(si_t *sih, void *intrsoff_fn, void *intrsrestore_fn,
+       void *intrsenabled_fn, void *intr_arg);
+extern void si_deregister_intr_callback(si_t *sih);
+extern void si_clkctl_init(si_t *sih);
+extern uint16 si_clkctl_fast_pwrup_delay(si_t *sih);
+extern bool si_clkctl_cc(si_t *sih, uint mode);
+extern int si_clkctl_xtal(si_t *sih, uint what, bool on);
+extern uint32 si_gpiotimerval(si_t *sih, uint32 mask, uint32 val);
+extern void si_btcgpiowar(si_t *sih);
+extern bool si_deviceremoved(si_t *sih);
+extern uint32 si_sysmem_size(si_t *sih);
+extern uint32 si_socram_size(si_t *sih);
+extern uint32 si_socdevram_size(si_t *sih);
+extern uint32 si_socram_srmem_size(si_t *sih);
+extern void si_socram_set_bankpda(si_t *sih, uint32 bankidx, uint32 bankpda);
+extern void si_socdevram(si_t *sih, bool set, uint8 *ennable, uint8 *protect, uint8 *remap);
+extern bool si_socdevram_pkg(si_t *sih);
+extern bool si_socdevram_remap_isenb(si_t *sih);
+extern uint32 si_socdevram_remap_size(si_t *sih);
+
+extern void si_watchdog(si_t *sih, uint ticks);
+extern void si_watchdog_ms(si_t *sih, uint32 ms);
+extern uint32 si_watchdog_msticks(void);
+extern void *si_gpiosetcore(si_t *sih);
+extern uint32 si_gpiocontrol(si_t *sih, uint32 mask, uint32 val, uint8 priority);
+extern uint32 si_gpioouten(si_t *sih, uint32 mask, uint32 val, uint8 priority);
+extern uint32 si_gpioout(si_t *sih, uint32 mask, uint32 val, uint8 priority);
+extern uint32 si_gpioin(si_t *sih);
+extern uint32 si_gpiointpolarity(si_t *sih, uint32 mask, uint32 val, uint8 priority);
+extern uint32 si_gpiointmask(si_t *sih, uint32 mask, uint32 val, uint8 priority);
+extern uint32 si_gpioled(si_t *sih, uint32 mask, uint32 val);
+extern uint32 si_gpioreserve(si_t *sih, uint32 gpio_num, uint8 priority);
+extern uint32 si_gpiorelease(si_t *sih, uint32 gpio_num, uint8 priority);
+extern uint32 si_gpiopull(si_t *sih, bool updown, uint32 mask, uint32 val);
+extern uint32 si_gpioevent(si_t *sih, uint regtype, uint32 mask, uint32 val);
+extern uint32 si_gpio_int_enable(si_t *sih, bool enable);
+extern void si_gci_uart_init(si_t *sih, osl_t *osh, uint8 seci_mode);
+extern void si_gci_enable_gpio(si_t *sih, uint8 gpio, uint32 mask, uint32 value);
+extern uint8 si_gci_host_wake_gpio_init(si_t *sih);
+extern void si_gci_host_wake_gpio_enable(si_t *sih, uint8 gpio, bool state);
+
+/* GCI interrupt handlers */
+extern void si_gci_handler_process(si_t *sih);
+
+/* GCI GPIO event handlers */
+extern void *si_gci_gpioint_handler_register(si_t *sih, uint8 gpio, uint8 sts,
+       gci_gpio_handler_t cb, void *arg);
+extern void si_gci_gpioint_handler_unregister(si_t *sih, void* gci_i);
+extern uint8 si_gci_gpio_status(si_t *sih, uint8 gci_gpio, uint8 mask, uint8 value);
+
+/* Get core base addr from core-id */
+#ifdef CUSTOMER_HW2
+extern uint32 si_corebase(si_t *sih, uint cid);
+#endif /* CUSTOMER_HW2 */
+
+/* Wake-on-wireless-LAN (WOWL) */
+extern bool si_pci_pmecap(si_t *sih);
+extern bool si_pci_fastpmecap(struct osl_info *osh);
+extern bool si_pci_pmestat(si_t *sih);
+extern void si_pci_pmeclr(si_t *sih);
+extern void si_pci_pmeen(si_t *sih);
+extern void si_pci_pmestatclr(si_t *sih);
+extern uint si_pcie_readreg(void *sih, uint addrtype, uint offset);
+extern uint si_pcie_writereg(void *sih, uint addrtype, uint offset, uint val);
+extern void si_deepsleep_count(si_t *sih, bool arm_wakeup);
+
+
+#ifdef BCMSDIO
+extern void si_sdio_init(si_t *sih);
+#endif
+
+extern uint16 si_d11_devid(si_t *sih);
+extern int si_corepciid(si_t *sih, uint func, uint16 *pcivendor, uint16 *pcidevice,
+       uint8 *pciclass, uint8 *pcisubclass, uint8 *pciprogif, uint8 *pciheader);
+
+#define si_eci(sih) 0
+static INLINE void * si_eci_init(si_t *sih) {return NULL;}
+#define si_eci_notify_bt(sih, type, val)  (0)
+#define si_seci(sih) 0
+#define si_seci_upd(sih, a)    do {} while (0)
+static INLINE void * si_seci_init(si_t *sih, uint8 use_seci) {return NULL;}
+static INLINE void * si_gci_init(si_t *sih) {return NULL;}
+#define si_seci_down(sih) do {} while (0)
+#define si_gci(sih) 0
+
+/* OTP status */
+extern bool si_is_otp_disabled(si_t *sih);
+extern bool si_is_otp_powered(si_t *sih);
+extern void si_otp_power(si_t *sih, bool on, uint32* min_res_mask);
+
+/* SPROM availability */
+extern bool si_is_sprom_available(si_t *sih);
+extern bool si_is_sprom_enabled(si_t *sih);
+extern void si_sprom_enable(si_t *sih, bool enable);
+
+/* OTP/SROM CIS stuff */
+extern int si_cis_source(si_t *sih);
+#define CIS_DEFAULT    0
+#define CIS_SROM       1
+#define CIS_OTP                2
+
+/* Fab-id information */
+#define        DEFAULT_FAB     0x0     /**< Original/first fab used for this chip */
+#define        CSM_FAB7        0x1     /**< CSM Fab7 chip */
+#define        TSMC_FAB12      0x2     /**< TSMC Fab12/Fab14 chip */
+#define        SMIC_FAB4       0x3     /**< SMIC Fab4 chip */
+
+extern int si_otp_fabid(si_t *sih, uint16 *fabid, bool rw);
+extern uint16 si_fabid(si_t *sih);
+extern uint16 si_chipid(si_t *sih);
+
+/*
+ * Build device path. Path size must be >= SI_DEVPATH_BUFSZ.
+ * The returned path is NULL terminated and has trailing '/'.
+ * Return 0 on success, nonzero otherwise.
+ */
+extern int si_devpath(si_t *sih, char *path, int size);
+extern int si_devpath_pcie(si_t *sih, char *path, int size);
+/* Read variable with prepending the devpath to the name */
+extern char *si_getdevpathvar(si_t *sih, const char *name);
+extern int si_getdevpathintvar(si_t *sih, const char *name);
+extern char *si_coded_devpathvar(si_t *sih, char *varname, int var_len, const char *name);
+
+
+extern uint8 si_pcieclkreq(si_t *sih, uint32 mask, uint32 val);
+extern uint32 si_pcielcreg(si_t *sih, uint32 mask, uint32 val);
+extern uint8 si_pcieltrenable(si_t *sih, uint32 mask, uint32 val);
+extern uint8 si_pcieobffenable(si_t *sih, uint32 mask, uint32 val);
+extern uint32 si_pcieltr_reg(si_t *sih, uint32 reg, uint32 mask, uint32 val);
+extern uint32 si_pcieltrspacing_reg(si_t *sih, uint32 mask, uint32 val);
+extern uint32 si_pcieltrhysteresiscnt_reg(si_t *sih, uint32 mask, uint32 val);
+extern void si_pcie_set_error_injection(si_t *sih, uint32 mode);
+extern void si_pcie_set_L1substate(si_t *sih, uint32 substate);
+extern uint32 si_pcie_get_L1substate(si_t *sih);
+extern void si_war42780_clkreq(si_t *sih, bool clkreq);
+extern void si_pci_down(si_t *sih);
+extern void si_pci_up(si_t *sih);
+extern void si_pci_sleep(si_t *sih);
+extern void si_pcie_war_ovr_update(si_t *sih, uint8 aspm);
+extern void si_pcie_power_save_enable(si_t *sih, bool enable);
+extern void si_pcie_extendL1timer(si_t *sih, bool extend);
+extern int si_pci_fixcfg(si_t *sih);
+extern void si_chippkg_set(si_t *sih, uint);
+
+extern void si_chipcontrl_btshd0_4331(si_t *sih, bool on);
+extern void si_chipcontrl_restore(si_t *sih, uint32 val);
+extern uint32 si_chipcontrl_read(si_t *sih);
+extern void si_chipcontrl_epa4331(si_t *sih, bool on);
+extern void si_chipcontrl_epa4331_wowl(si_t *sih, bool enter_wowl);
+extern void si_chipcontrl_srom4360(si_t *sih, bool on);
+extern void si_clk_srom4365(si_t *sih);
+/* Enable BT-COEX & Ex-PA for 4313 */
+extern void si_epa_4313war(si_t *sih);
+extern void si_btc_enable_chipcontrol(si_t *sih);
+/* BT/WL selection for 4313 bt combo >= P250 boards */
+extern void si_btcombo_p250_4313_war(si_t *sih);
+extern void si_btcombo_43228_war(si_t *sih);
+extern void si_clk_pmu_htavail_set(si_t *sih, bool set_clear);
+extern void si_pmu_avb_clk_set(si_t *sih, osl_t *osh, bool set_flag);
+extern void si_pmu_synth_pwrsw_4313_war(si_t *sih);
+extern uint si_pll_reset(si_t *sih);
+/* === debug routines === */
+
+extern bool si_taclear(si_t *sih, bool details);
+
+#if defined(BCMDBG_PHYDUMP)
+struct bcmstrbuf;
+extern int si_dump_pcieinfo(si_t *sih, struct bcmstrbuf *b);
+#endif 
+
+#if defined(BCMDBG_PHYDUMP)
+extern void si_dumpregs(si_t *sih, struct bcmstrbuf *b);
+#endif 
+
+extern uint32 si_ccreg(si_t *sih, uint32 offset, uint32 mask, uint32 val);
+extern uint32 si_pciereg(si_t *sih, uint32 offset, uint32 mask, uint32 val, uint type);
+extern int si_bpind_access(si_t *sih, uint32 addr_high, uint32 addr_low,
+       int32* data, bool read);
+#ifdef SR_DEBUG
+extern void si_dump_pmu(si_t *sih, void *pmu_var);
+extern void si_pmu_keep_on(si_t *sih, int32 int_val);
+extern uint32 si_pmu_keep_on_get(si_t *sih);
+extern uint32 si_power_island_set(si_t *sih, uint32 int_val);
+extern uint32 si_power_island_get(si_t *sih);
+#endif /* SR_DEBUG */
+extern uint32 si_pcieserdesreg(si_t *sih, uint32 mdioslave, uint32 offset, uint32 mask, uint32 val);
+extern void si_pcie_set_request_size(si_t *sih, uint16 size);
+extern uint16 si_pcie_get_request_size(si_t *sih);
+extern void si_pcie_set_maxpayload_size(si_t *sih, uint16 size);
+extern uint16 si_pcie_get_maxpayload_size(si_t *sih);
+extern uint16 si_pcie_get_ssid(si_t *sih);
+extern uint32 si_pcie_get_bar0(si_t *sih);
+extern int si_pcie_configspace_cache(si_t *sih);
+extern int si_pcie_configspace_restore(si_t *sih);
+extern int si_pcie_configspace_get(si_t *sih, uint8 *buf, uint size);
+
+char *si_getnvramflvar(si_t *sih, const char *name);
+
+
+extern uint32 si_tcm_size(si_t *sih);
+extern bool si_has_flops(si_t *sih);
+
+extern int si_set_sromctl(si_t *sih, uint32 value);
+extern uint32 si_get_sromctl(si_t *sih);
+
+extern uint32 si_gci_direct(si_t *sih, uint offset, uint32 mask, uint32 val);
+extern uint32 si_gci_indirect(si_t *sih, uint regidx, uint offset, uint32 mask, uint32 val);
+extern uint32 si_gci_output(si_t *sih, uint reg, uint32 mask, uint32 val);
+extern uint32 si_gci_input(si_t *sih, uint reg);
+extern uint32 si_gci_int_enable(si_t *sih, bool enable);
+extern void si_gci_reset(si_t *sih);
+#ifdef BCMLTECOEX
+extern void si_gci_seci_init(si_t *sih);
+extern void si_ercx_init(si_t *sih, uint32 ltecx_mux, uint32 ltecx_padnum,
+       uint32 ltecx_fnsel, uint32 ltecx_gcigpio);
+extern void si_wci2_init(si_t *sih, uint8 baudrate, uint32 ltecx_mux, uint32 ltecx_padnum,
+       uint32 ltecx_fnsel, uint32 ltecx_gcigpio);
+#endif /* BCMLTECOEX */
+extern void si_gci_set_functionsel(si_t *sih, uint32 pin, uint8 fnsel);
+extern uint32 si_gci_get_functionsel(si_t *sih, uint32 pin);
+extern void si_gci_clear_functionsel(si_t *sih, uint8 fnsel);
+extern uint8 si_gci_get_chipctrlreg_idx(uint32 pin, uint32 *regidx, uint32 *pos);
+extern uint32 si_gci_chipcontrol(si_t *sih, uint reg, uint32 mask, uint32 val);
+extern uint32 si_gci_chipstatus(si_t *sih, uint reg);
+extern uint16 si_cc_get_reg16(uint32 reg_offs);
+extern uint32 si_cc_get_reg32(uint32 reg_offs);
+extern uint32 si_cc_set_reg32(uint32 reg_offs, uint32 val);
+extern uint32 si_gci_preinit_upd_indirect(uint32 regidx, uint32 setval, uint32 mask);
+extern uint8 si_enable_device_wake(si_t *sih, uint8 *wake_status, uint8 *cur_status);
+extern void si_swdenable(si_t *sih, uint32 swdflag);
+
+#define CHIPCTRLREG1 0x1
+#define CHIPCTRLREG2 0x2
+#define CHIPCTRLREG3 0x3
+#define CHIPCTRLREG4 0x4
+#define CHIPCTRLREG5 0x5
+#define MINRESMASKREG 0x618
+#define MAXRESMASKREG 0x61c
+#define CHIPCTRLADDR 0x650
+#define CHIPCTRLDATA 0x654
+#define RSRCTABLEADDR 0x620
+#define RSRCUPDWNTIME 0x628
+#define PMUREG_RESREQ_MASK 0x68c
+
+void si_update_masks(si_t *sih);
+void si_force_islanding(si_t *sih, bool enable);
+extern uint32 si_pmu_res_req_timer_clr(si_t *sih);
+extern void si_pmu_rfldo(si_t *sih, bool on);
+extern void si_survive_perst_war(si_t *sih, bool reset, uint32 sperst_mask, uint32 spert_val);
+extern uint32 si_pcie_set_ctrlreg(si_t *sih, uint32 sperst_mask, uint32 spert_val);
+extern void si_pcie_ltr_war(si_t *sih);
+extern void si_pcie_hw_LTR_war(si_t *sih);
+extern void si_pcie_hw_L1SS_war(si_t *sih);
+extern void si_pciedev_crwlpciegen2(si_t *sih);
+extern void si_pcie_prep_D3(si_t *sih, bool enter_D3);
+extern void si_pciedev_reg_pm_clk_period(si_t *sih);
+
+#ifdef WLRSDB
+extern void si_d11rsdb_core_disable(si_t *sih, uint32 bits);
+extern void si_d11rsdb_core_reset(si_t *sih, uint32 bits, uint32 resetbits);
+#endif
+
+
+/* Macro to enable clock gating changes in different cores */
+#define MEM_CLK_GATE_BIT       5
+#define GCI_CLK_GATE_BIT       18
+
+#define USBAPP_CLK_BIT         0
+#define PCIE_CLK_BIT           3
+#define ARMCR4_DBG_CLK_BIT     4
+#define SAMPLE_SYNC_CLK_BIT    17
+#define PCIE_TL_CLK_BIT                18
+#define HQ_REQ_BIT             24
+#define PLL_DIV2_BIT_START     9
+#define PLL_DIV2_MASK          (0x37 << PLL_DIV2_BIT_START)
+#define PLL_DIV2_DIS_OP                (0x37 << PLL_DIV2_BIT_START)
+
+#define pmu_corereg(si, cc_idx, member, mask, val) \
+       (AOB_ENAB(si) ? \
+               si_pmu_corereg(si, si_findcoreidx(si, PMU_CORE_ID, 0), \
+                              OFFSETOF(pmuregs_t, member), mask, val): \
+               si_pmu_corereg(si, cc_idx, OFFSETOF(chipcregs_t, member), mask, val))
+
+/* GCI Macros */
+#define ALLONES_32                             0xFFFFFFFF
+#define GCI_CCTL_SECIRST_OFFSET                        0 /**< SeciReset */
+#define GCI_CCTL_RSTSL_OFFSET                  1 /**< ResetSeciLogic */
+#define GCI_CCTL_SECIEN_OFFSET                 2 /**< EnableSeci  */
+#define GCI_CCTL_FSL_OFFSET                    3 /**< ForceSeciOutLow */
+#define GCI_CCTL_SMODE_OFFSET                  4 /**< SeciOpMode, 6:4 */
+#define GCI_CCTL_US_OFFSET                     7 /**< UpdateSeci */
+#define GCI_CCTL_BRKONSLP_OFFSET               8 /**< BreakOnSleep */
+#define GCI_CCTL_SILOWTOUT_OFFSET              9 /**< SeciInLowTimeout, 10:9 */
+#define GCI_CCTL_RSTOCC_OFFSET                 11 /**< ResetOffChipCoex */
+#define GCI_CCTL_ARESEND_OFFSET                        12 /**< AutoBTSigResend */
+#define GCI_CCTL_FGCR_OFFSET                   16 /**< ForceGciClkReq */
+#define GCI_CCTL_FHCRO_OFFSET                  17 /**< ForceHWClockReqOff */
+#define GCI_CCTL_FREGCLK_OFFSET                        18 /**< ForceRegClk */
+#define GCI_CCTL_FSECICLK_OFFSET               19 /**< ForceSeciClk */
+#define GCI_CCTL_FGCA_OFFSET                   20 /**< ForceGciClkAvail */
+#define GCI_CCTL_FGCAV_OFFSET                  21 /**< ForceGciClkAvailValue */
+#define GCI_CCTL_SCS_OFFSET                    24 /**< SeciClkStretch, 31:24 */
+
+#define GCI_MODE_UART                          0x0
+#define GCI_MODE_SECI                          0x1
+#define GCI_MODE_BTSIG                         0x2
+#define GCI_MODE_GPIO                          0x3
+#define GCI_MODE_MASK                          0x7
+
+#define GCI_CCTL_LOWTOUT_DIS                   0x0
+#define GCI_CCTL_LOWTOUT_10BIT                 0x1
+#define GCI_CCTL_LOWTOUT_20BIT                 0x2
+#define GCI_CCTL_LOWTOUT_30BIT                 0x3
+#define GCI_CCTL_LOWTOUT_MASK                  0x3
+
+#define GCI_CCTL_SCS_DEF                       0x19
+#define GCI_CCTL_SCS_MASK                      0xFF
+
+#define GCI_SECIIN_MODE_OFFSET                 0
+#define GCI_SECIIN_GCIGPIO_OFFSET              4
+#define GCI_SECIIN_RXID2IP_OFFSET              8
+
+#define GCI_SECIOUT_MODE_OFFSET                        0
+#define GCI_SECIOUT_GCIGPIO_OFFSET             4
+#define GCI_SECIOUT_SECIINRELATED_OFFSET       16
+
+#define GCI_SECIAUX_RXENABLE_OFFSET            0
+#define GCI_SECIFIFO_RXENABLE_OFFSET           16
+
+#define GCI_SECITX_ENABLE_OFFSET               0
+
+#define GCI_GPIOCTL_INEN_OFFSET                        0
+#define GCI_GPIOCTL_OUTEN_OFFSET               1
+#define GCI_GPIOCTL_PDN_OFFSET                 4
+
+#define GCI_GPIOIDX_OFFSET                     16
+
+#define GCI_LTECX_SECI_ID                      0 /**< SECI port for LTECX */
+
+/* To access per GCI bit registers */
+#define GCI_REG_WIDTH                          32
+
+/* GCI bit positions */
+/* GCI [127:000] = WLAN [127:0] */
+#define GCI_WLAN_IP_ID                         0
+#define GCI_WLAN_BEGIN                         0
+#define GCI_WLAN_PRIO_POS                      (GCI_WLAN_BEGIN + 4)
+
+/* GCI [639:512] = LTE [127:0] */
+#define GCI_LTE_IP_ID                          4
+#define GCI_LTE_BEGIN                          512
+#define GCI_LTE_FRAMESYNC_POS                  (GCI_LTE_BEGIN + 0)
+#define GCI_LTE_RX_POS                         (GCI_LTE_BEGIN + 1)
+#define GCI_LTE_TX_POS                         (GCI_LTE_BEGIN + 2)
+#define GCI_LTE_AUXRXDVALID_POS                        (GCI_LTE_BEGIN + 56)
+
+/* Reg Index corresponding to ECI bit no x of ECI space */
+#define GCI_REGIDX(x)                          ((x)/GCI_REG_WIDTH)
+/* Bit offset of ECI bit no x in 32-bit words */
+#define GCI_BITOFFSET(x)                       ((x)%GCI_REG_WIDTH)
+
+/* End - GCI Macros */
+
+#ifdef REROUTE_OOBINT
+#define CC_OOB          0x0
+#define M2MDMA_OOB      0x1
+#define PMU_OOB         0x2
+#define D11_OOB         0x3
+#define SDIOD_OOB       0x4
+#define WLAN_OOB       0x5
+#define PMU_OOB_BIT     0x12
+#endif /* REROUTE_OOBINT */
+
+extern void si_pll_sr_reinit(si_t *sih);
+extern void si_pll_closeloop(si_t *sih);
+
+#endif /* _siutils_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/spid.h b/drivers/net/wireless/bcmdhd_1363/include/spid.h
new file mode 100644 (file)
index 0000000..8fdefa4
--- /dev/null
@@ -0,0 +1,168 @@
+/*
+ * SPI device spec header file
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: spid.h 514727 2014-11-12 03:02:48Z $
+ */
+
+#ifndef        _SPI_H
+#define        _SPI_H
+
+/*
+ * Brcm SPI Device Register Map.
+ *
+ */
+
+typedef volatile struct {
+       uint8   config;                 /* 0x00, len, endian, clock, speed, polarity, wakeup */
+       uint8   response_delay;         /* 0x01, read response delay in bytes (corerev < 3) */
+       uint8   status_enable;          /* 0x02, status-enable, intr with status, response_delay
+                                        * function selection, command/data error check
+                                        */
+       uint8   reset_bp;               /* 0x03, reset on wlan/bt backplane reset (corerev >= 1) */
+       uint16  intr_reg;               /* 0x04, Intr status register */
+       uint16  intr_en_reg;            /* 0x06, Intr mask register */
+       uint32  status_reg;             /* 0x08, RO, Status bits of last spi transfer */
+       uint16  f1_info_reg;            /* 0x0c, RO, enabled, ready for data transfer, blocksize */
+       uint16  f2_info_reg;            /* 0x0e, RO, enabled, ready for data transfer, blocksize */
+       uint16  f3_info_reg;            /* 0x10, RO, enabled, ready for data transfer, blocksize */
+       uint32  test_read;              /* 0x14, RO 0xfeedbead signature */
+       uint32  test_rw;                /* 0x18, RW */
+       uint8   resp_delay_f0;          /* 0x1c, read resp delay bytes for F0 (corerev >= 3) */
+       uint8   resp_delay_f1;          /* 0x1d, read resp delay bytes for F1 (corerev >= 3) */
+       uint8   resp_delay_f2;          /* 0x1e, read resp delay bytes for F2 (corerev >= 3) */
+       uint8   resp_delay_f3;          /* 0x1f, read resp delay bytes for F3 (corerev >= 3) */
+} spi_regs_t;
+
+/* SPI device register offsets */
+#define SPID_CONFIG                    0x00
+#define SPID_RESPONSE_DELAY            0x01
+#define SPID_STATUS_ENABLE             0x02
+#define SPID_RESET_BP                  0x03    /* (corerev >= 1) */
+#define SPID_INTR_REG                  0x04    /* 16 bits - Interrupt status */
+#define SPID_INTR_EN_REG               0x06    /* 16 bits - Interrupt mask */
+#define SPID_STATUS_REG                        0x08    /* 32 bits */
+#define SPID_F1_INFO_REG               0x0C    /* 16 bits */
+#define SPID_F2_INFO_REG               0x0E    /* 16 bits */
+#define SPID_F3_INFO_REG               0x10    /* 16 bits */
+#define SPID_TEST_READ                 0x14    /* 32 bits */
+#define SPID_TEST_RW                   0x18    /* 32 bits */
+#define SPID_RESP_DELAY_F0             0x1c    /* 8 bits (corerev >= 3) */
+#define SPID_RESP_DELAY_F1             0x1d    /* 8 bits (corerev >= 3) */
+#define SPID_RESP_DELAY_F2             0x1e    /* 8 bits (corerev >= 3) */
+#define SPID_RESP_DELAY_F3             0x1f    /* 8 bits (corerev >= 3) */
+
+/* Bit masks for SPID_CONFIG device register */
+#define WORD_LENGTH_32 0x1     /* 0/1 16/32 bit word length */
+#define ENDIAN_BIG     0x2     /* 0/1 Little/Big Endian */
+#define CLOCK_PHASE    0x4     /* 0/1 clock phase delay */
+#define CLOCK_POLARITY 0x8     /* 0/1 Idle state clock polarity is low/high */
+#define HIGH_SPEED_MODE        0x10    /* 1/0 High Speed mode / Normal mode */
+#define INTR_POLARITY  0x20    /* 1/0 Interrupt active polarity is high/low */
+#define WAKE_UP                0x80    /* 0/1 Wake-up command from Host to WLAN */
+
+/* Bit mask for SPID_RESPONSE_DELAY device register */
+#define RESPONSE_DELAY_MASK    0xFF    /* Configurable rd response delay in multiples of 8 bits */
+
+/* Bit mask for SPID_STATUS_ENABLE device register */
+#define STATUS_ENABLE          0x1     /* 1/0 Status sent/not sent to host after read/write */
+#define INTR_WITH_STATUS       0x2     /* 0/1 Do-not / do-interrupt if status is sent */
+#define RESP_DELAY_ALL         0x4     /* Applicability of resp delay to F1 or all func's read */
+#define DWORD_PKT_LEN_EN       0x8     /* Packet len denoted in dwords instead of bytes */
+#define CMD_ERR_CHK_EN         0x20    /* Command error check enable */
+#define DATA_ERR_CHK_EN                0x40    /* Data error check enable */
+
+/* Bit mask for SPID_RESET_BP device register */
+#define RESET_ON_WLAN_BP_RESET 0x4     /* enable reset for WLAN backplane */
+#define RESET_ON_BT_BP_RESET   0x8     /* enable reset for BT backplane */
+#define RESET_SPI              0x80    /* reset the above enabled logic */
+
+/* Bit mask for SPID_INTR_REG device register */
+#define DATA_UNAVAILABLE       0x0001  /* Requested data not available; Clear by writing a "1" */
+#define F2_F3_FIFO_RD_UNDERFLOW        0x0002
+#define F2_F3_FIFO_WR_OVERFLOW 0x0004
+#define COMMAND_ERROR          0x0008  /* Cleared by writing 1 */
+#define DATA_ERROR             0x0010  /* Cleared by writing 1 */
+#define F2_PACKET_AVAILABLE    0x0020
+#define F3_PACKET_AVAILABLE    0x0040
+#define F1_OVERFLOW            0x0080  /* Due to last write. Bkplane has pending write requests */
+#define MISC_INTR0             0x0100
+#define MISC_INTR1             0x0200
+#define MISC_INTR2             0x0400
+#define MISC_INTR3             0x0800
+#define MISC_INTR4             0x1000
+#define F1_INTR                        0x2000
+#define F2_INTR                        0x4000
+#define F3_INTR                        0x8000
+
+/* Bit mask for 32bit SPID_STATUS_REG device register */
+#define STATUS_DATA_NOT_AVAILABLE      0x00000001
+#define STATUS_UNDERFLOW               0x00000002
+#define STATUS_OVERFLOW                        0x00000004
+#define STATUS_F2_INTR                 0x00000008
+#define STATUS_F3_INTR                 0x00000010
+#define STATUS_F2_RX_READY             0x00000020
+#define STATUS_F3_RX_READY             0x00000040
+#define STATUS_HOST_CMD_DATA_ERR       0x00000080
+#define STATUS_F2_PKT_AVAILABLE                0x00000100
+#define STATUS_F2_PKT_LEN_MASK         0x000FFE00
+#define STATUS_F2_PKT_LEN_SHIFT                9
+#define STATUS_F3_PKT_AVAILABLE                0x00100000
+#define STATUS_F3_PKT_LEN_MASK         0xFFE00000
+#define STATUS_F3_PKT_LEN_SHIFT                21
+
+/* Bit mask for 16 bits SPID_F1_INFO_REG device register */
+#define F1_ENABLED                     0x0001
+#define F1_RDY_FOR_DATA_TRANSFER       0x0002
+#define F1_MAX_PKT_SIZE                        0x01FC
+
+/* Bit mask for 16 bits SPID_F2_INFO_REG device register */
+#define F2_ENABLED                     0x0001
+#define F2_RDY_FOR_DATA_TRANSFER       0x0002
+#define F2_MAX_PKT_SIZE                        0x3FFC
+
+/* Bit mask for 16 bits SPID_F3_INFO_REG device register */
+#define F3_ENABLED                     0x0001
+#define F3_RDY_FOR_DATA_TRANSFER       0x0002
+#define F3_MAX_PKT_SIZE                        0x3FFC
+
+/* Bit mask for 32 bits SPID_TEST_READ device register read in 16bit LE mode */
+#define TEST_RO_DATA_32BIT_LE          0xFEEDBEAD
+
+/* Maximum number of I/O funcs */
+#define SPI_MAX_IOFUNCS                4
+
+#define SPI_MAX_PKT_LEN                (2048*4)
+
+/* Misc defines */
+#define SPI_FUNC_0             0
+#define SPI_FUNC_1             1
+#define SPI_FUNC_2             2
+#define SPI_FUNC_3             3
+
+#define WAIT_F2RXFIFORDY       100
+#define WAIT_F2RXFIFORDY_DELAY 20
+
+#endif /* _SPI_H */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/trxhdr.h b/drivers/net/wireless/bcmdhd_1363/include/trxhdr.h
new file mode 100644 (file)
index 0000000..50cd3c1
--- /dev/null
@@ -0,0 +1,95 @@
+/*
+ * TRX image file header format.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: trxhdr.h 520026 2014-12-10 01:29:40Z $
+ */
+
+#ifndef _TRX_HDR_H
+#define _TRX_HDR_H
+
+#include <typedefs.h>
+
+#define TRX_MAGIC      0x30524448      /* "HDR0" */
+#define TRX_MAX_LEN    0x3B0000        /* Max length */
+#define TRX_NO_HEADER  1               /* Do not write TRX header */
+#define TRX_GZ_FILES   0x2     /* Contains up to TRX_MAX_OFFSET individual gzip files */
+#define TRX_EMBED_UCODE        0x8     /* Trx contains embedded ucode image */
+#define TRX_ROMSIM_IMAGE       0x10    /* Trx contains ROM simulation image */
+#define TRX_UNCOMP_IMAGE       0x20    /* Trx contains uncompressed rtecdc.bin image */
+#define TRX_BOOTLOADER         0x40    /* the image is a bootloader */
+
+#define TRX_V1         1
+#define TRX_V1_MAX_OFFSETS     3               /* V1: Max number of individual files */
+
+#ifndef BCMTRXV2
+#define TRX_VERSION    TRX_V1          /* Version 1 */
+#define TRX_MAX_OFFSET TRX_V1_MAX_OFFSETS
+#endif
+
+/* BMAC Host driver/application like bcmdl need to support both Ver 1 as well as
+ * Ver 2 of trx header. To make it generic, trx_header is structure is modified
+ * as below where size of "offsets" field will vary as per the TRX version.
+ * Currently, BMAC host driver and bcmdl are modified to support TRXV2 as well.
+ * To make sure, other applications like "dhdl" which are yet to be enhanced to support
+ * TRXV2 are not broken, new macro and structure defintion take effect only when BCMTRXV2
+ * is defined.
+ */
+struct trx_header {
+       uint32 magic;           /* "HDR0" */
+       uint32 len;             /* Length of file including header */
+       uint32 crc32;           /* 32-bit CRC from flag_version to end of file */
+       uint32 flag_version;    /* 0:15 flags, 16:31 version */
+#ifndef BCMTRXV2
+       uint32 offsets[TRX_MAX_OFFSET]; /* Offsets of partitions from start of header */
+#else
+       uint32 offsets[1];      /* Offsets of partitions from start of header */
+#endif
+};
+
+#ifdef BCMTRXV2
+#define TRX_VERSION            TRX_V2          /* Version 2 */
+#define TRX_MAX_OFFSET  TRX_V2_MAX_OFFSETS
+
+#define TRX_V2         2
+/* V2: Max number of individual files
+ * To support SDR signature + Config data region
+ */
+#define TRX_V2_MAX_OFFSETS     5
+#define SIZEOF_TRXHDR_V1       (sizeof(struct trx_header)+(TRX_V1_MAX_OFFSETS-1)*sizeof(uint32))
+#define SIZEOF_TRXHDR_V2       (sizeof(struct trx_header)+(TRX_V2_MAX_OFFSETS-1)*sizeof(uint32))
+#define TRX_VER(trx)           ((trx)->flag_version>>16)
+#define ISTRX_V1(trx)          (TRX_VER(trx) == TRX_V1)
+#define ISTRX_V2(trx)          (TRX_VER(trx) == TRX_V2)
+/* For V2, return size of V2 size: others, return V1 size */
+#define SIZEOF_TRX(trx)            (ISTRX_V2(trx) ? SIZEOF_TRXHDR_V2: SIZEOF_TRXHDR_V1)
+#else
+#define SIZEOF_TRX(trx)            (sizeof(struct trx_header))
+#endif /* BCMTRXV2 */
+
+/* Compatibility */
+typedef struct trx_header TRXHDR, *PTRXHDR;
+
+#endif /* _TRX_HDR_H */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/typedefs.h b/drivers/net/wireless/bcmdhd_1363/include/typedefs.h
new file mode 100644 (file)
index 0000000..650ead4
--- /dev/null
@@ -0,0 +1,339 @@
+/*
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: typedefs.h 514727 2014-11-12 03:02:48Z $
+ */
+
+#ifndef _TYPEDEFS_H_
+#define _TYPEDEFS_H_
+
+#ifdef SITE_TYPEDEFS
+
+/*
+ * Define SITE_TYPEDEFS in the compile to include a site-specific
+ * typedef file "site_typedefs.h".
+ *
+ * If SITE_TYPEDEFS is not defined, then the code section below makes
+ * inferences about the compile environment based on defined symbols and
+ * possibly compiler pragmas.
+ *
+ * Following these two sections is the Default Typedefs section.
+ * This section is only processed if USE_TYPEDEF_DEFAULTS is
+ * defined. This section has a default set of typedefs and a few
+ * preprocessor symbols (TRUE, FALSE, NULL, ...).
+ */
+
+#include "site_typedefs.h"
+
+#else
+
+/*
+ * Infer the compile environment based on preprocessor symbols and pragmas.
+ * Override type definitions as needed, and include configuration-dependent
+ * header files to define types.
+ */
+
+#ifdef __cplusplus
+
+#define TYPEDEF_BOOL
+#ifndef FALSE
+#define FALSE  false
+#endif
+#ifndef TRUE
+#define TRUE   true
+#endif
+
+#else  /* ! __cplusplus */
+
+
+#endif /* ! __cplusplus */
+
+#if defined(__LP64__)
+#define TYPEDEF_UINTPTR
+typedef unsigned long long int uintptr;
+#endif
+
+
+
+
+
+#if defined(_NEED_SIZE_T_)
+typedef long unsigned int size_t;
+#endif
+
+
+
+
+
+#if defined(__sparc__)
+#define TYPEDEF_ULONG
+#endif
+
+/*
+ * If this is either a Linux hybrid build or the per-port code of a hybrid build
+ * then use the Linux header files to get some of the typedefs.  Otherwise, define
+ * them entirely in this file.  We can't always define the types because we get
+ * a duplicate typedef error; there is no way to "undefine" a typedef.
+ * We know when it's per-port code because each file defines LINUX_PORT at the top.
+ */
+#define TYPEDEF_UINT
+#ifndef TARGETENV_android
+#define TYPEDEF_USHORT
+#define TYPEDEF_ULONG
+#endif /* TARGETENV_android */
+#ifdef __KERNEL__
+#include <linux/version.h>
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19))
+#define TYPEDEF_BOOL
+#endif /* >= 2.6.19 */
+/* special detection for 2.6.18-128.7.1.0.1.el5 */
+#if (LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 18))
+#include <linux/compiler.h>
+#ifdef noinline_for_stack
+#define TYPEDEF_BOOL
+#endif
+#endif /* == 2.6.18 */
+#endif /* __KERNEL__ */
+
+
+/* Do not support the (u)int64 types with strict ansi for GNU C */
+#if defined(__GNUC__) && defined(__STRICT_ANSI__)
+#define TYPEDEF_INT64
+#define TYPEDEF_UINT64
+#endif /* defined(__GNUC__) && defined(__STRICT_ANSI__) */
+
+/* ICL accepts unsigned 64 bit type only, and complains in ANSI mode
+ * for signed or unsigned
+ */
+#if defined(__ICL)
+
+#define TYPEDEF_INT64
+
+#if defined(__STDC__)
+#define TYPEDEF_UINT64
+#endif
+
+#endif /* __ICL */
+
+#if !defined(__DJGPP__)
+
+/* pick up ushort & uint from standard types.h */
+#if defined(__KERNEL__)
+
+/* See note above */
+#include <linux/types.h>       /* sys/types.h and linux/types.h are oil and water */
+
+#else
+
+#include <sys/types.h>
+
+#endif /* linux && __KERNEL__ */
+
+#endif 
+
+
+/* use the default typedefs in the next section of this file */
+#define USE_TYPEDEF_DEFAULTS
+
+#endif /* SITE_TYPEDEFS */
+
+
+/*
+ * Default Typedefs
+ */
+
+#ifdef USE_TYPEDEF_DEFAULTS
+#undef USE_TYPEDEF_DEFAULTS
+
+#ifndef TYPEDEF_BOOL
+typedef        /* @abstract@ */ unsigned char  bool;
+#endif /* endif TYPEDEF_BOOL */
+
+/* define uchar, ushort, uint, ulong */
+
+#ifndef TYPEDEF_UCHAR
+typedef unsigned char  uchar;
+#endif
+
+#ifndef TYPEDEF_USHORT
+typedef unsigned short ushort;
+#endif
+
+#ifndef TYPEDEF_UINT
+typedef unsigned int   uint;
+#endif
+
+#ifndef TYPEDEF_ULONG
+typedef unsigned long  ulong;
+#endif
+
+/* define [u]int8/16/32/64, uintptr */
+
+#ifndef TYPEDEF_UINT8
+typedef unsigned char  uint8;
+#endif
+
+#ifndef TYPEDEF_UINT16
+typedef unsigned short uint16;
+#endif
+
+#ifndef TYPEDEF_UINT32
+typedef unsigned int   uint32;
+#endif
+
+#ifndef TYPEDEF_UINT64
+typedef unsigned long long uint64;
+#endif
+
+#ifndef TYPEDEF_UINTPTR
+typedef unsigned int   uintptr;
+#endif
+
+#ifndef TYPEDEF_INT8
+typedef signed char    int8;
+#endif
+
+#ifndef TYPEDEF_INT16
+typedef signed short   int16;
+#endif
+
+#ifndef TYPEDEF_INT32
+typedef signed int     int32;
+#endif
+
+#ifndef TYPEDEF_INT64
+typedef signed long long int64;
+#endif
+
+/* define float32/64, float_t */
+
+#ifndef TYPEDEF_FLOAT32
+typedef float          float32;
+#endif
+
+#ifndef TYPEDEF_FLOAT64
+typedef double         float64;
+#endif
+
+/*
+ * abstracted floating point type allows for compile time selection of
+ * single or double precision arithmetic.  Compiling with -DFLOAT32
+ * selects single precision; the default is double precision.
+ */
+
+#ifndef TYPEDEF_FLOAT_T
+
+#if defined(FLOAT32)
+typedef float32 float_t;
+#else /* default to double precision floating point */
+typedef float64 float_t;
+#endif
+
+#endif /* TYPEDEF_FLOAT_T */
+
+/* define macro values */
+
+#ifndef FALSE
+#define FALSE  0
+#endif
+
+#ifndef TRUE
+#define TRUE   1  /* TRUE */
+#endif
+
+#ifndef NULL
+#define        NULL    0
+#endif
+
+#ifndef OFF
+#define        OFF     0
+#endif
+
+#ifndef ON
+#define        ON      1  /* ON = 1 */
+#endif
+
+#define        AUTO    (-1) /* Auto = -1 */
+
+/* define PTRSZ, INLINE */
+
+#ifndef PTRSZ
+#define        PTRSZ   sizeof(char*)
+#endif
+
+
+/* Detect compiler type. */
+#if defined(__GNUC__) || defined(__lint)
+       #define BWL_COMPILER_GNU
+#elif defined(__CC_ARM) && __CC_ARM
+       #define BWL_COMPILER_ARMCC
+#else
+       #error "Unknown compiler!"
+#endif 
+
+
+#ifndef INLINE
+       #if defined(BWL_COMPILER_MICROSOFT)
+               #define INLINE __inline
+       #elif defined(BWL_COMPILER_GNU)
+               #define INLINE __inline__
+       #elif defined(BWL_COMPILER_ARMCC)
+               #define INLINE  __inline
+       #else
+               #define INLINE
+       #endif 
+#endif /* INLINE */
+
+#undef TYPEDEF_BOOL
+#undef TYPEDEF_UCHAR
+#undef TYPEDEF_USHORT
+#undef TYPEDEF_UINT
+#undef TYPEDEF_ULONG
+#undef TYPEDEF_UINT8
+#undef TYPEDEF_UINT16
+#undef TYPEDEF_UINT32
+#undef TYPEDEF_UINT64
+#undef TYPEDEF_UINTPTR
+#undef TYPEDEF_INT8
+#undef TYPEDEF_INT16
+#undef TYPEDEF_INT32
+#undef TYPEDEF_INT64
+#undef TYPEDEF_FLOAT32
+#undef TYPEDEF_FLOAT64
+#undef TYPEDEF_FLOAT_T
+
+#endif /* USE_TYPEDEF_DEFAULTS */
+
+/* Suppress unused parameter warning */
+#define UNUSED_PARAMETER(x) (void)(x)
+
+/* Avoid warning for discarded const or volatile qualifier in special cases (-Wcast-qual) */
+#define DISCARD_QUAL(ptr, type) ((type *)(uintptr)(ptr))
+
+/*
+ * Including the bcmdefs.h here, to make sure everyone including typedefs.h
+ * gets this automatically
+*/
+#include <bcmdefs.h>
+#endif /* _TYPEDEFS_H_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/wlfc_proto.h b/drivers/net/wireless/bcmdhd_1363/include/wlfc_proto.h
new file mode 100644 (file)
index 0000000..a2d60f4
--- /dev/null
@@ -0,0 +1,350 @@
+/*
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: wlfc_proto.h 542895 2015-03-22 14:13:12Z $
+ *
+ */
+
+/** WL flow control for PROP_TXSTATUS. Related to host AMPDU reordering. */
+
+
+#ifndef __wlfc_proto_definitions_h__
+#define __wlfc_proto_definitions_h__
+
+       /* Use TLV to convey WLFC information.
+        ---------------------------------------------------------------------------
+       | Type |  Len | value                    | Description
+        ---------------------------------------------------------------------------
+       |  1   |   1  | (handle)                 | MAC OPEN
+        ---------------------------------------------------------------------------
+       |  2   |   1  | (handle)                 | MAC CLOSE
+        ---------------------------------------------------------------------------
+       |  3   |   2  | (count, handle, prec_bmp)| Set the credit depth for a MAC dstn
+        ---------------------------------------------------------------------------
+       |  4   |   4+ | see pkttag comments      | TXSTATUS
+       |      |   12 | TX status & timestamps   | Present only when pkt timestamp is enabled
+        ---------------------------------------------------------------------------
+       |  5   |   4  | see pkttag comments      | PKKTTAG [host->firmware]
+        ---------------------------------------------------------------------------
+       |  6   |   8  | (handle, ifid, MAC)      | MAC ADD
+        ---------------------------------------------------------------------------
+       |  7   |   8  | (handle, ifid, MAC)      | MAC DEL
+        ---------------------------------------------------------------------------
+       |  8   |   1  | (rssi)                   | RSSI - RSSI value for the packet.
+        ---------------------------------------------------------------------------
+       |  9   |   1  | (interface ID)           | Interface OPEN
+        ---------------------------------------------------------------------------
+       |  10  |   1  | (interface ID)           | Interface CLOSE
+        ---------------------------------------------------------------------------
+       |  11  |   8  | fifo credit returns map  | FIFO credits back to the host
+       |      |      |                          |
+       |      |      |                          | --------------------------------------
+       |      |      |                          | | ac0 | ac1 | ac2 | ac3 | bcmc | atim |
+       |      |      |                          | --------------------------------------
+       |      |      |                          |
+        ---------------------------------------------------------------------------
+       |  12  |   2  | MAC handle,              | Host provides a bitmap of pending
+       |      |      | AC[0-3] traffic bitmap   | unicast traffic for MAC-handle dstn.
+       |      |      |                          | [host->firmware]
+        ---------------------------------------------------------------------------
+       |  13  |   3  | (count, handle, prec_bmp)| One time request for packet to a specific
+       |      |      |                          | MAC destination.
+        ---------------------------------------------------------------------------
+       |  15  |  12  | (pkttag, timestamps)     | Send TX timestamp at reception from host
+        ---------------------------------------------------------------------------
+       |  16  |  12  | (pkttag, timestamps)     | Send WLAN RX timestamp along with RX frame
+        ---------------------------------------------------------------------------
+       | 255  |  N/A |  N/A                     | FILLER - This is a special type
+       |      |      |                          | that has no length or value.
+       |      |      |                          | Typically used for padding.
+        ---------------------------------------------------------------------------
+       */
+
+#define WLFC_CTL_TYPE_MAC_OPEN                 1
+#define WLFC_CTL_TYPE_MAC_CLOSE                        2
+#define WLFC_CTL_TYPE_MAC_REQUEST_CREDIT       3
+#define WLFC_CTL_TYPE_TXSTATUS                 4
+#define WLFC_CTL_TYPE_PKTTAG                   5       /** host<->dongle */
+
+#define WLFC_CTL_TYPE_MACDESC_ADD              6
+#define WLFC_CTL_TYPE_MACDESC_DEL              7
+#define WLFC_CTL_TYPE_RSSI                     8
+
+#define WLFC_CTL_TYPE_INTERFACE_OPEN           9
+#define WLFC_CTL_TYPE_INTERFACE_CLOSE          10
+
+#define WLFC_CTL_TYPE_FIFO_CREDITBACK          11
+
+#define WLFC_CTL_TYPE_PENDING_TRAFFIC_BMP      12      /** host->dongle */
+#define WLFC_CTL_TYPE_MAC_REQUEST_PACKET       13
+#define WLFC_CTL_TYPE_HOST_REORDER_RXPKTS      14
+
+#define WLFC_CTL_TYPE_TX_ENTRY_STAMP           15
+#define WLFC_CTL_TYPE_RX_STAMP                 16
+#define WLFC_CTL_TYPE_TX_STATUS_STAMP          17      /** obsolete */
+
+#define WLFC_CTL_TYPE_TRANS_ID                 18
+#define WLFC_CTL_TYPE_COMP_TXSTATUS            19
+
+#define WLFC_CTL_TYPE_TID_OPEN                 20
+#define WLFC_CTL_TYPE_TID_CLOSE                        21
+
+
+#define WLFC_CTL_TYPE_FILLER                   255
+
+#define WLFC_CTL_VALUE_LEN_MACDESC             8       /** handle, interface, MAC */
+
+#define WLFC_CTL_VALUE_LEN_MAC                 1       /** MAC-handle */
+#define WLFC_CTL_VALUE_LEN_RSSI                        1
+
+#define WLFC_CTL_VALUE_LEN_INTERFACE           1
+#define WLFC_CTL_VALUE_LEN_PENDING_TRAFFIC_BMP 2
+
+#define WLFC_CTL_VALUE_LEN_TXSTATUS            4
+#define WLFC_CTL_VALUE_LEN_PKTTAG              4
+#define WLFC_CTL_VALUE_LEN_TIMESTAMP           12      /** 4-byte rate info + 2 TSF */
+
+#define WLFC_CTL_VALUE_LEN_SEQ                 2
+
+/* The high bits of ratespec report in timestamp are used for various status */
+#define WLFC_TSFLAGS_RX_RETRY          (1 << 31)
+#define WLFC_TSFLAGS_PM_ENABLED                (1 << 30)
+#define WLFC_TSFLAGS_MASK              (WLFC_TSFLAGS_RX_RETRY | WLFC_TSFLAGS_PM_ENABLED)
+
+/* enough space to host all 4 ACs, bc/mc and atim fifo credit */
+#define WLFC_CTL_VALUE_LEN_FIFO_CREDITBACK     6
+
+#define WLFC_CTL_VALUE_LEN_REQUEST_CREDIT      3       /* credit, MAC-handle, prec_bitmap */
+#define WLFC_CTL_VALUE_LEN_REQUEST_PACKET      3       /* credit, MAC-handle, prec_bitmap */
+
+
+#define WLFC_PKTFLAG_PKTFROMHOST       0x01
+#define WLFC_PKTFLAG_PKT_REQUESTED     0x02
+
+#define WL_TXSTATUS_STATUS_MASK                        0xff /* allow 8 bits */
+#define WL_TXSTATUS_STATUS_SHIFT               24
+
+#define WL_TXSTATUS_SET_STATUS(x, status)      ((x)  = \
+       ((x) & ~(WL_TXSTATUS_STATUS_MASK << WL_TXSTATUS_STATUS_SHIFT)) | \
+       (((status) & WL_TXSTATUS_STATUS_MASK) << WL_TXSTATUS_STATUS_SHIFT))
+#define WL_TXSTATUS_GET_STATUS(x)      (((x) >> WL_TXSTATUS_STATUS_SHIFT) & \
+       WL_TXSTATUS_STATUS_MASK)
+
+/**
+ * Bit 31 of the 32-bit packet tag is defined as 'generation ID'. It is set by the host to the
+ * "current" generation, and by the firmware to the "expected" generation, toggling on suppress. The
+ * firmware accepts a packet when the generation matches; on reset (startup) both "current" and
+ * "expected" are set to 0.
+ */
+#define WL_TXSTATUS_GENERATION_MASK            1 /* allow 1 bit */
+#define WL_TXSTATUS_GENERATION_SHIFT           31
+
+#define WL_TXSTATUS_SET_GENERATION(x, gen)     ((x) = \
+       ((x) & ~(WL_TXSTATUS_GENERATION_MASK << WL_TXSTATUS_GENERATION_SHIFT)) | \
+       (((gen) & WL_TXSTATUS_GENERATION_MASK) << WL_TXSTATUS_GENERATION_SHIFT))
+
+#define WL_TXSTATUS_GET_GENERATION(x)  (((x) >> WL_TXSTATUS_GENERATION_SHIFT) & \
+       WL_TXSTATUS_GENERATION_MASK)
+
+#define WL_TXSTATUS_FLAGS_MASK                 0xf /* allow 4 bits only */
+#define WL_TXSTATUS_FLAGS_SHIFT                        27
+
+#define WL_TXSTATUS_SET_FLAGS(x, flags)        ((x)  = \
+       ((x) & ~(WL_TXSTATUS_FLAGS_MASK << WL_TXSTATUS_FLAGS_SHIFT)) | \
+       (((flags) & WL_TXSTATUS_FLAGS_MASK) << WL_TXSTATUS_FLAGS_SHIFT))
+#define WL_TXSTATUS_GET_FLAGS(x)               (((x) >> WL_TXSTATUS_FLAGS_SHIFT) & \
+       WL_TXSTATUS_FLAGS_MASK)
+
+#define WL_TXSTATUS_FIFO_MASK                  0x7 /* allow 3 bits for FIFO ID */
+#define WL_TXSTATUS_FIFO_SHIFT                 24
+
+#define WL_TXSTATUS_SET_FIFO(x, flags) ((x)  = \
+       ((x) & ~(WL_TXSTATUS_FIFO_MASK << WL_TXSTATUS_FIFO_SHIFT)) | \
+       (((flags) & WL_TXSTATUS_FIFO_MASK) << WL_TXSTATUS_FIFO_SHIFT))
+#define WL_TXSTATUS_GET_FIFO(x)                (((x) >> WL_TXSTATUS_FIFO_SHIFT) & WL_TXSTATUS_FIFO_MASK)
+
+#define WL_TXSTATUS_PKTID_MASK                 0xffffff /* allow 24 bits */
+#define WL_TXSTATUS_SET_PKTID(x, num)  ((x) = \
+       ((x) & ~WL_TXSTATUS_PKTID_MASK) | (num))
+#define WL_TXSTATUS_GET_PKTID(x)               ((x) & WL_TXSTATUS_PKTID_MASK)
+
+#define WL_TXSTATUS_HSLOT_MASK                 0xffff /* allow 16 bits */
+#define WL_TXSTATUS_HSLOT_SHIFT                        8
+
+#define WL_TXSTATUS_SET_HSLOT(x, hslot)        ((x)  = \
+       ((x) & ~(WL_TXSTATUS_HSLOT_MASK << WL_TXSTATUS_HSLOT_SHIFT)) | \
+       (((hslot) & WL_TXSTATUS_HSLOT_MASK) << WL_TXSTATUS_HSLOT_SHIFT))
+#define WL_TXSTATUS_GET_HSLOT(x)       (((x) >> WL_TXSTATUS_HSLOT_SHIFT)& \
+       WL_TXSTATUS_HSLOT_MASK)
+
+#define WL_TXSTATUS_FREERUNCTR_MASK            0xff /* allow 8 bits */
+
+#define WL_TXSTATUS_SET_FREERUNCTR(x, ctr)     ((x)  = \
+       ((x) & ~(WL_TXSTATUS_FREERUNCTR_MASK)) | \
+       ((ctr) & WL_TXSTATUS_FREERUNCTR_MASK))
+#define WL_TXSTATUS_GET_FREERUNCTR(x)          ((x)& WL_TXSTATUS_FREERUNCTR_MASK)
+
+/* Seq number part of AMSDU */
+#define WL_SEQ_AMSDU_MASK             0x1 /* allow 1 bit */
+#define WL_SEQ_AMSDU_SHIFT            14
+#define WL_SEQ_SET_AMSDU(x, val)      ((x) = \
+       ((x) & ~(WL_SEQ_AMSDU_MASK << WL_SEQ_AMSDU_SHIFT)) | \
+       (((val) & WL_SEQ_AMSDU_MASK) << WL_SEQ_AMSDU_SHIFT))
+#define WL_SEQ_GET_AMSDU(x)   (((x) >> WL_SEQ_AMSDU_SHIFT) & \
+                                       WL_SEQ_AMSDU_MASK)
+
+/* Seq number is valid coming from FW */
+#define WL_SEQ_FROMFW_MASK             0x1 /* allow 1 bit */
+#define WL_SEQ_FROMFW_SHIFT            13
+#define WL_SEQ_SET_FROMFW(x, val)      ((x) = \
+       ((x) & ~(WL_SEQ_FROMFW_MASK << WL_SEQ_FROMFW_SHIFT)) | \
+       (((val) & WL_SEQ_FROMFW_MASK) << WL_SEQ_FROMFW_SHIFT))
+#define WL_SEQ_GET_FROMFW(x)   (((x) >> WL_SEQ_FROMFW_SHIFT) & \
+       WL_SEQ_FROMFW_MASK)
+
+/**
+ * Proptxstatus related.
+ *
+ * Pkt from bus layer (DHD for SDIO and pciedev for PCIE)
+ * is re-using seq number previously suppressed
+ * so FW should not assign new one
+ */
+#define WL_SEQ_FROMDRV_MASK            0x1 /* allow 1 bit */
+#define WL_SEQ_FROMDRV_SHIFT           12
+#define WL_SEQ_SET_FROMDRV(x, val)     ((x) = \
+       ((x) & ~(WL_SEQ_FROMDRV_MASK << WL_SEQ_FROMDRV_SHIFT)) | \
+       (((val) & WL_SEQ_FROMDRV_MASK) << WL_SEQ_FROMDRV_SHIFT))
+#define WL_SEQ_GET_FROMDRV(x)  (((x) >> WL_SEQ_FROMDRV_SHIFT) & \
+       WL_SEQ_FROMDRV_MASK)
+
+#define WL_SEQ_NUM_MASK                        0xfff /* allow 12 bit */
+#define WL_SEQ_NUM_SHIFT               0
+#define WL_SEQ_SET_NUM(x, val) ((x) = \
+       ((x) & ~(WL_SEQ_NUM_MASK << WL_SEQ_NUM_SHIFT)) | \
+       (((val) & WL_SEQ_NUM_MASK) << WL_SEQ_NUM_SHIFT))
+#define WL_SEQ_GET_NUM(x)      (((x) >> WL_SEQ_NUM_SHIFT) & \
+       WL_SEQ_NUM_MASK)
+
+#define WL_SEQ_AMSDU_SUPPR_MASK        ((WL_SEQ_FROMDRV_MASK << WL_SEQ_FROMDRV_SHIFT) | \
+                               (WL_SEQ_AMSDU_MASK << WL_SEQ_AMSDU_SHIFT) | \
+                               (WL_SEQ_NUM_MASK << WL_SEQ_NUM_SHIFT))
+
+/* 32 STA should be enough??, 6 bits; Must be power of 2 */
+#define WLFC_MAC_DESC_TABLE_SIZE       32
+#define WLFC_MAX_IFNUM                         16
+#define WLFC_MAC_DESC_ID_INVALID       0xff
+
+/* b[7:5] -reuse guard, b[4:0] -value */
+#define WLFC_MAC_DESC_GET_LOOKUP_INDEX(x) ((x) & 0x1f)
+
+#define WLFC_PKTFLAG_SET_PKTREQUESTED(x)       (x) |= \
+       (WLFC_PKTFLAG_PKT_REQUESTED << WL_TXSTATUS_FLAGS_SHIFT)
+
+#define WLFC_PKTFLAG_CLR_PKTREQUESTED(x)       (x) &= \
+       ~(WLFC_PKTFLAG_PKT_REQUESTED << WL_TXSTATUS_FLAGS_SHIFT)
+
+
+#define WLFC_MAX_PENDING_DATALEN       120
+
+/* host is free to discard the packet */
+#define WLFC_CTL_PKTFLAG_DISCARD       0
+/* D11 suppressed a packet */
+#define WLFC_CTL_PKTFLAG_D11SUPPRESS   1
+/* WL firmware suppressed a packet because MAC is
+       already in PSMode (short time window)
+*/
+#define WLFC_CTL_PKTFLAG_WLSUPPRESS    2
+/* Firmware tossed this packet */
+#define WLFC_CTL_PKTFLAG_TOSSED_BYWLC  3
+/* Firmware tossed after retries */
+#define WLFC_CTL_PKTFLAG_DISCARD_NOACK 4
+/* Firmware wrongly reported suppressed previously,now fixing to acked */
+#define WLFC_CTL_PKTFLAG_SUPPRESS_ACKED        5
+
+#define WLFC_D11_STATUS_INTERPRET(txs) \
+       ((txs)->status.was_acked ? WLFC_CTL_PKTFLAG_DISCARD : \
+       (TXS_SUPR_MAGG_DONE((txs)->status.suppr_ind) ? \
+       WLFC_CTL_PKTFLAG_DISCARD_NOACK : WLFC_CTL_PKTFLAG_D11SUPPRESS))
+
+
+#ifdef PROP_TXSTATUS_DEBUG
+#define WLFC_DBGMESG(x) printf x
+/* wlfc-breadcrumb */
+#define WLFC_BREADCRUMB(x) do {if ((x) == NULL) \
+       {printf("WLFC: %s():%d:caller:%p\n", \
+       __FUNCTION__, __LINE__, __builtin_return_address(0));}} while (0)
+#define WLFC_PRINTMAC(banner, ea) do {printf("%s MAC: [%02x:%02x:%02x:%02x:%02x:%02x]\n", \
+       banner, ea[0],  ea[1],  ea[2],  ea[3],  ea[4],  ea[5]); } while (0)
+#define WLFC_WHEREIS(s) printf("WLFC: at %s():%d, %s\n", __FUNCTION__, __LINE__, (s))
+#else
+#define WLFC_DBGMESG(x)
+#define WLFC_BREADCRUMB(x)
+#define WLFC_PRINTMAC(banner, ea)
+#define WLFC_WHEREIS(s)
+#endif
+
+/* AMPDU host reorder packet flags */
+#define WLHOST_REORDERDATA_MAXFLOWS            256
+#define WLHOST_REORDERDATA_LEN          10
+#define WLHOST_REORDERDATA_TOTLEN      (WLHOST_REORDERDATA_LEN + 1 + 1) /* +tag +len */
+
+#define WLHOST_REORDERDATA_FLOWID_OFFSET               0
+#define WLHOST_REORDERDATA_MAXIDX_OFFSET               2
+#define WLHOST_REORDERDATA_FLAGS_OFFSET                        4
+#define WLHOST_REORDERDATA_CURIDX_OFFSET               6
+#define WLHOST_REORDERDATA_EXPIDX_OFFSET               8
+
+#define WLHOST_REORDERDATA_DEL_FLOW            0x01
+#define WLHOST_REORDERDATA_FLUSH_ALL           0x02
+#define WLHOST_REORDERDATA_CURIDX_VALID                0x04
+#define WLHOST_REORDERDATA_EXPIDX_VALID                0x08
+#define WLHOST_REORDERDATA_NEW_HOLE            0x10
+
+/* transaction id data len byte 0: rsvd, byte 1: seqnumber, byte 2-5 will be used for timestampe */
+#define WLFC_CTL_TRANS_ID_LEN                  6
+#define WLFC_TYPE_TRANS_ID_LEN                 6
+
+#define WLFC_MODE_HANGER       1 /* use hanger */
+#define WLFC_MODE_AFQ          2 /* use afq (At Firmware Queue) */
+#define WLFC_IS_OLD_DEF(x) ((x & 1) || (x & 2))
+
+#define WLFC_MODE_AFQ_SHIFT            2       /* afq bit */
+#define WLFC_SET_AFQ(x, val)   ((x) = \
+       ((x) & ~(1 << WLFC_MODE_AFQ_SHIFT)) | \
+       (((val) & 1) << WLFC_MODE_AFQ_SHIFT))
+#define WLFC_GET_AFQ(x)        (((x) >> WLFC_MODE_AFQ_SHIFT) & 1)
+
+#define WLFC_MODE_REUSESEQ_SHIFT       3       /* seq reuse bit */
+#define WLFC_SET_REUSESEQ(x, val)      ((x) = \
+       ((x) & ~(1 << WLFC_MODE_REUSESEQ_SHIFT)) | \
+       (((val) & 1) << WLFC_MODE_REUSESEQ_SHIFT))
+#define WLFC_GET_REUSESEQ(x)   (((x) >> WLFC_MODE_REUSESEQ_SHIFT) & 1)
+
+#define WLFC_MODE_REORDERSUPP_SHIFT    4       /* host reorder suppress pkt bit */
+#define WLFC_SET_REORDERSUPP(x, val)   ((x) = \
+       ((x) & ~(1 << WLFC_MODE_REORDERSUPP_SHIFT)) | \
+       (((val) & 1) << WLFC_MODE_REORDERSUPP_SHIFT))
+#define WLFC_GET_REORDERSUPP(x)        (((x) >> WLFC_MODE_REORDERSUPP_SHIFT) & 1)
+
+#endif /* __wlfc_proto_definitions_h__ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/wlioctl.h b/drivers/net/wireless/bcmdhd_1363/include/wlioctl.h
new file mode 100644 (file)
index 0000000..5865c04
--- /dev/null
@@ -0,0 +1,8087 @@
+/*
+ * Custom OID/ioctl definitions for
+ *
+ *
+ * Broadcom 802.11abg Networking Device Driver
+ *
+ * Definitions subject to change without notice.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: wlioctl.h 633955 2016-04-26 08:17:00Z $
+ */
+
+#ifndef _wlioctl_h_
+#define        _wlioctl_h_
+
+#include <typedefs.h>
+#include <proto/ethernet.h>
+#include <proto/bcmip.h>
+#include <proto/bcmeth.h>
+#include <proto/bcmip.h>
+#include <proto/bcmevent.h>
+#include <proto/802.11.h>
+#include <proto/802.1d.h>
+#include <bcmwifi_channels.h>
+#include <bcmwifi_rates.h>
+#include <devctrl_if/wlioctl_defs.h>
+#include <proto/bcmipv6.h>
+
+#include <bcm_mpool_pub.h>
+#include <bcmcdc.h>
+
+
+
+
+
+typedef struct {
+       uint32 num;
+       chanspec_t list[1];
+} chanspec_list_t;
+
+#define RSN_KCK_LENGTH 16
+#define RSN_KEK_LENGTH 16
+
+
+#ifndef INTF_NAME_SIZ
+#define INTF_NAME_SIZ  16
+#endif
+
+/* Used to send ioctls over the transport pipe */
+typedef struct remote_ioctl {
+       cdc_ioctl_t     msg;
+       uint32          data_len;
+       char           intf_name[INTF_NAME_SIZ];
+} rem_ioctl_t;
+#define REMOTE_SIZE    sizeof(rem_ioctl_t)
+
+
+/* DFS Forced param */
+typedef struct wl_dfs_forced_params {
+       chanspec_t chspec;
+       uint16 version;
+       chanspec_list_t chspec_list;
+} wl_dfs_forced_t;
+
+#define DFS_PREFCHANLIST_VER 0x01
+#define WL_CHSPEC_LIST_FIXED_SIZE      OFFSETOF(chanspec_list_t, list)
+#define WL_DFS_FORCED_PARAMS_FIXED_SIZE \
+       (WL_CHSPEC_LIST_FIXED_SIZE + OFFSETOF(wl_dfs_forced_t, chspec_list))
+#define WL_DFS_FORCED_PARAMS_MAX_SIZE \
+       WL_DFS_FORCED_PARAMS_FIXED_SIZE + (WL_NUMCHANNELS * sizeof(chanspec_t))
+
+/* association decision information */
+typedef struct {
+       bool            assoc_approved;         /**< (re)association approved */
+       uint16          reject_reason;          /**< reason code for rejecting association */
+       struct          ether_addr   da;
+       int64           sys_time;               /**< current system time */
+} assoc_decision_t;
+
+#define DFS_SCAN_S_IDLE                -1
+#define DFS_SCAN_S_RADAR_FREE 0
+#define DFS_SCAN_S_RADAR_FOUND 1
+#define DFS_SCAN_S_INPROGESS 2
+#define DFS_SCAN_S_SCAN_ABORTED 3
+#define DFS_SCAN_S_SCAN_MODESW_INPROGRESS 4
+#define DFS_SCAN_S_MAX 5
+
+
+#define ACTION_FRAME_SIZE 1800
+
+typedef struct wl_action_frame {
+       struct ether_addr       da;
+       uint16                  len;
+       uint32                  packetId;
+       uint8                   data[ACTION_FRAME_SIZE];
+} wl_action_frame_t;
+
+#define WL_WIFI_ACTION_FRAME_SIZE sizeof(struct wl_action_frame)
+
+typedef struct ssid_info
+{
+       uint8           ssid_len;       /**< the length of SSID */
+       uint8           ssid[32];       /**< SSID string */
+} ssid_info_t;
+
+typedef struct wl_af_params {
+       uint32                  channel;
+       int32                   dwell_time;
+       struct ether_addr       BSSID;
+       wl_action_frame_t       action_frame;
+} wl_af_params_t;
+
+#define WL_WIFI_AF_PARAMS_SIZE sizeof(struct wl_af_params)
+
+#define MFP_TEST_FLAG_NORMAL   0
+#define MFP_TEST_FLAG_ANY_KEY  1
+typedef struct wl_sa_query {
+       uint32                  flag;
+       uint8                   action;
+       uint16                  id;
+       struct ether_addr       da;
+} wl_sa_query_t;
+
+/* require default structure packing */
+#define BWL_DEFAULT_PACKING
+#include <packed_section_start.h>
+
+
+/* Flags for OBSS IOVAR Parameters */
+#define WL_OBSS_DYN_BWSW_FLAG_ACTIVITY_PERIOD        (0x01)
+#define WL_OBSS_DYN_BWSW_FLAG_NOACTIVITY_PERIOD      (0x02)
+#define WL_OBSS_DYN_BWSW_FLAG_NOACTIVITY_INCR_PERIOD (0x04)
+#define WL_OBSS_DYN_BWSW_FLAG_PSEUDO_SENSE_PERIOD    (0x08)
+#define WL_OBSS_DYN_BWSW_FLAG_RX_CRS_PERIOD          (0x10)
+#define WL_OBSS_DYN_BWSW_FLAG_DUR_THRESHOLD          (0x20)
+#define WL_OBSS_DYN_BWSW_FLAG_TXOP_PERIOD            (0x40)
+
+/* OBSS IOVAR Version information */
+#define WL_PROT_OBSS_CONFIG_PARAMS_VERSION 1
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint8 obss_bwsw_activity_cfm_count_cfg; /* configurable count in
+               * seconds before we confirm that OBSS is present and
+               * dynamically activate dynamic bwswitch.
+               */
+       uint8 obss_bwsw_no_activity_cfm_count_cfg; /* configurable count in
+               * seconds before we confirm that OBSS is GONE and
+               * dynamically start pseudo upgrade. If in pseudo sense time, we
+               * will see OBSS, [means that, we false detected that OBSS-is-gone
+               * in watchdog] this count will be incremented in steps of
+               * obss_bwsw_no_activity_cfm_count_incr_cfg for confirming OBSS
+               * detection again. Note that, at present, max 30seconds is
+               * allowed like this. [OBSS_BWSW_NO_ACTIVITY_MAX_INCR_DEFAULT]
+               */
+       uint8 obss_bwsw_no_activity_cfm_count_incr_cfg; /* see above
+               */
+       uint16 obss_bwsw_pseudo_sense_count_cfg; /* number of msecs/cnt to be in
+               * pseudo state. This is used to sense/measure the stats from lq.
+               */
+       uint8 obss_bwsw_rx_crs_threshold_cfg; /* RX CRS default threshold */
+       uint8 obss_bwsw_dur_thres; /* OBSS dyn bwsw trigger/RX CRS Sec */
+       uint8 obss_bwsw_txop_threshold_cfg; /* TXOP default threshold */
+} BWL_POST_PACKED_STRUCT wlc_prot_dynbwsw_config_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint32 version; /**< version field */
+       uint32 config_mask;
+       uint32 reset_mask;
+       wlc_prot_dynbwsw_config_t config_params;
+} BWL_POST_PACKED_STRUCT obss_config_params_t;
+
+
+/* bsscfg type */
+typedef enum bsscfg_type_t {
+       BSSCFG_TYPE_GENERIC = 0,        /**< default */
+       BSSCFG_TYPE_P2P = 1,    /**< The BSS is for p2p link */
+       BSSCFG_TYPE_BTA = 2,
+       BSSCFG_TYPE_TDLS = 4,
+       BSSCFG_TYPE_AWDL = 5,
+       BSSCFG_TYPE_PROXD = 6,
+       BSSCFG_TYPE_NAN = 7,
+       BSSCFG_TYPE_MAX
+} bsscfg_type_t;
+
+/* bsscfg subtype */
+enum {
+       BSSCFG_GENERIC_STA  = 1, /* GENERIC */
+       BSSCFG_GENERIC_AP = 2, /* GENERIC */
+       BSSCFG_P2P_GC   = 3, /* P2P */
+       BSSCFG_P2P_GO   = 4, /* P2P */
+       BSSCFG_P2P_DISC = 5, /* P2P */
+};
+
+typedef struct wlc_bsscfg_info {
+       uint32 type;
+       uint32 subtype;
+} wlc_bsscfg_info_t;
+
+
+
+/* Legacy structure to help keep backward compatible wl tool and tray app */
+
+#define        LEGACY_WL_BSS_INFO_VERSION      107     /**< older version of wl_bss_info struct */
+
+typedef struct wl_bss_info_107 {
+       uint32          version;                /**< version field */
+       uint32          length;                 /**< byte length of data in this record,
+                                                * starting at version and including IEs
+                                                */
+       struct ether_addr BSSID;
+       uint16          beacon_period;          /**< units are Kusec */
+       uint16          capability;             /**< Capability information */
+       uint8           SSID_len;
+       uint8           SSID[32];
+       struct {
+               uint    count;                  /**< # rates in this set */
+               uint8   rates[16];              /**< rates in 500kbps units w/hi bit set if basic */
+       } rateset;                              /**< supported rates */
+       uint8           channel;                /**< Channel no. */
+       uint16          atim_window;            /**< units are Kusec */
+       uint8           dtim_period;            /**< DTIM period */
+       int16           RSSI;                   /**< receive signal strength (in dBm) */
+       int8            phy_noise;              /**< noise (in dBm) */
+       uint32          ie_length;              /**< byte length of Information Elements */
+       /* variable length Information Elements */
+} wl_bss_info_107_t;
+
+/*
+ * Per-BSS information structure.
+ */
+
+#define        LEGACY2_WL_BSS_INFO_VERSION     108             /**< old version of wl_bss_info struct */
+
+/* BSS info structure
+ * Applications MUST CHECK ie_offset field and length field to access IEs and
+ * next bss_info structure in a vector (in wl_scan_results_t)
+ */
+typedef struct wl_bss_info_108 {
+       uint32          version;                /**< version field */
+       uint32          length;                 /**< byte length of data in this record,
+                                                * starting at version and including IEs
+                                                */
+       struct ether_addr BSSID;
+       uint16          beacon_period;          /**< units are Kusec */
+       uint16          capability;             /**< Capability information */
+       uint8           SSID_len;
+       uint8           SSID[32];
+       struct {
+               uint    count;                  /**< # rates in this set */
+               uint8   rates[16];              /**< rates in 500kbps units w/hi bit set if basic */
+       } rateset;                              /**< supported rates */
+       chanspec_t      chanspec;               /**< chanspec for bss */
+       uint16          atim_window;            /**< units are Kusec */
+       uint8           dtim_period;            /**< DTIM period */
+       int16           RSSI;                   /**< receive signal strength (in dBm) */
+       int8            phy_noise;              /**< noise (in dBm) */
+
+       uint8           n_cap;                  /**< BSS is 802.11N Capable */
+       uint32          nbss_cap;               /**< 802.11N BSS Capabilities (based on HT_CAP_*) */
+       uint8           ctl_ch;                 /**< 802.11N BSS control channel number */
+       uint32          reserved32[1];          /**< Reserved for expansion of BSS properties */
+       uint8           flags;                  /**< flags */
+       uint8           reserved[3];            /**< Reserved for expansion of BSS properties */
+       uint8           basic_mcs[MCSSET_LEN];  /**< 802.11N BSS required MCS set */
+
+       uint16          ie_offset;              /**< offset at which IEs start, from beginning */
+       uint32          ie_length;              /**< byte length of Information Elements */
+       /* Add new fields here */
+       /* variable length Information Elements */
+} wl_bss_info_108_t;
+
+#define        WL_BSS_INFO_VERSION     109             /**< current version of wl_bss_info struct */
+
+/* BSS info structure
+ * Applications MUST CHECK ie_offset field and length field to access IEs and
+ * next bss_info structure in a vector (in wl_scan_results_t)
+ */
+typedef struct wl_bss_info {
+       uint32          version;                /**< version field */
+       uint32          length;                 /**< byte length of data in this record,
+                                                * starting at version and including IEs
+                                                */
+       struct ether_addr BSSID;
+       uint16          beacon_period;          /**< units are Kusec */
+       uint16          capability;             /**< Capability information */
+       uint8           SSID_len;
+       uint8           SSID[32];
+       struct {
+               uint    count;                  /**< # rates in this set */
+               uint8   rates[16];              /**< rates in 500kbps units w/hi bit set if basic */
+       } rateset;                              /**< supported rates */
+       chanspec_t      chanspec;               /**< chanspec for bss */
+       uint16          atim_window;            /**< units are Kusec */
+       uint8           dtim_period;            /**< DTIM period */
+       int16           RSSI;                   /**< receive signal strength (in dBm) */
+       int8            phy_noise;              /**< noise (in dBm) */
+
+       uint8           n_cap;                  /**< BSS is 802.11N Capable */
+       uint32          nbss_cap;               /**< 802.11N+AC BSS Capabilities */
+       uint8           ctl_ch;                 /**< 802.11N BSS control channel number */
+       uint8           padding1[3];            /**< explicit struct alignment padding */
+       uint16          vht_rxmcsmap;   /**< VHT rx mcs map (802.11ac IE, VHT_CAP_MCS_MAP_*) */
+       uint16          vht_txmcsmap;   /**< VHT tx mcs map (802.11ac IE, VHT_CAP_MCS_MAP_*) */
+       uint8           flags;                  /**< flags */
+       uint8           vht_cap;                /**< BSS is vht capable */
+       uint8           reserved[2];            /**< Reserved for expansion of BSS properties */
+       uint8           basic_mcs[MCSSET_LEN];  /**< 802.11N BSS required MCS set */
+
+       uint16          ie_offset;              /**< offset at which IEs start, from beginning */
+       uint32          ie_length;              /**< byte length of Information Elements */
+       int16           SNR;                    /**< average SNR of during frame reception */
+       uint16          vht_mcsmap;             /**< STA's Associated vhtmcsmap */
+       uint16          vht_mcsmap_prop;        /**< STA's Associated prop vhtmcsmap */
+       uint16          vht_txmcsmap_prop;      /**< prop VHT tx mcs prop */
+       /* Add new fields here */
+       /* variable length Information Elements */
+} wl_bss_info_t;
+
+#define        WL_GSCAN_BSS_INFO_VERSION       1       /* current version of wl_gscan_bss_info struct */
+#define WL_GSCAN_INFO_FIXED_FIELD_SIZE   (sizeof(wl_gscan_bss_info_t) - sizeof(wl_bss_info_t))
+
+typedef struct wl_gscan_bss_info {
+       uint32      timestamp[2];
+       wl_bss_info_t info;
+       /* Do not add any more members below, fixed  */
+       /* and variable length Information Elements to follow */
+} wl_gscan_bss_info_t;
+
+
+typedef struct wl_bsscfg {
+       uint32  bsscfg_idx;
+       uint32  wsec;
+       uint32  WPA_auth;
+       uint32  wsec_index;
+       uint32  associated;
+       uint32  BSS;
+       uint32  phytest_on;
+       struct ether_addr   prev_BSSID;
+       struct ether_addr   BSSID;
+       uint32  targetbss_wpa2_flags;
+       uint32 assoc_type;
+       uint32 assoc_state;
+} wl_bsscfg_t;
+
+typedef struct wl_if_add {
+       uint32  bsscfg_flags;
+       uint32  if_flags;
+       uint32  ap;
+       struct ether_addr   mac_addr;
+       uint32  wlc_index;
+} wl_if_add_t;
+
+typedef struct wl_bss_config {
+       uint32  atim_window;
+       uint32  beacon_period;
+       uint32  chanspec;
+} wl_bss_config_t;
+
+#define WL_BSS_USER_RADAR_CHAN_SELECT  0x1     /**< User application will randomly select
+                                                * radar channel.
+                                                */
+
+#define DLOAD_HANDLER_VER                      1       /**< Downloader version */
+#define DLOAD_FLAG_VER_MASK            0xf000  /**< Downloader version mask */
+#define DLOAD_FLAG_VER_SHIFT   12      /**< Downloader version shift */
+
+#define DL_CRC_NOT_INUSE       0x0001
+#define DL_BEGIN               0x0002
+#define DL_END                 0x0004
+
+/* generic download types & flags */
+enum {
+       DL_TYPE_UCODE = 1,
+       DL_TYPE_CLM = 2
+};
+
+/* ucode type values */
+enum {
+       UCODE_FW,
+       INIT_VALS,
+       BS_INIT_VALS
+};
+
+struct wl_dload_data {
+       uint16 flag;
+       uint16 dload_type;
+       uint32 len;
+       uint32 crc;
+       uint8  data[1];
+};
+typedef struct wl_dload_data wl_dload_data_t;
+
+struct wl_ucode_info {
+       uint32 ucode_type;
+       uint32 num_chunks;
+       uint32 chunk_len;
+       uint32 chunk_num;
+       uint8  data_chunk[1];
+};
+typedef struct wl_ucode_info wl_ucode_info_t;
+
+struct wl_clm_dload_info {
+       uint32 ds_id;
+       uint32 clm_total_len;
+       uint32 num_chunks;
+       uint32 chunk_len;
+       uint32 chunk_offset;
+       uint8  data_chunk[1];
+};
+typedef struct wl_clm_dload_info wl_clm_dload_info_t;
+
+typedef struct wlc_ssid {
+       uint32          SSID_len;
+       uchar           SSID[DOT11_MAX_SSID_LEN];
+} wlc_ssid_t;
+
+typedef struct wlc_ssid_ext {
+       bool       hidden;
+       uint32          SSID_len;
+       uchar           SSID[DOT11_MAX_SSID_LEN];
+} wlc_ssid_ext_t;
+
+
+#define MAX_PREFERRED_AP_NUM     5
+typedef struct wlc_fastssidinfo {
+       uint32                          SSID_channel[MAX_PREFERRED_AP_NUM];
+       wlc_ssid_t              SSID_info[MAX_PREFERRED_AP_NUM];
+} wlc_fastssidinfo_t;
+
+#ifdef CUSTOMER_HW_31_1
+
+#define AP_NORM                0
+#define AP_STEALTH  1
+#define STREET_PASS_AP 2
+
+#define NSC_MAX_TGT_SSID       20
+typedef struct nsc_ssid_entry_list {
+       wlc_ssid_t ssid_info;
+       int ssid_type;
+} nsc_ssid_entry_list_t;
+
+typedef struct nsc_ssid_list {
+       uint32 num_entries;                             /* N wants 150 */
+       nsc_ssid_entry_list_t ssid_entry[1];
+} nsc_ssid_list_t;
+
+#define NSC_TGT_SSID_BUFSZ     (sizeof(nsc_ssid_entry_list_t) * \
+               (NSC_MAX_TGT_SSID - 1) + sizeof(nsc_ssid_list_t))
+
+/* Default values from N */
+#define NSC_SCPATT_ARRSZ       32
+
+/* scan types */
+#define UNI_SCAN       0
+#define SP_SCAN_ACTIVE 1
+#define SP_SCAN_PASSIVE        2
+#define DOZE   3
+
+/* what we found */
+typedef struct nsc_scan_results {
+       wlc_ssid_t ssid;
+       struct ether_addr mac;
+       int scantype;
+       uint16 channel;
+} nsc_scan_results_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct nsc_af_body {
+       uint8                   type;           /* should be 0x7f */
+       uint8                   oui[DOT11_OUI_LEN];     /* just like it says */
+       uint8                   subtype;
+       uint8                   ielen;          /* */
+       uint8                   data[1];        /* variable */
+} BWL_POST_PACKED_STRUCT nsc_af_body_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct nsc_sdlist {
+       uint8   scantype;
+       uint16  duration;
+       uint16  channel;                /* SP only */
+       uint8   ssid_index;             /* SP only */
+       uint16  rate;                   /* SP only */
+} BWL_POST_PACKED_STRUCT nsc_sdlist_t;
+
+typedef struct nsc_scandes {
+       uint32  num_entries;    /* number of list entries */
+       nsc_sdlist_t sdlist[1]; /* variable */
+} nsc_scandes_t;
+
+#define NSC_MAX_SDLIST_ENTRIES 8
+#define NSC_SDDESC_BUFSZ       (sizeof(nsc_sdlist_t) * \
+               (NSC_MAX_SDLIST_ENTRIES - 1) + sizeof(nsc_scandes_t))
+
+#define SCAN_ARR_END   (NSC_MAX_SDLIST_ENTRIES)
+#endif /* CUSTOMER_HW_31_1 */
+
+typedef BWL_PRE_PACKED_STRUCT struct wnm_url {
+       uint8   len;
+       uint8   data[1];
+} BWL_POST_PACKED_STRUCT wnm_url_t;
+
+#define WNM_BSS_SELECT_TYPE_RSSI   0
+#define WNM_BSS_SELECT_TYPE_CU   1
+
+#define WNM_BSSLOAD_MONITOR_VERSION   1
+typedef struct wnm_bssload_monitor_cfg {
+       uint8 version;
+       uint8 band;
+       uint8 duration; /* duration between 1 to 20sec */
+} wnm_bssload_monitor_cfg_t;
+
+#define BSS_MAXTABLE_SIZE 10
+#define WNM_BSS_SELECT_FACTOR_VERSION   1
+typedef struct wnm_bss_select_factor_params {
+       uint8 low;
+       uint8 high;
+       uint8 factor;
+       uint8 pad;
+} wnm_bss_select_factor_params_t;
+
+typedef struct wnm_bss_select_factor_cfg {
+       uint8 version;
+       uint8 band;
+       uint16 type;
+       uint16 pad;
+       uint16 count;
+       wnm_bss_select_factor_params_t params[1];
+} wnm_bss_select_factor_cfg_t;
+
+#define WNM_BSS_SELECT_WEIGHT_VERSION   1
+typedef struct wnm_bss_select_weight_cfg {
+       uint8 version;
+       uint8 band;
+       uint16 type;
+       uint16 weight; /* weightage for each type between 0 to 100 */
+} wnm_bss_select_weight_cfg_t;
+
+#define WNM_ROAM_TRIGGER_VERSION   1
+typedef struct wnm_roam_trigger_cfg {
+       uint8 version;
+       uint8 band;
+       uint16 type;
+       int16 trigger; /* trigger for each type in new roam algorithm */
+} wnm_roam_trigger_cfg_t;
+
+typedef struct chan_scandata {
+       uint8           txpower;
+       uint8           pad;
+       chanspec_t      channel;        /**< Channel num, bw, ctrl_sb and band */
+       uint32          channel_mintime;
+       uint32          channel_maxtime;
+} chan_scandata_t;
+
+typedef enum wl_scan_type {
+       EXTDSCAN_FOREGROUND_SCAN,
+       EXTDSCAN_BACKGROUND_SCAN,
+       EXTDSCAN_FORCEDBACKGROUND_SCAN
+} wl_scan_type_t;
+
+#define WLC_EXTDSCAN_MAX_SSID          5
+
+typedef struct wl_extdscan_params {
+       int8            nprobes;                /**< 0, passive, otherwise active */
+       int8            split_scan;             /**< split scan */
+       int8            band;                   /**< band */
+       int8            pad;
+       wlc_ssid_t      ssid[WLC_EXTDSCAN_MAX_SSID]; /* ssid list */
+       uint32          tx_rate;                /**< in 500ksec units */
+       wl_scan_type_t  scan_type;              /**< enum */
+       int32           channel_num;
+       chan_scandata_t channel_list[1];        /**< list of chandata structs */
+} wl_extdscan_params_t;
+
+#define WL_EXTDSCAN_PARAMS_FIXED_SIZE  (sizeof(wl_extdscan_params_t) - sizeof(chan_scandata_t))
+
+#define WL_SCAN_PARAMS_SSID_MAX        10
+
+typedef struct wl_scan_params {
+       wlc_ssid_t ssid;                /**< default: {0, ""} */
+       struct ether_addr bssid;        /**< default: bcast */
+       int8 bss_type;                  /**< default: any,
+                                        * DOT11_BSSTYPE_ANY/INFRASTRUCTURE/INDEPENDENT
+                                        */
+       uint8 scan_type;                /**< flags, 0 use default */
+       int32 nprobes;                  /**< -1 use default, number of probes per channel */
+       int32 active_time;              /**< -1 use default, dwell time per channel for
+                                        * active scanning
+                                        */
+       int32 passive_time;             /**< -1 use default, dwell time per channel
+                                        * for passive scanning
+                                        */
+       int32 home_time;                /**< -1 use default, dwell time for the home channel
+                                        * between channel scans
+                                        */
+       int32 channel_num;              /**< count of channels and ssids that follow
+                                        *
+                                        * low half is count of channels in channel_list, 0
+                                        * means default (use all available channels)
+                                        *
+                                        * high half is entries in wlc_ssid_t array that
+                                        * follows channel_list, aligned for int32 (4 bytes)
+                                        * meaning an odd channel count implies a 2-byte pad
+                                        * between end of channel_list and first ssid
+                                        *
+                                        * if ssid count is zero, single ssid in the fixed
+                                        * parameter portion is assumed, otherwise ssid in
+                                        * the fixed portion is ignored
+                                        */
+       uint16 channel_list[1];         /**< list of chanspecs */
+} wl_scan_params_t;
+
+/* size of wl_scan_params not including variable length array */
+#define WL_SCAN_PARAMS_FIXED_SIZE 64
+#define WL_MAX_ROAMSCAN_DATSZ  (WL_SCAN_PARAMS_FIXED_SIZE + (WL_NUMCHANNELS * sizeof(uint16)))
+
+#define ISCAN_REQ_VERSION 1
+
+/* incremental scan struct */
+typedef struct wl_iscan_params {
+       uint32 version;
+       uint16 action;
+       uint16 scan_duration;
+       wl_scan_params_t params;
+} wl_iscan_params_t;
+
+/* 3 fields + size of wl_scan_params, not including variable length array */
+#define WL_ISCAN_PARAMS_FIXED_SIZE (OFFSETOF(wl_iscan_params_t, params) + sizeof(wlc_ssid_t))
+
+typedef struct wl_scan_results {
+       uint32 buflen;
+       uint32 version;
+       uint32 count;
+       wl_bss_info_t bss_info[1];
+} wl_scan_results_t;
+
+/* size of wl_scan_results not including variable length array */
+#define WL_SCAN_RESULTS_FIXED_SIZE (sizeof(wl_scan_results_t) - sizeof(wl_bss_info_t))
+
+
+#define ESCAN_REQ_VERSION 1
+
+/** event scan reduces amount of SOC memory needed to store scan results */
+typedef struct wl_escan_params {
+       uint32 version;
+       uint16 action;
+       uint16 sync_id;
+       wl_scan_params_t params;
+} wl_escan_params_t;
+
+#define WL_ESCAN_PARAMS_FIXED_SIZE (OFFSETOF(wl_escan_params_t, params) + sizeof(wlc_ssid_t))
+
+/** event scan reduces amount of SOC memory needed to store scan results */
+typedef struct wl_escan_result {
+       uint32 buflen;
+       uint32 version;
+       uint16 sync_id;
+       uint16 bss_count;
+       wl_bss_info_t bss_info[1];
+} wl_escan_result_t;
+
+#define WL_ESCAN_RESULTS_FIXED_SIZE (sizeof(wl_escan_result_t) - sizeof(wl_bss_info_t))
+
+typedef struct wl_gscan_result {
+       uint32 buflen;
+       uint32 version;
+       wl_gscan_bss_info_t bss_info[1];
+} wl_gscan_result_t;
+
+#define WL_GSCAN_RESULTS_FIXED_SIZE (sizeof(wl_gscan_result_t) - sizeof(wl_gscan_bss_info_t))
+
+/* incremental scan results struct */
+typedef struct wl_iscan_results {
+       uint32 status;
+       wl_scan_results_t results;
+} wl_iscan_results_t;
+
+/* size of wl_iscan_results not including variable length array */
+#define WL_ISCAN_RESULTS_FIXED_SIZE \
+       (WL_SCAN_RESULTS_FIXED_SIZE + OFFSETOF(wl_iscan_results_t, results))
+
+#define SCANOL_PARAMS_VERSION  1
+
+typedef struct scanol_params {
+       uint32 version;
+       uint32 flags;   /**< offload scanning flags */
+       int32 active_time;      /**< -1 use default, dwell time per channel for active scanning */
+       int32 passive_time;     /**< -1 use default, dwell time per channel for passive scanning */
+       int32 idle_rest_time;   /**< -1 use default, time idle between scan cycle */
+       int32 idle_rest_time_multiplier;
+       int32 active_rest_time;
+       int32 active_rest_time_multiplier;
+       int32 scan_cycle_idle_rest_time;
+       int32 scan_cycle_idle_rest_multiplier;
+       int32 scan_cycle_active_rest_time;
+       int32 scan_cycle_active_rest_multiplier;
+       int32 max_rest_time;
+       int32 max_scan_cycles;
+       int32 nprobes;          /**< -1 use default, number of probes per channel */
+       int32 scan_start_delay;
+       uint32 nchannels;
+       uint32 ssid_count;
+       wlc_ssid_t ssidlist[1];
+} scanol_params_t;
+
+typedef struct wl_probe_params {
+       wlc_ssid_t ssid;
+       struct ether_addr bssid;
+       struct ether_addr mac;
+} wl_probe_params_t;
+
+#define WL_MAXRATES_IN_SET             16      /**< max # of rates in a rateset */
+typedef struct wl_rateset {
+       uint32  count;                  /**< # rates in this set */
+       uint8   rates[WL_MAXRATES_IN_SET];      /**< rates in 500kbps units w/hi bit set if basic */
+} wl_rateset_t;
+
+typedef struct wl_rateset_args {
+       uint32  count;                  /**< # rates in this set */
+       uint8   rates[WL_MAXRATES_IN_SET];      /**< rates in 500kbps units w/hi bit set if basic */
+       uint8   mcs[MCSSET_LEN];        /* supported mcs index bit map */
+       uint16 vht_mcs[VHT_CAP_MCS_MAP_NSS_MAX]; /* supported mcs index bit map per nss */
+} wl_rateset_args_t;
+
+#define TXBF_RATE_MCS_ALL              4
+#define TXBF_RATE_VHT_ALL              4
+#define TXBF_RATE_OFDM_ALL             8
+
+typedef struct wl_txbf_rateset {
+       uint8   txbf_rate_mcs[TXBF_RATE_MCS_ALL];       /**< one for each stream */
+       uint8   txbf_rate_mcs_bcm[TXBF_RATE_MCS_ALL];   /**< one for each stream */
+       uint16  txbf_rate_vht[TXBF_RATE_VHT_ALL];       /**< one for each stream */
+       uint16  txbf_rate_vht_bcm[TXBF_RATE_VHT_ALL];   /**< one for each stream */
+       uint8   txbf_rate_ofdm[TXBF_RATE_OFDM_ALL]; /**< bitmap of ofdm rates that enables txbf */
+       uint8   txbf_rate_ofdm_bcm[TXBF_RATE_OFDM_ALL]; /* bitmap of ofdm rates that enables txbf */
+       uint8   txbf_rate_ofdm_cnt;
+       uint8   txbf_rate_ofdm_cnt_bcm;
+} wl_txbf_rateset_t;
+
+#define OFDM_RATE_MASK                 0x0000007f
+typedef uint8 ofdm_rates_t;
+
+typedef struct wl_rates_info {
+       wl_rateset_t rs_tgt;
+       uint32 phy_type;
+       int32 bandtype;
+       uint8 cck_only;
+       uint8 rate_mask;
+       uint8 mcsallow;
+       uint8 bw;
+       uint8 txstreams;
+} wl_rates_info_t;
+
+/* uint32 list */
+typedef struct wl_uint32_list {
+       /* in - # of elements, out - # of entries */
+       uint32 count;
+       /* variable length uint32 list */
+       uint32 element[1];
+} wl_uint32_list_t;
+
+/* used for association with a specific BSSID and chanspec list */
+typedef struct wl_assoc_params {
+       struct ether_addr bssid;        /**< 00:00:00:00:00:00: broadcast scan */
+       uint16 bssid_cnt;               /**< 0: use chanspec_num, and the single bssid,
+                                       * otherwise count of chanspecs in chanspec_list
+                                       * AND paired bssids following chanspec_list
+                                       * also, chanspec_num has to be set to zero
+                                       * for bssid list to be used
+                                       */
+       int32 chanspec_num;             /**< 0: all available channels,
+                                       * otherwise count of chanspecs in chanspec_list
+                                       */
+       chanspec_t chanspec_list[1];    /**< list of chanspecs */
+} wl_assoc_params_t;
+
+#define WL_ASSOC_PARAMS_FIXED_SIZE     OFFSETOF(wl_assoc_params_t, chanspec_list)
+
+/* used for reassociation/roam to a specific BSSID and channel */
+typedef wl_assoc_params_t wl_reassoc_params_t;
+#define WL_REASSOC_PARAMS_FIXED_SIZE   WL_ASSOC_PARAMS_FIXED_SIZE
+
+/* used for association to a specific BSSID and channel */
+typedef wl_assoc_params_t wl_join_assoc_params_t;
+#define WL_JOIN_ASSOC_PARAMS_FIXED_SIZE        WL_ASSOC_PARAMS_FIXED_SIZE
+
+/* used for join with or without a specific bssid and channel list */
+typedef struct wl_join_params {
+       wlc_ssid_t ssid;
+       wl_assoc_params_t params;       /**< optional field, but it must include the fixed portion
+                                        * of the wl_assoc_params_t struct when it does present.
+                                        */
+} wl_join_params_t;
+
+#define WL_JOIN_PARAMS_FIXED_SIZE      (OFFSETOF(wl_join_params_t, params) + \
+                                        WL_ASSOC_PARAMS_FIXED_SIZE)
+/* scan params for extended join */
+typedef struct wl_join_scan_params {
+       uint8 scan_type;                /**< 0 use default, active or passive scan */
+       int32 nprobes;                  /**< -1 use default, number of probes per channel */
+       int32 active_time;              /**< -1 use default, dwell time per channel for
+                                        * active scanning
+                                        */
+       int32 passive_time;             /**< -1 use default, dwell time per channel
+                                        * for passive scanning
+                                        */
+       int32 home_time;                /**< -1 use default, dwell time for the home channel
+                                        * between channel scans
+                                        */
+} wl_join_scan_params_t;
+
+/* extended join params */
+typedef struct wl_extjoin_params {
+       wlc_ssid_t ssid;                /**< {0, ""}: wildcard scan */
+       wl_join_scan_params_t scan;
+       wl_join_assoc_params_t assoc;   /**< optional field, but it must include the fixed portion
+                                        * of the wl_join_assoc_params_t struct when it does
+                                        * present.
+                                        */
+} wl_extjoin_params_t;
+#define WL_EXTJOIN_PARAMS_FIXED_SIZE   (OFFSETOF(wl_extjoin_params_t, assoc) + \
+                                        WL_JOIN_ASSOC_PARAMS_FIXED_SIZE)
+
+#define ANT_SELCFG_MAX         4       /**< max number of antenna configurations */
+#define MAX_STREAMS_SUPPORTED  4       /**< max number of streams supported */
+typedef struct {
+       uint8 ant_config[ANT_SELCFG_MAX];       /**< antenna configuration */
+       uint8 num_antcfg;       /**< number of available antenna configurations */
+} wlc_antselcfg_t;
+
+typedef struct {
+       uint32 duration;        /**< millisecs spent sampling this channel */
+       uint32 congest_ibss;    /**< millisecs in our bss (presumably this traffic will */
+                               /**<  move if cur bss moves channels) */
+       uint32 congest_obss;    /**< traffic not in our bss */
+       uint32 interference;    /**< millisecs detecting a non 802.11 interferer. */
+       uint32 timestamp;       /**< second timestamp */
+} cca_congest_t;
+
+typedef struct {
+       chanspec_t chanspec;    /**< Which channel? */
+       uint16 num_secs;        /**< How many secs worth of data */
+       cca_congest_t  secs[1]; /**< Data */
+} cca_congest_channel_req_t;
+
+typedef struct {
+       uint32 duration;        /**< millisecs spent sampling this channel */
+       uint32 congest;         /**< millisecs detecting busy CCA */
+       uint32 timestamp;       /**< second timestamp */
+} cca_congest_simple_t;
+
+typedef struct {
+       uint16 status;
+       uint16 id;
+       chanspec_t chanspec;    /**< Which channel? */
+       uint16 len;
+       union {
+               cca_congest_simple_t  cca_busy; /**< CCA busy */
+               int noise;                      /**< noise floor */
+       };
+} cca_chan_qual_event_t;
+
+
+/* interference sources */
+enum interference_source {
+       ITFR_NONE = 0,          /**< interference */
+       ITFR_PHONE,             /**< wireless phone */
+       ITFR_VIDEO_CAMERA,      /**< wireless video camera */
+       ITFR_MICROWAVE_OVEN,    /**< microwave oven */
+       ITFR_BABY_MONITOR,      /**< wireless baby monitor */
+       ITFR_BLUETOOTH,         /**< bluetooth */
+       ITFR_VIDEO_CAMERA_OR_BABY_MONITOR,      /**< wireless camera or baby monitor */
+       ITFR_BLUETOOTH_OR_BABY_MONITOR, /**< bluetooth or baby monitor */
+       ITFR_VIDEO_CAMERA_OR_PHONE,     /**< video camera or phone */
+       ITFR_UNIDENTIFIED       /**< interference from unidentified source */
+};
+
+/* structure for interference source report */
+typedef struct {
+       uint32 flags;   /**< flags.  bit definitions below */
+       uint32 source;  /**< last detected interference source */
+       uint32 timestamp;       /**< second timestamp on interferenced flag change */
+} interference_source_rep_t;
+
+#define WLC_CNTRY_BUF_SZ       4               /**< Country string is 3 bytes + NUL */
+
+
+typedef struct wl_country {
+       char country_abbrev[WLC_CNTRY_BUF_SZ];  /**< nul-terminated country code used in
+                                                * the Country IE
+                                                */
+       int32 rev;                              /**< revision specifier for ccode
+                                                * on set, -1 indicates unspecified.
+                                                * on get, rev >= 0
+                                                */
+       char ccode[WLC_CNTRY_BUF_SZ];           /**< nul-terminated built-in country code.
+                                                * variable length, but fixed size in
+                                                * struct allows simple allocation for
+                                                * expected country strings <= 3 chars.
+                                                */
+} wl_country_t;
+
+#define CCODE_INFO_VERSION 1
+
+typedef enum wl_ccode_role {
+       WLC_CCODE_ROLE_ACTIVE = 0,
+       WLC_CCODE_ROLE_HOST,
+       WLC_CCODE_ROLE_80211D_ASSOC,
+       WLC_CCODE_ROLE_80211D_SCAN,
+       WLC_CCODE_ROLE_DEFAULT,
+       WLC_CCODE_LAST
+} wl_ccode_role_t;
+#define WLC_NUM_CCODE_INFO WLC_CCODE_LAST
+
+typedef struct wl_ccode_entry {
+       uint16 reserved;
+       uint8 band;
+       uint8 role;
+       char    ccode[WLC_CNTRY_BUF_SZ];
+} wl_ccode_entry_t;
+
+typedef struct wl_ccode_info {
+       uint16 version;
+       uint16 count;   /* Number of ccodes entries in the set */
+       wl_ccode_entry_t ccodelist[1];
+} wl_ccode_info_t;
+#define WL_CCODE_INFO_FIXED_LEN        OFFSETOF(wl_ccode_info_t, ccodelist)
+
+typedef struct wl_channels_in_country {
+       uint32 buflen;
+       uint32 band;
+       char country_abbrev[WLC_CNTRY_BUF_SZ];
+       uint32 count;
+       uint32 channel[1];
+} wl_channels_in_country_t;
+
+typedef struct wl_country_list {
+       uint32 buflen;
+       uint32 band_set;
+       uint32 band;
+       uint32 count;
+       char country_abbrev[1];
+} wl_country_list_t;
+
+typedef struct wl_rm_req_elt {
+       int8    type;
+       int8    flags;
+       chanspec_t      chanspec;
+       uint32  token;          /**< token for this measurement */
+       uint32  tsf_h;          /**< TSF high 32-bits of Measurement start time */
+       uint32  tsf_l;          /**< TSF low 32-bits */
+       uint32  dur;            /**< TUs */
+} wl_rm_req_elt_t;
+
+typedef struct wl_rm_req {
+       uint32  token;          /**< overall measurement set token */
+       uint32  count;          /**< number of measurement requests */
+       void    *cb;            /**< completion callback function: may be NULL */
+       void    *cb_arg;        /**< arg to completion callback function */
+       wl_rm_req_elt_t req[1]; /**< variable length block of requests */
+} wl_rm_req_t;
+#define WL_RM_REQ_FIXED_LEN    OFFSETOF(wl_rm_req_t, req)
+
+typedef struct wl_rm_rep_elt {
+       int8    type;
+       int8    flags;
+       chanspec_t      chanspec;
+       uint32  token;          /**< token for this measurement */
+       uint32  tsf_h;          /**< TSF high 32-bits of Measurement start time */
+       uint32  tsf_l;          /**< TSF low 32-bits */
+       uint32  dur;            /**< TUs */
+       uint32  len;            /**< byte length of data block */
+       uint8   data[1];        /**< variable length data block */
+} wl_rm_rep_elt_t;
+#define WL_RM_REP_ELT_FIXED_LEN        24      /**< length excluding data block */
+
+#define WL_RPI_REP_BIN_NUM 8
+typedef struct wl_rm_rpi_rep {
+       uint8   rpi[WL_RPI_REP_BIN_NUM];
+       int8    rpi_max[WL_RPI_REP_BIN_NUM];
+} wl_rm_rpi_rep_t;
+
+typedef struct wl_rm_rep {
+       uint32  token;          /**< overall measurement set token */
+       uint32  len;            /**< length of measurement report block */
+       wl_rm_rep_elt_t rep[1]; /**< variable length block of reports */
+} wl_rm_rep_t;
+#define WL_RM_REP_FIXED_LEN    8
+
+
+typedef enum sup_auth_status {
+       /* Basic supplicant authentication states */
+       WLC_SUP_DISCONNECTED = 0,
+       WLC_SUP_CONNECTING,
+       WLC_SUP_IDREQUIRED,
+       WLC_SUP_AUTHENTICATING,
+       WLC_SUP_AUTHENTICATED,
+       WLC_SUP_KEYXCHANGE,
+       WLC_SUP_KEYED,
+       WLC_SUP_TIMEOUT,
+       WLC_SUP_LAST_BASIC_STATE,
+
+       /* Extended supplicant authentication states */
+       /* Waiting to receive handshake msg M1 */
+       WLC_SUP_KEYXCHANGE_WAIT_M1 = WLC_SUP_AUTHENTICATED,
+       /* Preparing to send handshake msg M2 */
+       WLC_SUP_KEYXCHANGE_PREP_M2 = WLC_SUP_KEYXCHANGE,
+       /* Waiting to receive handshake msg M3 */
+       WLC_SUP_KEYXCHANGE_WAIT_M3 = WLC_SUP_LAST_BASIC_STATE,
+       WLC_SUP_KEYXCHANGE_PREP_M4,     /**< Preparing to send handshake msg M4 */
+       WLC_SUP_KEYXCHANGE_WAIT_G1,     /**< Waiting to receive handshake msg G1 */
+       WLC_SUP_KEYXCHANGE_PREP_G2      /**< Preparing to send handshake msg G2 */
+} sup_auth_status_t;
+
+typedef struct wl_wsec_key {
+       uint32          index;          /**< key index */
+       uint32          len;            /**< key length */
+       uint8           data[DOT11_MAX_KEY_SIZE];       /**< key data */
+       uint32          pad_1[18];
+       uint32          algo;           /**< CRYPTO_ALGO_AES_CCM, CRYPTO_ALGO_WEP128, etc */
+       uint32          flags;          /**< misc flags */
+       uint32          pad_2[2];
+       int             pad_3;
+       int             iv_initialized; /**< has IV been initialized already? */
+       int             pad_4;
+       /* Rx IV */
+       struct {
+               uint32  hi;             /**< upper 32 bits of IV */
+               uint16  lo;             /**< lower 16 bits of IV */
+       } rxiv;
+       uint32          pad_5[2];
+       struct ether_addr ea;           /**< per station */
+} wl_wsec_key_t;
+
+#define WSEC_MIN_PSK_LEN       8
+#define WSEC_MAX_PSK_LEN       64
+
+/* Flag for key material needing passhash'ing */
+#define WSEC_PASSPHRASE                (1<<0)
+
+/* receptacle for WLC_SET_WSEC_PMK parameter */
+typedef struct {
+       ushort  key_len;                /**< octets in key material */
+       ushort  flags;                  /**< key handling qualification */
+       uint8   key[WSEC_MAX_PSK_LEN];  /**< PMK material */
+} wsec_pmk_t;
+
+typedef struct _pmkid {
+       struct ether_addr       BSSID;
+       uint8                   PMKID[WPA2_PMKID_LEN];
+} pmkid_t;
+
+typedef struct _pmkid_list {
+       uint32  npmkid;
+       pmkid_t pmkid[1];
+} pmkid_list_t;
+
+typedef struct _pmkid_cand {
+       struct ether_addr       BSSID;
+       uint8                   preauth;
+} pmkid_cand_t;
+
+typedef struct _pmkid_cand_list {
+       uint32  npmkid_cand;
+       pmkid_cand_t    pmkid_cand[1];
+} pmkid_cand_list_t;
+
+#define WL_STA_ANT_MAX         4       /**< max possible rx antennas */
+
+typedef struct wl_assoc_info {
+       uint32          req_len;
+       uint32          resp_len;
+       uint32          flags;
+       struct dot11_assoc_req req;
+       struct ether_addr reassoc_bssid; /* used in reassoc's */
+       struct dot11_assoc_resp resp;
+} wl_assoc_info_t;
+
+typedef struct wl_led_info {
+       uint32      index;      /* led index */
+       uint32      behavior;
+       uint8       activehi;
+} wl_led_info_t;
+
+
+/* srom read/write struct passed through ioctl */
+typedef struct {
+       uint    byteoff;        /**< byte offset */
+       uint    nbytes;         /**< number of bytes */
+       uint16  buf[1];
+} srom_rw_t;
+
+#define CISH_FLAG_PCIECIS      (1 << 15)       /* write CIS format bit for PCIe CIS */
+/* similar cis (srom or otp) struct [iovar: may not be aligned] */
+typedef struct {
+       uint16  source;         /**< cis source */
+       uint16  flags;          /**< flags */
+       uint32  byteoff;        /**< byte offset */
+       uint32  nbytes;         /**< number of bytes */
+       /* data follows here */
+} cis_rw_t;
+
+/* R_REG and W_REG struct passed through ioctl */
+typedef struct {
+       uint32  byteoff;        /**< byte offset of the field in d11regs_t */
+       uint32  val;            /**< read/write value of the field */
+       uint32  size;           /**< sizeof the field */
+       uint    band;           /**< band (optional) */
+} rw_reg_t;
+
+/* Structure used by GET/SET_ATTEN ioctls - it controls power in b/g-band */
+/* PCL - Power Control Loop */
+typedef struct {
+       uint16  auto_ctrl;      /**< WL_ATTEN_XX */
+       uint16  bb;             /**< Baseband attenuation */
+       uint16  radio;          /**< Radio attenuation */
+       uint16  txctl1;         /**< Radio TX_CTL1 value */
+} atten_t;
+
+/* Per-AC retry parameters */
+struct wme_tx_params_s {
+       uint8  short_retry;
+       uint8  short_fallback;
+       uint8  long_retry;
+       uint8  long_fallback;
+       uint16 max_rate;  /* In units of 512 Kbps */
+};
+
+typedef struct wme_tx_params_s wme_tx_params_t;
+
+#define WL_WME_TX_PARAMS_IO_BYTES (sizeof(wme_tx_params_t) * AC_COUNT)
+
+/* Used to get specific link/ac parameters */
+typedef struct {
+       int32 ac;
+       uint8 val;
+       struct ether_addr ea;
+} link_val_t;
+
+
+#define WL_PM_MUTE_TX_VER 1
+
+typedef struct wl_pm_mute_tx {
+       uint16 version;         /**< version */
+       uint16 len;             /**< length */
+       uint16 deadline;        /**< deadline timer (in milliseconds) */
+       uint8  enable;          /**< set to 1 to enable mode; set to 0 to disable it */
+} wl_pm_mute_tx_t;
+
+
+typedef struct {
+       uint16                  ver;            /**< version of this struct */
+       uint16                  len;            /**< length in bytes of this structure */
+       uint16                  cap;            /**< sta's advertised capabilities */
+       uint32                  flags;          /**< flags defined below */
+       uint32                  idle;           /**< time since data pkt rx'd from sta */
+       struct ether_addr       ea;             /**< Station address */
+       wl_rateset_t            rateset;        /**< rateset in use */
+       uint32                  in;             /**< seconds elapsed since associated */
+       uint32                  listen_interval_inms; /* Min Listen interval in ms for this STA */
+       uint32                  tx_pkts;        /**< # of user packets transmitted (unicast) */
+       uint32                  tx_failures;    /**< # of user packets failed */
+       uint32                  rx_ucast_pkts;  /**< # of unicast packets received */
+       uint32                  rx_mcast_pkts;  /**< # of multicast packets received */
+       uint32                  tx_rate;        /**< Rate used by last tx frame */
+       uint32                  rx_rate;        /**< Rate of last successful rx frame */
+       uint32                  rx_decrypt_succeeds;    /**< # of packet decrypted successfully */
+       uint32                  rx_decrypt_failures;    /**< # of packet decrypted unsuccessfully */
+       uint32                  tx_tot_pkts;    /**< # of user tx pkts (ucast + mcast) */
+       uint32                  rx_tot_pkts;    /**< # of data packets recvd (uni + mcast) */
+       uint32                  tx_mcast_pkts;  /**< # of mcast pkts txed */
+       uint64                  tx_tot_bytes;   /**< data bytes txed (ucast + mcast) */
+       uint64                  rx_tot_bytes;   /**< data bytes recvd (ucast + mcast) */
+       uint64                  tx_ucast_bytes; /**< data bytes txed (ucast) */
+       uint64                  tx_mcast_bytes; /**< # data bytes txed (mcast) */
+       uint64                  rx_ucast_bytes; /**< data bytes recvd (ucast) */
+       uint64                  rx_mcast_bytes; /**< data bytes recvd (mcast) */
+       int8                    rssi[WL_STA_ANT_MAX]; /* average rssi per antenna
+                                                                                  * of data frames
+                                                                                  */
+       int8                    nf[WL_STA_ANT_MAX];     /**< per antenna noise floor */
+       uint16                  aid;            /**< association ID */
+       uint16                  ht_capabilities;        /**< advertised ht caps */
+       uint16                  vht_flags;              /**< converted vht flags */
+       uint32                  tx_pkts_retried;        /**< # of frames where a retry was
+                                                        * necessary
+                                                        */
+       uint32                  tx_pkts_retry_exhausted; /* # of user frames where a retry
+                                                         * was exhausted
+                                                         */
+       int8                    rx_lastpkt_rssi[WL_STA_ANT_MAX]; /* Per antenna RSSI of last
+                                                                 * received data frame.
+                                                                 */
+       /* TX WLAN retry/failure statistics:
+        * Separated for host requested frames and WLAN locally generated frames.
+        * Include unicast frame only where the retries/failures can be counted.
+        */
+       uint32                  tx_pkts_total;          /**< # user frames sent successfully */
+       uint32                  tx_pkts_retries;        /**< # user frames retries */
+       uint32                  tx_pkts_fw_total;       /**< # FW generated sent successfully */
+       uint32                  tx_pkts_fw_retries;     /**< # retries for FW generated frames */
+       uint32                  tx_pkts_fw_retry_exhausted;     /**< # FW generated where a retry
+                                                                * was exhausted
+                                                                */
+       uint32                  rx_pkts_retried;        /**< # rx with retry bit set */
+       uint32                  tx_rate_fallback;       /**< lowest fallback TX rate */
+} sta_info_t;
+
+#define WL_OLD_STAINFO_SIZE    OFFSETOF(sta_info_t, tx_tot_pkts)
+
+#define WL_STA_VER             4
+
+typedef struct {
+       uint32 auto_en;
+       uint32 active_ant;
+       uint32 rxcount;
+       int32 avg_snr_per_ant0;
+       int32 avg_snr_per_ant1;
+       int32 avg_snr_per_ant2;
+       uint32 swap_ge_rxcount0;
+       uint32 swap_ge_rxcount1;
+       uint32 swap_ge_snrthresh0;
+       uint32 swap_ge_snrthresh1;
+       uint32 swap_txfail0;
+       uint32 swap_txfail1;
+       uint32 swap_timer0;
+       uint32 swap_timer1;
+       uint32 swap_alivecheck0;
+       uint32 swap_alivecheck1;
+       uint32 rxcount_per_ant0;
+       uint32 rxcount_per_ant1;
+       uint32 acc_rxcount;
+       uint32 acc_rxcount_per_ant0;
+       uint32 acc_rxcount_per_ant1;
+       uint32 tx_auto_en;
+       uint32 tx_active_ant;
+       uint32 rx_policy;
+       uint32 tx_policy;
+       uint32 cell_policy;
+} wlc_swdiv_stats_t;
+
+#define        WLC_NUMRATES    16      /**< max # of rates in a rateset */
+
+typedef struct wlc_rateset {
+       uint32  count;                  /**< number of rates in rates[] */
+       uint8   rates[WLC_NUMRATES];    /**< rates in 500kbps units w/hi bit set if basic */
+       uint8   htphy_membership;       /**< HT PHY Membership */
+       uint8   mcs[MCSSET_LEN];        /**< supported mcs index bit map */
+       uint16  vht_mcsmap;             /**< supported vht mcs nss bit map */
+       uint16  vht_mcsmap_prop;        /**< supported prop vht mcs nss bit map */
+} wlc_rateset_t;
+
+/* Used to get specific STA parameters */
+typedef struct {
+       uint32  val;
+       struct ether_addr ea;
+} scb_val_t;
+
+/* Used by iovar versions of some ioctls, i.e. WLC_SCB_AUTHORIZE et al */
+typedef struct {
+       uint32 code;
+       scb_val_t ioctl_args;
+} authops_t;
+
+/* channel encoding */
+typedef struct channel_info {
+       int hw_channel;
+       int target_channel;
+       int scan_channel;
+} channel_info_t;
+
+/* For ioctls that take a list of MAC addresses */
+typedef struct maclist {
+       uint count;                     /**< number of MAC addresses */
+       struct ether_addr ea[1];        /**< variable length array of MAC addresses */
+} maclist_t;
+
+/* get pkt count struct passed through ioctl */
+typedef struct get_pktcnt {
+       uint rx_good_pkt;
+       uint rx_bad_pkt;
+       uint tx_good_pkt;
+       uint tx_bad_pkt;
+       uint rx_ocast_good_pkt; /* unicast packets destined for others */
+} get_pktcnt_t;
+
+/* NINTENDO2 */
+#define LQ_IDX_MIN              0
+#define LQ_IDX_MAX              1
+#define LQ_IDX_AVG              2
+#define LQ_IDX_SUM              2
+#define LQ_IDX_LAST             3
+#define LQ_STOP_MONITOR         0
+#define LQ_START_MONITOR        1
+
+/* Get averages RSSI, Rx PHY rate and SNR values */
+typedef struct {
+       int rssi[LQ_IDX_LAST];  /* Array to keep min, max, avg rssi */
+       int snr[LQ_IDX_LAST];   /* Array to keep min, max, avg snr */
+       int isvalid;            /* Flag indicating whether above data is valid */
+} wl_lq_t; /* Link Quality */
+
+typedef enum wl_wakeup_reason_type {
+       LCD_ON = 1,
+       LCD_OFF,
+       DRC1_WAKE,
+       DRC2_WAKE,
+       REASON_LAST
+} wl_wr_type_t;
+
+typedef struct {
+/* Unique filter id */
+       uint32  id;
+
+/* stores the reason for the last wake up */
+       uint8   reason;
+} wl_wr_t;
+
+/* Get MAC specific rate histogram command */
+typedef struct {
+       struct  ether_addr ea;  /**< MAC Address */
+       uint8   ac_cat; /**< Access Category */
+       uint8   num_pkts;       /**< Number of packet entries to be averaged */
+} wl_mac_ratehisto_cmd_t;      /**< MAC Specific Rate Histogram command */
+
+/* Get MAC rate histogram response */
+typedef struct {
+       uint32  rate[DOT11_RATE_MAX + 1];       /**< Rates */
+       uint32  mcs[WL_RATESET_SZ_HT_IOCTL * WL_TX_CHAINS_MAX]; /**< MCS counts */
+       uint32  vht[WL_RATESET_SZ_VHT_MCS][WL_TX_CHAINS_MAX];   /**< VHT counts */
+       uint32  tsf_timer[2][2];        /**< Start and End time for 8bytes value */
+       uint32  prop11n_mcs[WLC_11N_LAST_PROP_MCS - WLC_11N_FIRST_PROP_MCS + 1]; /* MCS counts */
+} wl_mac_ratehisto_res_t;      /**< MAC Specific Rate Histogram Response */
+
+/* Linux network driver ioctl encoding */
+typedef struct wl_ioctl {
+       uint cmd;       /**< common ioctl definition */
+       void *buf;      /**< pointer to user buffer */
+       uint len;       /**< length of user buffer */
+       uint8 set;              /**< 1=set IOCTL; 0=query IOCTL */
+       uint used;      /**< bytes read or written (optional) */
+       uint needed;    /**< bytes needed (optional) */
+} wl_ioctl_t;
+
+#ifdef CONFIG_COMPAT
+typedef struct compat_wl_ioctl {
+       uint cmd;       /**< common ioctl definition */
+       uint32 buf;     /**< pointer to user buffer */
+       uint len;       /**< length of user buffer */
+       uint8 set;              /**< 1=set IOCTL; 0=query IOCTL */
+       uint used;      /**< bytes read or written (optional) */
+       uint needed;    /**< bytes needed (optional) */
+} compat_wl_ioctl_t;
+#endif /* CONFIG_COMPAT */
+
+#define WL_NUM_RATES_CCK                       4 /* 1, 2, 5.5, 11 Mbps */
+#define WL_NUM_RATES_OFDM                      8 /* 6, 9, 12, 18, 24, 36, 48, 54 Mbps SISO/CDD */
+#define WL_NUM_RATES_MCS_1STREAM       8 /* MCS 0-7 1-stream rates - SISO/CDD/STBC/MCS */
+#define WL_NUM_RATES_EXTRA_VHT         2 /* Additional VHT 11AC rates */
+#define WL_NUM_RATES_VHT                       10
+#define WL_NUM_RATES_MCS32                     1
+
+
+/*
+ * Structure for passing hardware and software
+ * revision info up from the driver.
+ */
+typedef struct wlc_rev_info {
+       uint            vendorid;       /**< PCI vendor id */
+       uint            deviceid;       /**< device id of chip */
+       uint            radiorev;       /**< radio revision */
+       uint            chiprev;        /**< chip revision */
+       uint            corerev;        /**< core revision */
+       uint            boardid;        /**< board identifier (usu. PCI sub-device id) */
+       uint            boardvendor;    /**< board vendor (usu. PCI sub-vendor id) */
+       uint            boardrev;       /**< board revision */
+       uint            driverrev;      /**< driver version */
+       uint            ucoderev;       /**< microcode version */
+       uint            bus;            /**< bus type */
+       uint            chipnum;        /**< chip number */
+       uint            phytype;        /**< phy type */
+       uint            phyrev;         /**< phy revision */
+       uint            anarev;         /**< anacore rev */
+       uint            chippkg;        /**< chip package info */
+       uint            nvramrev;       /**< nvram revision number */
+} wlc_rev_info_t;
+
+#define WL_REV_INFO_LEGACY_LENGTH      48
+
+#define WL_BRAND_MAX 10
+typedef struct wl_instance_info {
+       uint instance;
+       char brand[WL_BRAND_MAX];
+} wl_instance_info_t;
+
+/* structure to change size of tx fifo */
+typedef struct wl_txfifo_sz {
+       uint16  magic;
+       uint16  fifo;
+       uint16  size;
+} wl_txfifo_sz_t;
+
+/* Transfer info about an IOVar from the driver */
+/* Max supported IOV name size in bytes, + 1 for nul termination */
+#define WLC_IOV_NAME_LEN 30
+typedef struct wlc_iov_trx_s {
+       uint8 module;
+       uint8 type;
+       char name[WLC_IOV_NAME_LEN];
+} wlc_iov_trx_t;
+
+/* bump this number if you change the ioctl interface */
+#define WLC_IOCTL_VERSION      2
+#define WLC_IOCTL_VERSION_LEGACY_IOTYPES       1
+
+#ifdef CONFIG_USBRNDIS_RETAIL
+/* struct passed in for WLC_NDCONFIG_ITEM */
+typedef struct {
+       char *name;
+       void *param;
+} ndconfig_item_t;
+#endif
+
+
+
+#define WL_PHY_PAVARS_LEN      32      /**< Phytype, Bandrange, chain, a[0], b[0], c[0], d[0] .. */
+
+
+#define WL_PHY_PAVAR_VER       1       /**< pavars version */
+#define WL_PHY_PAVARS2_NUM     3       /**< a1, b0, b1 */
+typedef struct wl_pavars2 {
+       uint16 ver;             /**< version of this struct */
+       uint16 len;             /**< len of this structure */
+       uint16 inuse;           /**< driver return 1 for a1,b0,b1 in current band range */
+       uint16 phy_type;        /**< phy type */
+       uint16 bandrange;
+       uint16 chain;
+       uint16 inpa[WL_PHY_PAVARS2_NUM];        /**< phy pavars for one band range */
+} wl_pavars2_t;
+
+typedef struct wl_po {
+       uint16  phy_type;       /**< Phy type */
+       uint16  band;
+       uint16  cckpo;
+       uint32  ofdmpo;
+       uint16  mcspo[8];
+} wl_po_t;
+
+#define WL_NUM_RPCALVARS 5     /**< number of rpcal vars */
+
+typedef struct wl_rpcal {
+       uint16 value;
+       uint16 update;
+} wl_rpcal_t;
+
+typedef struct wl_aci_args {
+       int enter_aci_thresh; /* Trigger level to start detecting ACI */
+       int exit_aci_thresh; /* Trigger level to exit ACI mode */
+       int usec_spin; /* microsecs to delay between rssi samples */
+       int glitch_delay; /* interval between ACI scans when glitch count is consistently high */
+       uint16 nphy_adcpwr_enter_thresh;        /**< ADC power to enter ACI mitigation mode */
+       uint16 nphy_adcpwr_exit_thresh; /**< ADC power to exit ACI mitigation mode */
+       uint16 nphy_repeat_ctr;         /**< Number of tries per channel to compute power */
+       uint16 nphy_num_samples;        /**< Number of samples to compute power on one channel */
+       uint16 nphy_undetect_window_sz; /**< num of undetects to exit ACI Mitigation mode */
+       uint16 nphy_b_energy_lo_aci;    /**< low ACI power energy threshold for bphy */
+       uint16 nphy_b_energy_md_aci;    /**< mid ACI power energy threshold for bphy */
+       uint16 nphy_b_energy_hi_aci;    /**< high ACI power energy threshold for bphy */
+       uint16 nphy_noise_noassoc_glitch_th_up; /* wl interference 4 */
+       uint16 nphy_noise_noassoc_glitch_th_dn;
+       uint16 nphy_noise_assoc_glitch_th_up;
+       uint16 nphy_noise_assoc_glitch_th_dn;
+       uint16 nphy_noise_assoc_aci_glitch_th_up;
+       uint16 nphy_noise_assoc_aci_glitch_th_dn;
+       uint16 nphy_noise_assoc_enter_th;
+       uint16 nphy_noise_noassoc_enter_th;
+       uint16 nphy_noise_assoc_rx_glitch_badplcp_enter_th;
+       uint16 nphy_noise_noassoc_crsidx_incr;
+       uint16 nphy_noise_assoc_crsidx_incr;
+       uint16 nphy_noise_crsidx_decr;
+} wl_aci_args_t;
+
+#define WL_ACI_ARGS_LEGACY_LENGTH      16      /**< bytes of pre NPHY aci args */
+#define        WL_SAMPLECOLLECT_T_VERSION      2       /**< version of wl_samplecollect_args_t struct */
+typedef struct wl_samplecollect_args {
+       /* version 0 fields */
+       uint8 coll_us;
+       int cores;
+       /* add'l version 1 fields */
+       uint16 version;     /* see definition of WL_SAMPLECOLLECT_T_VERSION */
+       uint16 length;      /* length of entire structure */
+       int8 trigger;
+       uint16 timeout;
+       uint16 mode;
+       uint32 pre_dur;
+       uint32 post_dur;
+       uint8 gpio_sel;
+       uint8 downsamp;
+       uint8 be_deaf;
+       uint8 agc;              /**< loop from init gain and going down */
+       uint8 filter;           /**< override high pass corners to lowest */
+       /* add'l version 2 fields */
+       uint8 trigger_state;
+       uint8 module_sel1;
+       uint8 module_sel2;
+       uint16 nsamps;
+       int bitStart;
+       uint32 gpioCapMask;
+} wl_samplecollect_args_t;
+
+#define        WL_SAMPLEDATA_T_VERSION         1       /**< version of wl_samplecollect_args_t struct */
+/* version for unpacked sample data, int16 {(I,Q),Core(0..N)} */
+#define        WL_SAMPLEDATA_T_VERSION_SPEC_AN 2
+
+typedef struct wl_sampledata {
+       uint16 version; /**< structure version */
+       uint16 size;    /**< size of structure */
+       uint16 tag;     /**< Header/Data */
+       uint16 length;  /**< data length */
+       uint32 flag;    /**< bit def */
+} wl_sampledata_t;
+
+
+/* WL_OTA START */
+/* OTA Test Status */
+enum {
+       WL_OTA_TEST_IDLE = 0,   /**< Default Idle state */
+       WL_OTA_TEST_ACTIVE = 1, /**< Test Running */
+       WL_OTA_TEST_SUCCESS = 2,        /**< Successfully Finished Test */
+       WL_OTA_TEST_FAIL = 3    /**< Test Failed in the Middle */
+};
+/* OTA SYNC Status */
+enum {
+       WL_OTA_SYNC_IDLE = 0,   /**< Idle state */
+       WL_OTA_SYNC_ACTIVE = 1, /**< Waiting for Sync */
+       WL_OTA_SYNC_FAIL = 2    /**< Sync pkt not recieved */
+};
+
+/* Various error states dut can get stuck during test */
+enum {
+       WL_OTA_SKIP_TEST_CAL_FAIL = 1,          /**< Phy calibration failed */
+       WL_OTA_SKIP_TEST_SYNCH_FAIL = 2,                /**< Sync Packet not recieved */
+       WL_OTA_SKIP_TEST_FILE_DWNLD_FAIL = 3,   /**< Cmd flow file download failed */
+       WL_OTA_SKIP_TEST_NO_TEST_FOUND = 4,     /**< No test found in Flow file */
+       WL_OTA_SKIP_TEST_WL_NOT_UP = 5,         /**< WL UP failed */
+       WL_OTA_SKIP_TEST_UNKNOWN_CALL           /**< Unintentional scheduling on ota test */
+};
+
+/* Differentiator for ota_tx and ota_rx */
+enum {
+       WL_OTA_TEST_TX = 0,             /**< ota_tx */
+       WL_OTA_TEST_RX = 1,             /**< ota_rx */
+};
+
+/* Catch 3 modes of operation: 20Mhz, 40Mhz, 20 in 40 Mhz */
+enum {
+       WL_OTA_TEST_BW_20_IN_40MHZ = 0,         /**< 20 in 40 operation */
+       WL_OTA_TEST_BW_20MHZ = 1,               /**< 20 Mhz operation */
+       WL_OTA_TEST_BW_40MHZ = 2,               /**< full 40Mhz operation */
+       WL_OTA_TEST_BW_80MHZ = 3                /* full 80Mhz operation */
+};
+
+#define HT_MCS_INUSE   0x00000080      /* HT MCS in use,indicates b0-6 holds an mcs */
+#define VHT_MCS_INUSE  0x00000100      /* VHT MCS in use,indicates b0-6 holds an mcs */
+#define OTA_RATE_MASK 0x0000007f       /* rate/mcs value */
+#define OTA_STF_SISO   0
+#define OTA_STF_CDD            1
+#define OTA_STF_STBC   2
+#define OTA_STF_SDM            3
+
+typedef struct ota_rate_info {
+       uint8 rate_cnt;                                 /**< Total number of rates */
+       uint16 rate_val_mbps[WL_OTA_TEST_MAX_NUM_RATE]; /**< array of rates from 1mbps to 130mbps */
+                                                       /**< for legacy rates : ratein mbps * 2 */
+                                                       /**< for HT rates : mcs index */
+} ota_rate_info_t;
+
+typedef struct ota_power_info {
+       int8 pwr_ctrl_on;       /**< power control on/off */
+       int8 start_pwr;         /**< starting power/index */
+       int8 delta_pwr;         /**< delta power/index */
+       int8 end_pwr;           /**< end power/index */
+} ota_power_info_t;
+
+typedef struct ota_packetengine {
+       uint16 delay;           /* Inter-packet delay */
+                               /**< for ota_tx, delay is tx ifs in micro seconds */
+                               /* for ota_rx, delay is wait time in milliseconds */
+       uint16 nframes;         /* Number of frames */
+       uint16 length;          /* Packet length */
+} ota_packetengine_t;
+
+/* Test info vector */
+typedef struct wl_ota_test_args {
+       uint8 cur_test;                 /**< test phase */
+       uint8 chan;                     /**< channel */
+       uint8 bw;                       /**< bandwidth */
+       uint8 control_band;             /**< control band */
+       uint8 stf_mode;                 /**< stf mode */
+       ota_rate_info_t rt_info;        /**< Rate info */
+       ota_packetengine_t pkteng;      /**< packeteng info */
+       uint8 txant;                    /**< tx antenna */
+       uint8 rxant;                    /**< rx antenna */
+       ota_power_info_t pwr_info;      /**< power sweep info */
+       uint8 wait_for_sync;            /**< wait for sync or not */
+       uint8 ldpc;
+       uint8 sgi;
+       /* Update WL_OTA_TESTVEC_T_VERSION for adding new members to this structure */
+} wl_ota_test_args_t;
+
+#define WL_OTA_TESTVEC_T_VERSION               1       /* version of wl_ota_test_vector_t struct */
+typedef struct wl_ota_test_vector {
+       uint16 version;
+       wl_ota_test_args_t test_arg[WL_OTA_TEST_MAX_NUM_SEQ];   /**< Test argument struct */
+       uint16 test_cnt;                                        /**< Total no of test */
+       uint8 file_dwnld_valid;                                 /**< File successfully downloaded */
+       uint8 sync_timeout;                                     /**< sync packet timeout */
+       int8 sync_fail_action;                                  /**< sync fail action */
+       struct ether_addr sync_mac;                             /**< macaddress for sync pkt */
+       struct ether_addr tx_mac;                               /**< macaddress for tx */
+       struct ether_addr rx_mac;                               /**< macaddress for rx */
+       int8 loop_test;                                 /**< dbg feature to loop the test */
+       uint16 test_rxcnt;
+       /* Update WL_OTA_TESTVEC_T_VERSION for adding new members to this structure */
+} wl_ota_test_vector_t;
+
+
+/* struct copied back form dongle to host to query the status */
+typedef struct wl_ota_test_status {
+       int16 cur_test_cnt;             /**< test phase */
+       int8 skip_test_reason;          /**< skip test reasoin */
+       wl_ota_test_args_t test_arg;    /**< cur test arg details */
+       uint16 test_cnt;                /**< total no of test downloaded */
+       uint8 file_dwnld_valid;         /**< file successfully downloaded ? */
+       uint8 sync_timeout;             /**< sync timeout */
+       int8 sync_fail_action;          /**< sync fail action */
+       struct ether_addr sync_mac;     /**< macaddress for sync pkt */
+       struct ether_addr tx_mac;       /**< tx mac address */
+       struct ether_addr rx_mac;       /**< rx mac address */
+       uint8  test_stage;              /**< check the test status */
+       int8 loop_test;         /**< Debug feature to puts test enfine in a loop */
+       uint8 sync_status;              /**< sync status */
+} wl_ota_test_status_t;
+typedef struct wl_ota_rx_rssi {
+       uint16  pktcnt;         /* Pkt count used for this rx test */
+       chanspec_t chanspec;    /* Channel info on which the packets are received */
+       int16   rssi;           /* Average RSSI of the first 50% packets received */
+} wl_ota_rx_rssi_t;
+
+#define        WL_OTARSSI_T_VERSION            1       /* version of wl_ota_test_rssi_t struct */
+#define WL_OTA_TEST_RSSI_FIXED_SIZE    OFFSETOF(wl_ota_test_rssi_t, rx_rssi)
+
+typedef struct wl_ota_test_rssi {
+       uint8 version;
+       uint8   testcnt;                /* total measured RSSI values, valid on output only */
+       wl_ota_rx_rssi_t rx_rssi[1]; /* Variable length array of wl_ota_rx_rssi_t */
+} wl_ota_test_rssi_t;
+
+/* WL_OTA END */
+
+/* wl_radar_args_t */
+typedef struct {
+       int npulses;    /**< required number of pulses at n * t_int */
+       int ncontig;    /**< required number of pulses at t_int */
+       int min_pw;     /**< minimum pulse width (20 MHz clocks) */
+       int max_pw;     /**< maximum pulse width (20 MHz clocks) */
+       uint16 thresh0; /**< Radar detection, thresh 0 */
+       uint16 thresh1; /**< Radar detection, thresh 1 */
+       uint16 blank;   /**< Radar detection, blank control */
+       uint16 fmdemodcfg;      /**< Radar detection, fmdemod config */
+       int npulses_lp;  /* Radar detection, minimum long pulses */
+       int min_pw_lp; /* Minimum pulsewidth for long pulses */
+       int max_pw_lp; /* Maximum pulsewidth for long pulses */
+       int min_fm_lp; /* Minimum fm for long pulses */
+       int max_span_lp;  /* Maximum deltat for long pulses */
+       int min_deltat; /* Minimum spacing between pulses */
+       int max_deltat; /* Maximum spacing between pulses */
+       uint16 autocorr;        /**< Radar detection, autocorr on or off */
+       uint16 st_level_time;   /**< Radar detection, start_timing level */
+       uint16 t2_min; /* minimum clocks needed to remain in state 2 */
+       uint32 version; /* version */
+       uint32 fra_pulse_err;   /**< sample error margin for detecting French radar pulsed */
+       int npulses_fra;  /* Radar detection, minimum French pulses set */
+       int npulses_stg2;  /* Radar detection, minimum staggered-2 pulses set */
+       int npulses_stg3;  /* Radar detection, minimum staggered-3 pulses set */
+       uint16 percal_mask;     /**< defines which period cal is masked from radar detection */
+       int quant;      /**< quantization resolution to pulse positions */
+       uint32 min_burst_intv_lp;       /**< minimum burst to burst interval for bin3 radar */
+       uint32 max_burst_intv_lp;       /**< maximum burst to burst interval for bin3 radar */
+       int nskip_rst_lp;       /**< number of skipped pulses before resetting lp buffer */
+       int max_pw_tol; /**< maximum tolerance allowd in detected pulse width for radar detection */
+       uint16 feature_mask; /* 16-bit mask to specify enabled features */
+} wl_radar_args_t;
+
+#define WL_RADAR_ARGS_VERSION 2
+
+typedef struct {
+       uint32 version; /* version */
+       uint16 thresh0_20_lo;   /* Radar detection, thresh 0 (range 5250-5350MHz) for BW 20MHz */
+       uint16 thresh1_20_lo;   /* Radar detection, thresh 1 (range 5250-5350MHz) for BW 20MHz */
+       uint16 thresh0_40_lo;   /* Radar detection, thresh 0 (range 5250-5350MHz) for BW 40MHz */
+       uint16 thresh1_40_lo;   /* Radar detection, thresh 1 (range 5250-5350MHz) for BW 40MHz */
+       uint16 thresh0_80_lo;   /* Radar detection, thresh 0 (range 5250-5350MHz) for BW 80MHz */
+       uint16 thresh1_80_lo;   /* Radar detection, thresh 1 (range 5250-5350MHz) for BW 80MHz */
+       uint16 thresh0_20_hi;   /* Radar detection, thresh 0 (range 5470-5725MHz) for BW 20MHz */
+       uint16 thresh1_20_hi;   /* Radar detection, thresh 1 (range 5470-5725MHz) for BW 20MHz */
+       uint16 thresh0_40_hi;   /* Radar detection, thresh 0 (range 5470-5725MHz) for BW 40MHz */
+       uint16 thresh1_40_hi;   /* Radar detection, thresh 1 (range 5470-5725MHz) for BW 40MHz */
+       uint16 thresh0_80_hi;   /* Radar detection, thresh 0 (range 5470-5725MHz) for BW 80MHz */
+       uint16 thresh1_80_hi;   /* Radar detection, thresh 1 (range 5470-5725MHz) for BW 80MHz */
+#ifdef WL11AC160
+       uint16 thresh0_160_lo;  /* Radar detection, thresh 0 (range 5250-5350MHz) for BW 160MHz */
+       uint16 thresh1_160_lo;  /* Radar detection, thresh 1 (range 5250-5350MHz) for BW 160MHz */
+       uint16 thresh0_160_hi;  /* Radar detection, thresh 0 (range 5470-5725MHz) for BW 160MHz */
+       uint16 thresh1_160_hi;  /* Radar detection, thresh 1 (range 5470-5725MHz) for BW 160MHz */
+#endif /* WL11AC160 */
+} wl_radar_thr_t;
+
+#define WL_RADAR_THR_VERSION   2
+
+/* RSSI per antenna */
+typedef struct {
+       uint32  version;                /**< version field */
+       uint32  count;                  /**< number of valid antenna rssi */
+       int8 rssi_ant[WL_RSSI_ANT_MAX]; /**< rssi per antenna */
+} wl_rssi_ant_t;
+
+/* data structure used in 'dfs_status' wl interface, which is used to query dfs status */
+typedef struct {
+       uint state;             /**< noted by WL_DFS_CACSTATE_XX. */
+       uint duration;          /**< time spent in ms in state. */
+       /* as dfs enters ISM state, it removes the operational channel from quiet channel
+        * list and notes the channel in channel_cleared. set to 0 if no channel is cleared
+        */
+       chanspec_t chanspec_cleared;
+       /* chanspec cleared used to be a uint, add another to uint16 to maintain size */
+       uint16 pad;
+} wl_dfs_status_t;
+
+typedef struct {
+       uint state;             /* noted by WL_DFS_CACSTATE_XX */
+       uint duration;          /* time spent in ms in state */
+       chanspec_t chanspec;    /* chanspec of this core */
+       chanspec_t chanspec_last_cleared; /* chanspec last cleared for operation by scanning */
+       uint16 sub_type;        /* currently just the index of the core or the respective PLL */
+       uint16 pad;
+} wl_dfs_sub_status_t;
+
+#define WL_DFS_STATUS_ALL_VERSION      (1)
+typedef struct {
+       uint16 version;         /* version field; current max version 1 */
+       uint16 num_sub_status;
+       wl_dfs_sub_status_t  dfs_sub_status[1]; /* struct array of length num_sub_status */
+} wl_dfs_status_all_t;
+
+#define WL_DFS_AP_MOVE_VERSION (1)
+typedef struct wl_dfs_ap_move_status {
+       int8 version;            /* version field; current max version 1 */
+       int8 move_status;        /* DFS move status */
+       chanspec_t chanspec;     /* New AP Chanspec */
+       wl_dfs_status_all_t scan_status; /* status; see dfs_status_all for wl_dfs_status_all_t */
+} wl_dfs_ap_move_status_t;
+
+
+/* data structure used in 'radar_status' wl interface, which is use to query radar det status */
+typedef struct {
+       bool detected;
+       int count;
+       bool pretended;
+       uint32 radartype;
+       uint32 timenow;
+       uint32 timefromL;
+       int lp_csect_single;
+       int detected_pulse_index;
+       int nconsecq_pulses;
+       chanspec_t ch;
+       int pw[10];
+       int intv[10];
+       int fm[10];
+} wl_radar_status_t;
+
+#define NUM_PWRCTRL_RATES 12
+
+typedef struct {
+       uint8 txpwr_band_max[NUM_PWRCTRL_RATES];        /**< User set target */
+       uint8 txpwr_limit[NUM_PWRCTRL_RATES];           /**< reg and local power limit */
+       uint8 txpwr_local_max;                          /**< local max according to the AP */
+       uint8 txpwr_local_constraint;                   /**< local constraint according to the AP */
+       uint8 txpwr_chan_reg_max;                       /**< Regulatory max for this channel */
+       uint8 txpwr_target[2][NUM_PWRCTRL_RATES];       /**< Latest target for 2.4 and 5 Ghz */
+       uint8 txpwr_est_Pout[2];                        /**< Latest estimate for 2.4 and 5 Ghz */
+       uint8 txpwr_opo[NUM_PWRCTRL_RATES];             /**< On G phy, OFDM power offset */
+       uint8 txpwr_bphy_cck_max[NUM_PWRCTRL_RATES];    /**< Max CCK power for this band (SROM) */
+       uint8 txpwr_bphy_ofdm_max;                      /**< Max OFDM power for this band (SROM) */
+       uint8 txpwr_aphy_max[NUM_PWRCTRL_RATES];        /**< Max power for A band (SROM) */
+       int8  txpwr_antgain[2];                         /**< Ant gain for each band - from SROM */
+       uint8 txpwr_est_Pout_gofdm;                     /**< Pwr estimate for 2.4 OFDM */
+} tx_power_legacy_t;
+
+#define WL_TX_POWER_RATES_LEGACY    45
+#define WL_TX_POWER_MCS20_FIRST         12
+#define WL_TX_POWER_MCS20_NUM           16
+#define WL_TX_POWER_MCS40_FIRST         28
+#define WL_TX_POWER_MCS40_NUM           17
+
+typedef struct {
+       uint32 flags;
+       chanspec_t chanspec;                 /* txpwr report for this channel */
+       chanspec_t local_chanspec;           /* channel on which we are associated */
+       uint8 local_max;                 /* local max according to the AP */
+       uint8 local_constraint;              /* local constraint according to the AP */
+       int8  antgain[2];                /* Ant gain for each band - from SROM */
+       uint8 rf_cores;                  /* count of RF Cores being reported */
+       uint8 est_Pout[4];                           /* Latest tx power out estimate per RF
+                                                         * chain without adjustment
+                                                         */
+       uint8 est_Pout_cck;                          /* Latest CCK tx power out estimate */
+       uint8 user_limit[WL_TX_POWER_RATES_LEGACY];  /* User limit */
+       uint8 reg_limit[WL_TX_POWER_RATES_LEGACY];   /* Regulatory power limit */
+       uint8 board_limit[WL_TX_POWER_RATES_LEGACY]; /* Max power board can support (SROM) */
+       uint8 target[WL_TX_POWER_RATES_LEGACY];      /* Latest target power */
+} tx_power_legacy2_t;
+
+#define WL_NUM_2x2_ELEMENTS            4
+#define WL_NUM_3x3_ELEMENTS            6
+#define WL_NUM_4x4_ELEMENTS            10
+
+typedef struct {
+       uint16 ver;                             /**< version of this struct */
+       uint16 len;                             /**< length in bytes of this structure */
+       uint32 flags;
+       chanspec_t chanspec;                    /**< txpwr report for this channel */
+       chanspec_t local_chanspec;              /**< channel on which we are associated */
+       uint32     buflen;                      /**< ppr buffer length */
+       uint8      pprbuf[1];                   /**< Latest target power buffer */
+} wl_txppr_t;
+
+#define WL_TXPPR_VERSION       1
+#define WL_TXPPR_LENGTH        (sizeof(wl_txppr_t))
+#define TX_POWER_T_VERSION     45
+/* number of ppr serialization buffers, it should be reg, board and target */
+#define WL_TXPPR_SER_BUF_NUM   (3)
+
+typedef struct chanspec_txpwr_max {
+       chanspec_t chanspec;   /* chanspec */
+       uint8 txpwr_max;       /* max txpwr in all the rates */
+       uint8 padding;
+} chanspec_txpwr_max_t;
+
+typedef struct  wl_chanspec_txpwr_max {
+       uint16 ver;                     /**< version of this struct */
+       uint16 len;                     /**< length in bytes of this structure */
+       uint32 count;           /**< number of elements of (chanspec, txpwr_max) pair */
+       chanspec_txpwr_max_t txpwr[1];  /**< array of (chanspec, max_txpwr) pair */
+} wl_chanspec_txpwr_max_t;
+
+#define WL_CHANSPEC_TXPWR_MAX_VER      1
+#define WL_CHANSPEC_TXPWR_MAX_LEN      (sizeof(wl_chanspec_txpwr_max_t))
+
+typedef struct tx_inst_power {
+       uint8 txpwr_est_Pout[2];                        /**< Latest estimate for 2.4 and 5 Ghz */
+       uint8 txpwr_est_Pout_gofdm;                     /**< Pwr estimate for 2.4 OFDM */
+} tx_inst_power_t;
+
+#define WL_NUM_TXCHAIN_MAX     4
+typedef struct wl_txchain_pwr_offsets {
+       int8 offset[WL_NUM_TXCHAIN_MAX];        /**< quarter dBm signed offset for each chain */
+} wl_txchain_pwr_offsets_t;
+/* maximum channels returned by the get valid channels iovar */
+#define WL_NUMCHANNELS         64
+
+/*
+ * Join preference iovar value is an array of tuples. Each tuple has a one-byte type,
+ * a one-byte length, and a variable length value.  RSSI type tuple must be present
+ * in the array.
+ *
+ * Types are defined in "join preference types" section.
+ *
+ * Length is the value size in octets. It is reserved for WL_JOIN_PREF_WPA type tuple
+ * and must be set to zero.
+ *
+ * Values are defined below.
+ *
+ * 1. RSSI - 2 octets
+ * offset 0: reserved
+ * offset 1: reserved
+ *
+ * 2. WPA - 2 + 12 * n octets (n is # tuples defined below)
+ * offset 0: reserved
+ * offset 1: # of tuples
+ * offset 2: tuple 1
+ * offset 14: tuple 2
+ * ...
+ * offset 2 + 12 * (n - 1) octets: tuple n
+ *
+ * struct wpa_cfg_tuple {
+ *   uint8 akm[DOT11_OUI_LEN+1];     akm suite
+ *   uint8 ucipher[DOT11_OUI_LEN+1]; unicast cipher suite
+ *   uint8 mcipher[DOT11_OUI_LEN+1]; multicast cipher suite
+ * };
+ *
+ * multicast cipher suite can be specified as a specific cipher suite or WL_WPA_ACP_MCS_ANY.
+ *
+ * 3. BAND - 2 octets
+ * offset 0: reserved
+ * offset 1: see "band preference" and "band types"
+ *
+ * 4. BAND RSSI - 2 octets
+ * offset 0: band types
+ * offset 1: +ve RSSI boost value in dB
+ */
+
+struct tsinfo_arg {
+       uint8 octets[3];
+};
+
+#define RATE_CCK_1MBPS 0
+#define RATE_CCK_2MBPS 1
+#define RATE_CCK_5_5MBPS 2
+#define RATE_CCK_11MBPS 3
+
+#define RATE_LEGACY_OFDM_6MBPS 0
+#define RATE_LEGACY_OFDM_9MBPS 1
+#define RATE_LEGACY_OFDM_12MBPS 2
+#define RATE_LEGACY_OFDM_18MBPS 3
+#define RATE_LEGACY_OFDM_24MBPS 4
+#define RATE_LEGACY_OFDM_36MBPS 5
+#define RATE_LEGACY_OFDM_48MBPS 6
+#define RATE_LEGACY_OFDM_54MBPS 7
+
+#define WL_BSSTRANS_RSSI_RATE_MAP_VERSION 1
+
+typedef struct wl_bsstrans_rssi {
+       int8 rssi_2g;   /**< RSSI in dbm for 2.4 G */
+       int8 rssi_5g;   /**< RSSI in dbm for 5G, unused for cck */
+} wl_bsstrans_rssi_t;
+
+#define RSSI_RATE_MAP_MAX_STREAMS 4    /**< max streams supported */
+
+/* RSSI to rate mapping, all 20Mhz, no SGI */
+typedef struct wl_bsstrans_rssi_rate_map {
+       uint16 ver;
+       uint16 len; /* length of entire structure */
+       wl_bsstrans_rssi_t cck[WL_NUM_RATES_CCK]; /* 2.4G only */
+       wl_bsstrans_rssi_t ofdm[WL_NUM_RATES_OFDM]; /* 6 to 54mbps */
+       wl_bsstrans_rssi_t phy_n[RSSI_RATE_MAP_MAX_STREAMS][WL_NUM_RATES_MCS_1STREAM]; /* MCS0-7 */
+       wl_bsstrans_rssi_t phy_ac[RSSI_RATE_MAP_MAX_STREAMS][WL_NUM_RATES_VHT]; /* MCS0-9 */
+} wl_bsstrans_rssi_rate_map_t;
+
+#define WL_BSSTRANS_ROAMTHROTTLE_VERSION 1
+
+/* Configure number of scans allowed per throttle period */
+typedef struct wl_bsstrans_roamthrottle {
+       uint16 ver;
+       uint16 period;
+       uint16 scans_allowed;
+} wl_bsstrans_roamthrottle_t;
+
+#define        NFIFO                   6       /**< # tx/rx fifopairs */
+#define NREINITREASONCOUNT     8
+#define REINITREASONIDX(_x)    (((_x) < NREINITREASONCOUNT) ? (_x) : 0)
+
+#define        WL_CNT_T_VERSION        30      /**< current version of wl_cnt_t struct */
+#define WL_CNT_VERSION_6       6
+#define WL_CNT_VERSION_11      11
+
+#define WLC_WITH_XTLV_CNT
+
+/*
+ * tlv IDs uniquely identifies counter component
+ * packed into wl_cmd_t container
+ */
+enum wl_cnt_xtlv_id {
+       WL_CNT_XTLV_WLC = 0x100,                /**< WLC layer counters */
+       WL_CNT_XTLV_CNTV_LE10_UCODE = 0x200,    /**< wl counter ver < 11 UCODE MACSTAT */
+       WL_CNT_XTLV_LT40_UCODE_V1 = 0x300,      /**< corerev < 40 UCODE MACSTAT */
+       WL_CNT_XTLV_GE40_UCODE_V1 = 0x400,      /**< corerev >= 40 UCODE MACSTAT */
+       WL_CNT_XTLV_GE64_UCODEX_V1 = 0x800      /* corerev >= 64 UCODEX MACSTAT */
+};
+
+/* The number of variables in wl macstat cnt struct.
+ * (wl_cnt_ge40mcst_v1_t, wl_cnt_lt40mcst_v1_t, wl_cnt_v_le10_mcst_t)
+ */
+#define WL_CNT_MCST_VAR_NUM 64
+/* sizeof(wl_cnt_ge40mcst_v1_t), sizeof(wl_cnt_lt40mcst_v1_t), and sizeof(wl_cnt_v_le10_mcst_t) */
+#define WL_CNT_MCST_STRUCT_SZ ((uint)sizeof(uint32) * WL_CNT_MCST_VAR_NUM)
+
+#define INVALID_CNT_VAL (uint32)(-1)
+#define WL_CNT_MCXST_STRUCT_SZ ((uint)sizeof(wl_cnt_ge64mcxst_v1_t))
+
+#define WL_XTLV_CNTBUF_MAX_SIZE ((uint)(OFFSETOF(wl_cnt_info_t, data)) +        \
+               (uint)BCM_XTLV_HDR_SIZE + (uint)sizeof(wl_cnt_wlc_t) +          \
+               (uint)BCM_XTLV_HDR_SIZE + WL_CNT_MCST_STRUCT_SZ +              \
+               (uint)BCM_XTLV_HDR_SIZE + WL_CNT_MCXST_STRUCT_SZ)
+
+#define WL_CNTBUF_MAX_SIZE MAX(WL_XTLV_CNTBUF_MAX_SIZE, (uint)sizeof(wl_cnt_ver_11_t))
+
+/* Top structure of counters IOVar buffer */
+typedef struct {
+       uint16  version;        /**< see definition of WL_CNT_T_VERSION */
+       uint16  datalen;        /**< length of data including all paddings. */
+       uint8   data [1];       /**< variable length payload:
+                                * 1 or more bcm_xtlv_t type of tuples.
+                                * each tuple is padded to multiple of 4 bytes.
+                                * 'datalen' field of this structure includes all paddings.
+                                */
+} wl_cnt_info_t;
+
+/* wlc layer counters */
+typedef struct {
+       /* transmit stat counters */
+       uint32  txframe;        /**< tx data frames */
+       uint32  txbyte;         /**< tx data bytes */
+       uint32  txretrans;      /**< tx mac retransmits */
+       uint32  txerror;        /**< tx data errors (derived: sum of others) */
+       uint32  txctl;          /**< tx management frames */
+       uint32  txprshort;      /**< tx short preamble frames */
+       uint32  txserr;         /**< tx status errors */
+       uint32  txnobuf;        /**< tx out of buffers errors */
+       uint32  txnoassoc;      /**< tx discard because we're not associated */
+       uint32  txrunt;         /**< tx runt frames */
+       uint32  txchit;         /**< tx header cache hit (fastpath) */
+       uint32  txcmiss;        /**< tx header cache miss (slowpath) */
+
+       /* transmit chip error counters */
+       uint32  txuflo;         /**< tx fifo underflows */
+       uint32  txphyerr;       /**< tx phy errors (indicated in tx status) */
+       uint32  txphycrs;
+
+       /* receive stat counters */
+       uint32  rxframe;        /**< rx data frames */
+       uint32  rxbyte;         /**< rx data bytes */
+       uint32  rxerror;        /**< rx data errors (derived: sum of others) */
+       uint32  rxctl;          /**< rx management frames */
+       uint32  rxnobuf;        /**< rx out of buffers errors */
+       uint32  rxnondata;      /**< rx non data frames in the data channel errors */
+       uint32  rxbadds;        /**< rx bad DS errors */
+       uint32  rxbadcm;        /**< rx bad control or management frames */
+       uint32  rxfragerr;      /**< rx fragmentation errors */
+       uint32  rxrunt;         /**< rx runt frames */
+       uint32  rxgiant;        /**< rx giant frames */
+       uint32  rxnoscb;        /**< rx no scb error */
+       uint32  rxbadproto;     /**< rx invalid frames */
+       uint32  rxbadsrcmac;    /**< rx frames with Invalid Src Mac */
+       uint32  rxbadda;        /**< rx frames tossed for invalid da */
+       uint32  rxfilter;       /**< rx frames filtered out */
+
+       /* receive chip error counters */
+       uint32  rxoflo;         /**< rx fifo overflow errors */
+       uint32  rxuflo[NFIFO];  /**< rx dma descriptor underflow errors */
+
+       uint32  d11cnt_txrts_off;       /**< d11cnt txrts value when reset d11cnt */
+       uint32  d11cnt_rxcrc_off;       /**< d11cnt rxcrc value when reset d11cnt */
+       uint32  d11cnt_txnocts_off;     /**< d11cnt txnocts value when reset d11cnt */
+
+       /* misc counters */
+       uint32  dmade;          /**< tx/rx dma descriptor errors */
+       uint32  dmada;          /**< tx/rx dma data errors */
+       uint32  dmape;          /**< tx/rx dma descriptor protocol errors */
+       uint32  reset;          /**< reset count */
+       uint32  tbtt;           /**< cnts the TBTT int's */
+       uint32  txdmawar;
+       uint32  pkt_callback_reg_fail;  /**< callbacks register failure */
+
+       /* 802.11 MIB counters, pp. 614 of 802.11 reaff doc. */
+       uint32  txfrag;         /**< dot11TransmittedFragmentCount */
+       uint32  txmulti;        /**< dot11MulticastTransmittedFrameCount */
+       uint32  txfail;         /**< dot11FailedCount */
+       uint32  txretry;        /**< dot11RetryCount */
+       uint32  txretrie;       /**< dot11MultipleRetryCount */
+       uint32  rxdup;          /**< dot11FrameduplicateCount */
+       uint32  txrts;          /**< dot11RTSSuccessCount */
+       uint32  txnocts;        /**< dot11RTSFailureCount */
+       uint32  txnoack;        /**< dot11ACKFailureCount */
+       uint32  rxfrag;         /**< dot11ReceivedFragmentCount */
+       uint32  rxmulti;        /**< dot11MulticastReceivedFrameCount */
+       uint32  rxcrc;          /**< dot11FCSErrorCount */
+       uint32  txfrmsnt;       /**< dot11TransmittedFrameCount (bogus MIB?) */
+       uint32  rxundec;        /**< dot11WEPUndecryptableCount */
+
+       /* WPA2 counters (see rxundec for DecryptFailureCount) */
+       uint32  tkipmicfaill;   /**< TKIPLocalMICFailures */
+       uint32  tkipcntrmsr;    /**< TKIPCounterMeasuresInvoked */
+       uint32  tkipreplay;     /**< TKIPReplays */
+       uint32  ccmpfmterr;     /**< CCMPFormatErrors */
+       uint32  ccmpreplay;     /**< CCMPReplays */
+       uint32  ccmpundec;      /**< CCMPDecryptErrors */
+       uint32  fourwayfail;    /**< FourWayHandshakeFailures */
+       uint32  wepundec;       /**< dot11WEPUndecryptableCount */
+       uint32  wepicverr;      /**< dot11WEPICVErrorCount */
+       uint32  decsuccess;     /**< DecryptSuccessCount */
+       uint32  tkipicverr;     /**< TKIPICVErrorCount */
+       uint32  wepexcluded;    /**< dot11WEPExcludedCount */
+
+       uint32  txchanrej;      /**< Tx frames suppressed due to channel rejection */
+       uint32  psmwds;         /**< Count PSM watchdogs */
+       uint32  phywatchdog;    /**< Count Phy watchdogs (triggered by ucode) */
+
+       /* MBSS counters, AP only */
+       uint32  prq_entries_handled;    /**< PRQ entries read in */
+       uint32  prq_undirected_entries; /**<    which were bcast bss & ssid */
+       uint32  prq_bad_entries;        /**<    which could not be translated to info */
+       uint32  atim_suppress_count;    /**< TX suppressions on ATIM fifo */
+       uint32  bcn_template_not_ready; /**< Template marked in use on send bcn ... */
+       uint32  bcn_template_not_ready_done; /* ...but "DMA done" interrupt rcvd */
+       uint32  late_tbtt_dpc;  /**< TBTT DPC did not happen in time */
+
+       /* per-rate receive stat counters */
+       uint32  rx1mbps;        /* packets rx at 1Mbps */
+       uint32  rx2mbps;        /* packets rx at 2Mbps */
+       uint32  rx5mbps5;       /* packets rx at 5.5Mbps */
+       uint32  rx6mbps;        /* packets rx at 6Mbps */
+       uint32  rx9mbps;        /* packets rx at 9Mbps */
+       uint32  rx11mbps;       /* packets rx at 11Mbps */
+       uint32  rx12mbps;       /* packets rx at 12Mbps */
+       uint32  rx18mbps;       /* packets rx at 18Mbps */
+       uint32  rx24mbps;       /* packets rx at 24Mbps */
+       uint32  rx36mbps;       /* packets rx at 36Mbps */
+       uint32  rx48mbps;       /* packets rx at 48Mbps */
+       uint32  rx54mbps;       /* packets rx at 54Mbps */
+       uint32  rx108mbps;      /* packets rx at 108mbps */
+       uint32  rx162mbps;      /* packets rx at 162mbps */
+       uint32  rx216mbps;      /* packets rx at 216 mbps */
+       uint32  rx270mbps;      /* packets rx at 270 mbps */
+       uint32  rx324mbps;      /* packets rx at 324 mbps */
+       uint32  rx378mbps;      /* packets rx at 378 mbps */
+       uint32  rx432mbps;      /* packets rx at 432 mbps */
+       uint32  rx486mbps;      /* packets rx at 486 mbps */
+       uint32  rx540mbps;      /* packets rx at 540 mbps */
+
+       uint32  rfdisable;      /**< count of radio disables */
+
+       uint32  txexptime;      /**< Tx frames suppressed due to timer expiration */
+
+       uint32  txmpdu_sgi;     /**< count for sgi transmit */
+       uint32  rxmpdu_sgi;     /**< count for sgi received */
+       uint32  txmpdu_stbc;    /**< count for stbc transmit */
+       uint32  rxmpdu_stbc;    /**< count for stbc received */
+
+       uint32  rxundec_mcst;   /**< dot11WEPUndecryptableCount */
+
+       /* WPA2 counters (see rxundec for DecryptFailureCount) */
+       uint32  tkipmicfaill_mcst;      /**< TKIPLocalMICFailures */
+       uint32  tkipcntrmsr_mcst;       /**< TKIPCounterMeasuresInvoked */
+       uint32  tkipreplay_mcst;        /**< TKIPReplays */
+       uint32  ccmpfmterr_mcst;        /**< CCMPFormatErrors */
+       uint32  ccmpreplay_mcst;        /**< CCMPReplays */
+       uint32  ccmpundec_mcst; /**< CCMPDecryptErrors */
+       uint32  fourwayfail_mcst;       /**< FourWayHandshakeFailures */
+       uint32  wepundec_mcst;  /**< dot11WEPUndecryptableCount */
+       uint32  wepicverr_mcst; /**< dot11WEPICVErrorCount */
+       uint32  decsuccess_mcst;        /**< DecryptSuccessCount */
+       uint32  tkipicverr_mcst;        /**< TKIPICVErrorCount */
+       uint32  wepexcluded_mcst;       /**< dot11WEPExcludedCount */
+
+       uint32  dma_hang;       /**< count for dma hang */
+       uint32  reinit;         /**< count for reinit */
+
+       uint32  pstatxucast;    /**< count of ucast frames xmitted on all psta assoc */
+       uint32  pstatxnoassoc;  /**< count of txnoassoc frames xmitted on all psta assoc */
+       uint32  pstarxucast;    /**< count of ucast frames received on all psta assoc */
+       uint32  pstarxbcmc;     /**< count of bcmc frames received on all psta */
+       uint32  pstatxbcmc;     /**< count of bcmc frames transmitted on all psta */
+
+       uint32  cso_passthrough; /* hw cso required but passthrough */
+       uint32  cso_normal;     /**< hw cso hdr for normal process */
+       uint32  chained;        /**< number of frames chained */
+       uint32  chainedsz1;     /**< number of chain size 1 frames */
+       uint32  unchained;      /**< number of frames not chained */
+       uint32  maxchainsz;     /**< max chain size so far */
+       uint32  currchainsz;    /**< current chain size */
+       uint32  pciereset;      /**< Secondary Bus Reset issued by driver */
+       uint32  cfgrestore;     /**< configspace restore by driver */
+       uint32  reinitreason[NREINITREASONCOUNT]; /* reinitreason counters; 0: Unknown reason */
+       uint32  rxrtry;
+
+       uint32  rxmpdu_mu;      /* Number of MU MPDUs received */
+
+       /* detailed control/management frames */
+       uint32  txbar;          /**< Number of TX BAR */
+       uint32  rxbar;          /**< Number of RX BAR */
+       uint32  txpspoll;       /**< Number of TX PS-poll */
+       uint32  rxpspoll;       /**< Number of RX PS-poll */
+       uint32  txnull;         /**< Number of TX NULL_DATA */
+       uint32  rxnull;         /**< Number of RX NULL_DATA */
+       uint32  txqosnull;      /**< Number of TX NULL_QoSDATA */
+       uint32  rxqosnull;      /**< Number of RX NULL_QoSDATA */
+       uint32  txassocreq;     /**< Number of TX ASSOC request */
+       uint32  rxassocreq;     /**< Number of RX ASSOC request */
+       uint32  txreassocreq;   /**< Number of TX REASSOC request */
+       uint32  rxreassocreq;   /**< Number of RX REASSOC request */
+       uint32  txdisassoc;     /**< Number of TX DISASSOC */
+       uint32  rxdisassoc;     /**< Number of RX DISASSOC */
+       uint32  txassocrsp;     /**< Number of TX ASSOC response */
+       uint32  rxassocrsp;     /**< Number of RX ASSOC response */
+       uint32  txreassocrsp;   /**< Number of TX REASSOC response */
+       uint32  rxreassocrsp;   /**< Number of RX REASSOC response */
+       uint32  txauth;         /**< Number of TX AUTH */
+       uint32  rxauth;         /**< Number of RX AUTH */
+       uint32  txdeauth;       /**< Number of TX DEAUTH */
+       uint32  rxdeauth;       /**< Number of RX DEAUTH */
+       uint32  txprobereq;     /**< Number of TX probe request */
+       uint32  rxprobereq;     /**< Number of RX probe request */
+       uint32  txprobersp;     /**< Number of TX probe response */
+       uint32  rxprobersp;     /**< Number of RX probe response */
+       uint32  txaction;       /**< Number of TX action frame */
+       uint32  rxaction;       /**< Number of RX action frame */
+} wl_cnt_wlc_t;
+
+/* MACXSTAT counters for ucodex (corerev >= 64) */
+typedef struct {
+       uint32 macxsusp;
+       uint32 m2vmsg;
+       uint32 v2mmsg;
+       uint32 mboxout;
+       uint32 musnd;
+       uint32 sfb2v;
+} wl_cnt_ge64mcxst_v1_t;
+
+/* MACSTAT counters for ucode (corerev >= 40) */
+typedef struct {
+       /* MAC counters: 32-bit version of d11.h's macstat_t */
+       uint32  txallfrm;       /**< total number of frames sent, incl. Data, ACK, RTS, CTS,
+                                * Control Management (includes retransmissions)
+                                */
+       uint32  txrtsfrm;       /**< number of RTS sent out by the MAC */
+       uint32  txctsfrm;       /**< number of CTS sent out by the MAC */
+       uint32  txackfrm;       /**< number of ACK frames sent out */
+       uint32  txdnlfrm;       /**< number of Null-Data transmission generated from template  */
+       uint32  txbcnfrm;       /**< beacons transmitted */
+       uint32  txfunfl[6];     /**< per-fifo tx underflows */
+       uint32  txampdu;        /**< number of AMPDUs transmitted */
+       uint32  txmpdu;         /**< number of MPDUs transmitted */
+       uint32  txtplunfl;      /**< Template underflows (mac was too slow to transmit ACK/CTS
+                                * or BCN)
+                                */
+       uint32  txphyerror;     /**< Transmit phy error, type of error is reported in tx-status for
+                                * driver enqueued frames
+                                */
+       uint32  pktengrxducast; /* unicast frames rxed by the pkteng code */
+       uint32  pktengrxdmcast; /* multicast frames rxed by the pkteng code */
+       uint32  rxfrmtoolong;   /**< Received frame longer than legal limit (2346 bytes) */
+       uint32  rxfrmtooshrt; /**< Received frame did not contain enough bytes for its frame type */
+       uint32  rxanyerr;       /**< Any RX error that is not counted by other counters. */
+       uint32  rxbadfcs;       /**< number of frames for which the CRC check failed in the MAC */
+       uint32  rxbadplcp;      /**< parity check of the PLCP header failed */
+       uint32  rxcrsglitch;    /**< PHY was able to correlate the preamble but not the header */
+       uint32  rxstrt;         /**< Number of received frames with a good PLCP
+                                * (i.e. passing parity check)
+                                */
+       uint32  rxdtucastmbss; /**< number of received DATA frames with good FCS and matching RA */
+       uint32  rxmgucastmbss; /**< number of received mgmt frames with good FCS and matching RA */
+       uint32  rxctlucast; /**< number of received CNTRL frames with good FCS and matching RA */
+       uint32  rxrtsucast;     /**< number of unicast RTS addressed to the MAC (good FCS) */
+       uint32  rxctsucast;     /**< number of unicast CTS addressed to the MAC (good FCS) */
+       uint32  rxackucast;     /**< number of ucast ACKS received (good FCS) */
+       uint32  rxdtocast; /**< number of received DATA frames (good FCS and not matching RA) */
+       uint32  rxmgocast; /**< number of received MGMT frames (good FCS and not matching RA) */
+       uint32  rxctlocast; /**< number of received CNTRL frame (good FCS and not matching RA) */
+       uint32  rxrtsocast;     /**< number of received RTS not addressed to the MAC */
+       uint32  rxctsocast;     /**< number of received CTS not addressed to the MAC */
+       uint32  rxdtmcast;      /**< number of RX Data multicast frames received by the MAC */
+       uint32  rxmgmcast;      /**< number of RX Management multicast frames received by the MAC */
+       uint32  rxctlmcast;     /**< number of RX Control multicast frames received by the MAC
+                                * (unlikely to see these)
+                                */
+       uint32  rxbeaconmbss;   /**< beacons received from member of BSS */
+       uint32  rxdtucastobss; /* number of unicast frames addressed to the MAC from
+                                 * other BSS (WDS FRAME)
+                                 */
+       uint32  rxbeaconobss;   /**< beacons received from other BSS */
+       uint32  rxrsptmout;     /**< number of response timeouts for transmitted frames
+                                * expecting a response
+                                */
+       uint32  bcntxcancl;     /**< transmit beacons canceled due to receipt of beacon (IBSS) */
+       uint32  rxnodelim;      /**< number of no valid delimiter detected by ampdu parser */
+       uint32  rxf0ovfl;       /**< number of receive fifo 0 overflows */
+       uint32  rxf1ovfl;       /**< number of receive fifo 1 overflows */
+       uint32  rxhlovfl;       /**< number of length / header fifo overflows */
+       uint32  missbcn_dbg;    /**< number of beacon missed to receive */
+       uint32  pmqovfl;        /**< number of PMQ overflows */
+       uint32  rxcgprqfrm;     /**< number of received Probe requests that made it into
+                                * the PRQ fifo
+                                */
+       uint32  rxcgprsqovfl;   /**< Rx Probe Request Que overflow in the AP */
+       uint32  txcgprsfail;    /**< Tx Probe Response Fail. AP sent probe response but did
+                                * not get ACK
+                                */
+       uint32  txcgprssuc;     /**< Tx Probe Response Success (ACK was received) */
+       uint32  prs_timeout;    /**< number of probe requests that were dropped from the PRQ
+                                * fifo because a probe response could not be sent out within
+                                * the time limit defined in M_PRS_MAXTIME
+                                */
+       uint32  txrtsfail;      /**< number of rts transmission failure that reach retry limit */
+       uint32  txucast;        /**< number of unicast tx expecting response other than cts/cwcts */
+       uint32  txinrtstxop;    /**< number of data frame transmissions during rts txop */
+       uint32  rxback;         /**< blockack rxcnt */
+       uint32  txback;         /**< blockack txcnt */
+       uint32  bphy_rxcrsglitch;       /**< PHY count of bphy glitches */
+       uint32  rxdrop20s;      /**< drop secondary cnt */
+       uint32  rxtoolate;      /**< receive too late */
+       uint32  bphy_badplcp;   /**< number of bad PLCP reception on BPHY rate */
+} wl_cnt_ge40mcst_v1_t;
+
+/* MACSTAT counters for ucode (corerev < 40) */
+typedef struct {
+       /* MAC counters: 32-bit version of d11.h's macstat_t */
+       uint32  txallfrm;       /**< total number of frames sent, incl. Data, ACK, RTS, CTS,
+                                * Control Management (includes retransmissions)
+                                */
+       uint32  txrtsfrm;       /**< number of RTS sent out by the MAC */
+       uint32  txctsfrm;       /**< number of CTS sent out by the MAC */
+       uint32  txackfrm;       /**< number of ACK frames sent out */
+       uint32  txdnlfrm;       /**< number of Null-Data transmission generated from template  */
+       uint32  txbcnfrm;       /**< beacons transmitted */
+       uint32  txfunfl[6];     /**< per-fifo tx underflows */
+       uint32  txampdu;        /**< number of AMPDUs transmitted */
+       uint32  txmpdu;         /**< number of MPDUs transmitted */
+       uint32  txtplunfl;      /**< Template underflows (mac was too slow to transmit ACK/CTS
+                                * or BCN)
+                                */
+       uint32  txphyerror;     /**< Transmit phy error, type of error is reported in tx-status for
+                                * driver enqueued frames
+                                */
+       uint32  pktengrxducast; /**< unicast frames rxed by the pkteng code */
+       uint32  pktengrxdmcast; /**< multicast frames rxed by the pkteng code */
+       uint32  rxfrmtoolong;   /**< Received frame longer than legal limit (2346 bytes) */
+       uint32  rxfrmtooshrt; /**< Received frame did not contain enough bytes for its frame type */
+       uint32  rxanyerr;       /**< Any RX error that is not counted by other counters. */
+       uint32  rxbadfcs;       /**< number of frames for which the CRC check failed in the MAC */
+       uint32  rxbadplcp;      /**< parity check of the PLCP header failed */
+       uint32  rxcrsglitch;    /**< PHY was able to correlate the preamble but not the header */
+       uint32  rxstrt;         /**< Number of received frames with a good PLCP
+                                * (i.e. passing parity check)
+                                */
+       uint32  rxdtucastmbss; /**< number of received DATA frames with good FCS and matching RA */
+       uint32  rxmgucastmbss; /**< number of received mgmt frames with good FCS and matching RA */
+       uint32  rxctlucast; /**< number of received CNTRL frames with good FCS and matching RA */
+       uint32  rxrtsucast;     /**< number of unicast RTS addressed to the MAC (good FCS) */
+       uint32  rxctsucast;     /**< number of unicast CTS addressed to the MAC (good FCS) */
+       uint32  rxackucast;     /**< number of ucast ACKS received (good FCS) */
+       uint32  rxdtocast;  /**< number of received DATA frames (good FCS and not matching RA) */
+       uint32  rxmgocast;  /**< number of received MGMT frames (good FCS and not matching RA) */
+       uint32  rxctlocast; /**< number of received CNTRL frame (good FCS and not matching RA) */
+       uint32  rxrtsocast;     /**< number of received RTS not addressed to the MAC */
+       uint32  rxctsocast;     /**< number of received CTS not addressed to the MAC */
+       uint32  rxdtmcast;      /**< number of RX Data multicast frames received by the MAC */
+       uint32  rxmgmcast;      /**< number of RX Management multicast frames received by the MAC */
+       uint32  rxctlmcast;     /**< number of RX Control multicast frames received by the MAC
+                                * (unlikely to see these)
+                                */
+       uint32  rxbeaconmbss;   /**< beacons received from member of BSS */
+       uint32  rxdtucastobss; /* number of unicast frames addressed to the MAC from
+                                 * other BSS (WDS FRAME)
+                                 */
+       uint32  rxbeaconobss;   /**< beacons received from other BSS */
+       uint32  rxrsptmout;     /**< number of response timeouts for transmitted frames
+                                * expecting a response
+                                */
+       uint32  bcntxcancl;     /**< transmit beacons canceled due to receipt of beacon (IBSS) */
+       uint32  rxnodelim;      /**< number of no valid delimiter detected by ampdu parser */
+       uint32  rxf0ovfl;       /**< number of receive fifo 0 overflows */
+       uint32  dbgoff46;
+       uint32  dbgoff47;
+       uint32  dbgoff48;       /**< Used for counting txstatus queue overflow (corerev <= 4)  */
+       uint32  pmqovfl;        /**< number of PMQ overflows */
+       uint32  rxcgprqfrm;     /**< number of received Probe requests that made it into
+                                * the PRQ fifo
+                                */
+       uint32  rxcgprsqovfl;   /**< Rx Probe Request Que overflow in the AP */
+       uint32  txcgprsfail;    /**< Tx Probe Response Fail. AP sent probe response but did
+                                * not get ACK
+                                */
+       uint32  txcgprssuc;     /**< Tx Probe Response Success (ACK was received) */
+       uint32  prs_timeout;    /**< number of probe requests that were dropped from the PRQ
+                                * fifo because a probe response could not be sent out within
+                                * the time limit defined in M_PRS_MAXTIME
+                                */
+       uint32  txrtsfail;      /**< number of rts transmission failure that reach retry limit */
+       uint32  txucast;        /**< number of unicast tx expecting response other than cts/cwcts */
+       uint32  txinrtstxop;    /**< number of data frame transmissions during rts txop */
+       uint32  rxback;         /**< blockack rxcnt */
+       uint32  txback;         /**< blockack txcnt */
+       uint32  bphy_rxcrsglitch;       /**< PHY count of bphy glitches */
+       uint32  phywatch;
+       uint32  rxtoolate;      /**< receive too late */
+       uint32  bphy_badplcp;   /**< number of bad PLCP reception on BPHY rate */
+} wl_cnt_lt40mcst_v1_t;
+
+/* MACSTAT counters for "wl counter" version <= 10 */
+typedef struct {
+       /* MAC counters: 32-bit version of d11.h's macstat_t */
+       uint32  txallfrm;       /**< total number of frames sent, incl. Data, ACK, RTS, CTS,
+                                * Control Management (includes retransmissions)
+                                */
+       uint32  txrtsfrm;       /**< number of RTS sent out by the MAC */
+       uint32  txctsfrm;       /**< number of CTS sent out by the MAC */
+       uint32  txackfrm;       /**< number of ACK frames sent out */
+       uint32  txdnlfrm;       /**< number of Null-Data transmission generated from template  */
+       uint32  txbcnfrm;       /**< beacons transmitted */
+       uint32  txfunfl[6];     /**< per-fifo tx underflows */
+       uint32  txfbw;          /**< transmit at fallback bw (dynamic bw) */
+       uint32  PAD0;           /**< number of MPDUs transmitted */
+       uint32  txtplunfl;      /**< Template underflows (mac was too slow to transmit ACK/CTS
+                                * or BCN)
+                                */
+       uint32  txphyerror;     /**< Transmit phy error, type of error is reported in tx-status for
+                                * driver enqueued frames
+                                */
+       uint32  pktengrxducast; /* unicast frames rxed by the pkteng code */
+       uint32  pktengrxdmcast; /* multicast frames rxed by the pkteng code */
+       uint32  rxfrmtoolong;   /**< Received frame longer than legal limit (2346 bytes) */
+       uint32  rxfrmtooshrt; /**< Received frame did not contain enough bytes for its frame type */
+       uint32  rxinvmachdr;    /**< Either the protocol version != 0 or frame type not
+                                * data/control/management
+                                */
+       uint32  rxbadfcs;       /**< number of frames for which the CRC check failed in the MAC */
+       uint32  rxbadplcp;      /**< parity check of the PLCP header failed */
+       uint32  rxcrsglitch;    /**< PHY was able to correlate the preamble but not the header */
+       uint32  rxstrt;         /**< Number of received frames with a good PLCP
+                                * (i.e. passing parity check)
+                                */
+       uint32  rxdfrmucastmbss; /* number of received DATA frames with good FCS and matching RA */
+       uint32  rxmfrmucastmbss; /* number of received mgmt frames with good FCS and matching RA */
+       uint32  rxcfrmucast; /**< number of received CNTRL frames with good FCS and matching RA */
+       uint32  rxrtsucast;  /**< number of unicast RTS addressed to the MAC (good FCS) */
+       uint32  rxctsucast;  /**< number of unicast CTS addressed to the MAC (good FCS) */
+       uint32  rxackucast;     /**< number of ucast ACKS received (good FCS) */
+       uint32  rxdfrmocast; /**< number of received DATA frames (good FCS and not matching RA) */
+       uint32  rxmfrmocast; /**< number of received MGMT frames (good FCS and not matching RA) */
+       uint32  rxcfrmocast; /**< number of received CNTRL frame (good FCS and not matching RA) */
+       uint32  rxrtsocast;     /**< number of received RTS not addressed to the MAC */
+       uint32  rxctsocast;     /**< number of received CTS not addressed to the MAC */
+       uint32  rxdfrmmcast;    /**< number of RX Data multicast frames received by the MAC */
+       uint32  rxmfrmmcast;    /**< number of RX Management multicast frames received by the MAC */
+       uint32  rxcfrmmcast;    /**< number of RX Control multicast frames received by the MAC
+                                * (unlikely to see these)
+                                */
+       uint32  rxbeaconmbss;   /**< beacons received from member of BSS */
+       uint32  rxdfrmucastobss; /**< number of unicast frames addressed to the MAC from
+                                 * other BSS (WDS FRAME)
+                                 */
+       uint32  rxbeaconobss;   /**< beacons received from other BSS */
+       uint32  rxrsptmout;     /**< number of response timeouts for transmitted frames
+                                * expecting a response
+                                */
+       uint32  bcntxcancl;     /**< transmit beacons canceled due to receipt of beacon (IBSS) */
+       uint32  PAD1;
+       uint32  rxf0ovfl;       /**< number of receive fifo 0 overflows */
+       uint32  rxf1ovfl;       /**< Number of receive fifo 1 overflows (obsolete) */
+       uint32  rxf2ovfl;       /**< Number of receive fifo 2 overflows (obsolete) */
+       uint32  txsfovfl;       /**< Number of transmit status fifo overflows (obsolete) */
+       uint32  pmqovfl;        /**< number of PMQ overflows */
+       uint32  rxcgprqfrm;     /**< number of received Probe requests that made it into
+                                * the PRQ fifo
+                                */
+       uint32  rxcgprsqovfl;   /**< Rx Probe Request Que overflow in the AP */
+       uint32  txcgprsfail;    /**< Tx Probe Response Fail. AP sent probe response but did
+                                * not get ACK
+                                */
+       uint32  txcgprssuc;     /**< Tx Probe Response Success (ACK was received) */
+       uint32  prs_timeout;    /**< number of probe requests that were dropped from the PRQ
+                                * fifo because a probe response could not be sent out within
+                                * the time limit defined in M_PRS_MAXTIME
+                                */
+       uint32  rxnack;         /**< obsolete */
+       uint32  frmscons;       /**< obsolete */
+       uint32  txnack;         /**< obsolete */
+       uint32  rxback;         /**< blockack rxcnt */
+       uint32  txback;         /**< blockack txcnt */
+       uint32  bphy_rxcrsglitch;       /**< PHY count of bphy glitches */
+       uint32  rxdrop20s;      /**< drop secondary cnt */
+       uint32  rxtoolate;      /**< receive too late */
+       uint32  bphy_badplcp;   /**< number of bad PLCP reception on BPHY rate */
+} wl_cnt_v_le10_mcst_t;
+
+typedef struct {
+       uint16  version;        /**< see definition of WL_CNT_T_VERSION */
+       uint16  length;         /**< length of entire structure */
+
+       /* transmit stat counters */
+       uint32  txframe;        /**< tx data frames */
+       uint32  txbyte;         /**< tx data bytes */
+       uint32  txretrans;      /**< tx mac retransmits */
+       uint32  txerror;        /**< tx data errors (derived: sum of others) */
+       uint32  txctl;          /**< tx management frames */
+       uint32  txprshort;      /**< tx short preamble frames */
+       uint32  txserr;         /**< tx status errors */
+       uint32  txnobuf;        /**< tx out of buffers errors */
+       uint32  txnoassoc;      /**< tx discard because we're not associated */
+       uint32  txrunt;         /**< tx runt frames */
+       uint32  txchit;         /**< tx header cache hit (fastpath) */
+       uint32  txcmiss;        /**< tx header cache miss (slowpath) */
+
+       /* transmit chip error counters */
+       uint32  txuflo;         /**< tx fifo underflows */
+       uint32  txphyerr;       /**< tx phy errors (indicated in tx status) */
+       uint32  txphycrs;
+
+       /* receive stat counters */
+       uint32  rxframe;        /**< rx data frames */
+       uint32  rxbyte;         /**< rx data bytes */
+       uint32  rxerror;        /**< rx data errors (derived: sum of others) */
+       uint32  rxctl;          /**< rx management frames */
+       uint32  rxnobuf;        /**< rx out of buffers errors */
+       uint32  rxnondata;      /**< rx non data frames in the data channel errors */
+       uint32  rxbadds;        /**< rx bad DS errors */
+       uint32  rxbadcm;        /**< rx bad control or management frames */
+       uint32  rxfragerr;      /**< rx fragmentation errors */
+       uint32  rxrunt;         /**< rx runt frames */
+       uint32  rxgiant;        /**< rx giant frames */
+       uint32  rxnoscb;        /**< rx no scb error */
+       uint32  rxbadproto;     /**< rx invalid frames */
+       uint32  rxbadsrcmac;    /**< rx frames with Invalid Src Mac */
+       uint32  rxbadda;        /**< rx frames tossed for invalid da */
+       uint32  rxfilter;       /**< rx frames filtered out */
+
+       /* receive chip error counters */
+       uint32  rxoflo;         /**< rx fifo overflow errors */
+       uint32  rxuflo[NFIFO];  /**< rx dma descriptor underflow errors */
+
+       uint32  d11cnt_txrts_off;       /**< d11cnt txrts value when reset d11cnt */
+       uint32  d11cnt_rxcrc_off;       /**< d11cnt rxcrc value when reset d11cnt */
+       uint32  d11cnt_txnocts_off;     /**< d11cnt txnocts value when reset d11cnt */
+
+       /* misc counters */
+       uint32  dmade;          /**< tx/rx dma descriptor errors */
+       uint32  dmada;          /**< tx/rx dma data errors */
+       uint32  dmape;          /**< tx/rx dma descriptor protocol errors */
+       uint32  reset;          /**< reset count */
+       uint32  tbtt;           /**< cnts the TBTT int's */
+       uint32  txdmawar;
+       uint32  pkt_callback_reg_fail;  /**< callbacks register failure */
+
+       /* MAC counters: 32-bit version of d11.h's macstat_t */
+       uint32  txallfrm;       /**< total number of frames sent, incl. Data, ACK, RTS, CTS,
+                                * Control Management (includes retransmissions)
+                                */
+       uint32  txrtsfrm;       /**< number of RTS sent out by the MAC */
+       uint32  txctsfrm;       /**< number of CTS sent out by the MAC */
+       uint32  txackfrm;       /**< number of ACK frames sent out */
+       uint32  txdnlfrm;       /**< Not used */
+       uint32  txbcnfrm;       /**< beacons transmitted */
+       uint32  txfunfl[6];     /**< per-fifo tx underflows */
+       uint32  rxtoolate;      /**< receive too late */
+       uint32  txfbw;          /**< transmit at fallback bw (dynamic bw) */
+       uint32  txtplunfl;      /**< Template underflows (mac was too slow to transmit ACK/CTS
+                                * or BCN)
+                                */
+       uint32  txphyerror;     /**< Transmit phy error, type of error is reported in tx-status for
+                                * driver enqueued frames
+                                */
+       uint32  rxfrmtoolong;   /**< Received frame longer than legal limit (2346 bytes) */
+       uint32  rxfrmtooshrt; /**< Received frame did not contain enough bytes for its frame type */
+       uint32  rxinvmachdr;    /**< Either the protocol version != 0 or frame type not
+                                * data/control/management
+                                */
+       uint32  rxbadfcs;       /**< number of frames for which the CRC check failed in the MAC */
+       uint32  rxbadplcp;      /**< parity check of the PLCP header failed */
+       uint32  rxcrsglitch;    /**< PHY was able to correlate the preamble but not the header */
+       uint32  rxstrt;         /**< Number of received frames with a good PLCP
+                                * (i.e. passing parity check)
+                                */
+       uint32  rxdfrmucastmbss; /* Number of received DATA frames with good FCS and matching RA */
+       uint32  rxmfrmucastmbss; /* number of received mgmt frames with good FCS and matching RA */
+       uint32  rxcfrmucast; /**< number of received CNTRL frames with good FCS and matching RA */
+       uint32  rxrtsucast;     /**< number of unicast RTS addressed to the MAC (good FCS) */
+       uint32  rxctsucast;     /**< number of unicast CTS addressed to the MAC (good FCS) */
+       uint32  rxackucast;     /**< number of ucast ACKS received (good FCS) */
+       uint32  rxdfrmocast; /**< number of received DATA frames (good FCS and not matching RA) */
+       uint32  rxmfrmocast; /**< number of received MGMT frames (good FCS and not matching RA) */
+       uint32  rxcfrmocast; /**< number of received CNTRL frame (good FCS and not matching RA) */
+       uint32  rxrtsocast;     /**< number of received RTS not addressed to the MAC */
+       uint32  rxctsocast;     /**< number of received CTS not addressed to the MAC */
+       uint32  rxdfrmmcast;    /**< number of RX Data multicast frames received by the MAC */
+       uint32  rxmfrmmcast;    /**< number of RX Management multicast frames received by the MAC */
+       uint32  rxcfrmmcast;    /**< number of RX Control multicast frames received by the MAC
+                                * (unlikely to see these)
+                                */
+       uint32  rxbeaconmbss;   /**< beacons received from member of BSS */
+       uint32  rxdfrmucastobss; /* number of unicast frames addressed to the MAC from
+                                 * other BSS (WDS FRAME)
+                                 */
+       uint32  rxbeaconobss;   /**< beacons received from other BSS */
+       uint32  rxrsptmout;     /**< Number of response timeouts for transmitted frames
+                                * expecting a response
+                                */
+       uint32  bcntxcancl;     /**< transmit beacons canceled due to receipt of beacon (IBSS) */
+       uint32  rxf0ovfl;       /**< Number of receive fifo 0 overflows */
+       uint32  rxf1ovfl;       /**< Number of receive fifo 1 overflows (obsolete) */
+       uint32  rxf2ovfl;       /**< Number of receive fifo 2 overflows (obsolete) */
+       uint32  txsfovfl;       /**< Number of transmit status fifo overflows (obsolete) */
+       uint32  pmqovfl;        /**< Number of PMQ overflows */
+       uint32  rxcgprqfrm;     /**< Number of received Probe requests that made it into
+                                * the PRQ fifo
+                                */
+       uint32  rxcgprsqovfl;   /**< Rx Probe Request Que overflow in the AP */
+       uint32  txcgprsfail;    /**< Tx Probe Response Fail. AP sent probe response but did
+                                * not get ACK
+                                */
+       uint32  txcgprssuc;     /**< Tx Probe Response Success (ACK was received) */
+       uint32  prs_timeout;    /**< Number of probe requests that were dropped from the PRQ
+                                * fifo because a probe response could not be sent out within
+                                * the time limit defined in M_PRS_MAXTIME
+                                */
+       uint32  rxnack;         /**< obsolete */
+       uint32  frmscons;       /**< obsolete */
+       uint32  txnack;         /**< obsolete */
+       uint32  rxback;         /**< blockack rxcnt */
+       uint32  txback;         /**< blockack txcnt */
+
+       /* 802.11 MIB counters, pp. 614 of 802.11 reaff doc. */
+       uint32  txfrag;         /**< dot11TransmittedFragmentCount */
+       uint32  txmulti;        /**< dot11MulticastTransmittedFrameCount */
+       uint32  txfail;         /**< dot11FailedCount */
+       uint32  txretry;        /**< dot11RetryCount */
+       uint32  txretrie;       /**< dot11MultipleRetryCount */
+       uint32  rxdup;          /**< dot11FrameduplicateCount */
+       uint32  txrts;          /**< dot11RTSSuccessCount */
+       uint32  txnocts;        /**< dot11RTSFailureCount */
+       uint32  txnoack;        /**< dot11ACKFailureCount */
+       uint32  rxfrag;         /**< dot11ReceivedFragmentCount */
+       uint32  rxmulti;        /**< dot11MulticastReceivedFrameCount */
+       uint32  rxcrc;          /**< dot11FCSErrorCount */
+       uint32  txfrmsnt;       /**< dot11TransmittedFrameCount (bogus MIB?) */
+       uint32  rxundec;        /**< dot11WEPUndecryptableCount */
+
+       /* WPA2 counters (see rxundec for DecryptFailureCount) */
+       uint32  tkipmicfaill;   /**< TKIPLocalMICFailures */
+       uint32  tkipcntrmsr;    /**< TKIPCounterMeasuresInvoked */
+       uint32  tkipreplay;     /**< TKIPReplays */
+       uint32  ccmpfmterr;     /**< CCMPFormatErrors */
+       uint32  ccmpreplay;     /**< CCMPReplays */
+       uint32  ccmpundec;      /**< CCMPDecryptErrors */
+       uint32  fourwayfail;    /**< FourWayHandshakeFailures */
+       uint32  wepundec;       /**< dot11WEPUndecryptableCount */
+       uint32  wepicverr;      /**< dot11WEPICVErrorCount */
+       uint32  decsuccess;     /**< DecryptSuccessCount */
+       uint32  tkipicverr;     /**< TKIPICVErrorCount */
+       uint32  wepexcluded;    /**< dot11WEPExcludedCount */
+
+       uint32  txchanrej;      /**< Tx frames suppressed due to channel rejection */
+       uint32  psmwds;         /**< Count PSM watchdogs */
+       uint32  phywatchdog;    /**< Count Phy watchdogs (triggered by ucode) */
+
+       /* MBSS counters, AP only */
+       uint32  prq_entries_handled;    /**< PRQ entries read in */
+       uint32  prq_undirected_entries; /**<    which were bcast bss & ssid */
+       uint32  prq_bad_entries;        /**<    which could not be translated to info */
+       uint32  atim_suppress_count;    /**< TX suppressions on ATIM fifo */
+       uint32  bcn_template_not_ready; /**< Template marked in use on send bcn ... */
+       uint32  bcn_template_not_ready_done; /* ...but "DMA done" interrupt rcvd */
+       uint32  late_tbtt_dpc;  /**< TBTT DPC did not happen in time */
+
+       /* per-rate receive stat counters */
+       uint32  rx1mbps;        /* packets rx at 1Mbps */
+       uint32  rx2mbps;        /* packets rx at 2Mbps */
+       uint32  rx5mbps5;       /* packets rx at 5.5Mbps */
+       uint32  rx6mbps;        /* packets rx at 6Mbps */
+       uint32  rx9mbps;        /* packets rx at 9Mbps */
+       uint32  rx11mbps;       /* packets rx at 11Mbps */
+       uint32  rx12mbps;       /* packets rx at 12Mbps */
+       uint32  rx18mbps;       /* packets rx at 18Mbps */
+       uint32  rx24mbps;       /* packets rx at 24Mbps */
+       uint32  rx36mbps;       /* packets rx at 36Mbps */
+       uint32  rx48mbps;       /* packets rx at 48Mbps */
+       uint32  rx54mbps;       /* packets rx at 54Mbps */
+       uint32  rx108mbps;      /* packets rx at 108mbps */
+       uint32  rx162mbps;      /* packets rx at 162mbps */
+       uint32  rx216mbps;      /* packets rx at 216 mbps */
+       uint32  rx270mbps;      /* packets rx at 270 mbps */
+       uint32  rx324mbps;      /* packets rx at 324 mbps */
+       uint32  rx378mbps;      /* packets rx at 378 mbps */
+       uint32  rx432mbps;      /* packets rx at 432 mbps */
+       uint32  rx486mbps;      /* packets rx at 486 mbps */
+       uint32  rx540mbps;      /* packets rx at 540 mbps */
+
+       /* pkteng rx frame stats */
+       uint32  pktengrxducast; /* unicast frames rxed by the pkteng code */
+       uint32  pktengrxdmcast; /* multicast frames rxed by the pkteng code */
+
+       uint32  rfdisable;      /**< count of radio disables */
+       uint32  bphy_rxcrsglitch;       /**< PHY count of bphy glitches */
+       uint32  bphy_badplcp;
+
+       uint32  txexptime;      /**< Tx frames suppressed due to timer expiration */
+
+       uint32  txmpdu_sgi;     /**< count for sgi transmit */
+       uint32  rxmpdu_sgi;     /**< count for sgi received */
+       uint32  txmpdu_stbc;    /**< count for stbc transmit */
+       uint32  rxmpdu_stbc;    /**< count for stbc received */
+
+       uint32  rxundec_mcst;   /**< dot11WEPUndecryptableCount */
+
+       /* WPA2 counters (see rxundec for DecryptFailureCount) */
+       uint32  tkipmicfaill_mcst;      /**< TKIPLocalMICFailures */
+       uint32  tkipcntrmsr_mcst;       /**< TKIPCounterMeasuresInvoked */
+       uint32  tkipreplay_mcst;        /**< TKIPReplays */
+       uint32  ccmpfmterr_mcst;        /**< CCMPFormatErrors */
+       uint32  ccmpreplay_mcst;        /**< CCMPReplays */
+       uint32  ccmpundec_mcst; /**< CCMPDecryptErrors */
+       uint32  fourwayfail_mcst;       /**< FourWayHandshakeFailures */
+       uint32  wepundec_mcst;  /**< dot11WEPUndecryptableCount */
+       uint32  wepicverr_mcst; /**< dot11WEPICVErrorCount */
+       uint32  decsuccess_mcst;        /**< DecryptSuccessCount */
+       uint32  tkipicverr_mcst;        /**< TKIPICVErrorCount */
+       uint32  wepexcluded_mcst;       /**< dot11WEPExcludedCount */
+
+       uint32  dma_hang;       /**< count for dma hang */
+       uint32  reinit;         /**< count for reinit */
+
+       uint32  pstatxucast;    /**< count of ucast frames xmitted on all psta assoc */
+       uint32  pstatxnoassoc;  /**< count of txnoassoc frames xmitted on all psta assoc */
+       uint32  pstarxucast;    /**< count of ucast frames received on all psta assoc */
+       uint32  pstarxbcmc;     /**< count of bcmc frames received on all psta */
+       uint32  pstatxbcmc;     /**< count of bcmc frames transmitted on all psta */
+
+       uint32  cso_passthrough; /* hw cso required but passthrough */
+       uint32  cso_normal;     /**< hw cso hdr for normal process */
+       uint32  chained;        /**< number of frames chained */
+       uint32  chainedsz1;     /**< number of chain size 1 frames */
+       uint32  unchained;      /**< number of frames not chained */
+       uint32  maxchainsz;     /**< max chain size so far */
+       uint32  currchainsz;    /**< current chain size */
+       uint32  rxdrop20s;      /**< drop secondary cnt */
+       uint32  pciereset;      /**< Secondary Bus Reset issued by driver */
+       uint32  cfgrestore;     /**< configspace restore by driver */
+       uint32  reinitreason[NREINITREASONCOUNT]; /* reinitreason counters; 0: Unknown reason */
+       uint32  rxrtry;         /**< num of received packets with retry bit on */
+       uint32  txmpdu;         /**< macstat cnt only valid in ver 11. number of MPDUs txed.  */
+       uint32  rxnodelim;      /**< macstat cnt only valid in ver 11.
+                                * number of occasions that no valid delimiter is detected
+                                * by ampdu parser.
+                                */
+       uint32  rxmpdu_mu;      /* Number of MU MPDUs received */
+
+       /* detailed control/management frames */
+       uint32  txbar;          /**< Number of TX BAR */
+       uint32  rxbar;          /**< Number of RX BAR */
+       uint32  txpspoll;       /**< Number of TX PS-poll */
+       uint32  rxpspoll;       /**< Number of RX PS-poll */
+       uint32  txnull;         /**< Number of TX NULL_DATA */
+       uint32  rxnull;         /**< Number of RX NULL_DATA */
+       uint32  txqosnull;      /**< Number of TX NULL_QoSDATA */
+       uint32  rxqosnull;      /**< Number of RX NULL_QoSDATA */
+       uint32  txassocreq;     /**< Number of TX ASSOC request */
+       uint32  rxassocreq;     /**< Number of RX ASSOC request */
+       uint32  txreassocreq;   /**< Number of TX REASSOC request */
+       uint32  rxreassocreq;   /**< Number of RX REASSOC request */
+       uint32  txdisassoc;     /**< Number of TX DISASSOC */
+       uint32  rxdisassoc;     /**< Number of RX DISASSOC */
+       uint32  txassocrsp;     /**< Number of TX ASSOC response */
+       uint32  rxassocrsp;     /**< Number of RX ASSOC response */
+       uint32  txreassocrsp;   /**< Number of TX REASSOC response */
+       uint32  rxreassocrsp;   /**< Number of RX REASSOC response */
+       uint32  txauth;         /**< Number of TX AUTH */
+       uint32  rxauth;         /**< Number of RX AUTH */
+       uint32  txdeauth;       /**< Number of TX DEAUTH */
+       uint32  rxdeauth;       /**< Number of RX DEAUTH */
+       uint32  txprobereq;     /**< Number of TX probe request */
+       uint32  rxprobereq;     /**< Number of RX probe request */
+       uint32  txprobersp;     /**< Number of TX probe response */
+       uint32  rxprobersp;     /**< Number of RX probe response */
+       uint32  txaction;       /**< Number of TX action frame */
+       uint32  rxaction;       /**< Number of RX action frame */
+
+} wl_cnt_ver_11_t;
+
+typedef struct {
+       uint16  version;    /* see definition of WL_CNT_T_VERSION */
+       uint16  length;     /* length of entire structure */
+
+       /* transmit stat counters */
+       uint32  txframe;    /* tx data frames */
+       uint32  txbyte;     /* tx data bytes */
+       uint32  txretrans;  /* tx mac retransmits */
+       uint32  txerror;    /* tx data errors (derived: sum of others) */
+       uint32  txctl;      /* tx management frames */
+       uint32  txprshort;  /* tx short preamble frames */
+       uint32  txserr;     /* tx status errors */
+       uint32  txnobuf;    /* tx out of buffers errors */
+       uint32  txnoassoc;  /* tx discard because we're not associated */
+       uint32  txrunt;     /* tx runt frames */
+       uint32  txchit;     /* tx header cache hit (fastpath) */
+       uint32  txcmiss;    /* tx header cache miss (slowpath) */
+
+       /* transmit chip error counters */
+       uint32  txuflo;     /* tx fifo underflows */
+       uint32  txphyerr;   /* tx phy errors (indicated in tx status) */
+       uint32  txphycrs;
+
+       /* receive stat counters */
+       uint32  rxframe;    /* rx data frames */
+       uint32  rxbyte;     /* rx data bytes */
+       uint32  rxerror;    /* rx data errors (derived: sum of others) */
+       uint32  rxctl;      /* rx management frames */
+       uint32  rxnobuf;    /* rx out of buffers errors */
+       uint32  rxnondata;  /* rx non data frames in the data channel errors */
+       uint32  rxbadds;    /* rx bad DS errors */
+       uint32  rxbadcm;    /* rx bad control or management frames */
+       uint32  rxfragerr;  /* rx fragmentation errors */
+       uint32  rxrunt;     /* rx runt frames */
+       uint32  rxgiant;    /* rx giant frames */
+       uint32  rxnoscb;    /* rx no scb error */
+       uint32  rxbadproto; /* rx invalid frames */
+       uint32  rxbadsrcmac;    /* rx frames with Invalid Src Mac */
+       uint32  rxbadda;    /* rx frames tossed for invalid da */
+       uint32  rxfilter;   /* rx frames filtered out */
+
+       /* receive chip error counters */
+       uint32  rxoflo;     /* rx fifo overflow errors */
+       uint32  rxuflo[NFIFO];  /* rx dma descriptor underflow errors */
+
+       uint32  d11cnt_txrts_off;   /* d11cnt txrts value when reset d11cnt */
+       uint32  d11cnt_rxcrc_off;   /* d11cnt rxcrc value when reset d11cnt */
+       uint32  d11cnt_txnocts_off; /* d11cnt txnocts value when reset d11cnt */
+
+       /* misc counters */
+       uint32  dmade;      /* tx/rx dma descriptor errors */
+       uint32  dmada;      /* tx/rx dma data errors */
+       uint32  dmape;      /* tx/rx dma descriptor protocol errors */
+       uint32  reset;      /* reset count */
+       uint32  tbtt;       /* cnts the TBTT int's */
+       uint32  txdmawar;
+       uint32  pkt_callback_reg_fail;  /* callbacks register failure */
+
+       /* MAC counters: 32-bit version of d11.h's macstat_t */
+       uint32  txallfrm;   /* total number of frames sent, incl. Data, ACK, RTS, CTS,
+                            * Control Management (includes retransmissions)
+                            */
+       uint32  txrtsfrm;   /* number of RTS sent out by the MAC */
+       uint32  txctsfrm;   /* number of CTS sent out by the MAC */
+       uint32  txackfrm;   /* number of ACK frames sent out */
+       uint32  txdnlfrm;   /* Not used */
+       uint32  txbcnfrm;   /* beacons transmitted */
+       uint32  txfunfl[6]; /* per-fifo tx underflows */
+       uint32  rxtoolate;      /* receive too late */
+       uint32  txfbw;      /* transmit at fallback bw (dynamic bw) */
+       uint32  txtplunfl;  /* Template underflows (mac was too slow to transmit ACK/CTS
+                            * or BCN)
+                            */
+       uint32  txphyerror; /* Transmit phy error, type of error is reported in tx-status for
+                            * driver enqueued frames
+                            */
+       uint32  rxfrmtoolong;   /* Received frame longer than legal limit (2346 bytes) */
+       uint32  rxfrmtooshrt;   /* Received frame did not contain enough bytes for its frame type */
+       uint32  rxinvmachdr;    /* Either the protocol version != 0 or frame type not
+                                * data/control/management
+                          */
+       uint32  rxbadfcs;   /* number of frames for which the CRC check failed in the MAC */
+       uint32  rxbadplcp;  /* parity check of the PLCP header failed */
+       uint32  rxcrsglitch;    /* PHY was able to correlate the preamble but not the header */
+       uint32  rxstrt;     /* Number of received frames with a good PLCP
+                            * (i.e. passing parity check)
+                            */
+       uint32  rxdfrmucastmbss; /* Number of received DATA frames with good FCS and matching RA */
+       uint32  rxmfrmucastmbss; /* number of received mgmt frames with good FCS and matching RA */
+       uint32  rxcfrmucast;    /* number of received CNTRL frames with good FCS and matching RA */
+       uint32  rxrtsucast; /* number of unicast RTS addressed to the MAC (good FCS) */
+       uint32  rxctsucast; /* number of unicast CTS addressed to the MAC (good FCS) */
+       uint32  rxackucast; /* number of ucast ACKS received (good FCS) */
+       uint32  rxdfrmocast;    /* number of received DATA frames (good FCS and not matching RA) */
+       uint32  rxmfrmocast;    /* number of received MGMT frames (good FCS and not matching RA) */
+       uint32  rxcfrmocast;    /* number of received CNTRL frame (good FCS and not matching RA) */
+       uint32  rxrtsocast; /* number of received RTS not addressed to the MAC */
+       uint32  rxctsocast; /* number of received CTS not addressed to the MAC */
+       uint32  rxdfrmmcast;    /* number of RX Data multicast frames received by the MAC */
+       uint32  rxmfrmmcast;    /* number of RX Management multicast frames received by the MAC */
+       uint32  rxcfrmmcast;    /* number of RX Control multicast frames received by the MAC
+                                * (unlikely to see these)
+                                */
+       uint32  rxbeaconmbss;   /* beacons received from member of BSS */
+       uint32  rxdfrmucastobss; /* number of unicast frames addressed to the MAC from
+                                 * other BSS (WDS FRAME)
+                                 */
+       uint32  rxbeaconobss;   /* beacons received from other BSS */
+       uint32  rxrsptmout; /* Number of response timeouts for transmitted frames
+                            * expecting a response
+                            */
+       uint32  bcntxcancl; /* transmit beacons canceled due to receipt of beacon (IBSS) */
+       uint32  rxf0ovfl;   /* Number of receive fifo 0 overflows */
+       uint32  rxf1ovfl;   /* Number of receive fifo 1 overflows (obsolete) */
+       uint32  rxf2ovfl;   /* Number of receive fifo 2 overflows (obsolete) */
+       uint32  txsfovfl;   /* Number of transmit status fifo overflows (obsolete) */
+       uint32  pmqovfl;    /* Number of PMQ overflows */
+       uint32  rxcgprqfrm; /* Number of received Probe requests that made it into
+                            * the PRQ fifo
+                            */
+       uint32  rxcgprsqovfl;   /* Rx Probe Request Que overflow in the AP */
+       uint32  txcgprsfail;    /* Tx Probe Response Fail. AP sent probe response but did
+                                * not get ACK
+                                */
+       uint32  txcgprssuc; /* Tx Probe Response Success (ACK was received) */
+       uint32  prs_timeout;    /* Number of probe requests that were dropped from the PRQ
+                                * fifo because a probe response could not be sent out within
+                                * the time limit defined in M_PRS_MAXTIME
+                                */
+       uint32  rxnack;
+       uint32  frmscons;
+       uint32  txnack;         /* obsolete */
+       uint32  rxback;         /* blockack rxcnt */
+       uint32  txback;         /* blockack txcnt */
+
+       /* 802.11 MIB counters, pp. 614 of 802.11 reaff doc. */
+       uint32  txfrag;     /* dot11TransmittedFragmentCount */
+       uint32  txmulti;    /* dot11MulticastTransmittedFrameCount */
+       uint32  txfail;     /* dot11FailedCount */
+       uint32  txretry;    /* dot11RetryCount */
+       uint32  txretrie;   /* dot11MultipleRetryCount */
+       uint32  rxdup;      /* dot11FrameduplicateCount */
+       uint32  txrts;      /* dot11RTSSuccessCount */
+       uint32  txnocts;    /* dot11RTSFailureCount */
+       uint32  txnoack;    /* dot11ACKFailureCount */
+       uint32  rxfrag;     /* dot11ReceivedFragmentCount */
+       uint32  rxmulti;    /* dot11MulticastReceivedFrameCount */
+       uint32  rxcrc;      /* dot11FCSErrorCount */
+       uint32  txfrmsnt;   /* dot11TransmittedFrameCount (bogus MIB?) */
+       uint32  rxundec;    /* dot11WEPUndecryptableCount */
+
+       /* WPA2 counters (see rxundec for DecryptFailureCount) */
+       uint32  tkipmicfaill;   /* TKIPLocalMICFailures */
+       uint32  tkipcntrmsr;    /* TKIPCounterMeasuresInvoked */
+       uint32  tkipreplay; /* TKIPReplays */
+       uint32  ccmpfmterr; /* CCMPFormatErrors */
+       uint32  ccmpreplay; /* CCMPReplays */
+       uint32  ccmpundec;  /* CCMPDecryptErrors */
+       uint32  fourwayfail;    /* FourWayHandshakeFailures */
+       uint32  wepundec;   /* dot11WEPUndecryptableCount */
+       uint32  wepicverr;  /* dot11WEPICVErrorCount */
+       uint32  decsuccess; /* DecryptSuccessCount */
+       uint32  tkipicverr; /* TKIPICVErrorCount */
+       uint32  wepexcluded;    /* dot11WEPExcludedCount */
+
+       uint32  rxundec_mcst;   /* dot11WEPUndecryptableCount */
+
+       /* WPA2 counters (see rxundec for DecryptFailureCount) */
+       uint32  tkipmicfaill_mcst;  /* TKIPLocalMICFailures */
+       uint32  tkipcntrmsr_mcst;   /* TKIPCounterMeasuresInvoked */
+       uint32  tkipreplay_mcst;    /* TKIPReplays */
+       uint32  ccmpfmterr_mcst;    /* CCMPFormatErrors */
+       uint32  ccmpreplay_mcst;    /* CCMPReplays */
+       uint32  ccmpundec_mcst; /* CCMPDecryptErrors */
+       uint32  fourwayfail_mcst;   /* FourWayHandshakeFailures */
+       uint32  wepundec_mcst;  /* dot11WEPUndecryptableCount */
+       uint32  wepicverr_mcst; /* dot11WEPICVErrorCount */
+       uint32  decsuccess_mcst;    /* DecryptSuccessCount */
+       uint32  tkipicverr_mcst;    /* TKIPICVErrorCount */
+       uint32  wepexcluded_mcst;   /* dot11WEPExcludedCount */
+
+       uint32  txchanrej;  /* Tx frames suppressed due to channel rejection */
+       uint32  txexptime;  /* Tx frames suppressed due to timer expiration */
+       uint32  psmwds;     /* Count PSM watchdogs */
+       uint32  phywatchdog;    /* Count Phy watchdogs (triggered by ucode) */
+
+       /* MBSS counters, AP only */
+       uint32  prq_entries_handled;    /* PRQ entries read in */
+       uint32  prq_undirected_entries; /*    which were bcast bss & ssid */
+       uint32  prq_bad_entries;    /*    which could not be translated to info */
+       uint32  atim_suppress_count;    /* TX suppressions on ATIM fifo */
+       uint32  bcn_template_not_ready; /* Template marked in use on send bcn ... */
+       uint32  bcn_template_not_ready_done; /* ...but "DMA done" interrupt rcvd */
+       uint32  late_tbtt_dpc;  /* TBTT DPC did not happen in time */
+
+       /* per-rate receive stat counters */
+       uint32  rx1mbps;    /* packets rx at 1Mbps */
+       uint32  rx2mbps;    /* packets rx at 2Mbps */
+       uint32  rx5mbps5;   /* packets rx at 5.5Mbps */
+       uint32  rx6mbps;    /* packets rx at 6Mbps */
+       uint32  rx9mbps;    /* packets rx at 9Mbps */
+       uint32  rx11mbps;   /* packets rx at 11Mbps */
+       uint32  rx12mbps;   /* packets rx at 12Mbps */
+       uint32  rx18mbps;   /* packets rx at 18Mbps */
+       uint32  rx24mbps;   /* packets rx at 24Mbps */
+       uint32  rx36mbps;   /* packets rx at 36Mbps */
+       uint32  rx48mbps;   /* packets rx at 48Mbps */
+       uint32  rx54mbps;   /* packets rx at 54Mbps */
+       uint32  rx108mbps;  /* packets rx at 108mbps */
+       uint32  rx162mbps;  /* packets rx at 162mbps */
+       uint32  rx216mbps;  /* packets rx at 216 mbps */
+       uint32  rx270mbps;  /* packets rx at 270 mbps */
+       uint32  rx324mbps;  /* packets rx at 324 mbps */
+       uint32  rx378mbps;  /* packets rx at 378 mbps */
+       uint32  rx432mbps;  /* packets rx at 432 mbps */
+       uint32  rx486mbps;  /* packets rx at 486 mbps */
+       uint32  rx540mbps;  /* packets rx at 540 mbps */
+
+       /* pkteng rx frame stats */
+       uint32  pktengrxducast; /* unicast frames rxed by the pkteng code */
+       uint32  pktengrxdmcast; /* multicast frames rxed by the pkteng code */
+
+       uint32  rfdisable;  /* count of radio disables */
+       uint32  bphy_rxcrsglitch;   /* PHY count of bphy glitches */
+       uint32  bphy_badplcp;
+
+       uint32  txmpdu_sgi; /* count for sgi transmit */
+       uint32  rxmpdu_sgi; /* count for sgi received */
+       uint32  txmpdu_stbc;    /* count for stbc transmit */
+       uint32  rxmpdu_stbc;    /* count for stbc received */
+
+       uint32  rxdrop20s;      /* drop secondary cnt */
+} wl_cnt_ver_6_t;
+
+#define        WL_DELTA_STATS_T_VERSION        2       /* current version of wl_delta_stats_t struct */
+
+typedef struct {
+       uint16 version;     /* see definition of WL_DELTA_STATS_T_VERSION */
+       uint16 length;      /* length of entire structure */
+
+       /* transmit stat counters */
+       uint32 txframe;     /* tx data frames */
+       uint32 txbyte;      /* tx data bytes */
+       uint32 txretrans;   /* tx mac retransmits */
+       uint32 txfail;      /* tx failures */
+
+       /* receive stat counters */
+       uint32 rxframe;     /* rx data frames */
+       uint32 rxbyte;      /* rx data bytes */
+
+       /* per-rate receive stat counters */
+       uint32  rx1mbps;        /* packets rx at 1Mbps */
+       uint32  rx2mbps;        /* packets rx at 2Mbps */
+       uint32  rx5mbps5;       /* packets rx at 5.5Mbps */
+       uint32  rx6mbps;        /* packets rx at 6Mbps */
+       uint32  rx9mbps;        /* packets rx at 9Mbps */
+       uint32  rx11mbps;       /* packets rx at 11Mbps */
+       uint32  rx12mbps;       /* packets rx at 12Mbps */
+       uint32  rx18mbps;       /* packets rx at 18Mbps */
+       uint32  rx24mbps;       /* packets rx at 24Mbps */
+       uint32  rx36mbps;       /* packets rx at 36Mbps */
+       uint32  rx48mbps;       /* packets rx at 48Mbps */
+       uint32  rx54mbps;       /* packets rx at 54Mbps */
+       uint32  rx108mbps;      /* packets rx at 108mbps */
+       uint32  rx162mbps;      /* packets rx at 162mbps */
+       uint32  rx216mbps;      /* packets rx at 216 mbps */
+       uint32  rx270mbps;      /* packets rx at 270 mbps */
+       uint32  rx324mbps;      /* packets rx at 324 mbps */
+       uint32  rx378mbps;      /* packets rx at 378 mbps */
+       uint32  rx432mbps;      /* packets rx at 432 mbps */
+       uint32  rx486mbps;      /* packets rx at 486 mbps */
+       uint32  rx540mbps;      /* packets rx at 540 mbps */
+
+       /* phy stats */
+       uint32 rxbadplcp;
+       uint32 rxcrsglitch;
+       uint32 bphy_rxcrsglitch;
+       uint32 bphy_badplcp;
+
+} wl_delta_stats_t;
+
+typedef struct {
+       uint32 packets;
+       uint32 bytes;
+} wl_traffic_stats_t;
+
+typedef struct {
+       uint16  version;        /* see definition of WL_WME_CNT_VERSION */
+       uint16  length;         /* length of entire structure */
+
+       wl_traffic_stats_t tx[AC_COUNT];        /* Packets transmitted */
+       wl_traffic_stats_t tx_failed[AC_COUNT]; /* Packets dropped or failed to transmit */
+       wl_traffic_stats_t rx[AC_COUNT];        /* Packets received */
+       wl_traffic_stats_t rx_failed[AC_COUNT]; /* Packets failed to receive */
+
+       wl_traffic_stats_t forward[AC_COUNT];   /* Packets forwarded by AP */
+
+       wl_traffic_stats_t tx_expired[AC_COUNT];        /* packets dropped due to lifetime expiry */
+
+} wl_wme_cnt_t;
+
+struct wl_msglevel2 {
+       uint32 low;
+       uint32 high;
+};
+
+typedef struct wl_mkeep_alive_pkt {
+       uint16  version; /* Version for mkeep_alive */
+       uint16  length; /* length of fixed parameters in the structure */
+       uint32  period_msec;
+       uint16  len_bytes;
+       uint8   keep_alive_id; /* 0 - 3 for N = 4 */
+       uint8   data[1];
+} wl_mkeep_alive_pkt_t;
+
+#define WL_MKEEP_ALIVE_VERSION         1
+#define WL_MKEEP_ALIVE_FIXED_LEN       OFFSETOF(wl_mkeep_alive_pkt_t, data)
+#define WL_MKEEP_ALIVE_PRECISION       500
+
+/* TCP Keep-Alive conn struct */
+typedef struct wl_mtcpkeep_alive_conn_pkt {
+       struct ether_addr saddr;                /* src mac address */
+       struct ether_addr daddr;                /* dst mac address */
+       struct ipv4_addr sipaddr;               /* source IP addr */
+       struct ipv4_addr dipaddr;               /* dest IP addr */
+       uint16 sport;                           /* src port */
+       uint16 dport;                           /* dest port */
+       uint32 seq;                             /* seq number */
+       uint32 ack;                             /* ACK number */
+       uint16 tcpwin;                          /* TCP window */
+} wl_mtcpkeep_alive_conn_pkt_t;
+
+/* TCP Keep-Alive interval struct */
+typedef struct wl_mtcpkeep_alive_timers_pkt {
+       uint16 interval;                /* interval timer */
+       uint16 retry_interval;          /* retry_interval timer */
+       uint16 retry_count;             /* retry_count */
+} wl_mtcpkeep_alive_timers_pkt_t;
+
+typedef struct wake_info {
+       uint32 wake_reason;
+       uint32 wake_info_len;           /* size of packet */
+       uchar  packet[1];
+} wake_info_t;
+
+typedef struct wake_pkt {
+       uint32 wake_pkt_len;            /* size of packet */
+       uchar  packet[1];
+} wake_pkt_t;
+
+
+#define WL_MTCPKEEP_ALIVE_VERSION              1
+
+#ifdef WLBA
+
+#define WLC_BA_CNT_VERSION  1   /* current version of wlc_ba_cnt_t */
+
+/* block ack related stats */
+typedef struct wlc_ba_cnt {
+       uint16  version;    /* WLC_BA_CNT_VERSION */
+       uint16  length;     /* length of entire structure */
+
+       /* transmit stat counters */
+       uint32 txpdu;       /* pdus sent */
+       uint32 txsdu;       /* sdus sent */
+       uint32 txfc;        /* tx side flow controlled packets */
+       uint32 txfci;       /* tx side flow control initiated */
+       uint32 txretrans;   /* retransmitted pdus */
+       uint32 txbatimer;   /* ba resend due to timer */
+       uint32 txdrop;      /* dropped packets */
+       uint32 txaddbareq;  /* addba req sent */
+       uint32 txaddbaresp; /* addba resp sent */
+       uint32 txdelba;     /* delba sent */
+       uint32 txba;        /* ba sent */
+       uint32 txbar;       /* bar sent */
+       uint32 txpad[4];    /* future */
+
+       /* receive side counters */
+       uint32 rxpdu;       /* pdus recd */
+       uint32 rxqed;       /* pdus buffered before sending up */
+       uint32 rxdup;       /* duplicate pdus */
+       uint32 rxnobuf;     /* pdus discarded due to no buf */
+       uint32 rxaddbareq;  /* addba req recd */
+       uint32 rxaddbaresp; /* addba resp recd */
+       uint32 rxdelba;     /* delba recd */
+       uint32 rxba;        /* ba recd */
+       uint32 rxbar;       /* bar recd */
+       uint32 rxinvba;     /* invalid ba recd */
+       uint32 rxbaholes;   /* ba recd with holes */
+       uint32 rxunexp;     /* unexpected packets */
+       uint32 rxpad[4];    /* future */
+} wlc_ba_cnt_t;
+#endif /* WLBA */
+
+/* structure for per-tid ampdu control */
+struct ampdu_tid_control {
+       uint8 tid;                      /* tid */
+       uint8 enable;                   /* enable/disable */
+};
+
+/* struct for ampdu tx/rx aggregation control */
+struct ampdu_aggr {
+       int8 aggr_override;     /* aggr overrided by dongle. Not to be set by host. */
+       uint16 conf_TID_bmap;   /* bitmap of TIDs to configure */
+       uint16 enab_TID_bmap;   /* enable/disable per TID */
+};
+
+/* structure for identifying ea/tid for sending addba/delba */
+struct ampdu_ea_tid {
+       struct ether_addr ea;           /* Station address */
+       uint8 tid;                      /* tid */
+       uint8 initiator;        /* 0 is recipient, 1 is originator */
+};
+/* structure for identifying retry/tid for retry_limit_tid/rr_retry_limit_tid */
+struct ampdu_retry_tid {
+       uint8 tid;      /* tid */
+       uint8 retry;    /* retry value */
+};
+
+#define BDD_FNAME_LEN       32  /* Max length of friendly name */
+typedef struct bdd_fname {
+       uint8 len;          /* length of friendly name */
+       uchar name[BDD_FNAME_LEN];  /* friendly name */
+} bdd_fname_t;
+
+/* structure for addts arguments */
+/* For ioctls that take a list of TSPEC */
+struct tslist {
+       int count;                      /* number of tspecs */
+       struct tsinfo_arg tsinfo[1];    /* variable length array of tsinfo */
+};
+
+#ifdef WLTDLS
+/* structure for tdls iovars */
+typedef struct tdls_iovar {
+       struct ether_addr ea;           /* Station address */
+       uint8 mode;                     /* mode: depends on iovar */
+       chanspec_t chanspec;
+       uint32 pad;                     /* future */
+} tdls_iovar_t;
+
+#define TDLS_WFD_IE_SIZE               512
+/* structure for tdls wfd ie */
+typedef struct tdls_wfd_ie_iovar {
+       struct ether_addr ea;           /* Station address */
+       uint8 mode;
+       uint16 length;
+       uint8 data[TDLS_WFD_IE_SIZE];
+} tdls_wfd_ie_iovar_t;
+#endif /* WLTDLS */
+
+/* structure for addts/delts arguments */
+typedef struct tspec_arg {
+       uint16 version;                 /* see definition of TSPEC_ARG_VERSION */
+       uint16 length;                  /* length of entire structure */
+       uint flag;                      /* bit field */
+       /* TSPEC Arguments */
+       struct tsinfo_arg tsinfo;       /* TS Info bit field */
+       uint16 nom_msdu_size;           /* (Nominal or fixed) MSDU Size (bytes) */
+       uint16 max_msdu_size;           /* Maximum MSDU Size (bytes) */
+       uint min_srv_interval;          /* Minimum Service Interval (us) */
+       uint max_srv_interval;          /* Maximum Service Interval (us) */
+       uint inactivity_interval;       /* Inactivity Interval (us) */
+       uint suspension_interval;       /* Suspension Interval (us) */
+       uint srv_start_time;            /* Service Start Time (us) */
+       uint min_data_rate;             /* Minimum Data Rate (bps) */
+       uint mean_data_rate;            /* Mean Data Rate (bps) */
+       uint peak_data_rate;            /* Peak Data Rate (bps) */
+       uint max_burst_size;            /* Maximum Burst Size (bytes) */
+       uint delay_bound;               /* Delay Bound (us) */
+       uint min_phy_rate;              /* Minimum PHY Rate (bps) */
+       uint16 surplus_bw;              /* Surplus Bandwidth Allowance (range 1.0 to 8.0) */
+       uint16 medium_time;             /* Medium Time (32 us/s periods) */
+       uint8 dialog_token;             /* dialog token */
+} tspec_arg_t;
+
+/* tspec arg for desired station */
+typedef        struct tspec_per_sta_arg {
+       struct ether_addr ea;
+       struct tspec_arg ts;
+} tspec_per_sta_arg_t;
+
+/* structure for max bandwidth for each access category */
+typedef        struct wme_max_bandwidth {
+       uint32  ac[AC_COUNT];   /* max bandwidth for each access category */
+} wme_max_bandwidth_t;
+
+#define WL_WME_MBW_PARAMS_IO_BYTES (sizeof(wme_max_bandwidth_t))
+
+/* current version of wl_tspec_arg_t struct */
+#define        TSPEC_ARG_VERSION               2       /* current version of wl_tspec_arg_t struct */
+#define TSPEC_ARG_LENGTH               55      /* argument length from tsinfo to medium_time */
+#define TSPEC_DEFAULT_DIALOG_TOKEN     42      /* default dialog token */
+#define TSPEC_DEFAULT_SBW_FACTOR       0x3000  /* default surplus bw */
+
+
+#define WL_WOWL_KEEPALIVE_MAX_PACKET_SIZE  80
+#define WLC_WOWL_MAX_KEEPALIVE 2
+
+/* Packet lifetime configuration per ac */
+typedef struct wl_lifetime {
+       uint32 ac;              /* access class */
+       uint32 lifetime;    /* Packet lifetime value in ms */
+} wl_lifetime_t;
+
+
+/* Channel Switch Announcement param */
+typedef struct wl_chan_switch {
+       uint8 mode;             /* value 0 or 1 */
+       uint8 count;            /* count # of beacons before switching */
+       chanspec_t chspec;      /* chanspec */
+       uint8 reg;              /* regulatory class */
+       uint8 frame_type;               /* csa frame type, unicast or broadcast */
+} wl_chan_switch_t;
+
+enum {
+       PFN_LIST_ORDER,
+       PFN_RSSI
+};
+
+enum {
+       DISABLE,
+       ENABLE
+};
+
+enum {
+       OFF_ADAPT,
+       SMART_ADAPT,
+       STRICT_ADAPT,
+       SLOW_ADAPT
+};
+
+#define SORT_CRITERIA_BIT              0
+#define AUTO_NET_SWITCH_BIT            1
+#define ENABLE_BKGRD_SCAN_BIT          2
+#define IMMEDIATE_SCAN_BIT             3
+#define        AUTO_CONNECT_BIT                4
+#define        ENABLE_BD_SCAN_BIT              5
+#define ENABLE_ADAPTSCAN_BIT           6
+#define IMMEDIATE_EVENT_BIT            8
+#define SUPPRESS_SSID_BIT              9
+#define ENABLE_NET_OFFLOAD_BIT         10
+/* report found/lost events for SSID and BSSID networks seperately */
+#define REPORT_SEPERATELY_BIT          11
+
+#define SORT_CRITERIA_MASK     0x0001
+#define AUTO_NET_SWITCH_MASK   0x0002
+#define ENABLE_BKGRD_SCAN_MASK 0x0004
+#define IMMEDIATE_SCAN_MASK    0x0008
+#define AUTO_CONNECT_MASK      0x0010
+
+#define ENABLE_BD_SCAN_MASK    0x0020
+#define ENABLE_ADAPTSCAN_MASK  0x00c0
+#define IMMEDIATE_EVENT_MASK   0x0100
+#define SUPPRESS_SSID_MASK     0x0200
+#define ENABLE_NET_OFFLOAD_MASK        0x0400
+/* report found/lost events for SSID and BSSID networks seperately */
+#define REPORT_SEPERATELY_MASK 0x0800
+
+#define PFN_VERSION                    2
+#define PFN_SCANRESULT_VERSION         1
+#define MAX_PFN_LIST_COUNT             16
+
+#define PFN_COMPLETE                   1
+#define PFN_INCOMPLETE                 0
+
+#define DEFAULT_BESTN                  2
+#define DEFAULT_MSCAN                  0
+#define DEFAULT_REPEAT                 10
+#define DEFAULT_EXP                    2
+
+#define PFN_PARTIAL_SCAN_BIT           0
+#define PFN_PARTIAL_SCAN_MASK          1
+#define PFN_SWC_RSSI_WINDOW_MAX   8
+#define PFN_SWC_MAX_NUM_APS       16
+#define PFN_HOTLIST_MAX_NUM_APS   64
+
+/* PFN network info structure */
+typedef struct wl_pfn_subnet_info {
+       struct ether_addr BSSID;
+       uint8   channel; /* channel number only */
+       uint8   SSID_len;
+       uint8   SSID[32];
+} wl_pfn_subnet_info_t;
+
+typedef struct wl_pfn_net_info {
+       wl_pfn_subnet_info_t pfnsubnet;
+       int16   RSSI; /* receive signal strength (in dBm) */
+       uint16  timestamp; /* age in seconds */
+} wl_pfn_net_info_t;
+
+typedef struct wl_pfn_lnet_info {
+       wl_pfn_subnet_info_t pfnsubnet; /* BSSID + channel + SSID len + SSID */
+       uint16  flags; /* partial scan, etc */
+       int16   RSSI; /* receive signal strength (in dBm) */
+       uint32  timestamp; /* age in miliseconds */
+       uint16  rtt0; /* estimated distance to this AP in centimeters */
+       uint16  rtt1; /* standard deviation of the distance to this AP in centimeters */
+} wl_pfn_lnet_info_t;
+
+typedef struct wl_pfn_lscanresults {
+       uint32 version;
+       uint32 status;
+       uint32 count;
+       wl_pfn_lnet_info_t netinfo[1];
+} wl_pfn_lscanresults_t;
+
+/* this is used to report on 1-* pfn scan results */
+typedef struct wl_pfn_scanresults {
+       uint32 version;
+       uint32 status;
+       uint32 count;
+       wl_pfn_net_info_t netinfo[1];
+} wl_pfn_scanresults_t;
+
+typedef struct wl_pfn_significant_net {
+       uint16 flags;
+       uint16 channel;
+       struct ether_addr BSSID;
+       int8 rssi[PFN_SWC_RSSI_WINDOW_MAX];
+} wl_pfn_significant_net_t;
+
+
+typedef struct wl_pfn_swc_results {
+       uint32 version;
+       uint32 pkt_count;
+       uint32 total_count;
+       wl_pfn_significant_net_t list[1];
+} wl_pfn_swc_results_t;
+
+/* used to report exactly one scan result */
+/* plus reports detailed scan info in bss_info */
+typedef struct wl_pfn_scanresult {
+       uint32 version;
+       uint32 status;
+       uint32 count;
+       wl_pfn_net_info_t netinfo;
+       wl_bss_info_t bss_info;
+} wl_pfn_scanresult_t;
+
+/* PFN data structure */
+typedef struct wl_pfn_param {
+       int32 version;                  /* PNO parameters version */
+       int32 scan_freq;                /* Scan frequency */
+       int32 lost_network_timeout;     /* Timeout in sec. to declare
+                                                               * discovered network as lost
+                                                               */
+       int16 flags;                    /* Bit field to control features
+                                                       * of PFN such as sort criteria auto
+                                                       * enable switch and background scan
+                                                       */
+       int16 rssi_margin;              /* Margin to avoid jitter for choosing a
+                                                       * PFN based on RSSI sort criteria
+                                                       */
+       uint8 bestn; /* number of best networks in each scan */
+       uint8 mscan; /* number of scans recorded */
+       uint8 repeat; /* Minimum number of scan intervals
+                                    *before scan frequency changes in adaptive scan
+                                    */
+       uint8 exp; /* Exponent of 2 for maximum scan interval */
+       int32 slow_freq; /* slow scan period */
+} wl_pfn_param_t;
+
+typedef struct wl_pfn_bssid {
+       struct ether_addr  macaddr;
+       /* Bit4: suppress_lost, Bit3: suppress_found */
+       uint16             flags;
+} wl_pfn_bssid_t;
+
+typedef struct wl_pfn_significant_bssid {
+       struct ether_addr       macaddr;
+       int8    rssi_low_threshold;
+       int8    rssi_high_threshold;
+} wl_pfn_significant_bssid_t;
+#define WL_PFN_SUPPRESSFOUND_MASK      0x08
+#define WL_PFN_SUPPRESSLOST_MASK       0x10
+#define WL_PFN_RSSI_MASK               0xff00
+#define WL_PFN_RSSI_SHIFT              8
+
+typedef struct wl_pfn_cfg {
+       uint32  reporttype;
+       int32   channel_num;
+       uint16  channel_list[WL_NUMCHANNELS];
+       uint32  flags;
+} wl_pfn_cfg_t;
+
+#define CH_BUCKET_REPORT_REGULAR                0
+#define CH_BUCKET_REPORT_FULL_RESULT            2
+#define CH_BUCKET_GSCAN                         4
+
+
+typedef struct wl_pfn_gscan_channel_bucket {
+       uint16 bucket_end_index;
+       uint8 bucket_freq_multiple;
+       uint8 report_flag;
+} wl_pfn_gscan_channel_bucket_t;
+
+#define GSCAN_SEND_ALL_RESULTS_MASK    (1 << 0)
+#define GSCAN_CFG_FLAGS_ONLY_MASK      (1 << 7)
+
+typedef struct wl_pfn_gscan_cfg {
+       /* BIT0 1 = send probes/beacons to HOST
+       * BIT2 Reserved
+        * Add any future flags here
+        * BIT7 1 = no other useful cfg sent
+        */
+       uint8 flags;
+       /* Buffer filled threshold in % to generate an event */
+       uint8   buffer_threshold;
+       /* No. of BSSIDs with "change" to generate an evt
+        * change - crosses rssi threshold/lost
+        */
+       uint8   swc_nbssid_threshold;
+       /* Max=8 (for now) Size of rssi cache buffer */
+       uint8  swc_rssi_window_size;
+       uint16  count_of_channel_buckets;
+       uint16  lost_ap_window;
+       wl_pfn_gscan_channel_bucket_t channel_bucket[1];
+} wl_pfn_gscan_cfg_t;
+
+
+#define WL_PFN_REPORT_ALLNET    0
+#define WL_PFN_REPORT_SSIDNET   1
+#define WL_PFN_REPORT_BSSIDNET  2
+#define WL_PFN_CFG_FLAGS_PROHIBITED    0x00000001      /* Accept and use prohibited channels */
+#define WL_PFN_CFG_FLAGS_RESERVED      0xfffffffe      /* Remaining reserved for future use */
+
+typedef struct wl_pfn {
+       wlc_ssid_t              ssid;                   /* ssid name and its length */
+       int32                   flags;                  /* bit2: hidden */
+       int32                   infra;                  /* BSS Vs IBSS */
+       int32                   auth;                   /* Open Vs Closed */
+       int32                   wpa_auth;               /* WPA type */
+       int32                   wsec;                   /* wsec value */
+} wl_pfn_t;
+
+typedef struct wl_pfn_list {
+       uint32          version;
+       uint32          enabled;
+       uint32          count;
+       wl_pfn_t        pfn[1];
+} wl_pfn_list_t;
+
+#define WL_PFN_MAC_OUI_ONLY_MASK      1
+#define WL_PFN_SET_MAC_UNASSOC_MASK   2
+/* To configure pfn_macaddr */
+typedef struct wl_pfn_macaddr_cfg {
+       uint8 version;
+       uint8 flags;
+       struct ether_addr macaddr;
+} wl_pfn_macaddr_cfg_t;
+#define WL_PFN_MACADDR_CFG_VER 1
+typedef BWL_PRE_PACKED_STRUCT struct pfn_olmsg_params_t {
+       wlc_ssid_t ssid;
+       uint32  cipher_type;
+       uint32  auth_type;
+       uint8   channels[4];
+} BWL_POST_PACKED_STRUCT pfn_olmsg_params;
+
+#define WL_PFN_HIDDEN_BIT              2
+#define WL_PFN_HIDDEN_MASK             0x4
+
+#ifndef BESTN_MAX
+#define BESTN_MAX                      3
+#endif
+
+#ifndef MSCAN_MAX
+#define MSCAN_MAX                      90
+#endif
+
+/*
+ * WLFCTS definition
+ */
+typedef struct wl_txstatus_additional_info {
+       uint32 rspec;
+       uint32 enq_ts;
+       uint32 last_ts;
+       uint32 entry_ts;
+       uint16 seq;
+       uint8  rts_cnt;
+       uint8  tx_cnt;
+} wl_txstatus_additional_info_t;
+
+/* Service discovery */
+typedef struct {
+       uint8   transaction_id; /* Transaction id */
+       uint8   protocol;       /* Service protocol type */
+       uint16  query_len;      /* Length of query */
+       uint16  response_len;   /* Length of response */
+       uint8   qrbuf[1];
+} wl_p2po_qr_t;
+
+typedef struct {
+       uint16                  period;                 /* extended listen period */
+       uint16                  interval;               /* extended listen interval */
+       uint16                  count;                  /* count to repeat */
+       uint16                  pad;                    /* pad for 32bit align */
+} wl_p2po_listen_t;
+
+/* GAS state machine tunable parameters.  Structure field values of 0 means use the default. */
+typedef struct wl_gas_config {
+       uint16 max_retransmit;          /* Max # of firmware/driver retransmits on no Ack
+                                        * from peer (on top of the ucode retries).
+                                        */
+       uint16 response_timeout;        /* Max time to wait for a GAS-level response
+                                        * after sending a packet.
+                                        */
+       uint16 max_comeback_delay;      /* Max GAS response comeback delay.
+                                        * Exceeding this fails the GAS exchange.
+                                        */
+       uint16 max_retries;             /* Max # of GAS state machine retries on failure
+                                        * of a GAS frame exchange.
+                                        */
+} wl_gas_config_t;
+
+/* P2P Find Offload parameters */
+typedef BWL_PRE_PACKED_STRUCT struct wl_p2po_find_config {
+       uint16 version;                 /* Version of this struct */
+       uint16 length;                  /* sizeof(wl_p2po_find_config_t) */
+       int32 search_home_time;         /* P2P search state home time when concurrent
+                                        * connection exists.  -1 for default.
+                                        */
+       uint8 num_social_channels;
+                       /* Number of social channels up to WL_P2P_SOCIAL_CHANNELS_MAX.
+                        * 0 means use default social channels.
+                        */
+       uint8 flags;
+       uint16 social_channels[1];      /* Variable length array of social channels */
+} BWL_POST_PACKED_STRUCT wl_p2po_find_config_t;
+#define WL_P2PO_FIND_CONFIG_VERSION 2  /* value for version field */
+
+/* wl_p2po_find_config_t flags */
+#define P2PO_FIND_FLAG_SCAN_ALL_APS 0x01       /* Whether to scan for all APs in the p2po_find
+                                                * periodic scans of all channels.
+                                                * 0 means scan for only P2P devices.
+                                                * 1 means scan for P2P devices plus non-P2P APs.
+                                                */
+
+
+/* For adding a WFDS service to seek */
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint32 seek_hdl;                /* unique id chosen by host */
+       uint8 addr[6];                  /* Seek service from a specific device with this
+                                        * MAC address, all 1's for any device.
+                                        */
+       uint8 service_hash[P2P_WFDS_HASH_LEN];
+       uint8 service_name_len;
+       uint8 service_name[MAX_WFDS_SEEK_SVC_NAME_LEN];
+                                       /* Service name to seek, not null terminated */
+       uint8 service_info_req_len;
+       uint8 service_info_req[1];      /* Service info request, not null terminated.
+                                        * Variable length specified by service_info_req_len.
+                                        * Maximum length is MAX_WFDS_SEEK_SVC_INFO_LEN.
+                                        */
+} BWL_POST_PACKED_STRUCT wl_p2po_wfds_seek_add_t;
+
+/* For deleting a WFDS service to seek */
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint32 seek_hdl;                /* delete service specified by id */
+} BWL_POST_PACKED_STRUCT wl_p2po_wfds_seek_del_t;
+
+
+/* For adding a WFDS service to advertise */
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint32 advertise_hdl;           /* unique id chosen by host */
+       uint8 service_hash[P2P_WFDS_HASH_LEN];
+       uint32 advertisement_id;
+       uint16 service_config_method;
+       uint8 service_name_len;
+       uint8 service_name[MAX_WFDS_SVC_NAME_LEN];
+                                       /* Service name , not null terminated */
+       uint8 service_status;
+       uint16 service_info_len;
+       uint8 service_info[1];          /* Service info, not null terminated.
+                                        * Variable length specified by service_info_len.
+                                        * Maximum length is MAX_WFDS_ADV_SVC_INFO_LEN.
+                                        */
+} BWL_POST_PACKED_STRUCT wl_p2po_wfds_advertise_add_t;
+
+/* For deleting a WFDS service to advertise */
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint32 advertise_hdl;   /* delete service specified by hdl */
+} BWL_POST_PACKED_STRUCT wl_p2po_wfds_advertise_del_t;
+
+/* P2P Offload discovery mode for the p2po_state iovar */
+typedef enum {
+       WL_P2PO_DISC_STOP,
+       WL_P2PO_DISC_LISTEN,
+       WL_P2PO_DISC_DISCOVERY
+} disc_mode_t;
+
+/* ANQP offload */
+
+#define ANQPO_MAX_QUERY_SIZE           256
+typedef struct {
+       uint16 max_retransmit;          /* ~0 use default, max retransmit on no ACK from peer */
+       uint16 response_timeout;        /* ~0 use default, msec to wait for resp after tx packet */
+       uint16 max_comeback_delay;      /* ~0 use default, max comeback delay in resp else fail */
+       uint16 max_retries;                     /* ~0 use default, max retries on failure */
+       uint16 query_len;                       /* length of ANQP query */
+       uint8 query_data[1];            /* ANQP encoded query (max ANQPO_MAX_QUERY_SIZE) */
+} wl_anqpo_set_t;
+
+typedef struct {
+       uint16 channel;                         /* channel of the peer */
+       struct ether_addr addr;         /* addr of the peer */
+} wl_anqpo_peer_t;
+
+#define ANQPO_MAX_PEER_LIST                    64
+typedef struct {
+       uint16 count;                           /* number of peers in list */
+       wl_anqpo_peer_t peer[1];        /* max ANQPO_MAX_PEER_LIST */
+} wl_anqpo_peer_list_t;
+
+#define ANQPO_MAX_IGNORE_SSID          64
+typedef struct {
+       bool is_clear;                          /* set to clear list (not used on GET) */
+       uint16 count;                           /* number of SSID in list */
+       wlc_ssid_t ssid[1];                     /* max ANQPO_MAX_IGNORE_SSID */
+} wl_anqpo_ignore_ssid_list_t;
+
+#define ANQPO_MAX_IGNORE_BSSID         64
+typedef struct {
+       bool is_clear;                          /* set to clear list (not used on GET) */
+       uint16 count;                           /* number of addr in list */
+       struct ether_addr bssid[1];     /* max ANQPO_MAX_IGNORE_BSSID */
+} wl_anqpo_ignore_bssid_list_t;
+
+
+struct toe_ol_stats_t {
+       /* Num of tx packets that don't need to be checksummed */
+       uint32 tx_summed;
+
+       /* Num of tx packets where checksum is filled by offload engine */
+       uint32 tx_iph_fill;
+       uint32 tx_tcp_fill;
+       uint32 tx_udp_fill;
+       uint32 tx_icmp_fill;
+
+       /*  Num of rx packets where toe finds out if checksum is good or bad */
+       uint32 rx_iph_good;
+       uint32 rx_iph_bad;
+       uint32 rx_tcp_good;
+       uint32 rx_tcp_bad;
+       uint32 rx_udp_good;
+       uint32 rx_udp_bad;
+       uint32 rx_icmp_good;
+       uint32 rx_icmp_bad;
+
+       /* Num of tx packets in which csum error is injected */
+       uint32 tx_tcp_errinj;
+       uint32 tx_udp_errinj;
+       uint32 tx_icmp_errinj;
+
+       /* Num of rx packets in which csum error is injected */
+       uint32 rx_tcp_errinj;
+       uint32 rx_udp_errinj;
+       uint32 rx_icmp_errinj;
+};
+
+/* Arp offload statistic counts */
+struct arp_ol_stats_t {
+       uint32  host_ip_entries;        /* Host IP table addresses (more than one if multihomed) */
+       uint32  host_ip_overflow;       /* Host IP table additions skipped due to overflow */
+
+       uint32  arp_table_entries;      /* ARP table entries */
+       uint32  arp_table_overflow;     /* ARP table additions skipped due to overflow */
+
+       uint32  host_request;           /* ARP requests from host */
+       uint32  host_reply;             /* ARP replies from host */
+       uint32  host_service;           /* ARP requests from host serviced by ARP Agent */
+
+       uint32  peer_request;           /* ARP requests received from network */
+       uint32  peer_request_drop;      /* ARP requests from network that were dropped */
+       uint32  peer_reply;             /* ARP replies received from network */
+       uint32  peer_reply_drop;        /* ARP replies from network that were dropped */
+       uint32  peer_service;           /* ARP request from host serviced by ARP Agent */
+};
+
+/* NS offload statistic counts */
+struct nd_ol_stats_t {
+       uint32  host_ip_entries;    /* Host IP table addresses (more than one if multihomed) */
+       uint32  host_ip_overflow;   /* Host IP table additions skipped due to overflow */
+       uint32  peer_request;       /* NS requests received from network */
+       uint32  peer_request_drop;  /* NS requests from network that were dropped */
+       uint32  peer_reply_drop;    /* NA replies from network that were dropped */
+       uint32  peer_service;       /* NS request from host serviced by firmware */
+};
+
+/*
+ * Keep-alive packet offloading.
+ */
+
+/* NAT keep-alive packets format: specifies the re-transmission period, the packet
+ * length, and packet contents.
+ */
+typedef struct wl_keep_alive_pkt {
+       uint32  period_msec;    /* Retransmission period (0 to disable packet re-transmits) */
+       uint16  len_bytes;      /* Size of packet to transmit (0 to disable packet re-transmits) */
+       uint8   data[1];        /* Variable length packet to transmit.  Contents should include
+                                * entire ethernet packet (enet header, IP header, UDP header,
+                                * and UDP payload) in network byte order.
+                                */
+} wl_keep_alive_pkt_t;
+
+#define WL_KEEP_ALIVE_FIXED_LEN                OFFSETOF(wl_keep_alive_pkt_t, data)
+
+
+/*
+ * Dongle pattern matching filter.
+ */
+
+#define MAX_WAKE_PACKET_CACHE_BYTES 128 /* Maximum cached wake packet */
+
+#define MAX_WAKE_PACKET_BYTES      (DOT11_A3_HDR_LEN +                     \
+                                    DOT11_QOS_LEN +                        \
+                                    sizeof(struct dot11_llc_snap_header) + \
+                                    ETHER_MAX_DATA)
+
+typedef struct pm_wake_packet {
+       uint32  status;         /* Is the wake reason a packet (if all the other field's valid) */
+       uint32  pattern_id;     /* Pattern ID that matched */
+       uint32  original_packet_size;
+       uint32  saved_packet_size;
+       uchar   packet[MAX_WAKE_PACKET_CACHE_BYTES];
+} pm_wake_packet_t;
+
+/* Packet filter types. Currently, only pattern matching is supported. */
+typedef enum wl_pkt_filter_type {
+       WL_PKT_FILTER_TYPE_PATTERN_MATCH=0,     /* Pattern matching filter */
+       WL_PKT_FILTER_TYPE_MAGIC_PATTERN_MATCH=1, /* Magic packet match */
+       WL_PKT_FILTER_TYPE_PATTERN_LIST_MATCH=2, /* A pattern list (match all to match filter) */
+       WL_PKT_FILTER_TYPE_ENCRYPTED_PATTERN_MATCH=3, /* SECURE WOWL magic / net pattern match */
+} wl_pkt_filter_type_t;
+
+#define WL_PKT_FILTER_TYPE wl_pkt_filter_type_t
+
+/* String mapping for types that may be used by applications or debug */
+#define WL_PKT_FILTER_TYPE_NAMES \
+       { "PATTERN", WL_PKT_FILTER_TYPE_PATTERN_MATCH },       \
+       { "MAGIC",   WL_PKT_FILTER_TYPE_MAGIC_PATTERN_MATCH }, \
+       { "PATLIST", WL_PKT_FILTER_TYPE_PATTERN_LIST_MATCH }
+
+/* Secured WOWL packet was encrypted, need decrypted before check filter match */
+typedef struct wl_pkt_decrypter {
+       uint8* (*dec_cb)(void* dec_ctx, const void *sdu, int sending);
+       void*  dec_ctx;
+} wl_pkt_decrypter_t;
+
+/* Pattern matching filter. Specifies an offset within received packets to
+ * start matching, the pattern to match, the size of the pattern, and a bitmask
+ * that indicates which bits within the pattern should be matched.
+ */
+typedef struct wl_pkt_filter_pattern {
+       uint32  offset;         /* Offset within received packet to start pattern matching.
+                                * Offset '0' is the first byte of the ethernet header.
+                                */
+       uint32  size_bytes;     /* Size of the pattern.  Bitmask must be the same size. */
+       uint8   mask_and_pattern[1]; /* Variable length mask and pattern data.  mask starts
+                                     * at offset 0.  Pattern immediately follows mask. for
+                                     * secured pattern, put the descrypter pointer to the
+                                     * beginning, mask and pattern postponed correspondingly
+                                     */
+} wl_pkt_filter_pattern_t;
+
+/* A pattern list is a numerically specified list of modified pattern structures. */
+typedef struct wl_pkt_filter_pattern_listel {
+       uint16 rel_offs;        /* Offset to begin match (relative to 'base' below) */
+       uint16 base_offs;       /* Base for offset (defined below) */
+       uint16 size_bytes;      /* Size of mask/pattern */
+       uint16 match_flags;     /* Addition flags controlling the match */
+       uint8  mask_and_data[1]; /* Variable length mask followed by data, each size_bytes */
+} wl_pkt_filter_pattern_listel_t;
+
+typedef struct wl_pkt_filter_pattern_list {
+       uint8 list_cnt;         /* Number of elements in the list */
+       uint8 PAD1[1];          /* Reserved (possible version: reserved) */
+       uint16 totsize;         /* Total size of this pattern list (includes this struct) */
+       wl_pkt_filter_pattern_listel_t patterns[1]; /* Variable number of list elements */
+} wl_pkt_filter_pattern_list_t;
+
+/* IOVAR "pkt_filter_add" parameter. Used to install packet filters. */
+typedef struct wl_pkt_filter {
+       uint32  id;             /* Unique filter id, specified by app. */
+       uint32  type;           /* Filter type (WL_PKT_FILTER_TYPE_xxx). */
+       uint32  negate_match;   /* Negate the result of filter matches */
+       union {                 /* Filter definitions */
+               wl_pkt_filter_pattern_t pattern;        /* Pattern matching filter */
+               wl_pkt_filter_pattern_list_t patlist; /* List of patterns to match */
+       } u;
+} wl_pkt_filter_t;
+
+/* IOVAR "tcp_keep_set" parameter. Used to install tcp keep_alive stuff. */
+typedef struct wl_tcp_keep_set {
+       uint32  val1;
+       uint32  val2;
+} wl_tcp_keep_set_t;
+
+#define WL_PKT_FILTER_FIXED_LEN                  OFFSETOF(wl_pkt_filter_t, u)
+#define WL_PKT_FILTER_PATTERN_FIXED_LEN          OFFSETOF(wl_pkt_filter_pattern_t, mask_and_pattern)
+#define WL_PKT_FILTER_PATTERN_LIST_FIXED_LEN OFFSETOF(wl_pkt_filter_pattern_list_t, patterns)
+#define WL_PKT_FILTER_PATTERN_LISTEL_FIXED_LEN \
+                       OFFSETOF(wl_pkt_filter_pattern_listel_t, mask_and_data)
+
+/* IOVAR "pkt_filter_enable" parameter. */
+typedef struct wl_pkt_filter_enable {
+       uint32  id;             /* Unique filter id */
+       uint32  enable;         /* Enable/disable bool */
+} wl_pkt_filter_enable_t;
+
+/* IOVAR "pkt_filter_list" parameter. Used to retrieve a list of installed filters. */
+typedef struct wl_pkt_filter_list {
+       uint32  num;            /* Number of installed packet filters */
+       wl_pkt_filter_t filter[1];      /* Variable array of packet filters. */
+} wl_pkt_filter_list_t;
+
+#define WL_PKT_FILTER_LIST_FIXED_LEN     OFFSETOF(wl_pkt_filter_list_t, filter)
+
+/* IOVAR "pkt_filter_stats" parameter. Used to retrieve debug statistics. */
+typedef struct wl_pkt_filter_stats {
+       uint32  num_pkts_matched;       /* # filter matches for specified filter id */
+       uint32  num_pkts_forwarded;     /* # packets fwded from dongle to host for all filters */
+       uint32  num_pkts_discarded;     /* # packets discarded by dongle for all filters */
+} wl_pkt_filter_stats_t;
+
+/* IOVAR "pkt_filter_ports" parameter.  Configure TCP/UDP port filters. */
+typedef struct wl_pkt_filter_ports {
+       uint8 version;          /* Be proper */
+       uint8 reserved;         /* Be really proper */
+       uint16 count;           /* Number of ports following */
+       /* End of fixed data */
+       uint16 ports[1];        /* Placeholder for ports[<count>] */
+} wl_pkt_filter_ports_t;
+
+#define WL_PKT_FILTER_PORTS_FIXED_LEN  OFFSETOF(wl_pkt_filter_ports_t, ports)
+
+#define WL_PKT_FILTER_PORTS_VERSION    0
+#define WL_PKT_FILTER_PORTS_MAX                128
+
+#define RSN_REPLAY_LEN 8
+typedef struct _gtkrefresh {
+       uchar   KCK[RSN_KCK_LENGTH];
+       uchar   KEK[RSN_KEK_LENGTH];
+       uchar   ReplayCounter[RSN_REPLAY_LEN];
+} gtk_keyinfo_t, *pgtk_keyinfo_t;
+
+/* Sequential Commands ioctl */
+typedef struct wl_seq_cmd_ioctl {
+       uint32 cmd;             /* common ioctl definition */
+       uint32 len;             /* length of user buffer */
+} wl_seq_cmd_ioctl_t;
+
+#define WL_SEQ_CMD_ALIGN_BYTES 4
+
+/* These are the set of get IOCTLs that should be allowed when using
+ * IOCTL sequence commands. These are issued implicitly by wl.exe each time
+ * it is invoked. We never want to buffer these, or else wl.exe will stop working.
+ */
+#define WL_SEQ_CMDS_GET_IOCTL_FILTER(cmd) \
+       (((cmd) == WLC_GET_MAGIC)               || \
+        ((cmd) == WLC_GET_VERSION)             || \
+        ((cmd) == WLC_GET_AP)                  || \
+        ((cmd) == WLC_GET_INSTANCE))
+
+typedef struct wl_pkteng {
+       uint32 flags;
+       uint32 delay;                   /* Inter-packet delay */
+       uint32 nframes;                 /* Number of frames */
+       uint32 length;                  /* Packet length */
+       uint8  seqno;                   /* Enable/disable sequence no. */
+       struct ether_addr dest;         /* Destination address */
+       struct ether_addr src;          /* Source address */
+} wl_pkteng_t;
+
+typedef struct wl_pkteng_stats {
+       uint32 lostfrmcnt;              /* RX PER test: no of frames lost (skip seqno) */
+       int32 rssi;                     /* RSSI */
+       int32 snr;                      /* signal to noise ratio */
+       uint16 rxpktcnt[NUM_80211_RATES+1];
+       uint8 rssi_qdb;                 /* qdB portion of the computed rssi */
+} wl_pkteng_stats_t;
+
+typedef struct wl_txcal_params {
+       wl_pkteng_t pkteng;
+       uint8 gidx_start;
+       int8 gidx_step;
+       uint8 gidx_stop;
+} wl_txcal_params_t;
+
+
+typedef enum {
+       wowl_pattern_type_bitmap = 0,
+       wowl_pattern_type_arp,
+       wowl_pattern_type_na
+} wowl_pattern_type_t;
+
+typedef struct wl_wowl_pattern {
+       uint32              masksize;           /* Size of the mask in #of bytes */
+       uint32              offset;             /* Pattern byte offset in packet */
+       uint32              patternoffset;      /* Offset of start of pattern in the structure */
+       uint32              patternsize;        /* Size of the pattern itself in #of bytes */
+       uint32              id;                 /* id */
+       uint32              reasonsize;         /* Size of the wakeup reason code */
+       wowl_pattern_type_t type;               /* Type of pattern */
+       /* Mask follows the structure above */
+       /* Pattern follows the mask is at 'patternoffset' from the start */
+} wl_wowl_pattern_t;
+
+typedef struct wl_wowl_pattern_list {
+       uint                    count;
+       wl_wowl_pattern_t       pattern[1];
+} wl_wowl_pattern_list_t;
+
+typedef struct wl_wowl_wakeind {
+       uint8   pci_wakeind;    /* Whether PCI PMECSR PMEStatus bit was set */
+       uint32  ucode_wakeind;  /* What wakeup-event indication was set by ucode */
+} wl_wowl_wakeind_t;
+
+typedef struct {
+       uint32          pktlen;             /* size of packet */
+       void            *sdu;
+} tcp_keepalive_wake_pkt_infop_t;
+
+/* per AC rate control related data structure */
+typedef struct wl_txrate_class {
+       uint8           init_rate;
+       uint8           min_rate;
+       uint8           max_rate;
+} wl_txrate_class_t;
+
+/* structure for Overlap BSS scan arguments */
+typedef struct wl_obss_scan_arg {
+       int16   passive_dwell;
+       int16   active_dwell;
+       int16   bss_widthscan_interval;
+       int16   passive_total;
+       int16   active_total;
+       int16   chanwidth_transition_delay;
+       int16   activity_threshold;
+} wl_obss_scan_arg_t;
+
+#define WL_OBSS_SCAN_PARAM_LEN sizeof(wl_obss_scan_arg_t)
+
+/* RSSI event notification configuration. */
+typedef struct wl_rssi_event {
+       uint32 rate_limit_msec;         /* # of events posted to application will be limited to
+                                        * one per specified period (0 to disable rate limit).
+                                        */
+       uint8 num_rssi_levels;          /* Number of entries in rssi_levels[] below */
+       int8 rssi_levels[MAX_RSSI_LEVELS];      /* Variable number of RSSI levels. An event
+                                                * will be posted each time the RSSI of received
+                                                * beacons/packets crosses a level.
+                                                */
+} wl_rssi_event_t;
+
+/* CCA based channel quality event configuration */
+#define WL_CHAN_QUAL_CCA       0
+#define WL_CHAN_QUAL_NF                1
+#define WL_CHAN_QUAL_NF_LTE    2
+#define WL_CHAN_QUAL_TOTAL     3
+
+#define MAX_CHAN_QUAL_LEVELS   8
+
+typedef struct wl_chan_qual_metric {
+       uint8 id;                               /* metric ID */
+       uint8 num_levels;                       /* Number of entries in rssi_levels[] below */
+       uint16 flags;
+       int16 htol[MAX_CHAN_QUAL_LEVELS];       /* threshold level array: hi-to-lo */
+       int16 ltoh[MAX_CHAN_QUAL_LEVELS];       /* threshold level array: lo-to-hi */
+} wl_chan_qual_metric_t;
+
+typedef struct wl_chan_qual_event {
+       uint32 rate_limit_msec;         /* # of events posted to application will be limited to
+                                        * one per specified period (0 to disable rate limit).
+                                        */
+       uint16 flags;
+       uint16 num_metrics;
+       wl_chan_qual_metric_t metric[WL_CHAN_QUAL_TOTAL];       /* metric array */
+} wl_chan_qual_event_t;
+
+typedef struct wl_action_obss_coex_req {
+       uint8 info;
+       uint8 num;
+       uint8 ch_list[1];
+} wl_action_obss_coex_req_t;
+
+
+/* IOVar parameter block for small MAC address array with type indicator */
+#define WL_IOV_MAC_PARAM_LEN  4
+
+#define WL_IOV_PKTQ_LOG_PRECS 16
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint32 num_addrs;
+       char   addr_type[WL_IOV_MAC_PARAM_LEN];
+       struct ether_addr ea[WL_IOV_MAC_PARAM_LEN];
+} BWL_POST_PACKED_STRUCT wl_iov_mac_params_t;
+
+/* This is extra info that follows wl_iov_mac_params_t */
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint32 addr_info[WL_IOV_MAC_PARAM_LEN];
+} BWL_POST_PACKED_STRUCT wl_iov_mac_extra_params_t;
+
+/* Combined structure */
+typedef struct {
+       wl_iov_mac_params_t params;
+       wl_iov_mac_extra_params_t extra_params;
+} wl_iov_mac_full_params_t;
+
+/* Parameter block for PKTQ_LOG statistics */
+#define PKTQ_LOG_COUNTERS_V4 \
+       /* packets requested to be stored */ \
+       uint32 requested; \
+       /* packets stored */ \
+       uint32 stored; \
+       /* packets saved, because a lowest priority queue has given away one packet */ \
+       uint32 saved; \
+       /* packets saved, because an older packet from the same queue has been dropped */ \
+       uint32 selfsaved; \
+       /* packets dropped, because pktq is full with higher precedence packets */ \
+       uint32 full_dropped; \
+        /* packets dropped because pktq per that precedence is full */ \
+       uint32 dropped; \
+       /* packets dropped, in order to save one from a queue of a highest priority */ \
+       uint32 sacrificed; \
+       /* packets droped because of hardware/transmission error */ \
+       uint32 busy; \
+       /* packets re-sent because they were not received */ \
+       uint32 retry; \
+       /* packets retried again (ps pretend) prior to moving power save mode */ \
+       uint32 ps_retry; \
+        /* suppressed packet count */ \
+       uint32 suppress; \
+       /* packets finally dropped after retry limit */ \
+       uint32 retry_drop; \
+       /* the high-water mark of the queue capacity for packets - goes to zero as queue fills */ \
+       uint32 max_avail; \
+       /* the high-water mark of the queue utilisation for packets - ('inverse' of max_avail) */ \
+       uint32 max_used; \
+        /* the maximum capacity of the queue */ \
+       uint32 queue_capacity; \
+       /* count of rts attempts that failed to receive cts */ \
+       uint32 rtsfail; \
+       /* count of packets sent (acked) successfully */ \
+       uint32 acked; \
+       /* running total of phy rate of packets sent successfully */ \
+       uint32 txrate_succ; \
+       /* running total of phy 'main' rate */ \
+       uint32 txrate_main; \
+       /* actual data transferred successfully */ \
+       uint32 throughput; \
+       /* time difference since last pktq_stats */ \
+       uint32 time_delta;
+
+typedef struct {
+       PKTQ_LOG_COUNTERS_V4
+} pktq_log_counters_v04_t;
+
+/* v5 is the same as V4 with extra parameter */
+typedef struct {
+       PKTQ_LOG_COUNTERS_V4
+       /* cumulative time to transmit */
+       uint32 airtime;
+} pktq_log_counters_v05_t;
+
+typedef struct {
+       uint8                num_prec[WL_IOV_MAC_PARAM_LEN];
+       pktq_log_counters_v04_t  counters[WL_IOV_MAC_PARAM_LEN][WL_IOV_PKTQ_LOG_PRECS];
+       uint32               counter_info[WL_IOV_MAC_PARAM_LEN];
+       uint32               pspretend_time_delta[WL_IOV_MAC_PARAM_LEN];
+       char                 headings[1];
+} pktq_log_format_v04_t;
+
+typedef struct {
+       uint8                num_prec[WL_IOV_MAC_PARAM_LEN];
+       pktq_log_counters_v05_t  counters[WL_IOV_MAC_PARAM_LEN][WL_IOV_PKTQ_LOG_PRECS];
+       uint32               counter_info[WL_IOV_MAC_PARAM_LEN];
+       uint32               pspretend_time_delta[WL_IOV_MAC_PARAM_LEN];
+       char                 headings[1];
+} pktq_log_format_v05_t;
+
+
+typedef struct {
+       uint32               version;
+       wl_iov_mac_params_t  params;
+       union {
+               pktq_log_format_v04_t v04;
+               pktq_log_format_v05_t v05;
+       } pktq_log;
+} wl_iov_pktq_log_t;
+
+/* PKTQ_LOG_AUTO, PKTQ_LOG_DEF_PREC flags introduced in v05, they are ignored by v04 */
+#define PKTQ_LOG_AUTO     (1 << 31)
+#define PKTQ_LOG_DEF_PREC (1 << 30)
+
+
+#define LEGACY1_WL_PFN_MACADDR_CFG_VER 0
+
+#define WL_PFN_MAC_OUI_ONLY_MASK      1
+#define WL_PFN_SET_MAC_UNASSOC_MASK   2
+#define WL_PFN_RESTRICT_LA_MAC_MASK   4
+#define WL_PFN_MACADDR_FLAG_MASK     0x7
+
+
+/*
+ * SCB_BS_DATA iovar definitions start.
+ */
+#define SCB_BS_DATA_STRUCT_VERSION     1
+
+/* The actual counters maintained for each station */
+typedef BWL_PRE_PACKED_STRUCT struct {
+       /* The following counters are a subset of what pktq_stats provides per precedence. */
+       uint32 retry;          /* packets re-sent because they were not received */
+       uint32 retry_drop;     /* packets finally dropped after retry limit */
+       uint32 rtsfail;        /* count of rts attempts that failed to receive cts */
+       uint32 acked;          /* count of packets sent (acked) successfully */
+       uint32 txrate_succ;    /* running total of phy rate of packets sent successfully */
+       uint32 txrate_main;    /* running total of phy 'main' rate */
+       uint32 throughput;     /* actual data transferred successfully */
+       uint32 time_delta;     /* time difference since last pktq_stats */
+       uint32 airtime;        /* cumulative total medium access delay in useconds */
+} BWL_POST_PACKED_STRUCT iov_bs_data_counters_t;
+
+/* The structure for individual station information. */
+typedef BWL_PRE_PACKED_STRUCT struct {
+       struct ether_addr       station_address;        /* The station MAC address */
+       uint16                  station_flags;          /* Bit mask of flags, for future use. */
+       iov_bs_data_counters_t  station_counters;       /* The actual counter values */
+} BWL_POST_PACKED_STRUCT iov_bs_data_record_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint16  structure_version;      /* Structure version number (for wl/wlu matching) */
+       uint16  structure_count;        /* Number of iov_bs_data_record_t records following */
+       iov_bs_data_record_t    structure_record[1];    /* 0 - structure_count records */
+} BWL_POST_PACKED_STRUCT iov_bs_data_struct_t;
+
+/* Bitmask of options that can be passed in to the iovar. */
+enum {
+       SCB_BS_DATA_FLAG_NO_RESET = (1<<0)      /* Do not clear the counters after reading */
+};
+/*
+ * SCB_BS_DATA iovar definitions end.
+ */
+
+typedef struct wlc_extlog_cfg {
+       int max_number;
+       uint16 module;  /* bitmap */
+       uint8 level;
+       uint8 flag;
+       uint16 version;
+} wlc_extlog_cfg_t;
+
+typedef struct log_record {
+       uint32 time;
+       uint16 module;
+       uint16 id;
+       uint8 level;
+       uint8 sub_unit;
+       uint8 seq_num;
+       int32 arg;
+       char str[MAX_ARGSTR_LEN];
+} log_record_t;
+
+typedef struct wlc_extlog_req {
+       uint32 from_last;
+       uint32 num;
+} wlc_extlog_req_t;
+
+typedef struct wlc_extlog_results {
+       uint16 version;
+       uint16 record_len;
+       uint32 num;
+       log_record_t logs[1];
+} wlc_extlog_results_t;
+
+typedef struct log_idstr {
+       uint16  id;
+       uint16  flag;
+       uint8   arg_type;
+       const char      *fmt_str;
+} log_idstr_t;
+
+#define FMTSTRF_USER           1
+
+/* flat ID definitions
+ * New definitions HAVE TO BE ADDED at the end of the table. Otherwise, it will
+ * affect backward compatibility with pre-existing apps
+ */
+typedef enum {
+       FMTSTR_DRIVER_UP_ID = 0,
+       FMTSTR_DRIVER_DOWN_ID = 1,
+       FMTSTR_SUSPEND_MAC_FAIL_ID = 2,
+       FMTSTR_NO_PROGRESS_ID = 3,
+       FMTSTR_RFDISABLE_ID = 4,
+       FMTSTR_REG_PRINT_ID = 5,
+       FMTSTR_EXPTIME_ID = 6,
+       FMTSTR_JOIN_START_ID = 7,
+       FMTSTR_JOIN_COMPLETE_ID = 8,
+       FMTSTR_NO_NETWORKS_ID = 9,
+       FMTSTR_SECURITY_MISMATCH_ID = 10,
+       FMTSTR_RATE_MISMATCH_ID = 11,
+       FMTSTR_AP_PRUNED_ID = 12,
+       FMTSTR_KEY_INSERTED_ID = 13,
+       FMTSTR_DEAUTH_ID = 14,
+       FMTSTR_DISASSOC_ID = 15,
+       FMTSTR_LINK_UP_ID = 16,
+       FMTSTR_LINK_DOWN_ID = 17,
+       FMTSTR_RADIO_HW_OFF_ID = 18,
+       FMTSTR_RADIO_HW_ON_ID = 19,
+       FMTSTR_EVENT_DESC_ID = 20,
+       FMTSTR_PNP_SET_POWER_ID = 21,
+       FMTSTR_RADIO_SW_OFF_ID = 22,
+       FMTSTR_RADIO_SW_ON_ID = 23,
+       FMTSTR_PWD_MISMATCH_ID = 24,
+       FMTSTR_FATAL_ERROR_ID = 25,
+       FMTSTR_AUTH_FAIL_ID = 26,
+       FMTSTR_ASSOC_FAIL_ID = 27,
+       FMTSTR_IBSS_FAIL_ID = 28,
+       FMTSTR_EXTAP_FAIL_ID = 29,
+       FMTSTR_MAX_ID
+} log_fmtstr_id_t;
+
+#ifdef DONGLEOVERLAYS
+typedef struct {
+       uint32 flags_idx;       /* lower 8 bits: overlay index; upper 24 bits: flags */
+       uint32 offset;          /* offset into overlay region to write code */
+       uint32 len;                     /* overlay code len */
+       /* overlay code follows this struct */
+} wl_ioctl_overlay_t;
+#endif /* DONGLEOVERLAYS */
+
+/* 11k Neighbor Report element (unversioned, deprecated) */
+typedef struct nbr_element {
+       uint8 id;
+       uint8 len;
+       struct ether_addr bssid;
+       uint32 bssid_info;
+       uint8 reg;
+       uint8 channel;
+       uint8 phytype;
+       uint8 pad;
+} nbr_element_t;
+
+#define WL_RRM_NBR_RPT_VER             1
+/* 11k Neighbor Report element */
+typedef struct nbr_rpt_elem {
+       uint8 version;
+       uint8 id;
+       uint8 len;
+       uint8 pad;
+       struct ether_addr bssid;
+       uint8 pad_1[2];
+       uint32 bssid_info;
+       uint8 reg;
+       uint8 channel;
+       uint8 phytype;
+       uint8 pad_2;
+       wlc_ssid_t ssid;
+       uint8 bss_trans_preference;
+       uint8 pad_3[3];
+} nbr_rpt_elem_t;
+
+typedef enum event_msgs_ext_command {
+       EVENTMSGS_NONE          =       0,
+       EVENTMSGS_SET_BIT       =       1,
+       EVENTMSGS_RESET_BIT     =       2,
+       EVENTMSGS_SET_MASK      =       3
+} event_msgs_ext_command_t;
+
+#define EVENTMSGS_VER 1
+#define EVENTMSGS_EXT_STRUCT_SIZE      OFFSETOF(eventmsgs_ext_t, mask[0])
+
+/* len-        for SET it would be mask size from the application to the firmware */
+/*             for GET it would be actual firmware mask size */
+/* maxgetsize -        is only used for GET. indicate max mask size that the */
+/*                             application can read from the firmware */
+typedef struct eventmsgs_ext
+{
+       uint8   ver;
+       uint8   command;
+       uint8   len;
+       uint8   maxgetsize;
+       uint8   mask[1];
+} eventmsgs_ext_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct pcie_bus_tput_params {
+       /* no of host dma descriptors programmed by the firmware before a commit */
+       uint16          max_dma_descriptors;
+
+       uint16          host_buf_len; /* length of host buffer */
+       dmaaddr_t       host_buf_addr; /* physical address for bus_throughput_buf */
+} BWL_POST_PACKED_STRUCT pcie_bus_tput_params_t;
+typedef BWL_PRE_PACKED_STRUCT struct pcie_bus_tput_stats {
+       uint16          time_taken; /* no of secs the test is run */
+       uint16          nbytes_per_descriptor; /* no of bytes of data dma ed per descriptor */
+
+       /* no of desciptors fo which dma is sucessfully completed within the test time */
+       uint32          count;
+} BWL_POST_PACKED_STRUCT pcie_bus_tput_stats_t;
+
+#define MAX_ROAMOFFL_BSSID_NUM 100
+
+typedef BWL_PRE_PACKED_STRUCT struct roamoffl_bssid_list {
+       int32 cnt;
+       struct ether_addr bssid[1];
+} BWL_POST_PACKED_STRUCT roamoffl_bssid_list_t;
+
+/* no default structure packing */
+#include <packed_section_end.h>
+
+typedef struct keepalives_max_idle {
+       uint16  keepalive_count;        /* nmbr of keepalives per bss_max_idle period */
+       uint8   mkeepalive_index;       /* mkeepalive_index for keepalive frame to be used */
+       uint8   PAD;                    /* to align next field */
+       uint16  max_interval;           /* seconds */
+} keepalives_max_idle_t;
+
+#define PM_IGNORE_BCMC_PROXY_ARP (1 << 0)
+#define PM_IGNORE_BCMC_ALL_DMS_ACCEPTED (1 << 1)
+
+/* require strict packing */
+#include <packed_section_start.h>
+
+/* ##### Power Stats section ##### */
+
+#define WL_PWRSTATS_VERSION    2
+
+/* Input structure for pwrstats IOVAR */
+typedef BWL_PRE_PACKED_STRUCT struct wl_pwrstats_query {
+       uint16 length;          /* Number of entries in type array. */
+       uint16 type[1];         /* Types (tags) to retrieve.
+                                * Length 0 (no types) means get all.
+                                */
+} BWL_POST_PACKED_STRUCT wl_pwrstats_query_t;
+
+/* This structure is for version 2; version 1 will be deprecated in by FW */
+typedef BWL_PRE_PACKED_STRUCT struct wl_pwrstats {
+       uint16 version;               /* Version = 2 is TLV format */
+       uint16 length;                /* Length of entire structure */
+       uint8 data[1];                /* TLV data, a series of structures,
+                                      * each starting with type and length.
+                                      *
+                                      * Padded as necessary so each section
+                                      * starts on a 4-byte boundary.
+                                      *
+                                      * Both type and len are uint16, but the
+                                      * upper nibble of length is reserved so
+                                      * valid len values are 0-4095.
+                                      */
+} BWL_POST_PACKED_STRUCT wl_pwrstats_t;
+#define WL_PWR_STATS_HDRLEN    OFFSETOF(wl_pwrstats_t, data)
+
+/* Type values for the data section */
+#define WL_PWRSTATS_TYPE_PHY           0 /* struct wl_pwr_phy_stats */
+#define WL_PWRSTATS_TYPE_SCAN          1 /* struct wl_pwr_scan_stats */
+#define WL_PWRSTATS_TYPE_USB_HSIC      2 /* struct wl_pwr_usb_hsic_stats */
+#define WL_PWRSTATS_TYPE_PM_AWAKE1     3 /* struct wl_pwr_pm_awake_stats_v1 */
+#define WL_PWRSTATS_TYPE_CONNECTION    4 /* struct wl_pwr_connect_stats; assoc and key-exch time */
+#define WL_PWRSTATS_TYPE_PCIE          6 /* struct wl_pwr_pcie_stats */
+#define WL_PWRSTATS_TYPE_PM_AWAKE2     7 /* struct wl_pwr_pm_awake_stats_v2 */
+
+/* Bits for wake reasons */
+#define WLC_PMD_WAKE_SET               0x1
+#define WLC_PMD_PM_AWAKE_BCN           0x2
+#define WLC_PMD_BTA_ACTIVE             0x4
+#define WLC_PMD_SCAN_IN_PROGRESS       0x8
+#define WLC_PMD_RM_IN_PROGRESS         0x10
+#define WLC_PMD_AS_IN_PROGRESS         0x20
+#define WLC_PMD_PM_PEND                        0x40
+#define WLC_PMD_PS_POLL                        0x80
+#define WLC_PMD_CHK_UNALIGN_TBTT       0x100
+#define WLC_PMD_APSD_STA_UP            0x200
+#define WLC_PMD_TX_PEND_WAR            0x400
+#define WLC_PMD_GPTIMER_STAY_AWAKE     0x800
+#define WLC_PMD_PM2_RADIO_SOFF_PEND    0x2000
+#define WLC_PMD_NON_PRIM_STA_UP                0x4000
+#define WLC_PMD_AP_UP                  0x8000
+
+typedef BWL_PRE_PACKED_STRUCT struct wlc_pm_debug {
+       uint32 timestamp;            /* timestamp in millisecond */
+       uint32 reason;               /* reason(s) for staying awake */
+} BWL_POST_PACKED_STRUCT wlc_pm_debug_t;
+
+/* WL_PWRSTATS_TYPE_PM_AWAKE1 structures (for 6.25 firmware) */
+#define WLC_STA_AWAKE_STATES_MAX_V1    30
+#define WLC_PMD_EVENT_MAX_V1           32
+/* Data sent as part of pwrstats IOVAR (and EXCESS_PM_WAKE event) */
+typedef BWL_PRE_PACKED_STRUCT struct pm_awake_data_v1 {
+       uint32 curr_time;       /* ms */
+       uint32 hw_macc;         /* HW maccontrol */
+       uint32 sw_macc;         /* SW maccontrol */
+       uint32 pm_dur;          /* Total sleep time in PM, msecs */
+       uint32 mpc_dur;         /* Total sleep time in MPC, msecs */
+
+       /* int32 drifts = remote - local; +ve drift => local-clk slow */
+       int32 last_drift;       /* Most recent TSF drift from beacon */
+       int32 min_drift;        /* Min TSF drift from beacon in magnitude */
+       int32 max_drift;        /* Max TSF drift from beacon in magnitude */
+
+       uint32 avg_drift;       /* Avg TSF drift from beacon */
+
+       /* Wake history tracking */
+       uint8  pmwake_idx;                                 /* for stepping through pm_state */
+       wlc_pm_debug_t pm_state[WLC_STA_AWAKE_STATES_MAX_V1]; /* timestamped wake bits */
+       uint32 pmd_event_wake_dur[WLC_PMD_EVENT_MAX_V1];      /* cumulative usecs per wake reason */
+       uint32 drift_cnt;       /* Count of drift readings over which avg_drift was computed */
+} BWL_POST_PACKED_STRUCT pm_awake_data_v1_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_pwr_pm_awake_stats_v1 {
+       uint16 type;         /* WL_PWRSTATS_TYPE_PM_AWAKE */
+       uint16 len;          /* Up to 4K-1, top 4 bits are reserved */
+
+       pm_awake_data_v1_t awake_data;
+       uint32 frts_time;       /* Cumulative ms spent in frts since driver load */
+       uint32 frts_end_cnt;    /* No of times frts ended since driver load */
+} BWL_POST_PACKED_STRUCT wl_pwr_pm_awake_stats_v1_t;
+
+/* WL_PWRSTATS_TYPE_PM_AWAKE2 structures */
+/* Data sent as part of pwrstats IOVAR */
+typedef BWL_PRE_PACKED_STRUCT struct pm_awake_data_v2 {
+       uint32 curr_time;       /* ms */
+       uint32 hw_macc;         /* HW maccontrol */
+       uint32 sw_macc;         /* SW maccontrol */
+       uint32 pm_dur;          /* Total sleep time in PM, msecs */
+       uint32 mpc_dur;         /* Total sleep time in MPC, msecs */
+
+       /* int32 drifts = remote - local; +ve drift => local-clk slow */
+       int32 last_drift;       /* Most recent TSF drift from beacon */
+       int32 min_drift;        /* Min TSF drift from beacon in magnitude */
+       int32 max_drift;        /* Max TSF drift from beacon in magnitude */
+
+       uint32 avg_drift;       /* Avg TSF drift from beacon */
+
+       /* Wake history tracking */
+
+       /* pmstate array (type wlc_pm_debug_t) start offset */
+       uint16 pm_state_offset;
+       /* pmstate number of array entries */
+       uint16 pm_state_len;
+
+       /* array (type uint32) start offset */
+       uint16 pmd_event_wake_dur_offset;
+       /* pmd_event_wake_dur number of array entries */
+       uint16 pmd_event_wake_dur_len;
+
+       uint32 drift_cnt;       /* Count of drift readings over which avg_drift was computed */
+       uint8  pmwake_idx;      /* for stepping through pm_state */
+       uint8  pad[3];
+       uint32 frts_time;       /* Cumulative ms spent in frts since driver load */
+       uint32 frts_end_cnt;    /* No of times frts ended since driver load */
+} BWL_POST_PACKED_STRUCT pm_awake_data_v2_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_pwr_pm_awake_stats_v2 {
+       uint16 type;         /* WL_PWRSTATS_TYPE_PM_AWAKE */
+       uint16 len;          /* Up to 4K-1, top 4 bits are reserved */
+
+       pm_awake_data_v2_t awake_data;
+} BWL_POST_PACKED_STRUCT wl_pwr_pm_awake_stats_v2_t;
+
+/* Original bus structure is for HSIC */
+typedef BWL_PRE_PACKED_STRUCT struct bus_metrics {
+       uint32 suspend_ct;      /* suspend count */
+       uint32 resume_ct;       /* resume count */
+       uint32 disconnect_ct;   /* disconnect count */
+       uint32 reconnect_ct;    /* reconnect count */
+       uint32 active_dur;      /* msecs in bus, usecs for user */
+       uint32 suspend_dur;     /* msecs in bus, usecs for user */
+       uint32 disconnect_dur;  /* msecs in bus, usecs for user */
+} BWL_POST_PACKED_STRUCT bus_metrics_t;
+
+/* Bus interface info for USB/HSIC */
+typedef BWL_PRE_PACKED_STRUCT struct wl_pwr_usb_hsic_stats {
+       uint16 type;         /* WL_PWRSTATS_TYPE_USB_HSIC */
+       uint16 len;          /* Up to 4K-1, top 4 bits are reserved */
+
+       bus_metrics_t hsic;     /* stats from hsic bus driver */
+} BWL_POST_PACKED_STRUCT wl_pwr_usb_hsic_stats_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct pcie_bus_metrics {
+       uint32 d3_suspend_ct;   /* suspend count */
+       uint32 d0_resume_ct;    /* resume count */
+       uint32 perst_assrt_ct;  /* PERST# assert count */
+       uint32 perst_deassrt_ct;        /* PERST# de-assert count */
+       uint32 active_dur;      /* msecs */
+       uint32 d3_suspend_dur;  /* msecs */
+       uint32 perst_dur;       /* msecs */
+       uint32 l0_cnt;          /* L0 entry count */
+       uint32 l0_usecs;        /* L0 duration in usecs */
+       uint32 l1_cnt;          /* L1 entry count */
+       uint32 l1_usecs;        /* L1 duration in usecs */
+       uint32 l1_1_cnt;        /* L1_1ss entry count */
+       uint32 l1_1_usecs;      /* L1_1ss duration in usecs */
+       uint32 l1_2_cnt;        /* L1_2ss entry count */
+       uint32 l1_2_usecs;      /* L1_2ss duration in usecs */
+       uint32 l2_cnt;          /* L2 entry count */
+       uint32 l2_usecs;        /* L2 duration in usecs */
+       uint32 timestamp;       /* Timestamp on when stats are collected */
+       uint32 num_h2d_doorbell;        /* # of doorbell interrupts - h2d */
+       uint32 num_d2h_doorbell;        /* # of doorbell interrupts - d2h */
+       uint32 num_submissions; /* # of submissions */
+       uint32 num_completions; /* # of completions */
+       uint32 num_rxcmplt;     /* # of rx completions */
+       uint32 num_rxcmplt_drbl;        /* of drbl interrupts for rx complt. */
+       uint32 num_txstatus;    /* # of tx completions */
+       uint32 num_txstatus_drbl;       /* of drbl interrupts for tx complt. */
+       uint32 ltr_active_ct;   /* # of times chip went to LTR ACTIVE */
+       uint32 ltr_active_dur;  /* # of msecs chip was in LTR ACTIVE */
+       uint32 ltr_sleep_ct;    /* # of times chip went to LTR SLEEP */
+       uint32 ltr_sleep_dur;   /* # of msecs chip was in LTR SLEEP */
+       uint32 deepsleep_count; /* # of times chip went to deepsleep */
+       uint32 deepsleep_dur;   /* # of msecs chip was in deepsleep */
+} BWL_POST_PACKED_STRUCT pcie_bus_metrics_t;
+
+/* Bus interface info for PCIE */
+typedef BWL_PRE_PACKED_STRUCT struct wl_pwr_pcie_stats {
+       uint16 type;         /* WL_PWRSTATS_TYPE_PCIE */
+       uint16 len;          /* Up to 4K-1, top 4 bits are reserved */
+       pcie_bus_metrics_t pcie;        /* stats from pcie bus driver */
+} BWL_POST_PACKED_STRUCT wl_pwr_pcie_stats_t;
+
+/* Scan information history per category */
+typedef BWL_PRE_PACKED_STRUCT struct scan_data {
+       uint32 count;           /* Number of scans performed */
+       uint32 dur;             /* Total time (in us) used */
+} BWL_POST_PACKED_STRUCT scan_data_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_pwr_scan_stats {
+       uint16 type;         /* WL_PWRSTATS_TYPE_SCAN */
+       uint16 len;          /* Up to 4K-1, top 4 bits are reserved */
+
+       /* Scan history */
+       scan_data_t user_scans;   /* User-requested scans: (i/e/p)scan */
+       scan_data_t assoc_scans;  /* Scans initiated by association requests */
+       scan_data_t roam_scans;   /* Scans initiated by the roam engine */
+       scan_data_t pno_scans[8]; /* For future PNO bucketing (BSSID, SSID, etc) */
+       scan_data_t other_scans;  /* Scan engine usage not assigned to the above */
+} BWL_POST_PACKED_STRUCT wl_pwr_scan_stats_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_pwr_connect_stats {
+       uint16 type;         /* WL_PWRSTATS_TYPE_SCAN */
+       uint16 len;          /* Up to 4K-1, top 4 bits are reserved */
+
+       /* Connection (Association + Key exchange) data */
+       uint32 count;   /* Number of connections performed */
+       uint32 dur;             /* Total time (in ms) used */
+} BWL_POST_PACKED_STRUCT wl_pwr_connect_stats_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_pwr_phy_stats {
+       uint16 type;        /* WL_PWRSTATS_TYPE_PHY */
+       uint16 len;         /* Up to 4K-1, top 4 bits are reserved */
+       uint32 tx_dur;      /* TX Active duration in us */
+       uint32 rx_dur;      /* RX Active duration in us */
+} BWL_POST_PACKED_STRUCT wl_pwr_phy_stats_t;
+
+
+/* ##### End of Power Stats section ##### */
+
+/* IPV4 Arp offloads for ndis context */
+BWL_PRE_PACKED_STRUCT struct hostip_id {
+       struct ipv4_addr ipa;
+       uint8 id;
+} BWL_POST_PACKED_STRUCT;
+
+/* Return values */
+#define ND_REPLY_PEER          0x1     /* Reply was sent to service NS request from peer */
+#define ND_REQ_SINK                    0x2     /* Input packet should be discarded */
+#define ND_FORCE_FORWARD       0X3     /* For the dongle to forward req to HOST */
+
+/* Neighbor Solicitation Response Offload IOVAR param */
+typedef BWL_PRE_PACKED_STRUCT struct nd_param {
+       struct ipv6_addr        host_ip[2];
+       struct ipv6_addr        solicit_ip;
+       struct ipv6_addr        remote_ip;
+       uint8   host_mac[ETHER_ADDR_LEN];
+       uint32  offload_id;
+} BWL_POST_PACKED_STRUCT nd_param_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_pfn_roam_thresh {
+       uint32 pfn_alert_thresh; /* time in ms */
+       uint32 roam_alert_thresh; /* time in ms */
+} BWL_POST_PACKED_STRUCT wl_pfn_roam_thresh_t;
+
+
+/* Reasons for wl_pmalert_t */
+#define PM_DUR_EXCEEDED                        (1<<0)
+#define MPC_DUR_EXCEEDED               (1<<1)
+#define ROAM_ALERT_THRESH_EXCEEDED     (1<<2)
+#define PFN_ALERT_THRESH_EXCEEDED      (1<<3)
+#define CONST_AWAKE_DUR_ALERT          (1<<4)
+#define CONST_AWAKE_DUR_RECOVERY       (1<<5)
+
+#define MIN_PM_ALERT_LEN 9
+
+/* Data sent in EXCESS_PM_WAKE event */
+#define WL_PM_ALERT_VERSION 3
+
+#define MAX_P2P_BSS_DTIM_PRD 4
+
+/* This structure is for version 3; version 2 will be deprecated in by FW */
+typedef BWL_PRE_PACKED_STRUCT struct wl_pmalert {
+       uint16 version;         /* Version = 3 is TLV format */
+       uint16 length;          /* Length of entire structure */
+       uint32 reasons;         /* reason(s) for pm_alert */
+       uint8 data[1];          /* TLV data, a series of structures,
+                                * each starting with type and length.
+                                *
+                                * Padded as necessary so each section
+                                * starts on a 4-byte boundary.
+                                *
+                                * Both type and len are uint16, but the
+                                * upper nibble of length is reserved so
+                                * valid len values are 0-4095.
+                               */
+} BWL_POST_PACKED_STRUCT wl_pmalert_t;
+
+/* Type values for the data section */
+#define WL_PMALERT_FIXED       0 /* struct wl_pmalert_fixed_t, fixed fields */
+#define WL_PMALERT_PMSTATE     1 /* struct wl_pmalert_pmstate_t, variable */
+#define WL_PMALERT_EVENT_DUR   2 /* struct wl_pmalert_event_dur_t, variable */
+#define WL_PMALERT_UCODE_DBG   3 /* struct wl_pmalert_ucode_dbg_t, variable */
+#define WL_PMALERT_PS_ALLOWED_HIST     4 /* struct wl_pmalert_ps_allowed_history, variable */
+#define WL_PMALERT_EXT_UCODE_DBG       5 /* struct wl_pmalert_ext_ucode_dbg_t, variable */
+#define WL_PMALERT_EPM_START_EVENT_DUR 6 /* struct wl_pmalert_event_dur_t, variable */
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_pmalert_fixed {
+       uint16 type;         /* WL_PMALERT_FIXED */
+       uint16 len;          /* Up to 4K-1, top 4 bits are reserved */
+       uint32 prev_stats_time; /* msecs */
+       uint32 curr_time;       /* ms */
+       uint32 prev_pm_dur;     /* msecs */
+       uint32 pm_dur;          /* Total sleep time in PM, msecs */
+       uint32 prev_mpc_dur;    /* msecs */
+       uint32 mpc_dur;         /* Total sleep time in MPC, msecs */
+       uint32 hw_macc;         /* HW maccontrol */
+       uint32 sw_macc;         /* SW maccontrol */
+
+       /* int32 drifts = remote - local; +ve drift -> local-clk slow */
+       int32 last_drift;       /* Most recent TSF drift from beacon */
+       int32 min_drift;        /* Min TSF drift from beacon in magnitude */
+       int32 max_drift;        /* Max TSF drift from beacon in magnitude */
+
+       uint32 avg_drift;       /* Avg TSF drift from beacon */
+       uint32 drift_cnt;       /* Count of drift readings over which avg_drift was computed */
+       uint32 frts_time;       /* Cumulative ms spent in data frts since driver load */
+       uint32 frts_end_cnt;    /* No of times frts ended since driver load */
+       uint32 prev_frts_dur;   /* Data frts duration at start of pm-period */
+       uint32 cal_dur;         /* Cumulative ms spent in calibration */
+       uint32 prev_cal_dur;    /* cal duration at start of pm-period */
+} BWL_POST_PACKED_STRUCT wl_pmalert_fixed_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_pmalert_pmstate {
+       uint16 type;         /* WL_PMALERT_PMSTATE */
+       uint16 len;          /* Up to 4K-1, top 4 bits are reserved */
+
+       uint8 pmwake_idx;   /* for stepping through pm_state */
+       uint8 pad[3];
+       /* Array of pmstate; len of array is based on tlv len */
+       wlc_pm_debug_t pmstate[1];
+} BWL_POST_PACKED_STRUCT wl_pmalert_pmstate_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_pmalert_event_dur {
+       uint16 type;         /* WL_PMALERT_EVENT_DUR */
+       uint16 len;          /* Up to 4K-1, top 4 bits are reserved */
+
+       /* Array of event_dur, len of array is based on tlv len */
+       uint32 event_dur[1];
+} BWL_POST_PACKED_STRUCT wl_pmalert_event_dur_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_pmalert_ucode_dbg {
+       uint16 type;         /* WL_PMALERT_UCODE_DBG */
+       uint16 len;          /* Up to 4K-1, top 4 bits are reserved */
+       uint32 macctrl;
+       uint16 m_p2p_hps;
+       uint32 psm_brc;
+       uint32 ifsstat;
+       uint16 m_p2p_bss_dtim_prd[MAX_P2P_BSS_DTIM_PRD];
+       uint32 psmdebug[20];
+       uint32 phydebug[20];
+} BWL_POST_PACKED_STRUCT wl_pmalert_ucode_dbg_t;
+
+
+/* Structures and constants used for "vndr_ie" IOVar interface */
+#define VNDR_IE_CMD_LEN                4       /* length of the set command string:
+                                        * "add", "del" (+ NUL)
+                                        */
+
+#define VNDR_IE_INFO_HDR_LEN   (sizeof(uint32))
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint32 pktflag;                 /* bitmask indicating which packet(s) contain this IE */
+       vndr_ie_t vndr_ie_data;         /* vendor IE data */
+} BWL_POST_PACKED_STRUCT vndr_ie_info_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+       int iecount;                    /* number of entries in the vndr_ie_list[] array */
+       vndr_ie_info_t vndr_ie_list[1]; /* variable size list of vndr_ie_info_t structs */
+} BWL_POST_PACKED_STRUCT vndr_ie_buf_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+       char cmd[VNDR_IE_CMD_LEN];      /* vndr_ie IOVar set command : "add", "del" + NUL */
+       vndr_ie_buf_t vndr_ie_buffer;   /* buffer containing Vendor IE list information */
+} BWL_POST_PACKED_STRUCT vndr_ie_setbuf_t;
+
+/* tag_ID/length/value_buffer tuple */
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint8   id;
+       uint8   len;
+       uint8   data[1];
+} BWL_POST_PACKED_STRUCT tlv_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint32 pktflag;                 /* bitmask indicating which packet(s) contain this IE */
+       tlv_t ie_data;          /* IE data */
+} BWL_POST_PACKED_STRUCT ie_info_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+       int iecount;                    /* number of entries in the ie_list[] array */
+       ie_info_t ie_list[1];   /* variable size list of ie_info_t structs */
+} BWL_POST_PACKED_STRUCT ie_buf_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+       char cmd[VNDR_IE_CMD_LEN];      /* ie IOVar set command : "add" + NUL */
+       ie_buf_t ie_buffer;     /* buffer containing IE list information */
+} BWL_POST_PACKED_STRUCT ie_setbuf_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint32 pktflag;         /* bitmask indicating which packet(s) contain this IE */
+       uint8 id;               /* IE type */
+} BWL_POST_PACKED_STRUCT ie_getbuf_t;
+
+/* structures used to define format of wps ie data from probe requests */
+/* passed up to applications via iovar "prbreq_wpsie" */
+typedef BWL_PRE_PACKED_STRUCT struct sta_prbreq_wps_ie_hdr {
+       struct ether_addr staAddr;
+       uint16 ieLen;
+} BWL_POST_PACKED_STRUCT sta_prbreq_wps_ie_hdr_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct sta_prbreq_wps_ie_data {
+       sta_prbreq_wps_ie_hdr_t hdr;
+       uint8 ieData[1];
+} BWL_POST_PACKED_STRUCT sta_prbreq_wps_ie_data_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct sta_prbreq_wps_ie_list {
+       uint32 totLen;
+       uint8 ieDataList[1];
+} BWL_POST_PACKED_STRUCT sta_prbreq_wps_ie_list_t;
+
+
+#ifdef WLMEDIA_TXFAILEVENT
+typedef BWL_PRE_PACKED_STRUCT struct {
+       char   dest[ETHER_ADDR_LEN]; /* destination MAC */
+       uint8  prio;            /* Packet Priority */
+       uint8  flags;           /* Flags           */
+       uint32 tsf_l;           /* TSF timer low   */
+       uint32 tsf_h;           /* TSF timer high  */
+       uint16 rates;           /* Main Rates      */
+       uint16 txstatus;        /* TX Status       */
+} BWL_POST_PACKED_STRUCT txfailinfo_t;
+#endif /* WLMEDIA_TXFAILEVENT */
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint32 flags;
+       chanspec_t chanspec;                    /* txpwr report for this channel */
+       chanspec_t local_chanspec;              /* channel on which we are associated */
+       uint8 local_max;                        /* local max according to the AP */
+       uint8 local_constraint;                 /* local constraint according to the AP */
+       int8  antgain[2];                       /* Ant gain for each band - from SROM */
+       uint8 rf_cores;                         /* count of RF Cores being reported */
+       uint8 est_Pout[4];                      /* Latest tx power out estimate per RF chain */
+       uint8 est_Pout_act[4]; /* Latest tx power out estimate per RF chain w/o adjustment */
+       uint8 est_Pout_cck;                     /* Latest CCK tx power out estimate */
+       uint8 tx_power_max[4];          /* Maximum target power among all rates */
+       uint tx_power_max_rate_ind[4];          /* Index of the rate with the max target power */
+       int8 sar;                                       /* SAR limit for display by wl executable */
+       int8 channel_bandwidth;         /* 20, 40 or 80 MHz bandwidth? */
+       uint8 version;                          /* Version of the data format wlu <--> driver */
+       uint8 display_core;                     /* Displayed curpower core */
+       int8 target_offsets[4];         /* Target power offsets for current rate per core */
+       uint32 last_tx_ratespec;        /* Ratespec for last transmition */
+       uint   user_target;             /* user limit */
+       uint32 ppr_len;         /* length of each ppr serialization buffer */
+       int8 SARLIMIT[MAX_STREAMS_SUPPORTED];
+       uint8  pprdata[1];              /* ppr serialization buffer */
+} BWL_POST_PACKED_STRUCT tx_pwr_rpt_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+       struct ipv4_addr        ipv4_addr;
+       struct ether_addr nexthop;
+} BWL_POST_PACKED_STRUCT ibss_route_entry_t;
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint32 num_entry;
+       ibss_route_entry_t route_entry[1];
+} BWL_POST_PACKED_STRUCT ibss_route_tbl_t;
+
+#define MAX_IBSS_ROUTE_TBL_ENTRY       64
+
+#define TXPWR_TARGET_VERSION  0
+typedef BWL_PRE_PACKED_STRUCT struct {
+       int32 version;          /* version number */
+       chanspec_t chanspec;    /* txpwr report for this channel */
+       int8 txpwr[WL_STA_ANT_MAX]; /* Max tx target power, in qdb */
+       uint8 rf_cores;         /* count of RF Cores being reported */
+} BWL_POST_PACKED_STRUCT txpwr_target_max_t;
+
+#define BSS_PEER_INFO_PARAM_CUR_VER    0
+/* Input structure for IOV_BSS_PEER_INFO */
+typedef BWL_PRE_PACKED_STRUCT  struct {
+       uint16                  version;
+       struct  ether_addr ea;  /* peer MAC address */
+} BWL_POST_PACKED_STRUCT bss_peer_info_param_t;
+
+#define BSS_PEER_INFO_CUR_VER          0
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint16                  version;
+       struct ether_addr       ea;
+       int32                   rssi;
+       uint32                  tx_rate;        /* current tx rate */
+       uint32                  rx_rate;        /* current rx rate */
+       wl_rateset_t            rateset;        /* rateset in use */
+       uint32                  age;            /* age in seconds */
+} BWL_POST_PACKED_STRUCT bss_peer_info_t;
+
+#define BSS_PEER_LIST_INFO_CUR_VER     0
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint16                  version;
+       uint16                  bss_peer_info_len;      /* length of bss_peer_info_t */
+       uint32                  count;                  /* number of peer info */
+       bss_peer_info_t         peer_info[1];           /* peer info */
+} BWL_POST_PACKED_STRUCT bss_peer_list_info_t;
+
+#define BSS_PEER_LIST_INFO_FIXED_LEN OFFSETOF(bss_peer_list_info_t, peer_info)
+
+#define AIBSS_BCN_FORCE_CONFIG_VER_0   0
+
+/* structure used to configure AIBSS beacon force xmit */
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint16  version;
+       uint16  len;
+       uint32 initial_min_bcn_dur;     /* dur in ms to check a bcn in bcn_flood period */
+       uint32 min_bcn_dur;     /* dur in ms to check a bcn after bcn_flood period */
+       uint32 bcn_flood_dur; /* Initial bcn xmit period in ms */
+} BWL_POST_PACKED_STRUCT aibss_bcn_force_config_t;
+
+#define AIBSS_TXFAIL_CONFIG_VER_0    0
+#define AIBSS_TXFAIL_CONFIG_VER_1    1
+#define AIBSS_TXFAIL_CONFIG_CUR_VER            AIBSS_TXFAIL_CONFIG_VER_1
+
+/* structure used to configure aibss tx fail event */
+typedef BWL_PRE_PACKED_STRUCT struct {
+       uint16  version;
+       uint16  len;
+       uint32 bcn_timeout;     /* dur in seconds to receive 1 bcn */
+       uint32 max_tx_retry;     /* no of consecutive no acks to send txfail event */
+       uint32 max_atim_failure; /* no of consecutive atim failure */
+} BWL_POST_PACKED_STRUCT aibss_txfail_config_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_aibss_if {
+       uint16 version;
+       uint16 len;
+       uint32 flags;
+       struct ether_addr addr;
+       chanspec_t chspec;
+} BWL_POST_PACKED_STRUCT wl_aibss_if_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wlc_ipfo_route_entry {
+       struct ipv4_addr ip_addr;
+       struct ether_addr nexthop;
+} BWL_POST_PACKED_STRUCT wlc_ipfo_route_entry_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wlc_ipfo_route_tbl {
+       uint32 num_entry;
+       wlc_ipfo_route_entry_t route_entry[1];
+} BWL_POST_PACKED_STRUCT wlc_ipfo_route_tbl_t;
+
+#define WL_IPFO_ROUTE_TBL_FIXED_LEN 4
+#define WL_MAX_IPFO_ROUTE_TBL_ENTRY    64
+
+/* no strict structure packing */
+#include <packed_section_end.h>
+
+       /* Global ASSERT Logging */
+#define ASSERTLOG_CUR_VER      0x0100
+#define MAX_ASSRTSTR_LEN       64
+
+       typedef struct assert_record {
+               uint32 time;
+               uint8 seq_num;
+               char str[MAX_ASSRTSTR_LEN];
+       } assert_record_t;
+
+       typedef struct assertlog_results {
+               uint16 version;
+               uint16 record_len;
+               uint32 num;
+               assert_record_t logs[1];
+       } assertlog_results_t;
+
+#define LOGRRC_FIX_LEN 8
+#define IOBUF_ALLOWED_NUM_OF_LOGREC(type, len) ((len - LOGRRC_FIX_LEN)/sizeof(type))
+
+#ifdef BCMWAPI_WAI
+#define IV_LEN 16
+       struct wapi_sta_msg_t
+       {
+               uint16  msg_type;
+               uint16  datalen;
+               uint8   vap_mac[6];
+               uint8   reserve_data1[2];
+               uint8   sta_mac[6];
+               uint8   reserve_data2[2];
+               uint8   gsn[IV_LEN];
+               uint8   wie[256];
+       };
+#endif /* BCMWAPI_WAI */
+
+       /* chanim acs record */
+       typedef struct {
+               bool valid;
+               uint8 trigger;
+               chanspec_t selected_chspc;
+               int8 bgnoise;
+               uint32 glitch_cnt;
+               uint8 ccastats;
+               uint8 chan_idle;
+               uint timestamp;
+       } chanim_acs_record_t;
+
+       typedef struct {
+               chanim_acs_record_t acs_record[CHANIM_ACS_RECORD];
+               uint8 count;
+               uint timestamp;
+       } wl_acs_record_t;
+
+       typedef struct chanim_stats {
+               uint32 glitchcnt;               /* normalized as per second count */
+               uint32 badplcp;                 /* normalized as per second count */
+               uint8 ccastats[CCASTATS_MAX];   /* normalized as 0-255 */
+               int8 bgnoise;                   /* background noise level (in dBm) */
+               chanspec_t chanspec;            /* ctrl chanspec of the interface */
+               uint32 timestamp;               /* time stamp at which the stats are collected */
+               uint32 bphy_glitchcnt;          /* normalized as per second count */
+               uint32 bphy_badplcp;            /* normalized as per second count */
+               uint8 chan_idle;                /* normalized as 0~255 */
+       } chanim_stats_t;
+
+#define WL_CHANIM_STATS_VERSION 2
+
+typedef struct {
+       uint32 buflen;
+       uint32 version;
+       uint32 count;
+       chanim_stats_t stats[1];
+} wl_chanim_stats_t;
+
+#define WL_CHANIM_STATS_FIXED_LEN OFFSETOF(wl_chanim_stats_t, stats)
+
+/* Noise measurement metrics. */
+#define NOISE_MEASURE_KNOISE   0x1
+
+/* scb probe parameter */
+typedef struct {
+       uint32 scb_timeout;
+       uint32 scb_activity_time;
+       uint32 scb_max_probe;
+} wl_scb_probe_t;
+
+/* structure/defines for selective mgmt frame (smf) stats support */
+
+#define SMFS_VERSION 1
+/* selected mgmt frame (smf) stats element */
+typedef struct wl_smfs_elem {
+       uint32 count;
+       uint16 code;  /* SC or RC code */
+} wl_smfs_elem_t;
+
+typedef struct wl_smf_stats {
+       uint32 version;
+       uint16 length;  /* reserved for future usage */
+       uint8 type;
+       uint8 codetype;
+       uint32 ignored_cnt;
+       uint32 malformed_cnt;
+       uint32 count_total; /* count included the interested group */
+       wl_smfs_elem_t elem[1];
+} wl_smf_stats_t;
+
+#define WL_SMFSTATS_FIXED_LEN OFFSETOF(wl_smf_stats_t, elem);
+
+enum {
+       SMFS_CODETYPE_SC,
+       SMFS_CODETYPE_RC
+};
+
+typedef enum smfs_type {
+       SMFS_TYPE_AUTH,
+       SMFS_TYPE_ASSOC,
+       SMFS_TYPE_REASSOC,
+       SMFS_TYPE_DISASSOC_TX,
+       SMFS_TYPE_DISASSOC_RX,
+       SMFS_TYPE_DEAUTH_TX,
+       SMFS_TYPE_DEAUTH_RX,
+       SMFS_TYPE_MAX
+} smfs_type_t;
+
+#ifdef PHYMON
+
+#define PHYMON_VERSION 1
+
+typedef struct wl_phycal_core_state {
+       /* Tx IQ/LO calibration coeffs */
+       int16 tx_iqlocal_a;
+       int16 tx_iqlocal_b;
+       int8 tx_iqlocal_ci;
+       int8 tx_iqlocal_cq;
+       int8 tx_iqlocal_di;
+       int8 tx_iqlocal_dq;
+       int8 tx_iqlocal_ei;
+       int8 tx_iqlocal_eq;
+       int8 tx_iqlocal_fi;
+       int8 tx_iqlocal_fq;
+
+       /* Rx IQ calibration coeffs */
+       int16 rx_iqcal_a;
+       int16 rx_iqcal_b;
+
+       uint8 tx_iqlocal_pwridx; /* Tx Power Index for Tx IQ/LO calibration */
+       uint32 papd_epsilon_table[64]; /* PAPD epsilon table */
+       int16 papd_epsilon_offset; /* PAPD epsilon offset */
+       uint8 curr_tx_pwrindex; /* Tx power index */
+       int8 idle_tssi; /* Idle TSSI */
+       int8 est_tx_pwr; /* Estimated Tx Power (dB) */
+       int8 est_rx_pwr; /* Estimated Rx Power (dB) from RSSI */
+       uint16 rx_gaininfo; /* Rx gain applied on last Rx pkt */
+       uint16 init_gaincode; /* initgain required for ACI */
+       int8 estirr_tx;
+       int8 estirr_rx;
+
+} wl_phycal_core_state_t;
+
+typedef struct wl_phycal_state {
+       int version;
+       int8 num_phy_cores; /* number of cores */
+       int8 curr_temperature; /* on-chip temperature sensor reading */
+       chanspec_t chspec; /* channspec for this state */
+       bool aci_state; /* ACI state: ON/OFF */
+       uint16 crsminpower; /* crsminpower required for ACI */
+       uint16 crsminpowerl; /* crsminpowerl required for ACI */
+       uint16 crsminpoweru; /* crsminpoweru required for ACI */
+       wl_phycal_core_state_t phycal_core[1];
+} wl_phycal_state_t;
+
+#define WL_PHYCAL_STAT_FIXED_LEN OFFSETOF(wl_phycal_state_t, phycal_core)
+#endif /* PHYMON */
+
+/* discovery state */
+typedef struct wl_p2p_disc_st {
+       uint8 state;    /* see state */
+       chanspec_t chspec;      /* valid in listen state */
+       uint16 dwell;   /* valid in listen state, in ms */
+} wl_p2p_disc_st_t;
+
+/* scan request */
+typedef struct wl_p2p_scan {
+       uint8 type;             /* 'S' for WLC_SCAN, 'E' for "escan" */
+       uint8 reserved[3];
+       /* scan or escan parms... */
+} wl_p2p_scan_t;
+
+/* i/f request */
+typedef struct wl_p2p_if {
+       struct ether_addr addr;
+       uint8 type;     /* see i/f type */
+       chanspec_t chspec;      /* for p2p_ifadd GO */
+} wl_p2p_if_t;
+
+/* i/f query */
+typedef struct wl_p2p_ifq {
+       uint bsscfgidx;
+       char ifname[BCM_MSG_IFNAME_MAX];
+} wl_p2p_ifq_t;
+
+/* OppPS & CTWindow */
+typedef struct wl_p2p_ops {
+       uint8 ops;      /* 0: disable 1: enable */
+       uint8 ctw;      /* >= 10 */
+} wl_p2p_ops_t;
+
+/* absence and presence request */
+typedef struct wl_p2p_sched_desc {
+       uint32 start;
+       uint32 interval;
+       uint32 duration;
+       uint32 count;   /* see count */
+} wl_p2p_sched_desc_t;
+
+typedef struct wl_p2p_sched {
+       uint8 type;     /* see schedule type */
+       uint8 action;   /* see schedule action */
+       uint8 option;   /* see schedule option */
+       wl_p2p_sched_desc_t desc[1];
+} wl_p2p_sched_t;
+
+typedef struct wl_p2p_wfds_hash {
+       uint32  advt_id;
+       uint16  nw_cfg_method;
+       uint8   wfds_hash[6];
+       uint8   name_len;
+       uint8   service_name[MAX_WFDS_SVC_NAME_LEN];
+} wl_p2p_wfds_hash_t;
+
+typedef struct wl_bcmdcs_data {
+       uint reason;
+       chanspec_t chspec;
+} wl_bcmdcs_data_t;
+
+
+/* NAT configuration */
+typedef struct {
+       uint32 ipaddr;          /* interface ip address */
+       uint32 ipaddr_mask;     /* interface ip address mask */
+       uint32 ipaddr_gateway;  /* gateway ip address */
+       uint8 mac_gateway[6];   /* gateway mac address */
+       uint32 ipaddr_dns;      /* DNS server ip address, valid only for public if */
+       uint8 mac_dns[6];       /* DNS server mac address,  valid only for public if */
+       uint8 GUID[38];         /* interface GUID */
+} nat_if_info_t;
+
+typedef struct {
+       uint op;                /* operation code */
+       bool pub_if;            /* set for public if, clear for private if */
+       nat_if_info_t if_info;  /* interface info */
+} nat_cfg_t;
+
+typedef struct {
+       int state;      /* NAT state returned */
+} nat_state_t;
+
+
+#define BTA_STATE_LOG_SZ       64
+
+/* BTAMP Statemachine states */
+enum {
+       HCIReset = 1,
+       HCIReadLocalAMPInfo,
+       HCIReadLocalAMPASSOC,
+       HCIWriteRemoteAMPASSOC,
+       HCICreatePhysicalLink,
+       HCIAcceptPhysicalLinkRequest,
+       HCIDisconnectPhysicalLink,
+       HCICreateLogicalLink,
+       HCIAcceptLogicalLink,
+       HCIDisconnectLogicalLink,
+       HCILogicalLinkCancel,
+       HCIAmpStateChange,
+       HCIWriteLogicalLinkAcceptTimeout
+};
+
+typedef struct flush_txfifo {
+       uint32 txfifobmp;
+       uint32 hwtxfifoflush;
+       struct ether_addr ea;
+} flush_txfifo_t;
+
+enum {
+       SPATIAL_MODE_2G_IDX = 0,
+       SPATIAL_MODE_5G_LOW_IDX,
+       SPATIAL_MODE_5G_MID_IDX,
+       SPATIAL_MODE_5G_HIGH_IDX,
+       SPATIAL_MODE_5G_UPPER_IDX,
+       SPATIAL_MODE_MAX_IDX
+};
+
+#define WLC_TXCORE_MAX 4       /* max number of txcore supports */
+#define WLC_SUBBAND_MAX        4       /* max number of sub-band supports */
+typedef struct {
+       uint8   band2g[WLC_TXCORE_MAX];
+       uint8   band5g[WLC_SUBBAND_MAX][WLC_TXCORE_MAX];
+} sar_limit_t;
+
+#define WLC_TXCAL_CORE_MAX 2   /* max number of txcore supports for txcal */
+#define MAX_NUM_TXCAL_MEAS 128
+#define MAX_NUM_PWR_STEP 40
+#define TXCAL_ROUNDING_FIX 1
+typedef struct wl_txcal_meas {
+#ifdef TXCAL_ROUNDING_FIX
+       uint16 tssi[WLC_TXCAL_CORE_MAX][MAX_NUM_TXCAL_MEAS];
+#else
+       uint8 tssi[WLC_TXCAL_CORE_MAX][MAX_NUM_TXCAL_MEAS];
+#endif /* TXCAL_ROUNDING_FIX */
+       int16 pwr[WLC_TXCAL_CORE_MAX][MAX_NUM_TXCAL_MEAS];
+       uint8 valid_cnt;
+} wl_txcal_meas_t;
+
+typedef struct wl_txcal_power_tssi {
+       uint8 set_core;
+       uint8 channel;
+       int16 tempsense[WLC_TXCAL_CORE_MAX];
+       int16 pwr_start[WLC_TXCAL_CORE_MAX];
+       uint8 pwr_start_idx[WLC_TXCAL_CORE_MAX];
+       uint8 num_entries[WLC_TXCAL_CORE_MAX];
+       uint8 tssi[WLC_TXCAL_CORE_MAX][MAX_NUM_PWR_STEP];
+       bool gen_tbl;
+} wl_txcal_power_tssi_t;
+
+/* IOVAR "mempool" parameter. Used to retrieve a list of memory pool statistics. */
+typedef struct wl_mempool_stats {
+       int     num;            /* Number of memory pools */
+       bcm_mp_stats_t s[1];    /* Variable array of memory pool stats. */
+} wl_mempool_stats_t;
+
+typedef struct {
+       uint32 ipaddr;
+       uint32 ipaddr_netmask;
+       uint32 ipaddr_gateway;
+} nwoe_ifconfig_t;
+
+/* Traffic management priority classes */
+typedef enum trf_mgmt_priority_class {
+       trf_mgmt_priority_low           = 0,        /* Maps to 802.1p BK */
+       trf_mgmt_priority_medium        = 1,        /* Maps to 802.1p BE */
+       trf_mgmt_priority_high          = 2,        /* Maps to 802.1p VI */
+       trf_mgmt_priority_nochange      = 3,        /* do not update the priority */
+       trf_mgmt_priority_invalid       = (trf_mgmt_priority_nochange + 1)
+} trf_mgmt_priority_class_t;
+
+/* Traffic management configuration parameters */
+typedef struct trf_mgmt_config {
+       uint32  trf_mgmt_enabled;                           /* 0 - disabled, 1 - enabled */
+       uint32  flags;                                      /* See TRF_MGMT_FLAG_xxx defines */
+       uint32  host_ip_addr;                               /* My IP address to determine subnet */
+       uint32  host_subnet_mask;                           /* My subnet mask */
+       uint32  downlink_bandwidth;                         /* In units of kbps */
+       uint32  uplink_bandwidth;                           /* In units of kbps */
+       uint32  min_tx_bandwidth[TRF_MGMT_MAX_PRIORITIES];  /* Minimum guaranteed tx bandwidth */
+       uint32  min_rx_bandwidth[TRF_MGMT_MAX_PRIORITIES];  /* Minimum guaranteed rx bandwidth */
+} trf_mgmt_config_t;
+
+/* Traffic management filter */
+typedef struct trf_mgmt_filter {
+       struct ether_addr           dst_ether_addr;         /* His L2 address */
+       uint32                      dst_ip_addr;            /* His IP address */
+       uint16                      dst_port;               /* His L4 port */
+       uint16                      src_port;               /* My L4 port */
+       uint16                      prot;                   /* L4 protocol (only TCP or UDP) */
+       uint16                      flags;                  /* TBD. For now, this must be zero. */
+       trf_mgmt_priority_class_t   priority;               /* Priority for filtered packets */
+       uint32                      dscp;                   /* DSCP */
+} trf_mgmt_filter_t;
+
+/* Traffic management filter list (variable length) */
+typedef struct trf_mgmt_filter_list     {
+       uint32              num_filters;
+       trf_mgmt_filter_t   filter[1];
+} trf_mgmt_filter_list_t;
+
+/* Traffic management global info used for all queues */
+typedef struct trf_mgmt_global_info {
+       uint32  maximum_bytes_per_second;
+       uint32  maximum_bytes_per_sampling_period;
+       uint32  total_bytes_consumed_per_second;
+       uint32  total_bytes_consumed_per_sampling_period;
+       uint32  total_unused_bytes_per_sampling_period;
+} trf_mgmt_global_info_t;
+
+/* Traffic management shaping info per priority queue */
+typedef struct trf_mgmt_shaping_info {
+       uint32  gauranteed_bandwidth_percentage;
+       uint32  guaranteed_bytes_per_second;
+       uint32  guaranteed_bytes_per_sampling_period;
+       uint32  num_bytes_produced_per_second;
+       uint32  num_bytes_consumed_per_second;
+       uint32  num_queued_packets;                         /* Number of packets in queue */
+       uint32  num_queued_bytes;                           /* Number of bytes in queue */
+} trf_mgmt_shaping_info_t;
+
+/* Traffic management shaping info array */
+typedef struct trf_mgmt_shaping_info_array {
+       trf_mgmt_global_info_t   tx_global_shaping_info;
+       trf_mgmt_shaping_info_t  tx_queue_shaping_info[TRF_MGMT_MAX_PRIORITIES];
+       trf_mgmt_global_info_t   rx_global_shaping_info;
+       trf_mgmt_shaping_info_t  rx_queue_shaping_info[TRF_MGMT_MAX_PRIORITIES];
+} trf_mgmt_shaping_info_array_t;
+
+
+/* Traffic management statistical counters */
+typedef struct trf_mgmt_stats {
+       uint32  num_processed_packets;      /* Number of packets processed */
+       uint32  num_processed_bytes;        /* Number of bytes processed */
+       uint32  num_discarded_packets;      /* Number of packets discarded from queue */
+} trf_mgmt_stats_t;
+
+/* Traffic management statisics array */
+typedef struct trf_mgmt_stats_array {
+       trf_mgmt_stats_t  tx_queue_stats[TRF_MGMT_MAX_PRIORITIES];
+       trf_mgmt_stats_t  rx_queue_stats[TRF_MGMT_MAX_PRIORITIES];
+} trf_mgmt_stats_array_t;
+
+typedef struct powersel_params {
+       /* LPC Params exposed via IOVAR */
+       int32           tp_ratio_thresh;  /* Throughput ratio threshold */
+       uint8           rate_stab_thresh; /* Thresh for rate stability based on nupd */
+       uint8           pwr_stab_thresh; /* Number of successes before power step down */
+       uint8           pwr_sel_exp_time; /* Time lapse for expiry of database */
+} powersel_params_t;
+
+typedef struct lpc_params {
+       /* LPC Params exposed via IOVAR */
+       uint8           rate_stab_thresh; /* Thresh for rate stability based on nupd */
+       uint8           pwr_stab_thresh; /* Number of successes before power step down */
+       uint8           lpc_exp_time; /* Time lapse for expiry of database */
+       uint8           pwrup_slow_step; /* Step size for slow step up */
+       uint8           pwrup_fast_step; /* Step size for fast step up */
+       uint8           pwrdn_slow_step; /* Step size for slow step down */
+} lpc_params_t;
+
+/* tx pkt delay statistics */
+#define        SCB_RETRY_SHORT_DEF     7       /* Default Short retry Limit */
+#define WLPKTDLY_HIST_NBINS    16      /* number of bins used in the Delay histogram */
+
+/* structure to store per-AC delay statistics */
+typedef struct scb_delay_stats {
+       uint32 txmpdu_lost;     /* number of MPDUs lost */
+       uint32 txmpdu_cnt[SCB_RETRY_SHORT_DEF]; /* retry times histogram */
+       uint32 delay_sum[SCB_RETRY_SHORT_DEF]; /* cumulative packet latency */
+       uint32 delay_min;       /* minimum packet latency observed */
+       uint32 delay_max;       /* maximum packet latency observed */
+       uint32 delay_avg;       /* packet latency average */
+       uint32 delay_hist[WLPKTDLY_HIST_NBINS]; /* delay histogram */
+} scb_delay_stats_t;
+
+/* structure for txdelay event */
+typedef struct txdelay_event {
+       uint8   status;
+       int             rssi;
+       chanim_stats_t          chanim_stats;
+       scb_delay_stats_t       delay_stats[AC_COUNT];
+} txdelay_event_t;
+
+/* structure for txdelay parameters */
+typedef struct txdelay_params {
+       uint16  ratio;  /* Avg Txdelay Delta */
+       uint8   cnt;    /* Sample cnt */
+       uint8   period; /* Sample period */
+       uint8   tune;   /* Debug */
+} txdelay_params_t;
+
+enum {
+       WNM_SERVICE_DMS = 1,
+       WNM_SERVICE_FMS = 2,
+       WNM_SERVICE_TFS = 3
+};
+
+/* Definitions for WNM/NPS TCLAS */
+typedef struct wl_tclas {
+       uint8 user_priority;
+       uint8 fc_len;
+       dot11_tclas_fc_t fc;
+} wl_tclas_t;
+
+#define WL_TCLAS_FIXED_SIZE    OFFSETOF(wl_tclas_t, fc)
+
+typedef struct wl_tclas_list {
+       uint32 num;
+       wl_tclas_t tclas[1];
+} wl_tclas_list_t;
+
+/* Definitions for WNM/NPS Traffic Filter Service */
+typedef struct wl_tfs_req {
+       uint8 tfs_id;
+       uint8 tfs_actcode;
+       uint8 tfs_subelem_id;
+       uint8 send;
+} wl_tfs_req_t;
+
+typedef struct wl_tfs_filter {
+       uint8 status;                   /* Status returned by the AP */
+       uint8 tclas_proc;               /* TCLAS processing value (0:and, 1:or)  */
+       uint8 tclas_cnt;                /* count of all wl_tclas_t in tclas array */
+       uint8 tclas[1];                 /* VLA of wl_tclas_t */
+} wl_tfs_filter_t;
+#define WL_TFS_FILTER_FIXED_SIZE       OFFSETOF(wl_tfs_filter_t, tclas)
+
+typedef struct wl_tfs_fset {
+       struct ether_addr ea;           /* Address of AP/STA involved with this filter set */
+       uint8 tfs_id;                   /* TFS ID field chosen by STA host */
+       uint8 status;                   /* Internal status TFS_STATUS_xxx */
+       uint8 actcode;                  /* Action code DOT11_TFS_ACTCODE_xxx */
+       uint8 token;                    /* Token used in last request frame */
+       uint8 notify;                   /* Notify frame sent/received because of this set */
+       uint8 filter_cnt;               /* count of all wl_tfs_filter_t in filter array */
+       uint8 filter[1];                /* VLA of wl_tfs_filter_t */
+} wl_tfs_fset_t;
+#define WL_TFS_FSET_FIXED_SIZE         OFFSETOF(wl_tfs_fset_t, filter)
+
+enum {
+       TFS_STATUS_DISABLED = 0,        /* TFS filter set disabled by user */
+       TFS_STATUS_DISABLING = 1,       /* Empty request just sent to AP */
+       TFS_STATUS_VALIDATED = 2,       /* Filter set validated by AP (but maybe not enabled!) */
+       TFS_STATUS_VALIDATING = 3,      /* Filter set just sent to AP */
+       TFS_STATUS_NOT_ASSOC = 4,       /* STA not associated */
+       TFS_STATUS_NOT_SUPPORT = 5,     /* TFS not supported by AP */
+       TFS_STATUS_DENIED = 6,          /* Filter set refused by AP (=> all sets are disabled!) */
+};
+
+typedef struct wl_tfs_status {
+       uint8 fset_cnt;                 /* count of all wl_tfs_fset_t in fset array */
+       wl_tfs_fset_t fset[1];          /* VLA of wl_tfs_fset_t */
+} wl_tfs_status_t;
+
+typedef struct wl_tfs_set {
+       uint8 send;                     /* Immediatly register registered sets on AP side */
+       uint8 tfs_id;                   /* ID of a specific set (existing or new), or nul for all */
+       uint8 actcode;                  /* Action code for this filter set */
+       uint8 tclas_proc;               /* TCLAS processing operator for this filter set */
+} wl_tfs_set_t;
+
+typedef struct wl_tfs_term {
+       uint8 del;                      /* Delete internal set once confirmation received */
+       uint8 tfs_id;                   /* ID of a specific set (existing), or nul for all */
+} wl_tfs_term_t;
+
+
+#define DMS_DEP_PROXY_ARP (1 << 0)
+
+/* Definitions for WNM/NPS Directed Multicast Service */
+enum {
+       DMS_STATUS_DISABLED = 0,        /* DMS desc disabled by user */
+       DMS_STATUS_ACCEPTED = 1,        /* Request accepted by AP */
+       DMS_STATUS_NOT_ASSOC = 2,       /* STA not associated */
+       DMS_STATUS_NOT_SUPPORT = 3,     /* DMS not supported by AP */
+       DMS_STATUS_DENIED = 4,          /* Request denied by AP */
+       DMS_STATUS_TERM = 5,            /* Request terminated by AP */
+       DMS_STATUS_REMOVING = 6,        /* Remove request just sent */
+       DMS_STATUS_ADDING = 7,          /* Add request just sent */
+       DMS_STATUS_ERROR = 8,           /* Non compliant AP behvior */
+       DMS_STATUS_IN_PROGRESS = 9, /* Request just sent */
+       DMS_STATUS_REQ_MISMATCH = 10 /* Conditions for sending DMS req not met */
+};
+
+typedef struct wl_dms_desc {
+       uint8 user_id;
+       uint8 status;
+       uint8 token;
+       uint8 dms_id;
+       uint8 tclas_proc;
+       uint8 mac_len;          /* length of all ether_addr in data array, 0 if STA */
+       uint8 tclas_len;        /* length of all wl_tclas_t in data array */
+       uint8 data[1];          /* VLA of 'ether_addr' and 'wl_tclas_t' (in this order ) */
+} wl_dms_desc_t;
+
+#define WL_DMS_DESC_FIXED_SIZE OFFSETOF(wl_dms_desc_t, data)
+
+typedef struct wl_dms_status {
+       uint32 cnt;
+       wl_dms_desc_t desc[1];
+} wl_dms_status_t;
+
+typedef struct wl_dms_set {
+       uint8 send;
+       uint8 user_id;
+       uint8 tclas_proc;
+} wl_dms_set_t;
+
+typedef struct wl_dms_term {
+       uint8 del;
+       uint8 user_id;
+} wl_dms_term_t;
+
+typedef struct wl_service_term {
+       uint8 service;
+       union {
+               wl_dms_term_t dms;
+       } u;
+} wl_service_term_t;
+
+/* Definitions for WNM/NPS BSS Transistion */
+typedef struct wl_bsstrans_req {
+       uint16 tbtt;                    /* time of BSS to end of life, in unit of TBTT */
+       uint16 dur;                     /* time of BSS to keep off, in unit of minute */
+       uint8 reqmode;                  /* request mode of BSS transition request */
+       uint8 unicast;                  /* request by unicast or by broadcast */
+} wl_bsstrans_req_t;
+
+enum {
+       BSSTRANS_RESP_AUTO = 0,         /* Currently equivalent to ENABLE */
+       BSSTRANS_RESP_DISABLE = 1,      /* Never answer BSS Trans Req frames */
+       BSSTRANS_RESP_ENABLE = 2,       /* Always answer Req frames with preset data */
+       BSSTRANS_RESP_WAIT = 3,         /* Send ind, wait and/or send preset data (NOT IMPL) */
+       BSSTRANS_RESP_IMMEDIATE = 4     /* After an ind, set data and send resp (NOT IMPL) */
+};
+
+typedef struct wl_bsstrans_resp {
+       uint8 policy;
+       uint8 status;
+       uint8 delay;
+       struct ether_addr target;
+} wl_bsstrans_resp_t;
+
+/* "wnm_bsstrans_policy" argument programs behavior after BSSTRANS Req reception.
+ * BSS-Transition feature is used by multiple programs such as NPS-PF, VE-PF,
+ * Band-steering, Hotspot 2.0 and customer requirements. Each PF and its test plan
+ * mandates different behavior on receiving BSS-transition request. To accomodate
+ * such divergent behaviors these policies have been created.
+ */
+enum {
+       WL_BSSTRANS_POLICY_ROAM_ALWAYS = 0,     /* Roam (or disassociate) in all cases */
+       WL_BSSTRANS_POLICY_ROAM_IF_MODE = 1,    /* Roam only if requested by Request Mode field */
+       WL_BSSTRANS_POLICY_ROAM_IF_PREF = 2,    /* Roam only if Preferred BSS provided */
+       WL_BSSTRANS_POLICY_WAIT = 3,            /* Wait for deauth and send Accepted status */
+       WL_BSSTRANS_POLICY_PRODUCT = 4,         /* Policy for real product use cases (non-pf) */
+};
+
+/* Definitions for WNM/NPS TIM Broadcast */
+typedef struct wl_timbc_offset {
+       int16 offset;           /* offset in us */
+       uint16 fix_intv;        /* override interval sent from STA */
+       uint16 rate_override;   /* use rate override to send high rate TIM broadcast frame */
+       uint8 tsf_present;      /* show timestamp in TIM broadcast frame */
+} wl_timbc_offset_t;
+
+typedef struct wl_timbc_set {
+       uint8 interval;         /* Interval in DTIM wished or required. */
+       uint8 flags;            /* Bitfield described below */
+       uint16 rate_min;        /* Minimum rate required for High/Low TIM frames. Optionnal */
+       uint16 rate_max;        /* Maximum rate required for High/Low TIM frames. Optionnal */
+} wl_timbc_set_t;
+
+enum {
+       WL_TIMBC_SET_TSF_REQUIRED = 1,  /* Enable TIMBC only if TSF in TIM frames */
+       WL_TIMBC_SET_NO_OVERRIDE = 2,   /* ... if AP does not override interval */
+       WL_TIMBC_SET_PROXY_ARP = 4,     /* ... if AP support Proxy ARP */
+       WL_TIMBC_SET_DMS_ACCEPTED = 8   /* ... if all DMS desc have been accepted */
+};
+
+typedef struct wl_timbc_status {
+       uint8 status_sta;               /* Status from internal state machine (check below) */
+       uint8 status_ap;                /* From AP response frame (check 8.4.2.86 from 802.11) */
+       uint8 interval;
+       uint8 pad;
+       int32 offset;
+       uint16 rate_high;
+       uint16 rate_low;
+} wl_timbc_status_t;
+
+enum {
+       WL_TIMBC_STATUS_DISABLE = 0,            /* TIMBC disabled by user */
+       WL_TIMBC_STATUS_REQ_MISMATCH = 1,       /* AP settings do no match user requirements */
+       WL_TIMBC_STATUS_NOT_ASSOC = 2,          /* STA not associated */
+       WL_TIMBC_STATUS_NOT_SUPPORT = 3,        /* TIMBC not supported by AP */
+       WL_TIMBC_STATUS_DENIED = 4,             /* Req to disable TIMBC sent to AP */
+       WL_TIMBC_STATUS_ENABLE = 5              /* TIMBC enabled */
+};
+
+/* Definitions for PM2 Dynamic Fast Return To Sleep */
+typedef struct wl_pm2_sleep_ret_ext {
+       uint8 logic;                    /* DFRTS logic: see WL_DFRTS_LOGIC_* below */
+       uint16 low_ms;                  /* Low FRTS timeout */
+       uint16 high_ms;                 /* High FRTS timeout */
+       uint16 rx_pkts_threshold;       /* switching threshold: # rx pkts */
+       uint16 tx_pkts_threshold;       /* switching threshold: # tx pkts */
+       uint16 txrx_pkts_threshold;     /* switching threshold: # (tx+rx) pkts */
+       uint32 rx_bytes_threshold;      /* switching threshold: # rx bytes */
+       uint32 tx_bytes_threshold;      /* switching threshold: # tx bytes */
+       uint32 txrx_bytes_threshold;    /* switching threshold: # (tx+rx) bytes */
+} wl_pm2_sleep_ret_ext_t;
+
+#define WL_DFRTS_LOGIC_OFF     0       /* Feature is disabled */
+#define WL_DFRTS_LOGIC_OR      1       /* OR all non-zero threshold conditions */
+#define WL_DFRTS_LOGIC_AND     2       /* AND all non-zero threshold conditions */
+
+/* Values for the passive_on_restricted_mode iovar.  When set to non-zero, this iovar
+ * disables automatic conversions of a channel from passively scanned to
+ * actively scanned.  These values only have an effect for country codes such
+ * as XZ where some 5 GHz channels are defined to be passively scanned.
+ */
+#define WL_PASSACTCONV_DISABLE_NONE    0       /* Enable permanent and temporary conversions */
+#define WL_PASSACTCONV_DISABLE_ALL     1       /* Disable permanent and temporary conversions */
+#define WL_PASSACTCONV_DISABLE_PERM    2       /* Disable only permanent conversions */
+
+/* Definitions for Reliable Multicast */
+#define WL_RMC_CNT_VERSION        1
+#define WL_RMC_TR_VERSION         1
+#define WL_RMC_MAX_CLIENT         32
+#define WL_RMC_FLAG_INBLACKLIST           1
+#define WL_RMC_FLAG_ACTIVEACKER           2
+#define WL_RMC_FLAG_RELMCAST      4
+#define WL_RMC_MAX_TABLE_ENTRY     4
+
+#define WL_RMC_VER                1
+#define WL_RMC_INDEX_ACK_ALL       255
+#define WL_RMC_NUM_OF_MC_STREAMS   4
+#define WL_RMC_MAX_TRS_PER_GROUP   1
+#define WL_RMC_MAX_TRS_IN_ACKALL   1
+#define WL_RMC_ACK_MCAST0          0x02
+#define WL_RMC_ACK_MCAST_ALL       0x01
+#define WL_RMC_ACTF_TIME_MIN       300  /* time in ms */
+#define WL_RMC_ACTF_TIME_MAX       20000 /* time in ms */
+#define WL_RMC_MAX_NUM_TRS        32    /* maximun transmitters allowed */
+#define WL_RMC_ARTMO_MIN           350  /* time in ms */
+#define WL_RMC_ARTMO_MAX           40000        /* time in ms */
+
+/* RMC events in action frames */
+enum rmc_opcodes {
+       RELMCAST_ENTRY_OP_DISABLE = 0,   /* Disable multi-cast group */
+       RELMCAST_ENTRY_OP_DELETE  = 1,   /* Delete multi-cast group */
+       RELMCAST_ENTRY_OP_ENABLE  = 2,   /* Enable multi-cast group */
+       RELMCAST_ENTRY_OP_ACK_ALL = 3    /* Enable ACK ALL bit in AMT */
+};
+
+/* RMC operational modes */
+enum rmc_modes {
+       WL_RMC_MODE_RECEIVER    = 0,     /* Receiver mode by default */
+       WL_RMC_MODE_TRANSMITTER = 1,     /* Transmitter mode using wl ackreq */
+       WL_RMC_MODE_INITIATOR   = 2      /* Initiator mode using wl ackreq */
+};
+
+/* Each RMC mcast client info */
+typedef struct wl_relmcast_client {
+       uint8 flag;                     /* status of client such as AR, R, or blacklisted */
+       int16 rssi;                     /* rssi value of RMC client */
+       struct ether_addr addr;         /* mac address of RMC client */
+} wl_relmcast_client_t;
+
+/* RMC Counters */
+typedef struct wl_rmc_cnts {
+       uint16  version;                /* see definition of WL_CNT_T_VERSION */
+       uint16  length;                 /* length of entire structure */
+       uint16  dupcnt;                 /* counter for duplicate rmc MPDU */
+       uint16  ackreq_err;             /* counter for wl ackreq error    */
+       uint16  af_tx_err;              /* error count for action frame transmit   */
+       uint16  null_tx_err;            /* error count for rmc null frame transmit */
+       uint16  af_unicast_tx_err;      /* error count for rmc unicast frame transmit */
+       uint16  mc_no_amt_slot;         /* No mcast AMT entry available */
+       /* Unused. Keep for rom compatibility */
+       uint16  mc_no_glb_slot;         /* No mcast entry available in global table */
+       uint16  mc_not_mirrored;        /* mcast group is not mirrored */
+       uint16  mc_existing_tr;         /* mcast group is already taken by transmitter */
+       uint16  mc_exist_in_amt;        /* mcast group is already programmed in amt */
+       /* Unused. Keep for rom compatibility */
+       uint16  mc_not_exist_in_gbl;    /* mcast group is not in global table */
+       uint16  mc_not_exist_in_amt;    /* mcast group is not in AMT table */
+       uint16  mc_utilized;            /* mcast addressed is already taken */
+       uint16  mc_taken_other_tr;      /* multi-cast addressed is already taken */
+       uint32  rmc_rx_frames_mac;      /* no of mc frames received from mac */
+       uint32  rmc_tx_frames_mac;      /* no of mc frames transmitted to mac */
+       uint32  mc_null_ar_cnt;         /* no. of times NULL AR is received */
+       uint32  mc_ar_role_selected;    /* no. of times took AR role */
+       uint32  mc_ar_role_deleted;     /* no. of times AR role cancelled */
+       uint32  mc_noacktimer_expired;  /* no. of times noack timer expired */
+       uint16  mc_no_wl_clk;           /* no wl clk detected when trying to access amt */
+       uint16  mc_tr_cnt_exceeded;     /* No of transmitters in the network exceeded */
+} wl_rmc_cnts_t;
+
+/* RMC Status */
+typedef struct wl_relmcast_st {
+       uint8         ver;              /* version of RMC */
+       uint8         num;              /* number of clients detected by transmitter */
+       wl_relmcast_client_t clients[WL_RMC_MAX_CLIENT];
+       uint16        err;              /* error status (used in infra) */
+       uint16        actf_time;        /* action frame time period */
+} wl_relmcast_status_t;
+
+/* Entry for each STA/node */
+typedef struct wl_rmc_entry {
+       /* operation on multi-cast entry such add,
+        * delete, ack-all
+        */
+       int8    flag;
+       struct ether_addr addr;         /* multi-cast group mac address */
+} wl_rmc_entry_t;
+
+/* RMC table */
+typedef struct wl_rmc_entry_table {
+       uint8   index;                  /* index to a particular mac entry in table */
+       uint8   opcode;                 /* opcodes or operation on entry */
+       wl_rmc_entry_t entry[WL_RMC_MAX_TABLE_ENTRY];
+} wl_rmc_entry_table_t;
+
+typedef struct wl_rmc_trans_elem {
+       struct ether_addr tr_mac;       /* transmitter mac */
+       struct ether_addr ar_mac;       /* ar mac */
+       uint16 artmo;                   /* AR timeout */
+       uint8 amt_idx;                  /* amt table entry */
+       uint16 flag;                    /* entry will be acked, not acked, programmed, full etc */
+} wl_rmc_trans_elem_t;
+
+/* RMC transmitters */
+typedef struct wl_rmc_trans_in_network {
+       uint8         ver;              /* version of RMC */
+       uint8         num_tr;           /* number of transmitters in the network */
+       wl_rmc_trans_elem_t trs[WL_RMC_MAX_NUM_TRS];
+} wl_rmc_trans_in_network_t;
+
+/* To update vendor specific ie for RMC */
+typedef struct wl_rmc_vsie {
+       uint8   oui[DOT11_OUI_LEN];
+       uint16  payload;        /* IE Data Payload */
+} wl_rmc_vsie_t;
+
+
+/* structures  & defines for proximity detection  */
+enum proxd_method {
+       PROXD_UNDEFINED_METHOD = 0,
+       PROXD_RSSI_METHOD = 1,
+       PROXD_TOF_METHOD = 2
+};
+
+/* structures for proximity detection device role */
+#define WL_PROXD_MODE_DISABLE  0
+#define WL_PROXD_MODE_NEUTRAL  1
+#define WL_PROXD_MODE_INITIATOR        2
+#define WL_PROXD_MODE_TARGET   3
+
+#define WL_PROXD_ACTION_STOP           0
+#define WL_PROXD_ACTION_START          1
+
+#define WL_PROXD_FLAG_TARGET_REPORT    0x1
+#define WL_PROXD_FLAG_REPORT_FAILURE   0x2
+#define WL_PROXD_FLAG_INITIATOR_REPORT 0x4
+#define WL_PROXD_FLAG_NOCHANSWT                0x8
+#define WL_PROXD_FLAG_NETRUAL          0x10
+#define WL_PROXD_FLAG_INITIATOR_RPTRTT 0x20
+#define WL_PROXD_FLAG_ONEWAY           0x40
+#define WL_PROXD_FLAG_SEQ_EN           0x80
+
+#define WL_PROXD_RANDOM_WAKEUP 0x8000
+#define WL_PROXD_MAXREPORT     8
+
+typedef struct wl_proxd_iovar {
+       uint16  method;         /* Proxmity Detection method */
+       uint16  mode;           /* Mode (neutral, initiator, target) */
+} wl_proxd_iovar_t;
+
+/*
+ * structures for proximity detection parameters
+ * consists of two parts, common and method specific params
+ * common params should be placed at the beginning
+ */
+
+/* require strict packing */
+#include <packed_section_start.h>
+
+typedef        BWL_PRE_PACKED_STRUCT struct    wl_proxd_params_common  {
+       chanspec_t      chanspec;       /* channel spec */
+       int16           tx_power;       /* tx power of Proximity Detection(PD) frames (in dBm) */
+       uint16          tx_rate;        /* tx rate of PD rames  (in 500kbps units) */
+       uint16          timeout;        /* timeout value */
+       uint16          interval;       /* interval between neighbor finding attempts (in TU) */
+       uint16          duration;       /* duration of neighbor finding attempts (in ms) */
+} BWL_POST_PACKED_STRUCT wl_proxd_params_common_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_params_rssi_method {
+       chanspec_t      chanspec;       /* chanspec for home channel */
+       int16           tx_power;       /* tx power of Proximity Detection frames (in dBm) */
+       uint16          tx_rate;        /* tx rate of PD frames, 500kbps units */
+       uint16          timeout;        /* state machine wait timeout of the frames (in ms) */
+       uint16          interval;       /* interval between neighbor finding attempts (in TU) */
+       uint16          duration;       /* duration of neighbor finding attempts (in ms) */
+                                       /* method specific ones go after this line */
+       int16           rssi_thresh;    /* RSSI threshold (in dBm) */
+       uint16          maxconvergtmo;  /* max wait converge timeout (in ms) */
+} wl_proxd_params_rssi_method_t;
+
+#define Q1_NS                  25      /* Q1 time units */
+
+#define TOF_BW_NUM             3       /* number of bandwidth that the TOF can support */
+#define TOF_BW_SEQ_NUM         (TOF_BW_NUM+2)  /* number of total index */
+enum tof_bw_index {
+       TOF_BW_20MHZ_INDEX = 0,
+       TOF_BW_40MHZ_INDEX = 1,
+       TOF_BW_80MHZ_INDEX = 2,
+       TOF_BW_SEQTX_INDEX = 3,
+       TOF_BW_SEQRX_INDEX = 4
+};
+
+#define BANDWIDTH_BASE 20      /* base value of bandwidth */
+#define TOF_BW_20MHZ    (BANDWIDTH_BASE << TOF_BW_20MHZ_INDEX)
+#define TOF_BW_40MHZ    (BANDWIDTH_BASE << TOF_BW_40MHZ_INDEX)
+#define TOF_BW_80MHZ    (BANDWIDTH_BASE << TOF_BW_80MHZ_INDEX)
+#define TOF_BW_10MHZ    10
+
+#define NFFT_BASE              64      /* base size of fft */
+#define TOF_NFFT_20MHZ  (NFFT_BASE << TOF_BW_20MHZ_INDEX)
+#define TOF_NFFT_40MHZ  (NFFT_BASE << TOF_BW_40MHZ_INDEX)
+#define TOF_NFFT_80MHZ  (NFFT_BASE << TOF_BW_80MHZ_INDEX)
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_params_tof_method {
+       chanspec_t      chanspec;       /* chanspec for home channel */
+       int16           tx_power;       /* tx power of Proximity Detection(PD) frames (in dBm) */
+       uint16          tx_rate;        /* tx rate of PD rames  (in 500kbps units) */
+       uint16          timeout;        /* state machine wait timeout of the frames (in ms) */
+       uint16          interval;       /* interval between neighbor finding attempts (in TU) */
+       uint16          duration;       /* duration of neighbor finding attempts (in ms) */
+       /* specific for the method go after this line */
+       struct ether_addr tgt_mac;      /* target mac addr for TOF method */
+       uint16          ftm_cnt;        /* number of the frames txed by initiator */
+       uint16          retry_cnt;      /* number of retransmit attampts for ftm frames */
+       int16           vht_rate;       /* ht or vht rate */
+       /* add more params required for other methods can be added here  */
+} BWL_POST_PACKED_STRUCT wl_proxd_params_tof_method_t;
+
+typedef struct wl_proxd_seq_config
+{
+       int16 N_tx_log2;
+       int16 N_rx_log2;
+       int16 N_tx_scale;
+       int16 N_rx_scale;
+       int16 w_len;
+       int16 w_offset;
+} wl_proxd_seq_config_t;
+
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_params_tof_tune {
+       uint32          Ki;                     /* h/w delay K factor for initiator */
+       uint32          Kt;                     /* h/w delay K factor for target */
+       int16           vhtack;                 /* enable/disable VHT ACK */
+       int16           N_log2[TOF_BW_SEQ_NUM]; /* simple threshold crossing */
+       int16           w_offset[TOF_BW_NUM];   /* offset of threshold crossing window(per BW) */
+       int16           w_len[TOF_BW_NUM];      /* length of threshold crossing window(per BW) */
+       int32           maxDT;                  /* max time difference of T4/T1 or T3/T2 */
+       int32           minDT;                  /* min time difference of T4/T1 or T3/T2 */
+       uint8           totalfrmcnt;    /* total count of transfered measurement frames */
+       uint16          rsv_media;              /* reserve media value for TOF */
+       uint32          flags;                  /* flags */
+       uint8           core;                   /* core to use for tx */
+       uint8           force_K;                /* set to force value of K  */
+       int16           N_scale[TOF_BW_SEQ_NUM]; /* simple threshold crossing */
+       uint8           sw_adj;                 /* enable sw assisted timestamp adjustment */
+       uint8           hw_adj;                 /* enable hw assisted timestamp adjustment */
+       uint8           seq_en;                 /* enable ranging sequence */
+       uint8           ftm_cnt[TOF_BW_SEQ_NUM]; /* number of ftm frames based on bandwidth */
+       int16           N_log2_2g;              /* simple threshold crossing for 2g channel */
+       int16           N_scale_2g;             /* simple threshold crossing for 2g channel */
+       wl_proxd_seq_config_t seq_5g20;
+} BWL_POST_PACKED_STRUCT wl_proxd_params_tof_tune_t;
+
+typedef struct wl_proxd_params_iovar {
+       uint16  method;                 /* Proxmity Detection method */
+       union {
+               /* common params for pdsvc */
+               wl_proxd_params_common_t        cmn_params;     /* common parameters */
+               /*  method specific */
+               wl_proxd_params_rssi_method_t   rssi_params;    /* RSSI method parameters */
+               wl_proxd_params_tof_method_t    tof_params;     /* TOF meothod parameters */
+               /* tune parameters */
+               wl_proxd_params_tof_tune_t      tof_tune;       /* TOF tune parameters */
+       } u;                            /* Method specific optional parameters */
+} wl_proxd_params_iovar_t;
+
+#define PROXD_COLLECT_GET_STATUS       0
+#define PROXD_COLLECT_SET_STATUS       1
+#define PROXD_COLLECT_QUERY_HEADER     2
+#define PROXD_COLLECT_QUERY_DATA       3
+#define PROXD_COLLECT_QUERY_DEBUG      4
+#define PROXD_COLLECT_REMOTE_REQUEST   5
+#define PROXD_COLLECT_DONE                     6
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_collect_query {
+       uint32          method;         /* method */
+       uint8           request;        /* Query request. */
+       uint8           status;         /* 0 -- disable, 1 -- enable collection, */
+                                       /* 2 -- enable collection & debug */
+       uint16          index;          /* The current frame index [0 to total_frames - 1]. */
+       uint16          mode;           /* Initiator or Target */
+       bool            busy;           /* tof sm is busy */
+       bool            remote;         /* Remote collect data */
+} BWL_POST_PACKED_STRUCT wl_proxd_collect_query_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_collect_header {
+       uint16          total_frames;                   /* The totral frames for this collect. */
+       uint16          nfft;                           /* nfft value */
+       uint16          bandwidth;                      /* bandwidth */
+       uint16          channel;                        /* channel number */
+       uint32          chanspec;                       /* channel spec */
+       uint32          fpfactor;                       /* avb timer value factor */
+       uint16          fpfactor_shift;                 /* avb timer value shift bits */
+       int32           distance;                       /* distance calculated by fw */
+       uint32          meanrtt;                        /* mean of RTTs */
+       uint32          modertt;                        /* mode of RTTs */
+       uint32          medianrtt;                      /* median of RTTs */
+       uint32          sdrtt;                          /* standard deviation of RTTs */
+       uint32          clkdivisor;                     /* clock divisor */
+       uint16          chipnum;                        /* chip type */
+       uint8           chiprev;                        /* chip revision */
+       uint8           phyver;                         /* phy version */
+       struct ether_addr       loaclMacAddr;           /* local mac address */
+       struct ether_addr       remoteMacAddr;          /* remote mac address */
+       wl_proxd_params_tof_tune_t params;
+} BWL_POST_PACKED_STRUCT wl_proxd_collect_header_t;
+
+
+#ifdef WL_NAN
+/*  ********************** NAN wl interface struct types and defs ******************** */
+
+#define WL_NAN_IOCTL_VERSION   0x1
+#define NAN_IOC_BUFSZ  256 /**< some sufficient ioc buff size for our module */
+#define NAN_IOC_BUFSZ_EXT  1024 /* some sufficient ioc buff size for dump commands */
+
+/*   wl_nan_sub_cmd may also be used in dhd  */
+typedef struct wl_nan_sub_cmd wl_nan_sub_cmd_t;
+typedef int (cmd_handler_t)(void *wl, const wl_nan_sub_cmd_t *cmd, char **argv);
+/* nan cmd list entry  */
+struct wl_nan_sub_cmd {
+       char *name;
+       uint8  version;         /* cmd  version */
+       uint16 id;                      /* id for the dongle f/w switch/case  */
+       uint16 type;            /* base type of argument */
+       cmd_handler_t *handler; /* cmd handler  */
+};
+
+/* container for nan iovtls & events */
+typedef BWL_PRE_PACKED_STRUCT struct wl_nan_ioc {
+       uint16  version;        /* interface command or event version */
+       uint16  id;                     /* nan ioctl cmd  ID  */
+       uint16  len;            /* total length of all tlv records in data[]  */
+       uint16  pad;            /* pad to be 32 bit aligment */
+       uint8   data [1];       /* var len payload of bcm_xtlv_t type */
+} BWL_POST_PACKED_STRUCT wl_nan_ioc_t;
+
+typedef struct wl_nan_status {
+       uint8 inited;
+       uint8 joined;
+       uint8 role;
+       uint8 hop_count;
+       uint32 chspec;
+       uint8 amr[8];                   /* Anchor Master Rank */
+       uint32 cnt_pend_txfrm;          /* pending TX frames */
+       uint32 cnt_bcn_tx;              /* TX disc/sync beacon count */
+       uint32 cnt_bcn_rx;              /* RX disc/sync beacon count */
+       uint32 cnt_svc_disc_tx;         /* TX svc disc frame count */
+       uint32 cnt_svc_disc_rx;         /* RX svc disc frame count */
+       struct ether_addr cid;
+       uint32 chspec_5g;
+} wl_nan_status_t;
+
+typedef struct wl_nan_count {
+       uint32 cnt_bcn_tx;              /* TX disc/sync beacon count */
+       uint32 cnt_bcn_rx;              /* RX disc/sync beacon count */
+       uint32 cnt_svc_disc_tx;         /* TX svc disc frame count */
+       uint32 cnt_svc_disc_rx;         /* RX svc disc frame count */
+} wl_nan_count_t;
+
+/* various params and ctl swithce for nan_debug instance  */
+typedef struct nan_debug_params {
+       uint8   enabled; /* runtime debuging enabled */
+       uint8   collect; /* enables debug svc sdf monitor mode  */
+       uint16  cmd;    /* debug cmd to perform a debug action */
+       uint32  msglevel; /* msg level if enabled */
+       uint16  status;
+} nan_debug_params_t;
+
+/* time slot */
+#define NAN_MAX_TIMESLOT       32
+typedef struct nan_timeslot {
+       uint32  abitmap; /* available bitmap */
+       uint32 chanlist[NAN_MAX_TIMESLOT];
+} nan_timeslot_t;
+
+/* nan passive scan params */
+#define NAN_SCAN_MAX_CHCNT 8
+typedef struct nan_scan_params {
+       uint16 scan_time;
+       uint16 home_time;
+       uint16 ms_intvl; /* interval between merge scan */
+       uint16 ms_dur;  /* duration of merge scan */
+       uint16 chspec_num;
+       uint8 pad[2];
+       chanspec_t chspec_list[NAN_SCAN_MAX_CHCNT]; /* act. used 3, 5 rfu */
+} nan_scan_params_t;
+
+enum wl_nan_role {
+       WL_NAN_ROLE_AUTO = 0,
+       WL_NAN_ROLE_NON_MASTER_NON_SYNC = 1,
+       WL_NAN_ROLE_NON_MASTER_SYNC = 2,
+       WL_NAN_ROLE_MASTER = 3,
+       WL_NAN_ROLE_ANCHOR_MASTER = 4
+};
+#define NAN_MASTER_RANK_LEN 8
+/* nan cmd IDs */
+enum wl_nan_cmds {
+        /* nan cfg /disc & dbg ioctls */
+       WL_NAN_CMD_ENABLE = 1,
+       WL_NAN_CMD_ATTR = 2,
+       WL_NAN_CMD_NAN_JOIN = 3,
+       WL_NAN_CMD_LEAVE = 4,
+       WL_NAN_CMD_MERGE = 5,
+       WL_NAN_CMD_STATUS = 6,
+       WL_NAN_CMD_TSRESERVE = 7,
+       WL_NAN_CMD_TSSCHEDULE = 8,
+       WL_NAN_CMD_TSRELEASE = 9,
+       WL_NAN_CMD_OUI = 10,
+
+       WL_NAN_CMD_COUNT = 15,
+       WL_NAN_CMD_CLEARCOUNT = 16,
+
+       /*  discovery engine commands */
+       WL_NAN_CMD_PUBLISH = 20,
+       WL_NAN_CMD_SUBSCRIBE = 21,
+       WL_NAN_CMD_CANCEL_PUBLISH = 22,
+       WL_NAN_CMD_CANCEL_SUBSCRIBE = 23,
+       WL_NAN_CMD_TRANSMIT = 24,
+       WL_NAN_CMD_CONNECTION = 25,
+       WL_NAN_CMD_SHOW = 26,
+       WL_NAN_CMD_STOP = 27,   /* stop nan for a given cluster ID  */
+       /*  nan debug iovars & cmds  */
+       WL_NAN_CMD_SCAN_PARAMS = 46,
+       WL_NAN_CMD_SCAN = 47,
+       WL_NAN_CMD_SCAN_RESULTS = 48,
+       WL_NAN_CMD_EVENT_MASK = 49,
+       WL_NAN_CMD_EVENT_CHECK = 50,
+       WL_NAN_CMD_DUMP = 51,
+       WL_NAN_CMD_CLEAR = 52,
+       WL_NAN_CMD_RSSI = 53,
+
+       WL_NAN_CMD_DEBUG = 60,
+       WL_NAN_CMD_TEST1 = 61,
+       WL_NAN_CMD_TEST2 = 62,
+       WL_NAN_CMD_TEST3 = 63,
+       WL_NAN_CMD_DISC_RESULTS = 64
+};
+
+/*
+ * tlv IDs uniquely identifies  cmd parameters
+ * packed into wl_nan_ioc_t container
+ */
+enum wl_nan_cmd_xtlv_id {
+       /* 0x00 ~ 0xFF: standard TLV ID whose data format is the same as NAN attribute TLV */
+       WL_NAN_XTLV_ZERO = 0,           /* used as tlv buf end marker */
+#ifdef NAN_STD_TLV                             /* rfu, don't use yet */
+       WL_NAN_XTLV_MASTER_IND = 1, /* == NAN_ATTR_MASTER_IND, */
+       WL_NAN_XTLV_CLUSTER = 2,        /* == NAN_ATTR_CLUSTER, */
+       WL_NAN_XTLV_VENDOR = 221,       /* == NAN_ATTR_VENDOR, */
+#endif
+       /* 0x02 ~ 0xFF: reserved. In case to use with the same data format as NAN attribute TLV */
+       /* 0x100 ~ : private TLV ID defined just for NAN command */
+       /* common types */
+       WL_NAN_XTLV_MAC_ADDR = 0x102,   /* used in various cmds */
+       WL_NAN_XTLV_REASON = 0x103,
+       WL_NAN_XTLV_ENABLED = 0x104,
+       /* explicit types, primarily for discovery engine iovars  */
+       WL_NAN_XTLV_SVC_PARAMS = 0x120,     /* Contains required params: wl_nan_disc_params_t */
+       WL_NAN_XTLV_MATCH_RX = 0x121,       /* Matching filter to evaluate on receive */
+       WL_NAN_XTLV_MATCH_TX = 0x122,       /* Matching filter to send */
+       WL_NAN_XTLV_SVC_INFO = 0x123,       /* Service specific info */
+       WL_NAN_XTLV_SVC_NAME = 0x124,       /* Optional UTF-8 service name, for debugging. */
+       WL_NAN_XTLV_INSTANCE_ID = 0x125,    /* Identifies unique publish or subscribe instance */
+       WL_NAN_XTLV_PRIORITY = 0x126,       /* used in transmit cmd context */
+       WL_NAN_XTLV_REQUESTOR_ID = 0x127,       /* Requestor instance ID */
+       WL_NAN_XTLV_VNDR = 0x128,               /* Vendor specific attribute */
+       WL_NAN_XTLV_SR_FILTER = 0x129,          /* Service Response Filter */
+       WL_NAN_XTLV_FOLLOWUP = 0x130,   /* Service Info for Follow-Up SDF */
+       WL_NAN_XTLV_PEER_INSTANCE_ID = 0x131, /* Used to parse remote instance Id */
+       /* explicit types, primarily for NAN MAC iovars   */
+       WL_NAN_XTLV_DW_LEN = 0x140,            /* discovery win length */
+       WL_NAN_XTLV_BCN_INTERVAL = 0x141,      /* beacon interval, both sync and descovery bcns?  */
+       WL_NAN_XTLV_CLUSTER_ID = 0x142,
+       WL_NAN_XTLV_IF_ADDR = 0x143,
+       WL_NAN_XTLV_MC_ADDR = 0x144,
+       WL_NAN_XTLV_ROLE = 0x145,
+       WL_NAN_XTLV_START = 0x146,
+
+       WL_NAN_XTLV_MASTER_PREF = 0x147,
+       WL_NAN_XTLV_DW_INTERVAL = 0x148,
+       WL_NAN_XTLV_PTBTT_OVERRIDE = 0x149,
+       /*  nan status command xtlvs  */
+       WL_NAN_XTLV_MAC_INITED = 0x14a,
+       WL_NAN_XTLV_MAC_ENABLED = 0x14b,
+       WL_NAN_XTLV_MAC_CHANSPEC = 0x14c,
+       WL_NAN_XTLV_MAC_AMR = 0x14d,    /* anchormaster rank u8 amr[8] */
+       WL_NAN_XTLV_MAC_HOPCNT = 0x14e,
+       WL_NAN_XTLV_MAC_AMBTT = 0x14f,
+       WL_NAN_XTLV_MAC_TXRATE = 0x150,
+       WL_NAN_XTLV_MAC_STATUS = 0x151,  /* xtlv payload is nan_status_t */
+       WL_NAN_XTLV_NAN_SCANPARAMS = 0x152,  /* payload is nan_scan_params_t */
+       WL_NAN_XTLV_DEBUGPARAMS = 0x153,  /* payload is nan_scan_params_t */
+       WL_NAN_XTLV_SUBSCR_ID = 0x154,   /* subscriber id  */
+       WL_NAN_XTLV_PUBLR_ID = 0x155,   /* publisher id */
+       WL_NAN_XTLV_EVENT_MASK = 0x156,
+       WL_NAN_XTLV_MASTER_RANK = 0x158,
+       WL_NAN_XTLV_WARM_UP_TIME = 0x159,
+       WL_NAN_XTLV_PM_OPTION = 0x15a,
+       WL_NAN_XTLV_OUI = 0x15b,        /* NAN OUI */
+       WL_NAN_XTLV_MAC_COUNT = 0x15c,  /* xtlv payload is nan_count_t */
+       /* nan timeslot management */
+       WL_NAN_XTLV_TSRESERVE = 0x160,
+       WL_NAN_XTLV_TSRELEASE = 0x161,
+       WL_NAN_XTLV_IDLE_DW_TIMEOUT = 0x162,
+       WL_NAN_XTLV_IDLE_DW_LEN = 0x163,
+       WL_NAN_XTLV_RND_FACTOR = 0x164,
+       WL_NAN_XTLV_SVC_DISC_TXTIME = 0x165,     /* svc disc frame tx time in DW */
+       WL_NAN_XTLV_OPERATING_BAND = 0x166,
+       WL_NAN_XTLV_STOP_BCN_TX = 0x167,
+       WL_NAN_XTLV_CONCUR_SCAN = 0x168,
+       WL_NAN_XTLV_DUMP_CLR_TYPE = 0x175, /* wl nan dump/clear subtype */
+       WL_NAN_XTLV_PEER_RSSI = 0x176, /* xtlv payload for wl nan dump rssi */
+       WL_NAN_XTLV_MAC_CHANSPEC_1 = 0x17A,     /* to get chanspec[1] */
+       WL_NAN_XTLV_DISC_RESULTS = 0x17B,        /* get disc results */
+       WL_NAN_XTLV_MAC_STATS = 0x17C /* xtlv payload for wl nan dump stats */
+};
+
+/* Flag bits for Publish and Subscribe (wl_nan_disc_params_t flags) */
+#define WL_NAN_RANGE_LIMITED           0x0040
+/* Bits specific to Publish */
+/* Unsolicited transmissions */
+#define WL_NAN_PUB_UNSOLICIT           0x1000
+/* Solicited transmissions */
+#define WL_NAN_PUB_SOLICIT             0x2000
+#define WL_NAN_PUB_BOTH                0x3000
+/* Set for broadcast solicited transmission
+ * Do not set for unicast solicited transmission
+ */
+#define WL_NAN_PUB_BCAST               0x4000
+/* Generate event on each solicited transmission */
+#define WL_NAN_PUB_EVENT               0x8000
+/* Used for one-time solicited Publish functions to indicate transmision occurred */
+#define WL_NAN_PUB_SOLICIT_PENDING     0x10000
+/* Follow-up frames */
+#define WL_NAN_FOLLOWUP                        0x20000
+/* Bits specific to Subscribe */
+/* Active subscribe mode (Leave unset for passive) */
+#define WL_NAN_SUB_ACTIVE              0x1000
+
+/* Special values for time to live (ttl) parameter */
+#define WL_NAN_TTL_UNTIL_CANCEL        0xFFFFFFFF
+/* Publish -  runs until first transmission
+ * Subscribe - runs until first  DiscoveryResult event
+ */
+#define WL_NAN_TTL_FIRST       0
+
+/* The service hash (service id) is exactly this many bytes. */
+#define WL_NAN_SVC_HASH_LEN    6
+
+/* Number of hash functions per bloom filter */
+#define WL_NAN_HASHES_PER_BLOOM 4
+
+/* Instance ID type (unique identifier) */
+typedef uint8 wl_nan_instance_id_t;
+
+/* no. of max last disc results */
+#define WL_NAN_MAX_DISC_RESULTS        3
+
+/** Mandatory parameters for publish/subscribe iovars - NAN_TLV_SVC_PARAMS */
+typedef struct wl_nan_disc_params_s {
+       /* Periodicity of unsolicited/query transmissions, in DWs */
+       uint32 period;
+       /* Time to live in DWs */
+       uint32 ttl;
+       /* Flag bits */
+       uint32 flags;
+       /* Publish or subscribe service id, i.e. hash of the service name */
+       uint8 svc_hash[WL_NAN_SVC_HASH_LEN];
+       /* pad to make 4 byte alignment, can be used for something else in the future */
+       uint8 pad;
+       /* Publish or subscribe id */
+       wl_nan_instance_id_t instance_id;
+} wl_nan_disc_params_t;
+
+/* recent discovery results */
+typedef struct wl_nan_disc_result_s
+{
+       wl_nan_instance_id_t instance_id;       /* instance id of pub/sub req */
+       wl_nan_instance_id_t peer_instance_id;  /* peer instance id of pub/sub req/resp */
+       uint8 svc_hash[WL_NAN_SVC_HASH_LEN];    /* service descp string */
+       struct ether_addr peer_mac;     /* peer mac address */
+} wl_nan_disc_result_t;
+
+/* list of recent discovery results */
+typedef struct wl_nan_disc_results_s
+{
+       wl_nan_disc_result_t disc_result[WL_NAN_MAX_DISC_RESULTS];
+} wl_nan_disc_results_list_t;
+
+/*
+* desovery interface event structures *
+*/
+
+/* NAN Ranging */
+
+/* Bit defines for global flags */
+#define WL_NAN_RANGING_ENABLE          1 /* enable RTT */
+#define WL_NAN_RANGING_RANGED          2 /* Report to host if ranged as target */
+typedef struct nan_ranging_config {
+       uint32 chanspec;                /* Ranging chanspec */
+       uint16 timeslot;                /* NAN RTT start time slot  1-511 */
+       uint16 duration;                /* NAN RTT duration in ms */
+       struct ether_addr allow_mac;    /* peer initiated ranging: the allowed peer mac
+                                        * address, a unicast (for one peer) or
+                                        * a broadcast for all. Setting it to all zeros
+                                        * means responding to none,same as not setting
+                                        * the flag bit NAN_RANGING_RESPOND
+                                        */
+       uint16 flags;
+} wl_nan_ranging_config_t;
+
+/* list of peers for self initiated ranging */
+/* Bit defines for per peer flags */
+#define WL_NAN_RANGING_REPORT (1<<0)   /* Enable reporting range to target */
+typedef struct nan_ranging_peer {
+       uint32 chanspec;                /* desired chanspec for this peer */
+       uint32 abitmap;                 /* available bitmap */
+       struct ether_addr ea;           /* peer MAC address */
+       uint8 frmcnt;                   /* frame count */
+       uint8 retrycnt;                 /* retry count */
+       uint16 flags;                   /* per peer flags, report or not */
+} wl_nan_ranging_peer_t;
+typedef struct nan_ranging_list {
+       uint8 count;                    /* number of MAC addresses */
+       uint8 num_peers_done;           /* host set to 0, when read, shows number of peers
+                                        * completed, success or fail
+                                        */
+       uint8 num_dws;                  /* time period to do the ranging, specified in dws */
+       uint8 reserve;                  /* reserved field */
+       wl_nan_ranging_peer_t rp[1];    /* variable length array of peers */
+} wl_nan_ranging_list_t;
+
+/* ranging results, a list for self initiated ranging and one for peer initiated ranging */
+/* There will be one structure for each peer */
+#define WL_NAN_RANGING_STATUS_SUCCESS          1
+#define WL_NAN_RANGING_STATUS_FAIL                     2
+#define WL_NAN_RANGING_STATUS_TIMEOUT          3
+#define WL_NAN_RANGING_STATUS_ABORT            4 /* with partial results if sounding count > 0 */
+typedef struct nan_ranging_result {
+       uint8 status;                   /* 1: Success, 2: Fail 3: Timeout 4: Aborted */
+       uint8 sounding_count;           /* number of measurements completed (0 = failure) */
+       struct ether_addr ea;           /* initiator MAC address */
+       uint32 chanspec;                /* Chanspec where the ranging was done */
+       uint32 timestamp;               /* 32bits of the TSF timestamp ranging was completed at */
+       uint32 distance;                /* mean distance in meters expressed as Q4 number.
+                                        * Only valid when sounding_count > 0. Examples:
+                                        * 0x08 = 0.5m
+                                        * 0x10 = 1m
+                                        * 0x18 = 1.5m
+                                        * set to 0xffffffff to indicate invalid number
+                                        */
+       int32 rtt_var;                  /* standard deviation in 10th of ns of RTTs measured.
+                                        * Only valid when sounding_count > 0
+                                        */
+       struct ether_addr tgtea;        /* target MAC address */
+} wl_nan_ranging_result_t;
+typedef struct nan_ranging_event_data {
+       uint8 mode;                     /* 1: Result of host initiated ranging */
+                                       /* 2: Result of peer initiated ranging */
+       uint8 reserved;
+       uint8 success_count;            /* number of peers completed successfully */
+       uint8 count;                    /* number of peers in the list */
+       wl_nan_ranging_result_t rr[1];  /* variable array of ranging peers */
+} wl_nan_ranging_event_data_t;
+enum {
+       WL_NAN_RSSI_DATA = 1,
+       WL_NAN_STATS_DATA = 2,
+/*
+ * ***** ADD before this line ****
+ */
+       WL_NAN_INVALID
+};
+
+typedef struct wl_nan_stats {
+       /* general */
+       uint32 cnt_dw; /* DW slots */
+       uint32 cnt_disc_bcn_sch; /* disc beacon slots */
+       uint32 cnt_amr_exp; /* count of ambtt expiries resetting roles */
+       uint32 cnt_bcn_upd; /* count of beacon template updates */
+       uint32 cnt_bcn_tx; /* count of sync & disc bcn tx */
+       uint32 cnt_bcn_rx; /* count of sync & disc bcn rx */
+       uint32 cnt_sync_bcn_tx; /* count of sync bcn tx within DW */
+       uint32 cnt_disc_bcn_tx; /* count of disc bcn tx */
+       uint32 cnt_sdftx_bcmc; /* count of bcast/mcast sdf tx */
+       uint32 cnt_sdftx_uc; /* count of unicast sdf tx */
+       uint32 cnt_sdftx_fail; /* count of unicast sdf tx fails */
+       uint32 cnt_sdf_rx; /* count of  sdf rx */
+       /* NAN roles */
+       uint32 cnt_am; /* anchor master */
+       uint32 cnt_master; /* master */
+       uint32 cnt_nms; /* non master sync */
+       uint32 cnt_nmns; /* non master non sync */
+       /* TX */
+       uint32 cnt_err_txtime; /* error in txtime */
+       uint32 cnt_err_unsch_tx; /* tx while not in DW/ disc bcn slot */
+       uint32 cnt_err_bcn_tx; /*  beacon tx error */
+       uint32 cnt_sync_bcn_tx_miss; /* no. of times time delta between 2 cosequetive
+                                               * sync beacons is more than dw interval
+                                               */
+       /* SCANS */
+       uint32 cnt_mrg_scan; /* count of merge scans completed */
+       uint32 cnt_err_ms_rej; /* number of merge scan failed */
+       uint32 cnt_scan_results; /* no. of nan beacons scanned */
+       uint32 cnt_join_scan_rej; /* no. of join scans rejected */
+       uint32 cnt_nan_scan_abort; /* no. of join scans rejected */
+       /* enable/disable */
+       uint32 cnt_nan_enab; /* no. of times nan feature got enabled */
+       uint32 cnt_nan_disab; /* no. of times nan feature got disabled */
+} wl_nan_stats_t;
+
+#define WL_NAN_MAC_MAX_NAN_PEERS 6
+#define WL_NAN_MAC_MAX_RSSI_DATA_PER_PEER  10
+
+typedef struct wl_nan_nbr_rssi {
+       uint8 rx_chan; /* channel number on which bcn rcvd */
+       int rssi_raw;  /* received rssi value */
+       int rssi_avg;  /* normalized rssi value */
+} wl_nan_peer_rssi_t;
+
+typedef struct wl_nan_peer_rssi_entry {
+       struct ether_addr mac;  /* peer mac address */
+       uint8 flags;   /* TODO:rssi data order: latest first, oldest first etc */
+       uint8 rssi_cnt;   /* rssi data sample present */
+       wl_nan_peer_rssi_t rssi[WL_NAN_MAC_MAX_RSSI_DATA_PER_PEER]; /* RSSI data frm peer */
+} wl_nan_peer_rssi_entry_t;
+
+#define WL_NAN_PEER_RSSI      0x1
+#define WL_NAN_PEER_RSSI_LIST 0x2
+
+typedef struct wl_nan_nbr_rssi_data {
+       uint8 flags;   /* this is a list or single rssi data */
+       uint8 peer_cnt; /* number of peers */
+       uint16 pad; /* padding */
+       wl_nan_peer_rssi_entry_t peers[1]; /* peers data list */
+} wl_nan_peer_rssi_data_t;
+
+/* ********************* end of NAN section ******************************** */
+#endif /* WL_NAN */
+
+
+#define RSSI_THRESHOLD_SIZE 16
+#define MAX_IMP_RESP_SIZE 256
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_rssi_bias {
+       int32           version;                        /* version */
+       int32           threshold[RSSI_THRESHOLD_SIZE]; /* threshold */
+       int32           peak_offset;                    /* peak offset */
+       int32           bias;                           /* rssi bias */
+       int32           gd_delta;                       /* GD - GD_ADJ */
+       int32           imp_resp[MAX_IMP_RESP_SIZE];    /* (Hi*Hi)+(Hr*Hr) */
+} BWL_POST_PACKED_STRUCT wl_proxd_rssi_bias_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_rssi_bias_avg {
+       int32           avg_threshold[RSSI_THRESHOLD_SIZE];     /* avg threshold */
+       int32           avg_peak_offset;                        /* avg peak offset */
+       int32           avg_rssi;                               /* avg rssi */
+       int32           avg_bias;                               /* avg bias */
+} BWL_POST_PACKED_STRUCT wl_proxd_rssi_bias_avg_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_collect_info {
+       uint16          type;    /* type: 0 channel table, 1 channel smoothing table, 2 and 3 seq */
+       uint16          index;          /* The current frame index, from 1 to total_frames. */
+       uint16          tof_cmd;        /* M_TOF_CMD      */
+       uint16          tof_rsp;        /* M_TOF_RSP      */
+       uint16          tof_avb_rxl;    /* M_TOF_AVB_RX_L */
+       uint16          tof_avb_rxh;    /* M_TOF_AVB_RX_H */
+       uint16          tof_avb_txl;    /* M_TOF_AVB_TX_L */
+       uint16          tof_avb_txh;    /* M_TOF_AVB_TX_H */
+       uint16          tof_id;         /* M_TOF_ID */
+       uint8           tof_frame_type;
+       uint8           tof_frame_bw;
+       int8            tof_rssi;
+       int32           tof_cfo;
+       int32           gd_adj_ns;      /* gound delay */
+       int32           gd_h_adj_ns;    /* group delay + threshold crossing */
+#ifdef RSSI_REFINE
+       wl_proxd_rssi_bias_t rssi_bias; /* RSSI refinement info */
+#endif
+       int16           nfft;           /* number of samples stored in H */
+
+} BWL_POST_PACKED_STRUCT wl_proxd_collect_info_t;
+
+#define k_tof_collect_H_pad  1
+#define k_tof_collect_H_size (256+16+k_tof_collect_H_pad)
+#define k_tof_collect_Hraw_size (2*k_tof_collect_H_size)
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_collect_data {
+       wl_proxd_collect_info_t  info;
+       uint32  H[k_tof_collect_H_size]; /* raw data read from phy used to adjust timestamps */
+
+} BWL_POST_PACKED_STRUCT wl_proxd_collect_data_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_debug_data {
+       uint8           count;          /* number of packets */
+       uint8           stage;          /* state machone stage */
+       uint8           received;       /* received or txed */
+       uint8           paket_type;     /* packet type */
+       uint8           category;       /* category field */
+       uint8           action;         /* action field */
+       uint8           token;          /* token number */
+       uint8           follow_token;   /* following token number */
+       uint16          index;          /* index of the packet */
+       uint16          tof_cmd;        /* M_TOF_CMD */
+       uint16          tof_rsp;        /* M_TOF_RSP */
+       uint16          tof_avb_rxl;    /* M_TOF_AVB_RX_L */
+       uint16          tof_avb_rxh;    /* M_TOF_AVB_RX_H */
+       uint16          tof_avb_txl;    /* M_TOF_AVB_TX_L */
+       uint16          tof_avb_txh;    /* M_TOF_AVB_TX_H */
+       uint16          tof_id;         /* M_TOF_ID */
+       uint16          tof_status0;    /* M_TOF_STATUS_0 */
+       uint16          tof_status2;    /* M_TOF_STATUS_2 */
+       uint16          tof_chsm0;      /* M_TOF_CHNSM_0 */
+       uint16          tof_phyctl0;    /* M_TOF_PHYCTL0 */
+       uint16          tof_phyctl1;    /* M_TOF_PHYCTL1 */
+       uint16          tof_phyctl2;    /* M_TOF_PHYCTL2 */
+       uint16          tof_lsig;       /* M_TOF_LSIG */
+       uint16          tof_vhta0;      /* M_TOF_VHTA0 */
+       uint16          tof_vhta1;      /* M_TOF_VHTA1 */
+       uint16          tof_vhta2;      /* M_TOF_VHTA2 */
+       uint16          tof_vhtb0;      /* M_TOF_VHTB0 */
+       uint16          tof_vhtb1;      /* M_TOF_VHTB1 */
+       uint16          tof_apmductl;   /* M_TOF_AMPDU_CTL */
+       uint16          tof_apmdudlim;  /* M_TOF_AMPDU_DLIM */
+       uint16          tof_apmdulen;   /* M_TOF_AMPDU_LEN */
+} BWL_POST_PACKED_STRUCT wl_proxd_debug_data_t;
+
+/* version of the wl_wsec_info structure */
+#define WL_WSEC_INFO_VERSION 0x01
+
+/* start enum value for BSS properties */
+#define WL_WSEC_INFO_BSS_BASE 0x0100
+
+/* size of len and type fields of wl_wsec_info_tlv_t struct */
+#define WL_WSEC_INFO_TLV_HDR_LEN OFFSETOF(wl_wsec_info_tlv_t, data)
+
+/* Allowed wl_wsec_info properties; not all of them may be supported. */
+typedef enum {
+       WL_WSEC_INFO_NONE = 0,
+       WL_WSEC_INFO_MAX_KEYS = 1,
+       WL_WSEC_INFO_NUM_KEYS = 2,
+       WL_WSEC_INFO_NUM_HW_KEYS = 3,
+       WL_WSEC_INFO_MAX_KEY_IDX = 4,
+       WL_WSEC_INFO_NUM_REPLAY_CNTRS = 5,
+       WL_WSEC_INFO_SUPPORTED_ALGOS = 6,
+       WL_WSEC_INFO_MAX_KEY_LEN = 7,
+       WL_WSEC_INFO_FLAGS = 8,
+       /* add global/per-wlc properties above */
+       WL_WSEC_INFO_BSS_FLAGS = (WL_WSEC_INFO_BSS_BASE + 1),
+       WL_WSEC_INFO_BSS_WSEC = (WL_WSEC_INFO_BSS_BASE + 2),
+       WL_WSEC_INFO_BSS_TX_KEY_ID = (WL_WSEC_INFO_BSS_BASE + 3),
+       WL_WSEC_INFO_BSS_ALGO = (WL_WSEC_INFO_BSS_BASE + 4),
+       WL_WSEC_INFO_BSS_KEY_LEN = (WL_WSEC_INFO_BSS_BASE + 5),
+       /* add per-BSS properties above */
+       WL_WSEC_INFO_MAX = 0xffff
+} wl_wsec_info_type_t;
+
+/* tlv used to return wl_wsec_info properties */
+typedef struct {
+       uint16 type;
+       uint16 len;             /* data length */
+       uint8 data[1];  /* data follows */
+} wl_wsec_info_tlv_t;
+
+/* input/output data type for wsec_info iovar */
+typedef struct wl_wsec_info {
+       uint8 version; /* structure version */
+       uint8 pad[2];
+       uint8 num_tlvs;
+       wl_wsec_info_tlv_t tlvs[1]; /* tlv data follows */
+} wl_wsec_info_t;
+
+/*
+ * scan MAC definitions
+ */
+
+/* common iovar struct */
+typedef struct wl_scanmac {
+       uint16 subcmd_id;       /* subcommand id */
+       uint16 len;             /* total length of data[] */
+       uint8 data[1];          /* subcommand data */
+} wl_scanmac_t;
+
+/* subcommand ids */
+#define WL_SCANMAC_SUBCMD_ENABLE   0
+#define WL_SCANMAC_SUBCMD_BSSCFG   1   /* only GET supported */
+#define WL_SCANMAC_SUBCMD_CONFIG   2
+
+/* scanmac enable data struct */
+typedef struct wl_scanmac_enable {
+       uint8 enable;   /* 1 - enable, 0 - disable */
+       uint8 pad[3];   /* 4-byte struct alignment */
+} wl_scanmac_enable_t;
+
+/* scanmac bsscfg data struct */
+typedef struct wl_scanmac_bsscfg {
+       uint32 bsscfg;  /* bsscfg index */
+} wl_scanmac_bsscfg_t;
+
+/* scanmac config data struct */
+typedef struct wl_scanmac_config {
+       struct ether_addr mac;  /* 6 bytes of MAC address or MAC prefix (i.e. OUI) */
+       struct ether_addr random_mask;  /* randomized bits on each scan */
+       uint16 scan_bitmap;     /* scans to use this MAC address */
+       uint8 pad[2];   /* 4-byte struct alignment */
+} wl_scanmac_config_t;
+
+/* scan bitmap */
+#define WL_SCANMAC_SCAN_UNASSOC                (0x01 << 0)     /* unassociated scans */
+#define WL_SCANMAC_SCAN_ASSOC_ROAM     (0x01 << 1)     /* associated roam scans */
+#define WL_SCANMAC_SCAN_ASSOC_PNO      (0x01 << 2)     /* associated PNO scans */
+#define WL_SCANMAC_SCAN_ASSOC_HOST     (0x01 << 3)     /* associated host scans */
+
+/* no default structure packing */
+#include <packed_section_end.h>
+
+enum rssi_reason {
+       RSSI_REASON_UNKNOW = 0,
+       RSSI_REASON_LOWRSSI = 1,
+       RSSI_REASON_NSYC = 2,
+       RSSI_REASON_TIMEOUT = 3
+};
+
+enum tof_reason {
+       TOF_REASON_OK = 0,
+       TOF_REASON_REQEND = 1,
+       TOF_REASON_TIMEOUT = 2,
+       TOF_REASON_NOACK = 3,
+       TOF_REASON_INVALIDAVB = 4,
+       TOF_REASON_INITIAL = 5,
+       TOF_REASON_ABORT = 6
+};
+
+enum rssi_state {
+       RSSI_STATE_POLL = 0,
+       RSSI_STATE_TPAIRING = 1,
+       RSSI_STATE_IPAIRING = 2,
+       RSSI_STATE_THANDSHAKE = 3,
+       RSSI_STATE_IHANDSHAKE = 4,
+       RSSI_STATE_CONFIRMED = 5,
+       RSSI_STATE_PIPELINE = 6,
+       RSSI_STATE_NEGMODE = 7,
+       RSSI_STATE_MONITOR = 8,
+       RSSI_STATE_LAST = 9
+};
+
+enum tof_state {
+       TOF_STATE_IDLE   = 0,
+       TOF_STATE_IWAITM = 1,
+       TOF_STATE_TWAITM = 2,
+       TOF_STATE_ILEGACY = 3,
+       TOF_STATE_IWAITCL = 4,
+       TOF_STATE_TWAITCL = 5,
+       TOF_STATE_ICONFIRM = 6,
+       TOF_STATE_IREPORT = 7
+};
+
+enum tof_mode_type {
+       TOF_LEGACY_UNKNOWN      = 0,
+       TOF_LEGACY_AP           = 1,
+       TOF_NONLEGACY_AP        = 2
+};
+
+enum tof_way_type {
+       TOF_TYPE_ONE_WAY = 0,
+       TOF_TYPE_TWO_WAY = 1,
+       TOF_TYPE_REPORT = 2
+};
+
+enum tof_rate_type {
+       TOF_FRAME_RATE_VHT = 0,
+       TOF_FRAME_RATE_LEGACY = 1
+};
+
+#define TOF_ADJ_TYPE_NUM       4       /* number of assisted timestamp adjustment */
+enum tof_adj_mode {
+       TOF_ADJ_SOFTWARE = 0,
+       TOF_ADJ_HARDWARE = 1,
+       TOF_ADJ_SEQ = 2,
+       TOF_ADJ_NONE = 3
+};
+
+#define FRAME_TYPE_NUM         4       /* number of frame type */
+enum frame_type {
+       FRAME_TYPE_CCK  = 0,
+       FRAME_TYPE_OFDM = 1,
+       FRAME_TYPE_11N  = 2,
+       FRAME_TYPE_11AC = 3
+};
+
+typedef struct wl_proxd_status_iovar {
+       uint16                  method;                         /* method */
+       uint8                   mode;                           /* mode */
+       uint8                   peermode;                       /* peer mode */
+       uint8                   state;                          /* state */
+       uint8                   reason;                         /* reason code */
+       uint32                  distance;                       /* distance */
+       uint32                  txcnt;                          /* tx pkt counter */
+       uint32                  rxcnt;                          /* rx pkt counter */
+       struct ether_addr       peer;                           /* peer mac address */
+       int8                    avg_rssi;                       /* average rssi */
+       int8                    hi_rssi;                        /* highest rssi */
+       int8                    low_rssi;                       /* lowest rssi */
+       uint32                  dbgstatus;                      /* debug status */
+       uint16                  frame_type_cnt[FRAME_TYPE_NUM]; /* frame types */
+       uint8                   adj_type_cnt[TOF_ADJ_TYPE_NUM]; /* adj types HW/SW */
+} wl_proxd_status_iovar_t;
+
+#ifdef NET_DETECT
+typedef struct net_detect_adapter_features {
+       bool    wowl_enabled;
+       bool    net_detect_enabled;
+       bool    nlo_enabled;
+} net_detect_adapter_features_t;
+
+typedef enum net_detect_bss_type {
+       nd_bss_any = 0,
+       nd_ibss,
+       nd_ess
+} net_detect_bss_type_t;
+
+typedef struct net_detect_profile {
+       wlc_ssid_t              ssid;
+       net_detect_bss_type_t   bss_type;       /* Ignore for now since Phase 1 is only for ESS */
+       uint32                  cipher_type;    /* DOT11_CIPHER_ALGORITHM enumeration values */
+       uint32                  auth_type;      /* DOT11_AUTH_ALGORITHM enumeration values */
+} net_detect_profile_t;
+
+typedef struct net_detect_profile_list {
+       uint32                  num_nd_profiles;
+       net_detect_profile_t    nd_profile[0];
+} net_detect_profile_list_t;
+
+typedef struct net_detect_config {
+       bool                        nd_enabled;
+       uint32                      scan_interval;
+       uint32                      wait_period;
+       bool                        wake_if_connected;
+       bool                        wake_if_disconnected;
+       net_detect_profile_list_t   nd_profile_list;
+} net_detect_config_t;
+
+typedef enum net_detect_wake_reason {
+       nd_reason_unknown,
+       nd_net_detected,
+       nd_wowl_event,
+       nd_ucode_error
+} net_detect_wake_reason_t;
+
+typedef struct net_detect_wake_data {
+       net_detect_wake_reason_t    nd_wake_reason;
+       uint32                      nd_wake_date_length;
+       uint8                       nd_wake_data[0];        /* Wake data (currently unused) */
+} net_detect_wake_data_t;
+
+#endif /* NET_DETECT */
+
+/* (unversioned, deprecated) */
+typedef struct bcnreq {
+       uint8 bcn_mode;
+       int dur;
+       int channel;
+       struct ether_addr da;
+       uint16 random_int;
+       wlc_ssid_t ssid;
+       uint16 reps;
+} bcnreq_t;
+
+#define WL_RRM_BCN_REQ_VER             1
+typedef struct bcn_req {
+       uint8 version;
+       uint8 bcn_mode;
+       uint8 pad_1[2];
+       int32 dur;
+       int32 channel;
+       struct ether_addr da;
+       uint16 random_int;
+       wlc_ssid_t ssid;
+       uint16 reps;
+       uint8 req_elements;
+       uint8 pad_2;
+       chanspec_list_t chspec_list;
+} bcn_req_t;
+
+typedef struct rrmreq {
+       struct ether_addr da;
+       uint8 reg;
+       uint8 chan;
+       uint16 random_int;
+       uint16 dur;
+       uint16 reps;
+} rrmreq_t;
+
+typedef struct framereq {
+       struct ether_addr da;
+       uint8 reg;
+       uint8 chan;
+       uint16 random_int;
+       uint16 dur;
+       struct ether_addr ta;
+       uint16 reps;
+} framereq_t;
+
+typedef struct statreq {
+       struct ether_addr da;
+       struct ether_addr peer;
+       uint16 random_int;
+       uint16 dur;
+       uint8 group_id;
+       uint16 reps;
+} statreq_t;
+
+#define WL_RRM_RPT_VER         0
+#define WL_RRM_RPT_MAX_PAYLOAD 256
+#define WL_RRM_RPT_MIN_PAYLOAD 7
+#define WL_RRM_RPT_FALG_ERR    0
+#define WL_RRM_RPT_FALG_GRP_ID_PROPR   (1 << 0)
+#define WL_RRM_RPT_FALG_GRP_ID_0       (1 << 1)
+typedef struct {
+       uint16 ver;             /* version */
+       struct ether_addr addr; /* STA MAC addr */
+       uint32 timestamp;       /* timestamp of the report */
+       uint16 flag;            /* flag */
+       uint16 len;             /* length of payload data */
+       unsigned char data[WL_RRM_RPT_MAX_PAYLOAD];
+} statrpt_t;
+
+typedef struct wlc_l2keepalive_ol_params {
+       uint8   flags;
+       uint8   prio;
+       uint16  period_ms;
+} wlc_l2keepalive_ol_params_t;
+
+typedef struct wlc_dwds_config {
+       uint32          enable;
+       uint32          mode; /* STA/AP interface */
+       struct ether_addr ea;
+} wlc_dwds_config_t;
+
+typedef struct wl_el_set_params_s {
+       uint8 set;      /* Set number */
+       uint32 size;    /* Size to make/expand */
+} wl_el_set_params_t;
+
+typedef struct wl_el_tag_params_s {
+       uint16 tag;
+       uint8 set;
+       uint8 flags;
+} wl_el_tag_params_t;
+
+/* Video Traffic Interference Monitor config */
+#define INTFER_VERSION         1
+typedef struct wl_intfer_params {
+       uint16 version;                 /* version */
+       uint8 period;                   /* sample period */
+       uint8 cnt;                      /* sample cnt */
+       uint8 txfail_thresh;    /* non-TCP txfail threshold */
+       uint8 tcptxfail_thresh; /* tcptxfail threshold */
+} wl_intfer_params_t;
+
+typedef struct wl_staprio_cfg {
+       struct ether_addr ea;   /* mac addr */
+       uint8 prio;             /* scb priority */
+} wl_staprio_cfg_t;
+
+typedef enum wl_stamon_cfg_cmd_type {
+       STAMON_CFG_CMD_DEL = 0,
+       STAMON_CFG_CMD_ADD = 1
+} wl_stamon_cfg_cmd_type_t;
+
+typedef struct wlc_stamon_sta_config {
+       wl_stamon_cfg_cmd_type_t cmd; /* 0 - delete, 1 - add */
+       struct ether_addr ea;
+} wlc_stamon_sta_config_t;
+
+#ifdef SR_DEBUG
+typedef struct /* pmu_reg */{
+       uint32  pmu_control;
+       uint32  pmu_capabilities;
+       uint32  pmu_status;
+       uint32  res_state;
+       uint32  res_pending;
+       uint32  pmu_timer1;
+       uint32  min_res_mask;
+       uint32  max_res_mask;
+       uint32  pmu_chipcontrol1[4];
+       uint32  pmu_regcontrol[5];
+       uint32  pmu_pllcontrol[5];
+       uint32  pmu_rsrc_up_down_timer[31];
+       uint32  rsrc_dep_mask[31];
+} pmu_reg_t;
+#endif /* pmu_reg */
+
+typedef struct wl_taf_define {
+       struct ether_addr ea;   /* STA MAC or 0xFF... */
+       uint16 version;         /* version */
+       uint32 sch;             /* method index */
+       uint32 prio;            /* priority */
+       uint32 misc;            /* used for return value */
+       char   text[1];         /* used to pass and return ascii text */
+} wl_taf_define_t;
+
+/* Received Beacons lengths information */
+#define WL_LAST_BCNS_INFO_FIXED_LEN            OFFSETOF(wlc_bcn_len_hist_t, bcnlen_ring)
+typedef struct wlc_bcn_len_hist {
+       uint16  ver;                            /* version field */
+       uint16  cur_index;                      /* current pointed index in ring buffer */
+       uint32  max_bcnlen;             /* Max beacon length received */
+       uint32  min_bcnlen;             /* Min beacon length received */
+       uint32  ringbuff_len;           /* Length of the ring buffer 'bcnlen_ring' */
+       uint32  bcnlen_ring[1]; /* ring buffer storing received beacon lengths */
+} wlc_bcn_len_hist_t;
+
+/* WDS net interface types */
+#define WL_WDSIFTYPE_NONE  0x0 /* The interface type is neither WDS nor DWDS. */
+#define WL_WDSIFTYPE_WDS   0x1 /* The interface is WDS type. */
+#define WL_WDSIFTYPE_DWDS  0x2 /* The interface is DWDS type. */
+
+typedef struct wl_bssload_static {
+       bool is_static;
+       uint16 sta_count;
+       uint8 chan_util;
+       uint16 aac;
+} wl_bssload_static_t;
+
+
+/* IO Var Operations - the Value of iov_op In wlc_ap_doiovar */
+typedef enum wlc_ap_iov_operation {
+       WLC_AP_IOV_OP_DELETE                   = -1,
+       WLC_AP_IOV_OP_DISABLE                  = 0,
+       WLC_AP_IOV_OP_ENABLE                   = 1,
+       WLC_AP_IOV_OP_MANUAL_AP_BSSCFG_CREATE  = 2,
+       WLC_AP_IOV_OP_MANUAL_STA_BSSCFG_CREATE = 3,
+       WLC_AP_IOV_OP_MOVE                     = 4
+} wlc_ap_iov_oper_t;
+
+/* LTE coex info */
+/* Analogue of HCI Set MWS Signaling cmd */
+typedef struct {
+       uint16  mws_rx_assert_offset;
+       uint16  mws_rx_assert_jitter;
+       uint16  mws_rx_deassert_offset;
+       uint16  mws_rx_deassert_jitter;
+       uint16  mws_tx_assert_offset;
+       uint16  mws_tx_assert_jitter;
+       uint16  mws_tx_deassert_offset;
+       uint16  mws_tx_deassert_jitter;
+       uint16  mws_pattern_assert_offset;
+       uint16  mws_pattern_assert_jitter;
+       uint16  mws_inact_dur_assert_offset;
+       uint16  mws_inact_dur_assert_jitter;
+       uint16  mws_scan_freq_assert_offset;
+       uint16  mws_scan_freq_assert_jitter;
+       uint16  mws_prio_assert_offset_req;
+} wci2_config_t;
+
+/* Analogue of HCI MWS Channel Params */
+typedef struct {
+       uint16  mws_rx_center_freq; /* MHz */
+       uint16  mws_tx_center_freq;
+       uint16  mws_rx_channel_bw;  /* KHz */
+       uint16  mws_tx_channel_bw;
+       uint8   mws_channel_en;
+       uint8   mws_channel_type;   /* Don't care for WLAN? */
+} mws_params_t;
+
+/* MWS wci2 message */
+typedef struct {
+       uint8   mws_wci2_data; /* BT-SIG msg */
+       uint16  mws_wci2_interval; /* Interval in us */
+       uint16  mws_wci2_repeat; /* No of msgs to send */
+} mws_wci2_msg_t;
+
+typedef struct {
+       uint32 config;  /* MODE: AUTO (-1), Disable (0), Enable (1) */
+       uint32 status;  /* Current state: Disabled (0), Enabled (1) */
+} wl_config_t;
+
+#define WLC_RSDB_MODE_AUTO_MASK 0x80
+#define WLC_RSDB_EXTRACT_MODE(val) ((int8)((val) & (~(WLC_RSDB_MODE_AUTO_MASK))))
+
+#define        WL_IF_STATS_T_VERSION 1 /* current version of wl_if_stats structure */
+
+/* per interface counters */
+typedef struct wl_if_stats {
+       uint16  version;                /* version of the structure */
+       uint16  length;                 /* length of the entire structure */
+       uint32  PAD;                    /* padding */
+
+       /* transmit stat counters */
+       uint64  txframe;                /* tx data frames */
+       uint64  txbyte;                 /* tx data bytes */
+       uint64  txerror;                /* tx data errors (derived: sum of others) */
+       uint64  txnobuf;                /* tx out of buffer errors */
+       uint64  txrunt;                 /* tx runt frames */
+       uint64  txfail;                 /* tx failed frames */
+       uint64  txretry;                /* tx retry frames */
+       uint64  txretrie;               /* tx multiple retry frames */
+       uint64  txfrmsnt;               /* tx sent frames */
+       uint64  txmulti;                /* tx mulitcast sent frames */
+       uint64  txfrag;                 /* tx fragments sent */
+
+       /* receive stat counters */
+       uint64  rxframe;                /* rx data frames */
+       uint64  rxbyte;                 /* rx data bytes */
+       uint64  rxerror;                /* rx data errors (derived: sum of others) */
+       uint64  rxnobuf;                /* rx out of buffer errors */
+       uint64  rxrunt;                 /* rx runt frames */
+       uint64  rxfragerr;              /* rx fragment errors */
+       uint64  rxmulti;                /* rx multicast frames */
+}
+wl_if_stats_t;
+
+typedef struct wl_band {
+       uint16          bandtype;               /* WL_BAND_2G, WL_BAND_5G */
+       uint16          bandunit;               /* bandstate[] index */
+       uint16          phytype;                /* phytype */
+       uint16          phyrev;
+}
+wl_band_t;
+
+#define        WL_WLC_VERSION_T_VERSION 1 /* current version of wlc_version structure */
+
+/* wlc interface version */
+typedef struct wl_wlc_version {
+       uint16  version;                /* version of the structure */
+       uint16  length;                 /* length of the entire structure */
+
+       /* epi version numbers */
+       uint16  epi_ver_major;          /* epi major version number */
+       uint16  epi_ver_minor;          /* epi minor version number */
+       uint16  epi_rc_num;             /* epi RC number */
+       uint16  epi_incr_num;           /* epi increment number */
+
+       /* wlc interface version numbers */
+       uint16  wlc_ver_major;          /* wlc interface major version number */
+       uint16  wlc_ver_minor;          /* wlc interface minor version number */
+}
+wl_wlc_version_t;
+
+/* Version of WLC interface to be returned as a part of wl_wlc_version structure.
+ * For the discussion related to versions update policy refer to
+ * http://hwnbu-twiki.broadcom.com/bin/view/Mwgroup/WlShimAbstractionLayer
+ * For now the policy is to increment WLC_VERSION_MAJOR each time
+ * there is a change that involves both WLC layer and per-port layer.
+ * WLC_VERSION_MINOR is currently not in use.
+ */
+#define WLC_VERSION_MAJOR      3
+#define WLC_VERSION_MINOR      0
+
+/* begin proxd definitions */
+#include <packed_section_start.h>
+
+#define WL_PROXD_API_VERSION 0x0300    /* version 3.0 */
+
+/* Minimum supported API version */
+#define WL_PROXD_API_MIN_VERSION 0x0300
+
+/* proximity detection methods */
+enum {
+       WL_PROXD_METHOD_NONE    = 0,
+       WL_PROXD_METHOD_RSVD1   = 1, /* backward compatibility - RSSI, not supported */
+       WL_PROXD_METHOD_TOF             = 2,
+       WL_PROXD_METHOD_RSVD2   = 3, /* 11v only - if needed */
+       WL_PROXD_METHOD_FTM             = 4, /* IEEE rev mc/2014 */
+       WL_PROXD_METHOD_MAX
+};
+typedef int16 wl_proxd_method_t;
+
+/* global and method configuration flags */
+enum {
+       WL_PROXD_FLAG_NONE                      = 0x00000000,
+       WL_PROXD_FLAG_RX_ENABLED        = 0x00000001, /* respond to requests */
+       WL_PROXD_FLAG_RX_RANGE_REQ      = 0x00000002, /* 11mc range requests enabled */
+       WL_PROXD_FLAG_TX_LCI            = 0x00000004, /* transmit location, if available */
+       WL_PROXD_FLAG_TX_CIVIC          = 0x00000008, /* tx civic loc, if available */
+       WL_PROXD_FLAG_RX_AUTO_BURST     = 0x00000010, /* respond to requests w/o host action */
+       WL_PROXD_FLAG_TX_AUTO_BURST     = 0x00000020, /* continue requests w/o host action */
+       WL_PROXD_FLAG_AVAIL_PUBLISH = 0x00000040, /* publish availability */
+       WL_PROXD_FLAG_AVAIL_SCHEDULE = 0x00000080, /* schedule using availability */
+       WL_PROXD_FLAG_ALL                       = 0xffffffff
+};
+typedef uint32 wl_proxd_flags_t;
+
+#define WL_PROXD_FLAGS_AVAIL (WL_PROXD_FLAG_AVAIL_PUBLISH | \
+       WL_PROXD_FLAG_AVAIL_SCHEDULE)
+
+/* session flags */
+enum {
+       WL_PROXD_SESSION_FLAG_NONE                      = 0x00000000,  /* no flags */
+       WL_PROXD_SESSION_FLAG_INITIATOR         = 0x00000001,  /* local device is initiator */
+       WL_PROXD_SESSION_FLAG_TARGET            = 0x00000002,  /* local device is target */
+       WL_PROXD_SESSION_FLAG_ONE_WAY           = 0x00000004,  /* (initiated) 1-way rtt */
+       WL_PROXD_SESSION_FLAG_AUTO_BURST        = 0x00000008,  /* created w/ rx_auto_burst */
+       WL_PROXD_SESSION_FLAG_PERSIST           = 0x00000010,  /* good until cancelled */
+       WL_PROXD_SESSION_FLAG_RTT_DETAIL        = 0x00000020,  /* rtt detail in results */
+       WL_PROXD_SESSION_FLAG_TOF_COMPAT        = 0x00000040,  /* TOF  compatibility - TBD */
+       WL_PROXD_SESSION_FLAG_AOA                       = 0x00000080,  /* AOA along w/ RTT */
+       WL_PROXD_SESSION_FLAG_RX_AUTO_BURST     = 0x00000100,  /* Same as proxd flags above */
+       WL_PROXD_SESSION_FLAG_TX_AUTO_BURST     = 0x00000200,  /* Same as proxd flags above */
+       WL_PROXD_SESSION_FLAG_NAN_BSS           = 0x00000400,  /* Use NAN BSS, if applicable */
+       WL_PROXD_SESSION_FLAG_TS1                       = 0x00000800,  /* e.g. FTM1 - cap or rx */
+       WL_PROXD_SESSION_FLAG_REPORT_FAILURE= 0x00002000, /* report failure to target */
+       WL_PROXD_SESSION_FLAG_INITIATOR_RPT     = 0x00004000, /* report distance to target */
+       WL_PROXD_SESSION_FLAG_NOCHANSWT         = 0x00008000, /* No channel switching */
+       WL_PROXD_SESSION_FLAG_NETRUAL           = 0x00010000, /* netrual mode */
+       WL_PROXD_SESSION_FLAG_SEQ_EN            = 0x00020000, /* Toast */
+       WL_PROXD_SESSION_FLAG_NO_PARAM_OVRD     = 0x00040000, /* no param override from target */
+       WL_PROXD_SESSION_FLAG_ASAP                      = 0x00080000, /* ASAP session */
+       WL_PROXD_SESSION_FLAG_REQ_LCI           = 0x00100000, /* transmit LCI req */
+       WL_PROXD_SESSION_FLAG_REQ_CIV           = 0x00200000, /* transmit civic loc req */
+       WL_PROXD_SESSION_FLAG_COLLECT           = 0x80000000,   /* debug - collect */
+       WL_PROXD_SESSION_FLAG_ALL                       = 0xffffffff
+};
+typedef uint32 wl_proxd_session_flags_t;
+
+/* time units - mc supports up to 0.1ns resolution */
+enum {
+       WL_PROXD_TMU_TU                 = 0,            /* 1024us */
+       WL_PROXD_TMU_SEC                = 1,
+       WL_PROXD_TMU_MILLI_SEC  = 2,
+       WL_PROXD_TMU_MICRO_SEC  = 3,
+       WL_PROXD_TMU_NANO_SEC   = 4,
+       WL_PROXD_TMU_PICO_SEC   = 5
+};
+typedef int16 wl_proxd_tmu_t;
+
+/* time interval e.g. 10ns */
+typedef struct wl_proxd_intvl {
+       uint32 intvl;
+       wl_proxd_tmu_t tmu;
+       uint8   pad[2];
+} wl_proxd_intvl_t;
+
+/* commands that can apply to proxd, method or a session */
+enum {
+       WL_PROXD_CMD_NONE                               = 0,
+       WL_PROXD_CMD_GET_VERSION                = 1,
+       WL_PROXD_CMD_ENABLE                     = 2,
+       WL_PROXD_CMD_DISABLE                    = 3,
+       WL_PROXD_CMD_CONFIG                     = 4,
+       WL_PROXD_CMD_START_SESSION              = 5,
+       WL_PROXD_CMD_BURST_REQUEST              = 6,
+       WL_PROXD_CMD_STOP_SESSION               = 7,
+       WL_PROXD_CMD_DELETE_SESSION     = 8,
+       WL_PROXD_CMD_GET_RESULT                 = 9,
+       WL_PROXD_CMD_GET_INFO                   = 10,
+       WL_PROXD_CMD_GET_STATUS                 = 11,
+       WL_PROXD_CMD_GET_SESSIONS               = 12,
+       WL_PROXD_CMD_GET_COUNTERS               = 13,
+       WL_PROXD_CMD_CLEAR_COUNTERS     = 14,
+       WL_PROXD_CMD_COLLECT                    = 15,
+       WL_PROXD_CMD_TUNE                               = 16,
+       WL_PROXD_CMD_DUMP                               = 17,
+       WL_PROXD_CMD_START_RANGING              = 18,
+       WL_PROXD_CMD_STOP_RANGING               = 19,
+       WL_PROXD_CMD_GET_RANGING_INFO   = 20,
+       WL_PROXD_CMD_IS_TLV_SUPPORTED   = 21,
+
+       WL_PROXD_CMD_MAX
+};
+typedef int16 wl_proxd_cmd_t;
+
+/* session ids:
+ * id 0 is reserved
+ * ids 1..0x7fff - allocated by host/app
+ * 0x8000-0xffff - allocated by firmware, used for auto/rx
+ */
+enum {
+        WL_PROXD_SESSION_ID_GLOBAL = 0
+};
+
+#define WL_PROXD_SID_HOST_MAX 0x7fff
+#define WL_PROXD_SID_HOST_ALLOC(_sid) ((_sid) > 0 && (_sid) <= WL_PROXD_SID_HOST_MAX)
+
+/* maximum number sessions that can be allocated, may be less if tunable */
+#define WL_PROXD_MAX_SESSIONS 16
+
+typedef uint16 wl_proxd_session_id_t;
+
+/* status - TBD BCME_ vs proxd status - range reserved for BCME_ */
+enum {
+       WL_PROXD_E_POLICY                       = -1045,
+       WL_PROXD_E_INCOMPLETE           = -1044,
+       WL_PROXD_E_OVERRIDDEN           = -1043,
+       WL_PROXD_E_ASAP_FAILED          = -1042,
+       WL_PROXD_E_NOTSTARTED           = -1041,
+       WL_PROXD_E_INVALIDAVB           = -1040,
+       WL_PROXD_E_INCAPABLE            = -1039,
+       WL_PROXD_E_MISMATCH                     = -1038,
+       WL_PROXD_E_DUP_SESSION          = -1037,
+       WL_PROXD_E_REMOTE_FAIL          = -1036,
+       WL_PROXD_E_REMOTE_INCAPABLE = -1035,
+       WL_PROXD_E_SCHED_FAIL           = -1034,
+       WL_PROXD_E_PROTO                        = -1033,
+       WL_PROXD_E_EXPIRED                      = -1032,
+       WL_PROXD_E_TIMEOUT                      = -1031,
+       WL_PROXD_E_NOACK                        = -1030,
+       WL_PROXD_E_DEFERRED                     = -1029,
+       WL_PROXD_E_INVALID_SID          = -1028,
+       WL_PROXD_E_REMOTE_CANCEL        = -1027,
+       WL_PROXD_E_CANCELED                     = -1026,        /* local */
+       WL_PROXD_E_INVALID_SESSION      = -1025,
+       WL_PROXD_E_BAD_STATE            = -1024,
+       WL_PROXD_E_ERROR                        = -1,
+       WL_PROXD_E_OK                           = 0
+};
+typedef int32 wl_proxd_status_t;
+
+/* session states */
+enum {
+       WL_PROXD_SESSION_STATE_NONE                             = 0,
+       WL_PROXD_SESSION_STATE_CREATED                  = 1,
+       WL_PROXD_SESSION_STATE_CONFIGURED               = 2,
+       WL_PROXD_SESSION_STATE_STARTED                  = 3,
+       WL_PROXD_SESSION_STATE_DELAY                    = 4,
+       WL_PROXD_SESSION_STATE_USER_WAIT                = 5,
+       WL_PROXD_SESSION_STATE_SCHED_WAIT               = 6,
+       WL_PROXD_SESSION_STATE_BURST                    = 7,
+       WL_PROXD_SESSION_STATE_STOPPING                 = 8,
+       WL_PROXD_SESSION_STATE_ENDED                    = 9,
+       WL_PROXD_SESSION_STATE_DESTROYING               = -1
+};
+typedef int16 wl_proxd_session_state_t;
+
+/* RTT sample flags */
+enum {
+       WL_PROXD_RTT_SAMPLE_NONE                = 0x00,
+       WL_PROXD_RTT_SAMPLE_DISCARD     = 0x01
+};
+typedef uint8 wl_proxd_rtt_sample_flags_t;
+
+typedef struct wl_proxd_rtt_sample {
+       uint8                           id;                     /* id for the sample - non-zero */
+       wl_proxd_rtt_sample_flags_t     flags;
+       int16                           rssi;
+       wl_proxd_intvl_t        rtt;            /* round trip time */
+       uint32                          ratespec;
+} wl_proxd_rtt_sample_t;
+
+/*  result flags */
+enum {
+       WL_PRXOD_RESULT_FLAG_NONE       = 0x0000,
+       WL_PROXD_RESULT_FLAG_NLOS       = 0x0001,       /* LOS - if available */
+       WL_PROXD_RESULT_FLAG_LOS    = 0x0002,   /* NLOS - if available */
+       WL_PROXD_RESULT_FLAG_FATAL      = 0x0004,       /* Fatal error during burst */
+       WL_PROXD_RESULT_FLAG_ALL        = 0xffff
+};
+typedef int16 wl_proxd_result_flags_t;
+
+/* rtt measurement result */
+typedef struct wl_proxd_rtt_result {
+       wl_proxd_session_id_t                   sid;
+       wl_proxd_result_flags_t                 flags;
+       wl_proxd_status_t                               status;
+       struct ether_addr                               peer;
+       wl_proxd_session_state_t                state;          /* current state */
+       union {
+               wl_proxd_intvl_t                        retry_after; /* hint for errors */
+               wl_proxd_intvl_t                        burst_duration; /* burst duration */
+       } u;
+       wl_proxd_rtt_sample_t                   avg_rtt;
+       uint32                                                  avg_dist;       /* 1/256m units */
+       uint16                                                  sd_rtt; /* RTT standard deviation */
+       uint8                                           num_valid_rtt; /* valid rtt cnt */
+       uint8                                           num_ftm; /* actual num of ftm cnt */
+       uint16                                                  burst_num;      /* in a session */
+       uint16                                                  num_rtt;        /* 0 if no detail */
+       wl_proxd_rtt_sample_t                   rtt[1];         /* variable */
+} wl_proxd_rtt_result_t;
+
+/* aoa measurement result */
+typedef struct wl_proxd_aoa_result {
+       wl_proxd_session_id_t                   sid;
+       wl_proxd_result_flags_t                 flags;
+       wl_proxd_status_t                               status;
+       struct ether_addr                               peer;
+       wl_proxd_session_state_t                state;
+       uint16                                                  burst_num;
+       uint8                                                   pad[2];
+       /* wl_proxd_aoa_sample_t sample_avg; TBD */
+} BWL_POST_PACKED_STRUCT wl_proxd_aoa_result_t;
+
+/* global stats */
+typedef struct wl_proxd_counters {
+       uint32 tx;                                      /* tx frame count */
+       uint32 rx;                                      /* rx frame count */
+       uint32 burst;                           /* total number of burst */
+       uint32 sessions;                        /* total number of sessions */
+       uint32 max_sessions;            /* max concurrency */
+       uint32 sched_fail;                      /* scheduling failures */
+       uint32 timeouts;                        /* timeouts */
+       uint32 protoerr;                        /* protocol errors */
+       uint32 noack;                           /* tx w/o ack */
+       uint32 txfail;                          /* any tx falure */
+       uint32 lci_req_tx;                      /* tx LCI requests */
+       uint32 lci_req_rx;                      /* rx LCI requests */
+       uint32 lci_rep_tx;                      /* tx LCI reports */
+       uint32 lci_rep_rx;                      /* rx LCI reports */
+       uint32 civic_req_tx;            /* tx civic requests */
+       uint32 civic_req_rx;            /* rx civic requests */
+       uint32 civic_rep_tx;            /* tx civic reports */
+       uint32 civic_rep_rx;            /* rx civic reports */
+       uint32 rctx;                            /* ranging contexts created */
+       uint32 rctx_done;                       /* count of ranging done */
+       uint32 publish_err;     /* availability publishing errors */
+       uint32 on_chan;         /* count of scheduler onchan */
+       uint32 off_chan;        /* count of scheduler offchan */
+} wl_proxd_counters_t;
+
+typedef struct wl_proxd_counters wl_proxd_session_counters_t;
+
+enum {
+       WL_PROXD_CAP_NONE               = 0x0000,
+       WL_PROXD_CAP_ALL                = 0xffff
+};
+typedef int16 wl_proxd_caps_t;
+
+/* method capabilities */
+enum {
+       WL_PROXD_FTM_CAP_NONE = 0x0000,
+       WL_PROXD_FTM_CAP_FTM1 = 0x0001
+};
+typedef uint16 wl_proxd_ftm_caps_t;
+
+typedef struct BWL_PRE_PACKED_STRUCT wl_proxd_tlv_id_list {
+       uint16                  num_ids;
+       uint16                  ids[1];
+} BWL_POST_PACKED_STRUCT wl_proxd_tlv_id_list_t;
+
+typedef struct wl_proxd_session_id_list {
+       uint16 num_ids;
+       wl_proxd_session_id_t ids[1];
+} wl_proxd_session_id_list_t;
+
+/* tlvs returned for get_info on ftm method
+ * configuration:
+ *             proxd flags
+ *     event mask
+ *     debug mask
+ *     session defaults (session tlvs)
+ * status tlv - not supported for ftm method
+ * info tlv
+ */
+typedef struct wl_proxd_ftm_info {
+       wl_proxd_ftm_caps_t caps;
+       uint16 max_sessions;
+       uint16 num_sessions;
+       uint16 rx_max_burst;
+} wl_proxd_ftm_info_t;
+
+/* tlvs returned for get_info on session
+ * session config (tlvs)
+ * session info tlv
+ */
+typedef struct wl_proxd_ftm_session_info {
+       uint16 sid;
+       uint8 bss_index;
+       uint8 pad;
+       struct ether_addr bssid;
+       wl_proxd_session_state_t state;
+       wl_proxd_status_t status;
+       uint16  burst_num;
+} wl_proxd_ftm_session_info_t;
+
+typedef struct wl_proxd_ftm_session_status {
+       uint16 sid;
+       wl_proxd_session_state_t state;
+       wl_proxd_status_t status;
+       uint16  burst_num;
+} wl_proxd_ftm_session_status_t;
+
+/* rrm range request */
+typedef struct wl_proxd_range_req {
+       uint16                  num_repeat;
+       uint16                  init_delay_range;       /* in TUs */
+       uint8                   pad;
+       uint8                   num_nbr;                        /* number of (possible) neighbors */
+       nbr_element_t   nbr[1];
+} wl_proxd_range_req_t;
+
+#define WL_PROXD_LCI_LAT_OFF   0
+#define WL_PROXD_LCI_LONG_OFF  5
+#define WL_PROXD_LCI_ALT_OFF   10
+
+#define WL_PROXD_LCI_GET_LAT(_lci, _lat, _lat_err) { \
+       unsigned _off = WL_PROXD_LCI_LAT_OFF; \
+       _lat_err = (_lci)->data[(_off)] & 0x3f; \
+       _lat = (_lci)->data[(_off)+1]; \
+       _lat |= (_lci)->data[(_off)+2] << 8; \
+       _lat |= (_lci)->data[_(_off)+3] << 16; \
+       _lat |= (_lci)->data[(_off)+4] << 24; \
+       _lat <<= 2; \
+       _lat |= (_lci)->data[(_off)] >> 6; \
+}
+
+#define WL_PROXD_LCI_GET_LONG(_lci, _lcilong, _long_err) { \
+       unsigned _off = WL_PROXD_LCI_LONG_OFF; \
+       _long_err = (_lci)->data[(_off)] & 0x3f; \
+       _lcilong = (_lci)->data[(_off)+1]; \
+       _lcilong |= (_lci)->data[(_off)+2] << 8; \
+       _lcilong |= (_lci)->data[_(_off)+3] << 16; \
+       _lcilong |= (_lci)->data[(_off)+4] << 24; \
+       __lcilong <<= 2; \
+       _lcilong |= (_lci)->data[(_off)] >> 6; \
+}
+
+#define WL_PROXD_LCI_GET_ALT(_lci, _alt_type, _alt, _alt_err) { \
+       unsigned _off = WL_PROXD_LCI_ALT_OFF; \
+       _alt_type = (_lci)->data[_off] & 0x0f; \
+       _alt_err = (_lci)->data[(_off)] >> 4; \
+       _alt_err |= ((_lci)->data[(_off)+1] & 0x03) << 4; \
+       _alt = (_lci)->data[(_off)+2]; \
+       _alt |= (_lci)->data[(_off)+3] << 8; \
+       _alt |= (_lci)->data[_(_off)+4] << 16; \
+       _alt <<= 6; \
+       _alt |= (_lci)->data[(_off) + 1] >> 2; \
+}
+
+#define WL_PROXD_LCI_VERSION(_lci) ((_lci)->data[15] >> 6)
+
+/* availability. advertising mechanism bss specific */
+/* availablity flags */
+enum {
+       WL_PROXD_AVAIL_NONE = 0,
+       WL_PROXD_AVAIL_NAN_PUBLISHED = 0x0001,
+       WL_PROXD_AVAIL_SCHEDULED = 0x0002        /* scheduled by proxd */
+};
+typedef int16 wl_proxd_avail_flags_t;
+
+/* time reference */
+enum {
+       WL_PROXD_TREF_NONE = 0,
+       WL_PROXD_TREF_DEV_TSF = 1,
+       WL_PROXD_TREF_NAN_DW = 2,
+       WL_PROXD_TREF_TBTT = 3,
+       WL_PROXD_TREF_MAX               /* last entry */
+};
+typedef int16 wl_proxd_time_ref_t;
+
+/* proxd channel-time slot */
+typedef struct {
+       wl_proxd_intvl_t start;         /* from ref */
+       wl_proxd_intvl_t duration;      /* from start */
+       uint32  chanspec;
+} wl_proxd_time_slot_t;
+
+typedef struct wl_proxd_avail24 {
+       wl_proxd_avail_flags_t flags; /* for query only */
+       wl_proxd_time_ref_t time_ref;
+       uint16  max_slots; /* for query only */
+       uint16  num_slots;
+       wl_proxd_time_slot_t slots[1];  /* ROM compat - not used */
+       wl_proxd_intvl_t        repeat;
+       wl_proxd_time_slot_t ts0[1];
+} wl_proxd_avail24_t;
+#define WL_PROXD_AVAIL24_TIMESLOT(_avail24, _i) (&(_avail24)->ts0[(_i)])
+#define WL_PROXD_AVAIL24_TIMESLOT_OFFSET(_avail24) OFFSETOF(wl_proxd_avail24_t, ts0)
+#define WL_PROXD_AVAIL24_TIMESLOTS(_avail24) WL_PROXD_AVAIL24_TIMESLOT(_avail24, 0)
+#define WL_PROXD_AVAIL24_SIZE(_avail24, _num_slots) (\
+       WL_PROXD_AVAIL24_TIMESLOT_OFFSET(_avail24) + \
+       (_num_slots) * sizeof(*WL_PROXD_AVAIL24_TIMESLOT(_avail24, 0)))
+
+typedef struct wl_proxd_avail {
+       wl_proxd_avail_flags_t flags; /* for query only */
+       wl_proxd_time_ref_t time_ref;
+       uint16  max_slots; /* for query only */
+       uint16  num_slots;
+       wl_proxd_intvl_t        repeat;
+       wl_proxd_time_slot_t slots[1];
+} wl_proxd_avail_t;
+#define WL_PROXD_AVAIL_TIMESLOT(_avail, _i) (&(_avail)->slots[(_i)])
+#define WL_PROXD_AVAIL_TIMESLOT_OFFSET(_avail) OFFSETOF(wl_proxd_avail_t, slots)
+
+#define WL_PROXD_AVAIL_TIMESLOTS(_avail) WL_PROXD_AVAIL_TIMESLOT(_avail, 0)
+#define WL_PROXD_AVAIL_SIZE(_avail, _num_slots) (\
+       WL_PROXD_AVAIL_TIMESLOT_OFFSET(_avail) + \
+       (_num_slots) * sizeof(*WL_PROXD_AVAIL_TIMESLOT(_avail, 0)))
+
+/* collect support TBD */
+
+/* debugging */
+enum {
+       WL_PROXD_DEBUG_NONE             = 0x00000000,
+       WL_PROXD_DEBUG_LOG              = 0x00000001,
+       WL_PROXD_DEBUG_IOV              = 0x00000002,
+       WL_PROXD_DEBUG_EVENT    = 0x00000004,
+       WL_PROXD_DEBUG_SESSION  = 0x00000008,
+       WL_PROXD_DEBUG_PROTO    = 0x00000010,
+       WL_PROXD_DEBUG_SCHED    = 0x00000020,
+       WL_PROXD_DEBUG_RANGING  = 0x00000040,
+       WL_PROXD_DEBUG_ALL              = 0xffffffff
+};
+typedef uint32 wl_proxd_debug_mask_t;
+
+/* tlv IDs - data length 4 bytes unless overridden by type, alignment 32 bits */
+enum {
+       WL_PROXD_TLV_ID_NONE                    = 0,
+       WL_PROXD_TLV_ID_METHOD                  = 1,
+       WL_PROXD_TLV_ID_FLAGS                   = 2,
+       WL_PROXD_TLV_ID_CHANSPEC                = 3,    /* note: uint32 */
+       WL_PROXD_TLV_ID_TX_POWER                = 4,
+       WL_PROXD_TLV_ID_RATESPEC                = 5,
+       WL_PROXD_TLV_ID_BURST_DURATION  = 6,    /* intvl - length of burst */
+       WL_PROXD_TLV_ID_BURST_PERIOD    = 7,    /* intvl - between bursts */
+       WL_PROXD_TLV_ID_BURST_FTM_SEP   = 8,    /* intvl - between FTMs */
+       WL_PROXD_TLV_ID_BURST_NUM_FTM   = 9,    /* uint16 - per burst */
+       WL_PROXD_TLV_ID_NUM_BURST               = 10,   /* uint16 */
+       WL_PROXD_TLV_ID_FTM_RETRIES     = 11,   /* uint16 at FTM level */
+       WL_PROXD_TLV_ID_BSS_INDEX               = 12,   /* uint8 */
+       WL_PROXD_TLV_ID_BSSID                   = 13,
+       WL_PROXD_TLV_ID_INIT_DELAY              = 14,   /* intvl - optional, non-standalone only */
+       WL_PROXD_TLV_ID_BURST_TIMEOUT   = 15,   /* expect response within - intvl */
+       WL_PROXD_TLV_ID_EVENT_MASK              = 16,   /* interested events - in/out */
+       WL_PROXD_TLV_ID_FLAGS_MASK              = 17,   /* interested flags - in only */
+       WL_PROXD_TLV_ID_PEER_MAC                = 18,   /* mac address of peer */
+       WL_PROXD_TLV_ID_FTM_REQ                 = 19,   /* dot11_ftm_req */
+       WL_PROXD_TLV_ID_LCI_REQ                 = 20,
+       WL_PROXD_TLV_ID_LCI                     = 21,
+       WL_PROXD_TLV_ID_CIVIC_REQ               = 22,
+       WL_PROXD_TLV_ID_CIVIC                   = 23,
+       WL_PROXD_TLV_ID_AVAIL24                 = 24,           /* ROM compatibility */
+       WL_PROXD_TLV_ID_SESSION_FLAGS   = 25,
+       WL_PROXD_TLV_ID_SESSION_FLAGS_MASK      = 26,   /* in only */
+       WL_PROXD_TLV_ID_RX_MAX_BURST = 27,              /* uint16 - limit bursts per session */
+       WL_PROXD_TLV_ID_RANGING_INFO    = 28,   /* ranging info */
+       WL_PROXD_TLV_ID_RANGING_FLAGS   = 29,   /* uint16 */
+       WL_PROXD_TLV_ID_RANGING_FLAGS_MASK      = 30,   /* uint16, in only */
+       WL_PROXD_TLV_ID_NAN_MAP_ID          = 31,
+       WL_PROXD_TLV_ID_DEV_ADDR            = 32,
+       WL_PROXD_TLV_ID_AVAIL                   = 33,           /* wl_proxd_avail_t  */
+       WL_PROXD_TLV_ID_TLV_ID        = 34,    /* uint16 tlv-id */
+       WL_PROXD_TLV_ID_FTM_REQ_RETRIES  = 35, /* uint16 FTM request retries */
+
+       /* output - 512 + x */
+       WL_PROXD_TLV_ID_STATUS                  = 512,
+       WL_PROXD_TLV_ID_COUNTERS                = 513,
+       WL_PROXD_TLV_ID_INFO                    = 514,
+       WL_PROXD_TLV_ID_RTT_RESULT              = 515,
+       WL_PROXD_TLV_ID_AOA_RESULT              = 516,
+       WL_PROXD_TLV_ID_SESSION_INFO    = 517,
+       WL_PROXD_TLV_ID_SESSION_STATUS  = 518,
+       WL_PROXD_TLV_ID_SESSION_ID_LIST = 519,
+
+       /* debug tlvs can be added starting 1024 */
+       WL_PROXD_TLV_ID_DEBUG_MASK      = 1024,
+       WL_PROXD_TLV_ID_COLLECT         = 1025,         /* output only */
+       WL_PROXD_TLV_ID_STRBUF          = 1026,
+
+       WL_PROXD_TLV_ID_MAX
+};
+
+typedef struct wl_proxd_tlv {
+       uint16 id;
+       uint16 len;
+       uint8  data[1];
+} wl_proxd_tlv_t;
+
+/* proxd iovar - applies to proxd, method or session */
+typedef struct wl_proxd_iov {
+       uint16                                  version;
+       uint16                                  len;
+       wl_proxd_cmd_t                  cmd;
+       wl_proxd_method_t               method;
+       wl_proxd_session_id_t   sid;
+       uint8                                   pad[2];
+       wl_proxd_tlv_t                  tlvs[1];        /* variable */
+} wl_proxd_iov_t;
+
+#define WL_PROXD_IOV_HDR_SIZE OFFSETOF(wl_proxd_iov_t, tlvs)
+
+/* The following event definitions may move to bcmevent.h, but sharing proxd types
+ * across needs more invasive changes unrelated to proxd
+ */
+enum {
+       WL_PROXD_EVENT_NONE                             = 0,    /* not an event, reserved */
+       WL_PROXD_EVENT_SESSION_CREATE   = 1,
+       WL_PROXD_EVENT_SESSION_START    = 2,
+       WL_PROXD_EVENT_FTM_REQ                  = 3,
+       WL_PROXD_EVENT_BURST_START              = 4,
+       WL_PROXD_EVENT_BURST_END                = 5,
+       WL_PROXD_EVENT_SESSION_END              = 6,
+       WL_PROXD_EVENT_SESSION_RESTART  = 7,
+       WL_PROXD_EVENT_BURST_RESCHED    = 8,    /* burst rescheduled - e.g. partial TSF */
+       WL_PROXD_EVENT_SESSION_DESTROY  = 9,
+       WL_PROXD_EVENT_RANGE_REQ                = 10,
+       WL_PROXD_EVENT_FTM_FRAME                = 11,
+       WL_PROXD_EVENT_DELAY                    = 12,
+       WL_PROXD_EVENT_VS_INITIATOR_RPT = 13,   /* (target) rx initiator-report */
+       WL_PROXD_EVENT_RANGING                  = 14,
+       WL_PROXD_EVENT_LCI_MEAS_REP     = 15,   /* LCI measurement report */
+       WL_PROXD_EVENT_CIVIC_MEAS_REP   = 16,   /* civic measurement report */
+
+       WL_PROXD_EVENT_MAX
+};
+typedef int16 wl_proxd_event_type_t;
+
+/* proxd event mask - upto 32 events for now */
+typedef uint32 wl_proxd_event_mask_t;
+
+#define WL_PROXD_EVENT_MASK_ALL 0xfffffffe
+#define WL_PROXD_EVENT_MASK_EVENT(_event_type) (1 << (_event_type))
+#define WL_PROXD_EVENT_ENABLED(_mask, _event_type) (\
+       ((_mask) & WL_PROXD_EVENT_MASK_EVENT(_event_type)) != 0)
+
+/* proxd event - applies to proxd, method or session */
+typedef struct wl_proxd_event {
+       uint16                                  version;
+       uint16                                  len;
+       wl_proxd_event_type_t   type;
+       wl_proxd_method_t               method;
+       wl_proxd_session_id_t   sid;
+       uint8                                   pad[2];
+       wl_proxd_tlv_t                  tlvs[1];        /* variable */
+} wl_proxd_event_t;
+
+enum {
+       WL_PROXD_RANGING_STATE_NONE = 0,
+       WL_PROXD_RANGING_STATE_NOTSTARTED = 1,
+       WL_PROXD_RANGING_STATE_INPROGRESS = 2,
+       WL_PROXD_RANGING_STATE_DONE = 3
+};
+typedef int16 wl_proxd_ranging_state_t;
+
+/* proxd ranging flags */
+enum {
+       WL_PROXD_RANGING_FLAG_NONE = 0x0000,  /* no flags */
+       WL_PROXD_RANGING_FLAG_DEL_SESSIONS_ON_STOP = 0x0001,
+       WL_PROXD_RANGING_FLAG_ALL = 0xffff
+};
+typedef uint16 wl_proxd_ranging_flags_t;
+
+struct wl_proxd_ranging_info {
+       wl_proxd_status_t   status;
+       wl_proxd_ranging_state_t state;
+       wl_proxd_ranging_flags_t flags;
+       uint16  num_sids;
+       uint16  num_done;
+};
+typedef struct wl_proxd_ranging_info wl_proxd_ranging_info_t;
+#include <packed_section_end.h>
+/* end proxd definitions */
+
+/* require strict packing */
+#include <packed_section_start.h>
+/* Data returned by the bssload_report iovar.
+ * This is also the WLC_E_BSS_LOAD event data.
+ */
+typedef BWL_PRE_PACKED_STRUCT struct wl_bssload {
+       uint16 sta_count;               /* station count */
+       uint16 aac;                     /* available admission capacity */
+       uint8 chan_util;                /* channel utilization */
+} BWL_POST_PACKED_STRUCT wl_bssload_t;
+
+/* Maximum number of configurable BSS Load levels.  The number of BSS Load
+ * ranges is always 1 more than the number of configured levels.  eg. if
+ * 3 levels of 10, 20, 30 are configured then this defines 4 load ranges:
+ * 0-10, 11-20, 21-30, 31-255.  A WLC_E_BSS_LOAD event is generated each time
+ * the utilization level crosses into another range, subject to the rate limit.
+ */
+#define MAX_BSSLOAD_LEVELS 8
+#define MAX_BSSLOAD_RANGES (MAX_BSSLOAD_LEVELS + 1)
+
+/* BSS Load event notification configuration. */
+typedef struct wl_bssload_cfg {
+       uint32 rate_limit_msec; /* # of events posted to application will be limited to
+                                * one per specified period (0 to disable rate limit).
+                                */
+       uint8 num_util_levels;  /* Number of entries in util_levels[] below */
+       uint8 util_levels[MAX_BSSLOAD_LEVELS];
+                               /* Variable number of BSS Load utilization levels in
+                                * low to high order.  An event will be posted each time
+                                * a received beacon's BSS Load IE channel utilization
+                                * value crosses a level.
+                                */
+} wl_bssload_cfg_t;
+
+/* Multiple roaming profile suport */
+#define WL_MAX_ROAM_PROF_BRACKETS      4
+
+#define WL_MAX_ROAM_PROF_VER   1
+
+#define WL_ROAM_PROF_NONE      (0 << 0)
+#define WL_ROAM_PROF_LAZY      (1 << 0)
+#define WL_ROAM_PROF_NO_CI     (1 << 1)
+#define WL_ROAM_PROF_SUSPEND   (1 << 2)
+#define WL_ROAM_PROF_SYNC_DTIM (1 << 6)
+#define WL_ROAM_PROF_DEFAULT   (1 << 7)        /* backward compatible single default profile */
+
+#define WL_FACTOR_TABLE_MAX_LIMIT 5
+
+typedef struct wl_roam_prof {
+       int8    roam_flags;             /* bit flags */
+       int8    roam_trigger;           /* RSSI trigger level per profile/RSSI bracket */
+       int8    rssi_lower;
+       int8    roam_delta;
+       int8    rssi_boost_thresh;      /* Min RSSI to qualify for RSSI boost */
+       int8    rssi_boost_delta;       /* RSSI boost for AP in the other band */
+       uint16  nfscan;                 /* nuber of full scan to start with */
+       uint16  fullscan_period;
+       uint16  init_scan_period;
+       uint16  backoff_multiplier;
+       uint16  max_scan_period;
+       uint8           channel_usage;
+       uint8           cu_avg_calc_dur;
+} wl_roam_prof_t;
+
+typedef struct wl_roam_prof_band {
+       uint32  band;                   /* Must be just one band */
+       uint16  ver;                    /* version of this struct */
+       uint16  len;                    /* length in bytes of this structure */
+       wl_roam_prof_t roam_prof[WL_MAX_ROAM_PROF_BRACKETS];
+} wl_roam_prof_band_t;
+
+/* Data structures for Interface Create/Remove  */
+
+#define WL_INTERFACE_CREATE_VER        (0)
+
+/*
+ * The flags filed of the wl_interface_create is designed to be
+ * a Bit Mask. As of now only Bit 0 and Bit 1 are used as mentioned below.
+ * The rest of the bits can be used, incase we have to provide
+ * more information to the dongle
+ */
+
+/*
+ * Bit 0 of flags field is used to inform whether the interface requested to
+ * be created is STA or AP.
+ * 0 - Create a STA interface
+ * 1 - Create an AP interface
+ */
+#define WL_INTERFACE_CREATE_STA        (0 << 0)
+#define WL_INTERFACE_CREATE_AP (1 << 0)
+
+/*
+ * Bit 1 of flags field is used to inform whether MAC is present in the
+ * data structure or not.
+ * 0 - Ignore mac_addr field
+ * 1 - Use the mac_addr field
+ */
+#define WL_INTERFACE_MAC_DONT_USE      (0 << 1)
+#define WL_INTERFACE_MAC_USE           (1 << 1)
+
+typedef struct wl_interface_create {
+       uint16  ver;                    /* version of this struct */
+       uint32  flags;                  /* flags that defines the operation */
+       struct  ether_addr   mac_addr;  /* Optional Mac address */
+} wl_interface_create_t;
+
+typedef struct wl_interface_info {
+       uint16  ver;                    /* version of this struct */
+       struct ether_addr    mac_addr;  /* MAC address of the interface */
+       char    ifname[BCM_MSG_IFNAME_MAX]; /* name of interface */
+       uint8   bsscfgidx;              /* source bsscfg index */
+} wl_interface_info_t;
+
+/* no default structure packing */
+#include <packed_section_end.h>
+
+#define TBOW_MAX_SSID_LEN        32
+#define TBOW_MAX_PASSPHRASE_LEN  63
+
+#define WL_TBOW_SETUPINFO_T_VERSION 1 /* version of tbow_setup_netinfo_t */
+typedef struct tbow_setup_netinfo {
+       uint32 version;
+       uint8 opmode;
+       uint8 pad;
+       uint8 macaddr[ETHER_ADDR_LEN];
+       uint32 ssid_len;
+       uint8 ssid[TBOW_MAX_SSID_LEN];
+       uint8 passphrase_len;
+       uint8 passphrase[TBOW_MAX_PASSPHRASE_LEN];
+       chanspec_t chanspec;
+} tbow_setup_netinfo_t;
+
+typedef enum tbow_ho_opmode {
+       TBOW_HO_MODE_START_GO = 0,
+       TBOW_HO_MODE_START_STA,
+       TBOW_HO_MODE_START_GC,
+       TBOW_HO_MODE_TEST_GO,
+       TBOW_HO_MODE_STOP_GO = 0x10,
+       TBOW_HO_MODE_STOP_STA,
+       TBOW_HO_MODE_STOP_GC,
+       TBOW_HO_MODE_TEARDOWN
+} tbow_ho_opmode_t;
+
+/* Beacon trim feature statistics */
+/* Configuration params */
+#define M_BCNTRIM_N                            (0)     /* Enable/Disable Beacon Trim */
+#define M_BCNTRIM_TIMEND               (1)     /* Waiting time for TIM IE to end */
+#define M_BCNTRIM_TSFTLRN              (2)     /* TSF tolerance value (usecs) */
+/* PSM internal use */
+#define M_BCNTRIM_PREVBCNLEN   (3)     /* Beacon length excluding the TIM IE */
+#define M_BCNTRIM_N_COUNTER            (4)     /* PSM's local beacon trim counter */
+#define M_BCNTRIM_STATE                        (5)     /* PSM's Beacon trim status register */
+#define M_BCNTRIM_TIMLEN               (6)     /* TIM IE Length */
+#define M_BCNTRIM_BMPCTL               (7)     /* Bitmap control word */
+#define M_BCNTRIM_TSF_L                        (8)     /* Lower TSF word */
+#define M_BCNTRIM_TSF_ML               (9)     /* Lower middle TSF word */
+#define M_BCNTRIM_RSSI                 (10) /* Partial beacon RSSI */
+#define M_BCNTRIM_CHANNEL              (11) /* Partial beacon channel */
+/* Trimming Counters */
+#define M_BCNTRIM_SBCNRXED             (12) /* Self-BSSID beacon received */
+#define M_BCNTRIM_CANTRIM              (13) /* Num of beacons which can be trimmed */
+#define M_BCNTRIM_TRIMMED              (14) /* # beacons which were trimmed */
+#define M_BCNTRIM_BCNLENCNG            (15) /* # beacons trimmed due to length change */
+#define M_BCNTRIM_TSFADJ               (16) /* # beacons not trimmed due to large TSF delta */
+#define M_BCNTRIM_TIMNOTFOUND  (17) /* # beacons not trimmed due to TIM missing */
+#define M_RXTSFTMRVAL_WD0              (18)
+#define M_RXTSFTMRVAL_WD1              (19)
+#define M_RXTSFTMRVAL_WD2              (20)
+#define M_RXTSFTMRVAL_WD3              (21)
+#define BCNTRIM_STATS_NUMPARAMS        (22) /* 16 bit words */
+
+#define TXPWRCAP_MAX_NUM_CORES 8
+#define TXPWRCAP_MAX_NUM_ANTENNAS (TXPWRCAP_MAX_NUM_CORES * 2)
+
+typedef struct wl_txpwrcap_tbl {
+       uint8 num_antennas_per_core[TXPWRCAP_MAX_NUM_CORES];
+       /* Stores values for valid antennas */
+       int8 pwrcap_cell_on[TXPWRCAP_MAX_NUM_ANTENNAS]; /* qdBm units */
+       int8 pwrcap_cell_off[TXPWRCAP_MAX_NUM_ANTENNAS]; /* qdBm units */
+} wl_txpwrcap_tbl_t;
+
+/* -------------- dynamic BTCOEX --------------- */
+/* require strict packing */
+#include <packed_section_start.h>
+
+#define DCTL_TROWS     2       /* currently practical number of rows  */
+#define DCTL_TROWS_MAX 4       /*  2 extra rows RFU */
+/* DYNCTL profile flags */
+#define DCTL_FLAGS_DYNCTL      (1 << 0)        /*  1 - enabled, 0 - legacy only */
+#define DCTL_FLAGS_DESENSE     (1 << 1)        /* auto desense is enabled */
+#define DCTL_FLAGS_MSWITCH     (1 << 2)        /* mode switching is enabled */
+/* for now AGG on/off is handled separately  */
+#define DCTL_FLAGS_TX_AGG_OFF  (1 << 3) /* TBD: allow TX agg Off */
+#define DCTL_FLAGS_RX_AGG_OFF  (1 << 4) /* TBD: allow RX agg Off */
+/* used for dry run testing only */
+#define DCTL_FLAGS_DRYRUN      (1 << 7) /* Eenables dynctl dry run mode  */
+#define IS_DYNCTL_ON(prof)     ((prof->flags & DCTL_FLAGS_DYNCTL) != 0)
+#define IS_DESENSE_ON(prof)    ((prof->flags & DCTL_FLAGS_DESENSE) != 0)
+#define IS_MSWITCH_ON(prof)    ((prof->flags & DCTL_FLAGS_MSWITCH) != 0)
+/* desense level currently in use */
+#define DESENSE_OFF    0
+#define DFLT_DESENSE_MID       12
+#define DFLT_DESENSE_HIGH      2
+
+/*
+ * dynctl data points(a set of btpwr & wlrssi thresholds)
+ * for mode & desense switching
+ */
+typedef struct btc_thr_data {
+       int8    mode;   /* used by desense sw */
+       int8    bt_pwr; /* BT tx power threshold */
+       int8    bt_rssi;        /* BT rssi threshold */
+       /* wl rssi range when mode or desense change may be needed */
+       int8    wl_rssi_high;
+       int8    wl_rssi_low;
+} btc_thr_data_t;
+
+/* dynctl. profile data structure  */
+#define DCTL_PROFILE_VER 0x01
+typedef BWL_PRE_PACKED_STRUCT struct  dctl_prof {
+       uint8 version;  /* dynctl profile version */
+       /* dynctl profile flags bit:0 - dynctl On, bit:1 dsns On, bit:2 mode sw On, */
+       uint8 flags;  /* bit[6:3] reserved, bit7 - Dryrun (sim) - On */
+       /*  wl desense levels to apply */
+       uint8   dflt_dsns_level;
+       uint8   low_dsns_level;
+       uint8   mid_dsns_level;
+       uint8   high_dsns_level;
+       /* mode switching hysteresis in dBm */
+       int8    msw_btrssi_hyster;
+       /* default btcoex mode */
+       uint8   default_btc_mode;
+        /* num of active rows in mode switching table */
+       uint8   msw_rows;
+       /* num of rows in desense table */
+       uint8   dsns_rows;
+       /* dynctl mode switching data table  */
+       btc_thr_data_t msw_data[DCTL_TROWS_MAX];
+       /* dynctl desense switching data table */
+       btc_thr_data_t dsns_data[DCTL_TROWS_MAX];
+} BWL_POST_PACKED_STRUCT dctl_prof_t;
+
+/*  dynctl status info */
+typedef BWL_PRE_PACKED_STRUCT struct  dynctl_status {
+       bool sim_on;    /* true if simulation is On */
+       uint16  bt_pwr_shm; /* BT per/task power as read from ucode  */
+       int8    bt_pwr;         /* BT pwr extracted & converted to dBm */
+       int8    bt_rssi;        /* BT rssi in dBm */
+       int8    wl_rssi;        /* last wl rssi reading used by btcoex */
+       uint8   dsns_level; /* current desense level */
+       uint8   btc_mode;   /* current btcoex mode */
+       /* add more status items if needed,  pad to 4 BB if needed */
+} BWL_POST_PACKED_STRUCT dynctl_status_t;
+
+/*  dynctl simulation (dryrun data) */
+typedef BWL_PRE_PACKED_STRUCT struct  dynctl_sim {
+       bool sim_on;    /* simulation mode on/off */
+       int8 btpwr;             /* simulated BT power in dBm */
+       int8 btrssi;    /* simulated BT rssi in dBm */
+       int8 wlrssi;    /* simulated WL rssi in dBm */
+} BWL_POST_PACKED_STRUCT dynctl_sim_t;
+/* no default structure packing */
+#include <packed_section_end.h>
+
+/* PTK key maintained per SCB */
+#define RSN_TEMP_ENCR_KEY_LEN 16
+typedef struct wpa_ptk {
+       uint8 kck[RSN_KCK_LENGTH]; /* EAPOL-Key Key Confirmation Key (KCK) */
+       uint8 kek[RSN_KEK_LENGTH]; /* EAPOL-Key Key Encryption Key (KEK) */
+       uint8 tk1[RSN_TEMP_ENCR_KEY_LEN]; /* Temporal Key 1 (TK1) */
+       uint8 tk2[RSN_TEMP_ENCR_KEY_LEN]; /* Temporal Key 2 (TK2) */
+} wpa_ptk_t;
+
+/* GTK key maintained per SCB */
+typedef struct wpa_gtk {
+       uint32 idx;
+       uint32 key_len;
+       uint8  key[DOT11_MAX_KEY_SIZE];
+} wpa_gtk_t;
+
+/* FBT Auth Response Data structure */
+typedef struct wlc_fbt_auth_resp {
+       uint8 macaddr[ETHER_ADDR_LEN]; /* station mac address */
+       uint8 pad[2];
+       uint8 pmk_r1_name[WPA2_PMKID_LEN];
+       wpa_ptk_t ptk; /* pairwise key */
+       wpa_gtk_t gtk; /* group key */
+       uint32 ie_len;
+       uint8 status;  /* Status of parsing FBT authentication
+                                       Request in application
+                                       */
+       uint8 ies[1]; /* IEs contains MDIE, RSNIE,
+                                       FBTIE (ANonce, SNonce,R0KH-ID, R1KH-ID)
+                                       */
+} wlc_fbt_auth_resp_t;
+
+/* FBT Action Response frame */
+typedef struct wlc_fbt_action_resp {
+       uint16 version; /* structure version */
+       uint16 length; /* length of structure */
+       uint8 macaddr[ETHER_ADDR_LEN]; /* station mac address */
+       uint8 data_len;  /* len of ie from Category */
+       uint8 data[1]; /* data contains category, action, sta address, target ap,
+                                               status code,fbt response frame body
+                                               */
+} wlc_fbt_action_resp_t;
+
+#define MACDBG_PMAC_ADDR_INPUT_MAXNUM 16
+#define MACDBG_PMAC_OBJ_TYPE_LEN 8
+
+typedef struct _wl_macdbg_pmac_param_t {
+       char type[MACDBG_PMAC_OBJ_TYPE_LEN];
+       uint8 step;
+       uint8 num;
+       uint32 bitmap;
+       bool addr_raw;
+       uint8 addr_num;
+       uint16 addr[MACDBG_PMAC_ADDR_INPUT_MAXNUM];
+} wl_macdbg_pmac_param_t;
+
+/* IOVAR 'svmp_mem' parameter. Used to read/clear svmp memory */
+typedef struct svmp_mem {
+       uint32 addr;    /* offset to read svmp memory from vasip base address */
+       uint16 len;     /* length in count of uint16's */
+       uint16 val;     /* set the range of addr/len with a value */
+} svmp_mem_t;
+
+#define WL_NAN_BAND_STR_SIZE 5       /* sizeof ("auto") */
+
+/* Definitions of different NAN Bands */
+enum {  /* mode selection for reading/writing tx iqlo cal coefficients */
+       NAN_BAND_AUTO,
+       NAN_BAND_B,
+       NAN_BAND_A,
+       NAN_BAND_INVALID = 0xFF
+};
+
+#if defined(WL_LINKSTAT)
+typedef struct {
+       uint32 preamble;
+       uint32 nss;
+       uint32 bw;
+       uint32 rateMcsIdx;
+       uint32 reserved;
+       uint32 bitrate;
+} wifi_rate;
+
+typedef struct {
+       uint16 version;
+       uint16 length;
+       uint32 tx_mpdu;
+       uint32 rx_mpdu;
+       uint32 mpdu_lost;
+       uint32 retries;
+       uint32 retries_short;
+       uint32 retries_long;
+       wifi_rate rate;
+} wifi_rate_stat_t;
+
+typedef int32 wifi_radio;
+
+typedef struct {
+       uint16 version;
+       uint16 length;
+       wifi_radio radio;
+       uint32 on_time;
+       uint32 tx_time;
+       uint32 rx_time;
+       uint32 on_time_scan;
+       uint32 on_time_nbd;
+       uint32 on_time_gscan;
+       uint32 on_time_roam_scan;
+       uint32 on_time_pno_scan;
+       uint32 on_time_hs20;
+       uint32 num_channels;
+       uint8 channels[1];
+} wifi_radio_stat;
+#endif /* WL_LINKSTAT */
+
+#ifdef WL11ULB
+/* ULB Mode configured via "ulb_mode" IOVAR */
+enum {
+    ULB_MODE_DISABLED = 0,
+    ULB_MODE_STD_ALONE_MODE = 1,    /* Standalone ULB Mode */
+    ULB_MODE_DYN_MODE = 2,      /* Dynamic ULB Mode */
+       /* Add all other enums before this */
+    MAX_SUPP_ULB_MODES
+};
+
+/* ULB BWs configured via "ulb_bw" IOVAR during Standalone Mode Only.
+ * Values of this enumeration are also used to specify 'Current Operational Bandwidth'
+ * and 'Primary Operational Bandwidth' sub-fields in 'ULB Operations' field (used in
+ * 'ULB Operations' Attribute or 'ULB Mode Switch' Attribute)
+ */
+typedef enum {
+    ULB_BW_DISABLED = 0,
+    ULB_BW_10MHZ    = 1,    /* Standalone ULB BW in 10 MHz BW */
+    ULB_BW_5MHZ = 2,    /* Standalone ULB BW in 5 MHz BW */
+    ULB_BW_2P5MHZ   = 3,    /* Standalone ULB BW in 2.5 MHz BW */
+       /* Add all other enums before this */
+    MAX_SUPP_ULB_BW
+} ulb_bw_type_t;
+#endif /* WL11ULB */
+
+#if defined(WLRCC)
+#define MAX_ROAM_CHANNEL      20
+
+typedef struct {
+       int n;
+       chanspec_t channels[MAX_ROAM_CHANNEL];
+} wl_roam_channel_list_t;
+#endif 
+
+
+/*
+ * Neighbor Discover Offload: enable NDO feature
+ * Called  by ipv6 event handler when interface comes up
+ * Set RA rate limit interval value(%)
+ */
+typedef struct nd_ra_ol_limits {
+       uint16 version;         /* version of the iovar buffer */
+       uint16 type;            /* type of data provided */
+       uint16 length;          /* length of the entire structure */
+       uint16 pad1;            /* pad union to 4 byte boundary */
+       union {
+               struct {
+                       uint16 min_time;         /* seconds, min time for RA offload hold */
+                       uint16 lifetime_percent;
+                       /* percent, lifetime percentage for offload hold time */
+               } lifetime_relative;
+               struct {
+                       uint16 hold_time;        /* seconds, RA offload hold time */
+                       uint16 pad2;             /* unused */
+               } fixed;
+       } limits;
+} nd_ra_ol_limits_t;
+
+#define ND_RA_OL_LIMITS_VER 1
+
+/* nd_ra_ol_limits sub-types */
+#define ND_RA_OL_LIMITS_REL_TYPE   0     /* relative, percent of RA lifetime */
+#define ND_RA_OL_LIMITS_FIXED_TYPE 1     /* fixed time */
+
+/* buffer lengths for the different nd_ra_ol_limits types */
+#define ND_RA_OL_LIMITS_REL_TYPE_LEN   12
+#define ND_RA_OL_LIMITS_FIXED_TYPE_LEN  10
+
+#define ND_RA_OL_SET    "SET"
+#define ND_RA_OL_GET    "GET"
+#define ND_PARAM_SIZE   50
+#define ND_VALUE_SIZE   5
+#define ND_PARAMS_DELIMETER " "
+#define ND_PARAM_VALUE_DELLIMETER   '='
+#define ND_LIMIT_STR_FMT ("%50s %50s")
+
+#define ND_RA_TYPE  "TYPE"
+#define ND_RA_MIN_TIME  "MIN"
+#define ND_RA_PER   "PER"
+#define ND_RA_HOLD  "HOLD"
+
+/*
+ * Temperature Throttling control mode
+ */
+typedef struct wl_temp_control {
+       bool enable;
+       uint16 control_bit;
+} wl_temp_control_t;
+
+/* SensorHub Iovar */
+typedef struct {
+       bool    enable;
+       uint16  cmd;
+       uint16  op_mode;
+       uint16  interval;
+} shub_control_t;
+
+#endif /* _wlioctl_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/include/wlioctl_utils.h b/drivers/net/wireless/bcmdhd_1363/include/wlioctl_utils.h
new file mode 100644 (file)
index 0000000..4d63227
--- /dev/null
@@ -0,0 +1,53 @@
+/*
+ * Custom OID/ioctl related helper functions.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: wlioctl_utils.h 555740 2015-05-11 10:16:23Z $
+ */
+
+#ifndef _wlioctl_utils_h_
+#define _wlioctl_utils_h_
+
+#include <wlioctl.h>
+
+#ifndef BCMDRIVER
+#define CCA_THRESH_MILLI       14
+#define CCA_THRESH_INTERFERE   6
+
+extern cca_congest_channel_req_t * cca_per_chan_summary(cca_congest_channel_req_t *input,
+       cca_congest_channel_req_t *avg, bool percent);
+
+extern int cca_analyze(cca_congest_channel_req_t *input[], int num_chans,
+       uint flags, chanspec_t *answer);
+#endif /* BCMDRIVER */
+
+extern int wl_cntbuf_to_xtlv_format(void *ctx, void *cntbuf,
+       int buflen, uint32 corerev);
+
+/* Get data pointer of wlc layer counters tuple from xtlv formatted counters IOVar buffer. */
+#define GET_WLCCNT_FROM_CNTBUF(cntbuf)                                         \
+               bcm_get_data_from_xtlv_buf(((wl_cnt_info_t *)cntbuf)->data,     \
+               ((wl_cnt_info_t *)cntbuf)->datalen, WL_CNT_XTLV_WLC,            \
+               NULL, BCM_XTLV_OPTION_ALIGN32)
+
+#endif /* _wlioctl_utils_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/linux_osl.c b/drivers/net/wireless/bcmdhd_1363/linux_osl.c
new file mode 100644 (file)
index 0000000..d8f7154
--- /dev/null
@@ -0,0 +1,2673 @@
+/*
+ * Linux OS Independent Layer
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: linux_osl.c 657686 2016-09-02 06:39:10Z $
+ */
+
+#define LINUX_PORT
+
+#include <typedefs.h>
+#include <bcmendian.h>
+#include <linuxver.h>
+#include <bcmdefs.h>
+
+
+#if !defined(STBLINUX)
+#if defined(__ARM_ARCH_7A__) && !defined(DHD_USE_COHERENT_MEM_FOR_RING)
+#include <asm/cacheflush.h>
+#endif /* __ARM_ARCH_7A__ && !DHD_USE_COHERENT_MEM_FOR_RING */
+#endif /* STBLINUX */
+
+#include <linux/random.h>
+
+#include <osl.h>
+#include <bcmutils.h>
+#include <linux/delay.h>
+#include <pcicfg.h>
+
+
+#ifdef BCM_SECURE_DMA
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/io.h>
+#include <linux/printk.h>
+#include <linux/errno.h>
+#include <linux/mm.h>
+#include <linux/moduleparam.h>
+#include <asm/io.h>
+#include <linux/skbuff.h>
+#include <linux/vmalloc.h>
+#include <linux/highmem.h>
+#include <linux/dma-mapping.h>
+#include <asm/memory.h>
+#if defined(__ARM_ARCH_7A__)
+#include <arch/arm/include/asm/tlbflush.h>
+#include <arch/arm/mm/mm.h>
+#endif
+#include <linux/brcmstb/cma_driver.h>
+#endif /* BCM_SECURE_DMA */
+
+#include <linux/fs.h>
+
+
+#ifdef BCM_OBJECT_TRACE
+#include <bcmutils.h>
+#endif /* BCM_OBJECT_TRACE */
+
+#define PCI_CFG_RETRY          10
+
+#define OS_HANDLE_MAGIC                0x1234abcd      /* Magic # to recognize osh */
+#define BCM_MEM_FILENAME_LEN   24              /* Mem. filename length */
+#define DUMPBUFSZ 1024
+
+/* dependancy check */
+#if !defined(BCMPCIE) && defined(DHD_USE_STATIC_CTRLBUF)
+#error "DHD_USE_STATIC_CTRLBUF suppored PCIE target only"
+#endif /* !BCMPCIE && DHD_USE_STATIC_CTRLBUF */
+
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+#ifdef DHD_USE_STATIC_CTRLBUF
+#define DHD_SKB_1PAGE_BUFSIZE  (PAGE_SIZE*1)
+#define DHD_SKB_2PAGE_BUFSIZE  (PAGE_SIZE*2)
+#define DHD_SKB_4PAGE_BUFSIZE  (PAGE_SIZE*4)
+
+#define PREALLOC_FREE_MAGIC    0xFEDC
+#define PREALLOC_USED_MAGIC    0xFCDE
+#else
+#define DHD_SKB_HDRSIZE                336
+#define DHD_SKB_1PAGE_BUFSIZE  ((PAGE_SIZE*1)-DHD_SKB_HDRSIZE)
+#define DHD_SKB_2PAGE_BUFSIZE  ((PAGE_SIZE*2)-DHD_SKB_HDRSIZE)
+#define DHD_SKB_4PAGE_BUFSIZE  ((PAGE_SIZE*4)-DHD_SKB_HDRSIZE)
+#endif /* DHD_USE_STATIC_CTRLBUF */
+
+#define STATIC_BUF_MAX_NUM     16
+#define STATIC_BUF_SIZE        (PAGE_SIZE*2)
+#define STATIC_BUF_TOTAL_LEN   (STATIC_BUF_MAX_NUM * STATIC_BUF_SIZE)
+
+typedef struct bcm_static_buf {
+       struct semaphore static_sem;
+       unsigned char *buf_ptr;
+       unsigned char buf_use[STATIC_BUF_MAX_NUM];
+} bcm_static_buf_t;
+
+static bcm_static_buf_t *bcm_static_buf = 0;
+
+#ifdef DHD_USE_STATIC_CTRLBUF
+#define STATIC_PKT_4PAGE_NUM   0
+#define DHD_SKB_MAX_BUFSIZE    DHD_SKB_2PAGE_BUFSIZE
+#elif defined(ENHANCED_STATIC_BUF)
+#define STATIC_PKT_4PAGE_NUM   1
+#define DHD_SKB_MAX_BUFSIZE    DHD_SKB_4PAGE_BUFSIZE
+#else
+#define STATIC_PKT_4PAGE_NUM   0
+#define DHD_SKB_MAX_BUFSIZE    DHD_SKB_2PAGE_BUFSIZE
+#endif /* DHD_USE_STATIC_CTRLBUF */
+
+#ifdef DHD_USE_STATIC_CTRLBUF
+#define STATIC_PKT_1PAGE_NUM   0
+#define STATIC_PKT_2PAGE_NUM   64
+#else
+#define STATIC_PKT_1PAGE_NUM   8
+#define STATIC_PKT_2PAGE_NUM   8
+#endif /* DHD_USE_STATIC_CTRLBUF */
+
+#define STATIC_PKT_1_2PAGE_NUM \
+       ((STATIC_PKT_1PAGE_NUM) + (STATIC_PKT_2PAGE_NUM))
+#define STATIC_PKT_MAX_NUM     \
+       ((STATIC_PKT_1_2PAGE_NUM) + (STATIC_PKT_4PAGE_NUM))
+
+typedef struct bcm_static_pkt {
+#ifdef DHD_USE_STATIC_CTRLBUF
+       struct sk_buff *skb_8k[STATIC_PKT_2PAGE_NUM];
+       unsigned char pkt_invalid[STATIC_PKT_2PAGE_NUM];
+       spinlock_t osl_pkt_lock;
+       uint32 last_allocated_index;
+#else
+       struct sk_buff *skb_4k[STATIC_PKT_1PAGE_NUM];
+       struct sk_buff *skb_8k[STATIC_PKT_2PAGE_NUM];
+#ifdef ENHANCED_STATIC_BUF
+       struct sk_buff *skb_16k;
+#endif /* ENHANCED_STATIC_BUF */
+       struct semaphore osl_pkt_sem;
+#endif /* DHD_USE_STATIC_CTRLBUF */
+       unsigned char pkt_use[STATIC_PKT_MAX_NUM];
+} bcm_static_pkt_t;
+
+static bcm_static_pkt_t *bcm_static_skb = 0;
+
+void* wifi_platform_prealloc(void *adapter, int section, unsigned long size);
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+
+typedef struct bcm_mem_link {
+       struct bcm_mem_link *prev;
+       struct bcm_mem_link *next;
+       uint    size;
+       int     line;
+       void    *osh;
+       char    file[BCM_MEM_FILENAME_LEN];
+} bcm_mem_link_t;
+
+struct osl_cmn_info {
+       atomic_t malloced;
+       atomic_t pktalloced;    /* Number of allocated packet buffers */
+       spinlock_t dbgmem_lock;
+       bcm_mem_link_t *dbgmem_list;
+       spinlock_t pktalloc_lock;
+       atomic_t refcount; /* Number of references to this shared structure. */
+};
+typedef struct osl_cmn_info osl_cmn_t;
+
+struct osl_info {
+       osl_pubinfo_t pub;
+       uint32  flags;          /* If specific cases to be handled in the OSL */
+#ifdef CTFPOOL
+       ctfpool_t *ctfpool;
+#endif /* CTFPOOL */
+       uint magic;
+       void *pdev;
+       uint failed;
+       uint bustype;
+       osl_cmn_t *cmn; /* Common OSL related data shred between two OSH's */
+
+       void *bus_handle;
+#ifdef BCMDBG_CTRACE
+       spinlock_t ctrace_lock;
+       struct list_head ctrace_list;
+       int ctrace_num;
+#endif /* BCMDBG_CTRACE */
+#ifdef BCM_SECURE_DMA
+       struct cma_dev *cma;
+       struct sec_mem_elem *sec_list_512;
+       struct sec_mem_elem *sec_list_base_512;
+       struct sec_mem_elem *sec_list_2048;
+       struct sec_mem_elem *sec_list_base_2048;
+       struct sec_mem_elem *sec_list_4096;
+       struct sec_mem_elem *sec_list_base_4096;
+       phys_addr_t  contig_base;
+       void *contig_base_va;
+       phys_addr_t  contig_base_alloc;
+       void *contig_base_alloc_va;
+       phys_addr_t contig_base_alloc_coherent;
+       void *contig_base_alloc_coherent_va;
+       phys_addr_t contig_delta_va_pa;
+       struct {
+               phys_addr_t pa;
+               void *va;
+               bool avail;
+       } sec_cma_coherent[SEC_CMA_COHERENT_MAX];
+
+#endif /* BCM_SECURE_DMA */
+};
+#ifdef BCM_SECURE_DMA
+phys_addr_t g_contig_delta_va_pa;
+static void osl_sec_dma_setup_contig_mem(osl_t *osh, unsigned long memsize, int regn);
+static int osl_sec_dma_alloc_contig_mem(osl_t *osh, unsigned long memsize, int regn);
+static void osl_sec_dma_free_contig_mem(osl_t *osh, u32 memsize, int regn);
+static void * osl_sec_dma_ioremap(osl_t *osh, struct page *page, size_t size,
+       bool iscache, bool isdecr);
+static void osl_sec_dma_iounmap(osl_t *osh, void *contig_base_va, size_t size);
+static void osl_sec_dma_init_elem_mem_block(osl_t *osh, size_t mbsize, int max,
+       sec_mem_elem_t **list);
+static void osl_sec_dma_deinit_elem_mem_block(osl_t *osh, size_t mbsize, int max,
+       void *sec_list_base);
+static sec_mem_elem_t * osl_sec_dma_alloc_mem_elem(osl_t *osh, void *va, uint size,
+       int direction, struct sec_cma_info *ptr_cma_info, uint offset);
+static void osl_sec_dma_free_mem_elem(osl_t *osh, sec_mem_elem_t *sec_mem_elem);
+static void osl_sec_dma_init_consistent(osl_t *osh);
+static void *osl_sec_dma_alloc_consistent(osl_t *osh, uint size, uint16 align_bits,
+       ulong *pap);
+static void osl_sec_dma_free_consistent(osl_t *osh, void *va, uint size, dmaaddr_t pa);
+#endif /* BCM_SECURE_DMA */
+
+#ifdef BCM_OBJECT_TRACE
+/* don't clear the first 4 byte that is the pkt sn */
+#define OSL_PKTTAG_CLEAR(p) \
+do { \
+       struct sk_buff *s = (struct sk_buff *)(p); \
+       ASSERT(OSL_PKTTAG_SZ == 32); \
+       *(uint32 *)(&s->cb[4]) = 0; \
+       *(uint32 *)(&s->cb[8]) = 0; *(uint32 *)(&s->cb[12]) = 0; \
+       *(uint32 *)(&s->cb[16]) = 0; *(uint32 *)(&s->cb[20]) = 0; \
+       *(uint32 *)(&s->cb[24]) = 0; *(uint32 *)(&s->cb[28]) = 0; \
+} while (0)
+#else
+#define OSL_PKTTAG_CLEAR(p) \
+do { \
+       struct sk_buff *s = (struct sk_buff *)(p); \
+       ASSERT(OSL_PKTTAG_SZ == 32); \
+       *(uint32 *)(&s->cb[0]) = 0; *(uint32 *)(&s->cb[4]) = 0; \
+       *(uint32 *)(&s->cb[8]) = 0; *(uint32 *)(&s->cb[12]) = 0; \
+       *(uint32 *)(&s->cb[16]) = 0; *(uint32 *)(&s->cb[20]) = 0; \
+       *(uint32 *)(&s->cb[24]) = 0; *(uint32 *)(&s->cb[28]) = 0; \
+} while (0)
+#endif /* BCM_OBJECT_TRACE */
+
+/* PCMCIA attribute space access macros */
+
+/* Global ASSERT type flag */
+uint32 g_assert_type = 1;
+module_param(g_assert_type, int, 0);
+
+static int16 linuxbcmerrormap[] =
+{      0,                      /* 0 */
+       -EINVAL,                /* BCME_ERROR */
+       -EINVAL,                /* BCME_BADARG */
+       -EINVAL,                /* BCME_BADOPTION */
+       -EINVAL,                /* BCME_NOTUP */
+       -EINVAL,                /* BCME_NOTDOWN */
+       -EINVAL,                /* BCME_NOTAP */
+       -EINVAL,                /* BCME_NOTSTA */
+       -EINVAL,                /* BCME_BADKEYIDX */
+       -EINVAL,                /* BCME_RADIOOFF */
+       -EINVAL,                /* BCME_NOTBANDLOCKED */
+       -EINVAL,                /* BCME_NOCLK */
+       -EINVAL,                /* BCME_BADRATESET */
+       -EINVAL,                /* BCME_BADBAND */
+       -E2BIG,                 /* BCME_BUFTOOSHORT */
+       -E2BIG,                 /* BCME_BUFTOOLONG */
+       -EBUSY,                 /* BCME_BUSY */
+       -EINVAL,                /* BCME_NOTASSOCIATED */
+       -EINVAL,                /* BCME_BADSSIDLEN */
+       -EINVAL,                /* BCME_OUTOFRANGECHAN */
+       -EINVAL,                /* BCME_BADCHAN */
+       -EFAULT,                /* BCME_BADADDR */
+       -ENOMEM,                /* BCME_NORESOURCE */
+       -EOPNOTSUPP,            /* BCME_UNSUPPORTED */
+       -EMSGSIZE,              /* BCME_BADLENGTH */
+       -EINVAL,                /* BCME_NOTREADY */
+       -EPERM,                 /* BCME_EPERM */
+       -ENOMEM,                /* BCME_NOMEM */
+       -EINVAL,                /* BCME_ASSOCIATED */
+       -ERANGE,                /* BCME_RANGE */
+       -EINVAL,                /* BCME_NOTFOUND */
+       -EINVAL,                /* BCME_WME_NOT_ENABLED */
+       -EINVAL,                /* BCME_TSPEC_NOTFOUND */
+       -EINVAL,                /* BCME_ACM_NOTSUPPORTED */
+       -EINVAL,                /* BCME_NOT_WME_ASSOCIATION */
+       -EIO,                   /* BCME_SDIO_ERROR */
+       -ENODEV,                /* BCME_DONGLE_DOWN */
+       -EINVAL,                /* BCME_VERSION */
+       -EIO,                   /* BCME_TXFAIL */
+       -EIO,                   /* BCME_RXFAIL */
+       -ENODEV,                /* BCME_NODEVICE */
+       -EINVAL,                /* BCME_NMODE_DISABLED */
+       -ENODATA,               /* BCME_NONRESIDENT */
+       -EINVAL,                /* BCME_SCANREJECT */
+       -EINVAL,                /* BCME_USAGE_ERROR */
+       -EIO,                   /* BCME_IOCTL_ERROR */
+       -EIO,                   /* BCME_SERIAL_PORT_ERR */
+       -EOPNOTSUPP,    /* BCME_DISABLED, BCME_NOTENABLED */
+       -EIO,                   /* BCME_DECERR */
+       -EIO,                   /* BCME_ENCERR */
+       -EIO,                   /* BCME_MICERR */
+       -ERANGE,                /* BCME_REPLAY */
+       -EINVAL,                /* BCME_IE_NOTFOUND */
+       -EINVAL,                /* BCME_DATA_NOTFOUND */
+
+/* When an new error code is added to bcmutils.h, add os
+ * specific error translation here as well
+ */
+/* check if BCME_LAST changed since the last time this function was updated */
+#if BCME_LAST != -53
+#error "You need to add a OS error translation in the linuxbcmerrormap \
+       for new error code defined in bcmutils.h"
+#endif
+};
+uint lmtest = FALSE;
+
+/* translate bcmerrors into linux errors */
+int
+osl_error(int bcmerror)
+{
+       if (bcmerror > 0)
+               bcmerror = 0;
+       else if (bcmerror < BCME_LAST)
+               bcmerror = BCME_ERROR;
+
+       /* Array bounds covered by ASSERT in osl_attach */
+       return linuxbcmerrormap[-bcmerror];
+}
+#ifdef SHARED_OSL_CMN
+osl_t *
+osl_attach(void *pdev, uint bustype, bool pkttag, void **osl_cmn)
+{
+#else
+osl_t *
+osl_attach(void *pdev, uint bustype, bool pkttag)
+{
+       void **osl_cmn = NULL;
+#endif /* SHARED_OSL_CMN */
+       osl_t *osh;
+       gfp_t flags;
+
+       flags = CAN_SLEEP() ? GFP_KERNEL: GFP_ATOMIC;
+       if (!(osh = kmalloc(sizeof(osl_t), flags)))
+               return osh;
+
+       ASSERT(osh);
+
+       bzero(osh, sizeof(osl_t));
+
+       if (osl_cmn == NULL || *osl_cmn == NULL) {
+               if (!(osh->cmn = kmalloc(sizeof(osl_cmn_t), flags))) {
+                       kfree(osh);
+                       return NULL;
+               }
+               bzero(osh->cmn, sizeof(osl_cmn_t));
+               if (osl_cmn)
+                       *osl_cmn = osh->cmn;
+               atomic_set(&osh->cmn->malloced, 0);
+               osh->cmn->dbgmem_list = NULL;
+               spin_lock_init(&(osh->cmn->dbgmem_lock));
+
+               spin_lock_init(&(osh->cmn->pktalloc_lock));
+
+       } else {
+               osh->cmn = *osl_cmn;
+       }
+       atomic_add(1, &osh->cmn->refcount);
+
+       bcm_object_trace_init();
+
+       /* Check that error map has the right number of entries in it */
+       ASSERT(ABS(BCME_LAST) == (ARRAYSIZE(linuxbcmerrormap) - 1));
+
+       osh->failed = 0;
+       osh->pdev = pdev;
+       osh->pub.pkttag = pkttag;
+       osh->bustype = bustype;
+       osh->magic = OS_HANDLE_MAGIC;
+#ifdef BCM_SECURE_DMA
+
+       osl_sec_dma_setup_contig_mem(osh, CMA_MEMBLOCK, CONT_ARMREGION);
+
+       osh->contig_base_alloc_coherent_va = osl_sec_dma_ioremap(osh,
+               phys_to_page((u32)osh->contig_base_alloc),
+               CMA_DMA_DESC_MEMBLOCK, FALSE, TRUE);
+
+       osh->contig_base_alloc_coherent = osh->contig_base_alloc;
+       osl_sec_dma_init_consistent(osh);
+
+       osh->contig_base_alloc += CMA_DMA_DESC_MEMBLOCK;
+
+       osh->contig_base_alloc_va = osl_sec_dma_ioremap(osh,
+               phys_to_page((u32)osh->contig_base_alloc), CMA_DMA_DATA_MEMBLOCK, TRUE, FALSE);
+       osh->contig_base_va = osh->contig_base_alloc_va;
+
+       /*
+       * osl_sec_dma_init_elem_mem_block(osh, CMA_BUFSIZE_512, CMA_BUFNUM, &osh->sec_list_512);
+       * osh->sec_list_base_512 = osh->sec_list_512;
+       * osl_sec_dma_init_elem_mem_block(osh, CMA_BUFSIZE_2K, CMA_BUFNUM, &osh->sec_list_2048);
+       * osh->sec_list_base_2048 = osh->sec_list_2048;
+       */
+       osl_sec_dma_init_elem_mem_block(osh, CMA_BUFSIZE_4K, CMA_BUFNUM, &osh->sec_list_4096);
+       osh->sec_list_base_4096 = osh->sec_list_4096;
+
+#endif /* BCM_SECURE_DMA */
+
+       switch (bustype) {
+               case PCI_BUS:
+               case SI_BUS:
+               case PCMCIA_BUS:
+                       osh->pub.mmbus = TRUE;
+                       break;
+               case JTAG_BUS:
+               case SDIO_BUS:
+               case USB_BUS:
+               case SPI_BUS:
+               case RPC_BUS:
+                       osh->pub.mmbus = FALSE;
+                       break;
+               default:
+                       ASSERT(FALSE);
+                       break;
+       }
+
+#ifdef BCMDBG_CTRACE
+       spin_lock_init(&osh->ctrace_lock);
+       INIT_LIST_HEAD(&osh->ctrace_list);
+       osh->ctrace_num = 0;
+#endif /* BCMDBG_CTRACE */
+
+
+       return osh;
+}
+
+int osl_static_mem_init(osl_t *osh, void *adapter)
+{
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+               if (!bcm_static_buf && adapter) {
+                       if (!(bcm_static_buf = (bcm_static_buf_t *)wifi_platform_prealloc(adapter,
+                               3, STATIC_BUF_SIZE + STATIC_BUF_TOTAL_LEN))) {
+                               printk("can not alloc static buf!\n");
+                               bcm_static_skb = NULL;
+                               ASSERT(osh->magic == OS_HANDLE_MAGIC);
+                               return -ENOMEM;
+                       } else {
+                               printk("alloc static buf at %p!\n", bcm_static_buf);
+                       }
+
+                       sema_init(&bcm_static_buf->static_sem, 1);
+
+                       bcm_static_buf->buf_ptr = (unsigned char *)bcm_static_buf + STATIC_BUF_SIZE;
+               }
+
+#if defined(BCMSDIO) || defined(DHD_USE_STATIC_CTRLBUF)
+               if (!bcm_static_skb && adapter) {
+                       int i;
+                       void *skb_buff_ptr = 0;
+                       bcm_static_skb = (bcm_static_pkt_t *)((char *)bcm_static_buf + 2048);
+                       skb_buff_ptr = wifi_platform_prealloc(adapter, 4, 0);
+                       if (!skb_buff_ptr) {
+                               printk("cannot alloc static buf!\n");
+                               bcm_static_buf = NULL;
+                               bcm_static_skb = NULL;
+                               ASSERT(osh->magic == OS_HANDLE_MAGIC);
+                               return -ENOMEM;
+                       }
+
+                       bcopy(skb_buff_ptr, bcm_static_skb, sizeof(struct sk_buff *) *
+                               (STATIC_PKT_MAX_NUM));
+                       for (i = 0; i < STATIC_PKT_MAX_NUM; i++) {
+                               bcm_static_skb->pkt_use[i] = 0;
+                       }
+
+#ifdef DHD_USE_STATIC_CTRLBUF
+                       spin_lock_init(&bcm_static_skb->osl_pkt_lock);
+                       bcm_static_skb->last_allocated_index = 0;
+#else
+                       sema_init(&bcm_static_skb->osl_pkt_sem, 1);
+#endif /* DHD_USE_STATIC_CTRLBUF */
+               }
+#endif /* BCMSDIO || DHD_USE_STATIC_CTRLBUF */
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+
+       return 0;
+}
+
+void osl_set_bus_handle(osl_t *osh, void *bus_handle)
+{
+       osh->bus_handle = bus_handle;
+}
+
+void* osl_get_bus_handle(osl_t *osh)
+{
+       return osh->bus_handle;
+}
+
+void
+osl_detach(osl_t *osh)
+{
+       if (osh == NULL)
+               return;
+
+#ifdef BCM_SECURE_DMA
+       osl_sec_dma_free_contig_mem(osh, CMA_MEMBLOCK, CONT_ARMREGION);
+       osl_sec_dma_deinit_elem_mem_block(osh, CMA_BUFSIZE_512, CMA_BUFNUM, osh->sec_list_base_512);
+       osl_sec_dma_deinit_elem_mem_block(osh, CMA_BUFSIZE_2K, CMA_BUFNUM, osh->sec_list_base_2048);
+       osl_sec_dma_deinit_elem_mem_block(osh, CMA_BUFSIZE_4K, CMA_BUFNUM, osh->sec_list_base_4096);
+       osl_sec_dma_iounmap(osh, osh->contig_base_va, CMA_MEMBLOCK);
+#endif /* BCM_SECURE_DMA */
+
+
+       bcm_object_trace_deinit();
+
+       ASSERT(osh->magic == OS_HANDLE_MAGIC);
+       atomic_sub(1, &osh->cmn->refcount);
+       if (atomic_read(&osh->cmn->refcount) == 0) {
+                       kfree(osh->cmn);
+       }
+       kfree(osh);
+}
+
+int osl_static_mem_deinit(osl_t *osh, void *adapter)
+{
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+       if (bcm_static_buf) {
+               bcm_static_buf = 0;
+       }
+#ifdef BCMSDIO
+       if (bcm_static_skb) {
+               bcm_static_skb = 0;
+       }
+#endif /* BCMSDIO */
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+       return 0;
+}
+
+static struct sk_buff *osl_alloc_skb(osl_t *osh, unsigned int len)
+{
+       struct sk_buff *skb;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)
+       gfp_t flags = (in_atomic() || irqs_disabled()) ? GFP_ATOMIC : GFP_KERNEL;
+#if defined(CONFIG_SPARSEMEM) && defined(CONFIG_ZONE_DMA)
+       flags |= GFP_ATOMIC;
+#endif
+#ifdef DHD_USE_ATOMIC_PKTGET
+       flags = GFP_ATOMIC;
+#endif /* DHD_USE_ATOMIC_PKTGET */
+       skb = __dev_alloc_skb(len, flags);
+#else
+       skb = dev_alloc_skb(len);
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25) */
+       return skb;
+}
+
+#ifdef CTFPOOL
+
+#ifdef CTFPOOL_SPINLOCK
+#define CTFPOOL_LOCK(ctfpool, flags)   spin_lock_irqsave(&(ctfpool)->lock, flags)
+#define CTFPOOL_UNLOCK(ctfpool, flags) spin_unlock_irqrestore(&(ctfpool)->lock, flags)
+#else
+#define CTFPOOL_LOCK(ctfpool, flags)   spin_lock_bh(&(ctfpool)->lock)
+#define CTFPOOL_UNLOCK(ctfpool, flags) spin_unlock_bh(&(ctfpool)->lock)
+#endif /* CTFPOOL_SPINLOCK */
+/*
+ * Allocate and add an object to packet pool.
+ */
+void *
+osl_ctfpool_add(osl_t *osh)
+{
+       struct sk_buff *skb;
+#ifdef CTFPOOL_SPINLOCK
+       unsigned long flags;
+#endif /* CTFPOOL_SPINLOCK */
+
+       if ((osh == NULL) || (osh->ctfpool == NULL))
+               return NULL;
+
+       CTFPOOL_LOCK(osh->ctfpool, flags);
+       ASSERT(osh->ctfpool->curr_obj <= osh->ctfpool->max_obj);
+
+       /* No need to allocate more objects */
+       if (osh->ctfpool->curr_obj == osh->ctfpool->max_obj) {
+               CTFPOOL_UNLOCK(osh->ctfpool, flags);
+               return NULL;
+       }
+
+       /* Allocate a new skb and add it to the ctfpool */
+       skb = osl_alloc_skb(osh, osh->ctfpool->obj_size);
+       if (skb == NULL) {
+               printf("%s: skb alloc of len %d failed\n", __FUNCTION__,
+                      osh->ctfpool->obj_size);
+               CTFPOOL_UNLOCK(osh->ctfpool, flags);
+               return NULL;
+       }
+
+       /* Add to ctfpool */
+       skb->next = (struct sk_buff *)osh->ctfpool->head;
+       osh->ctfpool->head = skb;
+       osh->ctfpool->fast_frees++;
+       osh->ctfpool->curr_obj++;
+
+       /* Hijack a skb member to store ptr to ctfpool */
+       CTFPOOLPTR(osh, skb) = (void *)osh->ctfpool;
+
+       /* Use bit flag to indicate skb from fast ctfpool */
+       PKTFAST(osh, skb) = FASTBUF;
+
+       CTFPOOL_UNLOCK(osh->ctfpool, flags);
+
+       return skb;
+}
+
+/*
+ * Add new objects to the pool.
+ */
+void
+osl_ctfpool_replenish(osl_t *osh, uint thresh)
+{
+       if ((osh == NULL) || (osh->ctfpool == NULL))
+               return;
+
+       /* Do nothing if no refills are required */
+       while ((osh->ctfpool->refills > 0) && (thresh--)) {
+               osl_ctfpool_add(osh);
+               osh->ctfpool->refills--;
+       }
+}
+
+/*
+ * Initialize the packet pool with specified number of objects.
+ */
+int32
+osl_ctfpool_init(osl_t *osh, uint numobj, uint size)
+{
+       gfp_t flags;
+
+       flags = CAN_SLEEP() ? GFP_KERNEL: GFP_ATOMIC;
+       osh->ctfpool = kzalloc(sizeof(ctfpool_t), flags);
+       ASSERT(osh->ctfpool);
+
+       osh->ctfpool->max_obj = numobj;
+       osh->ctfpool->obj_size = size;
+
+       spin_lock_init(&osh->ctfpool->lock);
+
+       while (numobj--) {
+               if (!osl_ctfpool_add(osh))
+                       return -1;
+               osh->ctfpool->fast_frees--;
+       }
+
+       return 0;
+}
+
+/*
+ * Cleanup the packet pool objects.
+ */
+void
+osl_ctfpool_cleanup(osl_t *osh)
+{
+       struct sk_buff *skb, *nskb;
+#ifdef CTFPOOL_SPINLOCK
+       unsigned long flags;
+#endif /* CTFPOOL_SPINLOCK */
+
+       if ((osh == NULL) || (osh->ctfpool == NULL))
+               return;
+
+       CTFPOOL_LOCK(osh->ctfpool, flags);
+
+       skb = osh->ctfpool->head;
+
+       while (skb != NULL) {
+               nskb = skb->next;
+               dev_kfree_skb(skb);
+               skb = nskb;
+               osh->ctfpool->curr_obj--;
+       }
+
+       ASSERT(osh->ctfpool->curr_obj == 0);
+       osh->ctfpool->head = NULL;
+       CTFPOOL_UNLOCK(osh->ctfpool, flags);
+
+       kfree(osh->ctfpool);
+       osh->ctfpool = NULL;
+}
+
+void
+osl_ctfpool_stats(osl_t *osh, void *b)
+{
+       struct bcmstrbuf *bb;
+
+       if ((osh == NULL) || (osh->ctfpool == NULL))
+               return;
+
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+       if (bcm_static_buf) {
+               bcm_static_buf = 0;
+       }
+#ifdef BCMSDIO
+       if (bcm_static_skb) {
+               bcm_static_skb = 0;
+       }
+#endif /* BCMSDIO */
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+
+       bb = b;
+
+       ASSERT((osh != NULL) && (bb != NULL));
+
+       bcm_bprintf(bb, "max_obj %d obj_size %d curr_obj %d refills %d\n",
+                   osh->ctfpool->max_obj, osh->ctfpool->obj_size,
+                   osh->ctfpool->curr_obj, osh->ctfpool->refills);
+       bcm_bprintf(bb, "fast_allocs %d fast_frees %d slow_allocs %d\n",
+                   osh->ctfpool->fast_allocs, osh->ctfpool->fast_frees,
+                   osh->ctfpool->slow_allocs);
+}
+
+static inline struct sk_buff *
+osl_pktfastget(osl_t *osh, uint len)
+{
+       struct sk_buff *skb;
+#ifdef CTFPOOL_SPINLOCK
+       unsigned long flags;
+#endif /* CTFPOOL_SPINLOCK */
+
+       /* Try to do fast allocate. Return null if ctfpool is not in use
+        * or if there are no items in the ctfpool.
+        */
+       if (osh->ctfpool == NULL)
+               return NULL;
+
+       CTFPOOL_LOCK(osh->ctfpool, flags);
+       if (osh->ctfpool->head == NULL) {
+               ASSERT(osh->ctfpool->curr_obj == 0);
+               osh->ctfpool->slow_allocs++;
+               CTFPOOL_UNLOCK(osh->ctfpool, flags);
+               return NULL;
+       }
+
+       if (len > osh->ctfpool->obj_size) {
+               CTFPOOL_UNLOCK(osh->ctfpool, flags);
+               return NULL;
+       }
+
+       ASSERT(len <= osh->ctfpool->obj_size);
+
+       /* Get an object from ctfpool */
+       skb = (struct sk_buff *)osh->ctfpool->head;
+       osh->ctfpool->head = (void *)skb->next;
+
+       osh->ctfpool->fast_allocs++;
+       osh->ctfpool->curr_obj--;
+       ASSERT(CTFPOOLHEAD(osh, skb) == (struct sock *)osh->ctfpool->head);
+       CTFPOOL_UNLOCK(osh->ctfpool, flags);
+
+       /* Init skb struct */
+       skb->next = skb->prev = NULL;
+#if defined(__ARM_ARCH_7A__)
+       skb->data = skb->head + NET_SKB_PAD;
+       skb->tail = skb->head + NET_SKB_PAD;
+#else
+       skb->data = skb->head + 16;
+       skb->tail = skb->head + 16;
+#endif /* __ARM_ARCH_7A__ */
+       skb->len = 0;
+       skb->cloned = 0;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 14)
+       skb->list = NULL;
+#endif
+       atomic_set(&skb->users, 1);
+
+       PKTSETCLINK(skb, NULL);
+       PKTCCLRATTR(skb);
+       PKTFAST(osh, skb) &= ~(CTFBUF | SKIPCT | CHAINED);
+
+       return skb;
+}
+#endif /* CTFPOOL */
+
+#if defined(BCM_GMAC3)
+/* Account for a packet delivered to downstream forwarder.
+ * Decrement a GMAC forwarder interface's pktalloced count.
+ */
+void BCMFASTPATH
+osl_pkt_tofwder(osl_t *osh, void *skbs, int skb_cnt)
+{
+
+       atomic_sub(skb_cnt, &osh->cmn->pktalloced);
+}
+
+/* Account for a downstream forwarder delivered packet to a WL/DHD driver.
+ * Increment a GMAC forwarder interface's pktalloced count.
+ */
+#ifdef BCMDBG_CTRACE
+void BCMFASTPATH
+osl_pkt_frmfwder(osl_t *osh, void *skbs, int skb_cnt, int line, char *file)
+#else
+void BCMFASTPATH
+osl_pkt_frmfwder(osl_t *osh, void *skbs, int skb_cnt)
+#endif /* BCMDBG_CTRACE */
+{
+#if defined(BCMDBG_CTRACE)
+       int i;
+       struct sk_buff *skb;
+#endif 
+
+#if defined(BCMDBG_CTRACE)
+       if (skb_cnt > 1) {
+               struct sk_buff **skb_array = (struct sk_buff **)skbs;
+               for (i = 0; i < skb_cnt; i++) {
+                       skb = skb_array[i];
+#if defined(BCMDBG_CTRACE)
+                       ASSERT(!PKTISCHAINED(skb));
+                       ADD_CTRACE(osh, skb, file, line);
+#endif /* BCMDBG_CTRACE */
+               }
+       } else {
+               skb = (struct sk_buff *)skbs;
+#if defined(BCMDBG_CTRACE)
+               ASSERT(!PKTISCHAINED(skb));
+               ADD_CTRACE(osh, skb, file, line);
+#endif /* BCMDBG_CTRACE */
+       }
+#endif 
+
+       atomic_add(skb_cnt, &osh->cmn->pktalloced);
+}
+
+#endif /* BCM_GMAC3 */
+
+/* Convert a driver packet to native(OS) packet
+ * In the process, packettag is zeroed out before sending up
+ * IP code depends on skb->cb to be setup correctly with various options
+ * In our case, that means it should be 0
+ */
+struct sk_buff * BCMFASTPATH
+osl_pkt_tonative(osl_t *osh, void *pkt)
+{
+       struct sk_buff *nskb;
+#ifdef BCMDBG_CTRACE
+       struct sk_buff *nskb1, *nskb2;
+#endif
+
+       if (osh->pub.pkttag)
+               OSL_PKTTAG_CLEAR(pkt);
+
+       /* Decrement the packet counter */
+       for (nskb = (struct sk_buff *)pkt; nskb; nskb = nskb->next) {
+               atomic_sub(PKTISCHAINED(nskb) ? PKTCCNT(nskb) : 1, &osh->cmn->pktalloced);
+
+#ifdef BCMDBG_CTRACE
+               for (nskb1 = nskb; nskb1 != NULL; nskb1 = nskb2) {
+                       if (PKTISCHAINED(nskb1)) {
+                               nskb2 = PKTCLINK(nskb1);
+                       }
+                       else
+                               nskb2 = NULL;
+
+                       DEL_CTRACE(osh, nskb1);
+               }
+#endif /* BCMDBG_CTRACE */
+       }
+       return (struct sk_buff *)pkt;
+}
+
+/* Convert a native(OS) packet to driver packet.
+ * In the process, native packet is destroyed, there is no copying
+ * Also, a packettag is zeroed out
+ */
+#ifdef BCMDBG_CTRACE
+void * BCMFASTPATH
+osl_pkt_frmnative(osl_t *osh, void *pkt, int line, char *file)
+#else
+void * BCMFASTPATH
+osl_pkt_frmnative(osl_t *osh, void *pkt)
+#endif /* BCMDBG_CTRACE */
+{
+       struct sk_buff *cskb;
+       struct sk_buff *nskb;
+       unsigned long pktalloced = 0;
+
+
+       if (osh->pub.pkttag)
+               OSL_PKTTAG_CLEAR(pkt);
+
+       /* walk the PKTCLINK() list */
+       for (cskb = (struct sk_buff *)pkt;
+               cskb != NULL;
+               cskb = PKTISCHAINED(cskb) ? PKTCLINK(cskb) : NULL) {
+
+               /* walk the pkt buffer list */
+               for (nskb = cskb; nskb; nskb = nskb->next) {
+
+                       /* Increment the packet counter */
+                       pktalloced++;
+
+                       /* clean the 'prev' pointer
+                        * Kernel 3.18 is leaving skb->prev pointer set to skb
+                        * to indicate a non-fragmented skb
+                        */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
+                       nskb->prev = NULL;
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0) */
+
+
+#ifdef BCMDBG_CTRACE
+               ADD_CTRACE(osh, nskb, file, line);
+#endif /* BCMDBG_CTRACE */
+               }
+       }
+       /* Increment the packet counter */
+       atomic_add(pktalloced, &osh->cmn->pktalloced);
+
+       return (void *)pkt;
+}
+
+/* Return a new packet. zero out pkttag */
+#ifdef BCMDBG_CTRACE
+void * BCMFASTPATH
+osl_pktget(osl_t *osh, uint len, int line, char *file)
+#else
+#ifdef BCM_OBJECT_TRACE
+void * BCMFASTPATH
+osl_pktget(osl_t *osh, uint len, int line, const char *caller)
+#else
+void * BCMFASTPATH
+osl_pktget(osl_t *osh, uint len)
+#endif /* BCM_OBJECT_TRACE */
+#endif /* BCMDBG_CTRACE */
+{
+       struct sk_buff *skb;
+       uchar num = 0;
+       if (lmtest != FALSE) {
+               get_random_bytes(&num, sizeof(uchar));
+               if ((num + 1) <= (256 * lmtest / 100))
+                       return NULL;
+       }
+
+#ifdef CTFPOOL
+       /* Allocate from local pool */
+       skb = osl_pktfastget(osh, len);
+       if ((skb != NULL) || ((skb = osl_alloc_skb(osh, len)) != NULL)) {
+#else /* CTFPOOL */
+       if ((skb = osl_alloc_skb(osh, len))) {
+#endif /* CTFPOOL */
+               skb->tail += len;
+               skb->len  += len;
+               skb->priority = 0;
+
+#ifdef BCMDBG_CTRACE
+               ADD_CTRACE(osh, skb, file, line);
+#endif
+               atomic_inc(&osh->cmn->pktalloced);
+#ifdef BCM_OBJECT_TRACE
+               bcm_object_trace_opr(skb, BCM_OBJDBG_ADD_PKT, caller, line);
+#endif /* BCM_OBJECT_TRACE */
+       }
+
+       return ((void*) skb);
+}
+
+#ifdef CTFPOOL
+static inline void
+osl_pktfastfree(osl_t *osh, struct sk_buff *skb)
+{
+       ctfpool_t *ctfpool;
+#ifdef CTFPOOL_SPINLOCK
+       unsigned long flags;
+#endif /* CTFPOOL_SPINLOCK */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 14)
+       skb->tstamp.tv.sec = 0;
+#else
+       skb->stamp.tv_sec = 0;
+#endif
+
+       /* We only need to init the fields that we change */
+       skb->dev = NULL;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 36)
+       skb->dst = NULL;
+#endif
+       OSL_PKTTAG_CLEAR(skb);
+       skb->ip_summed = 0;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
+       skb_orphan(skb);
+#else
+       skb->destructor = NULL;
+#endif
+
+       ctfpool = (ctfpool_t *)CTFPOOLPTR(osh, skb);
+       ASSERT(ctfpool != NULL);
+
+       /* Add object to the ctfpool */
+       CTFPOOL_LOCK(ctfpool, flags);
+       skb->next = (struct sk_buff *)ctfpool->head;
+       ctfpool->head = (void *)skb;
+
+       ctfpool->fast_frees++;
+       ctfpool->curr_obj++;
+
+       ASSERT(ctfpool->curr_obj <= ctfpool->max_obj);
+       CTFPOOL_UNLOCK(ctfpool, flags);
+}
+#endif /* CTFPOOL */
+
+/* Free the driver packet. Free the tag if present */
+#ifdef BCM_OBJECT_TRACE
+void BCMFASTPATH
+osl_pktfree(osl_t *osh, void *p, bool send, int line, const char *caller)
+#else
+void BCMFASTPATH
+osl_pktfree(osl_t *osh, void *p, bool send)
+#endif /* BCM_OBJECT_TRACE */
+{
+       struct sk_buff *skb, *nskb;
+       if (osh == NULL)
+               return;
+
+       skb = (struct sk_buff*) p;
+
+       if (send && osh->pub.tx_fn)
+               osh->pub.tx_fn(osh->pub.tx_ctx, p, 0);
+
+       PKTDBG_TRACE(osh, (void *) skb, PKTLIST_PKTFREE);
+
+#if defined(CONFIG_DHD_USE_STATIC_BUF) && defined(DHD_USE_STATIC_CTRLBUF)
+       if (skb && (skb->mac_len == PREALLOC_USED_MAGIC)) {
+               printk("%s: pkt %p is from static pool\n",
+                       __FUNCTION__, p);
+               dump_stack();
+               return;
+       }
+
+       if (skb && (skb->mac_len == PREALLOC_FREE_MAGIC)) {
+               printk("%s: pkt %p is from static pool and not in used\n",
+                       __FUNCTION__, p);
+               dump_stack();
+               return;
+       }
+#endif /* CONFIG_DHD_USE_STATIC_BUF && DHD_USE_STATIC_CTRLBUF */
+
+       /* perversion: we use skb->next to chain multi-skb packets */
+       while (skb) {
+               nskb = skb->next;
+               skb->next = NULL;
+
+#ifdef BCMDBG_CTRACE
+               DEL_CTRACE(osh, skb);
+#endif
+
+
+#ifdef BCM_OBJECT_TRACE
+               bcm_object_trace_opr(skb, BCM_OBJDBG_REMOVE, caller, line);
+#endif /* BCM_OBJECT_TRACE */
+
+#ifdef CTFPOOL
+               if (PKTISFAST(osh, skb)) {
+                       if (atomic_read(&skb->users) == 1)
+                               smp_rmb();
+                       else if (!atomic_dec_and_test(&skb->users))
+                               goto next_skb;
+                       osl_pktfastfree(osh, skb);
+               } else
+#endif
+               {
+                       dev_kfree_skb_any(skb);
+               }
+#ifdef CTFPOOL
+next_skb:
+#endif
+               atomic_dec(&osh->cmn->pktalloced);
+               skb = nskb;
+       }
+}
+
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+void*
+osl_pktget_static(osl_t *osh, uint len)
+{
+       int i = 0;
+       struct sk_buff *skb;
+#ifdef DHD_USE_STATIC_CTRLBUF
+       unsigned long flags;
+#endif /* DHD_USE_STATIC_CTRLBUF */
+
+       if (!bcm_static_skb)
+               return osl_pktget(osh, len);
+
+       if (len > DHD_SKB_MAX_BUFSIZE) {
+               printk("%s: attempt to allocate huge packet (0x%x)\n", __FUNCTION__, len);
+               return osl_pktget(osh, len);
+       }
+
+#ifdef DHD_USE_STATIC_CTRLBUF
+       spin_lock_irqsave(&bcm_static_skb->osl_pkt_lock, flags);
+
+       if (len <= DHD_SKB_2PAGE_BUFSIZE) {
+               uint32 index;
+               for (i = 0; i < STATIC_PKT_2PAGE_NUM; i++) {
+                       index = bcm_static_skb->last_allocated_index % STATIC_PKT_2PAGE_NUM;
+                       bcm_static_skb->last_allocated_index++;
+                       if (bcm_static_skb->skb_8k[index] &&
+                               bcm_static_skb->pkt_use[index] == 0) {
+                               break;
+                       }
+               }
+
+               if ((i != STATIC_PKT_2PAGE_NUM) &&
+                       (index >= 0) && (index < STATIC_PKT_2PAGE_NUM)) {
+                       bcm_static_skb->pkt_use[index] = 1;
+                       skb = bcm_static_skb->skb_8k[index];
+                       skb->data = skb->head;
+#ifdef NET_SKBUFF_DATA_USES_OFFSET
+                       skb_set_tail_pointer(skb, NET_SKB_PAD);
+#else
+                       skb->tail = skb->data + NET_SKB_PAD;
+#endif /* NET_SKBUFF_DATA_USES_OFFSET */
+                       skb->data += NET_SKB_PAD;
+                       skb->cloned = 0;
+                       skb->priority = 0;
+#ifdef NET_SKBUFF_DATA_USES_OFFSET
+                       skb_set_tail_pointer(skb, len);
+#else
+                       skb->tail = skb->data + len;
+#endif /* NET_SKBUFF_DATA_USES_OFFSET */
+                       skb->len = len;
+                       skb->mac_len = PREALLOC_USED_MAGIC;
+                       spin_unlock_irqrestore(&bcm_static_skb->osl_pkt_lock, flags);
+                       return skb;
+               }
+       }
+
+       spin_unlock_irqrestore(&bcm_static_skb->osl_pkt_lock, flags);
+       printk("%s: all static pkt in use!\n", __FUNCTION__);
+       return NULL;
+#else
+       down(&bcm_static_skb->osl_pkt_sem);
+
+       if (len <= DHD_SKB_1PAGE_BUFSIZE) {
+               for (i = 0; i < STATIC_PKT_MAX_NUM; i++) {
+                       if (bcm_static_skb->skb_4k[i] &&
+                               bcm_static_skb->pkt_use[i] == 0) {
+                               break;
+                       }
+               }
+
+               if (i != STATIC_PKT_MAX_NUM) {
+                       bcm_static_skb->pkt_use[i] = 1;
+
+                       skb = bcm_static_skb->skb_4k[i];
+#ifdef NET_SKBUFF_DATA_USES_OFFSET
+                       skb_set_tail_pointer(skb, len);
+#else
+                       skb->tail = skb->data + len;
+#endif /* NET_SKBUFF_DATA_USES_OFFSET */
+                       skb->len = len;
+
+                       up(&bcm_static_skb->osl_pkt_sem);
+                       return skb;
+               }
+       }
+
+       if (len <= DHD_SKB_2PAGE_BUFSIZE) {
+               for (i = STATIC_PKT_1PAGE_NUM; i < STATIC_PKT_1_2PAGE_NUM; i++) {
+                       if (bcm_static_skb->skb_8k[i - STATIC_PKT_1PAGE_NUM] &&
+                               bcm_static_skb->pkt_use[i] == 0) {
+                               break;
+                       }
+               }
+
+               if ((i >= STATIC_PKT_1PAGE_NUM) && (i < STATIC_PKT_1_2PAGE_NUM)) {
+                       bcm_static_skb->pkt_use[i] = 1;
+                       skb = bcm_static_skb->skb_8k[i - STATIC_PKT_1PAGE_NUM];
+#ifdef NET_SKBUFF_DATA_USES_OFFSET
+                       skb_set_tail_pointer(skb, len);
+#else
+                       skb->tail = skb->data + len;
+#endif /* NET_SKBUFF_DATA_USES_OFFSET */
+                       skb->len = len;
+
+                       up(&bcm_static_skb->osl_pkt_sem);
+                       return skb;
+               }
+       }
+
+#if defined(ENHANCED_STATIC_BUF)
+       if (bcm_static_skb->skb_16k &&
+               bcm_static_skb->pkt_use[STATIC_PKT_MAX_NUM - 1] == 0) {
+               bcm_static_skb->pkt_use[STATIC_PKT_MAX_NUM - 1] = 1;
+
+               skb = bcm_static_skb->skb_16k;
+#ifdef NET_SKBUFF_DATA_USES_OFFSET
+               skb_set_tail_pointer(skb, len);
+#else
+               skb->tail = skb->data + len;
+#endif /* NET_SKBUFF_DATA_USES_OFFSET */
+               skb->len = len;
+
+               up(&bcm_static_skb->osl_pkt_sem);
+               return skb;
+       }
+#endif /* ENHANCED_STATIC_BUF */
+
+       up(&bcm_static_skb->osl_pkt_sem);
+       printk("%s: all static pkt in use!\n", __FUNCTION__);
+       return osl_pktget(osh, len);
+#endif /* DHD_USE_STATIC_CTRLBUF */
+}
+
+void
+osl_pktfree_static(osl_t *osh, void *p, bool send)
+{
+       int i;
+#ifdef DHD_USE_STATIC_CTRLBUF
+       struct sk_buff *skb = (struct sk_buff *)p;
+       unsigned long flags;
+#endif /* DHD_USE_STATIC_CTRLBUF */
+
+       if (!p) {
+               return;
+       }
+
+       if (!bcm_static_skb) {
+               osl_pktfree(osh, p, send);
+               return;
+       }
+
+#ifdef DHD_USE_STATIC_CTRLBUF
+       spin_lock_irqsave(&bcm_static_skb->osl_pkt_lock, flags);
+
+       for (i = 0; i < STATIC_PKT_2PAGE_NUM; i++) {
+               if (p == bcm_static_skb->skb_8k[i]) {
+                       if (bcm_static_skb->pkt_use[i] == 0) {
+                               printk("%s: static pkt idx %d(%p) is double free\n",
+                                       __FUNCTION__, i, p);
+                       } else {
+                               bcm_static_skb->pkt_use[i] = 0;
+                       }
+
+                       if (skb->mac_len != PREALLOC_USED_MAGIC) {
+                               printk("%s: static pkt idx %d(%p) is not in used\n",
+                                       __FUNCTION__, i, p);
+                       }
+
+                       skb->mac_len = PREALLOC_FREE_MAGIC;
+                       spin_unlock_irqrestore(&bcm_static_skb->osl_pkt_lock, flags);
+                       return;
+               }
+       }
+
+       spin_unlock_irqrestore(&bcm_static_skb->osl_pkt_lock, flags);
+       printk("%s: packet %p does not exist in the pool\n", __FUNCTION__, p);
+#else
+       down(&bcm_static_skb->osl_pkt_sem);
+       for (i = 0; i < STATIC_PKT_1PAGE_NUM; i++) {
+               if (p == bcm_static_skb->skb_4k[i]) {
+                       bcm_static_skb->pkt_use[i] = 0;
+                       up(&bcm_static_skb->osl_pkt_sem);
+                       return;
+               }
+       }
+
+       for (i = STATIC_PKT_1PAGE_NUM; i < STATIC_PKT_1_2PAGE_NUM; i++) {
+               if (p == bcm_static_skb->skb_8k[i - STATIC_PKT_1PAGE_NUM]) {
+                       bcm_static_skb->pkt_use[i] = 0;
+                       up(&bcm_static_skb->osl_pkt_sem);
+                       return;
+               }
+       }
+#ifdef ENHANCED_STATIC_BUF
+       if (p == bcm_static_skb->skb_16k) {
+               bcm_static_skb->pkt_use[STATIC_PKT_MAX_NUM - 1] = 0;
+               up(&bcm_static_skb->osl_pkt_sem);
+               return;
+       }
+#endif
+       up(&bcm_static_skb->osl_pkt_sem);
+       osl_pktfree(osh, p, send);
+#endif /* DHD_USE_STATIC_CTRLBUF */
+}
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+
+uint32
+osl_pci_read_config(osl_t *osh, uint offset, uint size)
+{
+       uint val = 0;
+       uint retry = PCI_CFG_RETRY;
+
+       ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+
+       /* only 4byte access supported */
+       ASSERT(size == 4);
+
+       do {
+               pci_read_config_dword(osh->pdev, offset, &val);
+               if (val != 0xffffffff)
+                       break;
+       } while (retry--);
+
+
+       return (val);
+}
+
+void
+osl_pci_write_config(osl_t *osh, uint offset, uint size, uint val)
+{
+       uint retry = PCI_CFG_RETRY;
+
+       ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+
+       /* only 4byte access supported */
+       ASSERT(size == 4);
+
+       do {
+               pci_write_config_dword(osh->pdev, offset, val);
+               if (offset != PCI_BAR0_WIN)
+                       break;
+               if (osl_pci_read_config(osh, offset, size) == val)
+                       break;
+       } while (retry--);
+
+}
+
+/* return bus # for the pci device pointed by osh->pdev */
+uint
+osl_pci_bus(osl_t *osh)
+{
+       ASSERT(osh && (osh->magic == OS_HANDLE_MAGIC) && osh->pdev);
+
+#if defined(__ARM_ARCH_7A__) && LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 35)
+       return pci_domain_nr(((struct pci_dev *)osh->pdev)->bus);
+#else
+       return ((struct pci_dev *)osh->pdev)->bus->number;
+#endif
+}
+
+/* return slot # for the pci device pointed by osh->pdev */
+uint
+osl_pci_slot(osl_t *osh)
+{
+       ASSERT(osh && (osh->magic == OS_HANDLE_MAGIC) && osh->pdev);
+
+#if defined(__ARM_ARCH_7A__) && LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 35)
+       return PCI_SLOT(((struct pci_dev *)osh->pdev)->devfn) + 1;
+#else
+       return PCI_SLOT(((struct pci_dev *)osh->pdev)->devfn);
+#endif
+}
+
+/* return domain # for the pci device pointed by osh->pdev */
+uint
+osl_pcie_domain(osl_t *osh)
+{
+       ASSERT(osh && (osh->magic == OS_HANDLE_MAGIC) && osh->pdev);
+
+       return pci_domain_nr(((struct pci_dev *)osh->pdev)->bus);
+}
+
+/* return bus # for the pci device pointed by osh->pdev */
+uint
+osl_pcie_bus(osl_t *osh)
+{
+       ASSERT(osh && (osh->magic == OS_HANDLE_MAGIC) && osh->pdev);
+
+       return ((struct pci_dev *)osh->pdev)->bus->number;
+}
+
+/* return the pci device pointed by osh->pdev */
+struct pci_dev *
+osl_pci_device(osl_t *osh)
+{
+       ASSERT(osh && (osh->magic == OS_HANDLE_MAGIC) && osh->pdev);
+
+       return osh->pdev;
+}
+
+static void
+osl_pcmcia_attr(osl_t *osh, uint offset, char *buf, int size, bool write)
+{
+}
+
+void
+osl_pcmcia_read_attr(osl_t *osh, uint offset, void *buf, int size)
+{
+       osl_pcmcia_attr(osh, offset, (char *) buf, size, FALSE);
+}
+
+void
+osl_pcmcia_write_attr(osl_t *osh, uint offset, void *buf, int size)
+{
+       osl_pcmcia_attr(osh, offset, (char *) buf, size, TRUE);
+}
+
+void *
+osl_malloc(osl_t *osh, uint size)
+{
+       void *addr;
+       gfp_t flags;
+
+       /* only ASSERT if osh is defined */
+       if (osh)
+               ASSERT(osh->magic == OS_HANDLE_MAGIC);
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+       if (bcm_static_buf)
+       {
+               int i = 0;
+               if ((size >= PAGE_SIZE)&&(size <= STATIC_BUF_SIZE))
+               {
+                       down(&bcm_static_buf->static_sem);
+
+                       for (i = 0; i < STATIC_BUF_MAX_NUM; i++)
+                       {
+                               if (bcm_static_buf->buf_use[i] == 0)
+                                       break;
+                       }
+
+                       if (i == STATIC_BUF_MAX_NUM)
+                       {
+                               up(&bcm_static_buf->static_sem);
+                               printk("all static buff in use!\n");
+                               goto original;
+                       }
+
+                       bcm_static_buf->buf_use[i] = 1;
+                       up(&bcm_static_buf->static_sem);
+
+                       bzero(bcm_static_buf->buf_ptr+STATIC_BUF_SIZE*i, size);
+                       if (osh)
+                               atomic_add(size, &osh->cmn->malloced);
+
+                       return ((void *)(bcm_static_buf->buf_ptr+STATIC_BUF_SIZE*i));
+               }
+       }
+original:
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+
+       flags = CAN_SLEEP() ? GFP_KERNEL: GFP_ATOMIC;
+       if ((addr = kmalloc(size, flags)) == NULL) {
+               if (osh)
+                       osh->failed++;
+               return (NULL);
+       }
+       if (osh && osh->cmn)
+               atomic_add(size, &osh->cmn->malloced);
+
+       return (addr);
+}
+
+void *
+osl_mallocz(osl_t *osh, uint size)
+{
+       void *ptr;
+
+       ptr = osl_malloc(osh, size);
+
+       if (ptr != NULL) {
+               bzero(ptr, size);
+       }
+
+       return ptr;
+}
+
+void
+osl_mfree(osl_t *osh, void *addr, uint size)
+{
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+       if (bcm_static_buf)
+       {
+               if ((addr > (void *)bcm_static_buf) && ((unsigned char *)addr
+                       <= ((unsigned char *)bcm_static_buf + STATIC_BUF_TOTAL_LEN)))
+               {
+                       int buf_idx = 0;
+
+                       buf_idx = ((unsigned char *)addr - bcm_static_buf->buf_ptr)/STATIC_BUF_SIZE;
+
+                       down(&bcm_static_buf->static_sem);
+                       bcm_static_buf->buf_use[buf_idx] = 0;
+                       up(&bcm_static_buf->static_sem);
+
+                       if (osh && osh->cmn) {
+                               ASSERT(osh->magic == OS_HANDLE_MAGIC);
+                               atomic_sub(size, &osh->cmn->malloced);
+                       }
+                       return;
+               }
+       }
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+       if (osh && osh->cmn) {
+               ASSERT(osh->magic == OS_HANDLE_MAGIC);
+
+               ASSERT(size <= osl_malloced(osh));
+
+               atomic_sub(size, &osh->cmn->malloced);
+       }
+       kfree(addr);
+}
+
+uint
+osl_check_memleak(osl_t *osh)
+{
+       ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+       if (atomic_read(&osh->cmn->refcount) == 1)
+               return (atomic_read(&osh->cmn->malloced));
+       else
+               return 0;
+}
+
+uint
+osl_malloced(osl_t *osh)
+{
+       ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+       return (atomic_read(&osh->cmn->malloced));
+}
+
+uint
+osl_malloc_failed(osl_t *osh)
+{
+       ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+       return (osh->failed);
+}
+
+
+uint
+osl_dma_consistent_align(void)
+{
+       return (PAGE_SIZE);
+}
+
+void*
+osl_dma_alloc_consistent(osl_t *osh, uint size, uint16 align_bits, uint *alloced, dmaaddr_t *pap)
+{
+       void *va;
+       uint16 align = (1 << align_bits);
+       ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+
+       if (!ISALIGNED(DMA_CONSISTENT_ALIGN, align))
+               size += align;
+       *alloced = size;
+
+#ifndef        BCM_SECURE_DMA
+#if defined(__ARM_ARCH_7A__) && !defined(DHD_USE_COHERENT_MEM_FOR_RING)
+       va = kmalloc(size, GFP_ATOMIC | __GFP_ZERO);
+       if (va)
+               *pap = (ulong)__virt_to_phys((ulong)va);
+#else
+       {
+               dma_addr_t pap_lin;
+               struct pci_dev *hwdev = osh->pdev;
+               gfp_t flags;
+#ifdef DHD_ALLOC_COHERENT_MEM_FROM_ATOMIC_POOL
+               flags = GFP_ATOMIC;
+#else
+               flags = GFP_KERNEL;
+#endif /* DHD_ALLOC_COHERENT_MEM_FROM_ATOMIC_POOL */
+               va = dma_alloc_coherent(&hwdev->dev, size, &pap_lin, flags);
+#ifdef BCMDMA64OSL
+               PHYSADDRLOSET(*pap, pap_lin & 0xffffffff);
+               PHYSADDRHISET(*pap, (pap_lin >> 32) & 0xffffffff);
+#else
+               *pap = (dmaaddr_t)pap_lin;
+#endif /* BCMDMA64OSL */
+       }
+#endif /* __ARM_ARCH_7A__ && !DHD_USE_COHERENT_MEM_FOR_RING */
+#else
+       va = osl_sec_dma_alloc_consistent(osh, size, align_bits, pap);
+#endif /* BCM_SECURE_DMA */
+       return va;
+}
+
+void
+osl_dma_free_consistent(osl_t *osh, void *va, uint size, dmaaddr_t pa)
+{
+#ifdef BCMDMA64OSL
+       dma_addr_t paddr;
+#endif /* BCMDMA64OSL */
+       ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+
+#ifndef BCM_SECURE_DMA
+#if defined(__ARM_ARCH_7A__) && !defined(DHD_USE_COHERENT_MEM_FOR_RING)
+       kfree(va);
+#else
+#ifdef BCMDMA64OSL
+       PHYSADDRTOULONG(pa, paddr);
+       pci_free_consistent(osh->pdev, size, va, paddr);
+#else
+       pci_free_consistent(osh->pdev, size, va, (dma_addr_t)pa);
+#endif /* BCMDMA64OSL */
+#endif /* __ARM_ARCH_7A__ && !DHD_USE_COHERENT_MEM_FOR_RING */
+#else
+       osl_sec_dma_free_consistent(osh, va, size, pa);
+#endif /* BCM_SECURE_DMA */
+}
+
+dmaaddr_t BCMFASTPATH
+osl_dma_map(osl_t *osh, void *va, uint size, int direction, void *p, hnddma_seg_map_t *dmah)
+{
+       int dir;
+       dmaaddr_t ret_addr;
+       dma_addr_t  map_addr;
+       int ret;
+
+       ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+       dir = (direction == DMA_TX)? PCI_DMA_TODEVICE: PCI_DMA_FROMDEVICE;
+
+
+
+
+       map_addr = pci_map_single(osh->pdev, va, size, dir);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+       ret = pci_dma_mapping_error(osh->pdev, map_addr);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 5))
+       ret = pci_dma_mapping_error(map_addr);
+#else
+       ret = 0;
+#endif
+       if (ret) {
+               printk("%s: Failed to map memory\n", __FUNCTION__);
+               PHYSADDRLOSET(ret_addr, 0);
+               PHYSADDRHISET(ret_addr, 0);
+       } else {
+               PHYSADDRLOSET(ret_addr, map_addr & 0xffffffff);
+               PHYSADDRHISET(ret_addr, (map_addr >> 32) & 0xffffffff);
+       }
+
+       return ret_addr;
+}
+
+void BCMFASTPATH
+osl_dma_unmap(osl_t *osh, dmaaddr_t pa, uint size, int direction)
+{
+       int dir;
+#ifdef BCMDMA64OSL
+       dma_addr_t paddr;
+#endif /* BCMDMA64OSL */
+
+       ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+
+
+       dir = (direction == DMA_TX)? PCI_DMA_TODEVICE: PCI_DMA_FROMDEVICE;
+#ifdef BCMDMA64OSL
+       PHYSADDRTOULONG(pa, paddr);
+       pci_unmap_single(osh->pdev, paddr, size, dir);
+#else
+       pci_unmap_single(osh->pdev, (uint32)pa, size, dir);
+#endif /* BCMDMA64OSL */
+}
+
+/* OSL function for CPU relax */
+inline void BCMFASTPATH
+osl_cpu_relax(void)
+{
+       cpu_relax();
+}
+
+
+#if (defined(__ARM_ARCH_7A__) && !defined(DHD_USE_COHERENT_MEM_FOR_RING) || \
+       defined(CONFIG_ARCH_MSM8996) || defined(CONFIG_SOC_EXYNOS8890))
+
+#include <asm/dma-mapping.h>
+
+/*
+ * Note that its gauranteed that the Ring is cache line aligned, but
+ * the messages are not. And we see that __dma_inv_range in
+ * arch/arm64/mm/cache.S invalidates only if the request size is
+ * cache line aligned. If not, it will Clean and invalidate.
+ * So we'll better invalidate the whole ring.
+ *
+ * Also, the latest Kernel versions invoke cache maintenance operations
+ * from arch/arm64/mm/dma-mapping.c, __swiotlb_sync_single_for_device
+ * Only if is_device_dma_coherent returns 0. Since we don't have BSP
+ * source, assuming that its the case, since we pass NULL for the dev ptr
+ */
+inline void BCMFASTPATH
+osl_cache_flush(void *va, uint size)
+{
+       /*
+        * using long for address arithmatic is OK, in linux
+        * 32 bit its 4 bytes and 64 bit its 8 bytes
+        */
+       unsigned long end_cache_line_start;
+       unsigned long end_addr;
+       unsigned long next_cache_line_start;
+
+       end_addr = (unsigned long)va + size;
+
+       /* Start address beyond the cache line we plan to operate */
+       end_cache_line_start = (end_addr & ~(L1_CACHE_BYTES - 1));
+       next_cache_line_start = end_cache_line_start + L1_CACHE_BYTES;
+
+       /* Align the start address to cache line boundary */
+       va = (void *)((unsigned long)va & ~(L1_CACHE_BYTES - 1));
+
+       /* Ensure that size is also aligned and extends partial line to full */
+       size = next_cache_line_start - (unsigned long)va;
+
+#ifndef BCM_SECURE_DMA
+
+#ifdef CONFIG_ARM64
+       /*
+        * virt_to_dma is not present in arm64/include/dma-mapping.h
+        * So have to convert the va to pa first and then get the dma addr
+        * of the same.
+        */
+       {
+               phys_addr_t pa;
+               dma_addr_t dma_addr;
+               pa = virt_to_phys(va);
+               dma_addr = phys_to_dma(NULL, pa);
+               if (size > 0)
+                       dma_sync_single_for_device(OSH_NULL, dma_addr, size, DMA_TX);
+       }
+#else
+       if (size > 0)
+               dma_sync_single_for_device(OSH_NULL, virt_to_dma(OSH_NULL, va), size, DMA_TX);
+#endif /* !CONFIG_ARM64 */
+#else
+       phys_addr_t orig_pa = (phys_addr_t)(va - g_contig_delta_va_pa);
+       if (size > 0)
+               dma_sync_single_for_device(OSH_NULL, orig_pa, size, DMA_TX);
+#endif /* defined BCM_SECURE_DMA */
+}
+
+inline void BCMFASTPATH
+osl_cache_inv(void *va, uint size)
+{
+       /*
+        * using long for address arithmatic is OK, in linux
+        * 32 bit its 4 bytes and 64 bit its 8 bytes
+        */
+       unsigned long end_cache_line_start;
+       unsigned long end_addr;
+       unsigned long next_cache_line_start;
+
+       end_addr = (unsigned long)va + size;
+
+       /* Start address beyond the cache line we plan to operate */
+       end_cache_line_start = (end_addr & ~(L1_CACHE_BYTES - 1));
+       next_cache_line_start = end_cache_line_start + L1_CACHE_BYTES;
+
+       /* Align the start address to cache line boundary */
+       va = (void *)((unsigned long)va & ~(L1_CACHE_BYTES - 1));
+
+       /* Ensure that size is also aligned and extends partial line to full */
+       size = next_cache_line_start - (unsigned long)va;
+
+#ifndef BCM_SECURE_DMA
+
+#ifdef CONFIG_ARM64
+       /*
+        * virt_to_dma is not present in arm64/include/dma-mapping.h
+        * So have to convert the va to pa first and then get the dma addr
+        * of the same.
+        */
+       {
+               phys_addr_t pa;
+               dma_addr_t dma_addr;
+               pa = virt_to_phys(va);
+               dma_addr = phys_to_dma(NULL, pa);
+               dma_sync_single_for_cpu(OSH_NULL, dma_addr, size, DMA_RX);
+       }
+#else
+       dma_sync_single_for_cpu(OSH_NULL, virt_to_dma(OSH_NULL, va), size, DMA_RX);
+#endif /* !CONFIG_ARM64 */
+#else
+       phys_addr_t orig_pa = (phys_addr_t)(va - g_contig_delta_va_pa);
+       dma_sync_single_for_cpu(OSH_NULL, orig_pa, size, DMA_RX);
+#endif /* defined BCM_SECURE_DMA */
+}
+
+inline void osl_prefetch(const void *ptr)
+{
+       /* PLD instruction is not applicable in ARM 64. We don't care for now */
+#ifndef CONFIG_ARM64
+       __asm__ __volatile__("pld\t%0" :: "o"(*(const char *)ptr) : "cc");
+#endif
+}
+
+int osl_arch_is_coherent(void)
+{
+       return 0;
+}
+
+
+inline int osl_acp_war_enab(void)
+{
+       return 0;
+}
+
+#endif 
+
+#if defined(BCMASSERT_LOG)
+void
+osl_assert(const char *exp, const char *file, int line)
+{
+       char tempbuf[256];
+       const char *basename;
+
+       basename = strrchr(file, '/');
+       /* skip the '/' */
+       if (basename)
+               basename++;
+
+       if (!basename)
+               basename = file;
+
+#ifdef BCMASSERT_LOG
+       snprintf(tempbuf, 64, "\"%s\": file \"%s\", line %d\n",
+               exp, basename, line);
+#endif /* BCMASSERT_LOG */
+
+
+#if defined(BCMASSERT_LOG)
+       switch (g_assert_type) {
+       case 0:
+               panic("%s", tempbuf);
+               break;
+       case 1:
+               printk("%s", tempbuf);
+               break;
+       case 2:
+               printk("%s", tempbuf);
+               BUG();
+               break;
+       default:
+               break;
+       }
+#endif 
+
+}
+#endif 
+
+void
+osl_delay(uint usec)
+{
+       uint d;
+
+       while (usec > 0) {
+               d = MIN(usec, 1000);
+               udelay(d);
+               usec -= d;
+       }
+}
+
+void
+osl_sleep(uint ms)
+{
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
+       if (ms < 20)
+               usleep_range(ms*1000, ms*1000 + 1000);
+       else
+#endif
+       msleep(ms);
+}
+
+
+
+/* Clone a packet.
+ * The pkttag contents are NOT cloned.
+ */
+#ifdef BCMDBG_CTRACE
+void *
+osl_pktdup(osl_t *osh, void *skb, int line, char *file)
+#else
+#ifdef BCM_OBJECT_TRACE
+void *
+osl_pktdup(osl_t *osh, void *skb, int line, const char *caller)
+#else
+void *
+osl_pktdup(osl_t *osh, void *skb)
+#endif /* BCM_OBJECT_TRACE */
+#endif /* BCMDBG_CTRACE */
+{
+       void * p;
+
+       ASSERT(!PKTISCHAINED(skb));
+
+       /* clear the CTFBUF flag if set and map the rest of the buffer
+        * before cloning.
+        */
+       PKTCTFMAP(osh, skb);
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
+       if ((p = pskb_copy((struct sk_buff *)skb, GFP_ATOMIC)) == NULL)
+#else
+       if ((p = skb_clone((struct sk_buff *)skb, GFP_ATOMIC)) == NULL)
+#endif
+               return NULL;
+
+#ifdef CTFPOOL
+       if (PKTISFAST(osh, skb)) {
+               ctfpool_t *ctfpool;
+
+               /* if the buffer allocated from ctfpool is cloned then
+                * we can't be sure when it will be freed. since there
+                * is a chance that we will be losing a buffer
+                * from our pool, we increment the refill count for the
+                * object to be alloced later.
+                */
+               ctfpool = (ctfpool_t *)CTFPOOLPTR(osh, skb);
+               ASSERT(ctfpool != NULL);
+               PKTCLRFAST(osh, p);
+               PKTCLRFAST(osh, skb);
+               ctfpool->refills++;
+       }
+#endif /* CTFPOOL */
+
+       /* Clear PKTC  context */
+       PKTSETCLINK(p, NULL);
+       PKTCCLRFLAGS(p);
+       PKTCSETCNT(p, 1);
+       PKTCSETLEN(p, PKTLEN(osh, skb));
+
+       /* skb_clone copies skb->cb.. we don't want that */
+       if (osh->pub.pkttag)
+               OSL_PKTTAG_CLEAR(p);
+
+       /* Increment the packet counter */
+       atomic_inc(&osh->cmn->pktalloced);
+#ifdef BCM_OBJECT_TRACE
+       bcm_object_trace_opr(p, BCM_OBJDBG_ADD_PKT, caller, line);
+#endif /* BCM_OBJECT_TRACE */
+
+#ifdef BCMDBG_CTRACE
+       ADD_CTRACE(osh, (struct sk_buff *)p, file, line);
+#endif
+       return (p);
+}
+
+#ifdef BCMDBG_CTRACE
+int osl_pkt_is_frmnative(osl_t *osh, struct sk_buff *pkt)
+{
+       unsigned long flags;
+       struct sk_buff *skb;
+       int ck = FALSE;
+
+       spin_lock_irqsave(&osh->ctrace_lock, flags);
+
+       list_for_each_entry(skb, &osh->ctrace_list, ctrace_list) {
+               if (pkt == skb) {
+                       ck = TRUE;
+                       break;
+               }
+       }
+
+       spin_unlock_irqrestore(&osh->ctrace_lock, flags);
+       return ck;
+}
+
+void osl_ctrace_dump(osl_t *osh, struct bcmstrbuf *b)
+{
+       unsigned long flags;
+       struct sk_buff *skb;
+       int idx = 0;
+       int i, j;
+
+       spin_lock_irqsave(&osh->ctrace_lock, flags);
+
+       if (b != NULL)
+               bcm_bprintf(b, " Total %d sbk not free\n", osh->ctrace_num);
+       else
+               printk(" Total %d sbk not free\n", osh->ctrace_num);
+
+       list_for_each_entry(skb, &osh->ctrace_list, ctrace_list) {
+               if (b != NULL)
+                       bcm_bprintf(b, "[%d] skb %p:\n", ++idx, skb);
+               else
+                       printk("[%d] skb %p:\n", ++idx, skb);
+
+               for (i = 0; i < skb->ctrace_count; i++) {
+                       j = (skb->ctrace_start + i) % CTRACE_NUM;
+                       if (b != NULL)
+                               bcm_bprintf(b, "    [%s(%d)]\n", skb->func[j], skb->line[j]);
+                       else
+                               printk("    [%s(%d)]\n", skb->func[j], skb->line[j]);
+               }
+               if (b != NULL)
+                       bcm_bprintf(b, "\n");
+               else
+                       printk("\n");
+       }
+
+       spin_unlock_irqrestore(&osh->ctrace_lock, flags);
+
+       return;
+}
+#endif /* BCMDBG_CTRACE */
+
+
+/*
+ * OSLREGOPS specifies the use of osl_XXX routines to be used for register access
+ */
+
+/*
+ * BINOSL selects the slightly slower function-call-based binary compatible osl.
+ */
+
+uint
+osl_pktalloced(osl_t *osh)
+{
+       if (atomic_read(&osh->cmn->refcount) == 1)
+               return (atomic_read(&osh->cmn->pktalloced));
+       else
+               return 0;
+}
+
+uint32
+osl_rand(void)
+{
+       uint32 rand;
+
+       get_random_bytes(&rand, sizeof(rand));
+
+       return rand;
+}
+
+/* Linux Kernel: File Operations: start */
+void *
+osl_os_open_image(char *filename)
+{
+       struct file *fp;
+
+       fp = filp_open(filename, O_RDONLY, 0);
+       /*
+        * 2.6.11 (FC4) supports filp_open() but later revs don't?
+        * Alternative:
+        * fp = open_namei(AT_FDCWD, filename, O_RD, 0);
+        * ???
+        */
+        if (IS_ERR(fp))
+                fp = NULL;
+
+        return fp;
+}
+
+int
+osl_os_get_image_block(char *buf, int len, void *image)
+{
+       struct file *fp = (struct file *)image;
+       int rdlen;
+
+       if (!image)
+               return 0;
+
+       rdlen = kernel_read(fp, fp->f_pos, buf, len);
+       if (rdlen > 0)
+               fp->f_pos += rdlen;
+
+       return rdlen;
+}
+
+void
+osl_os_close_image(void *image)
+{
+       if (image)
+               filp_close((struct file *)image, NULL);
+}
+
+int
+osl_os_image_size(void *image)
+{
+       int len = 0, curroffset;
+
+       if (image) {
+               /* store the current offset */
+               curroffset = generic_file_llseek(image, 0, 1);
+               /* goto end of file to get length */
+               len = generic_file_llseek(image, 0, 2);
+               /* restore back the offset */
+               generic_file_llseek(image, curroffset, 0);
+       }
+       return len;
+}
+
+/* Linux Kernel: File Operations: end */
+
+
+/* APIs to set/get specific quirks in OSL layer */
+void
+osl_flag_set(osl_t *osh, uint32 mask)
+{
+       osh->flags |= mask;
+}
+
+bool
+osl_is_flag_set(osl_t *osh, uint32 mask)
+{
+       return (osh->flags & mask);
+}
+
+#ifdef BCM_SECURE_DMA
+
+static void
+osl_sec_dma_setup_contig_mem(osl_t *osh, unsigned long memsize, int regn)
+{
+       int ret;
+
+#if defined(__ARM_ARCH_7A__)
+       if (regn == CONT_ARMREGION) {
+               ret = osl_sec_dma_alloc_contig_mem(osh, memsize, regn);
+               if (ret != BCME_OK)
+                       printk("linux_osl.c: CMA memory access failed\n");
+       }
+#endif
+       /* implement the MIPS Here */
+}
+
+static int
+osl_sec_dma_alloc_contig_mem(osl_t *osh, unsigned long memsize, int regn)
+{
+       u64 addr;
+
+       printk("linux_osl.c: The value of cma mem block size = %ld\n", memsize);
+       osh->cma = cma_dev_get_cma_dev(regn);
+       printk("The value of cma = %p\n", osh->cma);
+       if (!osh->cma) {
+               printk("linux_osl.c:contig_region index is invalid\n");
+               return BCME_ERROR;
+       }
+       if (cma_dev_get_mem(osh->cma, &addr, (u32)memsize, SEC_DMA_ALIGN) < 0) {
+               printk("linux_osl.c: contiguous memory block allocation failure\n");
+               return BCME_ERROR;
+       }
+       osh->contig_base_alloc = (phys_addr_t)addr;
+       osh->contig_base = (phys_addr_t)osh->contig_base_alloc;
+       printk("contig base alloc=%lx \n", (ulong)osh->contig_base_alloc);
+
+       return BCME_OK;
+}
+
+static void
+osl_sec_dma_free_contig_mem(osl_t *osh, u32 memsize, int regn)
+{
+       int ret;
+
+       ret = cma_dev_put_mem(osh->cma, (u64)osh->contig_base, memsize);
+       if (ret)
+               printf("%s contig base free failed\n", __FUNCTION__);
+}
+
+static void *
+osl_sec_dma_ioremap(osl_t *osh, struct page *page, size_t size, bool iscache, bool isdecr)
+{
+
+       struct page **map;
+       int order, i;
+       void *addr = NULL;
+
+       size = PAGE_ALIGN(size);
+       order = get_order(size);
+
+       map = kmalloc(sizeof(struct page *) << order, GFP_ATOMIC);
+
+       if (map == NULL)
+               return NULL;
+
+       for (i = 0; i < (size >> PAGE_SHIFT); i++)
+               map[i] = page + i;
+
+       if (iscache) {
+               addr = vmap(map, size >> PAGE_SHIFT, VM_MAP, __pgprot(PAGE_KERNEL));
+               if (isdecr) {
+                       osh->contig_delta_va_pa = (phys_addr_t)(addr - page_to_phys(page));
+                       g_contig_delta_va_pa = osh->contig_delta_va_pa;
+               }
+       }
+       else {
+
+#if defined(__ARM_ARCH_7A__)
+               addr = vmap(map, size >> PAGE_SHIFT, VM_MAP,
+                       pgprot_noncached(__pgprot(PAGE_KERNEL)));
+#endif
+               if (isdecr) {
+                       osh->contig_delta_va_pa = (phys_addr_t)(addr - page_to_phys(page));
+                       g_contig_delta_va_pa = osh->contig_delta_va_pa;
+               }
+       }
+
+       kfree(map);
+       return (void *)addr;
+}
+
+static void
+osl_sec_dma_iounmap(osl_t *osh, void *contig_base_va, size_t size)
+{
+       vunmap(contig_base_va);
+}
+
+static void
+osl_sec_dma_init_elem_mem_block(osl_t *osh, size_t mbsize, int max, sec_mem_elem_t **list)
+{
+       int i;
+       sec_mem_elem_t *sec_mem_elem;
+
+       if ((sec_mem_elem = kmalloc(sizeof(sec_mem_elem_t)*(max), GFP_ATOMIC)) != NULL) {
+
+               *list = sec_mem_elem;
+               bzero(sec_mem_elem, sizeof(sec_mem_elem_t)*(max));
+               for (i = 0; i < max-1; i++) {
+                       sec_mem_elem->next = (sec_mem_elem + 1);
+                       sec_mem_elem->size = mbsize;
+                       sec_mem_elem->pa_cma = (u32)osh->contig_base_alloc;
+                       sec_mem_elem->vac = osh->contig_base_alloc_va;
+
+                       osh->contig_base_alloc += mbsize;
+                       osh->contig_base_alloc_va += mbsize;
+
+                       sec_mem_elem = sec_mem_elem + 1;
+               }
+               sec_mem_elem->next = NULL;
+               sec_mem_elem->size = mbsize;
+               sec_mem_elem->pa_cma = (u32)osh->contig_base_alloc;
+               sec_mem_elem->vac = osh->contig_base_alloc_va;
+
+               osh->contig_base_alloc += mbsize;
+               osh->contig_base_alloc_va += mbsize;
+
+       }
+       else
+               printf("%s sec mem elem kmalloc failed\n", __FUNCTION__);
+}
+
+
+static void
+osl_sec_dma_deinit_elem_mem_block(osl_t *osh, size_t mbsize, int max, void *sec_list_base)
+{
+       if (sec_list_base)
+               kfree(sec_list_base);
+}
+
+static sec_mem_elem_t * BCMFASTPATH
+osl_sec_dma_alloc_mem_elem(osl_t *osh, void *va, uint size, int direction,
+       struct sec_cma_info *ptr_cma_info, uint offset)
+{
+       sec_mem_elem_t *sec_mem_elem = NULL;
+
+       if (size <= 512 && osh->sec_list_512) {
+               sec_mem_elem = osh->sec_list_512;
+               osh->sec_list_512 = sec_mem_elem->next;
+       }
+       else if (size <= 2048 && osh->sec_list_2048) {
+               sec_mem_elem = osh->sec_list_2048;
+               osh->sec_list_2048 = sec_mem_elem->next;
+       }
+       else if (osh->sec_list_4096) {
+               sec_mem_elem = osh->sec_list_4096;
+               osh->sec_list_4096 = sec_mem_elem->next;
+       } else {
+               printf("%s No matching Pool available size=%d \n", __FUNCTION__, size);
+               return NULL;
+       }
+
+       if (sec_mem_elem != NULL) {
+               sec_mem_elem->next = NULL;
+
+       if (ptr_cma_info->sec_alloc_list_tail) {
+               ptr_cma_info->sec_alloc_list_tail->next = sec_mem_elem;
+       }
+
+       ptr_cma_info->sec_alloc_list_tail = sec_mem_elem;
+       if (ptr_cma_info->sec_alloc_list == NULL)
+               ptr_cma_info->sec_alloc_list = sec_mem_elem;
+       }
+       return sec_mem_elem;
+}
+
+static void BCMFASTPATH
+osl_sec_dma_free_mem_elem(osl_t *osh, sec_mem_elem_t *sec_mem_elem)
+{
+       sec_mem_elem->dma_handle = 0x0;
+       sec_mem_elem->va = NULL;
+
+       if (sec_mem_elem->size == 512) {
+               sec_mem_elem->next = osh->sec_list_512;
+               osh->sec_list_512 = sec_mem_elem;
+       }
+       else if (sec_mem_elem->size == 2048) {
+               sec_mem_elem->next = osh->sec_list_2048;
+               osh->sec_list_2048 = sec_mem_elem;
+       }
+       else if (sec_mem_elem->size == 4096) {
+               sec_mem_elem->next = osh->sec_list_4096;
+               osh->sec_list_4096 = sec_mem_elem;
+       }
+       else
+       printf("%s free failed size=%d \n", __FUNCTION__, sec_mem_elem->size);
+}
+
+static sec_mem_elem_t * BCMFASTPATH
+osl_sec_dma_find_rem_elem(osl_t *osh, struct sec_cma_info *ptr_cma_info, dma_addr_t dma_handle)
+{
+       sec_mem_elem_t *sec_mem_elem = ptr_cma_info->sec_alloc_list;
+       sec_mem_elem_t *sec_prv_elem = ptr_cma_info->sec_alloc_list;
+
+       if (sec_mem_elem->dma_handle == dma_handle) {
+
+               ptr_cma_info->sec_alloc_list = sec_mem_elem->next;
+
+               if (sec_mem_elem == ptr_cma_info->sec_alloc_list_tail) {
+                       ptr_cma_info->sec_alloc_list_tail = NULL;
+                       ASSERT(ptr_cma_info->sec_alloc_list == NULL);
+               }
+
+               return sec_mem_elem;
+       }
+
+       while (sec_mem_elem != NULL) {
+
+               if (sec_mem_elem->dma_handle == dma_handle) {
+
+                       sec_prv_elem->next = sec_mem_elem->next;
+                       if (sec_mem_elem == ptr_cma_info->sec_alloc_list_tail)
+                               ptr_cma_info->sec_alloc_list_tail = sec_prv_elem;
+
+                       return sec_mem_elem;
+               }
+               sec_prv_elem = sec_mem_elem;
+               sec_mem_elem = sec_mem_elem->next;
+       }
+       return NULL;
+}
+
+static sec_mem_elem_t *
+osl_sec_dma_rem_first_elem(osl_t *osh, struct sec_cma_info *ptr_cma_info)
+{
+       sec_mem_elem_t *sec_mem_elem = ptr_cma_info->sec_alloc_list;
+
+       if (sec_mem_elem) {
+
+               ptr_cma_info->sec_alloc_list = sec_mem_elem->next;
+
+               if (ptr_cma_info->sec_alloc_list == NULL)
+                       ptr_cma_info->sec_alloc_list_tail = NULL;
+
+               return sec_mem_elem;
+
+       } else
+               return NULL;
+}
+
+static void * BCMFASTPATH
+osl_sec_dma_last_elem(osl_t *osh, struct sec_cma_info *ptr_cma_info)
+{
+       return ptr_cma_info->sec_alloc_list_tail;
+}
+
+dma_addr_t BCMFASTPATH
+osl_sec_dma_map_txmeta(osl_t *osh, void *va, uint size, int direction, void *p,
+       hnddma_seg_map_t *dmah, void *ptr_cma_info)
+{
+       sec_mem_elem_t *sec_mem_elem;
+       struct page *pa_cma_page;
+       uint loffset;
+       void *vaorig = va + size;
+       dma_addr_t dma_handle = 0x0;
+       /* packet will be the one added with osl_sec_dma_map() just before this call */
+
+       sec_mem_elem = osl_sec_dma_last_elem(osh, ptr_cma_info);
+
+       if (sec_mem_elem && sec_mem_elem->va == vaorig) {
+
+               pa_cma_page = phys_to_page(sec_mem_elem->pa_cma);
+               loffset = sec_mem_elem->pa_cma -(sec_mem_elem->pa_cma & ~(PAGE_SIZE-1));
+
+               dma_handle = dma_map_page(osh->cma->dev, pa_cma_page, loffset, size,
+                       (direction == DMA_TX ? DMA_TO_DEVICE:DMA_FROM_DEVICE));
+
+       } else {
+               printf("%s: error orig va not found va = 0x%p \n",
+                       __FUNCTION__, vaorig);
+       }
+       return dma_handle;
+}
+
+dma_addr_t BCMFASTPATH
+osl_sec_dma_map(osl_t *osh, void *va, uint size, int direction, void *p,
+       hnddma_seg_map_t *dmah, void *ptr_cma_info, uint offset)
+{
+
+       sec_mem_elem_t *sec_mem_elem;
+       struct page *pa_cma_page;
+       void *pa_cma_kmap_va = NULL;
+       int *fragva;
+       uint buflen = 0;
+       struct sk_buff *skb;
+       dma_addr_t dma_handle = 0x0;
+       uint loffset;
+       int i = 0;
+
+       sec_mem_elem = osl_sec_dma_alloc_mem_elem(osh, va, size, direction, ptr_cma_info, offset);
+
+       if (sec_mem_elem == NULL) {
+               printk("linux_osl.c: osl_sec_dma_map - cma allocation failed\n");
+               return 0;
+       }
+       sec_mem_elem->va = va;
+       sec_mem_elem->direction = direction;
+       pa_cma_page = phys_to_page(sec_mem_elem->pa_cma);
+
+       loffset = sec_mem_elem->pa_cma -(sec_mem_elem->pa_cma & ~(PAGE_SIZE-1));
+       /* pa_cma_kmap_va = kmap_atomic(pa_cma_page);
+       * pa_cma_kmap_va += loffset;
+       */
+
+       pa_cma_kmap_va = sec_mem_elem->vac;
+
+       if (direction == DMA_TX) {
+
+               if (p == NULL) {
+
+                       memcpy(pa_cma_kmap_va+offset, va, size);
+                       buflen = size;
+               }
+               else {
+                       for (skb = (struct sk_buff *)p; skb != NULL; skb = PKTNEXT(osh, skb)) {
+                               if (skb_is_nonlinear(skb)) {
+
+
+                                       for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+                                               skb_frag_t *f = &skb_shinfo(skb)->frags[i];
+                                               fragva = kmap_atomic(skb_frag_page(f));
+                                               memcpy((pa_cma_kmap_va+offset+buflen),
+                                               (fragva + f->page_offset), skb_frag_size(f));
+                                               kunmap_atomic(fragva);
+                                               buflen += skb_frag_size(f);
+                                       }
+                               }
+                               else {
+                                       memcpy((pa_cma_kmap_va+offset+buflen), skb->data, skb->len);
+                                       buflen += skb->len;
+                               }
+                       }
+
+               }
+               if (dmah) {
+                       dmah->nsegs = 1;
+                       dmah->origsize = buflen;
+               }
+       }
+
+       else if (direction == DMA_RX)
+       {
+               buflen = size;
+               if ((p != NULL) && (dmah != NULL)) {
+                       dmah->nsegs = 1;
+                       dmah->origsize = buflen;
+               }
+       }
+       if (direction == DMA_RX || direction == DMA_TX) {
+
+               dma_handle = dma_map_page(osh->cma->dev, pa_cma_page, loffset+offset, buflen,
+                       (direction == DMA_TX ? DMA_TO_DEVICE:DMA_FROM_DEVICE));
+
+       }
+       if (dmah) {
+               dmah->segs[0].addr = dma_handle;
+               dmah->segs[0].length = buflen;
+       }
+       sec_mem_elem->dma_handle = dma_handle;
+       /* kunmap_atomic(pa_cma_kmap_va-loffset); */
+       return dma_handle;
+}
+
+dma_addr_t BCMFASTPATH
+osl_sec_dma_dd_map(osl_t *osh, void *va, uint size, int direction, void *p, hnddma_seg_map_t *map)
+{
+
+       struct page *pa_cma_page;
+       phys_addr_t pa_cma;
+       dma_addr_t dma_handle = 0x0;
+       uint loffset;
+
+       pa_cma = (phys_addr_t)(va - osh->contig_delta_va_pa);
+       pa_cma_page = phys_to_page(pa_cma);
+       loffset = pa_cma -(pa_cma & ~(PAGE_SIZE-1));
+
+       dma_handle = dma_map_page(osh->cma->dev, pa_cma_page, loffset, size,
+               (direction == DMA_TX ? DMA_TO_DEVICE:DMA_FROM_DEVICE));
+
+       return dma_handle;
+}
+
+void BCMFASTPATH
+osl_sec_dma_unmap(osl_t *osh, dma_addr_t dma_handle, uint size, int direction,
+void *p, hnddma_seg_map_t *map,        void *ptr_cma_info, uint offset)
+{
+       sec_mem_elem_t *sec_mem_elem;
+       struct page *pa_cma_page;
+       void *pa_cma_kmap_va = NULL;
+       uint buflen = 0;
+       dma_addr_t pa_cma;
+       void *va;
+       uint loffset = 0;
+       int read_count = 0;
+       BCM_REFERENCE(buflen);
+       BCM_REFERENCE(read_count);
+
+       sec_mem_elem = osl_sec_dma_find_rem_elem(osh, ptr_cma_info, dma_handle);
+       if (sec_mem_elem == NULL) {
+               printf("%s sec_mem_elem is NULL and dma_handle =0x%lx and dir=%d\n",
+                       __FUNCTION__, (ulong)dma_handle, direction);
+               return;
+       }
+
+       va = sec_mem_elem->va;
+       va -= offset;
+       pa_cma = sec_mem_elem->pa_cma;
+
+       pa_cma_page = phys_to_page(pa_cma);
+       loffset = sec_mem_elem->pa_cma -(sec_mem_elem->pa_cma & ~(PAGE_SIZE-1));
+
+       if (direction == DMA_RX) {
+
+               if (p == NULL) {
+
+                       /* pa_cma_kmap_va = kmap_atomic(pa_cma_page);
+                       * pa_cma_kmap_va += loffset;
+                       */
+
+                       pa_cma_kmap_va = sec_mem_elem->vac;
+
+                       dma_unmap_page(osh->cma->dev, pa_cma, size, DMA_FROM_DEVICE);
+                       memcpy(va, pa_cma_kmap_va, size);
+                       /* kunmap_atomic(pa_cma_kmap_va); */
+               }
+       } else {
+               dma_unmap_page(osh->cma->dev, pa_cma, size+offset, DMA_TO_DEVICE);
+       }
+
+       osl_sec_dma_free_mem_elem(osh, sec_mem_elem);
+}
+
+void
+osl_sec_dma_unmap_all(osl_t *osh, void *ptr_cma_info)
+{
+
+       sec_mem_elem_t *sec_mem_elem;
+
+       sec_mem_elem = osl_sec_dma_rem_first_elem(osh, ptr_cma_info);
+
+       while (sec_mem_elem != NULL) {
+
+               dma_unmap_page(osh->cma->dev, sec_mem_elem->pa_cma, sec_mem_elem->size,
+                       sec_mem_elem->direction == DMA_TX ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
+               osl_sec_dma_free_mem_elem(osh, sec_mem_elem);
+
+               sec_mem_elem = osl_sec_dma_rem_first_elem(osh, ptr_cma_info);
+       }
+}
+
+static void
+osl_sec_dma_init_consistent(osl_t *osh)
+{
+       int i;
+       void *temp_va = osh->contig_base_alloc_coherent_va;
+       phys_addr_t temp_pa = osh->contig_base_alloc_coherent;
+
+       for (i = 0; i < SEC_CMA_COHERENT_MAX; i++) {
+               osh->sec_cma_coherent[i].avail = TRUE;
+               osh->sec_cma_coherent[i].va = temp_va;
+               osh->sec_cma_coherent[i].pa = temp_pa;
+               temp_va += SEC_CMA_COHERENT_BLK;
+               temp_pa += SEC_CMA_COHERENT_BLK;
+       }
+}
+
+static void *
+osl_sec_dma_alloc_consistent(osl_t *osh, uint size, uint16 align_bits, ulong *pap)
+{
+
+       void *temp_va = NULL;
+       ulong temp_pa = 0;
+       int i;
+
+       if (size > SEC_CMA_COHERENT_BLK) {
+               printf("%s unsupported size\n", __FUNCTION__);
+               return NULL;
+       }
+
+       for (i = 0; i < SEC_CMA_COHERENT_MAX; i++) {
+               if (osh->sec_cma_coherent[i].avail == TRUE) {
+                       temp_va = osh->sec_cma_coherent[i].va;
+                       temp_pa = osh->sec_cma_coherent[i].pa;
+                       osh->sec_cma_coherent[i].avail = FALSE;
+                       break;
+               }
+       }
+
+       if (i == SEC_CMA_COHERENT_MAX)
+               printf("%s:No coherent mem: va = 0x%p pa = 0x%lx size = %d\n", __FUNCTION__,
+                       temp_va, (ulong)temp_pa, size);
+
+       *pap = (unsigned long)temp_pa;
+       return temp_va;
+}
+
+static void
+osl_sec_dma_free_consistent(osl_t *osh, void *va, uint size, dmaaddr_t pa)
+{
+       int i = 0;
+
+       for (i = 0; i < SEC_CMA_COHERENT_MAX; i++) {
+               if (osh->sec_cma_coherent[i].va == va) {
+                       osh->sec_cma_coherent[i].avail = TRUE;
+                       break;
+               }
+       }
+       if (i == SEC_CMA_COHERENT_MAX)
+               printf("%s:Error: va = 0x%p pa = 0x%lx size = %d\n", __FUNCTION__,
+                       va, (ulong)pa, size);
+}
+
+#endif /* BCM_SECURE_DMA */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0) && defined(TSQ_MULTIPLIER)
+#include <linux/kallsyms.h>
+#include <net/sock.h>
+void
+osl_pkt_orphan_partial(struct sk_buff *skb)
+{
+       uint32 fraction;
+       static void *p_tcp_wfree = NULL;
+
+       if (!skb->destructor || skb->destructor == sock_wfree)
+               return;
+
+       if (unlikely(!p_tcp_wfree)) {
+               char sym[KSYM_SYMBOL_LEN];
+               sprint_symbol(sym, (unsigned long)skb->destructor);
+               sym[9] = 0;
+               if (!strcmp(sym, "tcp_wfree"))
+                       p_tcp_wfree = skb->destructor;
+               else
+                       return;
+       }
+
+       if (unlikely(skb->destructor != p_tcp_wfree || !skb->sk))
+               return;
+
+       /* abstract a certain portion of skb truesize from the socket
+        * sk_wmem_alloc to allow more skb can be allocated for this
+        * socket for better cusion meeting WiFi device requirement
+        */
+       fraction = skb->truesize * (TSQ_MULTIPLIER - 1) / TSQ_MULTIPLIER;
+       skb->truesize -= fraction;
+       atomic_sub(fraction, &skb->sk->sk_wmem_alloc);
+}
+#endif /* LINUX_VERSION >= 3.6.0 && TSQ_MULTIPLIER */
diff --git a/drivers/net/wireless/bcmdhd_1363/pcie_core.c b/drivers/net/wireless/bcmdhd_1363/pcie_core.c
new file mode 100644 (file)
index 0000000..8dcf3d1
--- /dev/null
@@ -0,0 +1,115 @@
+/** @file pcie_core.c
+ *
+ * Contains PCIe related functions that are shared between different driver models (e.g. firmware
+ * builds, DHD builds, BMAC builds), in order to avoid code duplication.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: pcie_core.c 591285 2015-10-07 11:56:29Z $
+ */
+
+#include <bcm_cfg.h>
+#include <typedefs.h>
+#include <bcmutils.h>
+#include <bcmdefs.h>
+#include <osl.h>
+#include <siutils.h>
+#include <hndsoc.h>
+#include <sbchipc.h>
+
+#include "pcie_core.h"
+
+/* local prototypes */
+
+/* local variables */
+
+/* function definitions */
+
+#ifdef BCMDRIVER
+
+void pcie_watchdog_reset(osl_t *osh, si_t *sih, sbpcieregs_t *sbpcieregs)
+{
+       uint32 val, i, lsc;
+       uint16 cfg_offset[] = {PCIECFGREG_STATUS_CMD, PCIECFGREG_PM_CSR,
+               PCIECFGREG_MSI_CAP, PCIECFGREG_MSI_ADDR_L,
+               PCIECFGREG_MSI_ADDR_H, PCIECFGREG_MSI_DATA,
+               PCIECFGREG_LINK_STATUS_CTRL2, PCIECFGREG_RBAR_CTRL,
+               PCIECFGREG_PML1_SUB_CTRL1, PCIECFGREG_REG_BAR2_CONFIG,
+               PCIECFGREG_REG_BAR3_CONFIG};
+       sbpcieregs_t *pcie = NULL;
+       uint32 origidx = si_coreidx(sih);
+
+       /* Switch to PCIE2 core */
+       pcie = (sbpcieregs_t *)si_setcore(sih, PCIE2_CORE_ID, 0);
+       BCM_REFERENCE(pcie);
+       ASSERT(pcie != NULL);
+
+       /* Disable/restore ASPM Control to protect the watchdog reset */
+       W_REG(osh, &sbpcieregs->configaddr, PCIECFGREG_LINK_STATUS_CTRL);
+       lsc = R_REG(osh, &sbpcieregs->configdata);
+       val = lsc & (~PCIE_ASPM_ENAB);
+       W_REG(osh, &sbpcieregs->configdata, val);
+
+       si_corereg(sih, SI_CC_IDX, OFFSETOF(chipcregs_t, watchdog), ~0, 4);
+       OSL_DELAY(100000);
+
+       W_REG(osh, &sbpcieregs->configaddr, PCIECFGREG_LINK_STATUS_CTRL);
+       W_REG(osh, &sbpcieregs->configdata, lsc);
+
+       if (sih->buscorerev <= 13) {
+               /* Write configuration registers back to the shadow registers
+                * cause shadow registers are cleared out after watchdog reset.
+                */
+               for (i = 0; i < ARRAYSIZE(cfg_offset); i++) {
+                       W_REG(osh, &sbpcieregs->configaddr, cfg_offset[i]);
+                       val = R_REG(osh, &sbpcieregs->configdata);
+                       W_REG(osh, &sbpcieregs->configdata, val);
+               }
+       }
+       si_setcoreidx(sih, origidx);
+}
+
+
+/* CRWLPCIEGEN2-117 pcie_pipe_Iddq should be controlled
+ * by the L12 state from MAC to save power by putting the
+ * SerDes analog in IDDQ mode
+ */
+void  pcie_serdes_iddqdisable(osl_t *osh, si_t *sih, sbpcieregs_t *sbpcieregs)
+{
+       sbpcieregs_t *pcie = NULL;
+       uint crwlpciegen2_117_disable = 0;
+       uint32 origidx = si_coreidx(sih);
+
+       crwlpciegen2_117_disable = PCIE_PipeIddqDisable0 | PCIE_PipeIddqDisable1;
+       /* Switch to PCIE2 core */
+       pcie = (sbpcieregs_t *)si_setcore(sih, PCIE2_CORE_ID, 0);
+       BCM_REFERENCE(pcie);
+       ASSERT(pcie != NULL);
+
+       OR_REG(osh, &sbpcieregs->control,
+               crwlpciegen2_117_disable);
+
+       si_setcoreidx(sih, origidx);
+}
+#endif /* BCMDRIVER */
diff --git a/drivers/net/wireless/bcmdhd_1363/sbutils.c b/drivers/net/wireless/bcmdhd_1363/sbutils.c
new file mode 100644 (file)
index 0000000..25c6cfd
--- /dev/null
@@ -0,0 +1,1108 @@
+/*
+ * Misc utility routines for accessing chip-specific features
+ * of the SiliconBackplane-based Broadcom chips.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: sbutils.c 514727 2014-11-12 03:02:48Z $
+ */
+
+#include <bcm_cfg.h>
+#include <typedefs.h>
+#include <bcmdefs.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <siutils.h>
+#include <bcmdevs.h>
+#include <hndsoc.h>
+#include <sbchipc.h>
+#include <pcicfg.h>
+#include <sbpcmcia.h>
+
+#include "siutils_priv.h"
+
+
+/* local prototypes */
+static uint _sb_coreidx(si_info_t *sii, uint32 sba);
+static uint _sb_scan(si_info_t *sii, uint32 sba, void *regs, uint bus, uint32 sbba,
+                     uint ncores);
+static uint32 _sb_coresba(si_info_t *sii);
+static void *_sb_setcoreidx(si_info_t *sii, uint coreidx);
+#define        SET_SBREG(sii, r, mask, val)    \
+               W_SBREG((sii), (r), ((R_SBREG((sii), (r)) & ~(mask)) | (val)))
+#define        REGS2SB(va)     (sbconfig_t*) ((int8*)(va) + SBCONFIGOFF)
+
+/* sonicsrev */
+#define        SONICS_2_2      (SBIDL_RV_2_2 >> SBIDL_RV_SHIFT)
+#define        SONICS_2_3      (SBIDL_RV_2_3 >> SBIDL_RV_SHIFT)
+
+#define        R_SBREG(sii, sbr)       sb_read_sbreg((sii), (sbr))
+#define        W_SBREG(sii, sbr, v)    sb_write_sbreg((sii), (sbr), (v))
+#define        AND_SBREG(sii, sbr, v)  W_SBREG((sii), (sbr), (R_SBREG((sii), (sbr)) & (v)))
+#define        OR_SBREG(sii, sbr, v)   W_SBREG((sii), (sbr), (R_SBREG((sii), (sbr)) | (v)))
+
+static uint32
+sb_read_sbreg(si_info_t *sii, volatile uint32 *sbr)
+{
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint8 tmp;
+       uint32 val, intr_val = 0;
+
+
+       /*
+        * compact flash only has 11 bits address, while we needs 12 bits address.
+        * MEM_SEG will be OR'd with other 11 bits address in hardware,
+        * so we program MEM_SEG with 12th bit when necessary(access sb regsiters).
+        * For normal PCMCIA bus(CFTable_regwinsz > 2k), do nothing special
+        */
+       if (PCMCIA(sii)) {
+               INTR_OFF(sii, intr_val);
+               tmp = 1;
+               OSL_PCMCIA_WRITE_ATTR(sii->osh, MEM_SEG, &tmp, 1);
+               sbr = (volatile uint32 *)((uintptr)sbr & ~(1 << 11)); /* mask out bit 11 */
+       }
+
+       val = R_REG(sii->osh, sbr);
+
+       if (PCMCIA(sii)) {
+               tmp = 0;
+               OSL_PCMCIA_WRITE_ATTR(sii->osh, MEM_SEG, &tmp, 1);
+               INTR_RESTORE(sii, intr_val);
+       }
+
+       return (val);
+}
+
+static void
+sb_write_sbreg(si_info_t *sii, volatile uint32 *sbr, uint32 v)
+{
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint8 tmp;
+       volatile uint32 dummy;
+       uint32 intr_val = 0;
+
+
+       /*
+        * compact flash only has 11 bits address, while we needs 12 bits address.
+        * MEM_SEG will be OR'd with other 11 bits address in hardware,
+        * so we program MEM_SEG with 12th bit when necessary(access sb regsiters).
+        * For normal PCMCIA bus(CFTable_regwinsz > 2k), do nothing special
+        */
+       if (PCMCIA(sii)) {
+               INTR_OFF(sii, intr_val);
+               tmp = 1;
+               OSL_PCMCIA_WRITE_ATTR(sii->osh, MEM_SEG, &tmp, 1);
+               sbr = (volatile uint32 *)((uintptr)sbr & ~(1 << 11)); /* mask out bit 11 */
+       }
+
+       if (BUSTYPE(sii->pub.bustype) == PCMCIA_BUS) {
+               dummy = R_REG(sii->osh, sbr);
+               BCM_REFERENCE(dummy);
+               W_REG(sii->osh, (volatile uint16 *)sbr, (uint16)(v & 0xffff));
+               dummy = R_REG(sii->osh, sbr);
+               BCM_REFERENCE(dummy);
+               W_REG(sii->osh, ((volatile uint16 *)sbr + 1), (uint16)((v >> 16) & 0xffff));
+       } else
+               W_REG(sii->osh, sbr, v);
+
+       if (PCMCIA(sii)) {
+               tmp = 0;
+               OSL_PCMCIA_WRITE_ATTR(sii->osh, MEM_SEG, &tmp, 1);
+               INTR_RESTORE(sii, intr_val);
+       }
+}
+
+uint
+sb_coreid(si_t *sih)
+{
+       si_info_t *sii;
+       sbconfig_t *sb;
+
+       sii = SI_INFO(sih);
+       sb = REGS2SB(sii->curmap);
+
+       return ((R_SBREG(sii, &sb->sbidhigh) & SBIDH_CC_MASK) >> SBIDH_CC_SHIFT);
+}
+
+uint
+sb_intflag(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       void *corereg;
+       sbconfig_t *sb;
+       uint origidx, intflag, intr_val = 0;
+
+       INTR_OFF(sii, intr_val);
+       origidx = si_coreidx(sih);
+       corereg = si_setcore(sih, CC_CORE_ID, 0);
+       ASSERT(corereg != NULL);
+       sb = REGS2SB(corereg);
+       intflag = R_SBREG(sii, &sb->sbflagst);
+       sb_setcoreidx(sih, origidx);
+       INTR_RESTORE(sii, intr_val);
+
+       return intflag;
+}
+
+uint
+sb_flag(si_t *sih)
+{
+       si_info_t *sii;
+       sbconfig_t *sb;
+
+       sii = SI_INFO(sih);
+       sb = REGS2SB(sii->curmap);
+
+       return R_SBREG(sii, &sb->sbtpsflag) & SBTPS_NUM0_MASK;
+}
+
+void
+sb_setint(si_t *sih, int siflag)
+{
+       si_info_t *sii;
+       sbconfig_t *sb;
+       uint32 vec;
+
+       sii = SI_INFO(sih);
+       sb = REGS2SB(sii->curmap);
+
+       if (siflag == -1)
+               vec = 0;
+       else
+               vec = 1 << siflag;
+       W_SBREG(sii, &sb->sbintvec, vec);
+}
+
+/* return core index of the core with address 'sba' */
+static uint
+_sb_coreidx(si_info_t *sii, uint32 sba)
+{
+       uint i;
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+       for (i = 0; i < sii->numcores; i ++)
+               if (sba == cores_info->coresba[i])
+                       return i;
+       return BADIDX;
+}
+
+/* return core address of the current core */
+static uint32
+_sb_coresba(si_info_t *sii)
+{
+       uint32 sbaddr;
+
+
+       switch (BUSTYPE(sii->pub.bustype)) {
+       case SI_BUS: {
+               sbconfig_t *sb = REGS2SB(sii->curmap);
+               sbaddr = sb_base(R_SBREG(sii, &sb->sbadmatch0));
+               break;
+       }
+
+       case PCI_BUS:
+               sbaddr = OSL_PCI_READ_CONFIG(sii->osh, PCI_BAR0_WIN, sizeof(uint32));
+               break;
+
+       case PCMCIA_BUS: {
+               uint8 tmp = 0;
+               OSL_PCMCIA_READ_ATTR(sii->osh, PCMCIA_ADDR0, &tmp, 1);
+               sbaddr  = (uint32)tmp << 12;
+               OSL_PCMCIA_READ_ATTR(sii->osh, PCMCIA_ADDR1, &tmp, 1);
+               sbaddr |= (uint32)tmp << 16;
+               OSL_PCMCIA_READ_ATTR(sii->osh, PCMCIA_ADDR2, &tmp, 1);
+               sbaddr |= (uint32)tmp << 24;
+               break;
+       }
+
+#ifdef BCMSDIO
+       case SPI_BUS:
+       case SDIO_BUS:
+               sbaddr = (uint32)(uintptr)sii->curmap;
+               break;
+#endif
+
+
+       default:
+               sbaddr = BADCOREADDR;
+               break;
+       }
+
+       return sbaddr;
+}
+
+uint
+sb_corevendor(si_t *sih)
+{
+       si_info_t *sii;
+       sbconfig_t *sb;
+
+       sii = SI_INFO(sih);
+       sb = REGS2SB(sii->curmap);
+
+       return ((R_SBREG(sii, &sb->sbidhigh) & SBIDH_VC_MASK) >> SBIDH_VC_SHIFT);
+}
+
+uint
+sb_corerev(si_t *sih)
+{
+       si_info_t *sii;
+       sbconfig_t *sb;
+       uint sbidh;
+
+       sii = SI_INFO(sih);
+       sb = REGS2SB(sii->curmap);
+       sbidh = R_SBREG(sii, &sb->sbidhigh);
+
+       return (SBCOREREV(sbidh));
+}
+
+/* set core-specific control flags */
+void
+sb_core_cflags_wo(si_t *sih, uint32 mask, uint32 val)
+{
+       si_info_t *sii;
+       sbconfig_t *sb;
+       uint32 w;
+
+       sii = SI_INFO(sih);
+       sb = REGS2SB(sii->curmap);
+
+       ASSERT((val & ~mask) == 0);
+
+       /* mask and set */
+       w = (R_SBREG(sii, &sb->sbtmstatelow) & ~(mask << SBTML_SICF_SHIFT)) |
+               (val << SBTML_SICF_SHIFT);
+       W_SBREG(sii, &sb->sbtmstatelow, w);
+}
+
+/* set/clear core-specific control flags */
+uint32
+sb_core_cflags(si_t *sih, uint32 mask, uint32 val)
+{
+       si_info_t *sii;
+       sbconfig_t *sb;
+       uint32 w;
+
+       sii = SI_INFO(sih);
+       sb = REGS2SB(sii->curmap);
+
+       ASSERT((val & ~mask) == 0);
+
+       /* mask and set */
+       if (mask || val) {
+               w = (R_SBREG(sii, &sb->sbtmstatelow) & ~(mask << SBTML_SICF_SHIFT)) |
+                       (val << SBTML_SICF_SHIFT);
+               W_SBREG(sii, &sb->sbtmstatelow, w);
+       }
+
+       /* return the new value
+        * for write operation, the following readback ensures the completion of write opration.
+        */
+       return (R_SBREG(sii, &sb->sbtmstatelow) >> SBTML_SICF_SHIFT);
+}
+
+/* set/clear core-specific status flags */
+uint32
+sb_core_sflags(si_t *sih, uint32 mask, uint32 val)
+{
+       si_info_t *sii;
+       sbconfig_t *sb;
+       uint32 w;
+
+       sii = SI_INFO(sih);
+       sb = REGS2SB(sii->curmap);
+
+       ASSERT((val & ~mask) == 0);
+       ASSERT((mask & ~SISF_CORE_BITS) == 0);
+
+       /* mask and set */
+       if (mask || val) {
+               w = (R_SBREG(sii, &sb->sbtmstatehigh) & ~(mask << SBTMH_SISF_SHIFT)) |
+                       (val << SBTMH_SISF_SHIFT);
+               W_SBREG(sii, &sb->sbtmstatehigh, w);
+       }
+
+       /* return the new value */
+       return (R_SBREG(sii, &sb->sbtmstatehigh) >> SBTMH_SISF_SHIFT);
+}
+
+bool
+sb_iscoreup(si_t *sih)
+{
+       si_info_t *sii;
+       sbconfig_t *sb;
+
+       sii = SI_INFO(sih);
+       sb = REGS2SB(sii->curmap);
+
+       return ((R_SBREG(sii, &sb->sbtmstatelow) &
+                (SBTML_RESET | SBTML_REJ_MASK | (SICF_CLOCK_EN << SBTML_SICF_SHIFT))) ==
+               (SICF_CLOCK_EN << SBTML_SICF_SHIFT));
+}
+
+/*
+ * Switch to 'coreidx', issue a single arbitrary 32bit register mask&set operation,
+ * switch back to the original core, and return the new value.
+ *
+ * When using the silicon backplane, no fidleing with interrupts or core switches are needed.
+ *
+ * Also, when using pci/pcie, we can optimize away the core switching for pci registers
+ * and (on newer pci cores) chipcommon registers.
+ */
+uint
+sb_corereg(si_t *sih, uint coreidx, uint regoff, uint mask, uint val)
+{
+       uint origidx = 0;
+       uint32 *r = NULL;
+       uint w;
+       uint intr_val = 0;
+       bool fast = FALSE;
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+       ASSERT(GOODIDX(coreidx));
+       ASSERT(regoff < SI_CORE_SIZE);
+       ASSERT((val & ~mask) == 0);
+
+       if (coreidx >= SI_MAXCORES)
+               return 0;
+
+       if (BUSTYPE(sii->pub.bustype) == SI_BUS) {
+               /* If internal bus, we can always get at everything */
+               fast = TRUE;
+               /* map if does not exist */
+               if (!cores_info->regs[coreidx]) {
+                       cores_info->regs[coreidx] = REG_MAP(cores_info->coresba[coreidx],
+                                                   SI_CORE_SIZE);
+                       ASSERT(GOODREGS(cores_info->regs[coreidx]));
+               }
+               r = (uint32 *)((uchar *)cores_info->regs[coreidx] + regoff);
+       } else if (BUSTYPE(sii->pub.bustype) == PCI_BUS) {
+               /* If pci/pcie, we can get at pci/pcie regs and on newer cores to chipc */
+
+               if ((cores_info->coreid[coreidx] == CC_CORE_ID) && SI_FAST(sii)) {
+                       /* Chipc registers are mapped at 12KB */
+
+                       fast = TRUE;
+                       r = (uint32 *)((char *)sii->curmap + PCI_16KB0_CCREGS_OFFSET + regoff);
+               } else if (sii->pub.buscoreidx == coreidx) {
+                       /* pci registers are at either in the last 2KB of an 8KB window
+                        * or, in pcie and pci rev 13 at 8KB
+                        */
+                       fast = TRUE;
+                       if (SI_FAST(sii))
+                               r = (uint32 *)((char *)sii->curmap +
+                                              PCI_16KB0_PCIREGS_OFFSET + regoff);
+                       else
+                               r = (uint32 *)((char *)sii->curmap +
+                                              ((regoff >= SBCONFIGOFF) ?
+                                               PCI_BAR0_PCISBR_OFFSET : PCI_BAR0_PCIREGS_OFFSET) +
+                                              regoff);
+               }
+       }
+
+       if (!fast) {
+               INTR_OFF(sii, intr_val);
+
+               /* save current core index */
+               origidx = si_coreidx(&sii->pub);
+
+               /* switch core */
+               r = (uint32*) ((uchar*)sb_setcoreidx(&sii->pub, coreidx) + regoff);
+       }
+       ASSERT(r != NULL);
+
+       /* mask and set */
+       if (mask || val) {
+               if (regoff >= SBCONFIGOFF) {
+                       w = (R_SBREG(sii, r) & ~mask) | val;
+                       W_SBREG(sii, r, w);
+               } else {
+                       w = (R_REG(sii->osh, r) & ~mask) | val;
+                       W_REG(sii->osh, r, w);
+               }
+       }
+
+       /* readback */
+       if (regoff >= SBCONFIGOFF)
+               w = R_SBREG(sii, r);
+       else {
+               if ((CHIPID(sii->pub.chip) == BCM5354_CHIP_ID) &&
+                   (coreidx == SI_CC_IDX) &&
+                   (regoff == OFFSETOF(chipcregs_t, watchdog))) {
+                       w = val;
+               } else
+                       w = R_REG(sii->osh, r);
+       }
+
+       if (!fast) {
+               /* restore core index */
+               if (origidx != coreidx)
+                       sb_setcoreidx(&sii->pub, origidx);
+
+               INTR_RESTORE(sii, intr_val);
+       }
+
+       return (w);
+}
+
+/*
+ * If there is no need for fiddling with interrupts or core switches (typically silicon
+ * back plane registers, pci registers and chipcommon registers), this function
+ * returns the register offset on this core to a mapped address. This address can
+ * be used for W_REG/R_REG directly.
+ *
+ * For accessing registers that would need a core switch, this function will return
+ * NULL.
+ */
+uint32 *
+sb_corereg_addr(si_t *sih, uint coreidx, uint regoff)
+{
+       uint32 *r = NULL;
+       bool fast = FALSE;
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+       ASSERT(GOODIDX(coreidx));
+       ASSERT(regoff < SI_CORE_SIZE);
+
+       if (coreidx >= SI_MAXCORES)
+               return 0;
+
+       if (BUSTYPE(sii->pub.bustype) == SI_BUS) {
+               /* If internal bus, we can always get at everything */
+               fast = TRUE;
+               /* map if does not exist */
+               if (!cores_info->regs[coreidx]) {
+                       cores_info->regs[coreidx] = REG_MAP(cores_info->coresba[coreidx],
+                                                   SI_CORE_SIZE);
+                       ASSERT(GOODREGS(cores_info->regs[coreidx]));
+               }
+               r = (uint32 *)((uchar *)cores_info->regs[coreidx] + regoff);
+       } else if (BUSTYPE(sii->pub.bustype) == PCI_BUS) {
+               /* If pci/pcie, we can get at pci/pcie regs and on newer cores to chipc */
+
+               if ((cores_info->coreid[coreidx] == CC_CORE_ID) && SI_FAST(sii)) {
+                       /* Chipc registers are mapped at 12KB */
+
+                       fast = TRUE;
+                       r = (uint32 *)((char *)sii->curmap + PCI_16KB0_CCREGS_OFFSET + regoff);
+               } else if (sii->pub.buscoreidx == coreidx) {
+                       /* pci registers are at either in the last 2KB of an 8KB window
+                        * or, in pcie and pci rev 13 at 8KB
+                        */
+                       fast = TRUE;
+                       if (SI_FAST(sii))
+                               r = (uint32 *)((char *)sii->curmap +
+                                              PCI_16KB0_PCIREGS_OFFSET + regoff);
+                       else
+                               r = (uint32 *)((char *)sii->curmap +
+                                              ((regoff >= SBCONFIGOFF) ?
+                                               PCI_BAR0_PCISBR_OFFSET : PCI_BAR0_PCIREGS_OFFSET) +
+                                              regoff);
+               }
+       }
+
+       if (!fast)
+               return 0;
+
+       return (r);
+}
+
+/* Scan the enumeration space to find all cores starting from the given
+ * bus 'sbba'. Append coreid and other info to the lists in 'si'. 'sba'
+ * is the default core address at chip POR time and 'regs' is the virtual
+ * address that the default core is mapped at. 'ncores' is the number of
+ * cores expected on bus 'sbba'. It returns the total number of cores
+ * starting from bus 'sbba', inclusive.
+ */
+#define SB_MAXBUSES    2
+static uint
+_sb_scan(si_info_t *sii, uint32 sba, void *regs, uint bus, uint32 sbba, uint numcores)
+{
+       uint next;
+       uint ncc = 0;
+       uint i;
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+       if (bus >= SB_MAXBUSES) {
+               SI_ERROR(("_sb_scan: bus 0x%08x at level %d is too deep to scan\n", sbba, bus));
+               return 0;
+       }
+       SI_MSG(("_sb_scan: scan bus 0x%08x assume %u cores\n", sbba, numcores));
+
+       /* Scan all cores on the bus starting from core 0.
+        * Core addresses must be contiguous on each bus.
+        */
+       for (i = 0, next = sii->numcores; i < numcores && next < SB_BUS_MAXCORES; i++, next++) {
+               cores_info->coresba[next] = sbba + (i * SI_CORE_SIZE);
+
+               /* keep and reuse the initial register mapping */
+               if ((BUSTYPE(sii->pub.bustype) == SI_BUS) && (cores_info->coresba[next] == sba)) {
+                       SI_VMSG(("_sb_scan: reuse mapped regs %p for core %u\n", regs, next));
+                       cores_info->regs[next] = regs;
+               }
+
+               /* change core to 'next' and read its coreid */
+               sii->curmap = _sb_setcoreidx(sii, next);
+               sii->curidx = next;
+
+               cores_info->coreid[next] = sb_coreid(&sii->pub);
+
+               /* core specific processing... */
+               /* chipc provides # cores */
+               if (cores_info->coreid[next] == CC_CORE_ID) {
+                       chipcregs_t *cc = (chipcregs_t *)sii->curmap;
+                       uint32 ccrev = sb_corerev(&sii->pub);
+
+                       /* determine numcores - this is the total # cores in the chip */
+                       if (((ccrev == 4) || (ccrev >= 6))) {
+                               ASSERT(cc);
+                               numcores = (R_REG(sii->osh, &cc->chipid) & CID_CC_MASK) >>
+                                       CID_CC_SHIFT;
+                       } else {
+                               /* Older chips */
+                               uint chip = CHIPID(sii->pub.chip);
+
+                               if (chip == BCM4306_CHIP_ID)    /* < 4306c0 */
+                                       numcores = 6;
+                               else if (chip == BCM4704_CHIP_ID)
+                                       numcores = 9;
+                               else if (chip == BCM5365_CHIP_ID)
+                                       numcores = 7;
+                               else {
+                                       SI_ERROR(("sb_chip2numcores: unsupported chip 0x%x\n",
+                                                 chip));
+                                       ASSERT(0);
+                                       numcores = 1;
+                               }
+                       }
+                       SI_VMSG(("_sb_scan: there are %u cores in the chip %s\n", numcores,
+                               sii->pub.issim ? "QT" : ""));
+               }
+               /* scan bridged SB(s) and add results to the end of the list */
+               else if (cores_info->coreid[next] == OCP_CORE_ID) {
+                       sbconfig_t *sb = REGS2SB(sii->curmap);
+                       uint32 nsbba = R_SBREG(sii, &sb->sbadmatch1);
+                       uint nsbcc;
+
+                       sii->numcores = next + 1;
+
+                       if ((nsbba & 0xfff00000) != SI_ENUM_BASE)
+                               continue;
+                       nsbba &= 0xfffff000;
+                       if (_sb_coreidx(sii, nsbba) != BADIDX)
+                               continue;
+
+                       nsbcc = (R_SBREG(sii, &sb->sbtmstatehigh) & 0x000f0000) >> 16;
+                       nsbcc = _sb_scan(sii, sba, regs, bus + 1, nsbba, nsbcc);
+                       if (sbba == SI_ENUM_BASE)
+                               numcores -= nsbcc;
+                       ncc += nsbcc;
+               }
+       }
+
+       SI_MSG(("_sb_scan: found %u cores on bus 0x%08x\n", i, sbba));
+
+       sii->numcores = i + ncc;
+       return sii->numcores;
+}
+
+/* scan the sb enumerated space to identify all cores */
+void
+sb_scan(si_t *sih, void *regs, uint devid)
+{
+       uint32 origsba;
+       sbconfig_t *sb;
+       si_info_t *sii = SI_INFO(sih);
+
+       sb = REGS2SB(sii->curmap);
+
+       sii->pub.socirev = (R_SBREG(sii, &sb->sbidlow) & SBIDL_RV_MASK) >> SBIDL_RV_SHIFT;
+
+       /* Save the current core info and validate it later till we know
+        * for sure what is good and what is bad.
+        */
+       origsba = _sb_coresba(sii);
+
+       /* scan all SB(s) starting from SI_ENUM_BASE */
+       sii->numcores = _sb_scan(sii, origsba, regs, 0, SI_ENUM_BASE, 1);
+}
+
+/*
+ * This function changes logical "focus" to the indicated core;
+ * must be called with interrupts off.
+ * Moreover, callers should keep interrupts off during switching out of and back to d11 core
+ */
+void *
+sb_setcoreidx(si_t *sih, uint coreidx)
+{
+       si_info_t *sii = SI_INFO(sih);
+
+       if (coreidx >= sii->numcores)
+               return (NULL);
+
+       /*
+        * If the user has provided an interrupt mask enabled function,
+        * then assert interrupts are disabled before switching the core.
+        */
+       ASSERT((sii->intrsenabled_fn == NULL) || !(*(sii)->intrsenabled_fn)((sii)->intr_arg));
+
+       sii->curmap = _sb_setcoreidx(sii, coreidx);
+       sii->curidx = coreidx;
+
+       return (sii->curmap);
+}
+
+/* This function changes the logical "focus" to the indicated core.
+ * Return the current core's virtual address.
+ */
+static void *
+_sb_setcoreidx(si_info_t *sii, uint coreidx)
+{
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint32 sbaddr = cores_info->coresba[coreidx];
+       void *regs;
+
+       switch (BUSTYPE(sii->pub.bustype)) {
+       case SI_BUS:
+               /* map new one */
+               if (!cores_info->regs[coreidx]) {
+                       cores_info->regs[coreidx] = REG_MAP(sbaddr, SI_CORE_SIZE);
+                       ASSERT(GOODREGS(cores_info->regs[coreidx]));
+               }
+               regs = cores_info->regs[coreidx];
+               break;
+
+       case PCI_BUS:
+               /* point bar0 window */
+               OSL_PCI_WRITE_CONFIG(sii->osh, PCI_BAR0_WIN, 4, sbaddr);
+               regs = sii->curmap;
+               break;
+
+       case PCMCIA_BUS: {
+               uint8 tmp = (sbaddr >> 12) & 0x0f;
+               OSL_PCMCIA_WRITE_ATTR(sii->osh, PCMCIA_ADDR0, &tmp, 1);
+               tmp = (sbaddr >> 16) & 0xff;
+               OSL_PCMCIA_WRITE_ATTR(sii->osh, PCMCIA_ADDR1, &tmp, 1);
+               tmp = (sbaddr >> 24) & 0xff;
+               OSL_PCMCIA_WRITE_ATTR(sii->osh, PCMCIA_ADDR2, &tmp, 1);
+               regs = sii->curmap;
+               break;
+       }
+#ifdef BCMSDIO
+       case SPI_BUS:
+       case SDIO_BUS:
+               /* map new one */
+               if (!cores_info->regs[coreidx]) {
+                       cores_info->regs[coreidx] = (void *)(uintptr)sbaddr;
+                       ASSERT(GOODREGS(cores_info->regs[coreidx]));
+               }
+               regs = cores_info->regs[coreidx];
+               break;
+#endif /* BCMSDIO */
+
+
+       default:
+               ASSERT(0);
+               regs = NULL;
+               break;
+       }
+
+       return regs;
+}
+
+/* Return the address of sbadmatch0/1/2/3 register */
+static volatile uint32 *
+sb_admatch(si_info_t *sii, uint asidx)
+{
+       sbconfig_t *sb;
+       volatile uint32 *addrm;
+
+       sb = REGS2SB(sii->curmap);
+
+       switch (asidx) {
+       case 0:
+               addrm =  &sb->sbadmatch0;
+               break;
+
+       case 1:
+               addrm =  &sb->sbadmatch1;
+               break;
+
+       case 2:
+               addrm =  &sb->sbadmatch2;
+               break;
+
+       case 3:
+               addrm =  &sb->sbadmatch3;
+               break;
+
+       default:
+               SI_ERROR(("%s: Address space index (%d) out of range\n", __FUNCTION__, asidx));
+               return 0;
+       }
+
+       return (addrm);
+}
+
+/* Return the number of address spaces in current core */
+int
+sb_numaddrspaces(si_t *sih)
+{
+       si_info_t *sii;
+       sbconfig_t *sb;
+
+       sii = SI_INFO(sih);
+       sb = REGS2SB(sii->curmap);
+
+       /* + 1 because of enumeration space */
+       return ((R_SBREG(sii, &sb->sbidlow) & SBIDL_AR_MASK) >> SBIDL_AR_SHIFT) + 1;
+}
+
+/* Return the address of the nth address space in the current core */
+uint32
+sb_addrspace(si_t *sih, uint asidx)
+{
+       si_info_t *sii;
+
+       sii = SI_INFO(sih);
+
+       return (sb_base(R_SBREG(sii, sb_admatch(sii, asidx))));
+}
+
+/* Return the size of the nth address space in the current core */
+uint32
+sb_addrspacesize(si_t *sih, uint asidx)
+{
+       si_info_t *sii;
+
+       sii = SI_INFO(sih);
+
+       return (sb_size(R_SBREG(sii, sb_admatch(sii, asidx))));
+}
+
+
+/* do buffered registers update */
+void
+sb_commit(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint origidx;
+       uint intr_val = 0;
+
+       origidx = sii->curidx;
+       ASSERT(GOODIDX(origidx));
+
+       INTR_OFF(sii, intr_val);
+
+       /* switch over to chipcommon core if there is one, else use pci */
+       if (sii->pub.ccrev != NOREV) {
+               chipcregs_t *ccregs = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0);
+               ASSERT(ccregs != NULL);
+
+               /* do the buffer registers update */
+               W_REG(sii->osh, &ccregs->broadcastaddress, SB_COMMIT);
+               W_REG(sii->osh, &ccregs->broadcastdata, 0x0);
+       } else
+               ASSERT(0);
+
+       /* restore core index */
+       sb_setcoreidx(sih, origidx);
+       INTR_RESTORE(sii, intr_val);
+}
+
+void
+sb_core_disable(si_t *sih, uint32 bits)
+{
+       si_info_t *sii;
+       volatile uint32 dummy;
+       sbconfig_t *sb;
+
+       sii = SI_INFO(sih);
+
+       ASSERT(GOODREGS(sii->curmap));
+       sb = REGS2SB(sii->curmap);
+
+       /* if core is already in reset, just return */
+       if (R_SBREG(sii, &sb->sbtmstatelow) & SBTML_RESET)
+               return;
+
+       /* if clocks are not enabled, put into reset and return */
+       if ((R_SBREG(sii, &sb->sbtmstatelow) & (SICF_CLOCK_EN << SBTML_SICF_SHIFT)) == 0)
+               goto disable;
+
+       /* set target reject and spin until busy is clear (preserve core-specific bits) */
+       OR_SBREG(sii, &sb->sbtmstatelow, SBTML_REJ);
+       dummy = R_SBREG(sii, &sb->sbtmstatelow);
+       BCM_REFERENCE(dummy);
+       OSL_DELAY(1);
+       SPINWAIT((R_SBREG(sii, &sb->sbtmstatehigh) & SBTMH_BUSY), 100000);
+       if (R_SBREG(sii, &sb->sbtmstatehigh) & SBTMH_BUSY)
+               SI_ERROR(("%s: target state still busy\n", __FUNCTION__));
+
+       if (R_SBREG(sii, &sb->sbidlow) & SBIDL_INIT) {
+               OR_SBREG(sii, &sb->sbimstate, SBIM_RJ);
+               dummy = R_SBREG(sii, &sb->sbimstate);
+               BCM_REFERENCE(dummy);
+               OSL_DELAY(1);
+               SPINWAIT((R_SBREG(sii, &sb->sbimstate) & SBIM_BY), 100000);
+       }
+
+       /* set reset and reject while enabling the clocks */
+       W_SBREG(sii, &sb->sbtmstatelow,
+               (((bits | SICF_FGC | SICF_CLOCK_EN) << SBTML_SICF_SHIFT) |
+                SBTML_REJ | SBTML_RESET));
+       dummy = R_SBREG(sii, &sb->sbtmstatelow);
+       BCM_REFERENCE(dummy);
+       OSL_DELAY(10);
+
+       /* don't forget to clear the initiator reject bit */
+       if (R_SBREG(sii, &sb->sbidlow) & SBIDL_INIT)
+               AND_SBREG(sii, &sb->sbimstate, ~SBIM_RJ);
+
+disable:
+       /* leave reset and reject asserted */
+       W_SBREG(sii, &sb->sbtmstatelow, ((bits << SBTML_SICF_SHIFT) | SBTML_REJ | SBTML_RESET));
+       OSL_DELAY(1);
+}
+
+/* reset and re-enable a core
+ * inputs:
+ * bits - core specific bits that are set during and after reset sequence
+ * resetbits - core specific bits that are set only during reset sequence
+ */
+void
+sb_core_reset(si_t *sih, uint32 bits, uint32 resetbits)
+{
+       si_info_t *sii;
+       sbconfig_t *sb;
+       volatile uint32 dummy;
+
+       sii = SI_INFO(sih);
+       ASSERT(GOODREGS(sii->curmap));
+       sb = REGS2SB(sii->curmap);
+
+       /*
+        * Must do the disable sequence first to work for arbitrary current core state.
+        */
+       sb_core_disable(sih, (bits | resetbits));
+
+       /*
+        * Now do the initialization sequence.
+        */
+
+       /* set reset while enabling the clock and forcing them on throughout the core */
+       W_SBREG(sii, &sb->sbtmstatelow,
+               (((bits | resetbits | SICF_FGC | SICF_CLOCK_EN) << SBTML_SICF_SHIFT) |
+                SBTML_RESET));
+       dummy = R_SBREG(sii, &sb->sbtmstatelow);
+       BCM_REFERENCE(dummy);
+       OSL_DELAY(1);
+
+       if (R_SBREG(sii, &sb->sbtmstatehigh) & SBTMH_SERR) {
+               W_SBREG(sii, &sb->sbtmstatehigh, 0);
+       }
+       if ((dummy = R_SBREG(sii, &sb->sbimstate)) & (SBIM_IBE | SBIM_TO)) {
+               AND_SBREG(sii, &sb->sbimstate, ~(SBIM_IBE | SBIM_TO));
+       }
+
+       /* clear reset and allow it to propagate throughout the core */
+       W_SBREG(sii, &sb->sbtmstatelow,
+               ((bits | resetbits | SICF_FGC | SICF_CLOCK_EN) << SBTML_SICF_SHIFT));
+       dummy = R_SBREG(sii, &sb->sbtmstatelow);
+       BCM_REFERENCE(dummy);
+       OSL_DELAY(1);
+
+       /* leave clock enabled */
+       W_SBREG(sii, &sb->sbtmstatelow, ((bits | SICF_CLOCK_EN) << SBTML_SICF_SHIFT));
+       dummy = R_SBREG(sii, &sb->sbtmstatelow);
+       BCM_REFERENCE(dummy);
+       OSL_DELAY(1);
+}
+
+/*
+ * Set the initiator timeout for the "master core".
+ * The master core is defined to be the core in control
+ * of the chip and so it issues accesses to non-memory
+ * locations (Because of dma *any* core can access memeory).
+ *
+ * The routine uses the bus to decide who is the master:
+ *     SI_BUS => mips
+ *     JTAG_BUS => chipc
+ *     PCI_BUS => pci or pcie
+ *     PCMCIA_BUS => pcmcia
+ *     SDIO_BUS => pcmcia
+ *
+ * This routine exists so callers can disable initiator
+ * timeouts so accesses to very slow devices like otp
+ * won't cause an abort. The routine allows arbitrary
+ * settings of the service and request timeouts, though.
+ *
+ * Returns the timeout state before changing it or -1
+ * on error.
+ */
+
+#define        TO_MASK (SBIMCL_RTO_MASK | SBIMCL_STO_MASK)
+
+uint32
+sb_set_initiator_to(si_t *sih, uint32 to, uint idx)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint origidx;
+       uint intr_val = 0;
+       uint32 tmp, ret = 0xffffffff;
+       sbconfig_t *sb;
+
+
+       if ((to & ~TO_MASK) != 0)
+               return ret;
+
+       /* Figure out the master core */
+       if (idx == BADIDX) {
+               switch (BUSTYPE(sii->pub.bustype)) {
+               case PCI_BUS:
+                       idx = sii->pub.buscoreidx;
+                       break;
+               case JTAG_BUS:
+                       idx = SI_CC_IDX;
+                       break;
+               case PCMCIA_BUS:
+#ifdef BCMSDIO
+               case SDIO_BUS:
+#endif
+                       idx = si_findcoreidx(sih, PCMCIA_CORE_ID, 0);
+                       break;
+               case SI_BUS:
+                       idx = si_findcoreidx(sih, MIPS33_CORE_ID, 0);
+                       break;
+               default:
+                       ASSERT(0);
+               }
+               if (idx == BADIDX)
+                       return ret;
+       }
+
+       INTR_OFF(sii, intr_val);
+       origidx = si_coreidx(sih);
+
+       sb = REGS2SB(sb_setcoreidx(sih, idx));
+
+       tmp = R_SBREG(sii, &sb->sbimconfiglow);
+       ret = tmp & TO_MASK;
+       W_SBREG(sii, &sb->sbimconfiglow, (tmp & ~TO_MASK) | to);
+
+       sb_commit(sih);
+       sb_setcoreidx(sih, origidx);
+       INTR_RESTORE(sii, intr_val);
+       return ret;
+}
+
+uint32
+sb_base(uint32 admatch)
+{
+       uint32 base;
+       uint type;
+
+       type = admatch & SBAM_TYPE_MASK;
+       ASSERT(type < 3);
+
+       base = 0;
+
+       if (type == 0) {
+               base = admatch & SBAM_BASE0_MASK;
+       } else if (type == 1) {
+               ASSERT(!(admatch & SBAM_ADNEG));        /* neg not supported */
+               base = admatch & SBAM_BASE1_MASK;
+       } else if (type == 2) {
+               ASSERT(!(admatch & SBAM_ADNEG));        /* neg not supported */
+               base = admatch & SBAM_BASE2_MASK;
+       }
+
+       return (base);
+}
+
+uint32
+sb_size(uint32 admatch)
+{
+       uint32 size;
+       uint type;
+
+       type = admatch & SBAM_TYPE_MASK;
+       ASSERT(type < 3);
+
+       size = 0;
+
+       if (type == 0) {
+               size = 1 << (((admatch & SBAM_ADINT0_MASK) >> SBAM_ADINT0_SHIFT) + 1);
+       } else if (type == 1) {
+               ASSERT(!(admatch & SBAM_ADNEG));        /* neg not supported */
+               size = 1 << (((admatch & SBAM_ADINT1_MASK) >> SBAM_ADINT1_SHIFT) + 1);
+       } else if (type == 2) {
+               ASSERT(!(admatch & SBAM_ADNEG));        /* neg not supported */
+               size = 1 << (((admatch & SBAM_ADINT2_MASK) >> SBAM_ADINT2_SHIFT) + 1);
+       }
+
+       return (size);
+}
+
+#if defined(BCMDBG_PHYDUMP)
+/* print interesting sbconfig registers */
+void
+sb_dumpregs(si_t *sih, struct bcmstrbuf *b)
+{
+       sbconfig_t *sb;
+       uint origidx, i, intr_val = 0;
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+       origidx = sii->curidx;
+
+       INTR_OFF(sii, intr_val);
+
+       for (i = 0; i < sii->numcores; i++) {
+               sb = REGS2SB(sb_setcoreidx(sih, i));
+
+               bcm_bprintf(b, "core 0x%x: \n", cores_info->coreid[i]);
+
+               if (sii->pub.socirev > SONICS_2_2)
+                       bcm_bprintf(b, "sbimerrlog 0x%x sbimerrloga 0x%x\n",
+                                 sb_corereg(sih, si_coreidx(&sii->pub), SBIMERRLOG, 0, 0),
+                                 sb_corereg(sih, si_coreidx(&sii->pub), SBIMERRLOGA, 0, 0));
+
+               bcm_bprintf(b, "sbtmstatelow 0x%x sbtmstatehigh 0x%x sbidhigh 0x%x "
+                           "sbimstate 0x%x\n sbimconfiglow 0x%x sbimconfighigh 0x%x\n",
+                           R_SBREG(sii, &sb->sbtmstatelow), R_SBREG(sii, &sb->sbtmstatehigh),
+                           R_SBREG(sii, &sb->sbidhigh), R_SBREG(sii, &sb->sbimstate),
+                           R_SBREG(sii, &sb->sbimconfiglow), R_SBREG(sii, &sb->sbimconfighigh));
+       }
+
+       sb_setcoreidx(sih, origidx);
+       INTR_RESTORE(sii, intr_val);
+}
+#endif 
diff --git a/drivers/net/wireless/bcmdhd_1363/siutils.c b/drivers/net/wireless/bcmdhd_1363/siutils.c
new file mode 100644 (file)
index 0000000..208750f
--- /dev/null
@@ -0,0 +1,3270 @@
+/*
+ * Misc utility routines for accessing chip-specific features
+ * of the SiliconBackplane-based Broadcom chips.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: siutils.c 663718 2017-01-30 12:10:57Z $
+ */
+
+#include <bcm_cfg.h>
+#include <typedefs.h>
+#include <bcmdefs.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <siutils.h>
+#include <bcmdevs.h>
+#include <hndsoc.h>
+#include <sbchipc.h>
+#ifdef BCMPCIEDEV
+#include <pciedev.h>
+#endif /* BCMPCIEDEV */
+#include <pcicfg.h>
+#include <sbpcmcia.h>
+#include <sbsysmem.h>
+#include <sbsocram.h>
+#ifdef BCMSDIO
+#include <bcmsdh.h>
+#include <sdio.h>
+#include <sbsdio.h>
+#include <sbhnddma.h>
+#include <sbsdpcmdev.h>
+#include <bcmsdpcm.h>
+#endif /* BCMSDIO */
+#include <hndpmu.h>
+
+#ifdef BCM_SDRBL
+#include <hndcpu.h>
+#endif /* BCM_SDRBL */
+#ifdef HNDGCI
+#include <hndgci.h>
+#endif /* HNDGCI */
+
+#include "siutils_priv.h"
+
+/**
+ * A set of PMU registers is clocked in the ILP domain, which has an implication on register write
+ * behavior: if such a register is written, it takes multiple ILP clocks for the PMU block to absorb
+ * the write. During that time the 'SlowWritePending' bit in the PMUStatus register is set.
+ */
+#define PMUREGS_ILP_SENSITIVE(regoff) \
+       ((regoff) == OFFSETOF(pmuregs_t, pmutimer) || \
+        (regoff) == OFFSETOF(pmuregs_t, pmuwatchdog) || \
+        (regoff) == OFFSETOF(pmuregs_t, res_req_timer))
+
+#define CHIPCREGS_ILP_SENSITIVE(regoff) \
+       ((regoff) == OFFSETOF(chipcregs_t, pmutimer) || \
+        (regoff) == OFFSETOF(chipcregs_t, pmuwatchdog) || \
+        (regoff) == OFFSETOF(chipcregs_t, res_req_timer))
+
+/* local prototypes */
+static si_info_t *si_doattach(si_info_t *sii, uint devid, osl_t *osh, void *regs,
+                              uint bustype, void *sdh, char **vars, uint *varsz);
+static bool si_buscore_prep(si_info_t *sii, uint bustype, uint devid, void *sdh);
+static bool si_buscore_setup(si_info_t *sii, chipcregs_t *cc, uint bustype, uint32 savewin,
+       uint *origidx, void *regs);
+
+
+static bool si_pmu_is_ilp_sensitive(uint32 idx, uint regoff);
+
+#ifdef BCMLTECOEX
+static void si_config_gcigpio(si_t *sih, uint32 gci_pos, uint8 gcigpio,
+       uint8 gpioctl_mask, uint8 gpioctl_val);
+#endif /* BCMLTECOEX */
+
+
+/* global variable to indicate reservation/release of gpio's */
+static uint32 si_gpioreservation = 0;
+
+/* global flag to prevent shared resources from being initialized multiple times in si_attach() */
+#ifdef SR_DEBUG
+static const uint32 si_power_island_test_array[] = {
+       0x0000, 0x0001, 0x0010, 0x0011,
+       0x0100, 0x0101, 0x0110, 0x0111,
+       0x1000, 0x1001, 0x1010, 0x1011,
+       0x1100, 0x1101, 0x1110, 0x1111
+};
+#endif /* SR_DEBUG */
+
+int do_4360_pcie2_war = 0;
+
+/* global kernel resource */
+static si_info_t ksii;
+static si_cores_info_t ksii_cores_info;
+
+/**
+ * Allocate an si handle. This function may be called multiple times.
+ *
+ * devid - pci device id (used to determine chip#)
+ * osh - opaque OS handle
+ * regs - virtual address of initial core registers
+ * bustype - pci/pcmcia/sb/sdio/etc
+ * vars - pointer to a to-be created pointer area for "environment" variables. Some callers of this
+ *        function set 'vars' to NULL, making dereferencing of this parameter undesired.
+ * varsz - pointer to int to return the size of the vars
+ */
+si_t *
+si_attach(uint devid, osl_t *osh, void *regs,
+                       uint bustype, void *sdh, char **vars, uint *varsz)
+{
+       si_info_t *sii;
+       si_cores_info_t *cores_info;
+       /* alloc si_info_t */
+       if ((sii = MALLOCZ(osh, sizeof (si_info_t))) == NULL) {
+               SI_ERROR(("si_attach: malloc failed! malloced %d bytes\n", MALLOCED(osh)));
+               return (NULL);
+       }
+
+       /* alloc si_cores_info_t */
+       if ((cores_info = (si_cores_info_t *)MALLOCZ(osh, sizeof (si_cores_info_t))) == NULL) {
+               SI_ERROR(("si_attach: malloc failed! malloced %d bytes\n", MALLOCED(osh)));
+               MFREE(osh, sii, sizeof(si_info_t));
+               return (NULL);
+       }
+       sii->cores_info = cores_info;
+
+       if (si_doattach(sii, devid, osh, regs, bustype, sdh, vars, varsz) == NULL) {
+               MFREE(osh, sii, sizeof(si_info_t));
+               MFREE(osh, cores_info, sizeof(si_cores_info_t));
+               return (NULL);
+       }
+       sii->vars = vars ? *vars : NULL;
+       sii->varsz = varsz ? *varsz : 0;
+
+       return (si_t *)sii;
+}
+
+
+static uint32  wd_msticks;             /* watchdog timer ticks normalized to ms */
+
+/** generic kernel variant of si_attach() */
+si_t *
+si_kattach(osl_t *osh)
+{
+       static bool ksii_attached = FALSE;
+       si_cores_info_t *cores_info;
+
+       if (!ksii_attached) {
+               void *regs = NULL;
+               regs = REG_MAP(SI_ENUM_BASE, SI_CORE_SIZE);
+               cores_info = (si_cores_info_t *)&ksii_cores_info;
+               ksii.cores_info = cores_info;
+
+               ASSERT(osh);
+               if (si_doattach(&ksii, BCM4710_DEVICE_ID, osh, regs,
+                               SI_BUS, NULL,
+                               osh != SI_OSH ? &(ksii.vars) : NULL,
+                               osh != SI_OSH ? &(ksii.varsz) : NULL) == NULL) {
+                       SI_ERROR(("si_kattach: si_doattach failed\n"));
+                       REG_UNMAP(regs);
+                       return NULL;
+               }
+               REG_UNMAP(regs);
+
+               /* save ticks normalized to ms for si_watchdog_ms() */
+               if (PMUCTL_ENAB(&ksii.pub)) {
+                               /* based on 32KHz ILP clock */
+                               wd_msticks = 32;
+               } else {
+                       wd_msticks = ALP_CLOCK / 1000;
+               }
+
+               ksii_attached = TRUE;
+               SI_MSG(("si_kattach done. ccrev = %d, wd_msticks = %d\n",
+                       ksii.pub.ccrev, wd_msticks));
+       }
+
+       return &ksii.pub;
+}
+
+
+static bool
+si_buscore_prep(si_info_t *sii, uint bustype, uint devid, void *sdh)
+{
+       /* need to set memseg flag for CF card first before any sb registers access */
+       if (BUSTYPE(bustype) == PCMCIA_BUS)
+               sii->memseg = TRUE;
+
+
+#if defined(BCMSDIO)
+       if (BUSTYPE(bustype) == SDIO_BUS) {
+               int err;
+               uint8 clkset;
+
+               /* Try forcing SDIO core to do ALPAvail request only */
+               clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_ALP_AVAIL_REQ;
+               bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
+               if (!err) {
+                       uint8 clkval;
+
+                       /* If register supported, wait for ALPAvail and then force ALP */
+                       clkval = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, NULL);
+                       if ((clkval & ~SBSDIO_AVBITS) == clkset) {
+                               SPINWAIT(((clkval = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
+                                       SBSDIO_FUNC1_CHIPCLKCSR, NULL)), !SBSDIO_ALPAV(clkval)),
+                                       PMU_MAX_TRANSITION_DLY);
+                               if (!SBSDIO_ALPAV(clkval)) {
+                                       SI_ERROR(("timeout on ALPAV wait, clkval 0x%02x\n",
+                                               clkval));
+                                       return FALSE;
+                               }
+                               clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_FORCE_ALP;
+                               bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+                                       clkset, &err);
+                               OSL_DELAY(65);
+                       }
+               }
+
+               /* Also, disable the extra SDIO pull-ups */
+               bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SDIOPULLUP, 0, NULL);
+       }
+
+#endif /* BCMSDIO && BCMDONGLEHOST */
+
+       return TRUE;
+}
+
+static bool
+si_buscore_setup(si_info_t *sii, chipcregs_t *cc, uint bustype, uint32 savewin,
+       uint *origidx, void *regs)
+{
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       bool pci, pcie, pcie_gen2 = FALSE;
+       uint i;
+       uint pciidx, pcieidx, pcirev, pcierev;
+
+       /* first, enable backplane timeouts */
+       if (CHIPTYPE(sii->pub.socitype) == SOCI_AI)
+               ai_enable_backplane_timeouts(&sii->pub);
+
+       cc = si_setcoreidx(&sii->pub, SI_CC_IDX);
+       ASSERT((uintptr)cc);
+
+       /* get chipcommon rev */
+       sii->pub.ccrev = (int)si_corerev(&sii->pub);
+
+       /* get chipcommon chipstatus */
+       if (sii->pub.ccrev >= 11)
+               sii->pub.chipst = R_REG(sii->osh, &cc->chipstatus);
+
+       /* get chipcommon capabilites */
+       sii->pub.cccaps = R_REG(sii->osh, &cc->capabilities);
+       /* get chipcommon extended capabilities */
+
+       if (sii->pub.ccrev >= 35)
+               sii->pub.cccaps_ext = R_REG(sii->osh, &cc->capabilities_ext);
+
+       /* get pmu rev and caps */
+       if (sii->pub.cccaps & CC_CAP_PMU) {
+               if (AOB_ENAB(&sii->pub)) {
+                       uint pmucoreidx;
+                       pmuregs_t *pmu;
+                       pmucoreidx = si_findcoreidx(&sii->pub, PMU_CORE_ID, 0);
+                       if (!GOODIDX(pmucoreidx)) {
+                               SI_ERROR(("si_buscore_setup: si_findcoreidx failed\n"));
+                               return FALSE;
+                       }
+
+                       pmu = si_setcoreidx(&sii->pub, pmucoreidx);
+                       sii->pub.pmucaps = R_REG(sii->osh, &pmu->pmucapabilities);
+                       si_setcoreidx(&sii->pub, SI_CC_IDX);
+               } else
+                       sii->pub.pmucaps = R_REG(sii->osh, &cc->pmucapabilities);
+
+               sii->pub.pmurev = sii->pub.pmucaps & PCAP_REV_MASK;
+       }
+
+       SI_MSG(("Chipc: rev %d, caps 0x%x, chipst 0x%x pmurev %d, pmucaps 0x%x\n",
+               sii->pub.ccrev, sii->pub.cccaps, sii->pub.chipst, sii->pub.pmurev,
+               sii->pub.pmucaps));
+
+       /* figure out bus/orignal core idx */
+       sii->pub.buscoretype = NODEV_CORE_ID;
+       sii->pub.buscorerev = (uint)NOREV;
+       sii->pub.buscoreidx = BADIDX;
+
+       pci = pcie = FALSE;
+       pcirev = pcierev = (uint)NOREV;
+       pciidx = pcieidx = BADIDX;
+
+       for (i = 0; i < sii->numcores; i++) {
+               uint cid, crev;
+
+               si_setcoreidx(&sii->pub, i);
+               cid = si_coreid(&sii->pub);
+               crev = si_corerev(&sii->pub);
+
+               /* Display cores found */
+               SI_VMSG(("CORE[%d]: id 0x%x rev %d base 0x%x regs 0x%p\n",
+                       i, cid, crev, cores_info->coresba[i], cores_info->regs[i]));
+
+               if (BUSTYPE(bustype) == SI_BUS) {
+                       /* now look at the chipstatus register to figure the pacakge */
+                       /* for SDIO but downloaded on PCIE dev */
+                       if (cid == PCIE2_CORE_ID) {
+                               if (BCM43602_CHIP(sii->pub.chip) ||
+                                       (CHIPID(sii->pub.chip) == BCM4365_CHIP_ID) ||
+                                       (CHIPID(sii->pub.chip) == BCM4366_CHIP_ID) ||
+                                       ((CHIPID(sii->pub.chip) == BCM4345_CHIP_ID ||
+                                       CHIPID(sii->pub.chip) == BCM43454_CHIP_ID) &&
+                                       CST4345_CHIPMODE_PCIE(sii->pub.chipst))) {
+                                       pcieidx = i;
+                                       pcierev = crev;
+                                       pcie = TRUE;
+                                       pcie_gen2 = TRUE;
+                               }
+                       }
+
+               }
+               else if (BUSTYPE(bustype) == PCI_BUS) {
+                       if (cid == PCI_CORE_ID) {
+                               pciidx = i;
+                               pcirev = crev;
+                               pci = TRUE;
+                       } else if ((cid == PCIE_CORE_ID) || (cid == PCIE2_CORE_ID)) {
+                               pcieidx = i;
+                               pcierev = crev;
+                               pcie = TRUE;
+                               if (cid == PCIE2_CORE_ID)
+                                       pcie_gen2 = TRUE;
+                       }
+               } else if ((BUSTYPE(bustype) == PCMCIA_BUS) &&
+                          (cid == PCMCIA_CORE_ID)) {
+                       sii->pub.buscorerev = crev;
+                       sii->pub.buscoretype = cid;
+                       sii->pub.buscoreidx = i;
+               }
+#ifdef BCMSDIO
+               else if (((BUSTYPE(bustype) == SDIO_BUS) ||
+                         (BUSTYPE(bustype) == SPI_BUS)) &&
+                        ((cid == PCMCIA_CORE_ID) ||
+                         (cid == SDIOD_CORE_ID))) {
+                       sii->pub.buscorerev = crev;
+                       sii->pub.buscoretype = cid;
+                       sii->pub.buscoreidx = i;
+               }
+#endif /* BCMSDIO */
+
+               /* find the core idx before entering this func. */
+               if ((savewin && (savewin == cores_info->coresba[i])) ||
+                   (regs == cores_info->regs[i]))
+                       *origidx = i;
+       }
+
+
+#if defined(PCIE_FULL_DONGLE)
+       if (pcie) {
+               if (pcie_gen2)
+                       sii->pub.buscoretype = PCIE2_CORE_ID;
+               else
+                       sii->pub.buscoretype = PCIE_CORE_ID;
+               sii->pub.buscorerev = pcierev;
+               sii->pub.buscoreidx = pcieidx;
+       }
+       BCM_REFERENCE(pci);
+       BCM_REFERENCE(pcirev);
+       BCM_REFERENCE(pciidx);
+#else
+       if (pci) {
+               sii->pub.buscoretype = PCI_CORE_ID;
+               sii->pub.buscorerev = pcirev;
+               sii->pub.buscoreidx = pciidx;
+       } else if (pcie) {
+               if (pcie_gen2)
+                       sii->pub.buscoretype = PCIE2_CORE_ID;
+               else
+                       sii->pub.buscoretype = PCIE_CORE_ID;
+               sii->pub.buscorerev = pcierev;
+               sii->pub.buscoreidx = pcieidx;
+       }
+#endif /* defined(PCIE_FULL_DONGLE) */
+
+       SI_VMSG(("Buscore id/type/rev %d/0x%x/%d\n", sii->pub.buscoreidx, sii->pub.buscoretype,
+                sii->pub.buscorerev));
+
+       if (BUSTYPE(sii->pub.bustype) == SI_BUS && (CHIPID(sii->pub.chip) == BCM4712_CHIP_ID) &&
+           (sii->pub.chippkg != BCM4712LARGE_PKG_ID) && (CHIPREV(sii->pub.chiprev) <= 3))
+               OR_REG(sii->osh, &cc->slow_clk_ctl, SCC_SS_XTAL);
+
+
+#if defined(BCMSDIO)
+       /* Make sure any on-chip ARM is off (in case strapping is wrong), or downloaded code was
+        * already running.
+        */
+       if ((BUSTYPE(bustype) == SDIO_BUS) || (BUSTYPE(bustype) == SPI_BUS)) {
+               if (si_setcore(&sii->pub, ARM7S_CORE_ID, 0) ||
+                   si_setcore(&sii->pub, ARMCM3_CORE_ID, 0))
+                       si_core_disable(&sii->pub, 0);
+       }
+#endif /* BCMSDIO && BCMDONGLEHOST */
+
+       /* return to the original core */
+       si_setcoreidx(&sii->pub, *origidx);
+
+       return TRUE;
+}
+
+
+
+
+uint16
+si_chipid(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+
+       return (sii->chipnew) ? sii->chipnew : sih->chip;
+}
+
+static void
+si_chipid_fixup(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+
+       ASSERT(sii->chipnew == 0);
+       switch (sih->chip) {
+               case BCM43567_CHIP_ID:
+                       sii->chipnew = sih->chip; /* save it */
+                       sii->pub.chip = BCM43570_CHIP_ID; /* chip class */
+               break;
+               case BCM4358_CHIP_ID:
+               case BCM43566_CHIP_ID:
+                       sii->chipnew = sih->chip; /* save it */
+                       sii->pub.chip = BCM43569_CHIP_ID; /* chip class */
+               break;
+               case BCM4356_CHIP_ID:
+                       sii->chipnew = sih->chip; /* save it */
+                       sii->pub.chip = BCM4354_CHIP_ID; /* chip class */
+               break;
+               default:
+               break;
+       }
+}
+
+/**
+ * Allocate an si handle. This function may be called multiple times.
+ *
+ * vars - pointer to a to-be created pointer area for "environment" variables. Some callers of this
+ *        function set 'vars' to NULL.
+ */
+static si_info_t *
+si_doattach(si_info_t *sii, uint devid, osl_t *osh, void *regs,
+                       uint bustype, void *sdh, char **vars, uint *varsz)
+{
+       struct si_pub *sih = &sii->pub;
+       uint32 w, savewin;
+       chipcregs_t *cc;
+       char *pvars = NULL;
+       uint origidx;
+#if !defined(_CFEZ_) || defined(CFG_WL)
+#endif 
+
+       ASSERT(GOODREGS(regs));
+
+       savewin = 0;
+
+       sih->buscoreidx = BADIDX;
+
+       sii->curmap = regs;
+       sii->sdh = sdh;
+       sii->osh = osh;
+       sii->second_bar0win = ~0x0;
+
+
+       /* check to see if we are a si core mimic'ing a pci core */
+       if ((bustype == PCI_BUS) &&
+           (OSL_PCI_READ_CONFIG(sii->osh, PCI_SPROM_CONTROL, sizeof(uint32)) == 0xffffffff)) {
+               SI_ERROR(("%s: incoming bus is PCI but it's a lie, switching to SI "
+                         "devid:0x%x\n", __FUNCTION__, devid));
+               bustype = SI_BUS;
+       }
+
+       /* find Chipcommon address */
+       if (bustype == PCI_BUS) {
+               savewin = OSL_PCI_READ_CONFIG(sii->osh, PCI_BAR0_WIN, sizeof(uint32));
+               if (!GOODCOREADDR(savewin, SI_ENUM_BASE))
+                       savewin = SI_ENUM_BASE;
+               OSL_PCI_WRITE_CONFIG(sii->osh, PCI_BAR0_WIN, 4, SI_ENUM_BASE);
+               if (!regs)
+                       return NULL;
+               cc = (chipcregs_t *)regs;
+#ifdef BCMSDIO
+       } else if ((bustype == SDIO_BUS) || (bustype == SPI_BUS)) {
+               cc = (chipcregs_t *)sii->curmap;
+#endif
+       } else {
+               cc = (chipcregs_t *)REG_MAP(SI_ENUM_BASE, SI_CORE_SIZE);
+       }
+
+       sih->bustype = bustype;
+       if (bustype != BUSTYPE(bustype)) {
+               SI_ERROR(("si_doattach: bus type %d does not match configured bus type %d\n",
+                       bustype, BUSTYPE(bustype)));
+               return NULL;
+       }
+
+       /* bus/core/clk setup for register access */
+       if (!si_buscore_prep(sii, bustype, devid, sdh)) {
+               SI_ERROR(("si_doattach: si_core_clk_prep failed %d\n", bustype));
+               return NULL;
+       }
+
+       /* ChipID recognition.
+       *   We assume we can read chipid at offset 0 from the regs arg.
+       *   If we add other chiptypes (or if we need to support old sdio hosts w/o chipcommon),
+       *   some way of recognizing them needs to be added here.
+       */
+       if (!cc) {
+               SI_ERROR(("%s: chipcommon register space is null \n", __FUNCTION__));
+               return NULL;
+       }
+       w = R_REG(osh, &cc->chipid);
+       if ((w & 0xfffff) == 148277) w -= 65532;
+       sih->socitype = (w & CID_TYPE_MASK) >> CID_TYPE_SHIFT;
+       /* Might as wll fill in chip id rev & pkg */
+       sih->chip = w & CID_ID_MASK;
+       sih->chiprev = (w & CID_REV_MASK) >> CID_REV_SHIFT;
+       sih->chippkg = (w & CID_PKG_MASK) >> CID_PKG_SHIFT;
+
+       si_chipid_fixup(sih);
+
+       if ((CHIPID(sih->chip) == BCM4329_CHIP_ID) && CHIPREV(sih->chiprev == 0) &&
+               (sih->chippkg != BCM4329_289PIN_PKG_ID)) {
+               sih->chippkg = BCM4329_182PIN_PKG_ID;
+       }
+       sih->issim = IS_SIM(sih->chippkg);
+
+       /* scan for cores */
+       if (CHIPTYPE(sii->pub.socitype) == SOCI_SB) {
+               SI_MSG(("Found chip type SB (0x%08x)\n", w));
+               sb_scan(&sii->pub, regs, devid);
+       } else if ((CHIPTYPE(sii->pub.socitype) == SOCI_AI) ||
+               (CHIPTYPE(sii->pub.socitype) == SOCI_NAI)) {
+               if (CHIPTYPE(sii->pub.socitype) == SOCI_AI)
+                       SI_MSG(("Found chip type AI (0x%08x)\n", w));
+               else
+                       SI_MSG(("Found chip type NAI (0x%08x)\n", w));
+               /* pass chipc address instead of original core base */
+               ai_scan(&sii->pub, (void *)(uintptr)cc, devid);
+       } else if (CHIPTYPE(sii->pub.socitype) == SOCI_UBUS) {
+               SI_MSG(("Found chip type UBUS (0x%08x), chip id = 0x%4x\n", w, sih->chip));
+               /* pass chipc address instead of original core base */
+               ub_scan(&sii->pub, (void *)(uintptr)cc, devid);
+       } else {
+               SI_ERROR(("Found chip of unknown type (0x%08x)\n", w));
+               return NULL;
+       }
+       /* no cores found, bail out */
+       if (sii->numcores == 0) {
+               SI_ERROR(("si_doattach: could not find any cores\n"));
+               return NULL;
+       }
+       /* bus/core/clk setup */
+       origidx = SI_CC_IDX;
+       if (!si_buscore_setup(sii, cc, bustype, savewin, &origidx, regs)) {
+               SI_ERROR(("si_doattach: si_buscore_setup failed\n"));
+               goto exit;
+       }
+
+#if !defined(_CFEZ_) || defined(CFG_WL)
+       if (CHIPID(sih->chip) == BCM4322_CHIP_ID && (((sih->chipst & CST4322_SPROM_OTP_SEL_MASK)
+               >> CST4322_SPROM_OTP_SEL_SHIFT) == (CST4322_OTP_PRESENT |
+               CST4322_SPROM_PRESENT))) {
+               SI_ERROR(("%s: Invalid setting: both SPROM and OTP strapped.\n", __FUNCTION__));
+               return NULL;
+       }
+
+       /* assume current core is CC */
+       if ((sii->pub.ccrev == 0x25) && ((CHIPID(sih->chip) == BCM43236_CHIP_ID ||
+                                         CHIPID(sih->chip) == BCM43235_CHIP_ID ||
+                                         CHIPID(sih->chip) == BCM43234_CHIP_ID ||
+                                         CHIPID(sih->chip) == BCM43238_CHIP_ID) &&
+                                        (CHIPREV(sii->pub.chiprev) <= 2))) {
+
+               if ((cc->chipstatus & CST43236_BP_CLK) != 0) {
+                       uint clkdiv;
+                       clkdiv = R_REG(osh, &cc->clkdiv);
+                       /* otp_clk_div is even number, 120/14 < 9mhz */
+                       clkdiv = (clkdiv & ~CLKD_OTP) | (14 << CLKD_OTP_SHIFT);
+                       W_REG(osh, &cc->clkdiv, clkdiv);
+                       SI_ERROR(("%s: set clkdiv to %x\n", __FUNCTION__, clkdiv));
+               }
+               OSL_DELAY(10);
+       }
+
+       if (bustype == PCI_BUS) {
+
+       }
+#endif 
+#ifdef BCM_SDRBL
+       /* 4360 rom bootloader in PCIE case, if the SDR is enabled, But preotection is
+        * not turned on, then we want to hold arm in reset.
+        * Bottomline: In sdrenable case, we allow arm to boot only when protection is
+        * turned on.
+        */
+       if (CHIP_HOSTIF_PCIE(&(sii->pub))) {
+               uint32 sflags = si_arm_sflags(&(sii->pub));
+
+               /* If SDR is enabled but protection is not turned on
+               * then we want to force arm to WFI.
+               */
+               if ((sflags & (SISF_SDRENABLE | SISF_TCMPROT)) == SISF_SDRENABLE) {
+                       disable_arm_irq();
+                       while (1) {
+                               hnd_cpu_wait(sih);
+                       }
+               }
+       }
+#endif /* BCM_SDRBL */
+
+       pvars = NULL;
+       BCM_REFERENCE(pvars);
+
+
+
+               if (sii->pub.ccrev >= 20) {
+                       uint32 gpiopullup = 0, gpiopulldown = 0;
+                       cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0);
+                       ASSERT(cc != NULL);
+
+                       /* 4314/43142 has pin muxing, don't clear gpio bits */
+                       if ((CHIPID(sih->chip) == BCM4314_CHIP_ID) ||
+                               (CHIPID(sih->chip) == BCM43142_CHIP_ID)) {
+                               gpiopullup |= 0x402e0;
+                               gpiopulldown |= 0x20500;
+                       }
+
+
+                       W_REG(osh, &cc->gpiopullup, gpiopullup);
+                       W_REG(osh, &cc->gpiopulldown, gpiopulldown);
+                       si_setcoreidx(sih, origidx);
+               }
+
+
+       /* clear any previous epidiag-induced target abort */
+       ASSERT(!si_taclear(sih, FALSE));
+
+
+#ifdef BOOTLOADER_CONSOLE_OUTPUT
+       /* Enable console prints */
+       si_muxenab(sii, 3);
+#endif
+
+       return (sii);
+
+exit:
+
+       return NULL;
+}
+
+/** may be called with core in reset */
+void
+si_detach(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint idx;
+
+
+       if (BUSTYPE(sih->bustype) == SI_BUS)
+               for (idx = 0; idx < SI_MAXCORES; idx++)
+                       if (cores_info->regs[idx]) {
+                               REG_UNMAP(cores_info->regs[idx]);
+                               cores_info->regs[idx] = NULL;
+                       }
+
+
+#if !defined(BCMBUSTYPE) || (BCMBUSTYPE == SI_BUS)
+       if (cores_info != &ksii_cores_info)
+#endif /* !BCMBUSTYPE || (BCMBUSTYPE == SI_BUS) */
+               MFREE(sii->osh, cores_info, sizeof(si_cores_info_t));
+
+#if !defined(BCMBUSTYPE) || (BCMBUSTYPE == SI_BUS)
+       if (sii != &ksii)
+#endif /* !BCMBUSTYPE || (BCMBUSTYPE == SI_BUS) */
+               MFREE(sii->osh, sii, sizeof(si_info_t));
+}
+
+void *
+si_osh(si_t *sih)
+{
+       si_info_t *sii;
+
+       sii = SI_INFO(sih);
+       return sii->osh;
+}
+
+void
+si_setosh(si_t *sih, osl_t *osh)
+{
+       si_info_t *sii;
+
+       sii = SI_INFO(sih);
+       if (sii->osh != NULL) {
+               SI_ERROR(("osh is already set....\n"));
+               ASSERT(!sii->osh);
+       }
+       sii->osh = osh;
+}
+
+/** register driver interrupt disabling and restoring callback functions */
+void
+si_register_intr_callback(si_t *sih, void *intrsoff_fn, void *intrsrestore_fn,
+                          void *intrsenabled_fn, void *intr_arg)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       sii->intr_arg = intr_arg;
+       sii->intrsoff_fn = (si_intrsoff_t)intrsoff_fn;
+       sii->intrsrestore_fn = (si_intrsrestore_t)intrsrestore_fn;
+       sii->intrsenabled_fn = (si_intrsenabled_t)intrsenabled_fn;
+       /* save current core id.  when this function called, the current core
+        * must be the core which provides driver functions(il, et, wl, etc.)
+        */
+       sii->dev_coreid = cores_info->coreid[sii->curidx];
+}
+
+void
+si_deregister_intr_callback(si_t *sih)
+{
+       si_info_t *sii;
+
+       sii = SI_INFO(sih);
+       sii->intrsoff_fn = NULL;
+       sii->intrsrestore_fn = NULL;
+       sii->intrsenabled_fn = NULL;
+}
+
+uint
+si_intflag(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return sb_intflag(sih);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return R_REG(sii->osh, ((uint32 *)(uintptr)
+                           (sii->oob_router + OOB_STATUSA)));
+       else {
+               ASSERT(0);
+               return 0;
+       }
+}
+
+uint
+si_flag(si_t *sih)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return sb_flag(sih);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return ai_flag(sih);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               return ub_flag(sih);
+       else {
+               ASSERT(0);
+               return 0;
+       }
+}
+
+uint
+si_flag_alt(si_t *sih)
+{
+       if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return ai_flag_alt(sih);
+       else {
+               ASSERT(0);
+               return 0;
+       }
+}
+
+void
+si_setint(si_t *sih, int siflag)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               sb_setint(sih, siflag);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               ai_setint(sih, siflag);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               ub_setint(sih, siflag);
+       else
+               ASSERT(0);
+}
+
+#ifdef CUSTOMER_HW2
+uint32
+si_corebase(si_t *sih, uint cid)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint16 idx;
+
+       for (idx = 0; idx < SI_MAXCORES; idx++) {
+               SI_VMSG(("si_corebase cid %d idx %d core-id %d\n", cid, idx,
+                       cores_info->coreid[idx]));
+               if (cid == cores_info->coreid[idx]) {
+                       return cores_info->coresba[idx];
+               }
+       }
+
+       return 0;
+}
+#endif /* CUSTOMER_HW2 */
+
+uint
+si_coreid(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+       return cores_info->coreid[sii->curidx];
+}
+
+uint
+si_coreidx(si_t *sih)
+{
+       si_info_t *sii;
+
+       sii = SI_INFO(sih);
+       return sii->curidx;
+}
+
+void *
+si_d11_switch_addrbase(si_t *sih, uint coreunit)
+{
+       return si_setcore(sih,  D11_CORE_ID, coreunit);
+}
+
+/** return the core-type instantiation # of the current core */
+uint
+si_coreunit(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint idx;
+       uint coreid;
+       uint coreunit;
+       uint i;
+
+       coreunit = 0;
+
+       idx = sii->curidx;
+
+       ASSERT(GOODREGS(sii->curmap));
+       coreid = si_coreid(sih);
+
+       /* count the cores of our type */
+       for (i = 0; i < idx; i++)
+               if (cores_info->coreid[i] == coreid)
+                       coreunit++;
+
+       return (coreunit);
+}
+
+uint
+si_corevendor(si_t *sih)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return sb_corevendor(sih);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return ai_corevendor(sih);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               return ub_corevendor(sih);
+       else {
+               ASSERT(0);
+               return 0;
+       }
+}
+
+bool
+si_backplane64(si_t *sih)
+{
+       return ((sih->cccaps & CC_CAP_BKPLN64) != 0);
+}
+
+uint
+si_corerev(si_t *sih)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return sb_corerev(sih);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return ai_corerev(sih);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               return ub_corerev(sih);
+       else {
+               ASSERT(0);
+               return 0;
+       }
+}
+
+
+/* return index of coreid or BADIDX if not found */
+uint
+si_findcoreidx(si_t *sih, uint coreid, uint coreunit)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint found;
+       uint i;
+
+
+       found = 0;
+
+       for (i = 0; i < sii->numcores; i++)
+               if (cores_info->coreid[i] == coreid) {
+                       if (found == coreunit)
+                               return (i);
+                       found++;
+               }
+
+       return (BADIDX);
+}
+
+/** return total coreunit of coreid or zero if not found */
+uint
+si_numcoreunits(si_t *sih, uint coreid)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint found = 0;
+       uint i;
+
+       for (i = 0; i < sii->numcores; i++) {
+               if (cores_info->coreid[i] == coreid) {
+                       found++;
+               }
+       }
+
+       return found;
+}
+
+/** return total D11 coreunits */
+uint
+BCMRAMFN(si_numd11coreunits)(si_t *sih)
+{
+       uint found = 0;
+
+       found = si_numcoreunits(sih, D11_CORE_ID);
+
+#if defined(WLRSDB) && defined(WLRSDB_DISABLED)
+       /* If RSDB functionality is compiled out,
+        * then ignore any D11 cores beyond the first
+        * Used in norsdb dongle build variants for rsdb chip.
+        */
+       found = 1;
+#endif /* defined(WLRSDB) && !defined(WLRSDB_DISABLED) */
+
+       return found;
+}
+
+/** return list of found cores */
+uint
+si_corelist(si_t *sih, uint coreid[])
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+       bcopy((uchar*)cores_info->coreid, (uchar*)coreid, (sii->numcores * sizeof(uint)));
+       return (sii->numcores);
+}
+
+/** return current wrapper mapping */
+void *
+si_wrapperregs(si_t *sih)
+{
+       si_info_t *sii;
+
+       sii = SI_INFO(sih);
+       ASSERT(GOODREGS(sii->curwrap));
+
+       return (sii->curwrap);
+}
+
+/** return current register mapping */
+void *
+si_coreregs(si_t *sih)
+{
+       si_info_t *sii;
+
+       sii = SI_INFO(sih);
+       ASSERT(GOODREGS(sii->curmap));
+
+       return (sii->curmap);
+}
+
+/**
+ * This function changes logical "focus" to the indicated core;
+ * must be called with interrupts off.
+ * Moreover, callers should keep interrupts off during switching out of and back to d11 core
+ */
+void *
+si_setcore(si_t *sih, uint coreid, uint coreunit)
+{
+       uint idx;
+
+       idx = si_findcoreidx(sih, coreid, coreunit);
+       if (!GOODIDX(idx))
+               return (NULL);
+
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return sb_setcoreidx(sih, idx);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return ai_setcoreidx(sih, idx);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               return ub_setcoreidx(sih, idx);
+       else {
+               ASSERT(0);
+               return NULL;
+       }
+}
+
+void *
+si_setcoreidx(si_t *sih, uint coreidx)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return sb_setcoreidx(sih, coreidx);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return ai_setcoreidx(sih, coreidx);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               return ub_setcoreidx(sih, coreidx);
+       else {
+               ASSERT(0);
+               return NULL;
+       }
+}
+
+/** Turn off interrupt as required by sb_setcore, before switch core */
+void *
+si_switch_core(si_t *sih, uint coreid, uint *origidx, uint *intr_val)
+{
+       void *cc;
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+       if (SI_FAST(sii)) {
+               /* Overloading the origidx variable to remember the coreid,
+                * this works because the core ids cannot be confused with
+                * core indices.
+                */
+               *origidx = coreid;
+               if (coreid == CC_CORE_ID)
+                       return (void *)CCREGS_FAST(sii);
+               else if (coreid == sih->buscoretype)
+                       return (void *)PCIEREGS(sii);
+       }
+       INTR_OFF(sii, *intr_val);
+       *origidx = sii->curidx;
+       cc = si_setcore(sih, coreid, 0);
+       ASSERT(cc != NULL);
+
+       return cc;
+}
+
+/* restore coreidx and restore interrupt */
+void
+si_restore_core(si_t *sih, uint coreid, uint intr_val)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+       if (SI_FAST(sii) && ((coreid == CC_CORE_ID) || (coreid == sih->buscoretype)))
+               return;
+
+       si_setcoreidx(sih, coreid);
+       INTR_RESTORE(sii, intr_val);
+}
+
+int
+si_numaddrspaces(si_t *sih)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return sb_numaddrspaces(sih);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return ai_numaddrspaces(sih);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               return ub_numaddrspaces(sih);
+       else {
+               ASSERT(0);
+               return 0;
+       }
+}
+
+uint32
+si_addrspace(si_t *sih, uint asidx)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return sb_addrspace(sih, asidx);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return ai_addrspace(sih, asidx);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               return ub_addrspace(sih, asidx);
+       else {
+               ASSERT(0);
+               return 0;
+       }
+}
+
+uint32
+si_addrspacesize(si_t *sih, uint asidx)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return sb_addrspacesize(sih, asidx);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return ai_addrspacesize(sih, asidx);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               return ub_addrspacesize(sih, asidx);
+       else {
+               ASSERT(0);
+               return 0;
+       }
+}
+
+void
+si_coreaddrspaceX(si_t *sih, uint asidx, uint32 *addr, uint32 *size)
+{
+       /* Only supported for SOCI_AI */
+       if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               ai_coreaddrspaceX(sih, asidx, addr, size);
+       else
+               *size = 0;
+}
+
+uint32
+si_core_cflags(si_t *sih, uint32 mask, uint32 val)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return sb_core_cflags(sih, mask, val);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return ai_core_cflags(sih, mask, val);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               return ub_core_cflags(sih, mask, val);
+       else {
+               ASSERT(0);
+               return 0;
+       }
+}
+
+void
+si_core_cflags_wo(si_t *sih, uint32 mask, uint32 val)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               sb_core_cflags_wo(sih, mask, val);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               ai_core_cflags_wo(sih, mask, val);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               ub_core_cflags_wo(sih, mask, val);
+       else
+               ASSERT(0);
+}
+
+uint32
+si_core_sflags(si_t *sih, uint32 mask, uint32 val)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return sb_core_sflags(sih, mask, val);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return ai_core_sflags(sih, mask, val);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               return ub_core_sflags(sih, mask, val);
+       else {
+               ASSERT(0);
+               return 0;
+       }
+}
+
+bool
+si_iscoreup(si_t *sih)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return sb_iscoreup(sih);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return ai_iscoreup(sih);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               return ub_iscoreup(sih);
+       else {
+               ASSERT(0);
+               return FALSE;
+       }
+}
+
+uint
+si_wrapperreg(si_t *sih, uint32 offset, uint32 mask, uint32 val)
+{
+       /* only for AI back plane chips */
+       if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return (ai_wrap_reg(sih, offset, mask, val));
+       return 0;
+}
+/* si_backplane_access is used to read full backplane address from host for PCIE FD
+ * it uses secondary bar-0 window which lies at an offset of 16K from primary bar-0
+ * Provides support for read/write of 1/2/4 bytes of backplane address
+ * Can be used to read/write
+ *     1. core regs
+ *     2. Wrapper regs
+ *     3. memory
+ *     4. BT area
+ * For accessing any 32 bit backplane address, [31 : 12] of backplane should be given in "region"
+ * [11 : 0] should be the "regoff"
+ * for reading  4 bytes from reg 0x200 of d11 core use it like below
+ * : si_backplane_access(sih, 0x18001000, 0x200, 4, 0, TRUE)
+ */
+static int si_backplane_addr_sane(uint addr, uint size)
+{
+       int bcmerror = BCME_OK;
+
+       /* For 2 byte access, address has to be 2 byte aligned */
+       if (size == 2) {
+               if (addr & 0x1) {
+                       bcmerror = BCME_ERROR;
+               }
+       }
+       /* For 4 byte access, address has to be 4 byte aligned */
+       if (size == 4) {
+               if (addr & 0x3) {
+                       bcmerror = BCME_ERROR;
+               }
+       }
+
+       return bcmerror;
+}
+uint
+si_backplane_access(si_t *sih, uint addr, uint size, uint *val, bool read)
+{
+       uint32 *r = NULL;
+       uint32 region = 0;
+       si_info_t *sii = SI_INFO(sih);
+
+       /* Valid only for pcie bus */
+       if (BUSTYPE(sih->bustype) != PCI_BUS) {
+               SI_ERROR(("Valid only for pcie bus \n"));
+               return BCME_ERROR;
+       }
+
+       /* Split adrr into region and address offset */
+       region = (addr & (0xFFFFF << 12));
+       addr = addr & 0xFFF;
+
+       /* check for address and size sanity */
+       if (si_backplane_addr_sane(addr, size) != BCME_OK)
+               return BCME_ERROR;
+
+       /* Update window if required */
+       if (sii->second_bar0win != region) {
+               OSL_PCI_WRITE_CONFIG(sii->osh, PCIE2_BAR0_CORE2_WIN, 4, region);
+               sii->second_bar0win = region;
+       }
+
+       /* Estimate effective address
+        * sii->curmap   : bar-0 virtual address
+        * PCI_SECOND_BAR0_OFFSET  : secondar bar-0 offset
+        * regoff : actual reg offset
+        */
+       r = (uint32 *)((char *)sii->curmap + PCI_SECOND_BAR0_OFFSET + addr);
+
+       SI_VMSG(("si curmap %p  region %x regaddr %x effective addr %p READ %d\n",
+               (char*)sii->curmap, region, addr, r, read));
+
+       switch (size) {
+               case sizeof(uint8) :
+                       if (read)
+                               *val = R_REG(sii->osh, (uint8*)r);
+                       else
+                               W_REG(sii->osh, (uint8*)r, *val);
+                       break;
+               case sizeof(uint16) :
+                       if (read)
+                               *val = R_REG(sii->osh, (uint16*)r);
+                       else
+                               W_REG(sii->osh, (uint16*)r, *val);
+                       break;
+               case sizeof(uint32) :
+                       if (read)
+                               *val = R_REG(sii->osh, (uint32*)r);
+                       else
+                               W_REG(sii->osh, (uint32*)r, *val);
+                       break;
+
+               default :
+                       SI_ERROR(("Invalid  size %d \n", size));
+                       return (BCME_ERROR);
+                       break;
+       }
+
+       return (BCME_OK);
+}
+uint
+si_corereg(si_t *sih, uint coreidx, uint regoff, uint mask, uint val)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return sb_corereg(sih, coreidx, regoff, mask, val);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return ai_corereg(sih, coreidx, regoff, mask, val);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               return ub_corereg(sih, coreidx, regoff, mask, val);
+       else {
+               ASSERT(0);
+               return 0;
+       }
+}
+
+/** ILP sensitive register access needs special treatment to avoid backplane stalls */
+bool si_pmu_is_ilp_sensitive(uint32 idx, uint regoff)
+{
+       if (idx == SI_CC_IDX) {
+               if (CHIPCREGS_ILP_SENSITIVE(regoff))
+                       return TRUE;
+       } else if (PMUREGS_ILP_SENSITIVE(regoff)) {
+               return TRUE;
+       }
+
+       return FALSE;
+}
+
+/** 'idx' should refer either to the chipcommon core or the PMU core */
+uint
+si_pmu_corereg(si_t *sih, uint32 idx, uint regoff, uint mask, uint val)
+{
+       int pmustatus_offset;
+
+       /* prevent backplane stall on double write to 'ILP domain' registers in the PMU */
+       if (mask != 0 && sih->pmurev >= 22 &&
+           si_pmu_is_ilp_sensitive(idx, regoff)) {
+               pmustatus_offset = AOB_ENAB(sih) ? OFFSETOF(pmuregs_t, pmustatus) :
+                       OFFSETOF(chipcregs_t, pmustatus);
+
+               while (si_corereg(sih, idx, pmustatus_offset, 0, 0) & PST_SLOW_WR_PENDING)
+                       {};
+       }
+
+       return si_corereg(sih, idx, regoff, mask, val);
+}
+
+/*
+ * If there is no need for fiddling with interrupts or core switches (typically silicon
+ * back plane registers, pci registers and chipcommon registers), this function
+ * returns the register offset on this core to a mapped address. This address can
+ * be used for W_REG/R_REG directly.
+ *
+ * For accessing registers that would need a core switch, this function will return
+ * NULL.
+ */
+uint32 *
+si_corereg_addr(si_t *sih, uint coreidx, uint regoff)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               return sb_corereg_addr(sih, coreidx, regoff);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               return ai_corereg_addr(sih, coreidx, regoff);
+       else {
+               return 0;
+       }
+}
+
+void
+si_core_disable(si_t *sih, uint32 bits)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               sb_core_disable(sih, bits);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               ai_core_disable(sih, bits);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               ub_core_disable(sih, bits);
+}
+
+void
+si_core_reset(si_t *sih, uint32 bits, uint32 resetbits)
+{
+       if (CHIPTYPE(sih->socitype) == SOCI_SB)
+               sb_core_reset(sih, bits, resetbits);
+       else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+               ai_core_reset(sih, bits, resetbits);
+       else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+               ub_core_reset(sih, bits, resetbits);
+}
+
+/** Run bist on current core. Caller needs to take care of core-specific bist hazards */
+int
+si_corebist(si_t *sih)
+{
+       uint32 cflags;
+       int result = 0;
+
+       /* Read core control flags */
+       cflags = si_core_cflags(sih, 0, 0);
+
+       /* Set bist & fgc */
+       si_core_cflags(sih, ~0, (SICF_BIST_EN | SICF_FGC));
+
+       /* Wait for bist done */
+       SPINWAIT(((si_core_sflags(sih, 0, 0) & SISF_BIST_DONE) == 0), 100000);
+
+       if (si_core_sflags(sih, 0, 0) & SISF_BIST_ERROR)
+               result = BCME_ERROR;
+
+       /* Reset core control flags */
+       si_core_cflags(sih, 0xffff, cflags);
+
+       return result;
+}
+
+static uint32
+factor6(uint32 x)
+{
+       switch (x) {
+       case CC_F6_2:   return 2;
+       case CC_F6_3:   return 3;
+       case CC_F6_4:   return 4;
+       case CC_F6_5:   return 5;
+       case CC_F6_6:   return 6;
+       case CC_F6_7:   return 7;
+       default:        return 0;
+       }
+}
+
+/*
+ * Divide the clock by the divisor with protection for
+ * a zero divisor.
+ */
+static uint32
+divide_clock(uint32 clock, uint32 div)
+{
+       return div ? clock / div : 0;
+}
+
+
+/** calculate the speed the SI would run at given a set of clockcontrol values */
+uint32
+si_clock_rate(uint32 pll_type, uint32 n, uint32 m)
+{
+       uint32 n1, n2, clock, m1, m2, m3, mc;
+
+       n1 = n & CN_N1_MASK;
+       n2 = (n & CN_N2_MASK) >> CN_N2_SHIFT;
+
+       if (pll_type == PLL_TYPE6) {
+               if (m & CC_T6_MMASK)
+                       return CC_T6_M1;
+               else
+                       return CC_T6_M0;
+       } else if ((pll_type == PLL_TYPE1) ||
+                  (pll_type == PLL_TYPE3) ||
+                  (pll_type == PLL_TYPE4) ||
+                  (pll_type == PLL_TYPE7)) {
+               n1 = factor6(n1);
+               n2 += CC_F5_BIAS;
+       } else if (pll_type == PLL_TYPE2) {
+               n1 += CC_T2_BIAS;
+               n2 += CC_T2_BIAS;
+               ASSERT((n1 >= 2) && (n1 <= 7));
+               ASSERT((n2 >= 5) && (n2 <= 23));
+       } else if (pll_type == PLL_TYPE5) {
+               return (100000000);
+       } else
+               ASSERT(0);
+       /* PLL types 3 and 7 use BASE2 (25Mhz) */
+       if ((pll_type == PLL_TYPE3) ||
+           (pll_type == PLL_TYPE7)) {
+               clock = CC_CLOCK_BASE2 * n1 * n2;
+       } else
+               clock = CC_CLOCK_BASE1 * n1 * n2;
+
+       if (clock == 0)
+               return 0;
+
+       m1 = m & CC_M1_MASK;
+       m2 = (m & CC_M2_MASK) >> CC_M2_SHIFT;
+       m3 = (m & CC_M3_MASK) >> CC_M3_SHIFT;
+       mc = (m & CC_MC_MASK) >> CC_MC_SHIFT;
+
+       if ((pll_type == PLL_TYPE1) ||
+           (pll_type == PLL_TYPE3) ||
+           (pll_type == PLL_TYPE4) ||
+           (pll_type == PLL_TYPE7)) {
+               m1 = factor6(m1);
+               if ((pll_type == PLL_TYPE1) || (pll_type == PLL_TYPE3))
+                       m2 += CC_F5_BIAS;
+               else
+                       m2 = factor6(m2);
+               m3 = factor6(m3);
+
+               switch (mc) {
+               case CC_MC_BYPASS:      return (clock);
+               case CC_MC_M1:          return divide_clock(clock, m1);
+               case CC_MC_M1M2:        return divide_clock(clock, m1 * m2);
+               case CC_MC_M1M2M3:      return divide_clock(clock, m1 * m2 * m3);
+               case CC_MC_M1M3:        return divide_clock(clock, m1 * m3);
+               default:                return (0);
+               }
+       } else {
+               ASSERT(pll_type == PLL_TYPE2);
+
+               m1 += CC_T2_BIAS;
+               m2 += CC_T2M2_BIAS;
+               m3 += CC_T2_BIAS;
+               ASSERT((m1 >= 2) && (m1 <= 7));
+               ASSERT((m2 >= 3) && (m2 <= 10));
+               ASSERT((m3 >= 2) && (m3 <= 7));
+
+               if ((mc & CC_T2MC_M1BYP) == 0)
+                       clock /= m1;
+               if ((mc & CC_T2MC_M2BYP) == 0)
+                       clock /= m2;
+               if ((mc & CC_T2MC_M3BYP) == 0)
+                       clock /= m3;
+
+               return (clock);
+       }
+       return 0;
+}
+
+/**
+ * Some chips could have multiple host interfaces, however only one will be active.
+ * For a given chip. Depending pkgopt and cc_chipst return the active host interface.
+ */
+uint
+si_chip_hostif(si_t *sih)
+{
+       uint hosti = 0;
+
+       switch (CHIPID(sih->chip)) {
+
+       CASE_BCM43602_CHIP:
+               hosti = CHIP_HOSTIF_PCIEMODE;
+               break;
+
+       case BCM4360_CHIP_ID:
+               /* chippkg bit-0 == 0 is PCIE only pkgs
+                * chippkg bit-0 == 1 has both PCIE and USB cores enabled
+                */
+               if ((sih->chippkg & 0x1) && (sih->chipst & CST4360_MODE_USB))
+                       hosti = CHIP_HOSTIF_USBMODE;
+               else
+                       hosti = CHIP_HOSTIF_PCIEMODE;
+
+               break;
+
+       case BCM4335_CHIP_ID:
+               /* TBD: like in 4360, do we need to check pkg? */
+               if (CST4335_CHIPMODE_USB20D(sih->chipst))
+                       hosti = CHIP_HOSTIF_USBMODE;
+               else if (CST4335_CHIPMODE_SDIOD(sih->chipst))
+                       hosti = CHIP_HOSTIF_SDIOMODE;
+               else
+                       hosti = CHIP_HOSTIF_PCIEMODE;
+               break;
+
+       case BCM4345_CHIP_ID:
+       case BCM43454_CHIP_ID:
+               if (CST4345_CHIPMODE_USB20D(sih->chipst) || CST4345_CHIPMODE_HSIC(sih->chipst))
+                       hosti = CHIP_HOSTIF_USBMODE;
+               else if (CST4345_CHIPMODE_SDIOD(sih->chipst))
+                       hosti = CHIP_HOSTIF_SDIOMODE;
+               else if (CST4345_CHIPMODE_PCIE(sih->chipst))
+                       hosti = CHIP_HOSTIF_PCIEMODE;
+               break;
+
+       case BCM4349_CHIP_GRPID:
+               if (CST4349_CHIPMODE_SDIOD(sih->chipst))
+                       hosti = CHIP_HOSTIF_SDIOMODE;
+               else if (CST4349_CHIPMODE_PCIE(sih->chipst))
+                       hosti = CHIP_HOSTIF_PCIEMODE;
+               break;
+
+       case BCM4350_CHIP_ID:
+       case BCM4354_CHIP_ID:
+       case BCM4356_CHIP_ID:
+       case BCM43556_CHIP_ID:
+       case BCM43558_CHIP_ID:
+       case BCM43566_CHIP_ID:
+       case BCM43568_CHIP_ID:
+       case BCM43569_CHIP_ID:
+       case BCM43570_CHIP_ID:
+       case BCM4358_CHIP_ID:
+               if (CST4350_CHIPMODE_USB20D(sih->chipst) ||
+                   CST4350_CHIPMODE_HSIC20D(sih->chipst) ||
+                   CST4350_CHIPMODE_USB30D(sih->chipst) ||
+                   CST4350_CHIPMODE_USB30D_WL(sih->chipst) ||
+                   CST4350_CHIPMODE_HSIC30D(sih->chipst))
+                       hosti = CHIP_HOSTIF_USBMODE;
+               else if (CST4350_CHIPMODE_SDIOD(sih->chipst))
+                       hosti = CHIP_HOSTIF_SDIOMODE;
+               else if (CST4350_CHIPMODE_PCIE(sih->chipst))
+                       hosti = CHIP_HOSTIF_PCIEMODE;
+               break;
+
+       default:
+               break;
+       }
+
+       return hosti;
+}
+
+
+/** set chip watchdog reset timer to fire in 'ticks' */
+void
+si_watchdog(si_t *sih, uint ticks)
+{
+       uint nb, maxt;
+
+       if (PMUCTL_ENAB(sih)) {
+
+#if !defined(_CFEZ_) || defined(CFG_WL)
+               if ((CHIPID(sih->chip) == BCM4319_CHIP_ID) &&
+                   (CHIPREV(sih->chiprev) == 0) && (ticks != 0)) {
+                       si_corereg(sih, SI_CC_IDX, OFFSETOF(chipcregs_t, clk_ctl_st), ~0, 0x2);
+                       si_setcore(sih, USB20D_CORE_ID, 0);
+                       si_core_disable(sih, 1);
+                       si_setcore(sih, CC_CORE_ID, 0);
+               }
+#endif 
+
+                       nb = (sih->ccrev < 26) ? 16 : ((sih->ccrev >= 37) ? 32 : 24);
+               /* The mips compiler uses the sllv instruction,
+                * so we specially handle the 32-bit case.
+                */
+               if (nb == 32)
+                       maxt = 0xffffffff;
+               else
+                       maxt = ((1 << nb) - 1);
+
+               if (ticks == 1)
+                       ticks = 2;
+               else if (ticks > maxt)
+                       ticks = maxt;
+
+               pmu_corereg(sih, SI_CC_IDX, pmuwatchdog, ~0, ticks);
+       } else {
+               maxt = (1 << 28) - 1;
+               if (ticks > maxt)
+                       ticks = maxt;
+
+               si_corereg(sih, SI_CC_IDX, OFFSETOF(chipcregs_t, watchdog), ~0, ticks);
+       }
+}
+
+/** trigger watchdog reset after ms milliseconds */
+void
+si_watchdog_ms(si_t *sih, uint32 ms)
+{
+       si_watchdog(sih, wd_msticks * ms);
+}
+
+uint32 si_watchdog_msticks(void)
+{
+       return wd_msticks;
+}
+
+bool
+si_taclear(si_t *sih, bool details)
+{
+       return FALSE;
+}
+
+
+
+/** return the slow clock source - LPO, XTAL, or PCI */
+static uint
+si_slowclk_src(si_info_t *sii)
+{
+       chipcregs_t *cc;
+
+       ASSERT(SI_FAST(sii) || si_coreid(&sii->pub) == CC_CORE_ID);
+
+       if (sii->pub.ccrev < 6) {
+               if ((BUSTYPE(sii->pub.bustype) == PCI_BUS) &&
+                   (OSL_PCI_READ_CONFIG(sii->osh, PCI_GPIO_OUT, sizeof(uint32)) &
+                    PCI_CFG_GPIO_SCS))
+                       return (SCC_SS_PCI);
+               else
+                       return (SCC_SS_XTAL);
+       } else if (sii->pub.ccrev < 10) {
+               cc = (chipcregs_t *)si_setcoreidx(&sii->pub, sii->curidx);
+               ASSERT(cc);
+               return (R_REG(sii->osh, &cc->slow_clk_ctl) & SCC_SS_MASK);
+       } else  /* Insta-clock */
+               return (SCC_SS_XTAL);
+}
+
+/** return the ILP (slowclock) min or max frequency */
+static uint
+si_slowclk_freq(si_info_t *sii, bool max_freq, chipcregs_t *cc)
+{
+       uint32 slowclk;
+       uint div;
+
+       ASSERT(SI_FAST(sii) || si_coreid(&sii->pub) == CC_CORE_ID);
+
+       /* shouldn't be here unless we've established the chip has dynamic clk control */
+       ASSERT(R_REG(sii->osh, &cc->capabilities) & CC_CAP_PWR_CTL);
+
+       slowclk = si_slowclk_src(sii);
+       if (sii->pub.ccrev < 6) {
+               if (slowclk == SCC_SS_PCI)
+                       return (max_freq ? (PCIMAXFREQ / 64) : (PCIMINFREQ / 64));
+               else
+                       return (max_freq ? (XTALMAXFREQ / 32) : (XTALMINFREQ / 32));
+       } else if (sii->pub.ccrev < 10) {
+               div = 4 *
+                       (((R_REG(sii->osh, &cc->slow_clk_ctl) & SCC_CD_MASK) >> SCC_CD_SHIFT) + 1);
+               if (slowclk == SCC_SS_LPO)
+                       return (max_freq ? LPOMAXFREQ : LPOMINFREQ);
+               else if (slowclk == SCC_SS_XTAL)
+                       return (max_freq ? (XTALMAXFREQ / div) : (XTALMINFREQ / div));
+               else if (slowclk == SCC_SS_PCI)
+                       return (max_freq ? (PCIMAXFREQ / div) : (PCIMINFREQ / div));
+               else
+                       ASSERT(0);
+       } else {
+               /* Chipc rev 10 is InstaClock */
+               div = R_REG(sii->osh, &cc->system_clk_ctl) >> SYCC_CD_SHIFT;
+               div = 4 * (div + 1);
+               return (max_freq ? XTALMAXFREQ : (XTALMINFREQ / div));
+       }
+       return (0);
+}
+
+static void
+si_clkctl_setdelay(si_info_t *sii, void *chipcregs)
+{
+       chipcregs_t *cc = (chipcregs_t *)chipcregs;
+       uint slowmaxfreq, pll_delay, slowclk;
+       uint pll_on_delay, fref_sel_delay;
+
+       pll_delay = PLL_DELAY;
+
+       /* If the slow clock is not sourced by the xtal then add the xtal_on_delay
+        * since the xtal will also be powered down by dynamic clk control logic.
+        */
+
+       slowclk = si_slowclk_src(sii);
+       if (slowclk != SCC_SS_XTAL)
+               pll_delay += XTAL_ON_DELAY;
+
+       /* Starting with 4318 it is ILP that is used for the delays */
+       slowmaxfreq = si_slowclk_freq(sii, (sii->pub.ccrev >= 10) ? FALSE : TRUE, cc);
+
+       pll_on_delay = ((slowmaxfreq * pll_delay) + 999999) / 1000000;
+       fref_sel_delay = ((slowmaxfreq * FREF_DELAY) + 999999) / 1000000;
+
+       W_REG(sii->osh, &cc->pll_on_delay, pll_on_delay);
+       W_REG(sii->osh, &cc->fref_sel_delay, fref_sel_delay);
+}
+
+/** initialize power control delay registers */
+void
+si_clkctl_init(si_t *sih)
+{
+       si_info_t *sii;
+       uint origidx = 0;
+       chipcregs_t *cc;
+       bool fast;
+
+       if (!CCCTL_ENAB(sih))
+               return;
+
+       sii = SI_INFO(sih);
+       fast = SI_FAST(sii);
+       if (!fast) {
+               origidx = sii->curidx;
+               if ((cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0)) == NULL)
+                       return;
+       } else if ((cc = (chipcregs_t *)CCREGS_FAST(sii)) == NULL)
+               return;
+       ASSERT(cc != NULL);
+
+       /* set all Instaclk chip ILP to 1 MHz */
+       if (sih->ccrev >= 10)
+               SET_REG(sii->osh, &cc->system_clk_ctl, SYCC_CD_MASK,
+                       (ILP_DIV_1MHZ << SYCC_CD_SHIFT));
+
+       si_clkctl_setdelay(sii, (void *)(uintptr)cc);
+
+       OSL_DELAY(20000);
+
+       if (!fast)
+               si_setcoreidx(sih, origidx);
+}
+
+
+/** change logical "focus" to the gpio core for optimized access */
+void *
+si_gpiosetcore(si_t *sih)
+{
+       return (si_setcoreidx(sih, SI_CC_IDX));
+}
+
+/**
+ * mask & set gpiocontrol bits.
+ * If a gpiocontrol bit is set to 0, chipcommon controls the corresponding GPIO pin.
+ * If a gpiocontrol bit is set to 1, the GPIO pin is no longer a GPIO and becomes dedicated
+ *   to some chip-specific purpose.
+ */
+uint32
+si_gpiocontrol(si_t *sih, uint32 mask, uint32 val, uint8 priority)
+{
+       uint regoff;
+
+       regoff = 0;
+
+       /* gpios could be shared on router platforms
+        * ignore reservation if it's high priority (e.g., test apps)
+        */
+       if ((priority != GPIO_HI_PRIORITY) &&
+           (BUSTYPE(sih->bustype) == SI_BUS) && (val || mask)) {
+               mask = priority ? (si_gpioreservation & mask) :
+                       ((si_gpioreservation | mask) & ~(si_gpioreservation));
+               val &= mask;
+       }
+
+       regoff = OFFSETOF(chipcregs_t, gpiocontrol);
+       return (si_corereg(sih, SI_CC_IDX, regoff, mask, val));
+}
+
+/** mask&set gpio output enable bits */
+uint32
+si_gpioouten(si_t *sih, uint32 mask, uint32 val, uint8 priority)
+{
+       uint regoff;
+
+       regoff = 0;
+
+       /* gpios could be shared on router platforms
+        * ignore reservation if it's high priority (e.g., test apps)
+        */
+       if ((priority != GPIO_HI_PRIORITY) &&
+           (BUSTYPE(sih->bustype) == SI_BUS) && (val || mask)) {
+               mask = priority ? (si_gpioreservation & mask) :
+                       ((si_gpioreservation | mask) & ~(si_gpioreservation));
+               val &= mask;
+       }
+
+       regoff = OFFSETOF(chipcregs_t, gpioouten);
+       return (si_corereg(sih, SI_CC_IDX, regoff, mask, val));
+}
+
+/** mask&set gpio output bits */
+uint32
+si_gpioout(si_t *sih, uint32 mask, uint32 val, uint8 priority)
+{
+       uint regoff;
+
+       regoff = 0;
+
+       /* gpios could be shared on router platforms
+        * ignore reservation if it's high priority (e.g., test apps)
+        */
+       if ((priority != GPIO_HI_PRIORITY) &&
+           (BUSTYPE(sih->bustype) == SI_BUS) && (val || mask)) {
+               mask = priority ? (si_gpioreservation & mask) :
+                       ((si_gpioreservation | mask) & ~(si_gpioreservation));
+               val &= mask;
+       }
+
+       regoff = OFFSETOF(chipcregs_t, gpioout);
+       return (si_corereg(sih, SI_CC_IDX, regoff, mask, val));
+}
+
+/** reserve one gpio */
+uint32
+si_gpioreserve(si_t *sih, uint32 gpio_bitmask, uint8 priority)
+{
+       /* only cores on SI_BUS share GPIO's and only applcation users need to
+        * reserve/release GPIO
+        */
+       if ((BUSTYPE(sih->bustype) != SI_BUS) || (!priority)) {
+               ASSERT((BUSTYPE(sih->bustype) == SI_BUS) && (priority));
+               return 0xffffffff;
+       }
+       /* make sure only one bit is set */
+       if ((!gpio_bitmask) || ((gpio_bitmask) & (gpio_bitmask - 1))) {
+               ASSERT((gpio_bitmask) && !((gpio_bitmask) & (gpio_bitmask - 1)));
+               return 0xffffffff;
+       }
+
+       /* already reserved */
+       if (si_gpioreservation & gpio_bitmask)
+               return 0xffffffff;
+       /* set reservation */
+       si_gpioreservation |= gpio_bitmask;
+
+       return si_gpioreservation;
+}
+
+/**
+ * release one gpio.
+ *
+ * releasing the gpio doesn't change the current value on the GPIO last write value
+ * persists till someone overwrites it.
+ */
+uint32
+si_gpiorelease(si_t *sih, uint32 gpio_bitmask, uint8 priority)
+{
+       /* only cores on SI_BUS share GPIO's and only applcation users need to
+        * reserve/release GPIO
+        */
+       if ((BUSTYPE(sih->bustype) != SI_BUS) || (!priority)) {
+               ASSERT((BUSTYPE(sih->bustype) == SI_BUS) && (priority));
+               return 0xffffffff;
+       }
+       /* make sure only one bit is set */
+       if ((!gpio_bitmask) || ((gpio_bitmask) & (gpio_bitmask - 1))) {
+               ASSERT((gpio_bitmask) && !((gpio_bitmask) & (gpio_bitmask - 1)));
+               return 0xffffffff;
+       }
+
+       /* already released */
+       if (!(si_gpioreservation & gpio_bitmask))
+               return 0xffffffff;
+
+       /* clear reservation */
+       si_gpioreservation &= ~gpio_bitmask;
+
+       return si_gpioreservation;
+}
+
+/* return the current gpioin register value */
+uint32
+si_gpioin(si_t *sih)
+{
+       uint regoff;
+
+       regoff = OFFSETOF(chipcregs_t, gpioin);
+       return (si_corereg(sih, SI_CC_IDX, regoff, 0, 0));
+}
+
+/* mask&set gpio interrupt polarity bits */
+uint32
+si_gpiointpolarity(si_t *sih, uint32 mask, uint32 val, uint8 priority)
+{
+       uint regoff;
+
+       /* gpios could be shared on router platforms */
+       if ((BUSTYPE(sih->bustype) == SI_BUS) && (val || mask)) {
+               mask = priority ? (si_gpioreservation & mask) :
+                       ((si_gpioreservation | mask) & ~(si_gpioreservation));
+               val &= mask;
+       }
+
+       regoff = OFFSETOF(chipcregs_t, gpiointpolarity);
+       return (si_corereg(sih, SI_CC_IDX, regoff, mask, val));
+}
+
+/* mask&set gpio interrupt mask bits */
+uint32
+si_gpiointmask(si_t *sih, uint32 mask, uint32 val, uint8 priority)
+{
+       uint regoff;
+
+       /* gpios could be shared on router platforms */
+       if ((BUSTYPE(sih->bustype) == SI_BUS) && (val || mask)) {
+               mask = priority ? (si_gpioreservation & mask) :
+                       ((si_gpioreservation | mask) & ~(si_gpioreservation));
+               val &= mask;
+       }
+
+       regoff = OFFSETOF(chipcregs_t, gpiointmask);
+       return (si_corereg(sih, SI_CC_IDX, regoff, mask, val));
+}
+
+/* assign the gpio to an led */
+uint32
+si_gpioled(si_t *sih, uint32 mask, uint32 val)
+{
+       if (sih->ccrev < 16)
+               return 0xffffffff;
+
+       /* gpio led powersave reg */
+       return (si_corereg(sih, SI_CC_IDX, OFFSETOF(chipcregs_t, gpiotimeroutmask), mask, val));
+}
+
+/* mask&set gpio timer val */
+uint32
+si_gpiotimerval(si_t *sih, uint32 mask, uint32 gpiotimerval)
+{
+       if (sih->ccrev < 16)
+               return 0xffffffff;
+
+       return (si_corereg(sih, SI_CC_IDX,
+               OFFSETOF(chipcregs_t, gpiotimerval), mask, gpiotimerval));
+}
+
+uint32
+si_gpiopull(si_t *sih, bool updown, uint32 mask, uint32 val)
+{
+       uint offs;
+
+       if (sih->ccrev < 20)
+               return 0xffffffff;
+
+       offs = (updown ? OFFSETOF(chipcregs_t, gpiopulldown) : OFFSETOF(chipcregs_t, gpiopullup));
+       return (si_corereg(sih, SI_CC_IDX, offs, mask, val));
+}
+
+uint32
+si_gpioevent(si_t *sih, uint regtype, uint32 mask, uint32 val)
+{
+       uint offs;
+
+       if (sih->ccrev < 11)
+               return 0xffffffff;
+
+       if (regtype == GPIO_REGEVT)
+               offs = OFFSETOF(chipcregs_t, gpioevent);
+       else if (regtype == GPIO_REGEVT_INTMSK)
+               offs = OFFSETOF(chipcregs_t, gpioeventintmask);
+       else if (regtype == GPIO_REGEVT_INTPOL)
+               offs = OFFSETOF(chipcregs_t, gpioeventintpolarity);
+       else
+               return 0xffffffff;
+
+       return (si_corereg(sih, SI_CC_IDX, offs, mask, val));
+}
+
+uint32
+si_gpio_int_enable(si_t *sih, bool enable)
+{
+       uint offs;
+
+       if (sih->ccrev < 11)
+               return 0xffffffff;
+
+       offs = OFFSETOF(chipcregs_t, intmask);
+       return (si_corereg(sih, SI_CC_IDX, offs, CI_GPIO, (enable ? CI_GPIO : 0)));
+}
+
+/** Return the size of the specified SYSMEM bank */
+static uint
+sysmem_banksize(si_info_t *sii, sysmemregs_t *regs, uint8 idx, uint8 mem_type)
+{
+       uint banksize, bankinfo;
+       uint bankidx = idx | (mem_type << SYSMEM_BANKIDX_MEMTYPE_SHIFT);
+
+       ASSERT(mem_type <= SYSMEM_MEMTYPE_DEVRAM);
+
+       W_REG(sii->osh, &regs->bankidx, bankidx);
+       bankinfo = R_REG(sii->osh, &regs->bankinfo);
+       banksize = SYSMEM_BANKINFO_SZBASE * ((bankinfo & SYSMEM_BANKINFO_SZMASK) + 1);
+       return banksize;
+}
+
+/** Return the RAM size of the SYSMEM core */
+uint32
+si_sysmem_size(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint origidx;
+       uint intr_val = 0;
+
+       sysmemregs_t *regs;
+       bool wasup;
+       uint32 coreinfo;
+       uint memsize = 0;
+       uint8 i;
+       uint nb;
+
+       /* Block ints and save current core */
+       INTR_OFF(sii, intr_val);
+       origidx = si_coreidx(sih);
+
+       /* Switch to SYSMEM core */
+       if (!(regs = si_setcore(sih, SYSMEM_CORE_ID, 0)))
+               goto done;
+
+       /* Get info for determining size */
+       if (!(wasup = si_iscoreup(sih)))
+               si_core_reset(sih, 0, 0);
+       coreinfo = R_REG(sii->osh, &regs->coreinfo);
+
+       nb = (coreinfo & SRCI_SRNB_MASK) >> SRCI_SRNB_SHIFT;
+       for (i = 0; i < nb; i++)
+               memsize += sysmem_banksize(sii, regs, i, SYSMEM_MEMTYPE_RAM);
+
+       si_setcoreidx(sih, origidx);
+
+done:
+       INTR_RESTORE(sii, intr_val);
+
+       return memsize;
+}
+
+/** Return the size of the specified SOCRAM bank */
+static uint
+socram_banksize(si_info_t *sii, sbsocramregs_t *regs, uint8 idx, uint8 mem_type)
+{
+       uint banksize, bankinfo;
+       uint bankidx = idx | (mem_type << SOCRAM_BANKIDX_MEMTYPE_SHIFT);
+
+       ASSERT(mem_type <= SOCRAM_MEMTYPE_DEVRAM);
+
+       W_REG(sii->osh, &regs->bankidx, bankidx);
+       bankinfo = R_REG(sii->osh, &regs->bankinfo);
+       banksize = SOCRAM_BANKINFO_SZBASE * ((bankinfo & SOCRAM_BANKINFO_SZMASK) + 1);
+       return banksize;
+}
+
+void si_socram_set_bankpda(si_t *sih, uint32 bankidx, uint32 bankpda)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint origidx;
+       uint intr_val = 0;
+       sbsocramregs_t *regs;
+       bool wasup;
+       uint corerev;
+
+       /* Block ints and save current core */
+       INTR_OFF(sii, intr_val);
+       origidx = si_coreidx(sih);
+
+       /* Switch to SOCRAM core */
+       if (!(regs = si_setcore(sih, SOCRAM_CORE_ID, 0)))
+               goto done;
+
+       if (!(wasup = si_iscoreup(sih)))
+               si_core_reset(sih, 0, 0);
+
+       corerev = si_corerev(sih);
+       if (corerev >= 16) {
+               W_REG(sii->osh, &regs->bankidx, bankidx);
+               W_REG(sii->osh, &regs->bankpda, bankpda);
+       }
+
+       /* Return to previous state and core */
+       if (!wasup)
+               si_core_disable(sih, 0);
+       si_setcoreidx(sih, origidx);
+
+done:
+       INTR_RESTORE(sii, intr_val);
+}
+
+void
+si_socdevram(si_t *sih, bool set, uint8 *enable, uint8 *protect, uint8 *remap)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint origidx;
+       uint intr_val = 0;
+       sbsocramregs_t *regs;
+       bool wasup;
+       uint corerev;
+
+       /* Block ints and save current core */
+       INTR_OFF(sii, intr_val);
+       origidx = si_coreidx(sih);
+
+       if (!set)
+               *enable = *protect = *remap = 0;
+
+       /* Switch to SOCRAM core */
+       if (!(regs = si_setcore(sih, SOCRAM_CORE_ID, 0)))
+               goto done;
+
+       /* Get info for determining size */
+       if (!(wasup = si_iscoreup(sih)))
+               si_core_reset(sih, 0, 0);
+
+       corerev = si_corerev(sih);
+       if (corerev >= 10) {
+               uint32 extcinfo;
+               uint8 nb;
+               uint8 i;
+               uint32 bankidx, bankinfo;
+
+               extcinfo = R_REG(sii->osh, &regs->extracoreinfo);
+               nb = ((extcinfo & SOCRAM_DEVRAMBANK_MASK) >> SOCRAM_DEVRAMBANK_SHIFT);
+               for (i = 0; i < nb; i++) {
+                       bankidx = i | (SOCRAM_MEMTYPE_DEVRAM << SOCRAM_BANKIDX_MEMTYPE_SHIFT);
+                       W_REG(sii->osh, &regs->bankidx, bankidx);
+                       bankinfo = R_REG(sii->osh, &regs->bankinfo);
+                       if (set) {
+                               bankinfo &= ~SOCRAM_BANKINFO_DEVRAMSEL_MASK;
+                               bankinfo &= ~SOCRAM_BANKINFO_DEVRAMPRO_MASK;
+                               bankinfo &= ~SOCRAM_BANKINFO_DEVRAMREMAP_MASK;
+                               if (*enable) {
+                                       bankinfo |= (1 << SOCRAM_BANKINFO_DEVRAMSEL_SHIFT);
+                                       if (*protect)
+                                               bankinfo |= (1 << SOCRAM_BANKINFO_DEVRAMPRO_SHIFT);
+                                       if ((corerev >= 16) && *remap)
+                                               bankinfo |=
+                                                       (1 << SOCRAM_BANKINFO_DEVRAMREMAP_SHIFT);
+                               }
+                               W_REG(sii->osh, &regs->bankinfo, bankinfo);
+                       }
+                       else if (i == 0) {
+                               if (bankinfo & SOCRAM_BANKINFO_DEVRAMSEL_MASK) {
+                                       *enable = 1;
+                                       if (bankinfo & SOCRAM_BANKINFO_DEVRAMPRO_MASK)
+                                               *protect = 1;
+                                       if (bankinfo & SOCRAM_BANKINFO_DEVRAMREMAP_MASK)
+                                               *remap = 1;
+                               }
+                       }
+               }
+       }
+
+       /* Return to previous state and core */
+       if (!wasup)
+               si_core_disable(sih, 0);
+       si_setcoreidx(sih, origidx);
+
+done:
+       INTR_RESTORE(sii, intr_val);
+}
+
+bool
+si_socdevram_remap_isenb(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint origidx;
+       uint intr_val = 0;
+       sbsocramregs_t *regs;
+       bool wasup, remap = FALSE;
+       uint corerev;
+       uint32 extcinfo;
+       uint8 nb;
+       uint8 i;
+       uint32 bankidx, bankinfo;
+
+       /* Block ints and save current core */
+       INTR_OFF(sii, intr_val);
+       origidx = si_coreidx(sih);
+
+       /* Switch to SOCRAM core */
+       if (!(regs = si_setcore(sih, SOCRAM_CORE_ID, 0)))
+               goto done;
+
+       /* Get info for determining size */
+       if (!(wasup = si_iscoreup(sih)))
+               si_core_reset(sih, 0, 0);
+
+       corerev = si_corerev(sih);
+       if (corerev >= 16) {
+               extcinfo = R_REG(sii->osh, &regs->extracoreinfo);
+               nb = ((extcinfo & SOCRAM_DEVRAMBANK_MASK) >> SOCRAM_DEVRAMBANK_SHIFT);
+               for (i = 0; i < nb; i++) {
+                       bankidx = i | (SOCRAM_MEMTYPE_DEVRAM << SOCRAM_BANKIDX_MEMTYPE_SHIFT);
+                       W_REG(sii->osh, &regs->bankidx, bankidx);
+                       bankinfo = R_REG(sii->osh, &regs->bankinfo);
+                       if (bankinfo & SOCRAM_BANKINFO_DEVRAMREMAP_MASK) {
+                               remap = TRUE;
+                               break;
+                       }
+               }
+       }
+
+       /* Return to previous state and core */
+       if (!wasup)
+               si_core_disable(sih, 0);
+       si_setcoreidx(sih, origidx);
+
+done:
+       INTR_RESTORE(sii, intr_val);
+       return remap;
+}
+
+bool
+si_socdevram_pkg(si_t *sih)
+{
+       if (si_socdevram_size(sih) > 0)
+               return TRUE;
+       else
+               return FALSE;
+}
+
+uint32
+si_socdevram_size(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint origidx;
+       uint intr_val = 0;
+       uint32 memsize = 0;
+       sbsocramregs_t *regs;
+       bool wasup;
+       uint corerev;
+
+       /* Block ints and save current core */
+       INTR_OFF(sii, intr_val);
+       origidx = si_coreidx(sih);
+
+       /* Switch to SOCRAM core */
+       if (!(regs = si_setcore(sih, SOCRAM_CORE_ID, 0)))
+               goto done;
+
+       /* Get info for determining size */
+       if (!(wasup = si_iscoreup(sih)))
+               si_core_reset(sih, 0, 0);
+
+       corerev = si_corerev(sih);
+       if (corerev >= 10) {
+               uint32 extcinfo;
+               uint8 nb;
+               uint8 i;
+
+               extcinfo = R_REG(sii->osh, &regs->extracoreinfo);
+               nb = (((extcinfo & SOCRAM_DEVRAMBANK_MASK) >> SOCRAM_DEVRAMBANK_SHIFT));
+               for (i = 0; i < nb; i++)
+                       memsize += socram_banksize(sii, regs, i, SOCRAM_MEMTYPE_DEVRAM);
+       }
+
+       /* Return to previous state and core */
+       if (!wasup)
+               si_core_disable(sih, 0);
+       si_setcoreidx(sih, origidx);
+
+done:
+       INTR_RESTORE(sii, intr_val);
+
+       return memsize;
+}
+
+uint32
+si_socdevram_remap_size(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint origidx;
+       uint intr_val = 0;
+       uint32 memsize = 0, banksz;
+       sbsocramregs_t *regs;
+       bool wasup;
+       uint corerev;
+       uint32 extcinfo;
+       uint8 nb;
+       uint8 i;
+       uint32 bankidx, bankinfo;
+
+       /* Block ints and save current core */
+       INTR_OFF(sii, intr_val);
+       origidx = si_coreidx(sih);
+
+       /* Switch to SOCRAM core */
+       if (!(regs = si_setcore(sih, SOCRAM_CORE_ID, 0)))
+               goto done;
+
+       /* Get info for determining size */
+       if (!(wasup = si_iscoreup(sih)))
+               si_core_reset(sih, 0, 0);
+
+       corerev = si_corerev(sih);
+       if (corerev >= 16) {
+               extcinfo = R_REG(sii->osh, &regs->extracoreinfo);
+               nb = (((extcinfo & SOCRAM_DEVRAMBANK_MASK) >> SOCRAM_DEVRAMBANK_SHIFT));
+
+               /*
+                * FIX: A0 Issue: Max addressable is 512KB, instead 640KB
+                * Only four banks are accessible to ARM
+                */
+               if ((corerev == 16) && (nb == 5))
+                       nb = 4;
+
+               for (i = 0; i < nb; i++) {
+                       bankidx = i | (SOCRAM_MEMTYPE_DEVRAM << SOCRAM_BANKIDX_MEMTYPE_SHIFT);
+                       W_REG(sii->osh, &regs->bankidx, bankidx);
+                       bankinfo = R_REG(sii->osh, &regs->bankinfo);
+                       if (bankinfo & SOCRAM_BANKINFO_DEVRAMREMAP_MASK) {
+                               banksz = socram_banksize(sii, regs, i, SOCRAM_MEMTYPE_DEVRAM);
+                               memsize += banksz;
+                       } else {
+                               /* Account only consecutive banks for now */
+                               break;
+                       }
+               }
+       }
+
+       /* Return to previous state and core */
+       if (!wasup)
+               si_core_disable(sih, 0);
+       si_setcoreidx(sih, origidx);
+
+done:
+       INTR_RESTORE(sii, intr_val);
+
+       return memsize;
+}
+
+/** Return the RAM size of the SOCRAM core */
+uint32
+si_socram_size(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint origidx;
+       uint intr_val = 0;
+
+       sbsocramregs_t *regs;
+       bool wasup;
+       uint corerev;
+       uint32 coreinfo;
+       uint memsize = 0;
+
+       /* Block ints and save current core */
+       INTR_OFF(sii, intr_val);
+       origidx = si_coreidx(sih);
+
+       /* Switch to SOCRAM core */
+       if (!(regs = si_setcore(sih, SOCRAM_CORE_ID, 0)))
+               goto done;
+
+       /* Get info for determining size */
+       if (!(wasup = si_iscoreup(sih)))
+               si_core_reset(sih, 0, 0);
+       corerev = si_corerev(sih);
+       coreinfo = R_REG(sii->osh, &regs->coreinfo);
+
+       /* Calculate size from coreinfo based on rev */
+       if (corerev == 0)
+               memsize = 1 << (16 + (coreinfo & SRCI_MS0_MASK));
+       else if (corerev < 3) {
+               memsize = 1 << (SR_BSZ_BASE + (coreinfo & SRCI_SRBSZ_MASK));
+               memsize *= (coreinfo & SRCI_SRNB_MASK) >> SRCI_SRNB_SHIFT;
+       } else if ((corerev <= 7) || (corerev == 12)) {
+               uint nb = (coreinfo & SRCI_SRNB_MASK) >> SRCI_SRNB_SHIFT;
+               uint bsz = (coreinfo & SRCI_SRBSZ_MASK);
+               uint lss = (coreinfo & SRCI_LSS_MASK) >> SRCI_LSS_SHIFT;
+               if (lss != 0)
+                       nb --;
+               memsize = nb * (1 << (bsz + SR_BSZ_BASE));
+               if (lss != 0)
+                       memsize += (1 << ((lss - 1) + SR_BSZ_BASE));
+       } else {
+               uint8 i;
+               uint nb = (coreinfo & SRCI_SRNB_MASK) >> SRCI_SRNB_SHIFT;
+               for (i = 0; i < nb; i++)
+                       memsize += socram_banksize(sii, regs, i, SOCRAM_MEMTYPE_RAM);
+       }
+
+       /* Return to previous state and core */
+       if (!wasup)
+               si_core_disable(sih, 0);
+       si_setcoreidx(sih, origidx);
+
+done:
+       INTR_RESTORE(sii, intr_val);
+
+       return memsize;
+}
+
+
+/** Return the TCM-RAM size of the ARMCR4 core. */
+uint32
+si_tcm_size(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint origidx;
+       uint intr_val = 0;
+       uint8 *regs;
+       bool wasup;
+       uint32 corecap;
+       uint memsize = 0;
+       uint32 nab = 0;
+       uint32 nbb = 0;
+       uint32 totb = 0;
+       uint32 bxinfo = 0;
+       uint32 idx = 0;
+       uint32 *arm_cap_reg;
+       uint32 *arm_bidx;
+       uint32 *arm_binfo;
+
+       /* Block ints and save current core */
+       INTR_OFF(sii, intr_val);
+       origidx = si_coreidx(sih);
+
+       /* Switch to CR4 core */
+       if (!(regs = si_setcore(sih, ARMCR4_CORE_ID, 0)))
+               goto done;
+
+       /* Get info for determining size. If in reset, come out of reset,
+        * but remain in halt
+        */
+       if (!(wasup = si_iscoreup(sih)))
+               si_core_reset(sih, SICF_CPUHALT, SICF_CPUHALT);
+
+       arm_cap_reg = (uint32 *)(regs + SI_CR4_CAP);
+       corecap = R_REG(sii->osh, arm_cap_reg);
+
+       nab = (corecap & ARMCR4_TCBANB_MASK) >> ARMCR4_TCBANB_SHIFT;
+       nbb = (corecap & ARMCR4_TCBBNB_MASK) >> ARMCR4_TCBBNB_SHIFT;
+       totb = nab + nbb;
+
+       arm_bidx = (uint32 *)(regs + SI_CR4_BANKIDX);
+       arm_binfo = (uint32 *)(regs + SI_CR4_BANKINFO);
+       for (idx = 0; idx < totb; idx++) {
+               W_REG(sii->osh, arm_bidx, idx);
+
+               bxinfo = R_REG(sii->osh, arm_binfo);
+               memsize += ((bxinfo & ARMCR4_BSZ_MASK) + 1) * ARMCR4_BSZ_MULT;
+       }
+
+       /* Return to previous state and core */
+       if (!wasup)
+               si_core_disable(sih, 0);
+       si_setcoreidx(sih, origidx);
+
+done:
+       INTR_RESTORE(sii, intr_val);
+
+       return memsize;
+}
+
+bool
+si_has_flops(si_t *sih)
+{
+       uint origidx, cr4_rev;
+
+       /* Find out CR4 core revision */
+       origidx = si_coreidx(sih);
+       if (si_setcore(sih, ARMCR4_CORE_ID, 0)) {
+               cr4_rev = si_corerev(sih);
+               si_setcoreidx(sih, origidx);
+
+               if (cr4_rev == 1 || cr4_rev >= 3)
+                       return TRUE;
+       }
+       return FALSE;
+}
+
+uint32
+si_socram_srmem_size(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint origidx;
+       uint intr_val = 0;
+
+       sbsocramregs_t *regs;
+       bool wasup;
+       uint corerev;
+       uint32 coreinfo;
+       uint memsize = 0;
+
+       if ((CHIPID(sih->chip) == BCM4334_CHIP_ID) && (CHIPREV(sih->chiprev) < 2)) {
+               return (32 * 1024);
+       }
+
+       if (CHIPID(sih->chip) == BCM43430_CHIP_ID) {
+               return (64 * 1024);
+       }
+
+       /* Block ints and save current core */
+       INTR_OFF(sii, intr_val);
+       origidx = si_coreidx(sih);
+
+       /* Switch to SOCRAM core */
+       if (!(regs = si_setcore(sih, SOCRAM_CORE_ID, 0)))
+               goto done;
+
+       /* Get info for determining size */
+       if (!(wasup = si_iscoreup(sih)))
+               si_core_reset(sih, 0, 0);
+       corerev = si_corerev(sih);
+       coreinfo = R_REG(sii->osh, &regs->coreinfo);
+
+       /* Calculate size from coreinfo based on rev */
+       if (corerev >= 16) {
+               uint8 i;
+               uint nb = (coreinfo & SRCI_SRNB_MASK) >> SRCI_SRNB_SHIFT;
+               for (i = 0; i < nb; i++) {
+                       W_REG(sii->osh, &regs->bankidx, i);
+                       if (R_REG(sii->osh, &regs->bankinfo) & SOCRAM_BANKINFO_RETNTRAM_MASK)
+                               memsize += socram_banksize(sii, regs, i, SOCRAM_MEMTYPE_RAM);
+               }
+       }
+
+       /* Return to previous state and core */
+       if (!wasup)
+               si_core_disable(sih, 0);
+       si_setcoreidx(sih, origidx);
+
+done:
+       INTR_RESTORE(sii, intr_val);
+
+       return memsize;
+}
+
+
+#if !defined(_CFEZ_) || defined(CFG_WL)
+void
+si_btcgpiowar(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       uint origidx;
+       uint intr_val = 0;
+       chipcregs_t *cc;
+
+       /* Make sure that there is ChipCommon core present &&
+        * UART_TX is strapped to 1
+        */
+       if (!(sih->cccaps & CC_CAP_UARTGPIO))
+               return;
+
+       /* si_corereg cannot be used as we have to guarantee 8-bit read/writes */
+       INTR_OFF(sii, intr_val);
+
+       origidx = si_coreidx(sih);
+
+       cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0);
+       ASSERT(cc != NULL);
+
+       W_REG(sii->osh, &cc->uart0mcr, R_REG(sii->osh, &cc->uart0mcr) | 0x04);
+
+       /* restore the original index */
+       si_setcoreidx(sih, origidx);
+
+       INTR_RESTORE(sii, intr_val);
+}
+
+void
+si_chipcontrl_btshd0_4331(si_t *sih, bool on)
+{
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+       chipcregs_t *cc;
+       uint origidx;
+       uint32 val;
+       uint intr_val = 0;
+
+       INTR_OFF(sii, intr_val);
+
+       origidx = si_coreidx(sih);
+
+       if ((cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0)) == NULL) {
+               SI_ERROR(("%s: Failed to find CORE ID!\n", __FUNCTION__));
+               return;
+       }
+
+       val = R_REG(sii->osh, &cc->chipcontrol);
+
+       /* bt_shd0 controls are same for 4331 chiprevs 0 and 1, packages 12x9 and 12x12 */
+       if (on) {
+               /* Enable bt_shd0 on gpio4: */
+               val |= (CCTRL4331_BT_SHD0_ON_GPIO4);
+               W_REG(sii->osh, &cc->chipcontrol, val);
+       } else {
+               val &= ~(CCTRL4331_BT_SHD0_ON_GPIO4);
+               W_REG(sii->osh, &cc->chipcontrol, val);
+       }
+
+       /* restore the original index */
+       si_setcoreidx(sih, origidx);
+
+       INTR_RESTORE(sii, intr_val);
+}
+
+void
+si_chipcontrl_restore(si_t *sih, uint32 val)
+{
+       si_info_t *sii = SI_INFO(sih);
+       chipcregs_t *cc;
+       uint origidx = si_coreidx(sih);
+
+       if ((cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0)) == NULL) {
+               SI_ERROR(("%s: Failed to find CORE ID!\n", __FUNCTION__));
+               return;
+       }
+       W_REG(sii->osh, &cc->chipcontrol, val);
+       si_setcoreidx(sih, origidx);
+}
+
+uint32
+si_chipcontrl_read(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+       chipcregs_t *cc;
+       uint origidx = si_coreidx(sih);
+       uint32 val;
+
+       if ((cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0)) == NULL) {
+               SI_ERROR(("%s: Failed to find CORE ID!\n", __FUNCTION__));
+               return -1;
+       }
+       val = R_REG(sii->osh, &cc->chipcontrol);
+       si_setcoreidx(sih, origidx);
+       return val;
+}
+
+void
+si_chipcontrl_epa4331(si_t *sih, bool on)
+{
+       si_info_t *sii = SI_INFO(sih);
+       chipcregs_t *cc;
+       uint origidx = si_coreidx(sih);
+       uint32 val;
+
+       if ((cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0)) == NULL) {
+               SI_ERROR(("%s: Failed to find CORE ID!\n", __FUNCTION__));
+               return;
+       }
+       val = R_REG(sii->osh, &cc->chipcontrol);
+
+       if (on) {
+               if (sih->chippkg == 9 || sih->chippkg == 0xb) {
+                       val |= (CCTRL4331_EXTPA_EN | CCTRL4331_EXTPA_ON_GPIO2_5);
+                       /* Ext PA Controls for 4331 12x9 Package */
+                       W_REG(sii->osh, &cc->chipcontrol, val);
+               } else {
+                       /* Ext PA Controls for 4331 12x12 Package */
+                       if (CHIPREV(sih->chiprev) > 0) {
+                               W_REG(sii->osh, &cc->chipcontrol, val |
+                                     (CCTRL4331_EXTPA_EN) | (CCTRL4331_EXTPA_EN2));
+                       } else {
+                               W_REG(sii->osh, &cc->chipcontrol, val | (CCTRL4331_EXTPA_EN));
+                       }
+               }
+       } else {
+               val &= ~(CCTRL4331_EXTPA_EN | CCTRL4331_EXTPA_EN2 | CCTRL4331_EXTPA_ON_GPIO2_5);
+               W_REG(sii->osh, &cc->chipcontrol, val);
+       }
+
+       si_setcoreidx(sih, origidx);
+}
+
+/** switch muxed pins, on: SROM, off: FEMCTRL. Called for a family of ac chips, not just 4360. */
+void
+si_chipcontrl_srom4360(si_t *sih, bool on)
+{
+       si_info_t *sii = SI_INFO(sih);
+       chipcregs_t *cc;
+       uint origidx = si_coreidx(sih);
+       uint32 val;
+
+       if ((cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0)) == NULL) {
+               SI_ERROR(("%s: Failed to find CORE ID!\n", __FUNCTION__));
+               return;
+       }
+       val = R_REG(sii->osh, &cc->chipcontrol);
+
+       if (on) {
+               val &= ~(CCTRL4360_SECI_MODE |
+                       CCTRL4360_BTSWCTRL_MODE |
+                       CCTRL4360_EXTRA_FEMCTRL_MODE |
+                       CCTRL4360_BT_LGCY_MODE |
+                       CCTRL4360_CORE2FEMCTRL4_ON);
+
+               W_REG(sii->osh, &cc->chipcontrol, val);
+       } else {
+       }
+
+       si_setcoreidx(sih, origidx);
+}
+
+void
+si_clk_srom4365(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+       chipcregs_t *cc;
+       uint origidx = si_coreidx(sih);
+       uint32 val;
+
+       if ((cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0)) == NULL) {
+               SI_ERROR(("%s: Failed to find CORE ID!\n", __FUNCTION__));
+               return;
+       }
+       val = R_REG(sii->osh, &cc->clkdiv2);
+       W_REG(sii->osh, &cc->clkdiv2, ((val&~0xf) | 0x4));
+
+       si_setcoreidx(sih, origidx);
+}
+
+void
+si_d11rsdb_core1_alt_reg_clk_dis(si_t *sih)
+{
+#if defined(WLRSDB) && !defined(WLRSDB_DISABLED)
+       ai_d11rsdb_core1_alt_reg_clk_dis(sih);
+#endif /* defined(WLRSDB) && !defined(WLRSDB_DISABLED) */
+}
+
+void
+si_d11rsdb_core1_alt_reg_clk_en(si_t *sih)
+{
+#if defined(WLRSDB) && !defined(WLRSDB_DISABLED)
+       ai_d11rsdb_core1_alt_reg_clk_en(sih);
+#endif /* defined(WLRSDB) && !defined(WLRSDB_DISABLED) */
+}
+
+void
+si_chipcontrl_epa4331_wowl(si_t *sih, bool enter_wowl)
+{
+       si_info_t *sii;
+       chipcregs_t *cc;
+       uint origidx;
+       uint32 val;
+       bool sel_chip;
+
+       sel_chip = (CHIPID(sih->chip) == BCM4331_CHIP_ID) ||
+               (CHIPID(sih->chip) == BCM43431_CHIP_ID);
+       sel_chip &= ((sih->chippkg == 9 || sih->chippkg == 0xb));
+
+       if (!sel_chip)
+               return;
+
+       sii = SI_INFO(sih);
+       origidx = si_coreidx(sih);
+
+       if ((cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0)) == NULL) {
+               SI_ERROR(("%s: Failed to find CORE ID!\n", __FUNCTION__));
+               return;
+       }
+
+       val = R_REG(sii->osh, &cc->chipcontrol);
+
+       if (enter_wowl) {
+               val |= CCTRL4331_EXTPA_EN;
+               W_REG(sii->osh, &cc->chipcontrol, val);
+       } else {
+               val |= (CCTRL4331_EXTPA_EN | CCTRL4331_EXTPA_ON_GPIO2_5);
+               W_REG(sii->osh, &cc->chipcontrol, val);
+       }
+       si_setcoreidx(sih, origidx);
+}
+#endif 
+
+uint
+si_pll_reset(si_t *sih)
+{
+       uint err = 0;
+
+       return (err);
+}
+
+/** Enable BT-COEX & Ex-PA for 4313 */
+void
+si_epa_4313war(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+       chipcregs_t *cc;
+       uint origidx = si_coreidx(sih);
+
+       if ((cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0)) == NULL) {
+               SI_ERROR(("%s: Failed to find CORE ID!\n", __FUNCTION__));
+               return;
+       }
+
+       /* EPA Fix */
+       W_REG(sii->osh, &cc->gpiocontrol,
+       R_REG(sii->osh, &cc->gpiocontrol) | GPIO_CTRL_EPA_EN_MASK);
+
+       si_setcoreidx(sih, origidx);
+}
+
+void
+si_clk_pmu_htavail_set(si_t *sih, bool set_clear)
+{
+}
+
+void
+si_pmu_avb_clk_set(si_t *sih, osl_t *osh, bool set_flag)
+{
+}
+
+/** Re-enable synth_pwrsw resource in min_res_mask for 4313 */
+void
+si_pmu_synth_pwrsw_4313_war(si_t *sih)
+{
+}
+
+/** WL/BT control for 4313 btcombo boards >= P250 */
+void
+si_btcombo_p250_4313_war(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+       chipcregs_t *cc;
+       uint origidx = si_coreidx(sih);
+
+       if ((cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0)) == NULL) {
+               SI_ERROR(("%s: Failed to find CORE ID!\n", __FUNCTION__));
+               return;
+       }
+       W_REG(sii->osh, &cc->gpiocontrol,
+               R_REG(sii->osh, &cc->gpiocontrol) | GPIO_CTRL_5_6_EN_MASK);
+
+       W_REG(sii->osh, &cc->gpioouten,
+               R_REG(sii->osh, &cc->gpioouten) | GPIO_CTRL_5_6_EN_MASK);
+
+       si_setcoreidx(sih, origidx);
+}
+void
+si_btc_enable_chipcontrol(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+       chipcregs_t *cc;
+       uint origidx = si_coreidx(sih);
+
+       if ((cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0)) == NULL) {
+               SI_ERROR(("%s: Failed to find CORE ID!\n", __FUNCTION__));
+               return;
+       }
+
+       /* BT fix */
+       W_REG(sii->osh, &cc->chipcontrol,
+               R_REG(sii->osh, &cc->chipcontrol) | CC_BTCOEX_EN_MASK);
+
+       si_setcoreidx(sih, origidx);
+}
+void
+si_btcombo_43228_war(si_t *sih)
+{
+       si_info_t *sii = SI_INFO(sih);
+       chipcregs_t *cc;
+       uint origidx = si_coreidx(sih);
+
+       if ((cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0)) == NULL) {
+               SI_ERROR(("%s: Failed to find CORE ID!\n", __FUNCTION__));
+               return;
+       }
+
+       W_REG(sii->osh, &cc->gpioouten, GPIO_CTRL_7_6_EN_MASK);
+       W_REG(sii->osh, &cc->gpioout, GPIO_OUT_7_EN_MASK);
+
+       si_setcoreidx(sih, origidx);
+}
+
+/** check if the device is removed */
+bool
+si_deviceremoved(si_t *sih)
+{
+       uint32 w;
+
+       switch (BUSTYPE(sih->bustype)) {
+       case PCI_BUS:
+               ASSERT(SI_INFO(sih)->osh != NULL);
+               w = OSL_PCI_READ_CONFIG(SI_INFO(sih)->osh, PCI_CFG_VID, sizeof(uint32));
+               if ((w & 0xFFFF) != VENDOR_BROADCOM)
+                       return TRUE;
+               break;
+       }
+       return FALSE;
+}
+
+bool
+si_is_sprom_available(si_t *sih)
+{
+       if (sih->ccrev >= 31) {
+               si_info_t *sii;
+               uint origidx;
+               chipcregs_t *cc;
+               uint32 sromctrl;
+
+               if ((sih->cccaps & CC_CAP_SROM) == 0)
+                       return FALSE;
+
+               sii = SI_INFO(sih);
+               origidx = sii->curidx;
+               cc = si_setcoreidx(sih, SI_CC_IDX);
+               ASSERT(cc);
+               sromctrl = R_REG(sii->osh, &cc->sromcontrol);
+               si_setcoreidx(sih, origidx);
+               return (sromctrl & SRC_PRESENT);
+       }
+
+       switch (CHIPID(sih->chip)) {
+       case BCM4312_CHIP_ID:
+               return ((sih->chipst & CST4312_SPROM_OTP_SEL_MASK) != CST4312_OTP_SEL);
+       case BCM4325_CHIP_ID:
+               return (sih->chipst & CST4325_SPROM_SEL) != 0;
+       case BCM4322_CHIP_ID:   case BCM43221_CHIP_ID:  case BCM43231_CHIP_ID:
+       case BCM43222_CHIP_ID:  case BCM43111_CHIP_ID:  case BCM43112_CHIP_ID:
+       case BCM4342_CHIP_ID: {
+               uint32 spromotp;
+               spromotp = (sih->chipst & CST4322_SPROM_OTP_SEL_MASK) >>
+                       CST4322_SPROM_OTP_SEL_SHIFT;
+               return (spromotp & CST4322_SPROM_PRESENT) != 0;
+       }
+       case BCM4329_CHIP_ID:
+               return (sih->chipst & CST4329_SPROM_SEL) != 0;
+       case BCM4315_CHIP_ID:
+               return (sih->chipst & CST4315_SPROM_SEL) != 0;
+       case BCM4319_CHIP_ID:
+               return (sih->chipst & CST4319_SPROM_SEL) != 0;
+       case BCM4336_CHIP_ID:
+       case BCM43362_CHIP_ID:
+               return (sih->chipst & CST4336_SPROM_PRESENT) != 0;
+       case BCM4330_CHIP_ID:
+               return (sih->chipst & CST4330_SPROM_PRESENT) != 0;
+       case BCM4313_CHIP_ID:
+               return (sih->chipst & CST4313_SPROM_PRESENT) != 0;
+       case BCM4331_CHIP_ID:
+       case BCM43431_CHIP_ID:
+               return (sih->chipst & CST4331_SPROM_PRESENT) != 0;
+       case BCM43239_CHIP_ID:
+               return ((sih->chipst & CST43239_SPROM_MASK) &&
+                       !(sih->chipst & CST43239_SFLASH_MASK));
+       case BCM4324_CHIP_ID:
+       case BCM43242_CHIP_ID:
+               return ((sih->chipst & CST4324_SPROM_MASK) &&
+                       !(sih->chipst & CST4324_SFLASH_MASK));
+       case BCM4335_CHIP_ID:
+       case BCM4345_CHIP_ID:
+       case BCM43454_CHIP_ID:
+               return ((sih->chipst & CST4335_SPROM_MASK) &&
+                       !(sih->chipst & CST4335_SFLASH_MASK));
+       case BCM4349_CHIP_GRPID:
+               return (sih->chipst & CST4349_SPROM_PRESENT) != 0;
+               break;
+       case BCM4350_CHIP_ID:
+       case BCM4354_CHIP_ID:
+       case BCM4356_CHIP_ID:
+       case BCM43556_CHIP_ID:
+       case BCM43558_CHIP_ID:
+       case BCM43566_CHIP_ID:
+       case BCM43568_CHIP_ID:
+       case BCM43569_CHIP_ID:
+       case BCM43570_CHIP_ID:
+       case BCM4358_CHIP_ID:
+               return (sih->chipst & CST4350_SPROM_PRESENT) != 0;
+       CASE_BCM43602_CHIP:
+               return (sih->chipst & CST43602_SPROM_PRESENT) != 0;
+       case BCM43131_CHIP_ID:
+       case BCM43217_CHIP_ID:
+       case BCM43227_CHIP_ID:
+       case BCM43228_CHIP_ID:
+       case BCM43428_CHIP_ID:
+               return (sih->chipst & CST43228_OTP_PRESENT) != CST43228_OTP_PRESENT;
+       default:
+               return TRUE;
+       }
+}
+
+
+uint32 si_get_sromctl(si_t *sih)
+{
+       chipcregs_t *cc;
+       uint origidx = si_coreidx(sih);
+       uint32 sromctl;
+       osl_t *osh = si_osh(sih);
+
+       cc = si_setcoreidx(sih, SI_CC_IDX);
+       ASSERT((uintptr)cc);
+
+       sromctl = R_REG(osh, &cc->sromcontrol);
+
+       /* return to the original core */
+       si_setcoreidx(sih, origidx);
+       return sromctl;
+}
+
+int si_set_sromctl(si_t *sih, uint32 value)
+{
+       chipcregs_t *cc;
+       uint origidx = si_coreidx(sih);
+       osl_t *osh = si_osh(sih);
+       int ret = BCME_OK;
+
+       cc = si_setcoreidx(sih, SI_CC_IDX);
+       ASSERT((uintptr)cc);
+
+       /* get chipcommon rev */
+       if (si_corerev(sih) >= 32) {
+               /* SpromCtrl is only accessible if CoreCapabilities.SpromSupported and
+                * SpromPresent is 1.
+                */
+               if ((R_REG(osh, &cc->capabilities) & CC_CAP_SROM) != 0 &&
+                    (R_REG(osh, &cc->sromcontrol) & SRC_PRESENT)) {
+                       W_REG(osh, &cc->sromcontrol, value);
+               } else {
+                       ret = BCME_NODEVICE;
+               }
+       } else {
+               ret = BCME_UNSUPPORTED;
+       }
+
+       /* return to the original core */
+       si_setcoreidx(sih, origidx);
+
+       return ret;
+}
+
+uint
+si_core_wrapperreg(si_t *sih, uint32 coreidx, uint32 offset, uint32 mask, uint32 val)
+{
+       uint origidx, intr_val = 0;
+       uint ret_val;
+       si_info_t *sii = SI_INFO(sih);
+       si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+       origidx = si_coreidx(sih);
+
+       INTR_OFF(sii, intr_val);
+       si_setcoreidx(sih, coreidx);
+
+       ret_val = si_wrapperreg(sih, offset, mask, val);
+
+       /* return to the original core */
+       si_setcoreidx(sih, origidx);
+       INTR_RESTORE(sii, intr_val);
+       return ret_val;
+}
+
+
+/* cleanup the timer from the host when ARM is been halted
+ * without a chance for ARM cleanup its resources
+ * If left not cleanup, Intr from a software timer can still
+ * request HT clk when ARM is halted.
+ */
+uint32
+si_pmu_res_req_timer_clr(si_t *sih)
+{
+       uint32 mask;
+
+       mask = PRRT_REQ_ACTIVE | PRRT_INTEN | PRRT_HT_REQ;
+       if (CHIPID(sih->chip) != BCM4328_CHIP_ID)
+               mask <<= 14;
+       /* clear mask bits */
+       pmu_corereg(sih, SI_CC_IDX, res_req_timer, mask, 0);
+       /* readback to ensure write completes */
+       return pmu_corereg(sih, SI_CC_IDX, res_req_timer, 0, 0);
+}
+
+/** turn on/off rfldo */
+void
+si_pmu_rfldo(si_t *sih, bool on)
+{
+}
+
+
+#ifdef SURVIVE_PERST_ENAB
+static uint32
+si_pcie_survive_perst(si_t *sih, uint32 mask, uint32 val)
+{
+       si_info_t *sii;
+
+       sii = SI_INFO(sih);
+
+       if (!PCIE(sii))
+               return (0);
+
+       return pcie_survive_perst(sii->pch, mask, val);
+}
+
+static void
+si_watchdog_reset(si_t *sih)
+{
+       uint32 i;
+
+       /* issue a watchdog reset */
+       pmu_corereg(sih, SI_CC_IDX, pmuwatchdog, 2, 2);
+       /* do busy wait for 20ms */
+       for (i = 0; i < 2000; i++) {
+               OSL_DELAY(10);
+       }
+}
+#endif /* SURVIVE_PERST_ENAB */
+
+void
+si_survive_perst_war(si_t *sih, bool reset, uint32 sperst_mask, uint32 sperst_val)
+{
+#ifdef SURVIVE_PERST_ENAB
+       if (BUSTYPE(sih->bustype) != PCI_BUS)
+                 return;
+
+       if ((CHIPID(sih->chip) != BCM4360_CHIP_ID && CHIPID(sih->chip) != BCM4352_CHIP_ID) ||
+           (CHIPREV(sih->chiprev) >= 4))
+               return;
+
+       if (reset) {
+               si_info_t *sii = SI_INFO(sih);
+               uint32 bar0win, bar0win_after;
+
+               /* save the bar0win */
+               bar0win = OSL_PCI_READ_CONFIG(sii->osh, PCI_BAR0_WIN, sizeof(uint32));
+
+               si_watchdog_reset(sih);
+
+               bar0win_after = OSL_PCI_READ_CONFIG(sii->osh, PCI_BAR0_WIN, sizeof(uint32));
+               if (bar0win_after != bar0win) {
+                       SI_ERROR(("%s: bar0win before %08x, bar0win after %08x\n",
+                               __FUNCTION__, bar0win, bar0win_after));
+                       OSL_PCI_WRITE_CONFIG(sii->osh, PCI_BAR0_WIN, sizeof(uint32), bar0win);
+               }
+       }
+       if (sperst_mask) {
+               /* enable survive perst */
+               si_pcie_survive_perst(sih, sperst_mask, sperst_val);
+       }
+#endif /* SURVIVE_PERST_ENAB */
+}
+
+void
+si_pcie_ltr_war(si_t *sih)
+{
+}
+
+void
+si_pcie_hw_LTR_war(si_t *sih)
+{
+}
+
+void
+si_pciedev_reg_pm_clk_period(si_t *sih)
+{
+}
+
+void
+si_pciedev_crwlpciegen2(si_t *sih)
+{
+}
+
+void
+si_pcie_prep_D3(si_t *sih, bool enter_D3)
+{
+}
+
+
+
+void
+si_pll_sr_reinit(si_t *sih)
+{
+}
+
+void
+si_pll_closeloop(si_t *sih)
+{
+#if defined(SAVERESTORE)
+       uint32 data;
+
+       /* disable PLL open loop operation */
+       switch (CHIPID(sih->chip)) {
+#ifdef SAVERESTORE
+               case BCM43430_CHIP_ID:
+                       if (SR_ENAB() && sr_isenab(sih)) {
+                               /* read back the pll openloop state */
+                               data = si_pmu_pllcontrol(sih, PMU1_PLL0_PLLCTL8, 0, 0);
+                               /* current mode is openloop (possible POR) */
+                               if ((data & PMU1_PLLCTL8_OPENLOOP_MASK) != 0) {
+                                       si_pmu_pllcontrol(sih, PMU1_PLL0_PLLCTL8,
+                                               PMU1_PLLCTL8_OPENLOOP_MASK, 0);
+                                       si_pmu_pllupd(sih);
+                               }
+                       }
+                       break;
+#endif /* SAVERESTORE */
+               default:
+                       /* any unsupported chip bail */
+                       return;
+       }
+#endif 
+}
diff --git a/drivers/net/wireless/bcmdhd_1363/siutils_priv.h b/drivers/net/wireless/bcmdhd_1363/siutils_priv.h
new file mode 100644 (file)
index 0000000..56a3664
--- /dev/null
@@ -0,0 +1,294 @@
+/*
+ * Include file private to the SOC Interconnect support files.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: siutils_priv.h 625731 2016-03-17 11:53:31Z $
+ */
+
+#ifndef        _siutils_priv_h_
+#define        _siutils_priv_h_
+
+#if defined(SI_ERROR_ENFORCE)
+#define        SI_ERROR(args)  printf args
+#else
+#define        SI_ERROR(args)
+#endif 
+
+#define        SI_MSG(args)
+
+#ifdef BCMDBG_SI
+#define        SI_VMSG(args)   printf args
+#else
+#define        SI_VMSG(args)
+#endif
+
+#define        IS_SIM(chippkg) ((chippkg == HDLSIM_PKG_ID) || (chippkg == HWSIM_PKG_ID))
+
+typedef uint32 (*si_intrsoff_t)(void *intr_arg);
+typedef void (*si_intrsrestore_t)(void *intr_arg, uint32 arg);
+typedef bool (*si_intrsenabled_t)(void *intr_arg);
+
+
+#define SI_GPIO_MAX            16
+
+typedef struct gci_gpio_item {
+       void                    *arg;
+       uint8                   gci_gpio;
+       uint8                   status;
+       gci_gpio_handler_t      handler;
+       struct gci_gpio_item    *next;
+} gci_gpio_item_t;
+
+
+typedef struct si_cores_info {
+       void    *regs[SI_MAXCORES];     /* other regs va */
+
+       uint    coreid[SI_MAXCORES];    /* id of each core */
+       uint32  coresba[SI_MAXCORES];   /* backplane address of each core */
+       void    *regs2[SI_MAXCORES];    /* va of each core second register set (usbh20) */
+       uint32  coresba2[SI_MAXCORES];  /* address of each core second register set (usbh20) */
+       uint32  coresba_size[SI_MAXCORES]; /* backplane address space size */
+       uint32  coresba2_size[SI_MAXCORES]; /* second address space size */
+
+       void    *wrappers[SI_MAXCORES]; /* other cores wrapper va */
+       uint32  wrapba[SI_MAXCORES];    /* address of controlling wrapper */
+
+       void    *wrappers2[SI_MAXCORES];        /* other cores wrapper va */
+       uint32  wrapba2[SI_MAXCORES];   /* address of controlling wrapper */
+
+       uint32  cia[SI_MAXCORES];       /* erom cia entry for each core */
+       uint32  cib[SI_MAXCORES];       /* erom cia entry for each core */
+} si_cores_info_t;
+
+/* misc si info needed by some of the routines */
+typedef struct si_info {
+       struct si_pub pub;              /* back plane public state (must be first field) */
+
+       void    *osh;                   /* osl os handle */
+       void    *sdh;                   /* bcmsdh handle */
+
+       uint    dev_coreid;             /* the core provides driver functions */
+       void    *intr_arg;              /* interrupt callback function arg */
+       si_intrsoff_t intrsoff_fn;      /* turns chip interrupts off */
+       si_intrsrestore_t intrsrestore_fn; /* restore chip interrupts */
+       si_intrsenabled_t intrsenabled_fn; /* check if interrupts are enabled */
+
+       void *pch;                      /* PCI/E core handle */
+
+       bool    memseg;                 /* flag to toggle MEM_SEG register */
+
+       char *vars;
+       uint varsz;
+
+       void    *curmap;                /* current regs va */
+
+       uint    curidx;                 /* current core index */
+       uint    numcores;               /* # discovered cores */
+
+       void    *curwrap;               /* current wrapper va */
+
+       uint32  oob_router;             /* oob router registers for axi */
+
+       void *cores_info;
+       gci_gpio_item_t *gci_gpio_head; /* gci gpio interrupts head */
+       uint    chipnew;                /* new chip number */
+       uint second_bar0win;            /* Backplane region */
+       uint    num_br;         /* # discovered bridges */
+       uint32  br_wrapba[SI_MAXBR];    /* address of bridge controlling wrapper */
+       uint32  xtalfreq;
+} si_info_t;
+
+
+#define        SI_INFO(sih)    ((si_info_t *)(uintptr)sih)
+
+#define        GOODCOREADDR(x, b) (((x) >= (b)) && ((x) < ((b) + SI_MAXCORES * SI_CORE_SIZE)) && \
+               ISALIGNED((x), SI_CORE_SIZE))
+#define        GOODREGS(regs)  ((regs) != NULL && ISALIGNED((uintptr)(regs), SI_CORE_SIZE))
+#define BADCOREADDR    0
+#define        GOODIDX(idx)    (((uint)idx) < SI_MAXCORES)
+#define        NOREV           -1              /* Invalid rev */
+
+#define PCI(si)                ((BUSTYPE((si)->pub.bustype) == PCI_BUS) &&     \
+                        ((si)->pub.buscoretype == PCI_CORE_ID))
+
+#define PCIE_GEN1(si)  ((BUSTYPE((si)->pub.bustype) == PCI_BUS) &&     \
+                        ((si)->pub.buscoretype == PCIE_CORE_ID))
+
+#define PCIE_GEN2(si)  ((BUSTYPE((si)->pub.bustype) == PCI_BUS) &&     \
+                        ((si)->pub.buscoretype == PCIE2_CORE_ID))
+
+#define PCIE(si)       (PCIE_GEN1(si) || PCIE_GEN2(si))
+
+#define PCMCIA(si)     ((BUSTYPE((si)->pub.bustype) == PCMCIA_BUS) && ((si)->memseg == TRUE))
+
+/* Newer chips can access PCI/PCIE and CC core without requiring to change
+ * PCI BAR0 WIN
+ */
+#define SI_FAST(si) (PCIE(si) || (PCI(si) && ((si)->pub.buscorerev >= 13)))
+
+#define PCIEREGS(si) (((char *)((si)->curmap) + PCI_16KB0_PCIREGS_OFFSET))
+#define CCREGS_FAST(si) (((char *)((si)->curmap) + PCI_16KB0_CCREGS_OFFSET))
+
+/*
+ * Macros to disable/restore function core(D11, ENET, ILINE20, etc) interrupts before/
+ * after core switching to avoid invalid register accesss inside ISR.
+ */
+#define INTR_OFF(si, intr_val) \
+       if ((si)->intrsoff_fn && (cores_info)->coreid[(si)->curidx] == (si)->dev_coreid) {      \
+               intr_val = (*(si)->intrsoff_fn)((si)->intr_arg); }
+#define INTR_RESTORE(si, intr_val) \
+       if ((si)->intrsrestore_fn && (cores_info)->coreid[(si)->curidx] == (si)->dev_coreid) {  \
+               (*(si)->intrsrestore_fn)((si)->intr_arg, intr_val); }
+
+/* dynamic clock control defines */
+#define        LPOMINFREQ              25000           /* low power oscillator min */
+#define        LPOMAXFREQ              43000           /* low power oscillator max */
+#define        XTALMINFREQ             19800000        /* 20 MHz - 1% */
+#define        XTALMAXFREQ             20200000        /* 20 MHz + 1% */
+#define        PCIMINFREQ              25000000        /* 25 MHz */
+#define        PCIMAXFREQ              34000000        /* 33 MHz + fudge */
+
+#define        ILP_DIV_5MHZ            0               /* ILP = 5 MHz */
+#define        ILP_DIV_1MHZ            4               /* ILP = 1 MHz */
+
+/* Force fast clock for 4360b0 */
+#define PCI_FORCEHT(si)        \
+       (((PCIE_GEN1(si)) && (CHIPID(si->pub.chip) == BCM4311_CHIP_ID) && \
+       ((CHIPREV(si->pub.chiprev) <= 1))) || \
+       ((PCI(si) || PCIE_GEN1(si)) && (CHIPID(si->pub.chip) == BCM4321_CHIP_ID)) || \
+       (PCIE_GEN1(si) && (CHIPID(si->pub.chip) == BCM4716_CHIP_ID)) || \
+       (PCIE_GEN1(si) && (CHIPID(si->pub.chip) == BCM4748_CHIP_ID)))
+
+/* GPIO Based LED powersave defines */
+#define DEFAULT_GPIO_ONTIME    10              /* Default: 10% on */
+#define DEFAULT_GPIO_OFFTIME   90              /* Default: 10% on */
+
+#ifndef DEFAULT_GPIOTIMERVAL
+#define DEFAULT_GPIOTIMERVAL  ((DEFAULT_GPIO_ONTIME << GPIO_ONTIME_SHIFT) | DEFAULT_GPIO_OFFTIME)
+#endif
+
+/* Silicon Backplane externs */
+extern void sb_scan(si_t *sih, void *regs, uint devid);
+extern uint sb_coreid(si_t *sih);
+extern uint sb_intflag(si_t *sih);
+extern uint sb_flag(si_t *sih);
+extern void sb_setint(si_t *sih, int siflag);
+extern uint sb_corevendor(si_t *sih);
+extern uint sb_corerev(si_t *sih);
+extern uint sb_corereg(si_t *sih, uint coreidx, uint regoff, uint mask, uint val);
+extern uint32 *sb_corereg_addr(si_t *sih, uint coreidx, uint regoff);
+extern bool sb_iscoreup(si_t *sih);
+extern void *sb_setcoreidx(si_t *sih, uint coreidx);
+extern uint32 sb_core_cflags(si_t *sih, uint32 mask, uint32 val);
+extern void sb_core_cflags_wo(si_t *sih, uint32 mask, uint32 val);
+extern uint32 sb_core_sflags(si_t *sih, uint32 mask, uint32 val);
+extern void sb_commit(si_t *sih);
+extern uint32 sb_base(uint32 admatch);
+extern uint32 sb_size(uint32 admatch);
+extern void sb_core_reset(si_t *sih, uint32 bits, uint32 resetbits);
+extern void sb_core_disable(si_t *sih, uint32 bits);
+extern uint32 sb_addrspace(si_t *sih, uint asidx);
+extern uint32 sb_addrspacesize(si_t *sih, uint asidx);
+extern int sb_numaddrspaces(si_t *sih);
+
+extern uint32 sb_set_initiator_to(si_t *sih, uint32 to, uint idx);
+
+extern bool sb_taclear(si_t *sih, bool details);
+
+#if defined(BCMDBG_PHYDUMP)
+extern void sb_dumpregs(si_t *sih, struct bcmstrbuf *b);
+#endif 
+
+/* Wake-on-wireless-LAN (WOWL) */
+extern bool sb_pci_pmecap(si_t *sih);
+struct osl_info;
+extern bool sb_pci_fastpmecap(struct osl_info *osh);
+extern bool sb_pci_pmeclr(si_t *sih);
+extern void sb_pci_pmeen(si_t *sih);
+extern uint sb_pcie_readreg(void *sih, uint addrtype, uint offset);
+
+/* AMBA Interconnect exported externs */
+extern si_t *ai_attach(uint pcidev, osl_t *osh, void *regs, uint bustype,
+                       void *sdh, char **vars, uint *varsz);
+extern si_t *ai_kattach(osl_t *osh);
+extern void ai_scan(si_t *sih, void *regs, uint devid);
+
+extern uint ai_flag(si_t *sih);
+extern uint ai_flag_alt(si_t *sih);
+extern void ai_setint(si_t *sih, int siflag);
+extern uint ai_coreidx(si_t *sih);
+extern uint ai_corevendor(si_t *sih);
+extern uint ai_corerev(si_t *sih);
+extern uint32 *ai_corereg_addr(si_t *sih, uint coreidx, uint regoff);
+extern bool ai_iscoreup(si_t *sih);
+extern void *ai_setcoreidx(si_t *sih, uint coreidx);
+extern void *ai_setcoreidx_2ndwrap(si_t *sih, uint coreidx);
+extern uint32 ai_core_cflags(si_t *sih, uint32 mask, uint32 val);
+extern void ai_core_cflags_wo(si_t *sih, uint32 mask, uint32 val);
+extern uint32 ai_core_sflags(si_t *sih, uint32 mask, uint32 val);
+extern uint ai_corereg(si_t *sih, uint coreidx, uint regoff, uint mask, uint val);
+extern void ai_core_reset(si_t *sih, uint32 bits, uint32 resetbits);
+extern void ai_d11rsdb_core_reset(si_t *sih, uint32 bits,
+       uint32 resetbits, void *p, void *s);
+extern void ai_d11rsdb_core1_alt_reg_clk_en(si_t *sih);
+extern void ai_d11rsdb_core1_alt_reg_clk_dis(si_t *sih);
+
+extern void ai_core_disable(si_t *sih, uint32 bits);
+extern void ai_d11rsdb_core_disable(const si_info_t *sii, uint32 bits,
+       aidmp_t *pmacai, aidmp_t *smacai);
+extern int ai_numaddrspaces(si_t *sih);
+extern uint32 ai_addrspace(si_t *sih, uint asidx);
+extern uint32 ai_addrspacesize(si_t *sih, uint asidx);
+extern void ai_coreaddrspaceX(si_t *sih, uint asidx, uint32 *addr, uint32 *size);
+extern uint ai_wrap_reg(si_t *sih, uint32 offset, uint32 mask, uint32 val);
+extern void ai_enable_backplane_timeouts(si_t *sih);
+extern void ai_clear_backplane_to(si_t *sih);
+
+#if defined(BCMDBG_PHYDUMP)
+extern void ai_dumpregs(si_t *sih, struct bcmstrbuf *b);
+#endif 
+
+
+#define ub_scan(a, b, c) do {} while (0)
+#define ub_flag(a) (0)
+#define ub_setint(a, b) do {} while (0)
+#define ub_coreidx(a) (0)
+#define ub_corevendor(a) (0)
+#define ub_corerev(a) (0)
+#define ub_iscoreup(a) (0)
+#define ub_setcoreidx(a, b) (0)
+#define ub_core_cflags(a, b, c) (0)
+#define ub_core_cflags_wo(a, b, c) do {} while (0)
+#define ub_core_sflags(a, b, c) (0)
+#define ub_corereg(a, b, c, d, e) (0)
+#define ub_core_reset(a, b, c) do {} while (0)
+#define ub_core_disable(a, b) do {} while (0)
+#define ub_numaddrspaces(a) (0)
+#define ub_addrspace(a, b)  (0)
+#define ub_addrspacesize(a, b) (0)
+#define ub_view(a, b) do {} while (0)
+#define ub_dumpregs(a, b) do {} while (0)
+
+#endif /* _siutils_priv_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/uamp_api.h b/drivers/net/wireless/bcmdhd_1363/uamp_api.h
new file mode 100644 (file)
index 0000000..7fe81a8
--- /dev/null
@@ -0,0 +1,181 @@
+/*
+ *  Name:       uamp_api.h
+ *
+ *  Description: Universal AMP API
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: uamp_api.h 514727 2014-11-12 03:02:48Z $
+ *
+ */
+
+
+#ifndef UAMP_API_H
+#define UAMP_API_H
+
+
+#include "typedefs.h"
+
+
+/*****************************************************************************
+**  Constant and Type Definitions
+******************************************************************************
+*/
+
+#define BT_API
+
+/* Types. */
+typedef bool   BOOLEAN;
+typedef uint8  UINT8;
+typedef uint16 UINT16;
+
+
+/* UAMP identifiers */
+#define UAMP_ID_1   1
+#define UAMP_ID_2   2
+typedef UINT8 tUAMP_ID;
+
+/* UAMP event ids (used by UAMP_CBACK) */
+#define UAMP_EVT_RX_READY           0   /* Data from AMP controller is ready to be read */
+#define UAMP_EVT_CTLR_REMOVED       1   /* Controller removed */
+#define UAMP_EVT_CTLR_READY         2   /* Controller added/ready */
+typedef UINT8 tUAMP_EVT;
+
+
+/* UAMP Channels */
+#define UAMP_CH_HCI_CMD            0   /* HCI Command channel */
+#define UAMP_CH_HCI_EVT            1   /* HCI Event channel */
+#define UAMP_CH_HCI_DATA           2   /* HCI ACL Data channel */
+typedef UINT8 tUAMP_CH;
+
+/* tUAMP_EVT_DATA: union for event-specific data, used by UAMP_CBACK */
+typedef union {
+    tUAMP_CH channel;       /* UAMP_EVT_RX_READY: channel for which rx occured */
+} tUAMP_EVT_DATA;
+
+
+/*****************************************************************************
+**
+** Function:    UAMP_CBACK
+**
+** Description: Callback for events. Register callback using UAMP_Init.
+**
+** Parameters   amp_id:         AMP device identifier that generated the event
+**              amp_evt:        event id
+**              p_amp_evt_data: pointer to event-specific data
+**
+******************************************************************************
+*/
+typedef void (*tUAMP_CBACK)(tUAMP_ID amp_id, tUAMP_EVT amp_evt, tUAMP_EVT_DATA *p_amp_evt_data);
+
+/*****************************************************************************
+**  external function declarations
+******************************************************************************
+*/
+#ifdef __cplusplus
+extern "C"
+{
+#endif
+
+/*****************************************************************************
+**
+** Function:    UAMP_Init
+**
+** Description: Initialize UAMP driver
+**
+** Parameters   p_cback:    Callback function for UAMP event notification
+**
+******************************************************************************
+*/
+BT_API BOOLEAN UAMP_Init(tUAMP_CBACK p_cback);
+
+
+/*****************************************************************************
+**
+** Function:    UAMP_Open
+**
+** Description: Open connection to local AMP device.
+**
+** Parameters   app_id: Application specific AMP identifer. This value
+**                      will be included in AMP messages sent to the
+**                      BTU task, to identify source of the message
+**
+******************************************************************************
+*/
+BT_API BOOLEAN UAMP_Open(tUAMP_ID amp_id);
+
+/*****************************************************************************
+**
+** Function:    UAMP_Close
+**
+** Description: Close connection to local AMP device.
+**
+** Parameters   app_id: Application specific AMP identifer.
+**
+******************************************************************************
+*/
+BT_API void UAMP_Close(tUAMP_ID amp_id);
+
+
+/*****************************************************************************
+**
+** Function:    UAMP_Write
+**
+** Description: Send buffer to AMP device. Frees GKI buffer when done.
+**
+**
+** Parameters:  app_id:     AMP identifer.
+**              p_buf:      pointer to buffer to write
+**              num_bytes:  number of bytes to write
+**              channel:    UAMP_CH_HCI_ACL, or UAMP_CH_HCI_CMD
+**
+** Returns:     number of bytes written
+**
+******************************************************************************
+*/
+BT_API UINT16 UAMP_Write(tUAMP_ID amp_id, UINT8 *p_buf, UINT16 num_bytes, tUAMP_CH channel);
+
+/*****************************************************************************
+**
+** Function:    UAMP_Read
+**
+** Description: Read incoming data from AMP. Call after receiving a
+**              UAMP_EVT_RX_READY callback event.
+**
+** Parameters:  app_id:     AMP identifer.
+**              p_buf:      pointer to buffer for holding incoming AMP data
+**              buf_size:   size of p_buf
+**              channel:    UAMP_CH_HCI_ACL, or UAMP_CH_HCI_EVT
+**
+** Returns:     number of bytes read
+**
+******************************************************************************
+*/
+BT_API UINT16 UAMP_Read(tUAMP_ID amp_id, UINT8 *p_buf, UINT16 buf_size, tUAMP_CH channel);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* UAMP_API_H */
diff --git a/drivers/net/wireless/bcmdhd_1363/wl_android.c b/drivers/net/wireless/bcmdhd_1363/wl_android.c
new file mode 100644 (file)
index 0000000..dcf4c8a
--- /dev/null
@@ -0,0 +1,3861 @@
+/*
+ * Linux cfg80211 driver - Android related functions
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: wl_android.c 664848 2017-04-28 14:33:00Z $
+ */
+
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <net/netlink.h>
+#ifdef CONFIG_COMPAT
+#include <linux/compat.h>
+#endif
+
+#include <wl_android.h>
+#include <wldev_common.h>
+#include <wlioctl.h>
+#include <bcmutils.h>
+#include <linux_osl.h>
+#include <dhd_dbg.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <proto/bcmip.h>
+#ifdef PNO_SUPPORT
+#include <dhd_pno.h>
+#endif
+#ifdef BCMSDIO
+#include <bcmsdbus.h>
+#endif
+#ifdef WL_CFG80211
+#include <wl_cfg80211.h>
+#endif
+#ifdef WL_NAN
+#include <wl_cfgnan.h>
+#endif /* WL_NAN */
+#ifdef DHDTCPACK_SUPPRESS
+#include <dhd_ip.h>
+#endif /* DHDTCPACK_SUPPRESS */
+
+#ifdef DHD_BANDSTEER
+#include <dhd_bandsteer.h>
+#endif /* DHD_BANDSTEER */
+
+/*
+ * Android private command strings, PLEASE define new private commands here
+ * so they can be updated easily in the future (if needed)
+ */
+
+#define CMD_START              "START"
+#define CMD_STOP               "STOP"
+#define        CMD_SCAN_ACTIVE         "SCAN-ACTIVE"
+#define        CMD_SCAN_PASSIVE        "SCAN-PASSIVE"
+#define CMD_RSSI               "RSSI"
+#define CMD_LINKSPEED          "LINKSPEED"
+#define CMD_RXFILTER_START     "RXFILTER-START"
+#define CMD_RXFILTER_STOP      "RXFILTER-STOP"
+#define CMD_RXFILTER_ADD       "RXFILTER-ADD"
+#define CMD_RXFILTER_REMOVE    "RXFILTER-REMOVE"
+#define CMD_BTCOEXSCAN_START   "BTCOEXSCAN-START"
+#define CMD_BTCOEXSCAN_STOP    "BTCOEXSCAN-STOP"
+#define CMD_BTCOEXMODE         "BTCOEXMODE"
+#define CMD_SETSUSPENDOPT      "SETSUSPENDOPT"
+#define CMD_SETSUSPENDMODE      "SETSUSPENDMODE"
+#define CMD_MAXDTIM_IN_SUSPEND  "MAX_DTIM_IN_SUSPEND"
+#define CMD_P2P_DEV_ADDR       "P2P_DEV_ADDR"
+#define CMD_SETFWPATH          "SETFWPATH"
+#define CMD_SETBAND            "SETBAND"
+#define CMD_GETBAND            "GETBAND"
+#define CMD_COUNTRY            "COUNTRY"
+#define CMD_P2P_SET_NOA                "P2P_SET_NOA"
+#if !defined WL_ENABLE_P2P_IF
+#define CMD_P2P_GET_NOA                        "P2P_GET_NOA"
+#endif /* WL_ENABLE_P2P_IF */
+#define CMD_P2P_SD_OFFLOAD             "P2P_SD_"
+#define CMD_P2P_LISTEN_OFFLOAD         "P2P_LO_"
+#define CMD_P2P_SET_PS         "P2P_SET_PS"
+#define CMD_P2P_ECSA           "P2P_ECSA"
+#define CMD_P2P_INC_BW         "P2P_INCREASE_BW"
+#define CMD_SET_AP_WPS_P2P_IE          "SET_AP_WPS_P2P_IE"
+#define CMD_SETROAMMODE        "SETROAMMODE"
+#define CMD_SETIBSSBEACONOUIDATA       "SETIBSSBEACONOUIDATA"
+#define CMD_MIRACAST           "MIRACAST"
+#ifdef WL_NAN
+#define CMD_NAN         "NAN_"
+#endif /* WL_NAN */
+#define CMD_COUNTRY_DELIMITER "/"
+#ifdef WL11ULB
+#define CMD_ULB_MODE "ULB_MODE"
+#define CMD_ULB_BW "ULB_BW"
+#endif /* WL11ULB */
+
+#if defined(WL_SUPPORT_AUTO_CHANNEL)
+#define CMD_GET_BEST_CHANNELS  "GET_BEST_CHANNELS"
+#endif /* WL_SUPPORT_AUTO_CHANNEL */
+
+#define CMD_80211_MODE    "MODE"  /* 802.11 mode a/b/g/n/ac */
+#define CMD_CHANSPEC      "CHANSPEC"
+#define CMD_DATARATE      "DATARATE"
+#define CMD_ASSOC_CLIENTS "ASSOCLIST"
+#define CMD_SET_CSA       "SETCSA"
+#ifdef WL_SUPPORT_AUTO_CHANNEL
+#define CMD_SET_HAPD_AUTO_CHANNEL      "HAPD_AUTO_CHANNEL"
+#endif /* WL_SUPPORT_AUTO_CHANNEL */
+#ifdef SUPPORT_HIDDEN_AP
+/* Hostapd private command */
+#define CMD_SET_HAPD_MAX_NUM_STA       "HAPD_MAX_NUM_STA"
+#define CMD_SET_HAPD_SSID              "HAPD_SSID"
+#define CMD_SET_HAPD_HIDE_SSID         "HIDE_SSID"
+#endif /* SUPPORT_HIDDEN_AP */
+#ifdef CUSTOMER_HW4_PRIVATE_CMD
+#ifdef SUPPORT_SET_LPC
+#define CMD_HAPD_LPC_ENABLED           "HAPD_LPC_ENABLED"
+#endif /* SUPPORT_SET_LPC */
+#ifdef SUPPORT_TRIGGER_HANG_EVENT
+#define CMD_TEST_FORCE_HANG            "TEST_FORCE_HANG"
+#endif /* SUPPORT_TRIGGER_HANG_EVENT */
+#ifdef TEST_TX_POWER_CONTROL
+#define CMD_TEST_SET_TX_POWER          "TEST_SET_TX_POWER"
+#define CMD_TEST_GET_TX_POWER          "TEST_GET_TX_POWER"
+#endif /* TEST_TX_POWER_CONTROL */
+#define CMD_SARLIMIT_TX_CONTROL                "SET_TX_POWER_CALLING"
+#endif /* CUSTOMER_HW4_PRIVATE_CMD */
+#define CMD_KEEP_ALIVE         "KEEPALIVE"
+#define CMD_ADDIE "add_ie"
+#define CMD_DELIE "del_ie"
+
+#ifdef PNO_SUPPORT
+#define CMD_PNOSSIDCLR_SET     "PNOSSIDCLR"
+#define CMD_PNOSETUP_SET       "PNOSETUP "
+#define CMD_PNOENABLE_SET      "PNOFORCE"
+#define CMD_PNODEBUG_SET       "PNODEBUG"
+#define CMD_WLS_BATCHING       "WLS_BATCHING"
+#endif /* PNO_SUPPORT */
+
+#define        CMD_HAPD_MAC_FILTER     "HAPD_MAC_FILTER"
+
+#ifdef CUSTOMER_HW4_PRIVATE_CMD
+
+
+#if defined(SUPPORT_RANDOM_MAC_SCAN)
+#define ENABLE_RANDOM_MAC "ENABLE_RANDOM_MAC"
+#define DISABLE_RANDOM_MAC "DISABLE_RANDOM_MAC"
+#endif /* SUPPORT_RANDOM_MAC_SCAN */
+
+
+#define CMD_CHANGE_RL  "CHANGE_RL"
+#define CMD_RESTORE_RL  "RESTORE_RL"
+
+#define CMD_SET_RMC_ENABLE                     "SETRMCENABLE"
+#define CMD_SET_RMC_TXRATE                     "SETRMCTXRATE"
+#define CMD_SET_RMC_ACTPERIOD          "SETRMCACTIONPERIOD"
+#define CMD_SET_RMC_IDLEPERIOD         "SETRMCIDLEPERIOD"
+#define CMD_SET_RMC_LEADER                     "SETRMCLEADER"
+#define CMD_SET_RMC_EVENT                      "SETRMCEVENT"
+
+#define CMD_SET_SCSCAN         "SETSINGLEANT"
+#define CMD_GET_SCSCAN         "GETSINGLEANT"
+
+/* FCC_PWR_LIMIT_2G */
+#define CUSTOMER_HW4_ENABLE            0
+#define CUSTOMER_HW4_DISABLE   -1
+#define CUSTOMER_HW4_EN_CONVERT(i)     (i += 1)
+
+#ifdef WLTDLS
+#define CMD_TDLS_RESET "TDLS_RESET"
+#endif /* WLTDLS */
+
+#ifdef IPV6_NDO_SUPPORT
+#define CMD_NDRA_LIMIT "NDRA_LIMIT"
+#endif /* IPV6_NDO_SUPPORT */
+
+#endif /* CUSTOMER_HW4_PRIVATE_CMD */
+
+
+#define CMD_ROAM_OFFLOAD                       "SETROAMOFFLOAD"
+#define CMD_ROAM_OFFLOAD_APLIST                        "SETROAMOFFLAPLIST"
+#define CMD_INTERFACE_CREATE                   "INTERFACE_CREATE"
+#define CMD_INTERFACE_DELETE                   "INTERFACE_DELETE"
+
+#if defined(DHD_ENABLE_BIGDATA_LOGGING)
+#define CMD_GET_BSS_INFO            "GETBSSINFO"
+#define CMD_GET_ASSOC_REJECT_INFO   "GETASSOCREJECTINFO"
+#endif /* DHD_ENABLE_BIGDATA_LOGGING */
+
+#ifdef P2PRESP_WFDIE_SRC
+#define CMD_P2P_SET_WFDIE_RESP      "P2P_SET_WFDIE_RESP"
+#define CMD_P2P_GET_WFDIE_RESP      "P2P_GET_WFDIE_RESP"
+#endif /* P2PRESP_WFDIE_SRC */
+
+#define CMD_DFS_AP_MOVE                        "DFS_AP_MOVE"
+#define CMD_WBTEXT_ENABLE              "WBTEXT_ENABLE"
+#define CMD_WBTEXT_PROFILE_CONFIG      "WBTEXT_PROFILE_CONFIG"
+#define CMD_WBTEXT_WEIGHT_CONFIG       "WBTEXT_WEIGHT_CONFIG"
+#define CMD_WBTEXT_TABLE_CONFIG                "WBTEXT_TABLE_CONFIG"
+#define CMD_WBTEXT_DELTA_CONFIG                "WBTEXT_DELTA_CONFIG"
+
+#ifdef WLWFDS
+#define CMD_ADD_WFDS_HASH      "ADD_WFDS_HASH"
+#define CMD_DEL_WFDS_HASH      "DEL_WFDS_HASH"
+#endif /* WLWFDS */
+
+#ifdef SET_RPS_CPUS
+#define CMD_RPSMODE  "RPSMODE"
+#endif /* SET_RPS_CPUS */
+
+#ifdef BT_WIFI_HANDOVER
+#define CMD_TBOW_TEARDOWN "TBOW_TEARDOWN"
+#endif /* BT_WIFI_HANDOVER */
+
+#define CMD_MURX_BFE_CAP "MURX_BFE_CAP"
+#ifdef DHD_BANDSTEER
+#define CMD_BANDSTEER_ENABLE   "BANDSTEER_ENABLE"
+#define CMD_BANDSTEER_TRIGGER  "BANDSTEER_TRIGGER"
+#endif /* DHD_BANDSTEER */
+
+/* miracast related definition */
+#define MIRACAST_MODE_OFF      0
+#define MIRACAST_MODE_SOURCE   1
+#define MIRACAST_MODE_SINK     2
+
+#ifndef MIRACAST_AMPDU_SIZE
+#define MIRACAST_AMPDU_SIZE    8
+#endif
+
+#ifndef MIRACAST_MCHAN_ALGO
+#define MIRACAST_MCHAN_ALGO     1
+#endif
+
+#ifndef MIRACAST_MCHAN_BW
+#define MIRACAST_MCHAN_BW       25
+#endif
+
+#define CMD_AP_ISOLATE "AP_ISOLATE"
+
+#define CMD_MAXASSOC "MAXASSOC"
+
+#define CMD_CHANNEL_WIDTH "CHANNEL_WIDTH"
+
+#ifdef CONNECTION_STATISTICS
+#define CMD_GET_CONNECTION_STATS       "GET_CONNECTION_STATS"
+
+struct connection_stats {
+       u32 txframe;
+       u32 txbyte;
+       u32 txerror;
+       u32 rxframe;
+       u32 rxbyte;
+       u32 txfail;
+       u32 txretry;
+       u32 txretrie;
+       u32 txrts;
+       u32 txnocts;
+       u32 txexptime;
+       u32 txrate;
+       u8      chan_idle;
+};
+#endif /* CONNECTION_STATISTICS */
+
+static LIST_HEAD(miracast_resume_list);
+static u8 miracast_cur_mode;
+
+#ifdef DHD_LOG_DUMP
+#define CMD_NEW_DEBUG_PRINT_DUMP                       "DEBUG_DUMP"
+extern void dhd_schedule_log_dump(dhd_pub_t *dhdp);
+extern int dhd_bus_mem_dump(dhd_pub_t *dhd);
+#endif /* DHD_LOG_DUMP */
+#ifdef DHD_TRACE_WAKE_LOCK
+extern void dhd_wk_lock_stats_dump(dhd_pub_t *dhdp);
+#endif /* DHD_TRACE_WAKE_LOCK */
+
+struct io_cfg {
+       s8 *iovar;
+       s32 param;
+       u32 ioctl;
+       void *arg;
+       u32 len;
+       struct list_head list;
+};
+
+typedef struct _android_wifi_priv_cmd {
+       char *buf;
+       int used_len;
+       int total_len;
+} android_wifi_priv_cmd;
+
+#ifdef CONFIG_COMPAT
+typedef struct _compat_android_wifi_priv_cmd {
+       compat_caddr_t buf;
+       int used_len;
+       int total_len;
+} compat_android_wifi_priv_cmd;
+#endif /* CONFIG_COMPAT */
+
+#if defined(BCMFW_ROAM_ENABLE)
+#define CMD_SET_ROAMPREF       "SET_ROAMPREF"
+
+#define MAX_NUM_SUITES         10
+#define WIDTH_AKM_SUITE                8
+#define JOIN_PREF_RSSI_LEN             0x02
+#define JOIN_PREF_RSSI_SIZE            4       /* RSSI pref header size in bytes */
+#define JOIN_PREF_WPA_HDR_SIZE         4 /* WPA pref header size in bytes */
+#define JOIN_PREF_WPA_TUPLE_SIZE       12      /* Tuple size in bytes */
+#define JOIN_PREF_MAX_WPA_TUPLES       16
+#define MAX_BUF_SIZE           (JOIN_PREF_RSSI_SIZE + JOIN_PREF_WPA_HDR_SIZE + \
+                                          (JOIN_PREF_WPA_TUPLE_SIZE * JOIN_PREF_MAX_WPA_TUPLES))
+#endif /* BCMFW_ROAM_ENABLE */
+
+
+/**
+ * Extern function declarations (TODO: move them to dhd_linux.h)
+ */
+int dhd_net_bus_devreset(struct net_device *dev, uint8 flag);
+int dhd_dev_init_ioctl(struct net_device *dev);
+#ifdef WL_CFG80211
+int wl_cfg80211_get_p2p_dev_addr(struct net_device *net, struct ether_addr *p2pdev_addr);
+int wl_cfg80211_set_btcoex_dhcp(struct net_device *dev, dhd_pub_t *dhd, char *command);
+#else
+int wl_cfg80211_get_p2p_dev_addr(struct net_device *net, struct ether_addr *p2pdev_addr)
+{ return 0; }
+int wl_cfg80211_set_p2p_noa(struct net_device *net, char* buf, int len)
+{ return 0; }
+int wl_cfg80211_get_p2p_noa(struct net_device *net, char* buf, int len)
+{ return 0; }
+int wl_cfg80211_set_p2p_ps(struct net_device *net, char* buf, int len)
+{ return 0; }
+int wl_cfg80211_set_p2p_ecsa(struct net_device *net, char* buf, int len)
+{ return 0; }
+int wl_cfg80211_increase_p2p_bw(struct net_device *net, char* buf, int len)
+{ return 0; }
+#endif /* WK_CFG80211 */
+
+
+#ifdef ENABLE_4335BT_WAR
+extern int bcm_bt_lock(int cookie);
+extern void bcm_bt_unlock(int cookie);
+static int lock_cookie_wifi = 'W' | 'i'<<8 | 'F'<<16 | 'i'<<24;        /* cookie is "WiFi" */
+#endif /* ENABLE_4335BT_WAR */
+
+extern bool ap_fw_loaded;
+extern char iface_name[IFNAMSIZ];
+
+/**
+ * Local (static) functions and variables
+ */
+
+/* Initialize g_wifi_on to 1 so dhd_bus_start will be called for the first
+ * time (only) in dhd_open, subsequential wifi on will be handled by
+ * wl_android_wifi_on
+ */
+static int g_wifi_on = TRUE;
+
+/**
+ * Local (static) function definitions
+ */
+
+
+static int wl_android_set_ap_isolate(struct net_device *dev, char *command, int total_len)
+{
+       int val = 0, bytes_written = 0;
+
+       if (*(command + strlen(CMD_AP_ISOLATE)) == '\0') {
+               val = dhd_android_ap_isolate_getval(dev);
+               bytes_written = snprintf(command, total_len, "%s %d", CMD_AP_ISOLATE, val);
+               return bytes_written;
+       }
+       command = (command + strlen(CMD_AP_ISOLATE));
+       command++;
+       val = bcm_atoi(command);
+
+       DHD_INFO(("%s : ap_isolate = %d\n", __FUNCTION__, val));
+       dhd_android_ap_isolate_setval(dev, val);
+       return 0;
+}
+
+static int
+wl_android_set_maxassoc_limit(struct net_device *dev, char *command, int total_len)
+{
+       int ret = 0, max_assoc = 0, bytes_written = 0;
+
+       if (*(command + strlen(CMD_MAXASSOC)) == '\0') {
+               ret = wldev_iovar_getint(dev, "maxassoc", &max_assoc);
+               if (ret) {
+                       DHD_ERROR(("%s: Failed to get maxassoc limit\n", __FUNCTION__));
+                       return ret;
+               }
+               bytes_written = snprintf(command, total_len, "%s %d", CMD_MAXASSOC, max_assoc);
+               return bytes_written;
+       }
+       command = (command + strlen(CMD_MAXASSOC));
+       command++;
+       max_assoc = bcm_atoi(command);
+
+       DHD_INFO(("%s : maxassoc limit = %d\n", __FUNCTION__, max_assoc));
+       ret = wldev_iovar_setint(dev, "maxassoc", max_assoc);
+       if (ret) {
+               DHD_ERROR(("%s: Failed to set maxassoc limit to %d\n", __FUNCTION__, max_assoc));
+               return ret;
+       }
+       return 0;
+}
+
+static int
+wl_android_set_channel_width(struct net_device *dev, char *command, int total_len)
+{
+       u32 channel_width = 0;
+
+       struct wireless_dev *wdev = dev->ieee80211_ptr;
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)wiphy_priv(wdev->wiphy);
+
+       command = (command + strlen(CMD_CHANNEL_WIDTH));
+       command++;
+       channel_width = bcm_atoi(command);
+       if (channel_width == 80)
+               wl_set_chanwidth_by_netdev(cfg, dev, WL_CHANSPEC_BW_80);
+       else if (channel_width == 40)
+               wl_set_chanwidth_by_netdev(cfg, dev, WL_CHANSPEC_BW_40);
+       else if (channel_width == 20)
+               wl_set_chanwidth_by_netdev(cfg, dev, WL_CHANSPEC_BW_20);
+       else
+               return 0;
+
+       DHD_INFO(("%s : channel width = %d\n", __FUNCTION__, channel_width));
+       return 0;
+}
+
+#ifdef WLWFDS
+static int wl_android_set_wfds_hash(
+       struct net_device *dev, char *command, int total_len, bool enable)
+{
+       int error = 0;
+       wl_p2p_wfds_hash_t *wfds_hash = NULL;
+       char *smbuf = NULL;
+       smbuf = kmalloc(WLC_IOCTL_MAXLEN, GFP_KERNEL);
+
+       if (smbuf == NULL) {
+               DHD_ERROR(("%s: failed to allocated memory %d bytes\n",
+                       __FUNCTION__, WLC_IOCTL_MAXLEN));
+               return -ENOMEM;
+       }
+
+       if (enable) {
+               wfds_hash = (wl_p2p_wfds_hash_t *)(command + strlen(CMD_ADD_WFDS_HASH) + 1);
+               error = wldev_iovar_setbuf(dev, "p2p_add_wfds_hash", wfds_hash,
+                       sizeof(wl_p2p_wfds_hash_t), smbuf, WLC_IOCTL_MAXLEN, NULL);
+       }
+       else {
+               wfds_hash = (wl_p2p_wfds_hash_t *)(command + strlen(CMD_DEL_WFDS_HASH) + 1);
+               error = wldev_iovar_setbuf(dev, "p2p_del_wfds_hash", wfds_hash,
+                       sizeof(wl_p2p_wfds_hash_t), smbuf, WLC_IOCTL_MAXLEN, NULL);
+       }
+
+       if (error) {
+               DHD_ERROR(("%s: failed to %s, error=%d\n", __FUNCTION__, command, error));
+       }
+
+       if (smbuf)
+               kfree(smbuf);
+       return error;
+}
+#endif /* WLWFDS */
+
+static int wl_android_get_link_speed(struct net_device *net, char *command, int total_len)
+{
+       int link_speed;
+       int bytes_written;
+       int error;
+
+       error = wldev_get_link_speed(net, &link_speed);
+       if (error)
+               return -1;
+
+       /* Convert Kbps to Android Mbps */
+       link_speed = link_speed / 1000;
+       bytes_written = snprintf(command, total_len, "LinkSpeed %d", link_speed);
+       DHD_INFO(("%s: command result is %s\n", __FUNCTION__, command));
+       return bytes_written;
+}
+
+static int wl_android_get_rssi(struct net_device *net, char *command, int total_len)
+{
+       wlc_ssid_t ssid = {0};
+       int bytes_written = 0;
+       int error = 0;
+       scb_val_t scbval;
+       char *delim = NULL;
+
+       delim = strchr(command, ' ');
+       /* For Ap mode rssi command would be
+        * driver rssi <sta_mac_addr>
+        * for STA/GC mode
+        * driver rssi
+       */
+       if (delim) {
+               /* Ap/GO mode
+               * driver rssi <sta_mac_addr>
+               */
+               DHD_TRACE(("%s: cmd:%s\n", __FUNCTION__, delim));
+               /* skip space from delim after finding char */
+               delim++;
+               if (!(bcm_ether_atoe((delim), &scbval.ea)))
+               {
+                       DHD_ERROR(("%s:address err\n", __FUNCTION__));
+                       return -1;
+               }
+               scbval.val = htod32(0);
+               DHD_TRACE(("%s: address:"MACDBG, __FUNCTION__, MAC2STRDBG(scbval.ea.octet)));
+       }
+       else {
+               /* STA/GC mode */
+               memset(&scbval, 0, sizeof(scb_val_t));
+       }
+
+       error = wldev_get_rssi(net, &scbval);
+       if (error)
+               return -1;
+
+       error = wldev_get_ssid(net, &ssid);
+       if (error)
+               return -1;
+       if ((ssid.SSID_len == 0) || (ssid.SSID_len > DOT11_MAX_SSID_LEN)) {
+               DHD_ERROR(("%s: wldev_get_ssid failed\n", __FUNCTION__));
+       } else if (total_len <= ssid.SSID_len) {
+               return -ENOMEM;
+       } else {
+               memcpy(command, ssid.SSID, ssid.SSID_len);
+               bytes_written = ssid.SSID_len;
+       }
+       if ((total_len - bytes_written) < (strlen(" rssi -XXX") + 1))
+               return -ENOMEM;
+
+       bytes_written += scnprintf(&command[bytes_written], total_len - bytes_written,
+               " rssi %d", scbval.val);
+       command[bytes_written] = '\0';
+
+       DHD_TRACE(("%s: command result is %s (%d)\n", __FUNCTION__, command, bytes_written));
+       return bytes_written;
+}
+
+static int wl_android_set_suspendopt(struct net_device *dev, char *command, int total_len)
+{
+       int suspend_flag;
+       int ret_now;
+       int ret = 0;
+
+       suspend_flag = *(command + strlen(CMD_SETSUSPENDOPT) + 1) - '0';
+
+       if (suspend_flag != 0) {
+               suspend_flag = 1;
+       }
+       ret_now = net_os_set_suspend_disable(dev, suspend_flag);
+
+       if (ret_now != suspend_flag) {
+               if (!(ret = net_os_set_suspend(dev, ret_now, 1))) {
+                       DHD_INFO(("%s: Suspend Flag %d -> %d\n",
+                               __FUNCTION__, ret_now, suspend_flag));
+               } else {
+                       DHD_ERROR(("%s: failed %d\n", __FUNCTION__, ret));
+               }
+       }
+
+       return ret;
+}
+
+static int wl_android_set_suspendmode(struct net_device *dev, char *command, int total_len)
+{
+       int ret = 0;
+
+#if !defined(CONFIG_HAS_EARLYSUSPEND) || !defined(DHD_USE_EARLYSUSPEND)
+       int suspend_flag;
+
+       suspend_flag = *(command + strlen(CMD_SETSUSPENDMODE) + 1) - '0';
+       if (suspend_flag != 0)
+               suspend_flag = 1;
+
+       if (!(ret = net_os_set_suspend(dev, suspend_flag, 0)))
+               DHD_INFO(("%s: Suspend Mode %d\n", __FUNCTION__, suspend_flag));
+       else
+               DHD_ERROR(("%s: failed %d\n", __FUNCTION__, ret));
+#endif
+
+       return ret;
+}
+
+static int wl_android_set_max_dtim(struct net_device *dev, char *command, int total_len)
+{
+       int ret = 0;
+       int dtim_flag;
+
+       dtim_flag = *(command + strlen(CMD_MAXDTIM_IN_SUSPEND) + 1) - '0';
+
+       if (!(ret = net_os_set_max_dtim_enable(dev, dtim_flag))) {
+               DHD_TRACE(("%s: use Max bcn_li_dtim in suspend %s\n",
+                       __FUNCTION__, (dtim_flag ? "Enable" : "Disable")));
+       } else {
+               DHD_ERROR(("%s: failed %d\n", __FUNCTION__, ret));
+       }
+
+       return ret;
+}
+
+int wl_android_get_80211_mode(struct net_device *dev, char *command, int total_len)
+{
+       uint8 mode[4];
+       int  error = 0;
+       int bytes_written = 0;
+
+       error = wldev_get_mode(dev, mode);
+       if (error)
+               return -1;
+
+       DHD_INFO(("%s: mode:%s\n", __FUNCTION__, mode));
+       bytes_written = snprintf(command, total_len, "%s %s", CMD_80211_MODE, mode);
+       DHD_INFO(("%s: command:%s EXIT\n", __FUNCTION__, command));
+       return bytes_written;
+
+}
+
+extern chanspec_t
+wl_chspec_driver_to_host(chanspec_t chanspec);
+int wl_android_get_chanspec(struct net_device *dev, char *command, int total_len)
+{
+       int error = 0;
+       int bytes_written = 0;
+       int chsp = {0};
+       uint16 band = 0;
+       uint16 bw = 0;
+       uint16 channel = 0;
+       u32 sb = 0;
+       chanspec_t chanspec;
+
+       /* command is
+        * driver chanspec
+        */
+       error = wldev_iovar_getint(dev, "chanspec", &chsp);
+       if (error)
+               return -1;
+
+       chanspec = wl_chspec_driver_to_host(chsp);
+       DHD_INFO(("%s:return value of chanspec:%x\n", __FUNCTION__, chanspec));
+
+       channel = chanspec & WL_CHANSPEC_CHAN_MASK;
+       band = chanspec & WL_CHANSPEC_BAND_MASK;
+       bw = chanspec & WL_CHANSPEC_BW_MASK;
+
+       DHD_INFO(("%s:channel:%d band:%d bandwidth:%d\n", __FUNCTION__, channel, band, bw));
+
+       if (bw == WL_CHANSPEC_BW_80)
+               bw = WL_CH_BANDWIDTH_80MHZ;
+       else if (bw == WL_CHANSPEC_BW_40)
+               bw = WL_CH_BANDWIDTH_40MHZ;
+       else if (bw == WL_CHANSPEC_BW_20)
+               bw = WL_CH_BANDWIDTH_20MHZ;
+       else
+               bw = WL_CH_BANDWIDTH_20MHZ;
+
+       if (bw == WL_CH_BANDWIDTH_40MHZ) {
+               if (CHSPEC_SB_UPPER(chanspec)) {
+                       channel += CH_10MHZ_APART;
+               } else {
+                       channel -= CH_10MHZ_APART;
+               }
+       }
+       else if (bw == WL_CH_BANDWIDTH_80MHZ) {
+               sb = chanspec & WL_CHANSPEC_CTL_SB_MASK;
+               if (sb == WL_CHANSPEC_CTL_SB_LL) {
+                       channel -= (CH_10MHZ_APART + CH_20MHZ_APART);
+               } else if (sb == WL_CHANSPEC_CTL_SB_LU) {
+                       channel -= CH_10MHZ_APART;
+               } else if (sb == WL_CHANSPEC_CTL_SB_UL) {
+                       channel += CH_10MHZ_APART;
+               } else {
+                       /* WL_CHANSPEC_CTL_SB_UU */
+                       channel += (CH_10MHZ_APART + CH_20MHZ_APART);
+               }
+       }
+       bytes_written = snprintf(command, total_len, "%s channel %d band %s bw %d", CMD_CHANSPEC,
+               channel, band == WL_CHANSPEC_BAND_5G ? "5G":"2G", bw);
+
+       DHD_INFO(("%s: command:%s EXIT\n", __FUNCTION__, command));
+       return bytes_written;
+
+}
+
+/* returns current datarate datarate returned from firmware are in 500kbps */
+int wl_android_get_datarate(struct net_device *dev, char *command, int total_len)
+{
+       int  error = 0;
+       int datarate = 0;
+       int bytes_written = 0;
+
+       error = wldev_get_datarate(dev, &datarate);
+       if (error)
+               return -1;
+
+       DHD_INFO(("%s:datarate:%d\n", __FUNCTION__, datarate));
+
+       bytes_written = snprintf(command, total_len, "%s %d", CMD_DATARATE, (datarate/2));
+       return bytes_written;
+}
+int wl_android_get_assoclist(struct net_device *dev, char *command, int total_len)
+{
+       int  error = 0;
+       int bytes_written = 0;
+       uint i;
+       char mac_buf[MAX_NUM_OF_ASSOCLIST *
+               sizeof(struct ether_addr) + sizeof(uint)] = {0};
+       struct maclist *assoc_maclist = (struct maclist *)mac_buf;
+
+       DHD_TRACE(("%s: ENTER\n", __FUNCTION__));
+
+       assoc_maclist->count = htod32(MAX_NUM_OF_ASSOCLIST);
+
+       error = wldev_ioctl(dev, WLC_GET_ASSOCLIST, assoc_maclist, sizeof(mac_buf), false);
+       if (error)
+               return -1;
+
+       assoc_maclist->count = dtoh32(assoc_maclist->count);
+       bytes_written = snprintf(command, total_len, "%s listcount: %d Stations:",
+               CMD_ASSOC_CLIENTS, assoc_maclist->count);
+
+       for (i = 0; i < assoc_maclist->count; i++) {
+               bytes_written += snprintf(command + bytes_written, total_len, " " MACDBG,
+                       MAC2STRDBG(assoc_maclist->ea[i].octet));
+       }
+       return bytes_written;
+
+}
+extern chanspec_t
+wl_chspec_host_to_driver(chanspec_t chanspec);
+static int wl_android_set_csa(struct net_device *dev, char *command, int total_len)
+{
+       int error = 0;
+       char smbuf[WLC_IOCTL_SMLEN];
+       wl_chan_switch_t csa_arg;
+       u32 chnsp = 0;
+       int err = 0;
+
+       DHD_INFO(("%s: command:%s\n", __FUNCTION__, command));
+
+       command = (command + strlen(CMD_SET_CSA));
+       /* Order is mode, count channel */
+       if (!*++command) {
+               DHD_ERROR(("%s:error missing arguments\n", __FUNCTION__));
+               return -1;
+       }
+       csa_arg.mode = bcm_atoi(command);
+
+       if (csa_arg.mode != 0 && csa_arg.mode != 1) {
+               DHD_ERROR(("Invalid mode\n"));
+               return -1;
+       }
+
+       if (!*++command) {
+               DHD_ERROR(("%s:error missing count\n", __FUNCTION__));
+               return -1;
+       }
+       command++;
+       csa_arg.count = bcm_atoi(command);
+
+       csa_arg.reg = 0;
+       csa_arg.chspec = 0;
+       command += 2;
+       if (!*command) {
+               DHD_ERROR(("%s:error missing channel\n", __FUNCTION__));
+               return -1;
+       }
+
+       chnsp = wf_chspec_aton(command);
+       if (chnsp == 0) {
+               DHD_ERROR(("%s:chsp is not correct\n", __FUNCTION__));
+               return -1;
+       }
+       chnsp = wl_chspec_host_to_driver(chnsp);
+       csa_arg.chspec = chnsp;
+
+       if (chnsp & WL_CHANSPEC_BAND_5G) {
+               u32 chanspec = chnsp;
+               err = wldev_iovar_getint(dev, "per_chan_info", &chanspec);
+               if (!err) {
+                       if ((chanspec & WL_CHAN_RADAR) || (chanspec & WL_CHAN_PASSIVE)) {
+                               DHD_ERROR(("Channel is radar sensitive\n"));
+                               return -1;
+                       }
+                       if (chanspec == 0) {
+                               DHD_ERROR(("Invalid hw channel\n"));
+                               return -1;
+                       }
+               } else  {
+                       DHD_ERROR(("does not support per_chan_info\n"));
+                       return -1;
+               }
+               DHD_INFO(("non radar sensitivity\n"));
+       }
+       error = wldev_iovar_setbuf(dev, "csa", &csa_arg, sizeof(csa_arg),
+               smbuf, sizeof(smbuf), NULL);
+       if (error) {
+               DHD_ERROR(("%s:set csa failed:%d\n", __FUNCTION__, error));
+               return -1;
+       }
+       return 0;
+}
+static int wl_android_get_band(struct net_device *dev, char *command, int total_len)
+{
+       uint band;
+       int bytes_written;
+       int error;
+
+       error = wldev_get_band(dev, &band);
+       if (error)
+               return -1;
+       bytes_written = snprintf(command, total_len, "Band %d", band);
+       return bytes_written;
+}
+
+static int wl_android_add_vendor_ie(struct net_device *dev, char *command, int total_len)
+{
+       char ie_buf[VNDR_IE_MAX_LEN];
+       char *ioctl_buf = NULL;
+       char hex[] = "XX";
+       char *pcmd = NULL;
+       int ielen = 0, datalen = 0, idx = 0, tot_len = 0;
+       vndr_ie_setbuf_t *vndr_ie = NULL;
+       s32 iecount;
+       uint32 pktflag;
+       u16 kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+       s32 err = BCME_OK;
+
+       pcmd = command + strlen(CMD_ADDIE) + 1;
+
+       pktflag = simple_strtoul(pcmd, &pcmd, 16);
+
+       pcmd = pcmd + 1;
+
+       for (idx = 0; idx < DOT11_OUI_LEN; idx++) {
+               hex[0] = *pcmd++;
+               hex[1] = *pcmd++;
+               ie_buf[idx] =  (uint8)simple_strtoul(hex, NULL, 16);
+       }
+       pcmd++;
+       while ((*pcmd != '\0') && (idx < VNDR_IE_MAX_LEN)) {
+               hex[0] = *pcmd++;
+               hex[1] = *pcmd++;
+               ie_buf[idx++] =  (uint8)simple_strtoul(hex, NULL, 16);
+               datalen++;
+       }
+
+       tot_len = sizeof(vndr_ie_setbuf_t) + (datalen - 1);
+       vndr_ie = (vndr_ie_setbuf_t *) kzalloc(tot_len, kflags);
+       if (!vndr_ie) {
+               WL_ERR(("IE memory alloc failed\n"));
+               return -ENOMEM;
+       }
+
+       /* Copy the vndr_ie SET command ("add"/"del") to the buffer */
+       strncpy(vndr_ie->cmd, "add", VNDR_IE_CMD_LEN - 1);
+       vndr_ie->cmd[VNDR_IE_CMD_LEN - 1] = '\0';
+
+       /* Set the IE count - the buffer contains only 1 IE */
+       iecount = htod32(1);
+       memcpy((void *)&vndr_ie->vndr_ie_buffer.iecount, &iecount, sizeof(s32));
+
+       /* Set packet flag to indicate the appropriate frame will contain this IE */
+       pktflag = htod32(1<<pktflag);
+       memcpy((void *)&vndr_ie->vndr_ie_buffer.vndr_ie_list[0].pktflag, &pktflag,
+               sizeof(u32));
+
+       /* Set the IE ID */
+       vndr_ie->vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.id = (uchar) DOT11_MNG_PROPR_ID;
+
+       /* Set the OUI */
+       memcpy(&vndr_ie->vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.oui, &ie_buf,
+               DOT11_OUI_LEN);
+       /* Set the Data */
+       memcpy(&vndr_ie->vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.data,
+               &ie_buf[DOT11_OUI_LEN], datalen);
+
+       ielen = DOT11_OUI_LEN + datalen;
+       vndr_ie->vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.len = (uchar) ielen;
+
+       ioctl_buf = kmalloc(WLC_IOCTL_MEDLEN, GFP_KERNEL);
+       if (!ioctl_buf) {
+               WL_ERR(("ioctl memory alloc failed\n"));
+               if (vndr_ie) {
+                       kfree(vndr_ie);
+               }
+               return -ENOMEM;
+       }
+       memset(ioctl_buf, 0, WLC_IOCTL_MEDLEN); /* init the buffer */
+       err = wldev_iovar_setbuf(dev, "ie", vndr_ie, tot_len, ioctl_buf, WLC_IOCTL_MEDLEN, NULL);
+
+       if (err != BCME_OK) {
+               err = -EINVAL;
+               if (vndr_ie) {
+                       kfree(vndr_ie);
+               }
+       } else {
+               /* do NOT free 'vndr_ie' for the next process */
+               wl_cfg80211_ibss_vsie_set_buffer(dev, vndr_ie, tot_len);
+       }
+
+       if (ioctl_buf) {
+               kfree(ioctl_buf);
+       }
+
+       return err;
+}
+
+static int wl_android_del_vendor_ie(struct net_device *dev, char *command, int total_len)
+{
+       char ie_buf[VNDR_IE_MAX_LEN];
+       char *ioctl_buf = NULL;
+       char hex[] = "XX";
+       char *pcmd = NULL;
+       int ielen = 0, datalen = 0, idx = 0, tot_len = 0;
+       vndr_ie_setbuf_t *vndr_ie = NULL;
+       s32 iecount;
+       uint32 pktflag;
+       u16 kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+       s32 err = BCME_OK;
+
+       pcmd = command + strlen(CMD_ADDIE) + 1;
+
+       pktflag = simple_strtoul(pcmd, &pcmd, 16);
+
+       pcmd = pcmd + 1;
+       for (idx = 0; idx < DOT11_OUI_LEN; idx++) {
+               hex[0] = *pcmd++;
+               hex[1] = *pcmd++;
+               ie_buf[idx] =  (uint8)simple_strtoul(hex, NULL, 16);
+       }
+       pcmd++;
+       while ((*pcmd != '\0') && (idx < VNDR_IE_MAX_LEN)) {
+               hex[0] = *pcmd++;
+               hex[1] = *pcmd++;
+               ie_buf[idx++] =  (uint8)simple_strtoul(hex, NULL, 16);
+               datalen++;
+       }
+
+       tot_len = sizeof(vndr_ie_setbuf_t) + (datalen - 1);
+       vndr_ie = (vndr_ie_setbuf_t *) kzalloc(tot_len, kflags);
+       if (!vndr_ie) {
+               WL_ERR(("IE memory alloc failed\n"));
+               return -ENOMEM;
+       }
+       /* Copy the vndr_ie SET command ("add"/"del") to the buffer */
+       strncpy(vndr_ie->cmd, "del", VNDR_IE_CMD_LEN - 1);
+       vndr_ie->cmd[VNDR_IE_CMD_LEN - 1] = '\0';
+
+       /* Set the IE count - the buffer contains only 1 IE */
+       iecount = htod32(1);
+       memcpy((void *)&vndr_ie->vndr_ie_buffer.iecount, &iecount, sizeof(s32));
+
+       /* Set packet flag to indicate the appropriate frame will contain this IE */
+       pktflag = htod32(1<<pktflag);
+       memcpy((void *)&vndr_ie->vndr_ie_buffer.vndr_ie_list[0].pktflag, &pktflag,
+                       sizeof(u32));
+
+       /* Set the IE ID */
+       vndr_ie->vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.id = (uchar) DOT11_MNG_PROPR_ID;
+
+       /* Set the OUI */
+       memcpy(&vndr_ie->vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.oui, &ie_buf,
+                       DOT11_OUI_LEN);
+       /* Set the Data */
+       memcpy(&vndr_ie->vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.data,
+                       &ie_buf[DOT11_OUI_LEN], datalen);
+
+       ielen = DOT11_OUI_LEN + datalen;
+       vndr_ie->vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.len = (uchar) ielen;
+
+       ioctl_buf = kmalloc(WLC_IOCTL_MEDLEN, GFP_KERNEL);
+       if (!ioctl_buf) {
+               WL_ERR(("ioctl memory alloc failed\n"));
+               if (vndr_ie) {
+                       kfree(vndr_ie);
+               }
+               return -ENOMEM;
+       }
+       memset(ioctl_buf, 0, WLC_IOCTL_MEDLEN); /* init the buffer */
+       err = wldev_iovar_setbuf(dev, "ie", vndr_ie, tot_len, ioctl_buf, WLC_IOCTL_MEDLEN, NULL);
+
+       if (err != BCME_OK) {
+               err = -EINVAL;
+               if (vndr_ie) {
+                       kfree(vndr_ie);
+               }
+       } else {
+               /* do NOT free 'vndr_ie' for the next process */
+               wl_cfg80211_ibss_vsie_set_buffer(dev, vndr_ie, tot_len);
+       }
+
+       if (ioctl_buf) {
+               kfree(ioctl_buf);
+       }
+       return err;
+}
+
+
+#ifdef CUSTOMER_HW4_PRIVATE_CMD
+
+#ifdef FCC_PWR_LIMIT_2G
+int
+wl_android_set_fcc_pwr_limit_2g(struct net_device *dev, char *command, int total_len)
+{
+       int error = 0;
+       int enable = 0;
+
+       sscanf(command+sizeof("SET_FCC_CHANNEL"), "%d", &enable);
+
+       if ((enable != CUSTOMER_HW4_ENABLE) && (enable != CUSTOMER_HW4_DISABLE)) {
+               DHD_ERROR(("%s: Invalid data\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       CUSTOMER_HW4_EN_CONVERT(enable);
+
+       DHD_ERROR(("%s: fccpwrlimit2g set (%d)\n", __FUNCTION__, enable));
+       error = wldev_iovar_setint(dev, "fccpwrlimit2g", enable);
+       if (error) {
+               DHD_ERROR(("%s: fccpwrlimit2g set returned (%d)\n", __FUNCTION__, error));
+               return BCME_ERROR;
+       }
+
+       return error;
+}
+
+int
+wl_android_get_fcc_pwr_limit_2g(struct net_device *dev, char *command, int total_len)
+{
+       int error = 0;
+       int enable = 0;
+       int bytes_written = 0;
+
+       error = wldev_iovar_getint(dev, "fccpwrlimit2g", &enable);
+       if (error) {
+               DHD_ERROR(("%s: fccpwrlimit2g get error (%d)\n", __FUNCTION__, error));
+               return BCME_ERROR;
+       }
+       DHD_ERROR(("%s: fccpwrlimit2g get (%d)\n", __FUNCTION__, enable));
+
+       bytes_written = snprintf(command, total_len, "%s %d", CMD_GET_FCC_PWR_LIMIT_2G, enable);
+
+       return bytes_written;
+}
+#endif /* FCC_PWR_LIMIT_2G */
+
+#ifdef IPV6_NDO_SUPPORT
+int
+wl_android_nd_ra_limit(struct net_device *dev, char *command, int total_len)
+{
+       int err = 0;
+       int bytes_written = 0;
+       char *pos, *token, *delim;
+       char smbuf[WLC_IOCTL_SMLEN];
+       char param[ND_PARAM_SIZE+1], value[ND_VALUE_SIZE+1];
+       uint16 type = 0xff, min = 0, per = 0, hold = 0;
+       nd_ra_ol_limits_t ra_ol_limit;
+
+       WL_TRACE(("command=%s, len=%d\n", command, total_len));
+       pos = command + strlen(CMD_NDRA_LIMIT) + 1;
+       memset(&ra_ol_limit, 0, sizeof(nd_ra_ol_limits_t));
+
+       if (!strncmp(pos, ND_RA_OL_SET, strlen(ND_RA_OL_SET))) {
+               WL_TRACE(("SET NDRA_LIMIT\n"));
+               pos += strlen(ND_RA_OL_SET) + 1;
+               while ((token = strsep(&pos, ND_PARAMS_DELIMETER)) != NULL) {
+                       memset(param, 0, sizeof(param));
+                       memset(value, 0, sizeof(value));
+
+                       delim = strchr(token, ND_PARAM_VALUE_DELLIMETER);
+                       if (delim != NULL)
+                               *delim = ' ';
+
+                       if (!strncmp(param, ND_RA_TYPE, strlen(ND_RA_TYPE))) {
+                               type = simple_strtol(value, NULL, 0);
+                       } else if (!strncmp(param, ND_RA_MIN_TIME, strlen(ND_RA_MIN_TIME))) {
+                               min = simple_strtol(value, NULL, 0);
+                       } else if (!strncmp(param, ND_RA_PER, strlen(ND_RA_PER))) {
+                               per = simple_strtol(value, NULL, 0);
+                               if (per > 100) {
+                                       WL_ERR(("Invalid PERCENT %d\n", per));
+                                       err = BCME_BADARG;
+                                       goto exit;
+                               }
+                       } else if (!strncmp(param, ND_RA_HOLD, strlen(ND_RA_HOLD))) {
+                               hold = simple_strtol(value, NULL, 0);
+                       }
+               }
+
+               ra_ol_limit.version = htod32(ND_RA_OL_LIMITS_VER);
+               ra_ol_limit.type = htod32(type);
+               if (type == ND_RA_OL_LIMITS_REL_TYPE) {
+                       if ((min == 0) || (per == 0)) {
+                               WL_ERR(("Invalid min_time %d, percent %d\n", min, per));
+                               err = BCME_BADARG;
+                               goto exit;
+                       }
+                       ra_ol_limit.length = htod32(ND_RA_OL_LIMITS_REL_TYPE_LEN);
+                       ra_ol_limit.limits.lifetime_relative.min_time = htod32(min);
+                       ra_ol_limit.limits.lifetime_relative.lifetime_percent = htod32(per);
+               } else if (type == ND_RA_OL_LIMITS_FIXED_TYPE) {
+                       if (hold == 0) {
+                               WL_ERR(("Invalid hold_time %d\n", hold));
+                               err = BCME_BADARG;
+                               goto exit;
+                       }
+                       ra_ol_limit.length = htod32(ND_RA_OL_LIMITS_FIXED_TYPE_LEN);
+                       ra_ol_limit.limits.fixed.hold_time = htod32(hold);
+               } else {
+                       WL_ERR(("unknown TYPE %d\n", type));
+                       err = BCME_BADARG;
+                       goto exit;
+               }
+
+               err = wldev_iovar_setbuf(dev, "nd_ra_limit_intv", &ra_ol_limit,
+                       sizeof(nd_ra_ol_limits_t), smbuf, sizeof(smbuf), NULL);
+               if (err) {
+                       WL_ERR(("Failed to set nd_ra_limit_intv, error = %d\n", err));
+                       goto exit;
+               }
+
+               WL_TRACE(("TYPE %d, MIN %d, PER %d, HOLD %d\n", type, min, per, hold));
+       } else if (!strncmp(pos, ND_RA_OL_GET, strlen(ND_RA_OL_GET))) {
+               WL_TRACE(("GET NDRA_LIMIT\n"));
+               err = wldev_iovar_getbuf(dev, "nd_ra_limit_intv", NULL, 0,
+                       smbuf, sizeof(smbuf), NULL);
+               if (err) {
+                       WL_ERR(("Failed to get nd_ra_limit_intv, error = %d\n", err));
+                       goto exit;
+               }
+
+               memcpy(&ra_ol_limit, (uint8 *)smbuf, sizeof(nd_ra_ol_limits_t));
+               type = ra_ol_limit.type;
+               if (ra_ol_limit.version != ND_RA_OL_LIMITS_VER) {
+                       WL_ERR(("Invalid Version %d\n", ra_ol_limit.version));
+                       err = BCME_VERSION;
+                       goto exit;
+               }
+
+               if (ra_ol_limit.type == ND_RA_OL_LIMITS_REL_TYPE) {
+                       min = ra_ol_limit.limits.lifetime_relative.min_time;
+                       per = ra_ol_limit.limits.lifetime_relative.lifetime_percent;
+                       WL_ERR(("TYPE %d, MIN %d, PER %d\n", type, min, per));
+                       bytes_written = snprintf(command, total_len,
+                               "%s GET TYPE %d, MIN %d, PER %d", CMD_NDRA_LIMIT, type, min, per);
+               } else if (ra_ol_limit.type == ND_RA_OL_LIMITS_FIXED_TYPE) {
+                       hold = ra_ol_limit.limits.fixed.hold_time;
+                       WL_ERR(("TYPE %d, HOLD %d\n", type, hold));
+                       bytes_written = snprintf(command, total_len,
+                               "%s GET TYPE %d, HOLD %d", CMD_NDRA_LIMIT, type, hold);
+               } else {
+                       WL_ERR(("unknown TYPE %d\n", type));
+                       err = BCME_ERROR;
+                       goto exit;
+               }
+
+               return bytes_written;
+       } else {
+               WL_ERR(("unknown command\n"));
+               err = BCME_ERROR;
+               goto exit;
+       }
+
+exit:
+       return err;
+}
+#endif /* IPV6_NDO_SUPPORT */
+#ifdef WLTDLS
+int wl_android_tdls_reset(struct net_device *dev)
+{
+       int ret = 0;
+       ret = dhd_tdls_enable(dev, false, false, NULL);
+       if (ret < 0) {
+               DHD_ERROR(("Disable tdls failed. %d\n", ret));
+               return ret;
+       }
+       ret = dhd_tdls_enable(dev, true, true, NULL);
+       if (ret < 0) {
+               DHD_ERROR(("enable tdls failed. %d\n", ret));
+               return ret;
+       }
+       return 0;
+}
+#endif /* WLTDLS */
+#endif /* CUSTOMER_HW4_PRIVATE_CMD */
+
+#define ROAM_PROF_A    "a -70 -75 70 10 -75 -128 0 10"
+#define ROAM_PROF_B    "b -60 -75 70 10 -75 -128 0 10"
+#define ROAM_PROF_LEN  64
+
+static int wl_android_wbtext(struct net_device *dev, char *command, int total_len)
+{
+       int error = BCME_OK, argc = 0;
+       int data, bytes_written;
+       int roam_trigger[2];
+
+       argc = sscanf(command+sizeof(CMD_WBTEXT_ENABLE), "%d", &data);
+       if (!argc) {
+               error = wldev_iovar_getint(dev, "wnm_bsstrans_resp", &data);
+               if (error) {
+                       DHD_ERROR(("%s: Failed to set wbtext error = %d\n",
+                               __FUNCTION__, error));
+                       return error;
+               }
+               bytes_written = snprintf(command, total_len, "WBTEXT %s\n",
+                               (data == WL_BSSTRANS_POLICY_PRODUCT)? "ENABLED" : "DISABLED");
+               return bytes_written;
+       } else {
+               if (data) {
+                       char *roam_prof;
+                       char commandp[ROAM_PROF_LEN];
+                       snprintf(commandp, ROAM_PROF_LEN, CMD_WBTEXT_PROFILE_CONFIG);
+
+                       /* When enable wnm_bsstrans_resp, roam_prof set default value. */
+                       roam_prof = ROAM_PROF_A;
+                       error = wl_cfg80211_wbtext_config(dev, roam_prof, commandp, ROAM_PROF_LEN);
+                       if (error != BCME_OK) {
+                               DHD_ERROR(("%s: Failed to set roam_prof %s error = %d\n",
+                                       __FUNCTION__, roam_prof, error));
+                               return error;
+                       }
+                       roam_prof = ROAM_PROF_B;
+                       error = wl_cfg80211_wbtext_config(dev, roam_prof, commandp, ROAM_PROF_LEN);
+                       if (error != BCME_OK) {
+                               DHD_ERROR(("%s: Failed to set roam_prof %s error = %d\n",
+                                       __FUNCTION__, roam_prof, error));
+                               return error;
+                       }
+
+                       data = WL_BSSTRANS_POLICY_PRODUCT;
+               }
+
+               if ((error = wldev_iovar_setint(dev, "wnm_bsstrans_resp", data)) != BCME_OK) {
+                       DHD_ERROR(("%s: Failed to set wbtext error = %d\n",
+                               __FUNCTION__, error));
+                       return error;
+               }
+
+               if (!data) {
+                       /* reset legacy roam trigger when wbtext is off */
+                       roam_trigger[0] = DEFAULT_ROAM_TRIGGER_VALUE;
+                       roam_trigger[1] = WLC_BAND_ALL;
+                       if ((error = wldev_ioctl(dev, WLC_SET_ROAM_TRIGGER, roam_trigger,
+                               sizeof(roam_trigger), 1)) != BCME_OK) {
+                               DHD_ERROR(("%s: Failed to reset roam trigger = %d\n",
+                                       __FUNCTION__, error));
+                               return error;
+                       }
+               }
+       }
+       return error;
+}
+
+#ifdef PNO_SUPPORT
+#define PNO_PARAM_SIZE 50
+#define VALUE_SIZE 50
+#define LIMIT_STR_FMT  ("%50s %50s")
+static int
+wls_parse_batching_cmd(struct net_device *dev, char *command, int total_len)
+{
+       int err = BCME_OK;
+       uint i, tokens;
+       char *pos, *pos2, *token, *token2, *delim;
+       char param[PNO_PARAM_SIZE], value[VALUE_SIZE];
+       struct dhd_pno_batch_params batch_params;
+       DHD_PNO(("%s: command=%s, len=%d\n", __FUNCTION__, command, total_len));
+       if (total_len < strlen(CMD_WLS_BATCHING)) {
+               DHD_ERROR(("%s argument=%d less min size\n", __FUNCTION__, total_len));
+               err = BCME_ERROR;
+               goto exit;
+       }
+       pos = command + strlen(CMD_WLS_BATCHING) + 1;
+       memset(&batch_params, 0, sizeof(struct dhd_pno_batch_params));
+
+       if (!strncmp(pos, PNO_BATCHING_SET, strlen(PNO_BATCHING_SET))) {
+               pos += strlen(PNO_BATCHING_SET) + 1;
+               while ((token = strsep(&pos, PNO_PARAMS_DELIMETER)) != NULL) {
+                       memset(param, 0, sizeof(param));
+                       memset(value, 0, sizeof(value));
+                       if (token == NULL || !*token)
+                               break;
+                       if (*token == '\0')
+                               continue;
+                       delim = strchr(token, PNO_PARAM_VALUE_DELLIMETER);
+                       if (delim != NULL)
+                               *delim = ' ';
+
+                       tokens = sscanf(token, LIMIT_STR_FMT, param, value);
+                       if (!strncmp(param, PNO_PARAM_SCANFREQ, strlen(PNO_PARAM_SCANFREQ))) {
+                               batch_params.scan_fr = simple_strtol(value, NULL, 0);
+                               DHD_PNO(("scan_freq : %d\n", batch_params.scan_fr));
+                       } else if (!strncmp(param, PNO_PARAM_BESTN, strlen(PNO_PARAM_BESTN))) {
+                               batch_params.bestn = simple_strtol(value, NULL, 0);
+                               DHD_PNO(("bestn : %d\n", batch_params.bestn));
+                       } else if (!strncmp(param, PNO_PARAM_MSCAN, strlen(PNO_PARAM_MSCAN))) {
+                               batch_params.mscan = simple_strtol(value, NULL, 0);
+                               DHD_PNO(("mscan : %d\n", batch_params.mscan));
+                       } else if (!strncmp(param, PNO_PARAM_CHANNEL, strlen(PNO_PARAM_CHANNEL))) {
+                               i = 0;
+                               pos2 = value;
+                               tokens = sscanf(value, "<%s>", value);
+                               if (tokens != 1) {
+                                       err = BCME_ERROR;
+                                       DHD_ERROR(("%s : invalid format for channel"
+                                       " <> params\n", __FUNCTION__));
+                                       goto exit;
+                               }
+                                       while ((token2 = strsep(&pos2,
+                                       PNO_PARAM_CHANNEL_DELIMETER)) != NULL) {
+                                       if (token2 == NULL || !*token2)
+                                               break;
+                                       if (*token2 == '\0')
+                                               continue;
+                                       if (*token2 == 'A' || *token2 == 'B') {
+                                               batch_params.band = (*token2 == 'A')?
+                                                       WLC_BAND_5G : WLC_BAND_2G;
+                                               DHD_PNO(("band : %s\n",
+                                                       (*token2 == 'A')? "A" : "B"));
+                                       } else {
+                                               batch_params.chan_list[i++] =
+                                               simple_strtol(token2, NULL, 0);
+                                               batch_params.nchan++;
+                                               DHD_PNO(("channel :%d\n",
+                                               batch_params.chan_list[i-1]));
+                                       }
+                                }
+                       } else if (!strncmp(param, PNO_PARAM_RTT, strlen(PNO_PARAM_RTT))) {
+                               batch_params.rtt = simple_strtol(value, NULL, 0);
+                               DHD_PNO(("rtt : %d\n", batch_params.rtt));
+                       } else {
+                               DHD_ERROR(("%s : unknown param: %s\n", __FUNCTION__, param));
+                               err = BCME_ERROR;
+                               goto exit;
+                       }
+               }
+               err = dhd_dev_pno_set_for_batch(dev, &batch_params);
+               if (err < 0) {
+                       DHD_ERROR(("failed to configure batch scan\n"));
+               } else {
+                       memset(command, 0, total_len);
+                       err = snprintf(command, total_len, "%d", err);
+               }
+       } else if (!strncmp(pos, PNO_BATCHING_GET, strlen(PNO_BATCHING_GET))) {
+               err = dhd_dev_pno_get_for_batch(dev, command, total_len);
+               if (err < 0) {
+                       DHD_ERROR(("failed to getting batching results\n"));
+               } else {
+                       err = strlen(command);
+               }
+       } else if (!strncmp(pos, PNO_BATCHING_STOP, strlen(PNO_BATCHING_STOP))) {
+               err = dhd_dev_pno_stop_for_batch(dev);
+               if (err < 0) {
+                       DHD_ERROR(("failed to stop batching scan\n"));
+               } else {
+                       memset(command, 0, total_len);
+                       err = snprintf(command, total_len, "OK");
+               }
+       } else {
+               DHD_ERROR(("%s : unknown command\n", __FUNCTION__));
+               err = BCME_ERROR;
+               goto exit;
+       }
+exit:
+       return err;
+}
+#ifndef WL_SCHED_SCAN
+static int wl_android_set_pno_setup(struct net_device *dev, char *command, int total_len)
+{
+       wlc_ssid_ext_t ssids_local[MAX_PFN_LIST_COUNT];
+       int res = -1;
+       int nssid = 0;
+       cmd_tlv_t *cmd_tlv_temp;
+       char *str_ptr;
+       int tlv_size_left;
+       int pno_time = 0;
+       int pno_repeat = 0;
+       int pno_freq_expo_max = 0;
+
+#ifdef PNO_SET_DEBUG
+       int i;
+       char pno_in_example[] = {
+               'P', 'N', 'O', 'S', 'E', 'T', 'U', 'P', ' ',
+               'S', '1', '2', '0',
+               'S',
+               0x05,
+               'd', 'l', 'i', 'n', 'k',
+               'S',
+               0x04,
+               'G', 'O', 'O', 'G',
+               'T',
+               '0', 'B',
+               'R',
+               '2',
+               'M',
+               '2',
+               0x00
+               };
+#endif /* PNO_SET_DEBUG */
+       DHD_PNO(("%s: command=%s, len=%d\n", __FUNCTION__, command, total_len));
+
+       if (total_len < (strlen(CMD_PNOSETUP_SET) + sizeof(cmd_tlv_t))) {
+               DHD_ERROR(("%s argument=%d less min size\n", __FUNCTION__, total_len));
+               goto exit_proc;
+       }
+#ifdef PNO_SET_DEBUG
+       memcpy(command, pno_in_example, sizeof(pno_in_example));
+       total_len = sizeof(pno_in_example);
+#endif
+       str_ptr = command + strlen(CMD_PNOSETUP_SET);
+       tlv_size_left = total_len - strlen(CMD_PNOSETUP_SET);
+
+       cmd_tlv_temp = (cmd_tlv_t *)str_ptr;
+       memset(ssids_local, 0, sizeof(ssids_local));
+
+       if ((cmd_tlv_temp->prefix == PNO_TLV_PREFIX) &&
+               (cmd_tlv_temp->version == PNO_TLV_VERSION) &&
+               (cmd_tlv_temp->subtype == PNO_TLV_SUBTYPE_LEGACY_PNO)) {
+
+               str_ptr += sizeof(cmd_tlv_t);
+               tlv_size_left -= sizeof(cmd_tlv_t);
+
+               if ((nssid = wl_iw_parse_ssid_list_tlv(&str_ptr, ssids_local,
+                       MAX_PFN_LIST_COUNT, &tlv_size_left)) <= 0) {
+                       DHD_ERROR(("SSID is not presented or corrupted ret=%d\n", nssid));
+                       goto exit_proc;
+               } else {
+                       if ((str_ptr[0] != PNO_TLV_TYPE_TIME) || (tlv_size_left <= 1)) {
+                               DHD_ERROR(("%s scan duration corrupted field size %d\n",
+                                       __FUNCTION__, tlv_size_left));
+                               goto exit_proc;
+                       }
+                       str_ptr++;
+                       pno_time = simple_strtoul(str_ptr, &str_ptr, 16);
+                       DHD_PNO(("%s: pno_time=%d\n", __FUNCTION__, pno_time));
+
+                       if (str_ptr[0] != 0) {
+                               if ((str_ptr[0] != PNO_TLV_FREQ_REPEAT)) {
+                                       DHD_ERROR(("%s pno repeat : corrupted field\n",
+                                               __FUNCTION__));
+                                       goto exit_proc;
+                               }
+                               str_ptr++;
+                               pno_repeat = simple_strtoul(str_ptr, &str_ptr, 16);
+                               DHD_PNO(("%s :got pno_repeat=%d\n", __FUNCTION__, pno_repeat));
+                               if (str_ptr[0] != PNO_TLV_FREQ_EXPO_MAX) {
+                                       DHD_ERROR(("%s FREQ_EXPO_MAX corrupted field size\n",
+                                               __FUNCTION__));
+                                       goto exit_proc;
+                               }
+                               str_ptr++;
+                               pno_freq_expo_max = simple_strtoul(str_ptr, &str_ptr, 16);
+                               DHD_PNO(("%s: pno_freq_expo_max=%d\n",
+                                       __FUNCTION__, pno_freq_expo_max));
+                       }
+               }
+       } else {
+               DHD_ERROR(("%s get wrong TLV command\n", __FUNCTION__));
+               goto exit_proc;
+       }
+
+       res = dhd_dev_pno_set_for_ssid(dev, ssids_local, nssid, pno_time, pno_repeat,
+               pno_freq_expo_max, NULL, 0);
+exit_proc:
+       return res;
+}
+#endif /* !WL_SCHED_SCAN */
+#endif /* PNO_SUPPORT  */
+
+static int wl_android_get_p2p_dev_addr(struct net_device *ndev, char *command, int total_len)
+{
+       int ret;
+       int bytes_written = 0;
+
+       ret = wl_cfg80211_get_p2p_dev_addr(ndev, (struct ether_addr*)command);
+       if (ret)
+               return 0;
+       bytes_written = sizeof(struct ether_addr);
+       return bytes_written;
+}
+
+
+int
+wl_android_set_ap_mac_list(struct net_device *dev, int macmode, struct maclist *maclist)
+{
+       int i, j, match;
+       int ret = 0;
+       char mac_buf[MAX_NUM_OF_ASSOCLIST *
+               sizeof(struct ether_addr) + sizeof(uint)] = {0};
+       struct maclist *assoc_maclist = (struct maclist *)mac_buf;
+
+       /* set filtering mode */
+       if ((ret = wldev_ioctl(dev, WLC_SET_MACMODE, &macmode, sizeof(macmode), true)) != 0) {
+               DHD_ERROR(("%s : WLC_SET_MACMODE error=%d\n", __FUNCTION__, ret));
+               return ret;
+       }
+       if (macmode != MACLIST_MODE_DISABLED) {
+               /* set the MAC filter list */
+               if ((ret = wldev_ioctl(dev, WLC_SET_MACLIST, maclist,
+                       sizeof(int) + sizeof(struct ether_addr) * maclist->count, true)) != 0) {
+                       DHD_ERROR(("%s : WLC_SET_MACLIST error=%d\n", __FUNCTION__, ret));
+                       return ret;
+               }
+               /* get the current list of associated STAs */
+               assoc_maclist->count = MAX_NUM_OF_ASSOCLIST;
+               if ((ret = wldev_ioctl(dev, WLC_GET_ASSOCLIST, assoc_maclist,
+                       sizeof(mac_buf), false)) != 0) {
+                       DHD_ERROR(("%s : WLC_GET_ASSOCLIST error=%d\n", __FUNCTION__, ret));
+                       return ret;
+               }
+               /* do we have any STA associated?  */
+               if (assoc_maclist->count) {
+                       /* iterate each associated STA */
+                       for (i = 0; i < assoc_maclist->count; i++) {
+                               match = 0;
+                               /* compare with each entry */
+                               for (j = 0; j < maclist->count; j++) {
+                                       DHD_INFO(("%s : associated="MACDBG " list="MACDBG "\n",
+                                       __FUNCTION__, MAC2STRDBG(assoc_maclist->ea[i].octet),
+                                       MAC2STRDBG(maclist->ea[j].octet)));
+                                       if (memcmp(assoc_maclist->ea[i].octet,
+                                               maclist->ea[j].octet, ETHER_ADDR_LEN) == 0) {
+                                               match = 1;
+                                               break;
+                                       }
+                               }
+                               /* do conditional deauth */
+                               /*   "if not in the allow list" or "if in the deny list" */
+                               if ((macmode == MACLIST_MODE_ALLOW && !match) ||
+                                       (macmode == MACLIST_MODE_DENY && match)) {
+                                       scb_val_t scbval;
+
+                                       scbval.val = htod32(1);
+                                       memcpy(&scbval.ea, &assoc_maclist->ea[i],
+                                               ETHER_ADDR_LEN);
+                                       if ((ret = wldev_ioctl(dev,
+                                               WLC_SCB_DEAUTHENTICATE_FOR_REASON,
+                                               &scbval, sizeof(scb_val_t), true)) != 0)
+                                               DHD_ERROR(("%s WLC_SCB_DEAUTHENTICATE error=%d\n",
+                                                       __FUNCTION__, ret));
+                               }
+                       }
+               }
+       }
+       return ret;
+}
+
+/*
+ * HAPD_MAC_FILTER mac_mode mac_cnt mac_addr1 mac_addr2
+ *
+ */
+static int
+wl_android_set_mac_address_filter(struct net_device *dev, const char* str)
+{
+       int i;
+       int ret = 0;
+       int macnum = 0;
+       int macmode = MACLIST_MODE_DISABLED;
+       struct maclist *list;
+       char eabuf[ETHER_ADDR_STR_LEN];
+       char *token;
+
+       /* string should look like below (macmode/macnum/maclist) */
+       /*   1 2 00:11:22:33:44:55 00:11:22:33:44:ff  */
+
+       /* get the MAC filter mode */
+       token = strsep((char**)&str, " ");
+       if (!token) {
+               return -1;
+       }
+       macmode = bcm_atoi(token);
+
+       if (macmode < MACLIST_MODE_DISABLED || macmode > MACLIST_MODE_ALLOW) {
+               DHD_ERROR(("%s : invalid macmode %d\n", __FUNCTION__, macmode));
+               return -1;
+       }
+
+       token = strsep((char**)&str, " ");
+       if (!token) {
+               return -1;
+       }
+       macnum = bcm_atoi(token);
+       if (macnum < 0 || macnum > MAX_NUM_MAC_FILT) {
+               DHD_ERROR(("%s : invalid number of MAC address entries %d\n",
+                       __FUNCTION__, macnum));
+               return -1;
+       }
+       /* allocate memory for the MAC list */
+       list = (struct maclist*)kmalloc(sizeof(int) +
+               sizeof(struct ether_addr) * macnum, GFP_KERNEL);
+       if (!list) {
+               DHD_ERROR(("%s : failed to allocate memory\n", __FUNCTION__));
+               return -1;
+       }
+       /* prepare the MAC list */
+       list->count = htod32(macnum);
+       bzero((char *)eabuf, ETHER_ADDR_STR_LEN);
+       for (i = 0; i < list->count; i++) {
+               strncpy(eabuf, strsep((char**)&str, " "), ETHER_ADDR_STR_LEN - 1);
+               if (!(ret = bcm_ether_atoe(eabuf, &list->ea[i]))) {
+                       DHD_ERROR(("%s : mac parsing err index=%d, addr=%s\n",
+                               __FUNCTION__, i, eabuf));
+                       list->count--;
+                       break;
+               }
+               DHD_INFO(("%s : %d/%d MACADDR=%s", __FUNCTION__, i, list->count, eabuf));
+       }
+       /* set the list */
+       if ((ret = wl_android_set_ap_mac_list(dev, macmode, list)) != 0)
+               DHD_ERROR(("%s : Setting MAC list failed error=%d\n", __FUNCTION__, ret));
+
+       kfree(list);
+
+       return 0;
+}
+
+/**
+ * Global function definitions (declared in wl_android.h)
+ */
+
+int wl_android_wifi_on(struct net_device *dev)
+{
+       int ret = 0;
+       int retry = POWERUP_MAX_RETRY;
+
+       DHD_ERROR(("%s in\n", __FUNCTION__));
+       if (!dev) {
+               DHD_ERROR(("%s: dev is null\n", __FUNCTION__));
+               return -EINVAL;
+       }
+
+       dhd_net_if_lock(dev);
+       if (!g_wifi_on) {
+               do {
+                       dhd_net_wifi_platform_set_power(dev, TRUE, WIFI_TURNON_DELAY);
+#ifdef BCMSDIO
+                       ret = dhd_net_bus_resume(dev, 0);
+#endif /* BCMSDIO */
+#ifdef BCMPCIE
+                       ret = dhd_net_bus_devreset(dev, FALSE);
+#endif /* BCMPCIE */
+                       if (ret == 0) {
+                               break;
+                       }
+                       DHD_ERROR(("\nfailed to power up wifi chip, retry again (%d left) **\n\n",
+                               retry));
+#ifdef BCMPCIE
+                       dhd_net_bus_devreset(dev, TRUE);
+#endif /* BCMPCIE */
+                       dhd_net_wifi_platform_set_power(dev, FALSE, WIFI_TURNOFF_DELAY);
+               } while (retry-- > 0);
+               if (ret != 0) {
+                       DHD_ERROR(("\nfailed to power up wifi chip, max retry reached **\n\n"));
+                       goto exit;
+               }
+#ifdef BCMSDIO
+               ret = dhd_net_bus_devreset(dev, FALSE);
+               dhd_net_bus_resume(dev, 1);
+#endif /* BCMSDIO */
+
+#ifndef BCMPCIE
+               if (!ret) {
+                       if (dhd_dev_init_ioctl(dev) < 0) {
+                               ret = -EFAULT;
+                       }
+               }
+#endif /* !BCMPCIE */
+               g_wifi_on = TRUE;
+       }
+
+exit:
+       dhd_net_if_unlock(dev);
+
+       return ret;
+}
+
+int wl_android_wifi_off(struct net_device *dev, bool on_failure)
+{
+       int ret = 0;
+
+       DHD_ERROR(("%s in\n", __FUNCTION__));
+       if (!dev) {
+               DHD_TRACE(("%s: dev is null\n", __FUNCTION__));
+               return -EINVAL;
+       }
+
+       dhd_net_if_lock(dev);
+       if (g_wifi_on || on_failure) {
+#if defined(BCMSDIO) || defined(BCMPCIE)
+               ret = dhd_net_bus_devreset(dev, TRUE);
+#ifdef BCMSDIO
+               dhd_net_bus_suspend(dev);
+#endif /* BCMSDIO */
+#endif /* BCMSDIO || BCMPCIE */
+               dhd_net_wifi_platform_set_power(dev, FALSE, WIFI_TURNOFF_DELAY);
+               g_wifi_on = FALSE;
+       }
+       dhd_net_if_unlock(dev);
+
+       return ret;
+}
+
+static int wl_android_set_fwpath(struct net_device *net, char *command, int total_len)
+{
+       if ((strlen(command) - strlen(CMD_SETFWPATH)) > MOD_PARAM_PATHLEN)
+               return -1;
+       return dhd_net_set_fw_path(net, command + strlen(CMD_SETFWPATH) + 1);
+}
+
+#ifdef CONNECTION_STATISTICS
+static int
+wl_chanim_stats(struct net_device *dev, u8 *chan_idle)
+{
+       int err;
+       wl_chanim_stats_t *list;
+       /* Parameter _and_ returned buffer of chanim_stats. */
+       wl_chanim_stats_t param;
+       u8 result[WLC_IOCTL_SMLEN];
+       chanim_stats_t *stats;
+
+       memset(&param, 0, sizeof(param));
+       memset(result, 0, sizeof(result));
+
+       param.buflen = htod32(sizeof(wl_chanim_stats_t));
+       param.count = htod32(WL_CHANIM_COUNT_ONE);
+
+       if ((err = wldev_iovar_getbuf(dev, "chanim_stats", (char*)&param, sizeof(wl_chanim_stats_t),
+               (char*)result, sizeof(result), 0)) < 0) {
+               WL_ERR(("Failed to get chanim results %d \n", err));
+               return err;
+       }
+
+       list = (wl_chanim_stats_t*)result;
+
+       list->buflen = dtoh32(list->buflen);
+       list->version = dtoh32(list->version);
+       list->count = dtoh32(list->count);
+
+       if (list->buflen == 0) {
+               list->version = 0;
+               list->count = 0;
+       } else if (list->version != WL_CHANIM_STATS_VERSION) {
+               WL_ERR(("Sorry, firmware has wl_chanim_stats version %d "
+                       "but driver supports only version %d.\n",
+                               list->version, WL_CHANIM_STATS_VERSION));
+               list->buflen = 0;
+               list->count = 0;
+       }
+
+       stats = list->stats;
+       stats->glitchcnt = dtoh32(stats->glitchcnt);
+       stats->badplcp = dtoh32(stats->badplcp);
+       stats->chanspec = dtoh16(stats->chanspec);
+       stats->timestamp = dtoh32(stats->timestamp);
+       stats->chan_idle = dtoh32(stats->chan_idle);
+
+       WL_INFORM(("chanspec: 0x%4x glitch: %d badplcp: %d idle: %d timestamp: %d\n",
+               stats->chanspec, stats->glitchcnt, stats->badplcp, stats->chan_idle,
+               stats->timestamp));
+
+       *chan_idle = stats->chan_idle;
+
+       return (err);
+}
+
+static int
+wl_android_get_connection_stats(struct net_device *dev, char *command, int total_len)
+{
+       wl_cnt_t* cnt = NULL;
+#ifndef DISABLE_IF_COUNTERS
+       wl_if_stats_t* if_stats = NULL;
+#endif /* DISABLE_IF_COUNTERS */
+
+       int link_speed = 0;
+       struct connection_stats *output;
+       unsigned int bufsize = 0;
+       int bytes_written = -1;
+       int ret = 0;
+
+       WL_INFORM(("%s: enter Get Connection Stats\n", __FUNCTION__));
+
+       if (total_len <= 0) {
+               WL_ERR(("%s: invalid buffer size %d\n", __FUNCTION__, total_len));
+               goto error;
+       }
+
+       bufsize = total_len;
+       if (bufsize < sizeof(struct connection_stats)) {
+               WL_ERR(("%s: not enough buffer size, provided=%u, requires=%zu\n",
+                       __FUNCTION__, bufsize,
+                       sizeof(struct connection_stats)));
+               goto error;
+       }
+
+       output = (struct connection_stats *)command;
+
+#ifndef DISABLE_IF_COUNTERS
+       if ((if_stats = kmalloc(sizeof(*if_stats), GFP_KERNEL)) == NULL) {
+               WL_ERR(("%s(%d): kmalloc failed\n", __FUNCTION__, __LINE__));
+               goto error;
+       }
+       memset(if_stats, 0, sizeof(*if_stats));
+
+       ret = wldev_iovar_getbuf(dev, "if_counters", NULL, 0,
+               (char *)if_stats, sizeof(*if_stats), NULL);
+       if (ret) {
+               WL_ERR(("%s: if_counters not supported ret=%d\n",
+                       __FUNCTION__, ret));
+
+               /* In case if_stats IOVAR is not supported, get information from counters. */
+#endif /* DISABLE_IF_COUNTERS */
+               if ((cnt = kmalloc(sizeof(*cnt), GFP_KERNEL)) == NULL) {
+                       WL_ERR(("%s(%d): kmalloc failed\n", __FUNCTION__, __LINE__));
+                       goto error;
+               }
+               memset(cnt, 0, sizeof(*cnt));
+
+               ret = wldev_iovar_getbuf(dev, "counters", NULL, 0,
+                       (char *)cnt, sizeof(wl_cnt_t), NULL);
+               if (ret) {
+                       WL_ERR(("%s: wldev_iovar_getbuf() failed, ret=%d\n",
+                               __FUNCTION__, ret));
+                       goto error;
+               }
+
+               if (dtoh16(cnt->version) > WL_CNT_T_VERSION) {
+                       WL_ERR(("%s: incorrect version of wl_cnt_t, expected=%u got=%u\n",
+                               __FUNCTION__,  WL_CNT_T_VERSION, cnt->version));
+                       goto error;
+               }
+
+               output->txframe   = dtoh32(cnt->txframe);
+               output->txbyte    = dtoh32(cnt->txbyte);
+               output->txerror   = dtoh32(cnt->txerror);
+               output->rxframe   = dtoh32(cnt->rxframe);
+               output->rxbyte    = dtoh32(cnt->rxbyte);
+               output->txfail    = dtoh32(cnt->txfail);
+               output->txretry   = dtoh32(cnt->txretry);
+               output->txretrie  = dtoh32(cnt->txretrie);
+               output->txrts     = dtoh32(cnt->txrts);
+               output->txnocts   = dtoh32(cnt->txnocts);
+               output->txexptime = dtoh32(cnt->txexptime);
+#ifndef DISABLE_IF_COUNTERS
+       } else {
+               /* Populate from if_stats. */
+               if (dtoh16(if_stats->version) > WL_IF_STATS_T_VERSION) {
+                       WL_ERR(("%s: incorrect version of wl_if_stats_t, expected=%u got=%u\n",
+                               __FUNCTION__,  WL_IF_STATS_T_VERSION, if_stats->version));
+                       goto error;
+               }
+
+               output->txframe   = (uint32)dtoh64(if_stats->txframe);
+               output->txbyte    = (uint32)dtoh64(if_stats->txbyte);
+               output->txerror   = (uint32)dtoh64(if_stats->txerror);
+               output->rxframe   = (uint32)dtoh64(if_stats->rxframe);
+               output->rxbyte    = (uint32)dtoh64(if_stats->rxbyte);
+               output->txfail    = (uint32)dtoh64(if_stats->txfail);
+               output->txretry   = (uint32)dtoh64(if_stats->txretry);
+               output->txretrie  = (uint32)dtoh64(if_stats->txretrie);
+               /* Unavailable */
+               output->txrts     = 0;
+               output->txnocts   = 0;
+               output->txexptime = 0;
+       }
+#endif /* DISABLE_IF_COUNTERS */
+
+       /* link_speed is in kbps */
+       ret = wldev_get_link_speed(dev, &link_speed);
+       if (ret || link_speed < 0) {
+               WL_ERR(("%s: wldev_get_link_speed() failed, ret=%d, speed=%d\n",
+                       __FUNCTION__, ret, link_speed));
+               goto error;
+       }
+
+       output->txrate    = link_speed;
+
+       /* Channel idle ratio. */
+       if (wl_chanim_stats(dev, &(output->chan_idle)) < 0) {
+               output->chan_idle = 0;
+       };
+
+       bytes_written = sizeof(struct connection_stats);
+
+error:
+#ifndef DISABLE_IF_COUNTERS
+       if (if_stats) {
+               kfree(if_stats);
+       }
+#endif /* DISABLE_IF_COUNTERS */
+       if (cnt) {
+               kfree(cnt);
+       }
+
+       return bytes_written;
+}
+#endif /* CONNECTION_STATISTICS */
+
+
+#ifdef CUSTOMER_HW4_PRIVATE_CMD
+#endif /* CUSTOMER_HW4_PRIVATE_CMD */
+
+/* SoftAP feature */
+#define APCS_BAND_2G_LEGACY1   20
+#define APCS_BAND_2G_LEGACY2   0
+#define APCS_BAND_AUTO         "band=auto"
+#define APCS_BAND_2G           "band=2g"
+#define APCS_BAND_5G           "band=5g"
+#define APCS_MAX_2G_CHANNELS   11
+#define APCS_MAX_RETRY         10
+#define APCS_DEFAULT_2G_CH     1
+#define APCS_DEFAULT_5G_CH     149
+#if defined(WL_SUPPORT_AUTO_CHANNEL)
+static int
+wl_android_set_auto_channel(struct net_device *dev, const char* cmd_str,
+       char* command, int total_len)
+{
+       int channel = 0;
+       int chosen = 0;
+       int retry = 0;
+       int ret = 0;
+       int spect = 0;
+       u8 *reqbuf = NULL;
+       uint32 band = WLC_BAND_2G;
+       uint32 buf_size;
+
+       if (cmd_str) {
+               WL_INFORM(("Command: %s len:%d \n", cmd_str, (int)strlen(cmd_str)));
+               if (strncmp(cmd_str, APCS_BAND_AUTO, strlen(APCS_BAND_AUTO)) == 0) {
+                       band = WLC_BAND_AUTO;
+               } else if (strncmp(cmd_str, APCS_BAND_5G, strlen(APCS_BAND_5G)) == 0) {
+                       band = WLC_BAND_5G;
+               } else if (strncmp(cmd_str, APCS_BAND_2G, strlen(APCS_BAND_2G)) == 0) {
+                       band = WLC_BAND_2G;
+               } else {
+                       /*
+                        * For backward compatibility: Some platforms used to issue argument 20 or 0
+                        * to enforce the 2G channel selection
+                        */
+                       channel = bcm_atoi(cmd_str);
+                       if ((channel == APCS_BAND_2G_LEGACY1) ||
+                               (channel == APCS_BAND_2G_LEGACY2)) {
+                               band = WLC_BAND_2G;
+                       } else {
+                               WL_ERR(("Invalid argument\n"));
+                               return -EINVAL;
+                       }
+               }
+       } else {
+               /* If no argument is provided, default to 2G */
+               WL_ERR(("No argument given default to 2.4G scan\n"));
+               band = WLC_BAND_2G;
+       }
+       WL_INFORM(("HAPD_AUTO_CHANNEL = %d, band=%d \n", channel, band));
+
+       if ((ret = wldev_ioctl(dev, WLC_GET_SPECT_MANAGMENT, &spect, sizeof(spect), false)) < 0) {
+               WL_ERR(("ACS: error getting the spect\n"));
+               goto done;
+       }
+
+       if (spect > 0) {
+               /* If STA is connected, return is STA channel, else ACS can be issued,
+                * set spect to 0 and proceed with ACS
+                */
+               channel = wl_cfg80211_get_sta_channel(dev);
+               if (channel) {
+                       channel = (channel <= CH_MAX_2G_CHANNEL) ? channel : APCS_DEFAULT_2G_CH;
+                       goto done2;
+               }
+
+               if ((ret = wl_cfg80211_set_spect(dev, 0) < 0)) {
+                       WL_ERR(("ACS: error while setting spect\n"));
+                       goto done;
+               }
+       }
+
+       reqbuf = kzalloc(CHANSPEC_BUF_SIZE, GFP_KERNEL);
+       if (reqbuf == NULL) {
+               WL_ERR(("failed to allocate chanspec buffer\n"));
+               return -ENOMEM;
+       }
+
+       if (band == WLC_BAND_AUTO) {
+               WL_INFORM(("ACS full channel scan \n"));
+               reqbuf[0] = htod32(0);
+       } else if (band == WLC_BAND_5G) {
+               WL_INFORM(("ACS 5G band scan \n"));
+               if ((ret = wl_cfg80211_get_chanspecs_5g(dev, reqbuf, CHANSPEC_BUF_SIZE)) < 0) {
+                       WL_ERR(("ACS 5g chanspec retreival failed! \n"));
+                       goto done;
+               }
+       } else if (band == WLC_BAND_2G) {
+               /*
+                * If channel argument is not provided/ argument 20 is provided,
+                * Restrict channel to 2GHz, 20MHz BW, No SB
+                */
+               WL_INFORM(("ACS 2G band scan \n"));
+               if ((ret = wl_cfg80211_get_chanspecs_2g(dev, reqbuf, CHANSPEC_BUF_SIZE)) < 0) {
+                       WL_ERR(("ACS 2g chanspec retreival failed! \n"));
+                       goto done;
+               }
+       } else {
+               WL_ERR(("ACS: No band chosen\n"));
+               goto done2;
+       }
+
+       buf_size = (band == WLC_BAND_AUTO) ? sizeof(int) : CHANSPEC_BUF_SIZE;
+       ret = wldev_ioctl(dev, WLC_START_CHANNEL_SEL, (void *)reqbuf,
+               buf_size, true);
+       if (ret < 0) {
+               WL_ERR(("can't start auto channel scan, err = %d\n", ret));
+               channel = 0;
+               goto done;
+       }
+
+       /* Wait for auto channel selection, max 3000 ms */
+       if ((band == WLC_BAND_2G) || (band == WLC_BAND_5G)) {
+               OSL_SLEEP(500);
+       } else {
+               /*
+                * Full channel scan at the minimum takes 1.2secs
+                * even with parallel scan. max wait time: 3500ms
+                */
+               OSL_SLEEP(1000);
+       }
+
+       retry = APCS_MAX_RETRY;
+       while (retry--) {
+               ret = wldev_ioctl(dev, WLC_GET_CHANNEL_SEL, &chosen,
+                       sizeof(chosen), false);
+               if (ret < 0) {
+                       chosen = 0;
+               } else {
+                       chosen = dtoh32(chosen);
+               }
+
+               if (chosen) {
+                       int chosen_band;
+                       int apcs_band;
+#ifdef D11AC_IOTYPES
+                       if (wl_cfg80211_get_ioctl_version() == 1) {
+                               channel = LCHSPEC_CHANNEL((chanspec_t)chosen);
+                       } else {
+                               channel = CHSPEC_CHANNEL((chanspec_t)chosen);
+                       }
+#else
+                       channel = CHSPEC_CHANNEL((chanspec_t)chosen);
+#endif /* D11AC_IOTYPES */
+                       apcs_band = (band == WLC_BAND_AUTO) ? WLC_BAND_2G : band;
+                       chosen_band = (channel <= CH_MAX_2G_CHANNEL) ? WLC_BAND_2G : WLC_BAND_5G;
+                       if (apcs_band == chosen_band) {
+                               WL_ERR(("selected channel = %d\n", channel));
+                               break;
+                       }
+               }
+               WL_INFORM(("%d tried, ret = %d, chosen = 0x%x\n",
+                       (APCS_MAX_RETRY - retry), ret, chosen));
+               OSL_SLEEP(250);
+       }
+
+done:
+       if ((retry == 0) || (ret < 0)) {
+               /* On failure, fallback to a default channel */
+               if ((band == WLC_BAND_5G)) {
+                       channel = APCS_DEFAULT_5G_CH;
+               } else {
+                       channel = APCS_DEFAULT_2G_CH;
+               }
+               WL_ERR(("ACS failed. Fall back to default channel (%d) \n", channel));
+       }
+done2:
+       if (spect > 0) {
+               if ((ret = wl_cfg80211_set_spect(dev, spect) < 0)) {
+                       WL_ERR(("ACS: error while setting spect\n"));
+               }
+       }
+
+       if (reqbuf) {
+               kfree(reqbuf);
+       }
+
+       if (channel) {
+               snprintf(command, 4, "%d", channel);
+               WL_INFORM(("command result is %s \n", command));
+               return strlen(command);
+       } else {
+               return ret;
+       }
+}
+#endif /* WL_SUPPORT_AUTO_CHANNEL */
+
+#ifdef SUPPORT_HIDDEN_AP
+static int
+wl_android_set_max_num_sta(struct net_device *dev, const char* string_num)
+{
+       int max_assoc;
+
+       max_assoc = bcm_atoi(string_num);
+       DHD_INFO(("%s : HAPD_MAX_NUM_STA = %d\n", __FUNCTION__, max_assoc));
+       wldev_iovar_setint(dev, "maxassoc", max_assoc);
+       return 1;
+}
+
+static int
+wl_android_set_ssid(struct net_device *dev, const char* hapd_ssid)
+{
+       wlc_ssid_t ssid;
+       s32 ret;
+
+       ssid.SSID_len = strlen(hapd_ssid);
+       if (ssid.SSID_len > DOT11_MAX_SSID_LEN) {
+               ssid.SSID_len = DOT11_MAX_SSID_LEN;
+               DHD_ERROR(("%s : Too long SSID Length %zu\n", __FUNCTION__, strlen(hapd_ssid)));
+       }
+       bcm_strncpy_s(ssid.SSID, sizeof(ssid.SSID), hapd_ssid, ssid.SSID_len);
+       DHD_INFO(("%s: HAPD_SSID = %s\n", __FUNCTION__, ssid.SSID));
+       ret = wldev_ioctl(dev, WLC_SET_SSID, &ssid, sizeof(wlc_ssid_t), true);
+       if (ret < 0) {
+               DHD_ERROR(("%s : WLC_SET_SSID Error:%d\n", __FUNCTION__, ret));
+       }
+       return 1;
+
+}
+
+static int
+wl_android_set_hide_ssid(struct net_device *dev, char *command, int total_len)
+{
+       int hide_ssid;
+       int bytes_written = 0;
+       struct wireless_dev *wdev = dev->ieee80211_ptr;
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)wiphy_priv(wdev->wiphy);
+       struct net_info *_netinfo = wl_get_netinfo_by_netdev(cfg, dev);
+
+       if (*(command + strlen(CMD_SET_HAPD_HIDE_SSID)) == '\0') {
+               bytes_written = snprintf(command, total_len, "%s %d",
+                       CMD_SET_HAPD_HIDE_SSID, _netinfo->profile.hidden_ssid);
+               return bytes_written;
+       }
+       command = (command + strlen(CMD_SET_HAPD_HIDE_SSID));
+       command++;
+       hide_ssid = bcm_atoi(command);
+       DHD_INFO(("%s: HAPD_HIDE_SSID = %d\n", __FUNCTION__, hide_ssid));
+       _netinfo->profile.hidden_ssid = hide_ssid;
+       wldev_iovar_setint(dev, "closednet", _netinfo->profile.hidden_ssid);
+       return 0;
+}
+
+#endif /* SUPPORT_HIDDEN_AP */
+
+#ifdef CUSTOMER_HW4_PRIVATE_CMD
+
+#ifdef SUPPORT_SET_LPC
+static int
+wl_android_set_lpc(struct net_device *dev, const char* string_num)
+{
+       int lpc_enabled, ret;
+       s32 val = 1;
+
+       lpc_enabled = bcm_atoi(string_num);
+       DHD_INFO(("%s : HAPD_LPC_ENABLED = %d\n", __FUNCTION__, lpc_enabled));
+
+       ret = wldev_ioctl(dev, WLC_DOWN, &val, sizeof(s32), true);
+       if (ret < 0)
+               DHD_ERROR(("WLC_DOWN error %d\n", ret));
+
+       wldev_iovar_setint(dev, "lpc", lpc_enabled);
+
+       ret = wldev_ioctl(dev, WLC_UP, &val, sizeof(s32), true);
+       if (ret < 0)
+               DHD_ERROR(("WLC_UP error %d\n", ret));
+
+       return 1;
+}
+#endif /* SUPPORT_SET_LPC */
+
+static int
+wl_android_ch_res_rl(struct net_device *dev, bool change)
+{
+       int error = 0;
+       s32 srl = 7;
+       s32 lrl = 4;
+       printk("%s enter\n", __FUNCTION__);
+       if (change) {
+               srl = 4;
+               lrl = 2;
+       }
+       error = wldev_ioctl(dev, WLC_SET_SRL, &srl, sizeof(s32), true);
+       if (error) {
+               DHD_ERROR(("Failed to set SRL, error = %d\n", error));
+       }
+       error = wldev_ioctl(dev, WLC_SET_LRL, &lrl, sizeof(s32), true);
+       if (error) {
+               DHD_ERROR(("Failed to set LRL, error = %d\n", error));
+       }
+       return error;
+}
+
+
+static int
+wl_android_rmc_enable(struct net_device *net, int rmc_enable)
+{
+       int err;
+
+       err = wldev_iovar_setint(net, "rmc_ackreq", rmc_enable);
+       return err;
+}
+
+static int
+wl_android_rmc_set_leader(struct net_device *dev, const char* straddr)
+{
+       int error  = BCME_OK;
+       char smbuf[WLC_IOCTL_SMLEN];
+       wl_rmc_entry_t rmc_entry;
+       DHD_INFO(("%s: Set new RMC leader %s\n", __FUNCTION__, straddr));
+
+       memset(&rmc_entry, 0, sizeof(wl_rmc_entry_t));
+       if (!bcm_ether_atoe(straddr, &rmc_entry.addr)) {
+               if (strlen(straddr) == 1 && bcm_atoi(straddr) == 0) {
+                       DHD_INFO(("%s: Set auto leader selection mode\n", __FUNCTION__));
+                       memset(&rmc_entry, 0, sizeof(wl_rmc_entry_t));
+               } else {
+                       DHD_ERROR(("%s: No valid mac address provided\n",
+                               __FUNCTION__));
+                       return BCME_ERROR;
+               }
+       }
+
+       error = wldev_iovar_setbuf(dev, "rmc_ar", &rmc_entry, sizeof(wl_rmc_entry_t),
+               smbuf, sizeof(smbuf), NULL);
+
+       if (error != BCME_OK) {
+               DHD_ERROR(("%s: Unable to set RMC leader, error = %d\n",
+                       __FUNCTION__, error));
+       }
+
+       return error;
+}
+
+static int wl_android_set_rmc_event(struct net_device *dev, char *command, int total_len)
+{
+       int err = 0;
+       int pid = 0;
+
+       if (sscanf(command, CMD_SET_RMC_EVENT " %d", &pid) <= 0) {
+               WL_ERR(("Failed to get Parameter from : %s\n", command));
+               return -1;
+       }
+
+       /* set pid, and if the event was happened, let's send a notification through netlink */
+       wl_cfg80211_set_rmc_pid(dev, pid);
+
+       WL_DBG(("RMC pid=%d\n", pid));
+
+       return err;
+}
+
+int wl_android_get_singlecore_scan(struct net_device *dev, char *command, int total_len)
+{
+       int error = 0;
+       int bytes_written = 0;
+       int mode = 0;
+
+       error = wldev_iovar_getint(dev, "scan_ps", &mode);
+       if (error) {
+               DHD_ERROR(("%s: Failed to get single core scan Mode, error = %d\n",
+                       __FUNCTION__, error));
+               return -1;
+       }
+
+       bytes_written = snprintf(command, total_len, "%s %d", CMD_GET_SCSCAN, mode);
+
+       return bytes_written;
+}
+
+int wl_android_set_singlecore_scan(struct net_device *dev, char *command, int total_len)
+{
+       int error = 0;
+       int mode = 0;
+
+       if (sscanf(command, "%*s %d", &mode) != 1) {
+               DHD_ERROR(("%s: Failed to get Parameter\n", __FUNCTION__));
+               return -1;
+       }
+
+       error = wldev_iovar_setint(dev, "scan_ps", mode);
+       if (error) {
+               DHD_ERROR(("%s[1]: Failed to set Mode %d, error = %d\n",
+               __FUNCTION__, mode, error));
+               return -1;
+       }
+
+       return error;
+}
+#ifdef TEST_TX_POWER_CONTROL
+static int
+wl_android_set_tx_power(struct net_device *dev, const char* string_num)
+{
+       int err = 0;
+       s32 dbm;
+       enum nl80211_tx_power_setting type;
+
+       dbm = bcm_atoi(string_num);
+
+       if (dbm < -1) {
+               DHD_ERROR(("%s: dbm is negative...\n", __FUNCTION__));
+               return -EINVAL;
+       }
+
+       if (dbm == -1)
+               type = NL80211_TX_POWER_AUTOMATIC;
+       else
+               type = NL80211_TX_POWER_FIXED;
+
+       err = wl_set_tx_power(dev, type, dbm);
+       if (unlikely(err)) {
+               DHD_ERROR(("%s: error (%d)\n", __FUNCTION__, err));
+               return err;
+       }
+
+       return 1;
+}
+
+static int
+wl_android_get_tx_power(struct net_device *dev, char *command, int total_len)
+{
+       int err;
+       int bytes_written;
+       s32 dbm = 0;
+
+       err = wl_get_tx_power(dev, &dbm);
+       if (unlikely(err)) {
+               DHD_ERROR(("%s: error (%d)\n", __FUNCTION__, err));
+               return err;
+       }
+
+       bytes_written = snprintf(command, total_len, "%s %d",
+               CMD_TEST_GET_TX_POWER, dbm);
+
+       DHD_ERROR(("%s: GET_TX_POWER: dBm=%d\n", __FUNCTION__, dbm));
+
+       return bytes_written;
+}
+#endif /* TEST_TX_POWER_CONTROL */
+
+static int
+wl_android_set_sarlimit_txctrl(struct net_device *dev, const char* string_num)
+{
+       int err = 0;
+       int setval = 0;
+       s32 mode = bcm_atoi(string_num);
+
+       /* As Samsung specific and their requirement, '0' means activate sarlimit
+        * and '-1' means back to normal state (deactivate sarlimit)
+        */
+       if (mode == 0) {
+               DHD_INFO(("%s: SAR limit control activated\n", __FUNCTION__));
+               setval = 1;
+       } else if (mode == -1) {
+               DHD_INFO(("%s: SAR limit control deactivated\n", __FUNCTION__));
+               setval = 0;
+       } else {
+               return -EINVAL;
+       }
+
+       err = wldev_iovar_setint(dev, "sar_enable", setval);
+       if (unlikely(err)) {
+               DHD_ERROR(("%s: error (%d)\n", __FUNCTION__, err));
+               return err;
+       }
+       return 1;
+}
+#endif /* CUSTOMER_HW4_PRIVATE_CMD */
+
+int wl_android_set_roam_mode(struct net_device *dev, char *command, int total_len)
+{
+       int error = 0;
+       int mode = 0;
+
+       if (sscanf(command, "%*s %d", &mode) != 1) {
+               DHD_ERROR(("%s: Failed to get Parameter\n", __FUNCTION__));
+               return -1;
+       }
+
+       error = wldev_iovar_setint(dev, "roam_off", mode);
+       if (error) {
+               DHD_ERROR(("%s: Failed to set roaming Mode %d, error = %d\n",
+               __FUNCTION__, mode, error));
+               return -1;
+       }
+       else
+               DHD_ERROR(("%s: succeeded to set roaming Mode %d, error = %d\n",
+               __FUNCTION__, mode, error));
+       return 0;
+}
+
+int wl_android_set_ibss_beacon_ouidata(struct net_device *dev, char *command, int total_len)
+{
+       char ie_buf[VNDR_IE_MAX_LEN];
+       char *ioctl_buf = NULL;
+       char hex[] = "XX";
+       char *pcmd = NULL;
+       int ielen = 0, datalen = 0, idx = 0, tot_len = 0;
+       vndr_ie_setbuf_t *vndr_ie = NULL;
+       s32 iecount;
+       uint32 pktflag;
+       u16 kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+       s32 err = BCME_OK;
+
+       /* Check the VSIE (Vendor Specific IE) which was added.
+        *  If exist then send IOVAR to delete it
+        */
+       if (wl_cfg80211_ibss_vsie_delete(dev) != BCME_OK) {
+               return -EINVAL;
+       }
+
+       pcmd = command + strlen(CMD_SETIBSSBEACONOUIDATA) + 1;
+       for (idx = 0; idx < DOT11_OUI_LEN; idx++) {
+               hex[0] = *pcmd++;
+               hex[1] = *pcmd++;
+               ie_buf[idx] =  (uint8)simple_strtoul(hex, NULL, 16);
+       }
+       pcmd++;
+       while ((*pcmd != '\0') && (idx < VNDR_IE_MAX_LEN)) {
+               hex[0] = *pcmd++;
+               hex[1] = *pcmd++;
+               ie_buf[idx++] =  (uint8)simple_strtoul(hex, NULL, 16);
+               datalen++;
+       }
+       tot_len = sizeof(vndr_ie_setbuf_t) + (datalen - 1);
+       vndr_ie = (vndr_ie_setbuf_t *) kzalloc(tot_len, kflags);
+       if (!vndr_ie) {
+               WL_ERR(("IE memory alloc failed\n"));
+               return -ENOMEM;
+       }
+       /* Copy the vndr_ie SET command ("add"/"del") to the buffer */
+       strncpy(vndr_ie->cmd, "add", VNDR_IE_CMD_LEN - 1);
+       vndr_ie->cmd[VNDR_IE_CMD_LEN - 1] = '\0';
+
+       /* Set the IE count - the buffer contains only 1 IE */
+       iecount = htod32(1);
+       memcpy((void *)&vndr_ie->vndr_ie_buffer.iecount, &iecount, sizeof(s32));
+
+       /* Set packet flag to indicate that BEACON's will contain this IE */
+       pktflag = htod32(VNDR_IE_BEACON_FLAG | VNDR_IE_PRBRSP_FLAG);
+       memcpy((void *)&vndr_ie->vndr_ie_buffer.vndr_ie_list[0].pktflag, &pktflag,
+               sizeof(u32));
+       /* Set the IE ID */
+       vndr_ie->vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.id = (uchar) DOT11_MNG_PROPR_ID;
+
+       memcpy(&vndr_ie->vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.oui, &ie_buf,
+               DOT11_OUI_LEN);
+       memcpy(&vndr_ie->vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.data,
+               &ie_buf[DOT11_OUI_LEN], datalen);
+
+       ielen = DOT11_OUI_LEN + datalen;
+       vndr_ie->vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.len = (uchar) ielen;
+
+       ioctl_buf = kmalloc(WLC_IOCTL_MEDLEN, GFP_KERNEL);
+       if (!ioctl_buf) {
+               WL_ERR(("ioctl memory alloc failed\n"));
+               if (vndr_ie) {
+                       kfree(vndr_ie);
+               }
+               return -ENOMEM;
+       }
+       memset(ioctl_buf, 0, WLC_IOCTL_MEDLEN); /* init the buffer */
+       err = wldev_iovar_setbuf(dev, "ie", vndr_ie, tot_len, ioctl_buf, WLC_IOCTL_MEDLEN, NULL);
+
+
+       if (err != BCME_OK) {
+               err = -EINVAL;
+               if (vndr_ie) {
+                       kfree(vndr_ie);
+               }
+       }
+       else {
+               /* do NOT free 'vndr_ie' for the next process */
+               wl_cfg80211_ibss_vsie_set_buffer(dev, vndr_ie, tot_len);
+       }
+
+       if (ioctl_buf) {
+               kfree(ioctl_buf);
+       }
+
+       return err;
+}
+
+#if defined(BCMFW_ROAM_ENABLE)
+static int
+wl_android_set_roampref(struct net_device *dev, char *command, int total_len)
+{
+       int error = 0;
+       char smbuf[WLC_IOCTL_SMLEN];
+       uint8 buf[MAX_BUF_SIZE];
+       uint8 *pref = buf;
+       char *pcmd;
+       int num_ucipher_suites = 0;
+       int num_akm_suites = 0;
+       wpa_suite_t ucipher_suites[MAX_NUM_SUITES];
+       wpa_suite_t akm_suites[MAX_NUM_SUITES];
+       int num_tuples = 0;
+       int total_bytes = 0;
+       int total_len_left;
+       int i, j;
+       char hex[] = "XX";
+
+       pcmd = command + strlen(CMD_SET_ROAMPREF) + 1;
+       total_len_left = total_len - strlen(CMD_SET_ROAMPREF) + 1;
+
+       num_akm_suites = simple_strtoul(pcmd, NULL, 16);
+       if (num_akm_suites > MAX_NUM_SUITES) {
+               DHD_ERROR(("too many AKM suites = %d\n", num_akm_suites));
+               return -1;
+       }
+
+       /* Increment for number of AKM suites field + space */
+       pcmd += 3;
+       total_len_left -= 3;
+
+       /* check to make sure pcmd does not overrun */
+       if (total_len_left < (num_akm_suites * WIDTH_AKM_SUITE))
+               return -1;
+
+       memset(buf, 0, sizeof(buf));
+       memset(akm_suites, 0, sizeof(akm_suites));
+       memset(ucipher_suites, 0, sizeof(ucipher_suites));
+
+       /* Save the AKM suites passed in the command */
+       for (i = 0; i < num_akm_suites; i++) {
+               /* Store the MSB first, as required by join_pref */
+               for (j = 0; j < 4; j++) {
+                       hex[0] = *pcmd++;
+                       hex[1] = *pcmd++;
+                       buf[j] = (uint8)simple_strtoul(hex, NULL, 16);
+               }
+               memcpy((uint8 *)&akm_suites[i], buf, sizeof(uint32));
+       }
+
+       total_len_left -= (num_akm_suites * WIDTH_AKM_SUITE);
+       num_ucipher_suites = simple_strtoul(pcmd, NULL, 16);
+       /* Increment for number of cipher suites field + space */
+       pcmd += 3;
+       total_len_left -= 3;
+
+       if (total_len_left < (num_ucipher_suites * WIDTH_AKM_SUITE))
+               return -1;
+
+       /* Save the cipher suites passed in the command */
+       for (i = 0; i < num_ucipher_suites; i++) {
+               /* Store the MSB first, as required by join_pref */
+               for (j = 0; j < 4; j++) {
+                       hex[0] = *pcmd++;
+                       hex[1] = *pcmd++;
+                       buf[j] = (uint8)simple_strtoul(hex, NULL, 16);
+               }
+               memcpy((uint8 *)&ucipher_suites[i], buf, sizeof(uint32));
+       }
+
+       /* Join preference for RSSI
+        * Type   : 1 byte (0x01)
+        * Length : 1 byte (0x02)
+        * Value  : 2 bytes     (reserved)
+        */
+       *pref++ = WL_JOIN_PREF_RSSI;
+       *pref++ = JOIN_PREF_RSSI_LEN;
+       *pref++ = 0;
+       *pref++ = 0;
+
+       /* Join preference for WPA
+        * Type   : 1 byte (0x02)
+        * Length : 1 byte (not used)
+        * Value  : (variable length)
+        *              reserved: 1 byte
+        *      count   : 1 byte (no of tuples)
+        *              Tuple1  : 12 bytes
+        *                      akm[4]
+        *                      ucipher[4]
+        *                      mcipher[4]
+        *              Tuple2  : 12 bytes
+        *              Tuplen  : 12 bytes
+        */
+       num_tuples = num_akm_suites * num_ucipher_suites;
+       if (num_tuples != 0) {
+               if (num_tuples <= JOIN_PREF_MAX_WPA_TUPLES) {
+                       *pref++ = WL_JOIN_PREF_WPA;
+                       *pref++ = 0;
+                       *pref++ = 0;
+                       *pref++ = (uint8)num_tuples;
+                       total_bytes = JOIN_PREF_RSSI_SIZE + JOIN_PREF_WPA_HDR_SIZE +
+                               (JOIN_PREF_WPA_TUPLE_SIZE * num_tuples);
+               } else {
+                       DHD_ERROR(("%s: Too many wpa configs for join_pref \n", __FUNCTION__));
+                       return -1;
+               }
+       } else {
+               /* No WPA config, configure only RSSI preference */
+               total_bytes = JOIN_PREF_RSSI_SIZE;
+       }
+
+       /* akm-ucipher-mcipher tuples in the format required for join_pref */
+       for (i = 0; i < num_ucipher_suites; i++) {
+               for (j = 0; j < num_akm_suites; j++) {
+                       memcpy(pref, (uint8 *)&akm_suites[j], WPA_SUITE_LEN);
+                       pref += WPA_SUITE_LEN;
+                       memcpy(pref, (uint8 *)&ucipher_suites[i], WPA_SUITE_LEN);
+                       pref += WPA_SUITE_LEN;
+                       /* Set to 0 to match any available multicast cipher */
+                       memset(pref, 0, WPA_SUITE_LEN);
+                       pref += WPA_SUITE_LEN;
+               }
+       }
+
+       prhex("join pref", (uint8 *)buf, total_bytes);
+       error = wldev_iovar_setbuf(dev, "join_pref", buf, total_bytes, smbuf, sizeof(smbuf), NULL);
+       if (error) {
+               DHD_ERROR(("Failed to set join_pref, error = %d\n", error));
+       }
+       return error;
+}
+#endif /* defined(BCMFW_ROAM_ENABLE */
+
+static int
+wl_android_iolist_add(struct net_device *dev, struct list_head *head, struct io_cfg *config)
+{
+       struct io_cfg *resume_cfg;
+       s32 ret;
+
+       resume_cfg = kzalloc(sizeof(struct io_cfg), GFP_KERNEL);
+       if (!resume_cfg)
+               return -ENOMEM;
+
+       if (config->iovar) {
+               ret = wldev_iovar_getint(dev, config->iovar, &resume_cfg->param);
+               if (ret) {
+                       DHD_ERROR(("%s: Failed to get current %s value\n",
+                               __FUNCTION__, config->iovar));
+                       goto error;
+               }
+
+               ret = wldev_iovar_setint(dev, config->iovar, config->param);
+               if (ret) {
+                       DHD_ERROR(("%s: Failed to set %s to %d\n", __FUNCTION__,
+                               config->iovar, config->param));
+                       goto error;
+               }
+
+               resume_cfg->iovar = config->iovar;
+       } else {
+               resume_cfg->arg = kzalloc(config->len, GFP_KERNEL);
+               if (!resume_cfg->arg) {
+                       ret = -ENOMEM;
+                       goto error;
+               }
+               ret = wldev_ioctl(dev, config->ioctl, resume_cfg->arg, config->len, false);
+               if (ret) {
+                       DHD_ERROR(("%s: Failed to get ioctl %d\n", __FUNCTION__,
+                               config->ioctl));
+                       goto error;
+               }
+               ret = wldev_ioctl(dev, config->ioctl + 1, config->arg, config->len, true);
+               if (ret) {
+                       DHD_ERROR(("%s: Failed to set %s to %d\n", __FUNCTION__,
+                               config->iovar, config->param));
+                       goto error;
+               }
+               if (config->ioctl + 1 == WLC_SET_PM)
+                       wl_cfg80211_update_power_mode(dev);
+               resume_cfg->ioctl = config->ioctl;
+               resume_cfg->len = config->len;
+       }
+
+       list_add(&resume_cfg->list, head);
+
+       return 0;
+error:
+       kfree(resume_cfg->arg);
+       kfree(resume_cfg);
+       return ret;
+}
+
+static void
+wl_android_iolist_resume(struct net_device *dev, struct list_head *head)
+{
+       struct io_cfg *config;
+       struct list_head *cur, *q;
+       s32 ret = 0;
+
+       list_for_each_safe(cur, q, head) {
+               config = list_entry(cur, struct io_cfg, list);
+               if (config->iovar) {
+                       if (!ret)
+                               ret = wldev_iovar_setint(dev, config->iovar,
+                                       config->param);
+               } else {
+                       if (!ret)
+                               ret = wldev_ioctl(dev, config->ioctl + 1,
+                                       config->arg, config->len, true);
+                       if (config->ioctl + 1 == WLC_SET_PM)
+                               wl_cfg80211_update_power_mode(dev);
+                       kfree(config->arg);
+               }
+               list_del(cur);
+               kfree(config);
+       }
+}
+#ifdef WL11ULB
+static int
+wl_android_set_ulb_mode(struct net_device *dev, char *command, int total_len)
+{
+       int mode = 0;
+
+       DHD_INFO(("set ulb mode (%s) \n", command));
+       if (sscanf(command, "%*s %d", &mode) != 1) {
+               DHD_ERROR(("%s: Failed to get Parameter\n", __FUNCTION__));
+               return -1;
+       }
+       return wl_cfg80211_set_ulb_mode(dev, mode);
+}
+static int
+wl_android_set_ulb_bw(struct net_device *dev, char *command, int total_len)
+{
+       int bw = 0;
+       u8 *pos;
+       char *ifname = NULL;
+       DHD_INFO(("set ulb bw (%s) \n", command));
+
+       /*
+        * For sta/ap: IFNAME=<ifname> DRIVER ULB_BW <bw> ifname
+        * For p2p:    IFNAME=wlan0 DRIVER ULB_BW <bw> p2p-dev-wlan0
+        */
+       if (total_len < strlen(CMD_ULB_BW) + 2)
+               return -EINVAL;
+
+       pos = command + strlen(CMD_ULB_BW) + 1;
+       bw = bcm_atoi(pos);
+
+       if ((strlen(pos) >= 5)) {
+               ifname = pos + 2;
+       }
+
+       DHD_INFO(("[ULB] ifname:%s ulb_bw:%d \n", ifname, bw));
+       return wl_cfg80211_set_ulb_bw(dev, bw, ifname);
+}
+#endif /* WL11ULB */
+static int
+wl_android_set_miracast(struct net_device *dev, char *command, int total_len)
+{
+       int mode, val;
+       int ret = 0;
+       struct io_cfg config;
+
+       if (sscanf(command, "%*s %d", &mode) != 1) {
+               DHD_ERROR(("%s: Failed to get Parameter\n", __FUNCTION__));
+               return -1;
+       }
+
+       DHD_INFO(("%s: enter miracast mode %d\n", __FUNCTION__, mode));
+
+       if (miracast_cur_mode == mode) {
+               return 0;
+       }
+
+       wl_android_iolist_resume(dev, &miracast_resume_list);
+       miracast_cur_mode = MIRACAST_MODE_OFF;
+
+       switch (mode) {
+       case MIRACAST_MODE_SOURCE:
+               /* setting mchan_algo to platform specific value */
+               config.iovar = "mchan_algo";
+
+               ret = wldev_ioctl(dev, WLC_GET_BCNPRD, &val, sizeof(int), false);
+               if (!ret && val > 100) {
+                       config.param = 0;
+                       DHD_ERROR(("%s: Connected station's beacon interval: "
+                               "%d and set mchan_algo to %d \n",
+                               __FUNCTION__, val, config.param));
+               } else {
+                       config.param = MIRACAST_MCHAN_ALGO;
+               }
+               ret = wl_android_iolist_add(dev, &miracast_resume_list, &config);
+               if (ret) {
+                       goto resume;
+               }
+
+               /* setting mchan_bw to platform specific value */
+               config.iovar = "mchan_bw";
+               config.param = MIRACAST_MCHAN_BW;
+               ret = wl_android_iolist_add(dev, &miracast_resume_list, &config);
+               if (ret) {
+                       goto resume;
+               }
+
+               /* setting apmdu to platform specific value */
+               config.iovar = "ampdu_mpdu";
+               config.param = MIRACAST_AMPDU_SIZE;
+               ret = wl_android_iolist_add(dev, &miracast_resume_list, &config);
+               if (ret) {
+                       goto resume;
+               }
+               /* FALLTROUGH */
+               /* Source mode shares most configurations with sink mode.
+                * Fall through here to avoid code duplication
+                */
+       case MIRACAST_MODE_SINK:
+               /* disable internal roaming */
+               config.iovar = "roam_off";
+               config.param = 1;
+               ret = wl_android_iolist_add(dev, &miracast_resume_list, &config);
+               if (ret) {
+                       goto resume;
+               }
+
+               /* tunr off pm */
+               ret = wldev_ioctl(dev, WLC_GET_PM, &val, sizeof(val), false);
+               if (ret) {
+                       goto resume;
+               }
+
+               if (val != PM_OFF) {
+                       val = PM_OFF;
+                       config.iovar = NULL;
+                       config.ioctl = WLC_GET_PM;
+                       config.arg = &val;
+                       config.len = sizeof(int);
+                       ret = wl_android_iolist_add(dev, &miracast_resume_list, &config);
+                       if (ret) {
+                               goto resume;
+                       }
+               }
+               break;
+       case MIRACAST_MODE_OFF:
+       default:
+               break;
+       }
+       miracast_cur_mode = mode;
+
+       return 0;
+
+resume:
+       DHD_ERROR(("%s: turnoff miracast mode because of err%d\n", __FUNCTION__, ret));
+       wl_android_iolist_resume(dev, &miracast_resume_list);
+       return ret;
+}
+
+#define NETLINK_OXYGEN     30
+#define AIBSS_BEACON_TIMEOUT   10
+
+static struct sock *nl_sk = NULL;
+
+static void wl_netlink_recv(struct sk_buff *skb)
+{
+       WL_ERR(("netlink_recv called\n"));
+}
+
+static int wl_netlink_init(void)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
+       struct netlink_kernel_cfg cfg = {
+               .input  = wl_netlink_recv,
+       };
+#endif
+
+       if (nl_sk != NULL) {
+               WL_ERR(("nl_sk already exist\n"));
+               return BCME_ERROR;
+       }
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
+       nl_sk = netlink_kernel_create(&init_net, NETLINK_OXYGEN,
+               0, wl_netlink_recv, NULL, THIS_MODULE);
+#elif (LINUX_VERSION_CODE < KERNEL_VERSION(3, 7, 0))
+       nl_sk = netlink_kernel_create(&init_net, NETLINK_OXYGEN, THIS_MODULE, &cfg);
+#else
+       nl_sk = netlink_kernel_create(&init_net, NETLINK_OXYGEN, &cfg);
+#endif
+
+       if (nl_sk == NULL) {
+               WL_ERR(("nl_sk is not ready\n"));
+               return BCME_ERROR;
+       }
+
+       return BCME_OK;
+}
+
+static void wl_netlink_deinit(void)
+{
+       if (nl_sk) {
+               netlink_kernel_release(nl_sk);
+               nl_sk = NULL;
+       }
+}
+
+s32
+wl_netlink_send_msg(int pid, int type, int seq, void *data, size_t size)
+{
+       struct sk_buff *skb = NULL;
+       struct nlmsghdr *nlh = NULL;
+       int ret = -1;
+
+       if (nl_sk == NULL) {
+               WL_ERR(("nl_sk was not initialized\n"));
+               goto nlmsg_failure;
+       }
+
+       skb = alloc_skb(NLMSG_SPACE(size), GFP_ATOMIC);
+       if (skb == NULL) {
+               WL_ERR(("failed to allocate memory\n"));
+               goto nlmsg_failure;
+       }
+
+       nlh = nlmsg_put(skb, 0, 0, 0, size, 0);
+       if (nlh == NULL) {
+               WL_ERR(("failed to build nlmsg, skb_tailroom:%d, nlmsg_total_size:%d\n",
+                       skb_tailroom(skb), nlmsg_total_size(size)));
+               dev_kfree_skb(skb);
+               goto nlmsg_failure;
+       }
+
+       memcpy(nlmsg_data(nlh), data, size);
+       nlh->nlmsg_seq = seq;
+       nlh->nlmsg_type = type;
+
+       /* netlink_unicast() takes ownership of the skb and frees it itself. */
+       ret = netlink_unicast(nl_sk, skb, pid, 0);
+       WL_DBG(("netlink_unicast() pid=%d, ret=%d\n", pid, ret));
+
+nlmsg_failure:
+       return ret;
+}
+
+
+int wl_keep_alive_set(struct net_device *dev, char* extra, int total_len)
+{
+       char                            buf[256];
+       const char                      *str;
+       wl_mkeep_alive_pkt_t    mkeep_alive_pkt;
+       wl_mkeep_alive_pkt_t    *mkeep_alive_pktp;
+       int                                     buf_len;
+       int                                     str_len;
+       int res                                 = -1;
+       uint period_msec = 0;
+
+       if (extra == NULL)
+       {
+                DHD_ERROR(("%s: extra is NULL\n", __FUNCTION__));
+                return -1;
+       }
+       if (sscanf(extra, "%d", &period_msec) != 1)
+       {
+                DHD_ERROR(("%s: sscanf error. check period_msec value\n", __FUNCTION__));
+                return -EINVAL;
+       }
+       DHD_ERROR(("%s: period_msec is %d\n", __FUNCTION__, period_msec));
+
+       memset(&mkeep_alive_pkt, 0, sizeof(wl_mkeep_alive_pkt_t));
+
+       str = "mkeep_alive";
+       str_len = strlen(str);
+       strncpy(buf, str, str_len);
+       buf[ str_len ] = '\0';
+       mkeep_alive_pktp = (wl_mkeep_alive_pkt_t *) (buf + str_len + 1);
+       mkeep_alive_pkt.period_msec = period_msec;
+       buf_len = str_len + 1;
+       mkeep_alive_pkt.version = htod16(WL_MKEEP_ALIVE_VERSION);
+       mkeep_alive_pkt.length = htod16(WL_MKEEP_ALIVE_FIXED_LEN);
+
+       /* Setup keep alive zero for null packet generation */
+       mkeep_alive_pkt.keep_alive_id = 0;
+       mkeep_alive_pkt.len_bytes = 0;
+       buf_len += WL_MKEEP_ALIVE_FIXED_LEN;
+       /* Keep-alive attributes are set in local       variable (mkeep_alive_pkt), and
+        * then memcpy'ed into buffer (mkeep_alive_pktp) since there is no
+        * guarantee that the buffer is properly aligned.
+        */
+       memcpy((char *)mkeep_alive_pktp, &mkeep_alive_pkt, WL_MKEEP_ALIVE_FIXED_LEN);
+
+       if ((res = wldev_ioctl(dev, WLC_SET_VAR, buf, buf_len, TRUE)) < 0)
+       {
+               DHD_ERROR(("%s:keep_alive set failed. res[%d]\n", __FUNCTION__, res));
+       }
+       else
+       {
+               DHD_ERROR(("%s:keep_alive set ok. res[%d]\n", __FUNCTION__, res));
+       }
+
+       return res;
+}
+
+static const char *
+get_string_by_separator(char *result, int result_len, const char *src, char separator)
+{
+       char *end = result + result_len - 1;
+       while ((result != end) && (*src != separator) && (*src)) {
+               *result++ = *src++;
+       }
+       *result = 0;
+       if (*src == separator) {
+               ++src;
+       }
+       return src;
+}
+
+int
+wl_android_set_roam_offload_bssid_list(struct net_device *dev, const char *cmd)
+{
+       char sbuf[32];
+       int i, cnt, size, err, ioctl_buf_len;
+       roamoffl_bssid_list_t *bssid_list;
+       const char *str = cmd;
+       char *ioctl_buf;
+       dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(dev);
+
+       str = get_string_by_separator(sbuf, 32, str, ',');
+       cnt = bcm_atoi(sbuf);
+       cnt = MIN(cnt, MAX_ROAMOFFL_BSSID_NUM);
+
+       if ((cnt > 0) &&
+               (((dhdp->op_mode & DHD_FLAG_STA_MODE) && (dhdp->op_mode & DHD_FLAG_HOSTAP_MODE)) ||
+               FALSE)) {
+               WL_ERR(("Can't set ROAMOFFL_BSSID when enabled STA-SoftAP or WES\n"));
+               return -EINVAL;
+       }
+
+       size = sizeof(int32) + sizeof(struct ether_addr) * cnt;
+       WL_ERR(("ROAM OFFLOAD BSSID LIST %d BSSIDs, size %d\n", cnt, size));
+       bssid_list = kmalloc(size, GFP_KERNEL);
+       if (bssid_list == NULL) {
+               WL_ERR(("%s: memory alloc for bssid list(%d) failed\n",
+                       __FUNCTION__, size));
+               return -ENOMEM;
+       }
+       ioctl_buf_len = size + 64;
+       ioctl_buf = kmalloc(ioctl_buf_len, GFP_KERNEL);
+       if (ioctl_buf == NULL) {
+               WL_ERR(("%s: memory alloc for ioctl_buf(%d) failed\n",
+                       __FUNCTION__, ioctl_buf_len));
+               kfree(bssid_list);
+               return -ENOMEM;
+       }
+
+       for (i = 0; i < cnt; i++) {
+               str = get_string_by_separator(sbuf, 32, str, ',');
+               bcm_ether_atoe(sbuf, &bssid_list->bssid[i]);
+       }
+
+       bssid_list->cnt = (int32)cnt;
+       err = wldev_iovar_setbuf(dev, "roamoffl_bssid_list",
+                       bssid_list, size, ioctl_buf, ioctl_buf_len, NULL);
+       kfree(bssid_list);
+       kfree(ioctl_buf);
+
+       return err;
+}
+
+#ifdef P2PRESP_WFDIE_SRC
+static int wl_android_get_wfdie_resp(struct net_device *dev, char *command, int total_len)
+{
+       int error = 0;
+       int bytes_written = 0;
+       int only_resp_wfdsrc = 0;
+
+       error = wldev_iovar_getint(dev, "p2p_only_resp_wfdsrc", &only_resp_wfdsrc);
+       if (error) {
+               DHD_ERROR(("%s: Failed to get the mode for only_resp_wfdsrc, error = %d\n",
+                       __FUNCTION__, error));
+               return -1;
+       }
+
+       bytes_written = snprintf(command, total_len, "%s %d",
+               CMD_P2P_GET_WFDIE_RESP, only_resp_wfdsrc);
+
+       return bytes_written;
+}
+
+static int wl_android_set_wfdie_resp(struct net_device *dev, int only_resp_wfdsrc)
+{
+       int error = 0;
+
+       error = wldev_iovar_setint(dev, "p2p_only_resp_wfdsrc", only_resp_wfdsrc);
+       if (error) {
+               DHD_ERROR(("%s: Failed to set only_resp_wfdsrc %d, error = %d\n",
+                       __FUNCTION__, only_resp_wfdsrc, error));
+               return -1;
+       }
+
+       return 0;
+}
+#endif /* P2PRESP_WFDIE_SRC */
+
+#ifdef BT_WIFI_HANDOVER
+static int
+wl_tbow_teardown(struct net_device *dev, char *command, int total_len)
+{
+       int err = BCME_OK;
+       char buf[WLC_IOCTL_SMLEN];
+       tbow_setup_netinfo_t netinfo;
+       memset(&netinfo, 0, sizeof(netinfo));
+       netinfo.opmode = TBOW_HO_MODE_TEARDOWN;
+
+       err = wldev_iovar_setbuf_bsscfg(dev, "tbow_doho", &netinfo,
+                       sizeof(tbow_setup_netinfo_t), buf, WLC_IOCTL_SMLEN, 0, NULL);
+       if (err < 0) {
+               WL_ERR(("tbow_doho iovar error %d\n", err));
+                       return err;
+       }
+       return err;
+}
+#endif /* BT_WIFI_HANOVER */
+
+#ifdef SET_RPS_CPUS
+static int
+wl_android_set_rps_cpus(struct net_device *dev, char *command, int total_len)
+{
+       int error, enable;
+
+       enable = command[strlen(CMD_RPSMODE) + 1] - '0';
+       error = dhd_rps_cpus_enable(dev, enable);
+
+#if defined(DHDTCPACK_SUPPRESS) && defined(BCMPCIE) && defined(WL_CFG80211)
+       if (!error) {
+               void *dhdp = wl_cfg80211_get_dhdp(dev);
+               if (enable) {
+                       DHD_TRACE(("%s : set ack suppress. TCPACK_SUP_HOLD.\n", __FUNCTION__));
+                       dhd_tcpack_suppress_set(dhdp, TCPACK_SUP_HOLD);
+               } else {
+                       DHD_TRACE(("%s : clear ack suppress.\n", __FUNCTION__));
+                       dhd_tcpack_suppress_set(dhdp, TCPACK_SUP_OFF);
+               }
+       }
+#endif /* DHDTCPACK_SUPPRESS && BCMPCIE && WL_CFG80211 */
+
+       return error;
+}
+#endif /* SET_RPS_CPUS */
+#ifdef P2P_LISTEN_OFFLOADING
+s32
+wl_cfg80211_p2plo_offload(struct net_device *dev, char *cmd, char* buf, int len)
+{
+       int ret = 0;
+
+       WL_ERR(("Entry cmd:%s arg_len:%d \n", cmd, len));
+
+       if (strncmp(cmd, "P2P_LO_START", strlen("P2P_LO_START")) == 0) {
+               ret = wl_cfg80211_p2plo_listen_start(dev, buf, len);
+       } else if (strncmp(cmd, "P2P_LO_STOP", strlen("P2P_LO_STOP")) == 0) {
+               ret = wl_cfg80211_p2plo_listen_stop(dev);
+       } else {
+               WL_ERR(("Request for Unsupported CMD:%s \n", buf));
+               ret = -EINVAL;
+       }
+       return ret;
+}
+#endif /* P2P_LISTEN_OFFLOADING */
+
+int
+wl_android_murx_bfe_cap(struct net_device *dev, int val)
+{
+       int err = BCME_OK;
+       int iface_count = wl_cfg80211_iface_count(dev);
+       struct ether_addr bssid;
+       wl_reassoc_params_t params;
+
+       if (iface_count > 1) {
+               WL_ERR(("murx_bfe_cap change is not allowed when "
+                               "there are multiple interfaces\n"));
+               return -EINVAL;
+       }
+       /* Now there is only single interface */
+       err = wldev_iovar_setint(dev, "murx_bfe_cap", val);
+       if (unlikely(err)) {
+               WL_ERR(("Failed to set murx_bfe_cap IOVAR to %d,"
+                               "error %d\n", val, err));
+               return err;
+       }
+
+       /* If successful intiate a reassoc */
+       if ((err = wldev_ioctl(dev, WLC_GET_BSSID, &bssid, ETHER_ADDR_LEN, false)) < 0) {
+               WL_ERR(("Failed to get bssid, error=%d\n", err));
+               return err;
+       }
+
+       bzero(&params, sizeof(wl_reassoc_params_t));
+       memcpy(&params.bssid, &bssid, ETHER_ADDR_LEN);
+
+       if ((err = wldev_ioctl(dev, WLC_REASSOC, &params,
+               sizeof(wl_reassoc_params_t), true)) < 0) {
+               WL_ERR(("reassoc failed err:%d \n", err));
+       } else {
+               WL_DBG(("reassoc issued successfully\n"));
+       }
+
+       return err;
+}
+
+int wl_android_priv_cmd(struct net_device *net, struct ifreq *ifr, int cmd)
+{
+#define PRIVATE_COMMAND_MAX_LEN        8192
+#define PRIVATE_COMMAND_DEF_LEN        4096
+       int ret = 0;
+       char *command = NULL;
+       int bytes_written = 0;
+       int buf_size = 0;
+       android_wifi_priv_cmd priv_cmd;
+
+       net_os_wake_lock(net);
+
+       if (!capable(CAP_NET_ADMIN)) {
+               ret = -EPERM;
+               goto exit;
+       }
+
+       if (!ifr->ifr_data) {
+               ret = -EINVAL;
+               goto exit;
+       }
+
+#ifdef CONFIG_COMPAT
+#if ((LINUX_VERSION_CODE < KERNEL_VERSION(4, 6, 0)) || ((LINUX_VERSION_CODE >= \
+       KERNEL_VERSION(4, 6, 0)) && !defined(__X86)))
+       if (is_compat_task()) {
+               compat_android_wifi_priv_cmd compat_priv_cmd;
+               if (copy_from_user(&compat_priv_cmd, ifr->ifr_data,
+                       sizeof(compat_android_wifi_priv_cmd))) {
+                       ret = -EFAULT;
+                       goto exit;
+
+               }
+               priv_cmd.buf = compat_ptr(compat_priv_cmd.buf);
+               priv_cmd.used_len = compat_priv_cmd.used_len;
+               priv_cmd.total_len = compat_priv_cmd.total_len;
+       } else
+#endif /* LINUX_VER < 4.6 || (LINUX_VER >= 4.6 && !defined(__X86)) */
+#endif /* CONFIG_COMPAT */
+       {
+               if (copy_from_user(&priv_cmd, ifr->ifr_data, sizeof(android_wifi_priv_cmd))) {
+                       ret = -EFAULT;
+                       goto exit;
+               }
+       }
+       if ((priv_cmd.total_len > PRIVATE_COMMAND_MAX_LEN) || (priv_cmd.total_len < 0)) {
+               DHD_ERROR(("%s: buf length invalid:%d\n", __FUNCTION__, priv_cmd.total_len));
+               ret = -EINVAL;
+               goto exit;
+       }
+       buf_size = max(priv_cmd.total_len, PRIVATE_COMMAND_DEF_LEN);
+       command = kmalloc((buf_size + 1), GFP_KERNEL);
+       if (!command)
+       {
+               DHD_ERROR(("%s: failed to allocate memory\n", __FUNCTION__));
+               ret = -ENOMEM;
+               goto exit;
+       }
+       if (copy_from_user(command, priv_cmd.buf, priv_cmd.total_len)) {
+               ret = -EFAULT;
+               goto exit;
+       }
+       command[priv_cmd.total_len] = '\0';
+
+       DHD_INFO(("%s: Android private cmd \"%s\" on %s\n", __FUNCTION__, command, ifr->ifr_name));
+
+       if (strnicmp(command, CMD_START, strlen(CMD_START)) == 0) {
+               DHD_INFO(("%s, Received regular START command\n", __FUNCTION__));
+               bytes_written = wl_android_wifi_on(net);
+       }
+       else if (strnicmp(command, CMD_SETFWPATH, strlen(CMD_SETFWPATH)) == 0) {
+               bytes_written = wl_android_set_fwpath(net, command, priv_cmd.total_len);
+       }
+
+       if (!g_wifi_on) {
+               DHD_ERROR(("%s: Ignore private cmd \"%s\" - iface %s is down\n",
+                       __FUNCTION__, command, ifr->ifr_name));
+               ret = 0;
+               goto exit;
+       }
+
+       if (strnicmp(command, CMD_STOP, strlen(CMD_STOP)) == 0) {
+               bytes_written = wl_android_wifi_off(net, FALSE);
+       }
+       else if (strnicmp(command, CMD_SCAN_ACTIVE, strlen(CMD_SCAN_ACTIVE)) == 0) {
+               wl_cfg80211_set_passive_scan(net, command);
+       }
+       else if (strnicmp(command, CMD_SCAN_PASSIVE, strlen(CMD_SCAN_PASSIVE)) == 0) {
+               wl_cfg80211_set_passive_scan(net, command);
+       }
+       else if (strnicmp(command, CMD_RSSI, strlen(CMD_RSSI)) == 0) {
+               bytes_written = wl_android_get_rssi(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_LINKSPEED, strlen(CMD_LINKSPEED)) == 0) {
+               bytes_written = wl_android_get_link_speed(net, command, priv_cmd.total_len);
+       }
+#ifdef PKT_FILTER_SUPPORT
+       else if (strnicmp(command, CMD_RXFILTER_START, strlen(CMD_RXFILTER_START)) == 0) {
+               bytes_written = net_os_enable_packet_filter(net, 1);
+       }
+       else if (strnicmp(command, CMD_RXFILTER_STOP, strlen(CMD_RXFILTER_STOP)) == 0) {
+               bytes_written = net_os_enable_packet_filter(net, 0);
+       }
+       else if (strnicmp(command, CMD_RXFILTER_ADD, strlen(CMD_RXFILTER_ADD)) == 0) {
+               int filter_num = *(command + strlen(CMD_RXFILTER_ADD) + 1) - '0';
+               bytes_written = net_os_rxfilter_add_remove(net, TRUE, filter_num);
+       }
+       else if (strnicmp(command, CMD_RXFILTER_REMOVE, strlen(CMD_RXFILTER_REMOVE)) == 0) {
+               int filter_num = *(command + strlen(CMD_RXFILTER_REMOVE) + 1) - '0';
+               bytes_written = net_os_rxfilter_add_remove(net, FALSE, filter_num);
+       }
+#endif /* PKT_FILTER_SUPPORT */
+       else if (strnicmp(command, CMD_BTCOEXSCAN_START, strlen(CMD_BTCOEXSCAN_START)) == 0) {
+               /* TBD: BTCOEXSCAN-START */
+       }
+       else if (strnicmp(command, CMD_BTCOEXSCAN_STOP, strlen(CMD_BTCOEXSCAN_STOP)) == 0) {
+               /* TBD: BTCOEXSCAN-STOP */
+       }
+       else if (strnicmp(command, CMD_BTCOEXMODE, strlen(CMD_BTCOEXMODE)) == 0) {
+#ifdef WL_CFG80211
+               void *dhdp = wl_cfg80211_get_dhdp(net);
+               bytes_written = wl_cfg80211_set_btcoex_dhcp(net, dhdp, command);
+#else
+#ifdef PKT_FILTER_SUPPORT
+               uint mode = *(command + strlen(CMD_BTCOEXMODE) + 1) - '0';
+
+               if (mode == 1)
+                       net_os_enable_packet_filter(net, 0); /* DHCP starts */
+               else
+                       net_os_enable_packet_filter(net, 1); /* DHCP ends */
+#endif /* PKT_FILTER_SUPPORT */
+#endif /* WL_CFG80211 */
+       }
+       else if (strnicmp(command, CMD_ADDIE, strlen(CMD_ADDIE)) == 0) {
+               bytes_written = wl_android_add_vendor_ie(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_DELIE, strlen(CMD_DELIE)) == 0) {
+               bytes_written = wl_android_del_vendor_ie(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_SETSUSPENDOPT, strlen(CMD_SETSUSPENDOPT)) == 0) {
+               bytes_written = wl_android_set_suspendopt(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_SETSUSPENDMODE, strlen(CMD_SETSUSPENDMODE)) == 0) {
+               bytes_written = wl_android_set_suspendmode(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_MAXDTIM_IN_SUSPEND, strlen(CMD_MAXDTIM_IN_SUSPEND)) == 0) {
+               bytes_written = wl_android_set_max_dtim(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_SETBAND, strlen(CMD_SETBAND)) == 0) {
+               uint band = *(command + strlen(CMD_SETBAND) + 1) - '0';
+               bytes_written = wldev_set_band(net, band);
+       }
+       else if (strnicmp(command, CMD_GETBAND, strlen(CMD_GETBAND)) == 0) {
+               bytes_written = wl_android_get_band(net, command, priv_cmd.total_len);
+       }
+#ifdef WL_CFG80211
+       /* CUSTOMER_SET_COUNTRY feature is define for only GGSM model */
+       else if (strnicmp(command, CMD_COUNTRY, strlen(CMD_COUNTRY)) == 0) {
+               /*
+                * Usage examples:
+                * DRIVER COUNTRY US
+                * DRIVER COUNTRY US/7
+                */
+               char *country_code = command + strlen(CMD_COUNTRY) + 1;
+               char *rev_info_delim = country_code + 2; /* 2 bytes of country code */
+               int revinfo = -1;
+               if ((rev_info_delim) &&
+                       (strnicmp(rev_info_delim, CMD_COUNTRY_DELIMITER,
+                       strlen(CMD_COUNTRY_DELIMITER)) == 0) &&
+                       (rev_info_delim + 1)) {
+                       revinfo  = bcm_atoi(rev_info_delim + 1);
+               }
+               bytes_written = wldev_set_country(net, country_code, true, true, revinfo);
+#ifdef FCC_PWR_LIMIT_2G
+               if (wldev_iovar_setint(net, "fccpwrlimit2g", FALSE)) {
+                       DHD_ERROR(("%s: fccpwrlimit2g deactivation is failed\n", __FUNCTION__));
+               } else {
+                       DHD_ERROR(("%s: fccpwrlimit2g is deactivated\n", __FUNCTION__));
+               }
+#endif /* FCC_PWR_LIMIT_2G */
+       }
+#endif /* WL_CFG80211 */
+       else if (strnicmp(command, CMD_SET_CSA, strlen(CMD_SET_CSA)) == 0) {
+               bytes_written = wl_android_set_csa(net, command, priv_cmd.total_len);
+       } else if (strnicmp(command, CMD_80211_MODE, strlen(CMD_80211_MODE)) == 0) {
+               bytes_written = wl_android_get_80211_mode(net, command, priv_cmd.total_len);
+       } else if (strnicmp(command, CMD_CHANSPEC, strlen(CMD_CHANSPEC)) == 0) {
+               bytes_written = wl_android_get_chanspec(net, command, priv_cmd.total_len);
+       } else if (strnicmp(command, CMD_DATARATE, strlen(CMD_DATARATE)) == 0) {
+               bytes_written = wl_android_get_datarate(net, command, priv_cmd.total_len);
+       } else if (strnicmp(command, CMD_ASSOC_CLIENTS, strlen(CMD_ASSOC_CLIENTS)) == 0) {
+               bytes_written = wl_android_get_assoclist(net, command, priv_cmd.total_len);
+       }
+
+#ifdef CUSTOMER_HW4_PRIVATE_CMD
+#ifdef WLTDLS
+       else if (strnicmp(command, CMD_TDLS_RESET, strlen(CMD_TDLS_RESET)) == 0) {
+               bytes_written = wl_android_tdls_reset(net);
+       }
+#endif /* WLTDLS */
+#endif /* CUSTOMER_HW4_PRIVATE_CMD */
+
+#ifdef PNO_SUPPORT
+       else if (strnicmp(command, CMD_PNOSSIDCLR_SET, strlen(CMD_PNOSSIDCLR_SET)) == 0) {
+               bytes_written = dhd_dev_pno_stop_for_ssid(net);
+       }
+#ifndef WL_SCHED_SCAN
+       else if (strnicmp(command, CMD_PNOSETUP_SET, strlen(CMD_PNOSETUP_SET)) == 0) {
+               bytes_written = wl_android_set_pno_setup(net, command, priv_cmd.total_len);
+       }
+#endif /* !WL_SCHED_SCAN */
+       else if (strnicmp(command, CMD_PNOENABLE_SET, strlen(CMD_PNOENABLE_SET)) == 0) {
+               int enable = *(command + strlen(CMD_PNOENABLE_SET) + 1) - '0';
+               bytes_written = (enable)? 0 : dhd_dev_pno_stop_for_ssid(net);
+       }
+       else if (strnicmp(command, CMD_WLS_BATCHING, strlen(CMD_WLS_BATCHING)) == 0) {
+               bytes_written = wls_parse_batching_cmd(net, command, priv_cmd.total_len);
+       }
+#endif /* PNO_SUPPORT */
+       else if (strnicmp(command, CMD_P2P_DEV_ADDR, strlen(CMD_P2P_DEV_ADDR)) == 0) {
+               bytes_written = wl_android_get_p2p_dev_addr(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_P2P_SET_NOA, strlen(CMD_P2P_SET_NOA)) == 0) {
+               int skip = strlen(CMD_P2P_SET_NOA) + 1;
+               bytes_written = wl_cfg80211_set_p2p_noa(net, command + skip,
+                       priv_cmd.total_len - skip);
+       }
+#ifdef P2P_LISTEN_OFFLOADING
+       else if (strnicmp(command, CMD_P2P_LISTEN_OFFLOAD, strlen(CMD_P2P_LISTEN_OFFLOAD)) == 0) {
+               u8 *sub_command = strchr(command, ' ');
+               bytes_written = wl_cfg80211_p2plo_offload(net, command, sub_command,
+                               sub_command ? strlen(sub_command) : 0);
+       }
+#endif /* P2P_LISTEN_OFFLOADING */
+#ifdef WL_NAN
+       else if (strnicmp(command, CMD_NAN, strlen(CMD_NAN)) == 0) {
+               bytes_written = wl_cfg80211_nan_cmd_handler(net, command,
+                       priv_cmd.total_len);
+       }
+#endif /* WL_NAN */
+#if !defined WL_ENABLE_P2P_IF
+       else if (strnicmp(command, CMD_P2P_GET_NOA, strlen(CMD_P2P_GET_NOA)) == 0) {
+               bytes_written = wl_cfg80211_get_p2p_noa(net, command, priv_cmd.total_len);
+       }
+#endif /* WL_ENABLE_P2P_IF */
+       else if (strnicmp(command, CMD_P2P_SET_PS, strlen(CMD_P2P_SET_PS)) == 0) {
+               int skip = strlen(CMD_P2P_SET_PS) + 1;
+               bytes_written = wl_cfg80211_set_p2p_ps(net, command + skip,
+                       priv_cmd.total_len - skip);
+       }
+       else if (strnicmp(command, CMD_P2P_ECSA, strlen(CMD_P2P_ECSA)) == 0) {
+               int skip = strlen(CMD_P2P_ECSA) + 1;
+               bytes_written = wl_cfg80211_set_p2p_ecsa(net, command + skip,
+                       priv_cmd.total_len - skip);
+       }
+       else if (strnicmp(command, CMD_P2P_INC_BW, strlen(CMD_P2P_INC_BW)) == 0) {
+               int skip = strlen(CMD_P2P_INC_BW) + 1;
+               bytes_written = wl_cfg80211_increase_p2p_bw(net,
+                       command + skip, priv_cmd.total_len - skip);
+       }
+#ifdef WL_CFG80211
+       else if (strnicmp(command, CMD_SET_AP_WPS_P2P_IE,
+               strlen(CMD_SET_AP_WPS_P2P_IE)) == 0) {
+               int skip = strlen(CMD_SET_AP_WPS_P2P_IE) + 3;
+               bytes_written = wl_cfg80211_set_wps_p2p_ie(net, command + skip,
+                       priv_cmd.total_len - skip, *(command + skip - 2) - '0');
+       }
+#endif /* WL_CFG80211 */
+#if defined(WL_SUPPORT_AUTO_CHANNEL)
+       else if (strnicmp(command, CMD_GET_BEST_CHANNELS,
+               strlen(CMD_GET_BEST_CHANNELS)) == 0) {
+               bytes_written = wl_cfg80211_get_best_channels(net, command,
+                       priv_cmd.total_len);
+       }
+#endif /* WL_SUPPORT_AUTO_CHANNEL */
+#if defined(WL_SUPPORT_AUTO_CHANNEL)
+       else if (strnicmp(command, CMD_SET_HAPD_AUTO_CHANNEL,
+               strlen(CMD_SET_HAPD_AUTO_CHANNEL)) == 0) {
+               int skip = strlen(CMD_SET_HAPD_AUTO_CHANNEL) + 1;
+               bytes_written = wl_android_set_auto_channel(net, (const char*)command+skip, command,
+                       priv_cmd.total_len);
+       }
+#endif /* WL_SUPPORT_AUTO_CHANNEL */
+#ifdef CUSTOMER_HW4_PRIVATE_CMD
+#endif /* CUSTOMER_HW4_PRIVATE_CMD */
+#if defined(SUPPORT_HIDDEN_AP)
+       else if (strnicmp(command, CMD_SET_HAPD_MAX_NUM_STA,
+               strlen(CMD_SET_HAPD_MAX_NUM_STA)) == 0) {
+               int skip = strlen(CMD_SET_HAPD_MAX_NUM_STA) + 3;
+               wl_android_set_max_num_sta(net, (const char*)command+skip);
+       }
+       else if (strnicmp(command, CMD_SET_HAPD_SSID,
+               strlen(CMD_SET_HAPD_SSID)) == 0) {
+               int skip = strlen(CMD_SET_HAPD_SSID) + 3;
+               wl_android_set_ssid(net, (const char*)command+skip);
+       }
+       else if (strnicmp(command, CMD_SET_HAPD_HIDE_SSID,
+               strlen(CMD_SET_HAPD_HIDE_SSID)) == 0) {
+               bytes_written = wl_android_set_hide_ssid(net, command, priv_cmd.total_len);
+       }
+#endif /* SUPPORT_HIDDEN_AP */
+#ifdef CUSTOMER_HW4_PRIVATE_CMD
+#ifdef SUPPORT_SET_LPC
+       else if (strnicmp(command, CMD_HAPD_LPC_ENABLED,
+               strlen(CMD_HAPD_LPC_ENABLED)) == 0) {
+               int skip = strlen(CMD_HAPD_LPC_ENABLED) + 3;
+               wl_android_set_lpc(net, (const char*)command+skip);
+       }
+#endif /* SUPPORT_SET_LPC */
+#ifdef SUPPORT_TRIGGER_HANG_EVENT
+       else if (strnicmp(command, CMD_TEST_FORCE_HANG,
+               strlen(CMD_TEST_FORCE_HANG)) == 0) {
+               int skip = strlen(CMD_TEST_FORCE_HANG) + 1;
+               net_os_send_hang_message_reason(net, (const char*)command+skip);
+       }
+#endif /* SUPPORT_TRIGGER_HANG_EVENT */
+       else if (strnicmp(command, CMD_CHANGE_RL, strlen(CMD_CHANGE_RL)) == 0)
+               bytes_written = wl_android_ch_res_rl(net, true);
+       else if (strnicmp(command, CMD_RESTORE_RL, strlen(CMD_RESTORE_RL)) == 0)
+               bytes_written = wl_android_ch_res_rl(net, false);
+       else if (strnicmp(command, CMD_SET_RMC_ENABLE, strlen(CMD_SET_RMC_ENABLE)) == 0) {
+               int rmc_enable = *(command + strlen(CMD_SET_RMC_ENABLE) + 1) - '0';
+               bytes_written = wl_android_rmc_enable(net, rmc_enable);
+       }
+       else if (strnicmp(command, CMD_SET_RMC_TXRATE, strlen(CMD_SET_RMC_TXRATE)) == 0) {
+               int rmc_txrate;
+               sscanf(command, "%*s %10d", &rmc_txrate);
+               bytes_written = wldev_iovar_setint(net, "rmc_txrate", rmc_txrate * 2);
+       }
+       else if (strnicmp(command, CMD_SET_RMC_ACTPERIOD, strlen(CMD_SET_RMC_ACTPERIOD)) == 0) {
+               int actperiod;
+               sscanf(command, "%*s %10d", &actperiod);
+               bytes_written = wldev_iovar_setint(net, "rmc_actf_time", actperiod);
+       }
+       else if (strnicmp(command, CMD_SET_RMC_IDLEPERIOD, strlen(CMD_SET_RMC_IDLEPERIOD)) == 0) {
+               int acktimeout;
+               sscanf(command, "%*s %10d", &acktimeout);
+               acktimeout *= 1000;
+               bytes_written = wldev_iovar_setint(net, "rmc_acktmo", acktimeout);
+       }
+       else if (strnicmp(command, CMD_SET_RMC_LEADER, strlen(CMD_SET_RMC_LEADER)) == 0) {
+               int skip = strlen(CMD_SET_RMC_LEADER) + 1;
+               bytes_written = wl_android_rmc_set_leader(net, (const char*)command+skip);
+       }
+       else if (strnicmp(command, CMD_SET_RMC_EVENT,
+               strlen(CMD_SET_RMC_EVENT)) == 0)
+               bytes_written = wl_android_set_rmc_event(net, command, priv_cmd.total_len);
+       else if (strnicmp(command, CMD_GET_SCSCAN, strlen(CMD_GET_SCSCAN)) == 0) {
+               bytes_written = wl_android_get_singlecore_scan(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_SET_SCSCAN, strlen(CMD_SET_SCSCAN)) == 0) {
+               bytes_written = wl_android_set_singlecore_scan(net, command, priv_cmd.total_len);
+       }
+#ifdef TEST_TX_POWER_CONTROL
+       else if (strnicmp(command, CMD_TEST_SET_TX_POWER,
+               strlen(CMD_TEST_SET_TX_POWER)) == 0) {
+               int skip = strlen(CMD_TEST_SET_TX_POWER) + 1;
+               wl_android_set_tx_power(net, (const char*)command+skip);
+       }
+       else if (strnicmp(command, CMD_TEST_GET_TX_POWER,
+               strlen(CMD_TEST_GET_TX_POWER)) == 0) {
+               wl_android_get_tx_power(net, command, priv_cmd.total_len);
+       }
+#endif /* TEST_TX_POWER_CONTROL */
+       else if (strnicmp(command, CMD_SARLIMIT_TX_CONTROL,
+               strlen(CMD_SARLIMIT_TX_CONTROL)) == 0) {
+               int skip = strlen(CMD_SARLIMIT_TX_CONTROL) + 1;
+               wl_android_set_sarlimit_txctrl(net, (const char*)command+skip);
+       }
+#ifdef IPV6_NDO_SUPPORT
+       else if (strnicmp(command, CMD_NDRA_LIMIT, strlen(CMD_NDRA_LIMIT)) == 0) {
+               bytes_written = wl_android_nd_ra_limit(net, command, priv_cmd.total_len);
+       }
+#endif /* IPV6_NDO_SUPPORT */
+#endif /* CUSTOMER_HW4_PRIVATE_CMD */
+       else if (strnicmp(command, CMD_HAPD_MAC_FILTER, strlen(CMD_HAPD_MAC_FILTER)) == 0) {
+               int skip = strlen(CMD_HAPD_MAC_FILTER) + 1;
+               wl_android_set_mac_address_filter(net, (const char*)command+skip);
+       }
+       else if (strnicmp(command, CMD_SETROAMMODE, strlen(CMD_SETROAMMODE)) == 0)
+               bytes_written = wl_android_set_roam_mode(net, command, priv_cmd.total_len);
+#if defined(BCMFW_ROAM_ENABLE)
+       else if (strnicmp(command, CMD_SET_ROAMPREF, strlen(CMD_SET_ROAMPREF)) == 0) {
+               bytes_written = wl_android_set_roampref(net, command, priv_cmd.total_len);
+       }
+#endif /* BCMFW_ROAM_ENABLE */
+       else if (strnicmp(command, CMD_MIRACAST, strlen(CMD_MIRACAST)) == 0)
+               bytes_written = wl_android_set_miracast(net, command, priv_cmd.total_len);
+#ifdef WL11ULB
+       else if (strnicmp(command, CMD_ULB_MODE, strlen(CMD_ULB_MODE)) == 0)
+               bytes_written = wl_android_set_ulb_mode(net, command, priv_cmd.total_len);
+       else if (strnicmp(command, CMD_ULB_BW, strlen(CMD_ULB_BW)) == 0)
+               bytes_written = wl_android_set_ulb_bw(net, command, priv_cmd.total_len);
+#endif /* WL11ULB */
+       else if (strnicmp(command, CMD_SETIBSSBEACONOUIDATA, strlen(CMD_SETIBSSBEACONOUIDATA)) == 0)
+               bytes_written = wl_android_set_ibss_beacon_ouidata(net,
+               command, priv_cmd.total_len);
+       else if (strnicmp(command, CMD_KEEP_ALIVE, strlen(CMD_KEEP_ALIVE)) == 0) {
+               int skip = strlen(CMD_KEEP_ALIVE) + 1;
+               bytes_written = wl_keep_alive_set(net, command + skip, priv_cmd.total_len - skip);
+       }
+       else if (strnicmp(command, CMD_ROAM_OFFLOAD, strlen(CMD_ROAM_OFFLOAD)) == 0) {
+               int enable = *(command + strlen(CMD_ROAM_OFFLOAD) + 1) - '0';
+               bytes_written = wl_cfg80211_enable_roam_offload(net, enable);
+       }
+       else if (strnicmp(command, CMD_ROAM_OFFLOAD_APLIST, strlen(CMD_ROAM_OFFLOAD_APLIST)) == 0) {
+               bytes_written = wl_android_set_roam_offload_bssid_list(net,
+                       command + strlen(CMD_ROAM_OFFLOAD_APLIST) + 1);
+       }
+#if defined(WL_VIRTUAL_APSTA)
+       else if (strnicmp(command, CMD_INTERFACE_CREATE, strlen(CMD_INTERFACE_CREATE)) == 0) {
+               char *name = (command + strlen(CMD_INTERFACE_CREATE) +1);
+               WL_INFORM(("Creating %s interface\n", name));
+               bytes_written = wl_cfg80211_interface_create(net, name);
+       }
+       else if (strnicmp(command, CMD_INTERFACE_DELETE, strlen(CMD_INTERFACE_DELETE)) == 0) {
+               char *name = (command + strlen(CMD_INTERFACE_DELETE) +1);
+               WL_INFORM(("Deleteing %s interface\n", name));
+               bytes_written = wl_cfg80211_interface_delete(net, name);
+       }
+#endif /* defined (WL_VIRTUAL_APSTA) */
+#ifdef P2PRESP_WFDIE_SRC
+       else if (strnicmp(command, CMD_P2P_SET_WFDIE_RESP,
+               strlen(CMD_P2P_SET_WFDIE_RESP)) == 0) {
+               int mode = *(command + strlen(CMD_P2P_SET_WFDIE_RESP) + 1) - '0';
+               bytes_written = wl_android_set_wfdie_resp(net, mode);
+       } else if (strnicmp(command, CMD_P2P_GET_WFDIE_RESP,
+               strlen(CMD_P2P_GET_WFDIE_RESP)) == 0) {
+               bytes_written = wl_android_get_wfdie_resp(net, command, priv_cmd.total_len);
+       }
+#endif /* P2PRESP_WFDIE_SRC */
+       else if (strnicmp(command, CMD_DFS_AP_MOVE, strlen(CMD_DFS_AP_MOVE)) == 0) {
+               char *data = (command + strlen(CMD_DFS_AP_MOVE) +1);
+               bytes_written = wl_cfg80211_dfs_ap_move(net, data, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_WBTEXT_ENABLE, strlen(CMD_WBTEXT_ENABLE)) == 0) {
+               bytes_written = wl_android_wbtext(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_WBTEXT_PROFILE_CONFIG,
+                       strlen(CMD_WBTEXT_PROFILE_CONFIG)) == 0) {
+               char *data = (command + strlen(CMD_WBTEXT_PROFILE_CONFIG) + 1);
+               bytes_written = wl_cfg80211_wbtext_config(net, data, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_WBTEXT_WEIGHT_CONFIG,
+                       strlen(CMD_WBTEXT_WEIGHT_CONFIG)) == 0) {
+               char *data = (command + strlen(CMD_WBTEXT_WEIGHT_CONFIG) + 1);
+               bytes_written = wl_cfg80211_wbtext_weight_config(net, data,
+                               command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_WBTEXT_TABLE_CONFIG,
+                       strlen(CMD_WBTEXT_TABLE_CONFIG)) == 0) {
+               char *data = (command + strlen(CMD_WBTEXT_TABLE_CONFIG) + 1);
+               bytes_written = wl_cfg80211_wbtext_table_config(net, data,
+                               command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_WBTEXT_DELTA_CONFIG,
+                       strlen(CMD_WBTEXT_DELTA_CONFIG)) == 0) {
+               char *data = (command + strlen(CMD_WBTEXT_DELTA_CONFIG) + 1);
+               bytes_written = wl_cfg80211_wbtext_delta_config(net, data,
+                               command, priv_cmd.total_len);
+       }
+#ifdef SET_RPS_CPUS
+       else if (strnicmp(command, CMD_RPSMODE, strlen(CMD_RPSMODE)) == 0) {
+               bytes_written = wl_android_set_rps_cpus(net, command, priv_cmd.total_len);
+       }
+#endif /* SET_RPS_CPUS */
+#ifdef WLWFDS
+       else if (strnicmp(command, CMD_ADD_WFDS_HASH, strlen(CMD_ADD_WFDS_HASH)) == 0) {
+               bytes_written = wl_android_set_wfds_hash(net, command, priv_cmd.total_len, 1);
+       }
+       else if (strnicmp(command, CMD_DEL_WFDS_HASH, strlen(CMD_DEL_WFDS_HASH)) == 0) {
+               bytes_written = wl_android_set_wfds_hash(net, command, priv_cmd.total_len, 0);
+       }
+#endif /* WLWFDS */
+#ifdef BT_WIFI_HANDOVER
+       else if (strnicmp(command, CMD_TBOW_TEARDOWN, strlen(CMD_TBOW_TEARDOWN)) == 0) {
+           ret = wl_tbow_teardown(net, command, priv_cmd.total_len);
+       }
+#endif /* BT_WIFI_HANDOVER */
+#ifdef FCC_PWR_LIMIT_2G
+       else if (strnicmp(command, CMD_GET_FCC_PWR_LIMIT_2G,
+               strlen(CMD_GET_FCC_PWR_LIMIT_2G)) == 0) {
+               bytes_written = wl_android_get_fcc_pwr_limit_2g(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_SET_FCC_PWR_LIMIT_2G,
+               strlen(CMD_SET_FCC_PWR_LIMIT_2G)) == 0) {
+               bytes_written = wl_android_set_fcc_pwr_limit_2g(net, command, priv_cmd.total_len);
+       }
+#endif /* FCC_PWR_LIMIT_2G */
+       else if (strnicmp(command, CMD_MURX_BFE_CAP,
+                       strlen(CMD_MURX_BFE_CAP)) == 0) {
+               uint val = *(command + strlen(CMD_MURX_BFE_CAP) + 1) - '0';
+               bytes_written = wl_android_murx_bfe_cap(net, val);
+       }
+#if defined(DHD_ENABLE_BIGDATA_LOGGING)
+       else if (strnicmp(command, CMD_GET_BSS_INFO, strlen(CMD_GET_BSS_INFO)) == 0) {
+               bytes_written = wl_cfg80211_get_bss_info(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_GET_ASSOC_REJECT_INFO, strlen(CMD_GET_ASSOC_REJECT_INFO))
+                       == 0) {
+               bytes_written = wl_cfg80211_get_connect_failed_status(net, command,
+                               priv_cmd.total_len);
+       }
+#endif /* DHD_ENABLE_BIGDATA_LOGGING */
+#if defined(SUPPORT_RANDOM_MAC_SCAN)
+       else if (strnicmp(command, ENABLE_RANDOM_MAC, strlen(ENABLE_RANDOM_MAC)) == 0) {
+               bytes_written = wl_cfg80211_set_random_mac(net, TRUE);
+       } else if (strnicmp(command, DISABLE_RANDOM_MAC, strlen(DISABLE_RANDOM_MAC)) == 0) {
+               bytes_written = wl_cfg80211_set_random_mac(net, FALSE);
+       }
+#endif /* SUPPORT_RANDOM_MAC_SCAN */
+#ifdef DHD_LOG_DUMP
+       else if (strnicmp(command, CMD_NEW_DEBUG_PRINT_DUMP,
+               strlen(CMD_NEW_DEBUG_PRINT_DUMP)) == 0) {
+               dhd_pub_t *dhdp = wl_cfg80211_get_dhdp(net);
+#ifdef DHD_TRACE_WAKE_LOCK
+               dhd_wk_lock_stats_dump(dhdp);
+#endif /* DHD_TRACE_WAKE_LOCK */
+               dhd_schedule_log_dump(dhdp);
+#if defined(DHD_DEBUG) && defined(BCMPCIE) && defined(DHD_FW_COREDUMP)
+               dhdp->memdump_type = DUMP_TYPE_BY_SYSDUMP;
+               dhd_bus_mem_dump(dhdp);
+#endif /* DHD_DEBUG && BCMPCIE && DHD_FW_COREDUMP */
+       }
+#endif /* DHD_LOG_DUMP */
+#ifdef DHD_BANDSTEER
+       else if (strnicmp(command, CMD_BANDSTEER_ENABLE, strlen(CMD_BANDSTEER_ENABLE)) == 0) {
+               uint enable = *(command + strlen(CMD_BANDSTEER_ENABLE) + 1) - '0';
+               if (enable < 0 || enable > 1) {
+                       ret = BCME_UNSUPPORTED;
+                       goto exit;
+               }
+               if (enable) {
+                       bytes_written = dhd_bandsteer_module_init(net);
+               }
+               else {
+                       bytes_written = dhd_bandsteer_module_deinit(net);
+               }
+       } else if (strnicmp(command, CMD_BANDSTEER_TRIGGER, strlen(CMD_BANDSTEER_TRIGGER)) == 0) {
+               uint8 *p = command + strlen(CMD_BANDSTEER_TRIGGER)+1;
+               struct ether_addr ea;
+               char eabuf[ETHER_ADDR_STR_LEN];
+               bytes_written = 0;
+               ret = BCME_OK;
+
+               bzero((char *)eabuf, ETHER_ADDR_STR_LEN);
+               strncpy(eabuf, p, ETHER_ADDR_STR_LEN - 1);
+
+               if (!(ret = bcm_ether_atoe(eabuf, &ea))) {
+                       DHD_ERROR(("BANDSTEER: ERROR while parsing macaddr cmd %s - ignored\n",
+                                       command));
+                       goto exit;
+               }
+               dhd_bandsteer_trigger_bandsteer(net, ea.octet);
+       }
+#endif /* DHD_BANDSTEER */
+       else if (strnicmp(command, CMD_AP_ISOLATE, strlen(CMD_AP_ISOLATE)) == 0) {
+               bytes_written = wl_android_set_ap_isolate(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_MAXASSOC, strlen(CMD_MAXASSOC)) == 0) {
+               bytes_written = wl_android_set_maxassoc_limit(net, command, priv_cmd.total_len);
+       }
+       else if (strnicmp(command, CMD_CHANNEL_WIDTH, strlen(CMD_CHANNEL_WIDTH)) == 0) {
+               bytes_written = wl_android_set_channel_width(net, command, priv_cmd.total_len);
+       }
+       else {
+               DHD_ERROR(("Unknown PRIVATE command %s - ignored\n", command));
+               snprintf(command, 3, "OK");
+               bytes_written = strlen("OK");
+       }
+
+       if (bytes_written >= 0) {
+               if ((bytes_written == 0) && (priv_cmd.total_len > 0))
+                       command[0] = '\0';
+               if (bytes_written >= priv_cmd.total_len) {
+                       DHD_ERROR(("%s: err. bytes_written:%d >= buf_size:%d \n",
+                               __FUNCTION__, bytes_written, buf_size));
+                       ret = BCME_BUFTOOSHORT;
+                       goto exit;
+               }
+               bytes_written++;
+               priv_cmd.used_len = bytes_written;
+               if (copy_to_user(priv_cmd.buf, command, bytes_written)) {
+                       DHD_ERROR(("%s: failed to copy data to user buffer\n", __FUNCTION__));
+                       ret = -EFAULT;
+               }
+       }
+#ifdef CONNECTION_STATISTICS
+       else if (strnicmp(command, CMD_GET_CONNECTION_STATS,
+               strlen(CMD_GET_CONNECTION_STATS)) == 0) {
+               bytes_written = wl_android_get_connection_stats(net, command,
+                       priv_cmd.total_len);
+       }
+#endif
+       else {
+               ret = bytes_written;
+       }
+
+exit:
+       net_os_wake_unlock(net);
+       kfree(command);
+       return ret;
+}
+
+int wl_android_init(void)
+{
+       int ret = 0;
+
+#ifdef ENABLE_INSMOD_NO_FW_LOAD
+       dhd_download_fw_on_driverload = FALSE;
+#endif /* ENABLE_INSMOD_NO_FW_LOAD */
+       if (!iface_name[0]) {
+               memset(iface_name, 0, IFNAMSIZ);
+               bcm_strncpy_s(iface_name, IFNAMSIZ, "wlan", IFNAMSIZ);
+       }
+
+       wl_netlink_init();
+
+       return ret;
+}
+
+int wl_android_exit(void)
+{
+       int ret = 0;
+       struct io_cfg *cur, *q;
+
+       wl_netlink_deinit();
+
+       list_for_each_entry_safe(cur, q, &miracast_resume_list, list) {
+               list_del(&cur->list);
+               kfree(cur);
+       }
+
+       return ret;
+}
+
+void wl_android_post_init(void)
+{
+
+#ifdef ENABLE_4335BT_WAR
+       bcm_bt_unlock(lock_cookie_wifi);
+       printk("%s: btlock released\n", __FUNCTION__);
+#endif /* ENABLE_4335BT_WAR */
+
+       if (!dhd_download_fw_on_driverload)
+               g_wifi_on = FALSE;
+}
diff --git a/drivers/net/wireless/bcmdhd_1363/wl_android.h b/drivers/net/wireless/bcmdhd_1363/wl_android.h
new file mode 100644 (file)
index 0000000..1e25926
--- /dev/null
@@ -0,0 +1,80 @@
+/*
+ * Linux cfg80211 driver - Android related functions
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: wl_android.h 608194 2015-12-24 04:34:35Z $
+ */
+
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <wldev_common.h>
+
+/* If any feature uses the Generic Netlink Interface, put it here to enable WL_GENL
+ * automatically
+ */
+#if defined(BT_WIFI_HANDOVER) || defined(WL_NAN)
+#define WL_GENL
+#endif
+
+
+
+/**
+ * Android platform dependent functions, feel free to add Android specific functions here
+ * (save the macros in dhd). Please do NOT declare functions that are NOT exposed to dhd
+ * or cfg, define them as static in wl_android.c
+ */
+
+/**
+ * wl_android_init will be called from module init function (dhd_module_init now), similarly
+ * wl_android_exit will be called from module exit function (dhd_module_cleanup now)
+ */
+int wl_android_init(void);
+int wl_android_exit(void);
+void wl_android_post_init(void);
+int wl_android_wifi_on(struct net_device *dev);
+int wl_android_wifi_off(struct net_device *dev, bool on_failure);
+int wl_android_priv_cmd(struct net_device *net, struct ifreq *ifr, int cmd);
+
+s32 wl_netlink_send_msg(int pid, int type, int seq, void *data, size_t size);
+
+/* hostap mac mode */
+#define MACLIST_MODE_DISABLED   0
+#define MACLIST_MODE_DENY       1
+#define MACLIST_MODE_ALLOW      2
+
+/* max number of assoc list */
+#define MAX_NUM_OF_ASSOCLIST    64
+
+/* Bandwidth */
+#define WL_CH_BANDWIDTH_20MHZ 20
+#define WL_CH_BANDWIDTH_40MHZ 40
+#define WL_CH_BANDWIDTH_80MHZ 80
+/* max number of mac filter list
+ * restrict max number to 10 as maximum cmd string size is 255
+ */
+#define MAX_NUM_MAC_FILT        10
+
+int wl_android_set_ap_mac_list(struct net_device *dev, int macmode, struct maclist *maclist);
+int wl_android_set_roam_offload_bssid_list(struct net_device *dev, const char *cmd);
diff --git a/drivers/net/wireless/bcmdhd_1363/wl_cfg80211.c b/drivers/net/wireless/bcmdhd_1363/wl_cfg80211.c
new file mode 100644 (file)
index 0000000..f0836bd
--- /dev/null
@@ -0,0 +1,17869 @@
+/*
+ * Linux cfg80211 driver
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: wl_cfg80211.c 665077 2017-05-18 07:16:48Z $
+ */
+/* */
+#include <typedefs.h>
+#include <linuxver.h>
+#include <osl.h>
+#include <linux/kernel.h>
+
+#include <bcmutils.h>
+#include <bcmwifi_channels.h>
+#include <bcmendian.h>
+#include <proto/ethernet.h>
+#include <proto/802.11.h>
+#include <linux/if_arp.h>
+#include <asm/uaccess.h>
+
+#include <proto/ethernet.h>
+#include <linux/kernel.h>
+#include <linux/kthread.h>
+#include <linux/netdevice.h>
+#include <linux/sched.h>
+#include <linux/etherdevice.h>
+#include <linux/wireless.h>
+#include <linux/ieee80211.h>
+#include <linux/wait.h>
+#include <net/cfg80211.h>
+#include <net/rtnetlink.h>
+
+#include <wlioctl.h>
+#include <wldev_common.h>
+#include <wl_cfg80211.h>
+#include <wl_cfgp2p.h>
+#include <wl_android.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_linux.h>
+#include <dhdioctl.h>
+#include <wlioctl.h>
+#include <dhd_cfg80211.h>
+#include <dhd_bus.h>
+#ifdef PNO_SUPPORT
+#include <dhd_pno.h>
+#endif /* PNO_SUPPORT */
+
+#if defined(WL_VENDOR_EXT_SUPPORT)
+#include <wl_cfgvendor.h>
+#endif /* defined(WL_VENDOR_EXT_SUPPORT) */
+
+#ifdef WL_NAN
+#include <wl_cfgnan.h>
+#endif /* WL_NAN */
+
+#ifdef PROP_TXSTATUS
+#include <dhd_wlfc.h>
+#endif
+
+#ifdef BCMPCIE
+#include <dhd_flowring.h>
+#endif
+
+#ifdef DHD_BANDSTEER
+#include <dhd_bandsteer.h>
+#endif /* DHD_BANDSTEER */
+
+#ifdef WL11U
+#if !defined(WL_ENABLE_P2P_IF) && !defined(WL_CFG80211_P2P_DEV_IF)
+#error You should enable 'WL_ENABLE_P2P_IF' or 'WL_CFG80211_P2P_DEV_IF' \
+       according to Kernel version and is supported only in Android-JB
+#endif /* !WL_ENABLE_P2P_IF && !WL_CFG80211_P2P_DEV_IF */
+#endif /* WL11U */
+
+#ifdef BCMWAPI_WPI
+/* these items should evetually go into wireless.h of the linux system headfile dir */
+#ifndef IW_ENCODE_ALG_SM4
+#define IW_ENCODE_ALG_SM4 0x20
+#endif
+
+#ifndef IW_AUTH_WAPI_ENABLED
+#define IW_AUTH_WAPI_ENABLED 0x20
+#endif
+
+#ifndef IW_AUTH_WAPI_VERSION_1
+#define IW_AUTH_WAPI_VERSION_1  0x00000008
+#endif
+
+#ifndef IW_AUTH_CIPHER_SMS4
+#define IW_AUTH_CIPHER_SMS4     0x00000020
+#endif
+
+#ifndef IW_AUTH_KEY_MGMT_WAPI_PSK
+#define IW_AUTH_KEY_MGMT_WAPI_PSK 4
+#endif
+
+#ifndef IW_AUTH_KEY_MGMT_WAPI_CERT
+#define IW_AUTH_KEY_MGMT_WAPI_CERT 8
+#endif
+
+/*
+ * Defined new macro for WAPI cipher suite to map the corresponding value from
+ * supplicant, since kernel's value of WLAN_CIPHER_SUITE_SMS4 varies for different
+ * kernel versions
+ */
+#define WLAN_DHD_CIPHER_SUITE_SMS4     0x000FAC07
+/*
+ * Defined new macro for WAPI akm suite to map the corresponding value from
+ * supplicant, since corresponding macro does not exist in kernel
+ */
+#define WLAN_DHD_AKM_SUITE_WAPI_PSK    0x000FAC04
+#endif /* BCMWAPI_WPI */
+
+#ifdef BCMWAPI_WPI
+#define IW_WSEC_ENABLED(wsec)   ((wsec) & (WEP_ENABLED | TKIP_ENABLED | AES_ENABLED | SMS4_ENABLED))
+#else /* BCMWAPI_WPI */
+#define IW_WSEC_ENABLED(wsec)   ((wsec) & (WEP_ENABLED | TKIP_ENABLED | AES_ENABLED))
+#endif /* BCMWAPI_WPI */
+
+static struct device *cfg80211_parent_dev = NULL;
+#ifdef CUSTOMER_HW4_DEBUG
+u32 wl_dbg_level = WL_DBG_ERR | WL_DBG_P2P_ACTION;
+#else
+u32 wl_dbg_level = WL_DBG_ERR;
+#endif /* CUSTOMER_HW4_DEBUG */
+
+#define MAX_WAIT_TIME 1500
+#ifdef WLAIBSS_MCHAN
+#define IBSS_IF_NAME "ibss%d"
+#endif /* WLAIBSS_MCHAN */
+
+#ifdef VSDB
+/* sleep time to keep STA's connecting or connection for continuous af tx or finding a peer */
+#define DEFAULT_SLEEP_TIME_VSDB                120
+#define OFF_CHAN_TIME_THRESHOLD_MS     200
+#define AF_RETRY_DELAY_TIME                    40
+
+/* if sta is connected or connecting, sleep for a while before retry af tx or finding a peer */
+#define WL_AF_TX_KEEP_PRI_CONNECTION_VSDB(cfg) \
+       do {    \
+               if (wl_get_drv_status(cfg, CONNECTED, bcmcfg_to_prmry_ndev(cfg)) ||     \
+                       wl_get_drv_status(cfg, CONNECTING, bcmcfg_to_prmry_ndev(cfg))) {        \
+                       OSL_SLEEP(DEFAULT_SLEEP_TIME_VSDB);                     \
+               }       \
+       } while (0)
+#else /* VSDB */
+/* if not VSDB, do nothing */
+#define WL_AF_TX_KEEP_PRI_CONNECTION_VSDB(cfg)
+#endif /* VSDB */
+
+#ifdef WL_CFG80211_SYNC_GON
+#define WL_DRV_STATUS_SENDING_AF_FRM_EXT(cfg) \
+       (wl_get_drv_status_all(cfg, SENDING_ACT_FRM) || \
+               wl_get_drv_status_all(cfg, WAITING_NEXT_ACT_FRM_LISTEN))
+#else
+#define WL_DRV_STATUS_SENDING_AF_FRM_EXT(cfg) wl_get_drv_status_all(cfg, SENDING_ACT_FRM)
+#endif /* WL_CFG80211_SYNC_GON */
+
+#define DNGL_FUNC(func, parameters) func parameters
+#define COEX_DHCP
+
+#define WLAN_EID_SSID  0
+#define CH_MIN_5G_CHANNEL 34
+#define CH_MIN_2G_CHANNEL 1
+#define ACTIVE_SCAN 1
+#define PASSIVE_SCAN 0
+
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+#define BCM_SET_LIST_FIRST_ENTRY(entry, ptr, type, member) \
+_Pragma("GCC diagnostic push") \
+_Pragma("GCC diagnostic ignored \"-Wcast-qual\"") \
+(entry) = list_first_entry((ptr), type, member); \
+_Pragma("GCC diagnostic pop") \
+
+#define BCM_SET_CONTAINER_OF(entry, ptr, type, member) \
+_Pragma("GCC diagnostic push") \
+_Pragma("GCC diagnostic ignored \"-Wcast-qual\"") \
+entry = container_of((ptr), type, member); \
+_Pragma("GCC diagnostic pop") \
+
+#else
+#define BCM_SET_LIST_FIRST_ENTRY(entry, ptr, type, member) \
+(entry) = list_first_entry((ptr), type, member); \
+
+#define BCM_SET_CONTAINER_OF(entry, ptr, type, member) \
+entry = container_of((ptr), type, member); \
+
+#endif /* STRICT_GCC_WARNINGS */
+
+enum rmc_event_type {
+       RMC_EVENT_NONE,
+       RMC_EVENT_LEADER_CHECK_FAIL
+};
+
+/* This is to override regulatory domains defined in cfg80211 module (reg.c)
+ * By default world regulatory domain defined in reg.c puts the flags NL80211_RRF_PASSIVE_SCAN
+ * and NL80211_RRF_NO_IBSS for 5GHz channels (for 36..48 and 149..165).
+ * With respect to these flags, wpa_supplicant doesn't start p2p operations on 5GHz channels.
+ * All the chnages in world regulatory domain are to be done here.
+ *
+ * this definition reuires disabling missing-field-initializer warning
+ * as the ieee80211_regdomain definition differs in plain linux and in Android
+ */
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+_Pragma("GCC diagnostic push")
+_Pragma("GCC diagnostic ignored \"-Wmissing-field-initializers\"")
+#endif
+static const struct ieee80211_regdomain brcm_regdom = {
+       .n_reg_rules = 4,
+       .alpha2 =  "99",
+       .reg_rules = {
+               /* IEEE 802.11b/g, channels 1..11 */
+               REG_RULE(2412-10, 2472+10, 40, 6, 20, 0),
+               /* If any */
+               /* IEEE 802.11 channel 14 - Only JP enables
+                * this and for 802.11b only
+                */
+               REG_RULE(2484-10, 2484+10, 20, 6, 20, 0),
+               /* IEEE 802.11a, channel 36..64 */
+               REG_RULE(5150-10, 5350+10, 40, 6, 20, 0),
+               /* IEEE 802.11a, channel 100..165 */
+               REG_RULE(5470-10, 5850+10, 40, 6, 20, 0), }
+};
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+_Pragma("GCC diagnostic pop")
+#endif
+
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)) && \
+       (defined(WL_IFACE_COMB_NUM_CHANNELS) || defined(WL_CFG80211_P2P_DEV_IF))
+static const struct ieee80211_iface_limit common_if_limits[] = {
+       {
+       /*
+        * Driver can support up to 2 AP's
+        */
+       .max = 2,
+       .types = BIT(NL80211_IFTYPE_AP),
+       },
+       {
+       /*
+        * During P2P-GO removal, P2P-GO is first changed to STA and later only
+        * removed. So setting maximum possible number of STA interfaces according
+        * to kernel version.
+        *
+        * less than linux-3.8 - max:3 (wlan0 + p2p0 + group removal of p2p-p2p0-x)
+        * linux-3.8 and above - max:2 (wlan0 + group removal of p2p-wlan0-x)
+        */
+#ifdef WL_ENABLE_P2P_IF
+       .max = 3,
+#else
+       .max = 2,
+#endif /* WL_ENABLE_P2P_IF */
+       .types = BIT(NL80211_IFTYPE_STATION),
+       },
+       {
+       .max = 2,
+       .types = BIT(NL80211_IFTYPE_P2P_GO) | BIT(NL80211_IFTYPE_P2P_CLIENT),
+       },
+#if defined(WL_CFG80211_P2P_DEV_IF)
+       {
+       .max = 1,
+       .types = BIT(NL80211_IFTYPE_P2P_DEVICE),
+       },
+#endif /* WL_CFG80211_P2P_DEV_IF */
+       {
+       .max = 1,
+       .types = BIT(NL80211_IFTYPE_ADHOC),
+       },
+};
+#ifdef BCM4330_CHIP
+#define NUM_DIFF_CHANNELS 1
+#else
+#define NUM_DIFF_CHANNELS 2
+#endif
+static const struct ieee80211_iface_combination
+common_iface_combinations[] = {
+       {
+       .num_different_channels = NUM_DIFF_CHANNELS,
+       /*
+        * max_interfaces = 4
+        * The max no of interfaces will be used in dual p2p case.
+        * {STA, P2P Device, P2P Group 1, P2P Group 2}. Though we
+        * will not be using the STA functionality in this case, it
+        * will remain registered as it is the primary interface.
+        */
+       .max_interfaces = 4,
+       .limits = common_if_limits,
+       .n_limits = ARRAY_SIZE(common_if_limits),
+       },
+};
+#endif /* LINUX_VER >= 3.0 && (WL_IFACE_COMB_NUM_CHANNELS || WL_CFG80211_P2P_DEV_IF) */
+
+/* Data Element Definitions */
+#define WPS_ID_CONFIG_METHODS     0x1008
+#define WPS_ID_REQ_TYPE           0x103A
+#define WPS_ID_DEVICE_NAME        0x1011
+#define WPS_ID_VERSION            0x104A
+#define WPS_ID_DEVICE_PWD_ID      0x1012
+#define WPS_ID_REQ_DEV_TYPE       0x106A
+#define WPS_ID_SELECTED_REGISTRAR_CONFIG_METHODS 0x1053
+#define WPS_ID_PRIM_DEV_TYPE      0x1054
+
+/* Device Password ID */
+#define DEV_PW_DEFAULT 0x0000
+#define DEV_PW_USER_SPECIFIED 0x0001,
+#define DEV_PW_MACHINE_SPECIFIED 0x0002
+#define DEV_PW_REKEY 0x0003
+#define DEV_PW_PUSHBUTTON 0x0004
+#define DEV_PW_REGISTRAR_SPECIFIED 0x0005
+
+/* Config Methods */
+#define WPS_CONFIG_USBA 0x0001
+#define WPS_CONFIG_ETHERNET 0x0002
+#define WPS_CONFIG_LABEL 0x0004
+#define WPS_CONFIG_DISPLAY 0x0008
+#define WPS_CONFIG_EXT_NFC_TOKEN 0x0010
+#define WPS_CONFIG_INT_NFC_TOKEN 0x0020
+#define WPS_CONFIG_NFC_INTERFACE 0x0040
+#define WPS_CONFIG_PUSHBUTTON 0x0080
+#define WPS_CONFIG_KEYPAD 0x0100
+#define WPS_CONFIG_VIRT_PUSHBUTTON 0x0280
+#define WPS_CONFIG_PHY_PUSHBUTTON 0x0480
+#define WPS_CONFIG_VIRT_DISPLAY 0x2008
+#define WPS_CONFIG_PHY_DISPLAY 0x4008
+
+#define PM_BLOCK 1
+#define PM_ENABLE 0
+
+
+#define WL_AKM_SUITE_SHA256_1X  0x000FAC05
+#define WL_AKM_SUITE_SHA256_PSK 0x000FAC06
+
+#ifndef IBSS_COALESCE_ALLOWED
+#define IBSS_COALESCE_ALLOWED 0
+#endif
+
+#ifndef IBSS_INITIAL_SCAN_ALLOWED
+#define IBSS_INITIAL_SCAN_ALLOWED 0
+#endif
+
+#define CUSTOM_RETRY_MASK 0xff000000 /* Mask for retry counter of custom dwell time */
+#define LONG_LISTEN_TIME 2000
+
+#define MAX_SCAN_ABORT_WAIT_CNT 20
+#define WAIT_SCAN_ABORT_OSL_SLEEP_TIME 10
+
+#define IDSUP_4WAY_HANDSHAKE_TIMEOUT   10000
+enum idsup_event_type {
+       IDSUP_EVENT_SUCCESS = 0,
+       IDSUP_EVENT_4WAY_HANDSHAKE_TIMEOUT
+};
+/*
+ * cfg80211_ops api/callback list
+ */
+static s32 wl_frame_get_mgmt(u16 fc, const struct ether_addr *da,
+       const struct ether_addr *sa, const struct ether_addr *bssid,
+       u8 **pheader, u32 *body_len, u8 *pbody);
+static s32 __wl_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
+       struct cfg80211_scan_request *request,
+       struct cfg80211_ssid *this_ssid);
+#if defined(WL_CFG80211_P2P_DEV_IF)
+static s32
+wl_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request);
+#else
+static s32
+wl_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
+       struct cfg80211_scan_request *request);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+static s32 wl_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed);
+#ifdef WLAIBSS_MCHAN
+static bcm_struct_cfgdev* bcm_cfg80211_add_ibss_if(struct wiphy *wiphy, char *name);
+static s32 bcm_cfg80211_del_ibss_if(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev);
+#endif /* WLAIBSS_MCHAN */
+static s32 wl_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
+       struct cfg80211_ibss_params *params);
+static s32 wl_cfg80211_leave_ibss(struct wiphy *wiphy,
+       struct net_device *dev);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 16, 0))
+static s32 wl_cfg80211_get_station(struct wiphy *wiphy,
+       struct net_device *dev, const u8 *mac,
+       struct station_info *sinfo);
+#else
+static s32 wl_cfg80211_get_station(struct wiphy *wiphy,
+       struct net_device *dev, u8 *mac,
+       struct station_info *sinfo);
+#endif
+static s32 wl_cfg80211_set_power_mgmt(struct wiphy *wiphy,
+       struct net_device *dev, bool enabled,
+       s32 timeout);
+static int wl_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
+       struct cfg80211_connect_params *sme);
+static s32 wl_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *dev,
+       u16 reason_code);
+#if defined(WL_CFG80211_P2P_DEV_IF)
+static s32
+wl_cfg80211_set_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
+       enum nl80211_tx_power_setting type, s32 mbm);
+#else
+static s32
+wl_cfg80211_set_tx_power(struct wiphy *wiphy,
+       enum nl80211_tx_power_setting type, s32 dbm);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+#if defined(WL_CFG80211_P2P_DEV_IF)
+static s32 wl_cfg80211_get_tx_power(struct wiphy *wiphy,
+       struct wireless_dev *wdev, s32 *dbm);
+#else
+static s32 wl_cfg80211_get_tx_power(struct wiphy *wiphy, s32 *dbm);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+static s32 wl_cfg80211_config_default_key(struct wiphy *wiphy,
+       struct net_device *dev,
+       u8 key_idx, bool unicast, bool multicast);
+static s32 wl_cfg80211_add_key(struct wiphy *wiphy, struct net_device *dev,
+       u8 key_idx, bool pairwise, const u8 *mac_addr,
+       struct key_params *params);
+static s32 wl_cfg80211_del_key(struct wiphy *wiphy, struct net_device *dev,
+       u8 key_idx, bool pairwise, const u8 *mac_addr);
+static s32 wl_cfg80211_get_key(struct wiphy *wiphy, struct net_device *dev,
+       u8 key_idx, bool pairwise, const u8 *mac_addr,
+       void *cookie, void (*callback) (void *cookie,
+       struct key_params *params));
+static s32 wl_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
+       struct net_device *dev, u8 key_idx);
+static s32 wl_cfg80211_resume(struct wiphy *wiphy);
+#if defined(WL_SUPPORT_BACKPORTED_KPATCHES) || (LINUX_VERSION_CODE >= KERNEL_VERSION(3, \
+       2, 0))
+static s32 wl_cfg80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
+       bcm_struct_cfgdev *cfgdev, u64 cookie);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0))
+static s32 wl_cfg80211_del_station(
+               struct wiphy *wiphy, struct net_device *ndev,
+               struct station_del_parameters *params);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 16, 0))
+static s32 wl_cfg80211_del_station(struct wiphy *wiphy,
+       struct net_device *ndev, const u8* mac_addr);
+#else
+static s32 wl_cfg80211_del_station(struct wiphy *wiphy,
+       struct net_device *ndev, u8* mac_addr);
+#endif
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 16, 0))
+static s32 wl_cfg80211_change_station(struct wiphy *wiphy,
+       struct net_device *dev, const u8 *mac, struct station_parameters *params);
+#else
+static s32 wl_cfg80211_change_station(struct wiphy *wiphy,
+       struct net_device *dev, u8 *mac, struct station_parameters *params);
+#endif
+#endif /* WL_SUPPORT_BACKPORTED_KPATCHES || KERNEL_VER >= KERNEL_VERSION(3, 2, 0)) */
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)) || defined(WL_COMPAT_WIRELESS)
+static s32 wl_cfg80211_suspend(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
+#else
+static s32 wl_cfg80211_suspend(struct wiphy *wiphy);
+#endif /* KERNEL_VERSION(2, 6, 39) || WL_COMPAT_WIRELES */
+static s32 wl_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *dev,
+       struct cfg80211_pmksa *pmksa);
+static s32 wl_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *dev,
+       struct cfg80211_pmksa *pmksa);
+static s32 wl_cfg80211_flush_pmksa(struct wiphy *wiphy,
+       struct net_device *dev);
+static void wl_cfg80211_scan_abort(struct bcm_cfg80211 *cfg);
+static void wl_cfg80211_cancel_scan(struct bcm_cfg80211 *cfg);
+static s32 wl_notify_escan_complete(struct bcm_cfg80211 *cfg,
+       struct net_device *ndev, bool aborted, bool fw_abort);
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 2, 0)) || defined(WL_COMPAT_WIRELESS)
+#if (defined(CONFIG_ARCH_MSM) && defined(TDLS_MGMT_VERSION2)) || (LINUX_VERSION_CODE < \
+       KERNEL_VERSION(3, 16, 0) && LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0))
+static s32 wl_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+       u8 *peer, u8 action_code, u8 dialog_token, u16 status_code,
+       u32 peer_capability, const u8 *data, size_t len);
+#elif ((LINUX_VERSION_CODE >= KERNEL_VERSION(3, 16, 0)) && \
+               (LINUX_VERSION_CODE < KERNEL_VERSION(3, 18, 0)))
+static s32 wl_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+       const u8 *peer, u8 action_code, u8 dialog_token, u16 status_code,
+       u32 peer_capability, const u8 *data, size_t len);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
+static s32 wl_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+       const u8 *peer, u8 action_code, u8 dialog_token, u16 status_code,
+       u32 peer_capability, bool initiator, const u8 *data, size_t len);
+#else
+static s32 wl_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+       u8 *peer, u8 action_code, u8 dialog_token, u16 status_code, const u8 *data,
+       size_t len);
+#endif /* CONFIG_ARCH_MSM && TDLS_MGMT_VERSION2 */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 16, 0))
+static s32 wl_cfg80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
+       const u8 *peer, enum nl80211_tdls_operation oper);
+#else
+static s32 wl_cfg80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
+       u8 *peer, enum nl80211_tdls_operation oper);
+#endif
+#endif /* LINUX_VERSION > KERNEL_VERSION(3,2,0) || WL_COMPAT_WIRELESS */
+#ifdef WL_SCHED_SCAN
+static int wl_cfg80211_sched_scan_stop(struct wiphy *wiphy, struct net_device *dev);
+#endif
+#if defined(WL_VIRTUAL_APSTA) || defined(DUAL_STA_STATIC_IF)
+bcm_struct_cfgdev*
+wl_cfg80211_create_iface(struct wiphy *wiphy, enum nl80211_iftype
+                iface_type, u8 *mac_addr, const char *name);
+s32
+wl_cfg80211_del_iface(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev);
+#endif /* defined(WL_VIRTUAL_APSTA) || defined(DUAL_STA_STATIC_IF) */
+
+s32 wl_cfg80211_interface_ops(struct bcm_cfg80211 *cfg,
+       struct net_device *ndev, s32 bsscfg_idx,
+       enum nl80211_iftype iface_type, s32 del, u8 *addr);
+s32 wl_cfg80211_add_del_bss(struct bcm_cfg80211 *cfg,
+       struct net_device *ndev, s32 bsscfg_idx,
+       enum nl80211_iftype iface_type, s32 del, u8 *addr);
+chanspec_t wl_chspec_driver_to_host(chanspec_t chanspec);
+chanspec_t wl_chspec_host_to_driver(chanspec_t chanspec);
+#ifdef WL11ULB
+static s32 wl_cfg80211_get_ulb_bw(struct wireless_dev *wdev);
+static chanspec_t wl_cfg80211_ulb_get_min_bw_chspec(struct wireless_dev *wdev, s32 bssidx);
+static s32 wl_cfg80211_ulbbw_to_ulbchspec(u32 ulb_bw);
+#else
+static inline chanspec_t wl_cfg80211_ulb_get_min_bw_chspec(
+               struct wireless_dev *wdev, s32 bssidx)
+{
+       return WL_CHANSPEC_BW_20;
+}
+#endif /* WL11ULB */
+
+/*
+ * event & event Q handlers for cfg80211 interfaces
+ */
+static s32 wl_create_event_handler(struct bcm_cfg80211 *cfg);
+static void wl_destroy_event_handler(struct bcm_cfg80211 *cfg);
+static void wl_event_handler(struct work_struct *work_data);
+static void wl_init_eq(struct bcm_cfg80211 *cfg);
+static void wl_flush_eq(struct bcm_cfg80211 *cfg);
+static unsigned long wl_lock_eq(struct bcm_cfg80211 *cfg);
+static void wl_unlock_eq(struct bcm_cfg80211 *cfg, unsigned long flags);
+static void wl_init_eq_lock(struct bcm_cfg80211 *cfg);
+static void wl_init_event_handler(struct bcm_cfg80211 *cfg);
+static struct wl_event_q *wl_deq_event(struct bcm_cfg80211 *cfg);
+static s32 wl_enq_event(struct bcm_cfg80211 *cfg, struct net_device *ndev, u32 type,
+       const wl_event_msg_t *msg, void *data);
+static void wl_put_event(struct wl_event_q *e);
+static s32 wl_notify_connect_status_ap(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *e, void *data);
+static s32 wl_notify_connect_status(struct bcm_cfg80211 *cfg,
+       bcm_struct_cfgdev *cfgdev, const wl_event_msg_t *e, void *data);
+static s32 wl_notify_roaming_status(struct bcm_cfg80211 *cfg,
+       bcm_struct_cfgdev *cfgdev, const wl_event_msg_t *e, void *data);
+static s32 wl_notify_scan_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data);
+static s32 wl_bss_connect_done(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *e, void *data, bool completed);
+static s32 wl_bss_roaming_done(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *e, void *data);
+static s32 wl_notify_mic_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data);
+#ifdef BT_WIFI_HANDOVER
+static s32 wl_notify_bt_wifi_handover_req(struct bcm_cfg80211 *cfg,
+       bcm_struct_cfgdev *cfgdev, const wl_event_msg_t *e, void *data);
+#endif /* BT_WIFI_HANDOVER */
+#ifdef WL_SCHED_SCAN
+static s32
+wl_notify_sched_scan_results(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *e, void *data);
+#endif /* WL_SCHED_SCAN */
+#ifdef PNO_SUPPORT
+static s32 wl_notify_pfn_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data);
+#endif /* PNO_SUPPORT */
+#ifdef GSCAN_SUPPORT
+static s32 wl_notify_gscan_event(struct bcm_cfg80211 *wl, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data);
+#endif /* GSCAN_SUPPORT */
+static s32 wl_notifier_change_state(struct bcm_cfg80211 *cfg, struct net_info *_net_info,
+       enum wl_status state, bool set);
+#ifdef DHD_LOSSLESS_ROAMING
+static s32 wl_notify_roam_prep_status(struct bcm_cfg80211 *cfg,
+       bcm_struct_cfgdev *cfgdev, const wl_event_msg_t *e, void *data);
+static void wl_del_roam_timeout(struct bcm_cfg80211 *cfg);
+#endif /* DHD_LOSSLESS_ROAMING */
+#ifdef CUSTOM_EVENT_PM_WAKE
+static s32 wl_check_pmstatus(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data);
+#endif /* CUSTOM_EVENT_PM_WAKE */
+#ifdef ENABLE_TEMP_THROTTLING
+static s32 wl_check_rx_throttle_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data);
+#endif /* ENABLE_TEMP_THROTTLING */
+
+#ifdef WLTDLS
+static s32 wl_tdls_event_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data);
+#endif /* WLTDLS */
+/*
+ * register/deregister parent device
+ */
+static void wl_cfg80211_clear_parent_dev(void);
+/*
+ * ioctl utilites
+ */
+
+/*
+ * cfg80211 set_wiphy_params utilities
+ */
+static s32 wl_set_frag(struct net_device *dev, u32 frag_threshold);
+static s32 wl_set_rts(struct net_device *dev, u32 frag_threshold);
+static s32 wl_set_retry(struct net_device *dev, u32 retry, bool l);
+
+/*
+ * cfg profile utilities
+ */
+static s32 wl_update_prof(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *e, const void *data, s32 item);
+static void *wl_read_prof(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32 item);
+static void wl_init_prof(struct bcm_cfg80211 *cfg, struct net_device *ndev);
+
+/*
+ * cfg80211 connect utilites
+ */
+static s32 wl_set_wpa_version(struct net_device *dev,
+       struct cfg80211_connect_params *sme);
+static s32 wl_set_auth_type(struct net_device *dev,
+       struct cfg80211_connect_params *sme);
+static s32 wl_set_set_cipher(struct net_device *dev,
+       struct cfg80211_connect_params *sme);
+static s32 wl_set_key_mgmt(struct net_device *dev,
+       struct cfg80211_connect_params *sme);
+static s32 wl_set_set_sharedkey(struct net_device *dev,
+       struct cfg80211_connect_params *sme);
+#ifdef BCMWAPI_WPI
+static s32 wl_set_set_wapi_ie(struct net_device *dev,
+        struct cfg80211_connect_params *sme);
+#endif
+static s32 wl_get_assoc_ies(struct bcm_cfg80211 *cfg, struct net_device *ndev);
+static s32 wl_ch_to_chanspec(struct net_device *dev, int ch,
+       struct wl_join_params *join_params, size_t *join_params_size);
+void wl_cfg80211_clear_security(struct bcm_cfg80211 *cfg);
+
+#if (defined(AP_STA_RSDB_FEASIBILITY_CHK) && (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, \
+       0)))
+#error "enable AP_STA_RSDB_FEASIBILITY_CHK for linux version >= 3.6.0"
+#endif /* AP_STA_RSDB_FEASIBILITY_CHK && LINUX_VERSION < KERNEL_VERSION(3, 6, 0) */
+#ifdef AP_STA_RSDB_FEASIBILITY_CHK
+static bool wl_cfg80211_chk_conn_feasibility(struct bcm_cfg80211 *cfg,
+       struct ieee80211_channel *chan);
+#endif /* AP_STA_RSDB_FEASIBILITY_CHK */
+
+/*
+ * information element utilities
+ */
+static void wl_rst_ie(struct bcm_cfg80211 *cfg);
+static __used s32 wl_add_ie(struct bcm_cfg80211 *cfg, u8 t, u8 l, u8 *v);
+static void wl_update_hidden_ap_ie(struct wl_bss_info *bi, const u8 *ie_stream, u32 *ie_size,
+       bool roam);
+static s32 wl_mrg_ie(struct bcm_cfg80211 *cfg, u8 *ie_stream, u16 ie_size);
+static s32 wl_cp_ie(struct bcm_cfg80211 *cfg, u8 *dst, u16 dst_size);
+static u32 wl_get_ielen(struct bcm_cfg80211 *cfg);
+
+#ifdef WL11U
+bcm_tlv_t *
+wl_cfg80211_find_interworking_ie(u8 *parse, u32 len);
+static s32
+wl_cfg80211_add_iw_ie(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32 bssidx, s32 pktflag,
+            uint8 ie_id, uint8 *data, uint8 data_len);
+#endif /* WL11U */
+
+static s32 wl_setup_wiphy(struct wireless_dev *wdev, struct device *dev, void *data);
+static void wl_free_wdev(struct bcm_cfg80211 *cfg);
+#ifdef CONFIG_CFG80211_INTERNAL_REGDB
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 9, 0))
+static int
+#else
+static void
+#endif /* kernel version < 3.10.11 */
+wl_cfg80211_reg_notifier(struct wiphy *wiphy, struct regulatory_request *request);
+#endif /* CONFIG_CFG80211_INTERNAL_REGDB */
+
+static s32 wl_inform_bss(struct bcm_cfg80211 *cfg);
+static s32 wl_inform_single_bss(struct bcm_cfg80211 *cfg, struct wl_bss_info *bi, bool roam);
+static s32 wl_update_bss_info(struct bcm_cfg80211 *cfg, struct net_device *ndev, bool roam);
+static chanspec_t wl_cfg80211_get_shared_freq(struct wiphy *wiphy);
+s32 wl_cfg80211_channel_to_freq(u32 channel);
+
+
+static void wl_cfg80211_work_handler(struct work_struct *work);
+static s32 wl_add_keyext(struct wiphy *wiphy, struct net_device *dev,
+       u8 key_idx, const u8 *mac_addr,
+       struct key_params *params);
+/*
+ * key indianess swap utilities
+ */
+static void swap_key_from_BE(struct wl_wsec_key *key);
+static void swap_key_to_BE(struct wl_wsec_key *key);
+
+/*
+ * bcm_cfg80211 memory init/deinit utilities
+ */
+static s32 wl_init_priv_mem(struct bcm_cfg80211 *cfg);
+static void wl_deinit_priv_mem(struct bcm_cfg80211 *cfg);
+
+static void wl_delay(u32 ms);
+
+/*
+ * ibss mode utilities
+ */
+static bool wl_is_ibssmode(struct bcm_cfg80211 *cfg, struct net_device *ndev);
+static __used bool wl_is_ibssstarter(struct bcm_cfg80211 *cfg);
+
+/*
+ * link up/down , default configuration utilities
+ */
+static s32 __wl_cfg80211_up(struct bcm_cfg80211 *cfg);
+static s32 __wl_cfg80211_down(struct bcm_cfg80211 *cfg);
+static bool wl_is_linkdown(struct bcm_cfg80211 *cfg, const wl_event_msg_t *e);
+static bool wl_is_linkup(struct bcm_cfg80211 *cfg, const wl_event_msg_t *e,
+       struct net_device *ndev);
+static bool wl_is_nonetwork(struct bcm_cfg80211 *cfg, const wl_event_msg_t *e);
+static void wl_link_up(struct bcm_cfg80211 *cfg);
+static void wl_link_down(struct bcm_cfg80211 *cfg);
+static s32 wl_config_ifmode(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32 iftype);
+static void wl_init_conf(struct wl_conf *conf);
+static s32 wl_cfg80211_handle_ifdel(struct bcm_cfg80211 *cfg, wl_if_event_info *if_event_info,
+       struct net_device* ndev);
+
+int wl_cfg80211_get_ioctl_version(void);
+
+/*
+ * find most significant bit set
+ */
+static __used u32 wl_find_msb(u16 bit16);
+
+/*
+ * rfkill support
+ */
+static int wl_setup_rfkill(struct bcm_cfg80211 *cfg, bool setup);
+static int wl_rfkill_set(void *data, bool blocked);
+#ifdef DEBUGFS_CFG80211
+static s32 wl_setup_debugfs(struct bcm_cfg80211 *cfg);
+static s32 wl_free_debugfs(struct bcm_cfg80211 *cfg);
+#endif
+
+static wl_scan_params_t *wl_cfg80211_scan_alloc_params(struct wireless_dev *wdev, int channel,
+       int nprobes, int *out_params_size);
+static bool check_dev_role_integrity(struct bcm_cfg80211 *cfg, u32 dev_role);
+
+#ifdef WL_CFG80211_ACL
+/* ACL */
+static int wl_cfg80211_set_mac_acl(struct wiphy *wiphy, struct net_device *cfgdev,
+       const struct cfg80211_acl_data *acl);
+#endif /* WL_CFG80211_ACL */
+
+/*
+ * Some external functions, TODO: move them to dhd_linux.h
+ */
+int dhd_add_monitor(char *name, struct net_device **new_ndev);
+int dhd_del_monitor(struct net_device *ndev);
+int dhd_monitor_init(void *dhd_pub);
+int dhd_monitor_uninit(void);
+int dhd_start_xmit(struct sk_buff *skb, struct net_device *net);
+
+
+#ifdef DHD_IFDEBUG
+void wl_dump_ifinfo(struct bcm_cfg80211 *cfg);
+#endif
+
+#ifdef P2P_LISTEN_OFFLOADING
+s32 wl_cfg80211_p2plo_deinit(struct bcm_cfg80211 *cfg);
+#endif /* P2P_LISTEN_OFFLOADING */
+
+#ifdef PKT_FILTER_SUPPORT
+extern uint dhd_pkt_filter_enable;
+extern uint dhd_master_mode;
+extern void dhd_pktfilter_offload_enable(dhd_pub_t * dhd, char *arg, int enable, int master_mode);
+#endif /* PKT_FILTER_SUPPORT */
+
+static int wl_cfg80211_delayed_roam(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const struct ether_addr *bssid);
+
+static int bw2cap[] = { 0, 0, WLC_BW_CAP_20MHZ, WLC_BW_CAP_40MHZ, WLC_BW_CAP_80MHZ,
+       WLC_BW_CAP_160MHZ, WLC_BW_CAP_160MHZ };
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 2, 0))
+#define CFG80211_DISCONNECTED(dev, reason, ie, len, loc_gen, gfp) \
+       cfg80211_disconnected(dev, reason, ie, len, gfp);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0))
+#define CFG80211_DISCONNECTED(dev, reason, ie, len, loc_gen, gfp) \
+       cfg80211_disconnected(dev, reason, ie, len, loc_gen, gfp);
+#endif
+
+#ifdef RSSI_OFFSET
+static s32 wl_rssi_offset(s32 rssi)
+{
+       rssi += RSSI_OFFSET;
+       if (rssi > 0)
+               rssi = 0;
+       return rssi;
+}
+#else
+#define wl_rssi_offset(x)      x
+#endif
+
+#define IS_WPA_AKM(akm) ((akm) == RSN_AKM_NONE ||                      \
+                                (akm) == RSN_AKM_UNSPECIFIED ||        \
+                                (akm) == RSN_AKM_PSK)
+
+
+extern int dhd_wait_pend8021x(struct net_device *dev);
+#ifdef PROP_TXSTATUS_VSDB
+extern int disable_proptx;
+#endif /* PROP_TXSTATUS_VSDB */
+
+
+extern int passive_channel_skip;
+
+static s32
+wl_ap_start_ind(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data);
+static s32
+wl_csa_complete_ind(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data);
+#if ((LINUX_VERSION_CODE >= KERNEL_VERSION (3, 5, 0)) && (LINUX_VERSION_CODE <= (3, 7, \
+       0)))
+struct chan_info {
+       int freq;
+       int chan_type;
+};
+#endif
+
+
+#if (WL_DBG_LEVEL > 0)
+#define WL_DBG_ESTR_MAX        50
+static s8 wl_dbg_estr[][WL_DBG_ESTR_MAX] = {
+       "SET_SSID", "JOIN", "START", "AUTH", "AUTH_IND",
+       "DEAUTH", "DEAUTH_IND", "ASSOC", "ASSOC_IND", "REASSOC",
+       "REASSOC_IND", "DISASSOC", "DISASSOC_IND", "QUIET_START", "QUIET_END",
+       "BEACON_RX", "LINK", "MIC_ERROR", "NDIS_LINK", "ROAM",
+       "TXFAIL", "PMKID_CACHE", "RETROGRADE_TSF", "PRUNE", "AUTOAUTH",
+       "EAPOL_MSG", "SCAN_COMPLETE", "ADDTS_IND", "DELTS_IND", "BCNSENT_IND",
+       "BCNRX_MSG", "BCNLOST_MSG", "ROAM_PREP", "PFN_NET_FOUND",
+       "PFN_NET_LOST",
+       "RESET_COMPLETE", "JOIN_START", "ROAM_START", "ASSOC_START",
+       "IBSS_ASSOC",
+       "RADIO", "PSM_WATCHDOG",
+       "WLC_E_XXX_ASSOC_START", "WLC_E_XXX_ASSOC_ABORT",
+       "PROBREQ_MSG",
+       "SCAN_CONFIRM_IND", "PSK_SUP", "COUNTRY_CODE_CHANGED",
+       "EXCEEDED_MEDIUM_TIME", "ICV_ERROR",
+       "UNICAST_DECODE_ERROR", "MULTICAST_DECODE_ERROR", "TRACE",
+       "WLC_E_BTA_HCI_EVENT", "IF", "WLC_E_P2P_DISC_LISTEN_COMPLETE",
+       "RSSI", "PFN_SCAN_COMPLETE", "WLC_E_EXTLOG_MSG",
+       "ACTION_FRAME", "ACTION_FRAME_COMPLETE", "WLC_E_PRE_ASSOC_IND",
+       "WLC_E_PRE_REASSOC_IND", "WLC_E_CHANNEL_ADOPTED", "WLC_E_AP_STARTED",
+       "WLC_E_DFS_AP_STOP", "WLC_E_DFS_AP_RESUME", "WLC_E_WAI_STA_EVENT",
+       "WLC_E_WAI_MSG", "WLC_E_ESCAN_RESULT", "WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE",
+       "WLC_E_PROBRESP_MSG", "WLC_E_P2P_PROBREQ_MSG", "WLC_E_DCS_REQUEST", "WLC_E_FIFO_CREDIT_MAP",
+       "WLC_E_ACTION_FRAME_RX", "WLC_E_WAKE_EVENT", "WLC_E_RM_COMPLETE"
+};
+#endif                         /* WL_DBG_LEVEL */
+
+#define CHAN2G(_channel, _freq, _flags) {                      \
+       .band                   = IEEE80211_BAND_2GHZ,          \
+       .center_freq            = (_freq),                      \
+       .hw_value               = (_channel),                   \
+       .flags                  = (_flags),                     \
+       .max_antenna_gain       = 0,                            \
+       .max_power              = 30,                           \
+}
+
+#define CHAN5G(_channel, _flags) {                             \
+       .band                   = IEEE80211_BAND_5GHZ,          \
+       .center_freq            = 5000 + (5 * (_channel)),      \
+       .hw_value               = (_channel),                   \
+       .flags                  = (_flags),                     \
+       .max_antenna_gain       = 0,                            \
+       .max_power              = 30,                           \
+}
+
+#define RATE_TO_BASE100KBPS(rate)   (((rate) * 10) / 2)
+#define RATETAB_ENT(_rateid, _flags) \
+       {                                                               \
+               .bitrate        = RATE_TO_BASE100KBPS(_rateid),     \
+               .hw_value       = (_rateid),                        \
+               .flags    = (_flags),                        \
+       }
+
+static struct ieee80211_rate __wl_rates[] = {
+       RATETAB_ENT(DOT11_RATE_1M, 0),
+       RATETAB_ENT(DOT11_RATE_2M, IEEE80211_RATE_SHORT_PREAMBLE),
+       RATETAB_ENT(DOT11_RATE_5M5, IEEE80211_RATE_SHORT_PREAMBLE),
+       RATETAB_ENT(DOT11_RATE_11M, IEEE80211_RATE_SHORT_PREAMBLE),
+       RATETAB_ENT(DOT11_RATE_6M, 0),
+       RATETAB_ENT(DOT11_RATE_9M, 0),
+       RATETAB_ENT(DOT11_RATE_12M, 0),
+       RATETAB_ENT(DOT11_RATE_18M, 0),
+       RATETAB_ENT(DOT11_RATE_24M, 0),
+       RATETAB_ENT(DOT11_RATE_36M, 0),
+       RATETAB_ENT(DOT11_RATE_48M, 0),
+       RATETAB_ENT(DOT11_RATE_54M, 0)
+};
+
+#define wl_a_rates             (__wl_rates + 4)
+#define wl_a_rates_size        8
+#define wl_g_rates             (__wl_rates + 0)
+#define wl_g_rates_size        12
+
+static struct ieee80211_channel __wl_2ghz_channels[] = {
+       CHAN2G(1, 2412, 0),
+       CHAN2G(2, 2417, 0),
+       CHAN2G(3, 2422, 0),
+       CHAN2G(4, 2427, 0),
+       CHAN2G(5, 2432, 0),
+       CHAN2G(6, 2437, 0),
+       CHAN2G(7, 2442, 0),
+       CHAN2G(8, 2447, 0),
+       CHAN2G(9, 2452, 0),
+       CHAN2G(10, 2457, 0),
+       CHAN2G(11, 2462, 0),
+       CHAN2G(12, 2467, 0),
+       CHAN2G(13, 2472, 0),
+       CHAN2G(14, 2484, 0)
+};
+
+static struct ieee80211_channel __wl_5ghz_a_channels[] = {
+       CHAN5G(34, 0), CHAN5G(36, 0),
+       CHAN5G(38, 0), CHAN5G(40, 0),
+       CHAN5G(42, 0), CHAN5G(44, 0),
+       CHAN5G(46, 0), CHAN5G(48, 0),
+       CHAN5G(52, 0), CHAN5G(56, 0),
+       CHAN5G(60, 0), CHAN5G(64, 0),
+       CHAN5G(100, 0), CHAN5G(104, 0),
+       CHAN5G(108, 0), CHAN5G(112, 0),
+       CHAN5G(116, 0), CHAN5G(120, 0),
+       CHAN5G(124, 0), CHAN5G(128, 0),
+       CHAN5G(132, 0), CHAN5G(136, 0),
+       CHAN5G(140, 0), CHAN5G(144, 0),
+       CHAN5G(149, 0), CHAN5G(153, 0),
+       CHAN5G(157, 0), CHAN5G(161, 0),
+       CHAN5G(165, 0)
+};
+
+static struct ieee80211_supported_band __wl_band_2ghz = {
+       .band = IEEE80211_BAND_2GHZ,
+       .channels = __wl_2ghz_channels,
+       .n_channels = ARRAY_SIZE(__wl_2ghz_channels),
+       .bitrates = wl_g_rates,
+       .n_bitrates = wl_g_rates_size
+};
+
+static struct ieee80211_supported_band __wl_band_5ghz_a = {
+       .band = IEEE80211_BAND_5GHZ,
+       .channels = __wl_5ghz_a_channels,
+       .n_channels = ARRAY_SIZE(__wl_5ghz_a_channels),
+       .bitrates = wl_a_rates,
+       .n_bitrates = wl_a_rates_size
+};
+
+static const u32 __wl_cipher_suites[] = {
+       WLAN_CIPHER_SUITE_WEP40,
+       WLAN_CIPHER_SUITE_WEP104,
+       WLAN_CIPHER_SUITE_TKIP,
+       WLAN_CIPHER_SUITE_CCMP,
+       WLAN_CIPHER_SUITE_AES_CMAC,
+#ifdef BCMWAPI_WPI
+       WLAN_CIPHER_SUITE_SMS4,
+       WLAN_DHD_CIPHER_SUITE_SMS4,
+#endif
+};
+
+#ifdef WL_SUPPORT_ACS
+/*
+ * The firmware code required for this feature to work is currently under
+ * BCMINTERNAL flag. In future if this is to enabled we need to bring the
+ * required firmware code out of the BCMINTERNAL flag.
+ */
+struct wl_dump_survey {
+       u32 obss;
+       u32 ibss;
+       u32 no_ctg;
+       u32 no_pckt;
+       u32 tx;
+       u32 idle;
+};
+#endif /* WL_SUPPORT_ACS */
+
+
+#if defined(USE_DYNAMIC_MAXPKT_RXGLOM)
+static int maxrxpktglom = 0;
+#endif
+
+/* IOCtl version read from targeted driver */
+static int ioctl_version;
+#ifdef DEBUGFS_CFG80211
+#define S_SUBLOGLEVEL 20
+static const struct {
+       u32 log_level;
+       char *sublogname;
+} sublogname_map[] = {
+       {WL_DBG_ERR, "ERR"},
+       {WL_DBG_INFO, "INFO"},
+       {WL_DBG_DBG, "DBG"},
+       {WL_DBG_SCAN, "SCAN"},
+       {WL_DBG_TRACE, "TRACE"},
+       {WL_DBG_P2P_ACTION, "P2PACTION"}
+};
+#endif
+
+#ifdef CUSTOMER_HW4_DEBUG
+uint prev_dhd_console_ms = 0;
+u32 prev_wl_dbg_level = 0;
+bool wl_scan_timeout_dbg_enabled = 0;
+static void wl_scan_timeout_dbg_set(void);
+static void wl_scan_timeout_dbg_clear(void);
+
+static void wl_scan_timeout_dbg_set(void)
+{
+       WL_ERR(("Enter \n"));
+       prev_dhd_console_ms = dhd_console_ms;
+       prev_wl_dbg_level = wl_dbg_level;
+
+       dhd_console_ms = 1;
+       wl_dbg_level |= (WL_DBG_ERR | WL_DBG_P2P_ACTION | WL_DBG_SCAN);
+
+       wl_scan_timeout_dbg_enabled = 1;
+}
+static void wl_scan_timeout_dbg_clear(void)
+{
+       WL_ERR(("Enter \n"));
+       dhd_console_ms = prev_dhd_console_ms;
+       wl_dbg_level = prev_wl_dbg_level;
+
+       wl_scan_timeout_dbg_enabled = 0;
+}
+#endif /* CUSTOMER_HW4_DEBUG */
+
+/* watchdog timer for disconnecting when fw is not associated for FW_ASSOC_WATCHDOG_TIME ms */
+uint32 fw_assoc_watchdog_ms = 0;
+bool fw_assoc_watchdog_started = 0;
+#define FW_ASSOC_WATCHDOG_TIME 10 * 1000 /* msec */
+
+#ifdef DHD_IFDEBUG
+
+void wl_dump_ifinfo(struct bcm_cfg80211 *cfg)
+{
+       WL_ERR(("cfg=%p\n", cfg));
+       if (cfg) {
+               WL_ERR(("cfg->wdev=%p\n", bcmcfg_to_prmry_wdev(cfg)));
+               if (bcmcfg_to_prmry_wdev(cfg)) {
+                       WL_ERR(("cfg->wdev->wiphy=%p\n", bcmcfg_to_wiphy(cfg)));
+                       WL_ERR(("cfg->wdev->netdev=%p\n", bcmcfg_to_prmry_ndev(cfg)));
+               }
+       }
+}
+#endif
+
+static void wl_add_remove_pm_enable_work(struct bcm_cfg80211 *cfg,
+       enum wl_pm_workq_act_type type)
+{
+       u16 wq_duration = 0;
+       dhd_pub_t *dhd =  NULL;
+
+       if (cfg == NULL)
+               return;
+
+       dhd = (dhd_pub_t *)(cfg->pub);
+
+       mutex_lock(&cfg->pm_sync);
+       /*
+        * Make cancel and schedule work part mutually exclusive
+        * so that while cancelling, we are sure that there is no
+        * work getting scheduled.
+        */
+       if (delayed_work_pending(&cfg->pm_enable_work)) {
+               cancel_delayed_work_sync(&cfg->pm_enable_work);
+               DHD_PM_WAKE_UNLOCK(cfg->pub);
+       }
+
+       if (type == WL_PM_WORKQ_SHORT) {
+               wq_duration = WL_PM_ENABLE_TIMEOUT;
+       } else if (type == WL_PM_WORKQ_LONG) {
+               wq_duration = (WL_PM_ENABLE_TIMEOUT*2);
+       }
+
+       /* It should schedule work item only if driver is up */
+       if (wq_duration && dhd->up) {
+               if (schedule_delayed_work(&cfg->pm_enable_work,
+                               msecs_to_jiffies((const unsigned int)wq_duration))) {
+                       DHD_PM_WAKE_LOCK_TIMEOUT(cfg->pub,
+                               msecs_to_jiffies((const unsigned int)wq_duration));
+               } else {
+                       WL_ERR(("Can't schedule pm work handler\n"));
+               }
+       }
+       mutex_unlock(&cfg->pm_sync);
+}
+
+/* Return a new chanspec given a legacy chanspec
+ * Returns INVCHANSPEC on error
+ */
+static chanspec_t
+wl_chspec_from_legacy(chanspec_t legacy_chspec)
+{
+       chanspec_t chspec;
+
+       /* get the channel number */
+       chspec = LCHSPEC_CHANNEL(legacy_chspec);
+
+       /* convert the band */
+       if (LCHSPEC_IS2G(legacy_chspec)) {
+               chspec |= WL_CHANSPEC_BAND_2G;
+       } else {
+               chspec |= WL_CHANSPEC_BAND_5G;
+       }
+
+       /* convert the bw and sideband */
+       if (LCHSPEC_IS20(legacy_chspec)) {
+               chspec |= WL_CHANSPEC_BW_20;
+       } else {
+               chspec |= WL_CHANSPEC_BW_40;
+               if (LCHSPEC_CTL_SB(legacy_chspec) == WL_LCHANSPEC_CTL_SB_LOWER) {
+                       chspec |= WL_CHANSPEC_CTL_SB_L;
+               } else {
+                       chspec |= WL_CHANSPEC_CTL_SB_U;
+               }
+       }
+
+       if (wf_chspec_malformed(chspec)) {
+               WL_ERR(("wl_chspec_from_legacy: output chanspec (0x%04X) malformed\n",
+                       chspec));
+               return INVCHANSPEC;
+       }
+
+       return chspec;
+}
+
+/* Return a legacy chanspec given a new chanspec
+ * Returns INVCHANSPEC on error
+ */
+static chanspec_t
+wl_chspec_to_legacy(chanspec_t chspec)
+{
+       chanspec_t lchspec;
+
+       if (wf_chspec_malformed(chspec)) {
+               WL_ERR(("wl_chspec_to_legacy: input chanspec (0x%04X) malformed\n",
+                       chspec));
+               return INVCHANSPEC;
+       }
+
+       /* get the channel number */
+       lchspec = CHSPEC_CHANNEL(chspec);
+
+       /* convert the band */
+       if (CHSPEC_IS2G(chspec)) {
+               lchspec |= WL_LCHANSPEC_BAND_2G;
+       } else {
+               lchspec |= WL_LCHANSPEC_BAND_5G;
+       }
+
+       /* convert the bw and sideband */
+       if (CHSPEC_IS20(chspec)) {
+               lchspec |= WL_LCHANSPEC_BW_20;
+               lchspec |= WL_LCHANSPEC_CTL_SB_NONE;
+       } else if (CHSPEC_IS40(chspec)) {
+               lchspec |= WL_LCHANSPEC_BW_40;
+               if (CHSPEC_CTL_SB(chspec) == WL_CHANSPEC_CTL_SB_L) {
+                       lchspec |= WL_LCHANSPEC_CTL_SB_LOWER;
+               } else {
+                       lchspec |= WL_LCHANSPEC_CTL_SB_UPPER;
+               }
+       } else {
+               /* cannot express the bandwidth */
+               char chanbuf[CHANSPEC_STR_LEN];
+               WL_ERR((
+                       "wl_chspec_to_legacy: unable to convert chanspec %s (0x%04X) "
+                       "to pre-11ac format\n",
+                       wf_chspec_ntoa(chspec, chanbuf), chspec));
+               return INVCHANSPEC;
+       }
+
+       return lchspec;
+}
+
+/* given a chanspec value, do the endian and chanspec version conversion to
+ * a chanspec_t value
+ * Returns INVCHANSPEC on error
+ */
+chanspec_t
+wl_chspec_host_to_driver(chanspec_t chanspec)
+{
+       if (ioctl_version == 1) {
+               chanspec = wl_chspec_to_legacy(chanspec);
+               if (chanspec == INVCHANSPEC) {
+                       return chanspec;
+               }
+       }
+       chanspec = htodchanspec(chanspec);
+
+       return chanspec;
+}
+
+/* given a channel value, do the endian and chanspec version conversion to
+ * a chanspec_t value
+ * Returns INVCHANSPEC on error
+ */
+chanspec_t
+wl_ch_host_to_driver(struct wireless_dev *wdev, s32 bssidx, u16 channel)
+{
+       chanspec_t chanspec;
+
+       chanspec = channel & WL_CHANSPEC_CHAN_MASK;
+
+       if (channel <= CH_MAX_2G_CHANNEL)
+               chanspec |= WL_CHANSPEC_BAND_2G;
+       else
+               chanspec |= WL_CHANSPEC_BAND_5G;
+
+       chanspec |= wl_cfg80211_ulb_get_min_bw_chspec(wdev, bssidx);
+
+       chanspec |= WL_CHANSPEC_CTL_SB_NONE;
+
+       return wl_chspec_host_to_driver(chanspec);
+}
+
+/* given a chanspec value from the driver, do the endian and chanspec version conversion to
+ * a chanspec_t value
+ * Returns INVCHANSPEC on error
+ */
+chanspec_t
+wl_chspec_driver_to_host(chanspec_t chanspec)
+{
+       chanspec = dtohchanspec(chanspec);
+       if (ioctl_version == 1) {
+               chanspec = wl_chspec_from_legacy(chanspec);
+       }
+
+       return chanspec;
+}
+
+/*
+ * convert ASCII string to MAC address (colon-delimited format)
+ * eg: 00:11:22:33:44:55
+ */
+int
+wl_cfg80211_ether_atoe(const char *a, struct ether_addr *n)
+{
+       char *c = NULL;
+       int count = 0;
+
+       memset(n, 0, ETHER_ADDR_LEN);
+       for (;;) {
+               n->octet[count++] = (uint8)simple_strtoul(a, &c, 16);
+               if (!*c++ || count == ETHER_ADDR_LEN)
+                       break;
+               a = c;
+       }
+       return (count == ETHER_ADDR_LEN);
+}
+
+/* There isn't a lot of sense in it, but you can transmit anything you like */
+static const struct ieee80211_txrx_stypes
+wl_cfg80211_default_mgmt_stypes[NUM_NL80211_IFTYPES] = {
+       [NL80211_IFTYPE_ADHOC] = {
+               .tx = 0xffff,
+               .rx = BIT(IEEE80211_STYPE_ACTION >> 4)
+       },
+       [NL80211_IFTYPE_STATION] = {
+               .tx = 0xffff,
+               .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+               BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+       },
+       [NL80211_IFTYPE_AP] = {
+               .tx = 0xffff,
+               .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
+               BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
+               BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
+               BIT(IEEE80211_STYPE_DISASSOC >> 4) |
+               BIT(IEEE80211_STYPE_AUTH >> 4) |
+               BIT(IEEE80211_STYPE_DEAUTH >> 4) |
+               BIT(IEEE80211_STYPE_ACTION >> 4)
+       },
+       [NL80211_IFTYPE_AP_VLAN] = {
+               /* copy AP */
+               .tx = 0xffff,
+               .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
+               BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
+               BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
+               BIT(IEEE80211_STYPE_DISASSOC >> 4) |
+               BIT(IEEE80211_STYPE_AUTH >> 4) |
+               BIT(IEEE80211_STYPE_DEAUTH >> 4) |
+               BIT(IEEE80211_STYPE_ACTION >> 4)
+       },
+       [NL80211_IFTYPE_P2P_CLIENT] = {
+               .tx = 0xffff,
+               .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+               BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+       },
+       [NL80211_IFTYPE_P2P_GO] = {
+               .tx = 0xffff,
+               .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
+               BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
+               BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
+               BIT(IEEE80211_STYPE_DISASSOC >> 4) |
+               BIT(IEEE80211_STYPE_AUTH >> 4) |
+               BIT(IEEE80211_STYPE_DEAUTH >> 4) |
+               BIT(IEEE80211_STYPE_ACTION >> 4)
+       },
+#if defined(WL_CFG80211_P2P_DEV_IF)
+       [NL80211_IFTYPE_P2P_DEVICE] = {
+               .tx = 0xffff,
+               .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+               BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+       },
+#endif /* WL_CFG80211_P2P_DEV_IF */
+};
+
+static void swap_key_from_BE(struct wl_wsec_key *key)
+{
+       key->index = htod32(key->index);
+       key->len = htod32(key->len);
+       key->algo = htod32(key->algo);
+       key->flags = htod32(key->flags);
+       key->rxiv.hi = htod32(key->rxiv.hi);
+       key->rxiv.lo = htod16(key->rxiv.lo);
+       key->iv_initialized = htod32(key->iv_initialized);
+}
+
+static void swap_key_to_BE(struct wl_wsec_key *key)
+{
+       key->index = dtoh32(key->index);
+       key->len = dtoh32(key->len);
+       key->algo = dtoh32(key->algo);
+       key->flags = dtoh32(key->flags);
+       key->rxiv.hi = dtoh32(key->rxiv.hi);
+       key->rxiv.lo = dtoh16(key->rxiv.lo);
+       key->iv_initialized = dtoh32(key->iv_initialized);
+}
+
+/* Dump the contents of the encoded wps ie buffer and get pbc value */
+static void
+wl_validate_wps_ie(char *wps_ie, s32 wps_ie_len, bool *pbc)
+{
+       #define WPS_IE_FIXED_LEN 6
+       u16 len;
+       u8 *subel = NULL;
+       u16 subelt_id;
+       u16 subelt_len;
+       u16 val;
+       u8 *valptr = (uint8*) &val;
+       if (wps_ie == NULL || wps_ie_len < WPS_IE_FIXED_LEN) {
+               WL_ERR(("invalid argument : NULL\n"));
+               return;
+       }
+       len = (u16)wps_ie[TLV_LEN_OFF];
+
+       if (len > wps_ie_len) {
+               WL_ERR(("invalid length len %d, wps ie len %d\n", len, wps_ie_len));
+               return;
+       }
+       WL_DBG(("wps_ie len=%d\n", len));
+       len -= 4;       /* for the WPS IE's OUI, oui_type fields */
+       subel = wps_ie + WPS_IE_FIXED_LEN;
+       while (len >= 4) {              /* must have attr id, attr len fields */
+               valptr[0] = *subel++;
+               valptr[1] = *subel++;
+               subelt_id = HTON16(val);
+
+               valptr[0] = *subel++;
+               valptr[1] = *subel++;
+               subelt_len = HTON16(val);
+
+               len -= 4;                       /* for the attr id, attr len fields */
+
+               if (len < subelt_len) {
+                       WL_ERR(("not enough data, len %d, subelt_len %d\n", len,
+                               subelt_len));
+                       break;
+               }
+               len -= subelt_len;      /* for the remaining fields in this attribute */
+
+               WL_DBG((" subel=%p, subelt_id=0x%x subelt_len=%u\n",
+                       subel, subelt_id, subelt_len));
+
+               if (subelt_id == WPS_ID_VERSION) {
+                       WL_DBG(("  attr WPS_ID_VERSION: %u\n", *subel));
+               } else if (subelt_id == WPS_ID_REQ_TYPE) {
+                       WL_DBG(("  attr WPS_ID_REQ_TYPE: %u\n", *subel));
+               } else if (subelt_id == WPS_ID_CONFIG_METHODS) {
+                       valptr[0] = *subel;
+                       valptr[1] = *(subel + 1);
+                       WL_DBG(("  attr WPS_ID_CONFIG_METHODS: %x\n", HTON16(val)));
+               } else if (subelt_id == WPS_ID_DEVICE_NAME) {
+                       char devname[100];
+                       int namelen = MIN(subelt_len, (sizeof(devname) - 1));
+
+                       if (namelen) {
+                               memcpy(devname, subel, namelen);
+                               devname[namelen] = '\0';
+                               /* Printing len as rx'ed in the IE */
+                               WL_DBG(("  attr WPS_ID_DEVICE_NAME: %s (len %u)\n",
+                                       devname, subelt_len));
+                       }
+               } else if (subelt_id == WPS_ID_DEVICE_PWD_ID) {
+                       valptr[0] = *subel;
+                       valptr[1] = *(subel + 1);
+                       WL_DBG(("  attr WPS_ID_DEVICE_PWD_ID: %u\n", HTON16(val)));
+                       *pbc = (HTON16(val) == DEV_PW_PUSHBUTTON) ? true : false;
+               } else if (subelt_id == WPS_ID_PRIM_DEV_TYPE) {
+                       valptr[0] = *subel;
+                       valptr[1] = *(subel + 1);
+                       WL_DBG(("  attr WPS_ID_PRIM_DEV_TYPE: cat=%u \n", HTON16(val)));
+                       valptr[0] = *(subel + 6);
+                       valptr[1] = *(subel + 7);
+                       WL_DBG(("  attr WPS_ID_PRIM_DEV_TYPE: subcat=%u\n", HTON16(val)));
+               } else if (subelt_id == WPS_ID_REQ_DEV_TYPE) {
+                       valptr[0] = *subel;
+                       valptr[1] = *(subel + 1);
+                       WL_DBG(("  attr WPS_ID_REQ_DEV_TYPE: cat=%u\n", HTON16(val)));
+                       valptr[0] = *(subel + 6);
+                       valptr[1] = *(subel + 7);
+                       WL_DBG(("  attr WPS_ID_REQ_DEV_TYPE: subcat=%u\n", HTON16(val)));
+               } else if (subelt_id == WPS_ID_SELECTED_REGISTRAR_CONFIG_METHODS) {
+                       valptr[0] = *subel;
+                       valptr[1] = *(subel + 1);
+                       WL_DBG(("  attr WPS_ID_SELECTED_REGISTRAR_CONFIG_METHODS"
+                               ": cat=%u\n", HTON16(val)));
+               } else {
+                       WL_DBG(("  unknown attr 0x%x\n", subelt_id));
+               }
+
+               subel += subelt_len;
+       }
+}
+
+s32 wl_set_tx_power(struct net_device *dev,
+       enum nl80211_tx_power_setting type, s32 dbm)
+{
+       s32 err = 0;
+       s32 disable = 0;
+       s32 txpwrqdbm;
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+
+       /* Make sure radio is off or on as far as software is concerned */
+       disable = WL_RADIO_SW_DISABLE << 16;
+       disable = htod32(disable);
+       err = wldev_ioctl(dev, WLC_SET_RADIO, &disable, sizeof(disable), true);
+       if (unlikely(err)) {
+               WL_ERR(("WLC_SET_RADIO error (%d)\n", err));
+               return err;
+       }
+
+       if (dbm > 0xffff)
+               dbm = 0xffff;
+       txpwrqdbm = dbm * 4;
+       err = wldev_iovar_setbuf_bsscfg(dev, "qtxpower", (void *)&txpwrqdbm,
+               sizeof(txpwrqdbm), cfg->ioctl_buf, WLC_IOCTL_SMLEN, 0,
+               &cfg->ioctl_buf_sync);
+       if (unlikely(err))
+               WL_ERR(("qtxpower error (%d)\n", err));
+       else
+               WL_ERR(("dBm=%d, txpwrqdbm=0x%x\n", dbm, txpwrqdbm));
+
+       return err;
+}
+
+s32 wl_get_tx_power(struct net_device *dev, s32 *dbm)
+{
+       s32 err = 0;
+       s32 txpwrdbm;
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+
+       err = wldev_iovar_getbuf_bsscfg(dev, "qtxpower",
+               NULL, 0, cfg->ioctl_buf, WLC_IOCTL_SMLEN, 0, &cfg->ioctl_buf_sync);
+       if (unlikely(err)) {
+               WL_ERR(("error (%d)\n", err));
+               return err;
+       }
+
+       memcpy(&txpwrdbm, cfg->ioctl_buf, sizeof(txpwrdbm));
+       txpwrdbm = dtoh32(txpwrdbm);
+       *dbm = (txpwrdbm & ~WL_TXPWR_OVERRIDE) / 4;
+
+       WL_INFORM(("dBm=%d, txpwrdbm=0x%x\n", *dbm, txpwrdbm));
+
+       return err;
+}
+
+static chanspec_t wl_cfg80211_get_shared_freq(struct wiphy *wiphy)
+{
+       chanspec_t chspec;
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct net_device *dev = bcmcfg_to_prmry_ndev(cfg);
+       struct ether_addr bssid;
+       struct wl_bss_info *bss = NULL;
+       s32 bssidx = 0; /* Explicitly set to primary bssidx */
+
+       if ((err = wldev_ioctl(dev, WLC_GET_BSSID, &bssid, sizeof(bssid), false))) {
+               /* STA interface is not associated. So start the new interface on a temp
+                * channel . Later proper channel will be applied by the above framework
+                * via set_channel (cfg80211 API).
+                */
+               WL_DBG(("Not associated. Return a temp channel. \n"));
+               return wl_ch_host_to_driver(cfg->wdev, bssidx, WL_P2P_TEMP_CHAN);
+       }
+
+
+       *(u32 *) cfg->extra_buf = htod32(WL_EXTRA_BUF_MAX);
+       if ((err = wldev_ioctl(dev, WLC_GET_BSS_INFO, cfg->extra_buf,
+               WL_EXTRA_BUF_MAX, false))) {
+                       WL_ERR(("Failed to get associated bss info, use temp channel \n"));
+                       chspec = wl_ch_host_to_driver(cfg->wdev, bssidx, WL_P2P_TEMP_CHAN);
+       }
+       else {
+                       bss = (struct wl_bss_info *) (cfg->extra_buf + 4);
+                       chspec =  bss->chanspec;
+
+                       WL_DBG(("Valid BSS Found. chanspec:%d \n", chspec));
+       }
+       return chspec;
+}
+
+static bcm_struct_cfgdev *
+wl_cfg80211_add_monitor_if(char *name)
+{
+#if defined(WL_ENABLE_P2P_IF) || defined(WL_CFG80211_P2P_DEV_IF)
+       WL_INFORM(("wl_cfg80211_add_monitor_if: No more support monitor interface\n"));
+       return ERR_PTR(-EOPNOTSUPP);
+#else
+       struct net_device* ndev = NULL;
+
+       dhd_add_monitor(name, &ndev);
+       WL_INFORM(("wl_cfg80211_add_monitor_if net device returned: 0x%p\n", ndev));
+       return ndev_to_cfgdev(ndev);
+#endif /* WL_ENABLE_P2P_IF || WL_CFG80211_P2P_DEV_IF */
+}
+
+static bcm_struct_cfgdev *
+wl_cfg80211_add_virtual_iface(struct wiphy *wiphy,
+#if defined(WL_CFG80211_P2P_DEV_IF)
+       const char *name,
+#else
+       char *name,
+#endif /* WL_CFG80211_P2P_DEV_IF */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0))
+       unsigned char name_assign_type,
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)) */
+       enum nl80211_iftype type, u32 *flags,
+       struct vif_params *params)
+{
+       s32 err = -ENODEV;
+       s32 timeout = -1;
+       s32 wlif_type = -1;
+       s32 mode = 0;
+       s32 val = 0;
+       s32 cfg_type;
+       s32 dhd_mode = 0;
+       s32 is_mp2p_supported = BCME_ERROR;
+       /* @TODO need to refine the usage of this flag based on firmware limitations of MP2P */
+       chanspec_t chspec;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct net_device *primary_ndev;
+       struct net_device *new_ndev;
+       struct ether_addr primary_mac;
+#ifdef WL_VIRTUAL_APSTA
+       bcm_struct_cfgdev *new_cfgdev;
+#endif /* WL_VIRTUAL_APSTA */
+#ifdef PROP_TXSTATUS_VSDB
+#if defined(BCMSDIO)
+       s32 up = 1;
+       dhd_pub_t *dhd;
+       bool enabled;
+#endif 
+#endif /* PROP_TXSTATUS_VSDB */
+#if defined(SUPPORT_AP_POWERSAVE)
+       dhd_pub_t *dhd;
+#endif /* SUPPORT_AP_POWERSAVE */
+       bool hang_required = false;
+
+       if (!cfg)
+               return ERR_PTR(-EINVAL);
+
+#ifdef PROP_TXSTATUS_VSDB
+#if defined(BCMSDIO)
+       dhd = (dhd_pub_t *)(cfg->pub);
+#endif 
+#endif /* PROP_TXSTATUS_VSDB */
+#if defined(SUPPORT_AP_POWERSAVE)
+       dhd = (dhd_pub_t *)(cfg->pub);
+#endif /* SUPPORT_AP_POWERSAVE */
+
+       /* Use primary I/F for sending cmds down to firmware */
+       primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+
+       is_mp2p_supported = DHD_OPMODE_SUPPORTED(cfg->pub, DHD_FLAG_MP2P_MODE);
+
+
+       if (unlikely(!wl_get_drv_status(cfg, READY, primary_ndev))) {
+               WL_ERR(("device is not ready\n"));
+               return ERR_PTR(-ENODEV);
+       }
+
+       WL_DBG(("if name: %s, type: %d\n", name, type));
+       switch (type) {
+       case NL80211_IFTYPE_ADHOC:
+#ifdef WLAIBSS_MCHAN
+               return bcm_cfg80211_add_ibss_if(wiphy, (char *)name);
+#endif /* WLAIBSS_MCHAN */
+       case NL80211_IFTYPE_AP_VLAN:
+       case NL80211_IFTYPE_WDS:
+       case NL80211_IFTYPE_MESH_POINT:
+               WL_ERR(("Unsupported interface type\n"));
+               mode = WL_MODE_IBSS;
+               return NULL;
+       case NL80211_IFTYPE_MONITOR:
+               return wl_cfg80211_add_monitor_if((char *)name);
+#if defined(WL_CFG80211_P2P_DEV_IF)
+       case NL80211_IFTYPE_P2P_DEVICE:
+               cfg->down_disc_if = FALSE;
+               return wl_cfgp2p_add_p2p_disc_if(cfg);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+       case NL80211_IFTYPE_STATION:
+#ifdef WL_VIRTUAL_APSTA
+#ifdef WLAIBSS_MCHAN
+               if (cfg->ibss_cfgdev) {
+                       WL_ERR(("AIBSS is already operational. "
+                                       " AIBSS & DUALSTA can't be used together \n"));
+                       return ERR_PTR(-ENOMEM);
+               }
+#endif /* WLAIBSS_MCHAN */
+               if (!name) {
+                       WL_ERR(("Interface name not provided \n"));
+                       return ERR_PTR(-ENODEV);
+               }
+
+               if (wl_cfgp2p_vif_created(cfg)) {
+                       WL_ERR(("Could not create new iface."
+                               "Already one p2p interface is running"));
+                       return ERR_PTR(-ENODEV);
+               }
+               new_cfgdev = wl_cfg80211_create_iface(cfg->wdev->wiphy,
+                       NL80211_IFTYPE_STATION, NULL, name);
+               if (!new_cfgdev)
+                       return ERR_PTR(-ENOMEM);
+               else
+                       return new_cfgdev;
+#endif /* WL_VIRTUAL_APSTA */
+       case NL80211_IFTYPE_P2P_CLIENT:
+               wlif_type = WL_P2P_IF_CLIENT;
+               mode = WL_MODE_BSS;
+               break;
+       case NL80211_IFTYPE_P2P_GO:
+       case NL80211_IFTYPE_AP:
+               wlif_type = WL_P2P_IF_GO;
+               mode = WL_MODE_AP;
+               break;
+       default:
+               WL_ERR(("Unsupported interface type\n"));
+               return ERR_PTR(-ENODEV);
+               break;
+       }
+
+       if (!name) {
+               WL_ERR(("name is NULL\n"));
+               return ERR_PTR(-ENODEV);
+       }
+       if (cfg->p2p_supported && (wlif_type != -1)) {
+               ASSERT(cfg->p2p); /* ensure expectation of p2p initialization */
+
+#ifdef PROP_TXSTATUS_VSDB
+#if defined(BCMSDIO)
+               if (!dhd)
+                       return ERR_PTR(-ENODEV);
+#endif 
+#endif /* PROP_TXSTATUS_VSDB */
+               if (!cfg->p2p)
+                       return ERR_PTR(-ENODEV);
+
+               if (cfg->p2p && !cfg->p2p->on && strstr(name, WL_P2P_INTERFACE_PREFIX)) {
+                       p2p_on(cfg) = true;
+                       wl_cfgp2p_set_firm_p2p(cfg);
+                       wl_cfgp2p_init_discovery(cfg);
+                       get_primary_mac(cfg, &primary_mac);
+                       wl_cfgp2p_generate_bss_mac(cfg, &primary_mac);
+               }
+
+               strncpy(cfg->p2p->vir_ifname, name, IFNAMSIZ - 1);
+               cfg->p2p->vir_ifname[IFNAMSIZ - 1] = '\0';
+
+               wl_cfg80211_scan_abort(cfg);
+#ifdef PROP_TXSTATUS_VSDB
+#if defined(BCMSDIO)
+               if (!cfg->wlfc_on && !disable_proptx) {
+                       dhd_wlfc_get_enable(dhd, &enabled);
+                       if (!enabled && dhd->op_mode != DHD_FLAG_HOSTAP_MODE &&
+                               dhd->op_mode != DHD_FLAG_IBSS_MODE) {
+                               dhd_wlfc_init(dhd);
+                               err = wldev_ioctl(primary_ndev, WLC_UP, &up, sizeof(s32), true);
+                               if (err < 0)
+                                       WL_ERR(("WLC_UP return err:%d\n", err));
+                       }
+                       cfg->wlfc_on = true;
+               }
+#endif 
+#endif /* PROP_TXSTATUS_VSDB */
+
+               /* Dual p2p doesn't support multiple P2PGO interfaces,
+                * p2p_go_count is the counter for GO creation
+                * requests.
+                */
+               if (
+                               (!is_mp2p_supported) &&
+                               (cfg->p2p->p2p_go_count > 0) && (type == NL80211_IFTYPE_P2P_GO)) {
+
+                       WL_ERR(("Fw doesnot support  multiple Go"));
+                       return ERR_PTR(-ENOMEM);
+               }
+               /* In concurrency case, STA may be already associated in a particular channel.
+                * so retrieve the current channel of primary interface and then start the virtual
+                * interface on that.
+                */
+                chspec = wl_cfg80211_get_shared_freq(wiphy);
+
+               /* For P2P mode, use P2P-specific driver features to create the
+                * bss: "cfg p2p_ifadd"
+                */
+               if (wl_check_dongle_idle(wiphy) != TRUE) {
+                       WL_ERR(("FW is busy to add interface"));
+                       return ERR_PTR(-ENOMEM);
+               }
+               wl_set_p2p_status(cfg, IF_ADDING);
+               memset(&cfg->if_event_info, 0, sizeof(cfg->if_event_info));
+               if (wlif_type == WL_P2P_IF_GO)
+                       wldev_iovar_setint(primary_ndev, "mpc", 0);
+               cfg_type = wl_cfgp2p_get_conn_idx(cfg);
+               if (cfg_type == BCME_ERROR) {
+                       wl_clr_p2p_status(cfg, IF_ADDING);
+                       WL_ERR(("Failed to get connection idx for p2p interface"));
+                       goto fail;
+               }
+               err = wl_cfgp2p_ifadd(cfg, wl_to_p2p_bss_macaddr(cfg, cfg_type),
+                       htod32(wlif_type), chspec);
+               if (unlikely(err)) {
+                       wl_clr_p2p_status(cfg, IF_ADDING);
+                       WL_ERR((" virtual iface add failed (%d) \n", err));
+                       return ERR_PTR(-ENOMEM);
+               }
+
+               timeout = wait_event_interruptible_timeout(cfg->netif_change_event,
+                       ((wl_get_p2p_status(cfg, IF_ADDING) == false) &&
+                       (cfg->if_event_info.valid)),
+                       msecs_to_jiffies(MAX_WAIT_TIME));
+
+               if (timeout > 0 && !wl_get_p2p_status(cfg, IF_ADDING) && cfg->if_event_info.valid) {
+                       struct wireless_dev *vwdev;
+                       int pm_mode = PM_ENABLE;
+                       wl_if_event_info *event = &cfg->if_event_info;
+                       /* IF_ADD event has come back, we can proceed to to register
+                        * the new interface now, use the interface name provided by caller (thus
+                        * ignore the one from wlc)
+                        */
+                       new_ndev = wl_cfg80211_allocate_if(cfg, event->ifidx, cfg->p2p->vir_ifname,
+                               event->mac, event->bssidx, event->name);
+                       if (new_ndev == NULL)
+                               goto fail;
+
+                       wl_to_p2p_bss_ndev(cfg, cfg_type) = new_ndev;
+                       wl_to_p2p_bss_bssidx(cfg, cfg_type) = event->bssidx;
+                       vwdev = kzalloc(sizeof(*vwdev), GFP_KERNEL);
+                       if (unlikely(!vwdev)) {
+                               WL_ERR(("Could not allocate wireless device\n"));
+                               err = -ENOMEM;
+                               goto fail;
+                       }
+                       vwdev->wiphy = cfg->wdev->wiphy;
+                       WL_INFORM(("virtual interface(%s) is created\n", cfg->p2p->vir_ifname));
+                       if (type == NL80211_IFTYPE_P2P_GO) {
+                               cfg->p2p->p2p_go_count++;
+                       }
+                       vwdev->iftype = type;
+#ifdef DHD_IFDEBUG
+                       WL_ERR(("new_ndev: %p\n", new_ndev));
+#endif
+                       vwdev->netdev = new_ndev;
+                       new_ndev->ieee80211_ptr = vwdev;
+                       SET_NETDEV_DEV(new_ndev, wiphy_dev(vwdev->wiphy));
+                       wl_set_drv_status(cfg, READY, new_ndev);
+                       wl_set_mode_by_netdev(cfg, new_ndev, mode);
+
+                       if (wl_cfg80211_register_if(cfg, event->ifidx, new_ndev) != BCME_OK) {
+                               wl_cfg80211_remove_if(cfg, event->ifidx, new_ndev);
+                               err = -ENODEV;
+                               goto fail;
+                       }
+                       err = wl_alloc_netinfo(cfg, new_ndev, vwdev, mode, pm_mode, event->bssidx);
+                       if (unlikely(err != 0)) {
+                               WL_ERR(("Allocation of netinfo failed (%d) \n", err));
+                               goto fail;
+                       }
+                       val = 1;
+                       /* Disable firmware roaming for P2P interface  */
+                       wldev_iovar_setint(new_ndev, "roam_off", val);
+#ifdef WL11ULB
+                       if (cfg->p2p_wdev && is_p2p_group_iface(new_ndev->ieee80211_ptr)) {
+                               u32 ulb_bw = wl_cfg80211_get_ulb_bw(cfg->p2p_wdev);
+                               if (ulb_bw) {
+                                       /* Apply ULB BW settings on the newly spawned interface */
+                                       WL_DBG(("[ULB] Applying ULB BW for the newly"
+                                               "created P2P interface \n"));
+                                       if (wl_cfg80211_set_ulb_bw(new_ndev,
+                                               ulb_bw, new_ndev->name) < 0) {
+                                               /*
+                                                * If ulb_bw set failed, fail the iface creation.
+                                                * wl_dealloc_netinfo_by_wdev will be called by the
+                                                * unregister notifier.
+                                                */
+                                               wl_cfg80211_remove_if(cfg, event->ifidx, new_ndev);
+                                               err = -EINVAL;
+                                               goto fail;
+                                       }
+                               }
+                       }
+#endif /* WL11ULB */
+
+                       if (mode != WL_MODE_AP)
+                               wldev_iovar_setint(new_ndev, "buf_key_b4_m4", 1);
+
+                       WL_ERR((" virtual interface(%s) is "
+                               "created net attach done\n", cfg->p2p->vir_ifname));
+                       if (mode == WL_MODE_AP)
+                               wl_set_drv_status(cfg, CONNECTED, new_ndev);
+#ifdef SUPPORT_AP_POWERSAVE
+                       if (mode == WL_MODE_AP) {
+                               dhd_set_ap_powersave(dhd, 0, TRUE);
+                       }
+#endif /* SUPPORT_AP_POWERSAVE */
+                       if (type == NL80211_IFTYPE_P2P_CLIENT)
+                               dhd_mode = DHD_FLAG_P2P_GC_MODE;
+                       else if (type == NL80211_IFTYPE_P2P_GO)
+                               dhd_mode = DHD_FLAG_P2P_GO_MODE;
+                       DNGL_FUNC(dhd_cfg80211_set_p2p_info, (cfg, dhd_mode));
+                       /* reinitialize completion to clear previous count */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 13, 0))
+                       INIT_COMPLETION(cfg->iface_disable);
+#else
+                       init_completion(&cfg->iface_disable);
+#endif
+                       return ndev_to_cfgdev(new_ndev);
+               } else {
+                       wl_clr_p2p_status(cfg, IF_ADDING);
+                       WL_ERR((" virtual interface(%s) is not created \n", cfg->p2p->vir_ifname));
+
+                       WL_ERR(("left timeout : %d\n", timeout));
+                       WL_ERR(("IF_ADDING status : %d\n", wl_get_p2p_status(cfg, IF_ADDING)));
+                       WL_ERR(("event valid : %d\n", cfg->if_event_info.valid));
+
+                       wl_clr_p2p_status(cfg, GO_NEG_PHASE);
+                       wl_set_p2p_status(cfg, IF_DELETING);
+
+                       err = wl_cfgp2p_ifdel(cfg, wl_to_p2p_bss_macaddr(cfg, cfg_type));
+                       if (err == BCME_OK) {
+                               timeout = wait_event_interruptible_timeout(cfg->netif_change_event,
+                                       ((wl_get_p2p_status(cfg, IF_DELETING) == false) &&
+                                       (cfg->if_event_info.valid)),
+                                       msecs_to_jiffies(MAX_WAIT_TIME));
+                               if (timeout > 0 && !wl_get_p2p_status(cfg, IF_DELETING) &&
+                                       cfg->if_event_info.valid) {
+                                        /*
+                                         * Should indicate upper layer this failure case of p2p
+                                         * interface creation
+                                         */
+                                       WL_ERR(("IFDEL operation done\n"));
+                               } else {
+                                       WL_ERR(("IFDEL didn't complete properly\n"));
+                                       hang_required = true;
+                               }
+                       } else {
+                               hang_required = true;
+                       }
+
+                       if (hang_required) {
+                               struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+                               dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+
+                               WL_ERR(("p2p_ifdel failed, error %d, sent HANG event to %s\n",
+                                       err, ndev->name));
+                               dhd->hang_reason = HANG_REASON_P2P_IFACE_DEL_FAILURE;
+                               net_os_send_hang_message(ndev);
+                       }
+
+                       memset(cfg->p2p->vir_ifname, '\0', IFNAMSIZ);
+                       wl_to_p2p_bss_bssidx(cfg, cfg_type) = -1;
+#ifdef PROP_TXSTATUS_VSDB
+#if defined(BCMSDIO)
+                       dhd_wlfc_get_enable(dhd, &enabled);
+                       if (enabled && cfg->wlfc_on && dhd->op_mode != DHD_FLAG_HOSTAP_MODE &&
+                               dhd->op_mode != DHD_FLAG_IBSS_MODE) {
+                               dhd_wlfc_deinit(dhd);
+                               cfg->wlfc_on = false;
+                       }
+#endif 
+#endif /* PROP_TXSTATUS_VSDB */
+                       /*
+                       * Returns -ENODEV to upperlayer to indicate that DHD
+                       * failed to create p2p interface
+                       */
+                       err = -ENODEV;
+               }
+       }
+fail:
+       if (wlif_type == WL_P2P_IF_GO)
+               wldev_iovar_setint(primary_ndev, "mpc", 1);
+       return ERR_PTR(err);
+}
+
+static s32
+wl_cfg80211_del_virtual_iface(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev)
+{
+       struct net_device *dev = NULL;
+       struct ether_addr p2p_mac;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       s32 timeout = -1;
+       s32 ret = 0;
+       s32 index = -1;
+       s32 type = -1;
+#ifdef CUSTOM_SET_CPUCORE
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+#endif /* CUSTOM_SET_CPUCORE */
+       WL_DBG(("Enter\n"));
+
+#ifdef CUSTOM_SET_CPUCORE
+       dhd->chan_isvht80 &= ~DHD_FLAG_P2P_MODE;
+       if (!(dhd->chan_isvht80))
+               dhd_set_cpucore(dhd, FALSE);
+#endif /* CUSTOM_SET_CPUCORE */
+#ifdef WL_CFG80211_P2P_DEV_IF
+       if (cfgdev->iftype == NL80211_IFTYPE_P2P_DEVICE) {
+               if (dhd_download_fw_on_driverload) {
+                       return wl_cfgp2p_del_p2p_disc_if(cfgdev, cfg);
+               } else {
+                       cfg->down_disc_if = TRUE;
+                       return 0;
+               }
+       }
+#endif /* WL_CFG80211_P2P_DEV_IF */
+       dev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+#ifdef WLAIBSS_MCHAN
+       if (cfgdev == cfg->ibss_cfgdev)
+               return bcm_cfg80211_del_ibss_if(wiphy, cfgdev);
+#endif /* WLAIBSS_MCHAN */
+
+#ifdef WL_VIRTUAL_APSTA
+       if (cfgdev_to_wdev(cfgdev)->iftype == NL80211_IFTYPE_AP) {
+               return wl_cfg80211_del_iface(wiphy, cfgdev);
+       }
+#endif /* WL_VIRTUAL_APSTA */
+       if ((index = wl_get_bssidx_by_wdev(cfg, cfgdev_to_wdev(cfgdev))) < 0) {
+               WL_ERR(("Find p2p index from wdev failed\n"));
+               return BCME_ERROR;
+       }
+       if (wl_check_dongle_idle(wiphy) != TRUE) {
+               WL_ERR(("FW is busy to add interface"));
+               return BCME_ERROR;
+       }
+       if (cfg->p2p_supported) {
+               if (wl_cfgp2p_find_type(cfg, index, &type) != BCME_OK)
+                       return BCME_ERROR;
+               memcpy(p2p_mac.octet, wl_to_p2p_bss_macaddr(cfg, type).octet, ETHER_ADDR_LEN);
+
+               /* Clear GO_NEG_PHASE bit to take care of GO-NEG-FAIL cases
+                */
+               WL_DBG(("P2P: GO_NEG_PHASE status cleared "));
+               wl_clr_p2p_status(cfg, GO_NEG_PHASE);
+               if (wl_cfgp2p_vif_created(cfg)) {
+                       if (wl_get_drv_status(cfg, SCANNING, dev)) {
+                               wl_notify_escan_complete(cfg, dev, true, true);
+                       }
+                       wldev_iovar_setint(dev, "mpc", 1);
+                       /* Delete pm_enable_work */
+                       wl_add_remove_pm_enable_work(cfg, WL_PM_WORKQ_DEL);
+
+                       /* for GC */
+                       if (wl_get_drv_status(cfg, DISCONNECTING, dev) &&
+                               (wl_get_mode_by_netdev(cfg, dev) != WL_MODE_AP)) {
+                               WL_ERR(("Wait for Link Down event for GC !\n"));
+                               wait_for_completion_timeout
+                                       (&cfg->iface_disable, msecs_to_jiffies(500));
+                       }
+
+                       memset(&cfg->if_event_info, 0, sizeof(cfg->if_event_info));
+                       wl_set_p2p_status(cfg, IF_DELETING);
+                       DNGL_FUNC(dhd_cfg80211_clean_p2p_info, (cfg));
+
+                       /* for GO */
+                       if (wl_get_mode_by_netdev(cfg, dev) == WL_MODE_AP) {
+                               wl_add_remove_eventmsg(dev, WLC_E_PROBREQ_MSG, false);
+                               cfg->p2p->p2p_go_count--;
+                               /* disable interface before bsscfg free */
+                               ret = wl_cfgp2p_ifdisable(cfg, &p2p_mac);
+                               /* if fw doesn't support "ifdis",
+                                  do not wait for link down of ap mode
+                                */
+                               if (ret == 0) {
+                                       WL_ERR(("Wait for Link Down event for GO !!!\n"));
+                                       wait_for_completion_timeout(&cfg->iface_disable,
+                                               msecs_to_jiffies(500));
+                               } else if (ret != BCME_UNSUPPORTED) {
+                                       msleep(300);
+                               }
+                       }
+                       wl_cfg80211_clear_per_bss_ies(cfg, index);
+
+                       if (wl_get_mode_by_netdev(cfg, dev) != WL_MODE_AP)
+                               wldev_iovar_setint(dev, "buf_key_b4_m4", 0);
+                       memcpy(p2p_mac.octet, wl_to_p2p_bss_macaddr(cfg, type).octet,
+                       ETHER_ADDR_LEN);
+                       CFGP2P_INFO(("primary idx %d : cfg p2p_ifdis "MACDBG"\n",
+                              dev->ifindex, MAC2STRDBG(p2p_mac.octet)));
+
+                       /* delete interface after link down */
+                       ret = wl_cfgp2p_ifdel(cfg, &p2p_mac);
+                       if (ret != BCME_OK) {
+                               struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+                               dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+
+                               WL_ERR(("p2p_ifdel failed, error %d, sent HANG event to %s\n",
+                                       ret, ndev->name));
+                               dhd->hang_reason = HANG_REASON_P2P_IFACE_DEL_FAILURE;
+                               net_os_send_hang_message(ndev);
+                       } else {
+                               /* Wait for IF_DEL operation to be finished */
+                               timeout = wait_event_interruptible_timeout(cfg->netif_change_event,
+                                       ((wl_get_p2p_status(cfg, IF_DELETING) == false) &&
+                                       (cfg->if_event_info.valid)),
+                                       msecs_to_jiffies(MAX_WAIT_TIME));
+                               if (timeout > 0 && !wl_get_p2p_status(cfg, IF_DELETING) &&
+                                       cfg->if_event_info.valid) {
+
+                                       WL_DBG(("IFDEL operation done\n"));
+                                       wl_cfg80211_handle_ifdel(cfg, &cfg->if_event_info, dev);
+                               } else {
+                                       WL_ERR(("IFDEL didn't complete properly\n"));
+                               }
+                       }
+
+                       ret = dhd_del_monitor(dev);
+                       if (wl_get_mode_by_netdev(cfg, dev) == WL_MODE_AP) {
+                               DHD_OS_WAKE_LOCK_CTRL_TIMEOUT_CANCEL((dhd_pub_t *)(cfg->pub));
+                       }
+               }
+       }
+       return ret;
+}
+
+static s32
+wl_cfg80211_change_virtual_iface(struct wiphy *wiphy, struct net_device *ndev,
+       enum nl80211_iftype type, u32 *flags,
+       struct vif_params *params)
+{
+       s32 ap = 0;
+       s32 infra = 0;
+       s32 ibss = 0;
+       s32 wlif_type;
+       s32 mode = 0;
+       s32 err = BCME_OK;
+       s32 index;
+       s32 conn_idx = -1;
+       chanspec_t chspec;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+
+       WL_DBG(("Enter type %d\n", type));
+       switch (type) {
+       case NL80211_IFTYPE_MONITOR:
+       case NL80211_IFTYPE_WDS:
+       case NL80211_IFTYPE_MESH_POINT:
+               ap = 1;
+               WL_ERR(("type (%d) : currently we do not support this type\n",
+                       type));
+               break;
+       case NL80211_IFTYPE_ADHOC:
+               mode = WL_MODE_IBSS;
+               ibss = 1;
+               break;
+       case NL80211_IFTYPE_STATION:
+       case NL80211_IFTYPE_P2P_CLIENT:
+               mode = WL_MODE_BSS;
+               infra = 1;
+               break;
+       case NL80211_IFTYPE_AP:
+               dhd->op_mode |= DHD_FLAG_HOSTAP_MODE;
+               /* intentional fall through */
+       case NL80211_IFTYPE_AP_VLAN:
+       case NL80211_IFTYPE_P2P_GO:
+               mode = WL_MODE_AP;
+               ap = 1;
+               break;
+       default:
+               return -EINVAL;
+       }
+       if (!dhd)
+               return -EINVAL;
+
+       /* If any scan is going on, abort it */
+       if (wl_get_drv_status_all(cfg, SCANNING)) {
+               int wait_cnt = MAX_SCAN_ABORT_WAIT_CNT;
+               WL_ERR(("Scan in progress. Aborting the scan!\n"));
+               wl_cfg80211_scan_abort(cfg);
+               while (wl_get_drv_status_all(cfg, SCANNING) && wait_cnt) {
+                       WL_DBG(("Waiting for SCANNING terminated, wait_cnt: %d\n", wait_cnt));
+                       wait_cnt--;
+                       OSL_SLEEP(WAIT_SCAN_ABORT_OSL_SLEEP_TIME);
+               }
+               if (wl_get_drv_status_all(cfg, SCANNING)) {
+                       wl_notify_escan_complete(cfg, cfg->escan_info.ndev, true, true);
+               }
+       }
+
+       if (ap) {
+               wl_set_mode_by_netdev(cfg, ndev, mode);
+               if (is_p2p_group_iface(ndev->ieee80211_ptr) &&
+                       cfg->p2p && wl_cfgp2p_vif_created(cfg)) {
+                       WL_DBG(("p2p_vif_created p2p_on (%d)\n", p2p_on(cfg)));
+                       if (wl_check_dongle_idle(wiphy) != TRUE) {
+                               WL_ERR(("FW is busy to add interface"));
+                               return -EINVAL;
+                       }
+                       wldev_iovar_setint(ndev, "mpc", 0);
+                       wl_notify_escan_complete(cfg, ndev, true, true);
+
+                       /* Dual p2p doesn't support multiple P2PGO interfaces,
+                        * p2p_go_count is the counter for GO creation
+                        * requests.
+                        */
+                       if ((cfg->p2p->p2p_go_count > 0) && (type == NL80211_IFTYPE_P2P_GO)) {
+                               wl_set_mode_by_netdev(cfg, ndev, WL_MODE_BSS);
+                               WL_ERR(("Fw doesnot support  multiple GO "));
+                               return BCME_ERROR;
+                       }
+                       /* In concurrency case, STA may be already associated in a particular
+                        * channel. so retrieve the current channel of primary interface and
+                        * then start the virtual interface on that.
+                        */
+                       chspec = wl_cfg80211_get_shared_freq(wiphy);
+                       index = wl_get_bssidx_by_wdev(cfg, ndev->ieee80211_ptr);
+                       if (index < 0) {
+                               WL_ERR(("Find p2p index from ndev(%p) failed\n", ndev));
+                               return BCME_ERROR;
+                       }
+                       if (wl_cfgp2p_find_type(cfg, index, &conn_idx) != BCME_OK)
+                               return BCME_ERROR;
+
+                       wlif_type = WL_P2P_IF_GO;
+                       WL_DBG(("%s : ap (%d), infra (%d), iftype (%d) conn_idx (%d)\n",
+                               ndev->name, ap, infra, type, conn_idx));
+                       wl_set_p2p_status(cfg, IF_CHANGING);
+                       wl_clr_p2p_status(cfg, IF_CHANGED);
+                       wl_cfgp2p_ifchange(cfg, wl_to_p2p_bss_macaddr(cfg, conn_idx),
+                               htod32(wlif_type), chspec, conn_idx);
+                       wait_event_interruptible_timeout(cfg->netif_change_event,
+                               (wl_get_p2p_status(cfg, IF_CHANGED) == true),
+                               msecs_to_jiffies(MAX_WAIT_TIME));
+                       wl_set_mode_by_netdev(cfg, ndev, mode);
+                       dhd->op_mode &= ~DHD_FLAG_P2P_GC_MODE;
+                       dhd->op_mode |= DHD_FLAG_P2P_GO_MODE;
+                       wl_clr_p2p_status(cfg, IF_CHANGING);
+                       wl_clr_p2p_status(cfg, IF_CHANGED);
+                       if (mode == WL_MODE_AP)
+                               wl_set_drv_status(cfg, CONNECTED, ndev);
+#ifdef SUPPORT_AP_POWERSAVE
+                       dhd_set_ap_powersave(dhd, 0, TRUE);
+#endif /* SUPPORT_AP_POWERSAVE */
+               } else if ((wl_get_netinfo_by_netdev(cfg, ndev) != NULL) &&
+                       !wl_get_drv_status(cfg, AP_CREATED, ndev)) {
+                       wl_set_drv_status(cfg, AP_CREATING, ndev);
+               } else {
+                       WL_ERR(("Cannot change the interface for GO or SOFTAP\n"));
+                       return -EINVAL;
+               }
+       } else {
+               /* P2P GO interface deletion is handled on the basis of role type (AP).
+                * So avoid changing role for p2p type.
+                */
+               if (ndev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
+                       wl_set_mode_by_netdev(cfg, ndev, mode);
+               WL_DBG(("Change_virtual_iface for transition from GO/AP to client/STA"));
+#ifdef SUPPORT_AP_POWERSAVE
+               dhd_set_ap_powersave(dhd, 0, FALSE);
+#endif /* SUPPORT_AP_POWERSAVE */
+       }
+
+       if (ibss) {
+               infra = 0;
+               wl_set_mode_by_netdev(cfg, ndev, mode);
+               err = wldev_ioctl(ndev, WLC_SET_INFRA, &infra, sizeof(s32), true);
+               if (err < 0) {
+                       WL_ERR(("SET Adhoc error %d\n", err));
+                       return -EINVAL;
+               }
+       }
+
+       ndev->ieee80211_ptr->iftype = type;
+       return 0;
+}
+
+s32
+wl_cfg80211_notify_ifadd(void *cfg80211_priv, int ifidx, char *name, uint8 *mac, uint8 bssidx)
+{
+       bool ifadd_expected = FALSE;
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)cfg80211_priv;
+
+       /* P2P may send WLC_E_IF_ADD and/or WLC_E_IF_CHANGE during IF updating ("p2p_ifupd")
+        * redirect the IF_ADD event to ifchange as it is not a real "new" interface
+        */
+       if (wl_get_p2p_status(cfg, IF_CHANGING))
+               return wl_cfg80211_notify_ifchange(cfg80211_priv, ifidx, name, mac, bssidx);
+
+       /* Okay, we are expecting IF_ADD (as IF_ADDING is true) */
+       if (wl_get_p2p_status(cfg, IF_ADDING)) {
+               ifadd_expected = TRUE;
+               wl_clr_p2p_status(cfg, IF_ADDING);
+       } else if (cfg->bss_pending_op) {
+               ifadd_expected = TRUE;
+               cfg->bss_pending_op = FALSE;
+       }
+
+       if (ifadd_expected) {
+               wl_if_event_info *if_event_info = &cfg->if_event_info;
+
+               if_event_info->valid = TRUE;
+               if_event_info->ifidx = ifidx;
+               if_event_info->bssidx = bssidx;
+               strncpy(if_event_info->name, name, IFNAMSIZ);
+               if_event_info->name[IFNAMSIZ] = '\0';
+               if (mac)
+                       memcpy(if_event_info->mac, mac, ETHER_ADDR_LEN);
+               wake_up_interruptible(&cfg->netif_change_event);
+               return BCME_OK;
+       }
+
+       return BCME_ERROR;
+}
+
+s32
+wl_cfg80211_notify_ifdel(void *cfg80211_priv, int ifidx, char *name, uint8 *mac, uint8 bssidx)
+{
+       bool ifdel_expected = FALSE;
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)cfg80211_priv;
+       wl_if_event_info *if_event_info = &cfg->if_event_info;
+
+       if (wl_get_p2p_status(cfg, IF_DELETING)) {
+               ifdel_expected = TRUE;
+               wl_clr_p2p_status(cfg, IF_DELETING);
+       } else if (cfg->bss_pending_op) {
+               ifdel_expected = TRUE;
+               cfg->bss_pending_op = FALSE;
+       }
+
+       if (ifdel_expected) {
+               if_event_info->valid = TRUE;
+               if_event_info->ifidx = ifidx;
+               if_event_info->bssidx = bssidx;
+               wake_up_interruptible(&cfg->netif_change_event);
+               return BCME_OK;
+       }
+
+       return BCME_ERROR;
+}
+
+s32
+wl_cfg80211_notify_ifchange(void *cfg80211_priv, int ifidx, char *name, uint8 *mac, uint8 bssidx)
+{
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)cfg80211_priv;
+
+       if (wl_get_p2p_status(cfg, IF_CHANGING)) {
+               wl_set_p2p_status(cfg, IF_CHANGED);
+               wake_up_interruptible(&cfg->netif_change_event);
+               return BCME_OK;
+       }
+
+       return BCME_ERROR;
+}
+
+static s32 wl_cfg80211_handle_ifdel(struct bcm_cfg80211 *cfg, wl_if_event_info *if_event_info,
+       struct net_device* ndev)
+{
+       s32 type = -1;
+       s32 bssidx = -1;
+#ifdef PROP_TXSTATUS_VSDB
+#if defined(BCMSDIO)
+       dhd_pub_t *dhd =  (dhd_pub_t *)(cfg->pub);
+       bool enabled;
+#endif 
+#endif /* PROP_TXSTATUS_VSDB */
+
+       bssidx = if_event_info->bssidx;
+       if (bssidx != wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_CONNECTION1) &&
+               bssidx != wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_CONNECTION2)) {
+               WL_ERR(("got IF_DEL for if %d, not owned by cfg driver\n", bssidx));
+               return BCME_ERROR;
+       }
+
+       if (p2p_is_on(cfg) && wl_cfgp2p_vif_created(cfg)) {
+               if (cfg->scan_request && (cfg->escan_info.ndev == ndev)) {
+                       /* Abort any pending scan requests */
+                       cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
+                       WL_DBG(("ESCAN COMPLETED\n"));
+                       wl_notify_escan_complete(cfg, cfg->escan_info.ndev, true, false);
+               }
+
+               memset(cfg->p2p->vir_ifname, '\0', IFNAMSIZ);
+               if (wl_cfgp2p_find_type(cfg, bssidx, &type) == BCME_OK) {
+                       /* Update P2P data */
+                       wl_clr_drv_status(cfg, CONNECTED, wl_to_p2p_bss_ndev(cfg, type));
+                       wl_to_p2p_bss_ndev(cfg, type) = NULL;
+                       wl_to_p2p_bss_bssidx(cfg, type) = -1;
+               } else if (wl_get_bssidx_by_wdev(cfg, ndev->ieee80211_ptr) < 0) {
+                       WL_ERR(("bssidx not known for the given ndev as per net_info data \n"));
+                       return BCME_ERROR;
+               }
+
+#ifdef PROP_TXSTATUS_VSDB
+#if defined(BCMSDIO)
+               dhd_wlfc_get_enable(dhd, &enabled);
+               if (enabled && cfg->wlfc_on && dhd->op_mode != DHD_FLAG_HOSTAP_MODE &&
+                       dhd->op_mode != DHD_FLAG_IBSS_MODE) {
+                       dhd_wlfc_deinit(dhd);
+                       cfg->wlfc_on = false;
+               }
+#endif 
+#endif /* PROP_TXSTATUS_VSDB */
+       }
+
+       dhd_net_if_lock(ndev);
+       wl_cfg80211_remove_if(cfg, if_event_info->ifidx, ndev);
+       dhd_net_if_unlock(ndev);
+
+       return BCME_OK;
+}
+
+/* Find listen channel */
+static s32 wl_find_listen_channel(struct bcm_cfg80211 *cfg,
+       const u8 *ie, u32 ie_len)
+{
+       wifi_p2p_ie_t *p2p_ie;
+       u8 *end, *pos;
+       s32 listen_channel;
+
+/* unfortunately const cast required here - function is
+ * a callback so its signature must not be changed
+ * and cascade of changing wl_cfgp2p_find_p2pie
+ * causes need for const cast in other places
+ */
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+_Pragma("GCC diagnostic push")
+_Pragma("GCC diagnostic ignored \"-Wcast-qual\"")
+#endif
+       pos = (u8 *)ie;
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+_Pragma("GCC diagnostic pop")
+#endif
+       p2p_ie = wl_cfgp2p_find_p2pie(pos, ie_len);
+
+       if (p2p_ie == NULL)
+               return 0;
+
+       pos = p2p_ie->subelts;
+       end = p2p_ie->subelts + (p2p_ie->len - 4);
+
+       CFGP2P_DBG((" found p2p ie ! lenth %d \n",
+               p2p_ie->len));
+
+       while (pos < end) {
+               uint16 attr_len;
+               if (pos + 2 >= end) {
+                       CFGP2P_DBG((" -- Invalid P2P attribute"));
+                       return 0;
+               }
+               attr_len = ((uint16) (((pos + 1)[1] << 8) | (pos + 1)[0]));
+
+               if (pos + 3 + attr_len > end) {
+                       CFGP2P_DBG(("P2P: Attribute underflow "
+                                  "(len=%u left=%d)",
+                                  attr_len, (int) (end - pos - 3)));
+                       return 0;
+               }
+
+               /* if Listen Channel att id is 6 and the vailue is valid,
+                * return the listen channel
+                */
+               if (pos[0] == 6) {
+                       /* listen channel subel length format
+                        * 1(id) + 2(len) + 3(country) + 1(op. class) + 1(chan num)
+                        */
+                       listen_channel = pos[1 + 2 + 3 + 1];
+
+                       if (listen_channel == SOCIAL_CHAN_1 ||
+                               listen_channel == SOCIAL_CHAN_2 ||
+                               listen_channel == SOCIAL_CHAN_3) {
+                               CFGP2P_DBG((" Found my Listen Channel %d \n", listen_channel));
+                               return listen_channel;
+                       }
+               }
+               pos += 3 + attr_len;
+       }
+       return 0;
+}
+
+static void wl_scan_prep(struct wl_scan_params *params, struct cfg80211_scan_request *request)
+{
+       u32 n_ssids;
+       u32 n_channels;
+       u16 channel;
+       chanspec_t chanspec;
+       s32 i = 0, j = 0, offset;
+       char *ptr;
+       wlc_ssid_t ssid;
+       struct bcm_cfg80211 *cfg = NULL;
+       struct wireless_dev *wdev;
+
+       memcpy(&params->bssid, &ether_bcast, ETHER_ADDR_LEN);
+       params->bss_type = DOT11_BSSTYPE_ANY;
+       params->scan_type = 0;
+       params->nprobes = -1;
+       params->active_time = -1;
+       params->passive_time = -1;
+       params->home_time = -1;
+       params->channel_num = 0;
+       memset(&params->ssid, 0, sizeof(wlc_ssid_t));
+
+       WL_SCAN(("Preparing Scan request\n"));
+       WL_SCAN(("nprobes=%d\n", params->nprobes));
+       WL_SCAN(("active_time=%d\n", params->active_time));
+       WL_SCAN(("passive_time=%d\n", params->passive_time));
+       WL_SCAN(("home_time=%d\n", params->home_time));
+       WL_SCAN(("scan_type=%d\n", params->scan_type));
+
+       params->nprobes = htod32(params->nprobes);
+       params->active_time = htod32(params->active_time);
+       params->passive_time = htod32(params->passive_time);
+       params->home_time = htod32(params->home_time);
+
+       /* if request is null just exit so it will be all channel broadcast scan */
+       if (!request)
+               return;
+
+       n_ssids = request->n_ssids;
+       n_channels = request->n_channels;
+
+       /* Copy channel array if applicable */
+       WL_SCAN(("### List of channelspecs to scan ###\n"));
+       if (n_channels > 0) {
+#if defined(WL_CFG80211_P2P_DEV_IF)
+               wdev = request->wdev;
+#else
+               wdev = request->dev->ieee80211_ptr;
+#endif /* WL_CFG80211_P2P_DEV_IF */
+               cfg = WDEV_GET_CFG80211_PRIV(wdev);
+               for (i = 0; i < n_channels; i++) {
+                       chanspec = 0;
+                       channel = ieee80211_frequency_to_channel(request->channels[i]->center_freq);
+                       /* SKIP DFS channels for Secondary interface */
+                       if ((cfg->escan_info.ndev != bcmcfg_to_prmry_ndev(cfg)) &&
+                               (request->channels[i]->flags &
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 14, 0))
+                               (IEEE80211_CHAN_RADAR | IEEE80211_CHAN_PASSIVE_SCAN)))
+#else
+                               (IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IR)))
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(3, 14, 0) */
+                               continue;
+
+                       chanspec = wl_cfg80211_ulb_get_min_bw_chspec(wdev, -1);
+                       if (chanspec == INVCHANSPEC) {
+                               WL_ERR(("Invalid chanspec! Skipping channel\n"));
+                               continue;
+                       }
+
+                       if (request->channels[i]->band == IEEE80211_BAND_2GHZ) {
+                               chanspec |= WL_CHANSPEC_BAND_2G;
+                       } else {
+                               chanspec |= WL_CHANSPEC_BAND_5G;
+                       }
+                       params->channel_list[j] = channel;
+                       params->channel_list[j] &= WL_CHANSPEC_CHAN_MASK;
+                       params->channel_list[j] |= chanspec;
+                       WL_SCAN(("Chan : %d, Channel spec: %x \n",
+                               channel, params->channel_list[j]));
+                       params->channel_list[j] = wl_chspec_host_to_driver(params->channel_list[j]);
+                       j++;
+               }
+       } else {
+               WL_SCAN(("Scanning all channels\n"));
+       }
+       n_channels = j;
+       /* Copy ssid array if applicable */
+       WL_SCAN(("### List of SSIDs to scan ###\n"));
+       if (n_ssids > 0) {
+               offset = offsetof(wl_scan_params_t, channel_list) + n_channels * sizeof(u16);
+               offset = roundup(offset, sizeof(u32));
+               ptr = (char*)params + offset;
+               for (i = 0; i < n_ssids; i++) {
+                       memset(&ssid, 0, sizeof(wlc_ssid_t));
+                       ssid.SSID_len = MIN(request->ssids[i].ssid_len, DOT11_MAX_SSID_LEN);
+                       memcpy(ssid.SSID, request->ssids[i].ssid, ssid.SSID_len);
+                       if (!ssid.SSID_len)
+                               WL_SCAN(("%d: Broadcast scan\n", i));
+                       else
+                               WL_SCAN(("%d: scan  for  %s size =%d\n", i,
+                               ssid.SSID, ssid.SSID_len));
+                       memcpy(ptr, &ssid, sizeof(wlc_ssid_t));
+                       ptr += sizeof(wlc_ssid_t);
+               }
+       } else {
+               WL_SCAN(("Broadcast scan\n"));
+       }
+       /* Adding mask to channel numbers */
+       params->channel_num =
+               htod32((n_ssids << WL_SCAN_PARAMS_NSSID_SHIFT) |
+                      (n_channels & WL_SCAN_PARAMS_COUNT_MASK));
+
+       if (n_channels == 1) {
+               params->active_time = htod32(WL_SCAN_CONNECT_DWELL_TIME_MS);
+               params->nprobes = htod32(params->active_time / WL_SCAN_JOIN_PROBE_INTERVAL_MS);
+       }
+}
+
+static s32
+wl_get_valid_channels(struct net_device *ndev, u8 *valid_chan_list, s32 size)
+{
+       wl_uint32_list_t *list;
+       s32 err = BCME_OK;
+       if (valid_chan_list == NULL || size <= 0)
+               return -ENOMEM;
+
+       memset(valid_chan_list, 0, size);
+       list = (wl_uint32_list_t *)(void *) valid_chan_list;
+       list->count = htod32(WL_NUMCHANNELS);
+       err = wldev_ioctl(ndev, WLC_GET_VALID_CHANNELS, valid_chan_list, size, false);
+       if (err != 0) {
+               WL_ERR(("get channels failed with %d\n", err));
+       }
+
+       return err;
+}
+
+#if defined(USE_INITIAL_SHORT_DWELL_TIME)
+#define FIRST_SCAN_ACTIVE_DWELL_TIME_MS 40
+bool g_first_broadcast_scan = TRUE;
+#endif 
+
+static s32
+wl_run_escan(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       struct cfg80211_scan_request *request, uint16 action)
+{
+       s32 err = BCME_OK;
+       u32 n_channels;
+       u32 n_ssids;
+       s32 params_size = (WL_SCAN_PARAMS_FIXED_SIZE + OFFSETOF(wl_escan_params_t, params));
+       wl_escan_params_t *params = NULL;
+       u8 chan_buf[sizeof(u32)*(WL_NUMCHANNELS + 1)];
+       u32 num_chans = 0;
+       s32 channel;
+       u32 n_valid_chan;
+       s32 search_state = WL_P2P_DISC_ST_SCAN;
+       u32 i, j, n_nodfs = 0;
+       u16 *default_chan_list = NULL;
+       wl_uint32_list_t *list;
+       s32 bssidx = -1;
+       struct net_device *dev = NULL;
+#if defined(USE_INITIAL_SHORT_DWELL_TIME)
+       bool is_first_init_2g_scan = false;
+#endif 
+       p2p_scan_purpose_t      p2p_scan_purpose = P2P_SCAN_PURPOSE_MIN;
+
+       WL_DBG(("Enter \n"));
+
+       /* scan request can come with empty request : perform all default scan */
+       if (!cfg) {
+               err = -EINVAL;
+               goto exit;
+       }
+       if (!cfg->p2p_supported || !p2p_scan(cfg)) {
+               /* LEGACY SCAN TRIGGER */
+               WL_ERR((" LEGACY E-SCAN START\n"));
+
+#if defined(USE_INITIAL_SHORT_DWELL_TIME)
+               if (!request) {
+                       err = -EINVAL;
+                       goto exit;
+               }
+               if (ndev == bcmcfg_to_prmry_ndev(cfg) && g_first_broadcast_scan == true) {
+                       is_first_init_2g_scan = true;
+                       g_first_broadcast_scan = false;
+               }
+#endif 
+
+               /* if scan request is not empty parse scan request paramters */
+               if (request != NULL) {
+                       n_channels = request->n_channels;
+                       n_ssids = request->n_ssids;
+                       if (n_channels % 2)
+                               /* If n_channels is odd, add a padd of u16 */
+                               params_size += sizeof(u16) * (n_channels + 1);
+                       else
+                               params_size += sizeof(u16) * n_channels;
+
+                       /* Allocate space for populating ssids in wl_escan_params_t struct */
+                       params_size += sizeof(struct wlc_ssid) * n_ssids;
+               }
+               params = (wl_escan_params_t *) kzalloc(params_size, GFP_KERNEL);
+               if (params == NULL) {
+                       err = -ENOMEM;
+                       goto exit;
+               }
+               wl_scan_prep(&params->params, request);
+
+#if defined(USE_INITIAL_SHORT_DWELL_TIME)
+               /* Override active_time to reduce scan time if it's first bradcast scan. */
+               if (is_first_init_2g_scan)
+                       params->params.active_time = FIRST_SCAN_ACTIVE_DWELL_TIME_MS;
+#endif 
+
+               params->version = htod32(ESCAN_REQ_VERSION);
+               params->action =  htod16(action);
+               wl_escan_set_sync_id(params->sync_id, cfg);
+               wl_escan_set_type(cfg, WL_SCANTYPE_LEGACY);
+               if (params_size + sizeof("escan") >= WLC_IOCTL_MEDLEN) {
+                       WL_ERR(("ioctl buffer length not sufficient\n"));
+                       kfree(params);
+                       err = -ENOMEM;
+                       goto exit;
+               }
+               if (cfg->active_scan == PASSIVE_SCAN) {
+                       params->params.scan_type = DOT11_SCANTYPE_PASSIVE;
+                       WL_DBG(("Passive scan_type %d \n", params->params.scan_type));
+               }
+
+               bssidx = wl_get_bssidx_by_wdev(cfg, ndev->ieee80211_ptr);
+
+               err = wldev_iovar_setbuf(ndev, "escan", params, params_size,
+                       cfg->escan_ioctl_buf, WLC_IOCTL_MEDLEN, NULL);
+               WL_ERR(("LEGACY_SCAN sync ID: %d, bssidx: %d\n", params->sync_id, bssidx));
+               if (unlikely(err)) {
+                       if (err == BCME_EPERM)
+                               /* Scan Not permitted at this point of time */
+                               WL_DBG((" Escan not permitted at this time (%d)\n", err));
+                       else
+                               WL_ERR((" Escan set error (%d)\n", err));
+               }
+               kfree(params);
+       }
+       else if (p2p_is_on(cfg) && p2p_scan(cfg)) {
+               /* P2P SCAN TRIGGER */
+               s32 _freq = 0;
+               n_nodfs = 0;
+               if (request && request->n_channels) {
+                       num_chans = request->n_channels;
+                       WL_ERR((" chann number : %d\n", num_chans));
+                       default_chan_list = kzalloc(num_chans * sizeof(*default_chan_list),
+                               GFP_KERNEL);
+                       if (default_chan_list == NULL) {
+                               WL_ERR(("channel list allocation failed \n"));
+                               err = -ENOMEM;
+                               goto exit;
+                       }
+                       if (!wl_get_valid_channels(ndev, chan_buf, sizeof(chan_buf))) {
+#ifdef P2P_SKIP_DFS
+                               int is_printed = false;
+#endif /* P2P_SKIP_DFS */
+                               list = (wl_uint32_list_t *) chan_buf;
+                               n_valid_chan = dtoh32(list->count);
+                               if (n_valid_chan > WL_NUMCHANNELS) {
+                                       WL_ERR(("wrong n_valid_chan:%d.\n", n_valid_chan));
+                                       kfree(default_chan_list);
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+
+                               for (i = 0; i < num_chans; i++)
+                               {
+                                       _freq = request->channels[i]->center_freq;
+                                       channel = ieee80211_frequency_to_channel(_freq);
+
+                                       /* ignore DFS channels */
+                                       if (request->channels[i]->flags &
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+                                               (IEEE80211_CHAN_NO_IR
+                                               | IEEE80211_CHAN_RADAR))
+#else
+                                               (IEEE80211_CHAN_RADAR
+                                               | IEEE80211_CHAN_PASSIVE_SCAN))
+#endif
+                                               continue;
+#ifdef P2P_SKIP_DFS
+                                       if (channel >= 52 && channel <= 144) {
+                                               if (is_printed == false) {
+                                                       WL_ERR(("SKIP DFS CHANs(52~144)\n"));
+                                                       is_printed = true;
+                                               }
+                                               continue;
+                                       }
+#endif /* P2P_SKIP_DFS */
+
+                                       for (j = 0; j < n_valid_chan; j++) {
+                                               /* allows only supported channel on
+                                               *  current reguatory
+                                               */
+                                               if (channel == (dtoh32(list->element[j]))) {
+                                                       default_chan_list[n_nodfs++] =
+                                                               channel;
+                                                       break;
+                                               }
+                                       }
+
+                               }
+                       }
+                       if (num_chans == SOCIAL_CHAN_CNT && (
+                                               (default_chan_list[0] == SOCIAL_CHAN_1) &&
+                                               (default_chan_list[1] == SOCIAL_CHAN_2) &&
+                                               (default_chan_list[2] == SOCIAL_CHAN_3))) {
+                               /* SOCIAL CHANNELS 1, 6, 11 */
+                               search_state = WL_P2P_DISC_ST_SEARCH;
+                               p2p_scan_purpose = P2P_SCAN_SOCIAL_CHANNEL;
+                               WL_INFORM(("P2P SEARCH PHASE START \n"));
+                       } else if (((dev = wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_CONNECTION1)) &&
+                               (wl_get_mode_by_netdev(cfg, dev) == WL_MODE_AP)) ||
+                               ((dev = wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_CONNECTION2)) &&
+                               (wl_get_mode_by_netdev(cfg, dev) == WL_MODE_AP))) {
+                               /* If you are already a GO, then do SEARCH only */
+                               WL_INFORM(("Already a GO. Do SEARCH Only"));
+                               search_state = WL_P2P_DISC_ST_SEARCH;
+                               num_chans = n_nodfs;
+                               p2p_scan_purpose = P2P_SCAN_NORMAL;
+
+                       } else if (num_chans == 1) {
+                               p2p_scan_purpose = P2P_SCAN_CONNECT_TRY;
+                       } else if (num_chans == SOCIAL_CHAN_CNT + 1) {
+                       /* SOCIAL_CHAN_CNT + 1 takes care of the Progressive scan supported by
+                        * the supplicant
+                        */
+                               p2p_scan_purpose = P2P_SCAN_SOCIAL_CHANNEL;
+                       } else {
+                               WL_INFORM(("P2P SCAN STATE START \n"));
+                               num_chans = n_nodfs;
+                               p2p_scan_purpose = P2P_SCAN_NORMAL;
+                       }
+               } else {
+                       err = -EINVAL;
+                       goto exit;
+               }
+               err = wl_cfgp2p_escan(cfg, ndev, ACTIVE_SCAN, num_chans, default_chan_list,
+                       search_state, action,
+                       wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE), NULL,
+                       p2p_scan_purpose);
+
+               if (!err)
+                       cfg->p2p->search_state = search_state;
+
+               kfree(default_chan_list);
+       }
+exit:
+       if (unlikely(err)) {
+               /* Don't print Error incase of Scan suppress */
+               if ((err == BCME_EPERM) && cfg->scan_suppressed)
+                       WL_DBG(("Escan failed: Scan Suppressed \n"));
+               else
+                       WL_ERR(("error (%d)\n", err));
+       }
+       return err;
+}
+
+
+static s32
+wl_do_escan(struct bcm_cfg80211 *cfg, struct wiphy *wiphy, struct net_device *ndev,
+       struct cfg80211_scan_request *request)
+{
+       s32 err = BCME_OK;
+       s32 passive_scan;
+       s32 passive_scan_time;
+       s32 passive_scan_time_org;
+       wl_scan_results_t *results;
+       WL_SCAN(("Enter \n"));
+
+       results = wl_escan_get_buf(cfg, FALSE);
+       results->version = 0;
+       results->count = 0;
+       results->buflen = WL_SCAN_RESULTS_FIXED_SIZE;
+
+       cfg->escan_info.ndev = ndev;
+       cfg->escan_info.wiphy = wiphy;
+       cfg->escan_info.escan_state = WL_ESCAN_STATE_SCANING;
+       passive_scan = cfg->active_scan ? 0 : 1;
+       err = wldev_ioctl(ndev, WLC_SET_PASSIVE_SCAN,
+               &passive_scan, sizeof(passive_scan), true);
+       if (unlikely(err)) {
+               WL_ERR(("error (%d)\n", err));
+               goto exit;
+       }
+
+       if (passive_channel_skip) {
+
+               err = wldev_ioctl(ndev, WLC_GET_SCAN_PASSIVE_TIME,
+                       &passive_scan_time_org, sizeof(passive_scan_time_org), false);
+               if (unlikely(err)) {
+                       WL_ERR(("== error (%d)\n", err));
+                       goto exit;
+               }
+
+               WL_SCAN(("PASSIVE SCAN time : %d \n", passive_scan_time_org));
+
+               passive_scan_time = 0;
+               err = wldev_ioctl(ndev, WLC_SET_SCAN_PASSIVE_TIME,
+                       &passive_scan_time, sizeof(passive_scan_time), true);
+               if (unlikely(err)) {
+                       WL_ERR(("== error (%d)\n", err));
+                       goto exit;
+               }
+
+               WL_SCAN(("PASSIVE SCAN SKIPED!! (passive_channel_skip:%d) \n",
+                       passive_channel_skip));
+       }
+
+       err = wl_run_escan(cfg, ndev, request, WL_SCAN_ACTION_START);
+
+       if (passive_channel_skip) {
+               err = wldev_ioctl(ndev, WLC_SET_SCAN_PASSIVE_TIME,
+                       &passive_scan_time_org, sizeof(passive_scan_time_org), true);
+               if (unlikely(err)) {
+                       WL_ERR(("== error (%d)\n", err));
+                       goto exit;
+               }
+
+               WL_SCAN(("PASSIVE SCAN RECOVERED!! (passive_scan_time_org:%d) \n",
+                       passive_scan_time_org));
+       }
+
+exit:
+       return err;
+}
+
+static s32
+__wl_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
+       struct cfg80211_scan_request *request,
+       struct cfg80211_ssid *this_ssid)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct cfg80211_ssid *ssids;
+       struct ether_addr primary_mac;
+       bool p2p_ssid;
+#ifdef WL11U
+       bcm_tlv_t *interworking_ie;
+       u32 iw_ie_len = 0;
+       u8 iw_ie[IW_IES_MAX_BUF_LEN];
+#endif
+       s32 err = 0;
+       s32 bssidx = -1;
+       s32 i;
+
+       unsigned long flags;
+       static s32 busy_count = 0;
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+       struct net_device *remain_on_channel_ndev = NULL;
+#endif
+       uint scan_timer_interval_ms = WL_SCAN_TIMER_INTERVAL_MS;
+
+       /*
+        * Hostapd triggers scan before starting automatic channel selection
+        * to collect channel characteristics. However firmware scan engine
+        * doesn't support any channel characteristics collection along with
+        * scan. Hence return scan success.
+        */
+       if (request && (scan_req_iftype(request) == NL80211_IFTYPE_AP)) {
+               WL_INFORM(("Scan Command on SoftAP Interface. Ignoring...\n"));
+               return 0;
+       }
+
+       ndev = ndev_to_wlc_ndev(ndev, cfg);
+
+       if (WL_DRV_STATUS_SENDING_AF_FRM_EXT(cfg)) {
+               WL_ERR(("Sending Action Frames. Try it again.\n"));
+               return -EAGAIN;
+       }
+
+       WL_DBG(("Enter wiphy (%p)\n", wiphy));
+       if (wl_get_drv_status_all(cfg, SCANNING)) {
+               if (cfg->scan_request == NULL) {
+                       wl_clr_drv_status_all(cfg, SCANNING);
+                       WL_DBG(("<<<<<<<<<<<Force Clear Scanning Status>>>>>>>>>>>\n"));
+               } else {
+                       WL_ERR(("Scanning already\n"));
+                       return -EAGAIN;
+               }
+       }
+       if (wl_get_drv_status(cfg, SCAN_ABORTING, ndev)) {
+               WL_ERR(("Scanning being aborted\n"));
+               return -EAGAIN;
+       }
+       if (request && request->n_ssids > WL_SCAN_PARAMS_SSID_MAX) {
+               WL_ERR(("request null or n_ssids > WL_SCAN_PARAMS_SSID_MAX\n"));
+               return -EOPNOTSUPP;
+       }
+
+#ifdef P2P_LISTEN_OFFLOADING
+       if (wl_get_p2p_status(cfg, DISC_IN_PROGRESS)) {
+               WL_ERR(("P2P_FIND: Discovery offload is in progress\n"));
+               return -EAGAIN;
+       }
+#endif /* P2P_LISTEN_OFFLOADING */
+
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+       remain_on_channel_ndev = wl_cfg80211_get_remain_on_channel_ndev(cfg);
+       if (remain_on_channel_ndev) {
+               WL_DBG(("Remain_on_channel bit is set, somehow it didn't get cleared\n"));
+               wl_notify_escan_complete(cfg, remain_on_channel_ndev, true, true);
+       }
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+
+
+       /* Arm scan timeout timer */
+       mod_timer(&cfg->scan_timeout, jiffies + msecs_to_jiffies(scan_timer_interval_ms));
+       if (request) {          /* scan bss */
+               ssids = request->ssids;
+               p2p_ssid = false;
+               for (i = 0; i < request->n_ssids; i++) {
+                       if (ssids[i].ssid_len &&
+                               IS_P2P_SSID(ssids[i].ssid, ssids[i].ssid_len)) {
+                               p2p_ssid = true;
+                               break;
+                       }
+               }
+               if (p2p_ssid) {
+                       if (cfg->p2p_supported) {
+                               /* p2p scan trigger */
+                               if (p2p_on(cfg) == false) {
+                                       /* p2p on at the first time */
+                                       p2p_on(cfg) = true;
+                                       wl_cfgp2p_set_firm_p2p(cfg);
+                                       get_primary_mac(cfg, &primary_mac);
+                                       wl_cfgp2p_generate_bss_mac(cfg, &primary_mac);
+#if defined(P2P_IE_MISSING_FIX)
+                                       cfg->p2p_prb_noti = false;
+#endif
+                               }
+                               wl_clr_p2p_status(cfg, GO_NEG_PHASE);
+                               WL_DBG(("P2P: GO_NEG_PHASE status cleared \n"));
+                               p2p_scan(cfg) = true;
+                       }
+               } else {
+                       /* legacy scan trigger
+                        * So, we have to disable p2p discovery if p2p discovery is on
+                        */
+                       if (cfg->p2p_supported) {
+                               p2p_scan(cfg) = false;
+                               /* If Netdevice is not equals to primary and p2p is on
+                               *  , we will do p2p scan using P2PAPI_BSSCFG_DEVICE.
+                               */
+
+                               if (p2p_scan(cfg) == false) {
+                                       if (wl_get_p2p_status(cfg, DISCOVERY_ON)) {
+                                               err = wl_cfgp2p_discover_enable_search(cfg,
+                                               false);
+                                               if (unlikely(err)) {
+                                                       goto scan_out;
+                                               }
+
+                                       }
+                               }
+                       }
+                       if (!cfg->p2p_supported || !p2p_scan(cfg)) {
+                               if ((bssidx = wl_get_bssidx_by_wdev(cfg,
+                                       ndev->ieee80211_ptr)) < 0) {
+                                       WL_ERR(("Find p2p index from ndev(%p) failed\n",
+                                               ndev));
+                                       err = BCME_ERROR;
+                                       goto scan_out;
+                               }
+#ifdef WL11U
+                               wl_get_iwdata_by_netdev(cfg, ndev, iw_ie, &iw_ie_len);
+                               if ((interworking_ie = wl_cfg80211_find_interworking_ie(
+                                       (u8 *)request->ie, request->ie_len)) != NULL) {
+                                       err = wl_cfg80211_add_iw_ie(cfg, ndev, bssidx,
+                                              VNDR_IE_CUSTOM_FLAG, interworking_ie->id,
+                                              interworking_ie->data, interworking_ie->len);
+
+                                       if (unlikely(err)) {
+                                               WL_ERR(("Failed to add interworking IE"));
+                                       }
+                               } else if (iw_ie_len != 0) {
+                               /* we have to clear IW IE and disable gratuitous APR */
+                                       wl_cfg80211_add_iw_ie(cfg, ndev, bssidx,
+                                               VNDR_IE_CUSTOM_FLAG,
+                                               DOT11_MNG_INTERWORKING_ID,
+                                               0, 0);
+
+                                       (void)wldev_iovar_setint_bsscfg(ndev, "grat_arp", 0,
+                                               bssidx);
+                                       wl_clear_iwdata_by_netdev(cfg, ndev);
+                                       /* we don't care about error */
+                               }
+#endif /* WL11U */
+                               err = wl_cfg80211_set_mgmt_vndr_ies(cfg, ndev_to_cfgdev(ndev),
+                                       bssidx, VNDR_IE_PRBREQ_FLAG, request->ie,
+                                       request->ie_len);
+
+                               if (unlikely(err)) {
+                                       goto scan_out;
+                               }
+
+                       }
+               }
+       } else {                /* scan in ibss */
+               ssids = this_ssid;
+       }
+
+       if (request && cfg->p2p_supported && !p2p_scan(cfg)) {
+               WL_TRACE_HW4(("START SCAN\n"));
+               DHD_OS_SCAN_WAKE_LOCK_TIMEOUT((dhd_pub_t *)(cfg->pub),
+                       SCAN_WAKE_LOCK_TIMEOUT);
+               DHD_DISABLE_RUNTIME_PM((dhd_pub_t *)(cfg->pub));
+       }
+
+       if (cfg->p2p_supported) {
+               if (p2p_on(cfg) && p2p_scan(cfg)) {
+
+                       /* find my listen channel */
+                       cfg->afx_hdl->my_listen_chan =
+                               wl_find_listen_channel(cfg, request->ie,
+                               request->ie_len);
+                       err = wl_cfgp2p_enable_discovery(cfg, ndev,
+                       request->ie, request->ie_len);
+
+                       if (unlikely(err)) {
+                               goto scan_out;
+                       }
+               }
+       }
+       err = wl_do_escan(cfg, wiphy, ndev, request);
+       if (likely(!err))
+               goto scan_success;
+       else
+               goto scan_out;
+
+scan_success:
+       busy_count = 0;
+       cfg->scan_request = request;
+       wl_set_drv_status(cfg, SCANNING, ndev);
+
+       return 0;
+
+scan_out:
+       if (err == BCME_BUSY || err == BCME_NOTREADY) {
+               WL_ERR(("Scan err = (%d), busy?%d", err, -EBUSY));
+               err = -EBUSY;
+       } else if ((err == BCME_EPERM) && cfg->scan_suppressed) {
+               WL_ERR(("Scan not permitted due to scan suppress\n"));
+               err = -EPERM;
+       } else {
+               /* For all other fw errors, use a generic error code as return
+                * value to cfg80211 stack
+                */
+               err = -EAGAIN;
+       }
+
+#define SCAN_EBUSY_RETRY_LIMIT 20
+       if (err == -EBUSY) {
+               if (busy_count++ > SCAN_EBUSY_RETRY_LIMIT) {
+                       struct ether_addr bssid;
+                       s32 ret = 0;
+#if defined(DHD_DEBUG) && defined(BCMPCIE) && defined(DHD_FW_COREDUMP)
+                       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+#endif /* DHD_DEBUG && BCMPCIE && DHD_FW_COREDUMP */
+                       busy_count = 0;
+                       WL_ERR(("Unusual continuous EBUSY error, %d %d %d %d %d %d %d %d %d\n",
+                               wl_get_drv_status(cfg, SCANNING, ndev),
+                               wl_get_drv_status(cfg, SCAN_ABORTING, ndev),
+                               wl_get_drv_status(cfg, CONNECTING, ndev),
+                               wl_get_drv_status(cfg, CONNECTED, ndev),
+                               wl_get_drv_status(cfg, DISCONNECTING, ndev),
+                               wl_get_drv_status(cfg, AP_CREATING, ndev),
+                               wl_get_drv_status(cfg, AP_CREATED, ndev),
+                               wl_get_drv_status(cfg, SENDING_ACT_FRM, ndev),
+                               wl_get_drv_status(cfg, SENDING_ACT_FRM, ndev)));
+
+#if defined(DHD_DEBUG) && defined(BCMPCIE) && defined(DHD_FW_COREDUMP)
+                       if (dhdp->memdump_enabled) {
+                               dhdp->memdump_type = DUMP_TYPE_SCAN_BUSY;
+                               dhd_bus_mem_dump(dhdp);
+                       }
+#endif /* DHD_DEBUG && BCMPCIE && DHD_FW_COREDUMP */
+
+                       bzero(&bssid, sizeof(bssid));
+                       if ((ret = wldev_ioctl(ndev, WLC_GET_BSSID,
+                               &bssid, ETHER_ADDR_LEN, false)) == 0)
+                               WL_ERR(("FW is connected with " MACDBG "/n",
+                                       MAC2STRDBG(bssid.octet)));
+                       else
+                               WL_ERR(("GET BSSID failed with %d\n", ret));
+
+                       wl_cfg80211_scan_abort(cfg);
+
+               } else {
+                       /* Hold the context for 400msec, so that 10 subsequent scans
+                       * can give a buffer of 4sec which is enough to
+                       * cover any on-going scan in the firmware
+                       */
+                       WL_DBG(("Enforcing delay for EBUSY case \n"));
+                       msleep(500);
+               }
+       } else {
+               busy_count = 0;
+       }
+
+       wl_clr_drv_status(cfg, SCANNING, ndev);
+       if (timer_pending(&cfg->scan_timeout))
+               del_timer_sync(&cfg->scan_timeout);
+       DHD_OS_SCAN_WAKE_UNLOCK((dhd_pub_t *)(cfg->pub));
+       spin_lock_irqsave(&cfg->cfgdrv_lock, flags);
+       cfg->scan_request = NULL;
+       spin_unlock_irqrestore(&cfg->cfgdrv_lock, flags);
+
+       return err;
+}
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+static s32
+wl_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
+#else
+static s32
+wl_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
+       struct cfg80211_scan_request *request)
+#endif /* WL_CFG80211_P2P_DEV_IF */
+{
+       s32 err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+#if defined(WL_CFG80211_P2P_DEV_IF)
+       struct net_device *ndev = wdev_to_wlc_ndev(request->wdev, cfg);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+       WL_DBG(("Enter\n"));
+       RETURN_EIO_IF_NOT_UP(cfg);
+
+       mutex_lock(&cfg->usr_sync);
+       err = __wl_cfg80211_scan(wiphy, ndev, request, NULL);
+       if (unlikely(err)) {
+               WL_ERR(("scan error (%d)\n", err));
+       }
+       mutex_unlock(&cfg->usr_sync);
+
+       return err;
+}
+
+static s32 wl_set_rts(struct net_device *dev, u32 rts_threshold)
+{
+       s32 err = 0;
+
+       err = wldev_iovar_setint(dev, "rtsthresh", rts_threshold);
+       if (unlikely(err)) {
+               WL_ERR(("Error (%d)\n", err));
+               return err;
+       }
+       return err;
+}
+
+static s32 wl_set_frag(struct net_device *dev, u32 frag_threshold)
+{
+       s32 err = 0;
+
+       err = wldev_iovar_setint_bsscfg(dev, "fragthresh", frag_threshold, 0);
+       if (unlikely(err)) {
+               WL_ERR(("Error (%d)\n", err));
+               return err;
+       }
+       return err;
+}
+
+static s32 wl_set_retry(struct net_device *dev, u32 retry, bool l)
+{
+       s32 err = 0;
+       u32 cmd = (l ? WLC_SET_LRL : WLC_SET_SRL);
+
+       retry = htod32(retry);
+       err = wldev_ioctl(dev, cmd, &retry, sizeof(retry), true);
+       if (unlikely(err)) {
+               WL_ERR(("cmd (%d) , error (%d)\n", cmd, err));
+               return err;
+       }
+       return err;
+}
+
+static s32 wl_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
+{
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)wiphy_priv(wiphy);
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+       s32 err = 0;
+
+       RETURN_EIO_IF_NOT_UP(cfg);
+       WL_DBG(("Enter\n"));
+       if (changed & WIPHY_PARAM_RTS_THRESHOLD &&
+               (cfg->conf->rts_threshold != wiphy->rts_threshold)) {
+               cfg->conf->rts_threshold = wiphy->rts_threshold;
+               err = wl_set_rts(ndev, cfg->conf->rts_threshold);
+               if (!err)
+                       return err;
+       }
+       if (changed & WIPHY_PARAM_FRAG_THRESHOLD &&
+               (cfg->conf->frag_threshold != wiphy->frag_threshold)) {
+               cfg->conf->frag_threshold = wiphy->frag_threshold;
+               err = wl_set_frag(ndev, cfg->conf->frag_threshold);
+               if (!err)
+                       return err;
+       }
+       if (changed & WIPHY_PARAM_RETRY_LONG &&
+               (cfg->conf->retry_long != wiphy->retry_long)) {
+               cfg->conf->retry_long = wiphy->retry_long;
+               err = wl_set_retry(ndev, cfg->conf->retry_long, true);
+               if (!err)
+                       return err;
+       }
+       if (changed & WIPHY_PARAM_RETRY_SHORT &&
+               (cfg->conf->retry_short != wiphy->retry_short)) {
+               cfg->conf->retry_short = wiphy->retry_short;
+               err = wl_set_retry(ndev, cfg->conf->retry_short, false);
+               if (!err) {
+                       return err;
+               }
+       }
+
+       return err;
+}
+static chanspec_t
+channel_to_chanspec(struct wiphy *wiphy, struct net_device *dev, u32 channel, u32 bw_cap)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       u8 *buf = NULL;
+       wl_uint32_list_t *list;
+       int err = BCME_OK;
+       chanspec_t c = 0, ret_c = 0;
+       int bw = 0, tmp_bw = 0;
+       int i;
+       u32 tmp_c;
+       u16 kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+#define LOCAL_BUF_SIZE 1024
+       buf = (u8 *) kzalloc(LOCAL_BUF_SIZE, kflags);
+       if (!buf) {
+               WL_ERR(("buf memory alloc failed\n"));
+               goto exit;
+       }
+       list = (wl_uint32_list_t *)(void *)buf;
+       list->count = htod32(WL_NUMCHANSPECS);
+       err = wldev_iovar_getbuf_bsscfg(dev, "chanspecs", NULL,
+               0, buf, LOCAL_BUF_SIZE, 0, &cfg->ioctl_buf_sync);
+       if (err != BCME_OK) {
+               WL_ERR(("get chanspecs failed with %d\n", err));
+               goto exit;
+       }
+       for (i = 0; i < dtoh32(list->count); i++) {
+               c = dtoh32(list->element[i]);
+               if (channel <= CH_MAX_2G_CHANNEL) {
+                       if (!CHSPEC_IS20(c))
+                               continue;
+                       if (channel == CHSPEC_CHANNEL(c)) {
+                               ret_c = c;
+                               bw = 20;
+                               goto exit;
+                       }
+               }
+               tmp_c = wf_chspec_ctlchan(c);
+               tmp_bw = bw2cap[CHSPEC_BW(c) >> WL_CHANSPEC_BW_SHIFT];
+               if (tmp_c != channel)
+                       continue;
+
+               if ((tmp_bw > bw) && (tmp_bw <= bw_cap)) {
+                       bw = tmp_bw;
+                       ret_c = c;
+                       if (bw == bw_cap)
+                               goto exit;
+               }
+       }
+exit:
+       if (buf)
+               kfree(buf);
+#undef LOCAL_BUF_SIZE
+       WL_INFORM(("return chanspec %x %d\n", ret_c, bw));
+       return ret_c;
+}
+
+void
+wl_cfg80211_ibss_vsie_set_buffer(struct net_device *dev,
+       vndr_ie_setbuf_t *ibss_vsie, int ibss_vsie_len)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+
+       if (cfg != NULL && ibss_vsie != NULL) {
+               if (cfg->ibss_vsie != NULL) {
+                       kfree(cfg->ibss_vsie);
+               }
+               cfg->ibss_vsie = ibss_vsie;
+               cfg->ibss_vsie_len = ibss_vsie_len;
+       }
+}
+
+static void
+wl_cfg80211_ibss_vsie_free(struct bcm_cfg80211 *cfg)
+{
+       /* free & initiralize VSIE (Vendor Specific IE) */
+       if (cfg->ibss_vsie != NULL) {
+               kfree(cfg->ibss_vsie);
+               cfg->ibss_vsie = NULL;
+               cfg->ibss_vsie_len = 0;
+       }
+}
+
+s32
+wl_cfg80211_ibss_vsie_delete(struct net_device *dev)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+       char *ioctl_buf = NULL;
+       s32 ret = BCME_OK;
+
+       if (cfg != NULL && cfg->ibss_vsie != NULL) {
+               ioctl_buf = kmalloc(WLC_IOCTL_MEDLEN, GFP_KERNEL);
+               if (!ioctl_buf) {
+                       WL_ERR(("ioctl memory alloc failed\n"));
+                       return -ENOMEM;
+               }
+
+               /* change the command from "add" to "del" */
+               strncpy(cfg->ibss_vsie->cmd, "del", VNDR_IE_CMD_LEN - 1);
+               cfg->ibss_vsie->cmd[VNDR_IE_CMD_LEN - 1] = '\0';
+
+               ret = wldev_iovar_setbuf(dev, "ie",
+                       cfg->ibss_vsie, cfg->ibss_vsie_len,
+                       ioctl_buf, WLC_IOCTL_MEDLEN, NULL);
+               WL_ERR(("ret=%d\n", ret));
+
+               if (ret == BCME_OK) {
+                       /* free & initiralize VSIE */
+                       kfree(cfg->ibss_vsie);
+                       cfg->ibss_vsie = NULL;
+                       cfg->ibss_vsie_len = 0;
+               }
+
+               if (ioctl_buf) {
+                       kfree(ioctl_buf);
+               }
+       }
+
+       return ret;
+}
+
+#ifdef WLAIBSS_MCHAN
+static bcm_struct_cfgdev*
+bcm_cfg80211_add_ibss_if(struct wiphy *wiphy, char *name)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct wireless_dev* wdev = NULL;
+       struct net_device *new_ndev = NULL;
+       struct net_device *primary_ndev = NULL;
+       s32 timeout;
+       wl_aibss_if_t aibss_if;
+       wl_if_event_info *event = NULL;
+
+       if (cfg->ibss_cfgdev != NULL) {
+               WL_ERR(("IBSS interface %s already exists\n", name));
+               return NULL;
+       }
+
+       WL_ERR(("Try to create IBSS interface %s\n", name));
+       primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+       /* generate a new MAC address for the IBSS interface */
+       get_primary_mac(cfg, &cfg->ibss_if_addr);
+       cfg->ibss_if_addr.octet[4] ^= 0x40;
+       memset(&aibss_if, sizeof(aibss_if), 0);
+       memcpy(&aibss_if.addr, &cfg->ibss_if_addr, sizeof(aibss_if.addr));
+       aibss_if.chspec = 0;
+       aibss_if.len = sizeof(aibss_if);
+
+       cfg->bss_pending_op = TRUE;
+       memset(&cfg->if_event_info, 0, sizeof(cfg->if_event_info));
+       err = wldev_iovar_setbuf(primary_ndev, "aibss_ifadd", &aibss_if,
+               sizeof(aibss_if), cfg->ioctl_buf, WLC_IOCTL_MAXLEN, NULL);
+       if (err) {
+               WL_ERR(("IOVAR aibss_ifadd failed with error %d\n", err));
+               goto fail;
+       }
+       timeout = wait_event_interruptible_timeout(cfg->netif_change_event,
+               !cfg->bss_pending_op, msecs_to_jiffies(MAX_WAIT_TIME));
+       if (timeout <= 0 || cfg->bss_pending_op)
+               goto fail;
+
+       event = &cfg->if_event_info;
+       /* By calling wl_cfg80211_allocate_if (dhd_allocate_if eventually) we give the control
+        * over this net_device interface to dhd_linux, hence the interface is managed by dhd_liux
+        * and will be freed by dhd_detach unless it gets unregistered before that. The
+        * wireless_dev instance new_ndev->ieee80211_ptr associated with this net_device will
+        * be freed by wl_dealloc_netinfo
+        */
+       new_ndev = wl_cfg80211_allocate_if(cfg, event->ifidx, event->name,
+               event->mac, event->bssidx, event->name);
+       if (new_ndev == NULL)
+               goto fail;
+       wdev = kzalloc(sizeof(*wdev), GFP_KERNEL);
+       if (wdev == NULL)
+               goto fail;
+       wdev->wiphy = wiphy;
+       wdev->iftype = NL80211_IFTYPE_ADHOC;
+       wdev->netdev = new_ndev;
+       new_ndev->ieee80211_ptr = wdev;
+       SET_NETDEV_DEV(new_ndev, wiphy_dev(wdev->wiphy));
+
+       /* rtnl lock must have been acquired, if this is not the case, wl_cfg80211_register_if
+       * needs to be modified to take one parameter (bool need_rtnl_lock)
+        */
+       ASSERT_RTNL();
+       if (wl_cfg80211_register_if(cfg, event->ifidx, new_ndev) != BCME_OK)
+               goto fail;
+
+       wl_alloc_netinfo(cfg, new_ndev, wdev, WL_MODE_IBSS, PM_ENABLE, event->bssidx);
+       cfg->ibss_cfgdev = ndev_to_cfgdev(new_ndev);
+       WL_ERR(("IBSS interface %s created\n", new_ndev->name));
+       return cfg->ibss_cfgdev;
+
+fail:
+       WL_ERR(("failed to create IBSS interface %s \n", name));
+       cfg->bss_pending_op = FALSE;
+       if (new_ndev)
+               wl_cfg80211_remove_if(cfg, event->ifidx, new_ndev);
+       if (wdev)
+               kfree(wdev);
+       return NULL;
+}
+
+static s32
+bcm_cfg80211_del_ibss_if(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct net_device *ndev = NULL;
+       struct net_device *primary_ndev = NULL;
+       s32 timeout;
+
+       if (!cfgdev || cfg->ibss_cfgdev != cfgdev || ETHER_ISNULLADDR(&cfg->ibss_if_addr.octet))
+               return -EINVAL;
+       ndev = (struct net_device *)cfgdev_to_ndev(cfg->ibss_cfgdev);
+       primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+
+       cfg->bss_pending_op = TRUE;
+       memset(&cfg->if_event_info, 0, sizeof(cfg->if_event_info));
+       err = wldev_iovar_setbuf(primary_ndev, "aibss_ifdel", &cfg->ibss_if_addr,
+               sizeof(cfg->ibss_if_addr), cfg->ioctl_buf, WLC_IOCTL_MAXLEN, NULL);
+       if (err) {
+               WL_ERR(("IOVAR aibss_ifdel failed with error %d\n", err));
+               goto fail;
+       }
+       timeout = wait_event_interruptible_timeout(cfg->netif_change_event,
+               !cfg->bss_pending_op, msecs_to_jiffies(MAX_WAIT_TIME));
+       if (timeout <= 0 || cfg->bss_pending_op) {
+               WL_ERR(("timeout in waiting IF_DEL event\n"));
+               goto fail;
+       }
+
+       wl_cfg80211_remove_if(cfg, cfg->if_event_info.ifidx, ndev);
+       cfg->ibss_cfgdev = NULL;
+       return 0;
+
+fail:
+       cfg->bss_pending_op = FALSE;
+       return -1;
+}
+#endif /* WLAIBSS_MCHAN */
+
+s32
+wl_cfg80211_interface_ops(struct bcm_cfg80211 *cfg,
+       struct net_device *ndev, s32 bsscfg_idx,
+       enum nl80211_iftype iface_type, s32 del, u8 *addr)
+{
+       wl_interface_create_t iface;
+       s32 ret;
+       wl_interface_info_t *info;
+
+       bzero(&iface, sizeof(wl_interface_create_t));
+
+       iface.ver = WL_INTERFACE_CREATE_VER;
+
+       if (iface_type == NL80211_IFTYPE_AP)
+               iface.flags = WL_INTERFACE_CREATE_AP;
+       else
+               iface.flags = WL_INTERFACE_CREATE_STA;
+
+       if (del) {
+               ret = wldev_iovar_setbuf(ndev, "interface_remove",
+                       NULL, 0, cfg->ioctl_buf, WLC_IOCTL_MEDLEN, NULL);
+       } else {
+               if (addr) {
+                       memcpy(&iface.mac_addr.octet, addr, ETH_ALEN);
+                       iface.flags |= WL_INTERFACE_MAC_USE;
+               }
+               ret = wldev_iovar_getbuf(ndev, "interface_create",
+                       &iface, sizeof(wl_interface_create_t),
+                       cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+               if (ret == 0) {
+                       /* success */
+                       info = (wl_interface_info_t *)cfg->ioctl_buf;
+                       WL_DBG(("wl interface create success!! bssidx:%d \n",
+                               info->bsscfgidx));
+                       ret = info->bsscfgidx;
+               }
+       }
+
+       if (ret < 0)
+               WL_ERR(("Interface %s failed!! ret %d\n",
+                       del ? "remove" : "create", ret));
+
+       return ret;
+}
+
+
+s32
+wl_cfg80211_add_del_bss(struct bcm_cfg80211 *cfg,
+       struct net_device *ndev, s32 bsscfg_idx,
+       enum nl80211_iftype iface_type, s32 del, u8 *addr)
+{
+       s32 ret = BCME_OK;
+       s32 val = 0;
+
+       struct {
+               s32 cfg;
+               s32 val;
+               struct ether_addr ea;
+       } bss_setbuf;
+
+       WL_INFORM(("iface_type:%d del:%d \n", iface_type, del));
+
+       bzero(&bss_setbuf, sizeof(bss_setbuf));
+
+       /* AP=3, STA=2, up=1, down=0, val=-1 */
+       if (del) {
+               val = -1;
+       } else if (iface_type == NL80211_IFTYPE_AP) {
+               /* AP Interface */
+               WL_DBG(("Adding AP Interface \n"));
+               val = 3;
+       } else if (iface_type == NL80211_IFTYPE_STATION) {
+               WL_DBG(("Adding STA Interface \n"));
+               val = 2;
+       } else {
+               WL_ERR((" add_del_bss NOT supported for IFACE type:0x%x", iface_type));
+               return -EINVAL;
+       }
+
+       bss_setbuf.cfg = htod32(bsscfg_idx);
+       bss_setbuf.val = htod32(val);
+
+       if (addr) {
+               memcpy(&bss_setbuf.ea.octet, addr, ETH_ALEN);
+       }
+
+       ret = wldev_iovar_setbuf(ndev, "bss", &bss_setbuf, sizeof(bss_setbuf),
+               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+       if (ret != 0)
+               WL_ERR(("'bss %d' failed with %d\n", val, ret));
+
+       return ret;
+}
+
+#if defined(WL_VIRTUAL_APSTA) || defined(DUAL_STA_STATIC_IF)
+/* Create a Generic Network Interface and initialize it depending up on
+ * the interface type
+ */
+bcm_struct_cfgdev*
+wl_cfg80211_create_iface(struct wiphy *wiphy,
+       enum nl80211_iftype iface_type,
+       u8 *mac_addr, const char *name)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct net_device *new_ndev = NULL;
+       struct net_device *primary_ndev = NULL;
+       s32 ret = BCME_OK;
+       s32 bsscfg_idx = 0;
+       u32 timeout;
+       wl_if_event_info *event = NULL;
+       struct wireless_dev *wdev = NULL;
+       u8 addr[ETH_ALEN];
+       static int mac_idx = 0;
+
+       WL_DBG(("Enter\n"));
+
+       if (!name) {
+               WL_ERR(("Interface name not provided\n"));
+               return NULL;
+       }
+
+       primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+
+#ifdef DHD_IFDEBUG
+       WL_ERR(("cfg=%p, primary_ndev=%p, ifname=%s\n", cfg, primary_ndev, name));
+#endif
+
+       /* If any scan is going on, abort it */
+       if (wl_get_drv_status_all(cfg, SCANNING)) {
+               int wait_cnt = MAX_SCAN_ABORT_WAIT_CNT;
+               WL_ERR(("Scan in progress. Aborting the scan!\n"));
+               wl_cfg80211_scan_abort(cfg);
+               while (wl_get_drv_status_all(cfg, SCANNING) && wait_cnt) {
+                       WL_DBG(("Waiting for SCANNING terminated, wait_cnt: %d\n", wait_cnt));
+                       wait_cnt--;
+                       OSL_SLEEP(WAIT_SCAN_ABORT_OSL_SLEEP_TIME);
+               }
+               if (!wait_cnt && wl_get_drv_status_all(cfg, SCANNING)) {
+                       WL_ERR(("Failed to abort scan\n"));
+                       return NULL;
+               }
+       }
+
+       primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+       if (likely(!mac_addr)) {
+               /* Use primary MAC with the locally administered bit for the
+                *  Secondary STA I/F
+                */
+               memcpy(addr, primary_ndev->dev_addr, ETH_ALEN);
+               addr[0] |= 0x02;
+               /* MAC Adresses for virtual interfaces,
+                * for maximum two virtual interfaces
+                */
+               addr[3] ^= mac_idx ? 0xC0 : 0xA0;
+               mac_idx++;
+               mac_idx = mac_idx % 2;
+       } else {
+               /* Use the application provided mac address (if any) */
+               memcpy(addr, mac_addr, ETH_ALEN);
+       }
+
+       if ((iface_type != NL80211_IFTYPE_STATION) && (iface_type != NL80211_IFTYPE_AP)) {
+               WL_ERR(("IFACE type:%d not supported. STA "
+                                       "or AP IFACE is only supported\n", iface_type));
+               return NULL;
+       }
+
+       cfg->bss_pending_op = TRUE;
+       memset(&cfg->if_event_info, 0, sizeof(cfg->if_event_info));
+
+       /* De-initialize the p2p discovery interface, if operational */
+       if (p2p_is_on(cfg)) {
+               WL_DBG(("Disabling P2P Discovery Interface \n"));
+#ifdef WL_CFG80211_P2P_DEV_IF
+               ret = wl_cfg80211_scan_stop(bcmcfg_to_p2p_wdev(cfg));
+#else
+               ret = wl_cfg80211_scan_stop(cfg->p2p_net);
+#endif
+               if (unlikely(ret < 0)) {
+                       CFGP2P_ERR(("P2P scan stop failed, ret=%d\n", ret));
+               }
+
+#ifdef DHD_IFDEBUG
+               WL_ERR(("call wl_cfgp2p_disable_discovery()\n"));
+#endif
+               wl_cfgp2p_disable_discovery(cfg);
+               wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE) = 0;
+               p2p_on(cfg) = false;
+       }
+
+       /*
+        * Intialize the firmware I/F.
+        */
+       ret = wl_cfg80211_interface_ops(cfg, primary_ndev, bsscfg_idx,
+               NL80211_IFTYPE_STATION, 0, addr);
+       if (ret == BCME_UNSUPPORTED) {
+               /* Use bssidx 1 by default */
+               bsscfg_idx = 1;
+               if ((ret = wl_cfg80211_add_del_bss(cfg, primary_ndev,
+                       bsscfg_idx, iface_type, 0, addr)) < 0) {
+                       return NULL;
+               }
+       } else if (ret < 0) {
+               WL_ERR(("Interface create failed!! ret:%d \n", ret));
+               goto fail;
+       } else {
+               /* Success */
+               bsscfg_idx = ret;
+       }
+
+       WL_DBG(("Interface created!! bssidx:%d \n", bsscfg_idx));
+
+       /*
+        * Wait till the firmware send a confirmation event back.
+        */
+       WL_DBG(("Wait for the FW I/F Event\n"));
+       timeout = wait_event_interruptible_timeout(cfg->netif_change_event,
+               !cfg->bss_pending_op, msecs_to_jiffies(MAX_WAIT_TIME));
+       if (timeout <= 0 || cfg->bss_pending_op) {
+               WL_ERR(("ADD_IF event, didn't come. Return \n"));
+               goto fail;
+       }
+
+       /*
+        * Since FW operation is successful,we can go ahead with the
+        * the host interface creation.
+        */
+       event = &cfg->if_event_info;
+       new_ndev = wl_cfg80211_allocate_if(cfg, event->ifidx,
+               (char*)name, addr, event->bssidx, event->name);
+       if (!new_ndev) {
+               WL_ERR(("I/F allocation failed! \n"));
+               goto fail;
+       } else
+               WL_DBG(("I/F allocation succeeded! ifidx:0x%x bssidx:0x%x \n",
+                event->ifidx, event->bssidx));
+
+       wdev = kzalloc(sizeof(*wdev), GFP_KERNEL);
+       if (!wdev) {
+               WL_ERR(("wireless_dev alloc failed! \n"));
+               goto fail;
+       }
+
+       wdev->wiphy = wiphy;
+       wdev->iftype = iface_type;
+       new_ndev->ieee80211_ptr = wdev;
+       SET_NETDEV_DEV(new_ndev, wiphy_dev(wdev->wiphy));
+
+#ifdef DHD_IFDEBUG
+       WL_ERR(("wdev=%p, new_ndev=%p\n", wdev, new_ndev));
+#endif
+
+       /* RTNL lock must have been acquired. */
+       ASSERT_RTNL();
+
+       /* Set the locally administed mac addr, if not applied already */
+       if (memcmp(addr, event->mac, ETH_ALEN) != 0) {
+               ret = wldev_iovar_setbuf_bsscfg(primary_ndev, "cur_etheraddr",
+                       addr, ETH_ALEN, cfg->ioctl_buf, WLC_IOCTL_MAXLEN,
+                       event->bssidx, &cfg->ioctl_buf_sync);
+               if (unlikely(ret)) {
+                               WL_ERR(("set cur_etheraddr Error (%d)\n", ret));
+                               goto fail;
+               }
+               memcpy(new_ndev->dev_addr, addr, ETH_ALEN);
+       }
+
+       if (wl_cfg80211_register_if(cfg, event->ifidx, new_ndev) != BCME_OK) {
+               WL_ERR(("IFACE register failed \n"));
+               goto fail;
+       }
+
+       /* Initialize with the station mode params */
+       wl_alloc_netinfo(cfg, new_ndev, wdev,
+               (iface_type == NL80211_IFTYPE_STATION) ?
+               WL_MODE_BSS : WL_MODE_AP, PM_ENABLE, event->bssidx);
+
+       WL_DBG(("Host Network Interface for Secondary I/F created"));
+
+       return ndev_to_cfgdev(new_ndev);
+
+fail:
+       cfg->bss_pending_op = FALSE;
+
+       if (wdev)
+               kfree(wdev);
+       if (new_ndev)
+               wl_cfg80211_remove_if(cfg, event->ifidx, new_ndev);
+
+#ifdef DHD_IFDEBUG
+       WL_ERR(("failed!!!\n"));
+#endif
+
+       return NULL;
+}
+
+s32
+wl_cfg80211_del_iface(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct net_device *ndev = NULL;
+#ifdef DHD_IFDEBUG
+       struct net_device *primary_ndev = NULL;
+#endif
+       s32 ret = BCME_OK;
+       s32 bsscfg_idx = 1;
+       u32 timeout;
+       u32 ifidx;
+       enum nl80211_iftype iface_type = NL80211_IFTYPE_STATION;
+
+       WL_ERR(("Enter\n"));
+
+       /* If any scan is going on, abort it */
+       if (wl_get_drv_status_all(cfg, SCANNING)) {
+               WL_ERR(("Scan in progress. Aborting the scan!\n"));
+               wl_notify_escan_complete(cfg, cfg->escan_info.ndev, true, true);
+       }
+
+       ndev = (struct net_device *)cfgdev_to_ndev(cfgdev);
+#ifdef DHD_IFDEBUG
+       primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+       WL_ERR(("cfgdev=%p, ndev=%p, primary_ndev=%p\n",
+               cfgdev, ndev, primary_ndev));
+#endif
+
+       cfg->bss_pending_op = TRUE;
+       memset(&cfg->if_event_info, 0, sizeof(cfg->if_event_info));
+
+       /* Delete the firmware interface. "interface_remove" command
+        * should go on the interface to be deleted
+        */
+       /* Get the bssidx from netd */
+       bsscfg_idx = wl_get_bssidx_by_wdev(cfg, cfgdev_to_wdev(cfgdev));
+       if (bsscfg_idx < 0) {
+               WL_ERR(("DEL bss failed to get bssidx"));
+               goto exit;
+       }
+       ret = wl_cfg80211_interface_ops(cfg, ndev, bsscfg_idx,
+                       NL80211_IFTYPE_STATION, 1, NULL);
+       if (ret == BCME_UNSUPPORTED) {
+               if ((ret = wl_cfg80211_add_del_bss(cfg, ndev,
+                       bsscfg_idx, iface_type, true, NULL)) < 0) {
+                       WL_ERR(("DEL bss failed ret:%d \n", ret));
+                       goto exit;
+               }
+       } else if (ret < 0) {
+               WL_ERR(("Interface DEL failed ret:%d \n", ret));
+               goto exit;
+       }
+
+       timeout = wait_event_interruptible_timeout(cfg->netif_change_event,
+               !cfg->bss_pending_op, msecs_to_jiffies(MAX_WAIT_TIME));
+       if (timeout <= 0 || cfg->bss_pending_op) {
+               WL_ERR(("timeout in waiting IF_DEL event\n"));
+       }
+
+exit:
+       ifidx = dhd_net2idx(((struct dhd_pub *)(cfg->pub))->info, ndev);
+       if (ifidx >= 0) {
+               wl_cfg80211_remove_if(cfg, ifidx, ndev);
+       }
+       cfg->bss_pending_op = FALSE;
+
+       WL_ERR(("IF_DEL Done.\n"));
+
+       return ret;
+}
+#endif /* defined(WL_VIRTUAL_APSTA) || defined(DUAL_STA_STATIC_IF) */
+
+static s32
+wl_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
+       struct cfg80211_ibss_params *params)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct cfg80211_bss *bss;
+       struct ieee80211_channel *chan;
+       struct wl_join_params join_params;
+       int scan_suppress;
+       struct cfg80211_ssid ssid;
+       s32 scan_retry = 0;
+       s32 err = 0;
+       size_t join_params_size;
+       chanspec_t chanspec = 0;
+       u32 param[2] = {0, 0};
+       u32 bw_cap = 0;
+
+       WL_TRACE(("In\n"));
+       RETURN_EIO_IF_NOT_UP(cfg);
+       WL_INFORM(("JOIN BSSID:" MACDBG "\n", MAC2STRDBG(params->bssid)));
+       if (!params->ssid || params->ssid_len <= 0 ||
+               params->ssid_len > DOT11_MAX_SSID_LEN) {
+               WL_ERR(("Invalid parameter\n"));
+               return -EINVAL;
+       }
+#if defined(WL_CFG80211_P2P_DEV_IF)
+       chan = params->chandef.chan;
+#else
+       chan = params->channel;
+#endif /* WL_CFG80211_P2P_DEV_IF */
+       if (chan)
+               cfg->channel = ieee80211_frequency_to_channel(chan->center_freq);
+       if (wl_get_drv_status(cfg, CONNECTED, dev)) {
+               struct wlc_ssid *lssid = (struct wlc_ssid *)wl_read_prof(cfg, dev, WL_PROF_SSID);
+               u8 *bssid = (u8 *)wl_read_prof(cfg, dev, WL_PROF_BSSID);
+               u32 *channel = (u32 *)wl_read_prof(cfg, dev, WL_PROF_CHAN);
+               if (!params->bssid || ((memcmp(params->bssid, bssid, ETHER_ADDR_LEN) == 0) &&
+                       (memcmp(params->ssid, lssid->SSID, lssid->SSID_len) == 0) &&
+                       (*channel == cfg->channel))) {
+                       WL_ERR(("Connection already existed to " MACDBG "\n",
+                               MAC2STRDBG((u8 *)wl_read_prof(cfg, dev, WL_PROF_BSSID))));
+                       return -EISCONN;
+               }
+               WL_ERR(("Ignore Previous connecton to %s (" MACDBG ")\n",
+                       lssid->SSID, MAC2STRDBG(bssid)));
+       }
+
+       /* remove the VSIE */
+       wl_cfg80211_ibss_vsie_delete(dev);
+
+       bss = cfg80211_get_ibss(wiphy, NULL, params->ssid, params->ssid_len);
+       if (!bss) {
+               if (IBSS_INITIAL_SCAN_ALLOWED == TRUE) {
+                       memcpy(ssid.ssid, params->ssid, params->ssid_len);
+                       ssid.ssid_len = params->ssid_len;
+                       do {
+                               if (unlikely
+                                       (__wl_cfg80211_scan(wiphy, dev, NULL, &ssid) ==
+                                        -EBUSY)) {
+                                       wl_delay(150);
+                               } else {
+                                       break;
+                               }
+                       } while (++scan_retry < WL_SCAN_RETRY_MAX);
+
+                       /* rtnl lock code is removed here. don't see why rtnl lock
+                        * needs to be released.
+                        */
+
+                       /* wait 4 secons till scan done.... */
+                       schedule_timeout_interruptible(msecs_to_jiffies(4000));
+
+                       bss = cfg80211_get_ibss(wiphy, NULL,
+                               params->ssid, params->ssid_len);
+               }
+       }
+       if (bss && ((IBSS_COALESCE_ALLOWED == TRUE) ||
+               ((IBSS_COALESCE_ALLOWED == FALSE) && params->bssid &&
+               !memcmp(bss->bssid, params->bssid, ETHER_ADDR_LEN)))) {
+               cfg->ibss_starter = false;
+               WL_DBG(("Found IBSS\n"));
+       } else {
+               cfg->ibss_starter = true;
+       }
+       if (chan) {
+               if (chan->band == IEEE80211_BAND_5GHZ)
+                       param[0] = WLC_BAND_5G;
+               else if (chan->band == IEEE80211_BAND_2GHZ)
+                       param[0] = WLC_BAND_2G;
+               err = wldev_iovar_getint(dev, "bw_cap", param);
+               if (unlikely(err)) {
+                       WL_ERR(("Get bw_cap Failed (%d)\n", err));
+                       return err;
+               }
+               bw_cap = param[0];
+               chanspec = channel_to_chanspec(wiphy, dev, cfg->channel, bw_cap);
+       }
+       /*
+        * Join with specific BSSID and cached SSID
+        * If SSID is zero join based on BSSID only
+        */
+       memset(&join_params, 0, sizeof(join_params));
+       memcpy((void *)join_params.ssid.SSID, (void *)params->ssid,
+               params->ssid_len);
+       join_params.ssid.SSID_len = htod32(params->ssid_len);
+       if (params->bssid) {
+               memcpy(&join_params.params.bssid, params->bssid, ETHER_ADDR_LEN);
+               err = wldev_ioctl(dev, WLC_SET_DESIRED_BSSID, &join_params.params.bssid,
+                       ETHER_ADDR_LEN, true);
+               if (unlikely(err)) {
+                       WL_ERR(("Error (%d)\n", err));
+                       return err;
+               }
+       } else
+               memset(&join_params.params.bssid, 0, ETHER_ADDR_LEN);
+       wldev_iovar_setint(dev, "ibss_coalesce_allowed", IBSS_COALESCE_ALLOWED);
+
+       if (IBSS_INITIAL_SCAN_ALLOWED == FALSE) {
+               scan_suppress = TRUE;
+               /* Set the SCAN SUPPRESS Flag in the firmware to skip join scan */
+               err = wldev_ioctl(dev, WLC_SET_SCANSUPPRESS,
+                       &scan_suppress, sizeof(int), true);
+               if (unlikely(err)) {
+                       WL_ERR(("Scan Suppress Setting Failed (%d)\n", err));
+                       return err;
+               }
+       }
+
+       join_params.params.chanspec_list[0] = chanspec;
+       join_params.params.chanspec_num = 1;
+       wldev_iovar_setint(dev, "chanspec", chanspec);
+       join_params_size = sizeof(join_params);
+
+       /* Disable Authentication, IBSS will add key if it required */
+       wldev_iovar_setint(dev, "wpa_auth", WPA_AUTH_DISABLED);
+       wldev_iovar_setint(dev, "wsec", 0);
+
+
+       err = wldev_ioctl(dev, WLC_SET_SSID, &join_params,
+               join_params_size, true);
+       if (unlikely(err)) {
+               WL_ERR(("Error (%d)\n", err));
+               return err;
+       }
+
+       if (IBSS_INITIAL_SCAN_ALLOWED == FALSE) {
+               scan_suppress = FALSE;
+               /* Reset the SCAN SUPPRESS Flag */
+               err = wldev_ioctl(dev, WLC_SET_SCANSUPPRESS,
+                       &scan_suppress, sizeof(int), true);
+               if (unlikely(err)) {
+                       WL_ERR(("Reset Scan Suppress Flag Failed (%d)\n", err));
+                       return err;
+               }
+       }
+       wl_update_prof(cfg, dev, NULL, &join_params.ssid, WL_PROF_SSID);
+       wl_update_prof(cfg, dev, NULL, &cfg->channel, WL_PROF_CHAN);
+       cfg->rmc_event_seq = 0; /* initialize rmcfail sequence */
+       return err;
+}
+
+static s32 wl_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *dev)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       s32 err = 0;
+       scb_val_t scbval;
+       u8 *curbssid;
+
+       RETURN_EIO_IF_NOT_UP(cfg);
+       wl_link_down(cfg);
+
+       WL_ERR(("Leave IBSS\n"));
+       curbssid = wl_read_prof(cfg, dev, WL_PROF_BSSID);
+       wl_set_drv_status(cfg, DISCONNECTING, dev);
+       scbval.val = 0;
+       memcpy(&scbval.ea, curbssid, ETHER_ADDR_LEN);
+       err = wldev_ioctl(dev, WLC_DISASSOC, &scbval,
+               sizeof(scb_val_t), true);
+       if (unlikely(err)) {
+               wl_clr_drv_status(cfg, DISCONNECTING, dev);
+               WL_ERR(("error(%d)\n", err));
+               return err;
+       }
+
+       /* remove the VSIE */
+       wl_cfg80211_ibss_vsie_delete(dev);
+
+       return err;
+}
+
+
+static s32
+wl_set_wpa_version(struct net_device *dev, struct cfg80211_connect_params *sme)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+       struct wl_security *sec;
+       s32 val = 0;
+       s32 err = 0;
+       s32 bssidx;
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+
+       if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_1)
+               val = WPA_AUTH_PSK |
+                       WPA_AUTH_UNSPECIFIED;
+       else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_2)
+               val = WPA2_AUTH_PSK|
+                       WPA2_AUTH_UNSPECIFIED;
+       else
+               val = WPA_AUTH_DISABLED;
+
+       if (is_wps_conn(sme))
+               val = WPA_AUTH_DISABLED;
+
+#ifdef BCMWAPI_WPI
+       if (sme->crypto.n_ciphers_pairwise &&
+               (sme->crypto.ciphers_pairwise[0] == WLAN_DHD_CIPHER_SUITE_SMS4)) {
+               WL_DBG((" * wl_set_wpa_version, set wpa_auth"
+                       " to WPA_AUTH_WAPI 0x400"));
+               val = WAPI_AUTH_PSK | WAPI_AUTH_UNSPECIFIED;
+       }
+#endif
+       WL_DBG(("setting wpa_auth to 0x%0x\n", val));
+       err = wldev_iovar_setint_bsscfg(dev, "wpa_auth", val, bssidx);
+       if (unlikely(err)) {
+               WL_ERR(("set wpa_auth failed (%d)\n", err));
+               return err;
+       }
+       sec = wl_read_prof(cfg, dev, WL_PROF_SEC);
+       sec->wpa_versions = sme->crypto.wpa_versions;
+       return err;
+}
+
+#ifdef BCMWAPI_WPI
+static s32
+wl_set_set_wapi_ie(struct net_device *dev, struct cfg80211_connect_params *sme)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+       s32 err = 0;
+       s32 bssidx;
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+
+       WL_DBG((" %s \n", __FUNCTION__));
+
+       if (sme->crypto.n_ciphers_pairwise &&
+                       (sme->crypto.ciphers_pairwise[0] == WLAN_DHD_CIPHER_SUITE_SMS4)) {
+               err = wldev_iovar_setbuf_bsscfg(dev, "wapiie", (void*)sme->ie, sme->ie_len,
+                       cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+
+               if (unlikely(err)) {
+                       WL_ERR(("===> set_wapi_ie Error (%d)\n", err));
+                       return err;
+               }
+       } else
+               WL_DBG((" * skip \n"));
+       return err;
+}
+#endif /* BCMWAPI_WPI */
+
+static s32
+wl_set_auth_type(struct net_device *dev, struct cfg80211_connect_params *sme)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+       struct wl_security *sec;
+       s32 val = 0;
+       s32 err = 0;
+       s32 bssidx;
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+
+       switch (sme->auth_type) {
+       case NL80211_AUTHTYPE_OPEN_SYSTEM:
+               val = WL_AUTH_OPEN_SYSTEM;
+               WL_DBG(("open system\n"));
+               break;
+       case NL80211_AUTHTYPE_SHARED_KEY:
+               val = WL_AUTH_SHARED_KEY;
+               WL_DBG(("shared key\n"));
+               break;
+       case NL80211_AUTHTYPE_AUTOMATIC:
+               val = WL_AUTH_OPEN_SHARED;
+               WL_DBG(("automatic\n"));
+               break;
+       default:
+               val = 2;
+               WL_ERR(("invalid auth type (%d)\n", sme->auth_type));
+               break;
+       }
+
+       err = wldev_iovar_setint_bsscfg(dev, "auth", val, bssidx);
+       if (unlikely(err)) {
+               WL_ERR(("set auth failed (%d)\n", err));
+               return err;
+       }
+       sec = wl_read_prof(cfg, dev, WL_PROF_SEC);
+       sec->auth_type = sme->auth_type;
+       return err;
+}
+
+static s32
+wl_set_set_cipher(struct net_device *dev, struct cfg80211_connect_params *sme)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+       struct wl_security *sec;
+       s32 pval = 0;
+       s32 gval = 0;
+       s32 err = 0;
+       s32 wsec_val = 0;
+
+#ifdef BCMWAPI_WPI
+       s32 val = 0;
+#endif
+       s32 bssidx;
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+
+       if (sme->crypto.n_ciphers_pairwise) {
+               switch (sme->crypto.ciphers_pairwise[0]) {
+               case WLAN_CIPHER_SUITE_WEP40:
+               case WLAN_CIPHER_SUITE_WEP104:
+                       pval = WEP_ENABLED;
+                       break;
+               case WLAN_CIPHER_SUITE_TKIP:
+                       pval = TKIP_ENABLED;
+                       break;
+               case WLAN_CIPHER_SUITE_CCMP:
+               case WLAN_CIPHER_SUITE_AES_CMAC:
+                       pval = AES_ENABLED;
+                       break;
+#ifdef BCMWAPI_WPI
+               case WLAN_DHD_CIPHER_SUITE_SMS4:
+                       val = SMS4_ENABLED;
+                       pval = SMS4_ENABLED;
+                       break;
+#endif
+               default:
+                       WL_ERR(("invalid cipher pairwise (%d)\n",
+                               sme->crypto.ciphers_pairwise[0]));
+                       return -EINVAL;
+               }
+       }
+       if (sme->crypto.cipher_group) {
+               switch (sme->crypto.cipher_group) {
+               case WLAN_CIPHER_SUITE_WEP40:
+               case WLAN_CIPHER_SUITE_WEP104:
+                       gval = WEP_ENABLED;
+                       break;
+               case WLAN_CIPHER_SUITE_TKIP:
+                       gval = TKIP_ENABLED;
+                       break;
+               case WLAN_CIPHER_SUITE_CCMP:
+                       gval = AES_ENABLED;
+                       break;
+               case WLAN_CIPHER_SUITE_AES_CMAC:
+                       gval = AES_ENABLED;
+                       break;
+#ifdef BCMWAPI_WPI
+               case WLAN_DHD_CIPHER_SUITE_SMS4:
+                       val = SMS4_ENABLED;
+                       gval = SMS4_ENABLED;
+                       break;
+#endif
+               default:
+                       WL_ERR(("invalid cipher group (%d)\n",
+                               sme->crypto.cipher_group));
+                       return -EINVAL;
+               }
+       }
+
+       WL_DBG(("pval (%d) gval (%d)\n", pval, gval));
+
+       if (is_wps_conn(sme)) {
+               if (sme->privacy)
+                       err = wldev_iovar_setint_bsscfg(dev, "wsec", 4, bssidx);
+               else
+                       /* WPS-2.0 allows no security */
+                       err = wldev_iovar_setint_bsscfg(dev, "wsec", 0, bssidx);
+       } else {
+#ifdef BCMWAPI_WPI
+               if (sme->crypto.cipher_group == WLAN_DHD_CIPHER_SUITE_SMS4) {
+                       WL_DBG((" NO, is_wps_conn, WAPI set to SMS4_ENABLED"));
+                       err = wldev_iovar_setint_bsscfg(dev, "wsec", val, bssidx);
+               } else {
+#endif
+                       WL_DBG((" NO, is_wps_conn, Set pval | gval to WSEC"));
+                       wsec_val = pval | gval;
+
+                       WL_DBG((" Set WSEC to fW 0x%x \n", wsec_val));
+                       err = wldev_iovar_setint_bsscfg(dev, "wsec",
+                               wsec_val, bssidx);
+#ifdef BCMWAPI_WPI
+               }
+#endif
+       }
+       if (unlikely(err)) {
+               WL_ERR(("error (%d)\n", err));
+               return err;
+       }
+
+       sec = wl_read_prof(cfg, dev, WL_PROF_SEC);
+       sec->cipher_pairwise = sme->crypto.ciphers_pairwise[0];
+       sec->cipher_group = sme->crypto.cipher_group;
+
+       return err;
+}
+
+static s32
+wl_set_key_mgmt(struct net_device *dev, struct cfg80211_connect_params *sme)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+       struct wl_security *sec;
+       s32 val = 0;
+       s32 err = 0;
+       s32 bssidx;
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+
+       if (sme->crypto.n_akm_suites) {
+               err = wldev_iovar_getint(dev, "wpa_auth", &val);
+               if (unlikely(err)) {
+                       WL_ERR(("could not get wpa_auth (%d)\n", err));
+                       return err;
+               }
+               if (val & (WPA_AUTH_PSK |
+                       WPA_AUTH_UNSPECIFIED)) {
+                       switch (sme->crypto.akm_suites[0]) {
+                       case WLAN_AKM_SUITE_8021X:
+                               val = WPA_AUTH_UNSPECIFIED;
+                               break;
+                       case WLAN_AKM_SUITE_PSK:
+                               val = WPA_AUTH_PSK;
+                               break;
+                       default:
+                               WL_ERR(("invalid akm suite (0x%x)\n",
+                                       sme->crypto.akm_suites[0]));
+                               return -EINVAL;
+                       }
+               } else if (val & (WPA2_AUTH_PSK |
+                       WPA2_AUTH_UNSPECIFIED)) {
+                       switch (sme->crypto.akm_suites[0]) {
+                       case WLAN_AKM_SUITE_8021X:
+                               val = WPA2_AUTH_UNSPECIFIED;
+                               break;
+                       case WLAN_AKM_SUITE_PSK:
+                               val = WPA2_AUTH_PSK;
+                               break;
+                       default:
+                               WL_ERR(("invalid akm suite (0x%x)\n",
+                                       sme->crypto.akm_suites[0]));
+                               return -EINVAL;
+                       }
+               }
+#ifdef BCMWAPI_WPI
+               else {
+                       if (val & (WAPI_AUTH_PSK | WAPI_AUTH_UNSPECIFIED)) {
+                               switch (sme->crypto.akm_suites[0]) {
+                                       case WAPI_AUTH_UNSPECIFIED:
+                                               val = WAPI_AUTH_UNSPECIFIED;
+                                               break;
+                                       case WLAN_DHD_AKM_SUITE_WAPI_PSK:
+                                       case WAPI_AUTH_PSK:
+                                               val = WAPI_AUTH_PSK;
+                                               break;
+                               }
+                       }
+                       else {
+                               WL_ERR(("invalid akm suite (0x%x)\n",
+                                       sme->crypto.akm_suites[0]));
+                               return -EINVAL;
+                       }
+               }
+#endif /* BCMWAPI_WPI */
+
+
+               WL_DBG(("setting wpa_auth to 0x%x\n", val));
+
+               err = wldev_iovar_setint_bsscfg(dev, "wpa_auth", val, bssidx);
+               if (unlikely(err)) {
+                       WL_ERR(("could not set wpa_auth (%d)\n", err));
+                       return err;
+               }
+       }
+       sec = wl_read_prof(cfg, dev, WL_PROF_SEC);
+       sec->wpa_auth = sme->crypto.akm_suites[0];
+
+       return err;
+}
+
+static s32
+wl_set_set_sharedkey(struct net_device *dev,
+       struct cfg80211_connect_params *sme)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+       struct wl_security *sec;
+       struct wl_wsec_key key;
+       s32 val;
+       s32 err = 0;
+       s32 bssidx;
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+
+       WL_DBG(("key len (%d)\n", sme->key_len));
+       if (sme->key_len) {
+               sec = wl_read_prof(cfg, dev, WL_PROF_SEC);
+               WL_DBG(("wpa_versions 0x%x cipher_pairwise 0x%x\n",
+                       sec->wpa_versions, sec->cipher_pairwise));
+               if (!(sec->wpa_versions & (NL80211_WPA_VERSION_1 |
+                       NL80211_WPA_VERSION_2)) &&
+                       (sec->cipher_pairwise & (WLAN_CIPHER_SUITE_WEP40 |
+#ifdef BCMWAPI_WPI
+               WLAN_CIPHER_SUITE_WEP104 | WLAN_DHD_CIPHER_SUITE_SMS4)))
+#else
+               WLAN_CIPHER_SUITE_WEP104)))
+#endif
+               {
+                       memset(&key, 0, sizeof(key));
+                       key.len = (u32) sme->key_len;
+                       key.index = (u32) sme->key_idx;
+                       if (unlikely(key.len > sizeof(key.data))) {
+                               WL_ERR(("Too long key length (%u)\n", key.len));
+                               return -EINVAL;
+                       }
+                       memcpy(key.data, sme->key, key.len);
+                       key.flags = WL_PRIMARY_KEY;
+                       switch (sec->cipher_pairwise) {
+                       case WLAN_CIPHER_SUITE_WEP40:
+                               key.algo = CRYPTO_ALGO_WEP1;
+                               break;
+                       case WLAN_CIPHER_SUITE_WEP104:
+                               key.algo = CRYPTO_ALGO_WEP128;
+                               break;
+#ifdef BCMWAPI_WPI
+                       case WLAN_CIPHER_SUITE_SMS4:
+                               key.algo = CRYPTO_ALGO_SMS4;
+                               break;
+#endif
+                       default:
+                               WL_ERR(("Invalid algorithm (%d)\n",
+                                       sme->crypto.ciphers_pairwise[0]));
+                               return -EINVAL;
+                       }
+                       /* Set the new key/index */
+                       WL_DBG(("key length (%d) key index (%d) algo (%d)\n",
+                               key.len, key.index, key.algo));
+                       WL_DBG(("key \"%s\"\n", key.data));
+                       swap_key_from_BE(&key);
+                       err = wldev_iovar_setbuf_bsscfg(dev, "wsec_key", &key, sizeof(key),
+                               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+                       if (unlikely(err)) {
+                               WL_ERR(("WLC_SET_KEY error (%d)\n", err));
+                               return err;
+                       }
+                       if (sec->auth_type == NL80211_AUTHTYPE_SHARED_KEY) {
+                               WL_DBG(("set auth_type to shared key\n"));
+                               val = WL_AUTH_SHARED_KEY;       /* shared key */
+                               err = wldev_iovar_setint_bsscfg(dev, "auth", val, bssidx);
+                               if (unlikely(err)) {
+                                       WL_ERR(("set auth failed (%d)\n", err));
+                                       return err;
+                               }
+                       }
+               }
+       }
+       return err;
+}
+
+#if defined(ESCAN_RESULT_PATCH)
+static u8 connect_req_bssid[6];
+static u8 broad_bssid[6];
+#endif /* ESCAN_RESULT_PATCH */
+
+
+
+#if defined(CUSTOM_SET_CPUCORE) || defined(CONFIG_TCPACK_FASTTX)
+static bool wl_get_chan_isvht80(struct net_device *net, dhd_pub_t *dhd)
+{
+       u32 chanspec = 0;
+       bool isvht80 = 0;
+
+       if (wldev_iovar_getint(net, "chanspec", (s32 *)&chanspec) == BCME_OK)
+               chanspec = wl_chspec_driver_to_host(chanspec);
+
+       isvht80 = chanspec & WL_CHANSPEC_BW_80;
+       WL_INFO(("%s: chanspec(%x:%d)\n", __FUNCTION__, chanspec, isvht80));
+
+       return isvht80;
+}
+#endif /* CUSTOM_SET_CPUCORE || CONFIG_TCPACK_FASTTX */
+
+#ifdef AP_STA_RSDB_FEASIBILITY_CHK
+/* Check if STA connection can be allowed
+ * Reject if request leads to 3 channel concurrency
+ * or if request leads to Multi-Chan VSDB concurrency
+ */
+static bool
+wl_cfg80211_chk_conn_feasibility(struct bcm_cfg80211 *cfg, struct ieee80211_channel *chan)
+{
+       struct net_info *iter, *next;
+       u32 sta_chan = 0;
+       u32 *net_channel = NULL;
+       u32 ap_band, net_band;
+       u32 apcount = 0;
+       bool chan_matched = FALSE, band_matched = FALSE, reject = FALSE;
+
+       if (chan) {
+               sta_chan = ieee80211_frequency_to_channel(chan->center_freq);
+               WL_DBG(("channel (%d), center_req (%d)\n", sta_chan,
+                       chan->center_freq));
+       } else {
+               WL_DBG(("No channel info from user space\n"));
+               return reject;
+       }
+
+       for_each_ndev(cfg, iter, next) {
+               if (iter->ndev) {
+                       WL_DBG(("Mode (%d)\n", iter->mode));
+                       if (iter->mode != WL_MODE_AP) {
+                               continue;
+                       }
+                       apcount++;
+                       net_channel = (u32 *)wl_read_prof(cfg, iter->ndev, WL_PROF_CHAN);
+                       if (!net_channel) {
+                               WL_DBG(("%d Channel not found for a AP\n", __LINE__));
+                               continue;
+                       }
+                       WL_DBG(("Channel (%d)\n", *net_channel));
+                       if (*net_channel == sta_chan) {
+                               chan_matched = TRUE;
+                       } else {
+                               net_band = CHSPEC_BAND(wf_channel2chspec(*net_channel,
+                                       WL_CHANSPEC_BW_20));
+                               ap_band = CHSPEC_BAND(wf_channel2chspec(sta_chan,
+                                       WL_CHANSPEC_BW_20));
+                               WL_DBG(("Band (%d)\n", net_band));
+                               if (ap_band == net_band) {
+                                       band_matched = TRUE;
+                               }
+                       }
+               }
+       }
+
+       switch (apcount) {
+               case 1:
+                       /* If there is one AP/AGO connection */
+                       if (!chan_matched && band_matched) {
+                               reject = TRUE;
+                       }
+                       break;
+               case 2:
+                       /* If there are two AP/AGO connection */
+                       if (!chan_matched) {
+                               reject = TRUE;
+                       }
+                       break;
+               default:
+                       /* No AP/AGO connection */
+                       WL_DBG(("%d No AP/AGO connections formed yet\n", __LINE__));
+                       break;
+       }
+
+       return reject;
+}
+#endif /* AP_STA_RSDB_FEASIBILITY_CHK */
+
+static s32
+wl_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
+       struct cfg80211_connect_params *sme)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct ieee80211_channel *chan = sme->channel;
+       wl_extjoin_params_t *ext_join_params;
+       struct wl_join_params join_params;
+       size_t join_params_size;
+       s32 err = 0;
+       wpa_ie_fixed_t *wpa_ie;
+       bcm_tlv_t *wpa2_ie;
+       u8* wpaie  = 0;
+       u32 wpaie_len = 0;
+       u32 chan_cnt = 0;
+       struct ether_addr bssid;
+       s32 bssidx = -1;
+       int ret;
+       int wait_cnt;
+
+       WL_DBG(("In\n"));
+
+#if defined(SUPPORT_RANDOM_MAC_SCAN)
+       wl_cfg80211_set_random_mac(dev, FALSE);
+#endif /* SUPPORT_RANDOM_MAC_SCAN */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0))
+       if (sme->channel_hint) {
+               chan = sme->channel_hint;
+               WL_DBG(("channel_hint (%d), channel_hint center_freq (%d)\n",
+                       ieee80211_frequency_to_channel(sme->channel_hint->center_freq),
+                       sme->channel_hint->center_freq));
+       }
+       if (sme->bssid_hint) {
+               sme->bssid = sme->bssid_hint;
+               WL_DBG(("bssid_hint "MACDBG" \n", MAC2STRDBG(sme->bssid_hint)));
+       }
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0) */
+
+       if (unlikely(!sme->ssid)) {
+               WL_ERR(("Invalid ssid\n"));
+               return -EOPNOTSUPP;
+       }
+
+       if (unlikely(sme->ssid_len > DOT11_MAX_SSID_LEN)) {
+               WL_ERR(("Invalid SSID info: SSID=%s, length=%zd\n",
+                       sme->ssid, sme->ssid_len));
+               return -EINVAL;
+       }
+
+       RETURN_EIO_IF_NOT_UP(cfg);
+
+#ifdef AP_STA_RSDB_FEASIBILITY_CHK
+       /* Check if STA connection can be allowed
+        * This is temporary fix till we support
+        * AP/AGO movement to STA request channel
+        */
+       if (wl_cfg80211_chk_conn_feasibility(cfg, chan)) {
+               WL_DBG(("STA connection is not supported\n"));
+               return BCME_ERROR;
+       }
+#endif /* AP_STA_RSDB_FEASIBILITY_CHK */
+
+       /*
+        * Cancel ongoing scan to sync up with sme state machine of cfg80211.
+        */
+#if (defined(BCM4359_CHIP) || !defined(ESCAN_RESULT_PATCH))
+       if (cfg->scan_request) {
+               WL_TRACE_HW4(("Aborting the scan! \n"));
+               wl_cfg80211_scan_abort(cfg);
+               wait_cnt = MAX_SCAN_ABORT_WAIT_CNT;
+               while (wl_get_drv_status(cfg, SCANNING, dev) && wait_cnt) {
+                       WL_DBG(("Waiting for SCANNING terminated, wait_cnt: %d\n", wait_cnt));
+                       wait_cnt--;
+                       OSL_SLEEP(WAIT_SCAN_ABORT_OSL_SLEEP_TIME);
+               }
+               if (wl_get_drv_status(cfg, SCANNING, dev)) {
+                       wl_notify_escan_complete(cfg, dev, true, true);
+               }
+       }
+#endif
+#ifdef WL_SCHED_SCAN
+       if (cfg->sched_scan_req) {
+               wl_cfg80211_sched_scan_stop(wiphy, bcmcfg_to_prmry_ndev(cfg));
+       }
+#endif
+#if defined(ESCAN_RESULT_PATCH)
+       if (sme->bssid)
+               memcpy(connect_req_bssid, sme->bssid, ETHER_ADDR_LEN);
+       else
+               bzero(connect_req_bssid, ETHER_ADDR_LEN);
+       bzero(broad_bssid, ETHER_ADDR_LEN);
+#endif
+#if defined(USE_DYNAMIC_MAXPKT_RXGLOM)
+       maxrxpktglom = 0;
+#endif
+       bzero(&bssid, sizeof(bssid));
+       if (!wl_get_drv_status(cfg, CONNECTED, dev)&&
+               (ret = wldev_ioctl(dev, WLC_GET_BSSID, &bssid, ETHER_ADDR_LEN, false)) == 0) {
+               if (!ETHER_ISNULLADDR(&bssid)) {
+                       scb_val_t scbval;
+                       wl_set_drv_status(cfg, DISCONNECTING, dev);
+                       scbval.val = DOT11_RC_DISASSOC_LEAVING;
+                       memcpy(&scbval.ea, &bssid, ETHER_ADDR_LEN);
+                       scbval.val = htod32(scbval.val);
+
+                       WL_DBG(("drv status CONNECTED is not set, but connected in FW!" MACDBG "/n",
+                               MAC2STRDBG(bssid.octet)));
+                       err = wldev_ioctl(dev, WLC_DISASSOC, &scbval,
+                               sizeof(scb_val_t), true);
+                       if (unlikely(err)) {
+                               wl_clr_drv_status(cfg, DISCONNECTING, dev);
+                               WL_ERR(("error (%d)\n", err));
+                               return err;
+                       }
+                       wait_cnt = 500/10;
+                       while (wl_get_drv_status(cfg, DISCONNECTING, dev) && wait_cnt) {
+                               WL_DBG(("Waiting for disconnection terminated, wait_cnt: %d\n",
+                                       wait_cnt));
+                               wait_cnt--;
+                               OSL_SLEEP(10);
+                       }
+               } else
+                       WL_DBG(("Currently not associated!\n"));
+       } else {
+               /* if status is DISCONNECTING, wait for disconnection terminated max 500 ms */
+               wait_cnt = 200/10;
+               while (wl_get_drv_status(cfg, DISCONNECTING, dev) && wait_cnt) {
+                       WL_DBG(("Waiting for disconnection terminated, wait_cnt: %d\n", wait_cnt));
+                       wait_cnt--;
+                       OSL_SLEEP(10);
+               }
+               if (wl_get_drv_status(cfg, DISCONNECTING, dev)) {
+                       WL_ERR(("Force clear DISCONNECTING status!\n"));
+                       wl_clr_drv_status(cfg, DISCONNECTING, dev);
+               }
+       }
+
+       /* Clean BSSID */
+       bzero(&bssid, sizeof(bssid));
+       if (!wl_get_drv_status(cfg, DISCONNECTING, dev))
+               wl_update_prof(cfg, dev, NULL, (void *)&bssid, WL_PROF_BSSID);
+
+       if (p2p_is_on(cfg) && (dev != bcmcfg_to_prmry_ndev(cfg))) {
+               /* we only allow to connect using virtual interface in case of P2P */
+                       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+                               WL_ERR(("Find p2p index from wdev(%p) failed\n",
+                                       dev->ieee80211_ptr));
+                               return BCME_ERROR;
+                       }
+                       wl_cfg80211_set_mgmt_vndr_ies(cfg, ndev_to_cfgdev(dev), bssidx,
+                               VNDR_IE_ASSOCREQ_FLAG, sme->ie, sme->ie_len);
+       } else if (dev == bcmcfg_to_prmry_ndev(cfg)) {
+               /* find the RSN_IE */
+               if ((wpa2_ie = bcm_parse_tlvs((u8 *)sme->ie, sme->ie_len,
+                       DOT11_MNG_RSN_ID)) != NULL) {
+                       WL_DBG((" WPA2 IE is found\n"));
+               }
+               /* find the WPA_IE */
+               if ((wpa_ie = wl_cfgp2p_find_wpaie((u8 *)sme->ie,
+                       sme->ie_len)) != NULL) {
+                       WL_DBG((" WPA IE is found\n"));
+               }
+               if (wpa_ie != NULL || wpa2_ie != NULL) {
+                       wpaie = (wpa_ie != NULL) ? (u8 *)wpa_ie : (u8 *)wpa2_ie;
+                       wpaie_len = (wpa_ie != NULL) ? wpa_ie->length : wpa2_ie->len;
+                       wpaie_len += WPA_RSN_IE_TAG_FIXED_LEN;
+                       err = wldev_iovar_setbuf(dev, "wpaie", wpaie, wpaie_len,
+                               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+                       if (unlikely(err)) {
+                               WL_ERR(("wpaie set error (%d)\n", err));
+                               return err;
+                       }
+               } else {
+                       err = wldev_iovar_setbuf(dev, "wpaie", NULL, 0,
+                               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+                       if (unlikely(err)) {
+                               WL_ERR(("wpaie set error (%d)\n", err));
+                               return err;
+                       }
+               }
+
+               if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+                       WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+                       return BCME_ERROR;
+               }
+               err = wl_cfg80211_set_mgmt_vndr_ies(cfg, ndev_to_cfgdev(dev), bssidx,
+                       VNDR_IE_ASSOCREQ_FLAG, (const u8 *)sme->ie, sme->ie_len);
+               if (unlikely(err)) {
+                       return err;
+               }
+       }
+
+       if (chan) {
+               cfg->channel = ieee80211_frequency_to_channel(chan->center_freq);
+               chan_cnt = 1;
+               WL_DBG(("channel (%d), center_req (%d), %d channels\n", cfg->channel,
+                       chan->center_freq, chan_cnt));
+       } else {
+               WL_DBG(("No channel info from user space\n"));
+               cfg->channel = 0;
+       }
+
+
+#ifdef BCMWAPI_WPI
+       WL_DBG(("1. enable wapi auth\n"));
+       if (sme->crypto.n_ciphers_pairwise &&
+                       (sme->crypto.ciphers_pairwise[0] == WLAN_DHD_CIPHER_SUITE_SMS4)) {
+               WL_DBG(("2. set wapi ie  \n"));
+               err = wl_set_set_wapi_ie(dev, sme);
+               if (unlikely(err))
+                       return err;
+       } else
+               WL_DBG(("2. Not wapi ie  \n"));
+#endif
+       WL_DBG(("ie (%p), ie_len (%zd)\n", sme->ie, sme->ie_len));
+       WL_DBG(("3. set wpa version \n"));
+       err = wl_set_wpa_version(dev, sme);
+       if (unlikely(err)) {
+               WL_ERR(("Invalid wpa_version\n"));
+               return err;
+       }
+#ifdef BCMWAPI_WPI
+       if (sme->crypto.n_ciphers_pairwise &&
+                       (sme->crypto.ciphers_pairwise[0] == WLAN_DHD_CIPHER_SUITE_SMS4))
+               WL_DBG(("4. WAPI Dont Set wl_set_auth_type\n"));
+       else {
+               WL_DBG(("4. wl_set_auth_type\n"));
+#endif
+               err = wl_set_auth_type(dev, sme);
+               if (unlikely(err)) {
+                       WL_ERR(("Invalid auth type\n"));
+                       return err;
+               }
+#ifdef BCMWAPI_WPI
+       }
+#endif
+
+       err = wl_set_set_cipher(dev, sme);
+       if (unlikely(err)) {
+               WL_ERR(("Invalid ciper\n"));
+               return err;
+       }
+
+       err = wl_set_key_mgmt(dev, sme);
+       if (unlikely(err)) {
+               WL_ERR(("Invalid key mgmt\n"));
+               return err;
+       }
+
+       err = wl_set_set_sharedkey(dev, sme);
+       if (unlikely(err)) {
+               WL_ERR(("Invalid shared key\n"));
+               return err;
+       }
+
+       /*
+        *  Join with specific BSSID and cached SSID
+        *  If SSID is zero join based on BSSID only
+        */
+       join_params_size = WL_EXTJOIN_PARAMS_FIXED_SIZE +
+               chan_cnt * sizeof(chanspec_t);
+       ext_join_params =  (wl_extjoin_params_t*)kzalloc(join_params_size, GFP_KERNEL);
+       if (ext_join_params == NULL) {
+               err = -ENOMEM;
+               wl_clr_drv_status(cfg, CONNECTING, dev);
+               goto exit;
+       }
+       ext_join_params->ssid.SSID_len = min(sizeof(ext_join_params->ssid.SSID), sme->ssid_len);
+       memcpy(&ext_join_params->ssid.SSID, sme->ssid, ext_join_params->ssid.SSID_len);
+       wl_update_prof(cfg, dev, NULL, &ext_join_params->ssid, WL_PROF_SSID);
+       ext_join_params->ssid.SSID_len = htod32(ext_join_params->ssid.SSID_len);
+       /* increate dwell time to receive probe response or detect Beacon
+       * from target AP at a noisy air only during connect command
+       */
+       ext_join_params->scan.active_time = chan_cnt ? WL_SCAN_JOIN_ACTIVE_DWELL_TIME_MS : -1;
+       ext_join_params->scan.passive_time = chan_cnt ? WL_SCAN_JOIN_PASSIVE_DWELL_TIME_MS : -1;
+       /* Set up join scan parameters */
+       ext_join_params->scan.scan_type = -1;
+       ext_join_params->scan.nprobes = chan_cnt ?
+               (ext_join_params->scan.active_time/WL_SCAN_JOIN_PROBE_INTERVAL_MS) : -1;
+       ext_join_params->scan.home_time = -1;
+
+       if (sme->bssid)
+               memcpy(&ext_join_params->assoc.bssid, sme->bssid, ETH_ALEN);
+       else
+               memcpy(&ext_join_params->assoc.bssid, &ether_bcast, ETH_ALEN);
+       ext_join_params->assoc.chanspec_num = chan_cnt;
+       if (chan_cnt) {
+               if (cfg->channel) {
+                       /*
+                        * Use the channel provided by userspace
+                        */
+                       u16 channel, band, bw, ctl_sb;
+                       chanspec_t chspec;
+                       channel = cfg->channel;
+                       band = (channel <= CH_MAX_2G_CHANNEL) ? WL_CHANSPEC_BAND_2G
+                               : WL_CHANSPEC_BAND_5G;
+
+                       /* Get min_bw set for the interface */
+                       bw = wl_cfg80211_ulb_get_min_bw_chspec(dev->ieee80211_ptr, bssidx);
+                       if (bw == INVCHANSPEC) {
+                               WL_ERR(("Invalid chanspec \n"));
+                               kfree(ext_join_params);
+                               return BCME_ERROR;
+                       }
+
+                       ctl_sb = WL_CHANSPEC_CTL_SB_NONE;
+                       chspec = (channel | band | bw | ctl_sb);
+                       ext_join_params->assoc.chanspec_list[0]  &= WL_CHANSPEC_CHAN_MASK;
+                       ext_join_params->assoc.chanspec_list[0] |= chspec;
+                       ext_join_params->assoc.chanspec_list[0] =
+                               wl_chspec_host_to_driver(ext_join_params->assoc.chanspec_list[0]);
+               }
+       }
+       ext_join_params->assoc.chanspec_num = htod32(ext_join_params->assoc.chanspec_num);
+       if (ext_join_params->ssid.SSID_len < IEEE80211_MAX_SSID_LEN) {
+               WL_INFORM(("ssid \"%s\", len (%d)\n", ext_join_params->ssid.SSID,
+                       ext_join_params->ssid.SSID_len));
+       }
+       wl_set_drv_status(cfg, CONNECTING, dev);
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               kfree(ext_join_params);
+               return BCME_ERROR;
+       }
+       err = wldev_iovar_setbuf_bsscfg(dev, "join", ext_join_params, join_params_size,
+               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+
+       if (cfg->rcc_enabled) {
+               WL_ERR(("Connecting with" MACDBG " ssid \"%s\", len (%d) with rcc channels \n\n",
+                       MAC2STRDBG((u8*)(&ext_join_params->assoc.bssid)),
+                       ext_join_params->ssid.SSID, ext_join_params->ssid.SSID_len));
+       } else {
+               WL_ERR(("Connecting with" MACDBG " ssid \"%s\", len (%d) channel=%d\n\n",
+                       MAC2STRDBG((u8*)(&ext_join_params->assoc.bssid)),
+                       ext_join_params->ssid.SSID, ext_join_params->ssid.SSID_len, cfg->channel));
+       }
+
+       kfree(ext_join_params);
+       if (err) {
+               wl_clr_drv_status(cfg, CONNECTING, dev);
+               if (err == BCME_UNSUPPORTED) {
+                       WL_DBG(("join iovar is not supported\n"));
+                       goto set_ssid;
+               } else {
+                       WL_ERR(("error (%d)\n", err));
+                       goto exit;
+               }
+       } else
+               goto exit;
+
+set_ssid:
+       memset(&join_params, 0, sizeof(join_params));
+       join_params_size = sizeof(join_params.ssid);
+
+       join_params.ssid.SSID_len = min(sizeof(join_params.ssid.SSID), sme->ssid_len);
+       memcpy(&join_params.ssid.SSID, sme->ssid, join_params.ssid.SSID_len);
+       join_params.ssid.SSID_len = htod32(join_params.ssid.SSID_len);
+       wl_update_prof(cfg, dev, NULL, &join_params.ssid, WL_PROF_SSID);
+       if (sme->bssid)
+               memcpy(&join_params.params.bssid, sme->bssid, ETH_ALEN);
+       else
+               memcpy(&join_params.params.bssid, &ether_bcast, ETH_ALEN);
+
+       if (wl_ch_to_chanspec(dev, cfg->channel, &join_params, &join_params_size) < 0) {
+               WL_ERR(("Invalid chanspec\n"));
+               return -EINVAL;
+       }
+
+       WL_DBG(("join_param_size %zu\n", join_params_size));
+
+       if (join_params.ssid.SSID_len < IEEE80211_MAX_SSID_LEN) {
+               WL_INFORM(("ssid \"%s\", len (%d)\n", join_params.ssid.SSID,
+                       join_params.ssid.SSID_len));
+       }
+       wl_set_drv_status(cfg, CONNECTING, dev);
+       err = wldev_ioctl(dev, WLC_SET_SSID, &join_params, join_params_size, true);
+       if (err) {
+               WL_ERR(("error (%d)\n", err));
+               wl_clr_drv_status(cfg, CONNECTING, dev);
+       }
+exit:
+       return err;
+}
+
+static s32
+wl_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *dev,
+       u16 reason_code)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       scb_val_t scbval;
+       bool act = false;
+       s32 err = 0;
+       u8 *curbssid;
+#ifdef CUSTOM_SET_CPUCORE
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+#endif /* CUSTOM_SET_CPUCORE */
+       WL_ERR(("Reason %d\n", reason_code));
+       RETURN_EIO_IF_NOT_UP(cfg);
+       act = *(bool *) wl_read_prof(cfg, dev, WL_PROF_ACT);
+       curbssid = wl_read_prof(cfg, dev, WL_PROF_BSSID);
+#ifdef ESCAN_RESULT_PATCH
+       if (wl_get_drv_status(cfg, CONNECTING, dev) && curbssid &&
+               (memcmp(curbssid, connect_req_bssid, ETHER_ADDR_LEN) == 0)) {
+               WL_ERR(("Disconnecting from connecting device: " MACDBG "\n",
+                       MAC2STRDBG(curbssid)));
+               act = true;
+       }
+#endif /* ESCAN_RESULT_PATCH */
+
+       if (act) {
+               /*
+               * Cancel ongoing scan to sync up with sme state machine of cfg80211.
+               */
+#if !defined(ESCAN_RESULT_PATCH)
+               /* Let scan aborted by F/W */
+               if (cfg->scan_request) {
+                       WL_TRACE_HW4(("Aborting the scan! \n"));
+                       wl_notify_escan_complete(cfg, dev, true, true);
+               }
+#endif /* ESCAN_RESULT_PATCH */
+               if (wl_get_drv_status(cfg, CONNECTING, dev) ||
+                       wl_get_drv_status(cfg, CONNECTED, dev)) {
+                               wl_set_drv_status(cfg, DISCONNECTING, dev);
+                               scbval.val = reason_code;
+                               memcpy(&scbval.ea, curbssid, ETHER_ADDR_LEN);
+                               scbval.val = htod32(scbval.val);
+                               err = wldev_ioctl(dev, WLC_DISASSOC, &scbval,
+                                               sizeof(scb_val_t), true);
+                               if (unlikely(err)) {
+                                       wl_clr_drv_status(cfg, DISCONNECTING, dev);
+                                       WL_ERR(("error (%d)\n", err));
+                                       return err;
+                               }
+#if defined(BCM4358_CHIP)
+                               WL_ERR(("Wait for complete of disconnecting \n"));
+                               OSL_SLEEP(200);
+#endif /* BCM4358_CHIP */
+               }
+       }
+#ifdef CUSTOM_SET_CPUCORE
+       /* set default cpucore */
+       if (dev == bcmcfg_to_prmry_ndev(cfg)) {
+               dhd->chan_isvht80 &= ~DHD_FLAG_STA_MODE;
+               if (!(dhd->chan_isvht80))
+                       dhd_set_cpucore(dhd, FALSE);
+       }
+#endif /* CUSTOM_SET_CPUCORE */
+
+       return err;
+}
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+static s32
+wl_cfg80211_set_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
+       enum nl80211_tx_power_setting type, s32 mbm)
+#else
+static s32
+wl_cfg80211_set_tx_power(struct wiphy *wiphy,
+       enum nl80211_tx_power_setting type, s32 dbm)
+#endif /* WL_CFG80211_P2P_DEV_IF */
+{
+
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+       s32 err = 0;
+#if defined(WL_CFG80211_P2P_DEV_IF)
+       s32 dbm = MBM_TO_DBM(mbm);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0)) || \
+       defined(WL_COMPAT_WIRELESS) || defined(WL_SUPPORT_BACKPORTED_KPATCHES)
+       dbm = MBM_TO_DBM(dbm);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+       RETURN_EIO_IF_NOT_UP(cfg);
+       switch (type) {
+       case NL80211_TX_POWER_AUTOMATIC:
+               break;
+       case NL80211_TX_POWER_LIMITED:
+               if (dbm < 0) {
+                       WL_ERR(("TX_POWER_LIMITTED - dbm is negative\n"));
+                       return -EINVAL;
+               }
+               break;
+       case NL80211_TX_POWER_FIXED:
+               if (dbm < 0) {
+                       WL_ERR(("TX_POWER_FIXED - dbm is negative..\n"));
+                       return -EINVAL;
+               }
+               break;
+       }
+
+       err = wl_set_tx_power(ndev, type, dbm);
+       if (unlikely(err)) {
+               WL_ERR(("error (%d)\n", err));
+               return err;
+       }
+
+       cfg->conf->tx_power = dbm;
+
+       return err;
+}
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+static s32 wl_cfg80211_get_tx_power(struct wiphy *wiphy,
+       struct wireless_dev *wdev, s32 *dbm)
+#else
+static s32 wl_cfg80211_get_tx_power(struct wiphy *wiphy, s32 *dbm)
+#endif /* WL_CFG80211_P2P_DEV_IF */
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+       s32 err = 0;
+
+       RETURN_EIO_IF_NOT_UP(cfg);
+       err = wl_get_tx_power(ndev, dbm);
+       if (unlikely(err))
+               WL_ERR(("error (%d)\n", err));
+
+       return err;
+}
+
+static s32
+wl_cfg80211_config_default_key(struct wiphy *wiphy, struct net_device *dev,
+       u8 key_idx, bool unicast, bool multicast)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       u32 index;
+       s32 wsec;
+       s32 err = 0;
+       s32 bssidx;
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from dev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+
+       WL_DBG(("key index (%d)\n", key_idx));
+       RETURN_EIO_IF_NOT_UP(cfg);
+       err = wldev_iovar_getint_bsscfg(dev, "wsec", &wsec, bssidx);
+       if (unlikely(err)) {
+               WL_ERR(("WLC_GET_WSEC error (%d)\n", err));
+               return err;
+       }
+       if (wsec == WEP_ENABLED) {
+               /* Just select a new current key */
+               index = (u32) key_idx;
+               index = htod32(index);
+               err = wldev_ioctl(dev, WLC_SET_KEY_PRIMARY, &index,
+                       sizeof(index), true);
+               if (unlikely(err)) {
+                       WL_ERR(("error (%d)\n", err));
+               }
+       }
+       return err;
+}
+
+static s32
+wl_add_keyext(struct wiphy *wiphy, struct net_device *dev,
+       u8 key_idx, const u8 *mac_addr, struct key_params *params)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct wl_wsec_key key;
+       s32 err = 0;
+       s32 bssidx;
+       s32 mode = wl_get_mode_by_netdev(cfg, dev);
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+       memset(&key, 0, sizeof(key));
+       key.index = (u32) key_idx;
+
+       if (!ETHER_ISMULTI(mac_addr))
+               memcpy((char *)&key.ea, (const void *)mac_addr, ETHER_ADDR_LEN);
+       key.len = (u32) params->key_len;
+
+       /* check for key index change */
+       if (key.len == 0) {
+               /* key delete */
+               swap_key_from_BE(&key);
+               err = wldev_iovar_setbuf_bsscfg(dev, "wsec_key", &key, sizeof(key),
+                       cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+               if (unlikely(err)) {
+                       WL_ERR(("key delete error (%d)\n", err));
+                       return err;
+               }
+       } else {
+               if (key.len > sizeof(key.data)) {
+                       WL_ERR(("Invalid key length (%d)\n", key.len));
+                       return -EINVAL;
+               }
+               WL_DBG(("Setting the key index %d\n", key.index));
+               memcpy(key.data, params->key, key.len);
+
+               if ((mode == WL_MODE_BSS) &&
+                       (params->cipher == WLAN_CIPHER_SUITE_TKIP)) {
+                       u8 keybuf[8];
+                       memcpy(keybuf, &key.data[24], sizeof(keybuf));
+                       memcpy(&key.data[24], &key.data[16], sizeof(keybuf));
+                       memcpy(&key.data[16], keybuf, sizeof(keybuf));
+               }
+
+               /* if IW_ENCODE_EXT_RX_SEQ_VALID set */
+               if (params->seq && params->seq_len == 6) {
+                       /* rx iv */
+                       u8 *ivptr;
+                       ivptr = (u8 *) params->seq;
+                       key.rxiv.hi = (ivptr[5] << 24) | (ivptr[4] << 16) |
+                               (ivptr[3] << 8) | ivptr[2];
+                       key.rxiv.lo = (ivptr[1] << 8) | ivptr[0];
+                       key.iv_initialized = true;
+               }
+
+               switch (params->cipher) {
+               case WLAN_CIPHER_SUITE_WEP40:
+                       key.algo = CRYPTO_ALGO_WEP1;
+                       WL_DBG(("WLAN_CIPHER_SUITE_WEP40\n"));
+                       break;
+               case WLAN_CIPHER_SUITE_WEP104:
+                       key.algo = CRYPTO_ALGO_WEP128;
+                       WL_DBG(("WLAN_CIPHER_SUITE_WEP104\n"));
+                       break;
+               case WLAN_CIPHER_SUITE_TKIP:
+                       key.algo = CRYPTO_ALGO_TKIP;
+                       WL_DBG(("WLAN_CIPHER_SUITE_TKIP\n"));
+                       break;
+               case WLAN_CIPHER_SUITE_AES_CMAC:
+                       key.algo = CRYPTO_ALGO_AES_CCM;
+                       WL_DBG(("WLAN_CIPHER_SUITE_AES_CMAC\n"));
+                       break;
+               case WLAN_CIPHER_SUITE_CCMP:
+                       key.algo = CRYPTO_ALGO_AES_CCM;
+                       WL_DBG(("WLAN_CIPHER_SUITE_CCMP\n"));
+                       break;
+#ifdef BCMWAPI_WPI
+               case WLAN_DHD_CIPHER_SUITE_SMS4:
+                       key.algo = CRYPTO_ALGO_SMS4;
+                       WL_DBG(("WLAN_CIPHER_SUITE_SMS4\n"));
+                       break;
+#endif
+               default:
+                       WL_ERR(("Invalid cipher (0x%x)\n", params->cipher));
+                       return -EINVAL;
+               }
+               swap_key_from_BE(&key);
+               /* need to guarantee EAPOL 4/4 send out before set key */
+               dhd_wait_pend8021x(dev);
+               err = wldev_iovar_setbuf_bsscfg(dev, "wsec_key", &key, sizeof(key),
+                       cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+               if (unlikely(err)) {
+                       WL_ERR(("WLC_SET_KEY error (%d)\n", err));
+                       return err;
+               }
+       }
+       return err;
+}
+
+int
+wl_cfg80211_enable_roam_offload(struct net_device *dev, int enable)
+{
+       int err;
+       wl_eventmsg_buf_t ev_buf;
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+
+       if (dev != bcmcfg_to_prmry_ndev(cfg)) {
+               /* roam offload is only for the primary device */
+               return -1;
+       }
+       err = wldev_iovar_setint(dev, "roam_offload", enable);
+       if (err)
+               return err;
+
+       if (enable) {
+               err = wldev_iovar_setint(dev, "sup_wpa_tmo", IDSUP_4WAY_HANDSHAKE_TIMEOUT);
+               if (err) {
+                       WL_INFORM(("Setting 'sup_wpa_tmo' failed, err=%d\n", err));
+               }
+       }
+
+       bzero(&ev_buf, sizeof(wl_eventmsg_buf_t));
+       wl_cfg80211_add_to_eventbuffer(&ev_buf, WLC_E_ASSOC_REQ_IE, !enable);
+       wl_cfg80211_add_to_eventbuffer(&ev_buf, WLC_E_ASSOC_RESP_IE, !enable);
+       wl_cfg80211_add_to_eventbuffer(&ev_buf, WLC_E_REASSOC, !enable);
+       wl_cfg80211_add_to_eventbuffer(&ev_buf, WLC_E_JOIN, !enable);
+       wl_cfg80211_add_to_eventbuffer(&ev_buf, WLC_E_ROAM, !enable);
+       err = wl_cfg80211_apply_eventbuffer(dev, cfg, &ev_buf);
+       if (!err) {
+               cfg->roam_offload = enable;
+       }
+       return err;
+}
+
+#if defined(WL_VIRTUAL_APSTA)
+int
+wl_cfg80211_interface_create(struct net_device *dev, char *name)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+       bcm_struct_cfgdev *new_cfgdev;
+
+       new_cfgdev = wl_cfg80211_create_iface(cfg->wdev->wiphy,
+                       NL80211_IFTYPE_STATION, NULL, name);
+       if (!new_cfgdev) {
+               return BCME_ERROR;
+       }
+       else {
+               WL_DBG(("Iface %s created successfuly\n", name));
+               return BCME_OK;
+       }
+}
+
+int
+wl_cfg80211_interface_delete(struct net_device *dev, char *name)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+       struct net_info *iter, *next;
+       int err = BCME_ERROR;
+
+       if (name == NULL) {
+               return BCME_ERROR;
+       }
+
+       for_each_ndev(cfg, iter, next) {
+               if (iter->ndev) {
+                       if (strcmp(iter->ndev->name, name) == 0) {
+                               err =  wl_cfg80211_del_iface(cfg->wdev->wiphy,
+                                               ndev_to_cfgdev(iter->ndev));
+                               break;
+                       }
+               }
+       }
+       if (!err) {
+               WL_DBG(("Iface %s deleted successfuly", name));
+       }
+       return err;
+}
+
+#if defined(PKT_FILTER_SUPPORT) && defined(APSTA_BLOCK_ARP_DURING_DHCP)
+void
+wl_cfg80211_block_arp(struct net_device *dev, int enable)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+
+       if (!dhd_pkt_filter_enable) {
+               WL_INFORM(("Packet filter isn't enabled\n"));
+               return;
+       }
+
+       /* Block/Unblock ARP frames only if STA is connected to
+        * the upstream AP in case of STA+SoftAP Concurrenct mode
+        */
+       if (!wl_get_drv_status(cfg, CONNECTED, dev)) {
+               WL_INFORM(("STA doesn't connected to upstream AP\n"));
+               return;
+       }
+
+       if (enable) {
+               WL_DBG(("Enable ARP Filter\n"));
+               /* Add ARP filter */
+               dhd_packet_filter_add_remove(dhdp, TRUE, DHD_BROADCAST_ARP_FILTER_NUM);
+
+               /* Enable ARP packet filter - blacklist */
+               dhd_master_mode = FALSE;
+               dhd_pktfilter_offload_enable(dhdp, dhdp->pktfilter[DHD_BROADCAST_ARP_FILTER_NUM],
+                       TRUE, dhd_master_mode);
+       } else {
+               WL_DBG(("Disable ARP Filter\n"));
+               /* Disable ARP packet filter */
+               dhd_master_mode = TRUE;
+               dhd_pktfilter_offload_enable(dhdp, dhdp->pktfilter[DHD_BROADCAST_ARP_FILTER_NUM],
+                       FALSE, dhd_master_mode);
+
+               /* Delete ARP filter */
+               dhd_packet_filter_add_remove(dhdp, FALSE, DHD_BROADCAST_ARP_FILTER_NUM);
+       }
+}
+#endif /* PKT_FILTER_SUPPORT && APSTA_BLOCK_ARP_DURING_DHCP */
+#endif /* defined (WL_VIRTUAL_APSTA) */
+
+static s32
+wl_cfg80211_add_key(struct wiphy *wiphy, struct net_device *dev,
+       u8 key_idx, bool pairwise, const u8 *mac_addr,
+       struct key_params *params)
+{
+       struct wl_wsec_key key;
+       s32 val = 0;
+       s32 wsec = 0;
+       s32 err = 0;
+       u8 keybuf[8];
+       s32 bssidx = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       s32 mode = wl_get_mode_by_netdev(cfg, dev);
+       WL_DBG(("key index (%d)\n", key_idx));
+       RETURN_EIO_IF_NOT_UP(cfg);
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from dev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+
+       if (mac_addr &&
+               ((params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
+               (params->cipher != WLAN_CIPHER_SUITE_WEP104))) {
+                       wl_add_keyext(wiphy, dev, key_idx, mac_addr, params);
+                       goto exit;
+       }
+       memset(&key, 0, sizeof(key));
+       /* Clear any buffered wep key */
+       memset(&cfg->wep_key, 0, sizeof(struct wl_wsec_key));
+
+       key.len = (u32) params->key_len;
+       key.index = (u32) key_idx;
+
+       if (unlikely(key.len > sizeof(key.data))) {
+               WL_ERR(("Too long key length (%u)\n", key.len));
+               return -EINVAL;
+       }
+       memcpy(key.data, params->key, key.len);
+
+       key.flags = WL_PRIMARY_KEY;
+       switch (params->cipher) {
+       case WLAN_CIPHER_SUITE_WEP40:
+               key.algo = CRYPTO_ALGO_WEP1;
+               val = WEP_ENABLED;
+               WL_DBG(("WLAN_CIPHER_SUITE_WEP40\n"));
+               break;
+       case WLAN_CIPHER_SUITE_WEP104:
+               key.algo = CRYPTO_ALGO_WEP128;
+               val = WEP_ENABLED;
+               WL_DBG(("WLAN_CIPHER_SUITE_WEP104\n"));
+               break;
+       case WLAN_CIPHER_SUITE_TKIP:
+               key.algo = CRYPTO_ALGO_TKIP;
+               val = TKIP_ENABLED;
+               /* wpa_supplicant switches the third and fourth quarters of the TKIP key */
+               if (mode == WL_MODE_BSS) {
+                       bcopy(&key.data[24], keybuf, sizeof(keybuf));
+                       bcopy(&key.data[16], &key.data[24], sizeof(keybuf));
+                       bcopy(keybuf, &key.data[16], sizeof(keybuf));
+               }
+               WL_DBG(("WLAN_CIPHER_SUITE_TKIP\n"));
+               break;
+       case WLAN_CIPHER_SUITE_AES_CMAC:
+               key.algo = CRYPTO_ALGO_AES_CCM;
+               val = AES_ENABLED;
+               WL_DBG(("WLAN_CIPHER_SUITE_AES_CMAC\n"));
+               break;
+       case WLAN_CIPHER_SUITE_CCMP:
+               key.algo = CRYPTO_ALGO_AES_CCM;
+               val = AES_ENABLED;
+               WL_DBG(("WLAN_CIPHER_SUITE_CCMP\n"));
+               break;
+#ifdef BCMWAPI_WPI
+       case WLAN_DHD_CIPHER_SUITE_SMS4:
+               key.algo = CRYPTO_ALGO_SMS4;
+               WL_DBG(("WLAN_CIPHER_SUITE_SMS4\n"));
+               val = SMS4_ENABLED;
+               break;
+#endif /* BCMWAPI_WPI */
+       default:
+               WL_ERR(("Invalid cipher (0x%x)\n", params->cipher));
+               return -EINVAL;
+       }
+
+       /* Set the new key/index */
+       if ((mode == WL_MODE_IBSS) && (val & (TKIP_ENABLED | AES_ENABLED))) {
+               WL_ERR(("IBSS KEY setted\n"));
+               wldev_iovar_setint(dev, "wpa_auth", WPA_AUTH_NONE);
+       }
+       swap_key_from_BE(&key);
+       if ((params->cipher == WLAN_CIPHER_SUITE_WEP40) ||
+               (params->cipher == WLAN_CIPHER_SUITE_WEP104)) {
+               /*
+                * For AP role, since we are doing a wl down before bringing up AP,
+                * the plumbed keys will be lost. So for AP once we bring up AP, we
+                * need to plumb keys again. So buffer the keys for future use. This
+                * is more like a WAR. If firmware later has the capability to do
+                * interface upgrade without doing a "wl down" and "wl apsta 0", then
+                * this will not be required.
+                */
+               WL_DBG(("Buffering WEP Keys \n"));
+               memcpy(&cfg->wep_key, &key, sizeof(struct wl_wsec_key));
+       }
+       err = wldev_iovar_setbuf_bsscfg(dev, "wsec_key", &key, sizeof(key), cfg->ioctl_buf,
+               WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+       if (unlikely(err)) {
+               WL_ERR(("WLC_SET_KEY error (%d)\n", err));
+               return err;
+       }
+
+exit:
+       err = wldev_iovar_getint_bsscfg(dev, "wsec", &wsec, bssidx);
+       if (unlikely(err)) {
+               WL_ERR(("get wsec error (%d)\n", err));
+               return err;
+       }
+
+       wsec |= val;
+       err = wldev_iovar_setint_bsscfg(dev, "wsec", wsec, bssidx);
+       if (unlikely(err)) {
+               WL_ERR(("set wsec error (%d)\n", err));
+               return err;
+       }
+
+       return err;
+}
+
+static s32
+wl_cfg80211_del_key(struct wiphy *wiphy, struct net_device *dev,
+       u8 key_idx, bool pairwise, const u8 *mac_addr)
+{
+       struct wl_wsec_key key;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       s32 err = 0;
+       s32 bssidx;
+
+       WL_DBG(("Enter. key_idx: %d\n", key_idx));
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+
+       if ((key_idx >= DOT11_MAX_DEFAULT_KEYS) && (key_idx < DOT11_MAX_DEFAULT_KEYS+2))
+               return -EINVAL;
+
+       RETURN_EIO_IF_NOT_UP(cfg);
+       memset(&key, 0, sizeof(key));
+
+       key.flags = WL_PRIMARY_KEY;
+       key.algo = CRYPTO_ALGO_OFF;
+       key.index = (u32) key_idx;
+
+       /* Set the new key/index */
+       swap_key_from_BE(&key);
+       err = wldev_iovar_setbuf_bsscfg(dev, "wsec_key", &key, sizeof(key), cfg->ioctl_buf,
+               WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+       if (unlikely(err)) {
+               if (err == -EINVAL) {
+                       if (key.index >= DOT11_MAX_DEFAULT_KEYS) {
+                               /* we ignore this key index in this case */
+                               WL_DBG(("invalid key index (%d)\n", key_idx));
+                       }
+               } else {
+                       WL_ERR(("WLC_SET_KEY error (%d)\n", err));
+               }
+               return err;
+       }
+       return err;
+}
+
+static s32
+wl_cfg80211_get_key(struct wiphy *wiphy, struct net_device *dev,
+       u8 key_idx, bool pairwise, const u8 *mac_addr, void *cookie,
+       void (*callback) (void *cookie, struct key_params * params))
+{
+       struct key_params params;
+       struct wl_wsec_key key;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct wl_security *sec;
+       s32 wsec;
+       s32 err = 0;
+       s32 bssidx;
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+       WL_DBG(("key index (%d)\n", key_idx));
+       RETURN_EIO_IF_NOT_UP(cfg);
+       memset(&key, 0, sizeof(key));
+       key.index = key_idx;
+       swap_key_to_BE(&key);
+       memset(&params, 0, sizeof(params));
+       params.key_len = (u8) min_t(u8, DOT11_MAX_KEY_SIZE, key.len);
+       memcpy((void *)params.key, key.data, params.key_len);
+
+       err = wldev_iovar_getint_bsscfg(dev, "wsec", &wsec, bssidx);
+       if (unlikely(err)) {
+               WL_ERR(("WLC_GET_WSEC error (%d)\n", err));
+               return err;
+       }
+       switch (WSEC_ENABLED(wsec)) {
+               case WEP_ENABLED:
+                       sec = wl_read_prof(cfg, dev, WL_PROF_SEC);
+                       if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP40) {
+                               params.cipher = WLAN_CIPHER_SUITE_WEP40;
+                               WL_DBG(("WLAN_CIPHER_SUITE_WEP40\n"));
+                       } else if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP104) {
+                               params.cipher = WLAN_CIPHER_SUITE_WEP104;
+                               WL_DBG(("WLAN_CIPHER_SUITE_WEP104\n"));
+                       }
+                       break;
+               case TKIP_ENABLED:
+                       params.cipher = WLAN_CIPHER_SUITE_TKIP;
+                       WL_DBG(("WLAN_CIPHER_SUITE_TKIP\n"));
+                       break;
+               case AES_ENABLED:
+                       params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
+                       WL_DBG(("WLAN_CIPHER_SUITE_AES_CMAC\n"));
+                       break;
+#ifdef BCMWAPI_WPI
+               case SMS4_ENABLED:
+                       params.cipher = WLAN_DHD_CIPHER_SUITE_SMS4;
+                       WL_DBG(("WLAN_CIPHER_SUITE_SMS4\n"));
+                       break;
+#endif
+               default:
+                       WL_ERR(("Invalid algo (0x%x)\n", wsec));
+                       return -EINVAL;
+       }
+
+       callback(cookie, &params);
+       return err;
+}
+
+static s32
+wl_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
+       struct net_device *dev, u8 key_idx)
+{
+       WL_INFORM(("Not supported\n"));
+       return -EOPNOTSUPP;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 16, 0))
+static s32
+wl_cfg80211_get_station(struct wiphy *wiphy, struct net_device *dev,
+       const u8 *mac, struct station_info *sinfo)
+#else
+static s32
+wl_cfg80211_get_station(struct wiphy *wiphy, struct net_device *dev,
+       u8 *mac, struct station_info *sinfo)
+#endif
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       scb_val_t scb_val;
+       s32 rssi;
+       s32 rate;
+       s32 err = 0;
+       sta_info_t *sta;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)) || defined(WL_COMPAT_WIRELESS)
+       s8 eabuf[ETHER_ADDR_STR_LEN];
+#endif
+       dhd_pub_t *dhd =  (dhd_pub_t *)(cfg->pub);
+       bool fw_assoc_state = FALSE;
+       u32 dhd_assoc_state = 0;
+       RETURN_EIO_IF_NOT_UP(cfg);
+       if (wl_get_mode_by_netdev(cfg, dev) == WL_MODE_AP) {
+               err = wldev_iovar_getbuf(dev, "sta_info", (struct ether_addr *)mac,
+                       ETHER_ADDR_LEN, cfg->ioctl_buf, WLC_IOCTL_SMLEN, &cfg->ioctl_buf_sync);
+               if (err < 0) {
+                       WL_ERR(("GET STA INFO failed, %d\n", err));
+                       return err;
+               }
+               sinfo->filled = STA_INFO_BIT(INFO_INACTIVE_TIME);
+               sta = (sta_info_t *)cfg->ioctl_buf;
+               sta->len = dtoh16(sta->len);
+               sta->cap = dtoh16(sta->cap);
+               sta->flags = dtoh32(sta->flags);
+               sta->idle = dtoh32(sta->idle);
+               sta->in = dtoh32(sta->in);
+               sinfo->inactive_time = sta->idle * 1000;
+
+               sinfo->filled |= (STA_INFO_BIT(INFO_RX_PACKETS) |
+                       STA_INFO_BIT(INFO_RX_DROP_MISC) |
+                       STA_INFO_BIT(INFO_TX_PACKETS) |
+                       STA_INFO_BIT(INFO_TX_FAILED) |
+                       STA_INFO_BIT(INFO_RX_BYTES) |
+                       STA_INFO_BIT(INFO_TX_BYTES));
+               sinfo->rx_packets = sta->rx_ucast_pkts;
+               sinfo->rx_dropped_misc = sta->rx_decrypt_failures;
+               sinfo->tx_packets = sta->tx_pkts;
+               sinfo->tx_failed  = sta->tx_failures;
+               sinfo->rx_bytes = sta->rx_tot_bytes;
+               sinfo->tx_bytes = sta->tx_tot_bytes;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)) || defined(WL_COMPAT_WIRELESS)
+               if (sta->flags & WL_STA_ASSOC) {
+                       sinfo->filled |= STA_INFO_BIT(INFO_CONNECTED_TIME);
+                       sinfo->connected_time = sta->in;
+               }
+               WL_INFORM(("STA %s : idle time : %d sec, connected time :%d ms\n",
+                       bcm_ether_ntoa((const struct ether_addr *)mac, eabuf), sinfo->inactive_time,
+                       sta->idle * 1000));
+#endif
+       } else if (wl_get_mode_by_netdev(cfg, dev) == WL_MODE_BSS ||
+               wl_get_mode_by_netdev(cfg, dev) == WL_MODE_IBSS) {
+               get_pktcnt_t pktcnt;
+               u8 *curmacp;
+
+               if (cfg->roam_offload) {
+                       struct ether_addr bssid;
+                       err = wldev_ioctl(dev, WLC_GET_BSSID, &bssid, ETHER_ADDR_LEN, false);
+                       if (err) {
+                               WL_ERR(("Failed to get current BSSID\n"));
+                       } else {
+                               if (!ETHER_ISNULLADDR(&bssid.octet) &&
+                                               memcmp(mac, &bssid.octet, ETHER_ADDR_LEN) != 0) {
+                                       /* roaming is detected */
+                                       err = wl_cfg80211_delayed_roam(cfg, dev, &bssid);
+                                       if (err)
+                                               WL_ERR(("Failed to handle the delayed roam, "
+                                                       "err=%d", err));
+                                       mac = (u8 *)bssid.octet;
+                               }
+                       }
+               }
+               dhd_assoc_state = wl_get_drv_status(cfg, CONNECTED, dev);
+               fw_assoc_state = dhd_is_associated(dhd, 0, &err);
+               if (!dhd_assoc_state || !fw_assoc_state) {
+                       WL_ERR(("NOT assoc\n"));
+                       if (err == -ERESTARTSYS)
+                               return err;
+                       if (!dhd_assoc_state) {
+                               WL_TRACE_HW4(("drv state is not connected \n"));
+                       }
+                       if (!fw_assoc_state) {
+                               WL_TRACE_HW4(("fw state is not associated \n"));
+                       }
+                       /* Disconnect due to fw is not associated for FW_ASSOC_WATCHDOG_TIME ms.
+                       * 'err == 0' of dhd_is_associated() and '!fw_assoc_state'
+                       * means that BSSID is null.
+                       */
+                       if (dhd_assoc_state && !fw_assoc_state && !err) {
+                               if (!fw_assoc_watchdog_started) {
+                                       fw_assoc_watchdog_ms = OSL_SYSUPTIME();
+                                       fw_assoc_watchdog_started = TRUE;
+                                       WL_TRACE_HW4(("fw_assoc_watchdog_started \n"));
+                               } else {
+                                       if (OSL_SYSUPTIME() - fw_assoc_watchdog_ms >
+                                               FW_ASSOC_WATCHDOG_TIME) {
+                                               fw_assoc_watchdog_started = FALSE;
+                                               err = -ENODEV;
+                                               WL_TRACE_HW4(("fw is not associated for %d ms \n",
+                                                       (OSL_SYSUPTIME() - fw_assoc_watchdog_ms)));
+                                               goto get_station_err;
+                                       }
+                               }
+                       }
+                       err = -ENODEV;
+                       return err;
+               }
+               fw_assoc_watchdog_started = FALSE;
+               curmacp = wl_read_prof(cfg, dev, WL_PROF_BSSID);
+               if (memcmp(mac, curmacp, ETHER_ADDR_LEN)) {
+                       WL_ERR(("Wrong Mac address: "MACDBG" != "MACDBG"\n",
+                               MAC2STRDBG(mac), MAC2STRDBG(curmacp)));
+               }
+
+               /* Report the current tx rate */
+               err = wldev_ioctl(dev, WLC_GET_RATE, &rate, sizeof(rate), false);
+               if (err) {
+                       WL_ERR(("Could not get rate (%d)\n", err));
+               } else {
+#if defined(USE_DYNAMIC_MAXPKT_RXGLOM)
+                       int rxpktglom;
+#endif
+                       rate = dtoh32(rate);
+                       sinfo->filled |= STA_INFO_BIT(INFO_TX_BITRATE);
+                       sinfo->txrate.legacy = rate * 5;
+                       WL_DBG(("Rate %d Mbps\n", (rate / 2)));
+#if defined(USE_DYNAMIC_MAXPKT_RXGLOM)
+                       rxpktglom = ((rate/2) > 150) ? 20 : 10;
+
+                       if (maxrxpktglom != rxpktglom) {
+                               maxrxpktglom = rxpktglom;
+                               WL_DBG(("Rate %d Mbps, update bus:maxtxpktglom=%d\n", (rate/2),
+                                       maxrxpktglom));
+                               err = wldev_iovar_setbuf(dev, "bus:maxtxpktglom",
+                                       (char*)&maxrxpktglom, 4, cfg->ioctl_buf,
+                                       WLC_IOCTL_MAXLEN, NULL);
+                               if (err < 0) {
+                                       WL_ERR(("set bus:maxtxpktglom failed, %d\n", err));
+                               }
+                       }
+#endif
+               }
+
+               memset(&scb_val, 0, sizeof(scb_val));
+               scb_val.val = 0;
+               err = wldev_ioctl(dev, WLC_GET_RSSI, &scb_val,
+                       sizeof(scb_val_t), false);
+               if (err) {
+                       WL_ERR(("Could not get rssi (%d)\n", err));
+                       goto get_station_err;
+               }
+               rssi = wl_rssi_offset(dtoh32(scb_val.val));
+               sinfo->filled |= STA_INFO_BIT(INFO_SIGNAL);
+               sinfo->signal = rssi;
+               WL_DBG(("RSSI %d dBm\n", rssi));
+               err = wldev_ioctl(dev, WLC_GET_PKTCNTS, &pktcnt,
+                       sizeof(pktcnt), false);
+               if (!err) {
+                       sinfo->filled |= (STA_INFO_BIT(INFO_RX_PACKETS) |
+                               STA_INFO_BIT(INFO_RX_DROP_MISC) |
+                               STA_INFO_BIT(INFO_TX_PACKETS) |
+                               STA_INFO_BIT(INFO_TX_FAILED));
+                       sinfo->rx_packets = pktcnt.rx_good_pkt;
+                       sinfo->rx_dropped_misc = pktcnt.rx_bad_pkt;
+                       sinfo->tx_packets = pktcnt.tx_good_pkt;
+                       sinfo->tx_failed  = pktcnt.tx_bad_pkt;
+               }
+get_station_err:
+               if (err && (err != -ERESTARTSYS)) {
+                       /* Disconnect due to zero BSSID or error to get RSSI */
+                       WL_ERR(("force cfg80211_disconnected: %d\n", err));
+                       wl_clr_drv_status(cfg, CONNECTED, dev);
+                       CFG80211_DISCONNECTED(dev, 0, NULL, 0, false, GFP_KERNEL);
+                       wl_link_down(cfg);
+               }
+       }
+       else {
+               WL_ERR(("Invalid device mode %d\n", wl_get_mode_by_netdev(cfg, dev)));
+       }
+
+       return err;
+}
+
+static s32
+wl_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
+       bool enabled, s32 timeout)
+{
+       s32 pm;
+       s32 err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct net_info *_net_info = wl_get_netinfo_by_netdev(cfg, dev);
+
+       RETURN_EIO_IF_NOT_UP(cfg);
+       WL_DBG(("Enter\n"));
+       if (cfg->p2p_net == dev || _net_info == NULL ||
+               !wl_get_drv_status(cfg, CONNECTED, dev) ||
+               (wl_get_mode_by_netdev(cfg, dev) != WL_MODE_BSS &&
+               wl_get_mode_by_netdev(cfg, dev) != WL_MODE_IBSS)) {
+               return err;
+       }
+       /* Enlarge pm_enable_work */
+       wl_add_remove_pm_enable_work(cfg, WL_PM_WORKQ_LONG);
+
+       pm = enabled ? PM_FAST : PM_OFF;
+       if (_net_info->pm_block) {
+               WL_ERR(("%s:Do not enable the power save for pm_block %d\n",
+                       dev->name, _net_info->pm_block));
+               pm = PM_OFF;
+       }
+       pm = htod32(pm);
+       WL_DBG(("%s:power save %s\n", dev->name, (pm ? "enabled" : "disabled")));
+       err = wldev_ioctl(dev, WLC_SET_PM, &pm, sizeof(pm), true);
+       if (unlikely(err)) {
+               if (err == -ENODEV)
+                       WL_DBG(("net_device is not ready yet\n"));
+               else
+                       WL_ERR(("error (%d)\n", err));
+               return err;
+       }
+       wl_cfg80211_update_power_mode(dev);
+       return err;
+}
+
+void wl_cfg80211_update_power_mode(struct net_device *dev)
+{
+       int err, pm = -1;
+
+       err = wldev_ioctl(dev, WLC_GET_PM, &pm, sizeof(pm), true);
+       if (err)
+               WL_ERR(("%s:error (%d)\n", __FUNCTION__, err));
+       else if (pm != -1 && dev->ieee80211_ptr)
+               dev->ieee80211_ptr->ps = (pm == PM_OFF) ? false : true;
+}
+
+void wl_cfg80211_set_passive_scan(struct net_device *dev, char *command)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+
+       if (strcmp(command, "SCAN-ACTIVE") == 0) {
+               cfg->active_scan = 1;
+       } else if (strcmp(command, "SCAN-PASSIVE") == 0) {
+               cfg->active_scan = 0;
+       } else
+               WL_ERR(("Unknown command \n"));
+}
+
+static __used u32 wl_find_msb(u16 bit16)
+{
+       u32 ret = 0;
+
+       if (bit16 & 0xff00) {
+               ret += 8;
+               bit16 >>= 8;
+       }
+
+       if (bit16 & 0xf0) {
+               ret += 4;
+               bit16 >>= 4;
+       }
+
+       if (bit16 & 0xc) {
+               ret += 2;
+               bit16 >>= 2;
+       }
+
+       if (bit16 & 2)
+               ret += bit16 & 2;
+       else if (bit16)
+               ret += bit16;
+
+       return ret;
+}
+
+static s32 wl_cfg80211_resume(struct wiphy *wiphy)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+       s32 err = BCME_OK;
+
+       if (unlikely(!wl_get_drv_status(cfg, READY, ndev))) {
+               WL_INFORM(("device is not ready\n"));
+               return err;
+       }
+
+       return err;
+}
+
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)) || defined(WL_COMPAT_WIRELESS)
+static s32 wl_cfg80211_suspend(struct wiphy *wiphy, struct cfg80211_wowlan *wow)
+#else
+static s32 wl_cfg80211_suspend(struct wiphy *wiphy)
+#endif /* KERNEL_VERSION(2, 6, 39) || WL_COMPAT_WIRELES */
+{
+       s32 err = BCME_OK;
+#ifdef DHD_CLEAR_ON_SUSPEND
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct net_info *iter, *next;
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+       unsigned long flags;
+       if (unlikely(!wl_get_drv_status(cfg, READY, ndev))) {
+               WL_INFORM(("device is not ready : status (%d)\n",
+                       (int)cfg->status));
+               return err;
+       }
+       for_each_ndev(cfg, iter, next) {
+               /* p2p discovery iface doesn't have a ndev associated with it (for kernel > 3.8) */
+               if (iter->ndev)
+                       wl_set_drv_status(cfg, SCAN_ABORTING, iter->ndev);
+               }
+       spin_lock_irqsave(&cfg->cfgdrv_lock, flags);
+       if (cfg->scan_request) {
+               cfg80211_scan_done(cfg->scan_request, true);
+               cfg->scan_request = NULL;
+       }
+       for_each_ndev(cfg, iter, next) {
+               if (iter->ndev) {
+                       wl_clr_drv_status(cfg, SCANNING, iter->ndev);
+                       wl_clr_drv_status(cfg, SCAN_ABORTING, iter->ndev);
+               }
+       }
+       spin_unlock_irqrestore(&cfg->cfgdrv_lock, flags);
+       for_each_ndev(cfg, iter, next) {
+               if (iter->ndev) {
+                       if (wl_get_drv_status(cfg, CONNECTING, iter->ndev)) {
+                               wl_bss_connect_done(cfg, iter->ndev, NULL, NULL, false);
+                       }
+               }
+       }
+#endif /* DHD_CLEAR_ON_SUSPEND */
+
+
+       return err;
+}
+
+static s32
+wl_update_pmklist(struct net_device *dev, struct wl_pmk_list *pmk_list,
+       s32 err)
+{
+       int i, j;
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+       struct net_device *primary_dev = bcmcfg_to_prmry_ndev(cfg);
+
+       if (!pmk_list) {
+               WL_INFORM(("pmk_list is NULL\n"));
+               return -EINVAL;
+       }
+       /* pmk list is supported only for STA interface i.e. primary interface
+        * Refer code wlc_bsscfg.c->wlc_bsscfg_sta_init
+        */
+       if (primary_dev != dev) {
+               WL_INFORM(("Not supporting Flushing pmklist on virtual"
+                       " interfaces than primary interface\n"));
+               return err;
+       }
+
+       WL_DBG(("No of elements %d\n", pmk_list->pmkids.npmkid));
+       for (i = 0; i < pmk_list->pmkids.npmkid; i++) {
+               WL_DBG(("PMKID[%d]: %pM =\n", i,
+                       &pmk_list->pmkids.pmkid[i].BSSID));
+               for (j = 0; j < WPA2_PMKID_LEN; j++) {
+                       WL_DBG(("%02x\n", pmk_list->pmkids.pmkid[i].PMKID[j]));
+               }
+       }
+       if (likely(!err)) {
+               err = wldev_iovar_setbuf(dev, "pmkid_info", (char *)pmk_list,
+                       sizeof(*pmk_list), cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+       }
+
+       return err;
+}
+
+static s32
+wl_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *dev,
+       struct cfg80211_pmksa *pmksa)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       s32 err = 0;
+       int i;
+
+       RETURN_EIO_IF_NOT_UP(cfg);
+       for (i = 0; i < cfg->pmk_list->pmkids.npmkid; i++)
+               if (!memcmp(pmksa->bssid, &cfg->pmk_list->pmkids.pmkid[i].BSSID,
+                       ETHER_ADDR_LEN))
+                       break;
+       if (i < WL_NUM_PMKIDS_MAX) {
+               memcpy(&cfg->pmk_list->pmkids.pmkid[i].BSSID, pmksa->bssid,
+                       ETHER_ADDR_LEN);
+               memcpy(&cfg->pmk_list->pmkids.pmkid[i].PMKID, pmksa->pmkid,
+                       WPA2_PMKID_LEN);
+               if (i == cfg->pmk_list->pmkids.npmkid)
+                       cfg->pmk_list->pmkids.npmkid++;
+       } else {
+               err = -EINVAL;
+       }
+       WL_DBG(("set_pmksa,IW_PMKSA_ADD - PMKID: %pM =\n",
+               &cfg->pmk_list->pmkids.pmkid[cfg->pmk_list->pmkids.npmkid - 1].BSSID));
+       for (i = 0; i < WPA2_PMKID_LEN; i++) {
+               WL_DBG(("%02x\n",
+                       cfg->pmk_list->pmkids.pmkid[cfg->pmk_list->pmkids.npmkid - 1].
+                       PMKID[i]));
+       }
+
+       err = wl_update_pmklist(dev, cfg->pmk_list, err);
+
+       return err;
+}
+
+static s32
+wl_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *dev,
+       struct cfg80211_pmksa *pmksa)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+
+       struct _pmkid_list pmkid = {.npmkid = 0};
+       s32 err = 0;
+       int i;
+
+       RETURN_EIO_IF_NOT_UP(cfg);
+       memcpy(&pmkid.pmkid[0].BSSID, pmksa->bssid, ETHER_ADDR_LEN);
+       memcpy(pmkid.pmkid[0].PMKID, pmksa->pmkid, WPA2_PMKID_LEN);
+
+       WL_DBG(("del_pmksa,IW_PMKSA_REMOVE - PMKID: %pM =\n",
+               &pmkid.pmkid[0].BSSID));
+       for (i = 0; i < WPA2_PMKID_LEN; i++) {
+               WL_DBG(("%02x\n", pmkid.pmkid[0].PMKID[i]));
+       }
+
+       for (i = 0; i < cfg->pmk_list->pmkids.npmkid; i++)
+               if (!memcmp
+                   (pmksa->bssid, &cfg->pmk_list->pmkids.pmkid[i].BSSID,
+                    ETHER_ADDR_LEN))
+                       break;
+
+       if ((cfg->pmk_list->pmkids.npmkid > 0) &&
+               (i < cfg->pmk_list->pmkids.npmkid)) {
+               memset(&cfg->pmk_list->pmkids.pmkid[i], 0, sizeof(pmkid_t));
+               for (; i < (cfg->pmk_list->pmkids.npmkid - 1); i++) {
+                       memcpy(&cfg->pmk_list->pmkids.pmkid[i].BSSID,
+                               &cfg->pmk_list->pmkids.pmkid[i + 1].BSSID,
+                               ETHER_ADDR_LEN);
+                       memcpy(&cfg->pmk_list->pmkids.pmkid[i].PMKID,
+                               &cfg->pmk_list->pmkids.pmkid[i + 1].PMKID,
+                               WPA2_PMKID_LEN);
+               }
+               cfg->pmk_list->pmkids.npmkid--;
+       } else {
+               err = -EINVAL;
+       }
+
+       err = wl_update_pmklist(dev, cfg->pmk_list, err);
+
+       return err;
+
+}
+
+static s32
+wl_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *dev)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       s32 err = 0;
+       RETURN_EIO_IF_NOT_UP(cfg);
+       memset(cfg->pmk_list, 0, sizeof(*cfg->pmk_list));
+       err = wl_update_pmklist(dev, cfg->pmk_list, err);
+       return err;
+
+}
+
+static wl_scan_params_t *
+wl_cfg80211_scan_alloc_params(struct wireless_dev *wdev, int channel,
+       int nprobes, int *out_params_size)
+{
+       wl_scan_params_t *params;
+       int params_size;
+       int num_chans;
+       int bssidx = 0;
+
+       *out_params_size = 0;
+
+       /* Our scan params only need space for 1 channel and 0 ssids */
+       params_size = WL_SCAN_PARAMS_FIXED_SIZE + 1 * sizeof(uint16);
+       params = (wl_scan_params_t*) kzalloc(params_size, GFP_KERNEL);
+       if (params == NULL) {
+               WL_ERR(("mem alloc failed (%d bytes)\n", params_size));
+               return params;
+       }
+       memset(params, 0, params_size);
+       params->nprobes = nprobes;
+
+       num_chans = (channel == 0) ? 0 : 1;
+
+       memcpy(&params->bssid, &ether_bcast, ETHER_ADDR_LEN);
+       params->bss_type = DOT11_BSSTYPE_ANY;
+       params->scan_type = DOT11_SCANTYPE_ACTIVE;
+       params->nprobes = htod32(1);
+       params->active_time = htod32(-1);
+       params->passive_time = htod32(-1);
+       params->home_time = htod32(10);
+       if (channel == -1)
+               params->channel_list[0] = htodchanspec(channel);
+       else
+               params->channel_list[0] = wl_ch_host_to_driver(wdev, bssidx, channel);
+
+       /* Our scan params have 1 channel and 0 ssids */
+       params->channel_num = htod32((0 << WL_SCAN_PARAMS_NSSID_SHIFT) |
+               (num_chans & WL_SCAN_PARAMS_COUNT_MASK));
+
+       *out_params_size = params_size; /* rtn size to the caller */
+       return params;
+}
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+static s32
+wl_cfg80211_remain_on_channel(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev,
+       struct ieee80211_channel *channel, unsigned int duration, u64 *cookie)
+#else
+static s32
+wl_cfg80211_remain_on_channel(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev,
+       struct ieee80211_channel * channel,
+       enum nl80211_channel_type channel_type,
+       unsigned int duration, u64 *cookie)
+#endif /* WL_CFG80211_P2P_DEV_IF */
+{
+       s32 target_channel;
+       s32 err = BCME_OK;
+       struct ether_addr primary_mac;
+       struct net_device *ndev = NULL;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+       WL_DBG(("Enter, channel: %d, duration ms (%d) SCANNING ?? %s \n",
+               ieee80211_frequency_to_channel(channel->center_freq),
+               duration, (wl_get_drv_status(cfg, SCANNING, ndev)) ? "YES":"NO"));
+
+       if (!cfg->p2p) {
+               WL_ERR(("cfg->p2p is not initialized\n"));
+               err = BCME_ERROR;
+               goto exit;
+       }
+
+#ifdef P2P_LISTEN_OFFLOADING
+       if (wl_get_p2p_status(cfg, DISC_IN_PROGRESS)) {
+               WL_ERR(("P2P_FIND: Discovery offload is in progress\n"));
+               return -EAGAIN;
+       }
+#endif /* P2P_LISTEN_OFFLOADING */
+
+#ifndef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+       if (wl_get_drv_status_all(cfg, SCANNING)) {
+               wl_notify_escan_complete(cfg, cfg->escan_info.ndev, true, true);
+       }
+#endif /* not WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+
+       target_channel = ieee80211_frequency_to_channel(channel->center_freq);
+       memcpy(&cfg->remain_on_chan, channel, sizeof(struct ieee80211_channel));
+#if defined(WL_ENABLE_P2P_IF)
+       cfg->remain_on_chan_type = channel_type;
+#endif /* WL_ENABLE_P2P_IF */
+       *cookie = wl_cfg80211_get_new_roc_id(cfg);
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+       if (wl_get_drv_status(cfg, SCANNING, ndev)) {
+               struct timer_list *_timer;
+               WL_DBG(("scan is running. go to fake listen state\n"));
+
+               if (duration > LONG_LISTEN_TIME) {
+                       wl_cfg80211_scan_abort(cfg);
+               } else {
+                       wl_set_drv_status(cfg, FAKE_REMAINING_ON_CHANNEL, ndev);
+
+                       if (timer_pending(&cfg->p2p->listen_timer)) {
+                               WL_DBG(("cancel current listen timer \n"));
+                               del_timer_sync(&cfg->p2p->listen_timer);
+                       }
+
+                       _timer = &cfg->p2p->listen_timer;
+                       wl_clr_p2p_status(cfg, LISTEN_EXPIRED);
+
+                       INIT_TIMER(_timer, wl_cfgp2p_listen_expired, duration, 0);
+
+                       err = BCME_OK;
+                       goto exit;
+               }
+       }
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+
+#ifdef WL_CFG80211_SYNC_GON
+       if (wl_get_drv_status_all(cfg, WAITING_NEXT_ACT_FRM_LISTEN)) {
+               /* do not enter listen mode again if we are in listen mode already for next af.
+                * remain on channel completion will be returned by waiting next af completion.
+                */
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+               wl_set_drv_status(cfg, FAKE_REMAINING_ON_CHANNEL, ndev);
+#else
+               wl_set_drv_status(cfg, REMAINING_ON_CHANNEL, ndev);
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+               goto exit;
+       }
+#endif /* WL_CFG80211_SYNC_GON */
+       if (cfg->p2p && !cfg->p2p->on) {
+               /* In case of p2p_listen command, supplicant send remain_on_channel
+                * without turning on P2P
+                */
+               get_primary_mac(cfg, &primary_mac);
+               wl_cfgp2p_generate_bss_mac(cfg, &primary_mac);
+               p2p_on(cfg) = true;
+       }
+
+       if (p2p_is_on(cfg)) {
+               err = wl_cfgp2p_enable_discovery(cfg, ndev, NULL, 0);
+               if (unlikely(err)) {
+                       goto exit;
+               }
+#ifndef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+               wl_set_drv_status(cfg, REMAINING_ON_CHANNEL, ndev);
+#endif /* not WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+               err = wl_cfgp2p_discover_listen(cfg, target_channel, duration);
+
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+               if (err == BCME_OK) {
+                       wl_set_drv_status(cfg, REMAINING_ON_CHANNEL, ndev);
+               } else {
+                       /* if failed, firmware may be internal scanning state.
+                        * so other scan request shall not abort it
+                        */
+                       wl_set_drv_status(cfg, FAKE_REMAINING_ON_CHANNEL, ndev);
+               }
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+               /* WAR: set err = ok to prevent cookie mismatch in wpa_supplicant
+                * and expire timer will send a completion to the upper layer
+                */
+               err = BCME_OK;
+       }
+
+exit:
+       if (err == BCME_OK) {
+               WL_INFORM(("Success\n"));
+#if defined(WL_CFG80211_P2P_DEV_IF)
+               cfg80211_ready_on_channel(cfgdev, *cookie, channel,
+                       duration, GFP_KERNEL);
+#else
+               cfg80211_ready_on_channel(cfgdev, *cookie, channel,
+                       channel_type, duration, GFP_KERNEL);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+       } else {
+               WL_ERR(("Fail to Set (err=%d cookie:%llu)\n", err, *cookie));
+       }
+       return err;
+}
+
+static s32
+wl_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy,
+       bcm_struct_cfgdev *cfgdev, u64 cookie)
+{
+       s32 err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+
+#ifdef P2PLISTEN_AP_SAMECHN
+       struct net_device *dev;
+#endif /* P2PLISTEN_AP_SAMECHN */
+
+       RETURN_EIO_IF_NOT_UP(cfg);
+#if defined(WL_CFG80211_P2P_DEV_IF)
+       if (cfgdev->iftype == NL80211_IFTYPE_P2P_DEVICE) {
+               WL_DBG((" enter ) on P2P dedicated discover interface\n"));
+       }
+#else
+       WL_DBG((" enter ) netdev_ifidx: %d \n", cfgdev->ifindex));
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+#ifdef P2PLISTEN_AP_SAMECHN
+       if (cfg && cfg->p2p_resp_apchn_status) {
+               dev = bcmcfg_to_prmry_ndev(cfg);
+               wl_cfg80211_set_p2p_resp_ap_chn(dev, 0);
+               cfg->p2p_resp_apchn_status = false;
+               WL_DBG(("p2p_resp_apchn_status Turn OFF \n"));
+       }
+#endif /* P2PLISTEN_AP_SAMECHN */
+
+       if (cfg->last_roc_id == cookie) {
+               wl_cfgp2p_set_p2p_mode(cfg, WL_P2P_DISC_ST_SCAN, 0, 0,
+                       wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE));
+       } else {
+               WL_ERR(("%s : ignore, request cookie(%llu) is not matched. (cur : %llu)\n",
+                       __FUNCTION__, cookie, cfg->last_roc_id));
+       }
+
+       return err;
+}
+
+static void
+wl_cfg80211_afx_handler(struct work_struct *work)
+{
+       struct afx_hdl *afx_instance;
+       struct bcm_cfg80211 *cfg = NULL;
+       s32 ret = BCME_OK;
+
+       BCM_SET_CONTAINER_OF(afx_instance, work, struct afx_hdl, work);
+       cfg = NETDEV_GET_CFG80211_PRIV(afx_instance->dev);
+       if (afx_instance != NULL && cfg->afx_hdl->is_active) {
+               if (cfg->afx_hdl->is_listen && cfg->afx_hdl->my_listen_chan) {
+                       ret = wl_cfgp2p_discover_listen(cfg, cfg->afx_hdl->my_listen_chan,
+                               (100 * (1 + (RANDOM32() % 3)))); /* 100ms ~ 300ms */
+               } else {
+                       ret = wl_cfgp2p_act_frm_search(cfg, cfg->afx_hdl->dev,
+                               cfg->afx_hdl->bssidx, cfg->afx_hdl->peer_listen_chan,
+                               NULL);
+               }
+               if (unlikely(ret != BCME_OK)) {
+                       WL_ERR(("ERROR occurred! returned value is (%d)\n", ret));
+                       if (wl_get_drv_status_all(cfg, FINDING_COMMON_CHANNEL))
+                               complete(&cfg->act_frm_scan);
+               }
+       }
+}
+
+static s32
+wl_cfg80211_af_searching_channel(struct bcm_cfg80211 *cfg, struct net_device *dev)
+{
+       u32 max_retry = WL_CHANNEL_SYNC_RETRY;
+       bool is_p2p_gas = false;
+
+       if (dev == NULL)
+               return -1;
+
+       WL_DBG((" enter ) \n"));
+
+       wl_set_drv_status(cfg, FINDING_COMMON_CHANNEL, dev);
+       cfg->afx_hdl->is_active = TRUE;
+
+       if (cfg->afx_hdl->pending_tx_act_frm) {
+               wl_action_frame_t *action_frame;
+               action_frame = &(cfg->afx_hdl->pending_tx_act_frm->action_frame);
+               if (wl_cfgp2p_is_p2p_gas_action(action_frame->data, action_frame->len))
+                       is_p2p_gas = true;
+       }
+
+       /* Loop to wait until we find a peer's channel or the
+        * pending action frame tx is cancelled.
+        */
+       while ((cfg->afx_hdl->retry < max_retry) &&
+               (cfg->afx_hdl->peer_chan == WL_INVALID)) {
+               cfg->afx_hdl->is_listen = FALSE;
+               wl_set_drv_status(cfg, SCANNING, dev);
+               WL_DBG(("Scheduling the action frame for sending.. retry %d\n",
+                       cfg->afx_hdl->retry));
+               /* search peer on peer's listen channel */
+               schedule_work(&cfg->afx_hdl->work);
+               wait_for_completion_timeout(&cfg->act_frm_scan,
+                       msecs_to_jiffies(WL_AF_SEARCH_TIME_MAX));
+
+               if ((cfg->afx_hdl->peer_chan != WL_INVALID) ||
+                       !(wl_get_drv_status(cfg, FINDING_COMMON_CHANNEL, dev)))
+                       break;
+
+               if (is_p2p_gas)
+                       break;
+
+               if (cfg->afx_hdl->my_listen_chan) {
+                       WL_DBG(("Scheduling Listen peer in my listen channel = %d\n",
+                               cfg->afx_hdl->my_listen_chan));
+                       /* listen on my listen channel */
+                       cfg->afx_hdl->is_listen = TRUE;
+                       schedule_work(&cfg->afx_hdl->work);
+                       wait_for_completion_timeout(&cfg->act_frm_scan,
+                               msecs_to_jiffies(WL_AF_SEARCH_TIME_MAX));
+               }
+               if ((cfg->afx_hdl->peer_chan != WL_INVALID) ||
+                       !(wl_get_drv_status(cfg, FINDING_COMMON_CHANNEL, dev)))
+                       break;
+
+               cfg->afx_hdl->retry++;
+
+               WL_AF_TX_KEEP_PRI_CONNECTION_VSDB(cfg);
+       }
+
+       cfg->afx_hdl->is_active = FALSE;
+
+       wl_clr_drv_status(cfg, SCANNING, dev);
+       wl_clr_drv_status(cfg, FINDING_COMMON_CHANNEL, dev);
+
+       return (cfg->afx_hdl->peer_chan);
+}
+
+struct p2p_config_af_params {
+       s32 max_tx_retry;       /* max tx retry count if tx no ack */
+       /* To make sure to send successfully action frame, we have to turn off mpc
+        * 0: off, 1: on,  (-1): do nothing
+        */
+       s32 mpc_onoff;
+#ifdef WL_CFG80211_SYNC_GON
+       bool extra_listen;
+#endif
+       bool search_channel;    /* 1: search peer's channel to send af */
+};
+
+static s32
+wl_cfg80211_config_p2p_pub_af_tx(struct wiphy *wiphy,
+       wl_action_frame_t *action_frame, wl_af_params_t *af_params,
+       struct p2p_config_af_params *config_af_params)
+{
+       s32 err = BCME_OK;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       wifi_p2p_pub_act_frame_t *act_frm =
+               (wifi_p2p_pub_act_frame_t *) (action_frame->data);
+
+       /* initialize default value */
+#ifdef WL_CFG80211_SYNC_GON
+       config_af_params->extra_listen = true;
+#endif
+       config_af_params->search_channel = false;
+       config_af_params->max_tx_retry = WL_AF_TX_MAX_RETRY;
+       config_af_params->mpc_onoff = -1;
+       cfg->next_af_subtype = P2P_PAF_SUBTYPE_INVALID;
+
+       switch (act_frm->subtype) {
+       case P2P_PAF_GON_REQ: {
+               WL_DBG(("P2P: GO_NEG_PHASE status set \n"));
+               wl_set_p2p_status(cfg, GO_NEG_PHASE);
+
+               config_af_params->mpc_onoff = 0;
+               config_af_params->search_channel = true;
+               cfg->next_af_subtype = act_frm->subtype + 1;
+
+               /* increase dwell time to wait for RESP frame */
+               af_params->dwell_time = WL_MED_DWELL_TIME;
+
+               break;
+       }
+       case P2P_PAF_GON_RSP: {
+               cfg->next_af_subtype = act_frm->subtype + 1;
+               /* increase dwell time to wait for CONF frame */
+               af_params->dwell_time = WL_MED_DWELL_TIME + 100;
+               break;
+       }
+       case P2P_PAF_GON_CONF: {
+               /* If we reached till GO Neg confirmation reset the filter */
+               WL_DBG(("P2P: GO_NEG_PHASE status cleared \n"));
+               wl_clr_p2p_status(cfg, GO_NEG_PHASE);
+
+               /* turn on mpc again if go nego is done */
+               config_af_params->mpc_onoff = 1;
+
+               /* minimize dwell time */
+               af_params->dwell_time = WL_MIN_DWELL_TIME;
+
+#ifdef WL_CFG80211_SYNC_GON
+               config_af_params->extra_listen = false;
+#endif /* WL_CFG80211_SYNC_GON */
+               break;
+       }
+       case P2P_PAF_INVITE_REQ: {
+               config_af_params->search_channel = true;
+               cfg->next_af_subtype = act_frm->subtype + 1;
+
+               /* increase dwell time */
+               af_params->dwell_time = WL_MED_DWELL_TIME;
+               break;
+       }
+       case P2P_PAF_INVITE_RSP:
+               /* minimize dwell time */
+               af_params->dwell_time = WL_MIN_DWELL_TIME;
+#ifdef WL_CFG80211_SYNC_GON
+               config_af_params->extra_listen = false;
+#endif /* WL_CFG80211_SYNC_GON */
+               break;
+       case P2P_PAF_DEVDIS_REQ: {
+               if (IS_ACTPUB_WITHOUT_GROUP_ID(&act_frm->elts[0],
+                       action_frame->len)) {
+                       config_af_params->search_channel = true;
+               }
+
+               cfg->next_af_subtype = act_frm->subtype + 1;
+               /* maximize dwell time to wait for RESP frame */
+               af_params->dwell_time = WL_LONG_DWELL_TIME;
+               break;
+       }
+       case P2P_PAF_DEVDIS_RSP:
+               /* minimize dwell time */
+               af_params->dwell_time = WL_MIN_DWELL_TIME;
+#ifdef WL_CFG80211_SYNC_GON
+               config_af_params->extra_listen = false;
+#endif /* WL_CFG80211_SYNC_GON */
+               break;
+       case P2P_PAF_PROVDIS_REQ: {
+               if (IS_ACTPUB_WITHOUT_GROUP_ID(&act_frm->elts[0],
+                       action_frame->len)) {
+                       config_af_params->search_channel = true;
+               }
+
+               config_af_params->mpc_onoff = 0;
+               cfg->next_af_subtype = act_frm->subtype + 1;
+               /* increase dwell time to wait for RESP frame */
+               af_params->dwell_time = WL_MED_DWELL_TIME;
+               break;
+       }
+       case P2P_PAF_PROVDIS_RSP: {
+               cfg->next_af_subtype = P2P_PAF_GON_REQ;
+               af_params->dwell_time = WL_MIN_DWELL_TIME;
+#ifdef WL_CFG80211_SYNC_GON
+               config_af_params->extra_listen = false;
+#endif /* WL_CFG80211_SYNC_GON */
+               break;
+       }
+       default:
+               WL_DBG(("Unknown p2p pub act frame subtype: %d\n",
+                       act_frm->subtype));
+               err = BCME_BADARG;
+       }
+       return err;
+}
+
+#ifdef WL11U
+static bool
+wl_cfg80211_check_DFS_channel(struct bcm_cfg80211 *cfg, wl_af_params_t *af_params,
+       void *frame, u16 frame_len)
+{
+       struct wl_scan_results *bss_list;
+       struct wl_bss_info *bi = NULL;
+       bool result = false;
+       s32 i;
+       chanspec_t chanspec;
+
+       /* If DFS channel is 52~148, check to block it or not */
+       if (af_params &&
+               (af_params->channel >= 52 && af_params->channel <= 148)) {
+               if (!wl_cfgp2p_is_p2p_action(frame, frame_len)) {
+                       bss_list = cfg->bss_list;
+                       bi = next_bss(bss_list, bi);
+                       for_each_bss(bss_list, bi, i) {
+                               chanspec = wl_chspec_driver_to_host(bi->chanspec);
+                               if (CHSPEC_IS5G(chanspec) &&
+                                       ((bi->ctl_ch ? bi->ctl_ch : CHSPEC_CHANNEL(chanspec))
+                                       == af_params->channel)) {
+                                       result = true;  /* do not block the action frame */
+                                       break;
+                               }
+                       }
+               }
+       }
+       else {
+               result = true;
+       }
+
+       WL_DBG(("result=%s", result?"true":"false"));
+       return result;
+}
+#endif /* WL11U */
+static bool
+wl_cfg80211_check_dwell_overflow(int32 requested_dwell, ulong dwell_jiffies)
+{
+       if ((requested_dwell & CUSTOM_RETRY_MASK) &&
+                       (jiffies_to_msecs(jiffies - dwell_jiffies) >
+                        (requested_dwell & ~CUSTOM_RETRY_MASK))) {
+               WL_ERR(("Action frame TX retry time over dwell time!\n"));
+               return true;
+       }
+       return false;
+}
+
+static bool
+wl_cfg80211_send_action_frame(struct wiphy *wiphy, struct net_device *dev,
+       bcm_struct_cfgdev *cfgdev, wl_af_params_t *af_params,
+       wl_action_frame_t *action_frame, u16 action_frame_len, s32 bssidx)
+{
+#ifdef WL11U
+       struct net_device *ndev = NULL;
+#endif /* WL11U */
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       bool ack = false;
+       u8 category, action;
+       s32 tx_retry;
+       struct p2p_config_af_params config_af_params;
+       struct net_info *netinfo;
+#ifdef VSDB
+       ulong off_chan_started_jiffies = 0;
+#endif
+       ulong dwell_jiffies = 0;
+       bool dwell_overflow = false;
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+
+       int32 requested_dwell = af_params->dwell_time;
+
+       /* Add the default dwell time
+        * Dwell time to stay off-channel to wait for a response action frame
+        * after transmitting an GO Negotiation action frame
+        */
+       af_params->dwell_time = WL_DWELL_TIME;
+
+#ifdef WL11U
+#if defined(WL_CFG80211_P2P_DEV_IF)
+       ndev = dev;
+#else
+       ndev = ndev_to_cfgdev(cfgdev);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+#endif /* WL11U */
+
+       category = action_frame->data[DOT11_ACTION_CAT_OFF];
+       action = action_frame->data[DOT11_ACTION_ACT_OFF];
+
+       /* initialize variables */
+       tx_retry = 0;
+       cfg->next_af_subtype = P2P_PAF_SUBTYPE_INVALID;
+       config_af_params.max_tx_retry = WL_AF_TX_MAX_RETRY;
+       config_af_params.mpc_onoff = -1;
+       config_af_params.search_channel = false;
+#ifdef WL_CFG80211_SYNC_GON
+       config_af_params.extra_listen = false;
+#endif
+
+       /* config parameters */
+       /* Public Action Frame Process - DOT11_ACTION_CAT_PUBLIC */
+       if (category == DOT11_ACTION_CAT_PUBLIC) {
+               if ((action == P2P_PUB_AF_ACTION) &&
+                       (action_frame_len >= sizeof(wifi_p2p_pub_act_frame_t))) {
+                       /* p2p public action frame process */
+                       if (BCME_OK != wl_cfg80211_config_p2p_pub_af_tx(wiphy,
+                               action_frame, af_params, &config_af_params)) {
+                               WL_DBG(("Unknown subtype.\n"));
+                       }
+
+               } else if (action_frame_len >= sizeof(wifi_p2psd_gas_pub_act_frame_t)) {
+                       /* service discovery process */
+                       if (action == P2PSD_ACTION_ID_GAS_IREQ ||
+                               action == P2PSD_ACTION_ID_GAS_CREQ) {
+                               /* configure service discovery query frame */
+
+                               config_af_params.search_channel = true;
+
+                               /* save next af suptype to cancel remained dwell time */
+                               cfg->next_af_subtype = action + 1;
+
+                               af_params->dwell_time = WL_MED_DWELL_TIME;
+                               if (requested_dwell & CUSTOM_RETRY_MASK) {
+                                       config_af_params.max_tx_retry =
+                                               (requested_dwell & CUSTOM_RETRY_MASK) >> 24;
+                                       af_params->dwell_time =
+                                               (requested_dwell & ~CUSTOM_RETRY_MASK);
+                                       WL_DBG(("Custom retry(%d) and dwell time(%d) is set.\n",
+                                               config_af_params.max_tx_retry,
+                                               af_params->dwell_time));
+                               }
+                       } else if (action == P2PSD_ACTION_ID_GAS_IRESP ||
+                               action == P2PSD_ACTION_ID_GAS_CRESP) {
+                               /* configure service discovery response frame */
+                               af_params->dwell_time = WL_MIN_DWELL_TIME;
+                       } else {
+                               WL_DBG(("Unknown action type: %d\n", action));
+                       }
+               } else {
+                       WL_DBG(("Unknown Frame: category 0x%x, action 0x%x, length %d\n",
+                               category, action, action_frame_len));
+       }
+       } else if (category == P2P_AF_CATEGORY) {
+               /* do not configure anything. it will be sent with a default configuration */
+       } else {
+               WL_DBG(("Unknown Frame: category 0x%x, action 0x%x\n",
+                       category, action));
+               if (dhd->op_mode & DHD_FLAG_HOSTAP_MODE) {
+                       wl_clr_drv_status(cfg, SENDING_ACT_FRM, dev);
+                       return false;
+               }
+       }
+
+       /* To make sure to send successfully action frame, we have to turn off mpc */
+       if (config_af_params.mpc_onoff == 0) {
+               wldev_iovar_setint(dev, "mpc", 0);
+       }
+
+       netinfo = wl_get_netinfo_by_bssidx(cfg, bssidx);
+       /* validate channel and p2p ies */
+       if (config_af_params.search_channel && IS_P2P_SOCIAL(af_params->channel) &&
+               netinfo && netinfo->bss.ies.probe_req_ie_len) {
+               config_af_params.search_channel = true;
+       } else {
+               config_af_params.search_channel = false;
+       }
+#ifdef WL11U
+       if (ndev == bcmcfg_to_prmry_ndev(cfg))
+               config_af_params.search_channel = false;
+#endif /* WL11U */
+
+#ifdef VSDB
+       /* if connecting on primary iface, sleep for a while before sending af tx for VSDB */
+       if (wl_get_drv_status(cfg, CONNECTING, bcmcfg_to_prmry_ndev(cfg))) {
+               OSL_SLEEP(50);
+       }
+#endif
+
+       /* if scan is ongoing, abort current scan. */
+       if (wl_get_drv_status_all(cfg, SCANNING)) {
+               wl_notify_escan_complete(cfg, cfg->escan_info.ndev, true, true);
+       }
+
+       /* Abort P2P listen */
+       if (discover_cfgdev(cfgdev, cfg)) {
+               if (cfg->p2p_supported && cfg->p2p) {
+                       wl_cfgp2p_set_p2p_mode(cfg, WL_P2P_DISC_ST_SCAN, 0, 0,
+                               wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE));
+               }
+       }
+
+#ifdef WL11U
+       /* handling DFS channel exceptions */
+       if (!wl_cfg80211_check_DFS_channel(cfg, af_params, action_frame->data, action_frame->len)) {
+               return false;   /* the action frame was blocked */
+       }
+#endif /* WL11U */
+
+       /* set status and destination address before sending af */
+       if (cfg->next_af_subtype != P2P_PAF_SUBTYPE_INVALID) {
+               /* set this status to cancel the remained dwell time in rx process */
+               wl_set_drv_status(cfg, WAITING_NEXT_ACT_FRM, dev);
+       }
+       wl_set_drv_status(cfg, SENDING_ACT_FRM, dev);
+       memcpy(cfg->afx_hdl->tx_dst_addr.octet,
+               af_params->action_frame.da.octet,
+               sizeof(cfg->afx_hdl->tx_dst_addr.octet));
+
+       /* save af_params for rx process */
+       cfg->afx_hdl->pending_tx_act_frm = af_params;
+
+       if (wl_cfgp2p_is_p2p_gas_action(action_frame->data, action_frame->len)) {
+               WL_DBG(("Set GAS action frame config.\n"));
+               config_af_params.search_channel = false;
+               config_af_params.max_tx_retry = 1;
+       }
+
+       /* search peer's channel */
+       if (config_af_params.search_channel) {
+               /* initialize afx_hdl */
+               if ((cfg->afx_hdl->bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+                       WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+                       goto exit;
+               }
+               cfg->afx_hdl->dev = dev;
+               cfg->afx_hdl->retry = 0;
+               cfg->afx_hdl->peer_chan = WL_INVALID;
+
+               if (wl_cfg80211_af_searching_channel(cfg, dev) == WL_INVALID) {
+                       WL_ERR(("couldn't find peer's channel.\n"));
+                       wl_cfgp2p_print_actframe(true, action_frame->data, action_frame->len,
+                               af_params->channel);
+                       goto exit;
+               }
+
+               wl_clr_drv_status(cfg, SCANNING, cfg->afx_hdl->dev);
+               /*
+                * Abort scan even for VSDB scenarios. Scan gets aborted in firmware
+                * but after the check of piggyback algorithm.
+                * To take care of current piggback algo, lets abort the scan here itself.
+                */
+               wl_notify_escan_complete(cfg, dev, true, true);
+               /* Suspend P2P discovery's search-listen to prevent it from
+                * starting a scan or changing the channel.
+                */
+               if ((wl_cfgp2p_discover_enable_search(cfg, false)) < 0) {
+                       WL_ERR(("Can not disable discovery mode\n"));
+                       goto exit;
+               }
+
+               /* update channel */
+               af_params->channel = cfg->afx_hdl->peer_chan;
+       }
+
+#ifdef VSDB
+       off_chan_started_jiffies = jiffies;
+#endif /* VSDB */
+
+       wl_cfgp2p_print_actframe(true, action_frame->data, action_frame->len, af_params->channel);
+
+       wl_cfgp2p_need_wait_actfrmae(cfg, action_frame->data, action_frame->len, true);
+
+       dwell_jiffies = jiffies;
+       /* Now send a tx action frame */
+       ack = wl_cfgp2p_tx_action_frame(cfg, dev, af_params, bssidx) ? false : true;
+       dwell_overflow = wl_cfg80211_check_dwell_overflow(requested_dwell, dwell_jiffies);
+
+       /* if failed, retry it. tx_retry_max value is configure by .... */
+       while ((ack == false) && (tx_retry++ < config_af_params.max_tx_retry) &&
+                       !dwell_overflow) {
+#ifdef VSDB
+               if (af_params->channel) {
+                       if (jiffies_to_msecs(jiffies - off_chan_started_jiffies) >
+                               OFF_CHAN_TIME_THRESHOLD_MS) {
+                               WL_AF_TX_KEEP_PRI_CONNECTION_VSDB(cfg);
+                               off_chan_started_jiffies = jiffies;
+                       } else
+                               OSL_SLEEP(AF_RETRY_DELAY_TIME);
+               }
+#endif /* VSDB */
+               ack = wl_cfgp2p_tx_action_frame(cfg, dev, af_params, bssidx) ?
+                       false : true;
+               dwell_overflow = wl_cfg80211_check_dwell_overflow(requested_dwell, dwell_jiffies);
+       }
+
+       if (ack == false) {
+               WL_ERR(("Failed to send Action Frame(retry %d)\n", tx_retry));
+       }
+       WL_DBG(("Complete to send action frame\n"));
+exit:
+       /* Clear SENDING_ACT_FRM after all sending af is done */
+       wl_clr_drv_status(cfg, SENDING_ACT_FRM, dev);
+
+#ifdef WL_CFG80211_SYNC_GON
+       /* WAR: sometimes dongle does not keep the dwell time of 'actframe'.
+        * if we coundn't get the next action response frame and dongle does not keep
+        * the dwell time, go to listen state again to get next action response frame.
+        */
+       if (ack && config_af_params.extra_listen &&
+               wl_get_drv_status_all(cfg, WAITING_NEXT_ACT_FRM) &&
+               cfg->af_sent_channel == cfg->afx_hdl->my_listen_chan) {
+               s32 extar_listen_time;
+
+               extar_listen_time = af_params->dwell_time -
+                       jiffies_to_msecs(jiffies - cfg->af_tx_sent_jiffies);
+
+               if (extar_listen_time > 50) {
+                       wl_set_drv_status(cfg, WAITING_NEXT_ACT_FRM_LISTEN, dev);
+                       WL_DBG(("Wait more time! actual af time:%d,"
+                               "calculated extar listen:%d\n",
+                               af_params->dwell_time, extar_listen_time));
+                       if (wl_cfgp2p_discover_listen(cfg, cfg->af_sent_channel,
+                               extar_listen_time + 100) == BCME_OK) {
+                               wait_for_completion_timeout(&cfg->wait_next_af,
+                                       msecs_to_jiffies(extar_listen_time + 100 + 300));
+                       }
+                       wl_clr_drv_status(cfg, WAITING_NEXT_ACT_FRM_LISTEN, dev);
+               }
+       }
+#endif /* WL_CFG80211_SYNC_GON */
+       wl_clr_drv_status(cfg, WAITING_NEXT_ACT_FRM, dev);
+
+       if (cfg->afx_hdl->pending_tx_act_frm)
+               cfg->afx_hdl->pending_tx_act_frm = NULL;
+
+       WL_INFORM(("-- sending Action Frame is %s, listen chan: %d\n",
+               (ack) ? "Succeeded!!":"Failed!!", cfg->afx_hdl->my_listen_chan));
+
+
+       /* if all done, turn mpc on again */
+       if (config_af_params.mpc_onoff == 1) {
+               wldev_iovar_setint(dev, "mpc", 1);
+       }
+
+       return ack;
+}
+
+#define MAX_NUM_OF_ASSOCIATED_DEV       64
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+static s32
+wl_cfg80211_mgmt_tx(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev,
+       struct cfg80211_mgmt_tx_params *params, u64 *cookie)
+#else
+static s32
+wl_cfg80211_mgmt_tx(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev,
+       struct ieee80211_channel *channel, bool offchan,
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(3, 7, 0))
+       enum nl80211_channel_type channel_type,
+       bool channel_type_valid,
+#endif /* LINUX_VERSION_CODE <= KERNEL_VERSION(3, 7, 0) */
+       unsigned int wait, const u8* buf, size_t len,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)) || defined(WL_COMPAT_WIRELESS)
+       bool no_cck,
+#endif
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0)) || defined(WL_COMPAT_WIRELESS)
+       bool dont_wait_for_ack,
+#endif
+       u64 *cookie)
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0) */
+{
+       wl_action_frame_t *action_frame;
+       wl_af_params_t *af_params;
+       scb_val_t scb_val;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+       struct ieee80211_channel *channel = params->chan;
+       const u8 *buf = params->buf;
+       size_t len = params->len;
+#endif
+       const struct ieee80211_mgmt *mgmt;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct net_device *dev = NULL;
+       s32 err = BCME_OK;
+       s32 bssidx = 0;
+       u32 id;
+       bool ack = false;
+       s8 eabuf[ETHER_ADDR_STR_LEN];
+
+       WL_DBG(("Enter \n"));
+
+       dev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+       if (!dev) {
+               WL_ERR(("dev is NULL\n"));
+               return -EINVAL;
+       }
+
+       /* set bsscfg idx for iovar (wlan0: P2PAPI_BSSCFG_PRIMARY, p2p: P2PAPI_BSSCFG_DEVICE)   */
+       if (discover_cfgdev(cfgdev, cfg)) {
+               if (!cfg->p2p_supported || !cfg->p2p) {
+                       WL_ERR(("P2P doesn't setup completed yet\n"));
+                       return -EINVAL;
+               }
+               bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+       }
+       else {
+               if ((bssidx = wl_get_bssidx_by_wdev(cfg, cfgdev_to_wdev(cfgdev))) < 0) {
+                       WL_ERR(("Find p2p index failed\n"));
+                       return BCME_ERROR;
+               }
+       }
+
+       WL_DBG(("TX target bssidx=%d\n", bssidx));
+
+       if (p2p_is_on(cfg)) {
+               /* Suspend P2P discovery search-listen to prevent it from changing the
+                * channel.
+                */
+               if ((err = wl_cfgp2p_discover_enable_search(cfg, false)) < 0) {
+                       WL_ERR(("Can not disable discovery mode\n"));
+                       return -EFAULT;
+               }
+       }
+       *cookie = 0;
+       id = cfg->send_action_id++;
+       if (id == 0)
+               id = cfg->send_action_id++;
+       *cookie = id;
+       mgmt = (const struct ieee80211_mgmt *)buf;
+       if (ieee80211_is_mgmt(mgmt->frame_control)) {
+               if (ieee80211_is_probe_resp(mgmt->frame_control)) {
+                       s32 ie_offset =  DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
+                       s32 ie_len = len - ie_offset;
+                       if ((dev == bcmcfg_to_prmry_ndev(cfg)) && cfg->p2p) {
+                               bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+                       }
+                       wl_cfg80211_set_mgmt_vndr_ies(cfg, ndev_to_cfgdev(dev), bssidx,
+                               VNDR_IE_PRBRSP_FLAG, (const u8 *)(buf + ie_offset), ie_len);
+                       cfg80211_mgmt_tx_status(cfgdev, *cookie, buf, len, true, GFP_KERNEL);
+#if defined(P2P_IE_MISSING_FIX)
+                       if (!cfg->p2p_prb_noti) {
+                               cfg->p2p_prb_noti = true;
+                               WL_DBG(("%s: TX 802_1X Probe Response first time.\n",
+                                       __FUNCTION__));
+                       }
+#endif
+                       goto exit;
+               } else if (ieee80211_is_disassoc(mgmt->frame_control) ||
+                       ieee80211_is_deauth(mgmt->frame_control)) {
+                       char mac_buf[MAX_NUM_OF_ASSOCIATED_DEV *
+                               sizeof(struct ether_addr) + sizeof(uint)] = {0};
+                       int num_associated = 0;
+                       struct maclist *assoc_maclist = (struct maclist *)mac_buf;
+                       if (!bcmp((const uint8 *)BSSID_BROADCAST,
+                               (const struct ether_addr *)mgmt->da, ETHER_ADDR_LEN)) {
+                               assoc_maclist->count = MAX_NUM_OF_ASSOCIATED_DEV;
+                               err = wldev_ioctl(dev, WLC_GET_ASSOCLIST,
+                                       assoc_maclist, sizeof(mac_buf), false);
+                               if (err < 0)
+                                       WL_ERR(("WLC_GET_ASSOCLIST error %d\n", err));
+                               else
+                                       num_associated = assoc_maclist->count;
+                       }
+                       memcpy(scb_val.ea.octet, mgmt->da, ETH_ALEN);
+                       scb_val.val = mgmt->u.disassoc.reason_code;
+                       err = wldev_ioctl(dev, WLC_SCB_DEAUTHENTICATE_FOR_REASON, &scb_val,
+                               sizeof(scb_val_t), true);
+                       if (err < 0)
+                               WL_ERR(("WLC_SCB_DEAUTHENTICATE_FOR_REASON error %d\n", err));
+                       WL_ERR(("Disconnect STA : %s scb_val.val %d\n",
+                               bcm_ether_ntoa((const struct ether_addr *)mgmt->da, eabuf),
+                               scb_val.val));
+
+                       if (num_associated > 0 && ETHER_ISBCAST(mgmt->da))
+                               wl_delay(400);
+
+                       cfg80211_mgmt_tx_status(cfgdev, *cookie, buf, len, true, GFP_KERNEL);
+                       goto exit;
+
+               } else if (ieee80211_is_action(mgmt->frame_control)) {
+                       /* Abort the dwell time of any previous off-channel
+                       * action frame that may be still in effect.  Sending
+                       * off-channel action frames relies on the driver's
+                       * scan engine.  If a previous off-channel action frame
+                       * tx is still in progress (including the dwell time),
+                       * then this new action frame will not be sent out.
+                       */
+/* Do not abort scan for VSDB. Scan will be aborted in firmware if necessary.
+ * And previous off-channel action frame must be ended before new af tx.
+ */
+#ifndef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+                       wl_notify_escan_complete(cfg, dev, true, true);
+#endif /* not WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+               }
+
+       } else {
+               WL_ERR(("Driver only allows MGMT packet type\n"));
+               goto exit;
+       }
+
+       af_params = (wl_af_params_t *) kzalloc(WL_WIFI_AF_PARAMS_SIZE, GFP_KERNEL);
+
+       if (af_params == NULL)
+       {
+               WL_ERR(("unable to allocate frame\n"));
+               return -ENOMEM;
+       }
+
+       action_frame = &af_params->action_frame;
+
+       /* Add the packet Id */
+       action_frame->packetId = *cookie;
+       WL_DBG(("action frame %d\n", action_frame->packetId));
+       /* Add BSSID */
+       memcpy(&action_frame->da, &mgmt->da[0], ETHER_ADDR_LEN);
+       memcpy(&af_params->BSSID, &mgmt->bssid[0], ETHER_ADDR_LEN);
+
+       /* Add the length exepted for 802.11 header  */
+       action_frame->len = len - DOT11_MGMT_HDR_LEN;
+       WL_DBG(("action_frame->len: %d\n", action_frame->len));
+
+       /* Add the channel */
+       af_params->channel =
+               ieee80211_frequency_to_channel(channel->center_freq);
+       /* Save listen_chan for searching common channel */
+       cfg->afx_hdl->peer_listen_chan = af_params->channel;
+       WL_DBG(("channel from upper layer %d\n", cfg->afx_hdl->peer_listen_chan));
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+       af_params->dwell_time = params->wait;
+#else
+       af_params->dwell_time = wait;
+#endif
+
+       memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN], action_frame->len);
+
+       ack = wl_cfg80211_send_action_frame(wiphy, dev, cfgdev, af_params,
+               action_frame, action_frame->len, bssidx);
+       cfg80211_mgmt_tx_status(cfgdev, *cookie, buf, len, ack, GFP_KERNEL);
+
+       kfree(af_params);
+exit:
+       return err;
+}
+
+
+static void
+wl_cfg80211_mgmt_frame_register(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev,
+       u16 frame_type, bool reg)
+{
+
+       WL_DBG(("frame_type: %x, reg: %d\n", frame_type, reg));
+
+       if (frame_type != (IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_PROBE_REQ))
+               return;
+
+       return;
+}
+
+
+static s32
+wl_cfg80211_change_bss(struct wiphy *wiphy,
+       struct net_device *dev,
+       struct bss_parameters *params)
+{
+       s32 err = 0;
+       s32 ap_isolate = 0;
+
+       if (params->use_cts_prot >= 0) {
+       }
+
+       if (params->use_short_preamble >= 0) {
+       }
+
+       if (params->use_short_slot_time >= 0) {
+       }
+
+       if (params->basic_rates) {
+       }
+
+       if (params->ap_isolate >= 0) {
+               ap_isolate = params->ap_isolate;
+               err = wldev_iovar_setint(dev, "ap_isolate", ap_isolate);
+               if (unlikely(err))
+               {
+                       WL_ERR(("set ap_isolate Error (%d)\n", err));
+               }
+       }
+
+       if (params->ht_opmode >= 0) {
+       }
+
+
+       return 0;
+}
+
+static s32
+wl_cfg80211_set_channel(struct wiphy *wiphy, struct net_device *dev,
+       struct ieee80211_channel *chan,
+       enum nl80211_channel_type channel_type)
+{
+       s32 _chan;
+       chanspec_t chspec = 0;
+       chanspec_t fw_chspec = 0;
+       u32 bw = WL_CHANSPEC_BW_20;
+#ifdef WL11ULB
+       u32 ulb_bw = wl_cfg80211_get_ulb_bw(dev->ieee80211_ptr);
+#endif /* WL11ULB */
+
+       s32 err = BCME_OK;
+       s32 bw_cap = 0;
+       struct {
+               u32 band;
+               u32 bw_cap;
+       } param = {0, 0};
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+#ifdef CUSTOM_SET_CPUCORE
+       dhd_pub_t *dhd =  (dhd_pub_t *)(cfg->pub);
+#endif /* CUSTOM_SET_CPUCORE */
+       u32 channel_width = 0;
+
+       dev = ndev_to_wlc_ndev(dev, cfg);
+       _chan = ieee80211_frequency_to_channel(chan->center_freq);
+       WL_ERR(("netdev_ifidx(%d), chan_type(%d) target channel(%d) channel_width(%x)\n",
+               dev->ifindex, channel_type, _chan, wl_get_chanwidth_by_netdev(cfg, dev)));
+
+
+#ifdef WL11ULB
+       if (ulb_bw) {
+               WL_DBG(("[ULB] setting AP/GO BW to ulb_bw 0x%x \n", ulb_bw));
+               bw = wl_cfg80211_ulbbw_to_ulbchspec(ulb_bw);
+               goto set_channel;
+       }
+#endif /* WL11ULB */
+       if (chan->band == IEEE80211_BAND_5GHZ) {
+               param.band = WLC_BAND_5G;
+               channel_width = wl_get_chanwidth_by_netdev(cfg, dev);
+               switch (channel_width) {
+               case WL_CHANSPEC_BW_80:
+               case WL_CHANSPEC_BW_40:
+               case WL_CHANSPEC_BW_20:
+                       bw = channel_width;
+                       /* resetting user specified channel width */
+                       wl_set_chanwidth_by_netdev(cfg, dev, 0);
+                       break;
+               default:
+                       err = wldev_iovar_getbuf(dev, "bw_cap", &param, sizeof(param),
+                               cfg->ioctl_buf, WLC_IOCTL_SMLEN, &cfg->ioctl_buf_sync);
+                       if (err) {
+                               if (err != BCME_UNSUPPORTED) {
+                                       WL_ERR(("bw_cap failed, %d\n", err));
+                                       return err;
+                               } else {
+                                       err = wldev_iovar_getint(dev, "mimo_bw_cap", &bw_cap);
+                                       if (err) {
+                                               WL_ERR(("error get mimo_bw_cap (%d)\n", err));
+                                       }
+                                       if (bw_cap != WLC_N_BW_20ALL)
+                                               bw = WL_CHANSPEC_BW_40;
+                               }
+                       } else {
+                               if (WL_BW_CAP_80MHZ(cfg->ioctl_buf[0]))
+                                       bw = WL_CHANSPEC_BW_80;
+                               else if (WL_BW_CAP_40MHZ(cfg->ioctl_buf[0]))
+                                       bw = WL_CHANSPEC_BW_40;
+                               else
+                                       bw = WL_CHANSPEC_BW_20;
+                       }
+               break;
+               }
+
+       } else if (chan->band == IEEE80211_BAND_2GHZ)
+               bw = WL_CHANSPEC_BW_20;
+set_channel:
+       chspec = wf_channel2chspec(_chan, bw);
+       if (wf_chspec_valid(chspec)) {
+               fw_chspec = wl_chspec_host_to_driver(chspec);
+               if (fw_chspec != INVCHANSPEC) {
+                       if ((err = wldev_iovar_setint(dev, "chanspec",
+                               fw_chspec)) == BCME_BADCHAN) {
+                               if (bw == WL_CHANSPEC_BW_80)
+                                       goto change_bw;
+                               err = wldev_ioctl(dev, WLC_SET_CHANNEL,
+                                       &_chan, sizeof(_chan), true);
+                               if (err < 0) {
+                                       WL_ERR(("WLC_SET_CHANNEL error %d"
+                                       "chip may not be supporting this channel\n", err));
+                               }
+                       } else if (err) {
+                               WL_ERR(("failed to set chanspec error %d\n", err));
+                       }
+               } else {
+                       WL_ERR(("failed to convert host chanspec to fw chanspec\n"));
+                       err = BCME_ERROR;
+               }
+       } else {
+change_bw:
+               if (bw == WL_CHANSPEC_BW_80)
+                       bw = WL_CHANSPEC_BW_40;
+               else if (bw == WL_CHANSPEC_BW_40)
+                       bw = WL_CHANSPEC_BW_20;
+               else
+                       bw = 0;
+               if (bw)
+                       goto set_channel;
+               WL_ERR(("Invalid chanspec 0x%x\n", chspec));
+               err = BCME_ERROR;
+       }
+#ifdef CUSTOM_SET_CPUCORE
+       if (dhd->op_mode == DHD_FLAG_HOSTAP_MODE) {
+               WL_DBG(("SoftAP mode do not need to set cpucore\n"));
+       } else if (chspec & WL_CHANSPEC_BW_80) {
+               /* SoftAp only mode do not need to set cpucore */
+               if ((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP) &&
+                       dev != bcmcfg_to_prmry_ndev(cfg)) {
+                       /* Soft AP on virtual Iface (AP+STA case) */
+                       dhd->chan_isvht80 |= DHD_FLAG_HOSTAP_MODE;
+                       dhd_set_cpucore(dhd, TRUE);
+               } else if (is_p2p_group_iface(dev->ieee80211_ptr)) {
+                       /* If P2P IF is vht80 */
+                       dhd->chan_isvht80 |= DHD_FLAG_P2P_MODE;
+                       dhd_set_cpucore(dhd, TRUE);
+               }
+       }
+#endif /* CUSTOM_SET_CPUCORE */
+       if (!err && (wl_get_mode_by_netdev(cfg, dev) == WL_MODE_AP)) {
+               /* Update AP/GO operating channel */
+               cfg->ap_oper_channel = _chan;
+       }
+       return err;
+}
+
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+struct net_device *
+wl_cfg80211_get_remain_on_channel_ndev(struct bcm_cfg80211 *cfg)
+{
+       struct net_info *_net_info, *next;
+       list_for_each_entry_safe(_net_info, next, &cfg->net_list, list) {
+               if (_net_info->ndev &&
+                       test_bit(WL_STATUS_REMAINING_ON_CHANNEL, &_net_info->sme_state))
+                       return _net_info->ndev;
+       }
+       return NULL;
+}
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) || defined(WL_COMPAT_WIRELESS)
+#ifdef BCMWAPI_WPI
+static s32
+wl_validate_wapisecurity(struct net_device *dev, s32 bssidx)
+{
+               s32 err = BCME_OK;
+
+               /* set auth */
+               err = wldev_iovar_setint_bsscfg(dev, "auth", 0, bssidx);
+               if (err < 0) {
+                       WL_ERR(("WAPI auth error %d\n", err));
+                       return BCME_ERROR;
+               }
+
+               /* set wsec */
+               err = wldev_iovar_setint_bsscfg(dev, "wsec", SMS4_ENABLED, bssidx);
+               if (err < 0) {
+                       WL_ERR(("WAPI wsec error %d\n", err));
+                       return BCME_ERROR;
+               }
+
+               /* set upper-layer auth */
+               err = wldev_iovar_setint_bsscfg(dev, "wpa_auth", WAPI_AUTH_PSK, bssidx);
+               if (err < 0) {
+                       WL_ERR(("WAPI wpa_auth error %d\n", err));
+                       return BCME_ERROR;
+               }
+               return 0;
+}
+#endif /* BCMWAPI_WPI */
+#endif /* LINUX_VERSION >= VERSION(3,4,0) || WL_COMPAT_WIRELESS */
+
+static s32
+wl_validate_opensecurity(struct net_device *dev, s32 bssidx, bool privacy)
+{
+       s32 err = BCME_OK;
+       u32 wpa_val;
+       s32 wsec = 0;
+
+       /* set auth */
+       err = wldev_iovar_setint_bsscfg(dev, "auth", 0, bssidx);
+       if (err < 0) {
+               WL_ERR(("auth error %d\n", err));
+               return BCME_ERROR;
+       }
+
+       if (privacy) {
+               /* If privacy bit is set in open mode, then WEP would be enabled */
+               wsec = WEP_ENABLED;
+               WL_DBG(("Setting wsec to %d for WEP \n", wsec));
+       }
+
+       /* set wsec */
+       err = wldev_iovar_setint_bsscfg(dev, "wsec", wsec, bssidx);
+       if (err < 0) {
+               WL_ERR(("wsec error %d\n", err));
+               return BCME_ERROR;
+       }
+
+       /* set upper-layer auth */
+       if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_ADHOC)
+               wpa_val = WPA_AUTH_NONE;
+       else
+               wpa_val = WPA_AUTH_DISABLED;
+       err = wldev_iovar_setint_bsscfg(dev, "wpa_auth", wpa_val, bssidx);
+       if (err < 0) {
+               WL_ERR(("wpa_auth error %d\n", err));
+               return BCME_ERROR;
+       }
+
+       return 0;
+}
+
+static s32
+wl_validate_wpa2ie(struct net_device *dev, bcm_tlv_t *wpa2ie, s32 bssidx)
+{
+       s32 len = 0;
+       s32 err = BCME_OK;
+       u16 auth = 0; /* d11 open authentication */
+       u32 wsec;
+       u32 pval = 0;
+       u32 gval = 0;
+       u32 wpa_auth = 0;
+       wpa_suite_mcast_t *mcast;
+       wpa_suite_ucast_t *ucast;
+       wpa_suite_auth_key_mgmt_t *mgmt;
+       wpa_pmkid_list_t *pmkid;
+       int cnt = 0;
+
+       u16 suite_count;
+       u8 rsn_cap[2];
+       u32 wme_bss_disable;
+
+       if (wpa2ie == NULL)
+               goto exit;
+
+       WL_DBG(("Enter \n"));
+       len =  wpa2ie->len - WPA2_VERSION_LEN;
+       /* check the mcast cipher */
+       mcast = (wpa_suite_mcast_t *)&wpa2ie->data[WPA2_VERSION_LEN];
+       switch (mcast->type) {
+               case WPA_CIPHER_NONE:
+                       gval = 0;
+                       break;
+               case WPA_CIPHER_WEP_40:
+               case WPA_CIPHER_WEP_104:
+                       gval = WEP_ENABLED;
+                       break;
+               case WPA_CIPHER_TKIP:
+                       gval = TKIP_ENABLED;
+                       break;
+               case WPA_CIPHER_AES_CCM:
+                       gval = AES_ENABLED;
+                       break;
+#ifdef BCMWAPI_WPI
+               case WAPI_CIPHER_SMS4:
+                       gval = SMS4_ENABLED;
+                       break;
+#endif
+               default:
+                       WL_ERR(("No Security Info\n"));
+                       break;
+       }
+       if ((len -= WPA_SUITE_LEN) <= 0)
+               return BCME_BADLEN;
+
+       /* check the unicast cipher */
+       ucast = (wpa_suite_ucast_t *)&mcast[1];
+       suite_count = ltoh16_ua(&ucast->count);
+       switch (ucast->list[0].type) {
+               case WPA_CIPHER_NONE:
+                       pval = 0;
+                       break;
+               case WPA_CIPHER_WEP_40:
+               case WPA_CIPHER_WEP_104:
+                       pval = WEP_ENABLED;
+                       break;
+               case WPA_CIPHER_TKIP:
+                       pval = TKIP_ENABLED;
+                       break;
+               case WPA_CIPHER_AES_CCM:
+                       pval = AES_ENABLED;
+                       break;
+#ifdef BCMWAPI_WPI
+               case WAPI_CIPHER_SMS4:
+                       pval = SMS4_ENABLED;
+                       break;
+#endif
+               default:
+                       WL_ERR(("No Security Info\n"));
+       }
+       if ((len -= (WPA_IE_SUITE_COUNT_LEN + (WPA_SUITE_LEN * suite_count))) <= 0)
+               return BCME_BADLEN;
+
+       /* FOR WPS , set SEC_OW_ENABLED */
+       wsec = (pval | gval | SES_OW_ENABLED);
+       /* check the AKM */
+       mgmt = (wpa_suite_auth_key_mgmt_t *)&ucast->list[suite_count];
+       suite_count = cnt = ltoh16_ua(&mgmt->count);
+       while (cnt--) {
+               switch (mgmt->list[cnt].type) {
+               case RSN_AKM_NONE:
+                       wpa_auth |= WPA_AUTH_NONE;
+                       break;
+               case RSN_AKM_UNSPECIFIED:
+                       wpa_auth |= WPA2_AUTH_UNSPECIFIED;
+                       break;
+               case RSN_AKM_PSK:
+                       wpa_auth |= WPA2_AUTH_PSK;
+                       break;
+               default:
+                       WL_ERR(("No Key Mgmt Info\n"));
+               }
+       }
+
+       if ((len -= (WPA_IE_SUITE_COUNT_LEN + (WPA_SUITE_LEN * suite_count))) >= RSN_CAP_LEN) {
+               rsn_cap[0] = *(u8 *)&mgmt->list[suite_count];
+               rsn_cap[1] = *((u8 *)&mgmt->list[suite_count] + 1);
+
+               if (rsn_cap[0] & (RSN_CAP_16_REPLAY_CNTRS << RSN_CAP_PTK_REPLAY_CNTR_SHIFT)) {
+                       wme_bss_disable = 0;
+               } else {
+                       wme_bss_disable = 1;
+               }
+
+
+               /* set wme_bss_disable to sync RSN Capabilities */
+               err = wldev_iovar_setint_bsscfg(dev, "wme_bss_disable", wme_bss_disable, bssidx);
+               if (err < 0) {
+                       WL_ERR(("wme_bss_disable error %d\n", err));
+                       return BCME_ERROR;
+               }
+       } else {
+               WL_DBG(("There is no RSN Capabilities. remained len %d\n", len));
+       }
+
+       len -= RSN_CAP_LEN;
+       if (len >= WPA2_PMKID_COUNT_LEN) {
+               pmkid = (wpa_pmkid_list_t *)((u8 *)&mgmt->list[suite_count] + RSN_CAP_LEN);
+               cnt = ltoh16_ua(&pmkid->count);
+               if (cnt != 0) {
+                       WL_ERR(("AP has non-zero PMKID count. Wrong!\n"));
+                       return BCME_ERROR;
+               }
+               /* since PMKID cnt is known to be 0 for AP, */
+               /* so don't bother to send down this info to firmware */
+       }
+
+
+       /* set auth */
+       err = wldev_iovar_setint_bsscfg(dev, "auth", auth, bssidx);
+       if (err < 0) {
+               WL_ERR(("auth error %d\n", err));
+               return BCME_ERROR;
+       }
+
+       /* set wsec */
+       err = wldev_iovar_setint_bsscfg(dev, "wsec", wsec, bssidx);
+       if (err < 0) {
+               WL_ERR(("wsec error %d\n", err));
+               return BCME_ERROR;
+       }
+
+
+       /* set upper-layer auth */
+       err = wldev_iovar_setint_bsscfg(dev, "wpa_auth", wpa_auth, bssidx);
+       if (err < 0) {
+               WL_ERR(("wpa_auth error %d\n", err));
+               return BCME_ERROR;
+       }
+exit:
+       return 0;
+}
+
+static s32
+wl_validate_wpaie(struct net_device *dev, wpa_ie_fixed_t *wpaie, s32 bssidx)
+{
+       wpa_suite_mcast_t *mcast;
+       wpa_suite_ucast_t *ucast;
+       wpa_suite_auth_key_mgmt_t *mgmt;
+       u16 auth = 0; /* d11 open authentication */
+       u16 count;
+       s32 err = BCME_OK;
+       s32 len = 0;
+       u32 i;
+       u32 wsec;
+       u32 pval = 0;
+       u32 gval = 0;
+       u32 wpa_auth = 0;
+       u32 tmp = 0;
+
+       if (wpaie == NULL)
+               goto exit;
+       WL_DBG(("Enter \n"));
+       len = wpaie->length;    /* value length */
+       len -= WPA_IE_TAG_FIXED_LEN;
+       /* check for multicast cipher suite */
+       if (len < WPA_SUITE_LEN) {
+               WL_INFORM(("no multicast cipher suite\n"));
+               goto exit;
+       }
+
+       /* pick up multicast cipher */
+       mcast = (wpa_suite_mcast_t *)&wpaie[1];
+       len -= WPA_SUITE_LEN;
+       if (!bcmp(mcast->oui, WPA_OUI, WPA_OUI_LEN)) {
+               if (IS_WPA_CIPHER(mcast->type)) {
+                       tmp = 0;
+                       switch (mcast->type) {
+                               case WPA_CIPHER_NONE:
+                                       tmp = 0;
+                                       break;
+                               case WPA_CIPHER_WEP_40:
+                               case WPA_CIPHER_WEP_104:
+                                       tmp = WEP_ENABLED;
+                                       break;
+                               case WPA_CIPHER_TKIP:
+                                       tmp = TKIP_ENABLED;
+                                       break;
+                               case WPA_CIPHER_AES_CCM:
+                                       tmp = AES_ENABLED;
+                                       break;
+                               default:
+                                       WL_ERR(("No Security Info\n"));
+                       }
+                       gval |= tmp;
+               }
+       }
+       /* Check for unicast suite(s) */
+       if (len < WPA_IE_SUITE_COUNT_LEN) {
+               WL_INFORM(("no unicast suite\n"));
+               goto exit;
+       }
+       /* walk thru unicast cipher list and pick up what we recognize */
+       ucast = (wpa_suite_ucast_t *)&mcast[1];
+       count = ltoh16_ua(&ucast->count);
+       len -= WPA_IE_SUITE_COUNT_LEN;
+       for (i = 0; i < count && len >= WPA_SUITE_LEN;
+               i++, len -= WPA_SUITE_LEN) {
+               if (!bcmp(ucast->list[i].oui, WPA_OUI, WPA_OUI_LEN)) {
+                       if (IS_WPA_CIPHER(ucast->list[i].type)) {
+                               tmp = 0;
+                               switch (ucast->list[i].type) {
+                                       case WPA_CIPHER_NONE:
+                                               tmp = 0;
+                                               break;
+                                       case WPA_CIPHER_WEP_40:
+                                       case WPA_CIPHER_WEP_104:
+                                               tmp = WEP_ENABLED;
+                                               break;
+                                       case WPA_CIPHER_TKIP:
+                                               tmp = TKIP_ENABLED;
+                                               break;
+                                       case WPA_CIPHER_AES_CCM:
+                                               tmp = AES_ENABLED;
+                                               break;
+                                       default:
+                                               WL_ERR(("No Security Info\n"));
+                               }
+                               pval |= tmp;
+                       }
+               }
+       }
+       len -= (count - i) * WPA_SUITE_LEN;
+       /* Check for auth key management suite(s) */
+       if (len < WPA_IE_SUITE_COUNT_LEN) {
+               WL_INFORM((" no auth key mgmt suite\n"));
+               goto exit;
+       }
+       /* walk thru auth management suite list and pick up what we recognize */
+       mgmt = (wpa_suite_auth_key_mgmt_t *)&ucast->list[count];
+       count = ltoh16_ua(&mgmt->count);
+       len -= WPA_IE_SUITE_COUNT_LEN;
+       for (i = 0; i < count && len >= WPA_SUITE_LEN;
+               i++, len -= WPA_SUITE_LEN) {
+               if (!bcmp(mgmt->list[i].oui, WPA_OUI, WPA_OUI_LEN)) {
+                       if (IS_WPA_AKM(mgmt->list[i].type)) {
+                               tmp = 0;
+                               switch (mgmt->list[i].type) {
+                                       case RSN_AKM_NONE:
+                                               tmp = WPA_AUTH_NONE;
+                                               break;
+                                       case RSN_AKM_UNSPECIFIED:
+                                               tmp = WPA_AUTH_UNSPECIFIED;
+                                               break;
+                                       case RSN_AKM_PSK:
+                                               tmp = WPA_AUTH_PSK;
+                                               break;
+                                       default:
+                                               WL_ERR(("No Key Mgmt Info\n"));
+                               }
+                               wpa_auth |= tmp;
+                       }
+               }
+
+       }
+       /* FOR WPS , set SEC_OW_ENABLED */
+       wsec = (pval | gval | SES_OW_ENABLED);
+       /* set auth */
+       err = wldev_iovar_setint_bsscfg(dev, "auth", auth, bssidx);
+       if (err < 0) {
+               WL_ERR(("auth error %d\n", err));
+               return BCME_ERROR;
+       }
+       /* set wsec */
+       err = wldev_iovar_setint_bsscfg(dev, "wsec", wsec, bssidx);
+       if (err < 0) {
+               WL_ERR(("wsec error %d\n", err));
+               return BCME_ERROR;
+       }
+       /* set upper-layer auth */
+       err = wldev_iovar_setint_bsscfg(dev, "wpa_auth", wpa_auth, bssidx);
+       if (err < 0) {
+               WL_ERR(("wpa_auth error %d\n", err));
+               return BCME_ERROR;
+       }
+exit:
+       return 0;
+}
+
+
+static s32
+wl_cfg80211_bcn_validate_sec(
+       struct net_device *dev,
+       struct parsed_ies *ies,
+       u32 dev_role,
+       s32 bssidx,
+       bool privacy)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+       wl_cfgbss_t *bss = wl_get_cfgbss_by_wdev(cfg, dev->ieee80211_ptr);
+
+       if (!bss) {
+               WL_ERR(("cfgbss is NULL \n"));
+               return BCME_ERROR;
+       }
+
+       if (dev_role == NL80211_IFTYPE_P2P_GO && (ies->wpa2_ie)) {
+               /* For P2P GO, the sec type is WPA2-PSK */
+               WL_DBG(("P2P GO: validating wpa2_ie"));
+               if (wl_validate_wpa2ie(dev, ies->wpa2_ie, bssidx)  < 0)
+                       return BCME_ERROR;
+
+       } else if (dev_role == NL80211_IFTYPE_AP) {
+
+               WL_DBG(("SoftAP: validating security"));
+               /* If wpa2_ie or wpa_ie is present validate it */
+
+               if ((ies->wpa2_ie || ies->wpa_ie) &&
+                       ((wl_validate_wpa2ie(dev, ies->wpa2_ie, bssidx)  < 0 ||
+                       wl_validate_wpaie(dev, ies->wpa_ie, bssidx) < 0))) {
+                       bss->security_mode = false;
+                       return BCME_ERROR;
+               }
+
+               bss->security_mode = true;
+               if (bss->rsn_ie) {
+                       kfree(bss->rsn_ie);
+                       bss->rsn_ie = NULL;
+               }
+               if (bss->wpa_ie) {
+                       kfree(bss->wpa_ie);
+                       bss->wpa_ie = NULL;
+               }
+               if (bss->wps_ie) {
+                       kfree(bss->wps_ie);
+                       bss->wps_ie = NULL;
+               }
+               if (ies->wpa_ie != NULL) {
+                       /* WPAIE */
+                       bss->rsn_ie = NULL;
+                       bss->wpa_ie = kmemdup(ies->wpa_ie,
+                               ies->wpa_ie->length + WPA_RSN_IE_TAG_FIXED_LEN,
+                               GFP_KERNEL);
+               } else if (ies->wpa2_ie != NULL) {
+                       /* RSNIE */
+                       bss->wpa_ie = NULL;
+                       bss->rsn_ie = kmemdup(ies->wpa2_ie,
+                               ies->wpa2_ie->len + WPA_RSN_IE_TAG_FIXED_LEN,
+                               GFP_KERNEL);
+               }
+               if (!ies->wpa2_ie && !ies->wpa_ie) {
+                       wl_validate_opensecurity(dev, bssidx, privacy);
+                       bss->security_mode = false;
+               }
+
+               if (ies->wps_ie) {
+                       bss->wps_ie = kmemdup(ies->wps_ie, ies->wps_ie_len, GFP_KERNEL);
+               }
+       }
+
+       return 0;
+
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) || defined(WL_COMPAT_WIRELESS)
+static s32 wl_cfg80211_bcn_set_params(
+       struct cfg80211_ap_settings *info,
+       struct net_device *dev,
+       u32 dev_role, s32 bssidx)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+#ifdef SUPPORT_HIDDEN_AP
+       struct net_info *_netinfo = wl_get_netinfo_by_netdev(cfg, dev);
+#endif
+       s32 err = BCME_OK;
+
+       WL_DBG(("interval (%d) \ndtim_period (%d) \n",
+               info->beacon_interval, info->dtim_period));
+
+       if (info->beacon_interval) {
+               if ((err = wldev_ioctl(dev, WLC_SET_BCNPRD,
+                       &info->beacon_interval, sizeof(s32), true)) < 0) {
+                       WL_ERR(("Beacon Interval Set Error, %d\n", err));
+                       return err;
+               }
+       }
+
+       if (info->dtim_period) {
+               if ((err = wldev_ioctl(dev, WLC_SET_DTIMPRD,
+                       &info->dtim_period, sizeof(s32), true)) < 0) {
+                       WL_ERR(("DTIM Interval Set Error, %d\n", err));
+                       return err;
+               }
+       }
+
+       if ((info->ssid) && (info->ssid_len > 0) &&
+               (info->ssid_len <= DOT11_MAX_SSID_LEN)) {
+               WL_DBG(("SSID (%s) len:%zd \n", info->ssid, info->ssid_len));
+               if (dev_role == NL80211_IFTYPE_AP) {
+                       /* Store the hostapd SSID */
+                       memset(cfg->hostapd_ssid.SSID, 0x00, DOT11_MAX_SSID_LEN);
+                       memcpy(cfg->hostapd_ssid.SSID, info->ssid, info->ssid_len);
+                       cfg->hostapd_ssid.SSID_len = info->ssid_len;
+               } else {
+                               /* P2P GO */
+                       memset(cfg->p2p->ssid.SSID, 0x00, DOT11_MAX_SSID_LEN);
+                       memcpy(cfg->p2p->ssid.SSID, info->ssid, info->ssid_len);
+                       cfg->p2p->ssid.SSID_len = info->ssid_len;
+               }
+       }
+
+#ifdef SUPPORT_HIDDEN_AP
+       _netinfo->profile.hidden_ssid = info->hidden_ssid;
+#endif
+       if (info->hidden_ssid) {
+               if ((err = wldev_iovar_setint(dev, "closednet", 1)) < 0)
+                       WL_ERR(("failed to set hidden : %d\n", err));
+               WL_DBG(("hidden_ssid_enum_val: %d \n", info->hidden_ssid));
+       }
+       else {
+               if ((err = wldev_iovar_setint(dev, "closednet", 0)) < 0)
+                       WL_ERR(("failed to unset hidden : %d\n", err));
+               WL_DBG(("hidden_ssid_enum_val: %d \n", info->hidden_ssid));
+       }
+
+       return err;
+}
+#endif /* LINUX_VERSION >= VERSION(3,4,0) || WL_COMPAT_WIRELESS */
+
+static s32
+wl_cfg80211_parse_ies(u8 *ptr, u32 len, struct parsed_ies *ies)
+{
+       s32 err = BCME_OK;
+
+       memset(ies, 0, sizeof(struct parsed_ies));
+
+       /* find the WPSIE */
+       if ((ies->wps_ie = wl_cfgp2p_find_wpsie(ptr, len)) != NULL) {
+               WL_DBG(("WPSIE in beacon \n"));
+               ies->wps_ie_len = ies->wps_ie->length + WPA_RSN_IE_TAG_FIXED_LEN;
+       } else {
+               WL_ERR(("No WPSIE in beacon \n"));
+       }
+
+       /* find the RSN_IE */
+       if ((ies->wpa2_ie = bcm_parse_tlvs(ptr, len,
+               DOT11_MNG_RSN_ID)) != NULL) {
+               WL_DBG((" WPA2 IE found\n"));
+               ies->wpa2_ie_len = ies->wpa2_ie->len;
+       }
+
+       /* find the WPA_IE */
+       if ((ies->wpa_ie = wl_cfgp2p_find_wpaie(ptr, len)) != NULL) {
+               WL_DBG((" WPA found\n"));
+               ies->wpa_ie_len = ies->wpa_ie->length;
+       }
+
+       return err;
+
+}
+
+#define MAX_AP_LINK_WAIT_TIME   10000
+static s32
+wl_cfg80211_bcn_bringup_ap(
+       struct net_device *dev,
+       struct parsed_ies *ies,
+       u32 dev_role, s32 bssidx)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+       struct wl_join_params join_params;
+       struct wiphy *wiphy;
+       bool is_bssup = false;
+       s32 infra = 1;
+       s32 join_params_size = 0;
+       s32 ap = 1;
+       s32 pm;
+       s32 wsec;
+#ifdef SOFTAP_UAPSD_OFF
+       uint32 wme_apsd = 0;
+#endif /* SOFTAP_UAPSD_OFF */
+       s32 err = BCME_OK;
+       s32 is_rsdb_supported = BCME_ERROR;
+       u32 timeout;
+#if defined(DHD_DEBUG) && defined(BCMPCIE) && defined(DHD_FW_COREDUMP)
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+#endif /* DHD_DEBUG && BCMPCIE && DHD_FW_COREDUMP */
+
+       is_rsdb_supported = DHD_OPMODE_SUPPORTED(cfg->pub, DHD_FLAG_RSDB_MODE);
+       if (is_rsdb_supported < 0)
+               return (-ENODEV);
+
+       WL_DBG(("Enter dev_role:%d bssidx:%d\n", dev_role, bssidx));
+
+       /* Common code for SoftAP and P2P GO */
+       wiphy = bcmcfg_to_wiphy(cfg);
+       if (wl_check_dongle_idle(wiphy) != TRUE) {
+               WL_ERR(("FW is busy to add interface"));
+               return -EINVAL;
+       }
+       wldev_iovar_setint(dev, "mpc", 0);
+
+       wl_clr_drv_status(cfg, AP_CREATED, dev);
+
+       if (dev_role == NL80211_IFTYPE_P2P_GO) {
+               is_bssup = wl_cfgp2p_bss_isup(dev, bssidx);
+               if (!is_bssup && (ies->wpa2_ie != NULL)) {
+
+                       err = wldev_ioctl(dev, WLC_SET_INFRA, &infra, sizeof(s32), true);
+                       if (err < 0) {
+                               WL_ERR(("SET INFRA error %d\n", err));
+                               goto exit;
+                       }
+
+                       err = wldev_iovar_setbuf_bsscfg(dev, "ssid", &cfg->p2p->ssid,
+                               sizeof(cfg->p2p->ssid), cfg->ioctl_buf, WLC_IOCTL_MAXLEN,
+                               bssidx, &cfg->ioctl_buf_sync);
+                       if (err < 0) {
+                               WL_ERR(("GO SSID setting error %d\n", err));
+                               goto exit;
+                       }
+
+                       /* Do abort scan before creating GO */
+                       wl_cfg80211_scan_abort(cfg);
+
+                       if ((err = wl_cfgp2p_bss(cfg, dev, bssidx, 1)) < 0) {
+                               WL_ERR(("GO Bring up error %d\n", err));
+                               goto exit;
+                       }
+               } else
+                       WL_DBG(("Bss is already up\n"));
+       } else if ((dev_role == NL80211_IFTYPE_AP) &&
+               (wl_get_drv_status(cfg, AP_CREATING, dev))) {
+
+               /* Device role SoftAP */
+               WL_DBG(("Creating AP bssidx:%d dev_role:%d\n", bssidx, dev_role));
+
+               /* Clear the status bit after use */
+               wl_clr_drv_status(cfg, AP_CREATING, dev);
+
+               /* AP on primary Interface */
+               if (bssidx == 0) {
+                       if (is_rsdb_supported) {
+                               if ((err = wl_cfg80211_add_del_bss(cfg, dev, bssidx,
+                                       NL80211_IFTYPE_AP, 0, NULL)) < 0) {
+                                       WL_ERR(("wl add_del_bss returned error:%d\n", err));
+                                       goto exit;
+                               }
+                       } else if (is_rsdb_supported == 0) {
+                       /* AP mode switch not supported. Try setting up AP explicitly */
+                               err = wldev_ioctl(dev, WLC_DOWN, &ap, sizeof(s32), true);
+                               if (err < 0) {
+                                       WL_ERR(("WLC_DOWN error %d\n", err));
+                                       goto exit;
+                               }
+                               err = wldev_iovar_setint(dev, "apsta", 0);
+                               if (err < 0) {
+                                       WL_ERR(("wl apsta 0 error %d\n", err));
+                                       goto exit;
+                               }
+
+                               if ((err = wldev_ioctl(dev,
+                                       WLC_SET_AP, &ap, sizeof(s32), true)) < 0) {
+                                       WL_ERR(("setting AP mode failed %d \n", err));
+                                       goto exit;
+                               }
+
+                       }
+
+                       pm = 0;
+                       if ((err = wldev_ioctl(dev, WLC_SET_PM, &pm, sizeof(pm), true)) != 0) {
+                               WL_ERR(("wl PM 0 returned error:%d\n", err));
+                               goto exit;
+                       }
+
+                       err = wldev_ioctl(dev, WLC_SET_INFRA, &infra, sizeof(s32), true);
+                       if (err < 0) {
+                               WL_ERR(("SET INFRA error %d\n", err));
+                               goto exit;
+                       }
+               } else if (wl_get_netinfo_by_bssidx(cfg, bssidx) != NULL) {
+                       WL_DBG(("Bringup SoftAP on virtual Interface bssidx:%d \n", bssidx));
+
+                       if ((err = wl_cfg80211_add_del_bss(cfg, dev,
+                               bssidx, NL80211_IFTYPE_AP, 0, NULL)) < 0) {
+                               WL_ERR(("wl bss ap returned error:%d\n", err));
+                               goto exit;
+                       }
+
+               }
+
+#ifdef SOFTAP_UAPSD_OFF
+               err = wldev_iovar_setbuf_bsscfg(dev, "wme_apsd", &wme_apsd, sizeof(wme_apsd),
+                       cfg->ioctl_buf, WLC_IOCTL_SMLEN, bssidx, &cfg->ioctl_buf_sync);
+               if (err < 0) {
+                       WL_ERR(("failed to disable uapsd, error=%d\n", err));
+               }
+#endif /* SOFTAP_UAPSD_OFF */
+
+               err = wldev_ioctl(dev, WLC_UP, &ap, sizeof(s32), true);
+               if (unlikely(err)) {
+                       WL_ERR(("WLC_UP error (%d)\n", err));
+                       goto exit;
+               }
+
+
+               err = wldev_iovar_getint(dev, "wsec", (s32 *)&wsec);
+               if (unlikely(err)) {
+                       WL_ERR(("Could not get wsec %d\n", err));
+                       goto exit;
+               }
+               if ((wsec == WEP_ENABLED) && cfg->wep_key.len) {
+                       WL_DBG(("Applying buffered WEP KEY \n"));
+                       err = wldev_iovar_setbuf_bsscfg(dev, "wsec_key", &cfg->wep_key,
+                               sizeof(struct wl_wsec_key), cfg->ioctl_buf,
+                               WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+                       /* clear the key after use */
+                       memset(&cfg->wep_key, 0, sizeof(struct wl_wsec_key));
+                       if (unlikely(err)) {
+                               WL_ERR(("WLC_SET_KEY error (%d)\n", err));
+                               goto exit;
+                       }
+               }
+
+
+               memset(&join_params, 0, sizeof(join_params));
+               /* join parameters starts with ssid */
+               join_params_size = sizeof(join_params.ssid);
+               join_params.ssid.SSID_len = MIN(cfg->hostapd_ssid.SSID_len,
+                       (uint32)DOT11_MAX_SSID_LEN);
+               memcpy(join_params.ssid.SSID, cfg->hostapd_ssid.SSID,
+                       join_params.ssid.SSID_len);
+               join_params.ssid.SSID_len = htod32(join_params.ssid.SSID_len);
+
+               /* create softap */
+               if ((err = wldev_ioctl(dev, WLC_SET_SSID, &join_params,
+                       join_params_size, true)) != 0) {
+                       WL_ERR(("SoftAP/GO set ssid failed! \n"));
+                       goto exit;
+               } else {
+                       WL_DBG((" SoftAP SSID \"%s\" \n", join_params.ssid.SSID));
+               }
+
+               if (bssidx != 0) {
+                       /* AP on Virtual Interface */
+                       if ((err = wl_cfgp2p_bss(cfg, dev, bssidx, 1)) < 0) {
+                               WL_ERR(("GO Bring up error %d\n", err));
+                               goto exit;
+                       }
+               }
+
+       }
+       /* Wait for Linkup event to mark successful AP/GO bring up */
+       timeout = wait_event_interruptible_timeout(cfg->netif_change_event,
+               wl_get_drv_status(cfg, AP_CREATED, dev), msecs_to_jiffies(MAX_AP_LINK_WAIT_TIME));
+       if (timeout <= 0 || !wl_get_drv_status(cfg, AP_CREATED, dev)) {
+               WL_ERR(("Link up didn't come for AP interface. AP/GO creation failed! \n"));
+#if defined(DHD_DEBUG) && defined(BCMPCIE) && defined(DHD_FW_COREDUMP)
+               if (dhdp->memdump_enabled) {
+                       dhdp->memdump_type = DUMP_TYPE_AP_LINKUP_FAILURE;
+                       dhd_bus_mem_dump(dhdp);
+               }
+#endif /* DHD_DEBUG && BCMPCIE && DHD_FW_COREDUMP */
+               err = -ENODEV;
+               goto exit;
+       }
+
+exit:
+       if (cfg->wep_key.len) {
+               memset(&cfg->wep_key, 0, sizeof(struct wl_wsec_key));
+       }
+
+
+       return err;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) || defined(WL_COMPAT_WIRELESS)
+s32
+wl_cfg80211_parse_ap_ies(
+       struct net_device *dev,
+       struct cfg80211_beacon_data *info,
+       struct parsed_ies *ies)
+{
+       struct parsed_ies prb_ies;
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+       u8 *vndr = NULL;
+       u32 vndr_ie_len = 0;
+       s32 err = BCME_OK;
+
+       /* Parse Beacon IEs */
+       if (wl_cfg80211_parse_ies((u8 *)info->tail,
+               info->tail_len, ies) < 0) {
+               WL_ERR(("Beacon get IEs failed \n"));
+               err = -EINVAL;
+               goto fail;
+       }
+
+       vndr = (u8 *)info->proberesp_ies;
+       vndr_ie_len = info->proberesp_ies_len;
+
+       if (dhd->op_mode & DHD_FLAG_HOSTAP_MODE) {
+               /* SoftAP mode */
+               struct ieee80211_mgmt *mgmt;
+               mgmt = (struct ieee80211_mgmt *)info->probe_resp;
+               if (mgmt != NULL) {
+                       vndr = (u8 *)&mgmt->u.probe_resp.variable;
+                       vndr_ie_len = info->probe_resp_len -
+                               offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
+               }
+       }
+
+       /* Parse Probe Response IEs */
+       if (wl_cfg80211_parse_ies(vndr, vndr_ie_len, &prb_ies) < 0) {
+               WL_ERR(("PROBE RESP get IEs failed \n"));
+               err = -EINVAL;
+       }
+
+fail:
+
+       return err;
+}
+
+s32
+wl_cfg80211_set_ies(
+       struct net_device *dev,
+       struct cfg80211_beacon_data *info,
+       s32 bssidx)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+       u8 *vndr = NULL;
+       u32 vndr_ie_len = 0;
+       s32 err = BCME_OK;
+
+       /* Set Beacon IEs to FW */
+       if ((err = wl_cfg80211_set_mgmt_vndr_ies(cfg, ndev_to_cfgdev(dev), bssidx,
+               VNDR_IE_BEACON_FLAG, (const u8 *)info->tail,
+               info->tail_len)) < 0) {
+               WL_ERR(("Set Beacon IE Failed \n"));
+       } else {
+               WL_DBG(("Applied Vndr IEs for Beacon \n"));
+       }
+
+       vndr = (u8 *)info->proberesp_ies;
+       vndr_ie_len = info->proberesp_ies_len;
+
+       if (dhd->op_mode & DHD_FLAG_HOSTAP_MODE) {
+               /* SoftAP mode */
+               struct ieee80211_mgmt *mgmt;
+               mgmt = (struct ieee80211_mgmt *)info->probe_resp;
+               if (mgmt != NULL) {
+                       vndr = (u8 *)&mgmt->u.probe_resp.variable;
+                       vndr_ie_len = info->probe_resp_len -
+                               offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
+               }
+       }
+
+       /* Set Probe Response IEs to FW */
+       if ((err = wl_cfg80211_set_mgmt_vndr_ies(cfg, ndev_to_cfgdev(dev), bssidx,
+               VNDR_IE_PRBRSP_FLAG, vndr, vndr_ie_len)) < 0) {
+               WL_ERR(("Set Probe Resp IE Failed \n"));
+       } else {
+               WL_DBG(("Applied Vndr IEs for Probe Resp \n"));
+       }
+
+       return err;
+}
+#endif /* LINUX_VERSION >= VERSION(3,4,0) || WL_COMPAT_WIRELESS */
+
+static s32 wl_cfg80211_hostapd_sec(
+       struct net_device *dev,
+       struct parsed_ies *ies,
+       s32 bssidx)
+{
+       bool update_bss = 0;
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+       wl_cfgbss_t *bss = wl_get_cfgbss_by_wdev(cfg, dev->ieee80211_ptr);
+
+       if (!bss) {
+               WL_ERR(("cfgbss is NULL \n"));
+               return -EINVAL;
+       }
+
+       if (ies->wps_ie) {
+               if (bss->wps_ie &&
+                       memcmp(bss->wps_ie, ies->wps_ie, ies->wps_ie_len)) {
+                       WL_DBG((" WPS IE is changed\n"));
+                       kfree(bss->wps_ie);
+                       bss->wps_ie = kmemdup(ies->wps_ie, ies->wps_ie_len, GFP_KERNEL);
+               } else if (bss->wps_ie == NULL) {
+                       WL_DBG((" WPS IE is added\n"));
+                       bss->wps_ie = kmemdup(ies->wps_ie, ies->wps_ie_len, GFP_KERNEL);
+               }
+
+               if ((ies->wpa_ie != NULL || ies->wpa2_ie != NULL)) {
+                       if (!bss->security_mode) {
+                               /* change from open mode to security mode */
+                               update_bss = true;
+                               if (ies->wpa_ie != NULL) {
+                                       bss->wpa_ie = kmemdup(ies->wpa_ie,
+                                       ies->wpa_ie->length + WPA_RSN_IE_TAG_FIXED_LEN,
+                                       GFP_KERNEL);
+                               } else {
+                                       bss->rsn_ie = kmemdup(ies->wpa2_ie,
+                                       ies->wpa2_ie->len + WPA_RSN_IE_TAG_FIXED_LEN,
+                                       GFP_KERNEL);
+                               }
+                       } else if (bss->wpa_ie) {
+                               /* change from WPA2 mode to WPA mode */
+                               if (ies->wpa_ie != NULL) {
+                                       update_bss = true;
+                                       kfree(bss->rsn_ie);
+                                       bss->rsn_ie = NULL;
+                                       bss->wpa_ie = kmemdup(ies->wpa_ie,
+                                       ies->wpa_ie->length + WPA_RSN_IE_TAG_FIXED_LEN,
+                                       GFP_KERNEL);
+                               } else if (memcmp(bss->rsn_ie,
+                                       ies->wpa2_ie, ies->wpa2_ie->len
+                                       + WPA_RSN_IE_TAG_FIXED_LEN)) {
+                                       update_bss = true;
+                                       kfree(bss->rsn_ie);
+                                       bss->rsn_ie = kmemdup(ies->wpa2_ie,
+                                       ies->wpa2_ie->len + WPA_RSN_IE_TAG_FIXED_LEN,
+                                       GFP_KERNEL);
+                                       bss->wpa_ie = NULL;
+                               }
+                       }
+                       if (update_bss) {
+                               bss->security_mode = true;
+                               wl_cfgp2p_bss(cfg, dev, bssidx, 0);
+                               if (wl_validate_wpa2ie(dev, ies->wpa2_ie, bssidx)  < 0 ||
+                                       wl_validate_wpaie(dev, ies->wpa_ie, bssidx) < 0) {
+                                       return BCME_ERROR;
+                               }
+                               wl_cfgp2p_bss(cfg, dev, bssidx, 1);
+                       }
+               }
+       } else {
+               WL_ERR(("No WPSIE in beacon \n"));
+       }
+       return 0;
+}
+
+#if defined(WL_SUPPORT_BACKPORTED_KPATCHES) || (LINUX_VERSION_CODE >= KERNEL_VERSION(3, \
+       2, 0))
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0))
+static s32
+wl_cfg80211_del_station(
+               struct wiphy *wiphy, struct net_device *ndev,
+               struct station_del_parameters *params)
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 16, 0))
+static s32
+wl_cfg80211_del_station(
+       struct wiphy *wiphy,
+       struct net_device *ndev,
+       const u8* mac_addr)
+#else
+static s32
+wl_cfg80211_del_station(
+       struct wiphy *wiphy,
+       struct net_device *ndev,
+       u8* mac_addr)
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)) */
+{
+       struct net_device *dev;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       scb_val_t scb_val;
+       s8 eabuf[ETHER_ADDR_STR_LEN];
+       int err;
+       char mac_buf[MAX_NUM_OF_ASSOCIATED_DEV *
+               sizeof(struct ether_addr) + sizeof(uint)] = {0};
+       struct maclist *assoc_maclist = (struct maclist *)mac_buf;
+       int num_associated = 0;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0))
+       const u8 *mac_addr = params->mac;
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)) */
+
+       WL_DBG(("Entry\n"));
+       if (mac_addr == NULL) {
+               WL_DBG(("mac_addr is NULL ignore it\n"));
+               return 0;
+       }
+
+       dev = ndev_to_wlc_ndev(ndev, cfg);
+
+       if (p2p_is_on(cfg)) {
+               /* Suspend P2P discovery search-listen to prevent it from changing the
+                * channel.
+                */
+               if ((wl_cfgp2p_discover_enable_search(cfg, false)) < 0) {
+                       WL_ERR(("Can not disable discovery mode\n"));
+                       return -EFAULT;
+               }
+       }
+
+       assoc_maclist->count = MAX_NUM_OF_ASSOCIATED_DEV;
+       err = wldev_ioctl(ndev, WLC_GET_ASSOCLIST,
+               assoc_maclist, sizeof(mac_buf), false);
+       if (err < 0)
+               WL_ERR(("WLC_GET_ASSOCLIST error %d\n", err));
+       else
+               num_associated = assoc_maclist->count;
+
+       memcpy(scb_val.ea.octet, mac_addr, ETHER_ADDR_LEN);
+       scb_val.val = DOT11_RC_DEAUTH_LEAVING;
+       err = wldev_ioctl(dev, WLC_SCB_DEAUTHENTICATE_FOR_REASON, &scb_val,
+               sizeof(scb_val_t), true);
+       if (err < 0)
+               WL_ERR(("WLC_SCB_DEAUTHENTICATE_FOR_REASON err %d\n", err));
+       WL_ERR(("Disconnect STA : %s scb_val.val %d\n",
+               bcm_ether_ntoa((const struct ether_addr *)mac_addr, eabuf),
+               scb_val.val));
+
+       if (num_associated > 0 && ETHER_ISBCAST(mac_addr))
+               wl_delay(400);
+
+       return 0;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 16, 0))
+static s32
+wl_cfg80211_change_station(
+       struct wiphy *wiphy,
+       struct net_device *dev,
+       const u8 *mac,
+       struct station_parameters *params)
+#else
+static s32
+wl_cfg80211_change_station(
+       struct wiphy *wiphy,
+       struct net_device *dev,
+       u8 *mac,
+       struct station_parameters *params)
+#endif
+{
+       int err;
+#ifdef DHD_LOSSLESS_ROAMING
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+#endif
+
+       WL_DBG(("SCB_AUTHORIZE mac_addr:"MACDBG" sta_flags_mask:0x%x "
+                               "sta_flags_set:0x%x iface:%s \n", MAC2STRDBG(mac),
+                               params->sta_flags_mask, params->sta_flags_set, dev->name));
+
+       /* Processing only authorize/de-authorize flag for now */
+       if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED))) {
+               WL_ERR(("WLC_SCB_AUTHORIZE sta_flags_mask not set \n"));
+               return -ENOTSUPP;
+       }
+
+       if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED))) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 16, 0))
+               err = wldev_ioctl(dev, WLC_SCB_DEAUTHORIZE, (u8 *)mac, ETH_ALEN, true);
+#else
+               err = wldev_ioctl(dev, WLC_SCB_DEAUTHORIZE, mac, ETH_ALEN, true);
+#endif
+               if (err)
+                       WL_ERR(("WLC_SCB_DEAUTHORIZE error (%d)\n", err));
+               return err;
+       }
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 16, 0))
+       err = wldev_ioctl(dev, WLC_SCB_AUTHORIZE, (u8 *)mac, ETH_ALEN, true);
+#else
+       err = wldev_ioctl(dev, WLC_SCB_AUTHORIZE, mac, ETH_ALEN, true);
+#endif
+       if (err)
+               WL_ERR(("WLC_SCB_AUTHORIZE error (%d)\n", err));
+#ifdef DHD_LOSSLESS_ROAMING
+       wl_del_roam_timeout(cfg);
+#endif
+       return err;
+}
+#endif /* WL_SUPPORT_BACKPORTED_KPATCHES || KERNEL_VER >= KERNEL_VERSION(3, 2, 0)) */
+
+static s32
+wl_cfg80211_set_scb_timings(
+       struct bcm_cfg80211 *cfg,
+       struct net_device *dev)
+{
+       int err;
+       u32 ps_pretend;
+       wl_scb_probe_t scb_probe;
+
+       bzero(&scb_probe, sizeof(wl_scb_probe_t));
+       scb_probe.scb_timeout = WL_SCB_TIMEOUT;
+       scb_probe.scb_activity_time = WL_SCB_ACTIVITY_TIME;
+       scb_probe.scb_max_probe = WL_SCB_MAX_PROBE;
+       err = wldev_iovar_setbuf(dev, "scb_probe", (void *)&scb_probe,
+               sizeof(wl_scb_probe_t), cfg->ioctl_buf, WLC_IOCTL_SMLEN,
+               &cfg->ioctl_buf_sync);
+       if (unlikely(err)) {
+               WL_ERR(("set 'scb_probe' failed, error = %d\n", err));
+               return err;
+       }
+
+       ps_pretend = MAX(WL_SCB_MAX_PROBE / 2, WL_MIN_PSPRETEND_THRESHOLD);
+       err = wldev_iovar_setint(dev, "pspretend_threshold", ps_pretend);
+       if (unlikely(err)) {
+               if (err == BCME_UNSUPPORTED) {
+                       /* Ignore error if fw doesn't support the iovar */
+                       WL_DBG(("wl pspretend_threshold %d set error %d\n",
+                               ps_pretend, err));
+               } else {
+                       WL_ERR(("wl pspretend_threshold %d set error %d\n",
+                               ps_pretend, err));
+                       return err;
+               }
+       }
+
+       return 0;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) || defined(WL_COMPAT_WIRELESS)
+static s32
+wl_cfg80211_start_ap(
+       struct wiphy *wiphy,
+       struct net_device *dev,
+       struct cfg80211_ap_settings *info)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       s32 err = BCME_OK;
+       struct parsed_ies ies;
+       s32 bssidx = 0;
+       u32 dev_role = 0;
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+#ifdef AP_STA_RSDB_FEASIBILITY_CHK
+       u32 ap_chan = 0;
+       struct net_info *iter, *next;
+#endif /* AP_STA_RSDB_FEASIBILITY_CHK */
+#ifdef SUPPORT_HIDDEN_AP
+       struct net_info *_netinfo = wl_get_netinfo_by_netdev(cfg, dev);
+#endif
+
+#ifdef WL11U
+       bcm_tlv_t *interworking_ie;
+       u32 iw_ie_len = 0;
+       u8 iw_ie[IW_IES_MAX_BUF_LEN];
+#endif
+       WL_DBG(("Enter \n"));
+
+#if defined(SUPPORT_RANDOM_MAC_SCAN)
+       wl_cfg80211_set_random_mac(dev, FALSE);
+#endif /* SUPPORT_RANDOM_MAC_SCAN */
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+#if defined(WL_ENABLE_P2P_IF)
+       if (dev == cfg->p2p_net) {
+               /* Group Add request on p2p0 */
+               WL_DBG(("Start AP req on P2P iface: GO\n"));
+               dev = bcmcfg_to_prmry_ndev(cfg);
+               dev_role = NL80211_IFTYPE_P2P_GO;
+       } else
+#endif /* WL_ENABLE_P2P_IF */
+       if (wl_get_netinfo_by_netdev(cfg, dev) != NULL) {
+               WL_DBG(("Start AP req on iface: %s", dev->name));
+               dev_role = NL80211_IFTYPE_AP;
+       }
+
+       if (p2p_is_on(cfg) && (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO)) {
+               dev_role = NL80211_IFTYPE_P2P_GO;
+       } else if (dev_role == NL80211_IFTYPE_AP) {
+               dhd->op_mode |= DHD_FLAG_HOSTAP_MODE;
+               /*
+                * Enabling Softap is causing issues with STA NDO operations
+                * as NDO is not interface specific. So disable NDO while
+                * Softap is enabled
+                */
+               err = dhd_ndo_enable(dhd, FALSE);
+               WL_DBG(("%s: Disabling NDO on Hostapd mode %d\n", __FUNCTION__, err));
+               if (err) {
+                       /* Non fatal error. */
+                       WL_ERR(("%s: Disabling NDO Failed %d\n", __FUNCTION__, err));
+               } else {
+                       cfg->revert_ndo_disable = true;
+               }
+
+#ifdef PKT_FILTER_SUPPORT
+               /* Disable packet filter */
+               if (dhd->early_suspended) {
+                       WL_ERR(("Disable pkt_filter\n"));
+                       dhd_enable_packet_filter(0, dhd);
+               }
+#endif /* PKT_FILTER_SUPPORT */
+#ifdef ARP_OFFLOAD_SUPPORT
+               /* IF SoftAP is enabled, disable arpoe */
+               if (dhd->op_mode & DHD_FLAG_STA_MODE) {
+                       dhd_arp_offload_set(dhd, 0);
+                       dhd_arp_offload_enable(dhd, FALSE);
+               }
+#endif /* ARP_OFFLOAD_SUPPORT */
+               if ((dhd->op_mode & DHD_FLAG_STA_MODE) &&
+                       wl_cfg80211_is_roam_offload(NETDEV_GET_CFG80211_PRIV(dev))) {
+                       WL_ERR(("Cleare roam_offload_bssid_list at STA-SoftAP MODE.\n"));
+                       wl_android_set_roam_offload_bssid_list(dev, "0");
+               }
+       } else {
+               /* only AP or GO role need to be handled here. */
+               err = -EINVAL;
+               goto fail;
+       }
+
+       if (!check_dev_role_integrity(cfg, dev_role)) {
+               err = -EINVAL;
+               goto fail;
+       }
+
+#if ((LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0)) && !defined(WL_COMPAT_WIRELESS))
+       if ((err = wl_cfg80211_set_channel(wiphy, dev,
+               dev->ieee80211_ptr->preset_chandef.chan,
+               NL80211_CHAN_HT20) < 0)) {
+               WL_ERR(("Set channel failed \n"));
+               goto fail;
+       }
+#endif /* ((LINUX_VERSION >= VERSION(3, 6, 0) && !WL_COMPAT_WIRELESS) */
+
+       if ((err = wl_cfg80211_bcn_set_params(info, dev,
+               dev_role, bssidx)) < 0) {
+               WL_ERR(("Beacon params set failed \n"));
+               goto fail;
+       }
+
+       /* Parse IEs */
+       if ((err = wl_cfg80211_parse_ap_ies(dev, &info->beacon, &ies)) < 0) {
+               WL_ERR(("Set IEs failed \n"));
+               goto fail;
+       }
+
+
+#ifdef BCMWAPI_WPI
+       if (info->crypto.ciphers_pairwise[0] == WLAN_DHD_CIPHER_SUITE_SMS4) {
+               wl_validate_wapisecurity(dev, bssidx);
+       }
+       else
+#endif
+       {
+               WL_ERR(("%s info->crypto.ciphers_pairwise[0] is not "
+                                       "WLAN_CIPHER_SUITE_SMS4 \n", __FUNCTION__));
+
+               if ((err = wl_cfg80211_bcn_validate_sec(dev, &ies,
+                       dev_role, bssidx, info->privacy)) < 0)
+               {
+                       WL_ERR(("Beacon set security failed \n"));
+                       goto fail;
+               }
+       }
+
+       if ((err = wl_cfg80211_bcn_bringup_ap(dev, &ies,
+               dev_role, bssidx)) < 0) {
+               WL_ERR(("Beacon bring up AP/GO failed \n"));
+               goto fail;
+       }
+
+       if (bssidx != 0) {
+#ifdef SUPPORT_HIDDEN_AP
+               _netinfo->profile.hidden_ssid = info->hidden_ssid;
+#endif /* SUPPORT_HIDDEN_AP */
+               if ((err = wldev_iovar_setint_bsscfg(dev, "closednet",
+                       (info->hidden_ssid ? 1 : 0), bssidx)) < 0) {
+                       WL_ERR(("failed to set hidden ssid: %d\n", err));
+               }
+       }
+
+       /* Set GC/STA SCB expiry timings. */
+       if ((err = wl_cfg80211_set_scb_timings(cfg, dev))) {
+               WL_ERR(("scb setting failed \n"));
+               goto fail;
+       }
+
+       WL_DBG(("** AP/GO Created **\n"));
+
+#ifdef WL_CFG80211_ACL
+       /* Enfoce Admission Control. */
+       if ((err = wl_cfg80211_set_mac_acl(wiphy, dev, info->acl)) < 0) {
+               WL_ERR(("Set ACL failed\n"));
+       }
+#endif /* WL_CFG80211_ACL */
+
+#ifdef WL11U
+       wl_get_iwdata_by_netdev(cfg, dev, iw_ie, &iw_ie_len);
+       /* Add interworking IE from beacon data */
+       if ((interworking_ie = wl_cfg80211_find_interworking_ie(
+               (u8 *)info->beacon.beacon_ies, info->beacon.beacon_ies_len)) != NULL) {
+                       err = wl_cfg80211_add_iw_ie(cfg, dev, bssidx,
+                                       VNDR_IE_CUSTOM_FLAG, interworking_ie->id,
+                                       interworking_ie->data, interworking_ie->len);
+                       if (unlikely(err)) {
+                               WL_ERR(("Failed to add interworking IE"));
+                       }
+       } else if (iw_ie_len != 0) {
+               /* we have to clear IW IE and disable gratuitous APR */
+               wl_cfg80211_add_iw_ie(cfg, dev, bssidx,
+                               VNDR_IE_CUSTOM_FLAG,
+                               DOT11_MNG_INTERWORKING_ID,
+                               0, 0);
+
+               (void)wldev_iovar_setint_bsscfg(dev, "grat_arp", 0,
+                               bssidx);
+               wl_clear_iwdata_by_netdev(cfg, dev);
+               /* we don't care about error */
+       }
+#endif /* WL11U */
+
+       /* Set IEs to FW */
+       if ((err = wl_cfg80211_set_ies(dev, &info->beacon, bssidx)) < 0)
+               WL_ERR(("Set IEs failed \n"));
+
+       /* Enable Probe Req filter, WPS-AP certification 4.2.13 */
+       if ((dev_role == NL80211_IFTYPE_AP) && (ies.wps_ie != NULL)) {
+               bool pbc = 0;
+               wl_validate_wps_ie((char *) ies.wps_ie, ies.wps_ie_len, &pbc);
+               if (pbc) {
+                       WL_DBG(("set WLC_E_PROBREQ_MSG\n"));
+                       wl_add_remove_eventmsg(dev, WLC_E_PROBREQ_MSG, true);
+               }
+       }
+
+fail:
+       if (err) {
+               WL_ERR(("ADD/SET beacon failed\n"));
+               wldev_iovar_setint(dev, "mpc", 1);
+               if (dev_role == NL80211_IFTYPE_AP) {
+                       dhd->op_mode &= ~DHD_FLAG_HOSTAP_MODE;
+
+#ifdef PKT_FILTER_SUPPORT
+                       /* Enable packet filter */
+                       if (dhd->early_suspended) {
+                               WL_ERR(("Enable pkt_filter\n"));
+                               dhd_enable_packet_filter(1, dhd);
+                       }
+#endif /* PKT_FILTER_SUPPORT */
+#ifdef ARP_OFFLOAD_SUPPORT
+                       /* IF SoftAP is disabled, enable arpoe back for STA mode. */
+                       if (dhd->op_mode & DHD_FLAG_STA_MODE) {
+                               dhd_arp_offload_set(dhd, dhd_arp_mode);
+                               dhd_arp_offload_enable(dhd, TRUE);
+                       }
+#endif /* ARP_OFFLOAD_SUPPORT */
+               }
+       }
+#ifdef AP_STA_RSDB_FEASIBILITY_CHK
+       else {
+               WL_DBG(("Store AP channel now\n"));
+               ap_chan = ieee80211_frequency_to_channel(
+                               dev->ieee80211_ptr->preset_chandef.chan->center_freq);
+               for_each_ndev(cfg, iter, next) {
+                       if (iter->ndev == dev) {
+                               WL_DBG(("Set channel (%d)\n", ap_chan));
+                               wl_update_prof(cfg, iter->ndev, NULL,
+                                       (void *)&ap_chan, WL_PROF_CHAN);
+                       }
+               }
+       }
+#endif /* AP_STA_RSDB_FEASIBILITY_CHK */
+
+       return err;
+}
+
+static s32
+wl_cfg80211_stop_ap(
+       struct wiphy *wiphy,
+       struct net_device *dev)
+{
+       int err = 0;
+       u32 dev_role = 0;
+       int ap = 0;
+       s32 bssidx = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       s32 is_rsdb_supported = BCME_ERROR;
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+
+       WL_DBG(("Enter \n"));
+
+       is_rsdb_supported = DHD_OPMODE_SUPPORTED(cfg->pub, DHD_FLAG_RSDB_MODE);
+       if (is_rsdb_supported < 0)
+               return (-ENODEV);
+
+       wl_clr_drv_status(cfg, AP_CREATING, dev);
+       wl_clr_drv_status(cfg, AP_CREATED, dev);
+       cfg->ap_oper_channel = 0;
+
+       if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP) {
+               dev_role = NL80211_IFTYPE_AP;
+               WL_DBG(("stopping AP operation\n"));
+       } else if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) {
+               dev_role = NL80211_IFTYPE_P2P_GO;
+               WL_DBG(("stopping P2P GO operation\n"));
+#ifdef DHD_BANDSTEER
+               if (dev->ieee80211_ptr->iftype  == NL80211_IFTYPE_P2P_GO) {
+                       /* Disable bandsteer  */
+                       dhd_bandsteer_module_deinit(bcmcfg_to_prmry_ndev(cfg));
+               }
+#endif /* DHD_BANDSTEER */
+       } else {
+               WL_ERR(("no AP/P2P GO interface is operational.\n"));
+               return -EINVAL;
+       }
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+
+       if (!check_dev_role_integrity(cfg, dev_role)) {
+               WL_ERR(("role integrity check failed \n"));
+               err = -EINVAL;
+               goto exit;
+       }
+
+       if ((err = wl_cfgp2p_bss(cfg, dev, bssidx, 0)) < 0) {
+               WL_ERR(("bss down error %d\n", err));
+       }
+
+       if (dev_role == NL80211_IFTYPE_AP) {
+               if (cfg->revert_ndo_disable == true) {
+                       err = dhd_ndo_enable(dhd, TRUE);
+                       WL_DBG(("%s: Enabling back NDO on Softap turn off %d\n",
+                               __FUNCTION__, err));
+                       if (err) {
+                               WL_ERR(("%s: Enabling NDO Failed %d\n", __FUNCTION__, err));
+                       }
+                       cfg->revert_ndo_disable = false;
+               }
+
+#ifdef PKT_FILTER_SUPPORT
+               /* Enable packet filter */
+               if (dhd->early_suspended) {
+                       WL_ERR(("Enable pkt_filter\n"));
+                       dhd_enable_packet_filter(1, dhd);
+               }
+#endif /* PKT_FILTER_SUPPORT */
+#ifdef ARP_OFFLOAD_SUPPORT
+               /* IF SoftAP is disabled, enable arpoe back for STA mode. */
+               if (dhd->op_mode & DHD_FLAG_STA_MODE) {
+                       dhd_arp_offload_set(dhd, dhd_arp_mode);
+                       dhd_arp_offload_enable(dhd, TRUE);
+               }
+#endif /* ARP_OFFLOAD_SUPPORT */
+               /*
+                * Bring down the AP interface by changing role to STA.
+                * Don't do a down or "WLC_SET_AP 0" since the shared
+                * interface may be still running
+                */
+               if ((err = wl_cfg80211_add_del_bss(cfg, dev,
+                       bssidx, NL80211_IFTYPE_STATION, 0, NULL)) < 0) {
+                       if ((err = wldev_ioctl(dev, WLC_SET_AP, &ap, sizeof(s32),
+                               true)) < 0) {
+                               WL_ERR(("setting AP mode failed %d \n", err));
+                               err = -ENOTSUPP;
+                               goto exit;
+                       }
+               }
+
+               /* Turn on the MPC */
+               wldev_iovar_setint(dev, "mpc", 1);
+
+                wl_cfg80211_clear_per_bss_ies(cfg, bssidx);
+       } else {
+               WL_DBG(("Stopping P2P GO \n"));
+               DHD_OS_WAKE_LOCK_CTRL_TIMEOUT_ENABLE((dhd_pub_t *)(cfg->pub),
+                       DHD_EVENT_TIMEOUT_MS*3);
+               DHD_OS_WAKE_LOCK_TIMEOUT((dhd_pub_t *)(cfg->pub));
+       }
+
+exit:
+
+       if (dev_role == NL80211_IFTYPE_AP) {
+               /* clear the AP mode */
+               dhd->op_mode &= ~DHD_FLAG_HOSTAP_MODE;
+       }
+       return err;
+}
+
+static s32
+wl_cfg80211_change_beacon(
+       struct wiphy *wiphy,
+       struct net_device *dev,
+       struct cfg80211_beacon_data *info)
+{
+       s32 err = BCME_OK;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct parsed_ies ies;
+       u32 dev_role = 0;
+       s32 bssidx = 0;
+       bool pbc = 0;
+#ifdef WL11U
+       bcm_tlv_t *interworking_ie;
+       u32 iw_ie_len = 0;
+       u8 iw_ie[IW_IES_MAX_BUF_LEN];
+#endif
+
+       WL_DBG(("Enter \n"));
+
+       if (dev == bcmcfg_to_prmry_ndev(cfg)) {
+               dev_role = NL80211_IFTYPE_AP;
+       }
+#if defined(WL_ENABLE_P2P_IF)
+       else if (dev == cfg->p2p_net) {
+               /* Group Add request on p2p0 */
+               dev = bcmcfg_to_prmry_ndev(cfg);
+               dev_role = NL80211_IFTYPE_P2P_GO;
+       }
+#endif /* WL_ENABLE_P2P_IF */
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+
+       if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) {
+               dev_role = NL80211_IFTYPE_P2P_GO;
+       }
+
+       if (!check_dev_role_integrity(cfg, dev_role)) {
+               err = -EINVAL;
+               goto fail;
+       }
+
+       if ((dev_role == NL80211_IFTYPE_P2P_GO) && (cfg->p2p_wdev == NULL)) {
+               WL_ERR(("P2P already down status!\n"));
+               err = BCME_ERROR;
+               goto fail;
+       }
+
+       /* Parse IEs */
+       if ((err = wl_cfg80211_parse_ap_ies(dev, info, &ies)) < 0) {
+               WL_ERR(("Parse IEs failed \n"));
+               goto fail;
+       }
+#ifdef WL11U
+       wl_get_iwdata_by_netdev(cfg, dev, iw_ie, &iw_ie_len);
+       /* Add interworking IE from beacon data */
+       if ((interworking_ie = wl_cfg80211_find_interworking_ie(
+               (u8 *)info->beacon_ies, info->beacon_ies_len)) != NULL) {
+                       err = wl_cfg80211_add_iw_ie(cfg, dev, bssidx,
+                                       VNDR_IE_CUSTOM_FLAG, interworking_ie->id,
+                                       interworking_ie->data, interworking_ie->len);
+                       if (unlikely(err)) {
+                               WL_ERR(("Failed to add interworking IE"));
+                       }
+       } else if (iw_ie_len != 0) {
+               /* we have to clear IW IE and disable gratuitous APR */
+               wl_cfg80211_add_iw_ie(cfg, dev, bssidx,
+                               VNDR_IE_CUSTOM_FLAG,
+                               DOT11_MNG_INTERWORKING_ID,
+                               0, 0);
+
+               /* we don't bother whether grat_arp gets disabled or not */
+               (void)wldev_iovar_setint_bsscfg(dev, "grat_arp", 0,
+                               bssidx);
+               wl_clear_iwdata_by_netdev(cfg, dev);
+       } else {
+               WL_DBG(("no update in iw ie\n"));
+       }
+#endif /* WL11U */
+
+
+       /* Set IEs to FW */
+       if ((err = wl_cfg80211_set_ies(dev, info, bssidx)) < 0) {
+               WL_ERR(("Set IEs failed \n"));
+               goto fail;
+       }
+
+       if (dev_role == NL80211_IFTYPE_AP) {
+               if (wl_cfg80211_hostapd_sec(dev, &ies, bssidx) < 0) {
+                       WL_ERR(("Hostapd update sec failed \n"));
+                       err = -EINVAL;
+                       goto fail;
+               }
+               /* Enable Probe Req filter, WPS-AP certification 4.2.13 */
+               if ((dev_role == NL80211_IFTYPE_AP) && (ies.wps_ie != NULL)) {
+                       wl_validate_wps_ie((char *) ies.wps_ie, ies.wps_ie_len, &pbc);
+                       WL_DBG((" WPS AP, wps_ie is exists pbc=%d\n", pbc));
+                       if (pbc)
+                               wl_add_remove_eventmsg(dev, WLC_E_PROBREQ_MSG, true);
+                       else
+                               wl_add_remove_eventmsg(dev, WLC_E_PROBREQ_MSG, false);
+               }
+       }
+
+fail:
+       return err;
+}
+#else
+static s32
+wl_cfg80211_add_set_beacon(struct wiphy *wiphy, struct net_device *dev,
+       struct beacon_parameters *info)
+{
+       s32 err = BCME_OK;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       s32 ie_offset = 0;
+       s32 bssidx = 0;
+       u32 dev_role = NL80211_IFTYPE_AP;
+       struct parsed_ies ies;
+       bcm_tlv_t *ssid_ie;
+       bool pbc = 0;
+       bool privacy;
+       bool is_bss_up = 0;
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+
+       WL_DBG(("interval (%d) dtim_period (%d) head_len (%d) tail_len (%d)\n",
+               info->interval, info->dtim_period, info->head_len, info->tail_len));
+
+       if (dev == bcmcfg_to_prmry_ndev(cfg)) {
+               dev_role = NL80211_IFTYPE_AP;
+       }
+#if defined(WL_ENABLE_P2P_IF)
+       else if (dev == cfg->p2p_net) {
+               /* Group Add request on p2p0 */
+               dev = bcmcfg_to_prmry_ndev(cfg);
+               dev_role = NL80211_IFTYPE_P2P_GO;
+       }
+#endif /* WL_ENABLE_P2P_IF */
+
+       if ((bssidx = wl_get_bssidx_by_wdev(cfg, dev->ieee80211_ptr)) < 0) {
+               WL_ERR(("Find p2p index from wdev(%p) failed\n", dev->ieee80211_ptr));
+               return BCME_ERROR;
+       }
+
+       if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) {
+               dev_role = NL80211_IFTYPE_P2P_GO;
+       } else if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP) {
+               dhd->op_mode |= DHD_FLAG_HOSTAP_MODE;
+       }
+
+       if (!check_dev_role_integrity(cfg, dev_role)) {
+               err = -ENODEV;
+               goto fail;
+       }
+
+       if ((dev_role == NL80211_IFTYPE_P2P_GO) && (cfg->p2p_wdev == NULL)) {
+               WL_ERR(("P2P already down status!\n"));
+               err = BCME_ERROR;
+               goto fail;
+       }
+
+       ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
+       /* find the SSID */
+       if ((ssid_ie = bcm_parse_tlvs((u8 *)&info->head[ie_offset],
+               info->head_len - ie_offset,
+               DOT11_MNG_SSID_ID)) != NULL) {
+               if (dev_role == NL80211_IFTYPE_AP) {
+                       /* Store the hostapd SSID */
+                       memset(&cfg->hostapd_ssid.SSID[0], 0x00, DOT11_MAX_SSID_LEN);
+                       cfg->hostapd_ssid.SSID_len = MIN(ssid_ie->len, DOT11_MAX_SSID_LEN);
+                       memcpy(&cfg->hostapd_ssid.SSID[0], ssid_ie->data,
+                               cfg->hostapd_ssid.SSID_len);
+               } else {
+                               /* P2P GO */
+                       memset(&cfg->p2p->ssid.SSID[0], 0x00, DOT11_MAX_SSID_LEN);
+                       cfg->p2p->ssid.SSID_len = MIN(ssid_ie->len, DOT11_MAX_SSID_LEN);
+                       memcpy(cfg->p2p->ssid.SSID, ssid_ie->data,
+                               cfg->p2p->ssid.SSID_len);
+               }
+       }
+
+       if (wl_cfg80211_parse_ies((u8 *)info->tail,
+               info->tail_len, &ies) < 0) {
+               WL_ERR(("Beacon get IEs failed \n"));
+               err = -EINVAL;
+               goto fail;
+       }
+
+       if ((err = wl_cfg80211_set_mgmt_vndr_ies(cfg, ndev_to_cfgdev(dev), bssidx,
+               VNDR_IE_BEACON_FLAG, (u8 *)info->tail,
+               info->tail_len)) < 0) {
+               WL_ERR(("Beacon set IEs failed \n"));
+               goto fail;
+       } else {
+               WL_DBG(("Applied Vndr IEs for Beacon \n"));
+       }
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0))
+       if ((err = wl_cfg80211_set_mgmt_vndr_ies(cfg, ndev_to_cfgdev(dev), bssidx,
+               VNDR_IE_PRBRSP_FLAG, (u8 *)info->proberesp_ies,
+               info->proberesp_ies_len)) < 0) {
+               WL_ERR(("ProbeRsp set IEs failed \n"));
+               goto fail;
+       } else {
+               WL_DBG(("Applied Vndr IEs for ProbeRsp \n"));
+       }
+#endif
+
+       is_bss_up = wl_cfgp2p_bss_isup(dev, bssidx);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0))
+       privacy = info->privacy;
+#else
+       privacy = 0;
+#endif
+       if (!is_bss_up &&
+               (wl_cfg80211_bcn_validate_sec(dev, &ies, dev_role, bssidx, privacy) < 0))
+       {
+               WL_ERR(("Beacon set security failed \n"));
+               err = -EINVAL;
+               goto fail;
+       }
+
+       /* Set BI and DTIM period */
+       if (info->interval) {
+               if ((err = wldev_ioctl(dev, WLC_SET_BCNPRD,
+                       &info->interval, sizeof(s32), true)) < 0) {
+                       WL_ERR(("Beacon Interval Set Error, %d\n", err));
+                       return err;
+               }
+       }
+       if (info->dtim_period) {
+               if ((err = wldev_ioctl(dev, WLC_SET_DTIMPRD,
+                       &info->dtim_period, sizeof(s32), true)) < 0) {
+                       WL_ERR(("DTIM Interval Set Error, %d\n", err));
+                       return err;
+               }
+       }
+
+       /* If bss is already up, skip bring up */
+       if (!is_bss_up &&
+               (err = wl_cfg80211_bcn_bringup_ap(dev, &ies, dev_role, bssidx)) < 0)
+       {
+               WL_ERR(("Beacon bring up AP/GO failed \n"));
+               goto fail;
+       }
+
+       /* Set GC/STA SCB expiry timings. */
+       if ((err = wl_cfg80211_set_scb_timings(cfg, dev))) {
+               WL_ERR(("scb setting failed \n"));
+               goto fail;
+       }
+
+       if (wl_get_drv_status(cfg, AP_CREATED, dev)) {
+               /* Soft AP already running. Update changed params */
+               if (wl_cfg80211_hostapd_sec(dev, &ies, bssidx) < 0) {
+                       WL_ERR(("Hostapd update sec failed \n"));
+                       err = -EINVAL;
+                       goto fail;
+               }
+       }
+
+       /* Enable Probe Req filter */
+       if (((dev_role == NL80211_IFTYPE_P2P_GO) ||
+               (dev_role == NL80211_IFTYPE_AP)) && (ies.wps_ie != NULL)) {
+               wl_validate_wps_ie((char *) ies.wps_ie, ies.wps_ie_len, &pbc);
+               if (pbc)
+                       wl_add_remove_eventmsg(dev, WLC_E_PROBREQ_MSG, true);
+       }
+
+       WL_DBG(("** ADD/SET beacon done **\n"));
+
+fail:
+       if (err) {
+               WL_ERR(("ADD/SET beacon failed\n"));
+               wldev_iovar_setint(dev, "mpc", 1);
+               if (dev_role == NL80211_IFTYPE_AP) {
+                       /* clear the AP mode */
+                       dhd->op_mode &= ~DHD_FLAG_HOSTAP_MODE;
+               }
+       }
+       return err;
+
+}
+#endif /* LINUX_VERSION < VERSION(3,4,0) || WL_COMPAT_WIRELESS */
+
+#ifdef WL_SCHED_SCAN
+#define PNO_TIME               30
+#define PNO_REPEAT             4
+#define PNO_FREQ_EXPO_MAX      2
+static bool
+is_ssid_in_list(struct cfg80211_ssid *ssid, struct cfg80211_ssid *ssid_list, int count)
+{
+       int i;
+
+       if (!ssid || !ssid_list)
+               return FALSE;
+
+       for (i = 0; i < count; i++) {
+               if (ssid->ssid_len == ssid_list[i].ssid_len) {
+                       if (strncmp(ssid->ssid, ssid_list[i].ssid, ssid->ssid_len) == 0)
+                               return TRUE;
+               }
+       }
+       return FALSE;
+}
+
+static int
+wl_cfg80211_sched_scan_start(struct wiphy *wiphy,
+                             struct net_device *dev,
+                             struct cfg80211_sched_scan_request *request)
+{
+       ushort pno_time = PNO_TIME;
+       int pno_repeat = PNO_REPEAT;
+       int pno_freq_expo_max = PNO_FREQ_EXPO_MAX;
+       wlc_ssid_ext_t ssids_local[MAX_PFN_LIST_COUNT];
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct cfg80211_ssid *ssid = NULL;
+       struct cfg80211_ssid *hidden_ssid_list = NULL;
+       int ssid_cnt = 0;
+       int i;
+       int ret = 0;
+
+       if (!request) {
+               WL_ERR(("Sched scan request was NULL\n"));
+               return -EINVAL;
+       }
+
+       WL_DBG(("Enter \n"));
+       WL_PNO((">>> SCHED SCAN START\n"));
+       WL_PNO(("Enter n_match_sets:%d   n_ssids:%d \n",
+               request->n_match_sets, request->n_ssids));
+       WL_PNO(("ssids:%d pno_time:%d pno_repeat:%d pno_freq:%d \n",
+               request->n_ssids, pno_time, pno_repeat, pno_freq_expo_max));
+
+
+       if (!request->n_ssids || !request->n_match_sets) {
+               WL_ERR(("Invalid sched scan req!! n_ssids:%d \n", request->n_ssids));
+               return -EINVAL;
+       }
+
+       memset(&ssids_local, 0, sizeof(ssids_local));
+
+       if (request->n_ssids > 0) {
+               hidden_ssid_list = request->ssids;
+       }
+
+       for (i = 0; i < request->n_match_sets && ssid_cnt < MAX_PFN_LIST_COUNT; i++) {
+               ssid = &request->match_sets[i].ssid;
+               /* No need to include null ssid */
+               if (ssid->ssid_len) {
+                       ssids_local[ssid_cnt].SSID_len = MIN(ssid->ssid_len,
+                               (uint32)DOT11_MAX_SSID_LEN);
+                       memcpy(ssids_local[ssid_cnt].SSID, ssid->ssid,
+                               ssids_local[ssid_cnt].SSID_len);
+                       if (is_ssid_in_list(ssid, hidden_ssid_list, request->n_ssids)) {
+                               ssids_local[ssid_cnt].hidden = TRUE;
+                               WL_PNO((">>> PNO hidden SSID (%s) \n", ssid->ssid));
+                       } else {
+                               ssids_local[ssid_cnt].hidden = FALSE;
+                               WL_PNO((">>> PNO non-hidden SSID (%s) \n", ssid->ssid));
+                       }
+                       ssid_cnt++;
+               }
+       }
+
+       if (ssid_cnt) {
+               if ((ret = dhd_dev_pno_set_for_ssid(dev, ssids_local, ssid_cnt,
+                       pno_time, pno_repeat, pno_freq_expo_max, NULL, 0)) < 0) {
+                       WL_ERR(("PNO setup failed!! ret=%d \n", ret));
+                       return -EINVAL;
+               }
+               cfg->sched_scan_req = request;
+       } else {
+               return -EINVAL;
+       }
+
+       return 0;
+}
+
+static int
+wl_cfg80211_sched_scan_stop(struct wiphy *wiphy, struct net_device *dev)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+
+       WL_DBG(("Enter \n"));
+       WL_PNO((">>> SCHED SCAN STOP\n"));
+
+       if (dhd_dev_pno_stop_for_ssid(dev) < 0)
+               WL_ERR(("PNO Stop for SSID failed"));
+
+       if (cfg->scan_request && cfg->sched_scan_running) {
+               WL_PNO((">>> Sched scan running. Aborting it..\n"));
+               wl_notify_escan_complete(cfg, dev, true, true);
+       }
+
+        cfg->sched_scan_req = NULL;
+        cfg->sched_scan_running = FALSE;
+
+       return 0;
+}
+#endif /* WL_SCHED_SCAN */
+
+#ifdef WL_SUPPORT_ACS
+/*
+ * Currently the dump_obss IOVAR is returning string as output so we need to
+ * parse the output buffer in an unoptimized way. Going forward if we get the
+ * IOVAR output in binary format this method can be optimized
+ */
+static int wl_parse_dump_obss(char *buf, struct wl_dump_survey *survey)
+{
+       int i;
+       char *token;
+       char delim[] = " \n";
+
+       token = strsep(&buf, delim);
+       while (token != NULL) {
+               if (!strcmp(token, "OBSS")) {
+                       for (i = 0; i < OBSS_TOKEN_IDX; i++)
+                               token = strsep(&buf, delim);
+                       survey->obss = simple_strtoul(token, NULL, 10);
+               }
+
+               if (!strcmp(token, "IBSS")) {
+                       for (i = 0; i < IBSS_TOKEN_IDX; i++)
+                               token = strsep(&buf, delim);
+                       survey->ibss = simple_strtoul(token, NULL, 10);
+               }
+
+               if (!strcmp(token, "TXDur")) {
+                       for (i = 0; i < TX_TOKEN_IDX; i++)
+                               token = strsep(&buf, delim);
+                       survey->tx = simple_strtoul(token, NULL, 10);
+               }
+
+               if (!strcmp(token, "Category")) {
+                       for (i = 0; i < CTG_TOKEN_IDX; i++)
+                               token = strsep(&buf, delim);
+                       survey->no_ctg = simple_strtoul(token, NULL, 10);
+               }
+
+               if (!strcmp(token, "Packet")) {
+                       for (i = 0; i < PKT_TOKEN_IDX; i++)
+                               token = strsep(&buf, delim);
+                       survey->no_pckt = simple_strtoul(token, NULL, 10);
+               }
+
+               if (!strcmp(token, "Opp(time):")) {
+                       for (i = 0; i < IDLE_TOKEN_IDX; i++)
+                               token = strsep(&buf, delim);
+                       survey->idle = simple_strtoul(token, NULL, 10);
+               }
+
+               token = strsep(&buf, delim);
+       }
+
+       return 0;
+}
+
+static int wl_dump_obss(struct net_device *ndev, cca_msrmnt_query req,
+       struct wl_dump_survey *survey)
+{
+       cca_stats_n_flags *results;
+       char *buf;
+       int retry, err;
+
+       buf = kzalloc(sizeof(char) * WLC_IOCTL_MAXLEN, GFP_KERNEL);
+       if (unlikely(!buf)) {
+               WL_ERR(("%s: buf alloc failed\n", __func__));
+               return -ENOMEM;
+       }
+
+       retry = IOCTL_RETRY_COUNT;
+       while (retry--) {
+               err = wldev_iovar_getbuf(ndev, "dump_obss", &req, sizeof(req),
+                       buf, WLC_IOCTL_MAXLEN, NULL);
+               if (err >=  0) {
+                       break;
+               }
+               WL_DBG(("attempt = %d, err = %d, \n",
+                       (IOCTL_RETRY_COUNT - retry), err));
+       }
+
+       if (retry <= 0) {
+               WL_ERR(("failure, dump_obss IOVAR failed\n"));
+               err = -EINVAL;
+               goto exit;
+       }
+
+       results = (cca_stats_n_flags *)(buf);
+       wl_parse_dump_obss(results->buf, survey);
+       kfree(buf);
+
+       return 0;
+exit:
+       kfree(buf);
+       return err;
+}
+
+static int wl_cfg80211_dump_survey(struct wiphy *wiphy, struct net_device *ndev,
+       int idx, struct survey_info *info)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct wl_dump_survey *survey;
+       struct ieee80211_supported_band *band;
+       struct ieee80211_channel*chan;
+       cca_msrmnt_query req;
+       int val, err, noise, retry;
+
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+       if (!(dhd->op_mode & DHD_FLAG_HOSTAP_MODE)) {
+               return -ENOENT;
+       }
+       band = wiphy->bands[IEEE80211_BAND_2GHZ];
+       if (band && idx >= band->n_channels) {
+               idx -= band->n_channels;
+               band = NULL;
+       }
+
+       if (!band || idx >= band->n_channels) {
+               /* Move to 5G band */
+               band = wiphy->bands[IEEE80211_BAND_5GHZ];
+               if (idx >= band->n_channels) {
+                       return -ENOENT;
+               }
+       }
+
+       chan = &band->channels[idx];
+       /* Setting current channel to the requested channel */
+       if ((err = wl_cfg80211_set_channel(wiphy, ndev, chan,
+               NL80211_CHAN_HT20) < 0)) {
+               WL_ERR(("Set channel failed \n"));
+       }
+
+       if (!idx) {
+               /* Disable mpc */
+               val = 0;
+               err = wldev_iovar_setbuf_bsscfg(ndev, "mpc", (void *)&val,
+                       sizeof(val), cfg->ioctl_buf, WLC_IOCTL_SMLEN, 0,
+                       &cfg->ioctl_buf_sync);
+               if (err < 0) {
+                       WL_ERR(("set 'mpc' failed, error = %d\n", err));
+               }
+
+               /* Set interface up, explicitly. */
+               val = 1;
+               err = wldev_ioctl(ndev, WLC_UP, (void *)&val, sizeof(val), true);
+               if (err < 0) {
+                       WL_ERR(("set interface up failed, error = %d\n", err));
+               }
+       }
+
+       /* Get noise value */
+       retry = IOCTL_RETRY_COUNT;
+       while (retry--) {
+               err = wldev_ioctl(ndev, WLC_GET_PHY_NOISE, &noise,
+                       sizeof(noise), false);
+               if (err >=  0) {
+                       break;
+               }
+               WL_DBG(("attempt = %d, err = %d, \n",
+                       (IOCTL_RETRY_COUNT - retry), err));
+       }
+
+       if (retry <= 0) {
+               WL_ERR(("Get Phy Noise failed, error = %d\n", err));
+               noise = CHAN_NOISE_DUMMY;
+       }
+
+       survey = (struct wl_dump_survey *) kzalloc(sizeof(struct wl_dump_survey),
+               GFP_KERNEL);
+       if (unlikely(!survey)) {
+               WL_ERR(("%s: alloc failed\n", __func__));
+               return -ENOMEM;
+       }
+
+       /* Start Measurement for obss stats on current channel */
+       req.msrmnt_query = 0;
+       req.time_req = ACS_MSRMNT_DELAY;
+       if ((err = wl_dump_obss(ndev, req, survey)) < 0) {
+               goto exit;
+       }
+
+       /*
+        * Wait for the meaurement to complete, adding a buffer value of 10 to take
+        * into consideration any delay in IOVAR completion
+        */
+       msleep(ACS_MSRMNT_DELAY + 10);
+
+       /* Issue IOVAR to collect measurement results */
+       req.msrmnt_query = 1;
+       if ((err = wl_dump_obss(ndev, req, survey)) < 0) {
+               goto exit;
+       }
+
+       info->channel = chan;
+       info->noise = noise;
+       info->channel_time = ACS_MSRMNT_DELAY;
+       info->channel_time_busy = ACS_MSRMNT_DELAY - survey->idle;
+       info->channel_time_rx = survey->obss + survey->ibss + survey->no_ctg +
+               survey->no_pckt;
+       info->channel_time_tx = survey->tx;
+       info->filled = SURVEY_INFO_NOISE_DBM |SURVEY_INFO_CHANNEL_TIME |
+               SURVEY_INFO_CHANNEL_TIME_BUSY | SURVEY_INFO_CHANNEL_TIME_RX |
+               SURVEY_INFO_CHANNEL_TIME_TX;
+       kfree(survey);
+
+       return 0;
+exit:
+       kfree(survey);
+       return err;
+}
+#endif /* WL_SUPPORT_ACS */
+
+static struct cfg80211_ops wl_cfg80211_ops = {
+       .add_virtual_intf = wl_cfg80211_add_virtual_iface,
+       .del_virtual_intf = wl_cfg80211_del_virtual_iface,
+       .change_virtual_intf = wl_cfg80211_change_virtual_iface,
+#if defined(WL_CFG80211_P2P_DEV_IF)
+       .start_p2p_device = wl_cfgp2p_start_p2p_device,
+       .stop_p2p_device = wl_cfgp2p_stop_p2p_device,
+#endif /* WL_CFG80211_P2P_DEV_IF */
+       .scan = wl_cfg80211_scan,
+       .set_wiphy_params = wl_cfg80211_set_wiphy_params,
+       .join_ibss = wl_cfg80211_join_ibss,
+       .leave_ibss = wl_cfg80211_leave_ibss,
+       .get_station = wl_cfg80211_get_station,
+       .set_tx_power = wl_cfg80211_set_tx_power,
+       .get_tx_power = wl_cfg80211_get_tx_power,
+       .add_key = wl_cfg80211_add_key,
+       .del_key = wl_cfg80211_del_key,
+       .get_key = wl_cfg80211_get_key,
+       .set_default_key = wl_cfg80211_config_default_key,
+       .set_default_mgmt_key = wl_cfg80211_config_default_mgmt_key,
+       .set_power_mgmt = wl_cfg80211_set_power_mgmt,
+       .connect = wl_cfg80211_connect,
+       .disconnect = wl_cfg80211_disconnect,
+       .suspend = wl_cfg80211_suspend,
+       .resume = wl_cfg80211_resume,
+       .set_pmksa = wl_cfg80211_set_pmksa,
+       .del_pmksa = wl_cfg80211_del_pmksa,
+       .flush_pmksa = wl_cfg80211_flush_pmksa,
+       .remain_on_channel = wl_cfg80211_remain_on_channel,
+       .cancel_remain_on_channel = wl_cfg80211_cancel_remain_on_channel,
+       .mgmt_tx = wl_cfg80211_mgmt_tx,
+       .mgmt_frame_register = wl_cfg80211_mgmt_frame_register,
+       .change_bss = wl_cfg80211_change_bss,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0)) || defined(WL_COMPAT_WIRELESS)
+       .set_channel = wl_cfg80211_set_channel,
+#endif /* ((LINUX_VERSION < VERSION(3, 6, 0)) || WL_COMPAT_WIRELESS */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 4, 0)) && !defined(WL_COMPAT_WIRELESS)
+       .set_beacon = wl_cfg80211_add_set_beacon,
+       .add_beacon = wl_cfg80211_add_set_beacon,
+#else
+       .change_beacon = wl_cfg80211_change_beacon,
+       .start_ap = wl_cfg80211_start_ap,
+       .stop_ap = wl_cfg80211_stop_ap,
+#endif /* LINUX_VERSION < KERNEL_VERSION(3,4,0) && !WL_COMPAT_WIRELESS */
+#ifdef WL_SCHED_SCAN
+       .sched_scan_start = wl_cfg80211_sched_scan_start,
+       .sched_scan_stop = wl_cfg80211_sched_scan_stop,
+#endif /* WL_SCHED_SCAN */
+#if defined(WL_SUPPORT_BACKPORTED_KPATCHES) || (LINUX_VERSION_CODE >= KERNEL_VERSION(3, \
+       2, 0))
+       .del_station = wl_cfg80211_del_station,
+       .change_station = wl_cfg80211_change_station,
+       .mgmt_tx_cancel_wait = wl_cfg80211_mgmt_tx_cancel_wait,
+#endif /* WL_SUPPORT_BACKPORTED_KPATCHES || KERNEL_VERSION >= (3,2,0) */
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 2, 0)) || defined(WL_COMPAT_WIRELESS)
+       .tdls_mgmt = wl_cfg80211_tdls_mgmt,
+       .tdls_oper = wl_cfg80211_tdls_oper,
+#endif /* LINUX_VERSION > VERSION(3, 2, 0) || WL_COMPAT_WIRELESS */
+#ifdef WL_SUPPORT_ACS
+       .dump_survey = wl_cfg80211_dump_survey,
+#endif /* WL_SUPPORT_ACS */
+#ifdef WL_CFG80211_ACL
+       .set_mac_acl = wl_cfg80211_set_mac_acl,
+#endif /* WL_CFG80211_ACL */
+};
+
+s32 wl_mode_to_nl80211_iftype(s32 mode)
+{
+       s32 err = 0;
+
+       switch (mode) {
+       case WL_MODE_BSS:
+               return NL80211_IFTYPE_STATION;
+       case WL_MODE_IBSS:
+               return NL80211_IFTYPE_ADHOC;
+       case WL_MODE_AP:
+               return NL80211_IFTYPE_AP;
+       default:
+               return NL80211_IFTYPE_UNSPECIFIED;
+       }
+
+       return err;
+}
+
+#ifdef CONFIG_CFG80211_INTERNAL_REGDB
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 9, 0))
+static int
+#else
+static void
+#endif /* kernel version < 3.9.0 */
+wl_cfg80211_reg_notifier(
+       struct wiphy *wiphy,
+       struct regulatory_request *request)
+{
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)wiphy_priv(wiphy);
+       int ret = 0;
+       int revinfo = -1;
+
+       if (!request || !cfg) {
+               WL_ERR(("Invalid arg\n"));
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 9, 0))
+               return -EINVAL;
+#else
+               return;
+#endif /* kernel version < 3.9.0 */
+       }
+
+       WL_DBG(("ccode: %c%c Initiator: %d\n",
+               request->alpha2[0], request->alpha2[1], request->initiator));
+
+       /* We support only REGDOM_SET_BY_USER as of now */
+       if ((request->initiator != NL80211_REGDOM_SET_BY_USER) &&
+               (request->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE)) {
+               WL_ERR(("reg_notifier for intiator:%d not supported : set default\n",
+                       request->initiator));
+               /* in case of no supported country by regdb
+                    lets driver setup platform default Locale
+               */
+       }
+
+       WL_ERR(("Set country code %c%c from %s\n",
+               request->alpha2[0], request->alpha2[1],
+               ((request->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE) ? " 11d AP" : "User")));
+
+       if ((ret = wldev_set_country(bcmcfg_to_prmry_ndev(cfg), request->alpha2,
+               false, (request->initiator == NL80211_REGDOM_SET_BY_USER ? true : false),
+               revinfo)) < 0) {
+               WL_ERR(("set country Failed :%d\n", ret));
+       }
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 9, 0))
+       return ret;
+#else
+       return;
+#endif /* kernel version < 3.9.0 */
+}
+#endif /* CONFIG_CFG80211_INTERNAL_REGDB */
+
+#ifdef CONFIG_PM
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
+static const struct wiphy_wowlan_support brcm_wowlan_support = {
+       .flags = WIPHY_WOWLAN_ANY,
+       .n_patterns = WL_WOWLAN_MAX_PATTERNS,
+       .pattern_min_len = WL_WOWLAN_MIN_PATTERN_LEN,
+       .pattern_max_len = WL_WOWLAN_MAX_PATTERN_LEN,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0))
+       .max_pkt_offset = WL_WOWLAN_MAX_PATTERN_LEN,
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0) */
+};
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 0))
+static struct cfg80211_wowlan brcm_wowlan_config = {
+       .disconnect = true,
+       .gtk_rekey_failure = true,
+       .eap_identity_req = true,
+       .four_way_handshake = true,
+};
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 0) */
+#endif /* CONFIG_PM */
+
+static s32 wl_setup_wiphy(struct wireless_dev *wdev, struct device *sdiofunc_dev, void *context)
+{
+       s32 err = 0;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0) || defined(WL_COMPAT_WIRELESS))
+       dhd_pub_t *dhd = (dhd_pub_t *)context;
+       BCM_REFERENCE(dhd);
+
+       if (!dhd) {
+               WL_ERR(("DHD is NULL!!"));
+               err = -ENODEV;
+               return err;
+       }
+#endif 
+
+       wdev->wiphy =
+           wiphy_new(&wl_cfg80211_ops, sizeof(struct bcm_cfg80211));
+       if (unlikely(!wdev->wiphy)) {
+               WL_ERR(("Couldn not allocate wiphy device\n"));
+               err = -ENOMEM;
+               return err;
+       }
+       set_wiphy_dev(wdev->wiphy, sdiofunc_dev);
+       wdev->wiphy->max_scan_ie_len = WL_SCAN_IE_LEN_MAX;
+       /* Report  how many SSIDs Driver can support per Scan request */
+       wdev->wiphy->max_scan_ssids = WL_SCAN_PARAMS_SSID_MAX;
+       wdev->wiphy->max_num_pmkids = WL_NUM_PMKIDS_MAX;
+#ifdef WL_SCHED_SCAN
+       wdev->wiphy->max_sched_scan_ssids = MAX_PFN_LIST_COUNT;
+       wdev->wiphy->max_match_sets = MAX_PFN_LIST_COUNT;
+       wdev->wiphy->max_sched_scan_ie_len = WL_SCAN_IE_LEN_MAX;
+       wdev->wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
+#endif /* WL_SCHED_SCAN */
+       wdev->wiphy->interface_modes =
+               BIT(NL80211_IFTYPE_STATION)
+               | BIT(NL80211_IFTYPE_ADHOC)
+#if !defined(WL_ENABLE_P2P_IF) && !defined(WL_CFG80211_P2P_DEV_IF)
+               | BIT(NL80211_IFTYPE_MONITOR)
+#endif /* !WL_ENABLE_P2P_IF && !WL_CFG80211_P2P_DEV_IF */
+#if defined(WL_IFACE_COMB_NUM_CHANNELS) || defined(WL_CFG80211_P2P_DEV_IF)
+               | BIT(NL80211_IFTYPE_P2P_CLIENT)
+               | BIT(NL80211_IFTYPE_P2P_GO)
+#endif /* WL_IFACE_COMB_NUM_CHANNELS || WL_CFG80211_P2P_DEV_IF */
+#if defined(WL_CFG80211_P2P_DEV_IF)
+               | BIT(NL80211_IFTYPE_P2P_DEVICE)
+#endif /* WL_CFG80211_P2P_DEV_IF */
+               | BIT(NL80211_IFTYPE_AP);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)) && \
+       (defined(WL_IFACE_COMB_NUM_CHANNELS) || defined(WL_CFG80211_P2P_DEV_IF))
+       WL_DBG(("Setting interface combinations for common mode\n"));
+       wdev->wiphy->iface_combinations = common_iface_combinations;
+       wdev->wiphy->n_iface_combinations =
+               ARRAY_SIZE(common_iface_combinations);
+#endif /* LINUX_VER >= 3.0 && (WL_IFACE_COMB_NUM_CHANNELS || WL_CFG80211_P2P_DEV_IF) */
+
+       wdev->wiphy->bands[IEEE80211_BAND_2GHZ] = &__wl_band_2ghz;
+
+       wdev->wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
+       wdev->wiphy->cipher_suites = __wl_cipher_suites;
+       wdev->wiphy->n_cipher_suites = ARRAY_SIZE(__wl_cipher_suites);
+       wdev->wiphy->max_remain_on_channel_duration = 5000;
+       wdev->wiphy->mgmt_stypes = wl_cfg80211_default_mgmt_stypes;
+#ifndef WL_POWERSAVE_DISABLED
+       wdev->wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;
+#else
+       wdev->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+#endif                         /* !WL_POWERSAVE_DISABLED */
+       wdev->wiphy->flags |= WIPHY_FLAG_NETNS_OK |
+               WIPHY_FLAG_4ADDR_AP |
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 39)) && !defined(WL_COMPAT_WIRELESS)
+               WIPHY_FLAG_SUPPORTS_SEPARATE_DEFAULT_KEYS |
+#endif
+               WIPHY_FLAG_4ADDR_STATION;
+#if ((defined(ROAM_ENABLE) || defined(BCMFW_ROAM_ENABLE)) && ((LINUX_VERSION_CODE >= \
+       KERNEL_VERSION(3, 2, 0)) || defined(WL_COMPAT_WIRELESS)))
+       /*
+        * If FW ROAM flag is advertised, upper layer wouldn't provide
+        * the bssid & freq in the connect command. This will result a
+        * delay in initial connection time due to firmware doing a full
+        * channel scan to figure out the channel & bssid. However kernel
+        * ver >= 3.15, provides bssid_hint & freq_hint and hence kernel
+        * ver >= 3.15 won't have any issue. So if this flags need to be
+        * advertised for kernel < 3.15, suggest to use RCC along with it
+        * to avoid the initial connection delay.
+        */
+       wdev->wiphy->flags |= WIPHY_FLAG_SUPPORTS_FW_ROAM;
+#endif /* (ROAM_ENABLE || BCMFW_ROAM_ENABLE) && (LINUX_VERSION 3.2.0  || WL_COMPAT_WIRELESS) */
+#ifdef UNSET_FW_ROAM_WIPHY_FLAG
+       wdev->wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_FW_ROAM;
+#endif /* UNSET_FW_ROAM_WIPHY_FLAG */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0)) || defined(WL_COMPAT_WIRELESS)
+       wdev->wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
+               WIPHY_FLAG_OFFCHAN_TX;
+#endif
+#if defined(WL_SUPPORT_BACKPORTED_KPATCHES) || (LINUX_VERSION_CODE >= KERNEL_VERSION(3, \
+       4, 0))
+       /* From 3.4 kernel ownards AP_SME flag can be advertised
+        * to remove the patch from supplicant
+        */
+       wdev->wiphy->flags |= WIPHY_FLAG_HAVE_AP_SME;
+
+#ifdef WL_CFG80211_ACL
+       /* Configure ACL capabilities. */
+       wdev->wiphy->max_acl_mac_addrs = MAX_NUM_MAC_FILT;
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0) || defined(WL_COMPAT_WIRELESS))
+       /* Supplicant distinguish between the SoftAP mode and other
+        * modes (e.g. P2P, WPS, HS2.0) when it builds the probe
+        * response frame from Supplicant MR1 and Kernel 3.4.0 or
+        * later version. To add Vendor specific IE into the
+        * probe response frame in case of SoftAP mode,
+        * AP_PROBE_RESP_OFFLOAD flag is set to wiphy->flags variable.
+        */
+       if (dhd_get_fw_mode(dhd->info) == DHD_FLAG_HOSTAP_MODE) {
+               wdev->wiphy->flags |= WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD;
+               wdev->wiphy->probe_resp_offload = 0;
+       }
+#endif 
+#endif /* WL_SUPPORT_BACKPORTED_KPATCHES) || (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) */
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 2, 0)) || defined(WL_COMPAT_WIRELESS)
+       wdev->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
+#endif
+
+#if defined(CONFIG_PM) && defined(WL_CFG80211_P2P_DEV_IF)
+       /*
+        * From linux-3.10 kernel, wowlan packet filter is mandated to avoid the
+        * disconnection of connected network before suspend. So a dummy wowlan
+        * filter is configured for kernels linux-3.8 and above.
+        */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 0))
+       wdev->wiphy->wowlan = &brcm_wowlan_support;
+       /* If this is not provided cfg stack will get disconnect
+        * during suspend.
+        */
+       wdev->wiphy->wowlan_config = &brcm_wowlan_config;
+#else
+       wdev->wiphy->wowlan.flags = WIPHY_WOWLAN_ANY;
+       wdev->wiphy->wowlan.n_patterns = WL_WOWLAN_MAX_PATTERNS;
+       wdev->wiphy->wowlan.pattern_min_len = WL_WOWLAN_MIN_PATTERN_LEN;
+       wdev->wiphy->wowlan.pattern_max_len = WL_WOWLAN_MAX_PATTERN_LEN;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0))
+       wdev->wiphy->wowlan.max_pkt_offset = WL_WOWLAN_MAX_PATTERN_LEN;
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0) */
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 0) */
+#endif /* CONFIG_PM && WL_CFG80211_P2P_DEV_IF */
+
+       WL_DBG(("Registering custom regulatory)\n"));
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+       wdev->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
+#else
+       wdev->wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
+#endif
+       wiphy_apply_custom_regulatory(wdev->wiphy, &brcm_regdom);
+#if defined(WL_VENDOR_EXT_SUPPORT)
+       WL_ERR(("Registering Vendor80211\n"));
+       err = wl_cfgvendor_attach(wdev->wiphy);
+       if (unlikely(err < 0)) {
+               WL_ERR(("Couldn not attach vendor commands (%d)\n", err));
+       }
+#endif /* defined(WL_VENDOR_EXT_SUPPORT) */
+       /* Now we can register wiphy with cfg80211 module */
+       err = wiphy_register(wdev->wiphy);
+       if (unlikely(err < 0)) {
+               WL_ERR(("Couldn not register wiphy device (%d)\n", err));
+               wiphy_free(wdev->wiphy);
+       }
+
+#if ((LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)) && (LINUX_VERSION_CODE <= \
+       KERNEL_VERSION(3, 3, 0))) && defined(WL_IFACE_COMB_NUM_CHANNELS)
+       wdev->wiphy->flags &= ~WIPHY_FLAG_ENFORCE_COMBINATIONS;
+#endif
+
+       return err;
+}
+
+static void wl_free_wdev(struct bcm_cfg80211 *cfg)
+{
+       struct wireless_dev *wdev = cfg->wdev;
+       struct wiphy *wiphy = NULL;
+       if (!wdev) {
+               WL_ERR(("wdev is invalid\n"));
+               return;
+       }
+       if (wdev->wiphy) {
+               wiphy = wdev->wiphy;
+
+#if defined(WL_VENDOR_EXT_SUPPORT)
+               wl_cfgvendor_detach(wdev->wiphy);
+#endif /* if defined(WL_VENDOR_EXT_SUPPORT) */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 0))
+               /* Reset wowlan & wowlan_config before Unregister to avoid  Kernel Panic */
+               WL_DBG(("wl_free_wdev Clearing wowlan Config \n"));
+               wdev->wiphy->wowlan = NULL;
+               wdev->wiphy->wowlan_config = NULL;
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 0) */
+               wiphy_unregister(wdev->wiphy);
+               wdev->wiphy->dev.parent = NULL;
+               wdev->wiphy = NULL;
+       }
+
+       wl_delete_all_netinfo(cfg);
+       if (wiphy)
+               wiphy_free(wiphy);
+
+       /* PLEASE do NOT call any function after wiphy_free, the driver's private structure "cfg",
+        * which is the private part of wiphy, has been freed in wiphy_free !!!!!!!!!!!
+        */
+}
+
+static s32 wl_inform_bss(struct bcm_cfg80211 *cfg)
+{
+       struct wl_scan_results *bss_list;
+       struct wl_bss_info *bi = NULL;  /* must be initialized */
+       s32 err = 0;
+       s32 i;
+
+       bss_list = cfg->bss_list;
+       WL_DBG(("scanned AP count (%d)\n", bss_list->count));
+       bi = next_bss(bss_list, bi);
+       for_each_bss(bss_list, bi, i) {
+               err = wl_inform_single_bss(cfg, bi, false);
+               if (unlikely(err))
+                       break;
+       }
+       return err;
+}
+
+static s32 wl_inform_single_bss(struct bcm_cfg80211 *cfg, struct wl_bss_info *bi, bool roam)
+{
+       struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+       struct ieee80211_mgmt *mgmt;
+       struct ieee80211_channel *channel;
+       struct ieee80211_supported_band *band;
+       struct wl_cfg80211_bss_info *notif_bss_info;
+       struct wl_scan_req *sr = wl_to_sr(cfg);
+       struct beacon_proberesp *beacon_proberesp;
+       struct cfg80211_bss *cbss = NULL;
+       s32 mgmt_type;
+       s32 signal;
+       u32 freq;
+       s32 err = 0;
+       gfp_t aflags;
+
+       if (unlikely(dtoh32(bi->length) > WL_BSS_INFO_MAX)) {
+               WL_DBG(("Beacon is larger than buffer. Discarding\n"));
+               return err;
+       }
+       aflags = (in_atomic()) ? GFP_ATOMIC : GFP_KERNEL;
+       notif_bss_info = kzalloc(sizeof(*notif_bss_info) + sizeof(*mgmt)
+               - sizeof(u8) + WL_BSS_INFO_MAX, aflags);
+       if (unlikely(!notif_bss_info)) {
+               WL_ERR(("notif_bss_info alloc failed\n"));
+               return -ENOMEM;
+       }
+       mgmt = (struct ieee80211_mgmt *)notif_bss_info->frame_buf;
+       notif_bss_info->channel =
+               wf_chspec_ctlchan(wl_chspec_driver_to_host(bi->chanspec));
+
+       if (notif_bss_info->channel <= CH_MAX_2G_CHANNEL)
+               band = wiphy->bands[IEEE80211_BAND_2GHZ];
+       else
+               band = wiphy->bands[IEEE80211_BAND_5GHZ];
+       if (!band) {
+               WL_ERR(("No valid band"));
+               kfree(notif_bss_info);
+               return -EINVAL;
+       }
+       notif_bss_info->rssi = wl_rssi_offset(dtoh16(bi->RSSI));
+       memcpy(mgmt->bssid, &bi->BSSID, ETHER_ADDR_LEN);
+       mgmt_type = cfg->active_scan ?
+               IEEE80211_STYPE_PROBE_RESP : IEEE80211_STYPE_BEACON;
+       if (!memcmp(bi->SSID, sr->ssid.SSID, bi->SSID_len)) {
+           mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | mgmt_type);
+       }
+       beacon_proberesp = cfg->active_scan ?
+               (struct beacon_proberesp *)&mgmt->u.probe_resp :
+               (struct beacon_proberesp *)&mgmt->u.beacon;
+       beacon_proberesp->timestamp = 0;
+       beacon_proberesp->beacon_int = cpu_to_le16(bi->beacon_period);
+       beacon_proberesp->capab_info = cpu_to_le16(bi->capability);
+       wl_rst_ie(cfg);
+       wl_update_hidden_ap_ie(bi, ((u8 *) bi) + bi->ie_offset, &bi->ie_length, roam);
+       wl_mrg_ie(cfg, ((u8 *) bi) + bi->ie_offset, bi->ie_length);
+       wl_cp_ie(cfg, beacon_proberesp->variable, WL_BSS_INFO_MAX -
+               offsetof(struct wl_cfg80211_bss_info, frame_buf));
+       notif_bss_info->frame_len = offsetof(struct ieee80211_mgmt,
+               u.beacon.variable) + wl_get_ielen(cfg);
+#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 38) && !defined(WL_COMPAT_WIRELESS)
+       freq = ieee80211_channel_to_frequency(notif_bss_info->channel);
+       (void)band->band;
+#else
+       freq = ieee80211_channel_to_frequency(notif_bss_info->channel, band->band);
+#endif
+       if (freq == 0) {
+               WL_ERR(("Invalid channel, fail to chcnage channel to freq\n"));
+               kfree(notif_bss_info);
+               return -EINVAL;
+       }
+       channel = ieee80211_get_channel(wiphy, freq);
+       if (unlikely(!channel)) {
+               WL_ERR(("ieee80211_get_channel error\n"));
+               kfree(notif_bss_info);
+               return -EINVAL;
+       }
+       WL_DBG(("SSID : \"%s\", rssi %d, channel %d, capability : 0x04%x, bssid %pM"
+                       "mgmt_type %d frame_len %d\n", bi->SSID,
+                       notif_bss_info->rssi, notif_bss_info->channel,
+                       mgmt->u.beacon.capab_info, &bi->BSSID, mgmt_type,
+                       notif_bss_info->frame_len));
+
+       signal = notif_bss_info->rssi * 100;
+       if (!mgmt->u.probe_resp.timestamp) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39))
+               struct timespec ts;
+               get_monotonic_boottime(&ts);
+               mgmt->u.probe_resp.timestamp = ((u64)ts.tv_sec*1000000)
+                               + ts.tv_nsec / 1000;
+#else
+               struct timeval tv;
+               do_gettimeofday(&tv);
+               mgmt->u.probe_resp.timestamp = ((u64)tv.tv_sec*1000000)
+                               + tv.tv_usec;
+#endif
+       }
+
+
+       cbss = cfg80211_inform_bss_frame(wiphy, channel, mgmt,
+               le16_to_cpu(notif_bss_info->frame_len), signal, aflags);
+       if (unlikely(!cbss)) {
+               WL_ERR(("cfg80211_inform_bss_frame error\n"));
+               kfree(notif_bss_info);
+               return -EINVAL;
+       }
+
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0))
+       cfg80211_put_bss(wiphy, cbss);
+#else
+       cfg80211_put_bss(cbss);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0) */
+       kfree(notif_bss_info);
+       return err;
+}
+
+static bool wl_is_linkup(struct bcm_cfg80211 *cfg, const wl_event_msg_t *e, struct net_device *ndev)
+{
+       u32 event = ntoh32(e->event_type);
+       u32 status =  ntoh32(e->status);
+       u16 flags = ntoh16(e->flags);
+
+       WL_DBG(("event %d, status %d flags %x\n", event, status, flags));
+       if (event == WLC_E_SET_SSID) {
+               if (status == WLC_E_STATUS_SUCCESS) {
+                       if (!wl_is_ibssmode(cfg, ndev))
+                               return true;
+               }
+       } else if (event == WLC_E_LINK) {
+               if (flags & WLC_EVENT_MSG_LINK)
+                       return true;
+       }
+
+       WL_DBG(("wl_is_linkup false\n"));
+       return false;
+}
+
+static bool wl_is_linkdown(struct bcm_cfg80211 *cfg, const wl_event_msg_t *e)
+{
+       u32 event = ntoh32(e->event_type);
+       u16 flags = ntoh16(e->flags);
+
+       if (event == WLC_E_DEAUTH_IND ||
+       event == WLC_E_DISASSOC_IND ||
+       event == WLC_E_DISASSOC ||
+       event == WLC_E_DEAUTH) {
+#if (WL_DBG_LEVEL > 0)
+       WL_ERR(("Link down Reason : WLC_E_%s\n", wl_dbg_estr[event]));
+#endif /* (WL_DBG_LEVEL > 0) */
+               return true;
+       } else if (event == WLC_E_LINK) {
+               if (!(flags & WLC_EVENT_MSG_LINK)) {
+#if (WL_DBG_LEVEL > 0)
+       WL_ERR(("Link down Reason : WLC_E_%s\n", wl_dbg_estr[event]));
+#endif /* (WL_DBG_LEVEL > 0) */
+                       return true;
+               }
+       }
+
+       return false;
+}
+
+static bool wl_is_nonetwork(struct bcm_cfg80211 *cfg, const wl_event_msg_t *e)
+{
+       u32 event = ntoh32(e->event_type);
+       u32 status = ntoh32(e->status);
+
+       if (event == WLC_E_LINK && status == WLC_E_STATUS_NO_NETWORKS)
+               return true;
+       if (event == WLC_E_SET_SSID && status != WLC_E_STATUS_SUCCESS)
+               return true;
+
+       return false;
+}
+
+/* The mainline kernel >= 3.2.0 has support for indicating new/del station
+ * to AP/P2P GO via events. If this change is backported to kernel for which
+ * this driver is being built, then define WL_CFG80211_STA_EVENT. You
+ * should use this new/del sta event mechanism for BRCM supplicant >= 22.
+ */
+static s32
+wl_notify_connect_status_ap(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *e, void *data)
+{
+       s32 err = 0;
+       u32 event = ntoh32(e->event_type);
+       u32 reason = ntoh32(e->reason);
+       u32 len = ntoh32(e->datalen);
+       u32 status = ntoh32(e->status);
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 2, 0)) && !defined(WL_CFG80211_STA_EVENT) \
+       && !defined(WL_COMPAT_WIRELESS)
+       bool isfree = false;
+       u8 *mgmt_frame;
+       u8 bsscfgidx = e->bsscfgidx;
+       s32 freq;
+       s32 channel;
+       u8 *body = NULL;
+       u16 fc = 0;
+
+       struct ieee80211_supported_band *band;
+       struct ether_addr da;
+       struct ether_addr bssid;
+       struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+       channel_info_t ci;
+#else
+       struct station_info sinfo;
+#endif /* (LINUX_VERSION < VERSION(3,2,0)) && !WL_CFG80211_STA_EVENT && !WL_COMPAT_WIRELESS */
+
+       WL_DBG(("event %d status %d reason %d\n", event, ntoh32(e->status), reason));
+       /* if link down, bsscfg is disabled. */
+       if (event == WLC_E_LINK && reason == WLC_E_LINK_BSSCFG_DIS &&
+               wl_get_p2p_status(cfg, IF_DELETING) && (ndev != bcmcfg_to_prmry_ndev(cfg))) {
+               wl_add_remove_eventmsg(ndev, WLC_E_PROBREQ_MSG, false);
+               WL_INFORM(("AP mode link down !! \n"));
+               complete(&cfg->iface_disable);
+               return 0;
+       }
+
+       if ((event == WLC_E_LINK) && (status == WLC_E_STATUS_SUCCESS) &&
+               (reason == WLC_E_REASON_INITIAL_ASSOC) &&
+               (wl_get_mode_by_netdev(cfg, ndev) == WL_MODE_AP)) {
+               if (!wl_get_drv_status(cfg, AP_CREATED, ndev)) {
+                       /* AP/GO brought up successfull in firmware */
+                       WL_ERR(("** AP/GO Link up event **\n"));
+                       wl_set_drv_status(cfg, AP_CREATED, ndev);
+                       wake_up_interruptible(&cfg->netif_change_event);
+                       return 0;
+               }
+       }
+
+       if (event == WLC_E_DISASSOC_IND || event == WLC_E_DEAUTH_IND || event == WLC_E_DEAUTH) {
+               WL_ERR(("event %s(%d) status %d reason %d\n",
+               bcmevent_get_name(event), event, ntoh32(e->status), reason));
+       }
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 2, 0)) && !defined(WL_CFG80211_STA_EVENT) \
+       && !defined(WL_COMPAT_WIRELESS)
+       WL_DBG(("Enter \n"));
+       if (!len && (event == WLC_E_DEAUTH)) {
+               len = 2; /* reason code field */
+               data = &reason;
+       }
+       if (len) {
+               body = kzalloc(len, GFP_KERNEL);
+
+               if (body == NULL) {
+                       WL_ERR(("wl_notify_connect_status: Failed to allocate body\n"));
+                       return WL_INVALID;
+               }
+       }
+       memset(&bssid, 0, ETHER_ADDR_LEN);
+       WL_DBG(("Enter event %d ndev %p\n", event, ndev));
+       if (wl_get_mode_by_netdev(cfg, ndev) == WL_INVALID) {
+               kfree(body);
+               return WL_INVALID;
+       }
+       if (len)
+               memcpy(body, data, len);
+
+       wldev_iovar_getbuf_bsscfg(ndev, "cur_etheraddr",
+               NULL, 0, cfg->ioctl_buf, WLC_IOCTL_SMLEN, bsscfgidx, &cfg->ioctl_buf_sync);
+       memcpy(da.octet, cfg->ioctl_buf, ETHER_ADDR_LEN);
+       err = wldev_ioctl(ndev, WLC_GET_BSSID, &bssid, ETHER_ADDR_LEN, false);
+       switch (event) {
+               case WLC_E_ASSOC_IND:
+                       fc = FC_ASSOC_REQ;
+                       break;
+               case WLC_E_REASSOC_IND:
+                       fc = FC_REASSOC_REQ;
+                       break;
+               case WLC_E_DISASSOC_IND:
+                       fc = FC_DISASSOC;
+                       break;
+               case WLC_E_DEAUTH_IND:
+                       fc = FC_DISASSOC;
+                       break;
+               case WLC_E_DEAUTH:
+                       fc = FC_DISASSOC;
+                       break;
+               default:
+                       fc = 0;
+                       goto exit;
+       }
+       if ((err = wldev_ioctl(ndev, WLC_GET_CHANNEL, &ci, sizeof(ci), false))) {
+               kfree(body);
+               return err;
+       }
+
+       channel = dtoh32(ci.hw_channel);
+       if (channel <= CH_MAX_2G_CHANNEL)
+               band = wiphy->bands[IEEE80211_BAND_2GHZ];
+       else
+               band = wiphy->bands[IEEE80211_BAND_5GHZ];
+       if (!band) {
+               WL_ERR(("No valid band"));
+               if (body)
+                       kfree(body);
+               return -EINVAL;
+       }
+#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 38) && !defined(WL_COMPAT_WIRELESS)
+       freq = ieee80211_channel_to_frequency(channel);
+       (void)band->band;
+#else
+       freq = ieee80211_channel_to_frequency(channel, band->band);
+#endif
+
+       err = wl_frame_get_mgmt(fc, &da, &e->addr, &bssid,
+               &mgmt_frame, &len, body);
+       if (err < 0)
+               goto exit;
+       isfree = true;
+
+       if (event == WLC_E_ASSOC_IND && reason == DOT11_SC_SUCCESS) {
+#if ((LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) && (LINUX_VERSION_CODE < \
+       KERNEL_VERSION(3, 18, 0))) || defined(WL_COMPAT_WIRELESS)
+               cfg80211_rx_mgmt(ndev, freq, 0, mgmt_frame, len, GFP_ATOMIC);
+
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
+               cfg80211_rx_mgmt(ndev, freq, 0, mgmt_frame, len);
+#else
+               cfg80211_rx_mgmt(ndev, freq, mgmt_frame, len, GFP_ATOMIC);
+#endif /* LINUX_VERSION >= VERSION(3,4,0) || WL_COMPAT_WIRELESS */
+       } else if (event == WLC_E_DISASSOC_IND) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) || defined(WL_COMPAT_WIRELESS)
+               cfg80211_rx_mgmt(ndev, freq, 0, mgmt_frame, len, GFP_ATOMIC);
+#else
+               cfg80211_rx_mgmt(ndev, freq, mgmt_frame, len, GFP_ATOMIC);
+#endif /* LINUX_VERSION >= VERSION(3,4,0) || WL_COMPAT_WIRELESS */
+       } else if ((event == WLC_E_DEAUTH_IND) || (event == WLC_E_DEAUTH)) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) || defined(WL_COMPAT_WIRELESS)
+               cfg80211_rx_mgmt(ndev, freq, 0, mgmt_frame, len, GFP_ATOMIC);
+#else
+               cfg80211_rx_mgmt(ndev, freq, mgmt_frame, len, GFP_ATOMIC);
+#endif /* LINUX_VERSION >= VERSION(3,4,0) || WL_COMPAT_WIRELESS */
+       }
+
+exit:
+       if (isfree)
+               kfree(mgmt_frame);
+       if (body)
+               kfree(body);
+#else /* LINUX_VERSION < VERSION(3,2,0) && !WL_CFG80211_STA_EVENT && !WL_COMPAT_WIRELESS */
+       sinfo.filled = 0;
+       if (((event == WLC_E_ASSOC_IND) || (event == WLC_E_REASSOC_IND)) &&
+               reason == DOT11_SC_SUCCESS) {
+               /* Linux ver >= 4.0 assoc_req_ies_len is used instead of
+                * STATION_INFO_ASSOC_REQ_IES flag
+                */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 0, 0))
+               sinfo.filled = STA_INFO_BIT(INFO_ASSOC_REQ_IES);
+#endif /*  (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 0, 0)) */
+               if (!data) {
+                       WL_ERR(("No IEs present in ASSOC/REASSOC_IND"));
+                       return -EINVAL;
+               }
+               sinfo.assoc_req_ies = data;
+               sinfo.assoc_req_ies_len = len;
+               cfg80211_new_sta(ndev, e->addr.octet, &sinfo, GFP_ATOMIC);
+       } else if (event == WLC_E_DISASSOC_IND) {
+               cfg80211_del_sta(ndev, e->addr.octet, GFP_ATOMIC);
+       } else if ((event == WLC_E_DEAUTH_IND) || (event == WLC_E_DEAUTH)) {
+               cfg80211_del_sta(ndev, e->addr.octet, GFP_ATOMIC);
+       }
+#endif /* LINUX_VERSION < VERSION(3,2,0) && !WL_CFG80211_STA_EVENT && !WL_COMPAT_WIRELESS */
+       return err;
+}
+
+#if defined(DHD_ENABLE_BIGDATA_LOGGING)
+#define MAX_ASSOC_REJECT_ERR_STATUS 5
+int wl_get_connect_failed_status(struct bcm_cfg80211 *cfg, const wl_event_msg_t *e)
+{
+       u32 status = ntoh32(e->status);
+
+       cfg->assoc_reject_status = 0;
+
+       if (status == WLC_E_STATUS_FAIL) {
+               WL_ERR(("auth assoc status event=%d e->status %d e->reason %d \n",
+                       ntoh32(cfg->event_auth_assoc.event_type),
+                       (int)ntoh32(cfg->event_auth_assoc.status),
+                       (int)ntoh32(cfg->event_auth_assoc.reason)));
+
+               switch ((int)ntoh32(cfg->event_auth_assoc.status)) {
+                       case WLC_E_STATUS_NO_ACK:
+                               cfg->assoc_reject_status = 1;
+                               break;
+                       case WLC_E_STATUS_FAIL:
+                               cfg->assoc_reject_status = 2;
+                               break;
+                       case WLC_E_STATUS_UNSOLICITED:
+                               cfg->assoc_reject_status = 3;
+                               break;
+                       case WLC_E_STATUS_TIMEOUT:
+                               cfg->assoc_reject_status = 4;
+                               break;
+                       case WLC_E_STATUS_ABORT:
+                               cfg->assoc_reject_status = 5;
+                               break;
+                       default:
+                               break;
+               }
+               if (cfg->assoc_reject_status) {
+                       if (ntoh32(cfg->event_auth_assoc.event_type) == WLC_E_ASSOC) {
+                               cfg->assoc_reject_status += MAX_ASSOC_REJECT_ERR_STATUS;
+                       }
+               }
+       }
+
+       WL_ERR(("assoc_reject_status %d \n", cfg->assoc_reject_status));
+
+       return 0;
+}
+
+s32 wl_cfg80211_get_connect_failed_status(struct net_device *dev, char* cmd, int total_len)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+       int bytes_written = 0;
+
+       if (cfg == NULL) {
+               return -1;
+       }
+
+       memset(cmd, 0, total_len);
+       bytes_written = snprintf(cmd, 30, "assoc_reject.status %d", cfg->assoc_reject_status);
+
+       WL_ERR(("cmd: %s \n", cmd));
+
+       return bytes_written;
+}
+#endif /* DHD_ENABLE_BIGDATA_LOGGING */
+
+static s32
+wl_get_auth_assoc_status(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *e)
+{
+       u32 reason = ntoh32(e->reason);
+       u32 event = ntoh32(e->event_type);
+       struct wl_security *sec = wl_read_prof(cfg, ndev, WL_PROF_SEC);
+       WL_DBG(("event type : %d, reason : %d\n", event, reason));
+
+#if defined(DHD_ENABLE_BIGDATA_LOGGING)
+       memcpy(&cfg->event_auth_assoc, e, sizeof(wl_event_msg_t));
+       WL_ERR(("event=%d status %d reason %d \n",
+               ntoh32(cfg->event_auth_assoc.event_type),
+               ntoh32(cfg->event_auth_assoc.status),
+               ntoh32(cfg->event_auth_assoc.reason)));
+#endif /* DHD_ENABLE_BIGDATA_LOGGING */
+       if (sec) {
+               switch (event) {
+               case WLC_E_ASSOC:
+               case WLC_E_AUTH:
+                               sec->auth_assoc_res_status = reason;
+               default:
+                       break;
+               }
+       } else
+               WL_ERR(("sec is NULL\n"));
+       return 0;
+}
+
+static s32
+wl_notify_connect_status_ibss(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *e, void *data)
+{
+       s32 err = 0;
+       u32 event = ntoh32(e->event_type);
+       u16 flags = ntoh16(e->flags);
+       u32 status =  ntoh32(e->status);
+       bool active;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0)
+       struct ieee80211_channel *channel = NULL;
+       struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+       u32 chanspec, chan;
+       u32 freq, band;
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0) */
+
+       if (event == WLC_E_JOIN) {
+               WL_DBG(("joined in IBSS network\n"));
+       }
+       if (event == WLC_E_START) {
+               WL_DBG(("started IBSS network\n"));
+       }
+       if (event == WLC_E_JOIN || event == WLC_E_START ||
+               (event == WLC_E_LINK && (flags == WLC_EVENT_MSG_LINK))) {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0)
+               err = wldev_iovar_getint(ndev, "chanspec", (s32 *)&chanspec);
+               if (unlikely(err)) {
+                       WL_ERR(("Could not get chanspec %d\n", err));
+                       return err;
+               }
+               chan = wf_chspec_ctlchan(wl_chspec_driver_to_host(chanspec));
+               band = (chan <= CH_MAX_2G_CHANNEL) ? IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ;
+               freq = ieee80211_channel_to_frequency(chan, band);
+               channel = ieee80211_get_channel(wiphy, freq);
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0) */
+               if (wl_get_drv_status(cfg, CONNECTED, ndev)) {
+                       /* ROAM or Redundant */
+                       u8 *cur_bssid = wl_read_prof(cfg, ndev, WL_PROF_BSSID);
+                       if (memcmp(cur_bssid, &e->addr, ETHER_ADDR_LEN) == 0) {
+                               WL_DBG(("IBSS connected event from same BSSID("
+                                       MACDBG "), ignore it\n", MAC2STRDBG(cur_bssid)));
+                               return err;
+                       }
+                       WL_INFORM(("IBSS BSSID is changed from " MACDBG " to " MACDBG "\n",
+                               MAC2STRDBG(cur_bssid), MAC2STRDBG((const u8 *)&e->addr)));
+                       wl_get_assoc_ies(cfg, ndev);
+                       wl_update_prof(cfg, ndev, NULL, (const void *)&e->addr, WL_PROF_BSSID);
+                       wl_update_bss_info(cfg, ndev, false);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0)
+                       cfg80211_ibss_joined(ndev, (const s8 *)&e->addr, channel, GFP_KERNEL);
+#else
+                       cfg80211_ibss_joined(ndev, (const s8 *)&e->addr, GFP_KERNEL);
+#endif
+               }
+               else {
+                       /* New connection */
+                       WL_INFORM(("IBSS connected to " MACDBG "\n",
+                               MAC2STRDBG((const u8 *)&e->addr)));
+                       wl_link_up(cfg);
+                       wl_get_assoc_ies(cfg, ndev);
+                       wl_update_prof(cfg, ndev, NULL, (const void *)&e->addr, WL_PROF_BSSID);
+                       wl_update_bss_info(cfg, ndev, false);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0)
+                       cfg80211_ibss_joined(ndev, (const s8 *)&e->addr, channel, GFP_KERNEL);
+#else
+                       cfg80211_ibss_joined(ndev, (const s8 *)&e->addr, GFP_KERNEL);
+#endif
+                       wl_set_drv_status(cfg, CONNECTED, ndev);
+                       active = true;
+                       wl_update_prof(cfg, ndev, NULL, (const void *)&active, WL_PROF_ACT);
+               }
+       } else if ((event == WLC_E_LINK && !(flags & WLC_EVENT_MSG_LINK)) ||
+               event == WLC_E_DEAUTH_IND || event == WLC_E_DISASSOC_IND) {
+               wl_clr_drv_status(cfg, CONNECTED, ndev);
+               wl_link_down(cfg);
+               wl_init_prof(cfg, ndev);
+       }
+       else if (event == WLC_E_SET_SSID && status == WLC_E_STATUS_NO_NETWORKS) {
+               WL_DBG(("no action - join fail (IBSS mode)\n"));
+       }
+       else {
+               WL_DBG(("no action (IBSS mode)\n"));
+}
+       return err;
+}
+
+#if defined(DHD_ENABLE_BIGDATA_LOGGING)
+#define WiFiALL_OUI         "\x50\x6F\x9A"  /* Wi-FiAll OUI */
+#define WiFiALL_OUI_LEN     3
+#define WiFiALL_OUI_TYPE    16
+
+int wl_get_bss_info(struct bcm_cfg80211 *cfg, struct net_device *dev, uint8 *mac)
+{
+       s32 err = 0;
+       struct wl_bss_info *bi;
+       uint8 eabuf[ETHER_ADDR_LEN];
+       u32 rate, channel, freq, supported_rate, nss = 0, mcs_map, mode_80211 = 0;
+       char rate_str[4];
+       u8 *ie = NULL;
+       u32 ie_len;
+       struct wiphy *wiphy;
+       struct cfg80211_bss *bss;
+       bcm_tlv_t *interworking_ie = NULL;
+       bcm_tlv_t *tlv_ie = NULL;
+       bcm_tlv_t *vht_ie = NULL;
+       vndr_ie_t *vndrie;
+       int16 ie_11u_rel_num = -1, ie_mu_mimo_cap = -1;
+       u32 i, remained_len, count = 0;
+       char roam_count_str[4], akm_str[4];
+       s32 val = 0;
+
+       /* get BSS information */
+
+       strncpy(cfg->bss_info, "x x x x x x x x x x x x x", GET_BSS_INFO_LEN);
+
+       *(u32 *) cfg->extra_buf = htod32(WL_EXTRA_BUF_MAX);
+
+       err = wldev_ioctl(dev, WLC_GET_BSS_INFO, cfg->extra_buf, WL_EXTRA_BUF_MAX, false);
+       if (unlikely(err)) {
+               WL_ERR(("Could not get bss info %d\n", err));
+               cfg->roam_count = 0;
+               return -1;
+       }
+
+       if (!mac) {
+               WL_ERR(("mac is null \n"));
+               cfg->roam_count = 0;
+               return -1;
+       }
+
+       memcpy(eabuf, mac, ETHER_ADDR_LEN);
+
+       bi = (struct wl_bss_info *)(cfg->extra_buf + 4);
+       channel = wf_chspec_ctlchan(bi->chanspec);
+
+#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 38) && !defined(WL_COMPAT_WIRELESS)
+       freq = ieee80211_channel_to_frequency(channel);
+#else
+       if (channel > 14) {
+               freq = ieee80211_channel_to_frequency(channel, IEEE80211_BAND_5GHZ);
+       } else {
+               freq = ieee80211_channel_to_frequency(channel, IEEE80211_BAND_2GHZ);
+       }
+#endif
+
+       err = wldev_ioctl(dev, WLC_GET_RATE, &rate, sizeof(rate), false);
+       if (err) {
+               WL_ERR(("Could not get rate (%d)\n", err));
+               snprintf(rate_str, sizeof(rate_str), "x"); // Unknown
+
+       } else {
+               rate = dtoh32(rate);
+               snprintf(rate_str, sizeof(rate_str), "%d", (rate/2));
+       }
+
+       //supported maximum rate
+       supported_rate = (bi->rateset.rates[bi->rateset.count - 1] & 0x7f) / 2;
+
+       if (supported_rate < 12) {
+               mode_80211 = 0; //11b maximum rate is 11Mbps. 11b mode
+       } else {
+               //It's not HT Capable case.
+               if (channel > 14) {
+                       mode_80211 = 3; // 11a mode
+               } else {
+                       mode_80211 = 1; // 11g mode
+               }
+       }
+
+       if (bi->n_cap) {
+               /* check Rx MCS Map for HT */
+               nss = 0;
+               mode_80211 = 2;
+               for (i = 0; i < MAX_STREAMS_SUPPORTED; i++) {
+                       int8 bitmap = 0xFF;
+                       if (i == MAX_STREAMS_SUPPORTED-1) {
+                               bitmap = 0x7F;
+                       }
+                       if (bi->basic_mcs[i] & bitmap) {
+                               nss++;
+                       }
+               }
+       }
+
+       if (bi->vht_cap) {
+               nss = 0;
+               mode_80211 = 4;
+               for (i = 1; i <= VHT_CAP_MCS_MAP_NSS_MAX; i++) {
+                       mcs_map = VHT_MCS_MAP_GET_MCS_PER_SS(i, dtoh16(bi->vht_rxmcsmap));
+                       if (mcs_map != VHT_CAP_MCS_MAP_NONE) {
+                               nss++;
+                       }
+               }
+       }
+
+       if (nss) {
+               nss = nss - 1;
+       }
+
+       wiphy = bcmcfg_to_wiphy(cfg);
+       bss = cfg80211_get_bss(wiphy, NULL, eabuf,
+                       bi->SSID, strlen(bi->SSID), WLAN_CAPABILITY_ESS,
+                       WLAN_CAPABILITY_ESS);
+
+       if (!bss) {
+               WL_ERR(("Could not find the AP\n"));
+       } else {
+#if defined(WL_CFG80211_P2P_DEV_IF)
+               ie = (u8 *)bss->ies->data;
+               ie_len = bss->ies->len;
+#else
+               ie = bss->information_elements;
+               ie_len = bss->len_information_elements;
+#endif /* WL_CFG80211_P2P_DEV_IF */
+       }
+
+       if (ie) {
+               ie_mu_mimo_cap = 0;
+               ie_11u_rel_num = 0;
+
+               if (bi->vht_cap) {
+                       if ((vht_ie = bcm_parse_tlvs(ie, (u32)ie_len,
+                                       DOT11_MNG_VHT_CAP_ID)) != NULL) {
+                               ie_mu_mimo_cap = (vht_ie->data[2] & 0x08) >> 3;
+                       }
+               }
+
+               if ((interworking_ie = bcm_parse_tlvs(ie, (u32)ie_len,
+                               DOT11_MNG_INTERWORKING_ID)) != NULL) {
+                       if ((tlv_ie = bcm_parse_tlvs(ie, (u32)ie_len, DOT11_MNG_VS_ID)) != NULL) {
+                               remained_len = ie_len;
+
+                               while (tlv_ie) {
+                                       if (count > MAX_VNDR_IE_NUMBER)
+                                               break;
+
+                                       if (tlv_ie->id == DOT11_MNG_VS_ID) {
+                                               vndrie = (vndr_ie_t *) tlv_ie;
+
+                                               if (vndrie->len < (VNDR_IE_MIN_LEN + 1)) {
+                                                       WL_ERR(("%s: invalid vndr ie."
+                                                               "length is too small %d\n",
+                                                               __FUNCTION__, vndrie->len));
+                                                       break;
+                                               }
+
+                                               if (!bcmp(vndrie->oui,
+                                                       (u8*)WiFiALL_OUI, WiFiALL_OUI_LEN) &&
+                                                       (vndrie->data[0] == WiFiALL_OUI_TYPE))
+                                               {
+                                                       WL_ERR(("Found Wi-FiAll OUI oui.\n"));
+                                                       ie_11u_rel_num = vndrie->data[1];
+                                                       ie_11u_rel_num = (ie_11u_rel_num & 0xf0)>>4;
+                                                       ie_11u_rel_num += 1;
+
+                                                       break;
+                                               }
+                                       }
+                                       count++;
+                                       tlv_ie = bcm_next_tlv(tlv_ie, &remained_len);
+                               }
+                       }
+               }
+       }
+
+       for (i = 0; i < bi->SSID_len; i++) {
+               if (bi->SSID[i] == ' ') {
+                       bi->SSID[i] = '_';
+               }
+       }
+
+       //0 : None, 1 : OKC, 2 : FT, 3 : CCKM
+       err = wldev_iovar_getint(dev, "wpa_auth", &val);
+       if (unlikely(err)) {
+               WL_ERR(("could not get wpa_auth (%d)\n", err));
+               snprintf(akm_str, sizeof(akm_str), "x"); // Unknown
+       } else {
+               WL_ERR(("wpa_auth val %d \n", val));
+#if defined(BCMEXTCCX)
+               if (val & (WPA_AUTH_CCKM | WPA2_AUTH_CCKM)) {
+                       snprintf(akm_str, sizeof(akm_str), "3");
+               } else
+#endif  
+               if (val & WPA2_AUTH_FT) {
+                       snprintf(akm_str, sizeof(akm_str), "2");
+               } else if (val & (WPA_AUTH_UNSPECIFIED | WPA2_AUTH_UNSPECIFIED)) {
+                       snprintf(akm_str, sizeof(akm_str), "1");
+               } else {
+                       snprintf(akm_str, sizeof(akm_str), "0");
+               }
+       }
+
+       if (cfg->roam_offload) {
+               snprintf(roam_count_str, sizeof(roam_count_str), "x"); // Unknown
+       } else {
+               snprintf(roam_count_str, sizeof(roam_count_str), "%d", cfg->roam_count);
+       }
+       cfg->roam_count = 0;
+
+       WL_ERR(("BSSID:" MACDBG " SSID %s \n", MAC2STRDBG(eabuf), bi->SSID));
+       WL_ERR(("freq:%d, BW:%s, RSSI:%d dBm, Rate:%d Mbps, 11mode:%d, stream:%d,"
+                               "MU-MIMO:%d, Passpoint:%d, SNR:%d, Noise:%d, \n"
+                               "akm:%s roam:%s \n",
+                               freq, wf_chspec_to_bw_str(bi->chanspec),
+                               dtoh32(bi->RSSI), (rate / 2), mode_80211, nss,
+                               ie_mu_mimo_cap, ie_11u_rel_num, bi->SNR, bi->phy_noise,
+                               akm_str, roam_count_str));
+
+       if (ie) {
+               snprintf(cfg->bss_info, GET_BSS_INFO_LEN,
+                               "%02x:%02x:%02x %d %s %d %s %d %d %d %d %d %d %s %s",
+                               eabuf[0], eabuf[1], eabuf[2],
+                               freq, wf_chspec_to_bw_str(bi->chanspec),
+                               dtoh32(bi->RSSI), rate_str, mode_80211, nss,
+                               ie_mu_mimo_cap, ie_11u_rel_num,
+                               bi->SNR, bi->phy_noise, akm_str, roam_count_str);
+       } else {
+               //ie_mu_mimo_cap and ie_11u_rel_num is unknow.
+               snprintf(cfg->bss_info, GET_BSS_INFO_LEN,
+                               "%02x:%02x:%02x %d %s %d %s %d %d x x %d %d %s %s",
+                               eabuf[0], eabuf[1], eabuf[2],
+                               freq, wf_chspec_to_bw_str(bi->chanspec),
+                               dtoh32(bi->RSSI), rate_str, mode_80211, nss,
+                               bi->SNR, bi->phy_noise, akm_str, roam_count_str);
+       }
+
+
+       return 0;
+}
+
+s32 wl_cfg80211_get_bss_info(struct net_device *dev, char* cmd, int total_len)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+
+       if (cfg == NULL) {
+               return -1;
+       }
+
+       memset(cmd, 0, total_len);
+       memcpy(cmd, cfg->bss_info, GET_BSS_INFO_LEN);
+
+       WL_ERR(("cmd: %s \n", cmd));
+
+       return GET_BSS_INFO_LEN;
+}
+
+#endif /* DHD_ENABLE_BIGDATA_LOGGING */
+
+static s32
+wl_notify_connect_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       bool act;
+       struct net_device *ndev = NULL;
+       s32 err = 0;
+       u32 event = ntoh32(e->event_type);
+       struct wiphy *wiphy = NULL;
+       struct cfg80211_bss *bss = NULL;
+       struct wlc_ssid *ssid = NULL;
+       u8 *bssid = 0;
+
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+       if (wl_get_mode_by_netdev(cfg, ndev) == WL_MODE_AP) {
+               err = wl_notify_connect_status_ap(cfg, ndev, e, data);
+       } else if (wl_get_mode_by_netdev(cfg, ndev) == WL_MODE_IBSS) {
+               err = wl_notify_connect_status_ibss(cfg, ndev, e, data);
+       } else if (wl_get_mode_by_netdev(cfg, ndev) == WL_MODE_BSS) {
+               WL_DBG(("wl_notify_connect_status : event %d status : %d ndev %p\n",
+                       ntoh32(e->event_type), ntoh32(e->status), ndev));
+               if (event == WLC_E_ASSOC || event == WLC_E_AUTH) {
+                       wl_get_auth_assoc_status(cfg, ndev, e);
+                       return 0;
+               }
+               DHD_DISABLE_RUNTIME_PM((dhd_pub_t *)cfg->pub);
+               if (wl_is_linkup(cfg, e, ndev)) {
+                       wl_link_up(cfg);
+                       act = true;
+                       if (!wl_get_drv_status(cfg, DISCONNECTING, ndev)) {
+#ifdef DHD_LOSSLESS_ROAMING
+                                       bool is_connected = wl_get_drv_status(cfg, CONNECTED, ndev);
+#endif
+
+                                       WL_ERR(("wl_bss_connect_done succeeded with " MACDBG "\n",
+                                               MAC2STRDBG((const u8*)(&e->addr))));
+                                       wl_bss_connect_done(cfg, ndev, e, data, true);
+                                       WL_DBG(("joined in BSS network \"%s\"\n",
+                                       ((struct wlc_ssid *)
+                                        wl_read_prof(cfg, ndev, WL_PROF_SSID))->SSID));
+#ifdef DHD_LOSSLESS_ROAMING
+                                       if (event == WLC_E_LINK && is_connected &&
+                                                       !cfg->roam_offload) {
+                                               wl_bss_roaming_done(cfg, ndev, e, data);
+                                       }
+#endif /* DHD_LOSSLESS_ROAMING */
+
+                               }
+                       wl_update_prof(cfg, ndev, e, &act, WL_PROF_ACT);
+                       wl_update_prof(cfg, ndev, NULL, (const void *)&e->addr, WL_PROF_BSSID);
+
+               } else if (wl_is_linkdown(cfg, e)) {
+#ifdef DHD_LOSSLESS_ROAMING
+                       wl_del_roam_timeout(cfg);
+#endif
+#ifdef P2PLISTEN_AP_SAMECHN
+                       if (ndev == bcmcfg_to_prmry_ndev(cfg)) {
+                               wl_cfg80211_set_p2p_resp_ap_chn(ndev, 0);
+                               cfg->p2p_resp_apchn_status = false;
+                               WL_DBG(("p2p_resp_apchn_status Turn OFF \n"));
+                       }
+#endif /* P2PLISTEN_AP_SAMECHN */
+                       wl_cfg80211_cancel_scan(cfg);
+
+#if defined(DHD_ENABLE_BIGDATA_LOGGING)
+                       if (wl_get_drv_status(cfg, CONNECTED, ndev)) {
+                               wl_get_bss_info(cfg, ndev, (u8*)(&e->addr));
+                       }
+#endif /* DHD_ENABLE_BIGDATA_LOGGING */
+                       /* Explicitly calling unlink to remove BSS in CFG */
+                       wiphy = bcmcfg_to_wiphy(cfg);
+                       ssid = (struct wlc_ssid *)wl_read_prof(cfg, ndev, WL_PROF_SSID);
+                       bssid = (u8 *)wl_read_prof(cfg, ndev, WL_PROF_BSSID);
+                       if (ssid && bssid) {
+                               bss = cfg80211_get_bss(wiphy, NULL, bssid,
+                                       ssid->SSID, ssid->SSID_len, WLAN_CAPABILITY_ESS,
+                                       WLAN_CAPABILITY_ESS);
+                               if (bss) {
+                                       cfg80211_unlink_bss(wiphy, bss);
+                               }
+                       }
+
+                       if (wl_get_drv_status(cfg, CONNECTED, ndev)) {
+                               scb_val_t scbval;
+                               u8 *curbssid = wl_read_prof(cfg, ndev, WL_PROF_BSSID);
+                               s32 reason = 0;
+                               struct ether_addr bssid_dongle;
+                               struct ether_addr bssid_null = {{0, 0, 0, 0, 0, 0}};
+
+                               if (event == WLC_E_DEAUTH_IND || event == WLC_E_DISASSOC_IND)
+                                       reason = ntoh32(e->reason);
+                               /* WLAN_REASON_UNSPECIFIED is used for hang up event in Android */
+                               reason = (reason == WLAN_REASON_UNSPECIFIED)? 0 : reason;
+
+                               WL_ERR(("link down if %s may call cfg80211_disconnected. "
+                                       "event : %d, reason=%d from " MACDBG "\n",
+                                       ndev->name, event, ntoh32(e->reason),
+                                       MAC2STRDBG((const u8*)(&e->addr))));
+
+                               /* roam offload does not sync BSSID always, get it from dongle */
+                               if (cfg->roam_offload) {
+                                       if (wldev_ioctl(ndev, WLC_GET_BSSID, &bssid_dongle,
+                                                       sizeof(bssid_dongle), false) == BCME_OK) {
+                                               /* if not roam case, it would return null bssid */
+                                               if (memcmp(&bssid_dongle, &bssid_null,
+                                                               ETHER_ADDR_LEN) != 0) {
+                                                       curbssid = (u8 *)&bssid_dongle;
+                                               }
+                                       }
+                               }
+                               if (memcmp(curbssid, &e->addr, ETHER_ADDR_LEN) != 0) {
+                                       bool fw_assoc_state = TRUE;
+                                       dhd_pub_t *dhd = (dhd_pub_t *)cfg->pub;
+                                       fw_assoc_state = dhd_is_associated(dhd, e->ifidx, &err);
+                                       if (!fw_assoc_state) {
+                                               WL_ERR(("Even sends up even different BSSID"
+                                                       " cur: " MACDBG " event: " MACDBG"\n",
+                                                       MAC2STRDBG(curbssid),
+                                                       MAC2STRDBG((const u8*)(&e->addr))));
+                                       } else {
+                                               WL_ERR(("BSSID of event is not the connected BSSID"
+                                                       "(ignore it) cur: " MACDBG
+                                                       " event: " MACDBG"\n",
+                                                       MAC2STRDBG(curbssid),
+                                                       MAC2STRDBG((const u8*)(&e->addr))));
+                                               return 0;
+                                       }
+                               }
+                               wl_clr_drv_status(cfg, CONNECTED, ndev);
+                               if (! wl_get_drv_status(cfg, DISCONNECTING, ndev)) {
+                                       /* To make sure disconnect, explictly send dissassoc
+                                       *  for BSSID 00:00:00:00:00:00 issue
+                                       */
+                                       scbval.val = WLAN_REASON_DEAUTH_LEAVING;
+
+                                       memcpy(&scbval.ea, curbssid, ETHER_ADDR_LEN);
+                                       scbval.val = htod32(scbval.val);
+                                       err = wldev_ioctl(ndev, WLC_DISASSOC, &scbval,
+                                               sizeof(scb_val_t), true);
+                                       if (err < 0) {
+                                               WL_ERR(("WLC_DISASSOC error %d\n", err));
+                                               err = 0;
+                                       }
+                                       CFG80211_DISCONNECTED(ndev, reason, NULL, 0,
+                                                       false, GFP_KERNEL);
+                                       wl_link_down(cfg);
+                                       wl_init_prof(cfg, ndev);
+                               }
+                       }
+                       else if (wl_get_drv_status(cfg, CONNECTING, ndev)) {
+                               WL_ERR(("link down, during connecting\n"));
+#ifdef ESCAN_RESULT_PATCH
+                               if ((memcmp(connect_req_bssid, broad_bssid, ETHER_ADDR_LEN) == 0) ||
+                                       (memcmp(&e->addr, broad_bssid, ETHER_ADDR_LEN) == 0) ||
+                                       (memcmp(&e->addr, connect_req_bssid, ETHER_ADDR_LEN) == 0))
+                                       /* In case this event comes while associating another AP */
+#endif /* ESCAN_RESULT_PATCH */
+                                       wl_bss_connect_done(cfg, ndev, e, data, false);
+                       }
+                       wl_clr_drv_status(cfg, DISCONNECTING, ndev);
+
+                       /* if link down, bsscfg is diabled */
+                       if (ndev != bcmcfg_to_prmry_ndev(cfg))
+                               complete(&cfg->iface_disable);
+
+               } else if (wl_is_nonetwork(cfg, e)) {
+                       WL_ERR(("connect failed event=%d e->status %d e->reason %d \n",
+                               event, (int)ntoh32(e->status), (int)ntoh32(e->reason)));
+#if defined(DHD_ENABLE_BIGDATA_LOGGING)
+                       if (event == WLC_E_SET_SSID) {
+                               wl_get_connect_failed_status(cfg, e);
+                       }
+#endif /* DHD_ENABLE_BIGDATA_LOGGING */
+                       /* Clean up any pending scan request */
+                       wl_cfg80211_cancel_scan(cfg);
+                       if (wl_get_drv_status(cfg, CONNECTING, ndev))
+                               wl_bss_connect_done(cfg, ndev, e, data, false);
+               } else {
+                       WL_DBG(("%s nothing\n", __FUNCTION__));
+               }
+               DHD_ENABLE_RUNTIME_PM((dhd_pub_t *)cfg->pub);
+       }
+               else {
+               WL_ERR(("Invalid ndev status %d\n", wl_get_mode_by_netdev(cfg, ndev)));
+       }
+       return err;
+}
+
+void wl_cfg80211_set_rmc_pid(struct net_device *dev, int pid)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+       if (pid > 0)
+               cfg->rmc_event_pid = pid;
+       WL_DBG(("set pid for rmc event : pid=%d\n", pid));
+}
+
+#ifdef WL_RELMCAST
+static s32
+wl_notify_rmc_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       u32 evt = ntoh32(e->event_type);
+       u32 reason = ntoh32(e->reason);
+       int ret = -1;
+
+       switch (reason) {
+               case WLC_E_REASON_RMC_AR_LOST:
+               case WLC_E_REASON_RMC_AR_NO_ACK:
+                       if (cfg->rmc_event_pid != 0) {
+                               ret = wl_netlink_send_msg(cfg->rmc_event_pid,
+                                       RMC_EVENT_LEADER_CHECK_FAIL,
+                                       cfg->rmc_event_seq++, NULL, 0);
+                       }
+                       break;
+               default:
+                       break;
+       }
+       WL_DBG(("rmcevent : evt=%d, pid=%d, ret=%d\n", evt, cfg->rmc_event_pid, ret));
+       return ret;
+}
+#endif /* WL_RELMCAST */
+static s32
+wl_notify_roaming_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       bool act;
+       struct net_device *ndev = NULL;
+       s32 err = 0;
+       u32 event = be32_to_cpu(e->event_type);
+       u32 status = be32_to_cpu(e->status);
+#ifdef DHD_LOSSLESS_ROAMING
+       struct wl_security *sec;
+#endif
+       WL_DBG(("Enter \n"));
+
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+       if ((!cfg->disable_roam_event) && (event == WLC_E_BSSID)) {
+               wl_add_remove_eventmsg(ndev, WLC_E_ROAM, false);
+               cfg->disable_roam_event = TRUE;
+       }
+
+       if ((cfg->disable_roam_event) && (event == WLC_E_ROAM))
+               return err;
+
+       if ((event == WLC_E_ROAM || event == WLC_E_BSSID) && status == WLC_E_STATUS_SUCCESS) {
+               if (wl_get_drv_status(cfg, CONNECTED, ndev)) {
+#ifdef DHD_LOSSLESS_ROAMING
+                       if (cfg->roam_offload) {
+                               wl_bss_roaming_done(cfg, ndev, e, data);
+                               wl_del_roam_timeout(cfg);
+                       }
+                       else {
+                               sec = wl_read_prof(cfg, ndev, WL_PROF_SEC);
+                               /* In order to reduce roaming delay, wl_bss_roaming_done is
+                                * early called with WLC_E_LINK event. It is called from
+                                * here only if WLC_E_LINK event is blocked for specific
+                                * security type.
+                                */
+                               if (IS_AKM_SUITE_FT(sec)) {
+                                       wl_bss_roaming_done(cfg, ndev, e, data);
+                               }
+                               /* Roam timer is deleted mostly from wl_cfg80211_change_station
+                                * after roaming is finished successfully. We need to delete
+                                * the timer from here only for some security types that aren't
+                                * using wl_cfg80211_change_station to authorize SCB
+                                */
+                               if (IS_AKM_SUITE_FT(sec) || IS_AKM_SUITE_CCKM(sec)) {
+                                       wl_del_roam_timeout(cfg);
+                               }
+                       }
+#else
+                       wl_bss_roaming_done(cfg, ndev, e, data);
+#endif /* DHD_LOSSLESS_ROAMING */
+               } else {
+                       wl_bss_connect_done(cfg, ndev, e, data, true);
+               }
+               act = true;
+               wl_update_prof(cfg, ndev, e, &act, WL_PROF_ACT);
+               wl_update_prof(cfg, ndev, NULL, (const void *)&e->addr, WL_PROF_BSSID);
+       }
+#ifdef DHD_LOSSLESS_ROAMING
+       else if ((event == WLC_E_ROAM || event == WLC_E_BSSID) && status != WLC_E_STATUS_SUCCESS) {
+               wl_del_roam_timeout(cfg);
+       }
+#endif
+       return err;
+}
+
+#ifdef QOS_MAP_SET
+/* up range from low to high with up value */
+static bool
+up_table_set(uint8 *up_table, uint8 up, uint8 low, uint8 high)
+{
+       int i;
+
+       if (up > 7 || low > high || low >= UP_TABLE_MAX || high >= UP_TABLE_MAX) {
+               return FALSE;
+       }
+
+       for (i = low; i <= high; i++) {
+               up_table[i] = up;
+       }
+
+       return TRUE;
+}
+
+/* set user priority table */
+static void
+wl_set_up_table(uint8 *up_table, bcm_tlv_t *qos_map_ie)
+{
+       uint8 len;
+
+       if (up_table == NULL || qos_map_ie == NULL) {
+               return;
+       }
+
+       /* clear table to check table was set or not */
+       memset(up_table, 0xff, UP_TABLE_MAX);
+
+       /* length of QoS Map IE must be 16+n*2, n is number of exceptions */
+       if (qos_map_ie != NULL && qos_map_ie->id == DOT11_MNG_QOS_MAP_ID &&
+                       (len = qos_map_ie->len) >= QOS_MAP_FIXED_LENGTH &&
+                       (len % 2) == 0) {
+               uint8 *except_ptr = (uint8 *)qos_map_ie->data;
+               uint8 except_len = len - QOS_MAP_FIXED_LENGTH;
+               uint8 *range_ptr = except_ptr + except_len;
+               int i;
+
+               /* fill in ranges */
+               for (i = 0; i < QOS_MAP_FIXED_LENGTH; i += 2) {
+                       uint8 low = range_ptr[i];
+                       uint8 high = range_ptr[i + 1];
+                       if (low == 255 && high == 255) {
+                               continue;
+                       }
+
+                       if (!up_table_set(up_table, i / 2, low, high)) {
+                               /* clear the table on failure */
+                               memset(up_table, 0xff, UP_TABLE_MAX);
+                               return;
+                       }
+               }
+
+               /* update exceptions */
+               for (i = 0; i < except_len; i += 2) {
+                       uint8 dscp = except_ptr[i];
+                       uint8 up = except_ptr[i+1];
+
+                       /* exceptions with invalid dscp/up are ignored */
+                       up_table_set(up_table, up, dscp, dscp);
+               }
+       }
+
+       if (wl_dbg_level & WL_DBG_DBG) {
+               prhex("UP table", up_table, UP_TABLE_MAX);
+       }
+}
+
+/* get user priority table */
+uint8 *
+wl_get_up_table(void *cfg80211_priv)
+{
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)cfg80211_priv;
+       return (uint8 *)(cfg->up_table);
+}
+#endif /* QOS_MAP_SET */
+
+#ifdef DHD_LOSSLESS_ROAMING
+static s32
+wl_notify_roam_prep_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       s32 err = 0;
+       struct wl_security *sec;
+       struct net_device *ndev;
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+       sec = wl_read_prof(cfg, ndev, WL_PROF_SEC);
+       /* Disable Lossless Roaming for specific AKM suite
+        * Any other AKM suite can be added below if transition time
+        * is delayed because of Lossless Roaming
+        * and it causes any certication failure
+        */
+       if (IS_AKM_SUITE_FT(sec)) {
+               return err;
+       }
+
+       dhdp->dequeue_prec_map = 1 << PRIO_8021D_NC;
+       /* Restore flow control  */
+       dhd_txflowcontrol(dhdp, ALL_INTERFACES, OFF);
+
+       mod_timer(&cfg->roam_timeout, jiffies + msecs_to_jiffies(WL_ROAM_TIMEOUT_MS));
+
+       return err;
+}
+#endif /* DHD_LOSSLESS_ROAMING */
+
+static s32
+wl_notify_idsup_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+               const wl_event_msg_t *e, void *data)
+{
+       s32 err = 0;
+#if defined(WL_VENDOR_EXT_SUPPORT)
+       u32 idsup_status;
+       u32 reason = ntoh32(e->reason);
+       struct net_device *ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+       struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+#endif /* defined(WL_VENDOR_EXT_SUPPORT) */
+
+       if (cfg->roam_offload) {
+#if defined(WL_VENDOR_EXT_SUPPORT)
+               switch (reason) {
+                       case WLC_E_SUP_WPA_PSK_TMO:
+                               idsup_status = IDSUP_EVENT_4WAY_HANDSHAKE_TIMEOUT;
+                               break;
+                       case WLC_E_SUP_OTHER:
+                               idsup_status = IDSUP_EVENT_SUCCESS;
+                               break;
+                       default:
+                               WL_ERR(("Other type at IDSUP. "
+                                               "event=%d e->status %d e->reason %d \n",
+                                               (int)ntoh32(e->event_type), (int)ntoh32(e->status),
+                                               (int)ntoh32(e->reason)));
+                               return err;
+               }
+
+               err = wl_cfgvendor_send_async_event(wiphy, ndev,
+                               BRCM_VENDOR_EVENT_IDSUP_STATUS, &idsup_status, sizeof(u32));
+#endif /* defined(WL_VENDOR_EXT_SUPPORT) */
+       }
+       return err;
+}
+
+#ifdef CUSTOM_EVENT_PM_WAKE
+static s32
+wl_check_pmstatus(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+               const wl_event_msg_t *e, void *data)
+{
+       s32 err = 0;
+       struct net_device *ndev = NULL;
+       u8 *pbuf = NULL;
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+       pbuf = kzalloc(WLC_IOCTL_MEDLEN, GFP_KERNEL);
+       if (pbuf == NULL) {
+               WL_ERR(("failed to allocate local pbuf\n"));
+               return -ENOMEM;
+       }
+
+       err = wldev_iovar_getbuf_bsscfg(ndev, "dump",
+               "pm", strlen("pm"), pbuf, WLC_IOCTL_MEDLEN, 0, &cfg->ioctl_buf_sync);
+
+       if (err) {
+               WL_ERR(("dump ioctl err = %d", err));
+       } else {
+               WL_ERR(("PM status : %s\n", pbuf));
+       }
+
+       if (pbuf) {
+               kfree(pbuf);
+       }
+       return err;
+}
+#endif /* CUSTOM_EVENT_PM_WAKE */
+
+#ifdef ENABLE_TEMP_THROTTLING
+static s32
+wl_check_rx_throttle_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       s32 err = 0;
+       u32 status = ntoh32(e->status);
+       u32 reason = ntoh32(e->reason);
+
+       WL_ERR(("RX THROTTLE : status=%d, reason=0x%x\n", status, reason));
+
+       return err;
+}
+#endif /* ENABLE_TEMP_THROTTLING */
+
+static s32 wl_get_assoc_ies(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+       wl_assoc_info_t assoc_info;
+       struct wl_connect_info *conn_info = wl_to_conn(cfg);
+       s32 err = 0;
+#ifdef QOS_MAP_SET
+       bcm_tlv_t * qos_map_ie = NULL;
+#endif /* QOS_MAP_SET */
+
+       WL_DBG(("Enter \n"));
+       err = wldev_iovar_getbuf(ndev, "assoc_info", NULL, 0, cfg->extra_buf,
+               WL_ASSOC_INFO_MAX, NULL);
+       if (unlikely(err)) {
+               WL_ERR(("could not get assoc info (%d)\n", err));
+               return err;
+       }
+       memcpy(&assoc_info, cfg->extra_buf, sizeof(wl_assoc_info_t));
+       assoc_info.req_len = htod32(assoc_info.req_len);
+       assoc_info.resp_len = htod32(assoc_info.resp_len);
+       assoc_info.flags = htod32(assoc_info.flags);
+       if (conn_info->req_ie_len) {
+               conn_info->req_ie_len = 0;
+               bzero(conn_info->req_ie, sizeof(conn_info->req_ie));
+       }
+       if (conn_info->resp_ie_len) {
+               conn_info->resp_ie_len = 0;
+               bzero(conn_info->resp_ie, sizeof(conn_info->resp_ie));
+       }
+       if (assoc_info.req_len) {
+               err = wldev_iovar_getbuf(ndev, "assoc_req_ies", NULL, 0, cfg->extra_buf,
+                       WL_ASSOC_INFO_MAX, NULL);
+               if (unlikely(err)) {
+                       WL_ERR(("could not get assoc req (%d)\n", err));
+                       return err;
+               }
+               conn_info->req_ie_len = assoc_info.req_len - sizeof(struct dot11_assoc_req);
+               if (assoc_info.flags & WLC_ASSOC_REQ_IS_REASSOC) {
+                       conn_info->req_ie_len -= ETHER_ADDR_LEN;
+               }
+               if (conn_info->req_ie_len <= MAX_REQ_LINE)
+                       memcpy(conn_info->req_ie, cfg->extra_buf, conn_info->req_ie_len);
+               else {
+                       WL_ERR(("IE size %d above max %d size \n",
+                               conn_info->req_ie_len, MAX_REQ_LINE));
+                       return err;
+               }
+       } else {
+               conn_info->req_ie_len = 0;
+       }
+       if (assoc_info.resp_len) {
+               err = wldev_iovar_getbuf(ndev, "assoc_resp_ies", NULL, 0, cfg->extra_buf,
+                       WL_ASSOC_INFO_MAX, NULL);
+               if (unlikely(err)) {
+                       WL_ERR(("could not get assoc resp (%d)\n", err));
+                       return err;
+               }
+               conn_info->resp_ie_len = assoc_info.resp_len -sizeof(struct dot11_assoc_resp);
+               if (conn_info->resp_ie_len <= MAX_REQ_LINE) {
+                       memcpy(conn_info->resp_ie, cfg->extra_buf, conn_info->resp_ie_len);
+               } else {
+                       WL_ERR(("IE size %d above max %d size \n",
+                               conn_info->resp_ie_len, MAX_REQ_LINE));
+                       return err;
+               }
+
+#ifdef QOS_MAP_SET
+               /* find qos map set ie */
+               if ((qos_map_ie = bcm_parse_tlvs(conn_info->resp_ie, conn_info->resp_ie_len,
+                               DOT11_MNG_QOS_MAP_ID)) != NULL) {
+                       WL_DBG((" QoS map set IE found in assoc response\n"));
+                       if (!cfg->up_table) {
+                               cfg->up_table = kmalloc(UP_TABLE_MAX, GFP_KERNEL);
+                       }
+                       wl_set_up_table(cfg->up_table, qos_map_ie);
+               } else {
+                       kfree(cfg->up_table);
+                       cfg->up_table = NULL;
+               }
+#endif /* QOS_MAP_SET */
+       } else {
+               conn_info->resp_ie_len = 0;
+       }
+       WL_DBG(("req len (%d) resp len (%d)\n", conn_info->req_ie_len,
+               conn_info->resp_ie_len));
+
+       return err;
+}
+
+static s32 wl_ch_to_chanspec(struct net_device *dev, int ch, struct wl_join_params *join_params,
+        size_t *join_params_size)
+{
+       struct bcm_cfg80211 *cfg;
+       s32 bssidx = -1;
+       chanspec_t chanspec = 0, chspec;
+
+       if (ch != 0) {
+               cfg = (struct bcm_cfg80211 *)wiphy_priv(dev->ieee80211_ptr->wiphy);
+               if (cfg && cfg->rcc_enabled) {
+               } else {
+                       join_params->params.chanspec_num = 1;
+                       join_params->params.chanspec_list[0] = ch;
+
+                       if (join_params->params.chanspec_list[0] <= CH_MAX_2G_CHANNEL)
+                               chanspec |= WL_CHANSPEC_BAND_2G;
+                       else
+                               chanspec |= WL_CHANSPEC_BAND_5G;
+
+                       /* Get the min_bw set for the interface */
+                       chspec = wl_cfg80211_ulb_get_min_bw_chspec(dev->ieee80211_ptr, bssidx);
+                       if (chspec == INVCHANSPEC) {
+                               WL_ERR(("Invalid chanspec \n"));
+                               return -EINVAL;
+                       }
+                       chanspec |= chspec;
+                       chanspec |= WL_CHANSPEC_CTL_SB_NONE;
+
+                       *join_params_size += WL_ASSOC_PARAMS_FIXED_SIZE +
+                               join_params->params.chanspec_num * sizeof(chanspec_t);
+
+                       join_params->params.chanspec_list[0]  &= WL_CHANSPEC_CHAN_MASK;
+                       join_params->params.chanspec_list[0] |= chanspec;
+                       join_params->params.chanspec_list[0] =
+                               wl_chspec_host_to_driver(join_params->params.chanspec_list[0]);
+
+                       join_params->params.chanspec_num =
+                               htod32(join_params->params.chanspec_num);
+               }
+
+               WL_DBG(("join_params->params.chanspec_list[0]= %X, %d channels\n",
+                       join_params->params.chanspec_list[0],
+                       join_params->params.chanspec_num));
+       }
+       return 0;
+}
+
+static s32 wl_update_bss_info(struct bcm_cfg80211 *cfg, struct net_device *ndev, bool roam)
+{
+       struct wl_bss_info *bi;
+       struct bcm_tlv *tim;
+       s32 beacon_interval;
+       s32 dtim_period;
+       size_t ie_len;
+       u8 *ie;
+       u8 *curbssid;
+       s32 err = 0;
+       u32 channel;
+
+       curbssid = wl_read_prof(cfg, ndev, WL_PROF_BSSID);
+
+       mutex_lock(&cfg->usr_sync);
+
+       *(u32 *) cfg->extra_buf = htod32(WL_EXTRA_BUF_MAX);
+       err = wldev_ioctl(ndev, WLC_GET_BSS_INFO,
+               cfg->extra_buf, WL_EXTRA_BUF_MAX, false);
+       if (unlikely(err)) {
+               WL_ERR(("Could not get bss info %d\n", err));
+               goto update_bss_info_out;
+       }
+       bi = (struct wl_bss_info *)(cfg->extra_buf + 4);
+       channel = wf_chspec_ctlchan(wl_chspec_driver_to_host(bi->chanspec));
+       wl_update_prof(cfg, ndev, NULL, &channel, WL_PROF_CHAN);
+
+       if (memcmp(bi->BSSID.octet, curbssid, ETHER_ADDR_LEN)) {
+               WL_ERR(("Bssid doesn't match\n"));
+               err = -EIO;
+               goto update_bss_info_out;
+       }
+       err = wl_inform_single_bss(cfg, bi, roam);
+       if (unlikely(err))
+               goto update_bss_info_out;
+
+       ie = ((u8 *)bi) + bi->ie_offset;
+       ie_len = bi->ie_length;
+       beacon_interval = cpu_to_le16(bi->beacon_period);
+       tim = bcm_parse_tlvs(ie, ie_len, WLAN_EID_TIM);
+       if (tim) {
+               dtim_period = tim->data[1];
+       } else {
+               /*
+               * active scan was done so we could not get dtim
+               * information out of probe response.
+               * so we speficially query dtim information.
+               */
+               err = wldev_ioctl(ndev, WLC_GET_DTIMPRD,
+                       &dtim_period, sizeof(dtim_period), false);
+               if (unlikely(err)) {
+                       WL_ERR(("WLC_GET_DTIMPRD error (%d)\n", err));
+                       goto update_bss_info_out;
+               }
+       }
+
+       wl_update_prof(cfg, ndev, NULL, &beacon_interval, WL_PROF_BEACONINT);
+       wl_update_prof(cfg, ndev, NULL, &dtim_period, WL_PROF_DTIMPERIOD);
+
+update_bss_info_out:
+       if (unlikely(err)) {
+               WL_ERR(("Failed with error %d\n", err));
+       }
+       mutex_unlock(&cfg->usr_sync);
+       return err;
+}
+
+static s32
+wl_bss_roaming_done(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *e, void *data)
+{
+       struct wl_connect_info *conn_info = wl_to_conn(cfg);
+       s32 err = 0;
+       u8 *curbssid;
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)) || defined(WL_COMPAT_WIRELESS)
+       struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+       struct ieee80211_supported_band *band;
+       struct ieee80211_channel *notify_channel = NULL;
+       u32 *channel;
+       u32 freq;
+#endif /* LINUX_VERSION > 2.6.39 || WL_COMPAT_WIRELESS */
+
+
+       if (memcmp(&cfg->last_roamed_addr, &e->addr, ETHER_ADDR_LEN) == 0) {
+               WL_INFORM(("BSSID already updated\n"));
+               return err;
+       }
+
+       /* Skip calling cfg80211_roamed If current bssid and
+        * roamed bssid are same. Also clear timer roam_timeout.
+        */
+       curbssid = wl_read_prof(cfg, ndev, WL_PROF_BSSID);
+       if (memcmp(curbssid, &e->addr, ETHER_ADDR_LEN) == 0) {
+               WL_ERR(("BSS already present, Skipping roamed event to upper layer\n"));
+#ifdef DHD_LOSSLESS_ROAMING
+               wl_del_roam_timeout(cfg);
+#endif  /* DHD_LOSSLESS_ROAMING */
+               return  err;
+       }
+
+       wl_get_assoc_ies(cfg, ndev);
+       wl_update_prof(cfg, ndev, NULL, (const void *)(e->addr.octet), WL_PROF_BSSID);
+       curbssid = wl_read_prof(cfg, ndev, WL_PROF_BSSID);
+       wl_update_bss_info(cfg, ndev, true);
+       wl_update_pmklist(ndev, cfg->pmk_list, err);
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)) || defined(WL_COMPAT_WIRELESS)
+       /* channel info for cfg80211_roamed introduced in 2.6.39-rc1 */
+       channel = (u32 *)wl_read_prof(cfg, ndev, WL_PROF_CHAN);
+       if (*channel <= CH_MAX_2G_CHANNEL)
+               band = wiphy->bands[IEEE80211_BAND_2GHZ];
+       else
+               band = wiphy->bands[IEEE80211_BAND_5GHZ];
+       freq = ieee80211_channel_to_frequency(*channel, band->band);
+       notify_channel = ieee80211_get_channel(wiphy, freq);
+#endif /* LINUX_VERSION > 2.6.39  || WL_COMPAT_WIRELESS */
+       WL_ERR(("wl_bss_roaming_done succeeded to " MACDBG "\n",
+               MAC2STRDBG((const u8*)(&e->addr))));
+
+       cfg80211_roamed(ndev,
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)) || defined(WL_COMPAT_WIRELESS)
+               notify_channel,
+#endif
+               curbssid,
+               conn_info->req_ie, conn_info->req_ie_len,
+               conn_info->resp_ie, conn_info->resp_ie_len, GFP_KERNEL);
+       WL_DBG(("Report roaming result\n"));
+
+       memcpy(&cfg->last_roamed_addr, (void *)&e->addr, ETHER_ADDR_LEN);
+       wl_set_drv_status(cfg, CONNECTED, ndev);
+
+#if defined(DHD_ENABLE_BIGDATA_LOGGING)
+       cfg->roam_count++;
+#endif /* DHD_ENABLE_BIGDATA_LOGGING */
+
+       return err;
+}
+
+static s32
+wl_bss_connect_done(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *e, void *data, bool completed)
+{
+       struct wl_connect_info *conn_info = wl_to_conn(cfg);
+       struct wl_security *sec = wl_read_prof(cfg, ndev, WL_PROF_SEC);
+#if defined(CUSTOM_SET_CPUCORE)
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+#endif 
+       s32 err = 0;
+       u8 *curbssid = wl_read_prof(cfg, ndev, WL_PROF_BSSID);
+       if (!sec) {
+               WL_ERR(("sec is NULL\n"));
+               return -ENODEV;
+       }
+       WL_DBG((" enter\n"));
+#ifdef ESCAN_RESULT_PATCH
+       if (wl_get_drv_status(cfg, CONNECTED, ndev)) {
+               if (memcmp(curbssid, connect_req_bssid, ETHER_ADDR_LEN) == 0) {
+                       WL_DBG((" Connected event of connected device e=%d s=%d, ignore it\n",
+                               ntoh32(e->event_type), ntoh32(e->status)));
+                       return err;
+               }
+       }
+       if (memcmp(curbssid, broad_bssid, ETHER_ADDR_LEN) == 0 &&
+               memcmp(broad_bssid, connect_req_bssid, ETHER_ADDR_LEN) != 0) {
+               WL_DBG(("copy bssid\n"));
+               memcpy(curbssid, connect_req_bssid, ETHER_ADDR_LEN);
+       }
+
+#else
+       if (cfg->scan_request) {
+               wl_notify_escan_complete(cfg, ndev, true, true);
+       }
+#endif /* ESCAN_RESULT_PATCH */
+       if (wl_get_drv_status(cfg, CONNECTING, ndev)) {
+               wl_cfg80211_scan_abort(cfg);
+               wl_clr_drv_status(cfg, CONNECTING, ndev);
+               if (completed) {
+                       wl_get_assoc_ies(cfg, ndev);
+                       wl_update_prof(cfg, ndev, NULL, (const void *)(e->addr.octet),
+                               WL_PROF_BSSID);
+                       curbssid = wl_read_prof(cfg, ndev, WL_PROF_BSSID);
+                       wl_update_bss_info(cfg, ndev, false);
+                       wl_update_pmklist(ndev, cfg->pmk_list, err);
+                       wl_set_drv_status(cfg, CONNECTED, ndev);
+                       if (ndev != bcmcfg_to_prmry_ndev(cfg)) {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0)
+                               init_completion(&cfg->iface_disable);
+#else
+                               /* reinitialize completion to clear previous count */
+                               INIT_COMPLETION(cfg->iface_disable);
+#endif
+                       }
+#ifdef CUSTOM_SET_CPUCORE
+                       if (wl_get_chan_isvht80(ndev, dhd)) {
+                               if (ndev == bcmcfg_to_prmry_ndev(cfg))
+                                       dhd->chan_isvht80 |= DHD_FLAG_STA_MODE; /* STA mode */
+                               else if (is_p2p_group_iface(ndev->ieee80211_ptr))
+                                       dhd->chan_isvht80 |= DHD_FLAG_P2P_MODE; /* p2p mode */
+                               dhd_set_cpucore(dhd, TRUE);
+                       }
+#endif /* CUSTOM_SET_CPUCORE */
+                       memset(&cfg->last_roamed_addr, 0, ETHER_ADDR_LEN);
+               }
+               cfg80211_connect_result(ndev,
+                       curbssid,
+                       conn_info->req_ie,
+                       conn_info->req_ie_len,
+                       conn_info->resp_ie,
+                       conn_info->resp_ie_len,
+                       completed ? WLAN_STATUS_SUCCESS :
+                       (sec->auth_assoc_res_status) ?
+                       sec->auth_assoc_res_status :
+                       WLAN_STATUS_UNSPECIFIED_FAILURE,
+                       GFP_KERNEL);
+               if (completed)
+                       WL_INFORM(("Report connect result - connection succeeded\n"));
+               else
+                       WL_ERR(("Report connect result - connection failed\n"));
+       }
+#ifdef CONFIG_TCPACK_FASTTX
+       if (wl_get_chan_isvht80(ndev, dhd))
+               wldev_iovar_setint(ndev, "tcpack_fast_tx", 0);
+       else
+               wldev_iovar_setint(ndev, "tcpack_fast_tx", 1);
+#endif /* CONFIG_TCPACK_FASTTX */
+
+       return err;
+}
+
+static s32
+wl_notify_mic_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       struct net_device *ndev = NULL;
+       u16 flags = ntoh16(e->flags);
+       enum nl80211_key_type key_type;
+
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+       mutex_lock(&cfg->usr_sync);
+       if (flags & WLC_EVENT_MSG_GROUP)
+               key_type = NL80211_KEYTYPE_GROUP;
+       else
+               key_type = NL80211_KEYTYPE_PAIRWISE;
+
+       cfg80211_michael_mic_failure(ndev, (const u8 *)&e->addr, key_type, -1,
+               NULL, GFP_KERNEL);
+       mutex_unlock(&cfg->usr_sync);
+
+       return 0;
+}
+
+#ifdef BT_WIFI_HANDOVER
+static s32
+wl_notify_bt_wifi_handover_req(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       struct net_device *ndev = NULL;
+       u32 event = ntoh32(e->event_type);
+       u32 datalen = ntoh32(e->datalen);
+       s32 err;
+
+       WL_ERR(("wl_notify_bt_wifi_handover_req: event_type : %d, datalen : %d\n", event, datalen));
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+       err = wl_genl_send_msg(ndev, event, data, (u16)datalen, 0, 0);
+
+       return err;
+}
+#endif /* BT_WIFI_HANDOVER */
+
+#ifdef PNO_SUPPORT
+static s32
+wl_notify_pfn_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       struct net_device *ndev = NULL;
+
+       WL_ERR((">>> PNO Event\n"));
+
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+#ifndef WL_SCHED_SCAN
+       mutex_lock(&cfg->usr_sync);
+       /* TODO: Use cfg80211_sched_scan_results(wiphy); */
+       CFG80211_DISCONNECTED(ndev, 0, NULL, 0, false, GFP_KERNEL);
+       mutex_unlock(&cfg->usr_sync);
+#else
+       /* If cfg80211 scheduled scan is supported, report the pno results via sched
+        * scan results
+        */
+       wl_notify_sched_scan_results(cfg, ndev, e, data);
+#endif /* WL_SCHED_SCAN */
+       return 0;
+}
+#endif /* PNO_SUPPORT */
+
+#ifdef GSCAN_SUPPORT
+static s32
+wl_notify_gscan_event(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       s32 err = 0;
+       u32 event = be32_to_cpu(e->event_type);
+       void *ptr;
+       int send_evt_bytes = 0;
+       int batch_event_result_dummy = 0;
+       struct net_device *ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+       struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+       u32 len = ntoh32(e->datalen);
+
+       switch (event) {
+               case WLC_E_PFN_SWC:
+                       ptr = dhd_dev_swc_scan_event(ndev, data, &send_evt_bytes);
+                       if (send_evt_bytes) {
+                               wl_cfgvendor_send_async_event(wiphy, ndev,
+                                   GOOGLE_GSCAN_SIGNIFICANT_EVENT, ptr, send_evt_bytes);
+                               kfree(ptr);
+                       }
+                       break;
+               case WLC_E_PFN_BEST_BATCHING:
+                       err = dhd_dev_retrieve_batch_scan(ndev);
+                       if (err < 0) {
+                               WL_ERR(("Batch retrieval already in progress %d\n", err));
+                       } else {
+                               wl_cfgvendor_send_async_event(wiphy, ndev,
+                                   GOOGLE_GSCAN_BATCH_SCAN_EVENT,
+                                    &batch_event_result_dummy, sizeof(int));
+                       }
+                       break;
+               case WLC_E_PFN_SCAN_COMPLETE:
+                       batch_event_result_dummy = WIFI_SCAN_COMPLETE;
+                       wl_cfgvendor_send_async_event(wiphy, ndev,
+                               GOOGLE_SCAN_COMPLETE_EVENT,
+                               &batch_event_result_dummy, sizeof(int));
+                       break;
+               case WLC_E_PFN_BSSID_NET_FOUND:
+                       ptr = dhd_dev_hotlist_scan_event(ndev, data, &send_evt_bytes,
+                             HOTLIST_FOUND);
+                       if (ptr) {
+                               wl_cfgvendor_send_hotlist_event(wiphy, ndev,
+                                ptr, send_evt_bytes, GOOGLE_GSCAN_GEOFENCE_FOUND_EVENT);
+                               dhd_dev_gscan_hotlist_cache_cleanup(ndev, HOTLIST_FOUND);
+                       }
+                       break;
+               case WLC_E_PFN_BSSID_NET_LOST:
+                       /* WLC_E_PFN_BSSID_NET_LOST is conflict shared with WLC_E_PFN_SCAN_ALLGONE
+                        * We currently do not use WLC_E_PFN_SCAN_ALLGONE, so if we get it, ignore
+                        */
+                       if (len) {
+                               ptr = dhd_dev_hotlist_scan_event(ndev, data, &send_evt_bytes,
+                                           HOTLIST_LOST);
+                               if (ptr) {
+                                       wl_cfgvendor_send_hotlist_event(wiphy, ndev,
+                                        ptr, send_evt_bytes, GOOGLE_GSCAN_GEOFENCE_LOST_EVENT);
+                                       dhd_dev_gscan_hotlist_cache_cleanup(ndev, HOTLIST_LOST);
+                               }
+                       }
+                       break;
+               case WLC_E_PFN_GSCAN_FULL_RESULT:
+                       ptr = dhd_dev_process_full_gscan_result(ndev, data, &send_evt_bytes);
+                       if (ptr) {
+                               wl_cfgvendor_send_async_event(wiphy, ndev,
+                                   GOOGLE_SCAN_FULL_RESULTS_EVENT, ptr, send_evt_bytes);
+                               kfree(ptr);
+                       }
+                       break;
+               default:
+                       WL_ERR(("%s: Unexpected event! - %d\n", __FUNCTION__, event));
+
+       }
+       return err;
+}
+#endif /* GSCAN_SUPPORT */
+
+static s32
+wl_notify_scan_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       struct channel_info channel_inform;
+       struct wl_scan_results *bss_list;
+       struct net_device *ndev = NULL;
+       u32 len = WL_SCAN_BUF_MAX;
+       s32 err = 0;
+       unsigned long flags;
+
+       WL_DBG(("Enter \n"));
+       if (!wl_get_drv_status(cfg, SCANNING, ndev)) {
+               WL_ERR(("scan is not ready \n"));
+               return err;
+       }
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+       mutex_lock(&cfg->usr_sync);
+       wl_clr_drv_status(cfg, SCANNING, ndev);
+       err = wldev_ioctl(ndev, WLC_GET_CHANNEL, &channel_inform,
+               sizeof(channel_inform), false);
+       if (unlikely(err)) {
+               WL_ERR(("scan busy (%d)\n", err));
+               goto scan_done_out;
+       }
+       channel_inform.scan_channel = dtoh32(channel_inform.scan_channel);
+       if (unlikely(channel_inform.scan_channel)) {
+
+               WL_DBG(("channel_inform.scan_channel (%d)\n",
+                       channel_inform.scan_channel));
+       }
+       cfg->bss_list = cfg->scan_results;
+       bss_list = cfg->bss_list;
+       memset(bss_list, 0, len);
+       bss_list->buflen = htod32(len);
+       err = wldev_ioctl(ndev, WLC_SCAN_RESULTS, bss_list, len, false);
+       if (unlikely(err) && unlikely(!cfg->scan_suppressed)) {
+               WL_ERR(("%s Scan_results error (%d)\n", ndev->name, err));
+               err = -EINVAL;
+               goto scan_done_out;
+       }
+       bss_list->buflen = dtoh32(bss_list->buflen);
+       bss_list->version = dtoh32(bss_list->version);
+       bss_list->count = dtoh32(bss_list->count);
+
+       err = wl_inform_bss(cfg);
+
+scan_done_out:
+       del_timer_sync(&cfg->scan_timeout);
+       spin_lock_irqsave(&cfg->cfgdrv_lock, flags);
+       if (cfg->scan_request) {
+               cfg80211_scan_done(cfg->scan_request, false);
+               cfg->scan_request = NULL;
+       }
+       spin_unlock_irqrestore(&cfg->cfgdrv_lock, flags);
+       WL_DBG(("cfg80211_scan_done\n"));
+       mutex_unlock(&cfg->usr_sync);
+       return err;
+}
+
+static s32
+wl_frame_get_mgmt(u16 fc, const struct ether_addr *da,
+       const struct ether_addr *sa, const struct ether_addr *bssid,
+       u8 **pheader, u32 *body_len, u8 *pbody)
+{
+       struct dot11_management_header *hdr;
+       u32 totlen = 0;
+       s32 err = 0;
+       u8 *offset;
+       u32 prebody_len = *body_len;
+       switch (fc) {
+               case FC_ASSOC_REQ:
+                       /* capability , listen interval */
+                       totlen = DOT11_ASSOC_REQ_FIXED_LEN;
+                       *body_len += DOT11_ASSOC_REQ_FIXED_LEN;
+                       break;
+
+               case FC_REASSOC_REQ:
+                       /* capability, listen inteval, ap address */
+                       totlen = DOT11_REASSOC_REQ_FIXED_LEN;
+                       *body_len += DOT11_REASSOC_REQ_FIXED_LEN;
+                       break;
+       }
+       totlen += DOT11_MGMT_HDR_LEN + prebody_len;
+       *pheader = kzalloc(totlen, GFP_KERNEL);
+       if (*pheader == NULL) {
+               WL_ERR(("memory alloc failed \n"));
+               return -ENOMEM;
+       }
+       hdr = (struct dot11_management_header *) (*pheader);
+       hdr->fc = htol16(fc);
+       hdr->durid = 0;
+       hdr->seq = 0;
+       offset = (u8*)(hdr + 1) + (totlen - DOT11_MGMT_HDR_LEN - prebody_len);
+       bcopy((const char*)da, (u8*)&hdr->da, ETHER_ADDR_LEN);
+       bcopy((const char*)sa, (u8*)&hdr->sa, ETHER_ADDR_LEN);
+       bcopy((const char*)bssid, (u8*)&hdr->bssid, ETHER_ADDR_LEN);
+       if ((pbody != NULL) && prebody_len)
+               bcopy((const char*)pbody, offset, prebody_len);
+       *body_len = totlen;
+       return err;
+}
+
+
+void
+wl_stop_wait_next_action_frame(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+       if (wl_get_drv_status_all(cfg, FINDING_COMMON_CHANNEL)) {
+               if (timer_pending(&cfg->p2p->listen_timer)) {
+                       del_timer_sync(&cfg->p2p->listen_timer);
+               }
+               if (cfg->afx_hdl != NULL) {
+                       if (cfg->afx_hdl->dev != NULL) {
+                               wl_clr_drv_status(cfg, SCANNING, cfg->afx_hdl->dev);
+                               wl_clr_drv_status(cfg, FINDING_COMMON_CHANNEL, cfg->afx_hdl->dev);
+                       }
+                       cfg->afx_hdl->peer_chan = WL_INVALID;
+               }
+               complete(&cfg->act_frm_scan);
+               WL_DBG(("*** Wake UP ** Working afx searching is cleared\n"));
+       } else if (wl_get_drv_status_all(cfg, SENDING_ACT_FRM)) {
+               if (!(wl_get_p2p_status(cfg, ACTION_TX_COMPLETED) ||
+                       wl_get_p2p_status(cfg, ACTION_TX_NOACK)))
+                       wl_set_p2p_status(cfg, ACTION_TX_COMPLETED);
+
+               WL_DBG(("*** Wake UP ** abort actframe iovar\n"));
+               /* if channel is not zero, "actfame" uses off channel scan.
+                * So abort scan for off channel completion.
+                */
+               if (cfg->af_sent_channel)
+                       wl_cfg80211_scan_abort(cfg);
+       }
+#ifdef WL_CFG80211_SYNC_GON
+       else if (wl_get_drv_status_all(cfg, WAITING_NEXT_ACT_FRM_LISTEN)) {
+               WL_DBG(("*** Wake UP ** abort listen for next af frame\n"));
+               /* So abort scan to cancel listen */
+               wl_cfg80211_scan_abort(cfg);
+       }
+#endif /* WL_CFG80211_SYNC_GON */
+}
+
+#if defined(WLTDLS)
+bool wl_cfg80211_is_tdls_tunneled_frame(void *frame, u32 frame_len)
+{
+       unsigned char *data;
+
+       if (frame == NULL) {
+               WL_ERR(("Invalid frame \n"));
+               return false;
+       }
+
+       if (frame_len < 5) {
+               WL_ERR(("Invalid frame length [%d] \n", frame_len));
+               return false;
+       }
+
+       data = frame;
+
+       if (!memcmp(data, TDLS_TUNNELED_PRB_REQ, 5) ||
+               !memcmp(data, TDLS_TUNNELED_PRB_RESP, 5)) {
+               WL_DBG(("TDLS Vendor Specific Received type\n"));
+               return true;
+       }
+
+       return false;
+}
+#endif /* WLTDLS */
+
+
+int wl_cfg80211_get_ioctl_version(void)
+{
+       return ioctl_version;
+}
+
+static s32
+wl_notify_rx_mgmt_frame(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       struct ieee80211_supported_band *band;
+       struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+       struct ether_addr da;
+       struct ether_addr bssid;
+       bool isfree = false;
+       s32 err = 0;
+       s32 freq;
+       struct net_device *ndev = NULL;
+       wifi_p2p_pub_act_frame_t *act_frm = NULL;
+       wifi_p2p_action_frame_t *p2p_act_frm = NULL;
+       wifi_p2psd_gas_pub_act_frame_t *sd_act_frm = NULL;
+#if defined(WLTDLS) && defined(TDLS_MSG_ONLY_WFD)
+       dhd_pub_t *dhdp;
+#endif /* WLTDLS && TDLS_MSG_ONLY_WFD */
+       wl_event_rx_frame_data_t *rxframe =
+               (wl_event_rx_frame_data_t*)data;
+       u32 event = ntoh32(e->event_type);
+       u8 *mgmt_frame;
+       u8 bsscfgidx = e->bsscfgidx;
+       u32 mgmt_frame_len = ntoh32(e->datalen) - sizeof(wl_event_rx_frame_data_t);
+       u16 channel = ((ntoh16(rxframe->channel) & WL_CHANSPEC_CHAN_MASK));
+
+       memset(&bssid, 0, ETHER_ADDR_LEN);
+
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+       if (channel <= CH_MAX_2G_CHANNEL)
+               band = wiphy->bands[IEEE80211_BAND_2GHZ];
+       else
+               band = wiphy->bands[IEEE80211_BAND_5GHZ];
+       if (!band) {
+               WL_ERR(("No valid band"));
+               return -EINVAL;
+       }
+#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 38) && !defined(WL_COMPAT_WIRELESS)
+       freq = ieee80211_channel_to_frequency(channel);
+       (void)band->band;
+#else
+       freq = ieee80211_channel_to_frequency(channel, band->band);
+#endif
+       if (event == WLC_E_ACTION_FRAME_RX) {
+               wldev_iovar_getbuf_bsscfg(ndev, "cur_etheraddr",
+                       NULL, 0, cfg->ioctl_buf, WLC_IOCTL_SMLEN, bsscfgidx, &cfg->ioctl_buf_sync);
+
+               err = wldev_ioctl(ndev, WLC_GET_BSSID, &bssid, ETHER_ADDR_LEN, false);
+               if (err < 0)
+                        WL_ERR(("WLC_GET_BSSID error %d\n", err));
+               memcpy(da.octet, cfg->ioctl_buf, ETHER_ADDR_LEN);
+               err = wl_frame_get_mgmt(FC_ACTION, &da, &e->addr, &bssid,
+                       &mgmt_frame, &mgmt_frame_len,
+                       (u8 *)((wl_event_rx_frame_data_t *)rxframe + 1));
+               if (err < 0) {
+                       WL_ERR(("Error in receiving action frame len %d channel %d freq %d\n",
+                               mgmt_frame_len, channel, freq));
+                       goto exit;
+               }
+               isfree = true;
+               if (wl_cfgp2p_is_pub_action(&mgmt_frame[DOT11_MGMT_HDR_LEN],
+                       mgmt_frame_len - DOT11_MGMT_HDR_LEN)) {
+                       act_frm = (wifi_p2p_pub_act_frame_t *)
+                                       (&mgmt_frame[DOT11_MGMT_HDR_LEN]);
+               } else if (wl_cfgp2p_is_p2p_action(&mgmt_frame[DOT11_MGMT_HDR_LEN],
+                       mgmt_frame_len - DOT11_MGMT_HDR_LEN)) {
+                       p2p_act_frm = (wifi_p2p_action_frame_t *)
+                                       (&mgmt_frame[DOT11_MGMT_HDR_LEN]);
+                       (void) p2p_act_frm;
+               } else if (wl_cfgp2p_is_gas_action(&mgmt_frame[DOT11_MGMT_HDR_LEN],
+                       mgmt_frame_len - DOT11_MGMT_HDR_LEN)) {
+
+                       sd_act_frm = (wifi_p2psd_gas_pub_act_frame_t *)
+                                       (&mgmt_frame[DOT11_MGMT_HDR_LEN]);
+                       if (sd_act_frm && wl_get_drv_status_all(cfg, WAITING_NEXT_ACT_FRM)) {
+                               if (cfg->next_af_subtype == sd_act_frm->action) {
+                                       WL_DBG(("We got a right next frame of SD!(%d)\n",
+                                               sd_act_frm->action));
+                                       wl_clr_drv_status(cfg, WAITING_NEXT_ACT_FRM, ndev);
+
+                                       /* Stop waiting for next AF. */
+                                       wl_stop_wait_next_action_frame(cfg, ndev);
+                               }
+                       }
+                       (void) sd_act_frm;
+#ifdef WLTDLS
+               } else if ((mgmt_frame[DOT11_MGMT_HDR_LEN] == TDLS_AF_CATEGORY) ||
+                               (wl_cfg80211_is_tdls_tunneled_frame(
+                                   &mgmt_frame[DOT11_MGMT_HDR_LEN],
+                                   mgmt_frame_len - DOT11_MGMT_HDR_LEN))) {
+                       if (mgmt_frame[DOT11_MGMT_HDR_LEN] == TDLS_AF_CATEGORY) {
+                               WL_ERR((" TDLS Action Frame Received type = %d \n",
+                                       mgmt_frame[DOT11_MGMT_HDR_LEN + 1]));
+                       }
+#ifdef TDLS_MSG_ONLY_WFD
+                       dhdp = (dhd_pub_t *)(cfg->pub);
+                       if (!dhdp->tdls_mode) {
+                               WL_DBG((" TDLS Frame filtered \n"));
+                               return 0;
+                       }
+#else
+                       if (mgmt_frame[DOT11_MGMT_HDR_LEN + 1] == TDLS_ACTION_SETUP_RESP) {
+                               cfg->tdls_mgmt_frame = mgmt_frame;
+                               cfg->tdls_mgmt_frame_len = mgmt_frame_len;
+                               cfg->tdls_mgmt_freq = freq;
+                               return 0;
+                       }
+#endif /* TDLS_MSG_ONLY_WFD */
+#endif /* WLTDLS */
+#ifdef QOS_MAP_SET
+               } else if (mgmt_frame[DOT11_MGMT_HDR_LEN] == DOT11_ACTION_CAT_QOS) {
+                       /* update QoS map set table */
+                       bcm_tlv_t * qos_map_ie = NULL;
+                       if ((qos_map_ie = bcm_parse_tlvs(&mgmt_frame[DOT11_MGMT_HDR_LEN],
+                                       mgmt_frame_len - DOT11_MGMT_HDR_LEN,
+                                       DOT11_MNG_QOS_MAP_ID)) != NULL) {
+                               WL_DBG((" QoS map set IE found in QoS action frame\n"));
+                               if (!cfg->up_table) {
+                                       cfg->up_table = kmalloc(UP_TABLE_MAX, GFP_KERNEL);
+                               }
+                               wl_set_up_table(cfg->up_table, qos_map_ie);
+                       } else {
+                               kfree(cfg->up_table);
+                               cfg->up_table = NULL;
+                       }
+#endif /* QOS_MAP_SET */
+               } else {
+                       /*
+                        *  if we got normal action frame and ndev is p2p0,
+                        *  we have to change ndev from p2p0 to wlan0
+                        */
+
+
+                       if (cfg->next_af_subtype != P2P_PAF_SUBTYPE_INVALID) {
+                               u8 action = 0;
+                               if (wl_get_public_action(&mgmt_frame[DOT11_MGMT_HDR_LEN],
+                                       mgmt_frame_len - DOT11_MGMT_HDR_LEN, &action) != BCME_OK) {
+                                       WL_DBG(("Recived action is not public action frame\n"));
+                               } else if (cfg->next_af_subtype == action) {
+                                       WL_DBG(("Recived action is the waiting action(%d)\n",
+                                               action));
+                                       wl_clr_drv_status(cfg, WAITING_NEXT_ACT_FRM, ndev);
+
+                                       /* Stop waiting for next AF. */
+                                       wl_stop_wait_next_action_frame(cfg, ndev);
+                               }
+                       }
+               }
+
+               if (act_frm) {
+
+                       if (wl_get_drv_status_all(cfg, WAITING_NEXT_ACT_FRM)) {
+                               if (cfg->next_af_subtype == act_frm->subtype) {
+                                       WL_DBG(("We got a right next frame!(%d)\n",
+                                               act_frm->subtype));
+                                       wl_clr_drv_status(cfg, WAITING_NEXT_ACT_FRM, ndev);
+
+                                       if (cfg->next_af_subtype == P2P_PAF_GON_CONF) {
+                                               OSL_SLEEP(20);
+                                       }
+
+                                       /* Stop waiting for next AF. */
+                                       wl_stop_wait_next_action_frame(cfg, ndev);
+                               }
+                       }
+               }
+
+               wl_cfgp2p_print_actframe(false, &mgmt_frame[DOT11_MGMT_HDR_LEN],
+                       mgmt_frame_len - DOT11_MGMT_HDR_LEN, channel);
+               /*
+                * After complete GO Negotiation, roll back to mpc mode
+                */
+               if (act_frm && ((act_frm->subtype == P2P_PAF_GON_CONF) ||
+                       (act_frm->subtype == P2P_PAF_PROVDIS_RSP))) {
+                       wldev_iovar_setint(ndev, "mpc", 1);
+               }
+               if (act_frm && (act_frm->subtype == P2P_PAF_GON_CONF)) {
+                       WL_DBG(("P2P: GO_NEG_PHASE status cleared \n"));
+                       wl_clr_p2p_status(cfg, GO_NEG_PHASE);
+               }
+       } else if (event == WLC_E_PROBREQ_MSG) {
+
+               /* Handle probe reqs frame
+                * WPS-AP certification 4.2.13
+                */
+               struct parsed_ies prbreq_ies;
+               u32 prbreq_ie_len = 0;
+               bool pbc = 0;
+
+               WL_DBG((" Event WLC_E_PROBREQ_MSG received\n"));
+               mgmt_frame = (u8 *)(data);
+               mgmt_frame_len = ntoh32(e->datalen);
+
+               prbreq_ie_len = mgmt_frame_len - DOT11_MGMT_HDR_LEN;
+
+               /* Parse prob_req IEs */
+               if (wl_cfg80211_parse_ies(&mgmt_frame[DOT11_MGMT_HDR_LEN],
+                       prbreq_ie_len, &prbreq_ies) < 0) {
+                       WL_ERR(("Prob req get IEs failed\n"));
+                       return 0;
+               }
+               if (prbreq_ies.wps_ie != NULL) {
+                       wl_validate_wps_ie((char *)prbreq_ies.wps_ie, prbreq_ies.wps_ie_len, &pbc);
+                       WL_DBG((" wps_ie exist pbc = %d\n", pbc));
+                       /* if pbc method, send prob_req mgmt frame to upper layer */
+                       if (!pbc)
+                               return 0;
+               } else
+                       return 0;
+       } else {
+               mgmt_frame = (u8 *)((wl_event_rx_frame_data_t *)rxframe + 1);
+
+               /* wpa supplicant use probe request event for restarting another GON Req.
+                * but it makes GON Req repetition.
+                * so if src addr of prb req is same as my target device,
+                * do not send probe request event during sending action frame.
+                */
+               if (event == WLC_E_P2P_PROBREQ_MSG) {
+                       WL_DBG((" Event %s\n", (event == WLC_E_P2P_PROBREQ_MSG) ?
+                               "WLC_E_P2P_PROBREQ_MSG":"WLC_E_PROBREQ_MSG"));
+
+
+                       /* Filter any P2P probe reqs arriving during the
+                        * GO-NEG Phase
+                        */
+                       if (cfg->p2p &&
+#if defined(P2P_IE_MISSING_FIX)
+                               cfg->p2p_prb_noti &&
+#endif
+                               wl_get_p2p_status(cfg, GO_NEG_PHASE)) {
+                               WL_DBG(("Filtering P2P probe_req while "
+                                       "being in GO-Neg state\n"));
+                               return 0;
+                       }
+               }
+       }
+
+       if (discover_cfgdev(cfgdev, cfg))
+               WL_DBG(("Rx Managment frame For P2P Discovery Interface \n"));
+       else
+               WL_DBG(("Rx Managment frame For Iface (%s) \n", ndev->name));
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
+       cfg80211_rx_mgmt(cfgdev, freq, 0,  mgmt_frame, mgmt_frame_len, 0);
+#elif(LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0))
+       cfg80211_rx_mgmt(cfgdev, freq, 0,  mgmt_frame, mgmt_frame_len, 0, GFP_ATOMIC);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) || \
+       defined(WL_COMPAT_WIRELESS)
+       cfg80211_rx_mgmt(cfgdev, freq, 0, mgmt_frame, mgmt_frame_len, GFP_ATOMIC);
+#else
+       cfg80211_rx_mgmt(cfgdev, freq, mgmt_frame, mgmt_frame_len, GFP_ATOMIC);
+#endif /* LINUX_VERSION >= VERSION(3, 14, 0) */
+
+       WL_DBG(("mgmt_frame_len (%d) , e->datalen (%d), channel (%d), freq (%d)\n",
+               mgmt_frame_len, ntoh32(e->datalen), channel, freq));
+exit:
+       if (isfree)
+               kfree(mgmt_frame);
+       return 0;
+}
+
+#ifdef WL_SCHED_SCAN
+/* If target scan is not reliable, set the below define to "1" to do a
+ * full escan
+ */
+#define FULL_ESCAN_ON_PFN_NET_FOUND            0
+static s32
+wl_notify_sched_scan_results(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *e, void *data)
+{
+       wl_pfn_net_info_t *netinfo, *pnetinfo;
+       struct wiphy *wiphy     = bcmcfg_to_wiphy(cfg);
+       int err = 0;
+       struct cfg80211_scan_request *request = NULL;
+       struct cfg80211_ssid ssid[MAX_PFN_LIST_COUNT];
+       struct ieee80211_channel *channel = NULL;
+       int channel_req = 0;
+       int band = 0;
+       struct wl_pfn_scanresults *pfn_result = (struct wl_pfn_scanresults *)data;
+       int n_pfn_results = pfn_result->count;
+
+       WL_DBG(("Enter\n"));
+
+       if ((e->event_type == WLC_E_PFN_NET_LOST) || !data) {
+               WL_PNO(("Do Nothing %d\n", e->event_type));
+               return 0;
+       }
+       if (pfn_result->version != PFN_SCANRESULT_VERSION) {
+               WL_ERR(("Incorrect version %d, expected %d\n", pfn_result->version,
+                      PFN_SCANRESULT_VERSION));
+               return 0;
+       }
+       WL_PNO((">>> PFN NET FOUND event. count:%d \n", n_pfn_results));
+       if (n_pfn_results > 0) {
+               int i;
+
+               if (n_pfn_results > MAX_PFN_LIST_COUNT)
+                       n_pfn_results = MAX_PFN_LIST_COUNT;
+               pnetinfo = (wl_pfn_net_info_t *)(data + sizeof(wl_pfn_scanresults_t)
+                               - sizeof(wl_pfn_net_info_t));
+
+               memset(&ssid, 0x00, sizeof(ssid));
+
+               request = kzalloc(sizeof(*request)
+                       + sizeof(*request->channels) * n_pfn_results,
+                       GFP_KERNEL);
+               channel = (struct ieee80211_channel *)kzalloc(
+                       (sizeof(struct ieee80211_channel) * n_pfn_results),
+                       GFP_KERNEL);
+               if (!request || !channel) {
+                       WL_ERR(("No memory"));
+                       err = -ENOMEM;
+                       goto out_err;
+               }
+
+               request->wiphy = wiphy;
+
+               for (i = 0; i < n_pfn_results; i++) {
+                       netinfo = &pnetinfo[i];
+                       if (!netinfo) {
+                               WL_ERR(("Invalid netinfo ptr. index:%d", i));
+                               err = -EINVAL;
+                               goto out_err;
+                       }
+                       WL_PNO((">>> SSID:%s Channel:%d \n",
+                               netinfo->pfnsubnet.SSID, netinfo->pfnsubnet.channel));
+                       /* PFN result doesn't have all the info which are required by the supplicant
+                        * (For e.g IEs) Do a target Escan so that sched scan results are reported
+                        * via wl_inform_single_bss in the required format. Escan does require the
+                        * scan request in the form of cfg80211_scan_request. For timebeing, create
+                        * cfg80211_scan_request one out of the received PNO event.
+                        */
+                       ssid[i].ssid_len = MIN(netinfo->pfnsubnet.SSID_len, DOT11_MAX_SSID_LEN);
+                       memcpy(ssid[i].ssid, netinfo->pfnsubnet.SSID, ssid[i].ssid_len);
+                       request->n_ssids++;
+
+                       channel_req = netinfo->pfnsubnet.channel;
+                       band = (channel_req <= CH_MAX_2G_CHANNEL) ? NL80211_BAND_2GHZ
+                               : NL80211_BAND_5GHZ;
+                       channel[i].center_freq = ieee80211_channel_to_frequency(channel_req, band);
+                       channel[i].band = band;
+                       channel[i].flags |= IEEE80211_CHAN_NO_HT40;
+                       request->channels[i] = &channel[i];
+                       request->n_channels++;
+               }
+
+               /* assign parsed ssid array */
+               if (request->n_ssids)
+                       request->ssids = &ssid[0];
+
+               if (wl_get_drv_status_all(cfg, SCANNING)) {
+                       /* Abort any on-going scan */
+                       wl_notify_escan_complete(cfg, ndev, true, true);
+               }
+
+               if (wl_get_p2p_status(cfg, DISCOVERY_ON)) {
+                       WL_PNO((">>> P2P discovery was ON. Disabling it\n"));
+                       err = wl_cfgp2p_discover_enable_search(cfg, false);
+                       if (unlikely(err)) {
+                               wl_clr_drv_status(cfg, SCANNING, ndev);
+                               goto out_err;
+                       }
+                       p2p_scan(cfg) = false;
+               }
+
+               wl_set_drv_status(cfg, SCANNING, ndev);
+#if FULL_ESCAN_ON_PFN_NET_FOUND
+               WL_PNO((">>> Doing Full ESCAN on PNO event\n"));
+               err = wl_do_escan(cfg, wiphy, ndev, NULL);
+#else
+               WL_PNO((">>> Doing targeted ESCAN on PNO event\n"));
+               err = wl_do_escan(cfg, wiphy, ndev, request);
+#endif
+               if (err) {
+                       wl_clr_drv_status(cfg, SCANNING, ndev);
+                       goto out_err;
+               }
+               cfg->sched_scan_running = TRUE;
+       }
+       else {
+               WL_ERR(("FALSE PNO Event. (pfn_count == 0) \n"));
+       }
+out_err:
+       if (request)
+               kfree(request);
+       if (channel)
+               kfree(channel);
+       return err;
+}
+#endif /* WL_SCHED_SCAN */
+
+static void wl_init_conf(struct wl_conf *conf)
+{
+       WL_DBG(("Enter \n"));
+       conf->frag_threshold = (u32)-1;
+       conf->rts_threshold = (u32)-1;
+       conf->retry_short = (u32)-1;
+       conf->retry_long = (u32)-1;
+       conf->tx_power = -1;
+}
+
+static void wl_init_prof(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+       unsigned long flags;
+       struct wl_profile *profile = wl_get_profile_by_netdev(cfg, ndev);
+
+       spin_lock_irqsave(&cfg->cfgdrv_lock, flags);
+       memset(profile, 0, sizeof(struct wl_profile));
+       spin_unlock_irqrestore(&cfg->cfgdrv_lock, flags);
+}
+
+static void wl_init_event_handler(struct bcm_cfg80211 *cfg)
+{
+       memset(cfg->evt_handler, 0, sizeof(cfg->evt_handler));
+
+       cfg->evt_handler[WLC_E_SCAN_COMPLETE] = wl_notify_scan_status;
+       cfg->evt_handler[WLC_E_AUTH] = wl_notify_connect_status;
+       cfg->evt_handler[WLC_E_ASSOC] = wl_notify_connect_status;
+       cfg->evt_handler[WLC_E_LINK] = wl_notify_connect_status;
+       cfg->evt_handler[WLC_E_DEAUTH_IND] = wl_notify_connect_status;
+       cfg->evt_handler[WLC_E_DEAUTH] = wl_notify_connect_status;
+       cfg->evt_handler[WLC_E_DISASSOC_IND] = wl_notify_connect_status;
+       cfg->evt_handler[WLC_E_ASSOC_IND] = wl_notify_connect_status;
+       cfg->evt_handler[WLC_E_REASSOC_IND] = wl_notify_connect_status;
+       cfg->evt_handler[WLC_E_ROAM] = wl_notify_roaming_status;
+       cfg->evt_handler[WLC_E_MIC_ERROR] = wl_notify_mic_status;
+       cfg->evt_handler[WLC_E_SET_SSID] = wl_notify_connect_status;
+       cfg->evt_handler[WLC_E_ACTION_FRAME_RX] = wl_notify_rx_mgmt_frame;
+       cfg->evt_handler[WLC_E_PROBREQ_MSG] = wl_notify_rx_mgmt_frame;
+       cfg->evt_handler[WLC_E_P2P_PROBREQ_MSG] = wl_notify_rx_mgmt_frame;
+       cfg->evt_handler[WLC_E_P2P_DISC_LISTEN_COMPLETE] = wl_cfgp2p_listen_complete;
+       cfg->evt_handler[WLC_E_ACTION_FRAME_COMPLETE] = wl_cfgp2p_action_tx_complete;
+       cfg->evt_handler[WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE] = wl_cfgp2p_action_tx_complete;
+       cfg->evt_handler[WLC_E_JOIN] = wl_notify_connect_status;
+       cfg->evt_handler[WLC_E_START] = wl_notify_connect_status;
+#ifdef PNO_SUPPORT
+       cfg->evt_handler[WLC_E_PFN_NET_FOUND] = wl_notify_pfn_status;
+#endif /* PNO_SUPPORT */
+#ifdef GSCAN_SUPPORT
+       cfg->evt_handler[WLC_E_PFN_BEST_BATCHING] = wl_notify_gscan_event;
+       cfg->evt_handler[WLC_E_PFN_SCAN_COMPLETE] = wl_notify_gscan_event;
+       cfg->evt_handler[WLC_E_PFN_GSCAN_FULL_RESULT] = wl_notify_gscan_event;
+       cfg->evt_handler[WLC_E_PFN_SWC] = wl_notify_gscan_event;
+       cfg->evt_handler[WLC_E_PFN_BSSID_NET_FOUND] = wl_notify_gscan_event;
+       cfg->evt_handler[WLC_E_PFN_BSSID_NET_LOST] = wl_notify_gscan_event;
+#endif /* GSCAN_SUPPORT */
+#ifdef WLTDLS
+       cfg->evt_handler[WLC_E_TDLS_PEER_EVENT] = wl_tdls_event_handler;
+#endif /* WLTDLS */
+       cfg->evt_handler[WLC_E_BSSID] = wl_notify_roaming_status;
+#ifdef WL_RELMCAST
+       cfg->evt_handler[WLC_E_RMC_EVENT] = wl_notify_rmc_status;
+#endif
+#ifdef BT_WIFI_HANDOVER
+       cfg->evt_handler[WLC_E_BT_WIFI_HANDOVER_REQ] = wl_notify_bt_wifi_handover_req;
+#endif
+#ifdef WL_NAN
+       cfg->evt_handler[WLC_E_NAN] = wl_cfgnan_notify_nan_status;
+       cfg->evt_handler[WLC_E_PROXD] = wl_cfgnan_notify_proxd_status;
+#endif /* WL_NAN */
+       cfg->evt_handler[WLC_E_CSA_COMPLETE_IND] = wl_csa_complete_ind;
+#ifdef DHD_LOSSLESS_ROAMING
+       cfg->evt_handler[WLC_E_ROAM_PREP] = wl_notify_roam_prep_status;
+#endif
+       cfg->evt_handler[WLC_E_AP_STARTED] = wl_ap_start_ind;
+#ifdef CUSTOM_EVENT_PM_WAKE
+       cfg->evt_handler[WLC_E_EXCESS_PM_WAKE_EVENT] = wl_check_pmstatus;
+#endif /* CUSTOM_EVENT_PM_WAKE */
+       cfg->evt_handler[WLC_E_PSK_SUP] = wl_notify_idsup_status;
+#ifdef ENABLE_TEMP_THROTTLING
+       cfg->evt_handler[WLC_E_TEMP_THROTTLE] = wl_check_rx_throttle_status;
+#endif /* ENABLE_TEMP_THROTTLING */
+}
+
+#if defined(STATIC_WL_PRIV_STRUCT)
+static void
+wl_init_escan_result_buf(struct bcm_cfg80211 *cfg)
+{
+       cfg->escan_info.escan_buf = DHD_OS_PREALLOC(cfg->pub,
+               DHD_PREALLOC_WIPHY_ESCAN0, ESCAN_BUF_SIZE);
+       bzero(cfg->escan_info.escan_buf, ESCAN_BUF_SIZE);
+}
+
+static void
+wl_deinit_escan_result_buf(struct bcm_cfg80211 *cfg)
+{
+       cfg->escan_info.escan_buf = NULL;
+
+}
+#endif /* STATIC_WL_PRIV_STRUCT */
+
+static s32 wl_init_priv_mem(struct bcm_cfg80211 *cfg)
+{
+       WL_DBG(("Enter \n"));
+
+       cfg->scan_results = (void *)kzalloc(WL_SCAN_BUF_MAX, GFP_KERNEL);
+       if (unlikely(!cfg->scan_results)) {
+               WL_ERR(("Scan results alloc failed\n"));
+               goto init_priv_mem_out;
+       }
+       cfg->conf = (void *)kzalloc(sizeof(*cfg->conf), GFP_KERNEL);
+       if (unlikely(!cfg->conf)) {
+               WL_ERR(("wl_conf alloc failed\n"));
+               goto init_priv_mem_out;
+       }
+       cfg->scan_req_int =
+           (void *)kzalloc(sizeof(*cfg->scan_req_int), GFP_KERNEL);
+       if (unlikely(!cfg->scan_req_int)) {
+               WL_ERR(("Scan req alloc failed\n"));
+               goto init_priv_mem_out;
+       }
+       cfg->ioctl_buf = (void *)kzalloc(WLC_IOCTL_MAXLEN, GFP_KERNEL);
+       if (unlikely(!cfg->ioctl_buf)) {
+               WL_ERR(("Ioctl buf alloc failed\n"));
+               goto init_priv_mem_out;
+       }
+       cfg->escan_ioctl_buf = (void *)kzalloc(WLC_IOCTL_MAXLEN, GFP_KERNEL);
+       if (unlikely(!cfg->escan_ioctl_buf)) {
+               WL_ERR(("Ioctl buf alloc failed\n"));
+               goto init_priv_mem_out;
+       }
+       cfg->extra_buf = (void *)kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
+       if (unlikely(!cfg->extra_buf)) {
+               WL_ERR(("Extra buf alloc failed\n"));
+               goto init_priv_mem_out;
+       }
+       cfg->pmk_list = (void *)kzalloc(sizeof(*cfg->pmk_list), GFP_KERNEL);
+       if (unlikely(!cfg->pmk_list)) {
+               WL_ERR(("pmk list alloc failed\n"));
+               goto init_priv_mem_out;
+       }
+#if defined(STATIC_WL_PRIV_STRUCT)
+       cfg->conn_info = (void *)kzalloc(sizeof(*cfg->conn_info), GFP_KERNEL);
+       if (unlikely(!cfg->conn_info)) {
+               WL_ERR(("cfg->conn_info  alloc failed\n"));
+               goto init_priv_mem_out;
+       }
+       cfg->ie = (void *)kzalloc(sizeof(*cfg->ie), GFP_KERNEL);
+       if (unlikely(!cfg->ie)) {
+               WL_ERR(("cfg->ie  alloc failed\n"));
+               goto init_priv_mem_out;
+       }
+       wl_init_escan_result_buf(cfg);
+#endif /* STATIC_WL_PRIV_STRUCT */
+       cfg->afx_hdl = (void *)kzalloc(sizeof(*cfg->afx_hdl), GFP_KERNEL);
+       if (unlikely(!cfg->afx_hdl)) {
+               WL_ERR(("afx hdl  alloc failed\n"));
+               goto init_priv_mem_out;
+       } else {
+               init_completion(&cfg->act_frm_scan);
+               init_completion(&cfg->wait_next_af);
+
+               INIT_WORK(&cfg->afx_hdl->work, wl_cfg80211_afx_handler);
+       }
+#ifdef WLTDLS
+       if (cfg->tdls_mgmt_frame) {
+               kfree(cfg->tdls_mgmt_frame);
+               cfg->tdls_mgmt_frame = NULL;
+       }
+#endif /* WLTDLS */
+       return 0;
+
+init_priv_mem_out:
+       wl_deinit_priv_mem(cfg);
+
+       return -ENOMEM;
+}
+
+static void wl_deinit_priv_mem(struct bcm_cfg80211 *cfg)
+{
+       kfree(cfg->scan_results);
+       cfg->scan_results = NULL;
+       kfree(cfg->conf);
+       cfg->conf = NULL;
+       kfree(cfg->scan_req_int);
+       cfg->scan_req_int = NULL;
+       kfree(cfg->ioctl_buf);
+       cfg->ioctl_buf = NULL;
+       kfree(cfg->escan_ioctl_buf);
+       cfg->escan_ioctl_buf = NULL;
+       kfree(cfg->extra_buf);
+       cfg->extra_buf = NULL;
+       kfree(cfg->pmk_list);
+       cfg->pmk_list = NULL;
+#if defined(STATIC_WL_PRIV_STRUCT)
+       kfree(cfg->conn_info);
+       cfg->conn_info = NULL;
+       kfree(cfg->ie);
+       cfg->ie = NULL;
+       wl_deinit_escan_result_buf(cfg);
+#endif /* STATIC_WL_PRIV_STRUCT */
+       if (cfg->afx_hdl) {
+               cancel_work_sync(&cfg->afx_hdl->work);
+               kfree(cfg->afx_hdl);
+               cfg->afx_hdl = NULL;
+       }
+
+}
+
+static s32 wl_create_event_handler(struct bcm_cfg80211 *cfg)
+{
+       int ret = 0;
+       WL_DBG(("Enter \n"));
+
+       if (!cfg->event_workq) {
+               /* Allocate workqueue for event */
+               cfg->event_workq = alloc_workqueue("dhd_eventd", WQ_MEM_RECLAIM | WQ_HIGHPRI, 0);
+               if (!cfg->event_workq) {
+                       ret = -ENOMEM;
+               } else {
+                       INIT_WORK(&cfg->event_work, wl_event_handler);
+               }
+       }
+       return ret;
+}
+
+static void wl_destroy_event_handler(struct bcm_cfg80211 *cfg)
+{
+       if (cfg->event_workq) {
+               cancel_work_sync(&cfg->event_work);
+               destroy_workqueue(cfg->event_workq);
+               cfg->event_workq = NULL;
+       }
+}
+
+void wl_terminate_event_handler(void *cfg80211_priv)
+{
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)cfg80211_priv;
+
+       if (cfg) {
+               wl_destroy_event_handler(cfg);
+               wl_flush_eq(cfg);
+       }
+}
+
+static void wl_scan_timeout(unsigned long data)
+{
+       wl_event_msg_t msg;
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)data;
+       struct wireless_dev *wdev = NULL;
+       struct net_device *ndev = NULL;
+       struct wl_scan_results *bss_list;
+       struct wl_bss_info *bi = NULL;
+       s32 i;
+       u32 channel;
+#if defined(DHD_DEBUG) && defined(BCMPCIE) && defined(DHD_FW_COREDUMP)
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+       uint32 prev_memdump_mode = dhdp->memdump_enabled;
+#endif /* DHD_DEBUG && BCMPCIE */
+
+       if (!(cfg->scan_request)) {
+               WL_ERR(("timer expired but no scan request\n"));
+               return;
+       }
+
+       bss_list = wl_escan_get_buf(cfg, FALSE);
+       if (!bss_list) {
+               WL_ERR(("bss_list is null. Didn't receive any partial scan results\n"));
+       } else {
+               WL_ERR(("scanned AP count (%d)\n", bss_list->count));
+
+               bi = next_bss(bss_list, bi);
+               for_each_bss(bss_list, bi, i) {
+                       channel = wf_chspec_ctlchan(wl_chspec_driver_to_host(bi->chanspec));
+                       WL_ERR(("SSID :%s  Channel :%d\n", bi->SSID, channel));
+               }
+       }
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
+       if (cfg->scan_request->dev)
+               wdev = cfg->scan_request->dev->ieee80211_ptr;
+#else
+       wdev = cfg->scan_request->wdev;
+#endif /* LINUX_VERSION < KERNEL_VERSION(3, 6, 0) */
+       if (!wdev) {
+               WL_ERR(("No wireless_dev present\n"));
+               return;
+       }
+       ndev = wdev_to_wlc_ndev(wdev, cfg);
+
+       bzero(&msg, sizeof(wl_event_msg_t));
+       WL_ERR(("timer expired\n"));
+#if defined(DHD_DEBUG) && defined(BCMPCIE) && defined(DHD_FW_COREDUMP)
+       if (dhdp->memdump_enabled) {
+               dhdp->memdump_enabled = DUMP_MEMFILE;
+               dhdp->memdump_type = DUMP_TYPE_SCAN_TIMEOUT;
+               dhd_bus_mem_dump(dhdp);
+               dhdp->memdump_enabled = prev_memdump_mode;
+       }
+#endif /* DHD_DEBUG && BCMPCIE */
+       msg.event_type = hton32(WLC_E_ESCAN_RESULT);
+       msg.status = hton32(WLC_E_STATUS_TIMEOUT);
+       msg.reason = 0xFFFFFFFF;
+       wl_cfg80211_event(ndev, &msg, NULL);
+#ifdef CUSTOMER_HW4_DEBUG
+       if (!wl_scan_timeout_dbg_enabled)
+               wl_scan_timeout_dbg_set();
+#endif /* CUSTOMER_HW4_DEBUG */
+}
+
+#ifdef DHD_LOSSLESS_ROAMING
+static void wl_del_roam_timeout(struct bcm_cfg80211 *cfg)
+{
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+
+       /* restore prec_map to ALLPRIO */
+       dhdp->dequeue_prec_map = ALLPRIO;
+       if (timer_pending(&cfg->roam_timeout)) {
+               del_timer_sync(&cfg->roam_timeout);
+       }
+
+}
+
+static void wl_roam_timeout(unsigned long data)
+{
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)data;
+       dhd_pub_t *dhdp = (dhd_pub_t *)(cfg->pub);
+
+       WL_ERR(("roam timer expired\n"));
+
+       /* restore prec_map to ALLPRIO */
+       dhdp->dequeue_prec_map = ALLPRIO;
+}
+
+#endif /* DHD_LOSSLESS_ROAMING */
+
+static s32
+wl_cfg80211_netdev_notifier_call(struct notifier_block * nb,
+       unsigned long state, void *ptr)
+{
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 11, 0))
+       struct net_device *dev = ptr;
+#else
+       struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+#endif /* LINUX_VERSION < VERSION(3, 11, 0) */
+       struct wireless_dev *wdev = ndev_to_wdev(dev);
+       struct bcm_cfg80211 *cfg = NULL;
+
+#ifdef DHD_IFDEBUG
+       WL_ERR(("Enter \n"));
+#endif
+
+       if (!wdev)
+               return NOTIFY_DONE;
+
+       cfg = WDEV_GET_CFG80211_PRIV(wdev);
+       if (!cfg || dev == bcmcfg_to_prmry_ndev(cfg))
+               return NOTIFY_DONE;
+
+       switch (state) {
+               case NETDEV_DOWN:
+               {
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 11, 0))
+                       int max_wait_timeout = 2;
+                       int max_wait_count = 100;
+                       int refcnt = 0;
+                       unsigned long limit = jiffies + max_wait_timeout * HZ;
+#ifdef DHD_IFDEBUG
+                       WL_ERR(("NETDEV_DOWN(+) wdev=%p, cfg=%p, dev=%p\n", wdev, cfg, dev));
+#endif
+                       while (work_pending(&wdev->cleanup_work)) {
+                               if (refcnt%5 == 0) {
+                                       WL_ERR(("[NETDEV_DOWN] wait for "
+                                               "complete of cleanup_work"
+                                               " (%d th)\n", refcnt));
+                               }
+                               if (!time_before(jiffies, limit)) {
+                                       WL_ERR(("[NETDEV_DOWN] cleanup_work"
+                                               " of CFG80211 is not"
+                                               " completed in %d sec\n",
+                                               max_wait_timeout));
+                                       break;
+                               }
+                               if (refcnt >= max_wait_count) {
+                                       WL_ERR(("[NETDEV_DOWN] cleanup_work"
+                                               " of CFG80211 is not"
+                                               " completed in %d loop\n",
+                                               max_wait_count));
+                                       break;
+                               }
+                               set_current_state(TASK_INTERRUPTIBLE);
+                               (void)schedule_timeout(100);
+                               set_current_state(TASK_RUNNING);
+                               refcnt++;
+                       }
+#ifdef DHD_IFDEBUG
+                       WL_ERR(("NETDEV_DOWN(-) wdev=%p, cfg=%p, dev=%p\n", wdev, cfg, dev));
+#endif
+#endif /* LINUX_VERSION < VERSION(3, 14, 0) */
+                       break;
+               }
+               case NETDEV_UNREGISTER:
+#ifdef DHD_IFDEBUG
+                       WL_ERR(("NETDEV_UNREGISTER(+) wdev=%p, cfg=%p, dev=%p\n", wdev, cfg, dev));
+#endif
+                       /* after calling list_del_rcu(&wdev->list) */
+                       wl_cfg80211_clear_per_bss_ies(cfg,
+                               wl_get_bssidx_by_wdev(cfg, wdev));
+                       wl_dealloc_netinfo_by_wdev(cfg, wdev);
+#ifdef DHD_IFDEBUG
+                       WL_ERR(("NETDEV_UNREGISTER(-) wdev=%p, cfg=%p, dev=%p\n", wdev, cfg, dev));
+#endif
+                       break;
+               case NETDEV_GOING_DOWN:
+                       /*
+                        * At NETDEV_DOWN state, wdev_cleanup_work work will be called.
+                        * In front of door, the function checks whether current scan
+                        * is working or not. If the scanning is still working,
+                        * wdev_cleanup_work call WARN_ON and make the scan done forcibly.
+                        */
+#ifdef DHD_IFDEBUG
+                       WL_ERR(("NETDEV_GOING_DOWN wdev=%p, cfg=%p, dev=%p\n", wdev, cfg, dev));
+#endif
+                       if (wl_get_drv_status(cfg, SCANNING, dev))
+                               wl_notify_escan_complete(cfg, dev, true, true);
+                       break;
+       }
+       return NOTIFY_DONE;
+}
+
+static struct notifier_block wl_cfg80211_netdev_notifier = {
+       .notifier_call = wl_cfg80211_netdev_notifier_call,
+};
+
+/*
+ * to make sure we won't register the same notifier twice, otherwise a loop is likely to be
+ * created in kernel notifier link list (with 'next' pointing to itself)
+ */
+static bool wl_cfg80211_netdev_notifier_registered = FALSE;
+
+static void wl_cfg80211_cancel_scan(struct bcm_cfg80211 *cfg)
+{
+       struct wireless_dev *wdev = NULL;
+       struct net_device *ndev = NULL;
+
+       if (!cfg->scan_request)
+               return;
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
+       if (cfg->scan_request->dev)
+               wdev = cfg->scan_request->dev->ieee80211_ptr;
+#else
+       wdev = cfg->scan_request->wdev;
+#endif /* LINUX_VERSION < KERNEL_VERSION(3, 6, 0) */
+
+       if (!wdev) {
+               WL_ERR(("No wireless_dev present\n"));
+               return;
+       }
+
+       ndev = wdev_to_wlc_ndev(wdev, cfg);
+       wl_notify_escan_complete(cfg, ndev, true, true);
+       WL_ERR(("Scan aborted! \n"));
+}
+
+static void wl_cfg80211_scan_abort(struct bcm_cfg80211 *cfg)
+{
+       wl_scan_params_t *params = NULL;
+       s32 params_size = 0;
+       s32 err = BCME_OK;
+       struct net_device *dev = bcmcfg_to_prmry_ndev(cfg);
+       if (!in_atomic()) {
+               /* Our scan params only need space for 1 channel and 0 ssids */
+               params = wl_cfg80211_scan_alloc_params(cfg->wdev, -1, 0, &params_size);
+               if (params == NULL) {
+                       WL_ERR(("scan params allocation failed \n"));
+                       err = -ENOMEM;
+               } else {
+                       /* Do a scan abort to stop the driver's scan engine */
+                       err = wldev_ioctl(dev, WLC_SCAN, params, params_size, true);
+                       if (err < 0) {
+                               WL_ERR(("scan abort  failed \n"));
+                       }
+                       kfree(params);
+               }
+       }
+#ifdef WLTDLS
+       if (cfg->tdls_mgmt_frame) {
+               kfree(cfg->tdls_mgmt_frame);
+               cfg->tdls_mgmt_frame = NULL;
+       }
+#endif /* WLTDLS */
+}
+
+static s32 wl_notify_escan_complete(struct bcm_cfg80211 *cfg,
+       struct net_device *ndev,
+       bool aborted, bool fw_abort)
+{
+       s32 err = BCME_OK;
+       unsigned long flags;
+       struct net_device *dev;
+
+       WL_DBG(("Enter \n"));
+
+       mutex_lock(&cfg->scan_complete);
+
+       if (!ndev) {
+               WL_ERR(("ndev is null\n"));
+               err = BCME_ERROR;
+               goto out;
+       }
+
+       if (cfg->escan_info.ndev != ndev) {
+               WL_ERR(("ndev is different %p %p\n", cfg->escan_info.ndev, ndev));
+               err = BCME_ERROR;
+               goto out;
+       }
+
+       if (cfg->scan_request) {
+               dev = bcmcfg_to_prmry_ndev(cfg);
+#if defined(WL_ENABLE_P2P_IF)
+               if (cfg->scan_request->dev != cfg->p2p_net)
+                       dev = cfg->scan_request->dev;
+#elif defined(WL_CFG80211_P2P_DEV_IF)
+               if (cfg->scan_request->wdev->iftype != NL80211_IFTYPE_P2P_DEVICE) {
+#ifdef DHD_IFDEBUG
+                       WL_ERR(("%s: dev: %p\n", __FUNCTION__, cfg->scan_request->wdev->netdev));
+#endif
+                       dev = cfg->scan_request->wdev->netdev;
+               }
+#endif /* WL_ENABLE_P2P_IF */
+       }
+       else {
+               WL_DBG(("cfg->scan_request is NULL may be internal scan."
+                       "doing scan_abort for ndev %p primary %p",
+                               ndev, bcmcfg_to_prmry_ndev(cfg)));
+               dev = ndev;
+       }
+       if (fw_abort && !in_atomic())
+               wl_cfg80211_scan_abort(cfg);
+       if (timer_pending(&cfg->scan_timeout))
+               del_timer_sync(&cfg->scan_timeout);
+#if defined(ESCAN_RESULT_PATCH)
+       if (likely(cfg->scan_request)) {
+               cfg->bss_list = wl_escan_get_buf(cfg, aborted);
+               wl_inform_bss(cfg);
+       }
+#endif /* ESCAN_RESULT_PATCH */
+       spin_lock_irqsave(&cfg->cfgdrv_lock, flags);
+#ifdef WL_SCHED_SCAN
+       if (cfg->sched_scan_req && !cfg->scan_request) {
+               WL_PNO((">>> REPORTING SCHED SCAN RESULTS \n"));
+               if (!aborted)
+                       cfg80211_sched_scan_results(cfg->sched_scan_req->wiphy);
+               cfg->sched_scan_running = FALSE;
+               cfg->sched_scan_req = NULL;
+       }
+#endif /* WL_SCHED_SCAN */
+       if (likely(cfg->scan_request)) {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0)
+               struct cfg80211_scan_info info = {
+                       .aborted = aborted
+               };
+               cfg80211_scan_done(cfg->scan_request, &info);
+#else
+               cfg80211_scan_done(cfg->scan_request, aborted);
+#endif
+               cfg->scan_request = NULL;
+               DHD_OS_SCAN_WAKE_UNLOCK((dhd_pub_t *)(cfg->pub));
+               DHD_ENABLE_RUNTIME_PM((dhd_pub_t *)(cfg->pub));
+       }
+       if (p2p_is_on(cfg))
+               wl_clr_p2p_status(cfg, SCANNING);
+       wl_clr_drv_status(cfg, SCANNING, dev);
+       spin_unlock_irqrestore(&cfg->cfgdrv_lock, flags);
+
+out:
+       mutex_unlock(&cfg->scan_complete);
+       return err;
+}
+
+#ifdef ESCAN_BUF_OVERFLOW_MGMT
+static void
+wl_cfg80211_find_removal_candidate(wl_bss_info_t *bss, removal_element_t *candidate)
+{
+       int idx;
+       for (idx = 0; idx < BUF_OVERFLOW_MGMT_COUNT; idx++) {
+               int len = BUF_OVERFLOW_MGMT_COUNT - idx - 1;
+               if (bss->RSSI < candidate[idx].RSSI) {
+                       if (len)
+                               memcpy(&candidate[idx + 1], &candidate[idx],
+                                       sizeof(removal_element_t) * len);
+                       candidate[idx].RSSI = bss->RSSI;
+                       candidate[idx].length = bss->length;
+                       memcpy(&candidate[idx].BSSID, &bss->BSSID, ETHER_ADDR_LEN);
+                       return;
+               }
+       }
+}
+
+static void
+wl_cfg80211_remove_lowRSSI_info(wl_scan_results_t *list, removal_element_t *candidate,
+       wl_bss_info_t *bi)
+{
+       int idx1, idx2;
+       int total_delete_len = 0;
+       for (idx1 = 0; idx1 < BUF_OVERFLOW_MGMT_COUNT; idx1++) {
+               int cur_len = WL_SCAN_RESULTS_FIXED_SIZE;
+               wl_bss_info_t *bss = NULL;
+               if (candidate[idx1].RSSI >= bi->RSSI)
+                       continue;
+               for (idx2 = 0; idx2 < list->count; idx2++) {
+                       bss = bss ? (wl_bss_info_t *)((uintptr)bss + dtoh32(bss->length)) :
+                               list->bss_info;
+                       if (!bcmp(&candidate[idx1].BSSID, &bss->BSSID, ETHER_ADDR_LEN) &&
+                               candidate[idx1].RSSI == bss->RSSI &&
+                               candidate[idx1].length == dtoh32(bss->length)) {
+                               u32 delete_len = dtoh32(bss->length);
+                               WL_DBG(("delete scan info of " MACDBG " to add new AP\n",
+                                       MAC2STRDBG(bss->BSSID.octet)));
+                               if (idx2 < list->count -1) {
+                                       memmove((u8 *)bss, (u8 *)bss + delete_len,
+                                               list->buflen - cur_len - delete_len);
+                               }
+                               list->buflen -= delete_len;
+                               list->count--;
+                               total_delete_len += delete_len;
+                               /* if delete_len is greater than or equal to result length */
+                               if (total_delete_len >= bi->length) {
+                                       return;
+                               }
+                               break;
+                       }
+                       cur_len += dtoh32(bss->length);
+               }
+       }
+}
+#endif /* ESCAN_BUF_OVERFLOW_MGMT */
+
+static s32 wl_escan_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       s32 err = BCME_OK;
+       s32 status = ntoh32(e->status);
+       wl_bss_info_t *bi;
+       wl_escan_result_t *escan_result;
+       wl_bss_info_t *bss = NULL;
+       wl_scan_results_t *list;
+       wifi_p2p_ie_t * p2p_ie;
+       struct net_device *ndev = NULL;
+       u32 bi_length;
+       u32 i;
+       u8 *p2p_dev_addr = NULL;
+
+       WL_DBG((" enter event type : %d, status : %d \n",
+               ntoh32(e->event_type), ntoh32(e->status)));
+
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+       mutex_lock(&cfg->usr_sync);
+       /* P2P SCAN is coming from primary interface */
+       if (wl_get_p2p_status(cfg, SCANNING)) {
+               if (wl_get_drv_status_all(cfg, SENDING_ACT_FRM))
+                       ndev = cfg->afx_hdl->dev;
+               else
+                       ndev = cfg->escan_info.ndev;
+
+       }
+       if (!ndev || (!wl_get_drv_status(cfg, SCANNING, ndev) && !cfg->sched_scan_running)) {
+               WL_ERR(("escan is not ready ndev %p drv_status 0x%x e_type %d e_states %d\n",
+                       ndev, wl_get_drv_status(cfg, SCANNING, ndev),
+                       ntoh32(e->event_type), ntoh32(e->status)));
+               goto exit;
+       }
+       escan_result = (wl_escan_result_t *)data;
+
+       if (status == WLC_E_STATUS_PARTIAL) {
+               WL_INFORM(("WLC_E_STATUS_PARTIAL \n"));
+               if (!escan_result) {
+                       WL_ERR(("Invalid escan result (NULL pointer)\n"));
+                       goto exit;
+               }
+               if (dtoh16(escan_result->bss_count) != 1) {
+                       WL_ERR(("Invalid bss_count %d: ignoring\n", escan_result->bss_count));
+                       goto exit;
+               }
+               bi = escan_result->bss_info;
+               if (!bi) {
+                       WL_ERR(("Invalid escan bss info (NULL pointer)\n"));
+                       goto exit;
+               }
+               bi_length = dtoh32(bi->length);
+               if (bi_length != (dtoh32(escan_result->buflen) - WL_ESCAN_RESULTS_FIXED_SIZE)) {
+                       WL_ERR(("Invalid bss_info length %d: ignoring\n", bi_length));
+                       goto exit;
+               }
+               if (wl_escan_check_sync_id(status, escan_result->sync_id,
+                       cfg->escan_info.cur_sync_id) < 0)
+                       goto exit;
+
+               if (!(bcmcfg_to_wiphy(cfg)->interface_modes & BIT(NL80211_IFTYPE_ADHOC))) {
+                       if (dtoh16(bi->capability) & DOT11_CAP_IBSS) {
+                               WL_DBG(("Ignoring IBSS result\n"));
+                               goto exit;
+                       }
+               }
+
+               if (wl_get_drv_status_all(cfg, FINDING_COMMON_CHANNEL)) {
+                       p2p_dev_addr = wl_cfgp2p_retreive_p2p_dev_addr(bi, bi_length);
+                       if (p2p_dev_addr && !memcmp(p2p_dev_addr,
+                               cfg->afx_hdl->tx_dst_addr.octet, ETHER_ADDR_LEN)) {
+                               s32 channel = wf_chspec_ctlchan(
+                                       wl_chspec_driver_to_host(bi->chanspec));
+
+                               if ((channel > MAXCHANNEL) || (channel <= 0))
+                                       channel = WL_INVALID;
+                               else
+                                       WL_ERR(("ACTION FRAME SCAN : Peer " MACDBG " found,"
+                                               " channel : %d\n",
+                                               MAC2STRDBG(cfg->afx_hdl->tx_dst_addr.octet),
+                                               channel));
+
+                               wl_clr_p2p_status(cfg, SCANNING);
+                               cfg->afx_hdl->peer_chan = channel;
+                               complete(&cfg->act_frm_scan);
+                               goto exit;
+                       }
+
+               } else {
+                       int cur_len = WL_SCAN_RESULTS_FIXED_SIZE;
+#ifdef ESCAN_BUF_OVERFLOW_MGMT
+                       removal_element_t candidate[BUF_OVERFLOW_MGMT_COUNT];
+                       int remove_lower_rssi = FALSE;
+
+                       bzero(candidate, sizeof(removal_element_t)*BUF_OVERFLOW_MGMT_COUNT);
+#endif /* ESCAN_BUF_OVERFLOW_MGMT */
+
+                       list = wl_escan_get_buf(cfg, FALSE);
+                       if (scan_req_match(cfg)) {
+                               /* p2p scan && allow only probe response */
+                               if ((cfg->p2p->search_state != WL_P2P_DISC_ST_SCAN) &&
+                                       (bi->flags & WL_BSS_FLAGS_FROM_BEACON))
+                                       goto exit;
+                               if ((p2p_ie = wl_cfgp2p_find_p2pie(((u8 *) bi) + bi->ie_offset,
+                                       bi->ie_length)) == NULL) {
+                                               WL_ERR(("Couldn't find P2PIE in probe"
+                                                       " response/beacon\n"));
+                                               goto exit;
+                               }
+                       }
+#ifdef ESCAN_BUF_OVERFLOW_MGMT
+                       if (bi_length > ESCAN_BUF_SIZE - list->buflen)
+                               remove_lower_rssi = TRUE;
+#endif /* ESCAN_BUF_OVERFLOW_MGMT */
+
+                       for (i = 0; i < list->count; i++) {
+                               bss = bss ? (wl_bss_info_t *)((uintptr)bss + dtoh32(bss->length))
+                                       : list->bss_info;
+#ifdef ESCAN_BUF_OVERFLOW_MGMT
+                               WL_TRACE(("%s("MACDBG"), i=%d bss: RSSI %d list->count %d\n",
+                                       bss->SSID, MAC2STRDBG(bss->BSSID.octet),
+                                       i, bss->RSSI, list->count));
+
+                               if (remove_lower_rssi)
+                                       wl_cfg80211_find_removal_candidate(bss, candidate);
+#endif /* ESCAN_BUF_OVERFLOW_MGMT */
+
+                               if (!bcmp(&bi->BSSID, &bss->BSSID, ETHER_ADDR_LEN) &&
+                                       (CHSPEC_BAND(wl_chspec_driver_to_host(bi->chanspec))
+                                       == CHSPEC_BAND(wl_chspec_driver_to_host(bss->chanspec))) &&
+                                       bi->SSID_len == bss->SSID_len &&
+                                       !bcmp(bi->SSID, bss->SSID, bi->SSID_len)) {
+
+                                       /* do not allow beacon data to update
+                                       *the data recd from a probe response
+                                       */
+                                       if (!(bss->flags & WL_BSS_FLAGS_FROM_BEACON) &&
+                                               (bi->flags & WL_BSS_FLAGS_FROM_BEACON))
+                                               goto exit;
+
+                                       WL_DBG(("%s("MACDBG"), i=%d prev: RSSI %d"
+                                               " flags 0x%x, new: RSSI %d flags 0x%x\n",
+                                               bss->SSID, MAC2STRDBG(bi->BSSID.octet), i,
+                                               bss->RSSI, bss->flags, bi->RSSI, bi->flags));
+
+                                       if ((bss->flags & WL_BSS_FLAGS_RSSI_ONCHANNEL) ==
+                                               (bi->flags & WL_BSS_FLAGS_RSSI_ONCHANNEL)) {
+                                               /* preserve max RSSI if the measurements are
+                                               * both on-channel or both off-channel
+                                               */
+                                               WL_SCAN(("%s("MACDBG"), same onchan"
+                                               ", RSSI: prev %d new %d\n",
+                                               bss->SSID, MAC2STRDBG(bi->BSSID.octet),
+                                               bss->RSSI, bi->RSSI));
+                                               bi->RSSI = MAX(bss->RSSI, bi->RSSI);
+                                       } else if ((bss->flags & WL_BSS_FLAGS_RSSI_ONCHANNEL) &&
+                                               (bi->flags & WL_BSS_FLAGS_RSSI_ONCHANNEL) == 0) {
+                                               /* preserve the on-channel rssi measurement
+                                               * if the new measurement is off channel
+                                               */
+                                               WL_SCAN(("%s("MACDBG"), prev onchan"
+                                               ", RSSI: prev %d new %d\n",
+                                               bss->SSID, MAC2STRDBG(bi->BSSID.octet),
+                                               bss->RSSI, bi->RSSI));
+                                               bi->RSSI = bss->RSSI;
+                                               bi->flags |= WL_BSS_FLAGS_RSSI_ONCHANNEL;
+                                       }
+                                       if (dtoh32(bss->length) != bi_length) {
+                                               u32 prev_len = dtoh32(bss->length);
+
+                                               WL_SCAN(("bss info replacement"
+                                                       " is occured(bcast:%d->probresp%d)\n",
+                                                       bss->ie_length, bi->ie_length));
+                                               WL_DBG(("%s("MACDBG"), replacement!(%d -> %d)\n",
+                                               bss->SSID, MAC2STRDBG(bi->BSSID.octet),
+                                               prev_len, bi_length));
+
+                                               if (list->buflen - prev_len + bi_length
+                                                       > ESCAN_BUF_SIZE) {
+                                                       WL_ERR(("Buffer is too small: keep the"
+                                                               " previous result of this AP\n"));
+                                                       /* Only update RSSI */
+                                                       bss->RSSI = bi->RSSI;
+                                                       bss->flags |= (bi->flags
+                                                               & WL_BSS_FLAGS_RSSI_ONCHANNEL);
+                                                       goto exit;
+                                               }
+
+                                               if (i < list->count - 1) {
+                                                       /* memory copy required by this case only */
+                                                       memmove((u8 *)bss + bi_length,
+                                                               (u8 *)bss + prev_len,
+                                                               list->buflen - cur_len - prev_len);
+                                               }
+                                               list->buflen -= prev_len;
+                                               list->buflen += bi_length;
+                                       }
+                                       list->version = dtoh32(bi->version);
+                                       memcpy((u8 *)bss, (u8 *)bi, bi_length);
+                                       goto exit;
+                               }
+                               cur_len += dtoh32(bss->length);
+                       }
+                       if (bi_length > ESCAN_BUF_SIZE - list->buflen) {
+#ifdef ESCAN_BUF_OVERFLOW_MGMT
+                               wl_cfg80211_remove_lowRSSI_info(list, candidate, bi);
+                               if (bi_length > ESCAN_BUF_SIZE - list->buflen) {
+                                       WL_DBG(("RSSI(" MACDBG ") is too low(%d) to add Buffer\n",
+                                               MAC2STRDBG(bi->BSSID.octet), bi->RSSI));
+                                       goto exit;
+                               }
+#else
+                               WL_ERR(("Buffer is too small: ignoring\n"));
+                               goto exit;
+#endif /* ESCAN_BUF_OVERFLOW_MGMT */
+                       }
+
+                       memcpy(&(((char *)list)[list->buflen]), bi, bi_length);
+                       list->version = dtoh32(bi->version);
+                       list->buflen += bi_length;
+                       list->count++;
+
+                       /*
+                        * !Broadcast && number of ssid = 1 && number of channels =1
+                        * means specific scan to association
+                        */
+                       if (wl_cfgp2p_is_p2p_specific_scan(cfg->scan_request)) {
+                               WL_ERR(("P2P assoc scan fast aborted.\n"));
+                               wl_notify_escan_complete(cfg, cfg->escan_info.ndev, false, true);
+                               goto exit;
+                       }
+               }
+       }
+       else if (status == WLC_E_STATUS_SUCCESS) {
+               cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
+               wl_escan_print_sync_id(status, cfg->escan_info.cur_sync_id,
+                       escan_result->sync_id);
+
+               if (wl_get_drv_status_all(cfg, FINDING_COMMON_CHANNEL)) {
+                       WL_INFORM(("ACTION FRAME SCAN DONE\n"));
+                       wl_clr_p2p_status(cfg, SCANNING);
+                       wl_clr_drv_status(cfg, SCANNING, cfg->afx_hdl->dev);
+                       if (cfg->afx_hdl->peer_chan == WL_INVALID)
+                               complete(&cfg->act_frm_scan);
+               } else if ((likely(cfg->scan_request)) || (cfg->sched_scan_running)) {
+                       WL_INFORM(("ESCAN COMPLETED\n"));
+                       cfg->bss_list = wl_escan_get_buf(cfg, FALSE);
+                       if (!scan_req_match(cfg)) {
+                               WL_TRACE_HW4(("SCAN COMPLETED: scanned AP count=%d\n",
+                                       cfg->bss_list->count));
+                       }
+                       wl_inform_bss(cfg);
+                       wl_notify_escan_complete(cfg, ndev, false, false);
+               }
+               wl_escan_increment_sync_id(cfg, SCAN_BUF_NEXT);
+#ifdef CUSTOMER_HW4_DEBUG
+               if (wl_scan_timeout_dbg_enabled)
+                       wl_scan_timeout_dbg_clear();
+#endif /* CUSTOMER_HW4_DEBUG */
+       } else if ((status == WLC_E_STATUS_ABORT) || (status == WLC_E_STATUS_NEWSCAN) ||
+               (status == WLC_E_STATUS_11HQUIET) || (status == WLC_E_STATUS_CS_ABORT) ||
+               (status == WLC_E_STATUS_NEWASSOC)) {
+               /* Handle all cases of scan abort */
+               cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
+               wl_escan_print_sync_id(status, escan_result->sync_id,
+                       cfg->escan_info.cur_sync_id);
+               WL_DBG(("ESCAN ABORT reason: %d\n", status));
+               if (wl_get_drv_status_all(cfg, FINDING_COMMON_CHANNEL)) {
+                       WL_INFORM(("ACTION FRAME SCAN DONE\n"));
+                       wl_clr_drv_status(cfg, SCANNING, cfg->afx_hdl->dev);
+                       wl_clr_p2p_status(cfg, SCANNING);
+                       if (cfg->afx_hdl->peer_chan == WL_INVALID)
+                               complete(&cfg->act_frm_scan);
+               } else if ((likely(cfg->scan_request)) || (cfg->sched_scan_running)) {
+                       WL_INFORM(("ESCAN ABORTED\n"));
+                       cfg->bss_list = wl_escan_get_buf(cfg, TRUE);
+                       if (!scan_req_match(cfg)) {
+                               WL_TRACE_HW4(("scan_req_match=0: scanned AP count=%d\n",
+                                       cfg->bss_list->count));
+                       }
+                       wl_inform_bss(cfg);
+                       wl_notify_escan_complete(cfg, ndev, true, false);
+               } else {
+                       /* If there is no pending host initiated scan, do nothing */
+                       WL_DBG(("ESCAN ABORT: No pending scans. Ignoring event.\n"));
+               }
+               wl_escan_increment_sync_id(cfg, SCAN_BUF_CNT);
+       } else if (status == WLC_E_STATUS_TIMEOUT) {
+               WL_ERR(("WLC_E_STATUS_TIMEOUT : scan_request[%p]\n", cfg->scan_request));
+               WL_ERR(("reason[0x%x]\n", e->reason));
+               if (e->reason == 0xFFFFFFFF) {
+                       wl_notify_escan_complete(cfg, cfg->escan_info.ndev, true, true);
+               }
+       } else {
+               WL_ERR(("unexpected Escan Event %d : abort\n", status));
+               cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
+               wl_escan_print_sync_id(status, escan_result->sync_id,
+                       cfg->escan_info.cur_sync_id);
+               if (wl_get_drv_status_all(cfg, FINDING_COMMON_CHANNEL)) {
+                       WL_INFORM(("ACTION FRAME SCAN DONE\n"));
+                       wl_clr_p2p_status(cfg, SCANNING);
+                       wl_clr_drv_status(cfg, SCANNING, cfg->afx_hdl->dev);
+                       if (cfg->afx_hdl->peer_chan == WL_INVALID)
+                               complete(&cfg->act_frm_scan);
+               } else if ((likely(cfg->scan_request)) || (cfg->sched_scan_running)) {
+                       cfg->bss_list = wl_escan_get_buf(cfg, TRUE);
+                       if (!scan_req_match(cfg)) {
+                               WL_TRACE_HW4(("SCAN ABORTED(UNEXPECTED): "
+                                       "scanned AP count=%d\n",
+                                       cfg->bss_list->count));
+                       }
+                       wl_inform_bss(cfg);
+                       wl_notify_escan_complete(cfg, ndev, true, false);
+               }
+               wl_escan_increment_sync_id(cfg, 2);
+       }
+exit:
+       mutex_unlock(&cfg->usr_sync);
+       return err;
+}
+
+static void wl_cfg80211_concurrent_roam(struct bcm_cfg80211 *cfg, int enable)
+{
+       u32 connected_cnt  = wl_get_drv_status_all(cfg, CONNECTED);
+       bool p2p_connected  = wl_cfgp2p_vif_created(cfg);
+       struct net_info *iter, *next;
+
+       if (!cfg->roamoff_on_concurrent)
+               return;
+       if (enable && (p2p_connected||(connected_cnt > 1))) {
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+_Pragma("GCC diagnostic push")
+_Pragma("GCC diagnostic ignored \"-Wcast-qual\"")
+#endif
+               for_each_ndev(cfg, iter, next) {
+                       if (iter->ndev && iter->wdev &&
+                                       iter->wdev->iftype == NL80211_IFTYPE_STATION) {
+                               if (wldev_iovar_setint(iter->ndev, "roam_off", TRUE)
+                                               == BCME_OK) {
+                                       iter->roam_off = TRUE;
+                               }
+                               else {
+                                       WL_ERR(("error to enable roam_off\n"));
+                               }
+                       }
+               }
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+_Pragma("GCC diagnostic pop")
+#endif
+       }
+       else if (!enable) {
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+_Pragma("GCC diagnostic push")
+_Pragma("GCC diagnostic ignored \"-Wcast-qual\"")
+#endif
+               for_each_ndev(cfg, iter, next) {
+                       if (iter->ndev && iter->wdev &&
+                                       iter->wdev->iftype == NL80211_IFTYPE_STATION) {
+                               if (iter->roam_off != WL_INVALID) {
+                                       if (wldev_iovar_setint(iter->ndev, "roam_off", FALSE)
+                                                       == BCME_OK) {
+                                               iter->roam_off = FALSE;
+                                       }
+                                       else {
+                                               WL_ERR(("error to disable roam_off\n"));
+                                       }
+                               }
+                       }
+               }
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+_Pragma("GCC diagnostic pop")
+#endif
+       }
+       return;
+}
+
+static void wl_cfg80211_determine_vsdb_mode(struct bcm_cfg80211 *cfg)
+{
+       struct net_info *iter, *next;
+       u32 ctl_chan = 0;
+       u32 chanspec = 0;
+       u32 pre_ctl_chan = 0;
+       u32 connected_cnt  = wl_get_drv_status_all(cfg, CONNECTED);
+       cfg->vsdb_mode = false;
+
+       if (connected_cnt <= 1)  {
+               return;
+       }
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+_Pragma("GCC diagnostic push")
+_Pragma("GCC diagnostic ignored \"-Wcast-qual\"")
+#endif
+       for_each_ndev(cfg, iter, next) {
+               /* p2p discovery iface ndev could be null */
+               if (iter->ndev) {
+                       chanspec = 0;
+                       ctl_chan = 0;
+                       if (wl_get_drv_status(cfg, CONNECTED, iter->ndev)) {
+                               if (wldev_iovar_getint(iter->ndev, "chanspec",
+                                       (s32 *)&chanspec) == BCME_OK) {
+                                       chanspec = wl_chspec_driver_to_host(chanspec);
+                                       ctl_chan = wf_chspec_ctlchan(chanspec);
+                                       wl_update_prof(cfg, iter->ndev, NULL,
+                                               &ctl_chan, WL_PROF_CHAN);
+                               }
+                               if (!cfg->vsdb_mode) {
+                                       if (!pre_ctl_chan && ctl_chan)
+                                               pre_ctl_chan = ctl_chan;
+                                       else if (pre_ctl_chan && (pre_ctl_chan != ctl_chan)) {
+                                               cfg->vsdb_mode = true;
+                                       }
+                               }
+                       }
+               }
+       }
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+_Pragma("GCC diagnostic pop")
+#endif
+       WL_ERR(("%s concurrency is enabled\n", cfg->vsdb_mode ? "Multi Channel" : "Same Channel"));
+       return;
+}
+
+#if defined(DISABLE_FRAMEBURST_VSDB) && defined(USE_WFA_CERT_CONF)
+extern int g_frameburst;
+#endif /* DISABLE_FRAMEBURST_VSDB && USE_WFA_CERT_CONF */
+
+static s32 wl_notifier_change_state(struct bcm_cfg80211 *cfg, struct net_info *_net_info,
+       enum wl_status state, bool set)
+{
+       s32 pm = PM_FAST;
+       s32 err = BCME_OK;
+       u32 mode;
+       u32 chan = 0;
+       struct net_device *primary_dev = bcmcfg_to_prmry_ndev(cfg);
+       dhd_pub_t *dhd =  (dhd_pub_t *)(cfg->pub);
+       if (dhd->busstate == DHD_BUS_DOWN) {
+               WL_ERR(("%s : busstate is DHD_BUS_DOWN!\n", __FUNCTION__));
+               return 0;
+       }
+       WL_DBG(("Enter state %d set %d _net_info->pm_restore %d iface %s\n",
+               state, set, _net_info->pm_restore, _net_info->ndev->name));
+
+       if (state != WL_STATUS_CONNECTED)
+               return 0;
+       mode = wl_get_mode_by_netdev(cfg, _net_info->ndev);
+       if (set) {
+               wl_cfg80211_concurrent_roam(cfg, 1);
+               wl_cfg80211_determine_vsdb_mode(cfg);
+               if (mode == WL_MODE_AP) {
+                       if (wl_add_remove_eventmsg(primary_dev, WLC_E_P2P_PROBREQ_MSG, false))
+                               WL_ERR((" failed to unset WLC_E_P2P_PROPREQ_MSG\n"));
+               }
+
+               pm = PM_OFF;
+               if ((err = wldev_ioctl(_net_info->ndev, WLC_SET_PM, &pm,
+                               sizeof(pm), true)) != 0) {
+                       if (err == -ENODEV)
+                               WL_DBG(("%s:netdev not ready\n",
+                                       _net_info->ndev->name));
+                       else
+                               WL_ERR(("%s:error (%d)\n",
+                                       _net_info->ndev->name, err));
+
+                       wl_cfg80211_update_power_mode(_net_info->ndev);
+               }
+               wl_add_remove_pm_enable_work(cfg, WL_PM_WORKQ_SHORT);
+#if defined(WLTDLS)
+               if (wl_cfg80211_is_concurrent_mode(cfg)) {
+                       err = wldev_iovar_setint(primary_dev, "tdls_enable", 0);
+               }
+#endif /* defined(WLTDLS) */
+
+#ifdef DISABLE_FRAMEBURST_VSDB
+#ifdef USE_WFA_CERT_CONF
+               if (g_frameburst)
+#endif /* USE_WFA_CERT_CONF */
+               {
+                       if (wl_cfg80211_is_concurrent_mode(cfg)) {
+                               int frameburst = 0;
+                               if (wldev_ioctl(primary_dev, WLC_SET_FAKEFRAG, &frameburst,
+                                       sizeof(frameburst), true) != 0) {
+                                       WL_DBG(("frameburst set error\n"));
+                               }
+                               WL_DBG(("Frameburst Disabled\n"));
+                       }
+               }
+#endif /* DISABLE_FRAMEBURST_VSDB */
+       } else { /* clear */
+               chan = 0;
+               /* clear chan information when the net device is disconnected */
+               wl_update_prof(cfg, _net_info->ndev, NULL, &chan, WL_PROF_CHAN);
+               wl_cfg80211_determine_vsdb_mode(cfg);
+               if (primary_dev == _net_info->ndev) {
+                       pm = PM_FAST;
+                       if ((err = wldev_ioctl(_net_info->ndev, WLC_SET_PM, &pm,
+                                       sizeof(pm), true)) != 0) {
+                               if (err == -ENODEV)
+                                       WL_DBG(("%s:netdev not ready\n",
+                                               _net_info->ndev->name));
+                               else
+                                       WL_ERR(("%s:error (%d)\n",
+                                               _net_info->ndev->name, err));
+
+                               wl_cfg80211_update_power_mode(_net_info->ndev);
+                       }
+               }
+
+               wl_cfg80211_concurrent_roam(cfg, 0);
+#if defined(WLTDLS)
+               if (!wl_cfg80211_is_concurrent_mode(cfg)) {
+                       err = wldev_iovar_setint(primary_dev, "tdls_enable", 1);
+               }
+#endif /* defined(WLTDLS) */
+
+#ifdef DISABLE_FRAMEBURST_VSDB
+#ifdef USE_WFA_CERT_CONF
+               if (g_frameburst)
+#endif /* USE_WFA_CERT_CONF */
+               {
+                       int frameburst = 1;
+                       if (wldev_ioctl(primary_dev, WLC_SET_FAKEFRAG, &frameburst,
+                               sizeof(frameburst), true) != 0) {
+                               WL_DBG(("frameburst set error\n"));
+                       }
+                       WL_DBG(("Frameburst Enabled\n"));
+               }
+#endif /* DISABLE_FRAMEBURST_VSDB */
+       }
+       return err;
+}
+static s32 wl_init_scan(struct bcm_cfg80211 *cfg)
+{
+       int err = 0;
+
+       cfg->evt_handler[WLC_E_ESCAN_RESULT] = wl_escan_handler;
+       cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
+       wl_escan_init_sync_id(cfg);
+
+       /* Init scan_timeout timer */
+       init_timer(&cfg->scan_timeout);
+       cfg->scan_timeout.data = (unsigned long) cfg;
+       cfg->scan_timeout.function = wl_scan_timeout;
+
+       return err;
+}
+
+#ifdef DHD_LOSSLESS_ROAMING
+static s32 wl_init_roam_timeout(struct bcm_cfg80211 *cfg)
+{
+       int err = 0;
+
+       /* Init roam timer */
+       init_timer(&cfg->roam_timeout);
+       cfg->roam_timeout.data = (unsigned long) cfg;
+       cfg->roam_timeout.function = wl_roam_timeout;
+
+       return err;
+}
+#endif /* DHD_LOSSLESS_ROAMING */
+
+static s32 wl_init_priv(struct bcm_cfg80211 *cfg)
+{
+       struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+       s32 err = 0;
+
+       cfg->scan_request = NULL;
+       cfg->pwr_save = !!(wiphy->flags & WIPHY_FLAG_PS_ON_BY_DEFAULT);
+       cfg->roam_on = false;
+       cfg->active_scan = true;
+       cfg->rf_blocked = false;
+       cfg->vsdb_mode = false;
+#if defined(BCMSDIO)
+       cfg->wlfc_on = false;
+#endif 
+       cfg->roamoff_on_concurrent = true;
+       cfg->disable_roam_event = false;
+       /* register interested state */
+       set_bit(WL_STATUS_CONNECTED, &cfg->interrested_state);
+       spin_lock_init(&cfg->cfgdrv_lock);
+       mutex_init(&cfg->ioctl_buf_sync);
+       init_waitqueue_head(&cfg->netif_change_event);
+       init_completion(&cfg->send_af_done);
+       init_completion(&cfg->iface_disable);
+       wl_init_eq(cfg);
+       err = wl_init_priv_mem(cfg);
+       if (err)
+               return err;
+       if (wl_create_event_handler(cfg))
+               return -ENOMEM;
+       wl_init_event_handler(cfg);
+       mutex_init(&cfg->usr_sync);
+       mutex_init(&cfg->event_sync);
+       mutex_init(&cfg->scan_complete);
+       err = wl_init_scan(cfg);
+       if (err)
+               return err;
+#ifdef DHD_LOSSLESS_ROAMING
+       err = wl_init_roam_timeout(cfg);
+       if (err) {
+               return err;
+       }
+#endif /* DHD_LOSSLESS_ROAMING */
+       wl_init_conf(cfg->conf);
+       wl_init_prof(cfg, ndev);
+       wl_link_down(cfg);
+       DNGL_FUNC(dhd_cfg80211_init, (cfg));
+
+       return err;
+}
+
+static void wl_deinit_priv(struct bcm_cfg80211 *cfg)
+{
+       DNGL_FUNC(dhd_cfg80211_deinit, (cfg));
+       if (cfg->event_workq)
+               wl_destroy_event_handler(cfg);
+       wl_flush_eq(cfg);
+       wl_link_down(cfg);
+       del_timer_sync(&cfg->scan_timeout);
+#ifdef DHD_LOSSLESS_ROAMING
+       del_timer_sync(&cfg->roam_timeout);
+#endif
+       wl_deinit_priv_mem(cfg);
+       if (wl_cfg80211_netdev_notifier_registered) {
+               wl_cfg80211_netdev_notifier_registered = FALSE;
+               unregister_netdevice_notifier(&wl_cfg80211_netdev_notifier);
+       }
+}
+
+#if defined(WL_ENABLE_P2P_IF)
+static s32 wl_cfg80211_attach_p2p(struct bcm_cfg80211 *cfg)
+{
+       WL_TRACE(("Enter \n"));
+
+       if (wl_cfgp2p_register_ndev(cfg) < 0) {
+               WL_ERR(("P2P attach failed. \n"));
+               return -ENODEV;
+       }
+
+       return 0;
+}
+
+static s32  wl_cfg80211_detach_p2p(struct bcm_cfg80211 *cfg)
+{
+       struct wireless_dev *wdev;
+
+       WL_DBG(("Enter \n"));
+       if (!cfg) {
+               WL_ERR(("Invalid Ptr\n"));
+               return -EINVAL;
+       }
+       else {
+               wdev = cfg->p2p_wdev;
+               if (!wdev) {
+                       WL_ERR(("Invalid Ptr\n"));
+                       return -EINVAL;
+               }
+       }
+
+       wl_cfgp2p_unregister_ndev(cfg);
+
+       cfg->p2p_wdev = NULL;
+       cfg->p2p_net = NULL;
+       WL_DBG(("Freeing 0x%p \n", wdev));
+       kfree(wdev);
+
+       return 0;
+}
+#endif 
+
+s32 wl_cfg80211_attach_post(struct net_device *ndev)
+{
+       struct bcm_cfg80211 * cfg = NULL;
+       s32 err = 0;
+       s32 ret = 0;
+       WL_TRACE(("In\n"));
+       if (unlikely(!ndev)) {
+               WL_ERR(("ndev is invaild\n"));
+               return -ENODEV;
+       }
+       cfg = NETDEV_GET_CFG80211_PRIV(ndev);
+       if (unlikely(!cfg)) {
+               WL_ERR(("cfg is invaild\n"));
+               return -EINVAL;
+       }
+       if (!wl_get_drv_status(cfg, READY, ndev)) {
+               if (cfg->wdev) {
+                       ret = wl_cfgp2p_supported(cfg, ndev);
+                       if (ret > 0) {
+#if !defined(WL_ENABLE_P2P_IF)
+                               cfg->wdev->wiphy->interface_modes |=
+                                       (BIT(NL80211_IFTYPE_P2P_CLIENT)|
+                                       BIT(NL80211_IFTYPE_P2P_GO));
+#endif /* !WL_ENABLE_P2P_IF */
+                               if ((err = wl_cfgp2p_init_priv(cfg)) != 0)
+                                       goto fail;
+
+#if defined(WL_ENABLE_P2P_IF)
+                               if (cfg->p2p_net) {
+                                       /* Update MAC addr for p2p0 interface here. */
+                                       memcpy(cfg->p2p_net->dev_addr, ndev->dev_addr, ETH_ALEN);
+                                       cfg->p2p_net->dev_addr[0] |= 0x02;
+                                       WL_ERR(("%s: p2p_dev_addr="MACDBG "\n",
+                                               cfg->p2p_net->name,
+                                               MAC2STRDBG(cfg->p2p_net->dev_addr)));
+                               } else {
+                                       WL_ERR(("p2p_net not yet populated."
+                                       " Couldn't update the MAC Address for p2p0 \n"));
+                                       return -ENODEV;
+                               }
+#endif /* WL_ENABLE_P2P_IF */
+                               cfg->p2p_supported = true;
+                       } else if (ret == 0) {
+                               if ((err = wl_cfgp2p_init_priv(cfg)) != 0)
+                                       goto fail;
+                       } else {
+                               /* SDIO bus timeout */
+                               err = -ENODEV;
+                               goto fail;
+                       }
+               }
+       }
+       wl_set_drv_status(cfg, READY, ndev);
+fail:
+       return err;
+}
+
+void *wl_cfg80211_attach(struct net_device *ndev, void *context)
+{
+       struct wireless_dev *wdev;
+       struct bcm_cfg80211 *cfg = NULL;
+       s32 err = 0;
+       struct device *dev;
+
+       WL_TRACE(("In\n"));
+       if (!ndev) {
+               WL_ERR(("ndev is invaild\n"));
+               return NULL;
+       }
+       WL_DBG(("func %p\n", wl_cfg80211_get_parent_dev()));
+       dev = wl_cfg80211_get_parent_dev();
+
+       wdev = kzalloc(sizeof(*wdev), GFP_KERNEL);
+       if (unlikely(!wdev)) {
+               WL_ERR(("Could not allocate wireless device\n"));
+               return cfg;
+       }
+       err = wl_setup_wiphy(wdev, dev, context);
+       if (unlikely(err)) {
+               kfree(wdev);
+               return cfg;
+       }
+       wdev->iftype = wl_mode_to_nl80211_iftype(WL_MODE_BSS);
+       cfg = (struct bcm_cfg80211 *)wiphy_priv(wdev->wiphy);
+       cfg->wdev = wdev;
+       cfg->pub = context;
+       INIT_LIST_HEAD(&cfg->net_list);
+       spin_lock_init(&cfg->net_list_sync);
+       ndev->ieee80211_ptr = wdev;
+       SET_NETDEV_DEV(ndev, wiphy_dev(wdev->wiphy));
+       wdev->netdev = ndev;
+       cfg->state_notifier = wl_notifier_change_state;
+       err = wl_alloc_netinfo(cfg, ndev, wdev, WL_MODE_BSS, PM_ENABLE, 0);
+       if (err) {
+               WL_ERR(("Failed to alloc net_info (%d)\n", err));
+               goto cfg80211_attach_out;
+       }
+       err = wl_init_priv(cfg);
+       if (err) {
+               WL_ERR(("Failed to init iwm_priv (%d)\n", err));
+               goto cfg80211_attach_out;
+       }
+
+       err = wl_setup_rfkill(cfg, TRUE);
+       if (err) {
+               WL_ERR(("Failed to setup rfkill %d\n", err));
+               goto cfg80211_attach_out;
+       }
+#ifdef DEBUGFS_CFG80211
+       err = wl_setup_debugfs(cfg);
+       if (err) {
+               WL_ERR(("Failed to setup debugfs %d\n", err));
+               goto cfg80211_attach_out;
+       }
+#endif
+       if (!wl_cfg80211_netdev_notifier_registered) {
+               wl_cfg80211_netdev_notifier_registered = TRUE;
+               err = register_netdevice_notifier(&wl_cfg80211_netdev_notifier);
+               if (err) {
+                       wl_cfg80211_netdev_notifier_registered = FALSE;
+                       WL_ERR(("Failed to register notifierl %d\n", err));
+                       goto cfg80211_attach_out;
+               }
+       }
+#if defined(COEX_DHCP)
+       cfg->btcoex_info = wl_cfg80211_btcoex_init(cfg->wdev->netdev);
+       if (!cfg->btcoex_info)
+               goto cfg80211_attach_out;
+#endif 
+#if defined(SUPPORT_RANDOM_MAC_SCAN)
+       cfg->random_mac_enabled = FALSE;
+#endif /* SUPPORT_RANDOM_MAC_SCAN */
+
+#ifdef CONFIG_CFG80211_INTERNAL_REGDB
+       wdev->wiphy->reg_notifier = wl_cfg80211_reg_notifier;
+#endif /* CONFIG_CFG80211_INTERNAL_REGDB */
+
+#if defined(WL_ENABLE_P2P_IF)
+       err = wl_cfg80211_attach_p2p(cfg);
+       if (err)
+               goto cfg80211_attach_out;
+#endif 
+
+       INIT_DELAYED_WORK(&cfg->pm_enable_work, wl_cfg80211_work_handler);
+       mutex_init(&cfg->pm_sync);
+
+       return cfg;
+
+cfg80211_attach_out:
+       wl_setup_rfkill(cfg, FALSE);
+       wl_free_wdev(cfg);
+       cfg = NULL;
+       return cfg;
+}
+
+void wl_cfg80211_detach(void *cfg80211_priv)
+{
+       struct bcm_cfg80211 *cfg = NULL;
+
+       cfg = (struct bcm_cfg80211 *) cfg80211_priv;
+
+       WL_TRACE(("In\n"));
+
+       wl_add_remove_pm_enable_work(cfg, WL_PM_WORKQ_DEL);
+
+#if defined(COEX_DHCP)
+       wl_cfg80211_btcoex_deinit();
+       cfg->btcoex_info = NULL;
+#endif 
+
+       wl_setup_rfkill(cfg, FALSE);
+#ifdef DEBUGFS_CFG80211
+       wl_free_debugfs(cfg);
+#endif
+       if (cfg->p2p_supported) {
+               if (timer_pending(&cfg->p2p->listen_timer))
+                       del_timer_sync(&cfg->p2p->listen_timer);
+               wl_cfgp2p_deinit_priv(cfg);
+       }
+
+       if (timer_pending(&cfg->scan_timeout))
+               del_timer_sync(&cfg->scan_timeout);
+#ifdef DHD_LOSSLESS_ROAMING
+       if (timer_pending(&cfg->roam_timeout)) {
+               del_timer_sync(&cfg->roam_timeout);
+       }
+#endif /* DHD_LOSSLESS_ROAMING */
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+       if (cfg->p2p_wdev)
+               wl_cfgp2p_del_p2p_disc_if(cfg->p2p_wdev, cfg);
+#endif /* WL_CFG80211_P2P_DEV_IF  */
+#if defined(WL_ENABLE_P2P_IF)
+       wl_cfg80211_detach_p2p(cfg);
+#endif 
+
+       wl_cfg80211_ibss_vsie_free(cfg);
+       wl_cfg80211_clear_mgmt_vndr_ies(cfg);
+       wl_deinit_priv(cfg);
+       wl_cfg80211_clear_parent_dev();
+       wl_free_wdev(cfg);
+       /* PLEASE do NOT call any function after wl_free_wdev, the driver's private
+        * structure "cfg", which is the private part of wiphy, has been freed in
+        * wl_free_wdev !!!!!!!!!!!
+        */
+}
+
+static void wl_event_handler(struct work_struct *work_data)
+{
+       struct bcm_cfg80211 *cfg = NULL;
+       struct wl_event_q *e;
+       struct wireless_dev *wdev = NULL;
+
+       WL_DBG(("Enter \n"));
+       BCM_SET_CONTAINER_OF(cfg, work_data, struct bcm_cfg80211, event_work);
+       DHD_EVENT_WAKE_LOCK(cfg->pub);
+       while ((e = wl_deq_event(cfg))) {
+               WL_DBG(("event type (%d), ifidx: %d bssidx: %d \n",
+                               e->etype, e->emsg.ifidx, e->emsg.bsscfgidx));
+
+               if (e->emsg.ifidx > WL_MAX_IFS) {
+                       WL_ERR((" Event ifidx not in range. val:%d \n", e->emsg.ifidx));
+                       goto fail;
+               }
+
+               if (!(wdev = wl_get_wdev_by_bssidx(cfg, e->emsg.bsscfgidx))) {
+                       /* For WLC_E_IF would be handled by wl_host_event */
+                       if (e->etype != WLC_E_IF)
+                               WL_ERR(("No wdev corresponding to bssidx: 0x%x found!"
+                                                       " Ignoring event.\n", e->emsg.bsscfgidx));
+               } else if (e->etype < WLC_E_LAST && cfg->evt_handler[e->etype]) {
+                       dhd_pub_t *dhd = (struct dhd_pub *)(cfg->pub);
+                       if (dhd->busstate == DHD_BUS_DOWN) {
+                               WL_ERR((": BUS is DOWN.\n"));
+                       } else {
+#ifdef DHD_IFDEBUG
+                               if (cfg->iface_cnt == 0) {
+                                       wl_dump_ifinfo(cfg);
+                               }
+#endif
+                               cfg->evt_handler[e->etype](cfg, wdev_to_cfgdev(wdev),
+                                               &e->emsg, e->edata);
+                       }
+               } else {
+                       WL_DBG(("Unknown Event (%d): ignoring\n", e->etype));
+               }
+fail:
+               wl_put_event(e);
+       }
+       DHD_EVENT_WAKE_UNLOCK(cfg->pub);
+}
+
+void
+wl_cfg80211_event(struct net_device *ndev, const wl_event_msg_t * e, void *data)
+{
+       u32 event_type = ntoh32(e->event_type);
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(ndev);
+       struct net_info *netinfo;
+
+#if (WL_DBG_LEVEL > 0)
+       s8 *estr = (event_type <= sizeof(wl_dbg_estr) / WL_DBG_ESTR_MAX - 1) ?
+           wl_dbg_estr[event_type] : (s8 *) "Unknown";
+       WL_DBG(("event_type (%d):" "WLC_E_" "%s\n", event_type, estr));
+#endif /* (WL_DBG_LEVEL > 0) */
+
+       if ((cfg == NULL) || (cfg->p2p_supported && cfg->p2p == NULL)) {
+               WL_ERR(("Stale event ignored\n"));
+               return;
+       }
+
+       if (cfg->event_workq == NULL) {
+               WL_ERR(("Event handler is not created\n"));
+               return;
+       }
+
+       if (wl_get_p2p_status(cfg, IF_CHANGING) || wl_get_p2p_status(cfg, IF_ADDING)) {
+               WL_ERR(("during IF change, ignore event %d\n", event_type));
+               return;
+       }
+
+#ifdef DHD_IFDEBUG
+       if (event_type != WLC_E_ESCAN_RESULT) {
+               WL_ERR(("Event_type %d , status : %d, reason : %d, bssidx:%d \n",
+                       event_type, ntoh32(e->status), ntoh32(e->reason), e->bsscfgidx));
+       }
+#endif
+       netinfo = wl_get_netinfo_by_bssidx(cfg, e->bsscfgidx);
+       if (!netinfo) {
+               /* Since the netinfo entry is not there, the netdev entry is not
+                * created via cfg80211 interface. so the event is not of interest
+                * to the cfg80211 layer.
+                */
+               WL_ERR(("ignore event %d, not interested\n", event_type));
+               return;
+       }
+
+       if (event_type == WLC_E_PFN_NET_FOUND) {
+               WL_DBG((" PNOEVENT: PNO_NET_FOUND\n"));
+       }
+       else if (event_type == WLC_E_PFN_NET_LOST) {
+               WL_DBG((" PNOEVENT: PNO_NET_LOST\n"));
+       }
+
+       if (likely(!wl_enq_event(cfg, ndev, event_type, e, data))) {
+               if (cfg->event_workq) {
+                       queue_work(cfg->event_workq, &cfg->event_work);
+               }
+       }
+}
+
+static void wl_init_eq(struct bcm_cfg80211 *cfg)
+{
+       wl_init_eq_lock(cfg);
+       INIT_LIST_HEAD(&cfg->eq_list);
+}
+
+static void wl_flush_eq(struct bcm_cfg80211 *cfg)
+{
+       struct wl_event_q *e;
+       unsigned long flags;
+
+       flags = wl_lock_eq(cfg);
+       while (!list_empty_careful(&cfg->eq_list)) {
+               BCM_SET_LIST_FIRST_ENTRY(e, &cfg->eq_list, struct wl_event_q, eq_list);
+               list_del(&e->eq_list);
+               kfree(e);
+       }
+       wl_unlock_eq(cfg, flags);
+}
+
+/*
+* retrieve first queued event from head
+*/
+
+static struct wl_event_q *wl_deq_event(struct bcm_cfg80211 *cfg)
+{
+       struct wl_event_q *e = NULL;
+       unsigned long flags;
+
+       flags = wl_lock_eq(cfg);
+       if (likely(!list_empty(&cfg->eq_list))) {
+               BCM_SET_LIST_FIRST_ENTRY(e, &cfg->eq_list, struct wl_event_q, eq_list);
+               list_del(&e->eq_list);
+       }
+       wl_unlock_eq(cfg, flags);
+
+       return e;
+}
+
+/*
+ * push event to tail of the queue
+ */
+
+static s32
+wl_enq_event(struct bcm_cfg80211 *cfg, struct net_device *ndev, u32 event,
+       const wl_event_msg_t *msg, void *data)
+{
+       struct wl_event_q *e;
+       s32 err = 0;
+       uint32 evtq_size;
+       uint32 data_len;
+       unsigned long flags;
+       gfp_t aflags;
+
+       data_len = 0;
+       if (data)
+               data_len = ntoh32(msg->datalen);
+       evtq_size = sizeof(struct wl_event_q) + data_len;
+       aflags = (in_atomic()) ? GFP_ATOMIC : GFP_KERNEL;
+       e = kzalloc(evtq_size, aflags);
+       if (unlikely(!e)) {
+               WL_ERR(("event alloc failed\n"));
+               return -ENOMEM;
+       }
+       e->etype = event;
+       memcpy(&e->emsg, msg, sizeof(wl_event_msg_t));
+       if (data)
+               memcpy(e->edata, data, data_len);
+       flags = wl_lock_eq(cfg);
+       list_add_tail(&e->eq_list, &cfg->eq_list);
+       wl_unlock_eq(cfg, flags);
+
+       return err;
+}
+
+static void wl_put_event(struct wl_event_q *e)
+{
+       kfree(e);
+}
+
+static s32 wl_config_ifmode(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32 iftype)
+{
+       s32 infra = 0;
+       s32 err = 0;
+       s32 mode = 0;
+       switch (iftype) {
+       case NL80211_IFTYPE_MONITOR:
+       case NL80211_IFTYPE_WDS:
+               WL_ERR(("type (%d) : currently we do not support this mode\n",
+                       iftype));
+               err = -EINVAL;
+               return err;
+       case NL80211_IFTYPE_ADHOC:
+               mode = WL_MODE_IBSS;
+               break;
+       case NL80211_IFTYPE_STATION:
+       case NL80211_IFTYPE_P2P_CLIENT:
+               mode = WL_MODE_BSS;
+               infra = 1;
+               break;
+       case NL80211_IFTYPE_AP:
+       case NL80211_IFTYPE_P2P_GO:
+               mode = WL_MODE_AP;
+               infra = 1;
+               break;
+       default:
+               err = -EINVAL;
+               WL_ERR(("invalid type (%d)\n", iftype));
+               return err;
+       }
+       infra = htod32(infra);
+       err = wldev_ioctl(ndev, WLC_SET_INFRA, &infra, sizeof(infra), true);
+       if (unlikely(err)) {
+               WL_ERR(("WLC_SET_INFRA error (%d)\n", err));
+               return err;
+       }
+
+       wl_set_mode_by_netdev(cfg, ndev, mode);
+
+       return 0;
+}
+
+void wl_cfg80211_add_to_eventbuffer(struct wl_eventmsg_buf *ev, u16 event, bool set)
+{
+       if (!ev || (event > WLC_E_LAST))
+               return;
+
+       if (ev->num < MAX_EVENT_BUF_NUM) {
+               ev->event[ev->num].type = event;
+               ev->event[ev->num].set = set;
+               ev->num++;
+       } else {
+               WL_ERR(("evenbuffer doesn't support > %u events. Update"
+                       " the define MAX_EVENT_BUF_NUM \n", MAX_EVENT_BUF_NUM));
+               ASSERT(0);
+       }
+}
+
+s32 wl_cfg80211_apply_eventbuffer(
+       struct net_device *ndev,
+       struct bcm_cfg80211 *cfg,
+       wl_eventmsg_buf_t *ev)
+{
+       char eventmask[WL_EVENTING_MASK_LEN];
+       int i, ret = 0;
+       s8 iovbuf[WL_EVENTING_MASK_LEN + 12];
+
+       if (!ev || (!ev->num))
+               return -EINVAL;
+
+       mutex_lock(&cfg->event_sync);
+
+       /* Read event_msgs mask */
+       bcm_mkiovar("event_msgs", NULL, 0, iovbuf,
+               sizeof(iovbuf));
+       ret = wldev_ioctl(ndev, WLC_GET_VAR, iovbuf, sizeof(iovbuf), false);
+       if (unlikely(ret)) {
+               WL_ERR(("Get event_msgs error (%d)\n", ret));
+               goto exit;
+       }
+       memcpy(eventmask, iovbuf, WL_EVENTING_MASK_LEN);
+
+       /* apply the set bits */
+       for (i = 0; i < ev->num; i++) {
+               if (ev->event[i].set)
+                       setbit(eventmask, ev->event[i].type);
+               else
+                       clrbit(eventmask, ev->event[i].type);
+       }
+
+       /* Write updated Event mask */
+       bcm_mkiovar("event_msgs", eventmask, WL_EVENTING_MASK_LEN, iovbuf,
+               sizeof(iovbuf));
+       ret = wldev_ioctl(ndev, WLC_SET_VAR, iovbuf, sizeof(iovbuf), true);
+       if (unlikely(ret)) {
+               WL_ERR(("Set event_msgs error (%d)\n", ret));
+       }
+
+exit:
+       mutex_unlock(&cfg->event_sync);
+       return ret;
+}
+
+s32 wl_add_remove_eventmsg(struct net_device *ndev, u16 event, bool add)
+{
+       s8 iovbuf[WL_EVENTING_MASK_LEN + 12];
+       s8 eventmask[WL_EVENTING_MASK_LEN];
+       s32 err = 0;
+       struct bcm_cfg80211 *cfg = NULL;
+
+       if (!ndev)
+               return -ENODEV;
+
+       cfg = NETDEV_GET_CFG80211_PRIV(ndev);
+       if (!cfg)
+               return -ENODEV;
+
+       mutex_lock(&cfg->event_sync);
+
+       /* Setup event_msgs */
+       bcm_mkiovar("event_msgs", NULL, 0, iovbuf,
+               sizeof(iovbuf));
+       err = wldev_ioctl(ndev, WLC_GET_VAR, iovbuf, sizeof(iovbuf), false);
+       if (unlikely(err)) {
+               WL_ERR(("Get event_msgs error (%d)\n", err));
+               goto eventmsg_out;
+       }
+       memcpy(eventmask, iovbuf, WL_EVENTING_MASK_LEN);
+       if (add) {
+               setbit(eventmask, event);
+       } else {
+               clrbit(eventmask, event);
+       }
+       bcm_mkiovar("event_msgs", eventmask, WL_EVENTING_MASK_LEN, iovbuf,
+               sizeof(iovbuf));
+       err = wldev_ioctl(ndev, WLC_SET_VAR, iovbuf, sizeof(iovbuf), true);
+       if (unlikely(err)) {
+               WL_ERR(("Set event_msgs error (%d)\n", err));
+               goto eventmsg_out;
+       }
+
+eventmsg_out:
+       mutex_unlock(&cfg->event_sync);
+       return err;
+}
+
+static int wl_construct_reginfo(struct bcm_cfg80211 *cfg, s32 bw_cap)
+{
+       struct net_device *dev = bcmcfg_to_prmry_ndev(cfg);
+       struct ieee80211_channel *band_chan_arr = NULL;
+       wl_uint32_list_t *list;
+       u32 i, j, index, n_2g, n_5g, band, channel, array_size;
+       u32 *n_cnt = NULL;
+       chanspec_t c = 0;
+       s32 err = BCME_OK;
+       bool update;
+       bool ht40_allowed;
+       u8 *pbuf = NULL;
+       bool dfs_radar_disabled = FALSE;
+
+#define LOCAL_BUF_LEN 1024
+       pbuf = kzalloc(LOCAL_BUF_LEN, GFP_KERNEL);
+
+       if (pbuf == NULL) {
+               WL_ERR(("failed to allocate local buf\n"));
+               return -ENOMEM;
+       }
+       list = (wl_uint32_list_t *)(void *)pbuf;
+       list->count = htod32(WL_NUMCHANSPECS);
+
+
+       err = wldev_iovar_getbuf_bsscfg(dev, "chanspecs", NULL,
+               0, pbuf, LOCAL_BUF_LEN, 0, &cfg->ioctl_buf_sync);
+       if (err != 0) {
+               WL_ERR(("get chanspecs failed with %d\n", err));
+               kfree(pbuf);
+               return err;
+       }
+#undef LOCAL_BUF_LEN
+
+       list = (wl_uint32_list_t *)(void *)pbuf;
+       band = array_size = n_2g = n_5g = 0;
+       for (i = 0; i < dtoh32(list->count); i++) {
+               index = 0;
+               update = false;
+               ht40_allowed = false;
+               c = (chanspec_t)dtoh32(list->element[i]);
+               c = wl_chspec_driver_to_host(c);
+               channel = wf_chspec_ctlchan(c);
+
+               if (!CHSPEC_IS40(c) && ! CHSPEC_IS20(c)) {
+                       WL_DBG(("HT80/160/80p80 center channel : %d\n", channel));
+                       continue;
+               }
+               if (CHSPEC_IS2G(c) && (channel >= CH_MIN_2G_CHANNEL) &&
+                       (channel <= CH_MAX_2G_CHANNEL)) {
+                       band_chan_arr = __wl_2ghz_channels;
+                       array_size = ARRAYSIZE(__wl_2ghz_channels);
+                       n_cnt = &n_2g;
+                       band = IEEE80211_BAND_2GHZ;
+                       ht40_allowed = (bw_cap  == WLC_N_BW_40ALL)? true : false;
+               } else if (CHSPEC_IS5G(c) && channel >= CH_MIN_5G_CHANNEL) {
+                       band_chan_arr = __wl_5ghz_a_channels;
+                       array_size = ARRAYSIZE(__wl_5ghz_a_channels);
+                       n_cnt = &n_5g;
+                       band = IEEE80211_BAND_5GHZ;
+                       ht40_allowed = (bw_cap  == WLC_N_BW_20ALL)? false : true;
+               } else {
+                       WL_ERR(("Invalid channel Sepc. 0x%x.\n", c));
+                       continue;
+               }
+               if (!ht40_allowed && CHSPEC_IS40(c))
+                       continue;
+               for (j = 0; (j < *n_cnt && (*n_cnt < array_size)); j++) {
+                       if (band_chan_arr[j].hw_value == channel) {
+                               update = true;
+                               break;
+                       }
+               }
+               if (update)
+                       index = j;
+               else
+                       index = *n_cnt;
+               if (index <  array_size) {
+#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 38) && !defined(WL_COMPAT_WIRELESS)
+                       band_chan_arr[index].center_freq =
+                               ieee80211_channel_to_frequency(channel);
+#else
+                       band_chan_arr[index].center_freq =
+                               ieee80211_channel_to_frequency(channel, band);
+#endif
+                       band_chan_arr[index].hw_value = channel;
+
+                       if (CHSPEC_IS40(c) && ht40_allowed) {
+                               /* assuming the order is HT20, HT40 Upper,
+                                *  HT40 lower from chanspecs
+                                */
+                               u32 ht40_flag = band_chan_arr[index].flags & IEEE80211_CHAN_NO_HT40;
+                               if (CHSPEC_SB_UPPER(c)) {
+                                       if (ht40_flag == IEEE80211_CHAN_NO_HT40)
+                                               band_chan_arr[index].flags &=
+                                                       ~IEEE80211_CHAN_NO_HT40;
+                                       band_chan_arr[index].flags |= IEEE80211_CHAN_NO_HT40PLUS;
+                               } else {
+                                       /* It should be one of
+                                        * IEEE80211_CHAN_NO_HT40 or IEEE80211_CHAN_NO_HT40PLUS
+                                        */
+                                       band_chan_arr[index].flags &= ~IEEE80211_CHAN_NO_HT40;
+                                       if (ht40_flag == IEEE80211_CHAN_NO_HT40)
+                                               band_chan_arr[index].flags |=
+                                                       IEEE80211_CHAN_NO_HT40MINUS;
+                               }
+                       } else {
+                               band_chan_arr[index].flags = IEEE80211_CHAN_NO_HT40;
+                               if (!dfs_radar_disabled) {
+                                       if (band == IEEE80211_BAND_2GHZ)
+                                               channel |= WL_CHANSPEC_BAND_2G;
+                                       else
+                                               channel |= WL_CHANSPEC_BAND_5G;
+                                       channel |= WL_CHANSPEC_BW_20;
+                                       channel = wl_chspec_host_to_driver(channel);
+                                       err = wldev_iovar_getint(dev, "per_chan_info", &channel);
+                                       if (!err) {
+                                               if (channel & WL_CHAN_RADAR) {
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 14, 0))
+                                                       band_chan_arr[index].flags |=
+                                                               (IEEE80211_CHAN_RADAR
+                                                               | IEEE80211_CHAN_NO_IBSS);
+#else
+                                                       band_chan_arr[index].flags |=
+                                                               IEEE80211_CHAN_RADAR;
+#endif
+                                               }
+
+                                               if (channel & WL_CHAN_PASSIVE)
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 14, 0))
+                                                       band_chan_arr[index].flags |=
+                                                               IEEE80211_CHAN_PASSIVE_SCAN;
+#else
+                                                       band_chan_arr[index].flags |=
+                                                               IEEE80211_CHAN_NO_IR;
+#endif
+                                       } else if (err == BCME_UNSUPPORTED) {
+                                               dfs_radar_disabled = TRUE;
+                                               WL_ERR(("does not support per_chan_info\n"));
+                                       }
+                               }
+                       }
+                       if (!update)
+                               (*n_cnt)++;
+               }
+
+       }
+       __wl_band_2ghz.n_channels = n_2g;
+       __wl_band_5ghz_a.n_channels = n_5g;
+       kfree(pbuf);
+       return err;
+}
+
+s32 wl_update_wiphybands(struct bcm_cfg80211 *cfg, bool notify, bool user_sync)
+{
+       struct wiphy *wiphy;
+       struct net_device *dev;
+       u32 bandlist[3];
+       u32 nband = 0;
+       u32 i = 0;
+       s32 err = 0;
+       s32 index = 0;
+       s32 nmode = 0;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
+       u32 j = 0;
+       s32 vhtmode = 0;
+       s32 txstreams = 0;
+       s32 rxstreams = 0;
+       s32 ldpc_cap = 0;
+       s32 stbc_rx = 0;
+       s32 stbc_tx = 0;
+       s32 txbf_bfe_cap = 0;
+       s32 txbf_bfr_cap = 0;
+#endif 
+       s32 bw_cap = 0;
+       s32 cur_band = -1;
+       struct ieee80211_supported_band *bands[IEEE80211_NUM_BANDS] = {NULL, };
+
+       if (user_sync == true) {
+               mutex_lock(&cfg->usr_sync);
+       }
+       dev = bcmcfg_to_prmry_ndev(cfg);
+
+       memset(bandlist, 0, sizeof(bandlist));
+       err = wldev_ioctl(dev, WLC_GET_BANDLIST, bandlist,
+               sizeof(bandlist), false);
+       if (unlikely(err)) {
+               WL_ERR(("error read bandlist (%d)\n", err));
+               goto end_bands;
+       }
+       err = wldev_ioctl(dev, WLC_GET_BAND, &cur_band,
+               sizeof(s32), false);
+       if (unlikely(err)) {
+               WL_ERR(("error (%d)\n", err));
+               goto end_bands;
+       }
+
+       err = wldev_iovar_getint(dev, "nmode", &nmode);
+       if (unlikely(err)) {
+               WL_ERR(("error reading nmode (%d)\n", err));
+       }
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
+       err = wldev_iovar_getint(dev, "vhtmode", &vhtmode);
+       if (unlikely(err)) {
+               WL_ERR(("error reading vhtmode (%d)\n", err));
+       }
+
+       if (vhtmode) {
+               err = wldev_iovar_getint(dev, "txstreams", &txstreams);
+               if (unlikely(err)) {
+                       WL_ERR(("error reading txstreams (%d)\n", err));
+               }
+
+               err = wldev_iovar_getint(dev, "rxstreams", &rxstreams);
+               if (unlikely(err)) {
+                       WL_ERR(("error reading rxstreams (%d)\n", err));
+               }
+
+               err = wldev_iovar_getint(dev, "ldpc_cap", &ldpc_cap);
+               if (unlikely(err)) {
+                       WL_ERR(("error reading ldpc_cap (%d)\n", err));
+               }
+
+               err = wldev_iovar_getint(dev, "stbc_rx", &stbc_rx);
+               if (unlikely(err)) {
+                       WL_ERR(("error reading stbc_rx (%d)\n", err));
+               }
+
+               err = wldev_iovar_getint(dev, "stbc_tx", &stbc_tx);
+               if (unlikely(err)) {
+                       WL_ERR(("error reading stbc_tx (%d)\n", err));
+               }
+
+               err = wldev_iovar_getint(dev, "txbf_bfe_cap", &txbf_bfe_cap);
+               if (unlikely(err)) {
+                       WL_ERR(("error reading txbf_bfe_cap (%d)\n", err));
+               }
+
+               err = wldev_iovar_getint(dev, "txbf_bfr_cap", &txbf_bfr_cap);
+               if (unlikely(err)) {
+                       WL_ERR(("error reading txbf_bfr_cap (%d)\n", err));
+               }
+       }
+#endif 
+
+       /* For nmode and vhtmode   check bw cap */
+       if (nmode ||
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
+               vhtmode ||
+#endif 
+               0) {
+               err = wldev_iovar_getint(dev, "mimo_bw_cap", &bw_cap);
+               if (unlikely(err)) {
+                       WL_ERR(("error get mimo_bw_cap (%d)\n", err));
+               }
+       }
+
+       err = wl_construct_reginfo(cfg, bw_cap);
+       if (err) {
+               WL_ERR(("wl_construct_reginfo() fails err=%d\n", err));
+               if (err != BCME_UNSUPPORTED)
+                       goto end_bands;
+               err = 0;
+       }
+       wiphy = bcmcfg_to_wiphy(cfg);
+       nband = bandlist[0];
+
+       for (i = 1; i <= nband && i < ARRAYSIZE(bandlist); i++) {
+               index = -1;
+               if (bandlist[i] == WLC_BAND_5G && __wl_band_5ghz_a.n_channels > 0) {
+                       bands[IEEE80211_BAND_5GHZ] =
+                               &__wl_band_5ghz_a;
+                       index = IEEE80211_BAND_5GHZ;
+                       if (nmode && (bw_cap == WLC_N_BW_40ALL || bw_cap == WLC_N_BW_20IN2G_40IN5G))
+                               bands[index]->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
+                       /* VHT capabilities. */
+                       if (vhtmode) {
+                               /* Supported */
+                               bands[index]->vht_cap.vht_supported = TRUE;
+
+                               for (j = 1; j <= VHT_CAP_MCS_MAP_NSS_MAX; j++) {
+                                       /* TX stream rates. */
+                                       if (j <= txstreams) {
+                                               VHT_MCS_MAP_SET_MCS_PER_SS(j, VHT_CAP_MCS_MAP_0_9,
+                                                       bands[index]->vht_cap.vht_mcs.tx_mcs_map);
+                                       } else {
+                                               VHT_MCS_MAP_SET_MCS_PER_SS(j, VHT_CAP_MCS_MAP_NONE,
+                                                       bands[index]->vht_cap.vht_mcs.tx_mcs_map);
+                                       }
+
+                                       /* RX stream rates. */
+                                       if (j <= rxstreams) {
+                                               VHT_MCS_MAP_SET_MCS_PER_SS(j, VHT_CAP_MCS_MAP_0_9,
+                                                       bands[index]->vht_cap.vht_mcs.rx_mcs_map);
+                                       } else {
+                                               VHT_MCS_MAP_SET_MCS_PER_SS(j, VHT_CAP_MCS_MAP_NONE,
+                                                       bands[index]->vht_cap.vht_mcs.rx_mcs_map);
+                                       }
+                               }
+
+
+                               /* Capabilities */
+                               /* 80 MHz is mandatory */
+                               bands[index]->vht_cap.cap |=
+                                       IEEE80211_VHT_CAP_SHORT_GI_80;
+
+                               if (WL_BW_CAP_160MHZ(bw_cap)) {
+                                       bands[index]->vht_cap.cap |=
+                                               IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
+                                       bands[index]->vht_cap.cap |=
+                                               IEEE80211_VHT_CAP_SHORT_GI_160;
+                               }
+
+                               bands[index]->vht_cap.cap |=
+                                       IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
+
+                               if (ldpc_cap)
+                                       bands[index]->vht_cap.cap |=
+                                               IEEE80211_VHT_CAP_RXLDPC;
+
+                               if (stbc_tx)
+                                       bands[index]->vht_cap.cap |=
+                                               IEEE80211_VHT_CAP_TXSTBC;
+
+                               if (stbc_rx)
+                                       bands[index]->vht_cap.cap |=
+                                               (stbc_rx << VHT_CAP_INFO_RX_STBC_SHIFT);
+
+                               if (txbf_bfe_cap)
+                                       bands[index]->vht_cap.cap |=
+                                               IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
+
+                               if (txbf_bfr_cap) {
+                                       bands[index]->vht_cap.cap |=
+                                               IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
+                               }
+
+                               if (txbf_bfe_cap || txbf_bfr_cap) {
+                                       bands[index]->vht_cap.cap |=
+                                               (2 << VHT_CAP_INFO_NUM_BMFMR_ANT_SHIFT);
+                                       bands[index]->vht_cap.cap |=
+                                               ((txstreams - 1) <<
+                                                       VHT_CAP_INFO_NUM_SOUNDING_DIM_SHIFT);
+                                       bands[index]->vht_cap.cap |=
+                                               IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB;
+                               }
+
+                               /* AMPDU length limit, support max 1MB (2 ^ (13 + 7)) */
+                               bands[index]->vht_cap.cap |=
+                                       (7 << VHT_CAP_INFO_AMPDU_MAXLEN_EXP_SHIFT);
+                               WL_INFORM(("%s band[%d] vht_enab=%d vht_cap=%08x "
+                                       "vht_rx_mcs_map=%04x vht_tx_mcs_map=%04x\n",
+                                       __FUNCTION__, index,
+                                       bands[index]->vht_cap.vht_supported,
+                                       bands[index]->vht_cap.cap,
+                                       bands[index]->vht_cap.vht_mcs.rx_mcs_map,
+                                       bands[index]->vht_cap.vht_mcs.tx_mcs_map));
+                       }
+#endif 
+               }
+               else if (bandlist[i] == WLC_BAND_2G && __wl_band_2ghz.n_channels > 0) {
+                       bands[IEEE80211_BAND_2GHZ] =
+                               &__wl_band_2ghz;
+                       index = IEEE80211_BAND_2GHZ;
+                       if (bw_cap == WLC_N_BW_40ALL)
+                               bands[index]->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
+               }
+
+               if ((index >= 0) && nmode) {
+                       bands[index]->ht_cap.cap |=
+                               (IEEE80211_HT_CAP_SGI_20 | IEEE80211_HT_CAP_DSSSCCK40);
+                       bands[index]->ht_cap.ht_supported = TRUE;
+                       bands[index]->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
+                       bands[index]->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
+                       /* An HT shall support all EQM rates for one spatial stream */
+                       bands[index]->ht_cap.mcs.rx_mask[0] = 0xff;
+               }
+
+       }
+
+       wiphy->bands[IEEE80211_BAND_2GHZ] = bands[IEEE80211_BAND_2GHZ];
+       wiphy->bands[IEEE80211_BAND_5GHZ] = bands[IEEE80211_BAND_5GHZ];
+
+       /* check if any bands populated otherwise makes 2Ghz as default */
+       if (wiphy->bands[IEEE80211_BAND_2GHZ] == NULL &&
+               wiphy->bands[IEEE80211_BAND_5GHZ] == NULL) {
+               /* Setup 2Ghz band as default */
+               wiphy->bands[IEEE80211_BAND_2GHZ] = &__wl_band_2ghz;
+       }
+
+       if (notify)
+               wiphy_apply_custom_regulatory(wiphy, &brcm_regdom);
+
+       end_bands:
+               if (user_sync)
+                       mutex_unlock(&cfg->usr_sync);
+       return err;
+}
+
+static s32 __wl_cfg80211_up(struct bcm_cfg80211 *cfg)
+{
+       s32 err = 0;
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+       struct wireless_dev *wdev = ndev->ieee80211_ptr;
+
+       WL_DBG(("In\n"));
+
+       err = dhd_config_dongle(cfg);
+       if (unlikely(err))
+               return err;
+
+       err = wl_config_ifmode(cfg, ndev, wdev->iftype);
+       if (unlikely(err && err != -EINPROGRESS)) {
+               WL_ERR(("wl_config_ifmode failed\n"));
+               if (err == -1) {
+                       WL_ERR(("return error %d\n", err));
+                       return err;
+               }
+       }
+       err = wl_update_wiphybands(cfg, true, false);
+       if (unlikely(err)) {
+               WL_ERR(("wl_update_wiphybands failed\n"));
+               if (err == -1) {
+                       WL_ERR(("return error %d\n", err));
+                       return err;
+               }
+       }
+
+       err = wl_create_event_handler(cfg);
+       if (err) {
+               WL_ERR(("wl_create_event_handler failed\n"));
+               return err;
+       }
+       wl_init_event_handler(cfg);
+
+       err = wl_init_scan(cfg);
+       if (err) {
+               WL_ERR(("wl_init_scan failed\n"));
+               return err;
+       }
+#ifdef DHD_LOSSLESS_ROAMING
+       if (timer_pending(&cfg->roam_timeout)) {
+               del_timer_sync(&cfg->roam_timeout);
+       }
+#endif /* DHD_LOSSLESS_ROAMING */
+
+       err = dhd_monitor_init(cfg->pub);
+
+       wl_set_drv_status(cfg, READY, ndev);
+       return err;
+}
+
+static s32 __wl_cfg80211_down(struct bcm_cfg80211 *cfg)
+{
+       s32 err = 0;
+       unsigned long flags;
+       struct net_info *iter, *next;
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+#if defined(WL_CFG80211) && defined(WL_ENABLE_P2P_IF)
+       struct net_device *p2p_net = cfg->p2p_net;
+#endif 
+#ifdef PROP_TXSTATUS_VSDB
+#if defined(BCMSDIO)
+       dhd_pub_t *dhd =  (dhd_pub_t *)(cfg->pub);
+#endif
+#endif /* PROP_TXSTATUS_VSDB */
+       WL_DBG(("In\n"));
+       /* Delete pm_enable_work */
+       wl_add_remove_pm_enable_work(cfg, WL_PM_WORKQ_DEL);
+
+#ifdef WL_NAN
+       wl_cfgnan_stop_handler(ndev, cfg, NULL, 0, NULL);
+#endif /* WL_NAN */
+
+       if (cfg->p2p_supported) {
+               wl_clr_p2p_status(cfg, GO_NEG_PHASE);
+#ifdef PROP_TXSTATUS_VSDB
+#if defined(BCMSDIO)
+               if (wl_cfgp2p_vif_created(cfg)) {
+                       bool enabled = false;
+                       dhd_wlfc_get_enable(dhd, &enabled);
+                       if (enabled && cfg->wlfc_on && dhd->op_mode != DHD_FLAG_HOSTAP_MODE &&
+                               dhd->op_mode != DHD_FLAG_IBSS_MODE) {
+                               dhd_wlfc_deinit(dhd);
+                               cfg->wlfc_on = false;
+                       }
+               }
+#endif 
+#endif /* PROP_TXSTATUS_VSDB */
+       }
+
+
+       /* If primary BSS is operational (for e.g SoftAP), bring it down */
+       if (wl_cfgp2p_bss_isup(ndev, 0)) {
+               if (wl_cfgp2p_bss(cfg, ndev, 0, 0) < 0)
+                       WL_ERR(("BSS down failed \n"));
+       }
+
+       /* Check if cfg80211 interface is already down */
+       if (!wl_get_drv_status(cfg, READY, ndev))
+               return err;     /* it is even not ready */
+
+       /* clear all the security setting on primary Interface */
+       wl_cfg80211_clear_security(cfg);
+
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+_Pragma("GCC diagnostic push")
+_Pragma("GCC diagnostic ignored \"-Wcast-qual\"")
+#endif
+       for_each_ndev(cfg, iter, next) {
+               if (iter->ndev) /* p2p discovery iface is null */
+                       wl_set_drv_status(cfg, SCAN_ABORTING, iter->ndev);
+       }
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+_Pragma("GCC diagnostic pop")
+#endif
+
+#ifdef P2P_LISTEN_OFFLOADING
+       wl_cfg80211_p2plo_deinit(cfg);
+#endif /* P2P_LISTEN_OFFLOADING */
+
+       spin_lock_irqsave(&cfg->cfgdrv_lock, flags);
+       if (cfg->scan_request) {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0)
+               struct cfg80211_scan_info info = {
+                       .aborted = true
+               };
+               cfg80211_scan_done(cfg->scan_request, &info);
+#else
+               cfg80211_scan_done(cfg->scan_request, true);
+#endif
+               cfg->scan_request = NULL;
+       }
+       spin_unlock_irqrestore(&cfg->cfgdrv_lock, flags);
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+_Pragma("GCC diagnostic push")
+_Pragma("GCC diagnostic ignored \"-Wcast-qual\"")
+#endif
+       for_each_ndev(cfg, iter, next) {
+               /* p2p discovery iface ndev ptr could be null */
+               if (iter->ndev == NULL)
+                       continue;
+               wl_clr_drv_status(cfg, READY, iter->ndev);
+               wl_clr_drv_status(cfg, SCANNING, iter->ndev);
+               wl_clr_drv_status(cfg, SCAN_ABORTING, iter->ndev);
+               wl_clr_drv_status(cfg, CONNECTING, iter->ndev);
+               wl_clr_drv_status(cfg, CONNECTED, iter->ndev);
+               wl_clr_drv_status(cfg, DISCONNECTING, iter->ndev);
+               wl_clr_drv_status(cfg, AP_CREATED, iter->ndev);
+               wl_clr_drv_status(cfg, AP_CREATING, iter->ndev);
+       }
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+_Pragma("GCC diagnostic pop")
+#endif
+       bcmcfg_to_prmry_ndev(cfg)->ieee80211_ptr->iftype =
+               NL80211_IFTYPE_STATION;
+#if defined(WL_CFG80211) && defined(WL_ENABLE_P2P_IF)
+               if (p2p_net)
+                       dev_close(p2p_net);
+#endif 
+
+       /* Avoid deadlock from wl_cfg80211_down */
+       mutex_unlock(&cfg->usr_sync);
+       wl_destroy_event_handler(cfg);
+       mutex_lock(&cfg->usr_sync);
+       wl_flush_eq(cfg);
+       wl_link_down(cfg);
+       if (cfg->p2p_supported) {
+               if (timer_pending(&cfg->p2p->listen_timer))
+                       del_timer_sync(&cfg->p2p->listen_timer);
+               wl_cfgp2p_down(cfg);
+       }
+
+       if (timer_pending(&cfg->scan_timeout)) {
+               del_timer_sync(&cfg->scan_timeout);
+       }
+
+       DHD_OS_SCAN_WAKE_UNLOCK((dhd_pub_t *)(cfg->pub));
+
+       dhd_monitor_uninit();
+#ifdef WLAIBSS_MCHAN
+       bcm_cfg80211_del_ibss_if(cfg->wdev->wiphy, cfg->ibss_cfgdev);
+#endif /* WLAIBSS_MCHAN */
+
+#if defined(WL_VIRTUAL_APSTA) || defined(DUAL_STA_STATIC_IF)
+       /* Delete all the pending virtual interfaces */
+       for_each_ndev(cfg, iter, next) {
+               if (iter->ndev && (iter->ndev != bcmcfg_to_prmry_ndev(cfg))) {
+                       wl_cfg80211_del_iface(cfg->wdev->wiphy, ndev_to_cfgdev(iter->ndev));
+               }
+       }
+#endif /* defined (WL_VIRTUAL_APSTA) || defined (DUAL_STA_STATIC_IF) */
+
+#ifdef WL11U
+       /* Clear interworking element. */
+       wl_clear_iwdata(cfg);
+#endif /* WL11U */
+
+#ifdef CUSTOMER_HW4_DEBUG
+       if (wl_scan_timeout_dbg_enabled)
+               wl_scan_timeout_dbg_clear();
+#endif /* CUSTOMER_HW4_DEBUG */
+
+       cfg->disable_roam_event = false;
+
+       DNGL_FUNC(dhd_cfg80211_down, (cfg));
+
+#ifdef DHD_IFDEBUG
+       /* Printout all netinfo entries */
+       wl_probe_wdev_all(cfg);
+#endif /* DHD_IFDEBUG */
+
+       return err;
+}
+
+s32 wl_cfg80211_up(void *para)
+{
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)para;
+       s32 err = 0;
+       int val = 1;
+       dhd_pub_t *dhd;
+#ifdef DISABLE_PM_BCNRX
+       s32 interr = 0;
+       uint param = 0;
+       s8 iovbuf[WLC_IOCTL_SMLEN];
+#endif /* DISABLE_PM_BCNRX */
+
+       WL_DBG(("In\n"));
+
+       if ((err = wldev_ioctl(bcmcfg_to_prmry_ndev(cfg), WLC_GET_VERSION, &val,
+               sizeof(int), false) < 0)) {
+               WL_ERR(("WLC_GET_VERSION failed, err=%d\n", err));
+               return err;
+       }
+       val = dtoh32(val);
+       if (val != WLC_IOCTL_VERSION && val != 1) {
+               WL_ERR(("Version mismatch, please upgrade. Got %d, expected %d or 1\n",
+                       val, WLC_IOCTL_VERSION));
+               return BCME_VERSION;
+       }
+       ioctl_version = val;
+       WL_TRACE(("WLC_GET_VERSION=%d\n", ioctl_version));
+
+       mutex_lock(&cfg->usr_sync);
+       dhd = (dhd_pub_t *)(cfg->pub);
+       if (!(dhd->op_mode & DHD_FLAG_HOSTAP_MODE)) {
+               err = wl_cfg80211_attach_post(bcmcfg_to_prmry_ndev(cfg));
+               if (unlikely(err)) {
+                       mutex_unlock(&cfg->usr_sync);
+                       return err;
+               }
+       }
+       err = __wl_cfg80211_up(cfg);
+       if (unlikely(err))
+               WL_ERR(("__wl_cfg80211_up failed\n"));
+
+
+
+       /* IOVAR configurations with 'up' condition */
+#ifdef DISABLE_PM_BCNRX
+       bcm_mkiovar("pm_bcnrx", (char *)&param, 4, iovbuf, sizeof(iovbuf));
+       interr = wldev_ioctl(bcmcfg_to_prmry_ndev(cfg), WLC_SET_VAR, iovbuf, sizeof(iovbuf), true);
+       if (unlikely(interr))
+               WL_ERR(("Set pm_bcnrx returned (%d)\n", interr));
+#endif /* DISABLE_PM_BCNRX */
+
+       mutex_unlock(&cfg->usr_sync);
+
+#ifdef WLAIBSS_MCHAN
+       bcm_cfg80211_add_ibss_if(cfg->wdev->wiphy, IBSS_IF_NAME);
+#endif /* WLAIBSS_MCHAN */
+
+#ifdef DUAL_STA_STATIC_IF
+#ifdef WL_VIRTUAL_APSTA
+#error "Both DUAL STA and DUAL_STA_STATIC_IF can't be enabled together"
+#endif
+       /* Static Interface support is currently supported only for STA only builds (without P2P) */
+       wl_cfg80211_create_iface(cfg->wdev->wiphy, NL80211_IFTYPE_STATION, NULL, "wlan%d");
+#endif /* DUAL_STA_STATIC_IF */
+
+       return err;
+}
+
+/* Private Event to Supplicant with indication that chip hangs */
+int wl_cfg80211_hang(struct net_device *dev, u16 reason)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+       dhd_pub_t *dhd;
+#if defined(SOFTAP_SEND_HANGEVT)
+       /* specifc mac address used for hang event */
+       uint8 hang_mac[ETHER_ADDR_LEN] = {0x11, 0x11, 0x11, 0x11, 0x11, 0x11};
+#endif /* SOFTAP_SEND_HANGEVT */
+       if (!cfg) {
+               return BCME_ERROR;
+       }
+
+       dhd = (dhd_pub_t *)(cfg->pub);
+
+#ifdef DHD_USE_EXTENDED_HANG_REASON
+       if (dhd->hang_reason != 0) {
+               reason = dhd->hang_reason;
+       }
+#endif /* DHD_USE_EXTENDED_HANG_REASON */
+
+       WL_ERR(("In : chip crash eventing, reason=0x%x\n", (uint32)(dhd->hang_reason)));
+       wl_add_remove_pm_enable_work(cfg, WL_PM_WORKQ_DEL);
+#if defined(SOFTAP_SEND_HANGEVT)
+       if (dhd->op_mode & DHD_FLAG_HOSTAP_MODE) {
+               cfg80211_del_sta(dev, hang_mac, GFP_ATOMIC);
+       } else
+#endif /* SOFTAP_SEND_HANGEVT */
+       {
+               CFG80211_DISCONNECTED(dev, reason, NULL, 0, false, GFP_KERNEL);
+       }
+       if (cfg != NULL) {
+               wl_link_down(cfg);
+       }
+       return 0;
+}
+
+s32 wl_cfg80211_down(void *para)
+{
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)para;
+       s32 err = 0;
+
+       WL_DBG(("In\n"));
+       mutex_lock(&cfg->usr_sync);
+       err = __wl_cfg80211_down(cfg);
+       mutex_unlock(&cfg->usr_sync);
+
+       return err;
+}
+
+static void *wl_read_prof(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32 item)
+{
+       unsigned long flags;
+       void *rptr = NULL;
+       struct wl_profile *profile = wl_get_profile_by_netdev(cfg, ndev);
+
+       if (!profile)
+               return NULL;
+       spin_lock_irqsave(&cfg->cfgdrv_lock, flags);
+       switch (item) {
+       case WL_PROF_SEC:
+               rptr = &profile->sec;
+               break;
+       case WL_PROF_ACT:
+               rptr = &profile->active;
+               break;
+       case WL_PROF_BSSID:
+               rptr = profile->bssid;
+               break;
+       case WL_PROF_SSID:
+               rptr = &profile->ssid;
+               break;
+       case WL_PROF_CHAN:
+               rptr = &profile->channel;
+               break;
+       }
+       spin_unlock_irqrestore(&cfg->cfgdrv_lock, flags);
+       if (!rptr)
+               WL_ERR(("invalid item (%d)\n", item));
+       return rptr;
+}
+
+static s32
+wl_update_prof(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const wl_event_msg_t *e, const void *data, s32 item)
+{
+       s32 err = 0;
+       const struct wlc_ssid *ssid;
+       unsigned long flags;
+       struct wl_profile *profile = wl_get_profile_by_netdev(cfg, ndev);
+
+       if (!profile)
+               return WL_INVALID;
+       spin_lock_irqsave(&cfg->cfgdrv_lock, flags);
+       switch (item) {
+       case WL_PROF_SSID:
+               ssid = (const wlc_ssid_t *) data;
+               memset(profile->ssid.SSID, 0,
+                       sizeof(profile->ssid.SSID));
+               profile->ssid.SSID_len = MIN(ssid->SSID_len, DOT11_MAX_SSID_LEN);
+               memcpy(profile->ssid.SSID, ssid->SSID, profile->ssid.SSID_len);
+               break;
+       case WL_PROF_BSSID:
+               if (data)
+                       memcpy(profile->bssid, data, ETHER_ADDR_LEN);
+               else
+                       memset(profile->bssid, 0, ETHER_ADDR_LEN);
+               break;
+       case WL_PROF_SEC:
+               memcpy(&profile->sec, data, sizeof(profile->sec));
+               break;
+       case WL_PROF_ACT:
+               profile->active = *(const bool *)data;
+               break;
+       case WL_PROF_BEACONINT:
+               profile->beacon_interval = *(const u16 *)data;
+               break;
+       case WL_PROF_DTIMPERIOD:
+               profile->dtim_period = *(const u8 *)data;
+               break;
+       case WL_PROF_CHAN:
+               profile->channel = *(const u32*)data;
+               break;
+       default:
+               err = -EOPNOTSUPP;
+               break;
+       }
+       spin_unlock_irqrestore(&cfg->cfgdrv_lock, flags);
+
+       if (err == -EOPNOTSUPP)
+               WL_ERR(("unsupported item (%d)\n", item));
+
+       return err;
+}
+
+void wl_cfg80211_dbg_level(u32 level)
+{
+       /*
+       * prohibit to change debug level
+       * by insmod parameter.
+       * eventually debug level will be configured
+       * in compile time by using CONFIG_XXX
+       */
+       /* wl_dbg_level = level; */
+}
+
+static bool wl_is_ibssmode(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+       return wl_get_mode_by_netdev(cfg, ndev) == WL_MODE_IBSS;
+}
+
+static __used bool wl_is_ibssstarter(struct bcm_cfg80211 *cfg)
+{
+       return cfg->ibss_starter;
+}
+
+static void wl_rst_ie(struct bcm_cfg80211 *cfg)
+{
+       struct wl_ie *ie = wl_to_ie(cfg);
+
+       ie->offset = 0;
+}
+
+static __used s32 wl_add_ie(struct bcm_cfg80211 *cfg, u8 t, u8 l, u8 *v)
+{
+       struct wl_ie *ie = wl_to_ie(cfg);
+       s32 err = 0;
+
+       if (unlikely(ie->offset + l + 2 > WL_TLV_INFO_MAX)) {
+               WL_ERR(("ei crosses buffer boundary\n"));
+               return -ENOSPC;
+       }
+       ie->buf[ie->offset] = t;
+       ie->buf[ie->offset + 1] = l;
+       memcpy(&ie->buf[ie->offset + 2], v, l);
+       ie->offset += l + 2;
+
+       return err;
+}
+
+static void wl_update_hidden_ap_ie(struct wl_bss_info *bi, const u8 *ie_stream, u32 *ie_size,
+       bool roam)
+{
+       u8 *ssidie;
+       int32 ssid_len = MIN(bi->SSID_len, DOT11_MAX_SSID_LEN);
+       int32 remaining_ie_buf_len, available_buffer_len;
+       /* cfg80211_find_ie defined in kernel returning const u8 */
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+_Pragma("GCC diagnostic push")
+_Pragma("GCC diagnostic ignored \"-Wcast-qual\"")
+#endif
+       ssidie = (u8 *)cfg80211_find_ie(WLAN_EID_SSID, ie_stream, *ie_size);
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+_Pragma("GCC diagnostic pop")
+#endif
+       /* ERROR out if
+        * 1. No ssid IE is FOUND or
+        * 2. New ssid length is > what was allocated for existing ssid (as
+        * we do not want to overwrite the rest of the IEs) or
+        * 3. If in case of erroneous buffer input where ssid length doesnt match the space
+        * allocated to it.
+        */
+       if (!ssidie) {
+               return;
+       }
+       available_buffer_len = ((int)(*ie_size)) - (ssidie + 2 - ie_stream);
+       remaining_ie_buf_len = available_buffer_len - (int)ssidie[1];
+       if ((ssid_len > ssidie[1]) ||
+               (ssidie[1] > available_buffer_len)) {
+               return;
+       }
+
+
+       if (ssidie[1] != ssid_len) {
+               if (ssidie[1]) {
+                       WL_ERR(("%s: Wrong SSID len: %d != %d\n",
+                               __FUNCTION__, ssidie[1], bi->SSID_len));
+               }
+               if (roam) {
+                       WL_ERR(("Changing the SSID Info.\n"));
+                       memmove(ssidie + ssid_len + 2,
+                               (ssidie + 2) + ssidie[1],
+                               remaining_ie_buf_len);
+                       memcpy(ssidie + 2, bi->SSID, ssid_len);
+                       *ie_size = *ie_size + ssid_len - ssidie[1];
+                       ssidie[1] = ssid_len;
+               }
+               return;
+       }
+       if (*(ssidie + 2) == '\0')
+                memcpy(ssidie + 2, bi->SSID, ssid_len);
+       return;
+}
+
+static s32 wl_mrg_ie(struct bcm_cfg80211 *cfg, u8 *ie_stream, u16 ie_size)
+{
+       struct wl_ie *ie = wl_to_ie(cfg);
+       s32 err = 0;
+
+       if (unlikely(ie->offset + ie_size > WL_TLV_INFO_MAX)) {
+               WL_ERR(("ei_stream crosses buffer boundary\n"));
+               return -ENOSPC;
+       }
+       memcpy(&ie->buf[ie->offset], ie_stream, ie_size);
+       ie->offset += ie_size;
+
+       return err;
+}
+
+static s32 wl_cp_ie(struct bcm_cfg80211 *cfg, u8 *dst, u16 dst_size)
+{
+       struct wl_ie *ie = wl_to_ie(cfg);
+       s32 err = 0;
+
+       if (unlikely(ie->offset > dst_size)) {
+               WL_ERR(("dst_size is not enough\n"));
+               return -ENOSPC;
+       }
+       memcpy(dst, &ie->buf[0], ie->offset);
+
+       return err;
+}
+
+static u32 wl_get_ielen(struct bcm_cfg80211 *cfg)
+{
+       struct wl_ie *ie = wl_to_ie(cfg);
+
+       return ie->offset;
+}
+
+static void wl_link_up(struct bcm_cfg80211 *cfg)
+{
+       cfg->link_up = true;
+}
+
+static void wl_link_down(struct bcm_cfg80211 *cfg)
+{
+       struct wl_connect_info *conn_info = wl_to_conn(cfg);
+
+       WL_DBG(("In\n"));
+       cfg->link_up = false;
+       conn_info->req_ie_len = 0;
+       conn_info->resp_ie_len = 0;
+}
+
+static unsigned long wl_lock_eq(struct bcm_cfg80211 *cfg)
+{
+       unsigned long flags;
+
+       spin_lock_irqsave(&cfg->eq_lock, flags);
+       return flags;
+}
+
+static void wl_unlock_eq(struct bcm_cfg80211 *cfg, unsigned long flags)
+{
+       spin_unlock_irqrestore(&cfg->eq_lock, flags);
+}
+
+static void wl_init_eq_lock(struct bcm_cfg80211 *cfg)
+{
+       spin_lock_init(&cfg->eq_lock);
+}
+
+static void wl_delay(u32 ms)
+{
+       if (in_atomic() || (ms < jiffies_to_msecs(1))) {
+               OSL_DELAY(ms*1000);
+       } else {
+               OSL_SLEEP(ms);
+       }
+}
+
+s32 wl_cfg80211_get_p2p_dev_addr(struct net_device *net, struct ether_addr *p2pdev_addr)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(net);
+       struct ether_addr primary_mac;
+       if (!cfg->p2p)
+               return -1;
+       if (!p2p_is_on(cfg)) {
+               get_primary_mac(cfg, &primary_mac);
+               wl_cfgp2p_generate_bss_mac(cfg, &primary_mac);
+       } else {
+               memcpy(p2pdev_addr->octet, wl_to_p2p_bss_macaddr(cfg, P2PAPI_BSSCFG_DEVICE).octet,
+                       ETHER_ADDR_LEN);
+       }
+
+       return 0;
+}
+s32 wl_cfg80211_set_p2p_noa(struct net_device *net, char* buf, int len)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(net);
+
+       return wl_cfgp2p_set_p2p_noa(cfg, net, buf, len);
+}
+
+s32 wl_cfg80211_get_p2p_noa(struct net_device *net, char* buf, int len)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(net);
+
+       return wl_cfgp2p_get_p2p_noa(cfg, net, buf, len);
+}
+
+s32 wl_cfg80211_set_p2p_ps(struct net_device *net, char* buf, int len)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(net);
+
+       return wl_cfgp2p_set_p2p_ps(cfg, net, buf, len);
+}
+
+s32 wl_cfg80211_set_p2p_ecsa(struct net_device *net, char* buf, int len)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(net);
+
+       return wl_cfgp2p_set_p2p_ecsa(cfg, net, buf, len);
+}
+
+s32 wl_cfg80211_increase_p2p_bw(struct net_device *net, char* buf, int len)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(net);
+
+       return wl_cfgp2p_increase_p2p_bw(cfg, net, buf, len);
+}
+
+#ifdef P2PLISTEN_AP_SAMECHN
+s32 wl_cfg80211_set_p2p_resp_ap_chn(struct net_device *net, s32 enable)
+{
+       s32 ret = wldev_iovar_setint(net, "p2p_resp_ap_chn", enable);
+
+       if ((ret == 0) && enable) {
+               /* disable PM for p2p responding on infra AP channel */
+               s32 pm = PM_OFF;
+
+               ret = wldev_ioctl(net, WLC_SET_PM, &pm, sizeof(pm), true);
+       }
+
+       return ret;
+}
+#endif /* P2PLISTEN_AP_SAMECHN */
+
+s32 wl_cfg80211_channel_to_freq(u32 channel)
+{
+       int freq = 0;
+
+#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 38) && !defined(WL_COMPAT_WIRELESS)
+       freq = ieee80211_channel_to_frequency(channel);
+#else
+       {
+               u16 band = 0;
+               if (channel <= CH_MAX_2G_CHANNEL)
+                       band = IEEE80211_BAND_2GHZ;
+               else
+                       band = IEEE80211_BAND_5GHZ;
+               freq = ieee80211_channel_to_frequency(channel, band);
+       }
+#endif
+       return freq;
+}
+
+
+#ifdef WLTDLS
+static s32
+wl_tdls_event_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data) {
+
+       struct net_device *ndev = NULL;
+       u32 reason = ntoh32(e->reason);
+       s8 *msg = NULL;
+
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+       switch (reason) {
+       case WLC_E_TDLS_PEER_DISCOVERED :
+               msg = " TDLS PEER DISCOVERD ";
+               break;
+       case WLC_E_TDLS_PEER_CONNECTED :
+#ifdef PCIE_FULL_DONGLE
+               dhd_tdls_update_peer_info(ndev, TRUE, (uint8 *)&e->addr.octet[0]);
+#endif /* PCIE_FULL_DONGLE */
+               if (cfg->tdls_mgmt_frame) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
+                       cfg80211_rx_mgmt(cfgdev, cfg->tdls_mgmt_freq, 0,
+                               cfg->tdls_mgmt_frame, cfg->tdls_mgmt_frame_len,
+                               0);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 12, 0))
+                       cfg80211_rx_mgmt(cfgdev, cfg->tdls_mgmt_freq, 0,
+                               cfg->tdls_mgmt_frame, cfg->tdls_mgmt_frame_len,
+                               0, GFP_ATOMIC);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) || \
+       defined(WL_COMPAT_WIRELESS)
+                       cfg80211_rx_mgmt(cfgdev, cfg->tdls_mgmt_freq, 0,
+                               cfg->tdls_mgmt_frame, cfg->tdls_mgmt_frame_len,
+                               GFP_ATOMIC);
+#else
+                       cfg80211_rx_mgmt(cfgdev, cfg->tdls_mgmt_freq,
+                               cfg->tdls_mgmt_frame, cfg->tdls_mgmt_frame_len,
+                               GFP_ATOMIC);
+#endif /* LINUX_VERSION >= VERSION(3, 12, 0) */
+               }
+               msg = " TDLS PEER CONNECTED ";
+               break;
+       case WLC_E_TDLS_PEER_DISCONNECTED :
+#ifdef PCIE_FULL_DONGLE
+               dhd_tdls_update_peer_info(ndev, FALSE, (uint8 *)&e->addr.octet[0]);
+#endif /* PCIE_FULL_DONGLE */
+               if (cfg->tdls_mgmt_frame) {
+                       kfree(cfg->tdls_mgmt_frame);
+                       cfg->tdls_mgmt_frame = NULL;
+                       cfg->tdls_mgmt_freq = 0;
+               }
+               msg = "TDLS PEER DISCONNECTED ";
+               break;
+       }
+       if (msg) {
+               WL_ERR(("%s: " MACDBG " on %s ndev\n", msg, MAC2STRDBG((u8*)(&e->addr)),
+                       (bcmcfg_to_prmry_ndev(cfg) == ndev) ? "primary" : "secondary"));
+       }
+       return 0;
+
+}
+#endif  /* WLTDLS */
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 2, 0)) || defined(WL_COMPAT_WIRELESS)
+static s32
+#if (defined(CONFIG_ARCH_MSM) && defined(TDLS_MGMT_VERSION2)) || (LINUX_VERSION_CODE < \
+       KERNEL_VERSION(3, 16, 0) && LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0))
+wl_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+        u8 *peer, u8 action_code, u8 dialog_token, u16 status_code,
+        u32 peer_capability, const u8 *data, size_t len)
+#elif ((LINUX_VERSION_CODE >= KERNEL_VERSION(3, 16, 0)) && \
+               (LINUX_VERSION_CODE < KERNEL_VERSION(3, 18, 0)))
+wl_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+       const u8 *peer, u8 action_code, u8 dialog_token, u16 status_code,
+       u32 peer_capability, const u8 *data, size_t len)
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
+wl_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+       const u8 *peer, u8 action_code, u8 dialog_token, u16 status_code,
+       u32 peer_capability, bool initiator, const u8 *data, size_t len)
+#else
+wl_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+       u8 *peer, u8 action_code, u8 dialog_token, u16 status_code, const u8 *data,
+       size_t len)
+#endif  /* CONFIG_ARCH_MSM && TDLS_MGMT_VERSION2 */
+{
+       s32 ret = 0;
+#ifdef WLTDLS
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)wiphy_priv(wiphy);
+       tdls_wfd_ie_iovar_t info;
+       memset(&info, 0, sizeof(tdls_wfd_ie_iovar_t));
+
+#if defined(CONFIG_ARCH_MSM) && defined(TDLS_MGMT_VERSION2)
+       /* Some customer platform back ported this feature from kernel 3.15 to kernel 3.10
+       * and that cuases build error
+       */
+       BCM_REFERENCE(peer_capability);
+#endif  /* CONFIG_ARCH_MSM && TDLS_MGMT_VERSION2 */
+
+       switch (action_code) {
+       /* We need to set TDLS Wifi Display IE to firmware
+        * using tdls_wfd_ie iovar
+        */
+       case WLAN_TDLS_SET_PROBE_WFD_IE:
+               WL_ERR(("%s WLAN_TDLS_SET_PROBE_WFD_IE\n", __FUNCTION__));
+               info.mode = TDLS_WFD_PROBE_IE_TX;
+               memcpy(&info.data, data, len);
+               info.length = len;
+               break;
+       case WLAN_TDLS_SET_SETUP_WFD_IE:
+               WL_ERR(("%s WLAN_TDLS_SET_SETUP_WFD_IE\n", __FUNCTION__));
+               info.mode = TDLS_WFD_IE_TX;
+               memcpy(&info.data, data, len);
+               info.length = len;
+               break;
+       case WLAN_TDLS_SET_WFD_ENABLED:
+               WL_ERR(("%s WLAN_TDLS_SET_MODE_WFD_ENABLED\n", __FUNCTION__));
+               dhd_tdls_set_mode((dhd_pub_t *)(cfg->pub), true);
+               goto out;
+       case WLAN_TDLS_SET_WFD_DISABLED:
+               WL_ERR(("%s WLAN_TDLS_SET_MODE_WFD_DISABLED\n", __FUNCTION__));
+               dhd_tdls_set_mode((dhd_pub_t *)(cfg->pub), false);
+               goto out;
+       default:
+               WL_ERR(("Unsupported action code : %d\n", action_code));
+               goto out;
+       }
+
+       ret = wldev_iovar_setbuf(dev, "tdls_wfd_ie", &info, sizeof(info),
+               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+
+       if (ret) {
+               WL_ERR(("tdls_wfd_ie error %d\n", ret));
+       }
+out:
+#endif /* WLTDLS */
+       return ret;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 16, 0))
+static s32
+wl_cfg80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
+       const u8 *peer, enum nl80211_tdls_operation oper)
+#else
+static s32
+wl_cfg80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
+       u8 *peer, enum nl80211_tdls_operation oper)
+#endif
+{
+       s32 ret = 0;
+#ifdef WLTDLS
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)wiphy_priv(wiphy);
+       tdls_iovar_t info;
+       dhd_pub_t *dhdp;
+       bool tdls_auto_mode = false;
+       dhdp = (dhd_pub_t *)(cfg->pub);
+       memset(&info, 0, sizeof(tdls_iovar_t));
+       if (peer) {
+               memcpy(&info.ea, peer, ETHER_ADDR_LEN);
+       } else {
+               return -1;
+       }
+       switch (oper) {
+       case NL80211_TDLS_DISCOVERY_REQ:
+               /* If the discovery request is broadcast then we need to set
+                * info.mode to Tunneled Probe Request
+                */
+               if (memcmp(peer, (const uint8 *)BSSID_BROADCAST, ETHER_ADDR_LEN) == 0) {
+                       info.mode = TDLS_MANUAL_EP_WFD_TPQ;
+                       WL_ERR(("%s TDLS TUNNELED PRBOBE REQUEST\n", __FUNCTION__));
+               } else {
+                       info.mode = TDLS_MANUAL_EP_DISCOVERY;
+               }
+               break;
+       case NL80211_TDLS_SETUP:
+               if (dhdp->tdls_mode == true) {
+                       info.mode = TDLS_MANUAL_EP_CREATE;
+                       tdls_auto_mode = false;
+                       ret = dhd_tdls_enable(dev, false, tdls_auto_mode, NULL);
+                       if (ret < 0) {
+                               return ret;
+                       }
+               } else {
+                       tdls_auto_mode = true;
+               }
+               break;
+       case NL80211_TDLS_TEARDOWN:
+               info.mode = TDLS_MANUAL_EP_DELETE;
+               break;
+       default:
+               WL_ERR(("Unsupported operation : %d\n", oper));
+               goto out;
+       }
+       /* turn on TDLS */
+       ret = dhd_tdls_enable(dev, true, tdls_auto_mode, NULL);
+       if (ret < 0) {
+               return ret;
+       }
+       if (info.mode) {
+               ret = wldev_iovar_setbuf(dev, "tdls_endpoint", &info, sizeof(info),
+                       cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+               if (ret) {
+                       WL_ERR(("tdls_endpoint error %d\n", ret));
+               }
+       }
+out:
+#endif /* WLTDLS */
+       return ret;
+}
+#endif /* LINUX_VERSION > VERSION(3,2,0) || WL_COMPAT_WIRELESS */
+
+s32 wl_cfg80211_set_wps_p2p_ie(struct net_device *ndev, char *buf, int len,
+       enum wl_management_type type)
+{
+       struct bcm_cfg80211 *cfg = NULL;
+       s32 ret = 0;
+       struct ether_addr primary_mac;
+       s32 bssidx = 0;
+       s32 pktflag = 0;
+       cfg = NETDEV_GET_CFG80211_PRIV(ndev);
+
+       if (wl_get_drv_status(cfg, AP_CREATING, ndev)) {
+               /* Vendor IEs should be set to FW
+                * after SoftAP interface is brought up
+                */
+               WL_DBG(("Skipping set IE since AP is not up \n"));
+               goto exit;
+       } else  if (ndev == bcmcfg_to_prmry_ndev(cfg)) {
+               /* Either stand alone AP case or P2P discovery */
+               if (wl_get_drv_status(cfg, AP_CREATED, ndev)) {
+                       /* Stand alone AP case on primary interface */
+                       WL_DBG(("Apply IEs for Primary AP Interface \n"));
+                       bssidx = 0;
+               } else {
+                       /* P2P Discovery case (p2p listen) */
+                       if (!cfg->p2p->on) {
+                               /* Turn on Discovery interface */
+                               get_primary_mac(cfg, &primary_mac);
+                               wl_cfgp2p_generate_bss_mac(cfg, &primary_mac);
+                               p2p_on(cfg) = true;
+                               ret = wl_cfgp2p_enable_discovery(cfg, ndev, NULL, 0);
+                               if (unlikely(ret)) {
+                                       WL_ERR(("Enable discovery failed \n"));
+                                       goto exit;
+                               }
+                       }
+                       WL_DBG(("Apply IEs for P2P Discovery Iface \n"));
+                       ndev = wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_PRIMARY);
+                       bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+               }
+       } else {
+               /* Virtual AP/ P2P Group Interface */
+               WL_DBG(("Apply IEs for iface:%s\n", ndev->name));
+               bssidx = wl_get_bssidx_by_wdev(cfg, ndev->ieee80211_ptr);
+       }
+
+       if (ndev != NULL) {
+               switch (type) {
+                       case WL_BEACON:
+                               pktflag = VNDR_IE_BEACON_FLAG;
+                               break;
+                       case WL_PROBE_RESP:
+                               pktflag = VNDR_IE_PRBRSP_FLAG;
+                               break;
+                       case WL_ASSOC_RESP:
+                               pktflag = VNDR_IE_ASSOCRSP_FLAG;
+                               break;
+               }
+               if (pktflag) {
+                       ret = wl_cfg80211_set_mgmt_vndr_ies(cfg,
+                               ndev_to_cfgdev(ndev), bssidx, pktflag, buf, len);
+               }
+       }
+exit:
+       return ret;
+}
+
+#ifdef WL_SUPPORT_AUTO_CHANNEL
+static s32
+wl_cfg80211_set_auto_channel_scan_state(struct net_device *ndev)
+{
+       u32 val = 0;
+       s32 ret = BCME_ERROR;
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(ndev);
+       struct wiphy *wiphy;
+       /* Disable mpc, to avoid automatic interface down. */
+       val = 0;
+
+       wiphy = bcmcfg_to_wiphy(cfg);
+       if (wl_check_dongle_idle(wiphy) != TRUE) {
+               WL_ERR(("FW is busy to add interface"));
+               return ret;
+       }
+       ret = wldev_iovar_setbuf_bsscfg(ndev, "mpc", (void *)&val,
+               sizeof(val), cfg->ioctl_buf, WLC_IOCTL_SMLEN, 0,
+               &cfg->ioctl_buf_sync);
+       if (ret < 0) {
+               WL_ERR(("set 'mpc' failed, error = %d\n", ret));
+               goto done;
+       }
+
+       /* Set interface up, explicitly. */
+       val = 1;
+
+       ret = wldev_ioctl(ndev, WLC_UP, (void *)&val, sizeof(val), true);
+       if (ret < 0) {
+               WL_ERR(("set interface up failed, error = %d\n", ret));
+               goto done;
+       }
+
+       /* Stop all scan explicitly, till auto channel selection complete. */
+       wl_set_drv_status(cfg, SCANNING, ndev);
+       if (cfg->escan_info.ndev == NULL) {
+               ret = BCME_OK;
+               goto done;
+       }
+       ret = wl_notify_escan_complete(cfg, ndev, true, true);
+       if (ret < 0) {
+               WL_ERR(("set scan abort failed, error = %d\n", ret));
+               goto done;
+       }
+
+done:
+       return ret;
+}
+
+static bool
+wl_cfg80211_valid_channel_p2p(int channel)
+{
+       bool valid = false;
+
+       /* channel 1 to 14 */
+       if ((channel >= 1) && (channel <= 14)) {
+               valid = true;
+       }
+       /* channel 36 to 48 */
+       else if ((channel >= 36) && (channel <= 48)) {
+               valid = true;
+       }
+       /* channel 149 to 161 */
+       else if ((channel >= 149) && (channel <= 161)) {
+               valid = true;
+       }
+       else {
+               valid = false;
+               WL_INFORM(("invalid P2P chanspec, channel = %d\n", channel));
+       }
+
+       return valid;
+}
+
+s32
+wl_cfg80211_get_chanspecs_2g(struct net_device *ndev, void *buf, s32 buflen)
+{
+       s32 ret = BCME_ERROR;
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(ndev);
+       wl_uint32_list_t *list = NULL;
+       chanspec_t chanspec = 0;
+
+       memset(buf, 0, buflen);
+
+       list = (wl_uint32_list_t *)buf;
+       list->count = htod32(WL_NUMCHANSPECS);
+
+       /* Restrict channels to 2.4GHz, 20MHz BW, no SB. */
+       chanspec |= (WL_CHANSPEC_BAND_2G | WL_CHANSPEC_BW_20 |
+               WL_CHANSPEC_CTL_SB_NONE);
+       chanspec = wl_chspec_host_to_driver(chanspec);
+
+       ret = wldev_iovar_getbuf_bsscfg(ndev, "chanspecs", (void *)&chanspec,
+               sizeof(chanspec), buf, buflen, 0, &cfg->ioctl_buf_sync);
+       if (ret < 0) {
+               WL_ERR(("get 'chanspecs' failed, error = %d\n", ret));
+       }
+
+       return ret;
+}
+
+s32
+wl_cfg80211_get_chanspecs_5g(struct net_device *ndev, void *buf, s32 buflen)
+{
+       u32 channel = 0;
+       s32 ret = BCME_ERROR;
+       s32 i = 0;
+       s32 j = 0;
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(ndev);
+       wl_uint32_list_t *list = NULL;
+       chanspec_t chanspec = 0;
+
+       memset(buf, 0, buflen);
+
+       list = (wl_uint32_list_t *)buf;
+       list->count = htod32(WL_NUMCHANSPECS);
+
+       /* Restrict channels to 5GHz, 20MHz BW, no SB. */
+       chanspec |= (WL_CHANSPEC_BAND_5G | WL_CHANSPEC_BW_20 |
+               WL_CHANSPEC_CTL_SB_NONE);
+       chanspec = wl_chspec_host_to_driver(chanspec);
+
+       ret = wldev_iovar_getbuf_bsscfg(ndev, "chanspecs", (void *)&chanspec,
+               sizeof(chanspec), buf, buflen, 0, &cfg->ioctl_buf_sync);
+       if (ret < 0) {
+               WL_ERR(("get 'chanspecs' failed, error = %d\n", ret));
+               goto done;
+       }
+
+       /* Skip DFS and inavlid P2P channel. */
+       for (i = 0, j = 0; i < dtoh32(list->count); i++) {
+               chanspec = (chanspec_t) dtoh32(list->element[i]);
+               channel = CHSPEC_CHANNEL(chanspec);
+
+               ret = wldev_iovar_getint(ndev, "per_chan_info", &channel);
+               if (ret < 0) {
+                       WL_ERR(("get 'per_chan_info' failed, error = %d\n", ret));
+                       goto done;
+               }
+
+               if (CHANNEL_IS_RADAR(channel) ||
+                       !(wl_cfg80211_valid_channel_p2p(CHSPEC_CHANNEL(chanspec)))) {
+                       continue;
+               } else {
+                       list->element[j] = list->element[i];
+               }
+
+               j++;
+       }
+
+       list->count = j;
+
+done:
+       return ret;
+}
+
+static s32
+wl_cfg80211_get_best_channel(struct net_device *ndev, void *buf, int buflen,
+       int *channel)
+{
+       s32 ret = BCME_ERROR;
+       int chosen = 0;
+       int retry = 0;
+
+       /* Start auto channel selection scan. */
+       ret = wldev_ioctl(ndev, WLC_START_CHANNEL_SEL, buf, buflen, true);
+       if (ret < 0) {
+               WL_ERR(("can't start auto channel scan, error = %d\n", ret));
+               *channel = 0;
+               goto done;
+       }
+
+       /* Wait for auto channel selection, worst case possible delay is 5250ms. */
+       retry = CHAN_SEL_RETRY_COUNT;
+
+       while (retry--) {
+               OSL_SLEEP(CHAN_SEL_IOCTL_DELAY);
+
+               ret = wldev_ioctl(ndev, WLC_GET_CHANNEL_SEL, &chosen, sizeof(chosen),
+                       false);
+               if ((ret == 0) && (dtoh32(chosen) != 0)) {
+                       *channel = (u16)(chosen & 0x00FF);
+                       WL_INFORM(("selected channel = %d\n", *channel));
+                       break;
+               }
+               WL_INFORM(("attempt = %d, ret = %d, chosen = %d\n",
+                       (CHAN_SEL_RETRY_COUNT - retry), ret, dtoh32(chosen)));
+       }
+
+       if (retry <= 0) {
+               WL_ERR(("failure, auto channel selection timed out\n"));
+               *channel = 0;
+               ret = BCME_ERROR;
+       }
+
+done:
+       return ret;
+}
+
+static s32
+wl_cfg80211_restore_auto_channel_scan_state(struct net_device *ndev)
+{
+       u32 val = 0;
+       s32 ret = BCME_ERROR;
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(ndev);
+
+       /* Clear scan stop driver status. */
+       wl_clr_drv_status(cfg, SCANNING, ndev);
+
+       /* Enable mpc back to 1, irrespective of initial state. */
+       val = 1;
+
+       ret = wldev_iovar_setbuf_bsscfg(ndev, "mpc", (void *)&val,
+               sizeof(val), cfg->ioctl_buf, WLC_IOCTL_SMLEN, 0,
+               &cfg->ioctl_buf_sync);
+       if (ret < 0) {
+               WL_ERR(("set 'mpc' failed, error = %d\n", ret));
+       }
+
+       return ret;
+}
+
+s32
+wl_cfg80211_get_best_channels(struct net_device *dev, char* cmd, int total_len)
+{
+       int channel = 0;
+       s32 ret = BCME_ERROR;
+       u8 *buf = NULL;
+       char *pos = cmd;
+       struct bcm_cfg80211 *cfg = NULL;
+       struct net_device *ndev = NULL;
+
+       memset(cmd, 0, total_len);
+
+       buf = kmalloc(CHANSPEC_BUF_SIZE, GFP_KERNEL);
+       if (buf == NULL) {
+               WL_ERR(("failed to allocate chanspec buffer\n"));
+               return -ENOMEM;
+       }
+
+       /*
+        * Always use primary interface, irrespective of interface on which
+        * command came.
+        */
+       cfg = NETDEV_GET_CFG80211_PRIV(dev);
+       ndev = bcmcfg_to_prmry_ndev(cfg);
+
+       /*
+        * Make sure that FW and driver are in right state to do auto channel
+        * selection scan.
+        */
+       ret = wl_cfg80211_set_auto_channel_scan_state(ndev);
+       if (ret < 0) {
+               WL_ERR(("can't set auto channel scan state, error = %d\n", ret));
+               goto done;
+       }
+
+       /* Best channel selection in 2.4GHz band. */
+       ret = wl_cfg80211_get_chanspecs_2g(ndev, (void *)buf, CHANSPEC_BUF_SIZE);
+       if (ret < 0) {
+               WL_ERR(("can't get chanspecs in 2.4GHz, error = %d\n", ret));
+               goto done;
+       }
+
+       ret = wl_cfg80211_get_best_channel(ndev, (void *)buf, CHANSPEC_BUF_SIZE,
+               &channel);
+       if (ret < 0) {
+               WL_ERR(("can't select best channel scan in 2.4GHz, error = %d\n", ret));
+               goto done;
+       }
+
+       if (CHANNEL_IS_2G(channel)) {
+               channel = ieee80211_channel_to_frequency(channel, IEEE80211_BAND_2GHZ);
+       } else {
+               WL_ERR(("invalid 2.4GHz channel, channel = %d\n", channel));
+               channel = 0;
+       }
+
+       pos += snprintf(pos, total_len, "%04d ", channel);
+
+       /* Best channel selection in 5GHz band. */
+       ret = wl_cfg80211_get_chanspecs_5g(ndev, (void *)buf, CHANSPEC_BUF_SIZE);
+       if (ret < 0) {
+               WL_ERR(("can't get chanspecs in 5GHz, error = %d\n", ret));
+               goto done;
+       }
+
+       ret = wl_cfg80211_get_best_channel(ndev, (void *)buf, CHANSPEC_BUF_SIZE,
+               &channel);
+       if (ret < 0) {
+               WL_ERR(("can't select best channel scan in 5GHz, error = %d\n", ret));
+               goto done;
+       }
+
+       if (CHANNEL_IS_5G(channel)) {
+               channel = ieee80211_channel_to_frequency(channel, IEEE80211_BAND_5GHZ);
+       } else {
+               WL_ERR(("invalid 5GHz channel, channel = %d\n", channel));
+               channel = 0;
+       }
+
+       pos += snprintf(pos, total_len, "%04d ", channel);
+
+       /* Set overall best channel same as 5GHz best channel. */
+       pos += snprintf(pos, total_len, "%04d ", channel);
+
+done:
+       if (NULL != buf) {
+               kfree(buf);
+       }
+
+       /* Restore FW and driver back to normal state. */
+       ret = wl_cfg80211_restore_auto_channel_scan_state(ndev);
+       if (ret < 0) {
+               WL_ERR(("can't restore auto channel scan state, error = %d\n", ret));
+       }
+
+       return (pos - cmd);
+}
+#endif /* WL_SUPPORT_AUTO_CHANNEL */
+
+static const struct rfkill_ops wl_rfkill_ops = {
+       .set_block = wl_rfkill_set
+};
+
+static int wl_rfkill_set(void *data, bool blocked)
+{
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)data;
+
+       WL_DBG(("Enter \n"));
+       WL_DBG(("RF %s\n", blocked ? "blocked" : "unblocked"));
+
+       if (!cfg)
+               return -EINVAL;
+
+       cfg->rf_blocked = blocked;
+
+       return 0;
+}
+
+static int wl_setup_rfkill(struct bcm_cfg80211 *cfg, bool setup)
+{
+       s32 err = 0;
+
+       WL_DBG(("Enter \n"));
+       if (!cfg)
+               return -EINVAL;
+       if (setup) {
+               cfg->rfkill = rfkill_alloc("brcmfmac-wifi",
+                       wl_cfg80211_get_parent_dev(),
+                       RFKILL_TYPE_WLAN, &wl_rfkill_ops, (void *)cfg);
+
+               if (!cfg->rfkill) {
+                       err = -ENOMEM;
+                       goto err_out;
+               }
+
+               err = rfkill_register(cfg->rfkill);
+
+               if (err)
+                       rfkill_destroy(cfg->rfkill);
+       } else {
+               if (!cfg->rfkill) {
+                       err = -ENOMEM;
+                       goto err_out;
+               }
+
+               rfkill_unregister(cfg->rfkill);
+               rfkill_destroy(cfg->rfkill);
+       }
+
+err_out:
+       return err;
+}
+
+#ifdef DEBUGFS_CFG80211
+/**
+* Format : echo "SCAN:1 DBG:1" > /sys/kernel/debug/dhd/debug_level
+* to turn on SCAN and DBG log.
+* To turn off SCAN partially, echo "SCAN:0" > /sys/kernel/debug/dhd/debug_level
+* To see current setting of debug level,
+* cat /sys/kernel/debug/dhd/debug_level
+*/
+static ssize_t
+wl_debuglevel_write(struct file *file, const char __user *userbuf,
+       size_t count, loff_t *ppos)
+{
+       char tbuf[S_SUBLOGLEVEL * ARRAYSIZE(sublogname_map)], sublog[S_SUBLOGLEVEL];
+       char *params, *token, *colon;
+       uint i, tokens, log_on = 0;
+       memset(tbuf, 0, sizeof(tbuf));
+       memset(sublog, 0, sizeof(sublog));
+       if (copy_from_user(&tbuf, userbuf, min_t(size_t, (sizeof(tbuf) - 1), count)))
+               return -EFAULT;
+
+       params = &tbuf[0];
+       colon = strchr(params, '\n');
+       if (colon != NULL)
+               *colon = '\0';
+       while ((token = strsep(&params, " ")) != NULL) {
+               memset(sublog, 0, sizeof(sublog));
+               if (token == NULL || !*token)
+                       break;
+               if (*token == '\0')
+                       continue;
+               colon = strchr(token, ':');
+               if (colon != NULL) {
+                       *colon = ' ';
+               }
+               tokens = sscanf(token, "%s %u", sublog, &log_on);
+               if (colon != NULL)
+                       *colon = ':';
+
+               if (tokens == 2) {
+                               for (i = 0; i < ARRAYSIZE(sublogname_map); i++) {
+                                       if (!strncmp(sublog, sublogname_map[i].sublogname,
+                                               strlen(sublogname_map[i].sublogname))) {
+                                               if (log_on)
+                                                       wl_dbg_level |=
+                                                       (sublogname_map[i].log_level);
+                                               else
+                                                       wl_dbg_level &=
+                                                       ~(sublogname_map[i].log_level);
+                                       }
+                               }
+               } else
+                       WL_ERR(("%s: can't parse '%s' as a "
+                              "SUBMODULE:LEVEL (%d tokens)\n",
+                              tbuf, token, tokens));
+
+
+       }
+       return count;
+}
+
+static ssize_t
+wl_debuglevel_read(struct file *file, char __user *user_buf,
+       size_t count, loff_t *ppos)
+{
+       char *param;
+       char tbuf[S_SUBLOGLEVEL * ARRAYSIZE(sublogname_map)];
+       uint i;
+       memset(tbuf, 0, sizeof(tbuf));
+       param = &tbuf[0];
+       for (i = 0; i < ARRAYSIZE(sublogname_map); i++) {
+               param += snprintf(param, sizeof(tbuf) - 1, "%s:%d ",
+                       sublogname_map[i].sublogname,
+                       (wl_dbg_level & sublogname_map[i].log_level) ? 1 : 0);
+       }
+       *param = '\n';
+       return simple_read_from_buffer(user_buf, count, ppos, tbuf, strlen(&tbuf[0]));
+
+}
+static const struct file_operations fops_debuglevel = {
+       .open = NULL,
+       .write = wl_debuglevel_write,
+       .read = wl_debuglevel_read,
+       .owner = THIS_MODULE,
+       .llseek = NULL,
+};
+
+static s32 wl_setup_debugfs(struct bcm_cfg80211 *cfg)
+{
+       s32 err = 0;
+       struct dentry *_dentry;
+       if (!cfg)
+               return -EINVAL;
+       cfg->debugfs = debugfs_create_dir(KBUILD_MODNAME, NULL);
+       if (!cfg->debugfs || IS_ERR(cfg->debugfs)) {
+               if (cfg->debugfs == ERR_PTR(-ENODEV))
+                       WL_ERR(("Debugfs is not enabled on this kernel\n"));
+               else
+                       WL_ERR(("Can not create debugfs directory\n"));
+               cfg->debugfs = NULL;
+               goto exit;
+
+       }
+       _dentry = debugfs_create_file("debug_level", S_IRUSR | S_IWUSR,
+               cfg->debugfs, cfg, &fops_debuglevel);
+       if (!_dentry || IS_ERR(_dentry)) {
+               WL_ERR(("failed to create debug_level debug file\n"));
+               wl_free_debugfs(cfg);
+       }
+exit:
+       return err;
+}
+static s32 wl_free_debugfs(struct bcm_cfg80211 *cfg)
+{
+       if (!cfg)
+               return -EINVAL;
+       if (cfg->debugfs)
+               debugfs_remove_recursive(cfg->debugfs);
+       cfg->debugfs = NULL;
+       return 0;
+}
+#endif /* DEBUGFS_CFG80211 */
+
+struct device *wl_cfg80211_get_parent_dev(void)
+{
+       return cfg80211_parent_dev;
+}
+
+void wl_cfg80211_set_parent_dev(void *dev)
+{
+       cfg80211_parent_dev = dev;
+}
+
+static void wl_cfg80211_clear_parent_dev(void)
+{
+       cfg80211_parent_dev = NULL;
+}
+
+void get_primary_mac(struct bcm_cfg80211 *cfg, struct ether_addr *mac)
+{
+       wldev_iovar_getbuf_bsscfg(bcmcfg_to_prmry_ndev(cfg), "cur_etheraddr", NULL,
+               0, cfg->ioctl_buf, WLC_IOCTL_SMLEN, 0, &cfg->ioctl_buf_sync);
+       memcpy(mac->octet, cfg->ioctl_buf, ETHER_ADDR_LEN);
+}
+static bool check_dev_role_integrity(struct bcm_cfg80211 *cfg, u32 dev_role)
+{
+       dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+       if (((dev_role == NL80211_IFTYPE_AP) &&
+               !(dhd->op_mode & DHD_FLAG_HOSTAP_MODE)) ||
+               ((dev_role == NL80211_IFTYPE_P2P_GO) &&
+               !(dhd->op_mode & DHD_FLAG_P2P_GO_MODE)))
+       {
+               WL_ERR(("device role select failed role:%d op_mode:%d \n", dev_role, dhd->op_mode));
+               return false;
+       }
+       return true;
+}
+
+int wl_cfg80211_do_driver_init(struct net_device *net)
+{
+       struct bcm_cfg80211 *cfg = *(struct bcm_cfg80211 **)netdev_priv(net);
+
+       if (!cfg || !cfg->wdev)
+               return -EINVAL;
+
+       if (dhd_do_driver_init(cfg->wdev->netdev) < 0)
+               return -1;
+
+       return 0;
+}
+
+void wl_cfg80211_enable_trace(bool set, u32 level)
+{
+       if (set)
+               wl_dbg_level = level & WL_DBG_LEVEL;
+       else
+               wl_dbg_level |= (WL_DBG_LEVEL & level);
+}
+#if defined(WL_SUPPORT_BACKPORTED_KPATCHES) || (LINUX_VERSION_CODE >= KERNEL_VERSION(3, \
+       2, 0))
+static s32
+wl_cfg80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
+       bcm_struct_cfgdev *cfgdev, u64 cookie)
+{
+       /* CFG80211 checks for tx_cancel_wait callback when ATTR_DURATION
+        * is passed with CMD_FRAME. This callback is supposed to cancel
+        * the OFFCHANNEL Wait. Since we are already taking care of that
+        *  with the tx_mgmt logic, do nothing here.
+        */
+
+       return 0;
+}
+#endif /* WL_SUPPORT_BACKPORTED_PATCHES || KERNEL >= 3.2.0 */
+
+#ifdef WL11U
+bcm_tlv_t *
+wl_cfg80211_find_interworking_ie(u8 *parse, u32 len)
+{
+       bcm_tlv_t *ie;
+
+       while ((ie = bcm_parse_tlvs(parse, (u32)len, DOT11_MNG_INTERWORKING_ID))) {
+                       return (bcm_tlv_t *)ie;
+       }
+       return NULL;
+}
+
+
+static s32
+wl_cfg80211_add_iw_ie(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32 bssidx, s32 pktflag,
+            uint8 ie_id, uint8 *data, uint8 data_len)
+{
+       s32 err = BCME_OK;
+       s32 buf_len;
+       s32 iecount;
+       ie_setbuf_t *ie_setbuf;
+       u32 iw_ie_len = 0;
+       u8 iw_ie[IW_IES_MAX_BUF_LEN];
+
+       if (ie_id != DOT11_MNG_INTERWORKING_ID)
+               return BCME_UNSUPPORTED;
+
+       /* Validate the pktflag parameter */
+       if ((pktflag & ~(VNDR_IE_BEACON_FLAG | VNDR_IE_PRBRSP_FLAG |
+                   VNDR_IE_ASSOCRSP_FLAG | VNDR_IE_AUTHRSP_FLAG |
+                   VNDR_IE_PRBREQ_FLAG | VNDR_IE_ASSOCREQ_FLAG|
+                   VNDR_IE_CUSTOM_FLAG))) {
+               WL_ERR(("cfg80211 Add IE: Invalid packet flag 0x%x\n", pktflag));
+               return -1;
+       }
+
+       /* use VNDR_IE_CUSTOM_FLAG flags for none vendor IE . currently fixed value */
+       pktflag = htod32(pktflag);
+
+       if (data_len > IW_IES_MAX_BUF_LEN) {
+               WL_ERR(("IW IE len exceeds max len %d\n", IW_IES_MAX_BUF_LEN));
+               return -EINVAL;
+       }
+
+       buf_len = sizeof(ie_setbuf_t) + data_len - 1;
+       ie_setbuf = (ie_setbuf_t *) kzalloc(buf_len, GFP_KERNEL);
+
+       if (!ie_setbuf) {
+               WL_ERR(("Error allocating buffer for IE\n"));
+               return -ENOMEM;
+       }
+
+       wl_get_iwdata_by_netdev(cfg, ndev, iw_ie, &iw_ie_len);
+
+       if (iw_ie_len == data_len && !memcmp(iw_ie, data, data_len)) {
+               WL_ERR(("Previous IW IE is equals to current IE\n"));
+               err = BCME_OK;
+               goto exit;
+       }
+
+       strncpy(ie_setbuf->cmd, "add", VNDR_IE_CMD_LEN - 1);
+       ie_setbuf->cmd[VNDR_IE_CMD_LEN - 1] = '\0';
+
+       /* Buffer contains only 1 IE */
+       iecount = htod32(1);
+       memcpy((void *)&ie_setbuf->ie_buffer.iecount, &iecount, sizeof(int));
+       memcpy((void *)&ie_setbuf->ie_buffer.ie_list[0].pktflag, &pktflag, sizeof(uint32));
+
+       /* Now, add the IE to the buffer */
+       ie_setbuf->ie_buffer.ie_list[0].ie_data.id = ie_id;
+
+       /* if already set with previous values, delete it first */
+       if (iw_ie_len != 0) {
+               WL_DBG(("Different IW_IE was already set. clear first\n"));
+
+               ie_setbuf->ie_buffer.ie_list[0].ie_data.len = 0;
+
+               err = wldev_iovar_setbuf_bsscfg(ndev, "ie", ie_setbuf, buf_len,
+                       cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+
+               if (err != BCME_OK)
+                       goto exit;
+       }
+
+       ie_setbuf->ie_buffer.ie_list[0].ie_data.len = data_len;
+       memcpy((uchar *)&ie_setbuf->ie_buffer.ie_list[0].ie_data.data[0], data, data_len);
+
+       err = wldev_iovar_setbuf_bsscfg(ndev, "ie", ie_setbuf, buf_len,
+               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+
+       if (err == BCME_OK) {
+               wl_set_iwdata_by_netdev(cfg, ndev, data, data_len);
+               err = wldev_iovar_setint_bsscfg(ndev, "grat_arp", 1, bssidx);
+       }
+
+exit:
+       if (ie_setbuf)
+               kfree(ie_setbuf);
+       return err;
+}
+#endif /* WL11U */
+
+s32
+wl_cfg80211_dfs_ap_move(struct net_device *ndev, char *data, char *command, int total_len)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(ndev);
+       char ioctl_buf[50];
+       int err = 0;
+       uint32 val = 0;
+       chanspec_t chanspec = 0;
+       int abort;
+       int bytes_written = 0;
+       wl_dfs_ap_move_status_t *status;
+       char chanbuf[CHANSPEC_STR_LEN];
+       const char *dfs_state_str[DFS_SCAN_S_MAX] = {
+               "Radar Free On Channel",
+               "Radar Found On Channel",
+               "Radar Scan In Progress",
+               "Radar Scan Aborted",
+               "RSDB Mode switch in Progress For Scan"
+       };
+       if (ndev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
+               bytes_written = snprintf(command, total_len, "AP is not UP\n");
+               return bytes_written;
+       }
+       if (!*data) {
+               if ((err = wldev_iovar_getbuf(ndev, "dfs_ap_move", NULL, 0,
+                               cfg->ioctl_buf, WLC_IOCTL_MAXLEN,  &cfg->ioctl_buf_sync))) {
+                       WL_ERR(("setting dfs_ap_move failed with err=%d \n", err));
+                       return err;
+               }
+               status = (wl_dfs_ap_move_status_t *)cfg->ioctl_buf;
+
+               if (status->version != WL_DFS_AP_MOVE_VERSION) {
+                       err = BCME_UNSUPPORTED;
+                       WL_ERR(("err=%d version=%d\n", err, status->version));
+                       return err;
+               }
+
+               if (status->move_status != (int8) DFS_SCAN_S_IDLE) {
+                       chanspec = wl_chspec_driver_to_host(status->chanspec);
+                       if (chanspec != 0 && chanspec != INVCHANSPEC) {
+                               wf_chspec_ntoa(chanspec, chanbuf);
+                               bytes_written = snprintf(command, total_len,
+                                       "AP Target Chanspec %s (0x%x)\n", chanbuf, chanspec);
+                       }
+                       bytes_written += snprintf(command + bytes_written, total_len,
+                                        "%s\n", dfs_state_str[status->move_status]);
+                       return bytes_written;
+               } else {
+                       bytes_written = snprintf(command, total_len, "dfs AP move in IDLE state\n");
+                       return bytes_written;
+               }
+
+       }
+
+       abort = bcm_atoi(data);
+       if (abort == -1) {
+               if ((err = wldev_iovar_setbuf(ndev, "dfs_ap_move", &abort,
+                               sizeof(int), ioctl_buf, sizeof(ioctl_buf), NULL)) < 0) {
+                       WL_ERR(("seting dfs_ap_move failed with err %d\n", err));
+                       return err;
+               }
+       } else {
+               chanspec = wf_chspec_aton(data);
+               if (chanspec != 0) {
+                       val = wl_chspec_host_to_driver(chanspec);
+                       if (val != INVCHANSPEC) {
+                               if ((err = wldev_iovar_setbuf(ndev, "dfs_ap_move", &val,
+                                       sizeof(int), ioctl_buf, sizeof(ioctl_buf), NULL)) < 0) {
+                                       WL_ERR(("seting dfs_ap_move failed with err %d\n", err));
+                                       return err;
+                               }
+                               WL_DBG((" set dfs_ap_move successfull"));
+                       } else {
+                               err = BCME_USAGE_ERROR;
+                       }
+               }
+       }
+       return err;
+}
+
+s32
+wl_cfg80211_wbtext_config(struct net_device *ndev, char *data, char *command, int total_len)
+{
+       uint i = 0;
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(ndev);
+       wl_roam_prof_band_t *rp;
+       int err = -EINVAL, bytes_written = 0;
+       size_t len = strlen(data);
+       int rp_len = 0;
+       data[len] = '\0';
+       rp = (wl_roam_prof_band_t *) kzalloc(sizeof(*rp)
+                       * WL_MAX_ROAM_PROF_BRACKETS, GFP_KERNEL);
+       if (unlikely(!rp)) {
+               WL_ERR(("%s: failed to allocate memory\n", __func__));
+               err =  -ENOMEM;
+               goto exit;
+       }
+
+       rp->ver = WL_MAX_ROAM_PROF_VER;
+       if (*data && (!strncmp(data, "b", 1))) {
+               rp->band = WLC_BAND_2G;
+       } else if (*data && (!strncmp(data, "a", 1))) {
+               rp->band = WLC_BAND_5G;
+       } else {
+               err = snprintf(command, total_len, "Missing band\n");
+               goto exit;
+       }
+       data++;
+       rp->len = 0;
+       /* Getting roam profile  from fw */
+       if ((err = wldev_iovar_getbuf(ndev, "roam_prof", rp, sizeof(*rp),
+               cfg->ioctl_buf, WLC_IOCTL_MAXLEN,  &cfg->ioctl_buf_sync))) {
+               WL_ERR(("Getting roam_profile failed with err=%d \n", err));
+               goto exit;
+       }
+       memcpy(rp, cfg->ioctl_buf, sizeof(*rp) * WL_MAX_ROAM_PROF_BRACKETS);
+       /* roam_prof version get */
+       if (rp->ver != WL_MAX_ROAM_PROF_VER) {
+               WL_ERR(("bad version (=%d) in return data\n", rp->ver));
+               err = -EINVAL;
+               goto exit;
+       }
+       if ((rp->len % sizeof(wl_roam_prof_t)) != 0) {
+               WL_ERR(("bad length (=%d) in return data\n", rp->len));
+               err = -EINVAL;
+               goto exit;
+       }
+
+       if (!*data) {
+               for (i = 0; i < WL_MAX_ROAM_PROF_BRACKETS; i++) {
+                       /* printing contents of roam profile data from fw and exits
+                        * if code hits any of one of the below condtion. If remaining
+                        * length of buffer is less than roam profile size or
+                        * if there is no valid entry.
+                        */
+                       if (((i * sizeof(wl_roam_prof_t)) > rp->len) ||
+                               (rp->roam_prof[i].fullscan_period == 0)) {
+                               break;
+                       }
+                       bytes_written += snprintf(command+bytes_written,
+                                       total_len, "RSSI[%d,%d] CU(trigger:%d%%: duration:%ds)\n",
+                                       rp->roam_prof[i].roam_trigger, rp->roam_prof[i].rssi_lower,
+                                       rp->roam_prof[i].channel_usage,
+                                       rp->roam_prof[i].cu_avg_calc_dur);
+               }
+               err = bytes_written;
+               goto exit;
+       } else {
+               for (i = 0; i < WL_MAX_ROAM_PROF_BRACKETS; i++) {
+                       /* reading contents of roam profile data from fw and exits
+                        * if code hits any of one of the below condtion, If remaining
+                        * length of buffer is less than roam profile size or if there
+                        * is no valid entry.
+                        */
+                       if (((i * sizeof(wl_roam_prof_t)) > rp->len) ||
+                               (rp->roam_prof[i].fullscan_period == 0)) {
+                               break;
+                       }
+               }
+               /* Do not set roam_prof from upper layer if fw doesn't have 2 rows */
+               if (i != 2) {
+                       WL_ERR(("FW must have 2 rows to fill roam_prof\n"));
+                       err = -EINVAL;
+                       goto exit;
+               }
+               /* setting roam profile to fw */
+               data++;
+               for (i = 0; i < WL_MAX_ROAM_PROF_BRACKETS; i++) {
+                       rp->roam_prof[i].roam_trigger = simple_strtol(data, &data, 10);
+                       data++;
+                       rp->roam_prof[i].rssi_lower = simple_strtol(data, &data, 10);
+                       data++;
+                       rp->roam_prof[i].channel_usage = simple_strtol(data, &data, 10);
+                       data++;
+                       rp->roam_prof[i].cu_avg_calc_dur = simple_strtol(data, &data, 10);
+
+                       rp_len += sizeof(wl_roam_prof_t);
+                       if (*data == '\0') {
+                               break;
+                       }
+                       data++;
+               }
+               if (i != 1) {
+                       WL_ERR(("Only two roam_prof rows supported.\n"));
+                       err = -EINVAL;
+                       goto exit;
+               }
+               rp->len = rp_len;
+               if ((err = wldev_iovar_setbuf(ndev, "roam_prof", rp,
+                               sizeof(*rp), cfg->ioctl_buf, WLC_IOCTL_MEDLEN, NULL)) < 0) {
+                       WL_ERR(("seting roam_profile failed with err %d\n", err));
+               }
+       }
+exit:
+       if (rp) {
+               kfree(rp);
+       }
+       return err;
+}
+
+int wl_cfg80211_wbtext_weight_config(struct net_device *ndev, char *data,
+               char *command, int total_len)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(ndev);
+       int bytes_written = 0, err = -EINVAL, argc = 0;
+       char rssi[5], band[5], weight[5];
+       char *endptr = NULL;
+       wnm_bss_select_weight_cfg_t *bwcfg;
+
+       bwcfg = kzalloc(sizeof(*bwcfg), GFP_KERNEL);
+       if (unlikely(!bwcfg)) {
+               WL_ERR(("%s: failed to allocate memory\n", __func__));
+               err = -ENOMEM;
+               goto exit;
+       }
+       bwcfg->version =  WNM_BSSLOAD_MONITOR_VERSION;
+       bwcfg->type = 0;
+       bwcfg->weight = 0;
+
+       argc = sscanf(data, "%s %s %s", rssi, band, weight);
+
+       if (!strcasecmp(rssi, "rssi"))
+               bwcfg->type = WNM_BSS_SELECT_TYPE_RSSI;
+       else if (!strcasecmp(rssi, "cu"))
+               bwcfg->type = WNM_BSS_SELECT_TYPE_CU;
+       else {
+               /* Usage DRIVER WBTEXT_WEIGHT_CONFIG <rssi/cu> <band> <weight> */
+               WL_ERR(("%s: Command usage error\n", __func__));
+               goto exit;
+       }
+
+       if (!strcasecmp(band, "a"))
+               bwcfg->band = WLC_BAND_5G;
+       else if (!strcasecmp(band, "b"))
+               bwcfg->band = WLC_BAND_2G;
+       else if (!strcasecmp(band, "all"))
+               bwcfg->band = WLC_BAND_ALL;
+       else {
+               WL_ERR(("%s: Command usage error\n", __func__));
+               goto exit;
+       }
+
+       if (argc == 2) {
+               /* If there is no data after band, getting wnm_bss_select_weight from fw */
+               if (bwcfg->band == WLC_BAND_ALL) {
+                       WL_ERR(("band option \"all\" is for set only, not get\n"));
+                       goto exit;
+               }
+               if ((err = wldev_iovar_getbuf(ndev, "wnm_bss_select_weight", bwcfg,
+                               sizeof(*bwcfg),
+                               cfg->ioctl_buf, WLC_IOCTL_MAXLEN,  &cfg->ioctl_buf_sync))) {
+                       WL_ERR(("Getting wnm_bss_select_weight failed with err=%d \n", err));
+                       goto exit;
+               }
+               memcpy(bwcfg, cfg->ioctl_buf, sizeof(*bwcfg));
+               bytes_written = snprintf(command, total_len, "%s %s weight = %d\n",
+                       (bwcfg->type == WNM_BSS_SELECT_TYPE_RSSI) ? "RSSI" : "CU",
+                       (bwcfg->band == WLC_BAND_2G) ? "2G" : "5G", bwcfg->weight);
+               err = bytes_written;
+               goto exit;
+       } else {
+               /* if weight is non integer returns command usage error */
+               bwcfg->weight = simple_strtol(weight, &endptr, 0);
+               if (*endptr != '\0') {
+                       WL_ERR(("%s: Command usage error", __func__));
+                       goto exit;
+               }
+               /* setting weight for iovar wnm_bss_select_weight to fw */
+               if ((err = wldev_iovar_setbuf(ndev, "wnm_bss_select_weight", bwcfg,
+                               sizeof(*bwcfg),
+                               cfg->ioctl_buf, WLC_IOCTL_MAXLEN,  &cfg->ioctl_buf_sync))) {
+                       WL_ERR(("Getting wnm_bss_select_weight failed with err=%d\n", err));
+               }
+       }
+exit:
+       if (bwcfg) {
+               kfree(bwcfg);
+       }
+       return err;
+}
+
+/* WBTEXT_TUPLE_MIN_LEN_CHECK :strlen(low)+" "+strlen(high)+" "+strlen(factor) */
+#define WBTEXT_TUPLE_MIN_LEN_CHECK 5
+
+int wl_cfg80211_wbtext_table_config(struct net_device *ndev, char *data,
+       char *command, int total_len)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(ndev);
+       int bytes_written = 0, err = -EINVAL;
+       char rssi[5], band[5];
+       int btcfg_len = 0, i = 0, parsed_len = 0;
+       wnm_bss_select_factor_cfg_t *btcfg;
+       size_t slen = strlen(data);
+       char *start_addr = NULL;
+       data[slen] = '\0';
+
+       btcfg = kzalloc((sizeof(*btcfg) + sizeof(*btcfg) *
+                       WL_FACTOR_TABLE_MAX_LIMIT), GFP_KERNEL);
+       if (unlikely(!btcfg)) {
+               WL_ERR(("%s: failed to allocate memory\n", __func__));
+               err = -ENOMEM;
+               goto exit;
+       }
+
+       btcfg->version = WNM_BSS_SELECT_FACTOR_VERSION;
+       btcfg->band = WLC_BAND_AUTO;
+       btcfg->type = 0;
+       btcfg->count = 0;
+
+       sscanf(data, "%s %s", rssi, band);
+
+       if (!strcasecmp(rssi, "rssi")) {
+               btcfg->type = WNM_BSS_SELECT_TYPE_RSSI;
+       }
+       else if (!strcasecmp(rssi, "cu")) {
+               btcfg->type = WNM_BSS_SELECT_TYPE_CU;
+       }
+       else {
+               WL_ERR(("%s: Command usage error\n", __func__));
+               goto exit;
+       }
+
+       if (!strcasecmp(band, "a")) {
+               btcfg->band = WLC_BAND_5G;
+       }
+       else if (!strcasecmp(band, "b")) {
+               btcfg->band = WLC_BAND_2G;
+       }
+       else if (!strcasecmp(band, "all")) {
+               btcfg->band = WLC_BAND_ALL;
+       }
+       else {
+               WL_ERR(("%s: Command usage, Wrong band\n", __func__));
+               goto exit;
+       }
+
+       if ((slen - 1) == (strlen(rssi) + strlen(band))) {
+               /* Getting factor table using iovar 'wnm_bss_select_table' from fw */
+               if ((err = wldev_iovar_getbuf(ndev, "wnm_bss_select_table", btcfg,
+                               sizeof(*btcfg),
+                               cfg->ioctl_buf, WLC_IOCTL_MAXLEN,  &cfg->ioctl_buf_sync))) {
+                       WL_ERR(("Getting wnm_bss_select_table failed with err=%d \n", err));
+                       goto exit;
+               }
+               memcpy(btcfg, cfg->ioctl_buf, sizeof(*btcfg));
+               memcpy(btcfg, cfg->ioctl_buf, (btcfg->count+1) * sizeof(*btcfg));
+
+               bytes_written += snprintf(command + bytes_written, total_len,
+                                       "No of entries in table: %d\n", btcfg->count);
+               bytes_written += snprintf(command + bytes_written, total_len, "%s factor table\n",
+                               (btcfg->type == WNM_BSS_SELECT_TYPE_RSSI) ? "RSSI" : "CU");
+               bytes_written += snprintf(command + bytes_written, total_len,
+                                       "low\thigh\tfactor\n");
+               for (i = 0; i <= btcfg->count-1; i++) {
+                       bytes_written += snprintf(command + bytes_written, total_len,
+                               "%d\t%d\t%d\n", btcfg->params[i].low, btcfg->params[i].high,
+                               btcfg->params[i].factor);
+               }
+               err = bytes_written;
+               goto exit;
+       } else {
+               memset(btcfg->params, 0, sizeof(*btcfg) * WL_FACTOR_TABLE_MAX_LIMIT);
+               data += (strlen(rssi) + strlen(band) + 2);
+               start_addr = data;
+               slen = slen - (strlen(rssi) + strlen(band) + 2);
+               for (i = 0; i < WL_FACTOR_TABLE_MAX_LIMIT; i++) {
+                       if (parsed_len + WBTEXT_TUPLE_MIN_LEN_CHECK <= slen) {
+                               btcfg->params[i].low = simple_strtol(data, &data, 10);
+                               data++;
+                               btcfg->params[i].high = simple_strtol(data, &data, 10);
+                               data++;
+                               btcfg->params[i].factor = simple_strtol(data, &data, 10);
+                               btcfg->count++;
+                               if (*data == '\0') {
+                                       break;
+                               }
+                               data++;
+                               parsed_len = data - start_addr;
+                       } else {
+                               WL_ERR(("%s:Command usage:less no of args\n", __func__));
+                               goto exit;
+                       }
+               }
+               btcfg_len = sizeof(*btcfg) + ((btcfg->count) * sizeof(*btcfg));
+               if ((err = wldev_iovar_setbuf(ndev, "wnm_bss_select_table", btcfg, btcfg_len,
+                               cfg->ioctl_buf, WLC_IOCTL_MEDLEN, NULL)) < 0) {
+                       WL_ERR(("seting wnm_bss_select_table failed with err %d\n", err));
+                       goto exit;
+               }
+       }
+exit:
+       if (btcfg) {
+               kfree(btcfg);
+       }
+       return err;
+}
+
+s32
+wl_cfg80211_wbtext_delta_config(struct net_device *ndev, char *data, char *command, int total_len)
+{
+       uint i = 0;
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(ndev);
+       int err = -EINVAL, bytes_written = 0, argc = 0, val, len = 0;
+       char delta[5], band[5], *endptr = NULL;
+       wl_roam_prof_band_t *rp;
+
+       rp = (wl_roam_prof_band_t *) kzalloc(sizeof(*rp)
+                       * WL_MAX_ROAM_PROF_BRACKETS, GFP_KERNEL);
+       if (unlikely(!rp)) {
+               WL_ERR(("%s: failed to allocate memory\n", __func__));
+               err = -ENOMEM;
+               goto exit;
+       }
+
+       argc = sscanf(data, "%s %s", band, delta);
+       if (!strcasecmp(band, "a"))
+               rp->band = WLC_BAND_5G;
+       else if (!strcasecmp(band, "b"))
+               rp->band = WLC_BAND_2G;
+       else {
+               WL_ERR(("%s: Missing band\n", __func__));
+               goto exit;
+       }
+       /* Getting roam profile  from fw */
+       if ((err = wldev_iovar_getbuf(ndev, "roam_prof", rp, sizeof(*rp),
+               cfg->ioctl_buf, WLC_IOCTL_MAXLEN,  &cfg->ioctl_buf_sync))) {
+               WL_ERR(("Getting roam_profile failed with err=%d \n", err));
+               goto exit;
+       }
+       memcpy(rp, cfg->ioctl_buf, sizeof(wl_roam_prof_band_t));
+       if (rp->ver != WL_MAX_ROAM_PROF_VER) {
+               WL_ERR(("bad version (=%d) in return data\n", rp->ver));
+               err = -EINVAL;
+               goto exit;
+       }
+       if ((rp->len % sizeof(wl_roam_prof_t)) != 0) {
+               WL_ERR(("bad length (=%d) in return data\n", rp->len));
+               err = -EINVAL;
+               goto exit;
+       }
+
+       if (argc == 2) {
+               /* if delta is non integer returns command usage error */
+               val = simple_strtol(delta, &endptr, 0);
+               if (*endptr != '\0') {
+                       WL_ERR(("%s: Command usage error", __func__));
+                       goto exit;
+               }
+               for (i = 0; i < WL_MAX_ROAM_PROF_BRACKETS; i++) {
+               /*
+                * Checking contents of roam profile data from fw and exits
+                * if code hits below condtion. If remaining length of buffer is
+                * less than roam profile size or if there is no valid entry.
+                */
+                       if (((i * sizeof(wl_roam_prof_t)) > rp->len) ||
+                               (rp->roam_prof[i].fullscan_period == 0)) {
+                               break;
+                       }
+                       if (rp->roam_prof[i].channel_usage != 0) {
+                               rp->roam_prof[i].roam_delta = val;
+                       }
+                       len += sizeof(wl_roam_prof_t);
+               }
+       }
+       else {
+               if (rp->roam_prof[i].channel_usage != 0) {
+                       bytes_written = snprintf(command, total_len,
+                               "%s Delta %d\n", (rp->band == WLC_BAND_2G) ? "2G" : "5G",
+                               rp->roam_prof[0].roam_delta);
+               }
+               err = bytes_written;
+               goto exit;
+       }
+       rp->len = len;
+       if ((err = wldev_iovar_setbuf(ndev, "roam_prof", rp,
+                       sizeof(*rp), cfg->ioctl_buf, WLC_IOCTL_MEDLEN, NULL)) < 0) {
+               WL_ERR(("seting roam_profile failed with err %d\n", err));
+       }
+exit :
+       if (rp) {
+               kfree(rp);
+       }
+       return err;
+}
+
+
+int wl_cfg80211_scan_stop(bcm_struct_cfgdev *cfgdev)
+{
+       struct bcm_cfg80211 *cfg = NULL;
+       struct net_device *ndev = NULL;
+       unsigned long flags;
+       int clear_flag = 0;
+       int ret = 0;
+
+       WL_TRACE(("Enter\n"));
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+       cfg = WDEV_GET_CFG80211_PRIV(cfgdev);
+#else
+       cfg = NETDEV_GET_CFG80211_PRIV(cfgdev);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+       if (!cfg)
+               return -EINVAL;
+
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+       spin_lock_irqsave(&cfg->cfgdrv_lock, flags);
+#ifdef WL_CFG80211_P2P_DEV_IF
+       if (cfg->scan_request && cfg->scan_request->wdev == cfgdev) {
+#else
+       if (cfg->scan_request && cfg->scan_request->dev == cfgdev) {
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0)
+               struct cfg80211_scan_info info = {
+                       .aborted = true
+               };
+               cfg80211_scan_done(cfg->scan_request, &info);
+#else
+               cfg80211_scan_done(cfg->scan_request, true);
+#endif
+               cfg->scan_request = NULL;
+               clear_flag = 1;
+       }
+       spin_unlock_irqrestore(&cfg->cfgdrv_lock, flags);
+
+       if (clear_flag)
+               wl_clr_drv_status(cfg, SCANNING, ndev);
+
+       return ret;
+}
+
+bool wl_cfg80211_is_concurrent_mode(struct bcm_cfg80211 *cfg)
+{
+       if ((cfg) && (wl_get_drv_status_all(cfg, CONNECTED) > 1)) {
+               return true;
+       } else {
+               return false;
+       }
+}
+
+void* wl_cfg80211_get_dhdp(struct net_device *net)
+{
+       struct bcm_cfg80211 *cfg = NULL;
+
+       if (!net)
+               return NULL;
+
+       cfg = NETDEV_GET_CFG80211_PRIV(net);
+
+       return cfg->pub;
+}
+
+bool wl_cfg80211_is_p2p_active(struct wireless_dev *wdev)
+{
+       struct bcm_cfg80211 *cfg = WDEV_GET_CFG80211_PRIV(wdev);
+       return (cfg && cfg->p2p);
+}
+
+bool wl_cfg80211_is_roam_offload(struct bcm_cfg80211 *cfg)
+{
+       return (cfg && cfg->roam_offload);
+}
+
+bool wl_cfg80211_is_event_from_connected_bssid(void *cfg80211_priv,
+       const wl_event_msg_t *e, int ifidx)
+{
+       dhd_pub_t *dhd = NULL;
+       struct net_device *ndev = NULL;
+       u8 *curbssid = NULL;
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)cfg80211_priv;
+
+       dhd = (dhd_pub_t *)(cfg->pub);
+
+       if (dhd) {
+               ndev = dhd_idx2net(dhd, ifidx);
+       }
+
+       if (!dhd || !ndev) {
+               return false;
+       }
+
+       curbssid = wl_read_prof(cfg, ndev, WL_PROF_BSSID);
+
+       return memcmp(curbssid, &e->addr, ETHER_ADDR_LEN) == 0;
+}
+
+static void wl_cfg80211_work_handler(struct work_struct * work)
+{
+       struct bcm_cfg80211 *cfg = NULL;
+       struct net_info *iter, *next;
+       s32 err = BCME_OK;
+       s32 pm = PM_FAST;
+       BCM_SET_CONTAINER_OF(cfg, work, struct bcm_cfg80211, pm_enable_work.work);
+       WL_DBG(("Enter \n"));
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+_Pragma("GCC diagnostic push")
+_Pragma("GCC diagnostic ignored \"-Wcast-qual\"")
+#endif
+       for_each_ndev(cfg, iter, next) {
+               /* p2p discovery iface ndev could be null */
+               if (iter->ndev) {
+                       if (!wl_get_drv_status(cfg, CONNECTED, iter->ndev) ||
+                               (wl_get_mode_by_netdev(cfg, iter->ndev) != WL_MODE_BSS &&
+                               wl_get_mode_by_netdev(cfg, iter->ndev) != WL_MODE_IBSS))
+                               continue;
+                       if (iter->ndev) {
+                               if ((err = wldev_ioctl(iter->ndev, WLC_SET_PM,
+                                               &pm, sizeof(pm), true)) != 0) {
+                                       if (err == -ENODEV)
+                                               WL_DBG(("%s:netdev not ready\n",
+                                                       iter->ndev->name));
+                                       else
+                                               WL_ERR(("%s:error (%d)\n",
+                                                       iter->ndev->name, err));
+                               } else
+                                       wl_cfg80211_update_power_mode(iter->ndev);
+                       }
+               }
+       }
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+       _Pragma("GCC diagnostic pop")
+#endif
+       DHD_PM_WAKE_UNLOCK(cfg->pub);
+}
+
+u8
+wl_get_action_category(void *frame, u32 frame_len)
+{
+       u8 category;
+       u8 *ptr = (u8 *)frame;
+       if (frame == NULL)
+               return DOT11_ACTION_CAT_ERR_MASK;
+       if (frame_len < DOT11_ACTION_HDR_LEN)
+               return DOT11_ACTION_CAT_ERR_MASK;
+       category = ptr[DOT11_ACTION_CAT_OFF];
+       WL_INFORM(("Action Category: %d\n", category));
+       return category;
+}
+
+int
+wl_get_public_action(void *frame, u32 frame_len, u8 *ret_action)
+{
+       u8 *ptr = (u8 *)frame;
+       if (frame == NULL || ret_action == NULL)
+               return BCME_ERROR;
+       if (frame_len < DOT11_ACTION_HDR_LEN)
+               return BCME_ERROR;
+       if (DOT11_ACTION_CAT_PUBLIC != wl_get_action_category(frame, frame_len))
+               return BCME_ERROR;
+       *ret_action = ptr[DOT11_ACTION_ACT_OFF];
+       WL_INFORM(("Public Action : %d\n", *ret_action));
+       return BCME_OK;
+}
+
+
+static int
+wl_cfg80211_delayed_roam(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       const struct ether_addr *bssid)
+{
+       s32 err;
+       wl_event_msg_t e;
+
+       bzero(&e, sizeof(e));
+       e.event_type = cpu_to_be32(WLC_E_BSSID);
+       memcpy(&e.addr, bssid, ETHER_ADDR_LEN);
+       /* trigger the roam event handler */
+       WL_INFORM(("Delayed roam to " MACDBG "\n", MAC2STRDBG((u8*)(bssid))));
+       err = wl_notify_roaming_status(cfg, ndev_to_cfgdev(ndev), &e, NULL);
+
+       return err;
+}
+
+static s32
+wl_cfg80211_parse_vndr_ies(u8 *parse, u32 len,
+    struct parsed_vndr_ies *vndr_ies)
+{
+       s32 err = BCME_OK;
+       vndr_ie_t *vndrie;
+       bcm_tlv_t *ie;
+       struct parsed_vndr_ie_info *parsed_info;
+       u32 count = 0;
+       s32 remained_len;
+
+       remained_len = (s32)len;
+       memset(vndr_ies, 0, sizeof(*vndr_ies));
+
+       WL_INFORM(("---> len %d\n", len));
+       ie = (bcm_tlv_t *) parse;
+       if (!bcm_valid_tlv(ie, remained_len))
+               ie = NULL;
+       while (ie) {
+               if (count >= MAX_VNDR_IE_NUMBER)
+                       break;
+               if (ie->id == DOT11_MNG_VS_ID) {
+                       vndrie = (vndr_ie_t *) ie;
+                       /* len should be bigger than OUI length + one data length at least */
+                       if (vndrie->len < (VNDR_IE_MIN_LEN + 1)) {
+                               WL_ERR(("%s: invalid vndr ie. length is too small %d\n",
+                                       __FUNCTION__, vndrie->len));
+                               goto end;
+                       }
+                       /* if wpa or wme ie, do not add ie */
+                       if (!bcmp(vndrie->oui, (u8*)WPA_OUI, WPA_OUI_LEN) &&
+                               ((vndrie->data[0] == WPA_OUI_TYPE) ||
+                               (vndrie->data[0] == WME_OUI_TYPE))) {
+                               CFGP2P_DBG(("Found WPA/WME oui. Do not add it\n"));
+                               goto end;
+                       }
+
+                       parsed_info = &vndr_ies->ie_info[count++];
+
+                       /* save vndr ie information */
+                       parsed_info->ie_ptr = (char *)vndrie;
+                       parsed_info->ie_len = (vndrie->len + TLV_HDR_LEN);
+                       memcpy(&parsed_info->vndrie, vndrie, sizeof(vndr_ie_t));
+                       vndr_ies->count = count;
+
+                       WL_DBG(("\t ** OUI %02x %02x %02x, type 0x%02x len:%d\n",
+                       parsed_info->vndrie.oui[0], parsed_info->vndrie.oui[1],
+                       parsed_info->vndrie.oui[2], parsed_info->vndrie.data[0],
+                       parsed_info->ie_len));
+               }
+end:
+               ie = bcm_next_tlv(ie, &remained_len);
+       }
+       return err;
+}
+
+s32
+wl_cfg80211_clear_per_bss_ies(struct bcm_cfg80211 *cfg, s32 bssidx)
+{
+       s32 index;
+       struct net_info *netinfo;
+       s32 vndrie_flag[] = {VNDR_IE_BEACON_FLAG, VNDR_IE_PRBRSP_FLAG,
+               VNDR_IE_ASSOCRSP_FLAG, VNDR_IE_PRBREQ_FLAG, VNDR_IE_ASSOCREQ_FLAG};
+
+       netinfo = wl_get_netinfo_by_bssidx(cfg, bssidx);
+       if (!netinfo || !netinfo->wdev) {
+               WL_ERR(("netinfo or netinfo->wdev is NULL\n"));
+               return -1;
+       }
+
+       WL_DBG(("clear management vendor IEs for bssidx:%d \n", bssidx));
+       /* Clear the IEs set in the firmware so that host is in sync with firmware */
+       for (index = 0; index < ARRAYSIZE(vndrie_flag); index++) {
+               if (wl_cfg80211_set_mgmt_vndr_ies(cfg, wdev_to_cfgdev(netinfo->wdev),
+                       bssidx, vndrie_flag[index], NULL, 0) < 0)
+                       WL_ERR(("vndr_ies clear failed. Ignoring.. \n"));
+       }
+
+       return 0;
+}
+
+s32
+wl_cfg80211_clear_mgmt_vndr_ies(struct bcm_cfg80211 *cfg)
+{
+       struct net_info *iter, *next;
+
+       WL_DBG(("clear management vendor IEs \n"));
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+_Pragma("GCC diagnostic push")
+_Pragma("GCC diagnostic ignored \"-Wcast-qual\"")
+#endif
+       for_each_ndev(cfg, iter, next) {
+               wl_cfg80211_clear_per_bss_ies(cfg, iter->bssidx);
+       }
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+_Pragma("GCC diagnostic pop")
+#endif
+       return 0;
+}
+
+#define WL_VNDR_IE_MAXLEN 2048
+static s8 g_mgmt_ie_buf[WL_VNDR_IE_MAXLEN];
+int
+wl_cfg80211_set_mgmt_vndr_ies(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       s32 bssidx, s32 pktflag, const u8 *vndr_ie, u32 vndr_ie_len)
+{
+       struct net_device *ndev = NULL;
+       s32 ret = BCME_OK;
+       u8  *curr_ie_buf = NULL;
+       u8  *mgmt_ie_buf = NULL;
+       u32 mgmt_ie_buf_len = 0;
+       u32 *mgmt_ie_len = 0;
+       u32 del_add_ie_buf_len = 0;
+       u32 total_ie_buf_len = 0;
+       u32 parsed_ie_buf_len = 0;
+       struct parsed_vndr_ies old_vndr_ies;
+       struct parsed_vndr_ies new_vndr_ies;
+       s32 i;
+       u8 *ptr;
+       s32 remained_buf_len;
+       wl_bss_vndr_ies_t *ies = NULL;
+       struct net_info *netinfo;
+
+       WL_DBG(("Enter. pktflag:0x%x bssidx:%x vnd_ie_len:%d \n",
+               pktflag, bssidx, vndr_ie_len));
+
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+       if (bssidx > WL_MAX_IFS) {
+               WL_ERR(("bssidx > supported concurrent Ifaces \n"));
+               return -EINVAL;
+       }
+
+       netinfo = wl_get_netinfo_by_bssidx(cfg, bssidx);
+       if (!netinfo) {
+               WL_ERR(("net_info ptr is NULL \n"));
+               return -EINVAL;
+       }
+
+       /* Clear the global buffer */
+       memset(g_mgmt_ie_buf, 0, sizeof(g_mgmt_ie_buf));
+       curr_ie_buf = g_mgmt_ie_buf;
+       ies = &netinfo->bss.ies;
+
+       switch (pktflag) {
+               case VNDR_IE_PRBRSP_FLAG :
+                       mgmt_ie_buf = ies->probe_res_ie;
+                       mgmt_ie_len = &ies->probe_res_ie_len;
+                       mgmt_ie_buf_len = sizeof(ies->probe_res_ie);
+                       break;
+               case VNDR_IE_ASSOCRSP_FLAG :
+                       mgmt_ie_buf = ies->assoc_res_ie;
+                       mgmt_ie_len = &ies->assoc_res_ie_len;
+                       mgmt_ie_buf_len = sizeof(ies->assoc_res_ie);
+                       break;
+               case VNDR_IE_BEACON_FLAG :
+                       mgmt_ie_buf = ies->beacon_ie;
+                       mgmt_ie_len = &ies->beacon_ie_len;
+                       mgmt_ie_buf_len = sizeof(ies->beacon_ie);
+                       break;
+               case VNDR_IE_PRBREQ_FLAG :
+                       mgmt_ie_buf = ies->probe_req_ie;
+                       mgmt_ie_len = &ies->probe_req_ie_len;
+                       mgmt_ie_buf_len = sizeof(ies->probe_req_ie);
+                       break;
+               case VNDR_IE_ASSOCREQ_FLAG :
+                       mgmt_ie_buf = ies->assoc_req_ie;
+                       mgmt_ie_len = &ies->assoc_req_ie_len;
+                       mgmt_ie_buf_len = sizeof(ies->assoc_req_ie);
+                       break;
+               default:
+                       mgmt_ie_buf = NULL;
+                       mgmt_ie_len = NULL;
+                       WL_ERR(("not suitable packet type (%d)\n", pktflag));
+                       return BCME_ERROR;
+       }
+
+       if (vndr_ie_len > mgmt_ie_buf_len) {
+               WL_ERR(("extra IE size too big\n"));
+               ret = -ENOMEM;
+       } else {
+               /* parse and save new vndr_ie in curr_ie_buff before comparing it */
+               if (vndr_ie && vndr_ie_len && curr_ie_buf) {
+                       ptr = curr_ie_buf;
+/* must discard vndr_ie constness, attempt to change vndr_ie arg to non-const
+ * causes cascade of errors in other places, fix involves const casts there
+ */
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+_Pragma("GCC diagnostic push")
+_Pragma("GCC diagnostic ignored \"-Wcast-qual\"")
+#endif
+                       if ((ret = wl_cfg80211_parse_vndr_ies((u8 *)vndr_ie,
+                               vndr_ie_len, &new_vndr_ies)) < 0) {
+                               WL_ERR(("parse vndr ie failed \n"));
+                               goto exit;
+                       }
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+_Pragma("GCC diagnostic pop")
+#endif
+                       for (i = 0; i < new_vndr_ies.count; i++) {
+                               struct parsed_vndr_ie_info *vndrie_info =
+                                       &new_vndr_ies.ie_info[i];
+
+                               if ((parsed_ie_buf_len + vndrie_info->ie_len) > WL_VNDR_IE_MAXLEN) {
+                                       WL_ERR(("IE size is too big (%d > %d)\n",
+                                               parsed_ie_buf_len, WL_VNDR_IE_MAXLEN));
+                                       ret = -EINVAL;
+                                       goto exit;
+                               }
+
+                               memcpy(ptr + parsed_ie_buf_len, vndrie_info->ie_ptr,
+                                       vndrie_info->ie_len);
+                               parsed_ie_buf_len += vndrie_info->ie_len;
+                       }
+               }
+
+               if (mgmt_ie_buf != NULL) {
+                       if (parsed_ie_buf_len && (parsed_ie_buf_len == *mgmt_ie_len) &&
+                               (memcmp(mgmt_ie_buf, curr_ie_buf, parsed_ie_buf_len) == 0)) {
+                               WL_INFORM(("Previous mgmt IE is equals to current IE"));
+                               goto exit;
+                       }
+
+                       /* parse old vndr_ie */
+                       if ((ret = wl_cfg80211_parse_vndr_ies(mgmt_ie_buf, *mgmt_ie_len,
+                               &old_vndr_ies)) < 0) {
+                               WL_ERR(("parse vndr ie failed \n"));
+                               goto exit;
+                       }
+                       /* make a command to delete old ie */
+                       for (i = 0; i < old_vndr_ies.count; i++) {
+                               struct parsed_vndr_ie_info *vndrie_info =
+                               &old_vndr_ies.ie_info[i];
+
+                               WL_INFORM(("DELETED ID : %d, Len: %d , OUI:%02x:%02x:%02x\n",
+                                       vndrie_info->vndrie.id, vndrie_info->vndrie.len,
+                                       vndrie_info->vndrie.oui[0], vndrie_info->vndrie.oui[1],
+                                       vndrie_info->vndrie.oui[2]));
+
+                               del_add_ie_buf_len = wl_cfgp2p_vndr_ie(cfg, curr_ie_buf,
+                                       pktflag, vndrie_info->vndrie.oui,
+                                       vndrie_info->vndrie.id,
+                                       vndrie_info->ie_ptr + VNDR_IE_FIXED_LEN,
+                                       vndrie_info->ie_len - VNDR_IE_FIXED_LEN,
+                                       "del");
+
+                               curr_ie_buf += del_add_ie_buf_len;
+                               total_ie_buf_len += del_add_ie_buf_len;
+                       }
+               }
+
+               *mgmt_ie_len = 0;
+               /* Add if there is any extra IE */
+               if (mgmt_ie_buf && parsed_ie_buf_len) {
+                       ptr = mgmt_ie_buf;
+
+                       remained_buf_len = mgmt_ie_buf_len;
+
+                       /* make a command to add new ie */
+                       for (i = 0; i < new_vndr_ies.count; i++) {
+                               struct parsed_vndr_ie_info *vndrie_info =
+                                       &new_vndr_ies.ie_info[i];
+
+                               WL_INFORM(("ADDED ID : %d, Len: %d(%d), OUI:%02x:%02x:%02x\n",
+                                       vndrie_info->vndrie.id, vndrie_info->vndrie.len,
+                                       vndrie_info->ie_len - 2,
+                                       vndrie_info->vndrie.oui[0], vndrie_info->vndrie.oui[1],
+                                       vndrie_info->vndrie.oui[2]));
+
+                               del_add_ie_buf_len = wl_cfgp2p_vndr_ie(cfg, curr_ie_buf,
+                                       pktflag, vndrie_info->vndrie.oui,
+                                       vndrie_info->vndrie.id,
+                                       vndrie_info->ie_ptr + VNDR_IE_FIXED_LEN,
+                                       vndrie_info->ie_len - VNDR_IE_FIXED_LEN,
+                                       "add");
+
+                               /* verify remained buf size before copy data */
+                               if (remained_buf_len >= vndrie_info->ie_len) {
+                                       remained_buf_len -= vndrie_info->ie_len;
+                               } else {
+                                       WL_ERR(("no space in mgmt_ie_buf: pktflag = %d, "
+                                       "found vndr ies # = %d(cur %d), remained len %d, "
+                                       "cur mgmt_ie_len %d, new ie len = %d\n",
+                                       pktflag, new_vndr_ies.count, i, remained_buf_len,
+                                       *mgmt_ie_len, vndrie_info->ie_len));
+                                       break;
+                               }
+
+                               /* save the parsed IE in cfg struct */
+                               memcpy(ptr + (*mgmt_ie_len), vndrie_info->ie_ptr,
+                                       vndrie_info->ie_len);
+                               *mgmt_ie_len += vndrie_info->ie_len;
+                               curr_ie_buf += del_add_ie_buf_len;
+                               total_ie_buf_len += del_add_ie_buf_len;
+                       }
+               }
+
+               if (total_ie_buf_len && cfg->ioctl_buf != NULL) {
+                       ret  = wldev_iovar_setbuf_bsscfg(ndev, "vndr_ie", g_mgmt_ie_buf,
+                               total_ie_buf_len, cfg->ioctl_buf, WLC_IOCTL_MAXLEN,
+                               bssidx, &cfg->ioctl_buf_sync);
+                       if (ret)
+                               WL_ERR(("vndr ie set error : %d\n", ret));
+               }
+       }
+exit:
+
+return ret;
+}
+
+#ifdef WL_CFG80211_ACL
+static int
+wl_cfg80211_set_mac_acl(struct wiphy *wiphy, struct net_device *cfgdev,
+       const struct cfg80211_acl_data *acl)
+{
+       int i;
+       int ret = 0;
+       int macnum = 0;
+       int macmode = MACLIST_MODE_DISABLED;
+       struct maclist *list;
+
+       /* get the MAC filter mode */
+       if (acl && acl->acl_policy == NL80211_ACL_POLICY_DENY_UNLESS_LISTED) {
+               macmode = MACLIST_MODE_ALLOW;
+       } else if (acl && acl->acl_policy == NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
+       acl->n_acl_entries) {
+               macmode = MACLIST_MODE_DENY;
+       }
+
+       /* if acl == NULL, macmode is still disabled.. */
+       if (macmode == MACLIST_MODE_DISABLED) {
+               if ((ret = wl_android_set_ap_mac_list(cfgdev, macmode, NULL)) != 0)
+                       WL_ERR(("%s : Setting MAC list failed error=%d\n", __FUNCTION__, ret));
+
+               return ret;
+       }
+
+       macnum = acl->n_acl_entries;
+       if (macnum < 0 || macnum > MAX_NUM_MAC_FILT) {
+               WL_ERR(("%s : invalid number of MAC address entries %d\n",
+                       __FUNCTION__, macnum));
+               return -1;
+       }
+
+       /* allocate memory for the MAC list */
+       list = (struct maclist*)kmalloc(sizeof(int) +
+               sizeof(struct ether_addr) * macnum, GFP_KERNEL);
+       if (!list) {
+               WL_ERR(("%s : failed to allocate memory\n", __FUNCTION__));
+               return -1;
+       }
+
+       /* prepare the MAC list */
+       list->count = htod32(macnum);
+       for (i = 0; i < macnum; i++) {
+               memcpy(&list->ea[i], &acl->mac_addrs[i], ETHER_ADDR_LEN);
+       }
+       /* set the list */
+       if ((ret = wl_android_set_ap_mac_list(cfgdev, macmode, list)) != 0)
+               WL_ERR(("%s : Setting MAC list failed error=%d\n", __FUNCTION__, ret));
+
+       kfree(list);
+
+       return ret;
+}
+#endif /* WL_CFG80211_ACL */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 5, 0))
+int wl_chspec_chandef(chanspec_t chanspec,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0))
+       struct cfg80211_chan_def *chandef,
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 5, 0) && (LINUX_VERSION_CODE <= (3, 7, \
+       \
+       \
+       \
+       0)))
+       struct chan_info *chaninfo,
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 5, 0)) */
+struct wiphy *wiphy)
+
+{
+       uint16 freq = 0;
+       int chan_type = 0;
+       int channel = 0;
+       struct ieee80211_channel *chan;
+
+       if (!chandef) {
+               return -1;
+       }
+       channel = CHSPEC_CHANNEL(chanspec);
+
+       switch (CHSPEC_BW(chanspec)) {
+               case WL_CHANSPEC_BW_20:
+                       chan_type = NL80211_CHAN_HT20;
+                       break;
+               case WL_CHANSPEC_BW_40:
+               {
+                       if (CHSPEC_SB_UPPER(chanspec)) {
+                               channel += CH_10MHZ_APART;
+                       } else {
+                               channel -= CH_10MHZ_APART;
+                       }
+               }
+                       chan_type = NL80211_CHAN_HT40PLUS;
+                       break;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 8, 0))
+               case WL_CHANSPEC_BW_80:
+               case WL_CHANSPEC_BW_8080:
+               {
+                       uint16 sb = CHSPEC_CTL_SB(chanspec);
+
+                       if (sb == WL_CHANSPEC_CTL_SB_LL) {
+                               channel -= (CH_10MHZ_APART + CH_20MHZ_APART);
+                       } else if (sb == WL_CHANSPEC_CTL_SB_LU) {
+                               channel -= CH_10MHZ_APART;
+                       } else if (sb == WL_CHANSPEC_CTL_SB_UL) {
+                               channel += CH_10MHZ_APART;
+                       } else {
+                               /* WL_CHANSPEC_CTL_SB_UU */
+                               channel += (CH_10MHZ_APART + CH_20MHZ_APART);
+                       }
+
+                       if (sb == WL_CHANSPEC_CTL_SB_LL || sb == WL_CHANSPEC_CTL_SB_LU)
+                               chan_type = NL80211_CHAN_HT40MINUS;
+                       else if (sb == WL_CHANSPEC_CTL_SB_UL || sb == WL_CHANSPEC_CTL_SB_UU)
+                               chan_type = NL80211_CHAN_HT40PLUS;
+               }
+                       break;
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 8, 0)) */
+               default:
+                       chan_type = NL80211_CHAN_HT20;
+                       break;
+
+       }
+
+       if (CHSPEC_IS5G(chanspec))
+               freq = ieee80211_channel_to_frequency(channel, NL80211_BAND_5GHZ);
+       else
+               freq = ieee80211_channel_to_frequency(channel, NL80211_BAND_2GHZ);
+
+       chan = ieee80211_get_channel(wiphy, freq);
+       WL_DBG(("channel:%d freq:%d chan_type: %d chan_ptr:%p \n",
+               channel, freq, chan_type, chan));
+
+       if (unlikely(!chan)) {
+               /* fw and cfg80211 channel lists are not in sync */
+               WL_ERR(("Couldn't find matching channel in wiphy channel list \n"));
+               ASSERT(0);
+               return -EINVAL;
+       }
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 8, 0))
+       cfg80211_chandef_create(chandef, chan, chan_type);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 5, 0) && (LINUX_VERSION_CODE <= (3, 7, \
+       \
+       \
+       \
+       0)))
+       chaninfo->freq = freq;
+       chaninfo->chan_type = chan_type;
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 8, 0)) */
+       return 0;
+}
+
+void
+wl_cfg80211_ch_switch_notify(struct net_device *dev, uint16 chanspec, struct wiphy *wiphy)
+{
+       u32 freq;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 8, 0))
+       struct cfg80211_chan_def chandef;
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 5, 0) && (LINUX_VERSION_CODE <= (3, 7, \
+       \
+       \
+       \
+       0)))
+       struct chan_info chaninfo;
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 8, 0)) */
+
+       if (!wiphy) {
+               WL_ERR(("wiphy is null\n"));
+               return;
+       }
+#ifndef ALLOW_CHSW_EVT
+       /* Channel switch support is only for AP/GO/ADHOC/MESH */
+       if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_STATION ||
+               dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_CLIENT) {
+               WL_ERR(("No channel switch notify support for STA/GC\n"));
+               return;
+       }
+#endif /* !ALLOW_CHSW_EVT */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 8, 0))
+       if (wl_chspec_chandef(chanspec, &chandef, wiphy)) {
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 5, 0) && (LINUX_VERSION_CODE <= (3, 7, \
+       \
+       \
+       \
+       0)))
+       if (wl_chspec_chandef(chanspec, &chaninfo, wiphy)) {
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 8, 0)) */
+
+               WL_ERR(("chspec_chandef failed\n"));
+               return;
+       }
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 8, 0))
+       freq = chandef.chan ? chandef.chan->center_freq : chandef.center_freq1;
+       cfg80211_ch_switch_notify(dev, &chandef);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 5, 0) && (LINUX_VERSION_CODE <= (3, 7, \
+       \
+       \
+       \
+       0)))
+       freq = chan_info.freq;
+       cfg80211_ch_switch_notify(dev, chan_info.freq, chan_info.chan_type);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION (3, 8, 0)) */
+
+       WL_ERR(("Channel switch notification for freq: %d chanspec: 0x%x\n", freq, chanspec));
+       return;
+}
+#endif /* LINUX_VERSION_CODE >= (3, 5, 0) */
+
+#ifdef WL11ULB
+s32
+wl_cfg80211_set_ulb_mode(struct net_device *dev, int mode)
+{
+       int ret;
+       int cur_mode;
+
+       ret = wldev_iovar_getint(dev, "ulb_mode", &cur_mode);
+       if (unlikely(ret)) {
+               WL_ERR(("[ULB] ulb_mode get failed. ret:%d \n", ret));
+               return ret;
+       }
+
+       if (cur_mode == mode) {
+               /* If request mode is same as that of the current mode, then
+                * do nothing (Avoid unnecessary wl down and up).
+                */
+               WL_INFORM(("[ULB] No change in ulb_mode. Do nothing.\n"));
+               return 0;
+       }
+
+       /* setting of ulb_mode requires wl to be down */
+       ret = wldev_ioctl(dev, WLC_DOWN, NULL, 0, true);
+       if (unlikely(ret)) {
+               WL_ERR(("[ULB] WLC_DOWN command failed:[%d]\n", ret));
+               return ret;
+       }
+
+       if (mode >= MAX_SUPP_ULB_MODES) {
+               WL_ERR(("[ULB] unsupported ulb_mode :[%d]\n", mode));
+               return -EINVAL;
+       }
+
+       ret = wldev_iovar_setint(dev, "ulb_mode", mode);
+       if (unlikely(ret)) {
+               WL_ERR(("[ULB] ulb_mode set failed. ret:%d \n", ret));
+               return ret;
+       }
+
+       ret = wldev_ioctl(dev, WLC_UP, NULL, 0, true);
+       if (unlikely(ret)) {
+               WL_ERR(("[ULB] WLC_DOWN command failed:[%d]\n", ret));
+               return ret;
+       }
+
+       WL_DBG(("[ULB] ulb_mode set to %d successfully \n", mode));
+
+       return ret;
+}
+
+static s32
+wl_cfg80211_ulbbw_to_ulbchspec(u32 bw)
+{
+       if (bw == ULB_BW_DISABLED) {
+               return WL_CHANSPEC_BW_20;
+       } else if (bw == ULB_BW_10MHZ) {
+               return WL_CHANSPEC_BW_10;
+       } else if (bw == ULB_BW_5MHZ) {
+               return WL_CHANSPEC_BW_5;
+       } else if (bw == ULB_BW_2P5MHZ) {
+               return WL_CHANSPEC_BW_2P5;
+       } else {
+               WL_ERR(("[ULB] unsupported value for ulb_bw \n"));
+               return -EINVAL;
+       }
+}
+
+static chanspec_t
+wl_cfg80211_ulb_get_min_bw_chspec(struct wireless_dev *wdev, s32 bssidx)
+{
+       struct bcm_cfg80211 *cfg = NULL;
+       struct net_info *_netinfo = NULL;
+
+       /*
+        *  Return the chspec value corresponding to the
+        *  BW setting for a particular interface
+        */
+       if (wdev) {
+               /* if wdev is provided, use it */
+               cfg = WDEV_GET_CFG80211_PRIV(wdev);
+       }
+
+       if (!cfg) {
+               WL_ERR(("[ULB] bcm_cfg80211 is null \n"));
+               return INVCHANSPEC;
+       }
+
+       if (bssidx >= 0) {
+               /* if wdev is not provided, use it */
+               _netinfo = wl_get_netinfo_by_bssidx(cfg, bssidx);
+       } else {
+               _netinfo = wl_get_netinfo_by_wdev(cfg, wdev);
+       }
+
+       if (unlikely(!_netinfo)) {
+               WL_ERR(("[ULB] net_info is null \n"));
+               return INVCHANSPEC;
+       }
+
+       if (_netinfo->ulb_bw) {
+               WL_DBG(("[ULB] wdev_ptr:%p ulb_bw:0x%x \n", _netinfo->wdev, _netinfo->ulb_bw));
+               return wl_cfg80211_ulbbw_to_ulbchspec(_netinfo->ulb_bw);
+       } else {
+               return WL_CHANSPEC_BW_20;
+       }
+}
+
+static s32
+wl_cfg80211_get_ulb_bw(struct wireless_dev *wdev)
+{
+       struct bcm_cfg80211 *cfg = WDEV_GET_CFG80211_PRIV(wdev);
+       struct net_info *_netinfo = wl_get_netinfo_by_wdev(cfg, wdev);
+
+       /*
+        *  Return the ulb_bw setting for a
+        *  particular interface
+        */
+       if (unlikely(!_netinfo)) {
+               WL_ERR(("[ULB] net_info is null \n"));
+               return -1;
+       }
+
+       return _netinfo->ulb_bw;
+}
+
+s32
+wl_cfg80211_set_ulb_bw(struct net_device *dev,
+       u32 ulb_bw,  char *ifname)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+       int ret;
+       int mode;
+       struct net_info *_netinfo = NULL, *iter, *next;
+       u32 bssidx;
+
+       if (!ifname)
+               return -EINVAL;
+
+       WL_DBG(("[ULB] Enter. bw_type:%d \n", ulb_bw));
+
+       ret = wldev_iovar_getint(dev, "ulb_mode", &mode);
+       if (unlikely(ret)) {
+               WL_ERR(("[ULB] ulb_mode not supported \n"));
+               return ret;
+       }
+
+       if (mode != ULB_MODE_STD_ALONE_MODE) {
+               WL_ERR(("[ULB] ulb bw modification allowed only in stand-alone mode\n"));
+               return -EINVAL;
+       }
+
+       if (ulb_bw >= MAX_SUPP_ULB_BW) {
+               WL_ERR(("[ULB] unsupported value (%d) for ulb_bw \n", ulb_bw));
+               return -EINVAL;
+       }
+
+#ifdef WL_CFG80211_P2P_DEV_IF
+       if (strcmp(ifname, "p2p-dev-wlan0") == 0) {
+               /* Use wdev corresponding to the dedicated p2p discovery interface */
+               if (likely(cfg->p2p_wdev)) {
+                       _netinfo = wl_get_netinfo_by_wdev(cfg, cfg->p2p_wdev);
+               } else {
+                       return -ENODEV;
+               }
+       }
+#endif /* WL_CFG80211_P2P_DEV_IF */
+       if (!_netinfo) {
+               for_each_ndev(cfg, iter, next) {
+                       if (iter->ndev) {
+                               if (strncmp(iter->ndev->name, ifname, strlen(ifname)) == 0) {
+                                       _netinfo = wl_get_netinfo_by_netdev(cfg, iter->ndev);
+                               }
+                       }
+               }
+       }
+
+       if (!_netinfo)
+               return -ENODEV;
+       bssidx = _netinfo->bssidx;
+       _netinfo->ulb_bw = ulb_bw;
+
+
+       WL_DBG(("[ULB] Applying ulb_bw:%d for bssidx:%d \n", ulb_bw, bssidx));
+       ret = wldev_iovar_setbuf_bsscfg(dev, "ulb_bw", (void *)&ulb_bw, 4,
+               cfg->ioctl_buf, WLC_IOCTL_SMLEN, bssidx,
+               &cfg->ioctl_buf_sync);
+       if (unlikely(ret)) {
+               WL_ERR(("[ULB] ulb_bw set failed. ret:%d \n", ret));
+               return ret;
+       }
+
+       return ret;
+}
+#endif /* WL11ULB */
+
+static void
+wl_ap_channel_ind(struct bcm_cfg80211 *cfg,
+       struct net_device *ndev,
+       chanspec_t chanspec)
+{
+       u32 channel = LCHSPEC_CHANNEL(chanspec);
+
+       WL_DBG(("(%s) AP channel:%d chspec:0x%x \n",
+               ndev->name, channel, chanspec));
+       if (cfg->ap_oper_channel && (cfg->ap_oper_channel != channel)) {
+               /*
+                * If cached channel is different from the channel indicated
+                * by the event, notify user space about the channel switch.
+                */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 5, 0))
+               wl_cfg80211_ch_switch_notify(ndev, chanspec, bcmcfg_to_wiphy(cfg));
+#endif /* LINUX_VERSION_CODE >= (3, 5, 0) */
+               cfg->ap_oper_channel = channel;
+       }
+}
+
+static s32
+wl_ap_start_ind(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+const wl_event_msg_t *e, void *data)
+{
+       struct net_device *ndev = NULL;
+       chanspec_t chanspec;
+
+       WL_DBG(("Enter\n"));
+       if (unlikely(e->status)) {
+               WL_ERR(("status:0x%x \n", e->status));
+               return -1;
+       }
+
+       if (!data) {
+               return -EINVAL;
+       }
+
+       if (likely(cfgdev)) {
+               ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+               chanspec = *((chanspec_t *)data);
+
+               if (wl_get_mode_by_netdev(cfg, ndev) == WL_MODE_AP) {
+                       /* For AP/GO role */
+                       wl_ap_channel_ind(cfg, ndev, chanspec);
+               }
+       }
+
+       return 0;
+}
+
+static s32
+wl_csa_complete_ind(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+const wl_event_msg_t *e, void *data)
+{
+       int error = 0;
+       u32 chanspec = 0;
+       struct net_device *ndev = NULL;
+
+       WL_DBG(("Enter\n"));
+       if (unlikely(e->status)) {
+               WL_ERR(("status:0x%x \n", e->status));
+               return -1;
+       }
+
+       if (likely(cfgdev)) {
+               ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+               error = wldev_iovar_getint(ndev, "chanspec", &chanspec);
+               if (unlikely(error)) {
+                       WL_ERR(("Get chanspec error: %d \n", error));
+                       return -1;
+               }
+
+               if (wl_get_mode_by_netdev(cfg, ndev) == WL_MODE_AP) {
+                       /* For AP/GO role */
+                       wl_ap_channel_ind(cfg, ndev, chanspec);
+               } else {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 5, 0))
+                       wl_cfg80211_ch_switch_notify(ndev, chanspec, bcmcfg_to_wiphy(cfg));
+#endif /* LINUX_VERSION_CODE >= (3, 5, 0) */
+               }
+
+       }
+
+       return 0;
+}
+
+#ifdef WL_NAN
+int
+wl_cfg80211_nan_cmd_handler(struct net_device *ndev, char *cmd, int cmd_len)
+{
+       return wl_cfgnan_cmd_handler(ndev, NETDEV_GET_CFG80211_PRIV(ndev), cmd, cmd_len);
+}
+#endif /* WL_NAN */
+
+void wl_cfg80211_clear_security(struct bcm_cfg80211 *cfg)
+{
+       struct net_device *dev = bcmcfg_to_prmry_ndev(cfg);
+       int err;
+
+       /* Clear the security settings on the primary Interface */
+       err = wldev_iovar_setint(dev, "wsec", 0);
+       if (unlikely(err)) {
+               WL_ERR(("wsec clear failed \n"));
+       }
+       err = wldev_iovar_setint(dev, "auth", 0);
+       if (unlikely(err)) {
+               WL_ERR(("auth clear failed \n"));
+       }
+       err = wldev_iovar_setint(dev, "wpa_auth", WPA_AUTH_DISABLED);
+       if (unlikely(err)) {
+               WL_ERR(("wpa_auth clear failed \n"));
+       }
+}
+
+#ifdef WL_CFG80211_P2P_DEV_IF
+void wl_cfg80211_del_p2p_wdev(void *cfg80211_priv)
+{
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)cfg80211_priv;
+       struct wireless_dev *wdev = NULL;
+
+       WL_DBG(("Enter \n"));
+       if (!cfg) {
+               WL_ERR(("Invalid Ptr\n"));
+               return;
+       } else {
+               wdev = cfg->p2p_wdev;
+       }
+
+       if (wdev && cfg->down_disc_if) {
+               wl_cfgp2p_del_p2p_disc_if(wdev, cfg);
+               cfg->down_disc_if = FALSE;
+       }
+}
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+#if defined(WL_SUPPORT_AUTO_CHANNEL)
+int
+wl_cfg80211_set_spect(struct net_device *dev, int spect)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+       int down = 1;
+       int up = 1;
+       int err = BCME_OK;
+
+       if (!wl_get_drv_status_all(cfg, CONNECTED)) {
+               err = wldev_ioctl(dev, WLC_DOWN, &down, sizeof(down), true);
+               if (err) {
+                       WL_ERR(("%s: WLC_DOWN failed: code: %d\n", __func__, err));
+                       return err;
+               }
+
+               err = wldev_ioctl(dev, WLC_SET_SPECT_MANAGMENT, &spect, sizeof(spect), true);
+               if (err) {
+                       WL_ERR(("%s: error setting spect: code: %d\n", __func__, err));
+                       return err;
+               }
+
+               err = wldev_ioctl(dev, WLC_UP, &up, sizeof(up), true);
+               if (err) {
+                       WL_ERR(("%s: WLC_UP failed: code: %d\n", __func__, err));
+                       return err;
+               }
+       }
+       return err;
+}
+
+int
+wl_cfg80211_get_sta_channel(struct net_device *dev)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+       int channel = 0;
+
+       if (wl_get_drv_status(cfg, CONNECTED, ndev)) {
+               channel = cfg->channel;
+       }
+       return channel;
+}
+#endif /* WL_SUPPORT_AUTO_CHANNEL */
+#ifdef P2P_LISTEN_OFFLOADING
+s32
+wl_cfg80211_p2plo_deinit(struct bcm_cfg80211 *cfg)
+{
+       s32 bssidx;
+       int ret = 0;
+       int p2plo_pause = 0;
+       if (!cfg || !cfg->p2p) {
+               WL_ERR(("Wl %p or cfg->p2p %p is null\n",
+                       cfg, cfg ? cfg->p2p : 0));
+               return 0;
+       }
+
+       bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+       ret = wldev_iovar_setbuf_bsscfg(bcmcfg_to_prmry_ndev(cfg),
+                       "p2po_stop", (void*)&p2plo_pause, sizeof(p2plo_pause),
+                       cfg->ioctl_buf, WLC_IOCTL_SMLEN, bssidx, NULL);
+       if (ret < 0) {
+               WL_ERR(("p2po_stop Failed :%d\n", ret));
+       }
+
+       return  ret;
+}
+s32
+wl_cfg80211_p2plo_listen_start(struct net_device *dev, u8 *buf,        int len)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+       s32 bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+       wl_p2plo_listen_t p2plo_listen;
+       int ret = -EAGAIN;
+       int channel = 0;
+       int period = 0;
+       int interval = 0;
+       int count = 0;
+
+       if (WL_DRV_STATUS_SENDING_AF_FRM_EXT(cfg)) {
+               WL_ERR(("Sending Action Frames. Try it again.\n"));
+               goto exit;
+       }
+
+       if (wl_get_drv_status_all(cfg, SCANNING)) {
+               WL_ERR(("Scanning already\n"));
+               goto exit;
+       }
+
+       if (wl_get_drv_status(cfg, SCAN_ABORTING, dev)) {
+               WL_ERR(("Scanning being aborted\n"));
+               goto exit;
+       }
+
+       if (wl_get_p2p_status(cfg, DISC_IN_PROGRESS)) {
+               WL_ERR(("p2p listen offloading already running\n"));
+               goto exit;
+       }
+
+       /* Just in case if it is not enabled */
+       if ((ret = wl_cfgp2p_enable_discovery(cfg, dev, NULL, 0)) < 0) {
+               WL_ERR(("cfgp2p_enable discovery failed"));
+               goto exit;
+       }
+
+       bzero(&p2plo_listen, sizeof(wl_p2plo_listen_t));
+
+       if (len) {
+               sscanf(buf, " %10d %10d %10d %10d", &channel, &period, &interval, &count);
+               if ((channel == 0) || (period == 0) ||
+                       (interval == 0) || (count == 0)) {
+                       WL_ERR(("Wrong argument %d/%d/%d/%d \n",
+                               channel, period, interval, count));
+                       ret = -EAGAIN;
+                       goto exit;
+               }
+               p2plo_listen.period = period;
+               p2plo_listen.interval = interval;
+               p2plo_listen.count = count;
+
+               WL_ERR(("channel:%d period:%d, interval:%d count:%d\n",
+                               channel, period, interval, count));
+       } else {
+               WL_ERR(("Argument len is wrong.\n"));
+               ret = -EAGAIN;
+               goto exit;
+       }
+
+       if ((ret = wldev_iovar_setbuf_bsscfg(dev, "p2po_listen_channel", (void*)&channel,
+                       sizeof(channel), cfg->ioctl_buf, WLC_IOCTL_SMLEN,
+                       bssidx, &cfg->ioctl_buf_sync)) < 0) {
+               WL_ERR(("p2po_listen_channel Failed :%d\n", ret));
+               goto exit;
+       }
+
+       if ((ret = wldev_iovar_setbuf_bsscfg(dev, "p2po_listen", (void*)&p2plo_listen,
+                       sizeof(wl_p2plo_listen_t), cfg->ioctl_buf, WLC_IOCTL_SMLEN,
+                       bssidx, &cfg->ioctl_buf_sync)) < 0) {
+               WL_ERR(("p2po_listen Failed :%d\n", ret));
+               goto exit;
+       }
+
+       wl_set_p2p_status(cfg, DISC_IN_PROGRESS);
+       cfg->last_roc_id = P2PO_COOKIE;
+exit :
+       return ret;
+}
+s32
+wl_cfg80211_p2plo_listen_stop(struct net_device *dev)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+       s32 bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+       int ret = -EAGAIN;
+
+       if ((ret = wldev_iovar_setbuf_bsscfg(dev, "p2po_stop", NULL,
+                       0, cfg->ioctl_buf, WLC_IOCTL_SMLEN,
+                       bssidx, &cfg->ioctl_buf_sync)) < 0) {
+               WL_ERR(("p2po_stop Failed :%d\n", ret));
+               goto exit;
+       }
+
+exit:
+       return ret;
+}
+#endif /* P2P_LISTEN_OFFLOADING */
+u64
+wl_cfg80211_get_new_roc_id(struct bcm_cfg80211 *cfg)
+{
+       u64 id = 0;
+       id = ++cfg->last_roc_id;
+#ifdef  P2P_LISTEN_OFFLOADING
+       if (id == P2PO_COOKIE) {
+               id = ++cfg->last_roc_id;
+       }
+#endif /* P2P_LISTEN_OFFLOADING */
+       if (id == 0)
+               id = ++cfg->last_roc_id;
+       return id;
+}
+
+#if defined(SUPPORT_RANDOM_MAC_SCAN)
+int
+wl_cfg80211_set_random_mac(struct net_device *dev, bool enable)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+       int ret;
+
+       if (cfg->random_mac_enabled == enable) {
+               WL_ERR(("Random MAC already %s\n", enable ? "Enabled" : "Disabled"));
+               return BCME_OK;
+       }
+
+       if (enable) {
+               ret = wl_cfg80211_random_mac_enable(dev);
+       } else {
+               ret = wl_cfg80211_random_mac_disable(dev);
+       }
+
+       if (!ret) {
+               cfg->random_mac_enabled = enable;
+       }
+
+       return ret;
+}
+
+int
+wl_cfg80211_random_mac_enable(struct net_device *dev)
+{
+       u8 current_mac[ETH_ALEN] = {0, };
+       s32 err = BCME_ERROR;
+       uint8 buffer[20] = {0, };
+       wl_scanmac_t *sm = NULL;
+       int len = 0;
+       wl_scanmac_enable_t *sm_enable = NULL;
+       wl_scanmac_config_t *sm_config = NULL;
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+
+       if (wl_get_drv_status_all(cfg, CONNECTED) || wl_get_drv_status_all(cfg, CONNECTING) ||
+           wl_get_drv_status_all(cfg, AP_CREATED) || wl_get_drv_status_all(cfg, AP_CREATING)) {
+               WL_ERR(("Fail to Set random mac, current state is wrong\n"));
+               return err;
+       }
+
+       /* Read current mac address */
+       err = wldev_iovar_getbuf_bsscfg(dev, "cur_etheraddr",
+               NULL, 0, cfg->ioctl_buf, WLC_IOCTL_SMLEN, 0, &cfg->ioctl_buf_sync);
+
+       if (err != BCME_OK) {
+               WL_ERR(("failed to get current dongle mac address\n"));
+               return err;
+       }
+
+       memcpy(current_mac, cfg->ioctl_buf, ETH_ALEN);
+
+       /* Enable scan mac */
+       sm = (wl_scanmac_t *)buffer;
+       sm_enable = (wl_scanmac_enable_t *)sm->data;
+       sm->len = sizeof(*sm_enable);
+       sm_enable->enable = 1;
+       len = OFFSETOF(wl_scanmac_t, data) + sm->len;
+       sm->subcmd_id = WL_SCANMAC_SUBCMD_ENABLE;
+
+       err = wldev_iovar_setbuf_bsscfg(dev, "scanmac",
+               sm, len, cfg->ioctl_buf, WLC_IOCTL_SMLEN, 0, &cfg->ioctl_buf_sync);
+
+       if (err != BCME_OK) {
+               WL_ERR(("failed to enable scanmac, err=%d\n", err));
+               return err;
+       }
+
+       /* Configure scanmac */
+       memset(buffer, 0x0, sizeof(buffer));
+       sm_config = (wl_scanmac_config_t *)sm->data;
+       sm->len = sizeof(*sm_config);
+       sm->subcmd_id = WL_SCANMAC_SUBCMD_CONFIG;
+       sm_config->scan_bitmap = WL_SCANMAC_SCAN_UNASSOC;
+
+       /* Set current mac address */
+       memcpy(&sm_config->mac.octet, current_mac, ETH_ALEN);
+       sm_config->mac.octet[3] = 0x0;
+       sm_config->mac.octet[4] = 0x0;
+       sm_config->mac.octet[5] = 0x0;
+
+       /* Set randomize mac address(last 3bytes) */
+       memset(&sm_config->random_mask.octet, 0x0, ETH_ALEN);
+       sm_config->random_mask.octet[3] = 0xff;
+       sm_config->random_mask.octet[4] = 0xff;
+       sm_config->random_mask.octet[5] = 0xff;
+
+       len = OFFSETOF(wl_scanmac_t, data) + sm->len;
+
+       err = wldev_iovar_setbuf_bsscfg(dev, "scanmac",
+               sm, len, cfg->ioctl_buf, WLC_IOCTL_SMLEN, 0, &cfg->ioctl_buf_sync);
+
+       if (err != BCME_OK) {
+               WL_ERR(("failed scanmac configuration\n"));
+
+               /* Disable scan mac for clean-up */
+               wl_cfg80211_random_mac_disable(dev);
+               return err;
+       }
+
+       WL_ERR(("random MAC enable done"));
+       return err;
+}
+
+int
+wl_cfg80211_random_mac_disable(struct net_device *dev)
+{
+       s32 err = BCME_ERROR;
+       uint8 buffer[20] = {0, };
+       wl_scanmac_t *sm = NULL;
+       int len = 0;
+       wl_scanmac_enable_t *sm_enable = NULL;
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+
+       sm = (wl_scanmac_t *)buffer;
+       sm_enable = (wl_scanmac_enable_t *)sm->data;
+       sm->len = sizeof(*sm_enable);
+       sm_enable->enable = 0;
+       len = OFFSETOF(wl_scanmac_t, data) + sm->len;
+
+       sm->subcmd_id = WL_SCANMAC_SUBCMD_ENABLE;
+
+       err = wldev_iovar_setbuf_bsscfg(dev, "scanmac",
+               sm, len, cfg->ioctl_buf, WLC_IOCTL_SMLEN, 0, &cfg->ioctl_buf_sync);
+
+       if (err != BCME_OK) {
+               WL_ERR(("failed to disable scanmac, err=%d\n", err));
+               return err;
+       }
+
+       WL_ERR(("random MAC disable done\n"));
+       return err;
+}
+#endif /* SUPPORT_RANDOM_MAC_SCAN */
+
+int
+wl_cfg80211_iface_count(struct net_device *dev)
+{
+       struct bcm_cfg80211 *cfg = NETDEV_GET_CFG80211_PRIV(dev);
+       struct net_info *iter, *next;
+       int iface_count = 0;
+
+       for_each_ndev(cfg, iter, next) {
+               if (iter->ndev) {
+                       iface_count++;
+               }
+       }
+       return iface_count;
+}
+
+#ifdef DHD_LOG_DUMP
+struct bcm_cfg80211*
+wl_get_bcm_cfg80211_ptr(void)
+{
+       /* TODO: dynamically turning-off this feature
+        * for dual-pcie support as g_bcm_cfg80211 dep is removed.
+        * Need to support LOG_DUMP independant of private cfg80211 or dhd_pub.
+        */
+       return NULL;
+}
+#endif /* DHD_LOG_DUMP */
+
+#define CHECK_DONGLE_IDLE_TIME 50
+#define CHECK_DONGLE_IDLE_CNT  100
+int
+wl_check_dongle_idle(struct wiphy *wiphy)
+{
+       int error = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct net_device *primary_ndev;
+       int retry = 0;
+       struct channel_info ci;
+       if (!cfg)
+               return FALSE;
+       /* Use primary I/F for sending cmds down to firmware */
+       primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+
+       while (retry++ < CHECK_DONGLE_IDLE_CNT) {
+               error = wldev_ioctl(primary_ndev, WLC_GET_CHANNEL, &ci, sizeof(ci), false);
+               if (error != BCME_OK || ci.scan_channel != 0) {
+                       if (error == -ENODEV) {
+                               WL_ERR(("Firmware is not ready, return TRUE\n"));
+                               return TRUE;
+                       }
+                       WL_ERR(("Firmware is busy(err:%d scan channel:%d). wait %dms\n",
+                               error, ci.scan_channel, CHECK_DONGLE_IDLE_TIME));
+               } else {
+                       break;
+               }
+               wl_delay(CHECK_DONGLE_IDLE_TIME);
+       }
+       if (retry >= CHECK_DONGLE_IDLE_CNT) {
+               WL_ERR(("DONGLE is BUSY too long\n"));
+               return FALSE;
+       }
+       WL_DBG(("DONGLE is idle\n"));
+       return TRUE;
+}
diff --git a/drivers/net/wireless/bcmdhd_1363/wl_cfg80211.h b/drivers/net/wireless/bcmdhd_1363/wl_cfg80211.h
new file mode 100644 (file)
index 0000000..c1b3274
--- /dev/null
@@ -0,0 +1,1572 @@
+/*
+ * Linux cfg80211 driver
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: wl_cfg80211.h 665052 2017-05-16 13:55:24Z $
+ */
+
+/**
+ * Older Linux versions support the 'iw' interface, more recent ones the 'cfg80211' interface.
+ */
+
+#ifndef _wl_cfg80211_h_
+#define _wl_cfg80211_h_
+
+#include <linux/wireless.h>
+#include <typedefs.h>
+#include <proto/ethernet.h>
+#include <wlioctl.h>
+#include <linux/wireless.h>
+#include <net/cfg80211.h>
+#include <linux/rfkill.h>
+
+#include <wl_cfgp2p.h>
+#include <linux/time.h>
+
+struct wl_conf;
+struct wl_iface;
+struct bcm_cfg80211;
+struct wl_security;
+struct wl_ibss;
+
+
+#define htod32(i) (i)
+#define htod16(i) (i)
+#define dtoh64(i) (i)
+#define dtoh32(i) (i)
+#define dtoh16(i) (i)
+#define htodchanspec(i) (i)
+#define dtohchanspec(i) (i)
+
+#define WL_DBG_NONE    0
+#define WL_DBG_P2P_ACTION (1 << 5)
+#define WL_DBG_TRACE   (1 << 4)
+#define WL_DBG_SCAN    (1 << 3)
+#define WL_DBG_DBG     (1 << 2)
+#define WL_DBG_INFO    (1 << 1)
+#define WL_DBG_ERR     (1 << 0)
+
+#ifdef DHD_LOG_DUMP
+extern void dhd_log_dump_print(const char *fmt, ...);
+extern char *dhd_log_dump_get_timestamp(void);
+struct bcm_cfg80211 *wl_get_bcm_cfg80211_ptr(void);
+#endif /* DHD_LOG_DUMP */
+
+/* 0 invalidates all debug messages.  default is 1 */
+#define WL_DBG_LEVEL 0xFF
+
+#ifdef CUSTOMER_HW4_DEBUG
+#define CFG80211_ERROR_TEXT            "CFG80211-INFO2) "
+#else
+#define CFG80211_ERROR_TEXT            "CFG80211-ERROR) "
+#endif /* CUSTOMER_HW4_DEBUG */
+
+#if defined(DHD_DEBUG)
+#ifdef DHD_LOG_DUMP
+#define        WL_ERR(args)    \
+do {   \
+       if (wl_dbg_level & WL_DBG_ERR) {        \
+               printk(KERN_INFO CFG80211_ERROR_TEXT "%s : ", __func__);        \
+               printk args;    \
+               dhd_log_dump_print("[%s] %s: ", dhd_log_dump_get_timestamp(), __func__);        \
+               dhd_log_dump_print args;        \
+       }       \
+} while (0)
+#else
+#define        WL_ERR(args)                                                                    \
+do {                                                                           \
+       if (wl_dbg_level & WL_DBG_ERR) {                                \
+                       printk(KERN_INFO CFG80211_ERROR_TEXT "%s : ", __func__);        \
+                       printk args;                                            \
+               }                                                               \
+} while (0)
+#endif /* DHD_LOG_DUMP */
+#else /* defined(DHD_DEBUG) */
+#define        WL_ERR(args)                                                                    \
+do {                                                                           \
+       if ((wl_dbg_level & WL_DBG_ERR) && net_ratelimit()) {                           \
+                       printk(KERN_INFO CFG80211_ERROR_TEXT "%s : ", __func__);        \
+                       printk args;                                            \
+               }                                                               \
+} while (0)
+#endif /* defined(DHD_DEBUG) */
+
+#ifdef WL_INFORM
+#undef WL_INFORM
+#endif
+
+#define        WL_INFORM(args)                                                                 \
+do {                                                                           \
+       if (wl_dbg_level & WL_DBG_INFO) {                               \
+                       printk(KERN_INFO "CFG80211-INFO) %s : ", __func__);     \
+                       printk args;                                            \
+               }                                                               \
+} while (0)
+
+
+#ifdef WL_SCAN
+#undef WL_SCAN
+#endif
+#define        WL_SCAN(args)                                                           \
+do {                                                                   \
+       if (wl_dbg_level & WL_DBG_SCAN) {                       \
+               printk(KERN_INFO "CFG80211-SCAN) %s :", __func__);      \
+               printk args;                                                    \
+       }                                                                       \
+} while (0)
+#ifdef WL_TRACE
+#undef WL_TRACE
+#endif
+#define        WL_TRACE(args)                                                          \
+do {                                                                   \
+       if (wl_dbg_level & WL_DBG_TRACE) {                      \
+               printk(KERN_INFO "CFG80211-TRACE) %s :", __func__);     \
+               printk args;                                                    \
+       }                                                                       \
+} while (0)
+#ifdef WL_TRACE_HW4
+#undef WL_TRACE_HW4
+#endif
+#ifdef CUSTOMER_HW4_DEBUG
+#define        WL_TRACE_HW4(args)                                      \
+do {                                                                           \
+       if (wl_dbg_level & WL_DBG_ERR) {                                \
+                       printk(KERN_INFO "CFG80211-TRACE) %s : ", __func__);    \
+                       printk args;                                            \
+               }                                                               \
+} while (0)
+#else
+#define        WL_TRACE_HW4                    WL_TRACE
+#endif /* CUSTOMER_HW4_DEBUG */
+#if (WL_DBG_LEVEL > 0)
+#define        WL_DBG(args)                                                            \
+do {                                                                   \
+       if (wl_dbg_level & WL_DBG_DBG) {                        \
+               printk(KERN_DEBUG "CFG80211-DEBUG) %s :", __func__);    \
+               printk args;                                                    \
+       }                                                                       \
+} while (0)
+#else                          /* !(WL_DBG_LEVEL > 0) */
+#define        WL_DBG(args)
+#endif                         /* (WL_DBG_LEVEL > 0) */
+#define WL_PNO(x)
+#define WL_SD(x)
+
+
+#define WL_SCAN_RETRY_MAX      3
+#define WL_NUM_PMKIDS_MAX      MAXPMKID
+#define WL_SCAN_BUF_MAX        (1024 * 8)
+#define WL_TLV_INFO_MAX        1500
+#define WL_SCAN_IE_LEN_MAX      2048
+#define WL_BSS_INFO_MAX                2048
+#define WL_ASSOC_INFO_MAX      512
+#define WL_IOCTL_LEN_MAX       2048
+#define WL_EXTRA_BUF_MAX       2048
+#define WL_SCAN_ERSULTS_LAST   (WL_SCAN_RESULTS_NO_MEM+1)
+#define WL_AP_MAX                      256
+#define WL_FILE_NAME_MAX       256
+#define WL_DWELL_TIME          200
+#define WL_MED_DWELL_TIME      400
+#define WL_MIN_DWELL_TIME      100
+#define WL_LONG_DWELL_TIME     1000
+#define IFACE_MAX_CNT  4
+#define WL_SCAN_CONNECT_DWELL_TIME_MS          200
+#define WL_SCAN_JOIN_PROBE_INTERVAL_MS         20
+#define WL_SCAN_JOIN_ACTIVE_DWELL_TIME_MS      320
+#define WL_SCAN_JOIN_PASSIVE_DWELL_TIME_MS     400
+#define WL_AF_TX_MAX_RETRY     5
+
+#define WL_AF_SEARCH_TIME_MAX          450
+#define WL_AF_TX_EXTRA_TIME_MAX                200
+
+#define WL_SCAN_TIMER_INTERVAL_MS      10000 /* Scan timeout */
+#define WL_CHANNEL_SYNC_RETRY  5
+#define WL_INVALID             -1
+
+#ifdef DHD_LOSSLESS_ROAMING
+#define WL_ROAM_TIMEOUT_MS     1000 /* Roam timeout */
+#endif
+/* Bring down SCB Timeout to 20secs from 60secs default */
+#ifndef WL_SCB_TIMEOUT
+#define WL_SCB_TIMEOUT 20
+#endif
+
+#ifndef WL_SCB_ACTIVITY_TIME
+#define WL_SCB_ACTIVITY_TIME   5
+#endif
+
+#ifndef WL_SCB_MAX_PROBE
+#define WL_SCB_MAX_PROBE       3
+#endif
+
+#ifndef WL_MIN_PSPRETEND_THRESHOLD
+#define WL_MIN_PSPRETEND_THRESHOLD     2
+#endif
+
+/* SCAN_SUPPRESS timer values in ms */
+#define WL_SCAN_SUPPRESS_TIMEOUT 31000 /* default Framwork DHCP timeout is 30 sec */
+#define WL_SCAN_SUPPRESS_RETRY 3000
+
+#define WL_PM_ENABLE_TIMEOUT 10000
+
+/* cfg80211 wowlan definitions */
+#define WL_WOWLAN_MAX_PATTERNS                 8
+#define WL_WOWLAN_MIN_PATTERN_LEN              1
+#define WL_WOWLAN_MAX_PATTERN_LEN              255
+#define WL_WOWLAN_PKT_FILTER_ID_FIRST  201
+#define WL_WOWLAN_PKT_FILTER_ID_LAST   (WL_WOWLAN_PKT_FILTER_ID_FIRST + \
+                                                                       WL_WOWLAN_MAX_PATTERNS - 1)
+
+#ifdef WLTDLS
+#define TDLS_TUNNELED_PRB_REQ  "\x7f\x50\x6f\x9a\04"
+#define TDLS_TUNNELED_PRB_RESP "\x7f\x50\x6f\x9a\05"
+#endif /* WLTDLS */
+
+
+/* driver status */
+enum wl_status {
+       WL_STATUS_READY = 0,
+       WL_STATUS_SCANNING,
+       WL_STATUS_SCAN_ABORTING,
+       WL_STATUS_CONNECTING,
+       WL_STATUS_CONNECTED,
+       WL_STATUS_DISCONNECTING,
+       WL_STATUS_AP_CREATING,
+       WL_STATUS_AP_CREATED,
+       /* whole sending action frame procedure:
+        * includes a) 'finding common channel' for public action request frame
+        * and b) 'sending af via 'actframe' iovar'
+        */
+       WL_STATUS_SENDING_ACT_FRM,
+       /* find a peer to go to a common channel before sending public action req frame */
+       WL_STATUS_FINDING_COMMON_CHANNEL,
+       /* waiting for next af to sync time of supplicant.
+        * it includes SENDING_ACT_FRM and WAITING_NEXT_ACT_FRM_LISTEN
+        */
+       WL_STATUS_WAITING_NEXT_ACT_FRM,
+#ifdef WL_CFG80211_SYNC_GON
+       /* go to listen state to wait for next af after SENDING_ACT_FRM */
+       WL_STATUS_WAITING_NEXT_ACT_FRM_LISTEN,
+#endif /* WL_CFG80211_SYNC_GON */
+       /* it will be set when upper layer requests listen and succeed in setting listen mode.
+        * if set, other scan request can abort current listen state
+        */
+       WL_STATUS_REMAINING_ON_CHANNEL,
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+       /* it's fake listen state to keep current scan state.
+        * it will be set when upper layer requests listen but scan is running. then just run
+        * a expire timer without actual listen state.
+        * if set, other scan request does not need to abort scan.
+        */
+       WL_STATUS_FAKE_REMAINING_ON_CHANNEL
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+};
+
+/* wi-fi mode */
+enum wl_mode {
+       WL_MODE_BSS,
+       WL_MODE_IBSS,
+       WL_MODE_AP
+};
+
+/* driver profile list */
+enum wl_prof_list {
+       WL_PROF_MODE,
+       WL_PROF_SSID,
+       WL_PROF_SEC,
+       WL_PROF_IBSS,
+       WL_PROF_BAND,
+       WL_PROF_CHAN,
+       WL_PROF_BSSID,
+       WL_PROF_ACT,
+       WL_PROF_BEACONINT,
+       WL_PROF_DTIMPERIOD
+};
+
+/* donlge escan state */
+enum wl_escan_state {
+       WL_ESCAN_STATE_IDLE,
+       WL_ESCAN_STATE_SCANING
+};
+/* fw downloading status */
+enum wl_fw_status {
+       WL_FW_LOADING_DONE,
+       WL_NVRAM_LOADING_DONE
+};
+
+enum wl_management_type {
+       WL_BEACON = 0x1,
+       WL_PROBE_RESP = 0x2,
+       WL_ASSOC_RESP = 0x4
+};
+
+enum wl_pm_workq_act_type {
+       WL_PM_WORKQ_SHORT,
+       WL_PM_WORKQ_LONG,
+       WL_PM_WORKQ_DEL
+};
+
+/* beacon / probe_response */
+struct beacon_proberesp {
+       __le64 timestamp;
+       __le16 beacon_int;
+       __le16 capab_info;
+       u8 variable[0];
+} __attribute__ ((packed));
+
+/* driver configuration */
+struct wl_conf {
+       u32 frag_threshold;
+       u32 rts_threshold;
+       u32 retry_short;
+       u32 retry_long;
+       s32 tx_power;
+       struct ieee80211_channel channel;
+};
+
+typedef s32(*EVENT_HANDLER) (struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+                            const wl_event_msg_t *e, void *data);
+
+/* bss inform structure for cfg80211 interface */
+struct wl_cfg80211_bss_info {
+       u16 band;
+       u16 channel;
+       s16 rssi;
+       u16 frame_len;
+       u8 frame_buf[1];
+};
+
+/* basic structure of scan request */
+struct wl_scan_req {
+       struct wlc_ssid ssid;
+};
+
+/* basic structure of information element */
+struct wl_ie {
+       u16 offset;
+       u8 buf[WL_TLV_INFO_MAX];
+};
+
+/* event queue for cfg80211 main event */
+struct wl_event_q {
+       struct list_head eq_list;
+       u32 etype;
+       wl_event_msg_t emsg;
+       s8 edata[1];
+};
+
+/* security information with currently associated ap */
+struct wl_security {
+       u32 wpa_versions;
+       u32 auth_type;
+       u32 cipher_pairwise;
+       u32 cipher_group;
+       u32 wpa_auth;
+       u32 auth_assoc_res_status;
+};
+
+/* ibss information for currently joined ibss network */
+struct wl_ibss {
+       u8 beacon_interval;     /* in millisecond */
+       u8 atim;                /* in millisecond */
+       s8 join_only;
+       u8 band;
+       u8 channel;
+};
+
+typedef struct wl_bss_vndr_ies {
+       u8  probe_req_ie[VNDR_IES_BUF_LEN];
+       u8  probe_res_ie[VNDR_IES_MAX_BUF_LEN];
+       u8  assoc_req_ie[VNDR_IES_BUF_LEN];
+       u8  assoc_res_ie[VNDR_IES_BUF_LEN];
+       u8  beacon_ie[VNDR_IES_MAX_BUF_LEN];
+       u32 probe_req_ie_len;
+       u32 probe_res_ie_len;
+       u32 assoc_req_ie_len;
+       u32 assoc_res_ie_len;
+       u32 beacon_ie_len;
+} wl_bss_vndr_ies_t;
+
+typedef struct wl_cfgbss {
+       u8 *wpa_ie;
+       u8 *rsn_ie;
+       u8 *wps_ie;
+       bool security_mode;
+       struct wl_bss_vndr_ies ies;     /* Common for STA, P2P GC, GO, AP, P2P Disc Interface */
+} wl_cfgbss_t;
+
+#ifdef WL11U
+/* Max length of Interworking element */
+#define IW_IES_MAX_BUF_LEN         9
+#endif
+
+/* cfg driver profile */
+struct wl_profile {
+       u32 mode;
+       s32 band;
+       u32 channel;
+       struct wlc_ssid ssid;
+       struct wl_security sec;
+       struct wl_ibss ibss;
+       u8 bssid[ETHER_ADDR_LEN];
+       u16 beacon_interval;
+       u8 dtim_period;
+       bool active;
+#ifdef SUPPORT_HIDDEN_AP
+       bool hidden_ssid;
+#endif /* SUPPORT_HIDDEN_AP */
+       u32 channel_width;
+#ifdef WL11U
+       u8 iw_ie[IW_IES_MAX_BUF_LEN];
+       u32 iw_ie_len;
+#endif /* WL11U */
+};
+
+struct net_info {
+       struct net_device *ndev;
+       struct wireless_dev *wdev;
+       struct wl_profile profile;
+       s32 mode;
+       s32 roam_off;
+       unsigned long sme_state;
+       bool pm_restore;
+       bool pm_block;
+       s32 pm;
+       s32 bssidx;
+       wl_cfgbss_t bss;
+       u32 ulb_bw;
+       struct list_head list; /* list of all net_info structure */
+};
+
+/* association inform */
+#define MAX_REQ_LINE 1024
+struct wl_connect_info {
+       u8 req_ie[MAX_REQ_LINE];
+       s32 req_ie_len;
+       u8 resp_ie[MAX_REQ_LINE];
+       s32 resp_ie_len;
+};
+
+/* firmware /nvram downloading controller */
+struct wl_fw_ctrl {
+       const struct firmware *fw_entry;
+       unsigned long status;
+       u32 ptr;
+       s8 fw_name[WL_FILE_NAME_MAX];
+       s8 nvram_name[WL_FILE_NAME_MAX];
+};
+
+/* assoc ie length */
+struct wl_assoc_ielen {
+       u32 req_len;
+       u32 resp_len;
+};
+
+/* wpa2 pmk list */
+struct wl_pmk_list {
+       pmkid_list_t pmkids;
+       pmkid_t foo[MAXPMKID - 1];
+};
+
+#ifdef DHD_MAX_IFS
+#define WL_MAX_IFS DHD_MAX_IFS
+#else
+#define WL_MAX_IFS 16
+#endif
+
+#define ESCAN_BUF_SIZE (64 * 1024)
+
+struct escan_info {
+       u32 escan_state;
+#if defined(STATIC_WL_PRIV_STRUCT)
+#ifndef CONFIG_DHD_USE_STATIC_BUF
+#error STATIC_WL_PRIV_STRUCT should be used with CONFIG_DHD_USE_STATIC_BUF
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+       u8 *escan_buf;
+#else
+       u8 escan_buf[ESCAN_BUF_SIZE];
+#endif /* STATIC_WL_PRIV_STRUCT */
+       struct wiphy *wiphy;
+       struct net_device *ndev;
+};
+
+#ifdef ESCAN_BUF_OVERFLOW_MGMT
+#define BUF_OVERFLOW_MGMT_COUNT 3
+typedef struct {
+       int RSSI;
+       int length;
+       struct ether_addr BSSID;
+} removal_element_t;
+#endif /* ESCAN_BUF_OVERFLOW_MGMT */
+
+struct afx_hdl {
+       wl_af_params_t *pending_tx_act_frm;
+       struct ether_addr       tx_dst_addr;
+       struct net_device *dev;
+       struct work_struct work;
+       s32 bssidx;
+       u32 retry;
+       s32 peer_chan;
+       s32 peer_listen_chan; /* search channel: configured by upper layer */
+       s32 my_listen_chan;     /* listen chanel: extract it from prb req or gon req */
+       bool is_listen;
+       bool ack_recv;
+       bool is_active;
+};
+
+struct parsed_ies {
+       wpa_ie_fixed_t *wps_ie;
+       u32 wps_ie_len;
+       wpa_ie_fixed_t *wpa_ie;
+       u32 wpa_ie_len;
+       bcm_tlv_t *wpa2_ie;
+       u32 wpa2_ie_len;
+};
+
+
+#ifdef P2P_LISTEN_OFFLOADING
+typedef struct {
+       uint16  period;                 /* listen offload period */
+       uint16  interval;               /* listen offload interval */
+       uint16  count;                  /* listen offload count */
+       uint16  pad;                    /* pad for 32bit align */
+} wl_p2plo_listen_t;
+#endif /* P2P_LISTEN_OFFLOADING */
+
+#define MAX_EVENT_BUF_NUM 16
+typedef struct wl_eventmsg_buf {
+       u16 num;
+       struct {
+               u16 type;
+               bool set;
+       } event [MAX_EVENT_BUF_NUM];
+} wl_eventmsg_buf_t;
+
+typedef struct wl_if_event_info {
+       bool valid;
+       int ifidx;
+       int bssidx;
+       uint8 mac[ETHER_ADDR_LEN];
+       char name[IFNAMSIZ+1];
+} wl_if_event_info;
+
+#if defined(DHD_ENABLE_BIGDATA_LOGGING)
+#define GET_BSS_INFO_LEN 90
+#endif /* DHD_ENABLE_BIGDATA_LOGGING */
+
+
+/* private data of cfg80211 interface */
+struct bcm_cfg80211 {
+       struct wireless_dev *wdev;      /* representing cfg cfg80211 device */
+
+       struct wireless_dev *p2p_wdev;  /* representing cfg cfg80211 device for P2P */
+       struct net_device *p2p_net;    /* reference to p2p0 interface */
+
+       struct wl_conf *conf;
+       struct cfg80211_scan_request *scan_request;     /* scan request object */
+       EVENT_HANDLER evt_handler[WLC_E_LAST];
+       struct list_head eq_list;       /* used for event queue */
+       struct list_head net_list;     /* used for struct net_info */
+       spinlock_t net_list_sync;       /* to protect scan status (and others if needed) */
+       spinlock_t eq_lock;     /* for event queue synchronization */
+       spinlock_t cfgdrv_lock; /* to protect scan status (and others if needed) */
+       struct completion act_frm_scan;
+       struct completion iface_disable;
+       struct completion wait_next_af;
+       struct mutex usr_sync;  /* maily for up/down synchronization */
+       struct mutex scan_complete;     /* serialize scan_complete call */
+       struct wl_scan_results *bss_list;
+       struct wl_scan_results *scan_results;
+
+       /* scan request object for internal purpose */
+       struct wl_scan_req *scan_req_int;
+       /* information element object for internal purpose */
+#if defined(STATIC_WL_PRIV_STRUCT)
+       struct wl_ie *ie;
+#else
+       struct wl_ie ie;
+#endif
+
+       /* association information container */
+#if defined(STATIC_WL_PRIV_STRUCT)
+       struct wl_connect_info *conn_info;
+#else
+       struct wl_connect_info conn_info;
+#endif
+#ifdef DEBUGFS_CFG80211
+       struct dentry           *debugfs;
+#endif /* DEBUGFS_CFG80211 */
+       struct wl_pmk_list *pmk_list;   /* wpa2 pmk list */
+       tsk_ctl_t event_tsk;            /* task of main event handler thread */
+       void *pub;
+       u32 iface_cnt;
+       u32 channel;            /* current channel */
+       u32 af_sent_channel;    /* channel action frame is sent */
+       /* next af subtype to cancel the remained dwell time in rx process */
+       u8 next_af_subtype;
+#ifdef WL_CFG80211_SYNC_GON
+       ulong af_tx_sent_jiffies;
+#endif /* WL_CFG80211_SYNC_GON */
+       struct escan_info escan_info;   /* escan information */
+       bool active_scan;       /* current scan mode */
+       bool ibss_starter;      /* indicates this sta is ibss starter */
+       bool link_up;           /* link/connection up flag */
+
+       /* indicate whether chip to support power save mode */
+       bool pwr_save;
+       bool roam_on;           /* on/off switch for self-roaming */
+       bool scan_tried;        /* indicates if first scan attempted */
+#if defined(BCMSDIO) || defined(BCMPCIE)
+       bool wlfc_on;
+#endif 
+       bool vsdb_mode;
+       bool roamoff_on_concurrent;
+       u8 *ioctl_buf;          /* ioctl buffer */
+       struct mutex ioctl_buf_sync;
+       u8 *escan_ioctl_buf;
+       u8 *extra_buf;  /* maily to grab assoc information */
+       struct dentry *debugfsdir;
+       struct rfkill *rfkill;
+       bool rf_blocked;
+       struct ieee80211_channel remain_on_chan;
+       enum nl80211_channel_type remain_on_chan_type;
+       u64 send_action_id;
+       u64 last_roc_id;
+       wait_queue_head_t netif_change_event;
+       wl_if_event_info if_event_info;
+       struct completion send_af_done;
+       struct afx_hdl *afx_hdl;
+       struct p2p_info *p2p;
+       bool p2p_supported;
+       void *btcoex_info;
+       struct timer_list scan_timeout;   /* Timer for catch scan event timeout */
+#if defined(P2P_IE_MISSING_FIX)
+       bool p2p_prb_noti;
+#endif
+       s32(*state_notifier) (struct bcm_cfg80211 *cfg,
+               struct net_info *_net_info, enum wl_status state, bool set);
+       unsigned long interrested_state;
+       wlc_ssid_t hostapd_ssid;
+       bool sched_scan_running;        /* scheduled scan req status */
+#ifdef WL_SCHED_SCAN
+       struct cfg80211_sched_scan_request *sched_scan_req;     /* scheduled scan req */
+#endif /* WL_SCHED_SCAN */
+       bool scan_suppressed;
+       struct timer_list scan_supp_timer;
+       struct work_struct wlan_work;
+       struct mutex event_sync;        /* maily for up/down synchronization */
+       bool disable_roam_event;
+       struct delayed_work pm_enable_work;
+       struct mutex pm_sync;   /* mainly for pm work synchronization */
+       struct workqueue_struct *event_workq;   /* workqueue for event */
+       struct work_struct event_work;          /* work item for event */
+
+       vndr_ie_setbuf_t *ibss_vsie;    /* keep the VSIE for IBSS */
+       int ibss_vsie_len;
+       u32 rmc_event_pid;
+       u32 rmc_event_seq;
+#ifdef WLAIBSS_MCHAN
+       struct ether_addr ibss_if_addr;
+       bcm_struct_cfgdev *ibss_cfgdev; /* For AIBSS */
+#endif /* WLAIBSS_MCHAN */
+       bool bss_pending_op;            /* indicate where there is a pending IF operation */
+       int roam_offload;
+#ifdef WL_NAN
+       bool nan_enable;
+       bool nan_running;
+#endif /* WL_NAN */
+#ifdef WL_CFG80211_P2P_DEV_IF
+       bool down_disc_if;
+#endif /* WL_CFG80211_P2P_DEV_IF */
+#ifdef P2PLISTEN_AP_SAMECHN
+       bool p2p_resp_apchn_status;
+#endif /* P2PLISTEN_AP_SAMECHN */
+       struct wl_wsec_key wep_key;
+#ifdef WLTDLS
+       u8 *tdls_mgmt_frame;
+       u32 tdls_mgmt_frame_len;
+       s32 tdls_mgmt_freq;
+#endif /* WLTDLS */
+       bool need_wait_afrx;
+#ifdef QOS_MAP_SET
+       uint8    *up_table;     /* user priority table, size is UP_TABLE_MAX */
+#endif /* QOS_MAP_SET */
+       struct ether_addr last_roamed_addr;
+#ifdef DHD_LOSSLESS_ROAMING
+       struct timer_list roam_timeout;   /* Timer for catch roam timeout */
+#endif
+       bool rcc_enabled;       /* flag for Roam channel cache feature */
+#if defined(DHD_ENABLE_BIGDATA_LOGGING)
+       char bss_info[GET_BSS_INFO_LEN];
+       wl_event_msg_t event_auth_assoc;
+       u32 assoc_reject_status;
+       u32 roam_count;
+#endif /* DHD_ENABLE_BIGDATA_LOGGING */
+       u16 ap_oper_channel;
+       bool revert_ndo_disable;
+#if defined(SUPPORT_RANDOM_MAC_SCAN)
+       bool random_mac_enabled;
+#endif /* SUPPORT_RANDOM_MAC_SCAN */
+#ifdef DHD_BANDSTEER
+       void *dhd_bandsteer_cntx;
+#endif /* DHD_BANDSTEER */
+};
+
+/* dual-pcie chip support */
+#define WDEV_GET_CFG80211_PRIV(wdev) ((struct bcm_cfg80211 *)wiphy_priv((wdev)->wiphy))
+#define NETDEV_GET_CFG80211_PRIV(net) ({ \
+                   struct wireless_dev *__wdev = (struct wireless_dev *)net->ieee80211_ptr; \
+                   WDEV_GET_CFG80211_PRIV(__wdev); })
+
+#if defined(STRICT_GCC_WARNINGS) && defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == \
+       4 && __GNUC_MINOR__ >= 6))
+
+#define BCM_LIST_FOR_EACH_ENTRY_SAFE(pos, next, head, member) \
+_Pragma("GCC diagnostic push") \
+_Pragma("GCC diagnostic ignored \"-Wcast-qual\"") \
+list_for_each_entry_safe((pos), (next), (head), member) \
+_Pragma("GCC diagnostic pop") \
+
+#else
+#define BCM_LIST_FOR_EACH_ENTRY_SAFE(pos, next, head, member) \
+list_for_each_entry_safe((pos), (next), (head), member) \
+
+#endif /* STRICT_GCC_WARNINGS */
+
+static inline struct wl_bss_info *next_bss(struct wl_scan_results *list, struct wl_bss_info *bss)
+{
+       return bss = bss ?
+               (struct wl_bss_info *)((uintptr) bss + dtoh32(bss->length)) : list->bss_info;
+}
+
+static inline void
+wl_probe_wdev_all(struct bcm_cfg80211 *cfg)
+{
+       struct net_info *_net_info, *next;
+       unsigned long int flags;
+       int idx = 0;
+       spin_lock_irqsave(&cfg->net_list_sync, flags);
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next,
+               &cfg->net_list, list) {
+               WL_ERR(("%s: net_list[%d] bssidx: %d, "
+                       "ndev: %p, wdev: %p \n", __FUNCTION__,
+                       idx++, _net_info->bssidx,
+                       _net_info->ndev, _net_info->wdev));
+       }
+       spin_unlock_irqrestore(&cfg->net_list_sync, flags);
+       return;
+}
+
+static inline struct net_info *
+wl_get_netinfo_by_bssidx(struct bcm_cfg80211 *cfg, s32 bssidx)
+{
+       struct net_info *_net_info, *next, *info = NULL;
+       unsigned long int flags;
+
+       spin_lock_irqsave(&cfg->net_list_sync, flags);
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               if ((bssidx >= 0) && (_net_info->bssidx == bssidx)) {
+                       info = _net_info;
+                       break;
+               }
+       }
+       spin_unlock_irqrestore(&cfg->net_list_sync, flags);
+       return info;
+}
+
+static inline void
+wl_dealloc_netinfo_by_wdev(struct bcm_cfg80211 *cfg, struct wireless_dev *wdev)
+{
+       struct net_info *_net_info, *next;
+       unsigned long int flags;
+
+#ifdef DHD_IFDEBUG
+       WL_ERR(("dealloc_netinfo enter wdev=%p \n", wdev));
+#endif
+       spin_lock_irqsave(&cfg->net_list_sync, flags);
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               if (wdev && (_net_info->wdev == wdev)) {
+                       wl_cfgbss_t *bss = &_net_info->bss;
+
+                       kfree(bss->wpa_ie);
+                       bss->wpa_ie = NULL;
+                       kfree(bss->rsn_ie);
+                       bss->rsn_ie = NULL;
+                       kfree(bss->wps_ie);
+                       bss->wps_ie = NULL;
+                       list_del(&_net_info->list);
+                       cfg->iface_cnt--;
+                       kfree(_net_info);
+               }
+       }
+       spin_unlock_irqrestore(&cfg->net_list_sync, flags);
+#ifdef DHD_IFDEBUG
+       WL_ERR(("dealloc_netinfo exit iface_cnt=%d \n", cfg->iface_cnt));
+#endif
+}
+
+static inline s32
+wl_alloc_netinfo(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       struct wireless_dev * wdev, s32 mode, bool pm_block, u8 bssidx)
+{
+       struct net_info *_net_info;
+       s32 err = 0;
+       unsigned long int flags;
+#ifdef DHD_IFDEBUG
+       WL_ERR(("alloc_netinfo enter bssidx=%d wdev=%p ndev=%p\n", bssidx, wdev, ndev));
+#endif
+       /* Check whether there is any duplicate entry for the
+        *  same bssidx *
+        */
+       if ((_net_info = wl_get_netinfo_by_bssidx(cfg, bssidx))) {
+               /* We have a duplicate entry for the same bssidx
+                * already present which shouldn't have been the case.
+                * Attempt recovery.
+                */
+               WL_ERR(("Duplicate entry for bssidx=%d present\n", bssidx));
+               wl_probe_wdev_all(cfg);
+#ifdef DHD_DEBUG
+               ASSERT(0);
+#endif /* DHD_DEBUG */
+               WL_ERR(("Removing the Dup entry for bssidx=%d \n", bssidx));
+               wl_dealloc_netinfo_by_wdev(cfg, _net_info->wdev);
+       }
+       if (cfg->iface_cnt == IFACE_MAX_CNT)
+               return -ENOMEM;
+       _net_info = kzalloc(sizeof(struct net_info), GFP_KERNEL);
+       if (!_net_info)
+               err = -ENOMEM;
+       else {
+               _net_info->mode = mode;
+               _net_info->ndev = ndev;
+               _net_info->wdev = wdev;
+               _net_info->pm_restore = 0;
+               _net_info->pm = 0;
+               _net_info->pm_block = pm_block;
+               _net_info->roam_off = WL_INVALID;
+               _net_info->bssidx = bssidx;
+               spin_lock_irqsave(&cfg->net_list_sync, flags);
+               cfg->iface_cnt++;
+               list_add(&_net_info->list, &cfg->net_list);
+               spin_unlock_irqrestore(&cfg->net_list_sync, flags);
+       }
+#ifdef DHD_IFDEBUG
+       WL_ERR(("alloc_netinfo exit iface_cnt=%d \n", cfg->iface_cnt));
+#endif
+       return err;
+}
+
+static inline void
+wl_delete_all_netinfo(struct bcm_cfg80211 *cfg)
+{
+       struct net_info *_net_info, *next;
+       unsigned long int flags;
+
+       spin_lock_irqsave(&cfg->net_list_sync, flags);
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               wl_cfgbss_t *bss = &_net_info->bss;
+
+               kfree(bss->wpa_ie);
+               bss->wpa_ie = NULL;
+               kfree(bss->rsn_ie);
+               bss->rsn_ie = NULL;
+               kfree(bss->wps_ie);
+               bss->wps_ie = NULL;
+               list_del(&_net_info->list);
+               if (_net_info->wdev)
+                       kfree(_net_info->wdev);
+               kfree(_net_info);
+       }
+       cfg->iface_cnt = 0;
+       spin_unlock_irqrestore(&cfg->net_list_sync, flags);
+}
+static inline u32
+wl_get_status_all(struct bcm_cfg80211 *cfg, s32 status)
+
+{
+       struct net_info *_net_info, *next;
+       u32 cnt = 0;
+       unsigned long int flags;
+
+       spin_lock_irqsave(&cfg->net_list_sync, flags);
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               if (_net_info->ndev &&
+                       test_bit(status, &_net_info->sme_state))
+                       cnt++;
+       }
+       spin_unlock_irqrestore(&cfg->net_list_sync, flags);
+       return cnt;
+}
+static inline void
+wl_set_status_all(struct bcm_cfg80211 *cfg, s32 status, u32 op)
+{
+       struct net_info *_net_info, *next;
+       unsigned long int flags;
+
+       spin_lock_irqsave(&cfg->net_list_sync, flags);
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               switch (op) {
+                       case 1:
+                               break; /* set all status is not allowed */
+                       case 2:
+                               /*
+                                * Release the spinlock before calling notifier. Else there
+                                * will be nested calls
+                                */
+                               spin_unlock_irqrestore(&cfg->net_list_sync, flags);
+                               clear_bit(status, &_net_info->sme_state);
+                               if (cfg->state_notifier &&
+                                       test_bit(status, &(cfg->interrested_state)))
+                                       cfg->state_notifier(cfg, _net_info, status, false);
+                               return;
+                       case 4:
+                               break; /* change all status is not allowed */
+                       default:
+                               break; /* unknown operation */
+               }
+       }
+       spin_unlock_irqrestore(&cfg->net_list_sync, flags);
+}
+static inline void
+wl_set_status_by_netdev(struct bcm_cfg80211 *cfg, s32 status,
+       struct net_device *ndev, u32 op)
+{
+
+       struct net_info *_net_info, *next;
+       unsigned long int flags;
+
+       spin_lock_irqsave(&cfg->net_list_sync, flags);
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               if (ndev && (_net_info->ndev == ndev)) {
+                       switch (op) {
+                               case 1:
+                                       /*
+                                        * Release the spinlock before calling notifier. Else there
+                                        * will be nested calls
+                                        */
+                                       spin_unlock_irqrestore(&cfg->net_list_sync, flags);
+                                       set_bit(status, &_net_info->sme_state);
+                                       if (cfg->state_notifier &&
+                                               test_bit(status, &(cfg->interrested_state)))
+                                               cfg->state_notifier(cfg, _net_info, status, true);
+                                       return;
+                               case 2:
+                                       /*
+                                        * Release the spinlock before calling notifier. Else there
+                                        * will be nested calls
+                                        */
+                                       spin_unlock_irqrestore(&cfg->net_list_sync, flags);
+                                       clear_bit(status, &_net_info->sme_state);
+                                       if (cfg->state_notifier &&
+                                               test_bit(status, &(cfg->interrested_state)))
+                                               cfg->state_notifier(cfg, _net_info, status, false);
+                                       return;
+                               case 4:
+                                       change_bit(status, &_net_info->sme_state);
+                                       break;
+                       }
+               }
+
+       }
+       spin_unlock_irqrestore(&cfg->net_list_sync, flags);
+
+}
+
+static inline wl_cfgbss_t *
+wl_get_cfgbss_by_wdev(struct bcm_cfg80211 *cfg,
+       struct wireless_dev *wdev)
+{
+       struct net_info *_net_info, *next;
+       wl_cfgbss_t *bss = NULL;
+       unsigned long int flags;
+
+       spin_lock_irqsave(&cfg->net_list_sync, flags);
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               if (wdev && (_net_info->wdev == wdev)) {
+                       bss = &_net_info->bss;
+                       break;
+               }
+       }
+
+       spin_unlock_irqrestore(&cfg->net_list_sync, flags);
+       return bss;
+}
+
+static inline u32
+wl_get_status_by_netdev(struct bcm_cfg80211 *cfg, s32 status,
+       struct net_device *ndev)
+{
+       struct net_info *_net_info, *next;
+       u32 stat = 0;
+       unsigned long int flags;
+
+       spin_lock_irqsave(&cfg->net_list_sync, flags);
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               if (ndev && (_net_info->ndev == ndev)) {
+                       stat = test_bit(status, &_net_info->sme_state);
+                       break;
+               }
+       }
+       spin_unlock_irqrestore(&cfg->net_list_sync, flags);
+       return stat;
+}
+
+static inline s32
+wl_get_mode_by_netdev(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+       struct net_info *_net_info, *next;
+       s32 mode = -1;
+       unsigned long int flags;
+
+       spin_lock_irqsave(&cfg->net_list_sync, flags);
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               if (ndev && (_net_info->ndev == ndev)) {
+                       mode = _net_info->mode;
+                       break;
+               }
+       }
+       spin_unlock_irqrestore(&cfg->net_list_sync, flags);
+       return mode;
+}
+
+static inline void
+wl_set_mode_by_netdev(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       s32 mode)
+{
+       struct net_info *_net_info, *next;
+       unsigned long int flags;
+
+       spin_lock_irqsave(&cfg->net_list_sync, flags);
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               if (ndev && (_net_info->ndev == ndev))
+                       _net_info->mode = mode;
+       }
+       spin_unlock_irqrestore(&cfg->net_list_sync, flags);
+}
+
+static inline s32
+wl_get_bssidx_by_wdev(struct bcm_cfg80211 *cfg, struct wireless_dev *wdev)
+{
+       struct net_info *_net_info, *next;
+       s32 bssidx = -1;
+       unsigned long int flags;
+
+       spin_lock_irqsave(&cfg->net_list_sync, flags);
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               if (_net_info->wdev && (_net_info->wdev == wdev)) {
+                       bssidx = _net_info->bssidx;
+                       break;
+               }
+       }
+       spin_unlock_irqrestore(&cfg->net_list_sync, flags);
+       return bssidx;
+}
+
+static inline struct wireless_dev *
+wl_get_wdev_by_bssidx(struct bcm_cfg80211 *cfg, s32 bssidx)
+{
+       struct net_info *_net_info, *next;
+       struct wireless_dev *wdev = NULL;
+       unsigned long int flags;
+
+       if (bssidx < 0)
+               return NULL;
+       spin_lock_irqsave(&cfg->net_list_sync, flags);
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               if (_net_info->bssidx == bssidx) {
+                               wdev = _net_info->wdev;
+                               break;
+               }
+       }
+       spin_unlock_irqrestore(&cfg->net_list_sync, flags);
+       return wdev;
+}
+
+static inline struct wl_profile *
+wl_get_profile_by_netdev(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+       struct net_info *_net_info, *next;
+       struct wl_profile *prof = NULL;
+       unsigned long int flags;
+
+       spin_lock_irqsave(&cfg->net_list_sync, flags);
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               if (ndev && (_net_info->ndev == ndev)) {
+                       prof = &_net_info->profile;
+                       break;
+               }
+       }
+       spin_unlock_irqrestore(&cfg->net_list_sync, flags);
+       return prof;
+}
+static inline struct net_info *
+wl_get_netinfo_by_netdev(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+       struct net_info *_net_info, *next, *info = NULL;
+       unsigned long int flags;
+
+       spin_lock_irqsave(&cfg->net_list_sync, flags);
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               if (ndev && (_net_info->ndev == ndev)) {
+                       info = _net_info;
+                       break;
+               }
+       }
+       spin_unlock_irqrestore(&cfg->net_list_sync, flags);
+       return info;
+}
+
+static inline struct net_info *
+wl_get_netinfo_by_wdev(struct bcm_cfg80211 *cfg, struct wireless_dev *wdev)
+{
+       struct net_info *_net_info, *next, *info = NULL;
+       unsigned long int flags;
+
+       spin_lock_irqsave(&cfg->net_list_sync, flags);
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               if (wdev && (_net_info->wdev == wdev)) {
+                       info = _net_info;
+                       break;
+               }
+       }
+       spin_unlock_irqrestore(&cfg->net_list_sync, flags);
+       return info;
+}
+
+static inline u32
+wl_get_chanwidth_by_netdev(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+       struct net_info *_net_info, *next;
+       unsigned long int flags;
+       u32 info = 0;
+
+       spin_lock_irqsave(&cfg->net_list_sync, flags);
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               if (ndev && (_net_info->ndev == ndev)) {
+                       info = _net_info->profile.channel_width;
+                       break;
+               }
+       }
+       spin_unlock_irqrestore(&cfg->net_list_sync, flags);
+       return info;
+}
+
+static inline void
+wl_set_chanwidth_by_netdev(struct bcm_cfg80211 *cfg, struct net_device *ndev, u32 chanwidth)
+{
+       struct net_info *_net_info, *next;
+       unsigned long int flags;
+
+       spin_lock_irqsave(&cfg->net_list_sync, flags);
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               if (ndev && (_net_info->ndev == ndev))
+                       _net_info->profile.channel_width = chanwidth;
+       }
+       spin_unlock_irqrestore(&cfg->net_list_sync, flags);
+}
+
+#ifdef WL11U
+static inline void
+wl_get_iwdata_by_netdev(struct bcm_cfg80211 *cfg, struct net_device *ndev, u8 *iw_ie,
+       u32 *iw_ie_len)
+{
+       struct net_info *_net_info, *next;
+       unsigned long int flags;
+
+       spin_lock_irqsave(&cfg->net_list_sync, flags);
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               if (ndev && (_net_info->ndev == ndev)) {
+                       *iw_ie_len = _net_info->profile.iw_ie_len;
+                       memcpy(iw_ie, _net_info->profile.iw_ie, _net_info->profile.iw_ie_len);
+                       break;
+               }
+       }
+       spin_unlock_irqrestore(&cfg->net_list_sync, flags);
+}
+
+static inline void
+wl_set_iwdata_by_netdev(struct bcm_cfg80211 *cfg, struct net_device *ndev, u8 *iw_ie, u32 iw_ie_len)
+{
+       struct net_info *_net_info, *next;
+       unsigned long int flags;
+
+       spin_lock_irqsave(&cfg->net_list_sync, flags);
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               if (ndev && (_net_info->ndev == ndev)) {
+                       _net_info->profile.iw_ie_len = iw_ie_len;
+                       memcpy(_net_info->profile.iw_ie, iw_ie, _net_info->profile.iw_ie_len);
+               }
+       }
+       spin_unlock_irqrestore(&cfg->net_list_sync, flags);
+}
+
+static inline void
+wl_clear_iwdata_by_netdev(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+       struct net_info *_net_info, *next;
+       unsigned long int flags;
+
+       spin_lock_irqsave(&cfg->net_list_sync, flags);
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next, &cfg->net_list, list) {
+               if (ndev && (_net_info->ndev == ndev)) {
+                       _net_info->profile.iw_ie_len = 0;
+                       memset(_net_info->profile.iw_ie, 0, IW_IES_MAX_BUF_LEN);
+               }
+       }
+       spin_unlock_irqrestore(&cfg->net_list_sync, flags);
+}
+
+static inline void
+wl_clear_iwdata(struct bcm_cfg80211 *cfg)
+{
+       struct net_info *_net_info, *next;
+       unsigned long int flags;
+       spin_lock_irqsave(&cfg->net_list_sync, flags);
+       BCM_LIST_FOR_EACH_ENTRY_SAFE(_net_info, next,
+               &cfg->net_list, list) {
+               if (_net_info->profile.iw_ie_len) {
+                       _net_info->profile.iw_ie_len = 0;
+                       memset(_net_info->profile.iw_ie, 0, IW_IES_MAX_BUF_LEN);
+               }
+       }
+       spin_unlock_irqrestore(&cfg->net_list_sync, flags);
+       return;
+}
+#endif /* WL11U */
+
+#define is_p2p_group_iface(wdev) (((wdev->iftype == NL80211_IFTYPE_P2P_GO) || \
+               (wdev->iftype == NL80211_IFTYPE_P2P_CLIENT)) ? 1 : 0)
+#define bcmcfg_to_wiphy(cfg) (cfg->wdev->wiphy)
+#define bcmcfg_to_prmry_ndev(cfg) (cfg->wdev->netdev)
+#define bcmcfg_to_prmry_wdev(cfg) (cfg->wdev)
+#define bcmcfg_to_p2p_wdev(cfg) (cfg->p2p_wdev)
+#define ndev_to_wl(n) (wdev_to_wl(n->ieee80211_ptr))
+#define ndev_to_wdev(ndev) (ndev->ieee80211_ptr)
+#define wdev_to_ndev(wdev) (wdev->netdev)
+
+#if defined(WL_ENABLE_P2P_IF)
+#define ndev_to_wlc_ndev(ndev, cfg)    ((ndev == cfg->p2p_net) ? \
+       bcmcfg_to_prmry_ndev(cfg) : ndev)
+#else
+#define ndev_to_wlc_ndev(ndev, cfg)    (ndev)
+#endif /* WL_ENABLE_P2P_IF */
+
+#define wdev_to_wlc_ndev(wdev, cfg)    \
+       (wdev_to_ndev(wdev) ? \
+       wdev_to_ndev(wdev) : bcmcfg_to_prmry_ndev(cfg))
+#if defined(WL_CFG80211_P2P_DEV_IF)
+#define cfgdev_to_wlc_ndev(cfgdev, cfg)        wdev_to_wlc_ndev(cfgdev, cfg)
+#define bcmcfg_to_prmry_cfgdev(cfgdev, cfg) bcmcfg_to_prmry_wdev(cfg)
+#elif defined(WL_ENABLE_P2P_IF)
+#define cfgdev_to_wlc_ndev(cfgdev, cfg)        ndev_to_wlc_ndev(cfgdev, cfg)
+#define bcmcfg_to_prmry_cfgdev(cfgdev, cfg) bcmcfg_to_prmry_ndev(cfg)
+#else
+#define cfgdev_to_wlc_ndev(cfgdev, cfg)        (cfgdev)
+#define bcmcfg_to_prmry_cfgdev(cfgdev, cfg) (cfgdev)
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+#define cfgdev_to_wdev(cfgdev) (cfgdev)
+#define ndev_to_cfgdev(ndev)   ndev_to_wdev(ndev)
+#define cfgdev_to_ndev(cfgdev) (cfgdev ? (cfgdev->netdev) : NULL)
+#define wdev_to_cfgdev(cfgdev) (cfgdev)
+#define discover_cfgdev(cfgdev, cfg) (cfgdev->iftype == NL80211_IFTYPE_P2P_DEVICE)
+#else
+#define cfgdev_to_wdev(cfgdev) (cfgdev->ieee80211_ptr)
+#define wdev_to_cfgdev(cfgdev) cfgdev ? (cfgdev->netdev) : NULL
+#define ndev_to_cfgdev(ndev)   (ndev)
+#define cfgdev_to_ndev(cfgdev) (cfgdev)
+#define discover_cfgdev(cfgdev, cfg) (cfgdev == cfg->p2p_net)
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+#define scan_req_match(cfg)    (((cfg) && (cfg->scan_request) && \
+       (cfg->scan_request->wdev == cfg->p2p_wdev)) ? true : false)
+#elif defined(WL_ENABLE_P2P_IF)
+#define scan_req_match(cfg)    (((cfg) && (cfg->scan_request) && \
+       (cfg->scan_request->dev == cfg->p2p_net)) ? true : false)
+#else
+#define scan_req_match(cfg)    (((cfg) && p2p_is_on(cfg) && p2p_scan(cfg)) ? \
+       true : false)
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
+#define scan_req_iftype(req) (req->dev->ieee80211_ptr->iftype)
+#else
+#define scan_req_iftype(req) (req->wdev->iftype)
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0))
+#define IEEE80211_BAND_2GHZ NL80211_BAND_2GHZ
+#define IEEE80211_BAND_5GHZ NL80211_BAND_5GHZ
+#define IEEE80211_NUM_BANDS NUM_NL80211_BANDS
+#endif
+
+#define wl_to_sr(w) (w->scan_req_int)
+#if defined(STATIC_WL_PRIV_STRUCT)
+#define wl_to_ie(w) (w->ie)
+#define wl_to_conn(w) (w->conn_info)
+#else
+#define wl_to_ie(w) (&w->ie)
+#define wl_to_conn(w) (&w->conn_info)
+#endif
+#define wiphy_from_scan(w) (w->escan_info.wiphy)
+#define wl_get_drv_status_all(cfg, stat) \
+       (wl_get_status_all(cfg, WL_STATUS_ ## stat))
+#define wl_get_drv_status(cfg, stat, ndev)  \
+       (wl_get_status_by_netdev(cfg, WL_STATUS_ ## stat, ndev))
+#define wl_set_drv_status(cfg, stat, ndev)  \
+       (wl_set_status_by_netdev(cfg, WL_STATUS_ ## stat, ndev, 1))
+#define wl_clr_drv_status(cfg, stat, ndev)  \
+       (wl_set_status_by_netdev(cfg, WL_STATUS_ ## stat, ndev, 2))
+#define wl_clr_drv_status_all(cfg, stat)  \
+       (wl_set_status_all(cfg, WL_STATUS_ ## stat, 2))
+#define wl_chg_drv_status(cfg, stat, ndev)  \
+       (wl_set_status_by_netdev(cfg, WL_STATUS_ ## stat, ndev, 4))
+
+#define for_each_bss(list, bss, __i)   \
+       for (__i = 0; __i < list->count && __i < WL_AP_MAX; __i++, bss = next_bss(list, bss))
+
+#define for_each_ndev(cfg, iter, next) \
+       list_for_each_entry_safe(iter, next, &cfg->net_list, list)
+
+/* In case of WPS from wpa_supplicant, pairwise siute and group suite is 0.
+ * In addtion to that, wpa_version is WPA_VERSION_1
+ */
+#define is_wps_conn(_sme) \
+       ((wl_cfgp2p_find_wpsie((u8 *)_sme->ie, _sme->ie_len) != NULL) && \
+        (!_sme->crypto.n_ciphers_pairwise) && \
+        (!_sme->crypto.cipher_group))
+
+#define IS_AKM_SUITE_FT(sec) ({BCM_REFERENCE(sec); FALSE;})
+
+#define IS_AKM_SUITE_CCKM(sec) ({BCM_REFERENCE(sec); FALSE;})
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 0, 0))
+#define STA_INFO_BIT(info) (1ul << NL80211_STA_ ## info)
+#define strnicmp(str1, str2, len) strncasecmp((str1), (str2), (len))
+#else
+#define STA_INFO_BIT(info) (STATION_ ## info)
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 0, 0)) */
+
+extern void *wl_cfg80211_attach(struct net_device *ndev, void *context);
+extern s32 wl_cfg80211_attach_post(struct net_device *ndev);
+extern void wl_cfg80211_detach(void *cfg80211_priv);
+
+extern void wl_cfg80211_event(struct net_device *ndev, const wl_event_msg_t *e,
+            void *data);
+void wl_cfg80211_set_parent_dev(void *dev);
+struct device *wl_cfg80211_get_parent_dev(void);
+
+/* clear IEs */
+extern s32 wl_cfg80211_clear_mgmt_vndr_ies(struct bcm_cfg80211 *cfg);
+extern s32 wl_cfg80211_clear_per_bss_ies(struct bcm_cfg80211 *cfg, s32 bssidx);
+
+extern s32 wl_cfg80211_up(void *para);
+extern s32 wl_cfg80211_down(void *para);
+extern s32 wl_cfg80211_notify_ifadd(void *cfg80211_priv, int ifidx, char *name,
+       uint8 *mac, uint8 bssidx);
+extern s32 wl_cfg80211_notify_ifdel(void *cfg80211_priv, int ifidx, char *name,
+       uint8 *mac, uint8 bssidx);
+extern s32 wl_cfg80211_notify_ifchange(void *cfg80211_priv, int ifidx, char *name,
+       uint8 *mac, uint8 bssidx);
+extern struct net_device* wl_cfg80211_allocate_if(struct bcm_cfg80211 *cfg, int ifidx, char *name,
+       uint8 *mac, uint8 bssidx, char *dngl_name);
+extern int wl_cfg80211_register_if(struct bcm_cfg80211 *cfg, int ifidx, struct net_device* ndev);
+extern int wl_cfg80211_remove_if(struct bcm_cfg80211 *cfg, int ifidx, struct net_device* ndev);
+extern int wl_cfg80211_scan_stop(bcm_struct_cfgdev *cfgdev);
+extern bool wl_cfg80211_is_concurrent_mode(struct bcm_cfg80211 *cfg);
+extern void *wl_cfg80211_get_dhdp(struct net_device *net);
+extern bool wl_cfg80211_is_p2p_active(struct wireless_dev *wdev);
+extern bool wl_cfg80211_is_roam_offload(struct bcm_cfg80211 *cfg);
+extern bool wl_cfg80211_is_event_from_connected_bssid(void *cfg80211_priv,
+       const wl_event_msg_t *e, int ifidx);
+extern void wl_cfg80211_dbg_level(u32 level);
+extern s32 wl_cfg80211_get_p2p_dev_addr(struct net_device *net, struct ether_addr *p2pdev_addr);
+extern s32 wl_cfg80211_set_p2p_noa(struct net_device *net, char* buf, int len);
+extern s32 wl_cfg80211_get_p2p_noa(struct net_device *net, char* buf, int len);
+extern s32 wl_cfg80211_set_wps_p2p_ie(struct net_device *net, char *buf, int len,
+       enum wl_management_type type);
+extern s32 wl_cfg80211_set_p2p_ps(struct net_device *net, char* buf, int len);
+extern s32 wl_cfg80211_set_p2p_ecsa(struct net_device *net, char* buf, int len);
+extern s32 wl_cfg80211_increase_p2p_bw(struct net_device *net, char* buf, int len);
+#ifdef WL11ULB
+extern s32 wl_cfg80211_set_ulb_mode(struct net_device *dev, int mode);
+extern s32 wl_cfg80211_set_ulb_bw(struct net_device *dev,
+       u32 ulb_bw,  char *ifname);
+#endif /* WL11ULB */
+#ifdef P2PLISTEN_AP_SAMECHN
+extern s32 wl_cfg80211_set_p2p_resp_ap_chn(struct net_device *net, s32 enable);
+#endif /* P2PLISTEN_AP_SAMECHN */
+
+/* btcoex functions */
+void* wl_cfg80211_btcoex_init(struct net_device *ndev);
+void wl_cfg80211_btcoex_deinit(void);
+
+#ifdef WL_SUPPORT_AUTO_CHANNEL
+#define CHANSPEC_BUF_SIZE      1024
+#define CHAN_SEL_IOCTL_DELAY   300
+#define CHAN_SEL_RETRY_COUNT   15
+#define CHANNEL_IS_RADAR(channel)      (((channel & WL_CHAN_RADAR) || \
+       (channel & WL_CHAN_PASSIVE)) ? true : false)
+#define CHANNEL_IS_2G(channel) (((channel >= 1) && (channel <= 14)) ? \
+       true : false)
+#define CHANNEL_IS_5G(channel) (((channel >= 36) && (channel <= 165)) ? \
+       true : false)
+extern s32 wl_cfg80211_get_best_channels(struct net_device *dev, char* command,
+       int total_len);
+#endif /* WL_SUPPORT_AUTO_CHANNEL */
+extern int wl_cfg80211_ether_atoe(const char *a, struct ether_addr *n);
+extern int wl_cfg80211_hang(struct net_device *dev, u16 reason);
+extern s32 wl_mode_to_nl80211_iftype(s32 mode);
+int wl_cfg80211_do_driver_init(struct net_device *net);
+void wl_cfg80211_enable_trace(bool set, u32 level);
+extern s32 wl_update_wiphybands(struct bcm_cfg80211 *cfg, bool notify, bool user_sync);
+extern s32 wl_cfg80211_if_is_group_owner(void);
+extern chanspec_t wl_chspec_host_to_driver(chanspec_t chanspec);
+extern chanspec_t wl_ch_host_to_driver(struct wireless_dev *wdev, s32 bssidx, u16 channel);
+extern s32 wl_set_tx_power(struct net_device *dev,
+       enum nl80211_tx_power_setting type, s32 dbm);
+extern s32 wl_get_tx_power(struct net_device *dev, s32 *dbm);
+extern s32 wl_add_remove_eventmsg(struct net_device *ndev, u16 event, bool add);
+extern void wl_stop_wait_next_action_frame(struct bcm_cfg80211 *cfg, struct net_device *ndev);
+extern void wl_cfg80211_add_to_eventbuffer(wl_eventmsg_buf_t *ev, u16 event, bool set);
+extern s32 wl_cfg80211_apply_eventbuffer(struct net_device *ndev,
+       struct bcm_cfg80211 *cfg, wl_eventmsg_buf_t *ev);
+extern void get_primary_mac(struct bcm_cfg80211 *cfg, struct ether_addr *mac);
+extern void wl_cfg80211_update_power_mode(struct net_device *dev);
+extern void wl_cfg80211_set_passive_scan(struct net_device *dev, char *command);
+extern void wl_terminate_event_handler(void *cfg80211_priv);
+#if defined(DHD_ENABLE_BIGDATA_LOGGING)
+extern s32 wl_cfg80211_get_bss_info(struct net_device *dev, char* cmd, int total_len);
+extern s32 wl_cfg80211_get_connect_failed_status(struct net_device *dev, char* cmd, int total_len);
+#endif /* DHD_ENABLE_BIGDATA_LOGGING */
+
+#define SCAN_BUF_CNT   2
+#define SCAN_BUF_NEXT  1
+#define WL_SCANTYPE_LEGACY     0x1
+#define WL_SCANTYPE_P2P                0x2
+#define wl_escan_set_sync_id(a, b) ((a) = htod16(0x1234))
+#define wl_escan_set_type(a, b)
+#define wl_escan_get_buf(a, b) ((wl_scan_results_t *) (a)->escan_info.escan_buf)
+#define wl_escan_check_sync_id(a, b, c) 0
+#define wl_escan_print_sync_id(a, b, c)
+#define wl_escan_increment_sync_id(a, b)
+#define wl_escan_init_sync_id(a)
+extern void wl_cfg80211_ibss_vsie_set_buffer(struct net_device *dev,
+       vndr_ie_setbuf_t *ibss_vsie, int ibss_vsie_len);
+extern s32 wl_cfg80211_ibss_vsie_delete(struct net_device *dev);
+extern void wl_cfg80211_set_rmc_pid(struct net_device *dev, int pid);
+extern int wl_cfg80211_set_mgmt_vndr_ies(struct bcm_cfg80211 *cfg,
+       bcm_struct_cfgdev *cfgdev, s32 bssidx, s32 pktflag,
+       const u8 *vndr_ie, u32 vndr_ie_len);
+
+
+/* Action frame specific functions */
+extern u8 wl_get_action_category(void *frame, u32 frame_len);
+extern int wl_get_public_action(void *frame, u32 frame_len, u8 *ret_action);
+
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+struct net_device *wl_cfg80211_get_remain_on_channel_ndev(struct bcm_cfg80211 *cfg);
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+
+#ifdef WL_SUPPORT_ACS
+#define ACS_MSRMNT_DELAY 1000 /* dump_obss delay in ms */
+#define IOCTL_RETRY_COUNT 5
+#define CHAN_NOISE_DUMMY -80
+#define OBSS_TOKEN_IDX 15
+#define IBSS_TOKEN_IDX 15
+#define TX_TOKEN_IDX 14
+#define CTG_TOKEN_IDX 13
+#define PKT_TOKEN_IDX 15
+#define IDLE_TOKEN_IDX 12
+#endif /* WL_SUPPORT_ACS */
+
+extern int wl_cfg80211_get_ioctl_version(void);
+extern int wl_cfg80211_enable_roam_offload(struct net_device *dev, int enable);
+extern s32 wl_cfg80211_dfs_ap_move(struct net_device *ndev, char *data,
+               char *command, int total_len);
+extern s32 wl_cfg80211_wbtext_config(struct net_device *ndev, char *data,
+               char *command, int total_len);
+extern int wl_cfg80211_wbtext_weight_config(struct net_device *ndev, char *data,
+               char *command, int total_len);
+extern int wl_cfg80211_wbtext_table_config(struct net_device *ndev, char *data,
+               char *command, int total_len);
+extern s32 wl_cfg80211_wbtext_delta_config(struct net_device *ndev, char *data,
+               char *command, int total_len);
+extern s32 wl_cfg80211_get_chanspecs_2g(struct net_device *ndev,
+               void *buf, s32 buflen);
+extern s32 wl_cfg80211_get_chanspecs_5g(struct net_device *ndev,
+               void *buf, s32 buflen);
+#if defined(WL_VIRTUAL_APSTA)
+extern int wl_cfg80211_interface_create(struct net_device *dev, char *name);
+extern int wl_cfg80211_interface_delete(struct net_device *dev, char *name);
+#if defined(PKT_FILTER_SUPPORT) && defined(APSTA_BLOCK_ARP_DURING_DHCP)
+extern void wl_cfg80211_block_arp(struct net_device *dev, int enable);
+#endif /* PKT_FILTER_SUPPORT && APSTA_BLOCK_ARP_DURING_DHCP */
+#endif /* defined (WL_VIRTUAL_APSTA) */
+
+#ifdef WL_NAN
+extern int wl_cfg80211_nan_cmd_handler(struct net_device *ndev, char *cmd,
+       int cmd_len);
+#endif /* WL_NAN */
+
+#ifdef WL_CFG80211_P2P_DEV_IF
+extern void wl_cfg80211_del_p2p_wdev(void *cfg80211_priv);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+#if defined(WL_SUPPORT_AUTO_CHANNEL)
+extern int wl_cfg80211_set_spect(struct net_device *dev, int spect);
+extern int wl_cfg80211_get_sta_channel(struct net_device *dev);
+#endif /* WL_SUPPORT_AUTO_CHANNEL */
+
+#ifdef P2P_LISTEN_OFFLOADING
+extern s32 wl_cfg80211_p2plo_listen_start(struct net_device *dev, u8 *buf, int len);
+extern s32 wl_cfg80211_p2plo_listen_stop(struct net_device *dev);
+#endif /* P2P_LISTEN_OFFLOADING */
+
+#define RETURN_EIO_IF_NOT_UP(wlpriv)                        \
+do {                                    \
+       struct net_device *checkSysUpNDev = bcmcfg_to_prmry_ndev(wlpriv);           \
+       if (unlikely(!wl_get_drv_status(wlpriv, READY, checkSysUpNDev))) {  \
+               WL_INFORM(("device is not ready\n"));           \
+               return -EIO;                        \
+       }                               \
+} while (0)
+
+#ifdef QOS_MAP_SET
+extern uint8 *wl_get_up_table(void *cfg80211_priv);
+#endif /* QOS_MAP_SET */
+
+#define P2PO_COOKIE     65535
+u64 wl_cfg80211_get_new_roc_id(struct bcm_cfg80211 *cfg);
+#if defined(SUPPORT_RANDOM_MAC_SCAN)
+int wl_cfg80211_set_random_mac(struct net_device *dev, bool enable);
+int wl_cfg80211_random_mac_enable(struct net_device *dev);
+int wl_cfg80211_random_mac_disable(struct net_device *dev);
+#endif /* SUPPORT_RANDOM_MAC_SCAN */
+int wl_cfg80211_iface_count(struct net_device *dev);
+int wl_check_dongle_idle(struct wiphy *wiphy);
+#endif /* _wl_cfg80211_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/wl_cfg_btcoex.c b/drivers/net/wireless/bcmdhd_1363/wl_cfg_btcoex.c
new file mode 100644 (file)
index 0000000..93aa29b
--- /dev/null
@@ -0,0 +1,564 @@
+/*
+ * Linux cfg80211 driver - Dongle Host Driver (DHD) related
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: wl_cfg_btcoex.c 638301 2016-05-17 09:06:40Z $
+ */
+
+#include <net/rtnetlink.h>
+
+#include <bcmutils.h>
+#include <wldev_common.h>
+#include <wl_cfg80211.h>
+#include <dhd_cfg80211.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhdioctl.h>
+#include <wlioctl.h>
+
+#ifdef PKT_FILTER_SUPPORT
+extern uint dhd_pkt_filter_enable;
+extern uint dhd_master_mode;
+extern void dhd_pktfilter_offload_enable(dhd_pub_t * dhd, char *arg, int enable, int master_mode);
+#endif
+
+struct btcoex_info {
+       struct timer_list timer;
+       u32 timer_ms;
+       u32 timer_on;
+       u32 ts_dhcp_start;      /* ms ts ecord time stats */
+       u32 ts_dhcp_ok;         /* ms ts ecord time stats */
+       bool dhcp_done; /* flag, indicates that host done with
+                                        * dhcp before t1/t2 expiration
+                                        */
+       s32 bt_state;
+       struct work_struct work;
+       struct net_device *dev;
+};
+
+static struct btcoex_info *btcoex_info_loc = NULL;
+
+/* TODO: clean up the BT-Coex code, it still have some legacy ioctl/iovar functions */
+
+/* use New SCO/eSCO smart YG suppression */
+#define BT_DHCP_eSCO_FIX
+/* this flag boost wifi pkt priority to max, caution: -not fair to sco */
+#define BT_DHCP_USE_FLAGS
+/* T1 start SCO/ESCo priority suppression */
+#define BT_DHCP_OPPR_WIN_TIME  2500
+/* T2 turn off SCO/SCO supperesion is (timeout) */
+#define BT_DHCP_FLAG_FORCE_TIME 5500
+
+enum wl_cfg80211_btcoex_status {
+       BT_DHCP_IDLE,
+       BT_DHCP_START,
+       BT_DHCP_OPPR_WIN,
+       BT_DHCP_FLAG_FORCE_TIMEOUT
+};
+
+/*
+ * get named driver variable to uint register value and return error indication
+ * calling example: dev_wlc_intvar_get_reg(dev, "btc_params",66, &reg_value)
+ */
+static int
+dev_wlc_intvar_get_reg(struct net_device *dev, char *name,
+       uint reg, int *retval)
+{
+       union {
+               char buf[WLC_IOCTL_SMLEN];
+               int val;
+       } var;
+       int error;
+
+       bcm_mkiovar(name, (char *)(&reg), sizeof(reg),
+               (char *)(&var), sizeof(var.buf));
+       error = wldev_ioctl(dev, WLC_GET_VAR, (char *)(&var), sizeof(var.buf), false);
+
+       *retval = dtoh32(var.val);
+       return (error);
+}
+
+static int
+dev_wlc_bufvar_set(struct net_device *dev, char *name, char *buf, int len)
+{
+       char ioctlbuf_local[WLC_IOCTL_SMLEN];
+
+       bcm_mkiovar(name, buf, len, ioctlbuf_local, sizeof(ioctlbuf_local));
+
+       return (wldev_ioctl(dev, WLC_SET_VAR, ioctlbuf_local, sizeof(ioctlbuf_local), true));
+}
+/*
+get named driver variable to uint register value and return error indication
+calling example: dev_wlc_intvar_set_reg(dev, "btc_params",66, value)
+*/
+static int
+dev_wlc_intvar_set_reg(struct net_device *dev, char *name, char *addr, char * val)
+{
+       char reg_addr[8];
+
+       memset(reg_addr, 0, sizeof(reg_addr));
+       memcpy((char *)&reg_addr[0], (char *)addr, 4);
+       memcpy((char *)&reg_addr[4], (char *)val, 4);
+
+       return (dev_wlc_bufvar_set(dev, name, (char *)&reg_addr[0], sizeof(reg_addr)));
+}
+
+static bool btcoex_is_sco_active(struct net_device *dev)
+{
+       int ioc_res = 0;
+       bool res = FALSE;
+       int sco_id_cnt = 0;
+       int param27;
+       int i;
+
+       for (i = 0; i < 12; i++) {
+
+               ioc_res = dev_wlc_intvar_get_reg(dev, "btc_params", 27, &param27);
+
+               WL_TRACE(("sample[%d], btc params: 27:%x\n", i, param27));
+
+               if (ioc_res < 0) {
+                       WL_ERR(("ioc read btc params error\n"));
+                       break;
+               }
+
+               if ((param27 & 0x6) == 2) { /* count both sco & esco  */
+                       sco_id_cnt++;
+               }
+
+               if (sco_id_cnt > 2) {
+                       WL_TRACE(("sco/esco detected, pkt id_cnt:%d  samples:%d\n",
+                               sco_id_cnt, i));
+                       res = TRUE;
+                       break;
+               }
+
+               OSL_SLEEP(5);
+       }
+
+       return res;
+}
+
+#if defined(BT_DHCP_eSCO_FIX)
+/* Enhanced BT COEX settings for eSCO compatibility during DHCP window */
+static int set_btc_esco_params(struct net_device *dev, bool trump_sco)
+{
+       static bool saved_status = FALSE;
+
+       char buf_reg50va_dhcp_on[8] =
+               { 50, 00, 00, 00, 0x22, 0x80, 0x00, 0x00 };
+       char buf_reg51va_dhcp_on[8] =
+               { 51, 00, 00, 00, 0x00, 0x00, 0x00, 0x00 };
+       char buf_reg64va_dhcp_on[8] =
+               { 64, 00, 00, 00, 0x00, 0x00, 0x00, 0x00 };
+       char buf_reg65va_dhcp_on[8] =
+               { 65, 00, 00, 00, 0x00, 0x00, 0x00, 0x00 };
+       char buf_reg71va_dhcp_on[8] =
+               { 71, 00, 00, 00, 0x00, 0x00, 0x00, 0x00 };
+       uint32 regaddr;
+       static uint32 saved_reg50;
+       static uint32 saved_reg51;
+       static uint32 saved_reg64;
+       static uint32 saved_reg65;
+       static uint32 saved_reg71;
+
+       if (trump_sco) {
+               /* this should reduce eSCO agressive retransmit
+                * w/o breaking it
+                */
+
+               /* 1st save current */
+               WL_TRACE(("Do new SCO/eSCO coex algo {save &"
+                         "override}\n"));
+               if ((!dev_wlc_intvar_get_reg(dev, "btc_params", 50, &saved_reg50)) &&
+                       (!dev_wlc_intvar_get_reg(dev, "btc_params", 51, &saved_reg51)) &&
+                       (!dev_wlc_intvar_get_reg(dev, "btc_params", 64, &saved_reg64)) &&
+                       (!dev_wlc_intvar_get_reg(dev, "btc_params", 65, &saved_reg65)) &&
+                       (!dev_wlc_intvar_get_reg(dev, "btc_params", 71, &saved_reg71))) {
+                       saved_status = TRUE;
+                       WL_TRACE(("saved bt_params[50,51,64,65,71]:"
+                                 "0x%x 0x%x 0x%x 0x%x 0x%x\n",
+                                 saved_reg50, saved_reg51,
+                                 saved_reg64, saved_reg65, saved_reg71));
+               } else {
+                       WL_ERR((":%s: save btc_params failed\n",
+                               __FUNCTION__));
+                       saved_status = FALSE;
+                       return -1;
+               }
+
+               WL_TRACE(("override with [50,51,64,65,71]:"
+                         "0x%x 0x%x 0x%x 0x%x 0x%x\n",
+                         *(u32 *)(buf_reg50va_dhcp_on+4),
+                         *(u32 *)(buf_reg51va_dhcp_on+4),
+                         *(u32 *)(buf_reg64va_dhcp_on+4),
+                         *(u32 *)(buf_reg65va_dhcp_on+4),
+                         *(u32 *)(buf_reg71va_dhcp_on+4)));
+
+               dev_wlc_bufvar_set(dev, "btc_params",
+                       (char *)&buf_reg50va_dhcp_on[0], 8);
+               dev_wlc_bufvar_set(dev, "btc_params",
+                       (char *)&buf_reg51va_dhcp_on[0], 8);
+               dev_wlc_bufvar_set(dev, "btc_params",
+                       (char *)&buf_reg64va_dhcp_on[0], 8);
+               dev_wlc_bufvar_set(dev, "btc_params",
+                       (char *)&buf_reg65va_dhcp_on[0], 8);
+               dev_wlc_bufvar_set(dev, "btc_params",
+                       (char *)&buf_reg71va_dhcp_on[0], 8);
+
+               saved_status = TRUE;
+       } else if (saved_status) {
+               /* restore previously saved bt params */
+               WL_TRACE(("Do new SCO/eSCO coex algo {save &"
+                         "override}\n"));
+
+               regaddr = 50;
+               dev_wlc_intvar_set_reg(dev, "btc_params",
+                       (char *)&regaddr, (char *)&saved_reg50);
+               regaddr = 51;
+               dev_wlc_intvar_set_reg(dev, "btc_params",
+                       (char *)&regaddr, (char *)&saved_reg51);
+               regaddr = 64;
+               dev_wlc_intvar_set_reg(dev, "btc_params",
+                       (char *)&regaddr, (char *)&saved_reg64);
+               regaddr = 65;
+               dev_wlc_intvar_set_reg(dev, "btc_params",
+                       (char *)&regaddr, (char *)&saved_reg65);
+               regaddr = 71;
+               dev_wlc_intvar_set_reg(dev, "btc_params",
+                       (char *)&regaddr, (char *)&saved_reg71);
+
+               WL_TRACE(("restore bt_params[50,51,64,65,71]:"
+                       "0x%x 0x%x 0x%x 0x%x 0x%x\n",
+                       saved_reg50, saved_reg51, saved_reg64,
+                       saved_reg65, saved_reg71));
+
+               saved_status = FALSE;
+       } else {
+               WL_ERR((":%s att to restore not saved BTCOEX params\n",
+                       __FUNCTION__));
+               return -1;
+       }
+       return 0;
+}
+#endif /* BT_DHCP_eSCO_FIX */
+
+static void
+wl_cfg80211_bt_setflag(struct net_device *dev, bool set)
+{
+#if defined(BT_DHCP_USE_FLAGS)
+       char buf_flag7_dhcp_on[8] = { 7, 00, 00, 00, 0x1, 0x0, 0x00, 0x00 };
+       char buf_flag7_default[8]   = { 7, 00, 00, 00, 0x0, 0x00, 0x00, 0x00};
+#endif
+
+
+#if defined(BT_DHCP_eSCO_FIX)
+       /* set = 1, save & turn on  0 - off & restore prev settings */
+       set_btc_esco_params(dev, set);
+#endif
+
+#if defined(BT_DHCP_USE_FLAGS)
+       WL_TRACE(("WI-FI priority boost via bt flags, set:%d\n", set));
+       if (set == TRUE)
+               /* Forcing bt_flag7  */
+               dev_wlc_bufvar_set(dev, "btc_flags",
+                       (char *)&buf_flag7_dhcp_on[0],
+                       sizeof(buf_flag7_dhcp_on));
+       else
+               /* Restoring default bt flag7 */
+               dev_wlc_bufvar_set(dev, "btc_flags",
+                       (char *)&buf_flag7_default[0],
+                       sizeof(buf_flag7_default));
+#endif
+}
+
+static void wl_cfg80211_bt_timerfunc(ulong data)
+{
+       struct btcoex_info *bt_local = (struct btcoex_info *)data;
+       WL_TRACE(("Enter\n"));
+       bt_local->timer_on = 0;
+       schedule_work(&bt_local->work);
+}
+
+static void wl_cfg80211_bt_handler(struct work_struct *work)
+{
+       struct btcoex_info *btcx_inf;
+
+       btcx_inf = container_of(work, struct btcoex_info, work);
+
+       if (btcx_inf->timer_on) {
+               btcx_inf->timer_on = 0;
+               del_timer_sync(&btcx_inf->timer);
+       }
+
+       switch (btcx_inf->bt_state) {
+               case BT_DHCP_START:
+                       /* DHCP started
+                        * provide OPPORTUNITY window to get DHCP address
+                        */
+                       WL_TRACE(("bt_dhcp stm: started \n"));
+
+                       btcx_inf->bt_state = BT_DHCP_OPPR_WIN;
+                       mod_timer(&btcx_inf->timer,
+                               jiffies + msecs_to_jiffies(BT_DHCP_OPPR_WIN_TIME));
+                       btcx_inf->timer_on = 1;
+                       break;
+
+               case BT_DHCP_OPPR_WIN:
+                       if (btcx_inf->dhcp_done) {
+                               WL_TRACE(("DHCP Done before T1 expiration\n"));
+                               goto btc_coex_idle;
+                       }
+
+                       /* DHCP is not over yet, start lowering BT priority
+                        * enforce btc_params + flags if necessary
+                        */
+                       WL_TRACE(("DHCP T1:%d expired\n", BT_DHCP_OPPR_WIN_TIME));
+                       if (btcx_inf->dev)
+                               wl_cfg80211_bt_setflag(btcx_inf->dev, TRUE);
+                       btcx_inf->bt_state = BT_DHCP_FLAG_FORCE_TIMEOUT;
+                       mod_timer(&btcx_inf->timer,
+                               jiffies + msecs_to_jiffies(BT_DHCP_FLAG_FORCE_TIME));
+                       btcx_inf->timer_on = 1;
+                       break;
+
+               case BT_DHCP_FLAG_FORCE_TIMEOUT:
+                       if (btcx_inf->dhcp_done) {
+                               WL_TRACE(("DHCP Done before T2 expiration\n"));
+                       } else {
+                               /* Noo dhcp during T1+T2, restore BT priority */
+                               WL_TRACE(("DHCP wait interval T2:%d msec expired\n",
+                                       BT_DHCP_FLAG_FORCE_TIME));
+                       }
+
+                       /* Restoring default bt priority */
+                       if (btcx_inf->dev)
+                               wl_cfg80211_bt_setflag(btcx_inf->dev, FALSE);
+btc_coex_idle:
+                       btcx_inf->bt_state = BT_DHCP_IDLE;
+                       btcx_inf->timer_on = 0;
+                       break;
+
+               default:
+                       WL_ERR(("error g_status=%d !!!\n",      btcx_inf->bt_state));
+                       if (btcx_inf->dev)
+                               wl_cfg80211_bt_setflag(btcx_inf->dev, FALSE);
+                       btcx_inf->bt_state = BT_DHCP_IDLE;
+                       btcx_inf->timer_on = 0;
+                       break;
+       }
+
+       net_os_wake_unlock(btcx_inf->dev);
+}
+
+void* wl_cfg80211_btcoex_init(struct net_device *ndev)
+{
+       struct btcoex_info *btco_inf = NULL;
+
+       btco_inf = kmalloc(sizeof(struct btcoex_info), GFP_KERNEL);
+       if (!btco_inf)
+               return NULL;
+
+       btco_inf->bt_state = BT_DHCP_IDLE;
+       btco_inf->ts_dhcp_start = 0;
+       btco_inf->ts_dhcp_ok = 0;
+       /* Set up timer for BT  */
+       btco_inf->timer_ms = 10;
+       init_timer(&btco_inf->timer);
+       btco_inf->timer.data = (ulong)btco_inf;
+       btco_inf->timer.function = wl_cfg80211_bt_timerfunc;
+
+       btco_inf->dev = ndev;
+
+       INIT_WORK(&btco_inf->work, wl_cfg80211_bt_handler);
+
+       btcoex_info_loc = btco_inf;
+       return btco_inf;
+}
+
+void wl_cfg80211_btcoex_deinit()
+{
+       if (!btcoex_info_loc)
+               return;
+
+       if (btcoex_info_loc->timer_on) {
+               btcoex_info_loc->timer_on = 0;
+               del_timer_sync(&btcoex_info_loc->timer);
+       }
+
+       cancel_work_sync(&btcoex_info_loc->work);
+
+       kfree(btcoex_info_loc);
+}
+
+int wl_cfg80211_set_btcoex_dhcp(struct net_device *dev, dhd_pub_t *dhd, char *command)
+{
+
+       struct btcoex_info *btco_inf = btcoex_info_loc;
+       char powermode_val = 0;
+       char buf_reg66va_dhcp_on[8] = { 66, 00, 00, 00, 0x10, 0x27, 0x00, 0x00 };
+       char buf_reg41va_dhcp_on[8] = { 41, 00, 00, 00, 0x33, 0x00, 0x00, 0x00 };
+       char buf_reg68va_dhcp_on[8] = { 68, 00, 00, 00, 0x90, 0x01, 0x00, 0x00 };
+
+       uint32 regaddr;
+       static uint32 saved_reg66;
+       static uint32 saved_reg41;
+       static uint32 saved_reg68;
+       static bool saved_status = FALSE;
+
+       char buf_flag7_default[8] =   { 7, 00, 00, 00, 0x0, 0x00, 0x00, 0x00};
+
+       /* Figure out powermode 1 or o command */
+       strncpy((char *)&powermode_val, command + strlen("BTCOEXMODE") +1, 1);
+
+       if (strnicmp((char *)&powermode_val, "1", strlen("1")) == 0) {
+               WL_TRACE_HW4(("DHCP session starts\n"));
+
+
+#ifdef PKT_FILTER_SUPPORT
+               dhd->dhcp_in_progress = 1;
+
+#if defined(WL_VIRTUAL_APSTA) && defined(APSTA_BLOCK_ARP_DURING_DHCP)
+               if ((dhd->op_mode & DHD_FLAG_CONCURR_STA_HOSTAP_MODE) ==
+                       DHD_FLAG_CONCURR_STA_HOSTAP_MODE) {
+                       /* Block ARP frames while DHCP of STA interface is in
+                        * progress in case of STA/SoftAP concurrent mode
+                        */
+                       wl_cfg80211_block_arp(dev, TRUE);
+               } else
+#endif /* WL_VIRTUAL_APSTA && APSTA_BLOCK_ARP_DURING_DHCP */
+               if (dhd->early_suspended) {
+                       WL_TRACE_HW4(("DHCP in progressing , disable packet filter!!!\n"));
+                       dhd_enable_packet_filter(0, dhd);
+               }
+#endif /* PKT_FILTER_SUPPORT */
+
+               /* Retrieve and saved orig regs value */
+               if ((saved_status == FALSE) &&
+                       (!dev_wlc_intvar_get_reg(dev, "btc_params", 66,  &saved_reg66)) &&
+                       (!dev_wlc_intvar_get_reg(dev, "btc_params", 41,  &saved_reg41)) &&
+                       (!dev_wlc_intvar_get_reg(dev, "btc_params", 68,  &saved_reg68)))   {
+                               saved_status = TRUE;
+                               WL_TRACE(("Saved 0x%x 0x%x 0x%x\n",
+                                       saved_reg66, saved_reg41, saved_reg68));
+
+                               /* Disable PM mode during dhpc session */
+
+                               /* Disable PM mode during dhpc session */
+                               /* Start  BT timer only for SCO connection */
+                               if (btcoex_is_sco_active(dev)) {
+                                       /* btc_params 66 */
+                                       dev_wlc_bufvar_set(dev, "btc_params",
+                                               (char *)&buf_reg66va_dhcp_on[0],
+                                               sizeof(buf_reg66va_dhcp_on));
+                                       /* btc_params 41 0x33 */
+                                       dev_wlc_bufvar_set(dev, "btc_params",
+                                               (char *)&buf_reg41va_dhcp_on[0],
+                                               sizeof(buf_reg41va_dhcp_on));
+                                       /* btc_params 68 0x190 */
+                                       dev_wlc_bufvar_set(dev, "btc_params",
+                                               (char *)&buf_reg68va_dhcp_on[0],
+                                               sizeof(buf_reg68va_dhcp_on));
+                                       saved_status = TRUE;
+
+                                       btco_inf->bt_state = BT_DHCP_START;
+                                       btco_inf->timer_on = 1;
+                                       mod_timer(&btco_inf->timer, btco_inf->timer.expires);
+                                       WL_TRACE(("enable BT DHCP Timer\n"));
+                               }
+               }
+               else if (saved_status == TRUE) {
+                       WL_ERR(("was called w/o DHCP OFF. Continue\n"));
+               }
+       }
+       else if (strnicmp((char *)&powermode_val, "2", strlen("2")) == 0) {
+
+
+
+#ifdef PKT_FILTER_SUPPORT
+               dhd->dhcp_in_progress = 0;
+               WL_TRACE_HW4(("DHCP is complete \n"));
+
+#if defined(WL_VIRTUAL_APSTA) && defined(APSTA_BLOCK_ARP_DURING_DHCP)
+               if ((dhd->op_mode & DHD_FLAG_CONCURR_STA_HOSTAP_MODE) ==
+                       DHD_FLAG_CONCURR_STA_HOSTAP_MODE) {
+                       /* Unblock ARP frames */
+                       wl_cfg80211_block_arp(dev, FALSE);
+               } else
+#endif /* WL_VIRTUAL_APSTA && APSTA_BLOCK_ARP_DURING_DHCP */
+               if (dhd->early_suspended) {
+                       /* Enable packet filtering */
+                       WL_TRACE_HW4(("DHCP is complete , enable packet filter!!!\n"));
+                       dhd_enable_packet_filter(1, dhd);
+               }
+#endif /* PKT_FILTER_SUPPORT */
+
+               /* Restoring PM mode */
+
+               /* Stop any bt timer because DHCP session is done */
+               WL_TRACE(("disable BT DHCP Timer\n"));
+               if (btco_inf->timer_on) {
+                       btco_inf->timer_on = 0;
+                       del_timer_sync(&btco_inf->timer);
+
+                       if (btco_inf->bt_state != BT_DHCP_IDLE) {
+                       /* need to restore original btc flags & extra btc params */
+                               WL_TRACE(("bt->bt_state:%d\n", btco_inf->bt_state));
+                               /* wake up btcoex thread to restore btlags+params  */
+                               schedule_work(&btco_inf->work);
+                       }
+               }
+
+               /* Restoring btc_flag paramter anyway */
+               if (saved_status == TRUE)
+                       dev_wlc_bufvar_set(dev, "btc_flags",
+                               (char *)&buf_flag7_default[0], sizeof(buf_flag7_default));
+
+               /* Restore original values */
+               if (saved_status == TRUE) {
+                       regaddr = 66;
+                       dev_wlc_intvar_set_reg(dev, "btc_params",
+                               (char *)&regaddr, (char *)&saved_reg66);
+                       regaddr = 41;
+                       dev_wlc_intvar_set_reg(dev, "btc_params",
+                               (char *)&regaddr, (char *)&saved_reg41);
+                       regaddr = 68;
+                       dev_wlc_intvar_set_reg(dev, "btc_params",
+                               (char *)&regaddr, (char *)&saved_reg68);
+
+                       WL_TRACE(("restore regs {66,41,68} <- 0x%x 0x%x 0x%x\n",
+                               saved_reg66, saved_reg41, saved_reg68));
+               }
+               saved_status = FALSE;
+
+       }
+       else {
+               WL_ERR(("Unkwown yet power setting, ignored\n"));
+       }
+
+       snprintf(command, 3, "OK");
+
+       return (strlen("OK"));
+}
diff --git a/drivers/net/wireless/bcmdhd_1363/wl_cfgp2p.c b/drivers/net/wireless/bcmdhd_1363/wl_cfgp2p.c
new file mode 100644 (file)
index 0000000..604ca1e
--- /dev/null
@@ -0,0 +1,2614 @@
+/*
+ * Linux cfgp2p driver
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: wl_cfgp2p.c 653898 2016-08-10 07:50:39Z $
+ *
+ */
+#include <typedefs.h>
+#include <linuxver.h>
+#include <osl.h>
+#include <linux/kernel.h>
+#include <linux/kthread.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/types.h>
+#include <linux/string.h>
+#include <linux/timer.h>
+#include <linux/if_arp.h>
+#include <asm/uaccess.h>
+
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <proto/ethernet.h>
+#include <proto/802.11.h>
+#include <net/rtnetlink.h>
+
+#include <wl_cfg80211.h>
+#include <wl_cfgp2p.h>
+#include <wldev_common.h>
+#include <wl_android.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_linux.h>
+#include <dhdioctl.h>
+#include <wlioctl.h>
+#include <dhd_cfg80211.h>
+
+static s8 scanparambuf[WLC_IOCTL_SMLEN];
+static bool
+wl_cfgp2p_has_ie(u8 *ie, u8 **tlvs, u32 *tlvs_len, const u8 *oui, u32 oui_len, u8 type);
+
+static s32 wl_cfgp2p_cancel_listen(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       struct wireless_dev *wdev, bool notify);
+
+#if defined(WL_ENABLE_P2P_IF)
+static int wl_cfgp2p_start_xmit(struct sk_buff *skb, struct net_device *ndev);
+static int wl_cfgp2p_do_ioctl(struct net_device *net, struct ifreq *ifr, int cmd);
+static int wl_cfgp2p_if_open(struct net_device *net);
+static int wl_cfgp2p_if_stop(struct net_device *net);
+
+static const struct net_device_ops wl_cfgp2p_if_ops = {
+       .ndo_open       = wl_cfgp2p_if_open,
+       .ndo_stop       = wl_cfgp2p_if_stop,
+       .ndo_do_ioctl   = wl_cfgp2p_do_ioctl,
+       .ndo_start_xmit = wl_cfgp2p_start_xmit,
+};
+#endif /* WL_ENABLE_P2P_IF */
+
+
+bool wl_cfgp2p_is_pub_action(void *frame, u32 frame_len)
+{
+       wifi_p2p_pub_act_frame_t *pact_frm;
+
+       if (frame == NULL)
+               return false;
+       pact_frm = (wifi_p2p_pub_act_frame_t *)frame;
+       if (frame_len < sizeof(wifi_p2p_pub_act_frame_t) -1)
+               return false;
+
+       if (pact_frm->category == P2P_PUB_AF_CATEGORY &&
+               pact_frm->action == P2P_PUB_AF_ACTION &&
+               pact_frm->oui_type == P2P_VER &&
+               memcmp(pact_frm->oui, P2P_OUI, sizeof(pact_frm->oui)) == 0) {
+               return true;
+       }
+
+       return false;
+}
+
+bool wl_cfgp2p_is_p2p_action(void *frame, u32 frame_len)
+{
+       wifi_p2p_action_frame_t *act_frm;
+
+       if (frame == NULL)
+               return false;
+       act_frm = (wifi_p2p_action_frame_t *)frame;
+       if (frame_len < sizeof(wifi_p2p_action_frame_t) -1)
+               return false;
+
+       if (act_frm->category == P2P_AF_CATEGORY &&
+               act_frm->type  == P2P_VER &&
+               memcmp(act_frm->OUI, P2P_OUI, DOT11_OUI_LEN) == 0) {
+               return true;
+       }
+
+       return false;
+}
+
+#define GAS_RESP_LEN           2
+#define DOUBLE_TLV_BODY_OFF    4
+#define GAS_RESP_OFFSET                4
+#define GAS_CRESP_OFFSET       5
+
+bool wl_cfgp2p_find_gas_subtype(u8 subtype, u8* data, u32 len)
+{
+       bcm_tlv_t *ie = (bcm_tlv_t *)data;
+       u8 *frame = NULL;
+       u16 id, flen;
+
+       /* Skipped first ANQP Element, if frame has anqp elemnt */
+       ie = bcm_parse_tlvs(ie, (int)len, DOT11_MNG_ADVERTISEMENT_ID);
+
+       if (ie == NULL)
+               return false;
+
+       frame = (uint8 *)ie + ie->len + TLV_HDR_LEN + GAS_RESP_LEN;
+       id = ((u16) (((frame)[1] << 8) | (frame)[0]));
+       flen = ((u16) (((frame)[3] << 8) | (frame)[2]));
+
+       /* If the contents match the OUI and the type */
+       if (flen >= WFA_OUI_LEN + 1 &&
+               id ==  P2PSD_GAS_NQP_INFOID &&
+               !bcmp(&frame[DOUBLE_TLV_BODY_OFF], (const uint8*)WFA_OUI, WFA_OUI_LEN) &&
+               subtype == frame[DOUBLE_TLV_BODY_OFF+WFA_OUI_LEN]) {
+               return true;
+       }
+
+       return false;
+}
+
+bool wl_cfgp2p_is_gas_action(void *frame, u32 frame_len)
+{
+
+       wifi_p2psd_gas_pub_act_frame_t *sd_act_frm;
+
+       if (frame == NULL)
+               return false;
+
+       sd_act_frm = (wifi_p2psd_gas_pub_act_frame_t *)frame;
+       if (frame_len < (sizeof(wifi_p2psd_gas_pub_act_frame_t) - 1))
+               return false;
+       if (sd_act_frm->category != P2PSD_ACTION_CATEGORY)
+               return false;
+
+#ifdef WL11U
+       if (sd_act_frm->action == P2PSD_ACTION_ID_GAS_IRESP)
+               return wl_cfgp2p_find_gas_subtype(P2PSD_GAS_OUI_SUBTYPE,
+                       (u8 *)sd_act_frm->query_data + GAS_RESP_OFFSET,
+                       frame_len);
+
+       else if (sd_act_frm->action == P2PSD_ACTION_ID_GAS_CRESP)
+               return wl_cfgp2p_find_gas_subtype(P2PSD_GAS_OUI_SUBTYPE,
+                       (u8 *)sd_act_frm->query_data + GAS_CRESP_OFFSET,
+                       frame_len);
+       else if (sd_act_frm->action == P2PSD_ACTION_ID_GAS_IREQ ||
+               sd_act_frm->action == P2PSD_ACTION_ID_GAS_CREQ)
+               return true;
+       else
+               return false;
+#else
+       if (sd_act_frm->action == P2PSD_ACTION_ID_GAS_IREQ ||
+               sd_act_frm->action == P2PSD_ACTION_ID_GAS_IRESP ||
+               sd_act_frm->action == P2PSD_ACTION_ID_GAS_CREQ ||
+               sd_act_frm->action == P2PSD_ACTION_ID_GAS_CRESP)
+               return true;
+       else
+               return false;
+#endif /* WL11U */
+}
+
+bool wl_cfgp2p_is_p2p_gas_action(void *frame, u32 frame_len)
+{
+
+       wifi_p2psd_gas_pub_act_frame_t *sd_act_frm;
+
+       if (frame == NULL)
+               return false;
+
+       sd_act_frm = (wifi_p2psd_gas_pub_act_frame_t *)frame;
+       if (frame_len < (sizeof(wifi_p2psd_gas_pub_act_frame_t) - 1))
+               return false;
+       if (sd_act_frm->category != P2PSD_ACTION_CATEGORY)
+               return false;
+
+       if (sd_act_frm->action == P2PSD_ACTION_ID_GAS_IREQ)
+               return wl_cfgp2p_find_gas_subtype(P2PSD_GAS_OUI_SUBTYPE,
+                       (u8 *)sd_act_frm->query_data,
+                       frame_len);
+       else
+               return false;
+}
+
+void wl_cfgp2p_print_actframe(bool tx, void *frame, u32 frame_len, u32 channel)
+{
+       wifi_p2p_pub_act_frame_t *pact_frm;
+       wifi_p2p_action_frame_t *act_frm;
+       wifi_p2psd_gas_pub_act_frame_t *sd_act_frm;
+       if (!frame || frame_len <= 2)
+               return;
+
+       if (wl_cfgp2p_is_pub_action(frame, frame_len)) {
+               pact_frm = (wifi_p2p_pub_act_frame_t *)frame;
+               switch (pact_frm->subtype) {
+                       case P2P_PAF_GON_REQ:
+                               CFGP2P_ACTION(("%s P2P Group Owner Negotiation Req Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+                               break;
+                       case P2P_PAF_GON_RSP:
+                               CFGP2P_ACTION(("%s P2P Group Owner Negotiation Rsp Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+                               break;
+                       case P2P_PAF_GON_CONF:
+                               CFGP2P_ACTION(("%s P2P Group Owner Negotiation Confirm Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+                               break;
+                       case P2P_PAF_INVITE_REQ:
+                               CFGP2P_ACTION(("%s P2P Invitation Request  Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+                               break;
+                       case P2P_PAF_INVITE_RSP:
+                               CFGP2P_ACTION(("%s P2P Invitation Response Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+                               break;
+                       case P2P_PAF_DEVDIS_REQ:
+                               CFGP2P_ACTION(("%s P2P Device Discoverability Request Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+                               break;
+                       case P2P_PAF_DEVDIS_RSP:
+                               CFGP2P_ACTION(("%s P2P Device Discoverability Response Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+                               break;
+                       case P2P_PAF_PROVDIS_REQ:
+                               CFGP2P_ACTION(("%s P2P Provision Discovery Request Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+                               break;
+                       case P2P_PAF_PROVDIS_RSP:
+                               CFGP2P_ACTION(("%s P2P Provision Discovery Response Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+                               break;
+                       default:
+                               CFGP2P_ACTION(("%s Unknown Public Action Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+
+               }
+
+       } else if (wl_cfgp2p_is_p2p_action(frame, frame_len)) {
+               act_frm = (wifi_p2p_action_frame_t *)frame;
+               switch (act_frm->subtype) {
+                       case P2P_AF_NOTICE_OF_ABSENCE:
+                               CFGP2P_ACTION(("%s P2P Notice of Absence Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+                               break;
+                       case P2P_AF_PRESENCE_REQ:
+                               CFGP2P_ACTION(("%s P2P Presence Request Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+                               break;
+                       case P2P_AF_PRESENCE_RSP:
+                               CFGP2P_ACTION(("%s P2P Presence Response Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+                               break;
+                       case P2P_AF_GO_DISC_REQ:
+                               CFGP2P_ACTION(("%s P2P Discoverability Request Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+                               break;
+                       default:
+                               CFGP2P_ACTION(("%s Unknown P2P Action Frame,"
+                                       " channel=%d\n", (tx)? "TX": "RX", channel));
+               }
+
+       } else if (wl_cfgp2p_is_gas_action(frame, frame_len)) {
+               sd_act_frm = (wifi_p2psd_gas_pub_act_frame_t *)frame;
+               switch (sd_act_frm->action) {
+                       case P2PSD_ACTION_ID_GAS_IREQ:
+                               CFGP2P_ACTION(("%s GAS Initial Request,"
+                                       " channel=%d\n", (tx)? "TX" : "RX", channel));
+                               break;
+                       case P2PSD_ACTION_ID_GAS_IRESP:
+                               CFGP2P_ACTION(("%s GAS Initial Response,"
+                                       " channel=%d\n", (tx)? "TX" : "RX", channel));
+                               break;
+                       case P2PSD_ACTION_ID_GAS_CREQ:
+                               CFGP2P_ACTION(("%s GAS Comback Request,"
+                                       " channel=%d\n", (tx)? "TX" : "RX", channel));
+                               break;
+                       case P2PSD_ACTION_ID_GAS_CRESP:
+                               CFGP2P_ACTION(("%s GAS Comback Response,"
+                                       " channel=%d\n", (tx)? "TX" : "RX", channel));
+                               break;
+                       default:
+                               CFGP2P_ACTION(("%s Unknown GAS Frame,"
+                                       " channel=%d\n", (tx)? "TX" : "RX", channel));
+               }
+
+
+       }
+}
+
+/*
+ *  Initialize variables related to P2P
+ *
+ */
+s32
+wl_cfgp2p_init_priv(struct bcm_cfg80211 *cfg)
+{
+       if (!(cfg->p2p = kzalloc(sizeof(struct p2p_info), GFP_KERNEL))) {
+               CFGP2P_ERR(("struct p2p_info allocation failed\n"));
+               return -ENOMEM;
+       }
+
+       wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_PRIMARY) = bcmcfg_to_prmry_ndev(cfg);
+       wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_PRIMARY) = 0;
+       wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_DEVICE) = NULL;
+       wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE) = 0;
+       wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_CONNECTION1) = NULL;
+       wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_CONNECTION1) = -1;
+       wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_CONNECTION2) = NULL;
+       wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_CONNECTION2) = -1;
+       return BCME_OK;
+
+}
+/*
+ *  Deinitialize variables related to P2P
+ *
+ */
+void
+wl_cfgp2p_deinit_priv(struct bcm_cfg80211 *cfg)
+{
+       CFGP2P_ERR(("In\n"));
+       if (cfg->p2p) {
+               kfree(cfg->p2p);
+               cfg->p2p = NULL;
+       }
+       cfg->p2p_supported = 0;
+}
+/*
+ * Set P2P functions into firmware
+ */
+s32
+wl_cfgp2p_set_firm_p2p(struct bcm_cfg80211 *cfg)
+{
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+       struct ether_addr null_eth_addr = { { 0, 0, 0, 0, 0, 0 } };
+       s32 ret = BCME_OK;
+       s32 val = 0;
+       /* Do we have to check whether APSTA is enabled or not ? */
+       ret = wldev_iovar_getint(ndev, "apsta", &val);
+       if (ret < 0) {
+               CFGP2P_ERR(("get apsta error %d\n", ret));
+               return ret;
+       }
+       if (val == 0) {
+               val = 1;
+               ret = wldev_ioctl(ndev, WLC_DOWN, &val, sizeof(s32), true);
+               if (ret < 0) {
+                       CFGP2P_ERR(("WLC_DOWN error %d\n", ret));
+                       return ret;
+               }
+
+               ret = wldev_iovar_setint(ndev, "apsta", val);
+               if (ret < 0) {
+                       /* return error and fail the initialization */
+                       CFGP2P_ERR(("wl apsta %d set error. ret: %d\n", val, ret));
+                       return ret;
+               }
+
+               ret = wldev_ioctl(ndev, WLC_UP, &val, sizeof(s32), true);
+               if (ret < 0) {
+                       CFGP2P_ERR(("WLC_UP error %d\n", ret));
+                       return ret;
+               }
+       }
+
+       /* In case of COB type, firmware has default mac address
+        * After Initializing firmware, we have to set current mac address to
+        * firmware for P2P device address
+        */
+       ret = wldev_iovar_setbuf_bsscfg(ndev, "p2p_da_override", &null_eth_addr,
+               sizeof(null_eth_addr), cfg->ioctl_buf, WLC_IOCTL_MAXLEN, 0, &cfg->ioctl_buf_sync);
+       if (ret && ret != BCME_UNSUPPORTED) {
+               CFGP2P_ERR(("failed to update device address ret %d\n", ret));
+       }
+       return ret;
+}
+
+int wl_cfg_multip2p_operational(struct bcm_cfg80211 *cfg)
+{
+       if (!cfg->p2p) {
+               CFGP2P_DBG(("p2p not enabled! \n"));
+               return false;
+       }
+
+       if ((wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_CONNECTION1) != -1) &&
+           (wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_CONNECTION2) != -1))
+               return true;
+       else
+               return false;
+}
+
+/* Create a new P2P BSS.
+ * Parameters:
+ * @mac      : MAC address of the BSS to create
+ * @if_type  : interface type: WL_P2P_IF_GO or WL_P2P_IF_CLIENT
+ * @chspec   : chspec to use if creating a GO BSS.
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_ifadd(struct bcm_cfg80211 *cfg, struct ether_addr *mac, u8 if_type,
+            chanspec_t chspec)
+{
+       wl_p2p_if_t ifreq;
+       s32 err;
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+
+       ifreq.type = if_type;
+       ifreq.chspec = chspec;
+       memcpy(ifreq.addr.octet, mac->octet, sizeof(ifreq.addr.octet));
+
+       CFGP2P_DBG(("---cfg p2p_ifadd "MACDBG" %s %u\n",
+               MAC2STRDBG(ifreq.addr.octet),
+               (if_type == WL_P2P_IF_GO) ? "go" : "client",
+               (chspec & WL_CHANSPEC_CHAN_MASK) >> WL_CHANSPEC_CHAN_SHIFT));
+
+       err = wldev_iovar_setbuf(ndev, "p2p_ifadd", &ifreq, sizeof(ifreq),
+               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+       if (unlikely(err < 0)) {
+               printk("'cfg p2p_ifadd' error %d\n", err);
+               return err;
+       }
+
+       return err;
+}
+
+/* Disable a P2P BSS.
+ * Parameters:
+ * @mac      : MAC address of the BSS to disable
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_ifdisable(struct bcm_cfg80211 *cfg, struct ether_addr *mac)
+{
+       s32 ret;
+       struct net_device *netdev = bcmcfg_to_prmry_ndev(cfg);
+
+       CFGP2P_INFO(("------primary idx %d : cfg p2p_ifdis "MACDBG"\n",
+               netdev->ifindex, MAC2STRDBG(mac->octet)));
+       ret = wldev_iovar_setbuf(netdev, "p2p_ifdis", mac, sizeof(*mac),
+               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+       if (unlikely(ret < 0)) {
+               printk("'cfg p2p_ifdis' error %d\n", ret);
+       }
+       return ret;
+}
+
+/* Delete a P2P BSS.
+ * Parameters:
+ * @mac      : MAC address of the BSS to delete
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_ifdel(struct bcm_cfg80211 *cfg, struct ether_addr *mac)
+{
+       s32 ret;
+       struct net_device *netdev = bcmcfg_to_prmry_ndev(cfg);
+
+       CFGP2P_INFO(("------primary idx %d : cfg p2p_ifdel "MACDBG"\n",
+           netdev->ifindex, MAC2STRDBG(mac->octet)));
+       ret = wldev_iovar_setbuf(netdev, "p2p_ifdel", mac, sizeof(*mac),
+               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+       if (unlikely(ret < 0)) {
+               printk("'cfg p2p_ifdel' error %d\n", ret);
+       }
+       return ret;
+}
+
+/* Change a P2P Role.
+ * Parameters:
+ * @mac      : MAC address of the BSS to change a role
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_ifchange(struct bcm_cfg80211 *cfg, struct ether_addr *mac, u8 if_type,
+            chanspec_t chspec, s32 conn_idx)
+{
+       wl_p2p_if_t ifreq;
+       s32 err;
+
+       struct net_device *netdev =  wl_to_p2p_bss_ndev(cfg, conn_idx);
+
+       ifreq.type = if_type;
+       ifreq.chspec = chspec;
+       memcpy(ifreq.addr.octet, mac->octet, sizeof(ifreq.addr.octet));
+
+       CFGP2P_INFO(("---cfg p2p_ifchange "MACDBG" %s %u"
+               " chanspec 0x%04x\n", MAC2STRDBG(ifreq.addr.octet),
+               (if_type == WL_P2P_IF_GO) ? "go" : "client",
+               (chspec & WL_CHANSPEC_CHAN_MASK) >> WL_CHANSPEC_CHAN_SHIFT,
+               ifreq.chspec));
+
+       err = wldev_iovar_setbuf(netdev, "p2p_ifupd", &ifreq, sizeof(ifreq),
+               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+       if (unlikely(err < 0)) {
+               printk("'cfg p2p_ifupd' error %d\n", err);
+       } else if (if_type == WL_P2P_IF_GO) {
+               cfg->p2p->p2p_go_count++;
+       }
+       return err;
+}
+
+
+/* Get the index of a created P2P BSS.
+ * Parameters:
+ * @mac      : MAC address of the created BSS
+ * @index    : output: index of created BSS
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_ifidx(struct bcm_cfg80211 *cfg, struct ether_addr *mac, s32 *index)
+{
+       s32 ret;
+       u8 getbuf[64];
+       struct net_device *dev = bcmcfg_to_prmry_ndev(cfg);
+
+       CFGP2P_INFO(("---cfg p2p_if "MACDBG"\n", MAC2STRDBG(mac->octet)));
+
+       ret = wldev_iovar_getbuf_bsscfg(dev, "p2p_if", mac, sizeof(*mac), getbuf,
+               sizeof(getbuf), wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_PRIMARY), NULL);
+
+       if (ret == 0) {
+               memcpy(index, getbuf, sizeof(s32));
+               CFGP2P_INFO(("---cfg p2p_if   ==> %d\n", *index));
+       }
+
+       return ret;
+}
+
+static s32
+wl_cfgp2p_set_discovery(struct bcm_cfg80211 *cfg, s32 on)
+{
+       s32 ret = BCME_OK;
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+       CFGP2P_DBG(("enter\n"));
+
+       ret = wldev_iovar_setint(ndev, "p2p_disc", on);
+
+       if (unlikely(ret < 0)) {
+               CFGP2P_ERR(("p2p_disc %d error %d\n", on, ret));
+       }
+
+       return ret;
+}
+
+/* Set the WL driver's P2P mode.
+ * Parameters :
+ * @mode      : is one of WL_P2P_DISC_ST_{SCAN,LISTEN,SEARCH}.
+ * @channel   : the channel to listen
+ * @listen_ms : the time (milli seconds) to wait
+ * @bssidx    : bss index for BSSCFG
+ * Returns 0 if success
+ */
+
+s32
+wl_cfgp2p_set_p2p_mode(struct bcm_cfg80211 *cfg, u8 mode, u32 channel, u16 listen_ms, int bssidx)
+{
+       wl_p2p_disc_st_t discovery_mode;
+       s32 ret;
+       struct net_device *dev;
+       CFGP2P_DBG(("enter\n"));
+
+       if (unlikely(bssidx == WL_INVALID)) {
+               CFGP2P_ERR((" %d index out of range\n", bssidx));
+               return -1;
+       }
+
+       dev = wl_cfgp2p_find_ndev(cfg, bssidx);
+       if (unlikely(dev == NULL)) {
+               CFGP2P_ERR(("bssidx %d is not assigned\n", bssidx));
+               return BCME_NOTFOUND;
+       }
+
+#ifdef P2PLISTEN_AP_SAMECHN
+       CFGP2P_DBG(("p2p0 listen channel %d  AP connection chan %d \n",
+               channel, cfg->channel));
+       if ((mode == WL_P2P_DISC_ST_LISTEN) && (cfg->channel == channel)) {
+               struct net_device *primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+
+               if (cfg->p2p_resp_apchn_status) {
+                       CFGP2P_DBG(("p2p_resp_apchn_status already ON \n"));
+                       return BCME_OK;
+               }
+
+               if (wl_get_drv_status(cfg, CONNECTED, primary_ndev)) {
+                       ret = wl_cfg80211_set_p2p_resp_ap_chn(primary_ndev, 1);
+                       cfg->p2p_resp_apchn_status = true;
+                       CFGP2P_DBG(("p2p_resp_apchn_status ON \n"));
+                       return ret;
+               }
+       }
+#endif /* P2PLISTEN_AP_SAMECHN */
+
+       /* Put the WL driver into P2P Listen Mode to respond to P2P probe reqs */
+       discovery_mode.state = mode;
+       discovery_mode.chspec = wl_ch_host_to_driver(cfg->wdev, bssidx, channel);
+       discovery_mode.dwell = listen_ms;
+       ret = wldev_iovar_setbuf_bsscfg(dev, "p2p_state", &discovery_mode,
+               sizeof(discovery_mode), cfg->ioctl_buf, WLC_IOCTL_MAXLEN,
+               bssidx, &cfg->ioctl_buf_sync);
+
+       return ret;
+}
+
+/* Get the index of the P2P Discovery BSS */
+static s32
+wl_cfgp2p_get_disc_idx(struct bcm_cfg80211 *cfg, s32 *index)
+{
+       s32 ret;
+       struct net_device *dev = wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_PRIMARY);
+
+       ret = wldev_iovar_getint(dev, "p2p_dev", index);
+       CFGP2P_INFO(("p2p_dev bsscfg_idx=%d ret=%d\n", *index, ret));
+
+       if (unlikely(ret <  0)) {
+           CFGP2P_ERR(("'p2p_dev' error %d\n", ret));
+               return ret;
+       }
+       return ret;
+}
+
+int wl_cfgp2p_get_conn_idx(struct bcm_cfg80211 *cfg)
+{
+       int i;
+       s32 connected_cnt;
+       dhd_pub_t *dhd =  (dhd_pub_t *)(cfg->pub);
+       if (!dhd)
+               return (-ENODEV);
+       for (i = P2PAPI_BSSCFG_CONNECTION1; i < P2PAPI_BSSCFG_MAX; i++) {
+               if (wl_to_p2p_bss_bssidx(cfg, i) == -1) {
+                       if (i == P2PAPI_BSSCFG_CONNECTION2) {
+                               if (!(dhd->op_mode & DHD_FLAG_MP2P_MODE)) {
+                                       CFGP2P_ERR(("Multi p2p not supported"));
+                                       return BCME_ERROR;
+                               }
+                               if ((connected_cnt = wl_get_drv_status_all(cfg, CONNECTED)) > 1) {
+                                       CFGP2P_ERR(("Failed to create second p2p interface"
+                                               "Already one connection exists"));
+                                       return BCME_ERROR;
+                               }
+                       }
+               return i;
+               }
+       }
+       return BCME_ERROR;
+}
+
+s32
+wl_cfgp2p_init_discovery(struct bcm_cfg80211 *cfg)
+{
+
+       s32 bssidx = 0;
+       s32 ret = BCME_OK;
+
+       CFGP2P_DBG(("enter\n"));
+
+       if (wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE) > 0) {
+               CFGP2P_ERR(("do nothing, already initialized\n"));
+               return ret;
+       }
+
+       ret = wl_cfgp2p_set_discovery(cfg, 1);
+       if (ret < 0) {
+               CFGP2P_ERR(("set discover error\n"));
+               return ret;
+       }
+       /* Enable P2P Discovery in the WL Driver */
+       ret = wl_cfgp2p_get_disc_idx(cfg, &bssidx);
+
+       if (ret < 0) {
+               return ret;
+       }
+       /* In case of CFG80211 case, check if p2p_discovery interface has allocated p2p_wdev */
+       if (!cfg->p2p_wdev) {
+               CFGP2P_ERR(("p2p_wdev is NULL.\n"));
+               return BCME_NODEVICE;
+       }
+       /* Make an entry in the netinfo */
+       wl_alloc_netinfo(cfg, NULL, cfg->p2p_wdev, WL_MODE_BSS, 0, bssidx);
+
+       wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_DEVICE) =
+           wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_PRIMARY);
+       wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE) = bssidx;
+
+       /* Set the initial discovery state to SCAN */
+       ret = wl_cfgp2p_set_p2p_mode(cfg, WL_P2P_DISC_ST_SCAN, 0, 0,
+               wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE));
+
+       if (unlikely(ret != 0)) {
+               CFGP2P_ERR(("unable to set WL_P2P_DISC_ST_SCAN\n"));
+               wl_cfgp2p_set_discovery(cfg, 0);
+               wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE) = 0;
+               wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_DEVICE) = NULL;
+               return 0;
+       }
+       return ret;
+}
+
+/* Deinitialize P2P Discovery
+ * Parameters :
+ * @cfg        : wl_private data
+ * Returns 0 if succes
+ */
+static s32
+wl_cfgp2p_deinit_discovery(struct bcm_cfg80211 *cfg)
+{
+       s32 ret = BCME_OK;
+       s32 bssidx;
+
+       CFGP2P_DBG(("enter\n"));
+       bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+       if (bssidx <= 0) {
+               CFGP2P_ERR(("do nothing, not initialized\n"));
+               return -1;
+       }
+
+       /* Clear our saved WPS and P2P IEs for the discovery BSS */
+       wl_cfg80211_clear_per_bss_ies(cfg, bssidx);
+
+       /* Set the discovery state to SCAN */
+       wl_cfgp2p_set_p2p_mode(cfg, WL_P2P_DISC_ST_SCAN, 0, 0,
+                   bssidx);
+       /* Disable P2P discovery in the WL driver (deletes the discovery BSSCFG) */
+       ret = wl_cfgp2p_set_discovery(cfg, 0);
+
+       /* Remove the p2p disc entry in the netinfo */
+#ifdef DHD_IFDEBUG
+       WL_ERR(("dealloc_net_info by wdev=%p\n", cfg->p2p_wdev));
+#endif
+       wl_dealloc_netinfo_by_wdev(cfg, cfg->p2p_wdev);
+
+       wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE) = WL_INVALID;
+       wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_DEVICE) = NULL;
+
+       return ret;
+
+}
+/* Enable P2P Discovery
+ * Parameters:
+ * @cfg        : wl_private data
+ * @ie  : probe request ie (WPS IE + P2P IE)
+ * @ie_len   : probe request ie length
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_enable_discovery(struct bcm_cfg80211 *cfg, struct net_device *dev,
+       const u8 *ie, u32 ie_len)
+{
+       s32 ret = BCME_OK;
+       s32 bssidx;
+
+       CFGP2P_DBG(("enter\n"));
+       if (wl_get_p2p_status(cfg, DISCOVERY_ON)) {
+               CFGP2P_INFO((" DISCOVERY is already initialized, we have nothing to do\n"));
+               goto set_ie;
+       }
+
+       ret = wl_cfgp2p_init_discovery(cfg);
+       if (unlikely(ret < 0)) {
+               CFGP2P_ERR((" init discovery error %d\n", ret));
+               goto exit;
+       }
+
+       wl_set_p2p_status(cfg, DISCOVERY_ON);
+       /* Set wsec to any non-zero value in the discovery bsscfg to ensure our
+        * P2P probe responses have the privacy bit set in the 802.11 WPA IE.
+        * Some peer devices may not initiate WPS with us if this bit is not set.
+        */
+       ret = wldev_iovar_setint_bsscfg(wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_DEVICE),
+                       "wsec", AES_ENABLED, wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE));
+       if (unlikely(ret < 0)) {
+               CFGP2P_ERR((" wsec error %d\n", ret));
+       }
+set_ie:
+       if (ie_len) {
+
+               if (bcmcfg_to_prmry_ndev(cfg) == dev) {
+                       bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+               } else if ((bssidx = wl_get_bssidx_by_wdev(cfg, cfg->p2p_wdev)) < 0) {
+                       WL_ERR(("Find p2p index from wdev(%p) failed\n", cfg->p2p_wdev));
+                       return BCME_ERROR;
+               }
+
+               ret = wl_cfg80211_set_mgmt_vndr_ies(cfg, ndev_to_cfgdev(dev),
+                       bssidx,
+                       VNDR_IE_PRBREQ_FLAG, ie, ie_len);
+
+               if (unlikely(ret < 0)) {
+                       CFGP2P_ERR(("set probreq ie occurs error %d\n", ret));
+                       goto exit;
+               }
+       }
+exit:
+       return ret;
+}
+
+/* Disable P2P Discovery
+ * Parameters:
+ * @cfg       : wl_private_data
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_disable_discovery(struct bcm_cfg80211 *cfg)
+{
+       s32 ret = BCME_OK;
+       s32 bssidx;
+
+       CFGP2P_DBG((" enter\n"));
+       wl_clr_p2p_status(cfg, DISCOVERY_ON);
+
+#ifdef DHD_IFDEBUG
+       WL_ERR(("%s: (cfg)->p2p->bss[type].bssidx: %d\n",
+               __FUNCTION__, (cfg)->p2p->bss[P2PAPI_BSSCFG_DEVICE].bssidx));
+#endif
+       bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+       if (bssidx <= 0) {
+               CFGP2P_ERR((" do nothing, not initialized\n"));
+               return 0;
+       }
+
+       ret = wl_cfgp2p_set_p2p_mode(cfg, WL_P2P_DISC_ST_SCAN, 0, 0,
+                   bssidx);
+       if (unlikely(ret < 0)) {
+               CFGP2P_ERR(("unable to set WL_P2P_DISC_ST_SCAN\n"));
+       }
+       /* Do a scan abort to stop the driver's scan engine in case it is still
+        * waiting out an action frame tx dwell time.
+        */
+       wl_clr_p2p_status(cfg, DISCOVERY_ON);
+       ret = wl_cfgp2p_deinit_discovery(cfg);
+
+       return ret;
+}
+
+s32
+wl_cfgp2p_escan(struct bcm_cfg80211 *cfg, struct net_device *dev, u16 active,
+       u32 num_chans, u16 *channels,
+       s32 search_state, u16 action, u32 bssidx, struct ether_addr *tx_dst_addr,
+       p2p_scan_purpose_t p2p_scan_purpose)
+{
+       s32 ret = BCME_OK;
+       s32 memsize;
+       s32 eparams_size;
+       u32 i;
+       s8 *memblk;
+       wl_p2p_scan_t *p2p_params;
+       wl_escan_params_t *eparams;
+       wlc_ssid_t ssid;
+       /* Scan parameters */
+#define P2PAPI_SCAN_NPROBES 1
+#define P2PAPI_SCAN_DWELL_TIME_MS 80
+#define P2PAPI_SCAN_SOCIAL_DWELL_TIME_MS 40
+#define P2PAPI_SCAN_HOME_TIME_MS 60
+#define P2PAPI_SCAN_NPROBS_TIME_MS 30
+#define P2PAPI_SCAN_AF_SEARCH_DWELL_TIME_MS 100
+
+       struct net_device *pri_dev = wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_PRIMARY);
+       /* Allocate scan params which need space for 3 channels and 0 ssids */
+       eparams_size = (WL_SCAN_PARAMS_FIXED_SIZE +
+           OFFSETOF(wl_escan_params_t, params)) +
+               num_chans * sizeof(eparams->params.channel_list[0]);
+
+       memsize = sizeof(wl_p2p_scan_t) + eparams_size;
+       memblk = scanparambuf;
+       if (memsize > sizeof(scanparambuf)) {
+               CFGP2P_ERR((" scanpar buf too small (%u > %zu)\n",
+                   memsize, sizeof(scanparambuf)));
+               return -1;
+       }
+       memset(memblk, 0, memsize);
+       memset(cfg->ioctl_buf, 0, WLC_IOCTL_MAXLEN);
+       if (search_state == WL_P2P_DISC_ST_SEARCH) {
+               /*
+                * If we in SEARCH STATE, we don't need to set SSID explictly
+                * because dongle use P2P WILDCARD internally by default
+                */
+               wl_cfgp2p_set_p2p_mode(cfg, WL_P2P_DISC_ST_SEARCH, 0, 0, bssidx);
+               /* use null ssid */
+               ssid.SSID_len = 0;
+               memset(&ssid.SSID, 0, sizeof(ssid.SSID));
+       } else if (search_state == WL_P2P_DISC_ST_SCAN) {
+               /* SCAN STATE 802.11 SCAN
+                * WFD Supplicant has p2p_find command with (type=progressive, type= full)
+                * So if P2P_find command with type=progressive,
+                * we have to set ssid to P2P WILDCARD because
+                * we just do broadcast scan unless setting SSID
+                */
+               wl_cfgp2p_set_p2p_mode(cfg, WL_P2P_DISC_ST_SCAN, 0, 0, bssidx);
+               /* use wild card ssid */
+               ssid.SSID_len = WL_P2P_WILDCARD_SSID_LEN;
+               memset(&ssid.SSID, 0, sizeof(ssid.SSID));
+               memcpy(&ssid.SSID, WL_P2P_WILDCARD_SSID, WL_P2P_WILDCARD_SSID_LEN);
+       } else {
+               CFGP2P_ERR((" invalid search state %d\n", search_state));
+               return -1;
+       }
+
+
+       /* Fill in the P2P scan structure at the start of the iovar param block */
+       p2p_params = (wl_p2p_scan_t*) memblk;
+       p2p_params->type = 'E';
+       /* Fill in the Scan structure that follows the P2P scan structure */
+       eparams = (wl_escan_params_t*) (p2p_params + 1);
+       eparams->params.bss_type = DOT11_BSSTYPE_ANY;
+       if (active)
+               eparams->params.scan_type = DOT11_SCANTYPE_ACTIVE;
+       else
+               eparams->params.scan_type = DOT11_SCANTYPE_PASSIVE;
+
+       if (tx_dst_addr == NULL)
+               memcpy(&eparams->params.bssid, &ether_bcast, ETHER_ADDR_LEN);
+       else
+               memcpy(&eparams->params.bssid, tx_dst_addr, ETHER_ADDR_LEN);
+
+       if (ssid.SSID_len)
+               memcpy(&eparams->params.ssid, &ssid, sizeof(wlc_ssid_t));
+
+       eparams->params.home_time = htod32(P2PAPI_SCAN_HOME_TIME_MS);
+
+       switch (p2p_scan_purpose) {
+               case P2P_SCAN_SOCIAL_CHANNEL:
+               eparams->params.active_time = htod32(P2PAPI_SCAN_SOCIAL_DWELL_TIME_MS);
+                       break;
+               case P2P_SCAN_AFX_PEER_NORMAL:
+               case P2P_SCAN_AFX_PEER_REDUCED:
+               eparams->params.active_time = htod32(P2PAPI_SCAN_AF_SEARCH_DWELL_TIME_MS);
+                       break;
+               case P2P_SCAN_CONNECT_TRY:
+                       eparams->params.active_time = htod32(WL_SCAN_CONNECT_DWELL_TIME_MS);
+                       break;
+               default :
+                       if (wl_get_drv_status_all(cfg, CONNECTED))
+               eparams->params.active_time = -1;
+       else
+               eparams->params.active_time = htod32(P2PAPI_SCAN_DWELL_TIME_MS);
+                       break;
+       }
+
+       if (p2p_scan_purpose == P2P_SCAN_CONNECT_TRY)
+               eparams->params.nprobes = htod32(eparams->params.active_time /
+                       WL_SCAN_JOIN_PROBE_INTERVAL_MS);
+       else
+       eparams->params.nprobes = htod32((eparams->params.active_time /
+               P2PAPI_SCAN_NPROBS_TIME_MS));
+
+
+       if (eparams->params.nprobes <= 0)
+               eparams->params.nprobes = 1;
+       CFGP2P_DBG(("nprobes # %d, active_time %d\n",
+               eparams->params.nprobes, eparams->params.active_time));
+       eparams->params.passive_time = htod32(-1);
+       eparams->params.channel_num = htod32((0 << WL_SCAN_PARAMS_NSSID_SHIFT) |
+           (num_chans & WL_SCAN_PARAMS_COUNT_MASK));
+
+       for (i = 0; i < num_chans; i++) {
+               eparams->params.channel_list[i] = wl_ch_host_to_driver(cfg->wdev,
+                       bssidx, channels[i]);
+       }
+       eparams->version = htod32(ESCAN_REQ_VERSION);
+       eparams->action =  htod16(action);
+       wl_escan_set_sync_id(eparams->sync_id, cfg);
+       wl_escan_set_type(cfg, WL_SCANTYPE_P2P);
+       CFGP2P_INFO(("SCAN CHANNELS : "));
+
+       for (i = 0; i < num_chans; i++) {
+               if (i == 0) CFGP2P_INFO(("%d", channels[i]));
+               else CFGP2P_INFO((",%d", channels[i]));
+       }
+
+       CFGP2P_INFO(("\n"));
+
+       ret = wldev_iovar_setbuf_bsscfg(pri_dev, "p2p_scan",
+               memblk, memsize, cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+       WL_SCAN(("P2P_SEARCH sync ID: %d, bssidx: %d\n", eparams->sync_id, bssidx));
+       if (ret == BCME_OK)
+               wl_set_p2p_status(cfg, SCANNING);
+       return ret;
+}
+
+/* search function to reach at common channel to send action frame
+ * Parameters:
+ * @cfg       : wl_private data
+ * @ndev     : net device for bssidx
+ * @bssidx   : bssidx for BSS
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_act_frm_search(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       s32 bssidx, s32 channel, struct ether_addr *tx_dst_addr)
+{
+       s32 ret = 0;
+       u32 chan_cnt = 0;
+       u16 *default_chan_list = NULL;
+       p2p_scan_purpose_t p2p_scan_purpose = P2P_SCAN_AFX_PEER_NORMAL;
+       if (!p2p_is_on(cfg) || ndev == NULL || bssidx == WL_INVALID)
+               return -EINVAL;
+       WL_TRACE_HW4((" Enter\n"));
+       if (bssidx == wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_PRIMARY))
+               bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+       if (channel)
+               chan_cnt = AF_PEER_SEARCH_CNT;
+       else
+               chan_cnt = SOCIAL_CHAN_CNT;
+
+       if (cfg->afx_hdl->pending_tx_act_frm && cfg->afx_hdl->is_active) {
+               wl_action_frame_t *action_frame;
+               action_frame = &(cfg->afx_hdl->pending_tx_act_frm->action_frame);
+               if (wl_cfgp2p_is_p2p_gas_action(action_frame->data, action_frame->len)) {
+                       chan_cnt = 1;
+                       p2p_scan_purpose = P2P_SCAN_AFX_PEER_REDUCED;
+               }
+       }
+
+       default_chan_list = kzalloc(chan_cnt * sizeof(*default_chan_list), GFP_KERNEL);
+       if (default_chan_list == NULL) {
+               CFGP2P_ERR(("channel list allocation failed \n"));
+               ret = -ENOMEM;
+               goto exit;
+       }
+       if (channel) {
+               u32 i;
+               /* insert same channel to the chan_list */
+               for (i = 0; i < chan_cnt; i++) {
+                       default_chan_list[i] = channel;
+               }
+       } else {
+               default_chan_list[0] = SOCIAL_CHAN_1;
+               default_chan_list[1] = SOCIAL_CHAN_2;
+               default_chan_list[2] = SOCIAL_CHAN_3;
+       }
+       ret = wl_cfgp2p_escan(cfg, ndev, true, chan_cnt,
+               default_chan_list, WL_P2P_DISC_ST_SEARCH,
+               WL_SCAN_ACTION_START, bssidx, NULL, p2p_scan_purpose);
+       kfree(default_chan_list);
+exit:
+       return ret;
+}
+
+/* Check whether pointed-to IE looks like WPA. */
+#define wl_cfgp2p_is_wpa_ie(ie, tlvs, len)     wl_cfgp2p_has_ie(ie, tlvs, len, \
+               (const uint8 *)WPS_OUI, WPS_OUI_LEN, WPA_OUI_TYPE)
+/* Check whether pointed-to IE looks like WPS. */
+#define wl_cfgp2p_is_wps_ie(ie, tlvs, len)     wl_cfgp2p_has_ie(ie, tlvs, len, \
+               (const uint8 *)WPS_OUI, WPS_OUI_LEN, WPS_OUI_TYPE)
+/* Check whether the given IE looks like WFA P2P IE. */
+#define wl_cfgp2p_is_p2p_ie(ie, tlvs, len)     wl_cfgp2p_has_ie(ie, tlvs, len, \
+               (const uint8 *)WFA_OUI, WFA_OUI_LEN, WFA_OUI_TYPE_P2P)
+/* Check whether the given IE looks like WFA WFDisplay IE. */
+#ifndef WFA_OUI_TYPE_WFD
+#define WFA_OUI_TYPE_WFD       0x0a                    /* WiFi Display OUI TYPE */
+#endif
+#define wl_cfgp2p_is_wfd_ie(ie, tlvs, len)     wl_cfgp2p_has_ie(ie, tlvs, len, \
+               (const uint8 *)WFA_OUI, WFA_OUI_LEN, WFA_OUI_TYPE_WFD)
+
+
+/* Is any of the tlvs the expected entry? If
+ * not update the tlvs buffer pointer/length.
+ */
+static bool
+wl_cfgp2p_has_ie(u8 *ie, u8 **tlvs, u32 *tlvs_len, const u8 *oui, u32 oui_len, u8 type)
+{
+       /* If the contents match the OUI and the type */
+       if (ie[TLV_LEN_OFF] >= oui_len + 1 &&
+               !bcmp(&ie[TLV_BODY_OFF], oui, oui_len) &&
+               type == ie[TLV_BODY_OFF + oui_len]) {
+               return TRUE;
+       }
+
+       if (tlvs == NULL)
+               return FALSE;
+       /* point to the next ie */
+       ie += ie[TLV_LEN_OFF] + TLV_HDR_LEN;
+       /* calculate the length of the rest of the buffer */
+       *tlvs_len -= (int)(ie - *tlvs);
+       /* update the pointer to the start of the buffer */
+       *tlvs = ie;
+
+       return FALSE;
+}
+
+wpa_ie_fixed_t *
+wl_cfgp2p_find_wpaie(u8 *parse, u32 len)
+{
+       bcm_tlv_t *ie;
+
+       while ((ie = bcm_parse_tlvs(parse, (u32)len, DOT11_MNG_VS_ID))) {
+               if (wl_cfgp2p_is_wpa_ie((u8*)ie, &parse, &len)) {
+                       return (wpa_ie_fixed_t *)ie;
+               }
+       }
+       return NULL;
+}
+
+wpa_ie_fixed_t *
+wl_cfgp2p_find_wpsie(u8 *parse, u32 len)
+{
+       bcm_tlv_t *ie;
+
+       while ((ie = bcm_parse_tlvs(parse, (u32)len, DOT11_MNG_VS_ID))) {
+               if (wl_cfgp2p_is_wps_ie((u8*)ie, &parse, &len)) {
+                       return (wpa_ie_fixed_t *)ie;
+               }
+       }
+       return NULL;
+}
+
+wifi_p2p_ie_t *
+wl_cfgp2p_find_p2pie(u8 *parse, u32 len)
+{
+       bcm_tlv_t *ie;
+
+       while ((ie = bcm_parse_tlvs(parse, (int)len, DOT11_MNG_VS_ID))) {
+               if (wl_cfgp2p_is_p2p_ie((uint8*)ie, &parse, &len)) {
+                       return (wifi_p2p_ie_t *)ie;
+               }
+       }
+       return NULL;
+}
+
+wifi_wfd_ie_t *
+wl_cfgp2p_find_wfdie(u8 *parse, u32 len)
+{
+       bcm_tlv_t *ie;
+
+       while ((ie = bcm_parse_tlvs(parse, (int)len, DOT11_MNG_VS_ID))) {
+               if (wl_cfgp2p_is_wfd_ie((uint8*)ie, &parse, &len)) {
+                       return (wifi_wfd_ie_t *)ie;
+               }
+       }
+       return NULL;
+}
+u32
+wl_cfgp2p_vndr_ie(struct bcm_cfg80211 *cfg, u8 *iebuf, s32 pktflag,
+            s8 *oui, s32 ie_id, s8 *data, s32 datalen, const s8* add_del_cmd)
+{
+       vndr_ie_setbuf_t hdr;   /* aligned temporary vndr_ie buffer header */
+       s32 iecount;
+       u32 data_offset;
+
+       /* Validate the pktflag parameter */
+       if ((pktflag & ~(VNDR_IE_BEACON_FLAG | VNDR_IE_PRBRSP_FLAG |
+                   VNDR_IE_ASSOCRSP_FLAG | VNDR_IE_AUTHRSP_FLAG |
+                   VNDR_IE_PRBREQ_FLAG | VNDR_IE_ASSOCREQ_FLAG))) {
+               CFGP2P_ERR(("p2pwl_vndr_ie: Invalid packet flag 0x%x\n", pktflag));
+               return -1;
+       }
+
+       /* Copy the vndr_ie SET command ("add"/"del") to the buffer */
+       strncpy(hdr.cmd, add_del_cmd, VNDR_IE_CMD_LEN - 1);
+       hdr.cmd[VNDR_IE_CMD_LEN - 1] = '\0';
+
+       /* Set the IE count - the buffer contains only 1 IE */
+       iecount = htod32(1);
+       memcpy((void *)&hdr.vndr_ie_buffer.iecount, &iecount, sizeof(s32));
+
+       /* Copy packet flags that indicate which packets will contain this IE */
+       pktflag = htod32(pktflag);
+       memcpy((void *)&hdr.vndr_ie_buffer.vndr_ie_list[0].pktflag, &pktflag,
+               sizeof(u32));
+
+       /* Add the IE ID to the buffer */
+       hdr.vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.id = ie_id;
+
+       /* Add the IE length to the buffer */
+       hdr.vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.len =
+               (uint8) VNDR_IE_MIN_LEN + datalen;
+
+       /* Add the IE OUI to the buffer */
+       hdr.vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.oui[0] = oui[0];
+       hdr.vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.oui[1] = oui[1];
+       hdr.vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.oui[2] = oui[2];
+
+       /* Copy the aligned temporary vndr_ie buffer header to the IE buffer */
+       memcpy(iebuf, &hdr, sizeof(hdr) - 1);
+
+       /* Copy the IE data to the IE buffer */
+       data_offset =
+               (u8*)&hdr.vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.data[0] -
+               (u8*)&hdr;
+       memcpy(iebuf + data_offset, data, datalen);
+       return data_offset + datalen;
+
+}
+
+struct net_device *
+wl_cfgp2p_find_ndev(struct bcm_cfg80211 *cfg, s32 bssidx)
+{
+       u32 i;
+       struct net_device *ndev = NULL;
+       if (bssidx < 0) {
+               CFGP2P_ERR((" bsscfg idx is invalid\n"));
+               goto exit;
+       }
+
+       for (i = 0; i < P2PAPI_BSSCFG_MAX; i++) {
+               if (bssidx == wl_to_p2p_bss_bssidx(cfg, i)) {
+                       ndev = wl_to_p2p_bss_ndev(cfg, i);
+                       break;
+               }
+       }
+
+exit:
+       return ndev;
+}
+/*
+ * Search the driver array idx based on bssidx argument
+ * Parameters: Note that this idx is applicable only
+ * for primary and P2P interfaces. The virtual AP/STA is not
+ * covered here.
+ * @cfg     : wl_private data
+ * @bssidx : bssidx which indicate bsscfg->idx of firmware.
+ * @type   : output arg to store array idx of p2p->bss.
+ * Returns error
+ */
+
+s32
+wl_cfgp2p_find_type(struct bcm_cfg80211 *cfg, s32 bssidx, s32 *type)
+{
+       u32 i;
+       if (bssidx < 0 || type == NULL) {
+               CFGP2P_ERR((" argument is invalid\n"));
+               goto exit;
+       }
+
+       for (i = 0; i < P2PAPI_BSSCFG_MAX; i++) {
+               if (bssidx == wl_to_p2p_bss_bssidx(cfg, i)) {
+                       *type = i;
+                       return BCME_OK;
+               }
+       }
+
+exit:
+       return BCME_BADARG;
+}
+
+/*
+ * Callback function for WLC_E_P2P_DISC_LISTEN_COMPLETE
+ */
+s32
+wl_cfgp2p_listen_complete(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data)
+{
+       s32 ret = BCME_OK;
+       struct net_device *ndev = NULL;
+
+       if (!cfg || !cfg->p2p || !cfgdev)
+               return BCME_ERROR;
+
+       CFGP2P_DBG((" Enter\n"));
+
+#ifdef DHD_IFDEBUG
+       WL_ERR(("%s: cfg: %p, cfgdev: %p, cfg->wdev: %p, cfg->p2p_wdev: %p\n",
+               __FUNCTION__, cfg, cfgdev, cfg->wdev, cfg->p2p_wdev));
+#endif
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+#ifdef P2P_LISTEN_OFFLOADING
+       if (wl_get_p2p_status(cfg, DISC_IN_PROGRESS)) {
+               wl_clr_p2p_status(cfg, DISC_IN_PROGRESS);
+               CFGP2P_ERR(("DISC_IN_PROGRESS cleared\n"));
+               if (ndev && (ndev->ieee80211_ptr != NULL)) {
+#if defined(WL_CFG80211_P2P_DEV_IF)
+                       if (cfgdev && ((struct wireless_dev *)cfgdev)->wiphy) {
+                               cfg80211_remain_on_channel_expired(cfgdev, cfg->last_roc_id,
+                                               &cfg->remain_on_chan, GFP_KERNEL);
+                       } else {
+                               CFGP2P_ERR(("Invalid cfgdev. Dropping the"
+                                               "remain_on_channel_expired event.\n"));
+                       }
+#else
+                       cfg80211_remain_on_channel_expired(cfgdev, cfg->last_roc_id,
+                                       &cfg->remain_on_chan, cfg->remain_on_chan_type, GFP_KERNEL);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+               }
+       }
+#endif /* P2P_LISTEN_OFFLOADING */
+
+       if (wl_get_p2p_status(cfg, LISTEN_EXPIRED) == 0) {
+               wl_set_p2p_status(cfg, LISTEN_EXPIRED);
+               if (timer_pending(&cfg->p2p->listen_timer)) {
+                       del_timer_sync(&cfg->p2p->listen_timer);
+               }
+
+               if (cfg->afx_hdl->is_listen == TRUE &&
+                       wl_get_drv_status_all(cfg, FINDING_COMMON_CHANNEL)) {
+                       WL_DBG(("Listen DONE for action frame\n"));
+                       complete(&cfg->act_frm_scan);
+               }
+#ifdef WL_CFG80211_SYNC_GON
+               else if (wl_get_drv_status_all(cfg, WAITING_NEXT_ACT_FRM_LISTEN)) {
+                       wl_clr_drv_status(cfg, WAITING_NEXT_ACT_FRM_LISTEN, ndev);
+                       WL_DBG(("Listen DONE and wake up wait_next_af !!(%d)\n",
+                               jiffies_to_msecs(jiffies - cfg->af_tx_sent_jiffies)));
+
+                       if (wl_get_drv_status_all(cfg, WAITING_NEXT_ACT_FRM))
+                               wl_clr_drv_status(cfg, WAITING_NEXT_ACT_FRM, ndev);
+
+                       complete(&cfg->wait_next_af);
+               }
+#endif /* WL_CFG80211_SYNC_GON */
+
+#ifndef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+               if (wl_get_drv_status_all(cfg, REMAINING_ON_CHANNEL)) {
+#else
+               if (wl_get_drv_status_all(cfg, REMAINING_ON_CHANNEL) ||
+                       wl_get_drv_status_all(cfg, FAKE_REMAINING_ON_CHANNEL)) {
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+                       WL_DBG(("Listen DONE for remain on channel expired\n"));
+                       wl_clr_drv_status(cfg, REMAINING_ON_CHANNEL, ndev);
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+                       wl_clr_drv_status(cfg, FAKE_REMAINING_ON_CHANNEL, ndev);
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+                       if (ndev && (ndev->ieee80211_ptr != NULL)) {
+#if defined(WL_CFG80211_P2P_DEV_IF)
+                               if (cfgdev && ((struct wireless_dev *)cfgdev)->wiphy) {
+                                       /*
+                                        * To prevent kernel panic,
+                                        * if cfgdev->wiphy may be invalid, adding explicit check
+                                        */
+                                       cfg80211_remain_on_channel_expired(cfgdev, cfg->last_roc_id,
+                                               &cfg->remain_on_chan, GFP_KERNEL);
+                               } else {
+                                       CFGP2P_ERR(("Invalid cfgdev. Dropping the"
+                                               "remain_on_channel_expired event.\n"));
+                               }
+#else
+                               cfg80211_remain_on_channel_expired(cfgdev, cfg->last_roc_id,
+                                       &cfg->remain_on_chan, cfg->remain_on_chan_type, GFP_KERNEL);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+                       }
+               }
+               if (wl_add_remove_eventmsg(bcmcfg_to_prmry_ndev(cfg),
+                       WLC_E_P2P_PROBREQ_MSG, false) != BCME_OK) {
+                       CFGP2P_ERR((" failed to unset WLC_E_P2P_PROPREQ_MSG\n"));
+               }
+       } else
+               wl_clr_p2p_status(cfg, LISTEN_EXPIRED);
+
+       return ret;
+
+}
+
+/*
+ *  Timer expire callback function for LISTEN
+ *  We can't report cfg80211_remain_on_channel_expired from Timer ISR context,
+ *  so lets do it from thread context.
+ */
+void
+wl_cfgp2p_listen_expired(unsigned long data)
+{
+       wl_event_msg_t msg;
+       struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *) data;
+       CFGP2P_DBG((" Enter\n"));
+       bzero(&msg, sizeof(wl_event_msg_t));
+       msg.event_type =  hton32(WLC_E_P2P_DISC_LISTEN_COMPLETE);
+       msg.bsscfgidx  =  wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+#if defined(WL_ENABLE_P2P_IF)
+       wl_cfg80211_event(cfg->p2p_net ? cfg->p2p_net :
+               wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_DEVICE), &msg, NULL);
+#else
+       wl_cfg80211_event(wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_DEVICE), &msg,
+               NULL);
+#endif /* WL_ENABLE_P2P_IF */
+}
+/*
+ *  Routine for cancelling the P2P LISTEN
+ */
+static s32
+wl_cfgp2p_cancel_listen(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+                         struct wireless_dev *wdev, bool notify)
+{
+       WL_DBG(("Enter \n"));
+       /* Irrespective of whether timer is running or not, reset
+        * the LISTEN state.
+        */
+       if (timer_pending(&cfg->p2p->listen_timer)) {
+               del_timer_sync(&cfg->p2p->listen_timer);
+               if (notify) {
+#if defined(WL_CFG80211_P2P_DEV_IF)
+                       if (wdev)
+                               cfg80211_remain_on_channel_expired(wdev, cfg->last_roc_id,
+                                       &cfg->remain_on_chan, GFP_KERNEL);
+#else
+                       if (ndev && ndev->ieee80211_ptr)
+                               cfg80211_remain_on_channel_expired(ndev, cfg->last_roc_id,
+                                       &cfg->remain_on_chan, cfg->remain_on_chan_type, GFP_KERNEL);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+               }
+       }
+       return 0;
+}
+/*
+ * Do a P2P Listen on the given channel for the given duration.
+ * A listen consists of sitting idle and responding to P2P probe requests
+ * with a P2P probe response.
+ *
+ * This fn assumes dongle p2p device discovery is already enabled.
+ * Parameters   :
+ * @cfg          : wl_private data
+ * @channel     : channel to listen
+ * @duration_ms : the time (milli seconds) to wait
+ */
+s32
+wl_cfgp2p_discover_listen(struct bcm_cfg80211 *cfg, s32 channel, u32 duration_ms)
+{
+#define EXTRA_DELAY_TIME       100
+       s32 ret = BCME_OK;
+       struct timer_list *_timer;
+       s32 extra_delay;
+       struct net_device *netdev = bcmcfg_to_prmry_ndev(cfg);
+
+       CFGP2P_DBG((" Enter Listen Channel : %d, Duration : %d\n", channel, duration_ms));
+       if (unlikely(wl_get_p2p_status(cfg, DISCOVERY_ON) == 0)) {
+
+               CFGP2P_ERR((" Discovery is not set, so we have noting to do\n"));
+
+               ret = BCME_NOTREADY;
+               goto exit;
+       }
+       if (timer_pending(&cfg->p2p->listen_timer)) {
+               CFGP2P_DBG(("previous LISTEN is not completed yet\n"));
+               goto exit;
+
+       }
+#ifndef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+       else
+               wl_clr_p2p_status(cfg, LISTEN_EXPIRED);
+#endif /* not WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+       if (wl_add_remove_eventmsg(netdev, WLC_E_P2P_PROBREQ_MSG, true) != BCME_OK) {
+                       CFGP2P_ERR((" failed to set WLC_E_P2P_PROPREQ_MSG\n"));
+       }
+
+       ret = wl_cfgp2p_set_p2p_mode(cfg, WL_P2P_DISC_ST_LISTEN, channel, (u16) duration_ms,
+                   wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE));
+       _timer = &cfg->p2p->listen_timer;
+
+       /*  We will wait to receive WLC_E_P2P_DISC_LISTEN_COMPLETE from dongle ,
+        *  otherwise we will wait up to duration_ms + 100ms + duration / 10
+        */
+       if (ret == BCME_OK) {
+               extra_delay = EXTRA_DELAY_TIME + (duration_ms / 10);
+       } else {
+               /* if failed to set listen, it doesn't need to wait whole duration. */
+               duration_ms = 100 + duration_ms / 20;
+               extra_delay = 0;
+       }
+
+       INIT_TIMER(_timer, wl_cfgp2p_listen_expired, duration_ms, extra_delay);
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+       wl_clr_p2p_status(cfg, LISTEN_EXPIRED);
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+
+#undef EXTRA_DELAY_TIME
+exit:
+       return ret;
+}
+
+
+s32
+wl_cfgp2p_discover_enable_search(struct bcm_cfg80211 *cfg, u8 enable)
+{
+       s32 ret = BCME_OK;
+       CFGP2P_DBG((" Enter\n"));
+       if (!wl_get_p2p_status(cfg, DISCOVERY_ON)) {
+
+               CFGP2P_DBG((" do nothing, discovery is off\n"));
+               return ret;
+       }
+       if (wl_get_p2p_status(cfg, SEARCH_ENABLED) == enable) {
+               CFGP2P_DBG(("already : %d\n", enable));
+               return ret;
+       }
+
+       wl_chg_p2p_status(cfg, SEARCH_ENABLED);
+       /* When disabling Search, reset the WL driver's p2p discovery state to
+        * WL_P2P_DISC_ST_SCAN.
+        */
+       if (!enable) {
+               wl_clr_p2p_status(cfg, SCANNING);
+               ret = wl_cfgp2p_set_p2p_mode(cfg, WL_P2P_DISC_ST_SCAN, 0, 0,
+                           wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE));
+       }
+
+       return ret;
+}
+
+/*
+ * Callback function for WLC_E_ACTION_FRAME_COMPLETE, WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE
+ */
+s32
+wl_cfgp2p_action_tx_complete(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+            const wl_event_msg_t *e, void *data)
+{
+       s32 ret = BCME_OK;
+       u32 event_type = ntoh32(e->event_type);
+       u32 status = ntoh32(e->status);
+       struct net_device *ndev = NULL;
+       CFGP2P_DBG((" Enter\n"));
+
+       ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+       if (wl_get_drv_status_all(cfg, SENDING_ACT_FRM)) {
+               if (event_type == WLC_E_ACTION_FRAME_COMPLETE) {
+
+                       CFGP2P_INFO((" WLC_E_ACTION_FRAME_COMPLETE is received : %d\n", status));
+                       if (status == WLC_E_STATUS_SUCCESS) {
+                               wl_set_p2p_status(cfg, ACTION_TX_COMPLETED);
+                               CFGP2P_DBG(("WLC_E_ACTION_FRAME_COMPLETE : ACK\n"));
+                               if (!cfg->need_wait_afrx && cfg->af_sent_channel) {
+                                       CFGP2P_DBG(("no need to wait next AF.\n"));
+                                       wl_stop_wait_next_action_frame(cfg, ndev);
+                               }
+                       }
+                       else if (!wl_get_p2p_status(cfg, ACTION_TX_COMPLETED)) {
+                               wl_set_p2p_status(cfg, ACTION_TX_NOACK);
+                               CFGP2P_INFO(("WLC_E_ACTION_FRAME_COMPLETE : NO ACK\n"));
+                               wl_stop_wait_next_action_frame(cfg, ndev);
+                       }
+               } else {
+                       CFGP2P_INFO((" WLC_E_ACTION_FRAME_OFFCHAN_COMPLETE is received,"
+                                               "status : %d\n", status));
+
+                       if (wl_get_drv_status_all(cfg, SENDING_ACT_FRM))
+                               complete(&cfg->send_af_done);
+               }
+       }
+       return ret;
+}
+/* Send an action frame immediately without doing channel synchronization.
+ *
+ * This function does not wait for a completion event before returning.
+ * The WLC_E_ACTION_FRAME_COMPLETE event will be received when the action
+ * frame is transmitted.
+ * The WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE event will be received when an
+ * 802.11 ack has been received for the sent action frame.
+ */
+s32
+wl_cfgp2p_tx_action_frame(struct bcm_cfg80211 *cfg, struct net_device *dev,
+       wl_af_params_t *af_params, s32 bssidx)
+{
+       s32 ret = BCME_OK;
+       s32 evt_ret = BCME_OK;
+       s32 timeout = 0;
+       wl_eventmsg_buf_t buf;
+
+
+       CFGP2P_INFO(("\n"));
+       CFGP2P_INFO(("channel : %u , dwell time : %u\n",
+           af_params->channel, af_params->dwell_time));
+
+       wl_clr_p2p_status(cfg, ACTION_TX_COMPLETED);
+       wl_clr_p2p_status(cfg, ACTION_TX_NOACK);
+
+       bzero(&buf, sizeof(wl_eventmsg_buf_t));
+       wl_cfg80211_add_to_eventbuffer(&buf, WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE, true);
+       wl_cfg80211_add_to_eventbuffer(&buf, WLC_E_ACTION_FRAME_COMPLETE, true);
+       if ((evt_ret = wl_cfg80211_apply_eventbuffer(bcmcfg_to_prmry_ndev(cfg), cfg, &buf)) < 0)
+               return evt_ret;
+
+       cfg->af_sent_channel  = af_params->channel;
+#ifdef WL_CFG80211_SYNC_GON
+       cfg->af_tx_sent_jiffies = jiffies;
+#endif /* WL_CFG80211_SYNC_GON */
+
+       ret = wldev_iovar_setbuf_bsscfg(dev, "actframe", af_params, sizeof(*af_params),
+               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+
+       if (ret < 0) {
+               CFGP2P_ERR((" sending action frame is failed\n"));
+               goto exit;
+       }
+
+       timeout = wait_for_completion_timeout(&cfg->send_af_done,
+               msecs_to_jiffies(af_params->dwell_time + WL_AF_TX_EXTRA_TIME_MAX));
+
+       if (timeout >= 0 && wl_get_p2p_status(cfg, ACTION_TX_COMPLETED)) {
+               CFGP2P_INFO(("tx action frame operation is completed\n"));
+               ret = BCME_OK;
+       } else if (ETHER_ISBCAST(&cfg->afx_hdl->tx_dst_addr)) {
+               CFGP2P_INFO(("bcast tx action frame operation is completed\n"));
+               ret = BCME_OK;
+       } else {
+               ret = BCME_ERROR;
+               CFGP2P_INFO(("tx action frame operation is failed\n"));
+       }
+       /* clear status bit for action tx */
+       wl_clr_p2p_status(cfg, ACTION_TX_COMPLETED);
+       wl_clr_p2p_status(cfg, ACTION_TX_NOACK);
+
+exit:
+       CFGP2P_INFO((" via act frame iovar : status = %d\n", ret));
+
+       bzero(&buf, sizeof(wl_eventmsg_buf_t));
+       wl_cfg80211_add_to_eventbuffer(&buf, WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE, false);
+       wl_cfg80211_add_to_eventbuffer(&buf, WLC_E_ACTION_FRAME_COMPLETE, false);
+       if ((evt_ret = wl_cfg80211_apply_eventbuffer(bcmcfg_to_prmry_ndev(cfg), cfg, &buf)) < 0) {
+               WL_ERR(("TX frame events revert back failed \n"));
+               return evt_ret;
+       }
+
+       return ret;
+}
+
+/* Generate our P2P Device Address and P2P Interface Address from our primary
+ * MAC address.
+ */
+void
+wl_cfgp2p_generate_bss_mac(struct bcm_cfg80211 *cfg, struct ether_addr *primary_addr)
+{
+       struct ether_addr *mac_addr = wl_to_p2p_bss_macaddr(cfg, P2PAPI_BSSCFG_DEVICE);
+       struct ether_addr *int_addr;
+
+       memcpy(mac_addr, primary_addr, sizeof(struct ether_addr));
+       mac_addr->octet[0] |= 0x02;
+       WL_DBG(("P2P Discovery address:"MACDBG "\n", MAC2STRDBG(mac_addr->octet)));
+
+       int_addr = wl_to_p2p_bss_macaddr(cfg, P2PAPI_BSSCFG_CONNECTION1);
+       memcpy(int_addr, mac_addr, sizeof(struct ether_addr));
+       int_addr->octet[3] ^= 0x80;
+       WL_DBG(("Primary P2P Interface address:"MACDBG "\n", MAC2STRDBG(int_addr->octet)));
+
+       int_addr = wl_to_p2p_bss_macaddr(cfg, P2PAPI_BSSCFG_CONNECTION2);
+       memcpy(int_addr, mac_addr, sizeof(struct ether_addr));
+       int_addr->octet[3] ^= 0x90;
+}
+
+/* P2P IF Address change to Virtual Interface MAC Address */
+void
+wl_cfg80211_change_ifaddr(u8* buf, struct ether_addr *p2p_int_addr, u8 element_id)
+{
+       wifi_p2p_ie_t *ie = (wifi_p2p_ie_t*) buf;
+       u16 len = ie->len;
+       u8 *subel;
+       u8 subelt_id;
+       u16 subelt_len;
+       CFGP2P_DBG((" Enter\n"));
+
+       /* Point subel to the P2P IE's subelt field.
+        * Subtract the preceding fields (id, len, OUI, oui_type) from the length.
+        */
+       subel = ie->subelts;
+       len -= 4;       /* exclude OUI + OUI_TYPE */
+
+       while (len >= 3) {
+       /* attribute id */
+               subelt_id = *subel;
+               subel += 1;
+               len -= 1;
+
+               /* 2-byte little endian */
+               subelt_len = *subel++;
+               subelt_len |= *subel++ << 8;
+
+               len -= 2;
+               len -= subelt_len;      /* for the remaining subelt fields */
+
+               if (subelt_id == element_id) {
+                       if (subelt_id == P2P_SEID_INTINTADDR) {
+                               memcpy(subel, p2p_int_addr->octet, ETHER_ADDR_LEN);
+                               CFGP2P_INFO(("Intended P2P Interface Address ATTR FOUND\n"));
+                       } else if (subelt_id == P2P_SEID_DEV_ID) {
+                               memcpy(subel, p2p_int_addr->octet, ETHER_ADDR_LEN);
+                               CFGP2P_INFO(("Device ID ATTR FOUND\n"));
+                       } else if (subelt_id == P2P_SEID_DEV_INFO) {
+                               memcpy(subel, p2p_int_addr->octet, ETHER_ADDR_LEN);
+                               CFGP2P_INFO(("Device INFO ATTR FOUND\n"));
+                       } else if (subelt_id == P2P_SEID_GROUP_ID) {
+                               memcpy(subel, p2p_int_addr->octet, ETHER_ADDR_LEN);
+                               CFGP2P_INFO(("GROUP ID ATTR FOUND\n"));
+                       }                       return;
+               } else {
+                       CFGP2P_DBG(("OTHER id : %d\n", subelt_id));
+               }
+               subel += subelt_len;
+       }
+}
+/*
+ * Check if a BSS is up.
+ * This is a common implementation called by most OSL implementations of
+ * p2posl_bss_isup().  DO NOT call this function directly from the
+ * common code -- call p2posl_bss_isup() instead to allow the OSL to
+ * override the common implementation if necessary.
+ */
+bool
+wl_cfgp2p_bss_isup(struct net_device *ndev, int bsscfg_idx)
+{
+       s32 result, val;
+       bool isup = false;
+       s8 getbuf[64];
+
+       /* Check if the BSS is up */
+       *(int*)getbuf = -1;
+       result = wldev_iovar_getbuf_bsscfg(ndev, "bss", &bsscfg_idx,
+               sizeof(bsscfg_idx), getbuf, sizeof(getbuf), 0, NULL);
+       if (result != 0) {
+               CFGP2P_ERR(("'cfg bss -C %d' failed: %d\n", bsscfg_idx, result));
+               CFGP2P_ERR(("NOTE: this ioctl error is normal "
+                                       "when the BSS has not been created yet.\n"));
+       } else {
+               val = *(int*)getbuf;
+               val = dtoh32(val);
+               CFGP2P_INFO(("---cfg bss -C %d   ==> %d\n", bsscfg_idx, val));
+               isup = (val ? TRUE : FALSE);
+       }
+       return isup;
+}
+
+
+/* Bring up or down a BSS */
+s32
+wl_cfgp2p_bss(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32 bsscfg_idx, s32 is_up)
+{
+       s32 ret = BCME_OK;
+       s32 val = is_up ? 1 : 0;
+
+       struct {
+               s32 cfg;
+               s32 val;
+       } bss_setbuf;
+
+       bss_setbuf.cfg = htod32(bsscfg_idx);
+       bss_setbuf.val = htod32(val);
+       CFGP2P_INFO(("---cfg bss -C %d %s\n", bsscfg_idx, is_up ? "up" : "down"));
+       ret = wldev_iovar_setbuf(ndev, "bss", &bss_setbuf, sizeof(bss_setbuf),
+               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+
+       if (ret != 0) {
+               CFGP2P_ERR(("'bss %d' failed with %d\n", is_up, ret));
+       }
+
+       return ret;
+}
+
+/* Check if 'p2p' is supported in the driver */
+s32
+wl_cfgp2p_supported(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+       s32 ret = BCME_OK;
+       s32 p2p_supported = 0;
+       ret = wldev_iovar_getint(ndev, "p2p",
+                      &p2p_supported);
+       if (ret < 0) {
+               if (ret == BCME_UNSUPPORTED) {
+                       CFGP2P_INFO(("p2p is unsupported\n"));
+                       return 0;
+               } else {
+                       CFGP2P_ERR(("cfg p2p error %d\n", ret));
+                       return ret;
+               }
+       }
+       if (p2p_supported == 1) {
+               CFGP2P_INFO(("p2p is supported\n"));
+       } else {
+               CFGP2P_INFO(("p2p is unsupported\n"));
+               p2p_supported = 0;
+       }
+       return p2p_supported;
+}
+/* Cleanup P2P resources */
+s32
+wl_cfgp2p_down(struct bcm_cfg80211 *cfg)
+{
+       struct net_device *ndev = NULL;
+       struct wireless_dev *wdev = NULL;
+       s32 i = 0, index = -1;
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+       ndev = bcmcfg_to_prmry_ndev(cfg);
+       wdev = bcmcfg_to_p2p_wdev(cfg);
+#elif defined(WL_ENABLE_P2P_IF)
+       ndev = cfg->p2p_net ? cfg->p2p_net : bcmcfg_to_prmry_ndev(cfg);
+       wdev = ndev_to_wdev(ndev);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+       wl_cfgp2p_cancel_listen(cfg, ndev, wdev, TRUE);
+       wl_cfgp2p_disable_discovery(cfg);
+
+#if defined(WL_CFG80211_P2P_DEV_IF) && !defined(KEEP_WIFION_OPTION)
+       if (cfg->p2p_wdev) {
+               /* If p2p wdev is left out, clean it up */
+               WL_ERR(("Clean up the p2p discovery IF\n"));
+               wl_cfgp2p_del_p2p_disc_if(cfg->p2p_wdev, cfg);
+       }
+#endif /* WL_CFG80211_P2P_DEV_IF !defined(KEEP_WIFION_OPTION) */
+
+       for (i = 0; i < P2PAPI_BSSCFG_MAX; i++) {
+                       index = wl_to_p2p_bss_bssidx(cfg, i);
+                       if (index != WL_INVALID)
+                               wl_cfg80211_clear_per_bss_ies(cfg, index);
+       }
+       wl_cfgp2p_deinit_priv(cfg);
+       return 0;
+}
+
+int wl_cfgp2p_vif_created(struct bcm_cfg80211 *cfg)
+{
+       if (cfg->p2p && ((wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_CONNECTION1) != -1) ||
+               (wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_CONNECTION2) != -1)))
+               return true;
+       else
+               return false;
+
+}
+
+s32
+wl_cfgp2p_set_p2p_noa(struct bcm_cfg80211 *cfg, struct net_device *ndev, char* buf, int len)
+{
+       s32 ret = -1;
+       int count, start, duration;
+       wl_p2p_sched_t dongle_noa;
+       s32 bssidx, type;
+       int iovar_len = sizeof(dongle_noa);
+       CFGP2P_DBG((" Enter\n"));
+
+       memset(&dongle_noa, 0, sizeof(dongle_noa));
+
+       if (wl_cfgp2p_vif_created(cfg)) {
+               cfg->p2p->noa.desc[0].start = 0;
+
+               sscanf(buf, "%10d %10d %10d", &count, &start, &duration);
+               CFGP2P_DBG(("set_p2p_noa count %d start %d duration %d\n",
+                       count, start, duration));
+               if (count != -1)
+                       cfg->p2p->noa.desc[0].count = count;
+
+               /* supplicant gives interval as start */
+               if (start != -1)
+                       cfg->p2p->noa.desc[0].interval = start;
+
+               if (duration != -1)
+                       cfg->p2p->noa.desc[0].duration = duration;
+
+               if (cfg->p2p->noa.desc[0].count != 255 && cfg->p2p->noa.desc[0].count != 0) {
+                       cfg->p2p->noa.desc[0].start = 200;
+                       dongle_noa.type = WL_P2P_SCHED_TYPE_REQ_ABS;
+                       dongle_noa.action = WL_P2P_SCHED_ACTION_GOOFF;
+                       dongle_noa.option = WL_P2P_SCHED_OPTION_TSFOFS;
+               }
+               else if (cfg->p2p->noa.desc[0].count == 0) {
+                       cfg->p2p->noa.desc[0].start = 0;
+                       dongle_noa.type = WL_P2P_SCHED_TYPE_ABS;
+                       dongle_noa.option = WL_P2P_SCHED_OPTION_NORMAL;
+                       dongle_noa.action = WL_P2P_SCHED_ACTION_RESET;
+               }
+               else {
+                       /* Continuous NoA interval. */
+                       dongle_noa.action = WL_P2P_SCHED_ACTION_DOZE;
+                       dongle_noa.type = WL_P2P_SCHED_TYPE_ABS;
+                       if ((cfg->p2p->noa.desc[0].interval == 102) ||
+                               (cfg->p2p->noa.desc[0].interval == 100)) {
+                               cfg->p2p->noa.desc[0].start = 100 -
+                                       cfg->p2p->noa.desc[0].duration;
+                               dongle_noa.option = WL_P2P_SCHED_OPTION_BCNPCT;
+                       }
+                       else {
+                               dongle_noa.option = WL_P2P_SCHED_OPTION_NORMAL;
+                       }
+               }
+               /* Put the noa descriptor in dongle format for dongle */
+               dongle_noa.desc[0].count = htod32(cfg->p2p->noa.desc[0].count);
+               if (dongle_noa.option == WL_P2P_SCHED_OPTION_BCNPCT) {
+                       dongle_noa.desc[0].start = htod32(cfg->p2p->noa.desc[0].start);
+                       dongle_noa.desc[0].duration = htod32(cfg->p2p->noa.desc[0].duration);
+               }
+               else {
+                       dongle_noa.desc[0].start = htod32(cfg->p2p->noa.desc[0].start*1000);
+                       dongle_noa.desc[0].duration = htod32(cfg->p2p->noa.desc[0].duration*1000);
+               }
+               dongle_noa.desc[0].interval = htod32(cfg->p2p->noa.desc[0].interval*1000);
+               bssidx = wl_get_bssidx_by_wdev(cfg, ndev->ieee80211_ptr);
+               if (wl_cfgp2p_find_type(cfg, bssidx, &type) != BCME_OK)
+                       return BCME_ERROR;
+
+               if (dongle_noa.action == WL_P2P_SCHED_ACTION_RESET) {
+                       iovar_len -= sizeof(wl_p2p_sched_desc_t);
+               }
+
+               ret = wldev_iovar_setbuf(wl_to_p2p_bss_ndev(cfg, type),
+                       "p2p_noa", &dongle_noa, iovar_len, cfg->ioctl_buf,
+                       WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+
+               if (ret < 0) {
+                       CFGP2P_ERR(("fw set p2p_noa failed %d\n", ret));
+               }
+       }
+       else {
+               CFGP2P_ERR(("ERROR: set_noa in non-p2p mode\n"));
+       }
+       return ret;
+}
+s32
+wl_cfgp2p_get_p2p_noa(struct bcm_cfg80211 *cfg, struct net_device *ndev, char* buf, int buf_len)
+{
+
+       wifi_p2p_noa_desc_t *noa_desc;
+       int len = 0, i;
+       char _buf[200];
+
+       CFGP2P_DBG((" Enter\n"));
+       buf[0] = '\0';
+       if (wl_cfgp2p_vif_created(cfg)) {
+               if (cfg->p2p->noa.desc[0].count || cfg->p2p->ops.ops) {
+                       _buf[0] = 1; /* noa index */
+                       _buf[1] = (cfg->p2p->ops.ops ? 0x80: 0) |
+                               (cfg->p2p->ops.ctw & 0x7f); /* ops + ctw */
+                       len += 2;
+                       if (cfg->p2p->noa.desc[0].count) {
+                               noa_desc = (wifi_p2p_noa_desc_t*)&_buf[len];
+                               noa_desc->cnt_type = cfg->p2p->noa.desc[0].count;
+                               noa_desc->duration = cfg->p2p->noa.desc[0].duration;
+                               noa_desc->interval = cfg->p2p->noa.desc[0].interval;
+                               noa_desc->start = cfg->p2p->noa.desc[0].start;
+                               len += sizeof(wifi_p2p_noa_desc_t);
+                       }
+                       if (buf_len <= len * 2) {
+                               CFGP2P_ERR(("ERROR: buf_len %d in not enough for"
+                                       "returning noa in string format\n", buf_len));
+                               return -1;
+                       }
+                       /* We have to convert the buffer data into ASCII strings */
+                       for (i = 0; i < len; i++) {
+                               snprintf(buf, 3, "%02x", _buf[i]);
+                               buf += 2;
+                       }
+                       buf[i*2] = '\0';
+               }
+       }
+       else {
+               CFGP2P_ERR(("ERROR: get_noa in non-p2p mode\n"));
+               return -1;
+       }
+       return len * 2;
+}
+s32
+wl_cfgp2p_set_p2p_ps(struct bcm_cfg80211 *cfg, struct net_device *ndev, char* buf, int len)
+{
+       int ps, ctw;
+       int ret = -1;
+       s32 legacy_ps;
+       s32 conn_idx;
+       s32 bssidx;
+       struct net_device *dev;
+
+       CFGP2P_DBG((" Enter\n"));
+       if (wl_cfgp2p_vif_created(cfg)) {
+               sscanf(buf, "%10d %10d %10d", &legacy_ps, &ps, &ctw);
+               CFGP2P_DBG((" Enter legacy_ps %d ps %d ctw %d\n", legacy_ps, ps, ctw));
+
+               bssidx = wl_get_bssidx_by_wdev(cfg, ndev->ieee80211_ptr);
+               if (wl_cfgp2p_find_type(cfg, bssidx, &conn_idx) != BCME_OK)
+                       return BCME_ERROR;
+               dev = wl_to_p2p_bss_ndev(cfg, conn_idx);
+               if (ctw != -1) {
+                       cfg->p2p->ops.ctw = ctw;
+                       ret = 0;
+               }
+               if (ps != -1) {
+                       cfg->p2p->ops.ops = ps;
+                       ret = wldev_iovar_setbuf(dev,
+                               "p2p_ops", &cfg->p2p->ops, sizeof(cfg->p2p->ops),
+                               cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+                       if (ret < 0) {
+                               CFGP2P_ERR(("fw set p2p_ops failed %d\n", ret));
+                       }
+               }
+
+               if ((legacy_ps != -1) && ((legacy_ps == PM_MAX) || (legacy_ps == PM_OFF))) {
+                       ret = wldev_ioctl(dev,
+                               WLC_SET_PM, &legacy_ps, sizeof(legacy_ps), true);
+                       if (unlikely(ret))
+                               CFGP2P_ERR(("error (%d)\n", ret));
+                       wl_cfg80211_update_power_mode(dev);
+               }
+               else
+                       CFGP2P_ERR(("ilegal setting\n"));
+       }
+       else {
+               CFGP2P_ERR(("ERROR: set_p2p_ps in non-p2p mode\n"));
+               ret = -1;
+       }
+       return ret;
+}
+
+s32
+wl_cfgp2p_set_p2p_ecsa(struct bcm_cfg80211 *cfg, struct net_device *ndev, char* buf, int len)
+{
+       int ch, bw;
+       s32 conn_idx;
+       s32 bssidx;
+       struct net_device *dev;
+       char smbuf[WLC_IOCTL_SMLEN];
+       wl_chan_switch_t csa_arg;
+       u32 chnsp = 0;
+       int err = 0;
+
+       CFGP2P_DBG((" Enter\n"));
+       if (wl_cfgp2p_vif_created(cfg)) {
+               sscanf(buf, "%10d %10d", &ch, &bw);
+               CFGP2P_DBG(("Enter ch %d bw %d\n", ch, bw));
+
+               bssidx = wl_get_bssidx_by_wdev(cfg, ndev->ieee80211_ptr);
+               if (wl_cfgp2p_find_type(cfg, bssidx, &conn_idx) != BCME_OK) {
+                       return BCME_ERROR;
+               }
+               dev = wl_to_p2p_bss_ndev(cfg, conn_idx);
+               if (ch <= 0 || bw <= 0) {
+                       CFGP2P_ERR(("Negative value not permitted!\n"));
+                       return BCME_ERROR;
+               }
+
+               csa_arg.mode = DOT11_CSA_MODE_ADVISORY;
+               csa_arg.count = P2P_ECSA_CNT;
+               csa_arg.reg = 0;
+
+               sprintf(buf, "%d/%d", ch, bw);
+               chnsp = wf_chspec_aton(buf);
+               if (chnsp == 0) {
+                       CFGP2P_ERR(("%s:chsp is not correct\n", __FUNCTION__));
+                       return BCME_ERROR;
+               }
+               chnsp = wl_chspec_host_to_driver(chnsp);
+               csa_arg.chspec = chnsp;
+
+               err = wldev_iovar_setbuf(dev, "csa", &csa_arg, sizeof(csa_arg),
+                       smbuf, sizeof(smbuf), NULL);
+               if (err) {
+                       CFGP2P_ERR(("%s:set p2p_ecsa failed:%d\n", __FUNCTION__, err));
+                       return BCME_ERROR;
+               }
+       } else {
+               CFGP2P_ERR(("ERROR: set_p2p_ecsa in non-p2p mode\n"));
+               return BCME_ERROR;
+       }
+       return BCME_OK;
+}
+
+s32
+wl_cfgp2p_increase_p2p_bw(struct bcm_cfg80211 *cfg, struct net_device *ndev, char* buf, int len)
+{
+       int algo;
+       int bw;
+       int ret = BCME_OK;
+
+
+       sscanf(buf, "%3d", &bw);
+       if (bw == 0) {
+               algo = 0;
+               ret = wldev_iovar_setbuf(ndev, "mchan_algo", &algo, sizeof(algo), cfg->ioctl_buf,
+                               WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+               if (ret < 0) {
+                       CFGP2P_ERR(("fw set mchan_algo failed %d\n", ret));
+                       return BCME_ERROR;
+               }
+       } else {
+               algo = 1;
+               ret = wldev_iovar_setbuf(ndev, "mchan_algo", &algo, sizeof(algo), cfg->ioctl_buf,
+                               WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+               if (ret < 0) {
+                       CFGP2P_ERR(("fw set mchan_algo failed %d\n", ret));
+                       return BCME_ERROR;
+               }
+               ret = wldev_iovar_setbuf(ndev, "mchan_bw", &bw, sizeof(algo), cfg->ioctl_buf,
+                               WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+               if (ret < 0) {
+                       CFGP2P_ERR(("fw set mchan_bw failed %d\n", ret));
+                       return BCME_ERROR;
+               }
+       }
+       return BCME_OK;
+}
+
+u8 *
+wl_cfgp2p_retreive_p2pattrib(void *buf, u8 element_id)
+{
+       wifi_p2p_ie_t *ie = NULL;
+       u16 len = 0;
+       u8 *subel;
+       u8 subelt_id;
+       u16 subelt_len;
+
+       if (!buf) {
+               WL_ERR(("P2P IE not present"));
+               return 0;
+       }
+
+       ie = (wifi_p2p_ie_t*) buf;
+       len = ie->len;
+
+       /* Point subel to the P2P IE's subelt field.
+        * Subtract the preceding fields (id, len, OUI, oui_type) from the length.
+        */
+       subel = ie->subelts;
+       len -= 4;       /* exclude OUI + OUI_TYPE */
+
+       while (len >= 3) {
+               /* attribute id */
+               subelt_id = *subel;
+               subel += 1;
+               len -= 1;
+
+               /* 2-byte little endian */
+               subelt_len = *subel++;
+               subelt_len |= *subel++ << 8;
+
+               len -= 2;
+               len -= subelt_len;      /* for the remaining subelt fields */
+
+               if (subelt_id == element_id) {
+                       /* This will point to start of subelement attrib after
+                        * attribute id & len
+                        */
+                       return subel;
+               }
+
+               /* Go to next subelement */
+               subel += subelt_len;
+       }
+
+       /* Not Found */
+       return NULL;
+}
+
+#define P2P_GROUP_CAPAB_GO_BIT 0x01
+
+u8*
+wl_cfgp2p_find_attrib_in_all_p2p_Ies(u8 *parse, u32 len, u32 attrib)
+{
+       bcm_tlv_t *ie;
+       u8* pAttrib;
+
+       CFGP2P_INFO(("Starting parsing parse %p attrib %d remaining len %d ", parse, attrib, len));
+       while ((ie = bcm_parse_tlvs(parse, (int)len, DOT11_MNG_VS_ID))) {
+               if (wl_cfgp2p_is_p2p_ie((uint8*)ie, &parse, &len) == TRUE) {
+                       /* Have the P2p ie. Now check for attribute */
+                       if ((pAttrib = wl_cfgp2p_retreive_p2pattrib(parse, attrib)) != NULL) {
+                               CFGP2P_INFO(("P2P attribute %d was found at parse %p",
+                                       attrib, parse));
+                               return pAttrib;
+                       }
+                       else {
+                               parse += (ie->len + TLV_HDR_LEN);
+                               len -= (ie->len + TLV_HDR_LEN);
+                               CFGP2P_INFO(("P2P Attribute %d not found Moving parse"
+                                       " to %p len to %d", attrib, parse, len));
+                       }
+               }
+               else {
+                       /* It was not p2p IE. parse will get updated automatically to next TLV */
+                       CFGP2P_INFO(("IT was NOT P2P IE parse %p len %d", parse, len));
+               }
+       }
+       CFGP2P_ERR(("P2P attribute %d was NOT found", attrib));
+       return NULL;
+}
+
+u8 *
+wl_cfgp2p_retreive_p2p_dev_addr(wl_bss_info_t *bi, u32 bi_length)
+{
+       u8 *capability = NULL;
+       bool p2p_go     = 0;
+       u8 *ptr = NULL;
+
+       if ((capability = wl_cfgp2p_find_attrib_in_all_p2p_Ies(((u8 *) bi) + bi->ie_offset,
+       bi->ie_length, P2P_SEID_P2P_INFO)) == NULL) {
+               WL_ERR(("P2P Capability attribute not found"));
+               return NULL;
+       }
+
+       /* Check Group capability for Group Owner bit */
+       p2p_go = capability[1] & P2P_GROUP_CAPAB_GO_BIT;
+       if (!p2p_go) {
+               return bi->BSSID.octet;
+       }
+
+       /* In probe responses, DEVICE INFO attribute will be present */
+       if (!(ptr = wl_cfgp2p_find_attrib_in_all_p2p_Ies(((u8 *) bi) + bi->ie_offset,
+       bi->ie_length,  P2P_SEID_DEV_INFO))) {
+               /* If DEVICE_INFO is not found, this might be a beacon frame.
+                * check for DEVICE_ID in the beacon frame.
+                */
+               ptr = wl_cfgp2p_find_attrib_in_all_p2p_Ies(((u8 *) bi) + bi->ie_offset,
+               bi->ie_length,  P2P_SEID_DEV_ID);
+       }
+
+       if (!ptr)
+               WL_ERR((" Both DEVICE_ID & DEVICE_INFO attribute not present in P2P IE "));
+
+       return ptr;
+}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24)
+static void
+wl_cfgp2p_ethtool_get_drvinfo(struct net_device *net, struct ethtool_drvinfo *info)
+{
+       snprintf(info->driver, sizeof(info->driver), "p2p");
+       snprintf(info->version, sizeof(info->version), "%lu", (unsigned long)(0));
+}
+
+struct ethtool_ops cfgp2p_ethtool_ops = {
+       .get_drvinfo = wl_cfgp2p_ethtool_get_drvinfo
+};
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24) */
+
+#if defined(WL_ENABLE_P2P_IF)
+s32
+wl_cfgp2p_register_ndev(struct bcm_cfg80211 *cfg)
+{
+       int ret = 0;
+       struct net_device* net = NULL;
+       struct wireless_dev *wdev = NULL;
+       uint8 temp_addr[ETHER_ADDR_LEN] = { 0x00, 0x90, 0x4c, 0x33, 0x22, 0x11 };
+
+       if (cfg->p2p_net) {
+               CFGP2P_ERR(("p2p_net defined already.\n"));
+               return -EINVAL;
+       }
+
+       /* Allocate etherdev, including space for private structure */
+       if (!(net = alloc_etherdev(sizeof(struct bcm_cfg80211 *)))) {
+               CFGP2P_ERR(("%s: OOM - alloc_etherdev\n", __FUNCTION__));
+               return -ENODEV;
+       }
+
+       wdev = kzalloc(sizeof(*wdev), GFP_KERNEL);
+       if (unlikely(!wdev)) {
+               WL_ERR(("Could not allocate wireless device\n"));
+               free_netdev(net);
+               return -ENOMEM;
+       }
+
+       strncpy(net->name, "p2p%d", sizeof(net->name) - 1);
+       net->name[IFNAMSIZ - 1] = '\0';
+
+       /* Copy the reference to bcm_cfg80211 */
+       memcpy((void *)netdev_priv(net), &cfg, sizeof(struct bcm_cfg80211 *));
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31))
+       ASSERT(!net->open);
+       net->do_ioctl = wl_cfgp2p_do_ioctl;
+       net->hard_start_xmit = wl_cfgp2p_start_xmit;
+       net->open = wl_cfgp2p_if_open;
+       net->stop = wl_cfgp2p_if_stop;
+#else
+       ASSERT(!net->netdev_ops);
+       net->netdev_ops = &wl_cfgp2p_if_ops;
+#endif
+
+       /* Register with a dummy MAC addr */
+       memcpy(net->dev_addr, temp_addr, ETHER_ADDR_LEN);
+
+       wdev->wiphy = cfg->wdev->wiphy;
+
+       wdev->iftype = wl_mode_to_nl80211_iftype(WL_MODE_BSS);
+
+       net->ieee80211_ptr = wdev;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24)
+       net->ethtool_ops = &cfgp2p_ethtool_ops;
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24) */
+
+       SET_NETDEV_DEV(net, wiphy_dev(wdev->wiphy));
+
+       /* Associate p2p0 network interface with new wdev */
+       wdev->netdev = net;
+
+       ret = register_netdev(net);
+       if (ret) {
+               CFGP2P_ERR((" register_netdevice failed (%d)\n", ret));
+               free_netdev(net);
+               kfree(wdev);
+               return -ENODEV;
+       }
+
+       /* store p2p net ptr for further reference. Note that iflist won't have this
+        * entry as there corresponding firmware interface is a "Hidden" interface.
+        */
+       cfg->p2p_wdev = wdev;
+       cfg->p2p_net = net;
+
+       printk("%s: P2P Interface Registered\n", net->name);
+
+       return ret;
+}
+
+s32
+wl_cfgp2p_unregister_ndev(struct bcm_cfg80211 *cfg)
+{
+
+       if (!cfg || !cfg->p2p_net) {
+               CFGP2P_ERR(("Invalid Ptr\n"));
+               return -EINVAL;
+       }
+
+       unregister_netdev(cfg->p2p_net);
+       free_netdev(cfg->p2p_net);
+
+       return 0;
+}
+static int wl_cfgp2p_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+{
+
+       if (skb)
+       {
+               CFGP2P_DBG(("(%s) is not used for data operations.Droping the packet.\n",
+                       ndev->name));
+               dev_kfree_skb_any(skb);
+       }
+
+       return 0;
+}
+
+static int wl_cfgp2p_do_ioctl(struct net_device *net, struct ifreq *ifr, int cmd)
+{
+       int ret = 0;
+       struct bcm_cfg80211 *cfg = *(struct bcm_cfg80211 **)netdev_priv(net);
+       struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+
+       /* There is no ifidx corresponding to p2p0 in our firmware. So we should
+        * not Handle any IOCTL cmds on p2p0 other than ANDROID PRIVATE CMDs.
+        * For Android PRIV CMD handling map it to primary I/F
+        */
+       if (cmd == SIOCDEVPRIVATE+1) {
+               ret = wl_android_priv_cmd(ndev, ifr, cmd);
+
+       } else {
+               CFGP2P_ERR(("%s: IOCTL req 0x%x on p2p0 I/F. Ignoring. \n",
+               __FUNCTION__, cmd));
+               return -1;
+       }
+
+       return ret;
+}
+#endif 
+
+#if defined(WL_ENABLE_P2P_IF)
+static int wl_cfgp2p_if_open(struct net_device *net)
+{
+       struct wireless_dev *wdev = net->ieee80211_ptr;
+
+       if (!wdev || !wl_cfg80211_is_p2p_active(wdev))
+               return -EINVAL;
+       WL_TRACE(("Enter\n"));
+#if !defined(WL_IFACE_COMB_NUM_CHANNELS)
+       /* If suppose F/W download (ifconfig wlan0 up) hasn't been done by now,
+        * do it here. This will make sure that in concurrent mode, supplicant
+        * is not dependent on a particular order of interface initialization.
+        * i.e you may give wpa_supp -iwlan0 -N -ip2p0 or wpa_supp -ip2p0 -N
+        * -iwlan0.
+        */
+       wdev->wiphy->interface_modes |= (BIT(NL80211_IFTYPE_P2P_CLIENT)
+               | BIT(NL80211_IFTYPE_P2P_GO));
+#endif /* !WL_IFACE_COMB_NUM_CHANNELS */
+       wl_cfg80211_do_driver_init(net);
+
+       return 0;
+}
+
+static int wl_cfgp2p_if_stop(struct net_device *net)
+{
+       struct wireless_dev *wdev = net->ieee80211_ptr;
+
+       if (!wdev)
+               return -EINVAL;
+
+       wl_cfg80211_scan_stop(net);
+
+#if !defined(WL_IFACE_COMB_NUM_CHANNELS)
+       wdev->wiphy->interface_modes = (wdev->wiphy->interface_modes)
+                                       & (~(BIT(NL80211_IFTYPE_P2P_CLIENT)|
+                                       BIT(NL80211_IFTYPE_P2P_GO)));
+#endif /* !WL_IFACE_COMB_NUM_CHANNELS */
+       return 0;
+}
+
+bool wl_cfgp2p_is_ifops(const struct net_device_ops *if_ops)
+{
+       return (if_ops == &wl_cfgp2p_if_ops);
+}
+#endif /* WL_ENABLE_P2P_IF */
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+struct wireless_dev *
+wl_cfgp2p_add_p2p_disc_if(struct bcm_cfg80211 *cfg)
+{
+       struct wireless_dev *wdev = NULL;
+       struct ether_addr primary_mac;
+
+       if (!cfg || !cfg->p2p_supported)
+               return ERR_PTR(-EINVAL);
+
+       WL_TRACE(("Enter\n"));
+
+       if (cfg->p2p_wdev) {
+#ifndef EXPLICIT_DISCIF_CLEANUP
+               dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+#endif /* EXPLICIT_DISCIF_CLEANUP */
+               /*
+                * This is not expected. This can happen due to
+                * supplicant crash/unclean de-initialization which
+                * didn't free the p2p discovery interface. Indicate
+                * driver hang to user space so that the framework
+                * can rei-init the Wi-Fi.
+                */
+               CFGP2P_ERR(("p2p_wdev defined already.\n"));
+               wl_probe_wdev_all(cfg);
+#ifdef EXPLICIT_DISCIF_CLEANUP
+               /*
+                * CUSTOMER_HW4 design doesn't delete the p2p discovery
+                * interface on ifconfig wlan0 down context which comes
+                * without a preceeding NL80211_CMD_DEL_INTERFACE for p2p
+                * discovery. But during supplicant crash the DEL_IFACE
+                * command will not happen and will cause a left over iface
+                * even after ifconfig wlan0 down. So delete the iface
+                * first and then indicate the HANG event
+                */
+               wl_cfgp2p_del_p2p_disc_if(cfg->p2p_wdev, cfg);
+#else
+               dhd->hang_reason = HANG_REASON_P2P_IFACE_DEL_FAILURE;
+               net_os_send_hang_message(bcmcfg_to_prmry_ndev(cfg));
+               return ERR_PTR(-ENODEV);
+#endif /* EXPLICIT_DISCIF_CLEANUP */
+       }
+
+       wdev = kzalloc(sizeof(*wdev), GFP_KERNEL);
+       if (unlikely(!wdev)) {
+               WL_ERR(("Could not allocate wireless device\n"));
+               return ERR_PTR(-ENOMEM);
+       }
+
+       memset(&primary_mac, 0, sizeof(primary_mac));
+       get_primary_mac(cfg, &primary_mac);
+       wl_cfgp2p_generate_bss_mac(cfg, &primary_mac);
+
+       wdev->wiphy = cfg->wdev->wiphy;
+       wdev->iftype = NL80211_IFTYPE_P2P_DEVICE;
+       memcpy(wdev->address, wl_to_p2p_bss_macaddr(cfg, P2PAPI_BSSCFG_DEVICE), ETHER_ADDR_LEN);
+
+
+       /* store p2p wdev ptr for further reference. */
+       cfg->p2p_wdev = wdev;
+
+       CFGP2P_ERR(("P2P interface registered\n"));
+#ifdef DHD_IFDEBUG
+       WL_ERR(("%s: wdev: %p, wdev->net: %p\n", __FUNCTION__, wdev, wdev->netdev));
+#endif
+       return wdev;
+}
+
+int
+wl_cfgp2p_start_p2p_device(struct wiphy *wiphy, struct wireless_dev *wdev)
+{
+       int ret = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+
+       if (!cfg)
+               return -EINVAL;
+
+       WL_TRACE(("Enter\n"));
+
+       ret = wl_cfgp2p_set_firm_p2p(cfg);
+       if (unlikely(ret < 0)) {
+               CFGP2P_ERR(("Set P2P in firmware failed, ret=%d\n", ret));
+               goto exit;
+       }
+
+       ret = wl_cfgp2p_enable_discovery(cfg, bcmcfg_to_prmry_ndev(cfg), NULL, 0);
+       if (unlikely(ret < 0)) {
+               CFGP2P_ERR(("P2P enable discovery failed, ret=%d\n", ret));
+               goto exit;
+       }
+
+       p2p_on(cfg) = true;
+#if defined(P2P_IE_MISSING_FIX)
+       cfg->p2p_prb_noti = false;
+#endif
+
+       CFGP2P_DBG(("P2P interface started\n"));
+
+exit:
+       return ret;
+}
+
+void
+wl_cfgp2p_stop_p2p_device(struct wiphy *wiphy, struct wireless_dev *wdev)
+{
+       int ret = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+
+       if (!cfg)
+               return;
+
+       CFGP2P_DBG(("Enter\n"));
+
+       ret = wl_cfg80211_scan_stop(wdev);
+       if (unlikely(ret < 0)) {
+               CFGP2P_ERR(("P2P scan stop failed, ret=%d\n", ret));
+       }
+
+       if (!cfg->p2p)
+               return;
+
+       ret = wl_cfgp2p_disable_discovery(cfg);
+       if (unlikely(ret < 0)) {
+               CFGP2P_ERR(("P2P disable discovery failed, ret=%d\n", ret));
+       }
+
+       p2p_on(cfg) = false;
+
+       CFGP2P_DBG(("Exit. P2P interface stopped\n"));
+
+       return;
+}
+
+int
+wl_cfgp2p_del_p2p_disc_if(struct wireless_dev *wdev, struct bcm_cfg80211 *cfg)
+{
+       bool rollback_lock = false;
+
+       if (!wdev)
+               return -EINVAL;
+
+       WL_TRACE(("Enter\n"));
+#ifdef DHD_IFDEBUG
+       WL_ERR(("%s: wdev: %p, wdev->net: %p\n", __FUNCTION__, wdev, wdev->netdev));
+#endif
+
+       if (!rtnl_is_locked()) {
+               rtnl_lock();
+               rollback_lock = true;
+       }
+
+       cfg80211_unregister_wdev(wdev);
+
+       if (rollback_lock)
+               rtnl_unlock();
+
+       synchronize_rcu();
+
+       kfree(wdev);
+
+       if (cfg)
+               cfg->p2p_wdev = NULL;
+
+       CFGP2P_ERR(("P2P interface unregistered\n"));
+
+       return 0;
+}
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+void
+wl_cfgp2p_need_wait_actfrmae(struct bcm_cfg80211 *cfg, void *frame, u32 frame_len, bool tx)
+{
+       wifi_p2p_pub_act_frame_t *pact_frm;
+       int status = 0;
+
+       if (!frame || (frame_len < (sizeof(*pact_frm) + WL_P2P_AF_STATUS_OFFSET - 1))) {
+               return;
+       }
+
+       if (wl_cfgp2p_is_pub_action(frame, frame_len)) {
+               pact_frm = (wifi_p2p_pub_act_frame_t *)frame;
+               if (pact_frm->subtype == P2P_PAF_GON_RSP && tx) {
+                       CFGP2P_ACTION(("Check TX P2P Group Owner Negotiation Rsp Frame status\n"));
+                       status = pact_frm->elts[WL_P2P_AF_STATUS_OFFSET];
+                       if (status) {
+                               cfg->need_wait_afrx = false;
+                               return;
+                       }
+               }
+       }
+
+       cfg->need_wait_afrx = true;
+       return;
+}
+
+int
+wl_cfgp2p_is_p2p_specific_scan(struct cfg80211_scan_request *request)
+{
+       if (request && (request->n_ssids == 1) &&
+               (request->n_channels == 1) &&
+               IS_P2P_SSID(request->ssids[0].ssid, WL_P2P_WILDCARD_SSID_LEN) &&
+               (request->ssids[0].ssid_len > WL_P2P_WILDCARD_SSID_LEN)) {
+               return true;
+       }
+       return false;
+}
diff --git a/drivers/net/wireless/bcmdhd_1363/wl_cfgp2p.h b/drivers/net/wireless/bcmdhd_1363/wl_cfgp2p.h
new file mode 100644 (file)
index 0000000..42b2932
--- /dev/null
@@ -0,0 +1,446 @@
+/*
+ * Linux cfgp2p driver
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: wl_cfgp2p.h 635563 2016-05-04 09:26:53Z $
+ */
+#ifndef _wl_cfgp2p_h_
+#define _wl_cfgp2p_h_
+#include <proto/802.11.h>
+#include <proto/p2p.h>
+
+struct bcm_cfg80211;
+extern u32 wl_dbg_level;
+
+typedef struct wifi_p2p_ie wifi_wfd_ie_t;
+/* Enumeration of the usages of the BSSCFGs used by the P2P Library.  Do not
+ * confuse this with a bsscfg index.  This value is an index into the
+ * saved_ie[] array of structures which in turn contains a bsscfg index field.
+ */
+typedef enum {
+       P2PAPI_BSSCFG_PRIMARY, /* maps to driver's primary bsscfg */
+       P2PAPI_BSSCFG_DEVICE, /* maps to driver's P2P device discovery bsscfg */
+       P2PAPI_BSSCFG_CONNECTION1, /* maps to driver's P2P connection bsscfg */
+       P2PAPI_BSSCFG_CONNECTION2,
+       P2PAPI_BSSCFG_MAX
+} p2p_bsscfg_type_t;
+
+typedef enum {
+       P2P_SCAN_PURPOSE_MIN,
+       P2P_SCAN_SOCIAL_CHANNEL, /* scan for social channel */
+       P2P_SCAN_AFX_PEER_NORMAL, /* scan for action frame search */
+       P2P_SCAN_AFX_PEER_REDUCED, /* scan for action frame search with short time */
+       P2P_SCAN_DURING_CONNECTED, /* scan during connected status */
+       P2P_SCAN_CONNECT_TRY, /* scan for connecting */
+       P2P_SCAN_NORMAL, /* scan during not-connected status */
+       P2P_SCAN_PURPOSE_MAX
+} p2p_scan_purpose_t;
+
+/* vendor ies max buffer length for probe response or beacon */
+#define VNDR_IES_MAX_BUF_LEN   1400
+/* normal vendor ies buffer length */
+#define VNDR_IES_BUF_LEN               512
+
+struct p2p_bss {
+       s32 bssidx;
+       struct net_device *dev;
+       void *private_data;
+       struct ether_addr mac_addr;
+};
+
+struct p2p_info {
+       bool on;    /* p2p on/off switch */
+       bool scan;
+       int16 search_state;
+       s8 vir_ifname[IFNAMSIZ];
+       unsigned long status;
+       struct p2p_bss bss[P2PAPI_BSSCFG_MAX];
+       struct timer_list listen_timer;
+       wl_p2p_sched_t noa;
+       wl_p2p_ops_t ops;
+       wlc_ssid_t ssid;
+       s8 p2p_go_count;
+};
+
+#define MAX_VNDR_IE_NUMBER     10
+
+struct parsed_vndr_ie_info {
+       char *ie_ptr;
+       u32 ie_len;     /* total length including id & length field */
+       vndr_ie_t vndrie;
+};
+
+struct parsed_vndr_ies {
+       u32 count;
+       struct parsed_vndr_ie_info ie_info[MAX_VNDR_IE_NUMBER];
+};
+
+/* dongle status */
+enum wl_cfgp2p_status {
+       WLP2P_STATUS_DISCOVERY_ON = 0,
+       WLP2P_STATUS_SEARCH_ENABLED,
+       WLP2P_STATUS_IF_ADDING,
+       WLP2P_STATUS_IF_DELETING,
+       WLP2P_STATUS_IF_CHANGING,
+       WLP2P_STATUS_IF_CHANGED,
+       WLP2P_STATUS_LISTEN_EXPIRED,
+       WLP2P_STATUS_ACTION_TX_COMPLETED,
+       WLP2P_STATUS_ACTION_TX_NOACK,
+       WLP2P_STATUS_SCANNING,
+       WLP2P_STATUS_GO_NEG_PHASE,
+       WLP2P_STATUS_DISC_IN_PROGRESS
+};
+
+
+#define wl_to_p2p_bss_ndev(cfg, type)          ((cfg)->p2p->bss[type].dev)
+#define wl_to_p2p_bss_bssidx(cfg, type)                ((cfg)->p2p->bss[type].bssidx)
+#define wl_to_p2p_bss_macaddr(cfg, type)     &((cfg)->p2p->bss[type].mac_addr)
+#define wl_to_p2p_bss_saved_ie(cfg, type)      ((cfg)->p2p->bss[type].saved_ie)
+#define wl_to_p2p_bss_private(cfg, type)               ((cfg)->p2p->bss[type].private_data)
+#define wl_to_p2p_bss(cfg, type)                       ((cfg)->p2p->bss[type])
+#define wl_get_p2p_status(cfg, stat) ((!(cfg)->p2p_supported) ? 0 : \
+               test_bit(WLP2P_STATUS_ ## stat, &(cfg)->p2p->status))
+#define wl_set_p2p_status(cfg, stat) ((!(cfg)->p2p_supported) ? 0 : \
+               set_bit(WLP2P_STATUS_ ## stat, &(cfg)->p2p->status))
+#define wl_clr_p2p_status(cfg, stat) ((!(cfg)->p2p_supported) ? 0 : \
+               clear_bit(WLP2P_STATUS_ ## stat, &(cfg)->p2p->status))
+#define wl_chg_p2p_status(cfg, stat) ((!(cfg)->p2p_supported) ? 0 : \
+       change_bit(WLP2P_STATUS_ ## stat, &(cfg)->p2p->status))
+#define p2p_on(cfg) ((cfg)->p2p->on)
+#define p2p_scan(cfg) ((cfg)->p2p->scan)
+#define p2p_is_on(cfg) ((cfg)->p2p && (cfg)->p2p->on)
+
+/* dword align allocation */
+#define WLC_IOCTL_MAXLEN 8192
+
+#ifdef CUSTOMER_HW4_DEBUG
+#define CFGP2P_ERROR_TEXT              "CFGP2P-INFO2) "
+#else
+#define CFGP2P_ERROR_TEXT              "CFGP2P-ERROR) "
+#endif /* CUSTOMER_HW4_DEBUG */
+
+#ifdef DHD_LOG_DUMP
+#define CFGP2P_ERR(args)                                                                       \
+       do {                                                                            \
+               if (wl_dbg_level & WL_DBG_ERR) {                                \
+                       printk(KERN_INFO CFGP2P_ERROR_TEXT "%s : ", __func__);  \
+                       printk args;                                            \
+                       dhd_log_dump_print("[%s] %s: ", \
+                       dhd_log_dump_get_timestamp(), __func__);        \
+                       dhd_log_dump_print args;        \
+               }                                                                       \
+       } while (0)
+#else
+#define CFGP2P_ERR(args)                                                                       \
+       do {                                                                            \
+               if (wl_dbg_level & WL_DBG_ERR) {                                \
+                       printk(KERN_INFO CFGP2P_ERROR_TEXT "%s : ", __func__);  \
+                       printk args;                                            \
+               }                                                                       \
+       } while (0)
+#endif /* DHD_LOG_DUMP */
+#define        CFGP2P_INFO(args)                                                                       \
+       do {                                                                            \
+               if (wl_dbg_level & WL_DBG_INFO) {                               \
+                       printk(KERN_INFO "CFGP2P-INFO) %s : ", __func__);       \
+                       printk args;                                            \
+               }                                                                       \
+       } while (0)
+#define        CFGP2P_DBG(args)                                                                \
+       do {                                                                    \
+               if (wl_dbg_level & WL_DBG_DBG) {                        \
+                       printk(KERN_DEBUG "CFGP2P-DEBUG) %s :", __func__);      \
+                       printk args;                                                    \
+               }                                                                       \
+       } while (0)
+
+#define        CFGP2P_ACTION(args)                                                             \
+       do {                                                                    \
+               if (wl_dbg_level & WL_DBG_P2P_ACTION) {                 \
+                       printk(KERN_DEBUG "CFGP2P-ACTION) %s :", __func__);     \
+                       printk args;                                                    \
+               }                                                                       \
+       } while (0)
+#define INIT_TIMER(timer, func, duration, extra_delay) \
+       do {                               \
+               init_timer(timer); \
+               timer->function = func; \
+               timer->expires = jiffies + msecs_to_jiffies(duration + extra_delay); \
+               timer->data = (unsigned long) cfg; \
+               add_timer(timer); \
+       } while (0);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)) && !defined(WL_CFG80211_P2P_DEV_IF)
+#define WL_CFG80211_P2P_DEV_IF
+
+#ifdef WL_ENABLE_P2P_IF
+#undef WL_ENABLE_P2P_IF
+#endif
+
+#ifdef WL_SUPPORT_BACKPORTED_KPATCHES
+#undef WL_SUPPORT_BACKPORTED_KPATCHES
+#endif
+#else
+#ifdef WLP2P
+#ifndef WL_ENABLE_P2P_IF
+/* Enable P2P network Interface if P2P support is enabled */
+#define WL_ENABLE_P2P_IF
+#endif /* WL_ENABLE_P2P_IF */
+#endif /* WLP2P */
+#endif /* (LINUX_VERSION >= VERSION(3, 8, 0)) */
+
+#ifndef WL_CFG80211_P2P_DEV_IF
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+#if defined(WL_ENABLE_P2P_IF) && (defined(WL_CFG80211_P2P_DEV_IF) || \
+       (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)))
+#error Disable 'WL_ENABLE_P2P_IF', if 'WL_CFG80211_P2P_DEV_IF' is enabled \
+       or kernel version is 3.8.0 or above
+#endif /* WL_ENABLE_P2P_IF && (WL_CFG80211_P2P_DEV_IF || (LINUX_VERSION >= VERSION(3, 8, 0))) */
+
+#if !defined(WLP2P) && (defined(WL_ENABLE_P2P_IF) || defined(WL_CFG80211_P2P_DEV_IF))
+#error WLP2P not defined
+#endif /* !WLP2P && (WL_ENABLE_P2P_IF || WL_CFG80211_P2P_DEV_IF) */
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+#define bcm_struct_cfgdev      struct wireless_dev
+#else
+#define bcm_struct_cfgdev      struct net_device
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+#define P2P_ECSA_CNT 50
+
+extern void
+wl_cfgp2p_listen_expired(unsigned long data);
+extern bool
+wl_cfgp2p_is_pub_action(void *frame, u32 frame_len);
+extern bool
+wl_cfgp2p_is_p2p_action(void *frame, u32 frame_len);
+extern bool
+wl_cfgp2p_is_gas_action(void *frame, u32 frame_len);
+extern bool
+wl_cfgp2p_find_gas_subtype(u8 subtype, u8* data, u32 len);
+extern bool
+wl_cfgp2p_is_p2p_gas_action(void *frame, u32 frame_len);
+extern void
+wl_cfgp2p_print_actframe(bool tx, void *frame, u32 frame_len, u32 channel);
+extern s32
+wl_cfgp2p_init_priv(struct bcm_cfg80211 *cfg);
+extern void
+wl_cfgp2p_deinit_priv(struct bcm_cfg80211 *cfg);
+extern s32
+wl_cfgp2p_set_firm_p2p(struct bcm_cfg80211 *cfg);
+extern s32
+wl_cfgp2p_set_p2p_mode(struct bcm_cfg80211 *cfg, u8 mode,
+            u32 channel, u16 listen_ms, int bssidx);
+extern s32
+wl_cfgp2p_ifadd(struct bcm_cfg80211 *cfg, struct ether_addr *mac, u8 if_type,
+            chanspec_t chspec);
+extern s32
+wl_cfgp2p_ifdisable(struct bcm_cfg80211 *cfg, struct ether_addr *mac);
+extern s32
+wl_cfgp2p_ifdel(struct bcm_cfg80211 *cfg, struct ether_addr *mac);
+extern s32
+wl_cfgp2p_ifchange(struct bcm_cfg80211 *cfg, struct ether_addr *mac, u8 if_type,
+       chanspec_t chspec, s32 conn_idx);
+
+extern s32
+wl_cfgp2p_ifidx(struct bcm_cfg80211 *cfg, struct ether_addr *mac, s32 *index);
+
+extern s32
+wl_cfgp2p_init_discovery(struct bcm_cfg80211 *cfg);
+extern s32
+wl_cfgp2p_enable_discovery(struct bcm_cfg80211 *cfg, struct net_device *dev, const u8 *ie,
+       u32 ie_len);
+extern s32
+wl_cfgp2p_disable_discovery(struct bcm_cfg80211 *cfg);
+extern s32
+wl_cfgp2p_escan(struct bcm_cfg80211 *cfg, struct net_device *dev, u16 active, u32 num_chans,
+       u16 *channels,
+       s32 search_state, u16 action, u32 bssidx, struct ether_addr *tx_dst_addr,
+       p2p_scan_purpose_t p2p_scan_purpose);
+
+extern s32
+wl_cfgp2p_act_frm_search(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+       s32 bssidx, s32 channel, struct ether_addr *tx_dst_addr);
+
+extern wpa_ie_fixed_t *
+wl_cfgp2p_find_wpaie(u8 *parse, u32 len);
+
+extern wpa_ie_fixed_t *
+wl_cfgp2p_find_wpsie(u8 *parse, u32 len);
+
+extern wifi_p2p_ie_t *
+wl_cfgp2p_find_p2pie(u8 *parse, u32 len);
+
+extern wifi_wfd_ie_t *
+wl_cfgp2p_find_wfdie(u8 *parse, u32 len);
+extern s32
+wl_cfgp2p_set_management_ie(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32 bssidx,
+            s32 pktflag, const u8 *vndr_ie, u32 vndr_ie_len);
+extern s32
+wl_cfgp2p_clear_management_ie(struct bcm_cfg80211 *cfg, s32 bssidx);
+
+extern struct net_device *
+wl_cfgp2p_find_ndev(struct bcm_cfg80211 *cfg, s32 bssidx);
+extern s32
+wl_cfgp2p_find_type(struct bcm_cfg80211 *cfg, s32 bssidx, s32 *type);
+
+
+extern s32
+wl_cfgp2p_listen_complete(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data);
+extern s32
+wl_cfgp2p_discover_listen(struct bcm_cfg80211 *cfg, s32 channel, u32 duration_ms);
+
+extern s32
+wl_cfgp2p_discover_enable_search(struct bcm_cfg80211 *cfg, u8 enable);
+
+extern s32
+wl_cfgp2p_action_tx_complete(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+       const wl_event_msg_t *e, void *data);
+
+extern s32
+wl_cfgp2p_tx_action_frame(struct bcm_cfg80211 *cfg, struct net_device *dev,
+       wl_af_params_t *af_params, s32 bssidx);
+
+extern void
+wl_cfgp2p_generate_bss_mac(struct bcm_cfg80211 *cfg, struct ether_addr *primary_addr);
+
+extern void
+wl_cfg80211_change_ifaddr(u8* buf, struct ether_addr *p2p_int_addr, u8 element_id);
+extern bool
+wl_cfgp2p_bss_isup(struct net_device *ndev, int bsscfg_idx);
+
+extern s32
+wl_cfgp2p_bss(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32 bsscfg_idx, s32 up);
+
+
+extern s32
+wl_cfgp2p_supported(struct bcm_cfg80211 *cfg, struct net_device *ndev);
+
+extern s32
+wl_cfgp2p_down(struct bcm_cfg80211 *cfg);
+
+extern s32
+wl_cfgp2p_set_p2p_noa(struct bcm_cfg80211 *cfg, struct net_device *ndev, char* buf, int len);
+
+extern s32
+wl_cfgp2p_get_p2p_noa(struct bcm_cfg80211 *cfg, struct net_device *ndev, char* buf, int len);
+
+extern s32
+wl_cfgp2p_set_p2p_ps(struct bcm_cfg80211 *cfg, struct net_device *ndev, char* buf, int len);
+
+extern s32
+wl_cfgp2p_set_p2p_ecsa(struct bcm_cfg80211 *cfg, struct net_device *ndev, char* buf, int len);
+
+extern s32
+wl_cfgp2p_increase_p2p_bw(struct bcm_cfg80211 *cfg, struct net_device *ndev, char* buf, int len);
+
+extern u8 *
+wl_cfgp2p_retreive_p2pattrib(void *buf, u8 element_id);
+
+extern u8*
+wl_cfgp2p_find_attrib_in_all_p2p_Ies(u8 *parse, u32 len, u32 attrib);
+
+extern u8 *
+wl_cfgp2p_retreive_p2p_dev_addr(wl_bss_info_t *bi, u32 bi_length);
+
+extern s32
+wl_cfgp2p_register_ndev(struct bcm_cfg80211 *cfg);
+
+extern s32
+wl_cfgp2p_unregister_ndev(struct bcm_cfg80211 *cfg);
+
+extern bool
+wl_cfgp2p_is_ifops(const struct net_device_ops *if_ops);
+
+extern u32
+wl_cfgp2p_vndr_ie(struct bcm_cfg80211 *cfg, u8 *iebuf, s32 pktflag,
+       s8 *oui, s32 ie_id, s8 *data, s32 datalen, const s8* add_del_cmd);
+
+extern int wl_cfgp2p_get_conn_idx(struct bcm_cfg80211 *cfg);
+
+extern
+int wl_cfg_multip2p_operational(struct bcm_cfg80211 *cfg);
+
+extern
+int wl_cfgp2p_vif_created(struct bcm_cfg80211 *cfg);
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+extern struct wireless_dev *
+wl_cfgp2p_add_p2p_disc_if(struct bcm_cfg80211 *cfg);
+
+extern int
+wl_cfgp2p_start_p2p_device(struct wiphy *wiphy, struct wireless_dev *wdev);
+
+extern void
+wl_cfgp2p_stop_p2p_device(struct wiphy *wiphy, struct wireless_dev *wdev);
+
+extern int
+wl_cfgp2p_del_p2p_disc_if(struct wireless_dev *wdev, struct bcm_cfg80211 *cfg);
+
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+extern void
+wl_cfgp2p_need_wait_actfrmae(struct bcm_cfg80211 *cfg, void *frame, u32 frame_len, bool tx);
+
+extern int
+wl_cfgp2p_is_p2p_specific_scan(struct cfg80211_scan_request *request);
+
+/* WiFi Direct */
+#define SOCIAL_CHAN_1 1
+#define SOCIAL_CHAN_2 6
+#define SOCIAL_CHAN_3 11
+#define IS_P2P_SOCIAL_CHANNEL(channel) ((channel == SOCIAL_CHAN_1) || \
+                                       (channel == SOCIAL_CHAN_2) || \
+                                       (channel == SOCIAL_CHAN_3))
+#define SOCIAL_CHAN_CNT 3
+#define AF_PEER_SEARCH_CNT 2
+#define WL_P2P_WILDCARD_SSID "DIRECT-"
+#define WL_P2P_WILDCARD_SSID_LEN 7
+#define WL_P2P_INTERFACE_PREFIX "p2p"
+#define WL_P2P_TEMP_CHAN 11
+#define WL_P2P_AF_STATUS_OFFSET 9
+
+/* If the provision discovery is for JOIN operations,
+ * or the device discoverablity frame is destined to GO
+ * then we need not do an internal scan to find GO.
+ */
+#define IS_ACTPUB_WITHOUT_GROUP_ID(p2p_ie, len) \
+       (wl_cfgp2p_retreive_p2pattrib(p2p_ie, P2P_SEID_GROUP_ID) == NULL)
+
+#define IS_GAS_REQ(frame, len) (wl_cfgp2p_is_gas_action(frame, len) && \
+                                       ((frame->action == P2PSD_ACTION_ID_GAS_IREQ) || \
+                                       (frame->action == P2PSD_ACTION_ID_GAS_CREQ)))
+
+#define IS_P2P_PUB_ACT_RSP_SUBTYPE(subtype) ((subtype == P2P_PAF_GON_RSP) || \
+                                                       ((subtype == P2P_PAF_GON_CONF) || \
+                                                       (subtype == P2P_PAF_INVITE_RSP) || \
+                                                       (subtype == P2P_PAF_PROVDIS_RSP)))
+#define IS_P2P_SOCIAL(ch) ((ch == SOCIAL_CHAN_1) || (ch == SOCIAL_CHAN_2) || (ch == SOCIAL_CHAN_3))
+#define IS_P2P_SSID(ssid, len) (!memcmp(ssid, WL_P2P_WILDCARD_SSID, WL_P2P_WILDCARD_SSID_LEN) && \
+                                       (len == WL_P2P_WILDCARD_SSID_LEN))
+#endif                         /* _wl_cfgp2p_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/wl_cfgvendor.c b/drivers/net/wireless/bcmdhd_1363/wl_cfgvendor.c
new file mode 100644 (file)
index 0000000..1023192
--- /dev/null
@@ -0,0 +1,1835 @@
+/*
+ * Linux cfg80211 Vendor Extension Code
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: wl_cfgvendor.c 664399 2017-03-24 14:36:24Z $
+ */
+
+/*
+ * New vendor interface additon to nl80211/cfg80211 to allow vendors
+ * to implement proprietary features over the cfg80211 stack.
+*/
+
+#include <typedefs.h>
+#include <linuxver.h>
+#include <osl.h>
+#include <linux/kernel.h>
+#include <linux/vmalloc.h>
+
+#include <bcmutils.h>
+#include <bcmwifi_channels.h>
+#include <bcmendian.h>
+#include <proto/ethernet.h>
+#include <proto/802.11.h>
+#include <linux/if_arp.h>
+#include <asm/uaccess.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhdioctl.h>
+#include <wlioctl.h>
+#include <wlioctl_utils.h>
+#include <dhd_cfg80211.h>
+#ifdef PNO_SUPPORT
+#include <dhd_pno.h>
+#endif /* PNO_SUPPORT */
+#ifdef RTT_SUPPORT
+#include <dhd_rtt.h>
+#endif /* RTT_SUPPORT */
+#include <proto/ethernet.h>
+#include <linux/kernel.h>
+#include <linux/kthread.h>
+#include <linux/netdevice.h>
+#include <linux/sched.h>
+#include <linux/etherdevice.h>
+#include <linux/wireless.h>
+#include <linux/ieee80211.h>
+#include <linux/wait.h>
+#include <net/cfg80211.h>
+#include <net/rtnetlink.h>
+
+#include <wlioctl.h>
+#include <wldev_common.h>
+#include <wl_cfg80211.h>
+#include <wl_cfgp2p.h>
+#include <wl_android.h>
+#include <wl_cfgvendor.h>
+
+#ifdef PROP_TXSTATUS
+#include <dhd_wlfc.h>
+#endif
+#include <brcm_nl80211.h>
+
+#if defined(WL_VENDOR_EXT_SUPPORT)
+/*
+ * This API is to be used for asynchronous vendor events. This
+ * shouldn't be used in response to a vendor command from its
+ * do_it handler context (instead wl_cfgvendor_send_cmd_reply should
+ * be used).
+ */
+int wl_cfgvendor_send_async_event(struct wiphy *wiphy,
+       struct net_device *dev, int event_id, const void  *data, int len)
+{
+       u16 kflags;
+       struct sk_buff *skb;
+
+       kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+
+       /* Alloc the SKB for vendor_event */
+#if defined(CONFIG_ARCH_MSM) && defined(SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC)
+       skb = cfg80211_vendor_event_alloc(wiphy, NULL, len, event_id, kflags);
+#else
+       skb = cfg80211_vendor_event_alloc(wiphy, len, event_id, kflags);
+#endif /* CONFIG_ARCH_MSM && SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC */
+       if (!skb) {
+               WL_ERR(("skb alloc failed"));
+               return -ENOMEM;
+       }
+
+       /* Push the data to the skb */
+       nla_put_nohdr(skb, len, data);
+
+       cfg80211_vendor_event(skb, kflags);
+
+       return 0;
+}
+
+static int
+wl_cfgvendor_send_cmd_reply(struct wiphy *wiphy,
+       struct net_device *dev, const void  *data, int len)
+{
+       struct sk_buff *skb;
+
+       /* Alloc the SKB for vendor_event */
+       skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, len);
+       if (unlikely(!skb)) {
+               WL_ERR(("skb alloc failed"));
+               return -ENOMEM;
+       }
+
+       /* Push the data to the skb */
+       nla_put_nohdr(skb, len, data);
+
+       return cfg80211_vendor_cmd_reply(skb);
+}
+
+static int
+wl_cfgvendor_get_feature_set(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       int reply;
+
+       reply = dhd_dev_get_feature_set(bcmcfg_to_prmry_ndev(cfg));
+
+       err =  wl_cfgvendor_send_cmd_reply(wiphy, bcmcfg_to_prmry_ndev(cfg),
+                       &reply, sizeof(int));
+       if (unlikely(err))
+               WL_ERR(("Vendor Command reply failed ret:%d \n", err));
+
+       return err;
+}
+
+static int
+wl_cfgvendor_get_feature_set_matrix(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       struct sk_buff *skb;
+       int *reply;
+       int num, mem_needed, i;
+
+       reply = dhd_dev_get_feature_set_matrix(bcmcfg_to_prmry_ndev(cfg), &num);
+
+       if (!reply) {
+               WL_ERR(("Could not get feature list matrix\n"));
+               err = -EINVAL;
+               return err;
+       }
+       mem_needed = VENDOR_REPLY_OVERHEAD + (ATTRIBUTE_U32_LEN * num) +
+                    ATTRIBUTE_U32_LEN;
+
+       /* Alloc the SKB for vendor_event */
+       skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, mem_needed);
+       if (unlikely(!skb)) {
+               WL_ERR(("skb alloc failed"));
+               err = -ENOMEM;
+               goto exit;
+       }
+
+       nla_put_u32(skb, ANDR_WIFI_ATTRIBUTE_NUM_FEATURE_SET, num);
+       for (i = 0; i < num; i++) {
+               nla_put_u32(skb, ANDR_WIFI_ATTRIBUTE_FEATURE_SET, reply[i]);
+       }
+
+       err =  cfg80211_vendor_cmd_reply(skb);
+
+       if (unlikely(err))
+               WL_ERR(("Vendor Command reply failed ret:%d \n", err));
+
+exit:
+       kfree(reply);
+       return err;
+}
+
+static int
+wl_cfgvendor_set_pno_mac_oui(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       int type;
+       uint8 pno_random_mac_oui[DOT11_OUI_LEN];
+
+       type = nla_type(data);
+
+       if (type == ANDR_WIFI_ATTRIBUTE_PNO_RANDOM_MAC_OUI) {
+               memcpy(pno_random_mac_oui, nla_data(data), DOT11_OUI_LEN);
+
+               err = dhd_dev_pno_set_mac_oui(bcmcfg_to_prmry_ndev(cfg), pno_random_mac_oui);
+
+               if (unlikely(err))
+                       WL_ERR(("Bad OUI, could not set:%d \n", err));
+
+
+       } else {
+               err = -1;
+       }
+
+       return err;
+}
+
+#ifdef CUSTOM_FORCE_NODFS_FLAG
+static int
+wl_cfgvendor_set_nodfs_flag(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void *data, int len)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       int type;
+       u32 nodfs;
+
+       type = nla_type(data);
+       if (type == ANDR_WIFI_ATTRIBUTE_NODFS_SET) {
+               nodfs = nla_get_u32(data);
+               err = dhd_dev_set_nodfs(bcmcfg_to_prmry_ndev(cfg), nodfs);
+       } else {
+               err = -1;
+       }
+       return err;
+}
+#endif /* CUSTOM_FORCE_NODFS_FLAG */
+
+#ifdef GSCAN_SUPPORT
+int
+wl_cfgvendor_send_hotlist_event(struct wiphy *wiphy,
+       struct net_device *dev, void  *data, int len, wl_vendor_event_t event)
+{
+       u16 kflags;
+       const void *ptr;
+       struct sk_buff *skb;
+       int malloc_len, total, iter_cnt_to_send, cnt;
+       gscan_results_cache_t *cache = (gscan_results_cache_t *)data;
+       total = len/sizeof(wifi_gscan_result_t);
+       while (total > 0) {
+               malloc_len = (total * sizeof(wifi_gscan_result_t)) + VENDOR_DATA_OVERHEAD;
+               if (malloc_len > NLMSG_DEFAULT_SIZE) {
+                       malloc_len = NLMSG_DEFAULT_SIZE;
+               }
+               iter_cnt_to_send =
+                  (malloc_len - VENDOR_DATA_OVERHEAD)/sizeof(wifi_gscan_result_t);
+               total = total - iter_cnt_to_send;
+
+               kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+
+               /* Alloc the SKB for vendor_event */
+#if defined(CONFIG_ARCH_MSM) && defined(SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC)
+               skb = cfg80211_vendor_event_alloc(wiphy, NULL, malloc_len, event, kflags);
+#else
+               skb = cfg80211_vendor_event_alloc(wiphy, malloc_len, event, kflags);
+#endif /* CONFIG_ARCH_MSM && SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC */
+               if (!skb) {
+                       WL_ERR(("skb alloc failed"));
+                       return -ENOMEM;
+               }
+
+               while (cache && iter_cnt_to_send) {
+                       ptr = (const void *) &cache->results[cache->tot_consumed];
+
+                       if (iter_cnt_to_send < (cache->tot_count - cache->tot_consumed)) {
+                               cnt = iter_cnt_to_send;
+                       } else {
+                               cnt = (cache->tot_count - cache->tot_consumed);
+                       }
+
+                       iter_cnt_to_send -= cnt;
+                       cache->tot_consumed += cnt;
+                       /* Push the data to the skb */
+                       nla_append(skb, cnt * sizeof(wifi_gscan_result_t), ptr);
+                       if (cache->tot_consumed == cache->tot_count) {
+                               cache = cache->next;
+                       }
+
+               }
+
+               cfg80211_vendor_event(skb, kflags);
+       }
+
+       return 0;
+}
+
+
+static int
+wl_cfgvendor_gscan_get_capabilities(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       dhd_pno_gscan_capabilities_t *reply = NULL;
+       uint32 reply_len = 0;
+
+
+       reply = dhd_dev_pno_get_gscan(bcmcfg_to_prmry_ndev(cfg),
+       DHD_PNO_GET_CAPABILITIES, NULL, &reply_len);
+       if (!reply) {
+               WL_ERR(("Could not get capabilities\n"));
+               err = -EINVAL;
+               return err;
+       }
+
+       err =  wl_cfgvendor_send_cmd_reply(wiphy, bcmcfg_to_prmry_ndev(cfg),
+                      reply, reply_len);
+
+       if (unlikely(err)) {
+               WL_ERR(("Vendor Command reply failed ret:%d \n", err));
+       }
+
+       kfree(reply);
+       return err;
+}
+
+static int
+wl_cfgvendor_gscan_get_channel_list(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = 0, type, band;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       uint16 *reply = NULL;
+       uint32 reply_len = 0, num_channels, mem_needed;
+       struct sk_buff *skb;
+
+       type = nla_type(data);
+
+       if (type == GSCAN_ATTRIBUTE_BAND) {
+               band = nla_get_u32(data);
+       } else {
+               return -EINVAL;
+       }
+
+       reply = dhd_dev_pno_get_gscan(bcmcfg_to_prmry_ndev(cfg),
+                        DHD_PNO_GET_CHANNEL_LIST, &band, &reply_len);
+
+       if (!reply) {
+               WL_ERR(("Could not get channel list\n"));
+               err = -EINVAL;
+               return err;
+       }
+       num_channels =  reply_len/ sizeof(uint32);
+       mem_needed = reply_len + VENDOR_REPLY_OVERHEAD + (ATTRIBUTE_U32_LEN * 2);
+
+       /* Alloc the SKB for vendor_event */
+       skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, mem_needed);
+       if (unlikely(!skb)) {
+               WL_ERR(("skb alloc failed"));
+               err = -ENOMEM;
+               goto exit;
+       }
+
+       nla_put_u32(skb, GSCAN_ATTRIBUTE_NUM_CHANNELS, num_channels);
+       nla_put(skb, GSCAN_ATTRIBUTE_CHANNEL_LIST, reply_len, reply);
+
+       err =  cfg80211_vendor_cmd_reply(skb);
+
+       if (unlikely(err)) {
+               WL_ERR(("Vendor Command reply failed ret:%d \n", err));
+       }
+exit:
+       kfree(reply);
+       return err;
+}
+
+static int
+wl_cfgvendor_gscan_get_batch_results(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       gscan_results_cache_t *results, *iter;
+       uint32 reply_len, complete = 0, num_results_iter;
+       int32 mem_needed;
+       wifi_gscan_result_t *ptr;
+       uint16 num_scan_ids, num_results;
+       struct sk_buff *skb;
+       struct nlattr *scan_hdr;
+
+       dhd_dev_wait_batch_results_complete(bcmcfg_to_prmry_ndev(cfg));
+       dhd_dev_pno_lock_access_batch_results(bcmcfg_to_prmry_ndev(cfg));
+       results = dhd_dev_pno_get_gscan(bcmcfg_to_prmry_ndev(cfg),
+                    DHD_PNO_GET_BATCH_RESULTS, NULL, &reply_len);
+
+       if (!results) {
+               WL_ERR(("No results to send %d\n", err));
+               err =  wl_cfgvendor_send_cmd_reply(wiphy, bcmcfg_to_prmry_ndev(cfg),
+                       results, 0);
+
+               if (unlikely(err))
+                       WL_ERR(("Vendor Command reply failed ret:%d \n", err));
+               dhd_dev_pno_unlock_access_batch_results(bcmcfg_to_prmry_ndev(cfg));
+               return err;
+       }
+       num_scan_ids = reply_len & 0xFFFF;
+       num_results = (reply_len & 0xFFFF0000) >> 16;
+       mem_needed = (num_results * sizeof(wifi_gscan_result_t)) +
+                    (num_scan_ids * GSCAN_BATCH_RESULT_HDR_LEN) +
+                    VENDOR_REPLY_OVERHEAD + SCAN_RESULTS_COMPLETE_FLAG_LEN;
+
+       if (mem_needed > (int32)NLMSG_DEFAULT_SIZE) {
+               mem_needed = (int32)NLMSG_DEFAULT_SIZE;
+               complete = 0;
+       } else {
+               complete = 1;
+       }
+
+       WL_TRACE(("complete %d mem_needed %d max_mem %d\n", complete, mem_needed,
+               (int)NLMSG_DEFAULT_SIZE));
+       /* Alloc the SKB for vendor_event */
+       skb = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, mem_needed);
+       if (unlikely(!skb)) {
+               WL_ERR(("skb alloc failed"));
+               dhd_dev_pno_unlock_access_batch_results(bcmcfg_to_prmry_ndev(cfg));
+               return -ENOMEM;
+       }
+               iter = results;
+
+               nla_put_u32(skb, GSCAN_ATTRIBUTE_SCAN_RESULTS_COMPLETE, complete);
+               mem_needed = mem_needed - (SCAN_RESULTS_COMPLETE_FLAG_LEN + VENDOR_REPLY_OVERHEAD);
+               while (iter && ((mem_needed - GSCAN_BATCH_RESULT_HDR_LEN)  > 0)) {
+
+               scan_hdr = nla_nest_start(skb, GSCAN_ATTRIBUTE_SCAN_RESULTS);
+               nla_put_u32(skb, GSCAN_ATTRIBUTE_SCAN_ID, iter->scan_id);
+               nla_put_u8(skb, GSCAN_ATTRIBUTE_SCAN_FLAGS, iter->flag);
+
+               num_results_iter =
+               (mem_needed - GSCAN_BATCH_RESULT_HDR_LEN)/sizeof(wifi_gscan_result_t);
+
+               if ((iter->tot_count - iter->tot_consumed) < num_results_iter)
+                       num_results_iter = iter->tot_count - iter->tot_consumed;
+               nla_put_u32(skb, GSCAN_ATTRIBUTE_NUM_OF_RESULTS, num_results_iter);
+               if (num_results_iter) {
+                       ptr = &iter->results[iter->tot_consumed];
+                       iter->tot_consumed += num_results_iter;
+                       nla_put(skb, GSCAN_ATTRIBUTE_SCAN_RESULTS,
+                        num_results_iter * sizeof(wifi_gscan_result_t), ptr);
+               }
+               nla_nest_end(skb, scan_hdr);
+               mem_needed -= GSCAN_BATCH_RESULT_HDR_LEN +
+                       (num_results_iter * sizeof(wifi_gscan_result_t));
+               iter = iter->next;
+       }
+
+       dhd_dev_gscan_batch_cache_cleanup(bcmcfg_to_prmry_ndev(cfg));
+       dhd_dev_pno_unlock_access_batch_results(bcmcfg_to_prmry_ndev(cfg));
+
+       return cfg80211_vendor_cmd_reply(skb);
+}
+
+static int
+wl_cfgvendor_initiate_gscan(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       int type, tmp = len;
+       int run = 0xFF;
+       int flush = 0;
+       const struct nlattr *iter;
+
+       nla_for_each_attr(iter, data, len, tmp) {
+               type = nla_type(iter);
+               if (type == GSCAN_ATTRIBUTE_ENABLE_FEATURE)
+                       run = nla_get_u32(iter);
+               else if (type == GSCAN_ATTRIBUTE_FLUSH_FEATURE)
+                       flush = nla_get_u32(iter);
+       }
+
+       if (run != 0xFF) {
+               err = dhd_dev_pno_run_gscan(bcmcfg_to_prmry_ndev(cfg), run, flush);
+
+               if (unlikely(err)) {
+                       WL_ERR(("Could not run gscan:%d \n", err));
+               }
+               return err;
+       } else {
+               return -EINVAL;
+       }
+
+
+}
+
+static int
+wl_cfgvendor_enable_full_scan_result(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       int type;
+       bool real_time = FALSE;
+
+       type = nla_type(data);
+
+       if (type == GSCAN_ATTRIBUTE_ENABLE_FULL_SCAN_RESULTS) {
+               real_time = nla_get_u32(data);
+
+               err = dhd_dev_pno_enable_full_scan_result(bcmcfg_to_prmry_ndev(cfg), real_time);
+
+               if (unlikely(err)) {
+                       WL_ERR(("Could not run gscan:%d \n", err));
+               }
+
+       } else {
+               err = -EINVAL;
+       }
+
+       return err;
+}
+
+#define GSCAN_MAX_CHANNELS_IN_BUCKET 32
+static int
+wl_cfgvendor_set_scan_cfg_bucket(const struct nlattr *prev,
+       gscan_scan_params_t *scan_param, int num)
+{
+       struct dhd_pno_gscan_channel_bucket  *ch_bucket;
+       int k = 0, type, err = 0, rem;
+       const struct nlattr *cur, *next;
+
+       nla_for_each_nested(cur, prev, rem) {
+               type = nla_type(cur);
+               ch_bucket = scan_param->channel_bucket;
+               switch (type) {
+               case GSCAN_ATTRIBUTE_BUCKET_ID:
+                       break;
+               case GSCAN_ATTRIBUTE_BUCKET_PERIOD:
+                       if (nla_len(cur) != sizeof(uint32)) {
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       ch_bucket[num].bucket_freq_multiple = nla_get_u32(cur) / 1000;
+                       break;
+               case GSCAN_ATTRIBUTE_BUCKET_NUM_CHANNELS:
+                       if (nla_len(cur) != sizeof(uint32)) {
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       ch_bucket[num].num_channels = nla_get_u32(cur);
+                       if (ch_bucket[num].num_channels > GSCAN_MAX_CHANNELS_IN_BUCKET) {
+                               WL_ERR(("channel range:%d,bucket:%d\n",
+                                       ch_bucket[num].num_channels, num));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       break;
+               case GSCAN_ATTRIBUTE_BUCKET_CHANNELS:
+                       nla_for_each_nested(next, cur, rem) {
+                               if (k >= GSCAN_MAX_CHANNELS_IN_BUCKET)
+                                       break;
+                               if (nla_len(next) != sizeof(uint32)) {
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+                               ch_bucket[num].chan_list[k] = nla_get_u32(next);
+                               k++;
+                       }
+                       break;
+               case GSCAN_ATTRIBUTE_BUCKETS_BAND:
+                       if (nla_len(cur) != sizeof(uint32)) {
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       ch_bucket[num].band = (uint16)nla_get_u32(cur);
+                       break;
+               case GSCAN_ATTRIBUTE_REPORT_EVENTS:
+                       if (nla_len(cur) != sizeof(uint32)) {
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       ch_bucket[num].report_flag = (uint8)nla_get_u32(cur);
+                       break;
+               default:
+                       WL_ERR(("unknown attr type:%d\n", type));
+                       err = -EINVAL;
+                       goto exit;
+               }
+       }
+
+exit:
+       return err;
+}
+
+static int
+wl_cfgvendor_set_scan_cfg(struct wiphy *wiphy, struct wireless_dev *wdev,
+       const void  *data, int len)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       gscan_scan_params_t *scan_param;
+       int j = 0;
+       int type, tmp;
+       const struct nlattr *iter;
+
+       scan_param = kzalloc(sizeof(gscan_scan_params_t), GFP_KERNEL);
+       if (!scan_param) {
+               WL_ERR(("Could not set GSCAN scan cfg, mem alloc failure\n"));
+               err = -EINVAL;
+               return err;
+
+       }
+
+       scan_param->scan_fr = PNO_SCAN_MIN_FW_SEC;
+       nla_for_each_attr(iter, data, len, tmp) {
+               type = nla_type(iter);
+
+               if (j >= GSCAN_MAX_CH_BUCKETS) {
+                       break;
+               }
+
+               switch (type) {
+                       case GSCAN_ATTRIBUTE_BASE_PERIOD:
+                               if (nla_len(iter) != sizeof(uint32)) {
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+                               scan_param->scan_fr = nla_get_u32(iter)/1000;
+                               break;
+                       case GSCAN_ATTRIBUTE_NUM_BUCKETS:
+                               if (nla_len(iter) != sizeof(uint32)) {
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+                               scan_param->nchannel_buckets = nla_get_u32(iter);
+                               if (scan_param->nchannel_buckets >= GSCAN_MAX_CH_BUCKETS) {
+                                       WL_ERR(("ncha_buck out of range %d\n",
+                                               scan_param->nchannel_buckets));
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+                               break;
+                       case GSCAN_ATTRIBUTE_CH_BUCKET_1:
+                       case GSCAN_ATTRIBUTE_CH_BUCKET_2:
+                       case GSCAN_ATTRIBUTE_CH_BUCKET_3:
+                       case GSCAN_ATTRIBUTE_CH_BUCKET_4:
+                       case GSCAN_ATTRIBUTE_CH_BUCKET_5:
+                       case GSCAN_ATTRIBUTE_CH_BUCKET_6:
+                       case GSCAN_ATTRIBUTE_CH_BUCKET_7:
+                               err = wl_cfgvendor_set_scan_cfg_bucket(iter, scan_param, j);
+                               if (err < 0) {
+                                       WL_ERR(("set_scan_cfg_buck error:%d\n", err));
+                                       goto exit;
+                               }
+                               j++;
+                               break;
+                       default:
+                               WL_ERR(("Unknown type %d\n", type));
+                               err = -EINVAL;
+                               goto exit;
+               }
+       }
+
+       err = dhd_dev_pno_set_cfg_gscan(bcmcfg_to_prmry_ndev(cfg),
+               DHD_PNO_SCAN_CFG_ID, scan_param, FALSE);
+
+       if (err < 0) {
+               WL_ERR(("Could not set GSCAN scan cfg\n"));
+               err = -EINVAL;
+       }
+
+exit:
+       kfree(scan_param);
+       return err;
+
+}
+
+static int
+wl_cfgvendor_hotlist_cfg(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       gscan_hotlist_scan_params_t *hotlist_params;
+       int tmp, tmp1, tmp2, type, j = 0;
+       const struct nlattr *outer, *inner = NULL, *iter;
+       uint8 flush = 0;
+       struct bssid_t *pbssid;
+
+       if (len < sizeof(*hotlist_params) || len >= WLC_IOCTL_MAXLEN) {
+               WL_ERR(("buffer length :%d wrong - bail out.\n", len));
+               return -EINVAL;
+       }
+
+       hotlist_params = kzalloc(sizeof(*hotlist_params)
+               + (sizeof(struct bssid_t) * (PFN_SWC_MAX_NUM_APS - 1)), GFP_KERNEL);
+       if (!hotlist_params) {
+               WL_ERR(("Cannot Malloc memory. \n"));
+               return -ENOMEM;
+       }
+
+       hotlist_params->lost_ap_window = GSCAN_LOST_AP_WINDOW_DEFAULT;
+
+       nla_for_each_attr(iter, data, len, tmp2) {
+               type = nla_type(iter);
+               switch (type) {
+               case GSCAN_ATTRIBUTE_HOTLIST_BSSIDS:
+                       pbssid = hotlist_params->bssid;
+                       nla_for_each_nested(outer, iter, tmp) {
+                               nla_for_each_nested(inner, outer, tmp1) {
+                                       type = nla_type(inner);
+
+                                       switch (type) {
+                                       case GSCAN_ATTRIBUTE_BSSID:
+                                               if (nla_len(inner) != sizeof(pbssid[j].macaddr)) {
+                                                       WL_ERR(("type:%d length:%d not matching.\n",
+                                                               type, nla_len(inner)));
+                                                       err = -EINVAL;
+                                                       goto exit;
+                                               }
+                                               memcpy(&(pbssid[j].macaddr), nla_data(inner),
+                                                       ETHER_ADDR_LEN);
+                                               break;
+                                       case GSCAN_ATTRIBUTE_RSSI_LOW:
+                                               if (nla_len(inner) != sizeof(uint8)) {
+                                                       WL_ERR(("type:%d length:%d not matching.\n",
+                                                               type, nla_len(inner)));
+                                                       err = -EINVAL;
+                                                       goto exit;
+                                               }
+                                               pbssid[j].rssi_reporting_threshold =
+                                                       (int8)nla_get_u8(inner);
+                                               break;
+                                       case GSCAN_ATTRIBUTE_RSSI_HIGH:
+                                               if (nla_len(inner) != sizeof(uint8)) {
+                                                       WL_ERR(("type:%d length:%d not matching.\n",
+                                                               type, nla_len(inner)));
+                                                       err = -EINVAL;
+                                                       goto exit;
+                                               }
+                                               nla_get_u8(inner);
+                                               break;
+                                       default:
+                                               WL_ERR(("ATTR unknown %d\n", type));
+                                               err = -EINVAL;
+                                               goto exit;
+                                       }
+                               }
+
+                               if (++j >= PFN_SWC_MAX_NUM_APS) {
+                                       WL_ERR(("cap hotlist max:%d\n", j));
+                                       break;
+                               }
+                       }
+                       hotlist_params->nbssid = j;
+                       break;
+               case GSCAN_ATTRIBUTE_HOTLIST_FLUSH:
+                       if (nla_len(iter) != sizeof(uint8)) {
+                               WL_ERR(("type:%d length:%d not matching\n", type, nla_len(inner)));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       flush = nla_get_u8(iter);
+                       break;
+               case GSCAN_ATTRIBUTE_LOST_AP_SAMPLE_SIZE:
+                       if (nla_len(iter) != sizeof(uint32)) {
+                               WL_ERR(("type:%d length:%d not matching\n", type, nla_len(inner)));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       hotlist_params->lost_ap_window = (uint16)nla_get_u32(iter);
+                       break;
+               default:
+                       WL_ERR(("Unknown type %d\n", type));
+                       err = -EINVAL;
+                       goto exit;
+               }
+       }
+
+       if (dhd_dev_pno_set_cfg_gscan(bcmcfg_to_prmry_ndev(cfg),
+                       DHD_PNO_GEOFENCE_SCAN_CFG_ID, hotlist_params, flush) < 0) {
+               WL_ERR(("Could not set GSCAN HOTLIST cfg error: %d\n", err));
+               err = -EINVAL;
+               goto exit;
+       }
+exit:
+       kfree(hotlist_params);
+       return err;
+}
+static int
+wl_cfgvendor_set_batch_scan_cfg(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = 0, tmp, type;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       gscan_batch_params_t batch_param;
+       const struct nlattr *iter;
+
+       batch_param.mscan = batch_param.bestn = 0;
+       batch_param.buffer_threshold = GSCAN_BATCH_NO_THR_SET;
+
+       nla_for_each_attr(iter, data, len, tmp) {
+               type = nla_type(iter);
+
+               switch (type) {
+                       case GSCAN_ATTRIBUTE_NUM_AP_PER_SCAN:
+                               batch_param.bestn = nla_get_u32(iter);
+                               break;
+                       case GSCAN_ATTRIBUTE_NUM_SCANS_TO_CACHE:
+                               batch_param.mscan = nla_get_u32(iter);
+                               break;
+                       case GSCAN_ATTRIBUTE_REPORT_THRESHOLD:
+                               batch_param.buffer_threshold = nla_get_u32(iter);
+                               break;
+                       default:
+                               WL_ERR(("Unknown type %d\n", type));
+                               break;
+               }
+       }
+
+       if (dhd_dev_pno_set_cfg_gscan(bcmcfg_to_prmry_ndev(cfg),
+                       DHD_PNO_BATCH_SCAN_CFG_ID,
+                       &batch_param, 0) < 0) {
+               WL_ERR(("Could not set batch cfg\n"));
+               err = -EINVAL;
+               return err;
+       }
+
+       return err;
+}
+
+static int
+wl_cfgvendor_significant_change_cfg(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       gscan_swc_params_t *significant_params;
+       int tmp, tmp1, tmp2, type, j = 0;
+       const struct nlattr *outer, *inner, *iter;
+       uint8 flush = 0;
+       wl_pfn_significant_bssid_t *bssid;
+
+       significant_params = (gscan_swc_params_t *) kzalloc(len, GFP_KERNEL);
+       if (!significant_params) {
+               WL_ERR(("Cannot Malloc mem to parse config commands size - %d bytes \n", len));
+               return -ENOMEM;
+       }
+
+       nla_for_each_attr(iter, data, len, tmp2) {
+               type = nla_type(iter);
+
+               switch (type) {
+                       case GSCAN_ATTRIBUTE_SIGNIFICANT_CHANGE_FLUSH:
+                       flush = nla_get_u8(iter);
+                       break;
+                       case GSCAN_ATTRIBUTE_RSSI_SAMPLE_SIZE:
+                               significant_params->rssi_window = nla_get_u16(iter);
+                               break;
+                       case GSCAN_ATTRIBUTE_LOST_AP_SAMPLE_SIZE:
+                               significant_params->lost_ap_window = nla_get_u16(iter);
+                               break;
+                       case GSCAN_ATTRIBUTE_MIN_BREACHING:
+                               significant_params->swc_threshold = nla_get_u16(iter);
+                               break;
+                       case GSCAN_ATTRIBUTE_SIGNIFICANT_CHANGE_BSSIDS:
+                               bssid = significant_params->bssid_elem_list;
+                               nla_for_each_nested(outer, iter, tmp) {
+                                       nla_for_each_nested(inner, outer, tmp1) {
+                                                       switch (nla_type(inner)) {
+                                                               case GSCAN_ATTRIBUTE_BSSID:
+                                                                       memcpy(&(bssid[j].macaddr),
+                                                                              nla_data(inner),
+                                                                              ETHER_ADDR_LEN);
+                                                                       break;
+                                                               case GSCAN_ATTRIBUTE_RSSI_HIGH:
+                                                                       bssid[j].rssi_high_threshold
+                                                                        = (int8) nla_get_u8(inner);
+                                                                       break;
+                                                               case GSCAN_ATTRIBUTE_RSSI_LOW:
+                                                                       bssid[j].rssi_low_threshold
+                                                                        = (int8) nla_get_u8(inner);
+                                                                       break;
+                                                               default:
+                                                                       WL_ERR(("ATTR unknown %d\n",
+                                                                                 type));
+                                                                       break;
+                                                       }
+                                               }
+                                       j++;
+                               }
+                               break;
+                       default:
+                               WL_ERR(("Unknown type %d\n", type));
+                               break;
+               }
+       }
+       significant_params->nbssid = j;
+
+       if (dhd_dev_pno_set_cfg_gscan(bcmcfg_to_prmry_ndev(cfg),
+                     DHD_PNO_SIGNIFICANT_SCAN_CFG_ID,
+                     significant_params, flush) < 0) {
+               WL_ERR(("Could not set GSCAN significant cfg\n"));
+               err = -EINVAL;
+               goto exit;
+       }
+exit:
+       kfree(significant_params);
+       return err;
+}
+#endif /* GSCAN_SUPPORT */
+
+#ifdef RTT_SUPPORT
+void
+wl_cfgvendor_rtt_evt(void *ctx, void *rtt_data)
+{
+       struct wireless_dev *wdev = (struct wireless_dev *)ctx;
+       struct wiphy *wiphy;
+       struct sk_buff *skb;
+       uint32 tot_len = NLMSG_DEFAULT_SIZE, entry_len = 0;
+       gfp_t kflags;
+       rtt_report_t *rtt_report = NULL;
+       rtt_result_t *rtt_result = NULL;
+       struct list_head *rtt_list;
+       wiphy = wdev->wiphy;
+
+       WL_DBG(("In\n"));
+       /* Push the data to the skb */
+       if (!rtt_data) {
+               WL_ERR(("rtt_data is NULL\n"));
+               goto exit;
+       }
+       rtt_list = (struct list_head *)rtt_data;
+       kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+       /* Alloc the SKB for vendor_event */
+#if defined(CONFIG_ARCH_MSM) && defined(SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC)
+       skb = cfg80211_vendor_event_alloc(wiphy, NULL, tot_len, GOOGLE_RTT_COMPLETE_EVENT, kflags);
+#else
+       skb = cfg80211_vendor_event_alloc(wiphy, tot_len, GOOGLE_RTT_COMPLETE_EVENT, kflags);
+#endif /* CONFIG_ARCH_MSM && SUPPORT_WDEV_CFG80211_VENDOR_EVENT_ALLOC */
+       if (!skb) {
+               WL_ERR(("skb alloc failed"));
+               goto exit;
+       }
+       /* fill in the rtt results on each entry */
+       list_for_each_entry(rtt_result, rtt_list, list) {
+               entry_len = 0;
+               entry_len = sizeof(rtt_report_t);
+               rtt_report = kzalloc(entry_len, kflags);
+               if (!rtt_report) {
+                       WL_ERR(("rtt_report alloc failed"));
+                       kfree_skb(skb);
+                       goto exit;
+               }
+               rtt_report->addr = rtt_result->peer_mac;
+               rtt_report->num_measurement = 1; /* ONE SHOT */
+               rtt_report->status = rtt_result->err_code;
+               rtt_report->type =
+                       (rtt_result->TOF_type == TOF_TYPE_ONE_WAY) ? RTT_ONE_WAY: RTT_TWO_WAY;
+               rtt_report->peer = rtt_result->target_info->peer;
+               rtt_report->channel = rtt_result->target_info->channel;
+               rtt_report->rssi = rtt_result->avg_rssi;
+               /* tx_rate */
+               rtt_report->tx_rate = rtt_result->tx_rate;
+               /* RTT */
+               rtt_report->rtt = rtt_result->meanrtt;
+               rtt_report->rtt_sd = rtt_result->sdrtt/10;
+               /* convert to centi meter */
+               if (rtt_result->distance != 0xffffffff)
+                       rtt_report->distance = (rtt_result->distance >> 2) * 25;
+               else /* invalid distance */
+                       rtt_report->distance = -1;
+               rtt_report->ts = rtt_result->ts;
+               nla_append(skb, entry_len, rtt_report);
+               kfree(rtt_report);
+       }
+       cfg80211_vendor_event(skb, kflags);
+exit:
+       return;
+}
+
+static int
+wl_cfgvendor_rtt_set_config(struct wiphy *wiphy, struct wireless_dev *wdev,
+       const void *data, int len) {
+       int err = 0, rem, rem1, rem2, type;
+       rtt_config_params_t rtt_param;
+       rtt_target_info_t* rtt_target = NULL;
+       const struct nlattr *iter, *iter1, *iter2;
+       int8 eabuf[ETHER_ADDR_STR_LEN];
+       int8 chanbuf[CHANSPEC_STR_LEN];
+       int32 feature_set = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       feature_set = dhd_dev_get_feature_set(bcmcfg_to_prmry_ndev(cfg));
+
+       WL_DBG(("In\n"));
+       err = dhd_dev_rtt_register_noti_callback(wdev->netdev, wdev, wl_cfgvendor_rtt_evt);
+       if (err < 0) {
+               WL_ERR(("failed to register rtt_noti_callback\n"));
+               goto exit;
+       }
+       memset(&rtt_param, 0, sizeof(rtt_param));
+       if (len <= 0) {
+               WL_ERR(("Length of the nlattr is not valid len : %d\n", len));
+               err = BCME_ERROR;
+               goto exit;
+       }
+       nla_for_each_attr(iter, data, len, rem) {
+               type = nla_type(iter);
+               switch (type) {
+               case RTT_ATTRIBUTE_TARGET_CNT:
+                       rtt_param.rtt_target_cnt = nla_get_u8(iter);
+                       if ((rtt_param.rtt_target_cnt <= 0) ||
+                               (rtt_param.rtt_target_cnt > RTT_MAX_TARGET_CNT)) {
+                               WL_ERR(("target_cnt is not valid : %d\n",
+                                       rtt_param.rtt_target_cnt));
+                               err = BCME_RANGE;
+                               goto exit;
+                       }
+                       break;
+               case RTT_ATTRIBUTE_TARGET_INFO:
+                       /* Added this variable for safe check to avoid crash
+                        * incase the caller did not respect the order
+                        */
+                       if (rtt_param.target_info == NULL) {
+                               WL_ERR(("rtt_target_info is NULL\n"));
+                               err = BCME_NOMEM;
+                               goto exit;
+                       }
+                       rtt_target = rtt_param.target_info;
+                       nla_for_each_nested(iter1, iter, rem1) {
+                               nla_for_each_nested(iter2, iter1, rem2) {
+                                       type = nla_type(iter2);
+                                       switch (type) {
+                                       case RTT_ATTRIBUTE_TARGET_MAC:
+                                               memcpy(&rtt_target->addr, nla_data(iter2),
+                                                       ETHER_ADDR_LEN);
+                                               break;
+                                       case RTT_ATTRIBUTE_TARGET_TYPE:
+                                               rtt_target->type = nla_get_u8(iter2);
+                                               if (!(feature_set & WIFI_FEATURE_D2D_RTT)) {
+                                                       if (rtt_target->type == RTT_TWO_WAY ||
+                                                               rtt_target->type == RTT_INVALID) {
+                                                               WL_ERR(("doesn't support RTT type"
+                                                                       " : %d\n",
+                                                                       rtt_target->type));
+                                                               err = -EINVAL;
+                                                               goto exit;
+                                                       } else if (rtt_target->type == RTT_AUTO) {
+                                                               rtt_target->type = RTT_ONE_WAY;
+                                                       }
+                                               } else if (rtt_target->type == RTT_INVALID) {
+                                                       WL_ERR(("doesn't support RTT type"
+                                                               " : %d\n",
+                                                               rtt_target->type));
+                                                       err = -EINVAL;
+                                                       goto exit;
+                                               }
+                                               break;
+                                       case RTT_ATTRIBUTE_TARGET_PEER:
+                                               rtt_target->peer = nla_get_u8(iter2);
+                                               if (rtt_target->peer != RTT_PEER_AP) {
+                                                       WL_ERR(("doesn't support peer type : %d\n",
+                                                               rtt_target->peer));
+                                                       err = -EINVAL;
+                                                       goto exit;
+                                               }
+                                               break;
+                                       case RTT_ATTRIBUTE_TARGET_CHAN:
+                                               memcpy(&rtt_target->channel, nla_data(iter2),
+                                                       sizeof(rtt_target->channel));
+                                               break;
+                                       case RTT_ATTRIBUTE_TARGET_MODE:
+                                               rtt_target->continuous = nla_get_u8(iter2);
+                                               break;
+                                       case RTT_ATTRIBUTE_TARGET_INTERVAL:
+                                               rtt_target->interval = nla_get_u32(iter2);
+                                               break;
+                                       case RTT_ATTRIBUTE_TARGET_NUM_MEASUREMENT:
+                                               rtt_target->measure_cnt = nla_get_u32(iter2);
+                                               break;
+                                       case RTT_ATTRIBUTE_TARGET_NUM_PKT:
+                                               rtt_target->ftm_cnt = nla_get_u32(iter2);
+                                               break;
+                                       case RTT_ATTRIBUTE_TARGET_NUM_RETRY:
+                                               rtt_target->retry_cnt = nla_get_u32(iter2);
+                                       }
+                               }
+                               /* convert to chanspec value */
+                               rtt_target->chanspec =
+                                       dhd_rtt_convert_to_chspec(rtt_target->channel);
+                               if (rtt_target->chanspec == 0) {
+                                       WL_ERR(("Channel is not valid \n"));
+                                       goto exit;
+                               }
+                               WL_INFORM(("Target addr %s, Channel : %s for RTT \n",
+                                       bcm_ether_ntoa((const struct ether_addr *)&rtt_target->addr,
+                                       eabuf),
+                                       wf_chspec_ntoa(rtt_target->chanspec, chanbuf)));
+                               rtt_target++;
+                       }
+                       break;
+               }
+       }
+       WL_DBG(("leave :target_cnt : %d\n", rtt_param.rtt_target_cnt));
+       if (dhd_dev_rtt_set_cfg(bcmcfg_to_prmry_ndev(cfg), &rtt_param) < 0) {
+               WL_ERR(("Could not set RTT configuration\n"));
+               err = -EINVAL;
+       }
+exit:
+       return err;
+}
+
+static int
+wl_cfgvendor_rtt_cancel_config(struct wiphy *wiphy, struct wireless_dev *wdev,
+       const void *data, int len)
+{
+       int err = 0, rem, type, target_cnt = 0;
+       int target_cnt_chk = 0;
+       const struct nlattr *iter;
+       struct ether_addr *mac_list = NULL, *mac_addr = NULL;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+
+       if (len <= 0) {
+               WL_ERR(("Length of nlattr is not valid len : %d\n", len));
+               err = -EINVAL;
+               goto exit;
+       }
+       nla_for_each_attr(iter, data, len, rem) {
+               type = nla_type(iter);
+               switch (type) {
+               case RTT_ATTRIBUTE_TARGET_CNT:
+                       if (mac_list != NULL) {
+                               WL_ERR(("mac_list is not NULL\n"));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       target_cnt = nla_get_u8(iter);
+                       if ((target_cnt <= 0) && (target_cnt > RTT_MAX_TARGET_CNT)) {
+                               /* cancel the current whole RTT process */
+                               goto cancel;
+                       }
+                       mac_list = (struct ether_addr *)kzalloc(target_cnt * ETHER_ADDR_LEN,
+                               GFP_KERNEL);
+                       if (mac_list == NULL) {
+                               WL_ERR(("failed to allocate mem for mac list\n"));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+                       mac_addr = &mac_list[0];
+                       break;
+               case RTT_ATTRIBUTE_TARGET_MAC:
+                       if (mac_addr) {
+                               memcpy(mac_addr++, nla_data(iter), ETHER_ADDR_LEN);
+                               target_cnt_chk++;
+                               if (target_cnt_chk > target_cnt) {
+                                       WL_ERR(("over target count\n"));
+                                       err = -EINVAL;
+                                       goto exit;
+                               }
+                               break;
+                       } else {
+                               WL_ERR(("mac_list is NULL\n"));
+                               err = -EINVAL;
+                               goto exit;
+                       }
+               }
+       }
+cancel:
+       if (dhd_dev_rtt_cancel_cfg(bcmcfg_to_prmry_ndev(cfg), mac_list, target_cnt) < 0) {
+               WL_ERR(("Could not cancel RTT configuration\n"));
+               err = -EINVAL;
+               goto exit;
+       }
+
+exit:
+       if (mac_list) {
+               kfree(mac_list);
+       }
+       return err;
+}
+static int
+wl_cfgvendor_rtt_get_capability(struct wiphy *wiphy, struct wireless_dev *wdev,
+       const void *data, int len)
+{
+       int err = 0;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       rtt_capabilities_t capability;
+
+       err = dhd_dev_rtt_capability(bcmcfg_to_prmry_ndev(cfg), &capability);
+       if (unlikely(err)) {
+               WL_ERR(("Vendor Command reply failed ret:%d \n", err));
+               goto exit;
+       }
+       err =  wl_cfgvendor_send_cmd_reply(wiphy, bcmcfg_to_prmry_ndev(cfg),
+               &capability, sizeof(capability));
+
+       if (unlikely(err)) {
+               WL_ERR(("Vendor Command reply failed ret:%d \n", err));
+       }
+exit:
+       return err;
+}
+
+#endif /* RTT_SUPPORT */
+
+#if defined(KEEP_ALIVE)
+static int wl_cfgvendor_start_mkeep_alive(struct wiphy *wiphy, struct wireless_dev *wdev,
+       const void *data, int len)
+{
+       /* max size of IP packet for keep alive */
+       const int MKEEP_ALIVE_IP_PKT_MAX = 256;
+
+       int ret = BCME_OK, rem, type;
+       u8 mkeep_alive_id = 0;
+       u8 *ip_pkt = NULL;
+       u16 ip_pkt_len = 0;
+       u8 src_mac[ETHER_ADDR_LEN];
+       u8 dst_mac[ETHER_ADDR_LEN];
+       u32 period_msec = 0;
+       const struct nlattr *iter;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       dhd_pub_t *dhd_pub = cfg->pub;
+       gfp_t kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+       nla_for_each_attr(iter, data, len, rem) {
+               type = nla_type(iter);
+               switch (type) {
+                       case MKEEP_ALIVE_ATTRIBUTE_ID:
+                               mkeep_alive_id = nla_get_u8(iter);
+                               break;
+                       case MKEEP_ALIVE_ATTRIBUTE_IP_PKT_LEN:
+                               ip_pkt_len = nla_get_u16(iter);
+                               if (ip_pkt_len > MKEEP_ALIVE_IP_PKT_MAX) {
+                                       ret = BCME_BADARG;
+                                       goto exit;
+                               }
+                               break;
+                       case MKEEP_ALIVE_ATTRIBUTE_IP_PKT:
+                               if (!ip_pkt_len) {
+                                       ret = BCME_BADARG;
+                                       WL_ERR(("ip packet length is 0\n"));
+                                       goto exit;
+                               }
+                               ip_pkt = (u8 *)kzalloc(ip_pkt_len, kflags);
+                               if (ip_pkt == NULL) {
+                                       ret = BCME_NOMEM;
+                                       WL_ERR(("Failed to allocate mem for ip packet\n"));
+                                       goto exit;
+                               }
+                               memcpy(ip_pkt, (u8*)nla_data(iter), ip_pkt_len);
+                               break;
+                       case MKEEP_ALIVE_ATTRIBUTE_SRC_MAC_ADDR:
+                               memcpy(src_mac, nla_data(iter), ETHER_ADDR_LEN);
+                               break;
+                       case MKEEP_ALIVE_ATTRIBUTE_DST_MAC_ADDR:
+                               memcpy(dst_mac, nla_data(iter), ETHER_ADDR_LEN);
+                               break;
+                       case MKEEP_ALIVE_ATTRIBUTE_PERIOD_MSEC:
+                               period_msec = nla_get_u32(iter);
+                               break;
+                       default:
+                               WL_ERR(("Unknown type: %d\n", type));
+                               ret = BCME_BADARG;
+                               goto exit;
+               }
+       }
+
+       if (ip_pkt == NULL) {
+               ret = BCME_BADARG;
+               WL_ERR(("ip packet is NULL\n"));
+               goto exit;
+       }
+
+       ret = dhd_dev_start_mkeep_alive(dhd_pub, mkeep_alive_id, ip_pkt, ip_pkt_len, src_mac,
+               dst_mac, period_msec);
+       if (ret < 0) {
+               WL_ERR(("start_mkeep_alive is failed ret: %d\n", ret));
+       }
+
+exit:
+       if (ip_pkt) {
+               kfree(ip_pkt);
+       }
+
+       return ret;
+}
+
+static int wl_cfgvendor_stop_mkeep_alive(struct wiphy *wiphy, struct wireless_dev *wdev,
+       const void *data, int len)
+{
+       int ret = BCME_OK, rem, type;
+       u8 mkeep_alive_id = 0;
+       const struct nlattr *iter;
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       dhd_pub_t *dhd_pub = cfg->pub;
+
+       nla_for_each_attr(iter, data, len, rem) {
+               type = nla_type(iter);
+               switch (type) {
+                       case MKEEP_ALIVE_ATTRIBUTE_ID:
+                               mkeep_alive_id = nla_get_u8(iter);
+                               break;
+                       default:
+                               WL_ERR(("Unknown type: %d\n", type));
+                               ret = BCME_BADARG;
+                               break;
+               }
+       }
+
+       ret = dhd_dev_stop_mkeep_alive(dhd_pub, mkeep_alive_id);
+       if (ret < 0) {
+               WL_ERR(("stop_mkeep_alive is failed ret: %d\n", ret));
+       }
+
+       return ret;
+}
+#endif /* defined(KEEP_ALIVE) */
+static int
+wl_cfgvendor_priv_string_handler(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       int ret = 0;
+       int ret_len = 0, payload = 0, msglen;
+       const struct bcm_nlmsg_hdr *nlioc = data;
+       void *buf = NULL, *cur;
+       int maxmsglen = PAGE_SIZE - 0x100;
+       struct sk_buff *reply;
+
+       WL_ERR(("entry: cmd = %d\n", nlioc->cmd));
+
+       len -= sizeof(struct bcm_nlmsg_hdr);
+       ret_len = nlioc->len;
+       if (ret_len > 0 || len > 0) {
+               if (len > DHD_IOCTL_MAXLEN) {
+                       WL_ERR(("oversize input buffer %d\n", len));
+                       len = DHD_IOCTL_MAXLEN;
+               }
+               if (ret_len > DHD_IOCTL_MAXLEN) {
+                       WL_ERR(("oversize return buffer %d\n", ret_len));
+                       ret_len = DHD_IOCTL_MAXLEN;
+               }
+               payload = max(ret_len, len) + 1;
+               buf = vzalloc(payload);
+               if (!buf) {
+                       return -ENOMEM;
+               }
+               memcpy(buf, (void *)nlioc + nlioc->offset, len);
+               *(char *)(buf + len) = '\0';
+       }
+
+       ret = dhd_cfgvendor_priv_string_handler(cfg, wdev, nlioc, buf);
+       if (ret) {
+               WL_ERR(("dhd_cfgvendor returned error %d", ret));
+               vfree(buf);
+               return ret;
+       }
+       cur = buf;
+       while (ret_len > 0) {
+               msglen = nlioc->len > maxmsglen ? maxmsglen : ret_len;
+               ret_len -= msglen;
+               payload = msglen + sizeof(msglen);
+               reply = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, payload);
+               if (!reply) {
+                       WL_ERR(("Failed to allocate reply msg\n"));
+                       ret = -ENOMEM;
+                       break;
+               }
+
+               if (nla_put(reply, BCM_NLATTR_DATA, msglen, cur) ||
+                       nla_put_u16(reply, BCM_NLATTR_LEN, msglen)) {
+                       kfree_skb(reply);
+                       ret = -ENOBUFS;
+                       break;
+               }
+
+               ret = cfg80211_vendor_cmd_reply(reply);
+               if (ret) {
+                       WL_ERR(("testmode reply failed:%d\n", ret));
+                       break;
+               }
+               cur += msglen;
+       }
+
+       return ret;
+}
+
+static int
+wl_cfgvendor_priv_bcm_handler(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       int err = 0;
+       int data_len = 0;
+
+       WL_INFORM(("%s: Enter \n", __func__));
+
+       bzero(cfg->ioctl_buf, WLC_IOCTL_MAXLEN);
+
+       if (strncmp((char *)data, BRCM_VENDOR_SCMD_CAPA, strlen(BRCM_VENDOR_SCMD_CAPA)) == 0) {
+               err = wldev_iovar_getbuf(bcmcfg_to_prmry_ndev(cfg), "cap", NULL, 0,
+                       cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+               if (unlikely(err)) {
+                       WL_ERR(("error (%d)\n", err));
+                       return err;
+               }
+               data_len = strlen(cfg->ioctl_buf);
+       cfg->ioctl_buf[data_len] = '\0';
+       }
+
+       err =  wl_cfgvendor_send_cmd_reply(wiphy, bcmcfg_to_prmry_ndev(cfg),
+               cfg->ioctl_buf, data_len+1);
+       if (unlikely(err))
+               WL_ERR(("Vendor Command reply failed ret:%d \n", err));
+       else
+               WL_INFORM(("Vendor Command reply sent successfully!\n"));
+
+       return err;
+}
+
+#ifdef LINKSTAT_SUPPORT
+#define NUM_RATE 32
+#define NUM_PEER 1
+#define NUM_CHAN 11
+#define HEADER_SIZE sizeof(ver_len)
+static int wl_cfgvendor_lstats_get_info(struct wiphy *wiphy,
+       struct wireless_dev *wdev, const void  *data, int len)
+{
+       static char iovar_buf[WLC_IOCTL_MAXLEN];
+       struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+       int err = 0, i;
+       wifi_iface_stat *iface;
+       wifi_radio_stat *radio;
+       wl_wme_cnt_t *wl_wme_cnt;
+       wl_cnt_v_le10_mcst_t *macstat_cnt;
+       wl_cnt_wlc_t *wlc_cnt;
+       scb_val_t scbval;
+       char *output;
+       wifi_rate_stat *p_wifi_rate_stat = NULL;
+       wifi_rate_stat_v2 *p_wifi_rate_stat_v2 = NULL;
+       uint total_len = 0;
+
+
+       WL_INFORM(("%s: Enter \n", __func__));
+       RETURN_EIO_IF_NOT_UP(cfg);
+
+       bzero(&scbval, sizeof(scb_val_t));
+       bzero(cfg->ioctl_buf, WLC_IOCTL_MAXLEN);
+       bzero(iovar_buf, WLC_IOCTL_MAXLEN);
+
+       output = cfg->ioctl_buf;
+
+       err = wldev_iovar_getbuf(bcmcfg_to_prmry_ndev(cfg), "radiostat", NULL, 0,
+               iovar_buf, WLC_IOCTL_MAXLEN, NULL);
+       if (err != BCME_OK && err != BCME_UNSUPPORTED) {
+               WL_ERR(("error (%d) - size = %zu\n", err, sizeof(wifi_radio_stat)));
+               return err;
+       }
+       radio = (wifi_radio_stat *)iovar_buf;
+       radio->num_channels = NUM_CHAN;
+       memcpy(output, iovar_buf+HEADER_SIZE, sizeof(wifi_radio_stat)-HEADER_SIZE);
+
+       output += (sizeof(wifi_radio_stat) - HEADER_SIZE) - sizeof(wifi_channel_stat);
+       output += (NUM_CHAN*sizeof(wifi_channel_stat));
+
+       err = wldev_iovar_getbuf(bcmcfg_to_prmry_ndev(cfg), "wme_counters", NULL, 0,
+               iovar_buf, WLC_IOCTL_MAXLEN, NULL);
+       if (unlikely(err)) {
+               WL_ERR(("error (%d)\n", err));
+               return err;
+       }
+       wl_wme_cnt = (wl_wme_cnt_t *)iovar_buf;
+       iface = (wifi_iface_stat *)output;
+
+       iface->ac[WIFI_AC_VO].ac = WIFI_AC_VO;
+       iface->ac[WIFI_AC_VO].tx_mpdu = wl_wme_cnt->tx[AC_VO].packets;
+       iface->ac[WIFI_AC_VO].rx_mpdu = wl_wme_cnt->rx[AC_VO].packets;
+       iface->ac[WIFI_AC_VO].mpdu_lost = wl_wme_cnt->tx_failed[WIFI_AC_VO].packets;
+
+       iface->ac[WIFI_AC_VI].ac = WIFI_AC_VI;
+       iface->ac[WIFI_AC_VI].tx_mpdu = wl_wme_cnt->tx[AC_VI].packets;
+       iface->ac[WIFI_AC_VI].rx_mpdu = wl_wme_cnt->rx[AC_VI].packets;
+       iface->ac[WIFI_AC_VI].mpdu_lost = wl_wme_cnt->tx_failed[WIFI_AC_VI].packets;
+
+       iface->ac[WIFI_AC_BE].ac = WIFI_AC_BE;
+       iface->ac[WIFI_AC_BE].tx_mpdu = wl_wme_cnt->tx[AC_BE].packets;
+       iface->ac[WIFI_AC_BE].rx_mpdu = wl_wme_cnt->rx[AC_BE].packets;
+       iface->ac[WIFI_AC_BE].mpdu_lost = wl_wme_cnt->tx_failed[WIFI_AC_BE].packets;
+
+       iface->ac[WIFI_AC_BK].ac = WIFI_AC_BK;
+       iface->ac[WIFI_AC_BK].tx_mpdu = wl_wme_cnt->tx[AC_BK].packets;
+       iface->ac[WIFI_AC_BK].rx_mpdu = wl_wme_cnt->rx[AC_BK].packets;
+       iface->ac[WIFI_AC_BK].mpdu_lost = wl_wme_cnt->tx_failed[WIFI_AC_BK].packets;
+       bzero(iovar_buf, WLC_IOCTL_MAXLEN);
+
+       err = wldev_iovar_getbuf(bcmcfg_to_prmry_ndev(cfg), "counters", NULL, 0,
+               iovar_buf, WLC_IOCTL_MAXLEN, NULL);
+       if (unlikely(err)) {
+               WL_ERR(("error (%d) - size = %zu\n", err, sizeof(wl_cnt_wlc_t)));
+               return err;
+       }
+
+       /* Translate traditional (ver <= 10) counters struct to new xtlv type struct */
+       err = wl_cntbuf_to_xtlv_format(NULL, iovar_buf, WL_CNTBUF_MAX_SIZE, 0);
+       if (err != BCME_OK) {
+               WL_ERR(("%s wl_cntbuf_to_xtlv_format ERR %d\n",  __FUNCTION__, err));
+       return err;
+       }
+
+       if (!(wlc_cnt = GET_WLCCNT_FROM_CNTBUF(iovar_buf))) {
+               WL_ERR(("%s wlc_cnt NULL!\n", __FUNCTION__));
+               return BCME_ERROR;
+       }
+
+       iface->ac[WIFI_AC_BE].retries = wlc_cnt->txretry;
+
+       if ((macstat_cnt = bcm_get_data_from_xtlv_buf(((wl_cnt_info_t *)iovar_buf)->data,
+                       ((wl_cnt_info_t *)iovar_buf)->datalen,
+                       WL_CNT_XTLV_CNTV_LE10_UCODE, NULL,
+                       BCM_XTLV_OPTION_ALIGN32)) == NULL) {
+               macstat_cnt = bcm_get_data_from_xtlv_buf(((wl_cnt_info_t *)iovar_buf)->data,
+                               ((wl_cnt_info_t *)iovar_buf)->datalen,
+                               WL_CNT_XTLV_LT40_UCODE_V1, NULL,
+                               BCM_XTLV_OPTION_ALIGN32);
+       }
+
+       if (macstat_cnt == NULL) {
+               printf("wlmTxGetAckedPackets: macstat_cnt NULL!\n");
+               return FALSE;
+       }
+
+       iface->beacon_rx = macstat_cnt->rxbeaconmbss;
+
+       err = wldev_get_rssi(bcmcfg_to_prmry_ndev(cfg), &scbval);
+       if (unlikely(err)) {
+               WL_ERR(("get_rssi error (%d)\n", err));
+               return err;
+       }
+       iface->rssi_mgmt = scbval.val;
+
+       iface->num_peers = NUM_PEER;
+       iface->peer_info->num_rate = NUM_RATE;
+
+       bzero(iovar_buf, WLC_IOCTL_MAXLEN);
+
+       output = (char *) &(iface->peer_info->num_rate);
+       output += sizeof(iface->peer_info->num_rate);
+
+       err = wldev_iovar_getbuf(bcmcfg_to_prmry_ndev(cfg), "ratestat", NULL, 0,
+               iovar_buf, WLC_IOCTL_MAXLEN, NULL);
+       if (err != BCME_OK && err != BCME_UNSUPPORTED) {
+               WL_ERR(("error (%d) - size = %zu\n", err, NUM_RATE*sizeof(wifi_rate_stat_v2)));
+               return err;
+       }
+       for (i = 0; i < NUM_RATE; i++) {
+
+               p_wifi_rate_stat_v2 =
+                       (wifi_rate_stat_v2 *)(iovar_buf + i*sizeof(wifi_rate_stat_v2));
+
+               /* transform wifi_rate_stat_v2 to wifi_rate_stat */
+               p_wifi_rate_stat = (wifi_rate_stat *)output;
+               p_wifi_rate_stat->rate.preamble = p_wifi_rate_stat_v2->rate.preamble;
+               p_wifi_rate_stat->rate.nss = p_wifi_rate_stat_v2->rate.nss;
+               p_wifi_rate_stat->rate.bw = p_wifi_rate_stat_v2->rate.bw;
+               p_wifi_rate_stat->rate.rateMcsIdx = p_wifi_rate_stat_v2->rate.rateMcsIdx;
+               p_wifi_rate_stat->rate.reserved = p_wifi_rate_stat_v2->rate.reserved;
+               p_wifi_rate_stat->rate.bitrate = p_wifi_rate_stat_v2->rate.bitrate;
+               p_wifi_rate_stat->tx_mpdu = p_wifi_rate_stat_v2->tx_mpdu;
+               p_wifi_rate_stat->rx_mpdu = p_wifi_rate_stat_v2->rx_mpdu;
+               p_wifi_rate_stat->mpdu_lost = p_wifi_rate_stat_v2->mpdu_lost;
+               p_wifi_rate_stat->retries = p_wifi_rate_stat_v2->retries;
+               p_wifi_rate_stat->retries_short = p_wifi_rate_stat_v2->retries_short;
+               p_wifi_rate_stat->retries_long = p_wifi_rate_stat_v2->retries_long;
+
+               output = (char *) &(p_wifi_rate_stat->retries_long);
+               output += sizeof(p_wifi_rate_stat->retries_long);
+       }
+       total_len = sizeof(wifi_radio_stat)-HEADER_SIZE-sizeof(wifi_channel_stat) +
+               NUM_CHAN*sizeof(wifi_channel_stat) +
+               sizeof(wifi_iface_stat)-sizeof(wifi_peer_info) +
+               NUM_PEER*(sizeof(wifi_peer_info)-sizeof(wifi_rate_stat) +
+               NUM_RATE*sizeof(wifi_rate_stat));
+
+       if (total_len > WLC_IOCTL_MAXLEN) {
+               WL_ERR(("Error! total_len:%d is unexpected value\n", total_len));
+               return BCME_BADLEN;
+       }
+
+       err =  wl_cfgvendor_send_cmd_reply(wiphy, bcmcfg_to_prmry_ndev(cfg),
+               cfg->ioctl_buf,
+               total_len);
+
+       if (unlikely(err))
+               WL_ERR(("Vendor Command reply failed ret:%d \n", err));
+
+       return err;
+}
+#endif /* LINKSTAT_SUPPORT */
+
+static const struct wiphy_vendor_command wl_vendor_cmds [] = {
+       {
+               {
+                       .vendor_id = OUI_BRCM,
+                       .subcmd = BRCM_VENDOR_SCMD_PRIV_STR
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+               .doit = wl_cfgvendor_priv_string_handler
+       },
+       {
+               {
+                       .vendor_id = OUI_BRCM,
+                       .subcmd = BRCM_VENDOR_SCMD_BCM_STR
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+               .doit = wl_cfgvendor_priv_bcm_handler
+       },
+#ifdef GSCAN_SUPPORT
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = GSCAN_SUBCMD_GET_CAPABILITIES
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+               .doit = wl_cfgvendor_gscan_get_capabilities
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = GSCAN_SUBCMD_SET_CONFIG
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+               .doit = wl_cfgvendor_set_scan_cfg
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = GSCAN_SUBCMD_SET_SCAN_CONFIG
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+               .doit = wl_cfgvendor_set_batch_scan_cfg
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = GSCAN_SUBCMD_ENABLE_GSCAN
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+               .doit = wl_cfgvendor_initiate_gscan
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = GSCAN_SUBCMD_ENABLE_FULL_SCAN_RESULTS
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+               .doit = wl_cfgvendor_enable_full_scan_result
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = GSCAN_SUBCMD_SET_HOTLIST
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+               .doit = wl_cfgvendor_hotlist_cfg
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = GSCAN_SUBCMD_SET_SIGNIFICANT_CHANGE_CONFIG
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+               .doit = wl_cfgvendor_significant_change_cfg
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = GSCAN_SUBCMD_GET_SCAN_RESULTS
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+               .doit = wl_cfgvendor_gscan_get_batch_results
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = GSCAN_SUBCMD_GET_CHANNEL_LIST
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+               .doit = wl_cfgvendor_gscan_get_channel_list
+       },
+#endif /* GSCAN_SUPPORT */
+#ifdef RTT_SUPPORT
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = RTT_SUBCMD_SET_CONFIG
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+               .doit = wl_cfgvendor_rtt_set_config
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = RTT_SUBCMD_CANCEL_CONFIG
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+               .doit = wl_cfgvendor_rtt_cancel_config
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = RTT_SUBCMD_GETCAPABILITY
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+               .doit = wl_cfgvendor_rtt_get_capability
+       },
+#endif /* RTT_SUPPORT */
+#ifdef KEEP_ALIVE
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = WIFI_OFFLOAD_SUBCMD_START_MKEEP_ALIVE
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+               .doit = wl_cfgvendor_start_mkeep_alive
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = WIFI_OFFLOAD_SUBCMD_STOP_MKEEP_ALIVE
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+               .doit = wl_cfgvendor_stop_mkeep_alive
+       },
+#endif /* KEEP_ALIVE */
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = ANDR_WIFI_SUBCMD_GET_FEATURE_SET
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+               .doit = wl_cfgvendor_get_feature_set
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = ANDR_WIFI_SUBCMD_GET_FEATURE_SET_MATRIX
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+               .doit = wl_cfgvendor_get_feature_set_matrix
+       },
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = ANDR_WIFI_PNO_RANDOM_MAC_OUI
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+               .doit = wl_cfgvendor_set_pno_mac_oui
+       },
+#ifdef CUSTOM_FORCE_NODFS_FLAG
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = ANDR_WIFI_NODFS_CHANNELS
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+               .doit = wl_cfgvendor_set_nodfs_flag
+
+       },
+#endif /* CUSTOM_FORCE_NODFS_FLAG */
+#ifdef LINKSTAT_SUPPORT
+       {
+               {
+                       .vendor_id = OUI_GOOGLE,
+                       .subcmd = LSTATS_SUBCMD_GET_INFO
+               },
+               .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+               .doit = wl_cfgvendor_lstats_get_info
+       },
+#endif /* LINKSTAT_SUPPORT */
+};
+
+static const struct  nl80211_vendor_cmd_info wl_vendor_events [] = {
+               { OUI_BRCM, BRCM_VENDOR_EVENT_UNSPEC },
+               { OUI_BRCM, BRCM_VENDOR_EVENT_PRIV_STR },
+#ifdef GSCAN_SUPPORT
+               { OUI_GOOGLE, GOOGLE_GSCAN_SIGNIFICANT_EVENT },
+               { OUI_GOOGLE, GOOGLE_GSCAN_GEOFENCE_FOUND_EVENT },
+               { OUI_GOOGLE, GOOGLE_GSCAN_BATCH_SCAN_EVENT },
+               { OUI_GOOGLE, GOOGLE_SCAN_FULL_RESULTS_EVENT },
+#endif /* GSCAN_SUPPORT */
+#ifdef RTT_SUPPORT
+               { OUI_GOOGLE, GOOGLE_RTT_COMPLETE_EVENT },
+#endif /* RTT_SUPPORT */
+#ifdef GSCAN_SUPPORT
+               { OUI_GOOGLE, GOOGLE_SCAN_COMPLETE_EVENT },
+               { OUI_GOOGLE, GOOGLE_GSCAN_GEOFENCE_LOST_EVENT },
+#endif /* GSCAN_SUPPORT */
+               { OUI_GOOGLE, GOOGLE_RSSI_MONITOR_EVENT },
+#ifdef KEEP_ALIVE
+               { OUI_GOOGLE, GOOGLE_MKEEP_ALIVE_EVENT },
+#endif
+               { OUI_BRCM, BRCM_VENDOR_EVENT_IDSUP_STATUS }
+};
+
+int wl_cfgvendor_attach(struct wiphy *wiphy)
+{
+
+       WL_INFORM(("Vendor: Register BRCM cfg80211 vendor cmd(0x%x) interface \n",
+               NL80211_CMD_VENDOR));
+
+       wiphy->vendor_commands  = wl_vendor_cmds;
+       wiphy->n_vendor_commands = ARRAY_SIZE(wl_vendor_cmds);
+       wiphy->vendor_events    = wl_vendor_events;
+       wiphy->n_vendor_events  = ARRAY_SIZE(wl_vendor_events);
+
+       return 0;
+}
+
+int wl_cfgvendor_detach(struct wiphy *wiphy)
+{
+       WL_INFORM(("Vendor: Unregister BRCM cfg80211 vendor interface \n"));
+
+       wiphy->vendor_commands  = NULL;
+       wiphy->vendor_events    = NULL;
+       wiphy->n_vendor_commands = 0;
+       wiphy->n_vendor_events  = 0;
+
+       return 0;
+}
+#endif /* defined(WL_VENDOR_EXT_SUPPORT) */
diff --git a/drivers/net/wireless/bcmdhd_1363/wl_cfgvendor.h b/drivers/net/wireless/bcmdhd_1363/wl_cfgvendor.h
new file mode 100644 (file)
index 0000000..414692e
--- /dev/null
@@ -0,0 +1,286 @@
+/*
+ * Linux cfg80211 Vendor Extension Code
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: wl_cfgvendor.h 630676 2016-04-11 15:20:57Z $
+ */
+
+
+#ifndef _wl_cfgvendor_h_
+#define _wl_cfgvendor_h_
+
+#define OUI_BRCM    0x001018
+#define OUI_GOOGLE  0x001A11
+#define BRCM_VENDOR_SUBCMD_PRIV_STR    1
+#define ATTRIBUTE_U32_LEN                  (NLA_HDRLEN  + 4)
+#define VENDOR_ID_OVERHEAD                 ATTRIBUTE_U32_LEN
+#define VENDOR_SUBCMD_OVERHEAD             ATTRIBUTE_U32_LEN
+#define VENDOR_DATA_OVERHEAD               (NLA_HDRLEN)
+
+#define SCAN_RESULTS_COMPLETE_FLAG_LEN       ATTRIBUTE_U32_LEN
+#define SCAN_INDEX_HDR_LEN                   (NLA_HDRLEN)
+#define SCAN_ID_HDR_LEN                      ATTRIBUTE_U32_LEN
+#define SCAN_FLAGS_HDR_LEN                   ATTRIBUTE_U32_LEN
+#define GSCAN_NUM_RESULTS_HDR_LEN            ATTRIBUTE_U32_LEN
+#define GSCAN_RESULTS_HDR_LEN                (NLA_HDRLEN)
+#define GSCAN_BATCH_RESULT_HDR_LEN  (SCAN_INDEX_HDR_LEN + SCAN_ID_HDR_LEN + \
+                                                                       SCAN_FLAGS_HDR_LEN + \
+                                                               GSCAN_NUM_RESULTS_HDR_LEN + \
+                                                                       GSCAN_RESULTS_HDR_LEN)
+
+#define VENDOR_REPLY_OVERHEAD       (VENDOR_ID_OVERHEAD + \
+                                                                       VENDOR_SUBCMD_OVERHEAD + \
+                                                                       VENDOR_DATA_OVERHEAD)
+
+#define GSCAN_ATTR_SET1                                10
+#define GSCAN_ATTR_SET2                                20
+#define GSCAN_ATTR_SET3                                30
+#define GSCAN_ATTR_SET4                                40
+#define GSCAN_ATTR_SET5                                50
+#define GSCAN_ATTR_SET6                                60
+
+typedef enum {
+       /* don't use 0 as a valid subcommand */
+       VENDOR_NL80211_SUBCMD_UNSPECIFIED,
+
+       /* define all vendor startup commands between 0x0 and 0x0FFF */
+       VENDOR_NL80211_SUBCMD_RANGE_START = 0x0001,
+       VENDOR_NL80211_SUBCMD_RANGE_END   = 0x0FFF,
+
+       /* define all GScan related commands between 0x1000 and 0x10FF */
+       ANDROID_NL80211_SUBCMD_GSCAN_RANGE_START = 0x1000,
+       ANDROID_NL80211_SUBCMD_GSCAN_RANGE_END   = 0x10FF,
+
+       /* define all NearbyDiscovery related commands between 0x1100 and 0x11FF */
+       ANDROID_NL80211_SUBCMD_NBD_RANGE_START = 0x1100,
+       ANDROID_NL80211_SUBCMD_NBD_RANGE_END   = 0x11FF,
+
+       /* define all RTT related commands between 0x1100 and 0x11FF */
+       ANDROID_NL80211_SUBCMD_RTT_RANGE_START = 0x1100,
+       ANDROID_NL80211_SUBCMD_RTT_RANGE_END   = 0x11FF,
+
+       ANDROID_NL80211_SUBCMD_LSTATS_RANGE_START = 0x1200,
+       ANDROID_NL80211_SUBCMD_LSTATS_RANGE_END   = 0x12FF,
+
+       ANDROID_NL80211_SUBCMD_TDLS_RANGE_START = 0x1300,
+       ANDROID_NL80211_SUBCMD_TDLS_RANGE_END   = 0x13FF,
+       /* This is reserved for future usage */
+
+       /* define all wifi calling related commands between 0x1600 and 0x16FF */
+       ANDROID_NL80211_SUBCMD_WIFI_OFFLOAD_RANGE_START = 0x1600,
+       ANDROID_NL80211_SUBCMD_WIFI_OFFLOAD_RANGE_END   = 0x16FF
+} ANDROID_VENDOR_SUB_COMMAND;
+enum andr_vendor_subcmd {
+       GSCAN_SUBCMD_GET_CAPABILITIES = ANDROID_NL80211_SUBCMD_GSCAN_RANGE_START,
+       GSCAN_SUBCMD_SET_CONFIG,
+       GSCAN_SUBCMD_SET_SCAN_CONFIG,
+       GSCAN_SUBCMD_ENABLE_GSCAN,
+       GSCAN_SUBCMD_GET_SCAN_RESULTS,
+       GSCAN_SUBCMD_SCAN_RESULTS,
+       GSCAN_SUBCMD_SET_HOTLIST,
+       GSCAN_SUBCMD_SET_SIGNIFICANT_CHANGE_CONFIG,
+       GSCAN_SUBCMD_ENABLE_FULL_SCAN_RESULTS,
+       GSCAN_SUBCMD_GET_CHANNEL_LIST,
+       /* ANDR_WIFI_XXX although not related to gscan are defined here */
+       ANDR_WIFI_SUBCMD_GET_FEATURE_SET,
+       ANDR_WIFI_SUBCMD_GET_FEATURE_SET_MATRIX,
+       ANDR_WIFI_PNO_RANDOM_MAC_OUI,
+       ANDR_WIFI_NODFS_CHANNELS,
+       RTT_SUBCMD_SET_CONFIG = ANDROID_NL80211_SUBCMD_RTT_RANGE_START,
+       RTT_SUBCMD_CANCEL_CONFIG,
+       RTT_SUBCMD_GETCAPABILITY,
+
+       LSTATS_SUBCMD_GET_INFO = ANDROID_NL80211_SUBCMD_LSTATS_RANGE_START,
+
+       WIFI_OFFLOAD_SUBCMD_START_MKEEP_ALIVE = ANDROID_NL80211_SUBCMD_WIFI_OFFLOAD_RANGE_START,
+       WIFI_OFFLOAD_SUBCMD_STOP_MKEEP_ALIVE,
+    /* Add more sub commands here */
+       VENDOR_SUBCMD_MAX
+};
+
+enum gscan_attributes {
+    GSCAN_ATTRIBUTE_NUM_BUCKETS = GSCAN_ATTR_SET1,
+    GSCAN_ATTRIBUTE_BASE_PERIOD,
+    GSCAN_ATTRIBUTE_BUCKETS_BAND,
+    GSCAN_ATTRIBUTE_BUCKET_ID,
+    GSCAN_ATTRIBUTE_BUCKET_PERIOD,
+    GSCAN_ATTRIBUTE_BUCKET_NUM_CHANNELS,
+    GSCAN_ATTRIBUTE_BUCKET_CHANNELS,
+    GSCAN_ATTRIBUTE_NUM_AP_PER_SCAN,
+    GSCAN_ATTRIBUTE_REPORT_THRESHOLD,
+    GSCAN_ATTRIBUTE_NUM_SCANS_TO_CACHE,
+    GSCAN_ATTRIBUTE_BAND = GSCAN_ATTRIBUTE_BUCKETS_BAND,
+
+    GSCAN_ATTRIBUTE_ENABLE_FEATURE = GSCAN_ATTR_SET2,
+    GSCAN_ATTRIBUTE_SCAN_RESULTS_COMPLETE,
+    GSCAN_ATTRIBUTE_FLUSH_FEATURE,
+    GSCAN_ATTRIBUTE_ENABLE_FULL_SCAN_RESULTS,
+    GSCAN_ATTRIBUTE_REPORT_EVENTS,
+    /* remaining reserved for additional attributes */
+    GSCAN_ATTRIBUTE_NUM_OF_RESULTS = GSCAN_ATTR_SET3,
+    GSCAN_ATTRIBUTE_FLUSH_RESULTS,
+    GSCAN_ATTRIBUTE_SCAN_RESULTS,                       /* flat array of wifi_scan_result */
+    GSCAN_ATTRIBUTE_SCAN_ID,                            /* indicates scan number */
+    GSCAN_ATTRIBUTE_SCAN_FLAGS,                         /* indicates if scan was aborted */
+    GSCAN_ATTRIBUTE_AP_FLAGS,                           /* flags on significant change event */
+    GSCAN_ATTRIBUTE_NUM_CHANNELS,
+    GSCAN_ATTRIBUTE_CHANNEL_LIST,
+
+       /* remaining reserved for additional attributes */
+
+    GSCAN_ATTRIBUTE_SSID = GSCAN_ATTR_SET4,
+    GSCAN_ATTRIBUTE_BSSID,
+    GSCAN_ATTRIBUTE_CHANNEL,
+    GSCAN_ATTRIBUTE_RSSI,
+    GSCAN_ATTRIBUTE_TIMESTAMP,
+    GSCAN_ATTRIBUTE_RTT,
+    GSCAN_ATTRIBUTE_RTTSD,
+
+    /* remaining reserved for additional attributes */
+
+    GSCAN_ATTRIBUTE_HOTLIST_BSSIDS = GSCAN_ATTR_SET5,
+    GSCAN_ATTRIBUTE_RSSI_LOW,
+    GSCAN_ATTRIBUTE_RSSI_HIGH,
+    GSCAN_ATTRIBUTE_HOSTLIST_BSSID_ELEM,
+    GSCAN_ATTRIBUTE_HOTLIST_FLUSH,
+
+    /* remaining reserved for additional attributes */
+    GSCAN_ATTRIBUTE_RSSI_SAMPLE_SIZE = GSCAN_ATTR_SET6,
+    GSCAN_ATTRIBUTE_LOST_AP_SAMPLE_SIZE,
+    GSCAN_ATTRIBUTE_MIN_BREACHING,
+    GSCAN_ATTRIBUTE_SIGNIFICANT_CHANGE_BSSIDS,
+    GSCAN_ATTRIBUTE_SIGNIFICANT_CHANGE_FLUSH,
+    GSCAN_ATTRIBUTE_MAX
+};
+
+enum gscan_bucket_attributes {
+       GSCAN_ATTRIBUTE_CH_BUCKET_1,
+       GSCAN_ATTRIBUTE_CH_BUCKET_2,
+       GSCAN_ATTRIBUTE_CH_BUCKET_3,
+       GSCAN_ATTRIBUTE_CH_BUCKET_4,
+       GSCAN_ATTRIBUTE_CH_BUCKET_5,
+       GSCAN_ATTRIBUTE_CH_BUCKET_6,
+       GSCAN_ATTRIBUTE_CH_BUCKET_7
+};
+
+enum gscan_ch_attributes {
+       GSCAN_ATTRIBUTE_CH_ID_1,
+       GSCAN_ATTRIBUTE_CH_ID_2,
+       GSCAN_ATTRIBUTE_CH_ID_3,
+       GSCAN_ATTRIBUTE_CH_ID_4,
+       GSCAN_ATTRIBUTE_CH_ID_5,
+       GSCAN_ATTRIBUTE_CH_ID_6,
+       GSCAN_ATTRIBUTE_CH_ID_7
+};
+
+enum rtt_attributes {
+       RTT_ATTRIBUTE_TARGET_CNT,
+       RTT_ATTRIBUTE_TARGET_INFO,
+       RTT_ATTRIBUTE_TARGET_MAC,
+       RTT_ATTRIBUTE_TARGET_TYPE,
+       RTT_ATTRIBUTE_TARGET_PEER,
+       RTT_ATTRIBUTE_TARGET_CHAN,
+       RTT_ATTRIBUTE_TARGET_MODE,
+       RTT_ATTRIBUTE_TARGET_INTERVAL,
+       RTT_ATTRIBUTE_TARGET_NUM_MEASUREMENT,
+       RTT_ATTRIBUTE_TARGET_NUM_PKT,
+       RTT_ATTRIBUTE_TARGET_NUM_RETRY
+};
+
+enum mkeep_alive_attributes {
+       MKEEP_ALIVE_ATTRIBUTE_ID,
+       MKEEP_ALIVE_ATTRIBUTE_IP_PKT,
+       MKEEP_ALIVE_ATTRIBUTE_IP_PKT_LEN,
+       MKEEP_ALIVE_ATTRIBUTE_SRC_MAC_ADDR,
+       MKEEP_ALIVE_ATTRIBUTE_DST_MAC_ADDR,
+       MKEEP_ALIVE_ATTRIBUTE_PERIOD_MSEC
+};
+
+typedef enum wl_vendor_event {
+       BRCM_VENDOR_EVENT_UNSPEC,
+       BRCM_VENDOR_EVENT_PRIV_STR,
+       GOOGLE_GSCAN_SIGNIFICANT_EVENT,
+       GOOGLE_GSCAN_GEOFENCE_FOUND_EVENT,
+       GOOGLE_GSCAN_BATCH_SCAN_EVENT,
+       GOOGLE_SCAN_FULL_RESULTS_EVENT,
+       GOOGLE_RTT_COMPLETE_EVENT,
+       GOOGLE_SCAN_COMPLETE_EVENT,
+       GOOGLE_GSCAN_GEOFENCE_LOST_EVENT,
+       GOOGLE_RSSI_MONITOR_EVENT,
+       GOOGLE_MKEEP_ALIVE_EVENT,
+       BRCM_VENDOR_EVENT_IDSUP_STATUS
+} wl_vendor_event_t;
+
+enum andr_wifi_attr {
+       ANDR_WIFI_ATTRIBUTE_NUM_FEATURE_SET,
+       ANDR_WIFI_ATTRIBUTE_FEATURE_SET,
+       ANDR_WIFI_ATTRIBUTE_PNO_RANDOM_MAC_OUI,
+       ANDR_WIFI_ATTRIBUTE_NODFS_SET
+};
+
+typedef enum wl_vendor_gscan_attribute {
+       ATTR_START_GSCAN,
+       ATTR_STOP_GSCAN,
+       ATTR_SET_SCAN_BATCH_CFG_ID, /* set batch scan params */
+       ATTR_SET_SCAN_GEOFENCE_CFG_ID, /* set list of bssids to track */
+       ATTR_SET_SCAN_SIGNIFICANT_CFG_ID, /* set list of bssids, rssi threshold etc.. */
+       ATTR_SET_SCAN_CFG_ID, /* set common scan config params here */
+       ATTR_GET_GSCAN_CAPABILITIES_ID,
+    /* Add more sub commands here */
+       ATTR_GSCAN_MAX
+} wl_vendor_gscan_attribute_t;
+
+typedef enum gscan_batch_attribute {
+       ATTR_GSCAN_BATCH_BESTN,
+       ATTR_GSCAN_BATCH_MSCAN,
+       ATTR_GSCAN_BATCH_BUFFER_THRESHOLD
+} gscan_batch_attribute_t;
+
+typedef enum gscan_geofence_attribute {
+       ATTR_GSCAN_NUM_HOTLIST_BSSID,
+       ATTR_GSCAN_HOTLIST_BSSID
+} gscan_geofence_attribute_t;
+
+typedef enum gscan_complete_event {
+       WIFI_SCAN_BUFFER_FULL,
+       WIFI_SCAN_COMPLETE
+} gscan_complete_event_t;
+
+/* Capture the BRCM_VENDOR_SUBCMD_PRIV_STRINGS* here */
+#define BRCM_VENDOR_SCMD_CAPA  "cap"
+
+#if defined(WL_VENDOR_EXT_SUPPORT) || defined(CONFIG_BCMDHD_VENDOR_EXT)
+extern int wl_cfgvendor_attach(struct wiphy *wiphy);
+extern int wl_cfgvendor_detach(struct wiphy *wiphy);
+extern int wl_cfgvendor_send_async_event(struct wiphy *wiphy,
+                  struct net_device *dev, int event_id, const void  *data, int len);
+extern int wl_cfgvendor_send_hotlist_event(struct wiphy *wiphy,
+                struct net_device *dev, void  *data, int len, wl_vendor_event_t event);
+#else
+static INLINE int cfgvendor_attach(struct wiphy *wiphy) { return 0; }
+static INLINE int cfgvendor_detach(struct wiphy *wiphy) { return 0; }
+#endif /* defined(WL_VENDOR_EXT_SUPPORT) */
+
+#endif /* _wl_cfgvendor_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/wl_dbg.h b/drivers/net/wireless/bcmdhd_1363/wl_dbg.h
new file mode 100644 (file)
index 0000000..8d0a440
--- /dev/null
@@ -0,0 +1,211 @@
+/*
+ * Minimal debug/trace/assert driver definitions for
+ * Broadcom 802.11 Networking Adapter.
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: wl_dbg.h 519338 2014-12-05 21:23:30Z $
+ */
+
+
+#ifndef _wl_dbg_h_
+#define _wl_dbg_h_
+
+/* wl_msg_level is a bit vector with defs in wlioctl.h */
+extern uint32 wl_msg_level;
+extern uint32 wl_msg_level2;
+
+#define WL_TIMESTAMP()
+
+#define WL_PRINT(args)         do { WL_TIMESTAMP(); printf args; } while (0)
+
+#if defined(EVENT_LOG_COMPILE) && defined(WLMSG_SRSCAN)
+#define _WL_SRSCAN(fmt, ...)   EVENT_LOG(EVENT_LOG_TAG_SRSCAN, fmt, ##__VA_ARGS__)
+#define WL_SRSCAN(args)                _WL_SRSCAN args
+#else
+#define WL_SRSCAN(args)
+#endif
+
+#if defined(BCMCONDITIONAL_LOGGING)
+
+/* Ideally this should be some include file that vendors can include to conditionalize logging */
+
+/* DBGONLY() macro to reduce ifdefs in code for statements that are only needed when
+ * BCMDBG is defined.
+ */
+#define DBGONLY(x)
+
+/* To disable a message completely ... until you need it again */
+#define WL_NONE(args)
+#define WL_ERROR(args)         do {if (wl_msg_level & WL_ERROR_VAL) WL_PRINT(args);} while (0)
+#define WL_TRACE(args)
+#define WL_PRHDRS_MSG(args)
+#define WL_PRHDRS(i, p, f, t, r, l)
+#define WL_PRPKT(m, b, n)
+#define WL_INFORM(args)
+#define WL_TMP(args)
+#define WL_OID(args)
+#define WL_RATE(args)          do {if (wl_msg_level & WL_RATE_VAL) WL_PRINT(args);} while (0)
+#define WL_ASSOC(args)         do {if (wl_msg_level & WL_ASSOC_VAL) WL_PRINT(args);} while (0)
+#define WL_PRUSR(m, b, n)
+#define WL_PS(args)            do {if (wl_msg_level & WL_PS_VAL) WL_PRINT(args);} while (0)
+
+#define WL_PORT(args)
+#define WL_DUAL(args)
+#define WL_REGULATORY(args)    do {if (wl_msg_level & WL_REGULATORY_VAL) WL_PRINT(args);} while (0)
+
+#define WL_MPC(args)
+#define WL_APSTA(args)
+#define WL_APSTA_BCN(args)
+#define WL_APSTA_TX(args)
+#define WL_APSTA_TSF(args)
+#define WL_APSTA_BSSID(args)
+#define WL_BA(args)
+#define WL_MBSS(args)
+#define WL_PROTO(args)
+
+#define        WL_CAC(args)            do {if (wl_msg_level & WL_CAC_VAL) WL_PRINT(args);} while (0)
+#define WL_AMSDU(args)
+#define WL_AMPDU(args)
+#define WL_FFPLD(args)
+#define WL_MCHAN(args)
+
+#define WL_DFS(args)
+#define WL_WOWL(args)
+#define WL_DPT(args)
+#define WL_ASSOC_OR_DPT(args)
+#define WL_SCAN(args)          do {if (wl_msg_level2 & WL_SCAN_VAL) WL_PRINT(args);} while (0)
+#define WL_COEX(args)
+#define WL_RTDC(w, s, i, j)
+#define WL_RTDC2(w, s, i, j)
+#define WL_CHANINT(args)
+#define WL_BTA(args)
+#define WL_P2P(args)
+#define WL_ITFR(args)
+#define WL_TDLS(args)
+#define WL_MCNX(args)
+#define WL_PROT(args)
+#define WL_PSTA(args)
+#define WL_WFDS(m, b, n)
+#define WL_TRF_MGMT(args)
+#define WL_L2FILTER(args)
+#define WL_MQ(args)
+#define WL_TXBF(args)
+#define WL_P2PO(args)
+#define WL_ROAM(args)
+#define WL_WNM(args)
+
+
+#define WL_AMPDU_UPDN(args)
+#define WL_AMPDU_RX(args)
+#define WL_AMPDU_ERR(args)
+#define WL_AMPDU_TX(args)
+#define WL_AMPDU_CTL(args)
+#define WL_AMPDU_HW(args)
+#define WL_AMPDU_HWTXS(args)
+#define WL_AMPDU_HWDBG(args)
+#define WL_AMPDU_STAT(args)
+#define WL_AMPDU_ERR_ON()       0
+#define WL_AMPDU_HW_ON()        0
+#define WL_AMPDU_HWTXS_ON()     0
+
+#define WL_APSTA_UPDN(args)
+#define WL_APSTA_RX(args)
+#define WL_WSEC(args)
+#define WL_WSEC_DUMP(args)
+#define WL_PCIE(args)
+#define WL_TSLOG(w, s, i, j)
+#define WL_FBT(args)
+
+#define WL_ERROR_ON()          (wl_msg_level & WL_ERROR_VAL)
+#define WL_TRACE_ON()          0
+#define WL_PRHDRS_ON()         0
+#define WL_PRPKT_ON()          0
+#define WL_INFORM_ON()         0
+#define WL_TMP_ON()            0
+#define WL_OID_ON()            0
+#define WL_RATE_ON()           (wl_msg_level & WL_RATE_VAL)
+#define WL_ASSOC_ON()          (wl_msg_level & WL_ASSOC_VAL)
+#define WL_PRUSR_ON()          0
+#define WL_PS_ON()             (wl_msg_level & WL_PS_VAL)
+#define WL_PORT_ON()           0
+#define WL_WSEC_ON()           0
+#define WL_WSEC_DUMP_ON()      0
+#define WL_MPC_ON()            0
+#define WL_REGULATORY_ON()     (wl_msg_level & WL_REGULATORY_VAL)
+#define WL_APSTA_ON()          0
+#define WL_DFS_ON()            0
+#define WL_MBSS_ON()           0
+#define WL_CAC_ON()            (wl_msg_level & WL_CAC_VAL)
+#define WL_AMPDU_ON()          0
+#define WL_DPT_ON()            0
+#define WL_WOWL_ON()           0
+#define WL_SCAN_ON()           (wl_msg_level2 & WL_SCAN_VAL)
+#define WL_BTA_ON()            0
+#define WL_P2P_ON()            0
+#define WL_ITFR_ON()           0
+#define WL_MCHAN_ON()          0
+#define WL_TDLS_ON()           0
+#define WL_MCNX_ON()           0
+#define WL_PROT_ON()           0
+#define WL_PSTA_ON()           0
+#define WL_TRF_MGMT_ON()       0
+#define WL_LPC_ON()            0
+#define WL_L2FILTER_ON()       0
+#define WL_TXBF_ON()           0
+#define WL_P2PO_ON()           0
+#define WL_TSLOG_ON()          0
+#define WL_WNM_ON()            0
+#define WL_PCIE_ON()           0
+
+#else /* !BCMDBG */
+
+/* DBGONLY() macro to reduce ifdefs in code for statements that are only needed when
+ * BCMDBG is defined.
+ */
+#define DBGONLY(x)
+
+/* To disable a message completely ... until you need it again */
+#define WL_NONE(args)
+
+#define        WL_ERROR(args)
+#define        WL_TRACE(args)
+#define WL_APSTA_UPDN(args)
+#define WL_APSTA_RX(args)
+#ifdef WLMSG_WSEC
+#define WL_WSEC(args)          WL_PRINT(args)
+#define WL_WSEC_DUMP(args)     WL_PRINT(args)
+#else
+#define WL_WSEC(args)
+#define WL_WSEC_DUMP(args)
+#endif
+#define WL_PCIE(args)          do {if (wl_msg_level2 & WL_PCIE_VAL) WL_PRINT(args);} while (0)
+#define WL_PCIE_ON()           (wl_msg_level2 & WL_PCIE_VAL)
+#define WL_PFN(args)      do {if (wl_msg_level & WL_PFN_VAL) WL_PRINT(args);} while (0)
+#define WL_PFN_ON()            (wl_msg_level & WL_PFN_VAL)
+#endif 
+
+extern uint32 wl_msg_level;
+extern uint32 wl_msg_level2;
+#endif /* _wl_dbg_h_ */
diff --git a/drivers/net/wireless/bcmdhd_1363/wl_linux_mon.c b/drivers/net/wireless/bcmdhd_1363/wl_linux_mon.c
new file mode 100644 (file)
index 0000000..755f3d9
--- /dev/null
@@ -0,0 +1,406 @@
+/*
+ * Broadcom Dongle Host Driver (DHD), Linux monitor network interface
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: wl_linux_mon.c 514727 2014-11-12 03:02:48Z $
+ */
+
+#include <osl.h>
+#include <linux/string.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/if_arp.h>
+#include <linux/ieee80211.h>
+#include <linux/rtnetlink.h>
+#include <net/ieee80211_radiotap.h>
+
+#include <wlioctl.h>
+#include <bcmutils.h>
+#include <dhd_dbg.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+
+typedef enum monitor_states
+{
+       MONITOR_STATE_DEINIT = 0x0,
+       MONITOR_STATE_INIT = 0x1,
+       MONITOR_STATE_INTERFACE_ADDED = 0x2,
+       MONITOR_STATE_INTERFACE_DELETED = 0x4
+} monitor_states_t;
+int dhd_add_monitor(char *name, struct net_device **new_ndev);
+extern int dhd_start_xmit(struct sk_buff *skb, struct net_device *net);
+int dhd_del_monitor(struct net_device *ndev);
+int dhd_monitor_init(void *dhd_pub);
+int dhd_monitor_uninit(void);
+
+/**
+ * Local declarations and defintions (not exposed)
+ */
+#ifndef DHD_MAX_IFS
+#define DHD_MAX_IFS 16
+#endif
+#define MON_PRINT(format, ...) printk("DHD-MON: %s " format, __func__, ##__VA_ARGS__)
+#define MON_TRACE MON_PRINT
+
+typedef struct monitor_interface {
+       int radiotap_enabled;
+       struct net_device* real_ndev;   /* The real interface that the monitor is on */
+       struct net_device* mon_ndev;
+} monitor_interface;
+
+typedef struct dhd_linux_monitor {
+       void *dhd_pub;
+       monitor_states_t monitor_state;
+       monitor_interface mon_if[DHD_MAX_IFS];
+       struct mutex lock;              /* lock to protect mon_if */
+} dhd_linux_monitor_t;
+
+static dhd_linux_monitor_t g_monitor;
+
+static struct net_device* lookup_real_netdev(char *name);
+static monitor_interface* ndev_to_monif(struct net_device *ndev);
+static int dhd_mon_if_open(struct net_device *ndev);
+static int dhd_mon_if_stop(struct net_device *ndev);
+static int dhd_mon_if_subif_start_xmit(struct sk_buff *skb, struct net_device *ndev);
+static void dhd_mon_if_set_multicast_list(struct net_device *ndev);
+static int dhd_mon_if_change_mac(struct net_device *ndev, void *addr);
+
+static const struct net_device_ops dhd_mon_if_ops = {
+       .ndo_open               = dhd_mon_if_open,
+       .ndo_stop               = dhd_mon_if_stop,
+       .ndo_start_xmit         = dhd_mon_if_subif_start_xmit,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0))
+       .ndo_set_rx_mode = dhd_mon_if_set_multicast_list,
+#else
+       .ndo_set_multicast_list = dhd_mon_if_set_multicast_list,
+#endif
+       .ndo_set_mac_address    = dhd_mon_if_change_mac,
+};
+
+/**
+ * Local static function defintions
+ */
+
+/* Look up dhd's net device table to find a match (e.g. interface "eth0" is a match for "mon.eth0"
+ * "p2p-eth0-0" is a match for "mon.p2p-eth0-0")
+ */
+static struct net_device* lookup_real_netdev(char *name)
+{
+       struct net_device *ndev_found = NULL;
+
+       int i;
+       int len = 0;
+       int last_name_len = 0;
+       struct net_device *ndev;
+
+       /* We need to find interface "p2p-p2p-0" corresponding to monitor interface "mon-p2p-0",
+        * Once mon iface name reaches IFNAMSIZ, it is reset to p2p0-0 and corresponding mon
+        * iface would be mon-p2p0-0.
+        */
+       for (i = 0; i < DHD_MAX_IFS; i++) {
+               ndev = dhd_idx2net(g_monitor.dhd_pub, i);
+
+               /* Skip "p2p" and look for "-p2p0-x" in monitor interface name. If it
+                * it matches, then this netdev is the corresponding real_netdev.
+                */
+               if (ndev && strstr(ndev->name, "p2p-p2p0")) {
+                       len = strlen("p2p");
+               } else {
+               /* if p2p- is not present, then the IFNAMSIZ have reached and name
+                * would have got reset. In this casse,look for p2p0-x in mon-p2p0-x
+                */
+                       len = 0;
+               }
+               if (ndev && strstr(name, (ndev->name + len))) {
+                       if (strlen(ndev->name) > last_name_len) {
+                               ndev_found = ndev;
+                               last_name_len = strlen(ndev->name);
+                       }
+               }
+       }
+
+       return ndev_found;
+}
+
+static monitor_interface* ndev_to_monif(struct net_device *ndev)
+{
+       int i;
+
+       for (i = 0; i < DHD_MAX_IFS; i++) {
+               if (g_monitor.mon_if[i].mon_ndev == ndev)
+                       return &g_monitor.mon_if[i];
+       }
+
+       return NULL;
+}
+
+static int dhd_mon_if_open(struct net_device *ndev)
+{
+       int ret = 0;
+
+       MON_PRINT("enter\n");
+       return ret;
+}
+
+static int dhd_mon_if_stop(struct net_device *ndev)
+{
+       int ret = 0;
+
+       MON_PRINT("enter\n");
+       return ret;
+}
+
+static int dhd_mon_if_subif_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+{
+       int ret = 0;
+       int rtap_len;
+       int qos_len = 0;
+       int dot11_hdr_len = 24;
+       int snap_len = 6;
+       unsigned char *pdata;
+       unsigned short frame_ctl;
+       unsigned char src_mac_addr[6];
+       unsigned char dst_mac_addr[6];
+       struct ieee80211_hdr *dot11_hdr;
+       struct ieee80211_radiotap_header *rtap_hdr;
+       monitor_interface* mon_if;
+
+       MON_PRINT("enter\n");
+
+       mon_if = ndev_to_monif(ndev);
+       if (mon_if == NULL || mon_if->real_ndev == NULL) {
+               MON_PRINT(" cannot find matched net dev, skip the packet\n");
+               goto fail;
+       }
+
+       if (unlikely(skb->len < sizeof(struct ieee80211_radiotap_header)))
+               goto fail;
+
+       rtap_hdr = (struct ieee80211_radiotap_header *)skb->data;
+       if (unlikely(rtap_hdr->it_version))
+               goto fail;
+
+       rtap_len = ieee80211_get_radiotap_len(skb->data);
+       if (unlikely(skb->len < rtap_len))
+               goto fail;
+
+       MON_PRINT("radiotap len (should be 14): %d\n", rtap_len);
+
+       /* Skip the ratio tap header */
+       skb_pull(skb, rtap_len);
+
+       dot11_hdr = (struct ieee80211_hdr *)skb->data;
+       frame_ctl = le16_to_cpu(dot11_hdr->frame_control);
+       /* Check if the QoS bit is set */
+       if ((frame_ctl & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) {
+               /* Check if this ia a Wireless Distribution System (WDS) frame
+                * which has 4 MAC addresses
+                */
+               if (dot11_hdr->frame_control & 0x0080)
+                       qos_len = 2;
+               if ((dot11_hdr->frame_control & 0x0300) == 0x0300)
+                       dot11_hdr_len += 6;
+
+               memcpy(dst_mac_addr, dot11_hdr->addr1, sizeof(dst_mac_addr));
+               memcpy(src_mac_addr, dot11_hdr->addr2, sizeof(src_mac_addr));
+
+               /* Skip the 802.11 header, QoS (if any) and SNAP, but leave spaces for
+                * for two MAC addresses
+                */
+               skb_pull(skb, dot11_hdr_len + qos_len + snap_len - sizeof(src_mac_addr) * 2);
+               pdata = (unsigned char*)skb->data;
+               memcpy(pdata, dst_mac_addr, sizeof(dst_mac_addr));
+               memcpy(pdata + sizeof(dst_mac_addr), src_mac_addr, sizeof(src_mac_addr));
+               PKTSETPRIO(skb, 0);
+
+               MON_PRINT("if name: %s, matched if name %s\n", ndev->name, mon_if->real_ndev->name);
+
+               /* Use the real net device to transmit the packet */
+               ret = dhd_start_xmit(skb, mon_if->real_ndev);
+
+               return ret;
+       }
+fail:
+       dev_kfree_skb(skb);
+       return 0;
+}
+
+static void dhd_mon_if_set_multicast_list(struct net_device *ndev)
+{
+       monitor_interface* mon_if;
+
+       mon_if = ndev_to_monif(ndev);
+       if (mon_if == NULL || mon_if->real_ndev == NULL) {
+               MON_PRINT(" cannot find matched net dev, skip the packet\n");
+       } else {
+               MON_PRINT("enter, if name: %s, matched if name %s\n",
+               ndev->name, mon_if->real_ndev->name);
+       }
+}
+
+static int dhd_mon_if_change_mac(struct net_device *ndev, void *addr)
+{
+       int ret = 0;
+       monitor_interface* mon_if;
+
+       mon_if = ndev_to_monif(ndev);
+       if (mon_if == NULL || mon_if->real_ndev == NULL) {
+               MON_PRINT(" cannot find matched net dev, skip the packet\n");
+       } else {
+               MON_PRINT("enter, if name: %s, matched if name %s\n",
+               ndev->name, mon_if->real_ndev->name);
+       }
+       return ret;
+}
+
+/**
+ * Global function definitions (declared in dhd_linux_mon.h)
+ */
+
+int dhd_add_monitor(char *name, struct net_device **new_ndev)
+{
+       int i;
+       int idx = -1;
+       int ret = 0;
+       struct net_device* ndev = NULL;
+       dhd_linux_monitor_t **dhd_mon;
+
+       mutex_lock(&g_monitor.lock);
+
+       MON_TRACE("enter, if name: %s\n", name);
+       if (!name || !new_ndev) {
+               MON_PRINT("invalid parameters\n");
+               ret = -EINVAL;
+               goto out;
+       }
+
+       /*
+        * Find a vacancy
+        */
+       for (i = 0; i < DHD_MAX_IFS; i++)
+               if (g_monitor.mon_if[i].mon_ndev == NULL) {
+                       idx = i;
+                       break;
+               }
+       if (idx == -1) {
+               MON_PRINT("exceeds maximum interfaces\n");
+               ret = -EFAULT;
+               goto out;
+       }
+
+       ndev = alloc_etherdev(sizeof(dhd_linux_monitor_t*));
+       if (!ndev) {
+               MON_PRINT("failed to allocate memory\n");
+               ret = -ENOMEM;
+               goto out;
+       }
+
+       ndev->type = ARPHRD_IEEE80211_RADIOTAP;
+       strncpy(ndev->name, name, IFNAMSIZ);
+       ndev->name[IFNAMSIZ - 1] = 0;
+       ndev->netdev_ops = &dhd_mon_if_ops;
+
+       ret = register_netdevice(ndev);
+       if (ret) {
+               MON_PRINT(" register_netdevice failed (%d)\n", ret);
+               goto out;
+       }
+
+       *new_ndev = ndev;
+       g_monitor.mon_if[idx].radiotap_enabled = TRUE;
+       g_monitor.mon_if[idx].mon_ndev = ndev;
+       g_monitor.mon_if[idx].real_ndev = lookup_real_netdev(name);
+       dhd_mon = (dhd_linux_monitor_t **)netdev_priv(ndev);
+       *dhd_mon = &g_monitor;
+       g_monitor.monitor_state = MONITOR_STATE_INTERFACE_ADDED;
+       MON_PRINT("net device returned: 0x%p\n", ndev);
+       MON_PRINT("found a matched net device, name %s\n", g_monitor.mon_if[idx].real_ndev->name);
+
+out:
+       if (ret && ndev)
+               free_netdev(ndev);
+
+       mutex_unlock(&g_monitor.lock);
+       return ret;
+
+}
+
+int dhd_del_monitor(struct net_device *ndev)
+{
+       int i;
+       if (!ndev)
+               return -EINVAL;
+       mutex_lock(&g_monitor.lock);
+       for (i = 0; i < DHD_MAX_IFS; i++) {
+               if (g_monitor.mon_if[i].mon_ndev == ndev ||
+                       g_monitor.mon_if[i].real_ndev == ndev) {
+
+                       g_monitor.mon_if[i].real_ndev = NULL;
+                       unregister_netdevice(g_monitor.mon_if[i].mon_ndev);
+                       free_netdev(g_monitor.mon_if[i].mon_ndev);
+                       g_monitor.mon_if[i].mon_ndev = NULL;
+                       g_monitor.monitor_state = MONITOR_STATE_INTERFACE_DELETED;
+                       break;
+               }
+       }
+
+       if (g_monitor.monitor_state != MONITOR_STATE_INTERFACE_DELETED)
+               MON_PRINT("IF not found in monitor array, is this a monitor IF? 0x%p\n", ndev);
+       mutex_unlock(&g_monitor.lock);
+
+       return 0;
+}
+
+int dhd_monitor_init(void *dhd_pub)
+{
+       if (g_monitor.monitor_state == MONITOR_STATE_DEINIT) {
+               g_monitor.dhd_pub = dhd_pub;
+               mutex_init(&g_monitor.lock);
+               g_monitor.monitor_state = MONITOR_STATE_INIT;
+       }
+       return 0;
+}
+
+int dhd_monitor_uninit(void)
+{
+       int i;
+       struct net_device *ndev;
+       mutex_lock(&g_monitor.lock);
+       if (g_monitor.monitor_state != MONITOR_STATE_DEINIT) {
+               for (i = 0; i < DHD_MAX_IFS; i++) {
+                       ndev = g_monitor.mon_if[i].mon_ndev;
+                       if (ndev) {
+                               unregister_netdevice(ndev);
+                               free_netdev(ndev);
+                               g_monitor.mon_if[i].real_ndev = NULL;
+                               g_monitor.mon_if[i].mon_ndev = NULL;
+                       }
+               }
+               g_monitor.monitor_state = MONITOR_STATE_DEINIT;
+       }
+       mutex_unlock(&g_monitor.lock);
+       return 0;
+}
diff --git a/drivers/net/wireless/bcmdhd_1363/wl_roam.c b/drivers/net/wireless/bcmdhd_1363/wl_roam.c
new file mode 100644 (file)
index 0000000..f098462
--- /dev/null
@@ -0,0 +1,28 @@
+/*
+ * Linux roam cache
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: wl_roam.c 613173 2016-01-18 03:01:57Z $
+ */
diff --git a/drivers/net/wireless/bcmdhd_1363/wldev_common.c b/drivers/net/wireless/bcmdhd_1363/wldev_common.c
new file mode 100644 (file)
index 0000000..d1464f3
--- /dev/null
@@ -0,0 +1,456 @@
+/*
+ * Common function shared by Linux WEXT, cfg80211 and p2p drivers
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: wldev_common.c 585478 2015-09-10 13:33:58Z $
+ */
+
+#include <osl.h>
+#include <linux/kernel.h>
+#include <linux/kthread.h>
+#include <linux/netdevice.h>
+
+#include <wldev_common.h>
+#include <bcmutils.h>
+
+#define htod32(i) (i)
+#define htod16(i) (i)
+#define dtoh32(i) (i)
+#define dtoh16(i) (i)
+#define htodchanspec(i) (i)
+#define dtohchanspec(i) (i)
+
+#define        WLDEV_ERROR(args)                                               \
+       do {                                                                            \
+               printk(KERN_ERR "WLDEV-ERROR) ");       \
+               printk args;                                                    \
+       } while (0)
+
+#define        WLDEV_INFO(args)                                                \
+       do {                                                                            \
+               printk(KERN_INFO "WLDEV-INFO) ");       \
+               printk args;                                                    \
+       } while (0)
+
+extern int dhd_ioctl_entry_local(struct net_device *net, wl_ioctl_t *ioc, int cmd);
+
+s32 wldev_ioctl(
+       struct net_device *dev, u32 cmd, void *arg, u32 len, u32 set)
+{
+       s32 ret = 0;
+       struct wl_ioctl ioc;
+
+
+       memset(&ioc, 0, sizeof(ioc));
+       ioc.cmd = cmd;
+       ioc.buf = arg;
+       ioc.len = len;
+       ioc.set = set;
+
+       ret = dhd_ioctl_entry_local(dev, &ioc, cmd);
+
+       return ret;
+}
+
+/* Format a iovar buffer, not bsscfg indexed. The bsscfg index will be
+ * taken care of in dhd_ioctl_entry. Internal use only, not exposed to
+ * wl_iw, wl_cfg80211 and wl_cfgp2p
+ */
+static s32 wldev_mkiovar(
+       const s8 *iovar_name, s8 *param, s32 paramlen,
+       s8 *iovar_buf, u32 buflen)
+{
+       s32 iolen = 0;
+
+       iolen = bcm_mkiovar(iovar_name, param, paramlen, iovar_buf, buflen);
+       return iolen;
+}
+
+s32 wldev_iovar_getbuf(
+       struct net_device *dev, s8 *iovar_name,
+       void *param, s32 paramlen, void *buf, s32 buflen, struct mutex* buf_sync)
+{
+       s32 ret = 0;
+       if (buf_sync) {
+               mutex_lock(buf_sync);
+       }
+       wldev_mkiovar(iovar_name, param, paramlen, buf, buflen);
+       ret = wldev_ioctl(dev, WLC_GET_VAR, buf, buflen, FALSE);
+       if (buf_sync)
+               mutex_unlock(buf_sync);
+       return ret;
+}
+
+
+s32 wldev_iovar_setbuf(
+       struct net_device *dev, s8 *iovar_name,
+       void *param, s32 paramlen, void *buf, s32 buflen, struct mutex* buf_sync)
+{
+       s32 ret = 0;
+       s32 iovar_len;
+       if (buf_sync) {
+               mutex_lock(buf_sync);
+       }
+       iovar_len = wldev_mkiovar(iovar_name, param, paramlen, buf, buflen);
+       if (iovar_len > 0)
+               ret = wldev_ioctl(dev, WLC_SET_VAR, buf, iovar_len, TRUE);
+       else
+               ret = BCME_BUFTOOSHORT;
+
+       if (buf_sync)
+               mutex_unlock(buf_sync);
+       return ret;
+}
+
+s32 wldev_iovar_setint(
+       struct net_device *dev, s8 *iovar, s32 val)
+{
+       s8 iovar_buf[WLC_IOCTL_SMLEN];
+
+       val = htod32(val);
+       memset(iovar_buf, 0, sizeof(iovar_buf));
+       return wldev_iovar_setbuf(dev, iovar, &val, sizeof(val), iovar_buf,
+               sizeof(iovar_buf), NULL);
+}
+
+
+s32 wldev_iovar_getint(
+       struct net_device *dev, s8 *iovar, s32 *pval)
+{
+       s8 iovar_buf[WLC_IOCTL_SMLEN];
+       s32 err;
+
+       memset(iovar_buf, 0, sizeof(iovar_buf));
+       err = wldev_iovar_getbuf(dev, iovar, pval, sizeof(*pval), iovar_buf,
+               sizeof(iovar_buf), NULL);
+       if (err == 0)
+       {
+               memcpy(pval, iovar_buf, sizeof(*pval));
+               *pval = dtoh32(*pval);
+       }
+       return err;
+}
+
+/** Format a bsscfg indexed iovar buffer. The bsscfg index will be
+ *  taken care of in dhd_ioctl_entry. Internal use only, not exposed to
+ *  wl_iw, wl_cfg80211 and wl_cfgp2p
+ */
+s32 wldev_mkiovar_bsscfg(
+       const s8 *iovar_name, s8 *param, s32 paramlen,
+       s8 *iovar_buf, s32 buflen, s32 bssidx)
+{
+       const s8 *prefix = "bsscfg:";
+       s8 *p;
+       u32 prefixlen;
+       u32 namelen;
+       u32 iolen;
+
+       if (bssidx == 0) {
+               return wldev_mkiovar(iovar_name, param, paramlen,
+                       iovar_buf, buflen);
+       }
+
+       prefixlen = (u32) strlen(prefix); /* lengh of bsscfg prefix */
+       namelen = (u32) strlen(iovar_name) + 1; /* lengh of iovar  name + null */
+       iolen = prefixlen + namelen + sizeof(u32) + paramlen;
+
+       if (buflen < 0 || iolen > (u32)buflen)
+       {
+               WLDEV_ERROR(("%s: buffer is too short\n", __FUNCTION__));
+               return BCME_BUFTOOSHORT;
+       }
+
+       p = (s8 *)iovar_buf;
+
+       /* copy prefix, no null */
+       memcpy(p, prefix, prefixlen);
+       p += prefixlen;
+
+       /* copy iovar name including null */
+       memcpy(p, iovar_name, namelen);
+       p += namelen;
+
+       /* bss config index as first param */
+       bssidx = htod32(bssidx);
+       memcpy(p, &bssidx, sizeof(u32));
+       p += sizeof(u32);
+
+       /* parameter buffer follows */
+       if (paramlen)
+               memcpy(p, param, paramlen);
+
+       return iolen;
+
+}
+
+s32 wldev_iovar_getbuf_bsscfg(
+       struct net_device *dev, s8 *iovar_name,
+       void *param, s32 paramlen, void *buf, s32 buflen, s32 bsscfg_idx, struct mutex* buf_sync)
+{
+       s32 ret = 0;
+       if (buf_sync) {
+               mutex_lock(buf_sync);
+       }
+
+       wldev_mkiovar_bsscfg(iovar_name, param, paramlen, buf, buflen, bsscfg_idx);
+       ret = wldev_ioctl(dev, WLC_GET_VAR, buf, buflen, FALSE);
+       if (buf_sync) {
+               mutex_unlock(buf_sync);
+       }
+       return ret;
+
+}
+
+s32 wldev_iovar_setbuf_bsscfg(
+       struct net_device *dev, s8 *iovar_name,
+       void *param, s32 paramlen, void *buf, s32 buflen, s32 bsscfg_idx, struct mutex* buf_sync)
+{
+       s32 ret = 0;
+       s32 iovar_len;
+       if (buf_sync) {
+               mutex_lock(buf_sync);
+       }
+       iovar_len = wldev_mkiovar_bsscfg(iovar_name, param, paramlen, buf, buflen, bsscfg_idx);
+       if (iovar_len > 0)
+               ret = wldev_ioctl(dev, WLC_SET_VAR, buf, iovar_len, TRUE);
+       else {
+               ret = BCME_BUFTOOSHORT;
+       }
+
+       if (buf_sync) {
+               mutex_unlock(buf_sync);
+       }
+       return ret;
+}
+
+s32 wldev_iovar_setint_bsscfg(
+       struct net_device *dev, s8 *iovar, s32 val, s32 bssidx)
+{
+       s8 iovar_buf[WLC_IOCTL_SMLEN];
+
+       val = htod32(val);
+       memset(iovar_buf, 0, sizeof(iovar_buf));
+       return wldev_iovar_setbuf_bsscfg(dev, iovar, &val, sizeof(val), iovar_buf,
+               sizeof(iovar_buf), bssidx, NULL);
+}
+
+
+s32 wldev_iovar_getint_bsscfg(
+       struct net_device *dev, s8 *iovar, s32 *pval, s32 bssidx)
+{
+       s8 iovar_buf[WLC_IOCTL_SMLEN];
+       s32 err;
+
+       memset(iovar_buf, 0, sizeof(iovar_buf));
+       err = wldev_iovar_getbuf_bsscfg(dev, iovar, pval, sizeof(*pval), iovar_buf,
+               sizeof(iovar_buf), bssidx, NULL);
+       if (err == 0)
+       {
+               memcpy(pval, iovar_buf, sizeof(*pval));
+               *pval = dtoh32(*pval);
+       }
+       return err;
+}
+
+int wldev_get_link_speed(
+       struct net_device *dev, int *plink_speed)
+{
+       int error;
+
+       if (!plink_speed)
+               return -ENOMEM;
+       error = wldev_ioctl(dev, WLC_GET_RATE, plink_speed, sizeof(int), 0);
+       if (unlikely(error))
+               return error;
+
+       /* Convert internal 500Kbps to Kbps */
+       *plink_speed *= 500;
+       return error;
+}
+
+int wldev_get_rssi(
+       struct net_device *dev, scb_val_t *scb_val)
+{
+       int error;
+
+       if (!scb_val)
+               return -ENOMEM;
+
+       error = wldev_ioctl(dev, WLC_GET_RSSI, scb_val, sizeof(scb_val_t), 0);
+       if (unlikely(error))
+               return error;
+
+       return error;
+}
+
+int wldev_get_ssid(
+       struct net_device *dev, wlc_ssid_t *pssid)
+{
+       int error;
+
+       if (!pssid)
+               return -ENOMEM;
+       error = wldev_ioctl(dev, WLC_GET_SSID, pssid, sizeof(wlc_ssid_t), 0);
+       if (unlikely(error))
+               return error;
+       pssid->SSID_len = dtoh32(pssid->SSID_len);
+       return error;
+}
+
+int wldev_get_band(
+       struct net_device *dev, uint *pband)
+{
+       int error;
+
+       error = wldev_ioctl(dev, WLC_GET_BAND, pband, sizeof(uint), 0);
+       return error;
+}
+
+int wldev_set_band(
+       struct net_device *dev, uint band)
+{
+       int error = -1;
+
+       if ((band == WLC_BAND_AUTO) || (band == WLC_BAND_5G) || (band == WLC_BAND_2G)) {
+               error = wldev_ioctl(dev, WLC_SET_BAND, &band, sizeof(band), true);
+               if (!error)
+                       dhd_bus_band_set(dev, band);
+       }
+       return error;
+}
+int wldev_get_datarate(struct net_device *dev, int *datarate)
+{
+       int error = 0;
+
+       error = wldev_ioctl(dev, WLC_GET_RATE, datarate, sizeof(int), false);
+       if (error) {
+               return -1;
+       } else {
+               *datarate = dtoh32(*datarate);
+       }
+
+       return error;
+}
+
+extern chanspec_t
+wl_chspec_driver_to_host(chanspec_t chanspec);
+#define WL_EXTRA_BUF_MAX 2048
+int wldev_get_mode(
+       struct net_device *dev, uint8 *cap)
+{
+       int error = 0;
+       int chanspec = 0;
+       uint16 band = 0;
+       uint16 bandwidth = 0;
+       wl_bss_info_t *bss = NULL;
+       char* buf = kmalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
+       if (!buf)
+               return -1;
+       *(u32*) buf = htod32(WL_EXTRA_BUF_MAX);
+       error = wldev_ioctl(dev, WLC_GET_BSS_INFO, (void*)buf, WL_EXTRA_BUF_MAX, false);
+       if (error) {
+               WLDEV_ERROR(("%s:failed:%d\n", __FUNCTION__, error));
+               return -1;
+       }
+       bss = (struct  wl_bss_info *)(buf + 4);
+       chanspec = wl_chspec_driver_to_host(bss->chanspec);
+
+       band = chanspec & WL_CHANSPEC_BAND_MASK;
+       bandwidth = chanspec & WL_CHANSPEC_BW_MASK;
+
+       if (band == WL_CHANSPEC_BAND_2G) {
+               if (bss->n_cap)
+                       strcpy(cap, "n");
+               else
+                       strcpy(cap, "bg");
+       } else if (band == WL_CHANSPEC_BAND_5G) {
+               if (bandwidth == WL_CHANSPEC_BW_80)
+                       strcpy(cap, "ac");
+               else if ((bandwidth == WL_CHANSPEC_BW_40) || (bandwidth == WL_CHANSPEC_BW_20)) {
+                       if ((bss->nbss_cap & 0xf00) && (bss->n_cap))
+                               strcpy(cap, "n|ac");
+                       else if (bss->n_cap)
+                               strcpy(cap, "n");
+                       else if (bss->vht_cap)
+                               strcpy(cap, "ac");
+                       else
+                               strcpy(cap, "a");
+               } else {
+                       WLDEV_ERROR(("%s:Mode get failed\n", __FUNCTION__));
+                       return -1;
+               }
+
+       }
+       return error;
+}
+int wldev_set_country(
+       struct net_device *dev, char *country_code, bool notify, bool user_enforced, int revinfo)
+{
+       int error = -1;
+       wl_country_t cspec = {{0}, 0, {0}};
+       scb_val_t scbval;
+       char smbuf[WLC_IOCTL_SMLEN];
+
+       if (!country_code)
+               return error;
+
+       bzero(&scbval, sizeof(scb_val_t));
+       error = wldev_iovar_getbuf(dev, "country", NULL, 0, &cspec, sizeof(cspec), NULL);
+       if (error < 0) {
+               WLDEV_ERROR(("%s: get country failed = %d\n", __FUNCTION__, error));
+               return error;
+       }
+
+       if ((error < 0) ||
+                       dhd_force_country_change(dev) ||
+           (strncmp(country_code, cspec.ccode, WLC_CNTRY_BUF_SZ) != 0)) {
+
+               if (user_enforced) {
+                       bzero(&scbval, sizeof(scb_val_t));
+                       error = wldev_ioctl(dev, WLC_DISASSOC, &scbval, sizeof(scb_val_t), true);
+                       if (error < 0) {
+                               WLDEV_ERROR(("%s: set country failed due to Disassoc error %d\n",
+                                       __FUNCTION__, error));
+                               return error;
+                       }
+               }
+
+               cspec.rev = revinfo;
+               memcpy(cspec.country_abbrev, country_code, WLC_CNTRY_BUF_SZ);
+               memcpy(cspec.ccode, country_code, WLC_CNTRY_BUF_SZ);
+               dhd_get_customized_country_code(dev, (char *)&cspec.country_abbrev, &cspec);
+               error = wldev_iovar_setbuf(dev, "country", &cspec, sizeof(cspec),
+                       smbuf, sizeof(smbuf), NULL);
+               if (error < 0) {
+                       WLDEV_ERROR(("%s: set country for %s as %s rev %d failed\n",
+                               __FUNCTION__, country_code, cspec.ccode, cspec.rev));
+                       return error;
+               }
+               dhd_bus_country_set(dev, &cspec, notify);
+               WLDEV_INFO(("%s: set country for %s as %s rev %d\n",
+                       __FUNCTION__, country_code, cspec.ccode, cspec.rev));
+       }
+       return 0;
+}
diff --git a/drivers/net/wireless/bcmdhd_1363/wldev_common.h b/drivers/net/wireless/bcmdhd_1363/wldev_common.h
new file mode 100644 (file)
index 0000000..f080bc4
--- /dev/null
@@ -0,0 +1,124 @@
+/*
+ * Common function shared by Linux WEXT, cfg80211 and p2p drivers
+ *
+ * Copyright (C) 1999-2017, Broadcom Corporation
+ * 
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ * 
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ * 
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ *
+ * <<Broadcom-WL-IPTag/Open:>>
+ *
+ * $Id: wldev_common.h 619484 2016-02-17 02:14:06Z $
+ */
+#ifndef __WLDEV_COMMON_H__
+#define __WLDEV_COMMON_H__
+
+#include <wlioctl.h>
+
+/* wl_dev_ioctl - get/set IOCTLs, will call net_device's do_ioctl (or
+ *  netdev_ops->ndo_do_ioctl in new kernels)
+ *  @dev: the net_device handle
+ */
+s32 wldev_ioctl(
+       struct net_device *dev, u32 cmd, void *arg, u32 len, u32 set);
+
+/** Retrieve named IOVARs, this function calls wl_dev_ioctl with
+ *  WLC_GET_VAR IOCTL code
+ */
+s32 wldev_iovar_getbuf(
+       struct net_device *dev, s8 *iovar_name,
+       void *param, s32 paramlen, void *buf, s32 buflen, struct mutex* buf_sync);
+
+/** Set named IOVARs, this function calls wl_dev_ioctl with
+ *  WLC_SET_VAR IOCTL code
+ */
+s32 wldev_iovar_setbuf(
+       struct net_device *dev, s8 *iovar_name,
+       void *param, s32 paramlen, void *buf, s32 buflen, struct mutex* buf_sync);
+
+s32 wldev_iovar_setint(
+       struct net_device *dev, s8 *iovar, s32 val);
+
+s32 wldev_iovar_getint(
+       struct net_device *dev, s8 *iovar, s32 *pval);
+
+/** The following function can be implemented if there is a need for bsscfg
+ *  indexed IOVARs
+ */
+
+s32 wldev_mkiovar_bsscfg(
+       const s8 *iovar_name, s8 *param, s32 paramlen,
+       s8 *iovar_buf, s32 buflen, s32 bssidx);
+
+/** Retrieve named and bsscfg indexed IOVARs, this function calls wl_dev_ioctl with
+ *  WLC_GET_VAR IOCTL code
+ */
+s32 wldev_iovar_getbuf_bsscfg(
+       struct net_device *dev, s8 *iovar_name, void *param, s32 paramlen,
+       void *buf, s32 buflen, s32 bsscfg_idx, struct mutex* buf_sync);
+
+/** Set named and bsscfg indexed IOVARs, this function calls wl_dev_ioctl with
+ *  WLC_SET_VAR IOCTL code
+ */
+s32 wldev_iovar_setbuf_bsscfg(
+       struct net_device *dev, s8 *iovar_name, void *param, s32 paramlen,
+       void *buf, s32 buflen, s32 bsscfg_idx, struct mutex* buf_sync);
+
+s32 wldev_iovar_getint_bsscfg(
+       struct net_device *dev, s8 *iovar, s32 *pval, s32 bssidx);
+
+s32 wldev_iovar_setint_bsscfg(
+       struct net_device *dev, s8 *iovar, s32 val, s32 bssidx);
+
+extern int dhd_net_set_fw_path(struct net_device *dev, char *fw);
+extern int dhd_net_bus_suspend(struct net_device *dev);
+extern int dhd_net_bus_resume(struct net_device *dev, uint8 stage);
+extern int dhd_net_wifi_platform_set_power(struct net_device *dev, bool on,
+       unsigned long delay_msec);
+extern void dhd_get_customized_country_code(struct net_device *dev, char *country_iso_code,
+       wl_country_t *cspec);
+extern void dhd_bus_country_set(struct net_device *dev, wl_country_t *cspec, bool notify);
+extern bool dhd_force_country_change(struct net_device *dev);
+extern void dhd_bus_band_set(struct net_device *dev, uint band);
+extern int wldev_set_country(struct net_device *dev, char *country_code, bool notify,
+       bool user_enforced, int revinfo);
+extern int net_os_wake_lock(struct net_device *dev);
+extern int net_os_wake_unlock(struct net_device *dev);
+extern int net_os_wake_lock_timeout(struct net_device *dev);
+extern int net_os_wake_lock_timeout_enable(struct net_device *dev, int val);
+extern int net_os_set_dtim_skip(struct net_device *dev, int val);
+extern int net_os_set_suspend_disable(struct net_device *dev, int val);
+extern int net_os_set_suspend(struct net_device *dev, int val, int force);
+extern int net_os_set_max_dtim_enable(struct net_device *dev, int val);
+extern int wl_iw_parse_ssid_list_tlv(char** list_str, wlc_ssid_ext_t* ssid,
+       int max, int *bytes_left);
+
+/* Get the link speed from dongle, speed is in kpbs */
+int wldev_get_link_speed(struct net_device *dev, int *plink_speed);
+
+int wldev_get_rssi(struct net_device *dev, scb_val_t *prssi);
+
+int wldev_get_ssid(struct net_device *dev, wlc_ssid_t *pssid);
+
+int wldev_get_band(struct net_device *dev, uint *pband);
+int wldev_get_mode(struct net_device *dev, uint8 *pband);
+int wldev_get_datarate(struct net_device *dev, int *datarate);
+int wldev_set_band(struct net_device *dev, uint band);
+
+#endif /* __WLDEV_COMMON_H__ */