[meta-freescale] [meta-fsl-arm-extra][PATCH] linux-imx (3.0.35): add brcm80211 driver backported from v3.5

John Weber rjohnweber at gmail.com
Sat Mar 16 06:45:37 PDT 2013


Adds a backported driver from kernel v3.5 for brcm80211.  Used with
bcm4329 and other Broadcom Wifi devices.

Signed-off-by: John Weber <rjohnweber at gmail.com>
---
 ....0.35-Add-brcm80211-driver-backported-fro.patch |94038 ++++++++++++++++++++
 1 files changed, 94039 insertions(+)
 create mode 100644 recipes-kernel/linux/linux-imx-3.0.35/wandboard-dual/0003-linux-imx-3.0.35-Add-brcm80211-driver-backported-fro.patch

diff --git a/recipes-kernel/linux/linux-imx-3.0.35/wandboard-dual/0003-linux-imx-3.0.35-Add-brcm80211-driver-backported-fro.patch b/recipes-kernel/linux/linux-imx-3.0.35/wandboard-dual/0003-linux-imx-3.0.35-Add-brcm80211-driver-backported-fro.patch
new file mode 100644
index 0000000..1ed5f50
--- /dev/null
+++ b/recipes-kernel/linux/linux-imx-3.0.35/wandboard-dual/0003-linux-imx-3.0.35-Add-brcm80211-driver-backported-fro.patch
@@ -0,0 +1,94038 @@
+From 99044f426f004207f6256add552e64a509c205fd Mon Sep 17 00:00:00 2001
+From: John Weber <rjohnweber at gmail.com>
+Date: Sat, 9 Mar 2013 09:25:52 -0600
+Subject: [meta-fsl-arm-extra][PATCH 2/2] linux-imx (3.0.35): Add brcm80211
+ driver backported from 3.5
+
+Upstream-Status: Pending
+
+Signed-off-by: John Weber <rjohnweber at gmail.com>
+---
+ drivers/net/wireless/Kconfig                       |    2 +
+ drivers/net/wireless/Makefile                      |    4 +
+ drivers/net/wireless/brcm80211/Kconfig             |   62 +
+ drivers/net/wireless/brcm80211/Makefile            |   23 +
+ drivers/net/wireless/brcm80211/brcmfmac/Makefile   |   36 +
+ drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c   |  550 +
+ .../net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c |  703 +
+ drivers/net/wireless/brcm80211/brcmfmac/dhd.h      |  669 +
+ drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h  |  118 +
+ drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c  |  495 +
+ .../net/wireless/brcm80211/brcmfmac/dhd_common.c   |  882 +
+ drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h  |   79 +
+ .../net/wireless/brcm80211/brcmfmac/dhd_linux.c    | 1232 +
+ .../net/wireless/brcm80211/brcmfmac/dhd_proto.h    |   53 +
+ drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c | 4014 +++
+ .../net/wireless/brcm80211/brcmfmac/sdio_chip.c    |  622 +
+ .../net/wireless/brcm80211/brcmfmac/sdio_chip.h    |  136 +
+ .../net/wireless/brcm80211/brcmfmac/sdio_host.h    |  272 +
+ drivers/net/wireless/brcm80211/brcmfmac/usb.c      | 1617 ++
+ drivers/net/wireless/brcm80211/brcmfmac/usb.h      |   61 +
+ drivers/net/wireless/brcm80211/brcmfmac/usb_rdl.h  |   75 +
+ .../net/wireless/brcm80211/brcmfmac/wl_cfg80211.c  | 3881 +++
+ .../net/wireless/brcm80211/brcmfmac/wl_cfg80211.h  |  366 +
+ drivers/net/wireless/brcm80211/brcmsmac/Makefile   |   48 +
+ drivers/net/wireless/brcm80211/brcmsmac/aiutils.c  |  841 +
+ drivers/net/wireless/brcm80211/brcmsmac/aiutils.h  |  248 +
+ drivers/net/wireless/brcm80211/brcmsmac/ampdu.c    | 1236 +
+ drivers/net/wireless/brcm80211/brcmsmac/ampdu.h    |   30 +
+ drivers/net/wireless/brcm80211/brcmsmac/antsel.c   |  307 +
+ drivers/net/wireless/brcm80211/brcmsmac/antsel.h   |   29 +
+ .../brcm80211/brcmsmac/brcms_trace_events.c        |   23 +
+ .../brcm80211/brcmsmac/brcms_trace_events.h        |   92 +
+ drivers/net/wireless/brcm80211/brcmsmac/channel.c  | 1506 +
+ drivers/net/wireless/brcm80211/brcmsmac/channel.h  |   53 +
+ drivers/net/wireless/brcm80211/brcmsmac/d11.h      | 1901 ++
+ drivers/net/wireless/brcm80211/brcmsmac/dma.c      | 1444 +
+ drivers/net/wireless/brcm80211/brcmsmac/dma.h      |  122 +
+ .../net/wireless/brcm80211/brcmsmac/mac80211_if.c  | 1609 ++
+ .../net/wireless/brcm80211/brcmsmac/mac80211_if.h  |  108 +
+ drivers/net/wireless/brcm80211/brcmsmac/main.c     | 8495 ++++++
+ drivers/net/wireless/brcm80211/brcmsmac/main.h     |  720 +
+ .../net/wireless/brcm80211/brcmsmac/phy/phy_cmn.c  | 2961 ++
+ .../net/wireless/brcm80211/brcmsmac/phy/phy_hal.h  |  299 +
+ .../net/wireless/brcm80211/brcmsmac/phy/phy_int.h  | 1162 +
+ .../net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c  | 5137 ++++
+ .../net/wireless/brcm80211/brcmsmac/phy/phy_lcn.h  |  121 +
+ .../net/wireless/brcm80211/brcmsmac/phy/phy_n.c    |28685 ++++++++++++++++++++
+ .../wireless/brcm80211/brcmsmac/phy/phy_qmath.c    |  308 +
+ .../wireless/brcm80211/brcmsmac/phy/phy_qmath.h    |   42 +
+ .../wireless/brcm80211/brcmsmac/phy/phy_radio.h    | 1533 ++
+ .../net/wireless/brcm80211/brcmsmac/phy/phyreg_n.h |  167 +
+ .../wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c   | 3250 +++
+ .../wireless/brcm80211/brcmsmac/phy/phytbl_lcn.h   |   54 +
+ .../net/wireless/brcm80211/brcmsmac/phy/phytbl_n.c |10630 ++++++++
+ .../net/wireless/brcm80211/brcmsmac/phy/phytbl_n.h |   50 +
+ drivers/net/wireless/brcm80211/brcmsmac/phy_shim.c |  216 +
+ drivers/net/wireless/brcm80211/brcmsmac/phy_shim.h |  179 +
+ drivers/net/wireless/brcm80211/brcmsmac/pmu.c      |  375 +
+ drivers/net/wireless/brcm80211/brcmsmac/pmu.h      |   35 +
+ drivers/net/wireless/brcm80211/brcmsmac/pub.h      |  372 +
+ drivers/net/wireless/brcm80211/brcmsmac/rate.c     |  514 +
+ drivers/net/wireless/brcm80211/brcmsmac/rate.h     |  249 +
+ drivers/net/wireless/brcm80211/brcmsmac/scb.h      |   82 +
+ drivers/net/wireless/brcm80211/brcmsmac/stf.c      |  438 +
+ drivers/net/wireless/brcm80211/brcmsmac/stf.h      |   42 +
+ drivers/net/wireless/brcm80211/brcmsmac/types.h    |  304 +
+ .../net/wireless/brcm80211/brcmsmac/ucode_loader.c |  109 +
+ .../net/wireless/brcm80211/brcmsmac/ucode_loader.h |   58 +
+ drivers/net/wireless/brcm80211/brcmutil/Makefile   |   28 +
+ drivers/net/wireless/brcm80211/brcmutil/utils.c    |  278 +
+ .../net/wireless/brcm80211/include/brcm_hw_ids.h   |   41 +
+ .../net/wireless/brcm80211/include/brcmu_utils.h   |  196 +
+ .../net/wireless/brcm80211/include/brcmu_wifi.h    |  239 +
+ .../net/wireless/brcm80211/include/chipcommon.h    |  286 +
+ drivers/net/wireless/brcm80211/include/defs.h      |  103 +
+ drivers/net/wireless/brcm80211/include/soc.h       |   98 +
+ 76 files changed, 93405 insertions(+)
+ create mode 100644 drivers/net/wireless/brcm80211/Kconfig
+ create mode 100644 drivers/net/wireless/brcm80211/Makefile
+ create mode 100644 drivers/net/wireless/brcm80211/brcmfmac/Makefile
+ create mode 100644 drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
+ create mode 100644 drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
+ create mode 100644 drivers/net/wireless/brcm80211/brcmfmac/dhd.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c
+ create mode 100644 drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
+ create mode 100644 drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+ create mode 100644 drivers/net/wireless/brcm80211/brcmfmac/dhd_proto.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+ create mode 100644 drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
+ create mode 100644 drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmfmac/usb.c
+ create mode 100644 drivers/net/wireless/brcm80211/brcmfmac/usb.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmfmac/usb_rdl.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+ create mode 100644 drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/Makefile
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/aiutils.c
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/aiutils.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/ampdu.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/antsel.c
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/antsel.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/brcms_trace_events.c
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/brcms_trace_events.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/channel.c
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/channel.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/d11.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/dma.c
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/dma.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/main.c
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/main.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/phy/phy_cmn.c
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/phy/phy_hal.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/phy/phy_int.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/phy/phy_qmath.c
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/phy/phy_qmath.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/phy/phy_radio.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/phy/phyreg_n.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_n.c
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_n.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/phy_shim.c
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/phy_shim.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/pmu.c
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/pmu.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/pub.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/rate.c
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/rate.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/scb.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/stf.c
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/stf.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/types.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/ucode_loader.c
+ create mode 100644 drivers/net/wireless/brcm80211/brcmsmac/ucode_loader.h
+ create mode 100644 drivers/net/wireless/brcm80211/brcmutil/Makefile
+ create mode 100644 drivers/net/wireless/brcm80211/brcmutil/utils.c
+ create mode 100644 drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
+ create mode 100644 drivers/net/wireless/brcm80211/include/brcmu_utils.h
+ create mode 100644 drivers/net/wireless/brcm80211/include/brcmu_wifi.h
+ create mode 100644 drivers/net/wireless/brcm80211/include/chipcommon.h
+ create mode 100644 drivers/net/wireless/brcm80211/include/defs.h
+ create mode 100644 drivers/net/wireless/brcm80211/include/soc.h
+
+diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
+index fbcf861..d7da434 100644
+--- a/drivers/net/wireless/Kconfig
++++ b/drivers/net/wireless/Kconfig
+@@ -271,6 +271,7 @@ config MWL8K
+ source "drivers/net/wireless/ath/Kconfig"
+ source "drivers/net/wireless/b43/Kconfig"
+ source "drivers/net/wireless/b43legacy/Kconfig"
++source "drivers/net/wireless/brcm80211/Kconfig"
+ source "drivers/net/wireless/hostap/Kconfig"
+ source "drivers/net/wireless/ipw2x00/Kconfig"
+ source "drivers/net/wireless/iwlwifi/Kconfig"
+@@ -288,4 +289,5 @@ source "drivers/net/wireless/mwifiex/Kconfig"
+ #source "drivers/net/wireless/ath6kl/Kconfig"
+ #source "drivers/net/wireless/ath6kl/Kconfig"
+ 
++
+ endif # WLAN
+diff --git a/drivers/net/wireless/Makefile b/drivers/net/wireless/Makefile
+index 60a0a41..69a03f4 100644
+--- a/drivers/net/wireless/Makefile
++++ b/drivers/net/wireless/Makefile
+@@ -59,3 +59,7 @@ obj-$(CONFIG_IWM)	+= iwmc3200wifi/
+ 
+ obj-$(CONFIG_MWIFIEX)	+= mwifiex/
+ #obj-$(CONFIG_ATH6K_LEGACY)	+= ath6kl/
++
++obj-$(CONFIG_BRCMFMAC) += brcm80211/
++obj-$(CONFIG_BRCMUMAC) += brcm80211/
++obj-$(CONFIG_BRCMSMAC) += brcm80211/
+diff --git a/drivers/net/wireless/brcm80211/Kconfig b/drivers/net/wireless/brcm80211/Kconfig
+new file mode 100644
+index 0000000..b480088
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/Kconfig
+@@ -0,0 +1,62 @@
++config BRCMUTIL
++	tristate
++
++config BRCMSMAC
++	tristate "Broadcom IEEE802.11n PCIe SoftMAC WLAN driver"
++	depends on MAC80211
++	depends on BCMA
++	select BRCMUTIL
++	select FW_LOADER
++	select CRC_CCITT
++	select CRC8
++	select CORDIC
++	---help---
++	  This module adds support for PCIe wireless adapters based on Broadcom
++	  IEEE802.11n SoftMAC chipsets.  If you choose to build a module, it'll
++	  be called brcmsmac.ko.
++
++config BRCMFMAC
++	tristate "Broadcom IEEE802.11n embedded FullMAC WLAN driver"
++	depends on CFG80211
++	select BRCMUTIL
++	---help---
++	  This module adds support for embedded wireless adapters based on
++	  Broadcom IEEE802.11n FullMAC chipsets. It has to work with at least
++	  one of the bus interface support. If you choose to build a module,
++	  it'll be called brcmfmac.ko.
++
++config BRCMFMAC_SDIO
++	bool "SDIO bus interface support for FullMAC driver"
++	depends on MMC
++	depends on BRCMFMAC
++	select FW_LOADER
++	default y
++	---help---
++	  This option enables the SDIO bus interface support for Broadcom
++	  IEEE802.11n embedded FullMAC WLAN driver. Say Y if you want to
++	  use the driver for a SDIO wireless card.
++
++config BRCMFMAC_SDIO_OOB
++	bool "Out of band interrupt support for SDIO interface chipset"
++	depends on BRCMFMAC_SDIO
++	---help---
++	  This option enables out-of-band interrupt support for Broadcom
++	  SDIO Wifi chipset using fullmac in order to gain better
++	  performance and deep sleep wake up capability on certain
++	  platforms. Say N if you are unsure.
++
++config BRCMFMAC_USB
++	bool "USB bus interface support for FullMAC driver"
++	depends on USB
++	depends on BRCMFMAC
++	select FW_LOADER
++	---help---
++	  This option enables the USB bus interface support for Broadcom
++	  IEEE802.11n embedded FullMAC WLAN driver. Say Y if you want to
++	  use the driver for an USB wireless card.
++
++config BRCMDBG
++	bool "Broadcom driver debug functions"
++	depends on BRCMSMAC || BRCMFMAC
++	---help---
++	  Selecting this enables additional code for debug purposes.
+diff --git a/drivers/net/wireless/brcm80211/Makefile b/drivers/net/wireless/brcm80211/Makefile
+new file mode 100644
+index 0000000..b987920
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/Makefile
+@@ -0,0 +1,23 @@
++#
++# Makefile fragment for Broadcom 802.11n Networking Device Driver
++#
++# Copyright (c) 2010 Broadcom Corporation
++#
++# Permission to use, copy, modify, and/or distribute this software for any
++# purpose with or without fee is hereby granted, provided that the above
++# copyright notice and this permission notice appear in all copies.
++#
++# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++# SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++# OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++# CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++
++# common flags
++subdir-ccflags-$(CONFIG_BRCMDBG)	+= -DDEBUG
++
++obj-$(CONFIG_BRCMUTIL)	+= brcmutil/
++obj-$(CONFIG_BRCMFMAC)	+= brcmfmac/
++obj-$(CONFIG_BRCMSMAC)	+= brcmsmac/
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/Makefile b/drivers/net/wireless/brcm80211/brcmfmac/Makefile
+new file mode 100644
+index 0000000..a4c4d1c
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmfmac/Makefile
+@@ -0,0 +1,36 @@
++#
++# Makefile fragment for Broadcom 802.11n Networking Device Driver
++#
++# Copyright (c) 2010 Broadcom Corporation
++#
++# Permission to use, copy, modify, and/or distribute this software for any
++# purpose with or without fee is hereby granted, provided that the above
++# copyright notice and this permission notice appear in all copies.
++#
++# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++# SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++# OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++# CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++
++ccflags-y += \
++	-I$(obj)		\
++	-I$(obj)/../include
++
++ccflags-y += -D__CHECK_ENDIAN__
++
++obj-$(CONFIG_BRCMFMAC) += brcmfmac.o
++brcmfmac-objs += \
++		wl_cfg80211.o \
++		dhd_cdc.o \
++		dhd_common.o \
++		dhd_linux.o
++brcmfmac-$(CONFIG_BRCMFMAC_SDIO) += \
++		dhd_sdio.o \
++		bcmsdh.o \
++		bcmsdh_sdmmc.o \
++		sdio_chip.o
++brcmfmac-$(CONFIG_BRCMFMAC_USB) += \
++		usb.o
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
+new file mode 100644
+index 0000000..a87f141
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
+@@ -0,0 +1,550 @@
++/*
++ * Copyright (c) 2010 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++/* ****************** SDIO CARD Interface Functions **************************/
++
++#undef pr_fmt
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/types.h>
++#include <linux/netdevice.h>
++#include <linux/module.h>
++#include <linux/printk.h>
++#include <linux/pci.h>
++#include <linux/pci_ids.h>
++#include <linux/sched.h>
++#include <linux/completion.h>
++#include <linux/mmc/sdio.h>
++#include <linux/mmc/sdio_func.h>
++#include <linux/mmc/card.h>
++
++#include <defs.h>
++#include <brcm_hw_ids.h>
++#include <brcmu_utils.h>
++#include <brcmu_wifi.h>
++#include <soc.h>
++#include "dhd_bus.h"
++#include "dhd_dbg.h"
++#include "sdio_host.h"
++
++#define SDIOH_API_ACCESS_RETRY_LIMIT	2
++
++#ifdef CONFIG_BRCMFMAC_SDIO_OOB
++static irqreturn_t brcmf_sdio_irqhandler(int irq, void *dev_id)
++{
++	struct brcmf_sdio_dev *sdiodev = dev_get_drvdata(dev_id);
++
++	brcmf_dbg(INTR, "oob intr triggered\n");
++
++	/*
++	 * out-of-band interrupt is level-triggered which won't
++	 * be cleared until dpc
++	 */
++	if (sdiodev->irq_en) {
++		disable_irq_nosync(irq);
++		sdiodev->irq_en = false;
++	}
++
++	brcmf_sdbrcm_isr(sdiodev->bus);
++
++	return IRQ_HANDLED;
++}
++
++int brcmf_sdio_intr_register(struct brcmf_sdio_dev *sdiodev)
++{
++	int ret = 0;
++	u8 data;
++	unsigned long flags;
++
++	brcmf_dbg(TRACE, "Entering\n");
++
++	brcmf_dbg(ERROR, "requesting irq %d\n", sdiodev->irq);
++	ret = request_irq(sdiodev->irq, brcmf_sdio_irqhandler,
++			  sdiodev->irq_flags, "brcmf_oob_intr",
++			  &sdiodev->func[1]->card->dev);
++	if (ret != 0)
++		return ret;
++	spin_lock_init(&sdiodev->irq_en_lock);
++	spin_lock_irqsave(&sdiodev->irq_en_lock, flags);
++	sdiodev->irq_en = true;
++	spin_unlock_irqrestore(&sdiodev->irq_en_lock, flags);
++
++	ret = enable_irq_wake(sdiodev->irq);
++	if (ret != 0)
++		return ret;
++	sdiodev->irq_wake = true;
++
++	/* must configure SDIO_CCCR_IENx to enable irq */
++	data = brcmf_sdio_regrb(sdiodev, SDIO_CCCR_IENx, &ret);
++	data |= 1 << SDIO_FUNC_1 | 1 << SDIO_FUNC_2 | 1;
++	brcmf_sdio_regwb(sdiodev, SDIO_CCCR_IENx, data, &ret);
++
++	/* redirect, configure and enable io for interrupt signal */
++	data = SDIO_SEPINT_MASK | SDIO_SEPINT_OE;
++	if (sdiodev->irq_flags & IRQF_TRIGGER_HIGH)
++		data |= SDIO_SEPINT_ACT_HI;
++	brcmf_sdio_regwb(sdiodev, SDIO_CCCR_BRCM_SEPINT, data, &ret);
++
++	return 0;
++}
++
++int brcmf_sdio_intr_unregister(struct brcmf_sdio_dev *sdiodev)
++{
++	brcmf_dbg(TRACE, "Entering\n");
++
++	brcmf_sdio_regwb(sdiodev, SDIO_CCCR_BRCM_SEPINT, 0, NULL);
++	brcmf_sdio_regwb(sdiodev, SDIO_CCCR_IENx, 0, NULL);
++
++	if (sdiodev->irq_wake) {
++		disable_irq_wake(sdiodev->irq);
++		sdiodev->irq_wake = false;
++	}
++	free_irq(sdiodev->irq, &sdiodev->func[1]->card->dev);
++	sdiodev->irq_en = false;
++
++	return 0;
++}
++#else		/* CONFIG_BRCMFMAC_SDIO_OOB */
++static void brcmf_sdio_irqhandler(struct sdio_func *func)
++{
++	struct brcmf_sdio_dev *sdiodev = dev_get_drvdata(&func->card->dev);
++
++	brcmf_dbg(INTR, "ib intr triggered\n");
++
++	sdio_release_host(sdiodev->func[1]);
++	brcmf_sdbrcm_isr(sdiodev->bus);
++	sdio_claim_host(sdiodev->func[1]);
++}
++
++/* dummy handler for SDIO function 2 interrupt */
++static void brcmf_sdio_dummy_irqhandler(struct sdio_func *func)
++{
++}
++
++int brcmf_sdio_intr_register(struct brcmf_sdio_dev *sdiodev)
++{
++	brcmf_dbg(TRACE, "Entering\n");
++
++	sdio_claim_host(sdiodev->func[1]);
++	sdio_claim_irq(sdiodev->func[1], brcmf_sdio_irqhandler);
++	sdio_claim_irq(sdiodev->func[2], brcmf_sdio_dummy_irqhandler);
++	sdio_release_host(sdiodev->func[1]);
++
++	return 0;
++}
++
++int brcmf_sdio_intr_unregister(struct brcmf_sdio_dev *sdiodev)
++{
++	brcmf_dbg(TRACE, "Entering\n");
++
++	sdio_claim_host(sdiodev->func[1]);
++	sdio_release_irq(sdiodev->func[2]);
++	sdio_release_irq(sdiodev->func[1]);
++	sdio_release_host(sdiodev->func[1]);
++
++	return 0;
++}
++#endif		/* CONFIG_BRCMFMAC_SDIO_OOB */
++
++int
++brcmf_sdcard_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev, u32 address)
++{
++	int err = 0, i;
++	u8 addr[3];
++	s32 retry;
++
++	addr[0] = (address >> 8) & SBSDIO_SBADDRLOW_MASK;
++	addr[1] = (address >> 16) & SBSDIO_SBADDRMID_MASK;
++	addr[2] = (address >> 24) & SBSDIO_SBADDRHIGH_MASK;
++
++	for (i = 0; i < 3; i++) {
++		retry = 0;
++		do {
++			if (retry)
++				usleep_range(1000, 2000);
++			err = brcmf_sdioh_request_byte(sdiodev, SDIOH_WRITE,
++					SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRLOW + i,
++					&addr[i]);
++		} while (err != 0 && retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
++
++		if (err) {
++			brcmf_dbg(ERROR, "failed at addr:0x%0x\n",
++				  SBSDIO_FUNC1_SBADDRLOW + i);
++			break;
++		}
++	}
++
++	return err;
++}
++
++static int
++brcmf_sdio_regrw_helper(struct brcmf_sdio_dev *sdiodev, u32 addr,
++			void *data, bool write)
++{
++	u8 func_num, reg_size;
++	u32 bar;
++	s32 retry = 0;
++	int ret;
++
++	/*
++	 * figure out how to read the register based on address range
++	 * 0x00 ~ 0x7FF: function 0 CCCR and FBR
++	 * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
++	 * The rest: function 1 silicon backplane core registers
++	 */
++	if ((addr & ~REG_F0_REG_MASK) == 0) {
++		func_num = SDIO_FUNC_0;
++		reg_size = 1;
++	} else if ((addr & ~REG_F1_MISC_MASK) == 0) {
++		func_num = SDIO_FUNC_1;
++		reg_size = 1;
++	} else {
++		func_num = SDIO_FUNC_1;
++		reg_size = 4;
++
++		/* Set the window for SB core register */
++		bar = addr & ~SBSDIO_SB_OFT_ADDR_MASK;
++		if (bar != sdiodev->sbwad) {
++			ret = brcmf_sdcard_set_sbaddr_window(sdiodev, bar);
++			if (ret != 0) {
++				memset(data, 0xFF, reg_size);
++				return ret;
++			}
++			sdiodev->sbwad = bar;
++		}
++		addr &= SBSDIO_SB_OFT_ADDR_MASK;
++		addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
++	}
++
++	do {
++		if (!write)
++			memset(data, 0, reg_size);
++		if (retry)	/* wait for 1 ms till bus get settled down */
++			usleep_range(1000, 2000);
++		if (reg_size == 1)
++			ret = brcmf_sdioh_request_byte(sdiodev, write,
++						       func_num, addr, data);
++		else
++			ret = brcmf_sdioh_request_word(sdiodev, write,
++						       func_num, addr, data, 4);
++	} while (ret != 0 && retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
++
++	if (ret != 0)
++		brcmf_dbg(ERROR, "failed with %d\n", ret);
++
++	return ret;
++}
++
++u8 brcmf_sdio_regrb(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
++{
++	u8 data;
++	int retval;
++
++	brcmf_dbg(INFO, "addr:0x%08x\n", addr);
++	retval = brcmf_sdio_regrw_helper(sdiodev, addr, &data, false);
++	brcmf_dbg(INFO, "data:0x%02x\n", data);
++
++	if (ret)
++		*ret = retval;
++
++	return data;
++}
++
++u32 brcmf_sdio_regrl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
++{
++	u32 data;
++	int retval;
++
++	brcmf_dbg(INFO, "addr:0x%08x\n", addr);
++	retval = brcmf_sdio_regrw_helper(sdiodev, addr, &data, false);
++	brcmf_dbg(INFO, "data:0x%08x\n", data);
++
++	if (ret)
++		*ret = retval;
++
++	return data;
++}
++
++void brcmf_sdio_regwb(struct brcmf_sdio_dev *sdiodev, u32 addr,
++		      u8 data, int *ret)
++{
++	int retval;
++
++	brcmf_dbg(INFO, "addr:0x%08x, data:0x%02x\n", addr, data);
++	retval = brcmf_sdio_regrw_helper(sdiodev, addr, &data, true);
++
++	if (ret)
++		*ret = retval;
++}
++
++void brcmf_sdio_regwl(struct brcmf_sdio_dev *sdiodev, u32 addr,
++		      u32 data, int *ret)
++{
++	int retval;
++
++	brcmf_dbg(INFO, "addr:0x%08x, data:0x%08x\n", addr, data);
++	retval = brcmf_sdio_regrw_helper(sdiodev, addr, &data, true);
++
++	if (ret)
++		*ret = retval;
++}
++
++static int brcmf_sdcard_recv_prepare(struct brcmf_sdio_dev *sdiodev, uint fn,
++				     uint flags, uint width, u32 *addr)
++{
++	uint bar0 = *addr & ~SBSDIO_SB_OFT_ADDR_MASK;
++	int err = 0;
++
++	/* Async not implemented yet */
++	if (flags & SDIO_REQ_ASYNC)
++		return -ENOTSUPP;
++
++	if (bar0 != sdiodev->sbwad) {
++		err = brcmf_sdcard_set_sbaddr_window(sdiodev, bar0);
++		if (err)
++			return err;
++
++		sdiodev->sbwad = bar0;
++	}
++
++	*addr &= SBSDIO_SB_OFT_ADDR_MASK;
++
++	if (width == 4)
++		*addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
++
++	return 0;
++}
++
++int
++brcmf_sdcard_recv_buf(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
++		      uint flags, u8 *buf, uint nbytes)
++{
++	struct sk_buff *mypkt;
++	int err;
++
++	mypkt = brcmu_pkt_buf_get_skb(nbytes);
++	if (!mypkt) {
++		brcmf_dbg(ERROR, "brcmu_pkt_buf_get_skb failed: len %d\n",
++			  nbytes);
++		return -EIO;
++	}
++
++	err = brcmf_sdcard_recv_pkt(sdiodev, addr, fn, flags, mypkt);
++	if (!err)
++		memcpy(buf, mypkt->data, nbytes);
++
++	brcmu_pkt_buf_free_skb(mypkt);
++	return err;
++}
++
++int
++brcmf_sdcard_recv_pkt(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
++		      uint flags, struct sk_buff *pkt)
++{
++	uint incr_fix;
++	uint width;
++	int err = 0;
++
++	brcmf_dbg(INFO, "fun = %d, addr = 0x%x, size = %d\n",
++		  fn, addr, pkt->len);
++
++	width = (flags & SDIO_REQ_4BYTE) ? 4 : 2;
++	err = brcmf_sdcard_recv_prepare(sdiodev, fn, flags, width, &addr);
++	if (err)
++		return err;
++
++	incr_fix = (flags & SDIO_REQ_FIXED) ? SDIOH_DATA_FIX : SDIOH_DATA_INC;
++	err = brcmf_sdioh_request_buffer(sdiodev, incr_fix, SDIOH_READ,
++					 fn, addr, pkt);
++
++	return err;
++}
++
++int brcmf_sdcard_recv_chain(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
++			    uint flags, struct sk_buff_head *pktq)
++{
++	uint incr_fix;
++	uint width;
++	int err = 0;
++
++	brcmf_dbg(INFO, "fun = %d, addr = 0x%x, size = %d\n",
++		  fn, addr, pktq->qlen);
++
++	width = (flags & SDIO_REQ_4BYTE) ? 4 : 2;
++	err = brcmf_sdcard_recv_prepare(sdiodev, fn, flags, width, &addr);
++	if (err)
++		return err;
++
++	incr_fix = (flags & SDIO_REQ_FIXED) ? SDIOH_DATA_FIX : SDIOH_DATA_INC;
++	err = brcmf_sdioh_request_chain(sdiodev, incr_fix, SDIOH_READ, fn, addr,
++					pktq);
++
++	return err;
++}
++
++int
++brcmf_sdcard_send_buf(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
++		      uint flags, u8 *buf, uint nbytes)
++{
++	struct sk_buff *mypkt;
++	int err;
++
++	mypkt = brcmu_pkt_buf_get_skb(nbytes);
++	if (!mypkt) {
++		brcmf_dbg(ERROR, "brcmu_pkt_buf_get_skb failed: len %d\n",
++			  nbytes);
++		return -EIO;
++	}
++
++	memcpy(mypkt->data, buf, nbytes);
++	err = brcmf_sdcard_send_pkt(sdiodev, addr, fn, flags, mypkt);
++
++	brcmu_pkt_buf_free_skb(mypkt);
++	return err;
++
++}
++
++int
++brcmf_sdcard_send_pkt(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
++		      uint flags, struct sk_buff *pkt)
++{
++	uint incr_fix;
++	uint width;
++	uint bar0 = addr & ~SBSDIO_SB_OFT_ADDR_MASK;
++	int err = 0;
++
++	brcmf_dbg(INFO, "fun = %d, addr = 0x%x, size = %d\n",
++		  fn, addr, pkt->len);
++
++	/* Async not implemented yet */
++	if (flags & SDIO_REQ_ASYNC)
++		return -ENOTSUPP;
++
++	if (bar0 != sdiodev->sbwad) {
++		err = brcmf_sdcard_set_sbaddr_window(sdiodev, bar0);
++		if (err)
++			return err;
++
++		sdiodev->sbwad = bar0;
++	}
++
++	addr &= SBSDIO_SB_OFT_ADDR_MASK;
++
++	incr_fix = (flags & SDIO_REQ_FIXED) ? SDIOH_DATA_FIX : SDIOH_DATA_INC;
++	width = (flags & SDIO_REQ_4BYTE) ? 4 : 2;
++	if (width == 4)
++		addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
++
++	return brcmf_sdioh_request_buffer(sdiodev, incr_fix, SDIOH_WRITE, fn,
++					  addr, pkt);
++}
++
++int brcmf_sdcard_rwdata(struct brcmf_sdio_dev *sdiodev, uint rw, u32 addr,
++			u8 *buf, uint nbytes)
++{
++	struct sk_buff *mypkt;
++	bool write = rw ? SDIOH_WRITE : SDIOH_READ;
++	int err;
++
++	addr &= SBSDIO_SB_OFT_ADDR_MASK;
++	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
++
++	mypkt = brcmu_pkt_buf_get_skb(nbytes);
++	if (!mypkt) {
++		brcmf_dbg(ERROR, "brcmu_pkt_buf_get_skb failed: len %d\n",
++			  nbytes);
++		return -EIO;
++	}
++
++	/* For a write, copy the buffer data into the packet. */
++	if (write)
++		memcpy(mypkt->data, buf, nbytes);
++
++	err = brcmf_sdioh_request_buffer(sdiodev, SDIOH_DATA_INC, write,
++					 SDIO_FUNC_1, addr, mypkt);
++
++	/* For a read, copy the packet data back to the buffer. */
++	if (!err && !write)
++		memcpy(buf, mypkt->data, nbytes);
++
++	brcmu_pkt_buf_free_skb(mypkt);
++	return err;
++}
++
++int brcmf_sdcard_abort(struct brcmf_sdio_dev *sdiodev, uint fn)
++{
++	char t_func = (char)fn;
++	brcmf_dbg(TRACE, "Enter\n");
++
++	/* issue abort cmd52 command through F0 */
++	brcmf_sdioh_request_byte(sdiodev, SDIOH_WRITE, SDIO_FUNC_0,
++				 SDIO_CCCR_ABORT, &t_func);
++
++	brcmf_dbg(TRACE, "Exit\n");
++	return 0;
++}
++
++int brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
++{
++	u32 regs = 0;
++	int ret = 0;
++
++	ret = brcmf_sdioh_attach(sdiodev);
++	if (ret)
++		goto out;
++
++	regs = SI_ENUM_BASE;
++
++	/* Report the BAR, to fix if needed */
++	sdiodev->sbwad = SI_ENUM_BASE;
++
++	/* try to attach to the target device */
++	sdiodev->bus = brcmf_sdbrcm_probe(regs, sdiodev);
++	if (!sdiodev->bus) {
++		brcmf_dbg(ERROR, "device attach failed\n");
++		ret = -ENODEV;
++		goto out;
++	}
++
++out:
++	if (ret)
++		brcmf_sdio_remove(sdiodev);
++
++	return ret;
++}
++EXPORT_SYMBOL(brcmf_sdio_probe);
++
++int brcmf_sdio_remove(struct brcmf_sdio_dev *sdiodev)
++{
++	if (sdiodev->bus) {
++		brcmf_sdbrcm_disconnect(sdiodev->bus);
++		sdiodev->bus = NULL;
++	}
++
++	brcmf_sdioh_detach(sdiodev);
++
++	sdiodev->sbwad = 0;
++
++	return 0;
++}
++EXPORT_SYMBOL(brcmf_sdio_remove);
++
++void brcmf_sdio_wdtmr_enable(struct brcmf_sdio_dev *sdiodev, bool enable)
++{
++	if (enable)
++		brcmf_sdbrcm_wd_timer(sdiodev->bus, BRCMF_WD_POLL_MS);
++	else
++		brcmf_sdbrcm_wd_timer(sdiodev->bus, 0);
++}
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
+new file mode 100644
+index 0000000..391a721
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
+@@ -0,0 +1,703 @@
++/*
++ * Copyright (c) 2010 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#undef pr_fmt
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/version.h>
++#include <linux/types.h>
++#include <linux/netdevice.h>
++#include <linux/printk.h>
++#include <linux/mmc/sdio.h>
++#include <linux/mmc/core.h>
++#include <linux/mmc/sdio_func.h>
++#include <linux/mmc/sdio_ids.h>
++#include <linux/mmc/card.h>
++#include <linux/suspend.h>
++#include <linux/errno.h>
++#include <linux/sched.h>	/* request_irq() */
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <net/cfg80211.h>
++
++#include <defs.h>
++#include <brcm_hw_ids.h>
++#include <brcmu_utils.h>
++#include <brcmu_wifi.h>
++#include "sdio_host.h"
++#include "dhd_dbg.h"
++#include "dhd_bus.h"
++
++#define SDIO_VENDOR_ID_BROADCOM		0x02d0
++
++#define DMA_ALIGN_MASK	0x03
++
++#define SDIO_DEVICE_ID_BROADCOM_4329	0x4329
++#define SDIO_DEVICE_ID_BROADCOM_4330	0x4330
++
++#define SDIO_FUNC1_BLOCKSIZE		64
++#define SDIO_FUNC2_BLOCKSIZE		512
++
++/* devices we support, null terminated */
++static const struct sdio_device_id brcmf_sdmmc_ids[] = {
++	{SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4329)},
++	{SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4330)},
++	{ /* end: all zeroes */ },
++};
++MODULE_DEVICE_TABLE(sdio, brcmf_sdmmc_ids);
++
++#ifdef CONFIG_BRCMFMAC_SDIO_OOB
++static struct list_head oobirq_lh;
++struct brcmf_sdio_oobirq {
++	unsigned int irq;
++	unsigned long flags;
++	struct list_head list;
++};
++#endif		/* CONFIG_BRCMFMAC_SDIO_OOB */
++
++static bool
++brcmf_pm_resume_error(struct brcmf_sdio_dev *sdiodev)
++{
++	bool is_err = false;
++#if defined(CONFIG_PM_SLEEP) && (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,34))
++	is_err = atomic_read(&sdiodev->suspend);
++#endif
++	return is_err;
++}
++
++static void
++brcmf_pm_resume_wait(struct brcmf_sdio_dev *sdiodev, wait_queue_head_t *wq)
++{
++#if defined(CONFIG_PM_SLEEP) && (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,34))
++	int retry = 0;
++	while (atomic_read(&sdiodev->suspend) && retry++ != 30)
++		wait_event_timeout(*wq, false, HZ/100);
++#endif
++}
++
++static inline int brcmf_sdioh_f0_write_byte(struct brcmf_sdio_dev *sdiodev,
++					    uint regaddr, u8 *byte)
++{
++	struct sdio_func *sdfunc = sdiodev->func[0];
++	int err_ret;
++
++	/*
++	 * Can only directly write to some F0 registers.
++	 * Handle F2 enable/disable and Abort command
++	 * as a special case.
++	 */
++	if (regaddr == SDIO_CCCR_IOEx) {
++		sdfunc = sdiodev->func[2];
++		if (sdfunc) {
++			sdio_claim_host(sdfunc);
++			if (*byte & SDIO_FUNC_ENABLE_2) {
++				/* Enable Function 2 */
++				err_ret = sdio_enable_func(sdfunc);
++				if (err_ret)
++					brcmf_dbg(ERROR,
++						  "enable F2 failed:%d\n",
++						  err_ret);
++			} else {
++				/* Disable Function 2 */
++				err_ret = sdio_disable_func(sdfunc);
++				if (err_ret)
++					brcmf_dbg(ERROR,
++						  "Disable F2 failed:%d\n",
++						  err_ret);
++			}
++			sdio_release_host(sdfunc);
++		}
++	} else if ((regaddr == SDIO_CCCR_ABORT) ||
++		   (regaddr == SDIO_CCCR_IENx)) {
++		sdfunc = kmemdup(sdiodev->func[0], sizeof(struct sdio_func),
++				 GFP_KERNEL);
++		if (!sdfunc)
++			return -ENOMEM;
++		sdfunc->num = 0;
++		sdio_claim_host(sdfunc);
++		sdio_writeb(sdfunc, *byte, regaddr, &err_ret);
++		sdio_release_host(sdfunc);
++		kfree(sdfunc);
++	} else if (regaddr < 0xF0) {
++		brcmf_dbg(ERROR, "F0 Wr:0x%02x: write disallowed\n", regaddr);
++		err_ret = -EPERM;
++	} else {
++		sdio_claim_host(sdfunc);
++		sdio_f0_writeb(sdfunc, *byte, regaddr, &err_ret);
++		sdio_release_host(sdfunc);
++	}
++
++	return err_ret;
++}
++
++int brcmf_sdioh_request_byte(struct brcmf_sdio_dev *sdiodev, uint rw, uint func,
++			     uint regaddr, u8 *byte)
++{
++	int err_ret;
++
++	brcmf_dbg(INFO, "rw=%d, func=%d, addr=0x%05x\n", rw, func, regaddr);
++
++	brcmf_pm_resume_wait(sdiodev, &sdiodev->request_byte_wait);
++	if (brcmf_pm_resume_error(sdiodev))
++		return -EIO;
++
++	if (rw && func == 0) {
++		/* handle F0 separately */
++		err_ret = brcmf_sdioh_f0_write_byte(sdiodev, regaddr, byte);
++	} else {
++		sdio_claim_host(sdiodev->func[func]);
++		if (rw) /* CMD52 Write */
++			sdio_writeb(sdiodev->func[func], *byte, regaddr,
++				    &err_ret);
++		else if (func == 0) {
++			*byte = sdio_f0_readb(sdiodev->func[func], regaddr,
++					      &err_ret);
++		} else {
++			*byte = sdio_readb(sdiodev->func[func], regaddr,
++					   &err_ret);
++		}
++		sdio_release_host(sdiodev->func[func]);
++	}
++
++	if (err_ret)
++		brcmf_dbg(ERROR, "Failed to %s byte F%d:@0x%05x=%02x, Err: %d\n",
++			  rw ? "write" : "read", func, regaddr, *byte, err_ret);
++
++	return err_ret;
++}
++
++int brcmf_sdioh_request_word(struct brcmf_sdio_dev *sdiodev,
++			     uint rw, uint func, uint addr, u32 *word,
++			     uint nbytes)
++{
++	int err_ret = -EIO;
++
++	if (func == 0) {
++		brcmf_dbg(ERROR, "Only CMD52 allowed to F0\n");
++		return -EINVAL;
++	}
++
++	brcmf_dbg(INFO, "rw=%d, func=%d, addr=0x%05x, nbytes=%d\n",
++		  rw, func, addr, nbytes);
++
++	brcmf_pm_resume_wait(sdiodev, &sdiodev->request_word_wait);
++	if (brcmf_pm_resume_error(sdiodev))
++		return -EIO;
++	/* Claim host controller */
++	sdio_claim_host(sdiodev->func[func]);
++
++	if (rw) {		/* CMD52 Write */
++		if (nbytes == 4)
++			sdio_writel(sdiodev->func[func], *word, addr,
++				    &err_ret);
++		else if (nbytes == 2)
++			sdio_writew(sdiodev->func[func], (*word & 0xFFFF),
++				    addr, &err_ret);
++		else
++			brcmf_dbg(ERROR, "Invalid nbytes: %d\n", nbytes);
++	} else {		/* CMD52 Read */
++		if (nbytes == 4)
++			*word = sdio_readl(sdiodev->func[func], addr, &err_ret);
++		else if (nbytes == 2)
++			*word = sdio_readw(sdiodev->func[func], addr,
++					   &err_ret) & 0xFFFF;
++		else
++			brcmf_dbg(ERROR, "Invalid nbytes: %d\n", nbytes);
++	}
++
++	/* Release host controller */
++	sdio_release_host(sdiodev->func[func]);
++
++	if (err_ret)
++		brcmf_dbg(ERROR, "Failed to %s word, Err: 0x%08x\n",
++			  rw ? "write" : "read", err_ret);
++
++	return err_ret;
++}
++
++/* precondition: host controller is claimed */
++static int
++brcmf_sdioh_request_data(struct brcmf_sdio_dev *sdiodev, uint write, bool fifo,
++			 uint func, uint addr, struct sk_buff *pkt, uint pktlen)
++{
++	int err_ret = 0;
++
++	if ((write) && (!fifo)) {
++		err_ret = sdio_memcpy_toio(sdiodev->func[func], addr,
++					   ((u8 *) (pkt->data)), pktlen);
++	} else if (write) {
++		err_ret = sdio_memcpy_toio(sdiodev->func[func], addr,
++					   ((u8 *) (pkt->data)), pktlen);
++	} else if (fifo) {
++		err_ret = sdio_readsb(sdiodev->func[func],
++				      ((u8 *) (pkt->data)), addr, pktlen);
++	} else {
++		err_ret = sdio_memcpy_fromio(sdiodev->func[func],
++					     ((u8 *) (pkt->data)),
++					     addr, pktlen);
++	}
++
++	return err_ret;
++}
++
++/*
++ * This function takes a queue of packets. The packets on the queue
++ * are assumed to be properly aligned by the caller.
++ */
++int
++brcmf_sdioh_request_chain(struct brcmf_sdio_dev *sdiodev, uint fix_inc,
++			  uint write, uint func, uint addr,
++			  struct sk_buff_head *pktq)
++{
++	bool fifo = (fix_inc == SDIOH_DATA_FIX);
++	u32 SGCount = 0;
++	int err_ret = 0;
++
++	struct sk_buff *pkt;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	brcmf_pm_resume_wait(sdiodev, &sdiodev->request_chain_wait);
++	if (brcmf_pm_resume_error(sdiodev))
++		return -EIO;
++
++	/* Claim host controller */
++	sdio_claim_host(sdiodev->func[func]);
++
++	skb_queue_walk(pktq, pkt) {
++		uint pkt_len = pkt->len;
++		pkt_len += 3;
++		pkt_len &= 0xFFFFFFFC;
++
++		err_ret = brcmf_sdioh_request_data(sdiodev, write, fifo, func,
++						   addr, pkt, pkt_len);
++		if (err_ret) {
++			brcmf_dbg(ERROR, "%s FAILED %p[%d], addr=0x%05x, pkt_len=%d, ERR=0x%08x\n",
++				  write ? "TX" : "RX", pkt, SGCount, addr,
++				  pkt_len, err_ret);
++		} else {
++			brcmf_dbg(TRACE, "%s xfr'd %p[%d], addr=0x%05x, len=%d\n",
++				  write ? "TX" : "RX", pkt, SGCount, addr,
++				  pkt_len);
++		}
++		if (!fifo)
++			addr += pkt_len;
++
++		SGCount++;
++	}
++
++	/* Release host controller */
++	sdio_release_host(sdiodev->func[func]);
++
++	brcmf_dbg(TRACE, "Exit\n");
++	return err_ret;
++}
++
++/*
++ * This function takes a single DMA-able packet.
++ */
++int brcmf_sdioh_request_buffer(struct brcmf_sdio_dev *sdiodev,
++			       uint fix_inc, uint write, uint func, uint addr,
++			       struct sk_buff *pkt)
++{
++	int status;
++	uint pkt_len;
++	bool fifo = (fix_inc == SDIOH_DATA_FIX);
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	if (pkt == NULL)
++		return -EINVAL;
++	pkt_len = pkt->len;
++
++	brcmf_pm_resume_wait(sdiodev, &sdiodev->request_buffer_wait);
++	if (brcmf_pm_resume_error(sdiodev))
++		return -EIO;
++
++	/* Claim host controller */
++	sdio_claim_host(sdiodev->func[func]);
++
++	pkt_len += 3;
++	pkt_len &= (uint)~3;
++
++	status = brcmf_sdioh_request_data(sdiodev, write, fifo, func,
++					   addr, pkt, pkt_len);
++	if (status) {
++		brcmf_dbg(ERROR, "%s FAILED %p, addr=0x%05x, pkt_len=%d, ERR=0x%08x\n",
++			  write ? "TX" : "RX", pkt, addr, pkt_len, status);
++	} else {
++		brcmf_dbg(TRACE, "%s xfr'd %p, addr=0x%05x, len=%d\n",
++			  write ? "TX" : "RX", pkt, addr, pkt_len);
++	}
++
++	/* Release host controller */
++	sdio_release_host(sdiodev->func[func]);
++
++	return status;
++}
++
++static int brcmf_sdioh_get_cisaddr(struct brcmf_sdio_dev *sdiodev, u32 regaddr)
++{
++	/* read 24 bits and return valid 17 bit addr */
++	int i, ret;
++	u32 scratch, regdata;
++	__le32 scratch_le;
++	u8 *ptr = (u8 *)&scratch_le;
++
++	for (i = 0; i < 3; i++) {
++		regdata = brcmf_sdio_regrl(sdiodev, regaddr, &ret);
++		if (ret != 0)
++			brcmf_dbg(ERROR, "Can't read!\n");
++
++		*ptr++ = (u8) regdata;
++		regaddr++;
++	}
++
++	/* Only the lower 17-bits are valid */
++	scratch = le32_to_cpu(scratch_le);
++	scratch &= 0x0001FFFF;
++	return scratch;
++}
++
++static int brcmf_sdioh_enablefuncs(struct brcmf_sdio_dev *sdiodev)
++{
++	int err_ret;
++	u32 fbraddr;
++	u8 func;
++
++	brcmf_dbg(TRACE, "\n");
++
++	/* Get the Card's common CIS address */
++	sdiodev->func_cis_ptr[0] = brcmf_sdioh_get_cisaddr(sdiodev,
++							   SDIO_CCCR_CIS);
++	brcmf_dbg(INFO, "Card's Common CIS Ptr = 0x%x\n",
++		  sdiodev->func_cis_ptr[0]);
++
++	/* Get the Card's function CIS (for each function) */
++	for (fbraddr = SDIO_FBR_BASE(1), func = 1;
++	     func <= sdiodev->num_funcs; func++, fbraddr += SDIOD_FBR_SIZE) {
++		sdiodev->func_cis_ptr[func] =
++		    brcmf_sdioh_get_cisaddr(sdiodev, SDIO_FBR_CIS + fbraddr);
++		brcmf_dbg(INFO, "Function %d CIS Ptr = 0x%x\n",
++			  func, sdiodev->func_cis_ptr[func]);
++	}
++
++	/* Enable Function 1 */
++	sdio_claim_host(sdiodev->func[1]);
++	err_ret = sdio_enable_func(sdiodev->func[1]);
++	sdio_release_host(sdiodev->func[1]);
++	if (err_ret)
++		brcmf_dbg(ERROR, "Failed to enable F1 Err: 0x%08x\n", err_ret);
++
++	return false;
++}
++
++/*
++ *	Public entry points & extern's
++ */
++int brcmf_sdioh_attach(struct brcmf_sdio_dev *sdiodev)
++{
++	int err_ret = 0;
++
++	brcmf_dbg(TRACE, "\n");
++
++	sdiodev->num_funcs = 2;
++
++	sdio_claim_host(sdiodev->func[1]);
++	err_ret = sdio_set_block_size(sdiodev->func[1], SDIO_FUNC1_BLOCKSIZE);
++	sdio_release_host(sdiodev->func[1]);
++	if (err_ret) {
++		brcmf_dbg(ERROR, "Failed to set F1 blocksize\n");
++		goto out;
++	}
++
++	sdio_claim_host(sdiodev->func[2]);
++	err_ret = sdio_set_block_size(sdiodev->func[2], SDIO_FUNC2_BLOCKSIZE);
++	sdio_release_host(sdiodev->func[2]);
++	if (err_ret) {
++		brcmf_dbg(ERROR, "Failed to set F2 blocksize\n");
++		goto out;
++	}
++
++	brcmf_sdioh_enablefuncs(sdiodev);
++
++out:
++	brcmf_dbg(TRACE, "Done\n");
++	return err_ret;
++}
++
++void brcmf_sdioh_detach(struct brcmf_sdio_dev *sdiodev)
++{
++	brcmf_dbg(TRACE, "\n");
++
++	/* Disable Function 2 */
++	sdio_claim_host(sdiodev->func[2]);
++	sdio_disable_func(sdiodev->func[2]);
++	sdio_release_host(sdiodev->func[2]);
++
++	/* Disable Function 1 */
++	sdio_claim_host(sdiodev->func[1]);
++	sdio_disable_func(sdiodev->func[1]);
++	sdio_release_host(sdiodev->func[1]);
++
++}
++
++#ifdef CONFIG_BRCMFMAC_SDIO_OOB
++static int brcmf_sdio_getintrcfg(struct brcmf_sdio_dev *sdiodev)
++{
++	struct brcmf_sdio_oobirq *oobirq_entry;
++
++	if (list_empty(&oobirq_lh)) {
++		brcmf_dbg(ERROR, "no valid oob irq resource\n");
++		return -ENXIO;
++	}
++
++	oobirq_entry = list_first_entry(&oobirq_lh, struct brcmf_sdio_oobirq,
++					list);
++
++	sdiodev->irq = oobirq_entry->irq;
++	sdiodev->irq_flags = oobirq_entry->flags;
++	list_del(&oobirq_entry->list);
++	kfree(oobirq_entry);
++
++	return 0;
++}
++#else
++static inline int brcmf_sdio_getintrcfg(struct brcmf_sdio_dev *sdiodev)
++{
++	return 0;
++}
++#endif		/* CONFIG_BRCMFMAC_SDIO_OOB */
++
++static int brcmf_ops_sdio_probe(struct sdio_func *func,
++			      const struct sdio_device_id *id)
++{
++	int ret = 0;
++	struct brcmf_sdio_dev *sdiodev;
++	struct brcmf_bus *bus_if;
++
++	brcmf_dbg(TRACE, "Enter\n");
++	brcmf_dbg(TRACE, "func->class=%x\n", func->class);
++	brcmf_dbg(TRACE, "sdio_vendor: 0x%04x\n", func->vendor);
++	brcmf_dbg(TRACE, "sdio_device: 0x%04x\n", func->device);
++	brcmf_dbg(TRACE, "Function#: 0x%04x\n", func->num);
++
++	if (func->num == 1) {
++		if (dev_get_drvdata(&func->card->dev)) {
++			brcmf_dbg(ERROR, "card private drvdata occupied\n");
++			return -ENXIO;
++		}
++		bus_if = kzalloc(sizeof(struct brcmf_bus), GFP_KERNEL);
++		if (!bus_if)
++			return -ENOMEM;
++		sdiodev = kzalloc(sizeof(struct brcmf_sdio_dev), GFP_KERNEL);
++		if (!sdiodev) {
++			kfree(bus_if);
++			return -ENOMEM;
++		}
++		sdiodev->func[0] = func;
++		sdiodev->func[1] = func;
++		sdiodev->bus_if = bus_if;
++		bus_if->bus_priv.sdio = sdiodev;
++		bus_if->type = SDIO_BUS;
++		bus_if->align = BRCMF_SDALIGN;
++		dev_set_drvdata(&func->card->dev, sdiodev);
++
++		atomic_set(&sdiodev->suspend, false);
++		init_waitqueue_head(&sdiodev->request_byte_wait);
++		init_waitqueue_head(&sdiodev->request_word_wait);
++		init_waitqueue_head(&sdiodev->request_chain_wait);
++		init_waitqueue_head(&sdiodev->request_buffer_wait);
++	}
++
++	if (func->num == 2) {
++		sdiodev = dev_get_drvdata(&func->card->dev);
++		if ((!sdiodev) || (sdiodev->func[1]->card != func->card))
++			return -ENODEV;
++
++		ret = brcmf_sdio_getintrcfg(sdiodev);
++		if (ret)
++			return ret;
++		sdiodev->func[2] = func;
++
++		bus_if = sdiodev->bus_if;
++		sdiodev->dev = &func->dev;
++		dev_set_drvdata(&func->dev, bus_if);
++
++		brcmf_dbg(TRACE, "F2 found, calling brcmf_sdio_probe...\n");
++		ret = brcmf_sdio_probe(sdiodev);
++	}
++
++	return ret;
++}
++
++static void brcmf_ops_sdio_remove(struct sdio_func *func)
++{
++	struct brcmf_bus *bus_if;
++	struct brcmf_sdio_dev *sdiodev;
++	brcmf_dbg(TRACE, "Enter\n");
++	brcmf_dbg(INFO, "func->class=%x\n", func->class);
++	brcmf_dbg(INFO, "sdio_vendor: 0x%04x\n", func->vendor);
++	brcmf_dbg(INFO, "sdio_device: 0x%04x\n", func->device);
++	brcmf_dbg(INFO, "Function#: 0x%04x\n", func->num);
++
++	if (func->num == 2) {
++		bus_if = dev_get_drvdata(&func->dev);
++		sdiodev = bus_if->bus_priv.sdio;
++		brcmf_dbg(TRACE, "F2 found, calling brcmf_sdio_remove...\n");
++		brcmf_sdio_remove(sdiodev);
++		dev_set_drvdata(&func->card->dev, NULL);
++		dev_set_drvdata(&func->dev, NULL);
++		kfree(bus_if);
++		kfree(sdiodev);
++	}
++}
++
++#if defined(CONFIG_PM_SLEEP) && (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,34))
++static int brcmf_sdio_suspend(struct device *dev)
++{
++	mmc_pm_flag_t sdio_flags;
++	struct sdio_func *func = dev_to_sdio_func(dev);
++	struct brcmf_sdio_dev *sdiodev = dev_get_drvdata(&func->card->dev);
++	int ret = 0;
++
++	brcmf_dbg(TRACE, "\n");
++
++	atomic_set(&sdiodev->suspend, true);
++
++	sdio_flags = sdio_get_host_pm_caps(sdiodev->func[1]);
++	if (!(sdio_flags & MMC_PM_KEEP_POWER)) {
++		brcmf_dbg(ERROR, "Host can't keep power while suspended\n");
++		return -EINVAL;
++	}
++
++	ret = sdio_set_host_pm_flags(sdiodev->func[1], MMC_PM_KEEP_POWER);
++	if (ret) {
++		brcmf_dbg(ERROR, "Failed to set pm_flags\n");
++		return ret;
++	}
++
++	brcmf_sdio_wdtmr_enable(sdiodev, false);
++
++	return ret;
++}
++
++static int brcmf_sdio_resume(struct device *dev)
++{
++	struct sdio_func *func = dev_to_sdio_func(dev);
++	struct brcmf_sdio_dev *sdiodev = dev_get_drvdata(&func->card->dev);
++
++	brcmf_sdio_wdtmr_enable(sdiodev, true);
++	atomic_set(&sdiodev->suspend, false);
++	return 0;
++}
++
++static const struct dev_pm_ops brcmf_sdio_pm_ops = {
++	.suspend	= brcmf_sdio_suspend,
++	.resume		= brcmf_sdio_resume,
++};
++#endif	/* CONFIG_PM_SLEEP */
++
++static struct sdio_driver brcmf_sdmmc_driver = {
++	.probe = brcmf_ops_sdio_probe,
++	.remove = brcmf_ops_sdio_remove,
++	.name = "brcmfmac",
++	.id_table = brcmf_sdmmc_ids,
++#if defined(CONFIG_PM_SLEEP) && (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,34))
++	.drv = {
++		.pm = &brcmf_sdio_pm_ops,
++	},
++#endif	/* CONFIG_PM_SLEEP */
++};
++
++#ifdef CONFIG_BRCMFMAC_SDIO_OOB
++static int brcmf_sdio_pd_probe(struct platform_device *pdev)
++{
++	struct resource *res;
++	struct brcmf_sdio_oobirq *oobirq_entry;
++	int i, ret;
++
++	INIT_LIST_HEAD(&oobirq_lh);
++
++	for (i = 0; ; i++) {
++		res = platform_get_resource(pdev, IORESOURCE_IRQ, i);
++		if (!res)
++			break;
++
++		oobirq_entry = kzalloc(sizeof(struct brcmf_sdio_oobirq),
++				       GFP_KERNEL);
++		oobirq_entry->irq = res->start;
++		oobirq_entry->flags = res->flags & IRQF_TRIGGER_MASK;
++		list_add_tail(&oobirq_entry->list, &oobirq_lh);
++	}
++	if (i == 0)
++		return -ENXIO;
++
++	ret = sdio_register_driver(&brcmf_sdmmc_driver);
++
++	if (ret)
++		brcmf_dbg(ERROR, "sdio_register_driver failed: %d\n", ret);
++
++	return ret;
++}
++
++static struct platform_driver brcmf_sdio_pd = {
++	.probe		= brcmf_sdio_pd_probe,
++	.driver		= {
++		.name	= "brcmf_sdio_pd"
++	}
++};
++
++void brcmf_sdio_exit(void)
++{
++	brcmf_dbg(TRACE, "Enter\n");
++
++	sdio_unregister_driver(&brcmf_sdmmc_driver);
++
++	platform_driver_unregister(&brcmf_sdio_pd);
++}
++
++void brcmf_sdio_init(void)
++{
++	int ret;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	ret = platform_driver_register(&brcmf_sdio_pd);
++
++	if (ret)
++		brcmf_dbg(ERROR, "platform_driver_register failed: %d\n", ret);
++}
++#else
++void brcmf_sdio_exit(void)
++{
++	brcmf_dbg(TRACE, "Enter\n");
++
++	sdio_unregister_driver(&brcmf_sdmmc_driver);
++}
++
++void brcmf_sdio_init(void)
++{
++	int ret;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	ret = sdio_register_driver(&brcmf_sdmmc_driver);
++
++	if (ret)
++		brcmf_dbg(ERROR, "sdio_register_driver failed: %d\n", ret);
++}
++#endif		/* CONFIG_BRCMFMAC_SDIO_OOB */
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
+new file mode 100644
+index 0000000..9f63701
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
+@@ -0,0 +1,669 @@
++/*
++ * Copyright (c) 2010 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++/****************
++ * Common types *
++ */
++
++#ifndef _BRCMF_H_
++#define _BRCMF_H_
++
++#define BRCMF_VERSION_STR		"4.218.248.5"
++
++/*******************************************************************************
++ * IO codes that are interpreted by dongle firmware
++ ******************************************************************************/
++#define BRCMF_C_UP				2
++#define BRCMF_C_SET_PROMISC			10
++#define BRCMF_C_GET_RATE			12
++#define BRCMF_C_GET_INFRA			19
++#define BRCMF_C_SET_INFRA			20
++#define BRCMF_C_GET_AUTH			21
++#define BRCMF_C_SET_AUTH			22
++#define BRCMF_C_GET_BSSID			23
++#define BRCMF_C_GET_SSID			25
++#define BRCMF_C_SET_SSID			26
++#define BRCMF_C_GET_CHANNEL			29
++#define BRCMF_C_GET_SRL				31
++#define BRCMF_C_GET_LRL				33
++#define BRCMF_C_GET_RADIO			37
++#define BRCMF_C_SET_RADIO			38
++#define BRCMF_C_GET_PHYTYPE			39
++#define BRCMF_C_SET_KEY				45
++#define BRCMF_C_SET_PASSIVE_SCAN		49
++#define BRCMF_C_SCAN				50
++#define BRCMF_C_SCAN_RESULTS			51
++#define BRCMF_C_DISASSOC			52
++#define BRCMF_C_REASSOC				53
++#define BRCMF_C_SET_ROAM_TRIGGER		55
++#define BRCMF_C_SET_ROAM_DELTA			57
++#define BRCMF_C_GET_DTIMPRD			77
++#define BRCMF_C_SET_COUNTRY			84
++#define BRCMF_C_GET_PM				85
++#define BRCMF_C_SET_PM				86
++#define BRCMF_C_GET_AP				117
++#define BRCMF_C_SET_AP				118
++#define BRCMF_C_GET_RSSI			127
++#define BRCMF_C_GET_WSEC			133
++#define BRCMF_C_SET_WSEC			134
++#define BRCMF_C_GET_PHY_NOISE			135
++#define BRCMF_C_GET_BSS_INFO			136
++#define BRCMF_C_SET_SCAN_CHANNEL_TIME		185
++#define BRCMF_C_SET_SCAN_UNASSOC_TIME		187
++#define BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON	201
++#define BRCMF_C_GET_VALID_CHANNELS		217
++#define BRCMF_C_GET_KEY_PRIMARY			235
++#define BRCMF_C_SET_KEY_PRIMARY			236
++#define BRCMF_C_SET_SCAN_PASSIVE_TIME		258
++#define BRCMF_C_GET_VAR				262
++#define BRCMF_C_SET_VAR				263
++
++/* phy types (returned by WLC_GET_PHYTPE) */
++#define	WLC_PHY_TYPE_A		0
++#define	WLC_PHY_TYPE_B		1
++#define	WLC_PHY_TYPE_G		2
++#define	WLC_PHY_TYPE_N		4
++#define	WLC_PHY_TYPE_LP		5
++#define	WLC_PHY_TYPE_SSN	6
++#define	WLC_PHY_TYPE_HT		7
++#define	WLC_PHY_TYPE_LCN	8
++#define	WLC_PHY_TYPE_NULL	0xf
++
++#define BRCMF_EVENTING_MASK_LEN	16
++
++#define TOE_TX_CSUM_OL		0x00000001
++#define TOE_RX_CSUM_OL		0x00000002
++
++#define	BRCMF_BSS_INFO_VERSION	109 /* curr ver of brcmf_bss_info_le struct */
++
++/* size of brcmf_scan_params not including variable length array */
++#define BRCMF_SCAN_PARAMS_FIXED_SIZE 64
++
++/* masks for channel and ssid count */
++#define BRCMF_SCAN_PARAMS_COUNT_MASK 0x0000ffff
++#define BRCMF_SCAN_PARAMS_NSSID_SHIFT 16
++
++#define BRCMF_SCAN_ACTION_START      1
++#define BRCMF_SCAN_ACTION_CONTINUE   2
++#define WL_SCAN_ACTION_ABORT      3
++
++#define BRCMF_ISCAN_REQ_VERSION 1
++
++/* brcmf_iscan_results status values */
++#define BRCMF_SCAN_RESULTS_SUCCESS	0
++#define BRCMF_SCAN_RESULTS_PARTIAL	1
++#define BRCMF_SCAN_RESULTS_PENDING	2
++#define BRCMF_SCAN_RESULTS_ABORTED	3
++#define BRCMF_SCAN_RESULTS_NO_MEM	4
++
++/* Indicates this key is using soft encrypt */
++#define WL_SOFT_KEY	(1 << 0)
++/* primary (ie tx) key */
++#define BRCMF_PRIMARY_KEY	(1 << 1)
++/* Reserved for backward compat */
++#define WL_KF_RES_4	(1 << 4)
++/* Reserved for backward compat */
++#define WL_KF_RES_5	(1 << 5)
++/* Indicates a group key for a IBSS PEER */
++#define WL_IBSS_PEER_GROUP_KEY	(1 << 6)
++
++/* For supporting multiple interfaces */
++#define BRCMF_MAX_IFS	16
++
++#define DOT11_BSSTYPE_ANY			2
++#define DOT11_MAX_DEFAULT_KEYS	4
++
++#define BRCMF_EVENT_MSG_LINK		0x01
++#define BRCMF_EVENT_MSG_FLUSHTXQ	0x02
++#define BRCMF_EVENT_MSG_GROUP		0x04
++
++struct brcmf_event_msg {
++	__be16 version;
++	__be16 flags;
++	__be32 event_type;
++	__be32 status;
++	__be32 reason;
++	__be32 auth_type;
++	__be32 datalen;
++	u8 addr[ETH_ALEN];
++	char ifname[IFNAMSIZ];
++} __packed;
++
++struct brcm_ethhdr {
++	u16 subtype;
++	u16 length;
++	u8 version;
++	u8 oui[3];
++	u16 usr_subtype;
++} __packed;
++
++struct brcmf_event {
++	struct ethhdr eth;
++	struct brcm_ethhdr hdr;
++	struct brcmf_event_msg msg;
++} __packed;
++
++/* event codes sent by the dongle to this driver */
++#define BRCMF_E_SET_SSID			0
++#define BRCMF_E_JOIN				1
++#define BRCMF_E_START				2
++#define BRCMF_E_AUTH				3
++#define BRCMF_E_AUTH_IND			4
++#define BRCMF_E_DEAUTH				5
++#define BRCMF_E_DEAUTH_IND			6
++#define BRCMF_E_ASSOC				7
++#define BRCMF_E_ASSOC_IND			8
++#define BRCMF_E_REASSOC				9
++#define BRCMF_E_REASSOC_IND			10
++#define BRCMF_E_DISASSOC			11
++#define BRCMF_E_DISASSOC_IND			12
++#define BRCMF_E_QUIET_START			13
++#define BRCMF_E_QUIET_END			14
++#define BRCMF_E_BEACON_RX			15
++#define BRCMF_E_LINK				16
++#define BRCMF_E_MIC_ERROR			17
++#define BRCMF_E_NDIS_LINK			18
++#define BRCMF_E_ROAM				19
++#define BRCMF_E_TXFAIL				20
++#define BRCMF_E_PMKID_CACHE			21
++#define BRCMF_E_RETROGRADE_TSF			22
++#define BRCMF_E_PRUNE				23
++#define BRCMF_E_AUTOAUTH			24
++#define BRCMF_E_EAPOL_MSG			25
++#define BRCMF_E_SCAN_COMPLETE			26
++#define BRCMF_E_ADDTS_IND			27
++#define BRCMF_E_DELTS_IND			28
++#define BRCMF_E_BCNSENT_IND			29
++#define BRCMF_E_BCNRX_MSG			30
++#define BRCMF_E_BCNLOST_MSG			31
++#define BRCMF_E_ROAM_PREP			32
++#define BRCMF_E_PFN_NET_FOUND			33
++#define BRCMF_E_PFN_NET_LOST			34
++#define BRCMF_E_RESET_COMPLETE			35
++#define BRCMF_E_JOIN_START			36
++#define BRCMF_E_ROAM_START			37
++#define BRCMF_E_ASSOC_START			38
++#define BRCMF_E_IBSS_ASSOC			39
++#define BRCMF_E_RADIO				40
++#define BRCMF_E_PSM_WATCHDOG			41
++#define BRCMF_E_PROBREQ_MSG			44
++#define BRCMF_E_SCAN_CONFIRM_IND		45
++#define BRCMF_E_PSK_SUP				46
++#define BRCMF_E_COUNTRY_CODE_CHANGED		47
++#define	BRCMF_E_EXCEEDED_MEDIUM_TIME		48
++#define BRCMF_E_ICV_ERROR			49
++#define BRCMF_E_UNICAST_DECODE_ERROR		50
++#define BRCMF_E_MULTICAST_DECODE_ERROR		51
++#define BRCMF_E_TRACE				52
++#define BRCMF_E_IF				54
++#define BRCMF_E_RSSI				56
++#define BRCMF_E_PFN_SCAN_COMPLETE		57
++#define BRCMF_E_EXTLOG_MSG			58
++#define BRCMF_E_ACTION_FRAME			59
++#define BRCMF_E_ACTION_FRAME_COMPLETE		60
++#define BRCMF_E_PRE_ASSOC_IND			61
++#define BRCMF_E_PRE_REASSOC_IND			62
++#define BRCMF_E_CHANNEL_ADOPTED			63
++#define BRCMF_E_AP_STARTED			64
++#define BRCMF_E_DFS_AP_STOP			65
++#define BRCMF_E_DFS_AP_RESUME			66
++#define BRCMF_E_RESERVED1			67
++#define BRCMF_E_RESERVED2			68
++#define BRCMF_E_ESCAN_RESULT			69
++#define BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE	70
++#define BRCMF_E_DCS_REQUEST			73
++
++#define BRCMF_E_FIFO_CREDIT_MAP			74
++
++#define BRCMF_E_LAST				75
++
++#define BRCMF_E_STATUS_SUCCESS			0
++#define BRCMF_E_STATUS_FAIL			1
++#define BRCMF_E_STATUS_TIMEOUT			2
++#define BRCMF_E_STATUS_NO_NETWORKS		3
++#define BRCMF_E_STATUS_ABORT			4
++#define BRCMF_E_STATUS_NO_ACK			5
++#define BRCMF_E_STATUS_UNSOLICITED		6
++#define BRCMF_E_STATUS_ATTEMPT			7
++#define BRCMF_E_STATUS_PARTIAL			8
++#define BRCMF_E_STATUS_NEWSCAN			9
++#define BRCMF_E_STATUS_NEWASSOC			10
++#define BRCMF_E_STATUS_11HQUIET			11
++#define BRCMF_E_STATUS_SUPPRESS			12
++#define BRCMF_E_STATUS_NOCHANS			13
++#define BRCMF_E_STATUS_CS_ABORT			15
++#define BRCMF_E_STATUS_ERROR			16
++
++#define BRCMF_E_REASON_INITIAL_ASSOC		0
++#define BRCMF_E_REASON_LOW_RSSI			1
++#define BRCMF_E_REASON_DEAUTH			2
++#define BRCMF_E_REASON_DISASSOC			3
++#define BRCMF_E_REASON_BCNS_LOST		4
++#define BRCMF_E_REASON_MINTXRATE		9
++#define BRCMF_E_REASON_TXFAIL			10
++
++#define BRCMF_E_REASON_FAST_ROAM_FAILED		5
++#define BRCMF_E_REASON_DIRECTED_ROAM		6
++#define BRCMF_E_REASON_TSPEC_REJECTED		7
++#define BRCMF_E_REASON_BETTER_AP		8
++
++#define BRCMF_E_PRUNE_ENCR_MISMATCH		1
++#define BRCMF_E_PRUNE_BCAST_BSSID		2
++#define BRCMF_E_PRUNE_MAC_DENY			3
++#define BRCMF_E_PRUNE_MAC_NA			4
++#define BRCMF_E_PRUNE_REG_PASSV			5
++#define BRCMF_E_PRUNE_SPCT_MGMT			6
++#define BRCMF_E_PRUNE_RADAR			7
++#define BRCMF_E_RSN_MISMATCH			8
++#define BRCMF_E_PRUNE_NO_COMMON_RATES		9
++#define BRCMF_E_PRUNE_BASIC_RATES		10
++#define BRCMF_E_PRUNE_CIPHER_NA			12
++#define BRCMF_E_PRUNE_KNOWN_STA			13
++#define BRCMF_E_PRUNE_WDS_PEER			15
++#define BRCMF_E_PRUNE_QBSS_LOAD			16
++#define BRCMF_E_PRUNE_HOME_AP			17
++
++#define BRCMF_E_SUP_OTHER			0
++#define BRCMF_E_SUP_DECRYPT_KEY_DATA		1
++#define BRCMF_E_SUP_BAD_UCAST_WEP128		2
++#define BRCMF_E_SUP_BAD_UCAST_WEP40		3
++#define BRCMF_E_SUP_UNSUP_KEY_LEN		4
++#define BRCMF_E_SUP_PW_KEY_CIPHER		5
++#define BRCMF_E_SUP_MSG3_TOO_MANY_IE		6
++#define BRCMF_E_SUP_MSG3_IE_MISMATCH		7
++#define BRCMF_E_SUP_NO_INSTALL_FLAG		8
++#define BRCMF_E_SUP_MSG3_NO_GTK			9
++#define BRCMF_E_SUP_GRP_KEY_CIPHER		10
++#define BRCMF_E_SUP_GRP_MSG1_NO_GTK		11
++#define BRCMF_E_SUP_GTK_DECRYPT_FAIL		12
++#define BRCMF_E_SUP_SEND_FAIL			13
++#define BRCMF_E_SUP_DEAUTH			14
++
++#define BRCMF_E_IF_ADD				1
++#define BRCMF_E_IF_DEL				2
++#define BRCMF_E_IF_CHANGE			3
++
++#define BRCMF_E_IF_ROLE_STA			0
++#define BRCMF_E_IF_ROLE_AP			1
++#define BRCMF_E_IF_ROLE_WDS			2
++
++#define BRCMF_E_LINK_BCN_LOSS			1
++#define BRCMF_E_LINK_DISASSOC			2
++#define BRCMF_E_LINK_ASSOC_REC			3
++#define BRCMF_E_LINK_BSSCFG_DIS			4
++
++/* Pattern matching filter. Specifies an offset within received packets to
++ * start matching, the pattern to match, the size of the pattern, and a bitmask
++ * that indicates which bits within the pattern should be matched.
++ */
++struct brcmf_pkt_filter_pattern_le {
++	/*
++	 * Offset within received packet to start pattern matching.
++	 * Offset '0' is the first byte of the ethernet header.
++	 */
++	__le32 offset;
++	/* Size of the pattern.  Bitmask must be the same size.*/
++	__le32 size_bytes;
++	/*
++	 * Variable length mask and pattern data. mask starts at offset 0.
++	 * Pattern immediately follows mask.
++	 */
++	u8 mask_and_pattern[1];
++};
++
++/* IOVAR "pkt_filter_add" parameter. Used to install packet filters. */
++struct brcmf_pkt_filter_le {
++	__le32 id;		/* Unique filter id, specified by app. */
++	__le32 type;		/* Filter type (WL_PKT_FILTER_TYPE_xxx). */
++	__le32 negate_match;	/* Negate the result of filter matches */
++	union {			/* Filter definitions */
++		struct brcmf_pkt_filter_pattern_le pattern; /* Filter pattern */
++	} u;
++};
++
++/* IOVAR "pkt_filter_enable" parameter. */
++struct brcmf_pkt_filter_enable_le {
++	__le32 id;		/* Unique filter id */
++	__le32 enable;		/* Enable/disable bool */
++};
++
++/* BSS info structure
++ * Applications MUST CHECK ie_offset field and length field to access IEs and
++ * next bss_info structure in a vector (in struct brcmf_scan_results)
++ */
++struct brcmf_bss_info_le {
++	__le32 version;		/* version field */
++	__le32 length;		/* byte length of data in this record,
++				 * starting at version and including IEs
++				 */
++	u8 BSSID[ETH_ALEN];
++	__le16 beacon_period;	/* units are Kusec */
++	__le16 capability;	/* Capability information */
++	u8 SSID_len;
++	u8 SSID[32];
++	struct {
++		__le32 count;   /* # rates in this set */
++		u8 rates[16]; /* rates in 500kbps units w/hi bit set if basic */
++	} rateset;		/* supported rates */
++	__le16 chanspec;	/* chanspec for bss */
++	__le16 atim_window;	/* units are Kusec */
++	u8 dtim_period;	/* DTIM period */
++	__le16 RSSI;		/* receive signal strength (in dBm) */
++	s8 phy_noise;		/* noise (in dBm) */
++
++	u8 n_cap;		/* BSS is 802.11N Capable */
++	/* 802.11N BSS Capabilities (based on HT_CAP_*): */
++	__le32 nbss_cap;
++	u8 ctl_ch;		/* 802.11N BSS control channel number */
++	__le32 reserved32[1];	/* Reserved for expansion of BSS properties */
++	u8 flags;		/* flags */
++	u8 reserved[3];	/* Reserved for expansion of BSS properties */
++	u8 basic_mcs[MCSSET_LEN];	/* 802.11N BSS required MCS set */
++
++	__le16 ie_offset;	/* offset at which IEs start, from beginning */
++	__le32 ie_length;	/* byte length of Information Elements */
++	__le16 SNR;		/* average SNR of during frame reception */
++	/* Add new fields here */
++	/* variable length Information Elements */
++};
++
++struct brcm_rateset_le {
++	/* # rates in this set */
++	__le32 count;
++	/* rates in 500kbps units w/hi bit set if basic */
++	u8 rates[WL_NUMRATES];
++};
++
++struct brcmf_ssid {
++	u32 SSID_len;
++	unsigned char SSID[32];
++};
++
++struct brcmf_ssid_le {
++	__le32 SSID_len;
++	unsigned char SSID[32];
++};
++
++struct brcmf_scan_params_le {
++	struct brcmf_ssid_le ssid_le;	/* default: {0, ""} */
++	u8 bssid[ETH_ALEN];	/* default: bcast */
++	s8 bss_type;		/* default: any,
++				 * DOT11_BSSTYPE_ANY/INFRASTRUCTURE/INDEPENDENT
++				 */
++	u8 scan_type;	/* flags, 0 use default */
++	__le32 nprobes;	  /* -1 use default, number of probes per channel */
++	__le32 active_time;	/* -1 use default, dwell time per channel for
++				 * active scanning
++				 */
++	__le32 passive_time;	/* -1 use default, dwell time per channel
++				 * for passive scanning
++				 */
++	__le32 home_time;	/* -1 use default, dwell time for the
++				 * home channel between channel scans
++				 */
++	__le32 channel_num;	/* count of channels and ssids that follow
++				 *
++				 * low half is count of channels in
++				 * channel_list, 0 means default (use all
++				 * available channels)
++				 *
++				 * high half is entries in struct brcmf_ssid
++				 * array that follows channel_list, aligned for
++				 * s32 (4 bytes) meaning an odd channel count
++				 * implies a 2-byte pad between end of
++				 * channel_list and first ssid
++				 *
++				 * if ssid count is zero, single ssid in the
++				 * fixed parameter portion is assumed, otherwise
++				 * ssid in the fixed portion is ignored
++				 */
++	__le16 channel_list[1];	/* list of chanspecs */
++};
++
++/* incremental scan struct */
++struct brcmf_iscan_params_le {
++	__le32 version;
++	__le16 action;
++	__le16 scan_duration;
++	struct brcmf_scan_params_le params_le;
++};
++
++struct brcmf_scan_results {
++	u32 buflen;
++	u32 version;
++	u32 count;
++	struct brcmf_bss_info_le bss_info_le[];
++};
++
++struct brcmf_scan_results_le {
++	__le32 buflen;
++	__le32 version;
++	__le32 count;
++};
++
++/* used for association with a specific BSSID and chanspec list */
++struct brcmf_assoc_params_le {
++	/* 00:00:00:00:00:00: broadcast scan */
++	u8 bssid[ETH_ALEN];
++	/* 0: all available channels, otherwise count of chanspecs in
++	 * chanspec_list */
++	__le32 chanspec_num;
++	/* list of chanspecs */
++	__le16 chanspec_list[1];
++};
++
++/* used for join with or without a specific bssid and channel list */
++struct brcmf_join_params {
++	struct brcmf_ssid_le ssid_le;
++	struct brcmf_assoc_params_le params_le;
++};
++
++/* incremental scan results struct */
++struct brcmf_iscan_results {
++	union {
++		u32 status;
++		__le32 status_le;
++	};
++	union {
++		struct brcmf_scan_results results;
++		struct brcmf_scan_results_le results_le;
++	};
++};
++
++/* size of brcmf_iscan_results not including variable length array */
++#define BRCMF_ISCAN_RESULTS_FIXED_SIZE \
++	(sizeof(struct brcmf_scan_results) + \
++	 offsetof(struct brcmf_iscan_results, results))
++
++struct brcmf_wsec_key {
++	u32 index;		/* key index */
++	u32 len;		/* key length */
++	u8 data[WLAN_MAX_KEY_LEN];	/* key data */
++	u32 pad_1[18];
++	u32 algo;	/* CRYPTO_ALGO_AES_CCM, CRYPTO_ALGO_WEP128, etc */
++	u32 flags;	/* misc flags */
++	u32 pad_2[3];
++	u32 iv_initialized;	/* has IV been initialized already? */
++	u32 pad_3;
++	/* Rx IV */
++	struct {
++		u32 hi;	/* upper 32 bits of IV */
++		u16 lo;	/* lower 16 bits of IV */
++	} rxiv;
++	u32 pad_4[2];
++	u8 ea[ETH_ALEN];	/* per station */
++};
++
++/*
++ * dongle requires same struct as above but with fields in little endian order
++ */
++struct brcmf_wsec_key_le {
++	__le32 index;		/* key index */
++	__le32 len;		/* key length */
++	u8 data[WLAN_MAX_KEY_LEN];	/* key data */
++	__le32 pad_1[18];
++	__le32 algo;	/* CRYPTO_ALGO_AES_CCM, CRYPTO_ALGO_WEP128, etc */
++	__le32 flags;	/* misc flags */
++	__le32 pad_2[3];
++	__le32 iv_initialized;	/* has IV been initialized already? */
++	__le32 pad_3;
++	/* Rx IV */
++	struct {
++		__le32 hi;	/* upper 32 bits of IV */
++		__le16 lo;	/* lower 16 bits of IV */
++	} rxiv;
++	__le32 pad_4[2];
++	u8 ea[ETH_ALEN];	/* per station */
++};
++
++/* Used to get specific STA parameters */
++struct brcmf_scb_val_le {
++	__le32 val;
++	u8 ea[ETH_ALEN];
++};
++
++/* channel encoding */
++struct brcmf_channel_info_le {
++	__le32 hw_channel;
++	__le32 target_channel;
++	__le32 scan_channel;
++};
++
++/* Bus independent dongle command */
++struct brcmf_dcmd {
++	uint cmd;		/* common dongle cmd definition */
++	void *buf;		/* pointer to user buffer */
++	uint len;		/* length of user buffer */
++	u8 set;			/* get or set request (optional) */
++	uint used;		/* bytes read or written (optional) */
++	uint needed;		/* bytes needed (optional) */
++};
++
++/* Forward decls for struct brcmf_pub (see below) */
++struct brcmf_proto;	/* device communication protocol info */
++struct brcmf_cfg80211_dev; /* cfg80211 device info */
++
++/* Common structure for module and instance linkage */
++struct brcmf_pub {
++	/* Linkage ponters */
++	struct brcmf_bus *bus_if;
++	struct brcmf_proto *prot;
++	struct brcmf_cfg80211_dev *config;
++	struct device *dev;		/* fullmac dongle device pointer */
++
++	/* Internal brcmf items */
++	uint hdrlen;		/* Total BRCMF header length (proto + bus) */
++	uint rxsz;		/* Rx buffer size bus module should use */
++	u8 wme_dp;		/* wme discard priority */
++
++	/* Dongle media info */
++	bool iswl;		/* Dongle-resident driver is wl */
++	unsigned long drv_version;	/* Version of dongle-resident driver */
++	u8 mac[ETH_ALEN];		/* MAC address obtained from dongle */
++
++	/* Additional stats for the bus level */
++
++	/* Multicast data packets sent to dongle */
++	unsigned long tx_multicast;
++	/* Packets flushed due to unscheduled sendup thread */
++	unsigned long rx_flushed;
++	/* Number of times dpc scheduled by watchdog timer */
++	unsigned long wd_dpc_sched;
++
++	/* Number of flow control pkts recvd */
++	unsigned long fc_packets;
++
++	/* Last error return */
++	int bcmerror;
++
++	/* Last error from dongle */
++	int dongle_error;
++
++	/* Suspend disable flag  flag */
++	int suspend_disable_flag;	/* "1" to disable all extra powersaving
++					 during suspend */
++	int in_suspend;		/* flag set to 1 when early suspend called */
++	int dtim_skip;		/* dtim skip , default 0 means wake each dtim */
++
++	/* Pkt filter defination */
++	char *pktfilter[100];
++	int pktfilter_count;
++
++	u8 country_code[BRCM_CNTRY_BUF_SZ];
++	char eventmask[BRCMF_EVENTING_MASK_LEN];
++
++	struct brcmf_if *iflist[BRCMF_MAX_IFS];
++
++	struct mutex proto_block;
++
++	struct work_struct setmacaddr_work;
++	struct work_struct multicast_work;
++	u8 macvalue[ETH_ALEN];
++	atomic_t pend_8021x_cnt;
++};
++
++struct brcmf_if_event {
++	u8 ifidx;
++	u8 action;
++	u8 flags;
++	u8 bssidx;
++};
++
++struct bcmevent_name {
++	uint event;
++	const char *name;
++};
++
++extern const struct bcmevent_name bcmevent_names[];
++
++extern uint brcmf_c_mkiovar(char *name, char *data, uint datalen,
++			  char *buf, uint len);
++
++extern int brcmf_netdev_wait_pend8021x(struct net_device *ndev);
++
++extern s32 brcmf_exec_dcmd(struct net_device *dev, u32 cmd, void *arg, u32 len);
++
++/* Return pointer to interface name */
++extern char *brcmf_ifname(struct brcmf_pub *drvr, int idx);
++
++/* Query dongle */
++extern int brcmf_proto_cdc_query_dcmd(struct brcmf_pub *drvr, int ifidx,
++				       uint cmd, void *buf, uint len);
++
++#ifdef DEBUG
++extern int brcmf_write_to_file(struct brcmf_pub *drvr, const u8 *buf, int size);
++#endif				/* DEBUG */
++
++extern int brcmf_ifname2idx(struct brcmf_pub *drvr, char *name);
++extern int brcmf_c_host_event(struct brcmf_pub *drvr, int *idx,
++			      void *pktdata, struct brcmf_event_msg *,
++			      void **data_ptr);
++
++extern void brcmf_del_if(struct brcmf_pub *drvr, int ifidx);
++
++/* Send packet to dongle via data channel */
++extern int brcmf_sendpkt(struct brcmf_pub *drvr, int ifidx,\
++			 struct sk_buff *pkt);
++
++extern void brcmf_c_pktfilter_offload_set(struct brcmf_pub *drvr, char *arg);
++extern void brcmf_c_pktfilter_offload_enable(struct brcmf_pub *drvr, char *arg,
++					     int enable, int master_mode);
++
++#define	BRCMF_DCMD_SMLEN	256	/* "small" cmd buffer required */
++#define BRCMF_DCMD_MEDLEN	1536	/* "med" cmd buffer required */
++#define	BRCMF_DCMD_MAXLEN	8192	/* max length cmd buffer required */
++
++#endif				/* _BRCMF_H_ */
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
+new file mode 100644
+index 0000000..3669164
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
+@@ -0,0 +1,118 @@
++/*
++ * Copyright (c) 2010 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#ifndef _BRCMF_BUS_H_
++#define _BRCMF_BUS_H_
++
++/* The level of bus communication with the dongle */
++enum brcmf_bus_state {
++	BRCMF_BUS_DOWN,		/* Not ready for frame transfers */
++	BRCMF_BUS_LOAD,		/* Download access only (CPU reset) */
++	BRCMF_BUS_DATA		/* Ready for frame transfers */
++};
++
++struct dngl_stats {
++	unsigned long rx_packets;	/* total packets received */
++	unsigned long tx_packets;	/* total packets transmitted */
++	unsigned long rx_bytes;	/* total bytes received */
++	unsigned long tx_bytes;	/* total bytes transmitted */
++	unsigned long rx_errors;	/* bad packets received */
++	unsigned long tx_errors;	/* packet transmit problems */
++	unsigned long rx_dropped;	/* packets dropped by dongle */
++	unsigned long tx_dropped;	/* packets dropped by dongle */
++	unsigned long multicast;	/* multicast packets received */
++};
++
++/* interface structure between common and bus layer */
++struct brcmf_bus {
++	u8 type;		/* bus type */
++	union {
++		struct brcmf_sdio_dev *sdio;
++		struct brcmf_usbdev *usb;
++	} bus_priv;
++	struct brcmf_pub *drvr;	/* pointer to driver pub structure brcmf_pub */
++	enum brcmf_bus_state state;
++	uint maxctl;		/* Max size rxctl request from proto to bus */
++	bool drvr_up;		/* Status flag of driver up/down */
++	unsigned long tx_realloc;	/* Tx packets realloced for headroom */
++	struct dngl_stats dstats;	/* Stats for dongle-based data */
++	u8 align;		/* bus alignment requirement */
++
++	/* interface functions pointers */
++	/* Stop bus module: clear pending frames, disable data flow */
++	void (*brcmf_bus_stop)(struct device *);
++	/* Initialize bus module: prepare for communication w/dongle */
++	int (*brcmf_bus_init)(struct device *);
++	/* Send a data frame to the dongle.  Callee disposes of txp. */
++	int (*brcmf_bus_txdata)(struct device *, struct sk_buff *);
++	/* Send/receive a control message to/from the dongle.
++	 * Expects caller to enforce a single outstanding transaction.
++	 */
++	int (*brcmf_bus_txctl)(struct device *, unsigned char *, uint);
++	int (*brcmf_bus_rxctl)(struct device *, unsigned char *, uint);
++};
++
++/*
++ * interface functions from common layer
++ */
++
++/* Remove any protocol-specific data header. */
++extern int brcmf_proto_hdrpull(struct device *dev, int *ifidx,
++			       struct sk_buff *rxp);
++
++extern bool brcmf_c_prec_enq(struct device *dev, struct pktq *q,
++			 struct sk_buff *pkt, int prec);
++
++/* Receive frame for delivery to OS.  Callee disposes of rxp. */
++extern void brcmf_rx_frame(struct device *dev, int ifidx,
++			   struct sk_buff_head *rxlist);
++static inline void brcmf_rx_packet(struct device *dev, int ifidx,
++				   struct sk_buff *pkt)
++{
++	struct sk_buff_head q;
++
++	skb_queue_head_init(&q);
++	skb_queue_tail(&q, pkt);
++	brcmf_rx_frame(dev, ifidx, &q);
++}
++
++/* Indication from bus module regarding presence/insertion of dongle. */
++extern int brcmf_attach(uint bus_hdrlen, struct device *dev);
++/* Indication from bus module regarding removal/absence of dongle */
++extern void brcmf_detach(struct device *dev);
++
++/* Indication from bus module to change flow-control state */
++extern void brcmf_txflowcontrol(struct device *dev, int ifidx, bool on);
++
++/* Notify tx completion */
++extern void brcmf_txcomplete(struct device *dev, struct sk_buff *txp,
++			     bool success);
++
++extern int brcmf_bus_start(struct device *dev);
++
++extern int brcmf_add_if(struct device *dev, int ifidx,
++			char *name, u8 *mac_addr);
++
++#ifdef CONFIG_BRCMFMAC_SDIO
++extern void brcmf_sdio_exit(void);
++extern void brcmf_sdio_init(void);
++#endif
++#ifdef CONFIG_BRCMFMAC_USB
++extern void brcmf_usb_exit(void);
++extern void brcmf_usb_init(void);
++#endif
++
++#endif				/* _BRCMF_BUS_H_ */
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c
+new file mode 100644
+index 0000000..ca28295
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c
+@@ -0,0 +1,495 @@
++/*
++ * Copyright (c) 2010 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++/*******************************************************************************
++ * Communicates with the dongle by using dcmd codes.
++ * For certain dcmd codes, the dongle interprets string data from the host.
++ ******************************************************************************/
++
++#undef pr_fmt
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/types.h>
++#include <linux/netdevice.h>
++#include <linux/printk.h>
++#include <linux/sched.h>
++#include <defs.h>
++
++#include <brcmu_utils.h>
++#include <brcmu_wifi.h>
++
++#include "dhd.h"
++#include "dhd_proto.h"
++#include "dhd_bus.h"
++#include "dhd_dbg.h"
++
++struct brcmf_proto_cdc_dcmd {
++	__le32 cmd;	/* dongle command value */
++	__le32 len;	/* lower 16: output buflen;
++			 * upper 16: input buflen (excludes header) */
++	__le32 flags;	/* flag defns given below */
++	__le32 status;	/* status code returned from the device */
++};
++
++/* Max valid buffer size that can be sent to the dongle */
++#define CDC_MAX_MSG_SIZE	(ETH_FRAME_LEN+ETH_FCS_LEN)
++
++/* CDC flag definitions */
++#define CDC_DCMD_ERROR		0x01	/* 1=cmd failed */
++#define CDC_DCMD_SET		0x02	/* 0=get, 1=set cmd */
++#define CDC_DCMD_IF_MASK	0xF000		/* I/F index */
++#define CDC_DCMD_IF_SHIFT	12
++#define CDC_DCMD_ID_MASK	0xFFFF0000	/* id an cmd pairing */
++#define CDC_DCMD_ID_SHIFT	16		/* ID Mask shift bits */
++#define CDC_DCMD_ID(flags)	\
++	(((flags) & CDC_DCMD_ID_MASK) >> CDC_DCMD_ID_SHIFT)
++
++/*
++ * BDC header - Broadcom specific extension of CDC.
++ * Used on data packets to convey priority across USB.
++ */
++#define	BDC_HEADER_LEN		4
++#define BDC_PROTO_VER		2	/* Protocol version */
++#define BDC_FLAG_VER_MASK	0xf0	/* Protocol version mask */
++#define BDC_FLAG_VER_SHIFT	4	/* Protocol version shift */
++#define BDC_FLAG_SUM_GOOD	0x04	/* Good RX checksums */
++#define BDC_FLAG_SUM_NEEDED	0x08	/* Dongle needs to do TX checksums */
++#define BDC_PRIORITY_MASK	0x7
++#define BDC_FLAG2_IF_MASK	0x0f	/* packet rx interface in APSTA */
++#define BDC_FLAG2_IF_SHIFT	0
++
++#define BDC_GET_IF_IDX(hdr) \
++	((int)((((hdr)->flags2) & BDC_FLAG2_IF_MASK) >> BDC_FLAG2_IF_SHIFT))
++#define BDC_SET_IF_IDX(hdr, idx) \
++	((hdr)->flags2 = (((hdr)->flags2 & ~BDC_FLAG2_IF_MASK) | \
++	((idx) << BDC_FLAG2_IF_SHIFT)))
++
++struct brcmf_proto_bdc_header {
++	u8 flags;
++	u8 priority;	/* 802.1d Priority, 4:7 flow control info for usb */
++	u8 flags2;
++	u8 data_offset;
++};
++
++
++#define RETRIES 2 /* # of retries to retrieve matching dcmd response */
++#define BUS_HEADER_LEN	(16+64)		/* Must be atleast SDPCM_RESERVE
++					 * (amount of header tha might be added)
++					 * plus any space that might be needed
++					 * for bus alignment padding.
++					 */
++#define ROUND_UP_MARGIN	2048	/* Biggest bus block size possible for
++				 * round off at the end of buffer
++				 * Currently is SDIO
++				 */
++
++struct brcmf_proto {
++	u16 reqid;
++	u8 pending;
++	u32 lastcmd;
++	u8 bus_header[BUS_HEADER_LEN];
++	struct brcmf_proto_cdc_dcmd msg;
++	unsigned char buf[BRCMF_DCMD_MAXLEN + ROUND_UP_MARGIN];
++};
++
++static int brcmf_proto_cdc_msg(struct brcmf_pub *drvr)
++{
++	struct brcmf_proto *prot = drvr->prot;
++	int len = le32_to_cpu(prot->msg.len) +
++			sizeof(struct brcmf_proto_cdc_dcmd);
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	/* NOTE : cdc->msg.len holds the desired length of the buffer to be
++	 *        returned. Only up to CDC_MAX_MSG_SIZE of this buffer area
++	 *        is actually sent to the dongle
++	 */
++	if (len > CDC_MAX_MSG_SIZE)
++		len = CDC_MAX_MSG_SIZE;
++
++	/* Send request */
++	return drvr->bus_if->brcmf_bus_txctl(drvr->dev,
++					     (unsigned char *)&prot->msg,
++					     len);
++}
++
++static int brcmf_proto_cdc_cmplt(struct brcmf_pub *drvr, u32 id, u32 len)
++{
++	int ret;
++	struct brcmf_proto *prot = drvr->prot;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	do {
++		ret = drvr->bus_if->brcmf_bus_rxctl(drvr->dev,
++				(unsigned char *)&prot->msg,
++				len + sizeof(struct brcmf_proto_cdc_dcmd));
++		if (ret < 0)
++			break;
++	} while (CDC_DCMD_ID(le32_to_cpu(prot->msg.flags)) != id);
++
++	return ret;
++}
++
++int
++brcmf_proto_cdc_query_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
++			       void *buf, uint len)
++{
++	struct brcmf_proto *prot = drvr->prot;
++	struct brcmf_proto_cdc_dcmd *msg = &prot->msg;
++	void *info;
++	int ret = 0, retries = 0;
++	u32 id, flags;
++
++	brcmf_dbg(TRACE, "Enter\n");
++	brcmf_dbg(CTL, "cmd %d len %d\n", cmd, len);
++
++	/* Respond "bcmerror" and "bcmerrorstr" with local cache */
++	if (cmd == BRCMF_C_GET_VAR && buf) {
++		if (!strcmp((char *)buf, "bcmerrorstr")) {
++			strncpy((char *)buf, "bcm_error",
++				BCME_STRLEN);
++			goto done;
++		} else if (!strcmp((char *)buf, "bcmerror")) {
++			*(int *)buf = drvr->dongle_error;
++			goto done;
++		}
++	}
++
++	memset(msg, 0, sizeof(struct brcmf_proto_cdc_dcmd));
++
++	msg->cmd = cpu_to_le32(cmd);
++	msg->len = cpu_to_le32(len);
++	flags = (++prot->reqid << CDC_DCMD_ID_SHIFT);
++	flags = (flags & ~CDC_DCMD_IF_MASK) |
++		(ifidx << CDC_DCMD_IF_SHIFT);
++	msg->flags = cpu_to_le32(flags);
++
++	if (buf)
++		memcpy(prot->buf, buf, len);
++
++	ret = brcmf_proto_cdc_msg(drvr);
++	if (ret < 0) {
++		brcmf_dbg(ERROR, "brcmf_proto_cdc_msg failed w/status %d\n",
++			  ret);
++		goto done;
++	}
++
++retry:
++	/* wait for interrupt and get first fragment */
++	ret = brcmf_proto_cdc_cmplt(drvr, prot->reqid, len);
++	if (ret < 0)
++		goto done;
++
++	flags = le32_to_cpu(msg->flags);
++	id = (flags & CDC_DCMD_ID_MASK) >> CDC_DCMD_ID_SHIFT;
++
++	if ((id < prot->reqid) && (++retries < RETRIES))
++		goto retry;
++	if (id != prot->reqid) {
++		brcmf_dbg(ERROR, "%s: unexpected request id %d (expected %d)\n",
++			  brcmf_ifname(drvr, ifidx), id, prot->reqid);
++		ret = -EINVAL;
++		goto done;
++	}
++
++	/* Check info buffer */
++	info = (void *)&msg[1];
++
++	/* Copy info buffer */
++	if (buf) {
++		if (ret < (int)len)
++			len = ret;
++		memcpy(buf, info, len);
++	}
++
++	/* Check the ERROR flag */
++	if (flags & CDC_DCMD_ERROR) {
++		ret = le32_to_cpu(msg->status);
++		/* Cache error from dongle */
++		drvr->dongle_error = ret;
++	}
++
++done:
++	return ret;
++}
++
++int brcmf_proto_cdc_set_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
++				 void *buf, uint len)
++{
++	struct brcmf_proto *prot = drvr->prot;
++	struct brcmf_proto_cdc_dcmd *msg = &prot->msg;
++	int ret = 0;
++	u32 flags, id;
++
++	brcmf_dbg(TRACE, "Enter\n");
++	brcmf_dbg(CTL, "cmd %d len %d\n", cmd, len);
++
++	memset(msg, 0, sizeof(struct brcmf_proto_cdc_dcmd));
++
++	msg->cmd = cpu_to_le32(cmd);
++	msg->len = cpu_to_le32(len);
++	flags = (++prot->reqid << CDC_DCMD_ID_SHIFT) | CDC_DCMD_SET;
++	flags = (flags & ~CDC_DCMD_IF_MASK) |
++		(ifidx << CDC_DCMD_IF_SHIFT);
++	msg->flags = cpu_to_le32(flags);
++
++	if (buf)
++		memcpy(prot->buf, buf, len);
++
++	ret = brcmf_proto_cdc_msg(drvr);
++	if (ret < 0)
++		goto done;
++
++	ret = brcmf_proto_cdc_cmplt(drvr, prot->reqid, len);
++	if (ret < 0)
++		goto done;
++
++	flags = le32_to_cpu(msg->flags);
++	id = (flags & CDC_DCMD_ID_MASK) >> CDC_DCMD_ID_SHIFT;
++
++	if (id != prot->reqid) {
++		brcmf_dbg(ERROR, "%s: unexpected request id %d (expected %d)\n",
++			  brcmf_ifname(drvr, ifidx), id, prot->reqid);
++		ret = -EINVAL;
++		goto done;
++	}
++
++	/* Check the ERROR flag */
++	if (flags & CDC_DCMD_ERROR) {
++		ret = le32_to_cpu(msg->status);
++		/* Cache error from dongle */
++		drvr->dongle_error = ret;
++	}
++
++done:
++	return ret;
++}
++
++int
++brcmf_proto_dcmd(struct brcmf_pub *drvr, int ifidx, struct brcmf_dcmd *dcmd,
++		  int len)
++{
++	struct brcmf_proto *prot = drvr->prot;
++	int ret = -1;
++
++	if (drvr->bus_if->state == BRCMF_BUS_DOWN) {
++		brcmf_dbg(ERROR, "bus is down. we have nothing to do.\n");
++		return ret;
++	}
++	mutex_lock(&drvr->proto_block);
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	if (len > BRCMF_DCMD_MAXLEN)
++		goto done;
++
++	if (prot->pending == true) {
++		brcmf_dbg(TRACE, "CDC packet is pending!!!! cmd=0x%x (%lu) lastcmd=0x%x (%lu)\n",
++			  dcmd->cmd, (unsigned long)dcmd->cmd, prot->lastcmd,
++			  (unsigned long)prot->lastcmd);
++		if (dcmd->cmd == BRCMF_C_SET_VAR ||
++		    dcmd->cmd == BRCMF_C_GET_VAR)
++			brcmf_dbg(TRACE, "iovar cmd=%s\n", (char *)dcmd->buf);
++
++		goto done;
++	}
++
++	prot->pending = true;
++	prot->lastcmd = dcmd->cmd;
++	if (dcmd->set)
++		ret = brcmf_proto_cdc_set_dcmd(drvr, ifidx, dcmd->cmd,
++						   dcmd->buf, len);
++	else {
++		ret = brcmf_proto_cdc_query_dcmd(drvr, ifidx, dcmd->cmd,
++						     dcmd->buf, len);
++		if (ret > 0)
++			dcmd->used = ret -
++					sizeof(struct brcmf_proto_cdc_dcmd);
++	}
++
++	if (ret >= 0)
++		ret = 0;
++	else {
++		struct brcmf_proto_cdc_dcmd *msg = &prot->msg;
++		/* len == needed when set/query fails from dongle */
++		dcmd->needed = le32_to_cpu(msg->len);
++	}
++
++	/* Intercept the wme_dp dongle cmd here */
++	if (!ret && dcmd->cmd == BRCMF_C_SET_VAR &&
++	    !strcmp(dcmd->buf, "wme_dp")) {
++		int slen;
++		__le32 val = 0;
++
++		slen = strlen("wme_dp") + 1;
++		if (len >= (int)(slen + sizeof(int)))
++			memcpy(&val, (char *)dcmd->buf + slen, sizeof(int));
++		drvr->wme_dp = (u8) le32_to_cpu(val);
++	}
++
++	prot->pending = false;
++
++done:
++	mutex_unlock(&drvr->proto_block);
++
++	return ret;
++}
++
++static bool pkt_sum_needed(struct sk_buff *skb)
++{
++	return skb->ip_summed == CHECKSUM_PARTIAL;
++}
++
++static void pkt_set_sum_good(struct sk_buff *skb, bool x)
++{
++	skb->ip_summed = (x ? CHECKSUM_UNNECESSARY : CHECKSUM_NONE);
++}
++
++void brcmf_proto_hdrpush(struct brcmf_pub *drvr, int ifidx,
++			 struct sk_buff *pktbuf)
++{
++	struct brcmf_proto_bdc_header *h;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	/* Push BDC header used to convey priority for buses that don't */
++
++	skb_push(pktbuf, BDC_HEADER_LEN);
++
++	h = (struct brcmf_proto_bdc_header *)(pktbuf->data);
++
++	h->flags = (BDC_PROTO_VER << BDC_FLAG_VER_SHIFT);
++	if (pkt_sum_needed(pktbuf))
++		h->flags |= BDC_FLAG_SUM_NEEDED;
++
++	h->priority = (pktbuf->priority & BDC_PRIORITY_MASK);
++	h->flags2 = 0;
++	h->data_offset = 0;
++	BDC_SET_IF_IDX(h, ifidx);
++}
++
++int brcmf_proto_hdrpull(struct device *dev, int *ifidx,
++			struct sk_buff *pktbuf)
++{
++	struct brcmf_proto_bdc_header *h;
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_pub *drvr = bus_if->drvr;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	/* Pop BDC header used to convey priority for buses that don't */
++
++	if (pktbuf->len < BDC_HEADER_LEN) {
++		brcmf_dbg(ERROR, "rx data too short (%d < %d)\n",
++			  pktbuf->len, BDC_HEADER_LEN);
++		return -EBADE;
++	}
++
++	h = (struct brcmf_proto_bdc_header *)(pktbuf->data);
++
++	*ifidx = BDC_GET_IF_IDX(h);
++	if (*ifidx >= BRCMF_MAX_IFS) {
++		brcmf_dbg(ERROR, "rx data ifnum out of range (%d)\n", *ifidx);
++		return -EBADE;
++	}
++
++	if (((h->flags & BDC_FLAG_VER_MASK) >> BDC_FLAG_VER_SHIFT) !=
++	    BDC_PROTO_VER) {
++		brcmf_dbg(ERROR, "%s: non-BDC packet received, flags 0x%x\n",
++			  brcmf_ifname(drvr, *ifidx), h->flags);
++		return -EBADE;
++	}
++
++	if (h->flags & BDC_FLAG_SUM_GOOD) {
++		brcmf_dbg(INFO, "%s: BDC packet received with good rx-csum, flags 0x%x\n",
++			  brcmf_ifname(drvr, *ifidx), h->flags);
++		pkt_set_sum_good(pktbuf, true);
++	}
++
++	pktbuf->priority = h->priority & BDC_PRIORITY_MASK;
++
++	skb_pull(pktbuf, BDC_HEADER_LEN);
++	skb_pull(pktbuf, h->data_offset << 2);
++
++	return 0;
++}
++
++int brcmf_proto_attach(struct brcmf_pub *drvr)
++{
++	struct brcmf_proto *cdc;
++
++	cdc = kzalloc(sizeof(struct brcmf_proto), GFP_ATOMIC);
++	if (!cdc)
++		goto fail;
++
++	/* ensure that the msg buf directly follows the cdc msg struct */
++	if ((unsigned long)(&cdc->msg + 1) != (unsigned long)cdc->buf) {
++		brcmf_dbg(ERROR, "struct brcmf_proto is not correctly defined\n");
++		goto fail;
++	}
++
++	drvr->prot = cdc;
++	drvr->hdrlen += BDC_HEADER_LEN;
++	drvr->bus_if->maxctl = BRCMF_DCMD_MAXLEN +
++			sizeof(struct brcmf_proto_cdc_dcmd) + ROUND_UP_MARGIN;
++	return 0;
++
++fail:
++	kfree(cdc);
++	return -ENOMEM;
++}
++
++/* ~NOTE~ What if another thread is waiting on the semaphore?  Holding it? */
++void brcmf_proto_detach(struct brcmf_pub *drvr)
++{
++	kfree(drvr->prot);
++	drvr->prot = NULL;
++}
++
++int brcmf_proto_init(struct brcmf_pub *drvr)
++{
++	int ret = 0;
++	char buf[128];
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	mutex_lock(&drvr->proto_block);
++
++	/* Get the device MAC address */
++	strcpy(buf, "cur_etheraddr");
++	ret = brcmf_proto_cdc_query_dcmd(drvr, 0, BRCMF_C_GET_VAR,
++					  buf, sizeof(buf));
++	if (ret < 0) {
++		mutex_unlock(&drvr->proto_block);
++		return ret;
++	}
++	memcpy(drvr->mac, buf, ETH_ALEN);
++
++	mutex_unlock(&drvr->proto_block);
++
++	ret = brcmf_c_preinit_dcmds(drvr);
++
++	/* Always assumes wl for now */
++	drvr->iswl = true;
++
++	return ret;
++}
++
++void brcmf_proto_stop(struct brcmf_pub *drvr)
++{
++	/* Nothing to do for CDC */
++}
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
+new file mode 100644
+index 0000000..2962900
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
+@@ -0,0 +1,882 @@
++/*
++ * Copyright (c) 2010 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#undef pr_fmt
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/kernel.h>
++#include <linux/printk.h>
++#include <linux/string.h>
++#include <linux/sched.h>
++#include <linux/netdevice.h>
++#include <asm/unaligned.h>
++#include <defs.h>
++#include <brcmu_wifi.h>
++#include <brcmu_utils.h>
++#include "dhd.h"
++#include "dhd_bus.h"
++#include "dhd_proto.h"
++#include "dhd_dbg.h"
++
++#define BRCM_OUI			"\x00\x10\x18"
++#define DOT11_OUI_LEN			3
++#define BCMILCP_BCM_SUBTYPE_EVENT	1
++#define PKTFILTER_BUF_SIZE		2048
++#define BRCMF_ARPOL_MODE		0xb	/* agent|snoop|peer_autoreply */
++
++#define MSGTRACE_VERSION	1
++
++#define BRCMF_PKT_FILTER_FIXED_LEN	offsetof(struct brcmf_pkt_filter_le, u)
++#define BRCMF_PKT_FILTER_PATTERN_FIXED_LEN	\
++	offsetof(struct brcmf_pkt_filter_pattern_le, mask_and_pattern)
++
++#ifdef DEBUG
++static const char brcmf_version[] =
++	"Dongle Host Driver, version " BRCMF_VERSION_STR "\nCompiled on "
++	__DATE__ " at " __TIME__;
++#else
++static const char brcmf_version[] =
++	"Dongle Host Driver, version " BRCMF_VERSION_STR;
++#endif
++
++/* Message trace header */
++struct msgtrace_hdr {
++	u8 version;
++	u8 spare;
++	__be16 len;		/* Len of the trace */
++	__be32 seqnum;		/* Sequence number of message. Useful
++				 * if the messsage has been lost
++				 * because of DMA error or a bus reset
++				 * (ex: SDIO Func2)
++				 */
++	__be32 discarded_bytes;	/* Number of discarded bytes because of
++				 trace overflow  */
++	__be32 discarded_printf;	/* Number of discarded printf
++				 because of trace overflow */
++} __packed;
++
++
++uint
++brcmf_c_mkiovar(char *name, char *data, uint datalen, char *buf, uint buflen)
++{
++	uint len;
++
++	len = strlen(name) + 1;
++
++	if ((len + datalen) > buflen)
++		return 0;
++
++	strncpy(buf, name, buflen);
++
++	/* append data onto the end of the name string */
++	memcpy(&buf[len], data, datalen);
++	len += datalen;
++
++	return len;
++}
++
++bool brcmf_c_prec_enq(struct device *dev, struct pktq *q,
++		      struct sk_buff *pkt, int prec)
++{
++	struct sk_buff *p;
++	int eprec = -1;		/* precedence to evict from */
++	bool discard_oldest;
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_pub *drvr = bus_if->drvr;
++
++	/* Fast case, precedence queue is not full and we are also not
++	 * exceeding total queue length
++	 */
++	if (!pktq_pfull(q, prec) && !pktq_full(q)) {
++		brcmu_pktq_penq(q, prec, pkt);
++		return true;
++	}
++
++	/* Determine precedence from which to evict packet, if any */
++	if (pktq_pfull(q, prec))
++		eprec = prec;
++	else if (pktq_full(q)) {
++		p = brcmu_pktq_peek_tail(q, &eprec);
++		if (eprec > prec)
++			return false;
++	}
++
++	/* Evict if needed */
++	if (eprec >= 0) {
++		/* Detect queueing to unconfigured precedence */
++		discard_oldest = ac_bitmap_tst(drvr->wme_dp, eprec);
++		if (eprec == prec && !discard_oldest)
++			return false;	/* refuse newer (incoming) packet */
++		/* Evict packet according to discard policy */
++		p = discard_oldest ? brcmu_pktq_pdeq(q, eprec) :
++			brcmu_pktq_pdeq_tail(q, eprec);
++		if (p == NULL)
++			brcmf_dbg(ERROR, "brcmu_pktq_penq() failed, oldest %d\n",
++				  discard_oldest);
++
++		brcmu_pkt_buf_free_skb(p);
++	}
++
++	/* Enqueue */
++	p = brcmu_pktq_penq(q, prec, pkt);
++	if (p == NULL)
++		brcmf_dbg(ERROR, "brcmu_pktq_penq() failed\n");
++
++	return p != NULL;
++}
++
++#ifdef DEBUG
++static void
++brcmf_c_show_host_event(struct brcmf_event_msg *event, void *event_data)
++{
++	uint i, status, reason;
++	bool group = false, flush_txq = false, link = false;
++	char *auth_str, *event_name;
++	unsigned char *buf;
++	char err_msg[256], eabuf[ETHER_ADDR_STR_LEN];
++	static struct {
++		uint event;
++		char *event_name;
++	} event_names[] = {
++		{
++		BRCMF_E_SET_SSID, "SET_SSID"}, {
++		BRCMF_E_JOIN, "JOIN"}, {
++		BRCMF_E_START, "START"}, {
++		BRCMF_E_AUTH, "AUTH"}, {
++		BRCMF_E_AUTH_IND, "AUTH_IND"}, {
++		BRCMF_E_DEAUTH, "DEAUTH"}, {
++		BRCMF_E_DEAUTH_IND, "DEAUTH_IND"}, {
++		BRCMF_E_ASSOC, "ASSOC"}, {
++		BRCMF_E_ASSOC_IND, "ASSOC_IND"}, {
++		BRCMF_E_REASSOC, "REASSOC"}, {
++		BRCMF_E_REASSOC_IND, "REASSOC_IND"}, {
++		BRCMF_E_DISASSOC, "DISASSOC"}, {
++		BRCMF_E_DISASSOC_IND, "DISASSOC_IND"}, {
++		BRCMF_E_QUIET_START, "START_QUIET"}, {
++		BRCMF_E_QUIET_END, "END_QUIET"}, {
++		BRCMF_E_BEACON_RX, "BEACON_RX"}, {
++		BRCMF_E_LINK, "LINK"}, {
++		BRCMF_E_MIC_ERROR, "MIC_ERROR"}, {
++		BRCMF_E_NDIS_LINK, "NDIS_LINK"}, {
++		BRCMF_E_ROAM, "ROAM"}, {
++		BRCMF_E_TXFAIL, "TXFAIL"}, {
++		BRCMF_E_PMKID_CACHE, "PMKID_CACHE"}, {
++		BRCMF_E_RETROGRADE_TSF, "RETROGRADE_TSF"}, {
++		BRCMF_E_PRUNE, "PRUNE"}, {
++		BRCMF_E_AUTOAUTH, "AUTOAUTH"}, {
++		BRCMF_E_EAPOL_MSG, "EAPOL_MSG"}, {
++		BRCMF_E_SCAN_COMPLETE, "SCAN_COMPLETE"}, {
++		BRCMF_E_ADDTS_IND, "ADDTS_IND"}, {
++		BRCMF_E_DELTS_IND, "DELTS_IND"}, {
++		BRCMF_E_BCNSENT_IND, "BCNSENT_IND"}, {
++		BRCMF_E_BCNRX_MSG, "BCNRX_MSG"}, {
++		BRCMF_E_BCNLOST_MSG, "BCNLOST_MSG"}, {
++		BRCMF_E_ROAM_PREP, "ROAM_PREP"}, {
++		BRCMF_E_PFN_NET_FOUND, "PNO_NET_FOUND"}, {
++		BRCMF_E_PFN_NET_LOST, "PNO_NET_LOST"}, {
++		BRCMF_E_RESET_COMPLETE, "RESET_COMPLETE"}, {
++		BRCMF_E_JOIN_START, "JOIN_START"}, {
++		BRCMF_E_ROAM_START, "ROAM_START"}, {
++		BRCMF_E_ASSOC_START, "ASSOC_START"}, {
++		BRCMF_E_IBSS_ASSOC, "IBSS_ASSOC"}, {
++		BRCMF_E_RADIO, "RADIO"}, {
++		BRCMF_E_PSM_WATCHDOG, "PSM_WATCHDOG"}, {
++		BRCMF_E_PROBREQ_MSG, "PROBREQ_MSG"}, {
++		BRCMF_E_SCAN_CONFIRM_IND, "SCAN_CONFIRM_IND"}, {
++		BRCMF_E_PSK_SUP, "PSK_SUP"}, {
++		BRCMF_E_COUNTRY_CODE_CHANGED, "COUNTRY_CODE_CHANGED"}, {
++		BRCMF_E_EXCEEDED_MEDIUM_TIME, "EXCEEDED_MEDIUM_TIME"}, {
++		BRCMF_E_ICV_ERROR, "ICV_ERROR"}, {
++		BRCMF_E_UNICAST_DECODE_ERROR, "UNICAST_DECODE_ERROR"}, {
++		BRCMF_E_MULTICAST_DECODE_ERROR, "MULTICAST_DECODE_ERROR"}, {
++		BRCMF_E_TRACE, "TRACE"}, {
++		BRCMF_E_ACTION_FRAME, "ACTION FRAME"}, {
++		BRCMF_E_ACTION_FRAME_COMPLETE, "ACTION FRAME TX COMPLETE"}, {
++		BRCMF_E_IF, "IF"}, {
++		BRCMF_E_RSSI, "RSSI"}, {
++		BRCMF_E_PFN_SCAN_COMPLETE, "SCAN_COMPLETE"}
++	};
++	uint event_type, flags, auth_type, datalen;
++	static u32 seqnum_prev;
++	struct msgtrace_hdr hdr;
++	u32 nblost;
++	char *s, *p;
++
++	event_type = be32_to_cpu(event->event_type);
++	flags = be16_to_cpu(event->flags);
++	status = be32_to_cpu(event->status);
++	reason = be32_to_cpu(event->reason);
++	auth_type = be32_to_cpu(event->auth_type);
++	datalen = be32_to_cpu(event->datalen);
++	/* debug dump of event messages */
++	sprintf(eabuf, "%pM", event->addr);
++
++	event_name = "UNKNOWN";
++	for (i = 0; i < ARRAY_SIZE(event_names); i++) {
++		if (event_names[i].event == event_type)
++			event_name = event_names[i].event_name;
++	}
++
++	brcmf_dbg(EVENT, "EVENT: %s, event ID = %d\n", event_name, event_type);
++	brcmf_dbg(EVENT, "flags 0x%04x, status %d, reason %d, auth_type %d MAC %s\n",
++		  flags, status, reason, auth_type, eabuf);
++
++	if (flags & BRCMF_EVENT_MSG_LINK)
++		link = true;
++	if (flags & BRCMF_EVENT_MSG_GROUP)
++		group = true;
++	if (flags & BRCMF_EVENT_MSG_FLUSHTXQ)
++		flush_txq = true;
++
++	switch (event_type) {
++	case BRCMF_E_START:
++	case BRCMF_E_DEAUTH:
++	case BRCMF_E_DISASSOC:
++		brcmf_dbg(EVENT, "MACEVENT: %s, MAC %s\n", event_name, eabuf);
++		break;
++
++	case BRCMF_E_ASSOC_IND:
++	case BRCMF_E_REASSOC_IND:
++		brcmf_dbg(EVENT, "MACEVENT: %s, MAC %s\n", event_name, eabuf);
++		break;
++
++	case BRCMF_E_ASSOC:
++	case BRCMF_E_REASSOC:
++		if (status == BRCMF_E_STATUS_SUCCESS)
++			brcmf_dbg(EVENT, "MACEVENT: %s, MAC %s, SUCCESS\n",
++				  event_name, eabuf);
++		else if (status == BRCMF_E_STATUS_TIMEOUT)
++			brcmf_dbg(EVENT, "MACEVENT: %s, MAC %s, TIMEOUT\n",
++				  event_name, eabuf);
++		else if (status == BRCMF_E_STATUS_FAIL)
++			brcmf_dbg(EVENT, "MACEVENT: %s, MAC %s, FAILURE, reason %d\n",
++				  event_name, eabuf, (int)reason);
++		else
++			brcmf_dbg(EVENT, "MACEVENT: %s, MAC %s, unexpected status %d\n",
++				  event_name, eabuf, (int)status);
++		break;
++
++	case BRCMF_E_DEAUTH_IND:
++	case BRCMF_E_DISASSOC_IND:
++		brcmf_dbg(EVENT, "MACEVENT: %s, MAC %s, reason %d\n",
++			  event_name, eabuf, (int)reason);
++		break;
++
++	case BRCMF_E_AUTH:
++	case BRCMF_E_AUTH_IND:
++		if (auth_type == WLAN_AUTH_OPEN)
++			auth_str = "Open System";
++		else if (auth_type == WLAN_AUTH_SHARED_KEY)
++			auth_str = "Shared Key";
++		else {
++			sprintf(err_msg, "AUTH unknown: %d", (int)auth_type);
++			auth_str = err_msg;
++		}
++		if (event_type == BRCMF_E_AUTH_IND)
++			brcmf_dbg(EVENT, "MACEVENT: %s, MAC %s, %s\n",
++				  event_name, eabuf, auth_str);
++		else if (status == BRCMF_E_STATUS_SUCCESS)
++			brcmf_dbg(EVENT, "MACEVENT: %s, MAC %s, %s, SUCCESS\n",
++				  event_name, eabuf, auth_str);
++		else if (status == BRCMF_E_STATUS_TIMEOUT)
++			brcmf_dbg(EVENT, "MACEVENT: %s, MAC %s, %s, TIMEOUT\n",
++				  event_name, eabuf, auth_str);
++		else if (status == BRCMF_E_STATUS_FAIL) {
++			brcmf_dbg(EVENT, "MACEVENT: %s, MAC %s, %s, FAILURE, reason %d\n",
++				  event_name, eabuf, auth_str, (int)reason);
++		}
++
++		break;
++
++	case BRCMF_E_JOIN:
++	case BRCMF_E_ROAM:
++	case BRCMF_E_SET_SSID:
++		if (status == BRCMF_E_STATUS_SUCCESS)
++			brcmf_dbg(EVENT, "MACEVENT: %s, MAC %s\n",
++				  event_name, eabuf);
++		else if (status == BRCMF_E_STATUS_FAIL)
++			brcmf_dbg(EVENT, "MACEVENT: %s, failed\n", event_name);
++		else if (status == BRCMF_E_STATUS_NO_NETWORKS)
++			brcmf_dbg(EVENT, "MACEVENT: %s, no networks found\n",
++				  event_name);
++		else
++			brcmf_dbg(EVENT, "MACEVENT: %s, unexpected status %d\n",
++				  event_name, (int)status);
++		break;
++
++	case BRCMF_E_BEACON_RX:
++		if (status == BRCMF_E_STATUS_SUCCESS)
++			brcmf_dbg(EVENT, "MACEVENT: %s, SUCCESS\n", event_name);
++		else if (status == BRCMF_E_STATUS_FAIL)
++			brcmf_dbg(EVENT, "MACEVENT: %s, FAIL\n", event_name);
++		else
++			brcmf_dbg(EVENT, "MACEVENT: %s, status %d\n",
++				  event_name, status);
++		break;
++
++	case BRCMF_E_LINK:
++		brcmf_dbg(EVENT, "MACEVENT: %s %s\n",
++			  event_name, link ? "UP" : "DOWN");
++		break;
++
++	case BRCMF_E_MIC_ERROR:
++		brcmf_dbg(EVENT, "MACEVENT: %s, MAC %s, Group %d, Flush %d\n",
++			  event_name, eabuf, group, flush_txq);
++		break;
++
++	case BRCMF_E_ICV_ERROR:
++	case BRCMF_E_UNICAST_DECODE_ERROR:
++	case BRCMF_E_MULTICAST_DECODE_ERROR:
++		brcmf_dbg(EVENT, "MACEVENT: %s, MAC %s\n", event_name, eabuf);
++		break;
++
++	case BRCMF_E_TXFAIL:
++		brcmf_dbg(EVENT, "MACEVENT: %s, RA %s\n", event_name, eabuf);
++		break;
++
++	case BRCMF_E_SCAN_COMPLETE:
++	case BRCMF_E_PMKID_CACHE:
++		brcmf_dbg(EVENT, "MACEVENT: %s\n", event_name);
++		break;
++
++	case BRCMF_E_PFN_NET_FOUND:
++	case BRCMF_E_PFN_NET_LOST:
++	case BRCMF_E_PFN_SCAN_COMPLETE:
++		brcmf_dbg(EVENT, "PNOEVENT: %s\n", event_name);
++		break;
++
++	case BRCMF_E_PSK_SUP:
++	case BRCMF_E_PRUNE:
++		brcmf_dbg(EVENT, "MACEVENT: %s, status %d, reason %d\n",
++			  event_name, (int)status, (int)reason);
++		break;
++
++	case BRCMF_E_TRACE:
++		buf = (unsigned char *) event_data;
++		memcpy(&hdr, buf, sizeof(struct msgtrace_hdr));
++
++		if (hdr.version != MSGTRACE_VERSION) {
++			brcmf_dbg(ERROR,
++				  "MACEVENT: %s [unsupported version --> brcmf"
++				  " version:%d dongle version:%d]\n",
++				  event_name, MSGTRACE_VERSION, hdr.version);
++			/* Reset datalen to avoid display below */
++			datalen = 0;
++			break;
++		}
++
++		/* There are 2 bytes available at the end of data */
++		*(buf + sizeof(struct msgtrace_hdr)
++			 + be16_to_cpu(hdr.len)) = '\0';
++
++		if (be32_to_cpu(hdr.discarded_bytes)
++		    || be32_to_cpu(hdr.discarded_printf))
++			brcmf_dbg(ERROR,
++				  "WLC_E_TRACE: [Discarded traces in dongle -->"
++				  " discarded_bytes %d discarded_printf %d]\n",
++				  be32_to_cpu(hdr.discarded_bytes),
++				  be32_to_cpu(hdr.discarded_printf));
++
++		nblost = be32_to_cpu(hdr.seqnum) - seqnum_prev - 1;
++		if (nblost > 0)
++			brcmf_dbg(ERROR, "WLC_E_TRACE: [Event lost --> seqnum "
++				  " %d nblost %d\n", be32_to_cpu(hdr.seqnum),
++				  nblost);
++		seqnum_prev = be32_to_cpu(hdr.seqnum);
++
++		/* Display the trace buffer. Advance from \n to \n to
++		 * avoid display big
++		 * printf (issue with Linux printk )
++		 */
++		p = (char *)&buf[sizeof(struct msgtrace_hdr)];
++		while ((s = strstr(p, "\n")) != NULL) {
++			*s = '\0';
++			pr_debug("%s\n", p);
++			p = s + 1;
++		}
++		pr_debug("%s\n", p);
++
++		/* Reset datalen to avoid display below */
++		datalen = 0;
++		break;
++
++	case BRCMF_E_RSSI:
++		brcmf_dbg(EVENT, "MACEVENT: %s %d\n",
++			  event_name, be32_to_cpu(*((__be32 *)event_data)));
++		break;
++
++	default:
++		brcmf_dbg(EVENT,
++			  "MACEVENT: %s %d, MAC %s, status %d, reason %d, "
++			  "auth %d\n", event_name, event_type, eabuf,
++			  (int)status, (int)reason, (int)auth_type);
++		break;
++	}
++
++	/* show any appended data */
++	if (datalen) {
++		buf = (unsigned char *) event_data;
++		brcmf_dbg(EVENT, " data (%d) : ", datalen);
++		for (i = 0; i < datalen; i++)
++			brcmf_dbg(EVENT, " 0x%02x ", *buf++);
++		brcmf_dbg(EVENT, "\n");
++	}
++}
++#endif				/* DEBUG */
++
++int
++brcmf_c_host_event(struct brcmf_pub *drvr, int *ifidx, void *pktdata,
++		   struct brcmf_event_msg *event, void **data_ptr)
++{
++	/* check whether packet is a BRCM event pkt */
++	struct brcmf_event *pvt_data = (struct brcmf_event *) pktdata;
++	struct brcmf_if_event *ifevent;
++	char *event_data;
++	u32 type, status;
++	u16 flags;
++	int evlen;
++
++	if (memcmp(BRCM_OUI, &pvt_data->hdr.oui[0], DOT11_OUI_LEN)) {
++		brcmf_dbg(ERROR, "mismatched OUI, bailing\n");
++		return -EBADE;
++	}
++
++	/* BRCM event pkt may be unaligned - use xxx_ua to load user_subtype. */
++	if (get_unaligned_be16(&pvt_data->hdr.usr_subtype) !=
++	    BCMILCP_BCM_SUBTYPE_EVENT) {
++		brcmf_dbg(ERROR, "mismatched subtype, bailing\n");
++		return -EBADE;
++	}
++
++	*data_ptr = &pvt_data[1];
++	event_data = *data_ptr;
++
++	/* memcpy since BRCM event pkt may be unaligned. */
++	memcpy(event, &pvt_data->msg, sizeof(struct brcmf_event_msg));
++
++	type = get_unaligned_be32(&event->event_type);
++	flags = get_unaligned_be16(&event->flags);
++	status = get_unaligned_be32(&event->status);
++	evlen = get_unaligned_be32(&event->datalen) +
++		sizeof(struct brcmf_event);
++
++	switch (type) {
++	case BRCMF_E_IF:
++		ifevent = (struct brcmf_if_event *) event_data;
++		brcmf_dbg(TRACE, "if event\n");
++
++		if (ifevent->ifidx > 0 && ifevent->ifidx < BRCMF_MAX_IFS) {
++			if (ifevent->action == BRCMF_E_IF_ADD)
++				brcmf_add_if(drvr->dev, ifevent->ifidx,
++					     event->ifname,
++					     pvt_data->eth.h_dest);
++			else
++				brcmf_del_if(drvr, ifevent->ifidx);
++		} else {
++			brcmf_dbg(ERROR, "Invalid ifidx %d for %s\n",
++				  ifevent->ifidx, event->ifname);
++		}
++
++		/* send up the if event: btamp user needs it */
++		*ifidx = brcmf_ifname2idx(drvr, event->ifname);
++		break;
++
++		/* These are what external supplicant/authenticator wants */
++	case BRCMF_E_LINK:
++	case BRCMF_E_ASSOC_IND:
++	case BRCMF_E_REASSOC_IND:
++	case BRCMF_E_DISASSOC_IND:
++	case BRCMF_E_MIC_ERROR:
++	default:
++		/* Fall through: this should get _everything_  */
++
++		*ifidx = brcmf_ifname2idx(drvr, event->ifname);
++		brcmf_dbg(TRACE, "MAC event %d, flags %x, status %x\n",
++			  type, flags, status);
++
++		/* put it back to BRCMF_E_NDIS_LINK */
++		if (type == BRCMF_E_NDIS_LINK) {
++			u32 temp1;
++			__be32 temp2;
++
++			temp1 = get_unaligned_be32(&event->event_type);
++			brcmf_dbg(TRACE, "Converted to WLC_E_LINK type %d\n",
++				  temp1);
++
++			temp2 = cpu_to_be32(BRCMF_E_NDIS_LINK);
++			memcpy((void *)(&pvt_data->msg.event_type), &temp2,
++			       sizeof(pvt_data->msg.event_type));
++		}
++		break;
++	}
++
++#ifdef DEBUG
++	brcmf_c_show_host_event(event, event_data);
++#endif				/* DEBUG */
++
++	return 0;
++}
++
++/* Convert user's input in hex pattern to byte-size mask */
++static int brcmf_c_pattern_atoh(char *src, char *dst)
++{
++	int i;
++	if (strncmp(src, "0x", 2) != 0 && strncmp(src, "0X", 2) != 0) {
++		brcmf_dbg(ERROR, "Mask invalid format. Needs to start with 0x\n");
++		return -EINVAL;
++	}
++	src = src + 2;		/* Skip past 0x */
++	if (strlen(src) % 2 != 0) {
++		brcmf_dbg(ERROR, "Mask invalid format. Length must be even.\n");
++		return -EINVAL;
++	}
++	for (i = 0; *src != '\0'; i++) {
++		unsigned long res;
++		char num[3];
++		strncpy(num, src, 2);
++		num[2] = '\0';
++		if (kstrtoul(num, 16, &res))
++			return -EINVAL;
++		dst[i] = (u8)res;
++		src += 2;
++	}
++	return i;
++}
++
++void
++brcmf_c_pktfilter_offload_enable(struct brcmf_pub *drvr, char *arg, int enable,
++			     int master_mode)
++{
++	unsigned long res;
++	char *argv[8];
++	int i = 0;
++	const char *str;
++	int buf_len;
++	int str_len;
++	char *arg_save = NULL, *arg_org = NULL;
++	int rc;
++	char buf[128];
++	struct brcmf_pkt_filter_enable_le enable_parm;
++	struct brcmf_pkt_filter_enable_le *pkt_filterp;
++	__le32 mmode_le;
++
++	arg_save = kmalloc(strlen(arg) + 1, GFP_ATOMIC);
++	if (!arg_save)
++		goto fail;
++
++	arg_org = arg_save;
++	memcpy(arg_save, arg, strlen(arg) + 1);
++
++	argv[i] = strsep(&arg_save, " ");
++
++	i = 0;
++	if (NULL == argv[i]) {
++		brcmf_dbg(ERROR, "No args provided\n");
++		goto fail;
++	}
++
++	str = "pkt_filter_enable";
++	str_len = strlen(str);
++	strncpy(buf, str, str_len);
++	buf[str_len] = '\0';
++	buf_len = str_len + 1;
++
++	pkt_filterp = (struct brcmf_pkt_filter_enable_le *) (buf + str_len + 1);
++
++	/* Parse packet filter id. */
++	enable_parm.id = 0;
++	if (!kstrtoul(argv[i], 0, &res))
++		enable_parm.id = cpu_to_le32((u32)res);
++
++	/* Parse enable/disable value. */
++	enable_parm.enable = cpu_to_le32(enable);
++
++	buf_len += sizeof(enable_parm);
++	memcpy((char *)pkt_filterp, &enable_parm, sizeof(enable_parm));
++
++	/* Enable/disable the specified filter. */
++	rc = brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR, buf, buf_len);
++	rc = rc >= 0 ? 0 : rc;
++	if (rc)
++		brcmf_dbg(TRACE, "failed to add pktfilter %s, retcode = %d\n",
++			  arg, rc);
++	else
++		brcmf_dbg(TRACE, "successfully added pktfilter %s\n", arg);
++
++	/* Contorl the master mode */
++	mmode_le = cpu_to_le32(master_mode);
++	brcmf_c_mkiovar("pkt_filter_mode", (char *)&mmode_le, 4, buf,
++		    sizeof(buf));
++	rc = brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR, buf,
++				       sizeof(buf));
++	rc = rc >= 0 ? 0 : rc;
++	if (rc)
++		brcmf_dbg(TRACE, "failed to add pktfilter %s, retcode = %d\n",
++			  arg, rc);
++
++fail:
++	kfree(arg_org);
++}
++
++void brcmf_c_pktfilter_offload_set(struct brcmf_pub *drvr, char *arg)
++{
++	const char *str;
++	struct brcmf_pkt_filter_le pkt_filter;
++	struct brcmf_pkt_filter_le *pkt_filterp;
++	unsigned long res;
++	int buf_len;
++	int str_len;
++	int rc;
++	u32 mask_size;
++	u32 pattern_size;
++	char *argv[8], *buf = NULL;
++	int i = 0;
++	char *arg_save = NULL, *arg_org = NULL;
++
++	arg_save = kstrdup(arg, GFP_ATOMIC);
++	if (!arg_save)
++		goto fail;
++
++	arg_org = arg_save;
++
++	buf = kmalloc(PKTFILTER_BUF_SIZE, GFP_ATOMIC);
++	if (!buf)
++		goto fail;
++
++	argv[i] = strsep(&arg_save, " ");
++	while (argv[i++])
++		argv[i] = strsep(&arg_save, " ");
++
++	i = 0;
++	if (NULL == argv[i]) {
++		brcmf_dbg(ERROR, "No args provided\n");
++		goto fail;
++	}
++
++	str = "pkt_filter_add";
++	strcpy(buf, str);
++	str_len = strlen(str);
++	buf_len = str_len + 1;
++
++	pkt_filterp = (struct brcmf_pkt_filter_le *) (buf + str_len + 1);
++
++	/* Parse packet filter id. */
++	pkt_filter.id = 0;
++	if (!kstrtoul(argv[i], 0, &res))
++		pkt_filter.id = cpu_to_le32((u32)res);
++
++	if (NULL == argv[++i]) {
++		brcmf_dbg(ERROR, "Polarity not provided\n");
++		goto fail;
++	}
++
++	/* Parse filter polarity. */
++	pkt_filter.negate_match = 0;
++	if (!kstrtoul(argv[i], 0, &res))
++		pkt_filter.negate_match = cpu_to_le32((u32)res);
++
++	if (NULL == argv[++i]) {
++		brcmf_dbg(ERROR, "Filter type not provided\n");
++		goto fail;
++	}
++
++	/* Parse filter type. */
++	pkt_filter.type = 0;
++	if (!kstrtoul(argv[i], 0, &res))
++		pkt_filter.type = cpu_to_le32((u32)res);
++
++	if (NULL == argv[++i]) {
++		brcmf_dbg(ERROR, "Offset not provided\n");
++		goto fail;
++	}
++
++	/* Parse pattern filter offset. */
++	pkt_filter.u.pattern.offset = 0;
++	if (!kstrtoul(argv[i], 0, &res))
++		pkt_filter.u.pattern.offset = cpu_to_le32((u32)res);
++
++	if (NULL == argv[++i]) {
++		brcmf_dbg(ERROR, "Bitmask not provided\n");
++		goto fail;
++	}
++
++	/* Parse pattern filter mask. */
++	mask_size =
++	    brcmf_c_pattern_atoh
++		   (argv[i], (char *)pkt_filterp->u.pattern.mask_and_pattern);
++
++	if (NULL == argv[++i]) {
++		brcmf_dbg(ERROR, "Pattern not provided\n");
++		goto fail;
++	}
++
++	/* Parse pattern filter pattern. */
++	pattern_size =
++	    brcmf_c_pattern_atoh(argv[i],
++				   (char *)&pkt_filterp->u.pattern.
++				   mask_and_pattern[mask_size]);
++
++	if (mask_size != pattern_size) {
++		brcmf_dbg(ERROR, "Mask and pattern not the same size\n");
++		goto fail;
++	}
++
++	pkt_filter.u.pattern.size_bytes = cpu_to_le32(mask_size);
++	buf_len += BRCMF_PKT_FILTER_FIXED_LEN;
++	buf_len += (BRCMF_PKT_FILTER_PATTERN_FIXED_LEN + 2 * mask_size);
++
++	/* Keep-alive attributes are set in local
++	 * variable (keep_alive_pkt), and
++	 ** then memcpy'ed into buffer (keep_alive_pktp) since there is no
++	 ** guarantee that the buffer is properly aligned.
++	 */
++	memcpy((char *)pkt_filterp,
++	       &pkt_filter,
++	       BRCMF_PKT_FILTER_FIXED_LEN + BRCMF_PKT_FILTER_PATTERN_FIXED_LEN);
++
++	rc = brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR, buf, buf_len);
++	rc = rc >= 0 ? 0 : rc;
++
++	if (rc)
++		brcmf_dbg(TRACE, "failed to add pktfilter %s, retcode = %d\n",
++			  arg, rc);
++	else
++		brcmf_dbg(TRACE, "successfully added pktfilter %s\n", arg);
++
++fail:
++	kfree(arg_org);
++
++	kfree(buf);
++}
++
++static void brcmf_c_arp_offload_set(struct brcmf_pub *drvr, int arp_mode)
++{
++	char iovbuf[32];
++	int retcode;
++
++	brcmf_c_mkiovar("arp_ol", (char *)&arp_mode, 4, iovbuf, sizeof(iovbuf));
++	retcode = brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR,
++				   iovbuf, sizeof(iovbuf));
++	retcode = retcode >= 0 ? 0 : retcode;
++	if (retcode)
++		brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, retcode = %d\n",
++			  arp_mode, retcode);
++	else
++		brcmf_dbg(TRACE, "successfully set ARP offload mode to 0x%x\n",
++			  arp_mode);
++}
++
++static void brcmf_c_arp_offload_enable(struct brcmf_pub *drvr, int arp_enable)
++{
++	char iovbuf[32];
++	int retcode;
++
++	brcmf_c_mkiovar("arpoe", (char *)&arp_enable, 4,
++			iovbuf, sizeof(iovbuf));
++	retcode = brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR,
++				   iovbuf, sizeof(iovbuf));
++	retcode = retcode >= 0 ? 0 : retcode;
++	if (retcode)
++		brcmf_dbg(TRACE, "failed to enable ARP offload to %d, retcode = %d\n",
++			  arp_enable, retcode);
++	else
++		brcmf_dbg(TRACE, "successfully enabled ARP offload to %d\n",
++			  arp_enable);
++}
++
++int brcmf_c_preinit_dcmds(struct brcmf_pub *drvr)
++{
++	char iovbuf[BRCMF_EVENTING_MASK_LEN + 12];	/*  Room for
++				 "event_msgs" + '\0' + bitvec  */
++	char buf[128], *ptr;
++	u32 dongle_align = drvr->bus_if->align;
++	u32 glom = 0;
++	u32 roaming = 1;
++	uint bcn_timeout = 3;
++	int scan_assoc_time = 40;
++	int scan_unassoc_time = 40;
++	int i;
++
++	mutex_lock(&drvr->proto_block);
++
++	/* Set Country code */
++	if (drvr->country_code[0] != 0) {
++		if (brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_COUNTRY,
++					      drvr->country_code,
++					      sizeof(drvr->country_code)) < 0)
++			brcmf_dbg(ERROR, "country code setting failed\n");
++	}
++
++	/* query for 'ver' to get version info from firmware */
++	memset(buf, 0, sizeof(buf));
++	ptr = buf;
++	brcmf_c_mkiovar("ver", NULL, 0, buf, sizeof(buf));
++	brcmf_proto_cdc_query_dcmd(drvr, 0, BRCMF_C_GET_VAR, buf, sizeof(buf));
++	strsep(&ptr, "\n");
++	/* Print fw version info */
++	brcmf_dbg(ERROR, "Firmware version = %s\n", buf);
++
++	/* Match Host and Dongle rx alignment */
++	brcmf_c_mkiovar("bus:txglomalign", (char *)&dongle_align, 4, iovbuf,
++		    sizeof(iovbuf));
++	brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR, iovbuf,
++				  sizeof(iovbuf));
++
++	/* disable glom option per default */
++	brcmf_c_mkiovar("bus:txglom", (char *)&glom, 4, iovbuf, sizeof(iovbuf));
++	brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR, iovbuf,
++				  sizeof(iovbuf));
++
++	/* Setup timeout if Beacons are lost and roam is off to report
++		 link down */
++	brcmf_c_mkiovar("bcn_timeout", (char *)&bcn_timeout, 4, iovbuf,
++		    sizeof(iovbuf));
++	brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR, iovbuf,
++				  sizeof(iovbuf));
++
++	/* Enable/Disable build-in roaming to allowed ext supplicant to take
++		 of romaing */
++	brcmf_c_mkiovar("roam_off", (char *)&roaming, 4,
++		      iovbuf, sizeof(iovbuf));
++	brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR, iovbuf,
++				  sizeof(iovbuf));
++
++	/* Setup event_msgs */
++	brcmf_c_mkiovar("event_msgs", drvr->eventmask, BRCMF_EVENTING_MASK_LEN,
++		      iovbuf, sizeof(iovbuf));
++	brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR, iovbuf,
++				  sizeof(iovbuf));
++
++	brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_SCAN_CHANNEL_TIME,
++			 (char *)&scan_assoc_time, sizeof(scan_assoc_time));
++	brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_SCAN_UNASSOC_TIME,
++			 (char *)&scan_unassoc_time, sizeof(scan_unassoc_time));
++
++	/* Set and enable ARP offload feature */
++	brcmf_c_arp_offload_set(drvr, BRCMF_ARPOL_MODE);
++	brcmf_c_arp_offload_enable(drvr, true);
++
++	/* Set up pkt filter */
++	for (i = 0; i < drvr->pktfilter_count; i++) {
++		brcmf_c_pktfilter_offload_set(drvr, drvr->pktfilter[i]);
++		brcmf_c_pktfilter_offload_enable(drvr, drvr->pktfilter[i],
++						 0, true);
++	}
++
++	mutex_unlock(&drvr->proto_block);
++
++	return 0;
++}
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h
+new file mode 100644
+index 0000000..a2c4576
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h
+@@ -0,0 +1,79 @@
++/*
++ * Copyright (c) 2010 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#ifndef _BRCMF_DBG_H_
++#define _BRCMF_DBG_H_
++
++/* message levels */
++#define BRCMF_ERROR_VAL	0x0001
++#define BRCMF_TRACE_VAL	0x0002
++#define BRCMF_INFO_VAL	0x0004
++#define BRCMF_DATA_VAL	0x0008
++#define BRCMF_CTL_VAL	0x0010
++#define BRCMF_TIMER_VAL	0x0020
++#define BRCMF_HDRS_VAL	0x0040
++#define BRCMF_BYTES_VAL	0x0080
++#define BRCMF_INTR_VAL	0x0100
++#define BRCMF_GLOM_VAL	0x0400
++#define BRCMF_EVENT_VAL	0x0800
++#define BRCMF_BTA_VAL	0x1000
++#define BRCMF_ISCAN_VAL 0x2000
++
++#if defined(DEBUG)
++
++#define brcmf_dbg(level, fmt, ...)					\
++do {									\
++	if (BRCMF_ERROR_VAL == BRCMF_##level##_VAL) {			\
++		if (brcmf_msg_level & BRCMF_##level##_VAL) {		\
++			if (net_ratelimit())				\
++				pr_debug("%s: " fmt,			\
++					 __func__, ##__VA_ARGS__);	\
++		}							\
++	} else {							\
++		if (brcmf_msg_level & BRCMF_##level##_VAL) {		\
++			pr_debug("%s: " fmt,				\
++				 __func__, ##__VA_ARGS__);		\
++		}							\
++	}								\
++} while (0)
++
++#define BRCMF_DATA_ON()		(brcmf_msg_level & BRCMF_DATA_VAL)
++#define BRCMF_CTL_ON()		(brcmf_msg_level & BRCMF_CTL_VAL)
++#define BRCMF_HDRS_ON()		(brcmf_msg_level & BRCMF_HDRS_VAL)
++#define BRCMF_BYTES_ON()	(brcmf_msg_level & BRCMF_BYTES_VAL)
++#define BRCMF_GLOM_ON()		(brcmf_msg_level & BRCMF_GLOM_VAL)
++
++#else	/* (defined DEBUG) || (defined DEBUG) */
++
++#define brcmf_dbg(level, fmt, ...) no_printk(fmt, ##__VA_ARGS__)
++
++#define BRCMF_DATA_ON()		0
++#define BRCMF_CTL_ON()		0
++#define BRCMF_HDRS_ON()		0
++#define BRCMF_BYTES_ON()	0
++#define BRCMF_GLOM_ON()		0
++
++#endif				/* defined(DEBUG) */
++
++#define brcmf_dbg_hex_dump(test, data, len, fmt, ...)			\
++do {									\
++	if (test)							\
++		brcmu_dbg_hex_dump(data, len, fmt, ##__VA_ARGS__);	\
++} while (0)
++
++extern int brcmf_msg_level;
++
++#endif				/* _BRCMF_DBG_H_ */
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+new file mode 100644
+index 0000000..7c42840
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+@@ -0,0 +1,1232 @@
++/*
++ * Copyright (c) 2010 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#undef pr_fmt
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/version.h>
++#include <linux/init.h>
++#include <linux/kernel.h>
++#include <linux/printk.h>
++#include <linux/kthread.h>
++#include <linux/slab.h>
++#include <linux/skbuff.h>
++#include <linux/netdevice.h>
++#include <linux/etherdevice.h>
++#include <linux/mmc/sdio_func.h>
++#include <linux/random.h>
++#include <linux/spinlock.h>
++#include <linux/ethtool.h>
++#include <linux/fcntl.h>
++#include <linux/fs.h>
++#include <linux/uaccess.h>
++#include <linux/hardirq.h>
++#include <linux/mutex.h>
++#include <linux/wait.h>
++#include <linux/module.h>
++#include <net/cfg80211.h>
++#include <net/rtnetlink.h>
++#include <defs.h>
++#include <brcmu_utils.h>
++#include <brcmu_wifi.h>
++
++#include "dhd.h"
++#include "dhd_bus.h"
++#include "dhd_proto.h"
++#include "dhd_dbg.h"
++#include "wl_cfg80211.h"
++
++MODULE_AUTHOR("Broadcom Corporation");
++MODULE_DESCRIPTION("Broadcom 802.11n wireless LAN fullmac driver.");
++MODULE_SUPPORTED_DEVICE("Broadcom 802.11n WLAN fullmac cards");
++MODULE_LICENSE("Dual BSD/GPL");
++
++
++/* Interface control information */
++struct brcmf_if {
++	struct brcmf_pub *drvr;	/* back pointer to brcmf_pub */
++	/* OS/stack specifics */
++	struct net_device *ndev;
++	struct net_device_stats stats;
++	int idx;		/* iface idx in dongle */
++	u8 mac_addr[ETH_ALEN];	/* assigned MAC address */
++};
++
++/* Error bits */
++int brcmf_msg_level = BRCMF_ERROR_VAL;
++module_param(brcmf_msg_level, int, 0);
++
++int brcmf_ifname2idx(struct brcmf_pub *drvr, char *name)
++{
++	int i = BRCMF_MAX_IFS;
++	struct brcmf_if *ifp;
++
++	if (name == NULL || *name == '\0')
++		return 0;
++
++	while (--i > 0) {
++		ifp = drvr->iflist[i];
++		if (ifp && !strncmp(ifp->ndev->name, name, IFNAMSIZ))
++			break;
++	}
++
++	brcmf_dbg(TRACE, "return idx %d for \"%s\"\n", i, name);
++
++	return i;		/* default - the primary interface */
++}
++
++char *brcmf_ifname(struct brcmf_pub *drvr, int ifidx)
++{
++	if (ifidx < 0 || ifidx >= BRCMF_MAX_IFS) {
++		brcmf_dbg(ERROR, "ifidx %d out of range\n", ifidx);
++		return "<if_bad>";
++	}
++
++	if (drvr->iflist[ifidx] == NULL) {
++		brcmf_dbg(ERROR, "null i/f %d\n", ifidx);
++		return "<if_null>";
++	}
++
++	if (drvr->iflist[ifidx]->ndev)
++		return drvr->iflist[ifidx]->ndev->name;
++
++	return "<if_none>";
++}
++
++static void _brcmf_set_multicast_list(struct work_struct *work)
++{
++	struct net_device *ndev;
++	struct netdev_hw_addr *ha;
++	u32 dcmd_value, cnt;
++	__le32 cnt_le;
++	__le32 dcmd_le_value;
++
++	struct brcmf_dcmd dcmd;
++	char *buf, *bufp;
++	uint buflen;
++	int ret;
++
++	struct brcmf_pub *drvr = container_of(work, struct brcmf_pub,
++						    multicast_work);
++
++	ndev = drvr->iflist[0]->ndev;
++	cnt = netdev_mc_count(ndev);
++
++	/* Determine initial value of allmulti flag */
++	dcmd_value = (ndev->flags & IFF_ALLMULTI) ? true : false;
++
++	/* Send down the multicast list first. */
++
++	buflen = sizeof("mcast_list") + sizeof(cnt) + (cnt * ETH_ALEN);
++	bufp = buf = kmalloc(buflen, GFP_ATOMIC);
++	if (!bufp)
++		return;
++
++	strcpy(bufp, "mcast_list");
++	bufp += strlen("mcast_list") + 1;
++
++	cnt_le = cpu_to_le32(cnt);
++	memcpy(bufp, &cnt_le, sizeof(cnt));
++	bufp += sizeof(cnt_le);
++
++	netdev_for_each_mc_addr(ha, ndev) {
++		if (!cnt)
++			break;
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,35))
++		memcpy(bufp, ha->addr, ETH_ALEN);
++#else
++		memcpy(bufp, ha->dmi_addr, ETH_ALEN);
++#endif
++		bufp += ETH_ALEN;
++		cnt--;
++	}
++
++	memset(&dcmd, 0, sizeof(dcmd));
++	dcmd.cmd = BRCMF_C_SET_VAR;
++	dcmd.buf = buf;
++	dcmd.len = buflen;
++	dcmd.set = true;
++
++	ret = brcmf_proto_dcmd(drvr, 0, &dcmd, dcmd.len);
++	if (ret < 0) {
++		brcmf_dbg(ERROR, "%s: set mcast_list failed, cnt %d\n",
++			  brcmf_ifname(drvr, 0), cnt);
++		dcmd_value = cnt ? true : dcmd_value;
++	}
++
++	kfree(buf);
++
++	/* Now send the allmulti setting.  This is based on the setting in the
++	 * net_device flags, but might be modified above to be turned on if we
++	 * were trying to set some addresses and dongle rejected it...
++	 */
++
++	buflen = sizeof("allmulti") + sizeof(dcmd_value);
++	buf = kmalloc(buflen, GFP_ATOMIC);
++	if (!buf)
++		return;
++
++	dcmd_le_value = cpu_to_le32(dcmd_value);
++
++	if (!brcmf_c_mkiovar
++	    ("allmulti", (void *)&dcmd_le_value,
++	    sizeof(dcmd_le_value), buf, buflen)) {
++		brcmf_dbg(ERROR, "%s: mkiovar failed for allmulti, datalen %d buflen %u\n",
++			  brcmf_ifname(drvr, 0),
++			  (int)sizeof(dcmd_value), buflen);
++		kfree(buf);
++		return;
++	}
++
++	memset(&dcmd, 0, sizeof(dcmd));
++	dcmd.cmd = BRCMF_C_SET_VAR;
++	dcmd.buf = buf;
++	dcmd.len = buflen;
++	dcmd.set = true;
++
++	ret = brcmf_proto_dcmd(drvr, 0, &dcmd, dcmd.len);
++	if (ret < 0) {
++		brcmf_dbg(ERROR, "%s: set allmulti %d failed\n",
++			  brcmf_ifname(drvr, 0),
++			  le32_to_cpu(dcmd_le_value));
++	}
++
++	kfree(buf);
++
++	/* Finally, pick up the PROMISC flag as well, like the NIC
++		 driver does */
++
++	dcmd_value = (ndev->flags & IFF_PROMISC) ? true : false;
++	dcmd_le_value = cpu_to_le32(dcmd_value);
++
++	memset(&dcmd, 0, sizeof(dcmd));
++	dcmd.cmd = BRCMF_C_SET_PROMISC;
++	dcmd.buf = &dcmd_le_value;
++	dcmd.len = sizeof(dcmd_le_value);
++	dcmd.set = true;
++
++	ret = brcmf_proto_dcmd(drvr, 0, &dcmd, dcmd.len);
++	if (ret < 0) {
++		brcmf_dbg(ERROR, "%s: set promisc %d failed\n",
++			  brcmf_ifname(drvr, 0),
++			  le32_to_cpu(dcmd_le_value));
++	}
++}
++
++static void
++_brcmf_set_mac_address(struct work_struct *work)
++{
++	char buf[32];
++	struct brcmf_dcmd dcmd;
++	int ret;
++
++	struct brcmf_pub *drvr = container_of(work, struct brcmf_pub,
++						    setmacaddr_work);
++
++	brcmf_dbg(TRACE, "enter\n");
++	if (!brcmf_c_mkiovar("cur_etheraddr", (char *)drvr->macvalue,
++			   ETH_ALEN, buf, 32)) {
++		brcmf_dbg(ERROR, "%s: mkiovar failed for cur_etheraddr\n",
++			  brcmf_ifname(drvr, 0));
++		return;
++	}
++	memset(&dcmd, 0, sizeof(dcmd));
++	dcmd.cmd = BRCMF_C_SET_VAR;
++	dcmd.buf = buf;
++	dcmd.len = 32;
++	dcmd.set = true;
++
++	ret = brcmf_proto_dcmd(drvr, 0, &dcmd, dcmd.len);
++	if (ret < 0)
++		brcmf_dbg(ERROR, "%s: set cur_etheraddr failed\n",
++			  brcmf_ifname(drvr, 0));
++	else
++		memcpy(drvr->iflist[0]->ndev->dev_addr,
++		       drvr->macvalue, ETH_ALEN);
++
++	return;
++}
++
++static int brcmf_netdev_set_mac_address(struct net_device *ndev, void *addr)
++{
++	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct brcmf_pub *drvr = ifp->drvr;
++	struct sockaddr *sa = (struct sockaddr *)addr;
++
++	memcpy(&drvr->macvalue, sa->sa_data, ETH_ALEN);
++	schedule_work(&drvr->setmacaddr_work);
++	return 0;
++}
++
++static void brcmf_netdev_set_multicast_list(struct net_device *ndev)
++{
++	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct brcmf_pub *drvr = ifp->drvr;
++
++	schedule_work(&drvr->multicast_work);
++}
++
++int brcmf_sendpkt(struct brcmf_pub *drvr, int ifidx, struct sk_buff *pktbuf)
++{
++	/* Reject if down */
++	if (!drvr->bus_if->drvr_up || (drvr->bus_if->state == BRCMF_BUS_DOWN))
++		return -ENODEV;
++
++	/* Update multicast statistic */
++	if (pktbuf->len >= ETH_ALEN) {
++		u8 *pktdata = (u8 *) (pktbuf->data);
++		struct ethhdr *eh = (struct ethhdr *)pktdata;
++
++		if (is_multicast_ether_addr(eh->h_dest))
++			drvr->tx_multicast++;
++		if (ntohs(eh->h_proto) == ETH_P_PAE)
++			atomic_inc(&drvr->pend_8021x_cnt);
++	}
++
++	/* If the protocol uses a data header, apply it */
++	brcmf_proto_hdrpush(drvr, ifidx, pktbuf);
++
++	/* Use bus module to send data frame */
++	return drvr->bus_if->brcmf_bus_txdata(drvr->dev, pktbuf);
++}
++
++static int brcmf_netdev_start_xmit(struct sk_buff *skb, struct net_device *ndev)
++{
++	int ret;
++	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct brcmf_pub *drvr = ifp->drvr;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	/* Reject if down */
++	if (!drvr->bus_if->drvr_up ||
++	    (drvr->bus_if->state == BRCMF_BUS_DOWN)) {
++		brcmf_dbg(ERROR, "xmit rejected drvup=%d state=%d\n",
++			  drvr->bus_if->drvr_up,
++			  drvr->bus_if->state);
++		netif_stop_queue(ndev);
++		return -ENODEV;
++	}
++
++	if (!drvr->iflist[ifp->idx]) {
++		brcmf_dbg(ERROR, "bad ifidx %d\n", ifp->idx);
++		netif_stop_queue(ndev);
++		return -ENODEV;
++	}
++
++	/* Make sure there's enough room for any header */
++	if (skb_headroom(skb) < drvr->hdrlen) {
++		struct sk_buff *skb2;
++
++		brcmf_dbg(INFO, "%s: insufficient headroom\n",
++			  brcmf_ifname(drvr, ifp->idx));
++		drvr->bus_if->tx_realloc++;
++		skb2 = skb_realloc_headroom(skb, drvr->hdrlen);
++		dev_kfree_skb(skb);
++		skb = skb2;
++		if (skb == NULL) {
++			brcmf_dbg(ERROR, "%s: skb_realloc_headroom failed\n",
++				  brcmf_ifname(drvr, ifp->idx));
++			ret = -ENOMEM;
++			goto done;
++		}
++	}
++
++	ret = brcmf_sendpkt(drvr, ifp->idx, skb);
++
++done:
++	if (ret)
++		drvr->bus_if->dstats.tx_dropped++;
++	else
++		drvr->bus_if->dstats.tx_packets++;
++
++	/* Return ok: we always eat the packet */
++	return 0;
++}
++
++void brcmf_txflowcontrol(struct device *dev, int ifidx, bool state)
++{
++	struct net_device *ndev;
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_pub *drvr = bus_if->drvr;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	ndev = drvr->iflist[ifidx]->ndev;
++	if (state == ON)
++		netif_stop_queue(ndev);
++	else
++		netif_wake_queue(ndev);
++}
++
++static int brcmf_host_event(struct brcmf_pub *drvr, int *ifidx,
++			    void *pktdata, struct brcmf_event_msg *event,
++			    void **data)
++{
++	int bcmerror = 0;
++
++	bcmerror = brcmf_c_host_event(drvr, ifidx, pktdata, event, data);
++	if (bcmerror != 0)
++		return bcmerror;
++
++	if (drvr->iflist[*ifidx]->ndev)
++		brcmf_cfg80211_event(drvr->iflist[*ifidx]->ndev,
++				     event, *data);
++
++	return bcmerror;
++}
++
++void brcmf_rx_frame(struct device *dev, int ifidx,
++		    struct sk_buff_head *skb_list)
++{
++	unsigned char *eth;
++	uint len;
++	void *data;
++	struct sk_buff *skb, *pnext;
++	struct brcmf_if *ifp;
++	struct brcmf_event_msg event;
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_pub *drvr = bus_if->drvr;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	skb_queue_walk_safe(skb_list, skb, pnext) {
++		skb_unlink(skb, skb_list);
++
++		/* Get the protocol, maintain skb around eth_type_trans()
++		 * The main reason for this hack is for the limitation of
++		 * Linux 2.4 where 'eth_type_trans' uses the
++		 * 'net->hard_header_len'
++		 * to perform skb_pull inside vs ETH_HLEN. Since to avoid
++		 * coping of the packet coming from the network stack to add
++		 * BDC, Hardware header etc, during network interface
++		 * registration
++		 * we set the 'net->hard_header_len' to ETH_HLEN + extra space
++		 * required
++		 * for BDC, Hardware header etc. and not just the ETH_HLEN
++		 */
++		eth = skb->data;
++		len = skb->len;
++
++		ifp = drvr->iflist[ifidx];
++		if (ifp == NULL)
++			ifp = drvr->iflist[0];
++
++		if (!ifp || !ifp->ndev ||
++		    ifp->ndev->reg_state != NETREG_REGISTERED) {
++			brcmu_pkt_buf_free_skb(skb);
++			continue;
++		}
++
++		skb->dev = ifp->ndev;
++		skb->protocol = eth_type_trans(skb, skb->dev);
++
++		if (skb->pkt_type == PACKET_MULTICAST)
++			bus_if->dstats.multicast++;
++
++		skb->data = eth;
++		skb->len = len;
++
++		/* Strip header, count, deliver upward */
++		skb_pull(skb, ETH_HLEN);
++
++		/* Process special event packets and then discard them */
++		if (ntohs(skb->protocol) == ETH_P_LINK_CTL)
++			brcmf_host_event(drvr, &ifidx,
++					  skb_mac_header(skb),
++					  &event, &data);
++
++		if (drvr->iflist[ifidx]) {
++			ifp = drvr->iflist[ifidx];
++			ifp->ndev->last_rx = jiffies;
++		}
++
++		bus_if->dstats.rx_bytes += skb->len;
++		bus_if->dstats.rx_packets++;	/* Local count */
++
++		if (in_interrupt())
++			netif_rx(skb);
++		else
++			/* If the receive is not processed inside an ISR,
++			 * the softirqd must be woken explicitly to service
++			 * the NET_RX_SOFTIRQ.  In 2.6 kernels, this is handled
++			 * by netif_rx_ni(), but in earlier kernels, we need
++			 * to do it manually.
++			 */
++			netif_rx_ni(skb);
++	}
++}
++
++void brcmf_txcomplete(struct device *dev, struct sk_buff *txp, bool success)
++{
++	uint ifidx;
++	struct ethhdr *eh;
++	u16 type;
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_pub *drvr = bus_if->drvr;
++
++	brcmf_proto_hdrpull(dev, &ifidx, txp);
++
++	eh = (struct ethhdr *)(txp->data);
++	type = ntohs(eh->h_proto);
++
++	if (type == ETH_P_PAE)
++		atomic_dec(&drvr->pend_8021x_cnt);
++
++}
++
++static struct net_device_stats *brcmf_netdev_get_stats(struct net_device *ndev)
++{
++	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct brcmf_bus *bus_if = ifp->drvr->bus_if;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	/* Copy dongle stats to net device stats */
++	ifp->stats.rx_packets = bus_if->dstats.rx_packets;
++	ifp->stats.tx_packets = bus_if->dstats.tx_packets;
++	ifp->stats.rx_bytes = bus_if->dstats.rx_bytes;
++	ifp->stats.tx_bytes = bus_if->dstats.tx_bytes;
++	ifp->stats.rx_errors = bus_if->dstats.rx_errors;
++	ifp->stats.tx_errors = bus_if->dstats.tx_errors;
++	ifp->stats.rx_dropped = bus_if->dstats.rx_dropped;
++	ifp->stats.tx_dropped = bus_if->dstats.tx_dropped;
++	ifp->stats.multicast = bus_if->dstats.multicast;
++
++	return &ifp->stats;
++}
++
++/* Retrieve current toe component enables, which are kept
++	 as a bitmap in toe_ol iovar */
++static int brcmf_toe_get(struct brcmf_pub *drvr, int ifidx, u32 *toe_ol)
++{
++	struct brcmf_dcmd dcmd;
++	__le32 toe_le;
++	char buf[32];
++	int ret;
++
++	memset(&dcmd, 0, sizeof(dcmd));
++
++	dcmd.cmd = BRCMF_C_GET_VAR;
++	dcmd.buf = buf;
++	dcmd.len = (uint) sizeof(buf);
++	dcmd.set = false;
++
++	strcpy(buf, "toe_ol");
++	ret = brcmf_proto_dcmd(drvr, ifidx, &dcmd, dcmd.len);
++	if (ret < 0) {
++		/* Check for older dongle image that doesn't support toe_ol */
++		if (ret == -EIO) {
++			brcmf_dbg(ERROR, "%s: toe not supported by device\n",
++				  brcmf_ifname(drvr, ifidx));
++			return -EOPNOTSUPP;
++		}
++
++		brcmf_dbg(INFO, "%s: could not get toe_ol: ret=%d\n",
++			  brcmf_ifname(drvr, ifidx), ret);
++		return ret;
++	}
++
++	memcpy(&toe_le, buf, sizeof(u32));
++	*toe_ol = le32_to_cpu(toe_le);
++	return 0;
++}
++
++/* Set current toe component enables in toe_ol iovar,
++	 and set toe global enable iovar */
++static int brcmf_toe_set(struct brcmf_pub *drvr, int ifidx, u32 toe_ol)
++{
++	struct brcmf_dcmd dcmd;
++	char buf[32];
++	int ret;
++	__le32 toe_le = cpu_to_le32(toe_ol);
++
++	memset(&dcmd, 0, sizeof(dcmd));
++
++	dcmd.cmd = BRCMF_C_SET_VAR;
++	dcmd.buf = buf;
++	dcmd.len = (uint) sizeof(buf);
++	dcmd.set = true;
++
++	/* Set toe_ol as requested */
++	strcpy(buf, "toe_ol");
++	memcpy(&buf[sizeof("toe_ol")], &toe_le, sizeof(u32));
++
++	ret = brcmf_proto_dcmd(drvr, ifidx, &dcmd, dcmd.len);
++	if (ret < 0) {
++		brcmf_dbg(ERROR, "%s: could not set toe_ol: ret=%d\n",
++			  brcmf_ifname(drvr, ifidx), ret);
++		return ret;
++	}
++
++	/* Enable toe globally only if any components are enabled. */
++	toe_le = cpu_to_le32(toe_ol != 0);
++
++	strcpy(buf, "toe");
++	memcpy(&buf[sizeof("toe")], &toe_le, sizeof(u32));
++
++	ret = brcmf_proto_dcmd(drvr, ifidx, &dcmd, dcmd.len);
++	if (ret < 0) {
++		brcmf_dbg(ERROR, "%s: could not set toe: ret=%d\n",
++			  brcmf_ifname(drvr, ifidx), ret);
++		return ret;
++	}
++
++	return 0;
++}
++
++static void brcmf_ethtool_get_drvinfo(struct net_device *ndev,
++				    struct ethtool_drvinfo *info)
++{
++	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct brcmf_pub *drvr = ifp->drvr;
++
++	sprintf(info->driver, KBUILD_MODNAME);
++	sprintf(info->version, "%lu", drvr->drv_version);
++	sprintf(info->bus_info, "%s", dev_name(drvr->dev));
++}
++
++static const struct ethtool_ops brcmf_ethtool_ops = {
++	.get_drvinfo = brcmf_ethtool_get_drvinfo,
++};
++
++static int brcmf_ethtool(struct brcmf_pub *drvr, void __user *uaddr)
++{
++	struct ethtool_drvinfo info;
++	char drvname[sizeof(info.driver)];
++	u32 cmd;
++	struct ethtool_value edata;
++	u32 toe_cmpnt, csum_dir;
++	int ret;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	/* all ethtool calls start with a cmd word */
++	if (copy_from_user(&cmd, uaddr, sizeof(u32)))
++		return -EFAULT;
++
++	switch (cmd) {
++	case ETHTOOL_GDRVINFO:
++		/* Copy out any request driver name */
++		if (copy_from_user(&info, uaddr, sizeof(info)))
++			return -EFAULT;
++		strncpy(drvname, info.driver, sizeof(info.driver));
++		drvname[sizeof(info.driver) - 1] = '\0';
++
++		/* clear struct for return */
++		memset(&info, 0, sizeof(info));
++		info.cmd = cmd;
++
++		/* if requested, identify ourselves */
++		if (strcmp(drvname, "?dhd") == 0) {
++			sprintf(info.driver, "dhd");
++			strcpy(info.version, BRCMF_VERSION_STR);
++		}
++
++		/* otherwise, require dongle to be up */
++		else if (!drvr->bus_if->drvr_up) {
++			brcmf_dbg(ERROR, "dongle is not up\n");
++			return -ENODEV;
++		}
++
++		/* finally, report dongle driver type */
++		else if (drvr->iswl)
++			sprintf(info.driver, "wl");
++		else
++			sprintf(info.driver, "xx");
++
++		sprintf(info.version, "%lu", drvr->drv_version);
++		if (copy_to_user(uaddr, &info, sizeof(info)))
++			return -EFAULT;
++		brcmf_dbg(CTL, "given %*s, returning %s\n",
++			  (int)sizeof(drvname), drvname, info.driver);
++		break;
++
++		/* Get toe offload components from dongle */
++	case ETHTOOL_GRXCSUM:
++	case ETHTOOL_GTXCSUM:
++		ret = brcmf_toe_get(drvr, 0, &toe_cmpnt);
++		if (ret < 0)
++			return ret;
++
++		csum_dir =
++		    (cmd == ETHTOOL_GTXCSUM) ? TOE_TX_CSUM_OL : TOE_RX_CSUM_OL;
++
++		edata.cmd = cmd;
++		edata.data = (toe_cmpnt & csum_dir) ? 1 : 0;
++
++		if (copy_to_user(uaddr, &edata, sizeof(edata)))
++			return -EFAULT;
++		break;
++
++		/* Set toe offload components in dongle */
++	case ETHTOOL_SRXCSUM:
++	case ETHTOOL_STXCSUM:
++		if (copy_from_user(&edata, uaddr, sizeof(edata)))
++			return -EFAULT;
++
++		/* Read the current settings, update and write back */
++		ret = brcmf_toe_get(drvr, 0, &toe_cmpnt);
++		if (ret < 0)
++			return ret;
++
++		csum_dir =
++		    (cmd == ETHTOOL_STXCSUM) ? TOE_TX_CSUM_OL : TOE_RX_CSUM_OL;
++
++		if (edata.data != 0)
++			toe_cmpnt |= csum_dir;
++		else
++			toe_cmpnt &= ~csum_dir;
++
++		ret = brcmf_toe_set(drvr, 0, toe_cmpnt);
++		if (ret < 0)
++			return ret;
++
++		/* If setting TX checksum mode, tell Linux the new mode */
++		if (cmd == ETHTOOL_STXCSUM) {
++			if (edata.data)
++				drvr->iflist[0]->ndev->features |=
++				    NETIF_F_IP_CSUM;
++			else
++				drvr->iflist[0]->ndev->features &=
++				    ~NETIF_F_IP_CSUM;
++		}
++
++		break;
++
++	default:
++		return -EOPNOTSUPP;
++	}
++
++	return 0;
++}
++
++static int brcmf_netdev_ioctl_entry(struct net_device *ndev, struct ifreq *ifr,
++				    int cmd)
++{
++	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct brcmf_pub *drvr = ifp->drvr;
++
++	brcmf_dbg(TRACE, "ifidx %d, cmd 0x%04x\n", ifp->idx, cmd);
++
++	if (!drvr->iflist[ifp->idx])
++		return -1;
++
++	if (cmd == SIOCETHTOOL)
++		return brcmf_ethtool(drvr, ifr->ifr_data);
++
++	return -EOPNOTSUPP;
++}
++
++/* called only from within this driver. Sends a command to the dongle. */
++s32 brcmf_exec_dcmd(struct net_device *ndev, u32 cmd, void *arg, u32 len)
++{
++	struct brcmf_dcmd dcmd;
++	s32 err = 0;
++	int buflen = 0;
++	bool is_set_key_cmd;
++	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct brcmf_pub *drvr = ifp->drvr;
++
++	memset(&dcmd, 0, sizeof(dcmd));
++	dcmd.cmd = cmd;
++	dcmd.buf = arg;
++	dcmd.len = len;
++
++	if (dcmd.buf != NULL)
++		buflen = min_t(uint, dcmd.len, BRCMF_DCMD_MAXLEN);
++
++	/* send to dongle (must be up, and wl) */
++	if ((drvr->bus_if->state != BRCMF_BUS_DATA)) {
++		brcmf_dbg(ERROR, "DONGLE_DOWN\n");
++		err = -EIO;
++		goto done;
++	}
++
++	if (!drvr->iswl) {
++		err = -EIO;
++		goto done;
++	}
++
++	/*
++	 * Intercept BRCMF_C_SET_KEY CMD - serialize M4 send and
++	 * set key CMD to prevent M4 encryption.
++	 */
++	is_set_key_cmd = ((dcmd.cmd == BRCMF_C_SET_KEY) ||
++			  ((dcmd.cmd == BRCMF_C_SET_VAR) &&
++			   !(strncmp("wsec_key", dcmd.buf, 9))) ||
++			  ((dcmd.cmd == BRCMF_C_SET_VAR) &&
++			   !(strncmp("bsscfg:wsec_key", dcmd.buf, 15))));
++	if (is_set_key_cmd)
++		brcmf_netdev_wait_pend8021x(ndev);
++
++	err = brcmf_proto_dcmd(drvr, ifp->idx, &dcmd, buflen);
++
++done:
++	if (err > 0)
++		err = 0;
++
++	return err;
++}
++
++static int brcmf_netdev_stop(struct net_device *ndev)
++{
++	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct brcmf_pub *drvr = ifp->drvr;
++
++	brcmf_dbg(TRACE, "Enter\n");
++	brcmf_cfg80211_down(drvr->config);
++	if (drvr->bus_if->drvr_up == 0)
++		return 0;
++
++	/* Set state and stop OS transmissions */
++	drvr->bus_if->drvr_up = false;
++	netif_stop_queue(ndev);
++
++	return 0;
++}
++
++static int brcmf_netdev_open(struct net_device *ndev)
++{
++	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct brcmf_pub *drvr = ifp->drvr;
++	struct brcmf_bus *bus_if = drvr->bus_if;
++	u32 toe_ol;
++	s32 ret = 0;
++	uint up = 0;
++
++	brcmf_dbg(TRACE, "ifidx %d\n", ifp->idx);
++
++	if (ifp->idx == 0) {	/* do it only for primary eth0 */
++		/* If bus is not ready, can't continue */
++		if (bus_if->state != BRCMF_BUS_DATA) {
++			brcmf_dbg(ERROR, "failed bus is not ready\n");
++			return -EAGAIN;
++		}
++
++		atomic_set(&drvr->pend_8021x_cnt, 0);
++
++		memcpy(ndev->dev_addr, drvr->mac, ETH_ALEN);
++
++		/* Get current TOE mode from dongle */
++		if (brcmf_toe_get(drvr, ifp->idx, &toe_ol) >= 0
++		    && (toe_ol & TOE_TX_CSUM_OL) != 0)
++			drvr->iflist[ifp->idx]->ndev->features |=
++				NETIF_F_IP_CSUM;
++		else
++			drvr->iflist[ifp->idx]->ndev->features &=
++				~NETIF_F_IP_CSUM;
++	}
++
++	/* make sure RF is ready for work */
++	brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_UP, (char *)&up, sizeof(up));
++
++	/* Allow transmit calls */
++	netif_start_queue(ndev);
++	drvr->bus_if->drvr_up = true;
++	if (brcmf_cfg80211_up(drvr->config)) {
++		brcmf_dbg(ERROR, "failed to bring up cfg80211\n");
++		return -1;
++	}
++
++	return ret;
++}
++
++static const struct net_device_ops brcmf_netdev_ops_pri = {
++	.ndo_open = brcmf_netdev_open,
++	.ndo_stop = brcmf_netdev_stop,
++	.ndo_get_stats = brcmf_netdev_get_stats,
++	.ndo_do_ioctl = brcmf_netdev_ioctl_entry,
++	.ndo_start_xmit = brcmf_netdev_start_xmit,
++	.ndo_set_mac_address = brcmf_netdev_set_mac_address,
++	.ndo_set_rx_mode = brcmf_netdev_set_multicast_list
++};
++
++static int brcmf_net_attach(struct brcmf_if *ifp)
++{
++	struct brcmf_pub *drvr = ifp->drvr;
++	struct net_device *ndev;
++	u8 temp_addr[ETH_ALEN];
++
++	brcmf_dbg(TRACE, "ifidx %d\n", ifp->idx);
++
++	ndev = drvr->iflist[ifp->idx]->ndev;
++	ndev->netdev_ops = &brcmf_netdev_ops_pri;
++
++	/*
++	 * determine mac address to use
++	 */
++	if (is_valid_ether_addr(ifp->mac_addr))
++		memcpy(temp_addr, ifp->mac_addr, ETH_ALEN);
++	else
++		memcpy(temp_addr, drvr->mac, ETH_ALEN);
++
++	if (ifp->idx == 1) {
++		brcmf_dbg(TRACE, "ACCESS POINT MAC:\n");
++		/*  ACCESSPOINT INTERFACE CASE */
++		temp_addr[0] |= 0X02;	/* set bit 2 ,
++			 - Locally Administered address  */
++
++	}
++	ndev->hard_header_len = ETH_HLEN + drvr->hdrlen;
++	ndev->ethtool_ops = &brcmf_ethtool_ops;
++
++	drvr->rxsz = ndev->mtu + ndev->hard_header_len +
++			      drvr->hdrlen;
++
++	memcpy(ndev->dev_addr, temp_addr, ETH_ALEN);
++
++	/* attach to cfg80211 for primary interface */
++	if (!ifp->idx) {
++		drvr->config = brcmf_cfg80211_attach(ndev, drvr->dev, drvr);
++		if (drvr->config == NULL) {
++			brcmf_dbg(ERROR, "wl_cfg80211_attach failed\n");
++			goto fail;
++		}
++	}
++
++	if (register_netdev(ndev) != 0) {
++		brcmf_dbg(ERROR, "couldn't register the net device\n");
++		goto fail;
++	}
++
++	brcmf_dbg(INFO, "%s: Broadcom Dongle Host Driver\n", ndev->name);
++
++	return 0;
++
++fail:
++	ndev->netdev_ops = NULL;
++	return -EBADE;
++}
++
++int
++brcmf_add_if(struct device *dev, int ifidx, char *name, u8 *mac_addr)
++{
++	struct brcmf_if *ifp;
++	struct net_device *ndev;
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_pub *drvr = bus_if->drvr;
++
++	brcmf_dbg(TRACE, "idx %d\n", ifidx);
++
++	ifp = drvr->iflist[ifidx];
++	/*
++	 * Delete the existing interface before overwriting it
++	 * in case we missed the BRCMF_E_IF_DEL event.
++	 */
++	if (ifp) {
++		brcmf_dbg(ERROR, "ERROR: netdev:%s already exists, try free & unregister\n",
++			  ifp->ndev->name);
++		netif_stop_queue(ifp->ndev);
++		unregister_netdev(ifp->ndev);
++		free_netdev(ifp->ndev);
++		drvr->iflist[ifidx] = NULL;
++	}
++
++	/* Allocate netdev, including space for private structure */
++	ndev = alloc_netdev(sizeof(struct brcmf_if), name, ether_setup);
++	if (!ndev) {
++		brcmf_dbg(ERROR, "OOM - alloc_netdev\n");
++		return -ENOMEM;
++	}
++
++	ifp = netdev_priv(ndev);
++	ifp->ndev = ndev;
++	ifp->drvr = drvr;
++	drvr->iflist[ifidx] = ifp;
++	ifp->idx = ifidx;
++	if (mac_addr != NULL)
++		memcpy(&ifp->mac_addr, mac_addr, ETH_ALEN);
++
++	if (brcmf_net_attach(ifp)) {
++		brcmf_dbg(ERROR, "brcmf_net_attach failed");
++		free_netdev(ifp->ndev);
++		drvr->iflist[ifidx] = NULL;
++		return -EOPNOTSUPP;
++	}
++
++	brcmf_dbg(TRACE, " ==== pid:%x, net_device for if:%s created ===\n",
++		  current->pid, ifp->ndev->name);
++
++	return 0;
++}
++
++void brcmf_del_if(struct brcmf_pub *drvr, int ifidx)
++{
++	struct brcmf_if *ifp;
++
++	brcmf_dbg(TRACE, "idx %d\n", ifidx);
++
++	ifp = drvr->iflist[ifidx];
++	if (!ifp) {
++		brcmf_dbg(ERROR, "Null interface\n");
++		return;
++	}
++	if (ifp->ndev) {
++		if (ifidx == 0) {
++			if (ifp->ndev->netdev_ops == &brcmf_netdev_ops_pri) {
++				rtnl_lock();
++				brcmf_netdev_stop(ifp->ndev);
++				rtnl_unlock();
++			}
++		} else {
++			netif_stop_queue(ifp->ndev);
++		}
++
++		unregister_netdev(ifp->ndev);
++		drvr->iflist[ifidx] = NULL;
++		if (ifidx == 0)
++			brcmf_cfg80211_detach(drvr->config);
++		free_netdev(ifp->ndev);
++	}
++}
++
++int brcmf_attach(uint bus_hdrlen, struct device *dev)
++{
++	struct brcmf_pub *drvr = NULL;
++	int ret = 0;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	/* Allocate primary brcmf_info */
++	drvr = kzalloc(sizeof(struct brcmf_pub), GFP_ATOMIC);
++	if (!drvr)
++		return -ENOMEM;
++
++	mutex_init(&drvr->proto_block);
++
++	/* Link to bus module */
++	drvr->hdrlen = bus_hdrlen;
++	drvr->bus_if = dev_get_drvdata(dev);
++	drvr->bus_if->drvr = drvr;
++	drvr->dev = dev;
++
++	/* Attach and link in the protocol */
++	ret = brcmf_proto_attach(drvr);
++	if (ret != 0) {
++		brcmf_dbg(ERROR, "brcmf_prot_attach failed\n");
++		goto fail;
++	}
++
++	INIT_WORK(&drvr->setmacaddr_work, _brcmf_set_mac_address);
++	INIT_WORK(&drvr->multicast_work, _brcmf_set_multicast_list);
++
++	return ret;
++
++fail:
++	brcmf_detach(dev);
++
++	return ret;
++}
++
++int brcmf_bus_start(struct device *dev)
++{
++	int ret = -1;
++	/* Room for "event_msgs" + '\0' + bitvec */
++	char iovbuf[BRCMF_EVENTING_MASK_LEN + 12];
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_pub *drvr = bus_if->drvr;
++
++	brcmf_dbg(TRACE, "\n");
++
++	/* Bring up the bus */
++	ret = bus_if->brcmf_bus_init(dev);
++	if (ret != 0) {
++		brcmf_dbg(ERROR, "brcmf_sdbrcm_bus_init failed %d\n", ret);
++		return ret;
++	}
++
++	brcmf_c_mkiovar("event_msgs", drvr->eventmask, BRCMF_EVENTING_MASK_LEN,
++		      iovbuf, sizeof(iovbuf));
++	brcmf_proto_cdc_query_dcmd(drvr, 0, BRCMF_C_GET_VAR, iovbuf,
++				    sizeof(iovbuf));
++	memcpy(drvr->eventmask, iovbuf, BRCMF_EVENTING_MASK_LEN);
++
++	setbit(drvr->eventmask, BRCMF_E_SET_SSID);
++	setbit(drvr->eventmask, BRCMF_E_PRUNE);
++	setbit(drvr->eventmask, BRCMF_E_AUTH);
++	setbit(drvr->eventmask, BRCMF_E_REASSOC);
++	setbit(drvr->eventmask, BRCMF_E_REASSOC_IND);
++	setbit(drvr->eventmask, BRCMF_E_DEAUTH_IND);
++	setbit(drvr->eventmask, BRCMF_E_DISASSOC_IND);
++	setbit(drvr->eventmask, BRCMF_E_DISASSOC);
++	setbit(drvr->eventmask, BRCMF_E_JOIN);
++	setbit(drvr->eventmask, BRCMF_E_ASSOC_IND);
++	setbit(drvr->eventmask, BRCMF_E_PSK_SUP);
++	setbit(drvr->eventmask, BRCMF_E_LINK);
++	setbit(drvr->eventmask, BRCMF_E_NDIS_LINK);
++	setbit(drvr->eventmask, BRCMF_E_MIC_ERROR);
++	setbit(drvr->eventmask, BRCMF_E_PMKID_CACHE);
++	setbit(drvr->eventmask, BRCMF_E_TXFAIL);
++	setbit(drvr->eventmask, BRCMF_E_JOIN_START);
++	setbit(drvr->eventmask, BRCMF_E_SCAN_COMPLETE);
++
++/* enable dongle roaming event */
++
++	drvr->pktfilter_count = 1;
++	/* Setup filter to allow only unicast */
++	drvr->pktfilter[0] = "100 0 0 0 0x01 0x00";
++
++	/* Bus is ready, do any protocol initialization */
++	ret = brcmf_proto_init(drvr);
++	if (ret < 0)
++		return ret;
++
++	/* add primary networking interface */
++	ret = brcmf_add_if(dev, 0, "wlan%d", drvr->mac);
++	if (ret < 0)
++		return ret;
++
++	/* signal bus ready */
++	bus_if->state = BRCMF_BUS_DATA;
++	return 0;
++}
++
++static void brcmf_bus_detach(struct brcmf_pub *drvr)
++{
++	brcmf_dbg(TRACE, "Enter\n");
++
++	if (drvr) {
++		/* Stop the protocol module */
++		brcmf_proto_stop(drvr);
++
++		/* Stop the bus module */
++		drvr->bus_if->brcmf_bus_stop(drvr->dev);
++	}
++}
++
++void brcmf_detach(struct device *dev)
++{
++	int i;
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_pub *drvr = bus_if->drvr;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++
++	/* make sure primary interface removed last */
++	for (i = BRCMF_MAX_IFS-1; i > -1; i--)
++		if (drvr->iflist[i])
++			brcmf_del_if(drvr, i);
++
++	brcmf_bus_detach(drvr);
++
++	if (drvr->prot) {
++		cancel_work_sync(&drvr->setmacaddr_work);
++		cancel_work_sync(&drvr->multicast_work);
++		brcmf_proto_detach(drvr);
++	}
++
++	bus_if->drvr = NULL;
++	kfree(drvr);
++}
++
++static int brcmf_get_pend_8021x_cnt(struct brcmf_pub *drvr)
++{
++	return atomic_read(&drvr->pend_8021x_cnt);
++}
++
++#define MAX_WAIT_FOR_8021X_TX	10
++
++int brcmf_netdev_wait_pend8021x(struct net_device *ndev)
++{
++	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct brcmf_pub *drvr = ifp->drvr;
++	int timeout = 10 * HZ / 1000;
++	int ntimes = MAX_WAIT_FOR_8021X_TX;
++	int pend = brcmf_get_pend_8021x_cnt(drvr);
++
++	while (ntimes && pend) {
++		if (pend) {
++			set_current_state(TASK_INTERRUPTIBLE);
++			schedule_timeout(timeout);
++			set_current_state(TASK_RUNNING);
++			ntimes--;
++		}
++		pend = brcmf_get_pend_8021x_cnt(drvr);
++	}
++	return pend;
++}
++
++#ifdef DEBUG
++int brcmf_write_to_file(struct brcmf_pub *drvr, const u8 *buf, int size)
++{
++	int ret = 0;
++	struct file *fp;
++	mm_segment_t old_fs;
++	loff_t pos = 0;
++
++	/* change to KERNEL_DS address limit */
++	old_fs = get_fs();
++	set_fs(KERNEL_DS);
++
++	/* open file to write */
++	fp = filp_open("/tmp/mem_dump", O_WRONLY | O_CREAT, 0640);
++	if (!fp) {
++		brcmf_dbg(ERROR, "open file error\n");
++		ret = -1;
++		goto exit;
++	}
++
++	/* Write buf to file */
++	fp->f_op->write(fp, (char __user *)buf, size, &pos);
++
++exit:
++	/* free buf before return */
++	kfree(buf);
++	/* close file before return */
++	if (fp)
++		filp_close(fp, current->files);
++	/* restore previous address limit */
++	set_fs(old_fs);
++
++	return ret;
++}
++#endif				/* DEBUG */
++
++static void brcmf_driver_init(struct work_struct *work)
++{
++#ifdef CONFIG_BRCMFMAC_SDIO
++	brcmf_sdio_init();
++#endif
++#ifdef CONFIG_BRCMFMAC_USB
++	brcmf_usb_init();
++#endif
++}
++static DECLARE_WORK(brcmf_driver_work, brcmf_driver_init);
++
++static int __init brcmfmac_module_init(void)
++{
++	if (!schedule_work(&brcmf_driver_work))
++		return -EBUSY;
++
++	return 0;
++}
++
++static void __exit brcmfmac_module_exit(void)
++{
++	cancel_work_sync(&brcmf_driver_work);
++
++#ifdef CONFIG_BRCMFMAC_SDIO
++	brcmf_sdio_exit();
++#endif
++#ifdef CONFIG_BRCMFMAC_USB
++	brcmf_usb_exit();
++#endif
++}
++
++module_init(brcmfmac_module_init);
++module_exit(brcmfmac_module_exit);
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_proto.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_proto.h
+new file mode 100644
+index 0000000..6bc4425
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_proto.h
+@@ -0,0 +1,53 @@
++/*
++ * Copyright (c) 2010 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#ifndef _BRCMF_PROTO_H_
++#define _BRCMF_PROTO_H_
++
++/*
++ * Exported from the brcmf protocol module (brcmf_cdc)
++ */
++
++/* Linkage, sets prot link and updates hdrlen in pub */
++extern int brcmf_proto_attach(struct brcmf_pub *drvr);
++
++/* Unlink, frees allocated protocol memory (including brcmf_proto) */
++extern void brcmf_proto_detach(struct brcmf_pub *drvr);
++
++/* Initialize protocol: sync w/dongle state.
++ * Sets dongle media info (iswl, drv_version, mac address).
++ */
++extern int brcmf_proto_init(struct brcmf_pub *drvr);
++
++/* Stop protocol: sync w/dongle state. */
++extern void brcmf_proto_stop(struct brcmf_pub *drvr);
++
++/* Add any protocol-specific data header.
++ * Caller must reserve prot_hdrlen prepend space.
++ */
++extern void brcmf_proto_hdrpush(struct brcmf_pub *, int ifidx,
++				struct sk_buff *txp);
++
++/* Use protocol to issue command to dongle */
++extern int brcmf_proto_dcmd(struct brcmf_pub *drvr, int ifidx,
++				struct brcmf_dcmd *dcmd, int len);
++
++extern int brcmf_c_preinit_dcmds(struct brcmf_pub *drvr);
++
++extern int brcmf_proto_cdc_set_dcmd(struct brcmf_pub *drvr, int ifidx,
++				     uint cmd, void *buf, uint len);
++
++#endif				/* _BRCMF_PROTO_H_ */
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+new file mode 100644
+index 0000000..0d23b8d
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+@@ -0,0 +1,4014 @@
++/*
++ * Copyright (c) 2010 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#undef pr_fmt
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/types.h>
++#include <linux/kernel.h>
++#include <linux/kthread.h>
++#include <linux/printk.h>
++#include <linux/pci_ids.h>
++#include <linux/netdevice.h>
++#include <linux/interrupt.h>
++#include <linux/sched.h>
++#include <linux/mmc/sdio.h>
++#include <linux/mmc/sdio_func.h>
++#include <linux/mmc/card.h>
++#include <linux/semaphore.h>
++#include <linux/firmware.h>
++#include <linux/module.h>
++#include <linux/bcma/bcma.h>
++#include <asm/unaligned.h>
++#include <defs.h>
++#include <brcmu_wifi.h>
++#include <brcmu_utils.h>
++#include <brcm_hw_ids.h>
++#include <soc.h>
++#include "sdio_host.h"
++#include "sdio_chip.h"
++
++#define DCMD_RESP_TIMEOUT  2000	/* In milli second */
++
++#ifdef DEBUG
++
++#define BRCMF_TRAP_INFO_SIZE	80
++
++#define CBUF_LEN	(128)
++
++struct rte_log_le {
++	__le32 buf;		/* Can't be pointer on (64-bit) hosts */
++	__le32 buf_size;
++	__le32 idx;
++	char *_buf_compat;	/* Redundant pointer for backward compat. */
++};
++
++struct rte_console {
++	/* Virtual UART
++	 * When there is no UART (e.g. Quickturn),
++	 * the host should write a complete
++	 * input line directly into cbuf and then write
++	 * the length into vcons_in.
++	 * This may also be used when there is a real UART
++	 * (at risk of conflicting with
++	 * the real UART).  vcons_out is currently unused.
++	 */
++	uint vcons_in;
++	uint vcons_out;
++
++	/* Output (logging) buffer
++	 * Console output is written to a ring buffer log_buf at index log_idx.
++	 * The host may read the output when it sees log_idx advance.
++	 * Output will be lost if the output wraps around faster than the host
++	 * polls.
++	 */
++	struct rte_log_le log_le;
++
++	/* Console input line buffer
++	 * Characters are read one at a time into cbuf
++	 * until <CR> is received, then
++	 * the buffer is processed as a command line.
++	 * Also used for virtual UART.
++	 */
++	uint cbuf_idx;
++	char cbuf[CBUF_LEN];
++};
++
++#endif				/* DEBUG */
++#include <chipcommon.h>
++
++#include "dhd_bus.h"
++#include "dhd_dbg.h"
++
++#define TXQLEN		2048	/* bulk tx queue length */
++#define TXHI		(TXQLEN - 256)	/* turn on flow control above TXHI */
++#define TXLOW		(TXHI - 256)	/* turn off flow control below TXLOW */
++#define PRIOMASK	7
++
++#define TXRETRIES	2	/* # of retries for tx frames */
++
++#define BRCMF_RXBOUND	50	/* Default for max rx frames in
++				 one scheduling */
++
++#define BRCMF_TXBOUND	20	/* Default for max tx frames in
++				 one scheduling */
++
++#define BRCMF_TXMINMAX	1	/* Max tx frames if rx still pending */
++
++#define MEMBLOCK	2048	/* Block size used for downloading
++				 of dongle image */
++#define MAX_DATA_BUF	(32 * 1024)	/* Must be large enough to hold
++				 biggest possible glom */
++
++#define BRCMF_FIRSTREAD	(1 << 6)
++
++
++/* SBSDIO_DEVICE_CTL */
++
++/* 1: device will assert busy signal when receiving CMD53 */
++#define SBSDIO_DEVCTL_SETBUSY		0x01
++/* 1: assertion of sdio interrupt is synchronous to the sdio clock */
++#define SBSDIO_DEVCTL_SPI_INTR_SYNC	0x02
++/* 1: mask all interrupts to host except the chipActive (rev 8) */
++#define SBSDIO_DEVCTL_CA_INT_ONLY	0x04
++/* 1: isolate internal sdio signals, put external pads in tri-state; requires
++ * sdio bus power cycle to clear (rev 9) */
++#define SBSDIO_DEVCTL_PADS_ISO		0x08
++/* Force SD->SB reset mapping (rev 11) */
++#define SBSDIO_DEVCTL_SB_RST_CTL	0x30
++/*   Determined by CoreControl bit */
++#define SBSDIO_DEVCTL_RST_CORECTL	0x00
++/*   Force backplane reset */
++#define SBSDIO_DEVCTL_RST_BPRESET	0x10
++/*   Force no backplane reset */
++#define SBSDIO_DEVCTL_RST_NOBPRESET	0x20
++
++/* direct(mapped) cis space */
++
++/* MAPPED common CIS address */
++#define SBSDIO_CIS_BASE_COMMON		0x1000
++/* maximum bytes in one CIS */
++#define SBSDIO_CIS_SIZE_LIMIT		0x200
++/* cis offset addr is < 17 bits */
++#define SBSDIO_CIS_OFT_ADDR_MASK	0x1FFFF
++
++/* manfid tuple length, include tuple, link bytes */
++#define SBSDIO_CIS_MANFID_TUPLE_LEN	6
++
++/* intstatus */
++#define I_SMB_SW0	(1 << 0)	/* To SB Mail S/W interrupt 0 */
++#define I_SMB_SW1	(1 << 1)	/* To SB Mail S/W interrupt 1 */
++#define I_SMB_SW2	(1 << 2)	/* To SB Mail S/W interrupt 2 */
++#define I_SMB_SW3	(1 << 3)	/* To SB Mail S/W interrupt 3 */
++#define I_SMB_SW_MASK	0x0000000f	/* To SB Mail S/W interrupts mask */
++#define I_SMB_SW_SHIFT	0	/* To SB Mail S/W interrupts shift */
++#define I_HMB_SW0	(1 << 4)	/* To Host Mail S/W interrupt 0 */
++#define I_HMB_SW1	(1 << 5)	/* To Host Mail S/W interrupt 1 */
++#define I_HMB_SW2	(1 << 6)	/* To Host Mail S/W interrupt 2 */
++#define I_HMB_SW3	(1 << 7)	/* To Host Mail S/W interrupt 3 */
++#define I_HMB_SW_MASK	0x000000f0	/* To Host Mail S/W interrupts mask */
++#define I_HMB_SW_SHIFT	4	/* To Host Mail S/W interrupts shift */
++#define I_WR_OOSYNC	(1 << 8)	/* Write Frame Out Of Sync */
++#define I_RD_OOSYNC	(1 << 9)	/* Read Frame Out Of Sync */
++#define	I_PC		(1 << 10)	/* descriptor error */
++#define	I_PD		(1 << 11)	/* data error */
++#define	I_DE		(1 << 12)	/* Descriptor protocol Error */
++#define	I_RU		(1 << 13)	/* Receive descriptor Underflow */
++#define	I_RO		(1 << 14)	/* Receive fifo Overflow */
++#define	I_XU		(1 << 15)	/* Transmit fifo Underflow */
++#define	I_RI		(1 << 16)	/* Receive Interrupt */
++#define I_BUSPWR	(1 << 17)	/* SDIO Bus Power Change (rev 9) */
++#define I_XMTDATA_AVAIL (1 << 23)	/* bits in fifo */
++#define	I_XI		(1 << 24)	/* Transmit Interrupt */
++#define I_RF_TERM	(1 << 25)	/* Read Frame Terminate */
++#define I_WF_TERM	(1 << 26)	/* Write Frame Terminate */
++#define I_PCMCIA_XU	(1 << 27)	/* PCMCIA Transmit FIFO Underflow */
++#define I_SBINT		(1 << 28)	/* sbintstatus Interrupt */
++#define I_CHIPACTIVE	(1 << 29)	/* chip from doze to active state */
++#define I_SRESET	(1 << 30)	/* CCCR RES interrupt */
++#define I_IOE2		(1U << 31)	/* CCCR IOE2 Bit Changed */
++#define	I_ERRORS	(I_PC | I_PD | I_DE | I_RU | I_RO | I_XU)
++#define I_DMA		(I_RI | I_XI | I_ERRORS)
++
++/* corecontrol */
++#define CC_CISRDY		(1 << 0)	/* CIS Ready */
++#define CC_BPRESEN		(1 << 1)	/* CCCR RES signal */
++#define CC_F2RDY		(1 << 2)	/* set CCCR IOR2 bit */
++#define CC_CLRPADSISO		(1 << 3)	/* clear SDIO pads isolation */
++#define CC_XMTDATAAVAIL_MODE	(1 << 4)
++#define CC_XMTDATAAVAIL_CTRL	(1 << 5)
++
++/* SDA_FRAMECTRL */
++#define SFC_RF_TERM	(1 << 0)	/* Read Frame Terminate */
++#define SFC_WF_TERM	(1 << 1)	/* Write Frame Terminate */
++#define SFC_CRC4WOOS	(1 << 2)	/* CRC error for write out of sync */
++#define SFC_ABORTALL	(1 << 3)	/* Abort all in-progress frames */
++
++/* HW frame tag */
++#define SDPCM_FRAMETAG_LEN	4	/* 2 bytes len, 2 bytes check val */
++
++/* Total length of frame header for dongle protocol */
++#define SDPCM_HDRLEN	(SDPCM_FRAMETAG_LEN + SDPCM_SWHEADER_LEN)
++#define SDPCM_RESERVE	(SDPCM_HDRLEN + BRCMF_SDALIGN)
++
++/*
++ * Software allocation of To SB Mailbox resources
++ */
++
++/* tosbmailbox bits corresponding to intstatus bits */
++#define SMB_NAK		(1 << 0)	/* Frame NAK */
++#define SMB_INT_ACK	(1 << 1)	/* Host Interrupt ACK */
++#define SMB_USE_OOB	(1 << 2)	/* Use OOB Wakeup */
++#define SMB_DEV_INT	(1 << 3)	/* Miscellaneous Interrupt */
++
++/* tosbmailboxdata */
++#define SMB_DATA_VERSION_SHIFT	16	/* host protocol version */
++
++/*
++ * Software allocation of To Host Mailbox resources
++ */
++
++/* intstatus bits */
++#define I_HMB_FC_STATE	I_HMB_SW0	/* Flow Control State */
++#define I_HMB_FC_CHANGE	I_HMB_SW1	/* Flow Control State Changed */
++#define I_HMB_FRAME_IND	I_HMB_SW2	/* Frame Indication */
++#define I_HMB_HOST_INT	I_HMB_SW3	/* Miscellaneous Interrupt */
++
++/* tohostmailboxdata */
++#define HMB_DATA_NAKHANDLED	1	/* retransmit NAK'd frame */
++#define HMB_DATA_DEVREADY	2	/* talk to host after enable */
++#define HMB_DATA_FC		4	/* per prio flowcontrol update flag */
++#define HMB_DATA_FWREADY	8	/* fw ready for protocol activity */
++
++#define HMB_DATA_FCDATA_MASK	0xff000000
++#define HMB_DATA_FCDATA_SHIFT	24
++
++#define HMB_DATA_VERSION_MASK	0x00ff0000
++#define HMB_DATA_VERSION_SHIFT	16
++
++/*
++ * Software-defined protocol header
++ */
++
++/* Current protocol version */
++#define SDPCM_PROT_VERSION	4
++
++/* SW frame header */
++#define SDPCM_PACKET_SEQUENCE(p)	(((u8 *)p)[0] & 0xff)
++
++#define SDPCM_CHANNEL_MASK		0x00000f00
++#define SDPCM_CHANNEL_SHIFT		8
++#define SDPCM_PACKET_CHANNEL(p)		(((u8 *)p)[1] & 0x0f)
++
++#define SDPCM_NEXTLEN_OFFSET		2
++
++/* Data Offset from SOF (HW Tag, SW Tag, Pad) */
++#define SDPCM_DOFFSET_OFFSET		3	/* Data Offset */
++#define SDPCM_DOFFSET_VALUE(p)		(((u8 *)p)[SDPCM_DOFFSET_OFFSET] & 0xff)
++#define SDPCM_DOFFSET_MASK		0xff000000
++#define SDPCM_DOFFSET_SHIFT		24
++#define SDPCM_FCMASK_OFFSET		4	/* Flow control */
++#define SDPCM_FCMASK_VALUE(p)		(((u8 *)p)[SDPCM_FCMASK_OFFSET] & 0xff)
++#define SDPCM_WINDOW_OFFSET		5	/* Credit based fc */
++#define SDPCM_WINDOW_VALUE(p)		(((u8 *)p)[SDPCM_WINDOW_OFFSET] & 0xff)
++
++#define SDPCM_SWHEADER_LEN	8	/* SW header is 64 bits */
++
++/* logical channel numbers */
++#define SDPCM_CONTROL_CHANNEL	0	/* Control channel Id */
++#define SDPCM_EVENT_CHANNEL	1	/* Asyc Event Indication Channel Id */
++#define SDPCM_DATA_CHANNEL	2	/* Data Xmit/Recv Channel Id */
++#define SDPCM_GLOM_CHANNEL	3	/* For coalesced packets */
++#define SDPCM_TEST_CHANNEL	15	/* Reserved for test/debug packets */
++
++#define SDPCM_SEQUENCE_WRAP	256	/* wrap-around val for 8bit frame seq */
++
++#define SDPCM_GLOMDESC(p)	(((u8 *)p)[1] & 0x80)
++
++/*
++ * Shared structure between dongle and the host.
++ * The structure contains pointers to trap or assert information.
++ */
++#define SDPCM_SHARED_VERSION       0x0002
++#define SDPCM_SHARED_VERSION_MASK  0x00FF
++#define SDPCM_SHARED_ASSERT_BUILT  0x0100
++#define SDPCM_SHARED_ASSERT        0x0200
++#define SDPCM_SHARED_TRAP          0x0400
++
++/* Space for header read, limit for data packets */
++#define MAX_HDR_READ	(1 << 6)
++#define MAX_RX_DATASZ	2048
++
++/* Maximum milliseconds to wait for F2 to come up */
++#define BRCMF_WAIT_F2RDY	3000
++
++/* Bump up limit on waiting for HT to account for first startup;
++ * if the image is doing a CRC calculation before programming the PMU
++ * for HT availability, it could take a couple hundred ms more, so
++ * max out at a 1 second (1000000us).
++ */
++#undef PMU_MAX_TRANSITION_DLY
++#define PMU_MAX_TRANSITION_DLY 1000000
++
++/* Value for ChipClockCSR during initial setup */
++#define BRCMF_INIT_CLKCTL1	(SBSDIO_FORCE_HW_CLKREQ_OFF |	\
++					SBSDIO_ALP_AVAIL_REQ)
++
++/* Flags for SDH calls */
++#define F2SYNC	(SDIO_REQ_4BYTE | SDIO_REQ_FIXED)
++
++#define BRCMF_SDIO_FW_NAME	"brcm/brcmfmac-sdio.bin"
++#define BRCMF_SDIO_NV_NAME	"brcm/brcmfmac-sdio.txt"
++MODULE_FIRMWARE(BRCMF_SDIO_FW_NAME);
++MODULE_FIRMWARE(BRCMF_SDIO_NV_NAME);
++
++#define BRCMF_IDLE_IMMEDIATE	(-1)	/* Enter idle immediately */
++#define BRCMF_IDLE_ACTIVE	0	/* Do not request any SD clock change
++					 * when idle
++					 */
++#define BRCMF_IDLE_INTERVAL	1
++
++/*
++ * Conversion of 802.1D priority to precedence level
++ */
++static uint prio2prec(u32 prio)
++{
++	return (prio == PRIO_8021D_NONE || prio == PRIO_8021D_BE) ?
++	       (prio^2) : prio;
++}
++
++/* core registers */
++struct sdpcmd_regs {
++	u32 corecontrol;		/* 0x00, rev8 */
++	u32 corestatus;			/* rev8 */
++	u32 PAD[1];
++	u32 biststatus;			/* rev8 */
++
++	/* PCMCIA access */
++	u16 pcmciamesportaladdr;	/* 0x010, rev8 */
++	u16 PAD[1];
++	u16 pcmciamesportalmask;	/* rev8 */
++	u16 PAD[1];
++	u16 pcmciawrframebc;		/* rev8 */
++	u16 PAD[1];
++	u16 pcmciaunderflowtimer;	/* rev8 */
++	u16 PAD[1];
++
++	/* interrupt */
++	u32 intstatus;			/* 0x020, rev8 */
++	u32 hostintmask;		/* rev8 */
++	u32 intmask;			/* rev8 */
++	u32 sbintstatus;		/* rev8 */
++	u32 sbintmask;			/* rev8 */
++	u32 funcintmask;		/* rev4 */
++	u32 PAD[2];
++	u32 tosbmailbox;		/* 0x040, rev8 */
++	u32 tohostmailbox;		/* rev8 */
++	u32 tosbmailboxdata;		/* rev8 */
++	u32 tohostmailboxdata;		/* rev8 */
++
++	/* synchronized access to registers in SDIO clock domain */
++	u32 sdioaccess;			/* 0x050, rev8 */
++	u32 PAD[3];
++
++	/* PCMCIA frame control */
++	u8 pcmciaframectrl;		/* 0x060, rev8 */
++	u8 PAD[3];
++	u8 pcmciawatermark;		/* rev8 */
++	u8 PAD[155];
++
++	/* interrupt batching control */
++	u32 intrcvlazy;			/* 0x100, rev8 */
++	u32 PAD[3];
++
++	/* counters */
++	u32 cmd52rd;			/* 0x110, rev8 */
++	u32 cmd52wr;			/* rev8 */
++	u32 cmd53rd;			/* rev8 */
++	u32 cmd53wr;			/* rev8 */
++	u32 abort;			/* rev8 */
++	u32 datacrcerror;		/* rev8 */
++	u32 rdoutofsync;		/* rev8 */
++	u32 wroutofsync;		/* rev8 */
++	u32 writebusy;			/* rev8 */
++	u32 readwait;			/* rev8 */
++	u32 readterm;			/* rev8 */
++	u32 writeterm;			/* rev8 */
++	u32 PAD[40];
++	u32 clockctlstatus;		/* rev8 */
++	u32 PAD[7];
++
++	u32 PAD[128];			/* DMA engines */
++
++	/* SDIO/PCMCIA CIS region */
++	char cis[512];			/* 0x400-0x5ff, rev6 */
++
++	/* PCMCIA function control registers */
++	char pcmciafcr[256];		/* 0x600-6ff, rev6 */
++	u16 PAD[55];
++
++	/* PCMCIA backplane access */
++	u16 backplanecsr;		/* 0x76E, rev6 */
++	u16 backplaneaddr0;		/* rev6 */
++	u16 backplaneaddr1;		/* rev6 */
++	u16 backplaneaddr2;		/* rev6 */
++	u16 backplaneaddr3;		/* rev6 */
++	u16 backplanedata0;		/* rev6 */
++	u16 backplanedata1;		/* rev6 */
++	u16 backplanedata2;		/* rev6 */
++	u16 backplanedata3;		/* rev6 */
++	u16 PAD[31];
++
++	/* sprom "size" & "blank" info */
++	u16 spromstatus;		/* 0x7BE, rev2 */
++	u32 PAD[464];
++
++	u16 PAD[0x80];
++};
++
++#ifdef DEBUG
++/* Device console log buffer state */
++struct brcmf_console {
++	uint count;		/* Poll interval msec counter */
++	uint log_addr;		/* Log struct address (fixed) */
++	struct rte_log_le log_le;	/* Log struct (host copy) */
++	uint bufsize;		/* Size of log buffer */
++	u8 *buf;		/* Log buffer (host copy) */
++	uint last;		/* Last buffer read index */
++};
++#endif				/* DEBUG */
++
++struct sdpcm_shared {
++	u32 flags;
++	u32 trap_addr;
++	u32 assert_exp_addr;
++	u32 assert_file_addr;
++	u32 assert_line;
++	u32 console_addr;	/* Address of struct rte_console */
++	u32 msgtrace_addr;
++	u8 tag[32];
++};
++
++struct sdpcm_shared_le {
++	__le32 flags;
++	__le32 trap_addr;
++	__le32 assert_exp_addr;
++	__le32 assert_file_addr;
++	__le32 assert_line;
++	__le32 console_addr;	/* Address of struct rte_console */
++	__le32 msgtrace_addr;
++	u8 tag[32];
++};
++
++
++/* misc chip info needed by some of the routines */
++/* Private data for SDIO bus interaction */
++struct brcmf_sdio {
++	struct brcmf_sdio_dev *sdiodev;	/* sdio device handler */
++	struct chip_info *ci;	/* Chip info struct */
++	char *vars;		/* Variables (from CIS and/or other) */
++	uint varsz;		/* Size of variables buffer */
++
++	u32 ramsize;		/* Size of RAM in SOCRAM (bytes) */
++
++	u32 hostintmask;	/* Copy of Host Interrupt Mask */
++	u32 intstatus;	/* Intstatus bits (events) pending */
++	bool dpc_sched;		/* Indicates DPC schedule (intrpt rcvd) */
++	bool fcstate;		/* State of dongle flow-control */
++
++	uint blocksize;		/* Block size of SDIO transfers */
++	uint roundup;		/* Max roundup limit */
++
++	struct pktq txq;	/* Queue length used for flow-control */
++	u8 flowcontrol;	/* per prio flow control bitmask */
++	u8 tx_seq;		/* Transmit sequence number (next) */
++	u8 tx_max;		/* Maximum transmit sequence allowed */
++
++	u8 hdrbuf[MAX_HDR_READ + BRCMF_SDALIGN];
++	u8 *rxhdr;		/* Header of current rx frame (in hdrbuf) */
++	u16 nextlen;		/* Next Read Len from last header */
++	u8 rx_seq;		/* Receive sequence number (expected) */
++	bool rxskip;		/* Skip receive (awaiting NAK ACK) */
++
++	uint rxbound;		/* Rx frames to read before resched */
++	uint txbound;		/* Tx frames to send before resched */
++	uint txminmax;
++
++	struct sk_buff *glomd;	/* Packet containing glomming descriptor */
++	struct sk_buff_head glom; /* Packet list for glommed superframe */
++	uint glomerr;		/* Glom packet read errors */
++
++	u8 *rxbuf;		/* Buffer for receiving control packets */
++	uint rxblen;		/* Allocated length of rxbuf */
++	u8 *rxctl;		/* Aligned pointer into rxbuf */
++	u8 *databuf;		/* Buffer for receiving big glom packet */
++	u8 *dataptr;		/* Aligned pointer into databuf */
++	uint rxlen;		/* Length of valid data in buffer */
++
++	u8 sdpcm_ver;	/* Bus protocol reported by dongle */
++
++	bool intr;		/* Use interrupts */
++	bool poll;		/* Use polling */
++	bool ipend;		/* Device interrupt is pending */
++	uint intrcount;		/* Count of device interrupt callbacks */
++	uint lastintrs;		/* Count as of last watchdog timer */
++	uint spurious;		/* Count of spurious interrupts */
++	uint pollrate;		/* Ticks between device polls */
++	uint polltick;		/* Tick counter */
++	uint pollcnt;		/* Count of active polls */
++
++#ifdef DEBUG
++	uint console_interval;
++	struct brcmf_console console;	/* Console output polling support */
++	uint console_addr;	/* Console address from shared struct */
++#endif				/* DEBUG */
++
++	uint regfails;		/* Count of R_REG failures */
++
++	uint clkstate;		/* State of sd and backplane clock(s) */
++	bool activity;		/* Activity flag for clock down */
++	s32 idletime;		/* Control for activity timeout */
++	s32 idlecount;	/* Activity timeout counter */
++	s32 idleclock;	/* How to set bus driver when idle */
++	s32 sd_rxchain;
++	bool use_rxchain;	/* If brcmf should use PKT chains */
++	bool sleeping;		/* Is SDIO bus sleeping? */
++	bool rxflow_mode;	/* Rx flow control mode */
++	bool rxflow;		/* Is rx flow control on */
++	bool alp_only;		/* Don't use HT clock (ALP only) */
++/* Field to decide if rx of control frames happen in rxbuf or lb-pool */
++	bool usebufpool;
++
++	/* Some additional counters */
++	uint tx_sderrs;		/* Count of tx attempts with sd errors */
++	uint fcqueued;		/* Tx packets that got queued */
++	uint rxrtx;		/* Count of rtx requests (NAK to dongle) */
++	uint rx_toolong;	/* Receive frames too long to receive */
++	uint rxc_errors;	/* SDIO errors when reading control frames */
++	uint rx_hdrfail;	/* SDIO errors on header reads */
++	uint rx_badhdr;		/* Bad received headers (roosync?) */
++	uint rx_badseq;		/* Mismatched rx sequence number */
++	uint fc_rcvd;		/* Number of flow-control events received */
++	uint fc_xoff;		/* Number which turned on flow-control */
++	uint fc_xon;		/* Number which turned off flow-control */
++	uint rxglomfail;	/* Failed deglom attempts */
++	uint rxglomframes;	/* Number of glom frames (superframes) */
++	uint rxglompkts;	/* Number of packets from glom frames */
++	uint f2rxhdrs;		/* Number of header reads */
++	uint f2rxdata;		/* Number of frame data reads */
++	uint f2txdata;		/* Number of f2 frame writes */
++	uint f1regdata;		/* Number of f1 register accesses */
++	uint tickcnt;		/* Number of watchdog been schedule */
++	unsigned long tx_ctlerrs;	/* Err of sending ctrl frames */
++	unsigned long tx_ctlpkts;	/* Ctrl frames sent to dongle */
++	unsigned long rx_ctlerrs;	/* Err of processing rx ctrl frames */
++	unsigned long rx_ctlpkts;	/* Ctrl frames processed from dongle */
++	unsigned long rx_readahead_cnt;	/* Number of packets where header
++					 * read-ahead was used. */
++
++	u8 *ctrl_frame_buf;
++	u32 ctrl_frame_len;
++	bool ctrl_frame_stat;
++
++	spinlock_t txqlock;
++	wait_queue_head_t ctrl_wait;
++	wait_queue_head_t dcmd_resp_wait;
++
++	struct timer_list timer;
++	struct completion watchdog_wait;
++	struct task_struct *watchdog_tsk;
++	bool wd_timer_valid;
++	uint save_ms;
++
++	struct task_struct *dpc_tsk;
++	struct completion dpc_wait;
++	struct list_head dpc_tsklst;
++	spinlock_t dpc_tl_lock;
++
++	struct semaphore sdsem;
++
++	const struct firmware *firmware;
++	u32 fw_ptr;
++
++	bool txoff;		/* Transmit flow-controlled */
++};
++
++/* clkstate */
++#define CLK_NONE	0
++#define CLK_SDONLY	1
++#define CLK_PENDING	2	/* Not used yet */
++#define CLK_AVAIL	3
++
++#ifdef DEBUG
++static int qcount[NUMPRIO];
++static int tx_packets[NUMPRIO];
++#endif				/* DEBUG */
++
++#define SDIO_DRIVE_STRENGTH	6	/* in milliamps */
++
++#define RETRYCHAN(chan) ((chan) == SDPCM_EVENT_CHANNEL)
++
++/* Retry count for register access failures */
++static const uint retry_limit = 2;
++
++/* Limit on rounding up frames */
++static const uint max_roundup = 512;
++
++#define ALIGNMENT  4
++
++static void pkt_align(struct sk_buff *p, int len, int align)
++{
++	uint datalign;
++	datalign = (unsigned long)(p->data);
++	datalign = roundup(datalign, (align)) - datalign;
++	if (datalign)
++		skb_pull(p, datalign);
++	__skb_trim(p, len);
++}
++
++/* To check if there's window offered */
++static bool data_ok(struct brcmf_sdio *bus)
++{
++	return (u8)(bus->tx_max - bus->tx_seq) != 0 &&
++	       ((u8)(bus->tx_max - bus->tx_seq) & 0x80) == 0;
++}
++
++/*
++ * Reads a register in the SDIO hardware block. This block occupies a series of
++ * adresses on the 32 bit backplane bus.
++ */
++static int
++r_sdreg32(struct brcmf_sdio *bus, u32 *regvar, u32 offset)
++{
++	u8 idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
++	int ret;
++
++	*regvar = brcmf_sdio_regrl(bus->sdiodev,
++				   bus->ci->c_inf[idx].base + offset, &ret);
++
++	return ret;
++}
++
++static int
++w_sdreg32(struct brcmf_sdio *bus, u32 regval, u32 reg_offset)
++{
++	u8 idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
++	int ret;
++
++	brcmf_sdio_regwl(bus->sdiodev,
++			 bus->ci->c_inf[idx].base + reg_offset,
++			 regval, &ret);
++
++	return ret;
++}
++
++#define PKT_AVAILABLE()		(intstatus & I_HMB_FRAME_IND)
++
++#define HOSTINTMASK		(I_HMB_SW_MASK | I_CHIPACTIVE)
++
++/* Packet free applicable unconditionally for sdio and sdspi.
++ * Conditional if bufpool was present for gspi bus.
++ */
++static void brcmf_sdbrcm_pktfree2(struct brcmf_sdio *bus, struct sk_buff *pkt)
++{
++	if (bus->usebufpool)
++		brcmu_pkt_buf_free_skb(pkt);
++}
++
++/* Turn backplane clock on or off */
++static int brcmf_sdbrcm_htclk(struct brcmf_sdio *bus, bool on, bool pendok)
++{
++	int err;
++	u8 clkctl, clkreq, devctl;
++	unsigned long timeout;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	clkctl = 0;
++
++	if (on) {
++		/* Request HT Avail */
++		clkreq =
++		    bus->alp_only ? SBSDIO_ALP_AVAIL_REQ : SBSDIO_HT_AVAIL_REQ;
++
++		brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
++				 clkreq, &err);
++		if (err) {
++			brcmf_dbg(ERROR, "HT Avail request error: %d\n", err);
++			return -EBADE;
++		}
++
++		/* Check current status */
++		clkctl = brcmf_sdio_regrb(bus->sdiodev,
++					  SBSDIO_FUNC1_CHIPCLKCSR, &err);
++		if (err) {
++			brcmf_dbg(ERROR, "HT Avail read error: %d\n", err);
++			return -EBADE;
++		}
++
++		/* Go to pending and await interrupt if appropriate */
++		if (!SBSDIO_CLKAV(clkctl, bus->alp_only) && pendok) {
++			/* Allow only clock-available interrupt */
++			devctl = brcmf_sdio_regrb(bus->sdiodev,
++						  SBSDIO_DEVICE_CTL, &err);
++			if (err) {
++				brcmf_dbg(ERROR, "Devctl error setting CA: %d\n",
++					  err);
++				return -EBADE;
++			}
++
++			devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
++			brcmf_sdio_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
++					 devctl, &err);
++			brcmf_dbg(INFO, "CLKCTL: set PENDING\n");
++			bus->clkstate = CLK_PENDING;
++
++			return 0;
++		} else if (bus->clkstate == CLK_PENDING) {
++			/* Cancel CA-only interrupt filter */
++			devctl = brcmf_sdio_regrb(bus->sdiodev,
++						  SBSDIO_DEVICE_CTL, &err);
++			devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
++			brcmf_sdio_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
++					 devctl, &err);
++		}
++
++		/* Otherwise, wait here (polling) for HT Avail */
++		timeout = jiffies +
++			  msecs_to_jiffies(PMU_MAX_TRANSITION_DLY/1000);
++		while (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
++			clkctl = brcmf_sdio_regrb(bus->sdiodev,
++						  SBSDIO_FUNC1_CHIPCLKCSR,
++						  &err);
++			if (time_after(jiffies, timeout))
++				break;
++			else
++				usleep_range(5000, 10000);
++		}
++		if (err) {
++			brcmf_dbg(ERROR, "HT Avail request error: %d\n", err);
++			return -EBADE;
++		}
++		if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
++			brcmf_dbg(ERROR, "HT Avail timeout (%d): clkctl 0x%02x\n",
++				  PMU_MAX_TRANSITION_DLY, clkctl);
++			return -EBADE;
++		}
++
++		/* Mark clock available */
++		bus->clkstate = CLK_AVAIL;
++		brcmf_dbg(INFO, "CLKCTL: turned ON\n");
++
++#if defined(DEBUG)
++		if (!bus->alp_only) {
++			if (SBSDIO_ALPONLY(clkctl))
++				brcmf_dbg(ERROR, "HT Clock should be on\n");
++		}
++#endif				/* defined (DEBUG) */
++
++		bus->activity = true;
++	} else {
++		clkreq = 0;
++
++		if (bus->clkstate == CLK_PENDING) {
++			/* Cancel CA-only interrupt filter */
++			devctl = brcmf_sdio_regrb(bus->sdiodev,
++						  SBSDIO_DEVICE_CTL, &err);
++			devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
++			brcmf_sdio_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
++					 devctl, &err);
++		}
++
++		bus->clkstate = CLK_SDONLY;
++		brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
++				 clkreq, &err);
++		brcmf_dbg(INFO, "CLKCTL: turned OFF\n");
++		if (err) {
++			brcmf_dbg(ERROR, "Failed access turning clock off: %d\n",
++				  err);
++			return -EBADE;
++		}
++	}
++	return 0;
++}
++
++/* Change idle/active SD state */
++static int brcmf_sdbrcm_sdclk(struct brcmf_sdio *bus, bool on)
++{
++	brcmf_dbg(TRACE, "Enter\n");
++
++	if (on)
++		bus->clkstate = CLK_SDONLY;
++	else
++		bus->clkstate = CLK_NONE;
++
++	return 0;
++}
++
++/* Transition SD and backplane clock readiness */
++static int brcmf_sdbrcm_clkctl(struct brcmf_sdio *bus, uint target, bool pendok)
++{
++#ifdef DEBUG
++	uint oldstate = bus->clkstate;
++#endif				/* DEBUG */
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	/* Early exit if we're already there */
++	if (bus->clkstate == target) {
++		if (target == CLK_AVAIL) {
++			brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
++			bus->activity = true;
++		}
++		return 0;
++	}
++
++	switch (target) {
++	case CLK_AVAIL:
++		/* Make sure SD clock is available */
++		if (bus->clkstate == CLK_NONE)
++			brcmf_sdbrcm_sdclk(bus, true);
++		/* Now request HT Avail on the backplane */
++		brcmf_sdbrcm_htclk(bus, true, pendok);
++		brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
++		bus->activity = true;
++		break;
++
++	case CLK_SDONLY:
++		/* Remove HT request, or bring up SD clock */
++		if (bus->clkstate == CLK_NONE)
++			brcmf_sdbrcm_sdclk(bus, true);
++		else if (bus->clkstate == CLK_AVAIL)
++			brcmf_sdbrcm_htclk(bus, false, false);
++		else
++			brcmf_dbg(ERROR, "request for %d -> %d\n",
++				  bus->clkstate, target);
++		brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
++		break;
++
++	case CLK_NONE:
++		/* Make sure to remove HT request */
++		if (bus->clkstate == CLK_AVAIL)
++			brcmf_sdbrcm_htclk(bus, false, false);
++		/* Now remove the SD clock */
++		brcmf_sdbrcm_sdclk(bus, false);
++		brcmf_sdbrcm_wd_timer(bus, 0);
++		break;
++	}
++#ifdef DEBUG
++	brcmf_dbg(INFO, "%d -> %d\n", oldstate, bus->clkstate);
++#endif				/* DEBUG */
++
++	return 0;
++}
++
++static int brcmf_sdbrcm_bussleep(struct brcmf_sdio *bus, bool sleep)
++{
++	int ret;
++
++	brcmf_dbg(INFO, "request %s (currently %s)\n",
++		  sleep ? "SLEEP" : "WAKE",
++		  bus->sleeping ? "SLEEP" : "WAKE");
++
++	/* Done if we're already in the requested state */
++	if (sleep == bus->sleeping)
++		return 0;
++
++	/* Going to sleep: set the alarm and turn off the lights... */
++	if (sleep) {
++		/* Don't sleep if something is pending */
++		if (bus->dpc_sched || bus->rxskip || pktq_len(&bus->txq))
++			return -EBUSY;
++
++		/* Make sure the controller has the bus up */
++		brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
++
++		/* Tell device to start using OOB wakeup */
++		ret = w_sdreg32(bus, SMB_USE_OOB,
++				offsetof(struct sdpcmd_regs, tosbmailbox));
++		if (ret != 0)
++			brcmf_dbg(ERROR, "CANNOT SIGNAL CHIP, WILL NOT WAKE UP!!\n");
++
++		/* Turn off our contribution to the HT clock request */
++		brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
++
++		brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
++				 SBSDIO_FORCE_HW_CLKREQ_OFF, NULL);
++
++		/* Isolate the bus */
++		brcmf_sdio_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
++				 SBSDIO_DEVCTL_PADS_ISO, NULL);
++
++		/* Change state */
++		bus->sleeping = true;
++
++	} else {
++		/* Waking up: bus power up is ok, set local state */
++
++		brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
++				 0, NULL);
++
++		/* Make sure the controller has the bus up */
++		brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
++
++		/* Send misc interrupt to indicate OOB not needed */
++		ret = w_sdreg32(bus, 0,
++				offsetof(struct sdpcmd_regs, tosbmailboxdata));
++		if (ret == 0)
++			ret = w_sdreg32(bus, SMB_DEV_INT,
++				offsetof(struct sdpcmd_regs, tosbmailbox));
++
++		if (ret != 0)
++			brcmf_dbg(ERROR, "CANNOT SIGNAL CHIP TO CLEAR OOB!!\n");
++
++		/* Make sure we have SD bus access */
++		brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
++
++		/* Change state */
++		bus->sleeping = false;
++	}
++
++	return 0;
++}
++
++static void bus_wake(struct brcmf_sdio *bus)
++{
++	if (bus->sleeping)
++		brcmf_sdbrcm_bussleep(bus, false);
++}
++
++static u32 brcmf_sdbrcm_hostmail(struct brcmf_sdio *bus)
++{
++	u32 intstatus = 0;
++	u32 hmb_data;
++	u8 fcbits;
++	int ret;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	/* Read mailbox data and ack that we did so */
++	ret = r_sdreg32(bus, &hmb_data,
++			offsetof(struct sdpcmd_regs, tohostmailboxdata));
++
++	if (ret == 0)
++		w_sdreg32(bus, SMB_INT_ACK,
++			  offsetof(struct sdpcmd_regs, tosbmailbox));
++	bus->f1regdata += 2;
++
++	/* Dongle recomposed rx frames, accept them again */
++	if (hmb_data & HMB_DATA_NAKHANDLED) {
++		brcmf_dbg(INFO, "Dongle reports NAK handled, expect rtx of %d\n",
++			  bus->rx_seq);
++		if (!bus->rxskip)
++			brcmf_dbg(ERROR, "unexpected NAKHANDLED!\n");
++
++		bus->rxskip = false;
++		intstatus |= I_HMB_FRAME_IND;
++	}
++
++	/*
++	 * DEVREADY does not occur with gSPI.
++	 */
++	if (hmb_data & (HMB_DATA_DEVREADY | HMB_DATA_FWREADY)) {
++		bus->sdpcm_ver =
++		    (hmb_data & HMB_DATA_VERSION_MASK) >>
++		    HMB_DATA_VERSION_SHIFT;
++		if (bus->sdpcm_ver != SDPCM_PROT_VERSION)
++			brcmf_dbg(ERROR, "Version mismatch, dongle reports %d, "
++				  "expecting %d\n",
++				  bus->sdpcm_ver, SDPCM_PROT_VERSION);
++		else
++			brcmf_dbg(INFO, "Dongle ready, protocol version %d\n",
++				  bus->sdpcm_ver);
++	}
++
++	/*
++	 * Flow Control has been moved into the RX headers and this out of band
++	 * method isn't used any more.
++	 * remaining backward compatible with older dongles.
++	 */
++	if (hmb_data & HMB_DATA_FC) {
++		fcbits = (hmb_data & HMB_DATA_FCDATA_MASK) >>
++							HMB_DATA_FCDATA_SHIFT;
++
++		if (fcbits & ~bus->flowcontrol)
++			bus->fc_xoff++;
++
++		if (bus->flowcontrol & ~fcbits)
++			bus->fc_xon++;
++
++		bus->fc_rcvd++;
++		bus->flowcontrol = fcbits;
++	}
++
++	/* Shouldn't be any others */
++	if (hmb_data & ~(HMB_DATA_DEVREADY |
++			 HMB_DATA_NAKHANDLED |
++			 HMB_DATA_FC |
++			 HMB_DATA_FWREADY |
++			 HMB_DATA_FCDATA_MASK | HMB_DATA_VERSION_MASK))
++		brcmf_dbg(ERROR, "Unknown mailbox data content: 0x%02x\n",
++			  hmb_data);
++
++	return intstatus;
++}
++
++static void brcmf_sdbrcm_rxfail(struct brcmf_sdio *bus, bool abort, bool rtx)
++{
++	uint retries = 0;
++	u16 lastrbc;
++	u8 hi, lo;
++	int err;
++
++	brcmf_dbg(ERROR, "%sterminate frame%s\n",
++		  abort ? "abort command, " : "",
++		  rtx ? ", send NAK" : "");
++
++	if (abort)
++		brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
++
++	brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
++			 SFC_RF_TERM, &err);
++	bus->f1regdata++;
++
++	/* Wait until the packet has been flushed (device/FIFO stable) */
++	for (lastrbc = retries = 0xffff; retries > 0; retries--) {
++		hi = brcmf_sdio_regrb(bus->sdiodev,
++				      SBSDIO_FUNC1_RFRAMEBCHI, &err);
++		lo = brcmf_sdio_regrb(bus->sdiodev,
++				      SBSDIO_FUNC1_RFRAMEBCLO, &err);
++		bus->f1regdata += 2;
++
++		if ((hi == 0) && (lo == 0))
++			break;
++
++		if ((hi > (lastrbc >> 8)) && (lo > (lastrbc & 0x00ff))) {
++			brcmf_dbg(ERROR, "count growing: last 0x%04x now 0x%04x\n",
++				  lastrbc, (hi << 8) + lo);
++		}
++		lastrbc = (hi << 8) + lo;
++	}
++
++	if (!retries)
++		brcmf_dbg(ERROR, "count never zeroed: last 0x%04x\n", lastrbc);
++	else
++		brcmf_dbg(INFO, "flush took %d iterations\n", 0xffff - retries);
++
++	if (rtx) {
++		bus->rxrtx++;
++		err = w_sdreg32(bus, SMB_NAK,
++				offsetof(struct sdpcmd_regs, tosbmailbox));
++
++		bus->f1regdata++;
++		if (err == 0)
++			bus->rxskip = true;
++	}
++
++	/* Clear partial in any case */
++	bus->nextlen = 0;
++
++	/* If we can't reach the device, signal failure */
++	if (err)
++		bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
++}
++
++/* copy a buffer into a pkt buffer chain */
++static uint brcmf_sdbrcm_glom_from_buf(struct brcmf_sdio *bus, uint len)
++{
++	uint n, ret = 0;
++	struct sk_buff *p;
++	u8 *buf;
++
++	buf = bus->dataptr;
++
++	/* copy the data */
++	skb_queue_walk(&bus->glom, p) {
++		n = min_t(uint, p->len, len);
++		memcpy(p->data, buf, n);
++		buf += n;
++		len -= n;
++		ret += n;
++		if (!len)
++			break;
++	}
++
++	return ret;
++}
++
++/* return total length of buffer chain */
++static uint brcmf_sdbrcm_glom_len(struct brcmf_sdio *bus)
++{
++	struct sk_buff *p;
++	uint total;
++
++	total = 0;
++	skb_queue_walk(&bus->glom, p)
++		total += p->len;
++	return total;
++}
++
++static void brcmf_sdbrcm_free_glom(struct brcmf_sdio *bus)
++{
++	struct sk_buff *cur, *next;
++
++	skb_queue_walk_safe(&bus->glom, cur, next) {
++		skb_unlink(cur, &bus->glom);
++		brcmu_pkt_buf_free_skb(cur);
++	}
++}
++
++static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
++{
++	u16 dlen, totlen;
++	u8 *dptr, num = 0;
++
++	u16 sublen, check;
++	struct sk_buff *pfirst, *pnext;
++
++	int errcode;
++	u8 chan, seq, doff, sfdoff;
++	u8 txmax;
++
++	int ifidx = 0;
++	bool usechain = bus->use_rxchain;
++
++	/* If packets, issue read(s) and send up packet chain */
++	/* Return sequence numbers consumed? */
++
++	brcmf_dbg(TRACE, "start: glomd %p glom %p\n",
++		  bus->glomd, skb_peek(&bus->glom));
++
++	/* If there's a descriptor, generate the packet chain */
++	if (bus->glomd) {
++		pfirst = pnext = NULL;
++		dlen = (u16) (bus->glomd->len);
++		dptr = bus->glomd->data;
++		if (!dlen || (dlen & 1)) {
++			brcmf_dbg(ERROR, "bad glomd len(%d), ignore descriptor\n",
++				  dlen);
++			dlen = 0;
++		}
++
++		for (totlen = num = 0; dlen; num++) {
++			/* Get (and move past) next length */
++			sublen = get_unaligned_le16(dptr);
++			dlen -= sizeof(u16);
++			dptr += sizeof(u16);
++			if ((sublen < SDPCM_HDRLEN) ||
++			    ((num == 0) && (sublen < (2 * SDPCM_HDRLEN)))) {
++				brcmf_dbg(ERROR, "descriptor len %d bad: %d\n",
++					  num, sublen);
++				pnext = NULL;
++				break;
++			}
++			if (sublen % BRCMF_SDALIGN) {
++				brcmf_dbg(ERROR, "sublen %d not multiple of %d\n",
++					  sublen, BRCMF_SDALIGN);
++				usechain = false;
++			}
++			totlen += sublen;
++
++			/* For last frame, adjust read len so total
++				 is a block multiple */
++			if (!dlen) {
++				sublen +=
++				    (roundup(totlen, bus->blocksize) - totlen);
++				totlen = roundup(totlen, bus->blocksize);
++			}
++
++			/* Allocate/chain packet for next subframe */
++			pnext = brcmu_pkt_buf_get_skb(sublen + BRCMF_SDALIGN);
++			if (pnext == NULL) {
++				brcmf_dbg(ERROR, "bcm_pkt_buf_get_skb failed, num %d len %d\n",
++					  num, sublen);
++				break;
++			}
++			skb_queue_tail(&bus->glom, pnext);
++
++			/* Adhere to start alignment requirements */
++			pkt_align(pnext, sublen, BRCMF_SDALIGN);
++		}
++
++		/* If all allocations succeeded, save packet chain
++			 in bus structure */
++		if (pnext) {
++			brcmf_dbg(GLOM, "allocated %d-byte packet chain for %d subframes\n",
++				  totlen, num);
++			if (BRCMF_GLOM_ON() && bus->nextlen &&
++			    totlen != bus->nextlen) {
++				brcmf_dbg(GLOM, "glomdesc mismatch: nextlen %d glomdesc %d rxseq %d\n",
++					  bus->nextlen, totlen, rxseq);
++			}
++			pfirst = pnext = NULL;
++		} else {
++			brcmf_sdbrcm_free_glom(bus);
++			num = 0;
++		}
++
++		/* Done with descriptor packet */
++		brcmu_pkt_buf_free_skb(bus->glomd);
++		bus->glomd = NULL;
++		bus->nextlen = 0;
++	}
++
++	/* Ok -- either we just generated a packet chain,
++		 or had one from before */
++	if (!skb_queue_empty(&bus->glom)) {
++		if (BRCMF_GLOM_ON()) {
++			brcmf_dbg(GLOM, "try superframe read, packet chain:\n");
++			skb_queue_walk(&bus->glom, pnext) {
++				brcmf_dbg(GLOM, "    %p: %p len 0x%04x (%d)\n",
++					  pnext, (u8 *) (pnext->data),
++					  pnext->len, pnext->len);
++			}
++		}
++
++		pfirst = skb_peek(&bus->glom);
++		dlen = (u16) brcmf_sdbrcm_glom_len(bus);
++
++		/* Do an SDIO read for the superframe.  Configurable iovar to
++		 * read directly into the chained packet, or allocate a large
++		 * packet and and copy into the chain.
++		 */
++		if (usechain) {
++			errcode = brcmf_sdcard_recv_chain(bus->sdiodev,
++					bus->sdiodev->sbwad,
++					SDIO_FUNC_2, F2SYNC, &bus->glom);
++		} else if (bus->dataptr) {
++			errcode = brcmf_sdcard_recv_buf(bus->sdiodev,
++					bus->sdiodev->sbwad,
++					SDIO_FUNC_2, F2SYNC,
++					bus->dataptr, dlen);
++			sublen = (u16) brcmf_sdbrcm_glom_from_buf(bus, dlen);
++			if (sublen != dlen) {
++				brcmf_dbg(ERROR, "FAILED TO COPY, dlen %d sublen %d\n",
++					  dlen, sublen);
++				errcode = -1;
++			}
++			pnext = NULL;
++		} else {
++			brcmf_dbg(ERROR, "COULDN'T ALLOC %d-BYTE GLOM, FORCE FAILURE\n",
++				  dlen);
++			errcode = -1;
++		}
++		bus->f2rxdata++;
++
++		/* On failure, kill the superframe, allow a couple retries */
++		if (errcode < 0) {
++			brcmf_dbg(ERROR, "glom read of %d bytes failed: %d\n",
++				  dlen, errcode);
++			bus->sdiodev->bus_if->dstats.rx_errors++;
++
++			if (bus->glomerr++ < 3) {
++				brcmf_sdbrcm_rxfail(bus, true, true);
++			} else {
++				bus->glomerr = 0;
++				brcmf_sdbrcm_rxfail(bus, true, false);
++				bus->rxglomfail++;
++				brcmf_sdbrcm_free_glom(bus);
++			}
++			return 0;
++		}
++
++		brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
++				   pfirst->data, min_t(int, pfirst->len, 48),
++				   "SUPERFRAME:\n");
++
++		/* Validate the superframe header */
++		dptr = (u8 *) (pfirst->data);
++		sublen = get_unaligned_le16(dptr);
++		check = get_unaligned_le16(dptr + sizeof(u16));
++
++		chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
++		seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
++		bus->nextlen = dptr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
++		if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
++			brcmf_dbg(INFO, "nextlen too large (%d) seq %d\n",
++				  bus->nextlen, seq);
++			bus->nextlen = 0;
++		}
++		doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
++		txmax = SDPCM_WINDOW_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
++
++		errcode = 0;
++		if ((u16)~(sublen ^ check)) {
++			brcmf_dbg(ERROR, "(superframe): HW hdr error: len/check 0x%04x/0x%04x\n",
++				  sublen, check);
++			errcode = -1;
++		} else if (roundup(sublen, bus->blocksize) != dlen) {
++			brcmf_dbg(ERROR, "(superframe): len 0x%04x, rounded 0x%04x, expect 0x%04x\n",
++				  sublen, roundup(sublen, bus->blocksize),
++				  dlen);
++			errcode = -1;
++		} else if (SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]) !=
++			   SDPCM_GLOM_CHANNEL) {
++			brcmf_dbg(ERROR, "(superframe): bad channel %d\n",
++				  SDPCM_PACKET_CHANNEL(
++					  &dptr[SDPCM_FRAMETAG_LEN]));
++			errcode = -1;
++		} else if (SDPCM_GLOMDESC(&dptr[SDPCM_FRAMETAG_LEN])) {
++			brcmf_dbg(ERROR, "(superframe): got 2nd descriptor?\n");
++			errcode = -1;
++		} else if ((doff < SDPCM_HDRLEN) ||
++			   (doff > (pfirst->len - SDPCM_HDRLEN))) {
++			brcmf_dbg(ERROR, "(superframe): Bad data offset %d: HW %d pkt %d min %d\n",
++				  doff, sublen, pfirst->len, SDPCM_HDRLEN);
++			errcode = -1;
++		}
++
++		/* Check sequence number of superframe SW header */
++		if (rxseq != seq) {
++			brcmf_dbg(INFO, "(superframe) rx_seq %d, expected %d\n",
++				  seq, rxseq);
++			bus->rx_badseq++;
++			rxseq = seq;
++		}
++
++		/* Check window for sanity */
++		if ((u8) (txmax - bus->tx_seq) > 0x40) {
++			brcmf_dbg(ERROR, "unlikely tx max %d with tx_seq %d\n",
++				  txmax, bus->tx_seq);
++			txmax = bus->tx_seq + 2;
++		}
++		bus->tx_max = txmax;
++
++		/* Remove superframe header, remember offset */
++		skb_pull(pfirst, doff);
++		sfdoff = doff;
++		num = 0;
++
++		/* Validate all the subframe headers */
++		skb_queue_walk(&bus->glom, pnext) {
++			/* leave when invalid subframe is found */
++			if (errcode)
++				break;
++
++			dptr = (u8 *) (pnext->data);
++			dlen = (u16) (pnext->len);
++			sublen = get_unaligned_le16(dptr);
++			check = get_unaligned_le16(dptr + sizeof(u16));
++			chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
++			doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
++			brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
++					   dptr, 32, "subframe:\n");
++
++			if ((u16)~(sublen ^ check)) {
++				brcmf_dbg(ERROR, "(subframe %d): HW hdr error: len/check 0x%04x/0x%04x\n",
++					  num, sublen, check);
++				errcode = -1;
++			} else if ((sublen > dlen) || (sublen < SDPCM_HDRLEN)) {
++				brcmf_dbg(ERROR, "(subframe %d): length mismatch: len 0x%04x, expect 0x%04x\n",
++					  num, sublen, dlen);
++				errcode = -1;
++			} else if ((chan != SDPCM_DATA_CHANNEL) &&
++				   (chan != SDPCM_EVENT_CHANNEL)) {
++				brcmf_dbg(ERROR, "(subframe %d): bad channel %d\n",
++					  num, chan);
++				errcode = -1;
++			} else if ((doff < SDPCM_HDRLEN) || (doff > sublen)) {
++				brcmf_dbg(ERROR, "(subframe %d): Bad data offset %d: HW %d min %d\n",
++					  num, doff, sublen, SDPCM_HDRLEN);
++				errcode = -1;
++			}
++			/* increase the subframe count */
++			num++;
++		}
++
++		if (errcode) {
++			/* Terminate frame on error, request
++				 a couple retries */
++			if (bus->glomerr++ < 3) {
++				/* Restore superframe header space */
++				skb_push(pfirst, sfdoff);
++				brcmf_sdbrcm_rxfail(bus, true, true);
++			} else {
++				bus->glomerr = 0;
++				brcmf_sdbrcm_rxfail(bus, true, false);
++				bus->rxglomfail++;
++				brcmf_sdbrcm_free_glom(bus);
++			}
++			bus->nextlen = 0;
++			return 0;
++		}
++
++		/* Basic SD framing looks ok - process each packet (header) */
++
++		skb_queue_walk_safe(&bus->glom, pfirst, pnext) {
++			dptr = (u8 *) (pfirst->data);
++			sublen = get_unaligned_le16(dptr);
++			chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
++			seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
++			doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
++
++			brcmf_dbg(GLOM, "Get subframe %d, %p(%p/%d), sublen %d chan %d seq %d\n",
++				  num, pfirst, pfirst->data,
++				  pfirst->len, sublen, chan, seq);
++
++			/* precondition: chan == SDPCM_DATA_CHANNEL ||
++					 chan == SDPCM_EVENT_CHANNEL */
++
++			if (rxseq != seq) {
++				brcmf_dbg(GLOM, "rx_seq %d, expected %d\n",
++					  seq, rxseq);
++				bus->rx_badseq++;
++				rxseq = seq;
++			}
++			rxseq++;
++
++			brcmf_dbg_hex_dump(BRCMF_BYTES_ON() && BRCMF_DATA_ON(),
++					   dptr, dlen, "Rx Subframe Data:\n");
++
++			__skb_trim(pfirst, sublen);
++			skb_pull(pfirst, doff);
++
++			if (pfirst->len == 0) {
++				skb_unlink(pfirst, &bus->glom);
++				brcmu_pkt_buf_free_skb(pfirst);
++				continue;
++			} else if (brcmf_proto_hdrpull(bus->sdiodev->dev,
++						       &ifidx, pfirst) != 0) {
++				brcmf_dbg(ERROR, "rx protocol error\n");
++				bus->sdiodev->bus_if->dstats.rx_errors++;
++				skb_unlink(pfirst, &bus->glom);
++				brcmu_pkt_buf_free_skb(pfirst);
++				continue;
++			}
++
++			brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
++					   pfirst->data,
++					   min_t(int, pfirst->len, 32),
++					   "subframe %d to stack, %p (%p/%d) nxt/lnk %p/%p\n",
++					   bus->glom.qlen, pfirst, pfirst->data,
++					   pfirst->len, pfirst->next,
++					   pfirst->prev);
++		}
++		/* sent any remaining packets up */
++		if (bus->glom.qlen) {
++			up(&bus->sdsem);
++			brcmf_rx_frame(bus->sdiodev->dev, ifidx, &bus->glom);
++			down(&bus->sdsem);
++		}
++
++		bus->rxglomframes++;
++		bus->rxglompkts += bus->glom.qlen;
++	}
++	return num;
++}
++
++static int brcmf_sdbrcm_dcmd_resp_wait(struct brcmf_sdio *bus, uint *condition,
++					bool *pending)
++{
++	DECLARE_WAITQUEUE(wait, current);
++	int timeout = msecs_to_jiffies(DCMD_RESP_TIMEOUT);
++
++	/* Wait until control frame is available */
++	add_wait_queue(&bus->dcmd_resp_wait, &wait);
++	set_current_state(TASK_INTERRUPTIBLE);
++
++	while (!(*condition) && (!signal_pending(current) && timeout))
++		timeout = schedule_timeout(timeout);
++
++	if (signal_pending(current))
++		*pending = true;
++
++	set_current_state(TASK_RUNNING);
++	remove_wait_queue(&bus->dcmd_resp_wait, &wait);
++
++	return timeout;
++}
++
++static int brcmf_sdbrcm_dcmd_resp_wake(struct brcmf_sdio *bus)
++{
++	if (waitqueue_active(&bus->dcmd_resp_wait))
++		wake_up_interruptible(&bus->dcmd_resp_wait);
++
++	return 0;
++}
++static void
++brcmf_sdbrcm_read_control(struct brcmf_sdio *bus, u8 *hdr, uint len, uint doff)
++{
++	uint rdlen, pad;
++
++	int sdret;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	/* Set rxctl for frame (w/optional alignment) */
++	bus->rxctl = bus->rxbuf;
++	bus->rxctl += BRCMF_FIRSTREAD;
++	pad = ((unsigned long)bus->rxctl % BRCMF_SDALIGN);
++	if (pad)
++		bus->rxctl += (BRCMF_SDALIGN - pad);
++	bus->rxctl -= BRCMF_FIRSTREAD;
++
++	/* Copy the already-read portion over */
++	memcpy(bus->rxctl, hdr, BRCMF_FIRSTREAD);
++	if (len <= BRCMF_FIRSTREAD)
++		goto gotpkt;
++
++	/* Raise rdlen to next SDIO block to avoid tail command */
++	rdlen = len - BRCMF_FIRSTREAD;
++	if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
++		pad = bus->blocksize - (rdlen % bus->blocksize);
++		if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
++		    ((len + pad) < bus->sdiodev->bus_if->maxctl))
++			rdlen += pad;
++	} else if (rdlen % BRCMF_SDALIGN) {
++		rdlen += BRCMF_SDALIGN - (rdlen % BRCMF_SDALIGN);
++	}
++
++	/* Satisfy length-alignment requirements */
++	if (rdlen & (ALIGNMENT - 1))
++		rdlen = roundup(rdlen, ALIGNMENT);
++
++	/* Drop if the read is too big or it exceeds our maximum */
++	if ((rdlen + BRCMF_FIRSTREAD) > bus->sdiodev->bus_if->maxctl) {
++		brcmf_dbg(ERROR, "%d-byte control read exceeds %d-byte buffer\n",
++			  rdlen, bus->sdiodev->bus_if->maxctl);
++		bus->sdiodev->bus_if->dstats.rx_errors++;
++		brcmf_sdbrcm_rxfail(bus, false, false);
++		goto done;
++	}
++
++	if ((len - doff) > bus->sdiodev->bus_if->maxctl) {
++		brcmf_dbg(ERROR, "%d-byte ctl frame (%d-byte ctl data) exceeds %d-byte limit\n",
++			  len, len - doff, bus->sdiodev->bus_if->maxctl);
++		bus->sdiodev->bus_if->dstats.rx_errors++;
++		bus->rx_toolong++;
++		brcmf_sdbrcm_rxfail(bus, false, false);
++		goto done;
++	}
++
++	/* Read remainder of frame body into the rxctl buffer */
++	sdret = brcmf_sdcard_recv_buf(bus->sdiodev,
++				bus->sdiodev->sbwad,
++				SDIO_FUNC_2,
++				F2SYNC, (bus->rxctl + BRCMF_FIRSTREAD), rdlen);
++	bus->f2rxdata++;
++
++	/* Control frame failures need retransmission */
++	if (sdret < 0) {
++		brcmf_dbg(ERROR, "read %d control bytes failed: %d\n",
++			  rdlen, sdret);
++		bus->rxc_errors++;
++		brcmf_sdbrcm_rxfail(bus, true, true);
++		goto done;
++	}
++
++gotpkt:
++
++	brcmf_dbg_hex_dump(BRCMF_BYTES_ON() && BRCMF_CTL_ON(),
++			   bus->rxctl, len, "RxCtrl:\n");
++
++	/* Point to valid data and indicate its length */
++	bus->rxctl += doff;
++	bus->rxlen = len - doff;
++
++done:
++	/* Awake any waiters */
++	brcmf_sdbrcm_dcmd_resp_wake(bus);
++}
++
++/* Pad read to blocksize for efficiency */
++static void brcmf_pad(struct brcmf_sdio *bus, u16 *pad, u16 *rdlen)
++{
++	if (bus->roundup && bus->blocksize && *rdlen > bus->blocksize) {
++		*pad = bus->blocksize - (*rdlen % bus->blocksize);
++		if (*pad <= bus->roundup && *pad < bus->blocksize &&
++		    *rdlen + *pad + BRCMF_FIRSTREAD < MAX_RX_DATASZ)
++			*rdlen += *pad;
++	} else if (*rdlen % BRCMF_SDALIGN) {
++		*rdlen += BRCMF_SDALIGN - (*rdlen % BRCMF_SDALIGN);
++	}
++}
++
++static void
++brcmf_alloc_pkt_and_read(struct brcmf_sdio *bus, u16 rdlen,
++			 struct sk_buff **pkt, u8 **rxbuf)
++{
++	int sdret;		/* Return code from calls */
++
++	*pkt = brcmu_pkt_buf_get_skb(rdlen + BRCMF_SDALIGN);
++	if (*pkt == NULL)
++		return;
++
++	pkt_align(*pkt, rdlen, BRCMF_SDALIGN);
++	*rxbuf = (u8 *) ((*pkt)->data);
++	/* Read the entire frame */
++	sdret = brcmf_sdcard_recv_pkt(bus->sdiodev, bus->sdiodev->sbwad,
++				      SDIO_FUNC_2, F2SYNC, *pkt);
++	bus->f2rxdata++;
++
++	if (sdret < 0) {
++		brcmf_dbg(ERROR, "(nextlen): read %d bytes failed: %d\n",
++			  rdlen, sdret);
++		brcmu_pkt_buf_free_skb(*pkt);
++		bus->sdiodev->bus_if->dstats.rx_errors++;
++		/* Force retry w/normal header read.
++		 * Don't attempt NAK for
++		 * gSPI
++		 */
++		brcmf_sdbrcm_rxfail(bus, true, true);
++		*pkt = NULL;
++	}
++}
++
++/* Checks the header */
++static int
++brcmf_check_rxbuf(struct brcmf_sdio *bus, struct sk_buff *pkt, u8 *rxbuf,
++		  u8 rxseq, u16 nextlen, u16 *len)
++{
++	u16 check;
++	bool len_consistent;	/* Result of comparing readahead len and
++				   len from hw-hdr */
++
++	memcpy(bus->rxhdr, rxbuf, SDPCM_HDRLEN);
++
++	/* Extract hardware header fields */
++	*len = get_unaligned_le16(bus->rxhdr);
++	check = get_unaligned_le16(bus->rxhdr + sizeof(u16));
++
++	/* All zeros means readahead info was bad */
++	if (!(*len | check)) {
++		brcmf_dbg(INFO, "(nextlen): read zeros in HW header???\n");
++		goto fail;
++	}
++
++	/* Validate check bytes */
++	if ((u16)~(*len ^ check)) {
++		brcmf_dbg(ERROR, "(nextlen): HW hdr error: nextlen/len/check 0x%04x/0x%04x/0x%04x\n",
++			  nextlen, *len, check);
++		bus->rx_badhdr++;
++		brcmf_sdbrcm_rxfail(bus, false, false);
++		goto fail;
++	}
++
++	/* Validate frame length */
++	if (*len < SDPCM_HDRLEN) {
++		brcmf_dbg(ERROR, "(nextlen): HW hdr length invalid: %d\n",
++			  *len);
++		goto fail;
++	}
++
++	/* Check for consistency with readahead info */
++	len_consistent = (nextlen != (roundup(*len, 16) >> 4));
++	if (len_consistent) {
++		/* Mismatch, force retry w/normal
++			header (may be >4K) */
++		brcmf_dbg(ERROR, "(nextlen): mismatch, nextlen %d len %d rnd %d; expected rxseq %d\n",
++			  nextlen, *len, roundup(*len, 16),
++			  rxseq);
++		brcmf_sdbrcm_rxfail(bus, true, true);
++		goto fail;
++	}
++
++	return 0;
++
++fail:
++	brcmf_sdbrcm_pktfree2(bus, pkt);
++	return -EINVAL;
++}
++
++/* Return true if there may be more frames to read */
++static uint
++brcmf_sdbrcm_readframes(struct brcmf_sdio *bus, uint maxframes, bool *finished)
++{
++	u16 len, check;	/* Extracted hardware header fields */
++	u8 chan, seq, doff;	/* Extracted software header fields */
++	u8 fcbits;		/* Extracted fcbits from software header */
++
++	struct sk_buff *pkt;		/* Packet for event or data frames */
++	u16 pad;		/* Number of pad bytes to read */
++	u16 rdlen;		/* Total number of bytes to read */
++	u8 rxseq;		/* Next sequence number to expect */
++	uint rxleft = 0;	/* Remaining number of frames allowed */
++	int sdret;		/* Return code from calls */
++	u8 txmax;		/* Maximum tx sequence offered */
++	u8 *rxbuf;
++	int ifidx = 0;
++	uint rxcount = 0;	/* Total frames read */
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	/* Not finished unless we encounter no more frames indication */
++	*finished = false;
++
++	for (rxseq = bus->rx_seq, rxleft = maxframes;
++	     !bus->rxskip && rxleft &&
++	     bus->sdiodev->bus_if->state != BRCMF_BUS_DOWN;
++	     rxseq++, rxleft--) {
++
++		/* Handle glomming separately */
++		if (bus->glomd || !skb_queue_empty(&bus->glom)) {
++			u8 cnt;
++			brcmf_dbg(GLOM, "calling rxglom: glomd %p, glom %p\n",
++				  bus->glomd, skb_peek(&bus->glom));
++			cnt = brcmf_sdbrcm_rxglom(bus, rxseq);
++			brcmf_dbg(GLOM, "rxglom returned %d\n", cnt);
++			rxseq += cnt - 1;
++			rxleft = (rxleft > cnt) ? (rxleft - cnt) : 1;
++			continue;
++		}
++
++		/* Try doing single read if we can */
++		if (bus->nextlen) {
++			u16 nextlen = bus->nextlen;
++			bus->nextlen = 0;
++
++			rdlen = len = nextlen << 4;
++			brcmf_pad(bus, &pad, &rdlen);
++
++			/*
++			 * After the frame is received we have to
++			 * distinguish whether it is data
++			 * or non-data frame.
++			 */
++			brcmf_alloc_pkt_and_read(bus, rdlen, &pkt, &rxbuf);
++			if (pkt == NULL) {
++				/* Give up on data, request rtx of events */
++				brcmf_dbg(ERROR, "(nextlen): brcmf_alloc_pkt_and_read failed: len %d rdlen %d expected rxseq %d\n",
++					  len, rdlen, rxseq);
++				continue;
++			}
++
++			if (brcmf_check_rxbuf(bus, pkt, rxbuf, rxseq, nextlen,
++					      &len) < 0)
++				continue;
++
++			/* Extract software header fields */
++			chan = SDPCM_PACKET_CHANNEL(
++					&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
++			seq = SDPCM_PACKET_SEQUENCE(
++					&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
++			doff = SDPCM_DOFFSET_VALUE(
++					&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
++			txmax = SDPCM_WINDOW_VALUE(
++					&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
++
++			bus->nextlen =
++			    bus->rxhdr[SDPCM_FRAMETAG_LEN +
++				       SDPCM_NEXTLEN_OFFSET];
++			if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
++				brcmf_dbg(INFO, "(nextlen): got frame w/nextlen too large (%d), seq %d\n",
++					  bus->nextlen, seq);
++				bus->nextlen = 0;
++			}
++
++			bus->rx_readahead_cnt++;
++
++			/* Handle Flow Control */
++			fcbits = SDPCM_FCMASK_VALUE(
++					&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
++
++			if (bus->flowcontrol != fcbits) {
++				if (~bus->flowcontrol & fcbits)
++					bus->fc_xoff++;
++
++				if (bus->flowcontrol & ~fcbits)
++					bus->fc_xon++;
++
++				bus->fc_rcvd++;
++				bus->flowcontrol = fcbits;
++			}
++
++			/* Check and update sequence number */
++			if (rxseq != seq) {
++				brcmf_dbg(INFO, "(nextlen): rx_seq %d, expected %d\n",
++					  seq, rxseq);
++				bus->rx_badseq++;
++				rxseq = seq;
++			}
++
++			/* Check window for sanity */
++			if ((u8) (txmax - bus->tx_seq) > 0x40) {
++				brcmf_dbg(ERROR, "got unlikely tx max %d with tx_seq %d\n",
++					  txmax, bus->tx_seq);
++				txmax = bus->tx_seq + 2;
++			}
++			bus->tx_max = txmax;
++
++			brcmf_dbg_hex_dump(BRCMF_BYTES_ON() && BRCMF_DATA_ON(),
++					   rxbuf, len, "Rx Data:\n");
++			brcmf_dbg_hex_dump(!(BRCMF_BYTES_ON() &&
++					     BRCMF_DATA_ON()) &&
++					   BRCMF_HDRS_ON(),
++					   bus->rxhdr, SDPCM_HDRLEN,
++					   "RxHdr:\n");
++
++			if (chan == SDPCM_CONTROL_CHANNEL) {
++				brcmf_dbg(ERROR, "(nextlen): readahead on control packet %d?\n",
++					  seq);
++				/* Force retry w/normal header read */
++				bus->nextlen = 0;
++				brcmf_sdbrcm_rxfail(bus, false, true);
++				brcmf_sdbrcm_pktfree2(bus, pkt);
++				continue;
++			}
++
++			/* Validate data offset */
++			if ((doff < SDPCM_HDRLEN) || (doff > len)) {
++				brcmf_dbg(ERROR, "(nextlen): bad data offset %d: HW len %d min %d\n",
++					  doff, len, SDPCM_HDRLEN);
++				brcmf_sdbrcm_rxfail(bus, false, false);
++				brcmf_sdbrcm_pktfree2(bus, pkt);
++				continue;
++			}
++
++			/* All done with this one -- now deliver the packet */
++			goto deliver;
++		}
++
++		/* Read frame header (hardware and software) */
++		sdret = brcmf_sdcard_recv_buf(bus->sdiodev, bus->sdiodev->sbwad,
++					      SDIO_FUNC_2, F2SYNC, bus->rxhdr,
++					      BRCMF_FIRSTREAD);
++		bus->f2rxhdrs++;
++
++		if (sdret < 0) {
++			brcmf_dbg(ERROR, "RXHEADER FAILED: %d\n", sdret);
++			bus->rx_hdrfail++;
++			brcmf_sdbrcm_rxfail(bus, true, true);
++			continue;
++		}
++		brcmf_dbg_hex_dump(BRCMF_BYTES_ON() || BRCMF_HDRS_ON(),
++				   bus->rxhdr, SDPCM_HDRLEN, "RxHdr:\n");
++
++
++		/* Extract hardware header fields */
++		len = get_unaligned_le16(bus->rxhdr);
++		check = get_unaligned_le16(bus->rxhdr + sizeof(u16));
++
++		/* All zeros means no more frames */
++		if (!(len | check)) {
++			*finished = true;
++			break;
++		}
++
++		/* Validate check bytes */
++		if ((u16) ~(len ^ check)) {
++			brcmf_dbg(ERROR, "HW hdr err: len/check 0x%04x/0x%04x\n",
++				  len, check);
++			bus->rx_badhdr++;
++			brcmf_sdbrcm_rxfail(bus, false, false);
++			continue;
++		}
++
++		/* Validate frame length */
++		if (len < SDPCM_HDRLEN) {
++			brcmf_dbg(ERROR, "HW hdr length invalid: %d\n", len);
++			continue;
++		}
++
++		/* Extract software header fields */
++		chan = SDPCM_PACKET_CHANNEL(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
++		seq = SDPCM_PACKET_SEQUENCE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
++		doff = SDPCM_DOFFSET_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
++		txmax = SDPCM_WINDOW_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
++
++		/* Validate data offset */
++		if ((doff < SDPCM_HDRLEN) || (doff > len)) {
++			brcmf_dbg(ERROR, "Bad data offset %d: HW len %d, min %d seq %d\n",
++				  doff, len, SDPCM_HDRLEN, seq);
++			bus->rx_badhdr++;
++			brcmf_sdbrcm_rxfail(bus, false, false);
++			continue;
++		}
++
++		/* Save the readahead length if there is one */
++		bus->nextlen =
++		    bus->rxhdr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
++		if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
++			brcmf_dbg(INFO, "(nextlen): got frame w/nextlen too large (%d), seq %d\n",
++				  bus->nextlen, seq);
++			bus->nextlen = 0;
++		}
++
++		/* Handle Flow Control */
++		fcbits = SDPCM_FCMASK_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
++
++		if (bus->flowcontrol != fcbits) {
++			if (~bus->flowcontrol & fcbits)
++				bus->fc_xoff++;
++
++			if (bus->flowcontrol & ~fcbits)
++				bus->fc_xon++;
++
++			bus->fc_rcvd++;
++			bus->flowcontrol = fcbits;
++		}
++
++		/* Check and update sequence number */
++		if (rxseq != seq) {
++			brcmf_dbg(INFO, "rx_seq %d, expected %d\n", seq, rxseq);
++			bus->rx_badseq++;
++			rxseq = seq;
++		}
++
++		/* Check window for sanity */
++		if ((u8) (txmax - bus->tx_seq) > 0x40) {
++			brcmf_dbg(ERROR, "unlikely tx max %d with tx_seq %d\n",
++				  txmax, bus->tx_seq);
++			txmax = bus->tx_seq + 2;
++		}
++		bus->tx_max = txmax;
++
++		/* Call a separate function for control frames */
++		if (chan == SDPCM_CONTROL_CHANNEL) {
++			brcmf_sdbrcm_read_control(bus, bus->rxhdr, len, doff);
++			continue;
++		}
++
++		/* precondition: chan is either SDPCM_DATA_CHANNEL,
++		   SDPCM_EVENT_CHANNEL, SDPCM_TEST_CHANNEL or
++		   SDPCM_GLOM_CHANNEL */
++
++		/* Length to read */
++		rdlen = (len > BRCMF_FIRSTREAD) ? (len - BRCMF_FIRSTREAD) : 0;
++
++		/* May pad read to blocksize for efficiency */
++		if (bus->roundup && bus->blocksize &&
++			(rdlen > bus->blocksize)) {
++			pad = bus->blocksize - (rdlen % bus->blocksize);
++			if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
++			    ((rdlen + pad + BRCMF_FIRSTREAD) < MAX_RX_DATASZ))
++				rdlen += pad;
++		} else if (rdlen % BRCMF_SDALIGN) {
++			rdlen += BRCMF_SDALIGN - (rdlen % BRCMF_SDALIGN);
++		}
++
++		/* Satisfy length-alignment requirements */
++		if (rdlen & (ALIGNMENT - 1))
++			rdlen = roundup(rdlen, ALIGNMENT);
++
++		if ((rdlen + BRCMF_FIRSTREAD) > MAX_RX_DATASZ) {
++			/* Too long -- skip this frame */
++			brcmf_dbg(ERROR, "too long: len %d rdlen %d\n",
++				  len, rdlen);
++			bus->sdiodev->bus_if->dstats.rx_errors++;
++			bus->rx_toolong++;
++			brcmf_sdbrcm_rxfail(bus, false, false);
++			continue;
++		}
++
++		pkt = brcmu_pkt_buf_get_skb(rdlen +
++					    BRCMF_FIRSTREAD + BRCMF_SDALIGN);
++		if (!pkt) {
++			/* Give up on data, request rtx of events */
++			brcmf_dbg(ERROR, "brcmu_pkt_buf_get_skb failed: rdlen %d chan %d\n",
++				  rdlen, chan);
++			bus->sdiodev->bus_if->dstats.rx_dropped++;
++			brcmf_sdbrcm_rxfail(bus, false, RETRYCHAN(chan));
++			continue;
++		}
++
++		/* Leave room for what we already read, and align remainder */
++		skb_pull(pkt, BRCMF_FIRSTREAD);
++		pkt_align(pkt, rdlen, BRCMF_SDALIGN);
++
++		/* Read the remaining frame data */
++		sdret = brcmf_sdcard_recv_pkt(bus->sdiodev, bus->sdiodev->sbwad,
++					      SDIO_FUNC_2, F2SYNC, pkt);
++		bus->f2rxdata++;
++
++		if (sdret < 0) {
++			brcmf_dbg(ERROR, "read %d %s bytes failed: %d\n", rdlen,
++				  ((chan == SDPCM_EVENT_CHANNEL) ? "event"
++				   : ((chan == SDPCM_DATA_CHANNEL) ? "data"
++				      : "test")), sdret);
++			brcmu_pkt_buf_free_skb(pkt);
++			bus->sdiodev->bus_if->dstats.rx_errors++;
++			brcmf_sdbrcm_rxfail(bus, true, RETRYCHAN(chan));
++			continue;
++		}
++
++		/* Copy the already-read portion */
++		skb_push(pkt, BRCMF_FIRSTREAD);
++		memcpy(pkt->data, bus->rxhdr, BRCMF_FIRSTREAD);
++
++		brcmf_dbg_hex_dump(BRCMF_BYTES_ON() && BRCMF_DATA_ON(),
++				   pkt->data, len, "Rx Data:\n");
++
++deliver:
++		/* Save superframe descriptor and allocate packet frame */
++		if (chan == SDPCM_GLOM_CHANNEL) {
++			if (SDPCM_GLOMDESC(&bus->rxhdr[SDPCM_FRAMETAG_LEN])) {
++				brcmf_dbg(GLOM, "glom descriptor, %d bytes:\n",
++					  len);
++				brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
++						   pkt->data, len,
++						   "Glom Data:\n");
++				__skb_trim(pkt, len);
++				skb_pull(pkt, SDPCM_HDRLEN);
++				bus->glomd = pkt;
++			} else {
++				brcmf_dbg(ERROR, "%s: glom superframe w/o "
++					  "descriptor!\n", __func__);
++				brcmf_sdbrcm_rxfail(bus, false, false);
++			}
++			continue;
++		}
++
++		/* Fill in packet len and prio, deliver upward */
++		__skb_trim(pkt, len);
++		skb_pull(pkt, doff);
++
++		if (pkt->len == 0) {
++			brcmu_pkt_buf_free_skb(pkt);
++			continue;
++		} else if (brcmf_proto_hdrpull(bus->sdiodev->dev, &ifidx,
++			   pkt) != 0) {
++			brcmf_dbg(ERROR, "rx protocol error\n");
++			brcmu_pkt_buf_free_skb(pkt);
++			bus->sdiodev->bus_if->dstats.rx_errors++;
++			continue;
++		}
++
++		/* Unlock during rx call */
++		up(&bus->sdsem);
++		brcmf_rx_packet(bus->sdiodev->dev, ifidx, pkt);
++		down(&bus->sdsem);
++	}
++	rxcount = maxframes - rxleft;
++	/* Message if we hit the limit */
++	if (!rxleft)
++		brcmf_dbg(DATA, "hit rx limit of %d frames\n",
++			  maxframes);
++	else
++		brcmf_dbg(DATA, "processed %d frames\n", rxcount);
++	/* Back off rxseq if awaiting rtx, update rx_seq */
++	if (bus->rxskip)
++		rxseq--;
++	bus->rx_seq = rxseq;
++
++	return rxcount;
++}
++
++static void
++brcmf_sdbrcm_wait_for_event(struct brcmf_sdio *bus, bool *lockvar)
++{
++	up(&bus->sdsem);
++	wait_event_interruptible_timeout(bus->ctrl_wait, !*lockvar, HZ * 2);
++	down(&bus->sdsem);
++	return;
++}
++
++static void
++brcmf_sdbrcm_wait_event_wakeup(struct brcmf_sdio *bus)
++{
++	if (waitqueue_active(&bus->ctrl_wait))
++		wake_up_interruptible(&bus->ctrl_wait);
++	return;
++}
++
++/* Writes a HW/SW header into the packet and sends it. */
++/* Assumes: (a) header space already there, (b) caller holds lock */
++static int brcmf_sdbrcm_txpkt(struct brcmf_sdio *bus, struct sk_buff *pkt,
++			      uint chan, bool free_pkt)
++{
++	int ret;
++	u8 *frame;
++	u16 len, pad = 0;
++	u32 swheader;
++	struct sk_buff *new;
++	int i;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	frame = (u8 *) (pkt->data);
++
++	/* Add alignment padding, allocate new packet if needed */
++	pad = ((unsigned long)frame % BRCMF_SDALIGN);
++	if (pad) {
++		if (skb_headroom(pkt) < pad) {
++			brcmf_dbg(INFO, "insufficient headroom %d for %d pad\n",
++				  skb_headroom(pkt), pad);
++			bus->sdiodev->bus_if->tx_realloc++;
++			new = brcmu_pkt_buf_get_skb(pkt->len + BRCMF_SDALIGN);
++			if (!new) {
++				brcmf_dbg(ERROR, "couldn't allocate new %d-byte packet\n",
++					  pkt->len + BRCMF_SDALIGN);
++				ret = -ENOMEM;
++				goto done;
++			}
++
++			pkt_align(new, pkt->len, BRCMF_SDALIGN);
++			memcpy(new->data, pkt->data, pkt->len);
++			if (free_pkt)
++				brcmu_pkt_buf_free_skb(pkt);
++			/* free the pkt if canned one is not used */
++			free_pkt = true;
++			pkt = new;
++			frame = (u8 *) (pkt->data);
++			/* precondition: (frame % BRCMF_SDALIGN) == 0) */
++			pad = 0;
++		} else {
++			skb_push(pkt, pad);
++			frame = (u8 *) (pkt->data);
++			/* precondition: pad + SDPCM_HDRLEN <= pkt->len */
++			memset(frame, 0, pad + SDPCM_HDRLEN);
++		}
++	}
++	/* precondition: pad < BRCMF_SDALIGN */
++
++	/* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
++	len = (u16) (pkt->len);
++	*(__le16 *) frame = cpu_to_le16(len);
++	*(((__le16 *) frame) + 1) = cpu_to_le16(~len);
++
++	/* Software tag: channel, sequence number, data offset */
++	swheader =
++	    ((chan << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK) | bus->tx_seq |
++	    (((pad +
++	       SDPCM_HDRLEN) << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
++
++	put_unaligned_le32(swheader, frame + SDPCM_FRAMETAG_LEN);
++	put_unaligned_le32(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
++
++#ifdef DEBUG
++	tx_packets[pkt->priority]++;
++#endif
++
++	brcmf_dbg_hex_dump(BRCMF_BYTES_ON() &&
++			   ((BRCMF_CTL_ON() && chan == SDPCM_CONTROL_CHANNEL) ||
++			    (BRCMF_DATA_ON() && chan != SDPCM_CONTROL_CHANNEL)),
++			   frame, len, "Tx Frame:\n");
++	brcmf_dbg_hex_dump(!(BRCMF_BYTES_ON() &&
++			     ((BRCMF_CTL_ON() &&
++			       chan == SDPCM_CONTROL_CHANNEL) ||
++			      (BRCMF_DATA_ON() &&
++			       chan != SDPCM_CONTROL_CHANNEL))) &&
++			   BRCMF_HDRS_ON(),
++			   frame, min_t(u16, len, 16), "TxHdr:\n");
++
++	/* Raise len to next SDIO block to eliminate tail command */
++	if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
++		u16 pad = bus->blocksize - (len % bus->blocksize);
++		if ((pad <= bus->roundup) && (pad < bus->blocksize))
++				len += pad;
++	} else if (len % BRCMF_SDALIGN) {
++		len += BRCMF_SDALIGN - (len % BRCMF_SDALIGN);
++	}
++
++	/* Some controllers have trouble with odd bytes -- round to even */
++	if (len & (ALIGNMENT - 1))
++			len = roundup(len, ALIGNMENT);
++
++	ret = brcmf_sdcard_send_pkt(bus->sdiodev, bus->sdiodev->sbwad,
++				    SDIO_FUNC_2, F2SYNC, pkt);
++	bus->f2txdata++;
++
++	if (ret < 0) {
++		/* On failure, abort the command and terminate the frame */
++		brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
++			  ret);
++		bus->tx_sderrs++;
++
++		brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
++		brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
++				 SFC_WF_TERM, NULL);
++		bus->f1regdata++;
++
++		for (i = 0; i < 3; i++) {
++			u8 hi, lo;
++			hi = brcmf_sdio_regrb(bus->sdiodev,
++					      SBSDIO_FUNC1_WFRAMEBCHI, NULL);
++			lo = brcmf_sdio_regrb(bus->sdiodev,
++					      SBSDIO_FUNC1_WFRAMEBCLO, NULL);
++			bus->f1regdata += 2;
++			if ((hi == 0) && (lo == 0))
++				break;
++		}
++
++	}
++	if (ret == 0)
++		bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
++
++done:
++	/* restore pkt buffer pointer before calling tx complete routine */
++	skb_pull(pkt, SDPCM_HDRLEN + pad);
++	up(&bus->sdsem);
++	brcmf_txcomplete(bus->sdiodev->dev, pkt, ret != 0);
++	down(&bus->sdsem);
++
++	if (free_pkt)
++		brcmu_pkt_buf_free_skb(pkt);
++
++	return ret;
++}
++
++static uint brcmf_sdbrcm_sendfromq(struct brcmf_sdio *bus, uint maxframes)
++{
++	struct sk_buff *pkt;
++	u32 intstatus = 0;
++	int ret = 0, prec_out;
++	uint cnt = 0;
++	uint datalen;
++	u8 tx_prec_map;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	tx_prec_map = ~bus->flowcontrol;
++
++	/* Send frames until the limit or some other event */
++	for (cnt = 0; (cnt < maxframes) && data_ok(bus); cnt++) {
++		spin_lock_bh(&bus->txqlock);
++		pkt = brcmu_pktq_mdeq(&bus->txq, tx_prec_map, &prec_out);
++		if (pkt == NULL) {
++			spin_unlock_bh(&bus->txqlock);
++			break;
++		}
++		spin_unlock_bh(&bus->txqlock);
++		datalen = pkt->len - SDPCM_HDRLEN;
++
++		ret = brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_DATA_CHANNEL, true);
++		if (ret)
++			bus->sdiodev->bus_if->dstats.tx_errors++;
++		else
++			bus->sdiodev->bus_if->dstats.tx_bytes += datalen;
++
++		/* In poll mode, need to check for other events */
++		if (!bus->intr && cnt) {
++			/* Check device status, signal pending interrupt */
++			ret = r_sdreg32(bus, &intstatus,
++					offsetof(struct sdpcmd_regs,
++						 intstatus));
++			bus->f2txdata++;
++			if (ret != 0)
++				break;
++			if (intstatus & bus->hostintmask)
++				bus->ipend = true;
++		}
++	}
++
++	/* Deflow-control stack if needed */
++	if (bus->sdiodev->bus_if->drvr_up &&
++	    (bus->sdiodev->bus_if->state == BRCMF_BUS_DATA) &&
++	    bus->txoff && (pktq_len(&bus->txq) < TXLOW)) {
++		bus->txoff = OFF;
++		brcmf_txflowcontrol(bus->sdiodev->dev, 0, OFF);
++	}
++
++	return cnt;
++}
++
++static void brcmf_sdbrcm_bus_stop(struct device *dev)
++{
++	u32 local_hostintmask;
++	u8 saveclk;
++	int err;
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
++	struct brcmf_sdio *bus = sdiodev->bus;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	if (bus->watchdog_tsk) {
++		send_sig(SIGTERM, bus->watchdog_tsk, 1);
++		kthread_stop(bus->watchdog_tsk);
++		bus->watchdog_tsk = NULL;
++	}
++
++	if (bus->dpc_tsk && bus->dpc_tsk != current) {
++		send_sig(SIGTERM, bus->dpc_tsk, 1);
++		kthread_stop(bus->dpc_tsk);
++		bus->dpc_tsk = NULL;
++	}
++
++	down(&bus->sdsem);
++
++	bus_wake(bus);
++
++	/* Enable clock for device interrupts */
++	brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
++
++	/* Disable and clear interrupts at the chip level also */
++	w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, hostintmask));
++	local_hostintmask = bus->hostintmask;
++	bus->hostintmask = 0;
++
++	/* Change our idea of bus state */
++	bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
++
++	/* Force clocks on backplane to be sure F2 interrupt propagates */
++	saveclk = brcmf_sdio_regrb(bus->sdiodev,
++				   SBSDIO_FUNC1_CHIPCLKCSR, &err);
++	if (!err) {
++		brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
++				 (saveclk | SBSDIO_FORCE_HT), &err);
++	}
++	if (err)
++		brcmf_dbg(ERROR, "Failed to force clock for F2: err %d\n", err);
++
++	/* Turn off the bus (F2), free any pending packets */
++	brcmf_dbg(INTR, "disable SDIO interrupts\n");
++	brcmf_sdio_regwb(bus->sdiodev, SDIO_CCCR_IOEx, SDIO_FUNC_ENABLE_1,
++			 NULL);
++
++	/* Clear any pending interrupts now that F2 is disabled */
++	w_sdreg32(bus, local_hostintmask,
++		  offsetof(struct sdpcmd_regs, intstatus));
++
++	/* Turn off the backplane clock (only) */
++	brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
++
++	/* Clear the data packet queues */
++	brcmu_pktq_flush(&bus->txq, true, NULL, NULL);
++
++	/* Clear any held glomming stuff */
++	if (bus->glomd)
++		brcmu_pkt_buf_free_skb(bus->glomd);
++	brcmf_sdbrcm_free_glom(bus);
++
++	/* Clear rx control and wake any waiters */
++	bus->rxlen = 0;
++	brcmf_sdbrcm_dcmd_resp_wake(bus);
++
++	/* Reset some F2 state stuff */
++	bus->rxskip = false;
++	bus->tx_seq = bus->rx_seq = 0;
++
++	up(&bus->sdsem);
++}
++
++#ifdef CONFIG_BRCMFMAC_SDIO_OOB
++static inline void brcmf_sdbrcm_clrintr(struct brcmf_sdio *bus)
++{
++	unsigned long flags;
++
++	spin_lock_irqsave(&bus->sdiodev->irq_en_lock, flags);
++	if (!bus->sdiodev->irq_en && !bus->ipend) {
++		enable_irq(bus->sdiodev->irq);
++		bus->sdiodev->irq_en = true;
++	}
++	spin_unlock_irqrestore(&bus->sdiodev->irq_en_lock, flags);
++}
++#else
++static inline void brcmf_sdbrcm_clrintr(struct brcmf_sdio *bus)
++{
++}
++#endif		/* CONFIG_BRCMFMAC_SDIO_OOB */
++
++static bool brcmf_sdbrcm_dpc(struct brcmf_sdio *bus)
++{
++	u32 intstatus, newstatus = 0;
++	uint rxlimit = bus->rxbound;	/* Rx frames to read before resched */
++	uint txlimit = bus->txbound;	/* Tx frames to send before resched */
++	uint framecnt = 0;	/* Temporary counter of tx/rx frames */
++	bool rxdone = true;	/* Flag for no more read data */
++	bool resched = false;	/* Flag indicating resched wanted */
++	int err = 0;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	/* Start with leftover status bits */
++	intstatus = bus->intstatus;
++
++	down(&bus->sdsem);
++
++	/* If waiting for HTAVAIL, check status */
++	if (bus->clkstate == CLK_PENDING) {
++		u8 clkctl, devctl = 0;
++
++#ifdef DEBUG
++		/* Check for inconsistent device control */
++		devctl = brcmf_sdio_regrb(bus->sdiodev,
++					  SBSDIO_DEVICE_CTL, &err);
++		if (err) {
++			brcmf_dbg(ERROR, "error reading DEVCTL: %d\n", err);
++			bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
++		}
++#endif				/* DEBUG */
++
++		/* Read CSR, if clock on switch to AVAIL, else ignore */
++		clkctl = brcmf_sdio_regrb(bus->sdiodev,
++					  SBSDIO_FUNC1_CHIPCLKCSR, &err);
++		if (err) {
++			brcmf_dbg(ERROR, "error reading CSR: %d\n",
++				  err);
++			bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
++		}
++
++		brcmf_dbg(INFO, "DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n",
++			  devctl, clkctl);
++
++		if (SBSDIO_HTAV(clkctl)) {
++			devctl = brcmf_sdio_regrb(bus->sdiodev,
++						  SBSDIO_DEVICE_CTL, &err);
++			if (err) {
++				brcmf_dbg(ERROR, "error reading DEVCTL: %d\n",
++					  err);
++				bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
++			}
++			devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
++			brcmf_sdio_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
++					 devctl, &err);
++			if (err) {
++				brcmf_dbg(ERROR, "error writing DEVCTL: %d\n",
++					  err);
++				bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
++			}
++			bus->clkstate = CLK_AVAIL;
++		} else {
++			goto clkwait;
++		}
++	}
++
++	bus_wake(bus);
++
++	/* Make sure backplane clock is on */
++	brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, true);
++	if (bus->clkstate == CLK_PENDING)
++		goto clkwait;
++
++	/* Pending interrupt indicates new device status */
++	if (bus->ipend) {
++		bus->ipend = false;
++		err = r_sdreg32(bus, &newstatus,
++				offsetof(struct sdpcmd_regs, intstatus));
++		bus->f1regdata++;
++		if (err != 0)
++			newstatus = 0;
++		newstatus &= bus->hostintmask;
++		bus->fcstate = !!(newstatus & I_HMB_FC_STATE);
++		if (newstatus) {
++			err = w_sdreg32(bus, newstatus,
++					offsetof(struct sdpcmd_regs,
++						 intstatus));
++			bus->f1regdata++;
++		}
++	}
++
++	/* Merge new bits with previous */
++	intstatus |= newstatus;
++	bus->intstatus = 0;
++
++	/* Handle flow-control change: read new state in case our ack
++	 * crossed another change interrupt.  If change still set, assume
++	 * FC ON for safety, let next loop through do the debounce.
++	 */
++	if (intstatus & I_HMB_FC_CHANGE) {
++		intstatus &= ~I_HMB_FC_CHANGE;
++		err = w_sdreg32(bus, I_HMB_FC_CHANGE,
++				offsetof(struct sdpcmd_regs, intstatus));
++
++		err = r_sdreg32(bus, &newstatus,
++				offsetof(struct sdpcmd_regs, intstatus));
++		bus->f1regdata += 2;
++		bus->fcstate =
++		    !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE));
++		intstatus |= (newstatus & bus->hostintmask);
++	}
++
++	/* Handle host mailbox indication */
++	if (intstatus & I_HMB_HOST_INT) {
++		intstatus &= ~I_HMB_HOST_INT;
++		intstatus |= brcmf_sdbrcm_hostmail(bus);
++	}
++
++	/* Generally don't ask for these, can get CRC errors... */
++	if (intstatus & I_WR_OOSYNC) {
++		brcmf_dbg(ERROR, "Dongle reports WR_OOSYNC\n");
++		intstatus &= ~I_WR_OOSYNC;
++	}
++
++	if (intstatus & I_RD_OOSYNC) {
++		brcmf_dbg(ERROR, "Dongle reports RD_OOSYNC\n");
++		intstatus &= ~I_RD_OOSYNC;
++	}
++
++	if (intstatus & I_SBINT) {
++		brcmf_dbg(ERROR, "Dongle reports SBINT\n");
++		intstatus &= ~I_SBINT;
++	}
++
++	/* Would be active due to wake-wlan in gSPI */
++	if (intstatus & I_CHIPACTIVE) {
++		brcmf_dbg(INFO, "Dongle reports CHIPACTIVE\n");
++		intstatus &= ~I_CHIPACTIVE;
++	}
++
++	/* Ignore frame indications if rxskip is set */
++	if (bus->rxskip)
++		intstatus &= ~I_HMB_FRAME_IND;
++
++	/* On frame indication, read available frames */
++	if (PKT_AVAILABLE()) {
++		framecnt = brcmf_sdbrcm_readframes(bus, rxlimit, &rxdone);
++		if (rxdone || bus->rxskip)
++			intstatus &= ~I_HMB_FRAME_IND;
++		rxlimit -= min(framecnt, rxlimit);
++	}
++
++	/* Keep still-pending events for next scheduling */
++	bus->intstatus = intstatus;
++
++clkwait:
++	brcmf_sdbrcm_clrintr(bus);
++
++	if (data_ok(bus) && bus->ctrl_frame_stat &&
++		(bus->clkstate == CLK_AVAIL)) {
++		int ret, i;
++
++		ret = brcmf_sdcard_send_buf(bus->sdiodev, bus->sdiodev->sbwad,
++			SDIO_FUNC_2, F2SYNC, (u8 *) bus->ctrl_frame_buf,
++			(u32) bus->ctrl_frame_len);
++
++		if (ret < 0) {
++			/* On failure, abort the command and
++				terminate the frame */
++			brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
++				  ret);
++			bus->tx_sderrs++;
++
++			brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
++
++			brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
++					 SFC_WF_TERM, &err);
++			bus->f1regdata++;
++
++			for (i = 0; i < 3; i++) {
++				u8 hi, lo;
++				hi = brcmf_sdio_regrb(bus->sdiodev,
++						      SBSDIO_FUNC1_WFRAMEBCHI,
++						      &err);
++				lo = brcmf_sdio_regrb(bus->sdiodev,
++						      SBSDIO_FUNC1_WFRAMEBCLO,
++						      &err);
++				bus->f1regdata += 2;
++				if ((hi == 0) && (lo == 0))
++					break;
++			}
++
++		}
++		if (ret == 0)
++			bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
++
++		brcmf_dbg(INFO, "Return_dpc value is : %d\n", ret);
++		bus->ctrl_frame_stat = false;
++		brcmf_sdbrcm_wait_event_wakeup(bus);
++	}
++	/* Send queued frames (limit 1 if rx may still be pending) */
++	else if ((bus->clkstate == CLK_AVAIL) && !bus->fcstate &&
++		 brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) && txlimit
++		 && data_ok(bus)) {
++		framecnt = rxdone ? txlimit : min(txlimit, bus->txminmax);
++		framecnt = brcmf_sdbrcm_sendfromq(bus, framecnt);
++		txlimit -= framecnt;
++	}
++
++	/* Resched if events or tx frames are pending,
++		 else await next interrupt */
++	/* On failed register access, all bets are off:
++		 no resched or interrupts */
++	if ((bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN) || (err != 0)) {
++		brcmf_dbg(ERROR, "failed backplane access over SDIO, halting operation\n");
++		bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
++		bus->intstatus = 0;
++	} else if (bus->clkstate == CLK_PENDING) {
++		brcmf_dbg(INFO, "rescheduled due to CLK_PENDING awaiting I_CHIPACTIVE interrupt\n");
++		resched = true;
++	} else if (bus->intstatus || bus->ipend ||
++		(!bus->fcstate && brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol)
++		 && data_ok(bus)) || PKT_AVAILABLE()) {
++		resched = true;
++	}
++
++	bus->dpc_sched = resched;
++
++	/* If we're done for now, turn off clock request. */
++	if ((bus->clkstate != CLK_PENDING)
++	    && bus->idletime == BRCMF_IDLE_IMMEDIATE) {
++		bus->activity = false;
++		brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
++	}
++
++	up(&bus->sdsem);
++
++	return resched;
++}
++
++static inline void brcmf_sdbrcm_adddpctsk(struct brcmf_sdio *bus)
++{
++	struct list_head *new_hd;
++	unsigned long flags;
++
++	if (in_interrupt())
++		new_hd = kzalloc(sizeof(struct list_head), GFP_ATOMIC);
++	else
++		new_hd = kzalloc(sizeof(struct list_head), GFP_KERNEL);
++	if (new_hd == NULL)
++		return;
++
++	spin_lock_irqsave(&bus->dpc_tl_lock, flags);
++	list_add_tail(new_hd, &bus->dpc_tsklst);
++	spin_unlock_irqrestore(&bus->dpc_tl_lock, flags);
++}
++
++static int brcmf_sdbrcm_dpc_thread(void *data)
++{
++	struct brcmf_sdio *bus = (struct brcmf_sdio *) data;
++	struct list_head *cur_hd, *tmp_hd;
++	unsigned long flags;
++
++	allow_signal(SIGTERM);
++	/* Run until signal received */
++	while (1) {
++		if (kthread_should_stop())
++			break;
++
++		if (list_empty(&bus->dpc_tsklst))
++			if (wait_for_completion_interruptible(&bus->dpc_wait))
++				break;
++
++		spin_lock_irqsave(&bus->dpc_tl_lock, flags);
++		list_for_each_safe(cur_hd, tmp_hd, &bus->dpc_tsklst) {
++			spin_unlock_irqrestore(&bus->dpc_tl_lock, flags);
++
++			if (bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN) {
++				/* after stopping the bus, exit thread */
++				brcmf_sdbrcm_bus_stop(bus->sdiodev->dev);
++				bus->dpc_tsk = NULL;
++				spin_lock_irqsave(&bus->dpc_tl_lock, flags);
++				break;
++			}
++
++			if (brcmf_sdbrcm_dpc(bus))
++				brcmf_sdbrcm_adddpctsk(bus);
++
++			spin_lock_irqsave(&bus->dpc_tl_lock, flags);
++			list_del(cur_hd);
++			kfree(cur_hd);
++		}
++		spin_unlock_irqrestore(&bus->dpc_tl_lock, flags);
++	}
++	return 0;
++}
++
++static int brcmf_sdbrcm_bus_txdata(struct device *dev, struct sk_buff *pkt)
++{
++	int ret = -EBADE;
++	uint datalen, prec;
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
++	struct brcmf_sdio *bus = sdiodev->bus;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	datalen = pkt->len;
++
++	/* Add space for the header */
++	skb_push(pkt, SDPCM_HDRLEN);
++	/* precondition: IS_ALIGNED((unsigned long)(pkt->data), 2) */
++
++	prec = prio2prec((pkt->priority & PRIOMASK));
++
++	/* Check for existing queue, current flow-control,
++			 pending event, or pending clock */
++	brcmf_dbg(TRACE, "deferring pktq len %d\n", pktq_len(&bus->txq));
++	bus->fcqueued++;
++
++	/* Priority based enq */
++	spin_lock_bh(&bus->txqlock);
++	if (!brcmf_c_prec_enq(bus->sdiodev->dev, &bus->txq, pkt, prec)) {
++		skb_pull(pkt, SDPCM_HDRLEN);
++		brcmf_txcomplete(bus->sdiodev->dev, pkt, false);
++		brcmu_pkt_buf_free_skb(pkt);
++		brcmf_dbg(ERROR, "out of bus->txq !!!\n");
++		ret = -ENOSR;
++	} else {
++		ret = 0;
++	}
++	spin_unlock_bh(&bus->txqlock);
++
++	if (pktq_len(&bus->txq) >= TXHI) {
++		bus->txoff = ON;
++		brcmf_txflowcontrol(bus->sdiodev->dev, 0, ON);
++	}
++
++#ifdef DEBUG
++	if (pktq_plen(&bus->txq, prec) > qcount[prec])
++		qcount[prec] = pktq_plen(&bus->txq, prec);
++#endif
++	/* Schedule DPC if needed to send queued packet(s) */
++	if (!bus->dpc_sched) {
++		bus->dpc_sched = true;
++		if (bus->dpc_tsk) {
++			brcmf_sdbrcm_adddpctsk(bus);
++			complete(&bus->dpc_wait);
++		}
++	}
++
++	return ret;
++}
++
++static int
++brcmf_sdbrcm_membytes(struct brcmf_sdio *bus, bool write, u32 address, u8 *data,
++		 uint size)
++{
++	int bcmerror = 0;
++	u32 sdaddr;
++	uint dsize;
++
++	/* Determine initial transfer parameters */
++	sdaddr = address & SBSDIO_SB_OFT_ADDR_MASK;
++	if ((sdaddr + size) & SBSDIO_SBWINDOW_MASK)
++		dsize = (SBSDIO_SB_OFT_ADDR_LIMIT - sdaddr);
++	else
++		dsize = size;
++
++	/* Set the backplane window to include the start address */
++	bcmerror = brcmf_sdcard_set_sbaddr_window(bus->sdiodev, address);
++	if (bcmerror) {
++		brcmf_dbg(ERROR, "window change failed\n");
++		goto xfer_done;
++	}
++
++	/* Do the transfer(s) */
++	while (size) {
++		brcmf_dbg(INFO, "%s %d bytes at offset 0x%08x in window 0x%08x\n",
++			  write ? "write" : "read", dsize,
++			  sdaddr, address & SBSDIO_SBWINDOW_MASK);
++		bcmerror = brcmf_sdcard_rwdata(bus->sdiodev, write,
++					       sdaddr, data, dsize);
++		if (bcmerror) {
++			brcmf_dbg(ERROR, "membytes transfer failed\n");
++			break;
++		}
++
++		/* Adjust for next transfer (if any) */
++		size -= dsize;
++		if (size) {
++			data += dsize;
++			address += dsize;
++			bcmerror = brcmf_sdcard_set_sbaddr_window(bus->sdiodev,
++								  address);
++			if (bcmerror) {
++				brcmf_dbg(ERROR, "window change failed\n");
++				break;
++			}
++			sdaddr = 0;
++			dsize = min_t(uint, SBSDIO_SB_OFT_ADDR_LIMIT, size);
++		}
++	}
++
++xfer_done:
++	/* Return the window to backplane enumeration space for core access */
++	if (brcmf_sdcard_set_sbaddr_window(bus->sdiodev, bus->sdiodev->sbwad))
++		brcmf_dbg(ERROR, "FAILED to set window back to 0x%x\n",
++			  bus->sdiodev->sbwad);
++
++	return bcmerror;
++}
++
++#ifdef DEBUG
++#define CONSOLE_LINE_MAX	192
++
++static int brcmf_sdbrcm_readconsole(struct brcmf_sdio *bus)
++{
++	struct brcmf_console *c = &bus->console;
++	u8 line[CONSOLE_LINE_MAX], ch;
++	u32 n, idx, addr;
++	int rv;
++
++	/* Don't do anything until FWREADY updates console address */
++	if (bus->console_addr == 0)
++		return 0;
++
++	/* Read console log struct */
++	addr = bus->console_addr + offsetof(struct rte_console, log_le);
++	rv = brcmf_sdbrcm_membytes(bus, false, addr, (u8 *)&c->log_le,
++				   sizeof(c->log_le));
++	if (rv < 0)
++		return rv;
++
++	/* Allocate console buffer (one time only) */
++	if (c->buf == NULL) {
++		c->bufsize = le32_to_cpu(c->log_le.buf_size);
++		c->buf = kmalloc(c->bufsize, GFP_ATOMIC);
++		if (c->buf == NULL)
++			return -ENOMEM;
++	}
++
++	idx = le32_to_cpu(c->log_le.idx);
++
++	/* Protect against corrupt value */
++	if (idx > c->bufsize)
++		return -EBADE;
++
++	/* Skip reading the console buffer if the index pointer
++	 has not moved */
++	if (idx == c->last)
++		return 0;
++
++	/* Read the console buffer */
++	addr = le32_to_cpu(c->log_le.buf);
++	rv = brcmf_sdbrcm_membytes(bus, false, addr, c->buf, c->bufsize);
++	if (rv < 0)
++		return rv;
++
++	while (c->last != idx) {
++		for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
++			if (c->last == idx) {
++				/* This would output a partial line.
++				 * Instead, back up
++				 * the buffer pointer and output this
++				 * line next time around.
++				 */
++				if (c->last >= n)
++					c->last -= n;
++				else
++					c->last = c->bufsize - n;
++				goto break2;
++			}
++			ch = c->buf[c->last];
++			c->last = (c->last + 1) % c->bufsize;
++			if (ch == '\n')
++				break;
++			line[n] = ch;
++		}
++
++		if (n > 0) {
++			if (line[n - 1] == '\r')
++				n--;
++			line[n] = 0;
++			pr_debug("CONSOLE: %s\n", line);
++		}
++	}
++break2:
++
++	return 0;
++}
++#endif				/* DEBUG */
++
++static int brcmf_tx_frame(struct brcmf_sdio *bus, u8 *frame, u16 len)
++{
++	int i;
++	int ret;
++
++	bus->ctrl_frame_stat = false;
++	ret = brcmf_sdcard_send_buf(bus->sdiodev, bus->sdiodev->sbwad,
++				    SDIO_FUNC_2, F2SYNC, frame, len);
++
++	if (ret < 0) {
++		/* On failure, abort the command and terminate the frame */
++		brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
++			  ret);
++		bus->tx_sderrs++;
++
++		brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
++
++		brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
++				 SFC_WF_TERM, NULL);
++		bus->f1regdata++;
++
++		for (i = 0; i < 3; i++) {
++			u8 hi, lo;
++			hi = brcmf_sdio_regrb(bus->sdiodev,
++					      SBSDIO_FUNC1_WFRAMEBCHI, NULL);
++			lo = brcmf_sdio_regrb(bus->sdiodev,
++					      SBSDIO_FUNC1_WFRAMEBCLO, NULL);
++			bus->f1regdata += 2;
++			if (hi == 0 && lo == 0)
++				break;
++		}
++		return ret;
++	}
++
++	bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
++
++	return ret;
++}
++
++static int
++brcmf_sdbrcm_bus_txctl(struct device *dev, unsigned char *msg, uint msglen)
++{
++	u8 *frame;
++	u16 len;
++	u32 swheader;
++	uint retries = 0;
++	u8 doff = 0;
++	int ret = -1;
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
++	struct brcmf_sdio *bus = sdiodev->bus;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	/* Back the pointer to make a room for bus header */
++	frame = msg - SDPCM_HDRLEN;
++	len = (msglen += SDPCM_HDRLEN);
++
++	/* Add alignment padding (optional for ctl frames) */
++	doff = ((unsigned long)frame % BRCMF_SDALIGN);
++	if (doff) {
++		frame -= doff;
++		len += doff;
++		msglen += doff;
++		memset(frame, 0, doff + SDPCM_HDRLEN);
++	}
++	/* precondition: doff < BRCMF_SDALIGN */
++	doff += SDPCM_HDRLEN;
++
++	/* Round send length to next SDIO block */
++	if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
++		u16 pad = bus->blocksize - (len % bus->blocksize);
++		if ((pad <= bus->roundup) && (pad < bus->blocksize))
++			len += pad;
++	} else if (len % BRCMF_SDALIGN) {
++		len += BRCMF_SDALIGN - (len % BRCMF_SDALIGN);
++	}
++
++	/* Satisfy length-alignment requirements */
++	if (len & (ALIGNMENT - 1))
++		len = roundup(len, ALIGNMENT);
++
++	/* precondition: IS_ALIGNED((unsigned long)frame, 2) */
++
++	/* Need to lock here to protect txseq and SDIO tx calls */
++	down(&bus->sdsem);
++
++	bus_wake(bus);
++
++	/* Make sure backplane clock is on */
++	brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
++
++	/* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
++	*(__le16 *) frame = cpu_to_le16((u16) msglen);
++	*(((__le16 *) frame) + 1) = cpu_to_le16(~msglen);
++
++	/* Software tag: channel, sequence number, data offset */
++	swheader =
++	    ((SDPCM_CONTROL_CHANNEL << SDPCM_CHANNEL_SHIFT) &
++	     SDPCM_CHANNEL_MASK)
++	    | bus->tx_seq | ((doff << SDPCM_DOFFSET_SHIFT) &
++			     SDPCM_DOFFSET_MASK);
++	put_unaligned_le32(swheader, frame + SDPCM_FRAMETAG_LEN);
++	put_unaligned_le32(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
++
++	if (!data_ok(bus)) {
++		brcmf_dbg(INFO, "No bus credit bus->tx_max %d, bus->tx_seq %d\n",
++			  bus->tx_max, bus->tx_seq);
++		bus->ctrl_frame_stat = true;
++		/* Send from dpc */
++		bus->ctrl_frame_buf = frame;
++		bus->ctrl_frame_len = len;
++
++		brcmf_sdbrcm_wait_for_event(bus, &bus->ctrl_frame_stat);
++
++		if (!bus->ctrl_frame_stat) {
++			brcmf_dbg(INFO, "ctrl_frame_stat == false\n");
++			ret = 0;
++		} else {
++			brcmf_dbg(INFO, "ctrl_frame_stat == true\n");
++			ret = -1;
++		}
++	}
++
++	if (ret == -1) {
++		brcmf_dbg_hex_dump(BRCMF_BYTES_ON() && BRCMF_CTL_ON(),
++				   frame, len, "Tx Frame:\n");
++		brcmf_dbg_hex_dump(!(BRCMF_BYTES_ON() && BRCMF_CTL_ON()) &&
++				   BRCMF_HDRS_ON(),
++				   frame, min_t(u16, len, 16), "TxHdr:\n");
++
++		do {
++			ret = brcmf_tx_frame(bus, frame, len);
++		} while (ret < 0 && retries++ < TXRETRIES);
++	}
++
++	if ((bus->idletime == BRCMF_IDLE_IMMEDIATE) && !bus->dpc_sched) {
++		bus->activity = false;
++		brcmf_sdbrcm_clkctl(bus, CLK_NONE, true);
++	}
++
++	up(&bus->sdsem);
++
++	if (ret)
++		bus->tx_ctlerrs++;
++	else
++		bus->tx_ctlpkts++;
++
++	return ret ? -EIO : 0;
++}
++
++static int
++brcmf_sdbrcm_bus_rxctl(struct device *dev, unsigned char *msg, uint msglen)
++{
++	int timeleft;
++	uint rxlen = 0;
++	bool pending;
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
++	struct brcmf_sdio *bus = sdiodev->bus;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	/* Wait until control frame is available */
++	timeleft = brcmf_sdbrcm_dcmd_resp_wait(bus, &bus->rxlen, &pending);
++
++	down(&bus->sdsem);
++	rxlen = bus->rxlen;
++	memcpy(msg, bus->rxctl, min(msglen, rxlen));
++	bus->rxlen = 0;
++	up(&bus->sdsem);
++
++	if (rxlen) {
++		brcmf_dbg(CTL, "resumed on rxctl frame, got %d expected %d\n",
++			  rxlen, msglen);
++	} else if (timeleft == 0) {
++		brcmf_dbg(ERROR, "resumed on timeout\n");
++	} else if (pending) {
++		brcmf_dbg(CTL, "cancelled\n");
++		return -ERESTARTSYS;
++	} else {
++		brcmf_dbg(CTL, "resumed for unknown reason?\n");
++	}
++
++	if (rxlen)
++		bus->rx_ctlpkts++;
++	else
++		bus->rx_ctlerrs++;
++
++	return rxlen ? (int)rxlen : -ETIMEDOUT;
++}
++
++static int brcmf_sdbrcm_downloadvars(struct brcmf_sdio *bus, void *arg, int len)
++{
++	int bcmerror = 0;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	/* Basic sanity checks */
++	if (bus->sdiodev->bus_if->drvr_up) {
++		bcmerror = -EISCONN;
++		goto err;
++	}
++	if (!len) {
++		bcmerror = -EOVERFLOW;
++		goto err;
++	}
++
++	/* Free the old ones and replace with passed variables */
++	kfree(bus->vars);
++
++	bus->vars = kmalloc(len, GFP_ATOMIC);
++	bus->varsz = bus->vars ? len : 0;
++	if (bus->vars == NULL) {
++		bcmerror = -ENOMEM;
++		goto err;
++	}
++
++	/* Copy the passed variables, which should include the
++		 terminating double-null */
++	memcpy(bus->vars, arg, bus->varsz);
++err:
++	return bcmerror;
++}
++
++static int brcmf_sdbrcm_write_vars(struct brcmf_sdio *bus)
++{
++	int bcmerror = 0;
++	u32 varsize;
++	u32 varaddr;
++	u8 *vbuffer;
++	u32 varsizew;
++	__le32 varsizew_le;
++#ifdef DEBUG
++	char *nvram_ularray;
++#endif				/* DEBUG */
++
++	/* Even if there are no vars are to be written, we still
++		 need to set the ramsize. */
++	varsize = bus->varsz ? roundup(bus->varsz, 4) : 0;
++	varaddr = (bus->ramsize - 4) - varsize;
++
++	if (bus->vars) {
++		vbuffer = kzalloc(varsize, GFP_ATOMIC);
++		if (!vbuffer)
++			return -ENOMEM;
++
++		memcpy(vbuffer, bus->vars, bus->varsz);
++
++		/* Write the vars list */
++		bcmerror =
++		    brcmf_sdbrcm_membytes(bus, true, varaddr, vbuffer, varsize);
++#ifdef DEBUG
++		/* Verify NVRAM bytes */
++		brcmf_dbg(INFO, "Compare NVRAM dl & ul; varsize=%d\n", varsize);
++		nvram_ularray = kmalloc(varsize, GFP_ATOMIC);
++		if (!nvram_ularray) {
++			kfree(vbuffer);
++			return -ENOMEM;
++		}
++
++		/* Upload image to verify downloaded contents. */
++		memset(nvram_ularray, 0xaa, varsize);
++
++		/* Read the vars list to temp buffer for comparison */
++		bcmerror =
++		    brcmf_sdbrcm_membytes(bus, false, varaddr, nvram_ularray,
++				     varsize);
++		if (bcmerror) {
++			brcmf_dbg(ERROR, "error %d on reading %d nvram bytes at 0x%08x\n",
++				  bcmerror, varsize, varaddr);
++		}
++		/* Compare the org NVRAM with the one read from RAM */
++		if (memcmp(vbuffer, nvram_ularray, varsize))
++			brcmf_dbg(ERROR, "Downloaded NVRAM image is corrupted\n");
++		else
++			brcmf_dbg(ERROR, "Download/Upload/Compare of NVRAM ok\n");
++
++		kfree(nvram_ularray);
++#endif				/* DEBUG */
++
++		kfree(vbuffer);
++	}
++
++	/* adjust to the user specified RAM */
++	brcmf_dbg(INFO, "Physical memory size: %d\n", bus->ramsize);
++	brcmf_dbg(INFO, "Vars are at %d, orig varsize is %d\n",
++		  varaddr, varsize);
++	varsize = ((bus->ramsize - 4) - varaddr);
++
++	/*
++	 * Determine the length token:
++	 * Varsize, converted to words, in lower 16-bits, checksum
++	 * in upper 16-bits.
++	 */
++	if (bcmerror) {
++		varsizew = 0;
++		varsizew_le = cpu_to_le32(0);
++	} else {
++		varsizew = varsize / 4;
++		varsizew = (~varsizew << 16) | (varsizew & 0x0000FFFF);
++		varsizew_le = cpu_to_le32(varsizew);
++	}
++
++	brcmf_dbg(INFO, "New varsize is %d, length token=0x%08x\n",
++		  varsize, varsizew);
++
++	/* Write the length token to the last word */
++	bcmerror = brcmf_sdbrcm_membytes(bus, true, (bus->ramsize - 4),
++					 (u8 *)&varsizew_le, 4);
++
++	return bcmerror;
++}
++
++static int brcmf_sdbrcm_download_state(struct brcmf_sdio *bus, bool enter)
++{
++	int bcmerror = 0;
++	struct chip_info *ci = bus->ci;
++
++	/* To enter download state, disable ARM and reset SOCRAM.
++	 * To exit download state, simply reset ARM (default is RAM boot).
++	 */
++	if (enter) {
++		bus->alp_only = true;
++
++		ci->coredisable(bus->sdiodev, ci, BCMA_CORE_ARM_CM3);
++
++		ci->resetcore(bus->sdiodev, ci, BCMA_CORE_INTERNAL_MEM);
++
++		/* Clear the top bit of memory */
++		if (bus->ramsize) {
++			u32 zeros = 0;
++			brcmf_sdbrcm_membytes(bus, true, bus->ramsize - 4,
++					 (u8 *)&zeros, 4);
++		}
++	} else {
++		if (!ci->iscoreup(bus->sdiodev, ci, BCMA_CORE_INTERNAL_MEM)) {
++			brcmf_dbg(ERROR, "SOCRAM core is down after reset?\n");
++			bcmerror = -EBADE;
++			goto fail;
++		}
++
++		bcmerror = brcmf_sdbrcm_write_vars(bus);
++		if (bcmerror) {
++			brcmf_dbg(ERROR, "no vars written to RAM\n");
++			bcmerror = 0;
++		}
++
++		w_sdreg32(bus, 0xFFFFFFFF,
++			  offsetof(struct sdpcmd_regs, intstatus));
++
++		ci->resetcore(bus->sdiodev, ci, BCMA_CORE_ARM_CM3);
++
++		/* Allow HT Clock now that the ARM is running. */
++		bus->alp_only = false;
++
++		bus->sdiodev->bus_if->state = BRCMF_BUS_LOAD;
++	}
++fail:
++	return bcmerror;
++}
++
++static int brcmf_sdbrcm_get_image(char *buf, int len, struct brcmf_sdio *bus)
++{
++	if (bus->firmware->size < bus->fw_ptr + len)
++		len = bus->firmware->size - bus->fw_ptr;
++
++	memcpy(buf, &bus->firmware->data[bus->fw_ptr], len);
++	bus->fw_ptr += len;
++	return len;
++}
++
++static int brcmf_sdbrcm_download_code_file(struct brcmf_sdio *bus)
++{
++	int offset = 0;
++	uint len;
++	u8 *memblock = NULL, *memptr;
++	int ret;
++
++	brcmf_dbg(INFO, "Enter\n");
++
++	ret = request_firmware(&bus->firmware, BRCMF_SDIO_FW_NAME,
++			       &bus->sdiodev->func[2]->dev);
++	if (ret) {
++		brcmf_dbg(ERROR, "Fail to request firmware %d\n", ret);
++		return ret;
++	}
++	bus->fw_ptr = 0;
++
++	memptr = memblock = kmalloc(MEMBLOCK + BRCMF_SDALIGN, GFP_ATOMIC);
++	if (memblock == NULL) {
++		ret = -ENOMEM;
++		goto err;
++	}
++	if ((u32)(unsigned long)memblock % BRCMF_SDALIGN)
++		memptr += (BRCMF_SDALIGN -
++			   ((u32)(unsigned long)memblock % BRCMF_SDALIGN));
++
++	/* Download image */
++	while ((len =
++		brcmf_sdbrcm_get_image((char *)memptr, MEMBLOCK, bus))) {
++		ret = brcmf_sdbrcm_membytes(bus, true, offset, memptr, len);
++		if (ret) {
++			brcmf_dbg(ERROR, "error %d on writing %d membytes at 0x%08x\n",
++				  ret, MEMBLOCK, offset);
++			goto err;
++		}
++
++		offset += MEMBLOCK;
++	}
++
++err:
++	kfree(memblock);
++
++	release_firmware(bus->firmware);
++	bus->fw_ptr = 0;
++
++	return ret;
++}
++
++/*
++ * ProcessVars:Takes a buffer of "<var>=<value>\n" lines read from a file
++ * and ending in a NUL.
++ * Removes carriage returns, empty lines, comment lines, and converts
++ * newlines to NULs.
++ * Shortens buffer as needed and pads with NULs.  End of buffer is marked
++ * by two NULs.
++*/
++
++static uint brcmf_process_nvram_vars(char *varbuf, uint len)
++{
++	char *dp;
++	bool findNewline;
++	int column;
++	uint buf_len, n;
++
++	dp = varbuf;
++
++	findNewline = false;
++	column = 0;
++
++	for (n = 0; n < len; n++) {
++		if (varbuf[n] == 0)
++			break;
++		if (varbuf[n] == '\r')
++			continue;
++		if (findNewline && varbuf[n] != '\n')
++			continue;
++		findNewline = false;
++		if (varbuf[n] == '#') {
++			findNewline = true;
++			continue;
++		}
++		if (varbuf[n] == '\n') {
++			if (column == 0)
++				continue;
++			*dp++ = 0;
++			column = 0;
++			continue;
++		}
++		*dp++ = varbuf[n];
++		column++;
++	}
++	buf_len = dp - varbuf;
++
++	while (dp < varbuf + n)
++		*dp++ = 0;
++
++	return buf_len;
++}
++
++static int brcmf_sdbrcm_download_nvram(struct brcmf_sdio *bus)
++{
++	uint len;
++	char *memblock = NULL;
++	char *bufp;
++	int ret;
++
++	ret = request_firmware(&bus->firmware, BRCMF_SDIO_NV_NAME,
++			       &bus->sdiodev->func[2]->dev);
++	if (ret) {
++		brcmf_dbg(ERROR, "Fail to request nvram %d\n", ret);
++		return ret;
++	}
++	bus->fw_ptr = 0;
++
++	memblock = kmalloc(MEMBLOCK, GFP_ATOMIC);
++	if (memblock == NULL) {
++		ret = -ENOMEM;
++		goto err;
++	}
++
++	len = brcmf_sdbrcm_get_image(memblock, MEMBLOCK, bus);
++
++	if (len > 0 && len < MEMBLOCK) {
++		bufp = (char *)memblock;
++		bufp[len] = 0;
++		len = brcmf_process_nvram_vars(bufp, len);
++		bufp += len;
++		*bufp++ = 0;
++		if (len)
++			ret = brcmf_sdbrcm_downloadvars(bus, memblock, len + 1);
++		if (ret)
++			brcmf_dbg(ERROR, "error downloading vars: %d\n", ret);
++	} else {
++		brcmf_dbg(ERROR, "error reading nvram file: %d\n", len);
++		ret = -EIO;
++	}
++
++err:
++	kfree(memblock);
++
++	release_firmware(bus->firmware);
++	bus->fw_ptr = 0;
++
++	return ret;
++}
++
++static int _brcmf_sdbrcm_download_firmware(struct brcmf_sdio *bus)
++{
++	int bcmerror = -1;
++
++	/* Keep arm in reset */
++	if (brcmf_sdbrcm_download_state(bus, true)) {
++		brcmf_dbg(ERROR, "error placing ARM core in reset\n");
++		goto err;
++	}
++
++	/* External image takes precedence if specified */
++	if (brcmf_sdbrcm_download_code_file(bus)) {
++		brcmf_dbg(ERROR, "dongle image file download failed\n");
++		goto err;
++	}
++
++	/* External nvram takes precedence if specified */
++	if (brcmf_sdbrcm_download_nvram(bus))
++		brcmf_dbg(ERROR, "dongle nvram file download failed\n");
++
++	/* Take arm out of reset */
++	if (brcmf_sdbrcm_download_state(bus, false)) {
++		brcmf_dbg(ERROR, "error getting out of ARM core reset\n");
++		goto err;
++	}
++
++	bcmerror = 0;
++
++err:
++	return bcmerror;
++}
++
++static bool
++brcmf_sdbrcm_download_firmware(struct brcmf_sdio *bus)
++{
++	bool ret;
++
++	/* Download the firmware */
++	brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
++
++	ret = _brcmf_sdbrcm_download_firmware(bus) == 0;
++
++	brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
++
++	return ret;
++}
++
++static int brcmf_sdbrcm_bus_init(struct device *dev)
++{
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
++	struct brcmf_sdio *bus = sdiodev->bus;
++	unsigned long timeout;
++	u8 ready, enable;
++	int err, ret = 0;
++	u8 saveclk;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	/* try to download image and nvram to the dongle */
++	if (bus_if->state == BRCMF_BUS_DOWN) {
++		if (!(brcmf_sdbrcm_download_firmware(bus)))
++			return -1;
++	}
++
++	if (!bus->sdiodev->bus_if->drvr)
++		return 0;
++
++	/* Start the watchdog timer */
++	bus->tickcnt = 0;
++	brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
++
++	down(&bus->sdsem);
++
++	/* Make sure backplane clock is on, needed to generate F2 interrupt */
++	brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
++	if (bus->clkstate != CLK_AVAIL)
++		goto exit;
++
++	/* Force clocks on backplane to be sure F2 interrupt propagates */
++	saveclk = brcmf_sdio_regrb(bus->sdiodev,
++				   SBSDIO_FUNC1_CHIPCLKCSR, &err);
++	if (!err) {
++		brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
++				 (saveclk | SBSDIO_FORCE_HT), &err);
++	}
++	if (err) {
++		brcmf_dbg(ERROR, "Failed to force clock for F2: err %d\n", err);
++		goto exit;
++	}
++
++	/* Enable function 2 (frame transfers) */
++	w_sdreg32(bus, SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT,
++		  offsetof(struct sdpcmd_regs, tosbmailboxdata));
++	enable = (SDIO_FUNC_ENABLE_1 | SDIO_FUNC_ENABLE_2);
++
++	brcmf_sdio_regwb(bus->sdiodev, SDIO_CCCR_IOEx, enable, NULL);
++
++	timeout = jiffies + msecs_to_jiffies(BRCMF_WAIT_F2RDY);
++	ready = 0;
++	while (enable != ready) {
++		ready = brcmf_sdio_regrb(bus->sdiodev,
++					 SDIO_CCCR_IORx, NULL);
++		if (time_after(jiffies, timeout))
++			break;
++		else if (time_after(jiffies, timeout - BRCMF_WAIT_F2RDY + 50))
++			/* prevent busy waiting if it takes too long */
++			msleep_interruptible(20);
++	}
++
++	brcmf_dbg(INFO, "enable 0x%02x, ready 0x%02x\n", enable, ready);
++
++	/* If F2 successfully enabled, set core and enable interrupts */
++	if (ready == enable) {
++		/* Set up the interrupt mask and enable interrupts */
++		bus->hostintmask = HOSTINTMASK;
++		w_sdreg32(bus, bus->hostintmask,
++			  offsetof(struct sdpcmd_regs, hostintmask));
++
++		brcmf_sdio_regwb(bus->sdiodev, SBSDIO_WATERMARK, 8, &err);
++	} else {
++		/* Disable F2 again */
++		enable = SDIO_FUNC_ENABLE_1;
++		brcmf_sdio_regwb(bus->sdiodev, SDIO_CCCR_IOEx, enable, NULL);
++		ret = -ENODEV;
++	}
++
++	/* Restore previous clock setting */
++	brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, saveclk, &err);
++
++	if (ret == 0) {
++		ret = brcmf_sdio_intr_register(bus->sdiodev);
++		if (ret != 0)
++			brcmf_dbg(ERROR, "intr register failed:%d\n", ret);
++	}
++
++	/* If we didn't come up, turn off backplane clock */
++	if (bus_if->state != BRCMF_BUS_DATA)
++		brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
++
++exit:
++	up(&bus->sdsem);
++
++	return ret;
++}
++
++void brcmf_sdbrcm_isr(void *arg)
++{
++	struct brcmf_sdio *bus = (struct brcmf_sdio *) arg;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	if (!bus) {
++		brcmf_dbg(ERROR, "bus is null pointer, exiting\n");
++		return;
++	}
++
++	if (bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN) {
++		brcmf_dbg(ERROR, "bus is down. we have nothing to do\n");
++		return;
++	}
++	/* Count the interrupt call */
++	bus->intrcount++;
++	bus->ipend = true;
++
++	/* Shouldn't get this interrupt if we're sleeping? */
++	if (bus->sleeping) {
++		brcmf_dbg(ERROR, "INTERRUPT WHILE SLEEPING??\n");
++		return;
++	}
++
++	/* Disable additional interrupts (is this needed now)? */
++	if (!bus->intr)
++		brcmf_dbg(ERROR, "isr w/o interrupt configured!\n");
++
++#ifndef CONFIG_BRCMFMAC_SDIO_OOB
++	while (brcmf_sdbrcm_dpc(bus))
++		;
++#else
++	bus->dpc_sched = true;
++	if (bus->dpc_tsk) {
++		brcmf_sdbrcm_adddpctsk(bus);
++		complete(&bus->dpc_wait);
++	}
++#endif
++}
++
++static bool brcmf_sdbrcm_bus_watchdog(struct brcmf_sdio *bus)
++{
++#ifdef DEBUG
++	struct brcmf_bus *bus_if = dev_get_drvdata(bus->sdiodev->dev);
++#endif	/* DEBUG */
++
++	brcmf_dbg(TIMER, "Enter\n");
++
++	/* Ignore the timer if simulating bus down */
++	if (bus->sleeping)
++		return false;
++
++	down(&bus->sdsem);
++
++	/* Poll period: check device if appropriate. */
++	if (bus->poll && (++bus->polltick >= bus->pollrate)) {
++		u32 intstatus = 0;
++
++		/* Reset poll tick */
++		bus->polltick = 0;
++
++		/* Check device if no interrupts */
++		if (!bus->intr || (bus->intrcount == bus->lastintrs)) {
++
++			if (!bus->dpc_sched) {
++				u8 devpend;
++				devpend = brcmf_sdio_regrb(bus->sdiodev,
++							   SDIO_CCCR_INTx,
++							   NULL);
++				intstatus =
++				    devpend & (INTR_STATUS_FUNC1 |
++					       INTR_STATUS_FUNC2);
++			}
++
++			/* If there is something, make like the ISR and
++				 schedule the DPC */
++			if (intstatus) {
++				bus->pollcnt++;
++				bus->ipend = true;
++
++				bus->dpc_sched = true;
++				if (bus->dpc_tsk) {
++					brcmf_sdbrcm_adddpctsk(bus);
++					complete(&bus->dpc_wait);
++				}
++			}
++		}
++
++		/* Update interrupt tracking */
++		bus->lastintrs = bus->intrcount;
++	}
++#ifdef DEBUG
++	/* Poll for console output periodically */
++	if (bus_if->state == BRCMF_BUS_DATA &&
++	    bus->console_interval != 0) {
++		bus->console.count += BRCMF_WD_POLL_MS;
++		if (bus->console.count >= bus->console_interval) {
++			bus->console.count -= bus->console_interval;
++			/* Make sure backplane clock is on */
++			brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
++			if (brcmf_sdbrcm_readconsole(bus) < 0)
++				/* stop on error */
++				bus->console_interval = 0;
++		}
++	}
++#endif				/* DEBUG */
++
++	/* On idle timeout clear activity flag and/or turn off clock */
++	if ((bus->idletime > 0) && (bus->clkstate == CLK_AVAIL)) {
++		if (++bus->idlecount >= bus->idletime) {
++			bus->idlecount = 0;
++			if (bus->activity) {
++				bus->activity = false;
++				brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
++			} else {
++				brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
++			}
++		}
++	}
++
++	up(&bus->sdsem);
++
++	return bus->ipend;
++}
++
++static bool brcmf_sdbrcm_chipmatch(u16 chipid)
++{
++	if (chipid == BCM4329_CHIP_ID)
++		return true;
++	if (chipid == BCM4330_CHIP_ID)
++		return true;
++	return false;
++}
++
++static void brcmf_sdbrcm_release_malloc(struct brcmf_sdio *bus)
++{
++	brcmf_dbg(TRACE, "Enter\n");
++
++	kfree(bus->rxbuf);
++	bus->rxctl = bus->rxbuf = NULL;
++	bus->rxlen = 0;
++
++	kfree(bus->databuf);
++	bus->databuf = NULL;
++}
++
++static bool brcmf_sdbrcm_probe_malloc(struct brcmf_sdio *bus)
++{
++	brcmf_dbg(TRACE, "Enter\n");
++
++	if (bus->sdiodev->bus_if->maxctl) {
++		bus->rxblen =
++		    roundup((bus->sdiodev->bus_if->maxctl + SDPCM_HDRLEN),
++			    ALIGNMENT) + BRCMF_SDALIGN;
++		bus->rxbuf = kmalloc(bus->rxblen, GFP_ATOMIC);
++		if (!(bus->rxbuf))
++			goto fail;
++	}
++
++	/* Allocate buffer to receive glomed packet */
++	bus->databuf = kmalloc(MAX_DATA_BUF, GFP_ATOMIC);
++	if (!(bus->databuf)) {
++		/* release rxbuf which was already located as above */
++		if (!bus->rxblen)
++			kfree(bus->rxbuf);
++		goto fail;
++	}
++
++	/* Align the buffer */
++	if ((unsigned long)bus->databuf % BRCMF_SDALIGN)
++		bus->dataptr = bus->databuf + (BRCMF_SDALIGN -
++			       ((unsigned long)bus->databuf % BRCMF_SDALIGN));
++	else
++		bus->dataptr = bus->databuf;
++
++	return true;
++
++fail:
++	return false;
++}
++
++static bool
++brcmf_sdbrcm_probe_attach(struct brcmf_sdio *bus, u32 regsva)
++{
++	u8 clkctl = 0;
++	int err = 0;
++	int reg_addr;
++	u32 reg_val;
++	u8 idx;
++
++	bus->alp_only = true;
++
++	pr_debug("F1 signature read @0x18000000=0x%4x\n",
++		 brcmf_sdio_regrl(bus->sdiodev, SI_ENUM_BASE, NULL));
++
++	/*
++	 * Force PLL off until brcmf_sdio_chip_attach()
++	 * programs PLL control regs
++	 */
++
++	brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
++			 BRCMF_INIT_CLKCTL1, &err);
++	if (!err)
++		clkctl = brcmf_sdio_regrb(bus->sdiodev,
++					  SBSDIO_FUNC1_CHIPCLKCSR, &err);
++
++	if (err || ((clkctl & ~SBSDIO_AVBITS) != BRCMF_INIT_CLKCTL1)) {
++		brcmf_dbg(ERROR, "ChipClkCSR access: err %d wrote 0x%02x read 0x%02x\n",
++			  err, BRCMF_INIT_CLKCTL1, clkctl);
++		goto fail;
++	}
++
++	if (brcmf_sdio_chip_attach(bus->sdiodev, &bus->ci, regsva)) {
++		brcmf_dbg(ERROR, "brcmf_sdio_chip_attach failed!\n");
++		goto fail;
++	}
++
++	if (!brcmf_sdbrcm_chipmatch((u16) bus->ci->chip)) {
++		brcmf_dbg(ERROR, "unsupported chip: 0x%04x\n", bus->ci->chip);
++		goto fail;
++	}
++
++	brcmf_sdio_chip_drivestrengthinit(bus->sdiodev, bus->ci,
++					  SDIO_DRIVE_STRENGTH);
++
++	/* Get info on the SOCRAM cores... */
++	bus->ramsize = bus->ci->ramsize;
++	if (!(bus->ramsize)) {
++		brcmf_dbg(ERROR, "failed to find SOCRAM memory!\n");
++		goto fail;
++	}
++
++	/* Set core control so an SDIO reset does a backplane reset */
++	idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
++	reg_addr = bus->ci->c_inf[idx].base +
++		   offsetof(struct sdpcmd_regs, corecontrol);
++	reg_val = brcmf_sdio_regrl(bus->sdiodev, reg_addr, NULL);
++	brcmf_sdio_regwl(bus->sdiodev, reg_addr, reg_val | CC_BPRESEN, NULL);
++
++	brcmu_pktq_init(&bus->txq, (PRIOMASK + 1), TXQLEN);
++
++	/* Locate an appropriately-aligned portion of hdrbuf */
++	bus->rxhdr = (u8 *) roundup((unsigned long)&bus->hdrbuf[0],
++				    BRCMF_SDALIGN);
++
++	/* Set the poll and/or interrupt flags */
++	bus->intr = true;
++	bus->poll = false;
++	if (bus->poll)
++		bus->pollrate = 1;
++
++	return true;
++
++fail:
++	return false;
++}
++
++static bool brcmf_sdbrcm_probe_init(struct brcmf_sdio *bus)
++{
++	brcmf_dbg(TRACE, "Enter\n");
++
++	/* Disable F2 to clear any intermediate frame state on the dongle */
++	brcmf_sdio_regwb(bus->sdiodev, SDIO_CCCR_IOEx,
++			 SDIO_FUNC_ENABLE_1, NULL);
++
++	bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
++	bus->sleeping = false;
++	bus->rxflow = false;
++
++	/* Done with backplane-dependent accesses, can drop clock... */
++	brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
++
++	/* ...and initialize clock/power states */
++	bus->clkstate = CLK_SDONLY;
++	bus->idletime = BRCMF_IDLE_INTERVAL;
++	bus->idleclock = BRCMF_IDLE_ACTIVE;
++
++	/* Query the F2 block size, set roundup accordingly */
++	bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
++	bus->roundup = min(max_roundup, bus->blocksize);
++
++	/* bus module does not support packet chaining */
++	bus->use_rxchain = false;
++	bus->sd_rxchain = false;
++
++	return true;
++}
++
++static int
++brcmf_sdbrcm_watchdog_thread(void *data)
++{
++	struct brcmf_sdio *bus = (struct brcmf_sdio *)data;
++
++	allow_signal(SIGTERM);
++	/* Run until signal received */
++	while (1) {
++		if (kthread_should_stop())
++			break;
++		if (!wait_for_completion_interruptible(&bus->watchdog_wait)) {
++			brcmf_sdbrcm_bus_watchdog(bus);
++			/* Count the tick for reference */
++			bus->tickcnt++;
++		} else
++			break;
++	}
++	return 0;
++}
++
++static void
++brcmf_sdbrcm_watchdog(unsigned long data)
++{
++	struct brcmf_sdio *bus = (struct brcmf_sdio *)data;
++
++	if (bus->watchdog_tsk) {
++		complete(&bus->watchdog_wait);
++		/* Reschedule the watchdog */
++		if (bus->wd_timer_valid)
++			mod_timer(&bus->timer,
++				  jiffies + BRCMF_WD_POLL_MS * HZ / 1000);
++	}
++}
++
++static void brcmf_sdbrcm_release_dongle(struct brcmf_sdio *bus)
++{
++	brcmf_dbg(TRACE, "Enter\n");
++
++	if (bus->ci) {
++		brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
++		brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
++		brcmf_sdio_chip_detach(&bus->ci);
++		if (bus->vars && bus->varsz)
++			kfree(bus->vars);
++		bus->vars = NULL;
++	}
++
++	brcmf_dbg(TRACE, "Disconnected\n");
++}
++
++/* Detach and free everything */
++static void brcmf_sdbrcm_release(struct brcmf_sdio *bus)
++{
++	brcmf_dbg(TRACE, "Enter\n");
++
++	if (bus) {
++		/* De-register interrupt handler */
++		brcmf_sdio_intr_unregister(bus->sdiodev);
++
++		if (bus->sdiodev->bus_if->drvr) {
++			brcmf_detach(bus->sdiodev->dev);
++			brcmf_sdbrcm_release_dongle(bus);
++		}
++
++		brcmf_sdbrcm_release_malloc(bus);
++
++		kfree(bus);
++	}
++
++	brcmf_dbg(TRACE, "Disconnected\n");
++}
++
++void *brcmf_sdbrcm_probe(u32 regsva, struct brcmf_sdio_dev *sdiodev)
++{
++	int ret;
++	struct brcmf_sdio *bus;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	/* We make an assumption about address window mappings:
++	 * regsva == SI_ENUM_BASE*/
++
++	/* Allocate private bus interface state */
++	bus = kzalloc(sizeof(struct brcmf_sdio), GFP_ATOMIC);
++	if (!bus)
++		goto fail;
++
++	bus->sdiodev = sdiodev;
++	sdiodev->bus = bus;
++	skb_queue_head_init(&bus->glom);
++	bus->txbound = BRCMF_TXBOUND;
++	bus->rxbound = BRCMF_RXBOUND;
++	bus->txminmax = BRCMF_TXMINMAX;
++	bus->tx_seq = SDPCM_SEQUENCE_WRAP - 1;
++	bus->usebufpool = false;	/* Use bufpool if allocated,
++					 else use locally malloced rxbuf */
++
++	/* attempt to attach to the dongle */
++	if (!(brcmf_sdbrcm_probe_attach(bus, regsva))) {
++		brcmf_dbg(ERROR, "brcmf_sdbrcm_probe_attach failed\n");
++		goto fail;
++	}
++
++	spin_lock_init(&bus->txqlock);
++	init_waitqueue_head(&bus->ctrl_wait);
++	init_waitqueue_head(&bus->dcmd_resp_wait);
++
++	/* Set up the watchdog timer */
++	init_timer(&bus->timer);
++	bus->timer.data = (unsigned long)bus;
++	bus->timer.function = brcmf_sdbrcm_watchdog;
++
++	/* Initialize thread based operation and lock */
++	sema_init(&bus->sdsem, 1);
++
++	/* Initialize watchdog thread */
++	init_completion(&bus->watchdog_wait);
++	bus->watchdog_tsk = kthread_run(brcmf_sdbrcm_watchdog_thread,
++					bus, "brcmf_watchdog");
++	if (IS_ERR(bus->watchdog_tsk)) {
++		pr_warn("brcmf_watchdog thread failed to start\n");
++		bus->watchdog_tsk = NULL;
++	}
++	/* Initialize DPC thread */
++	init_completion(&bus->dpc_wait);
++	INIT_LIST_HEAD(&bus->dpc_tsklst);
++	spin_lock_init(&bus->dpc_tl_lock);
++	bus->dpc_tsk = kthread_run(brcmf_sdbrcm_dpc_thread,
++				   bus, "brcmf_dpc");
++	if (IS_ERR(bus->dpc_tsk)) {
++		pr_warn("brcmf_dpc thread failed to start\n");
++		bus->dpc_tsk = NULL;
++	}
++
++	/* Assign bus interface call back */
++	bus->sdiodev->bus_if->brcmf_bus_stop = brcmf_sdbrcm_bus_stop;
++	bus->sdiodev->bus_if->brcmf_bus_init = brcmf_sdbrcm_bus_init;
++	bus->sdiodev->bus_if->brcmf_bus_txdata = brcmf_sdbrcm_bus_txdata;
++	bus->sdiodev->bus_if->brcmf_bus_txctl = brcmf_sdbrcm_bus_txctl;
++	bus->sdiodev->bus_if->brcmf_bus_rxctl = brcmf_sdbrcm_bus_rxctl;
++	/* Attach to the brcmf/OS/network interface */
++	ret = brcmf_attach(SDPCM_RESERVE, bus->sdiodev->dev);
++	if (ret != 0) {
++		brcmf_dbg(ERROR, "brcmf_attach failed\n");
++		goto fail;
++	}
++
++	/* Allocate buffers */
++	if (!(brcmf_sdbrcm_probe_malloc(bus))) {
++		brcmf_dbg(ERROR, "brcmf_sdbrcm_probe_malloc failed\n");
++		goto fail;
++	}
++
++	if (!(brcmf_sdbrcm_probe_init(bus))) {
++		brcmf_dbg(ERROR, "brcmf_sdbrcm_probe_init failed\n");
++		goto fail;
++	}
++
++	brcmf_dbg(INFO, "completed!!\n");
++
++	/* if firmware path present try to download and bring up bus */
++	ret = brcmf_bus_start(bus->sdiodev->dev);
++	if (ret != 0) {
++		if (ret == -ENOLINK) {
++			brcmf_dbg(ERROR, "dongle is not responding\n");
++			goto fail;
++		}
++	}
++
++	return bus;
++
++fail:
++	brcmf_sdbrcm_release(bus);
++	return NULL;
++}
++
++void brcmf_sdbrcm_disconnect(void *ptr)
++{
++	struct brcmf_sdio *bus = (struct brcmf_sdio *)ptr;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	if (bus)
++		brcmf_sdbrcm_release(bus);
++
++	brcmf_dbg(TRACE, "Disconnected\n");
++}
++
++void
++brcmf_sdbrcm_wd_timer(struct brcmf_sdio *bus, uint wdtick)
++{
++	/* Totally stop the timer */
++	if (!wdtick && bus->wd_timer_valid) {
++		del_timer_sync(&bus->timer);
++		bus->wd_timer_valid = false;
++		bus->save_ms = wdtick;
++		return;
++	}
++
++	/* don't start the wd until fw is loaded */
++	if (bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN)
++		return;
++
++	if (wdtick) {
++		if (bus->save_ms != BRCMF_WD_POLL_MS) {
++			if (bus->wd_timer_valid)
++				/* Stop timer and restart at new value */
++				del_timer_sync(&bus->timer);
++
++			/* Create timer again when watchdog period is
++			   dynamically changed or in the first instance
++			 */
++			bus->timer.expires =
++				jiffies + BRCMF_WD_POLL_MS * HZ / 1000;
++			add_timer(&bus->timer);
++
++		} else {
++			/* Re arm the timer, at last watchdog period */
++			mod_timer(&bus->timer,
++				jiffies + BRCMF_WD_POLL_MS * HZ / 1000);
++		}
++
++		bus->wd_timer_valid = true;
++		bus->save_ms = wdtick;
++	}
++}
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
+new file mode 100644
+index 0000000..13f630c
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
+@@ -0,0 +1,622 @@
++/*
++ * Copyright (c) 2011 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++/* ***** SDIO interface chip backplane handle functions ***** */
++
++#undef pr_fmt
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/types.h>
++#include <linux/netdevice.h>
++#include <linux/printk.h>
++#include <linux/mmc/card.h>
++#include <linux/ssb/ssb_regs.h>
++#include <linux/bcma/bcma.h>
++
++#include <chipcommon.h>
++#include <brcm_hw_ids.h>
++#include <brcmu_wifi.h>
++#include <brcmu_utils.h>
++#include <soc.h>
++#include "dhd_dbg.h"
++#include "sdio_host.h"
++#include "sdio_chip.h"
++
++/* chip core base & ramsize */
++/* bcm4329 */
++/* SDIO device core, ID 0x829 */
++#define BCM4329_CORE_BUS_BASE		0x18011000
++/* internal memory core, ID 0x80e */
++#define BCM4329_CORE_SOCRAM_BASE	0x18003000
++/* ARM Cortex M3 core, ID 0x82a */
++#define BCM4329_CORE_ARM_BASE		0x18002000
++#define BCM4329_RAMSIZE			0x48000
++
++#define	SBCOREREV(sbidh) \
++	((((sbidh) & SSB_IDHIGH_RCHI) >> SSB_IDHIGH_RCHI_SHIFT) | \
++	  ((sbidh) & SSB_IDHIGH_RCLO))
++
++/* SOC Interconnect types (aka chip types) */
++#define SOCI_SB		0
++#define SOCI_AI		1
++
++/* EROM CompIdentB */
++#define CIB_REV_MASK		0xff000000
++#define CIB_REV_SHIFT		24
++
++#define SDIOD_DRVSTR_KEY(chip, pmu)     (((chip) << 16) | (pmu))
++/* SDIO Pad drive strength to select value mappings */
++struct sdiod_drive_str {
++	u8 strength;	/* Pad Drive Strength in mA */
++	u8 sel;		/* Chip-specific select value */
++};
++/* SDIO Drive Strength to sel value table for PMU Rev 11 (1.8V) */
++static const struct sdiod_drive_str sdiod_drvstr_tab1_1v8[] = {
++	{32, 0x6},
++	{26, 0x7},
++	{22, 0x4},
++	{16, 0x5},
++	{12, 0x2},
++	{8, 0x3},
++	{4, 0x0},
++	{0, 0x1}
++};
++
++u8
++brcmf_sdio_chip_getinfidx(struct chip_info *ci, u16 coreid)
++{
++	u8 idx;
++
++	for (idx = 0; idx < BRCMF_MAX_CORENUM; idx++)
++		if (coreid == ci->c_inf[idx].id)
++			return idx;
++
++	return BRCMF_MAX_CORENUM;
++}
++
++static u32
++brcmf_sdio_sb_corerev(struct brcmf_sdio_dev *sdiodev,
++		      struct chip_info *ci, u16 coreid)
++{
++	u32 regdata;
++	u8 idx;
++
++	idx = brcmf_sdio_chip_getinfidx(ci, coreid);
++
++	regdata = brcmf_sdio_regrl(sdiodev,
++				   CORE_SB(ci->c_inf[idx].base, sbidhigh),
++				   NULL);
++	return SBCOREREV(regdata);
++}
++
++static u32
++brcmf_sdio_ai_corerev(struct brcmf_sdio_dev *sdiodev,
++		      struct chip_info *ci, u16 coreid)
++{
++	u8 idx;
++
++	idx = brcmf_sdio_chip_getinfidx(ci, coreid);
++
++	return (ci->c_inf[idx].cib & CIB_REV_MASK) >> CIB_REV_SHIFT;
++}
++
++static bool
++brcmf_sdio_sb_iscoreup(struct brcmf_sdio_dev *sdiodev,
++		       struct chip_info *ci, u16 coreid)
++{
++	u32 regdata;
++	u8 idx;
++
++	idx = brcmf_sdio_chip_getinfidx(ci, coreid);
++
++	regdata = brcmf_sdio_regrl(sdiodev,
++				   CORE_SB(ci->c_inf[idx].base, sbtmstatelow),
++				   NULL);
++	regdata &= (SSB_TMSLOW_RESET | SSB_TMSLOW_REJECT |
++		    SSB_IMSTATE_REJECT | SSB_TMSLOW_CLOCK);
++	return (SSB_TMSLOW_CLOCK == regdata);
++}
++
++static bool
++brcmf_sdio_ai_iscoreup(struct brcmf_sdio_dev *sdiodev,
++		       struct chip_info *ci, u16 coreid)
++{
++	u32 regdata;
++	u8 idx;
++	bool ret;
++
++	idx = brcmf_sdio_chip_getinfidx(ci, coreid);
++
++	regdata = brcmf_sdio_regrl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
++				   NULL);
++	ret = (regdata & (BCMA_IOCTL_FGC | BCMA_IOCTL_CLK)) == BCMA_IOCTL_CLK;
++
++	regdata = brcmf_sdio_regrl(sdiodev,
++				   ci->c_inf[idx].wrapbase+BCMA_RESET_CTL,
++				   NULL);
++	ret = ret && ((regdata & BCMA_RESET_CTL_RESET) == 0);
++
++	return ret;
++}
++
++static void
++brcmf_sdio_sb_coredisable(struct brcmf_sdio_dev *sdiodev,
++			  struct chip_info *ci, u16 coreid)
++{
++	u32 regdata, base;
++	u8 idx;
++
++	idx = brcmf_sdio_chip_getinfidx(ci, coreid);
++	base = ci->c_inf[idx].base;
++
++	regdata = brcmf_sdio_regrl(sdiodev, CORE_SB(base, sbtmstatelow), NULL);
++	if (regdata & SSB_TMSLOW_RESET)
++		return;
++
++	regdata = brcmf_sdio_regrl(sdiodev, CORE_SB(base, sbtmstatelow), NULL);
++	if ((regdata & SSB_TMSLOW_CLOCK) != 0) {
++		/*
++		 * set target reject and spin until busy is clear
++		 * (preserve core-specific bits)
++		 */
++		regdata = brcmf_sdio_regrl(sdiodev, CORE_SB(base, sbtmstatelow),
++					   NULL);
++		brcmf_sdio_regwl(sdiodev, CORE_SB(base, sbtmstatelow),
++				 regdata | SSB_TMSLOW_REJECT, NULL);
++
++		regdata = brcmf_sdio_regrl(sdiodev, CORE_SB(base, sbtmstatelow),
++					   NULL);
++		udelay(1);
++		SPINWAIT((brcmf_sdio_regrl(sdiodev,
++					   CORE_SB(base, sbtmstatehigh),
++					   NULL) &
++			SSB_TMSHIGH_BUSY), 100000);
++
++		regdata = brcmf_sdio_regrl(sdiodev,
++					   CORE_SB(base, sbtmstatehigh),
++					   NULL);
++		if (regdata & SSB_TMSHIGH_BUSY)
++			brcmf_dbg(ERROR, "core state still busy\n");
++
++		regdata = brcmf_sdio_regrl(sdiodev, CORE_SB(base, sbidlow),
++					   NULL);
++		if (regdata & SSB_IDLOW_INITIATOR) {
++			regdata = brcmf_sdio_regrl(sdiodev,
++						   CORE_SB(base, sbimstate),
++						   NULL);
++			regdata |= SSB_IMSTATE_REJECT;
++			brcmf_sdio_regwl(sdiodev, CORE_SB(base, sbimstate),
++					 regdata, NULL);
++			regdata = brcmf_sdio_regrl(sdiodev,
++						   CORE_SB(base, sbimstate),
++						   NULL);
++			udelay(1);
++			SPINWAIT((brcmf_sdio_regrl(sdiodev,
++						   CORE_SB(base, sbimstate),
++						   NULL) &
++				SSB_IMSTATE_BUSY), 100000);
++		}
++
++		/* set reset and reject while enabling the clocks */
++		regdata = SSB_TMSLOW_FGC | SSB_TMSLOW_CLOCK |
++			  SSB_TMSLOW_REJECT | SSB_TMSLOW_RESET;
++		brcmf_sdio_regwl(sdiodev, CORE_SB(base, sbtmstatelow),
++				 regdata, NULL);
++		regdata = brcmf_sdio_regrl(sdiodev, CORE_SB(base, sbtmstatelow),
++					   NULL);
++		udelay(10);
++
++		/* clear the initiator reject bit */
++		regdata = brcmf_sdio_regrl(sdiodev, CORE_SB(base, sbidlow),
++					   NULL);
++		if (regdata & SSB_IDLOW_INITIATOR) {
++			regdata = brcmf_sdio_regrl(sdiodev,
++						   CORE_SB(base, sbimstate),
++						   NULL);
++			regdata &= ~SSB_IMSTATE_REJECT;
++			brcmf_sdio_regwl(sdiodev, CORE_SB(base, sbimstate),
++					 regdata, NULL);
++		}
++	}
++
++	/* leave reset and reject asserted */
++	brcmf_sdio_regwl(sdiodev, CORE_SB(base, sbtmstatelow),
++			 (SSB_TMSLOW_REJECT | SSB_TMSLOW_RESET), NULL);
++	udelay(1);
++}
++
++static void
++brcmf_sdio_ai_coredisable(struct brcmf_sdio_dev *sdiodev,
++			  struct chip_info *ci, u16 coreid)
++{
++	u8 idx;
++	u32 regdata;
++
++	idx = brcmf_sdio_chip_getinfidx(ci, coreid);
++
++	/* if core is already in reset, just return */
++	regdata = brcmf_sdio_regrl(sdiodev,
++				   ci->c_inf[idx].wrapbase+BCMA_RESET_CTL,
++				   NULL);
++	if ((regdata & BCMA_RESET_CTL_RESET) != 0)
++		return;
++
++	brcmf_sdio_regwl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL, 0, NULL);
++	regdata = brcmf_sdio_regrl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
++				   NULL);
++	udelay(10);
++
++	brcmf_sdio_regwl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_RESET_CTL,
++			 BCMA_RESET_CTL_RESET, NULL);
++	udelay(1);
++}
++
++static void
++brcmf_sdio_sb_resetcore(struct brcmf_sdio_dev *sdiodev,
++			struct chip_info *ci, u16 coreid)
++{
++	u32 regdata;
++	u8 idx;
++
++	idx = brcmf_sdio_chip_getinfidx(ci, coreid);
++
++	/*
++	 * Must do the disable sequence first to work for
++	 * arbitrary current core state.
++	 */
++	brcmf_sdio_sb_coredisable(sdiodev, ci, coreid);
++
++	/*
++	 * Now do the initialization sequence.
++	 * set reset while enabling the clock and
++	 * forcing them on throughout the core
++	 */
++	brcmf_sdio_regwl(sdiodev,
++			 CORE_SB(ci->c_inf[idx].base, sbtmstatelow),
++			 SSB_TMSLOW_FGC | SSB_TMSLOW_CLOCK | SSB_TMSLOW_RESET,
++			 NULL);
++	regdata = brcmf_sdio_regrl(sdiodev,
++				   CORE_SB(ci->c_inf[idx].base, sbtmstatelow),
++				   NULL);
++	udelay(1);
++
++	/* clear any serror */
++	regdata = brcmf_sdio_regrl(sdiodev,
++				   CORE_SB(ci->c_inf[idx].base, sbtmstatehigh),
++				   NULL);
++	if (regdata & SSB_TMSHIGH_SERR)
++		brcmf_sdio_regwl(sdiodev,
++				 CORE_SB(ci->c_inf[idx].base, sbtmstatehigh),
++				 0, NULL);
++
++	regdata = brcmf_sdio_regrl(sdiodev,
++				   CORE_SB(ci->c_inf[idx].base, sbimstate),
++				   NULL);
++	if (regdata & (SSB_IMSTATE_IBE | SSB_IMSTATE_TO))
++		brcmf_sdio_regwl(sdiodev,
++				 CORE_SB(ci->c_inf[idx].base, sbimstate),
++				 regdata & ~(SSB_IMSTATE_IBE | SSB_IMSTATE_TO),
++				 NULL);
++
++	/* clear reset and allow it to propagate throughout the core */
++	brcmf_sdio_regwl(sdiodev, CORE_SB(ci->c_inf[idx].base, sbtmstatelow),
++			 SSB_TMSLOW_FGC | SSB_TMSLOW_CLOCK, NULL);
++	regdata = brcmf_sdio_regrl(sdiodev,
++				   CORE_SB(ci->c_inf[idx].base, sbtmstatelow),
++				   NULL);
++	udelay(1);
++
++	/* leave clock enabled */
++	brcmf_sdio_regwl(sdiodev, CORE_SB(ci->c_inf[idx].base, sbtmstatelow),
++			 SSB_TMSLOW_CLOCK, NULL);
++	regdata = brcmf_sdio_regrl(sdiodev,
++				   CORE_SB(ci->c_inf[idx].base, sbtmstatelow),
++				   NULL);
++	udelay(1);
++}
++
++static void
++brcmf_sdio_ai_resetcore(struct brcmf_sdio_dev *sdiodev,
++			struct chip_info *ci, u16 coreid)
++{
++	u8 idx;
++	u32 regdata;
++
++	idx = brcmf_sdio_chip_getinfidx(ci, coreid);
++
++	/* must disable first to work for arbitrary current core state */
++	brcmf_sdio_ai_coredisable(sdiodev, ci, coreid);
++
++	/* now do initialization sequence */
++	brcmf_sdio_regwl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
++			 BCMA_IOCTL_FGC | BCMA_IOCTL_CLK, NULL);
++	regdata = brcmf_sdio_regrl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
++				   NULL);
++	brcmf_sdio_regwl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_RESET_CTL,
++			 0, NULL);
++	udelay(1);
++
++	brcmf_sdio_regwl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
++			 BCMA_IOCTL_CLK, NULL);
++	regdata = brcmf_sdio_regrl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
++				   NULL);
++	udelay(1);
++}
++
++static int brcmf_sdio_chip_recognition(struct brcmf_sdio_dev *sdiodev,
++				       struct chip_info *ci, u32 regs)
++{
++	u32 regdata;
++
++	/*
++	 * Get CC core rev
++	 * Chipid is assume to be at offset 0 from regs arg
++	 * For different chiptypes or old sdio hosts w/o chipcommon,
++	 * other ways of recognition should be added here.
++	 */
++	ci->c_inf[0].id = BCMA_CORE_CHIPCOMMON;
++	ci->c_inf[0].base = regs;
++	regdata = brcmf_sdio_regrl(sdiodev,
++				   CORE_CC_REG(ci->c_inf[0].base, chipid),
++				   NULL);
++	ci->chip = regdata & CID_ID_MASK;
++	ci->chiprev = (regdata & CID_REV_MASK) >> CID_REV_SHIFT;
++	ci->socitype = (regdata & CID_TYPE_MASK) >> CID_TYPE_SHIFT;
++
++	brcmf_dbg(INFO, "chipid=0x%x chiprev=%d\n", ci->chip, ci->chiprev);
++
++	/* Address of cores for new chips should be added here */
++	switch (ci->chip) {
++	case BCM4329_CHIP_ID:
++		ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
++		ci->c_inf[1].base = BCM4329_CORE_BUS_BASE;
++		ci->c_inf[2].id = BCMA_CORE_INTERNAL_MEM;
++		ci->c_inf[2].base = BCM4329_CORE_SOCRAM_BASE;
++		ci->c_inf[3].id = BCMA_CORE_ARM_CM3;
++		ci->c_inf[3].base = BCM4329_CORE_ARM_BASE;
++		ci->ramsize = BCM4329_RAMSIZE;
++		break;
++	case BCM4330_CHIP_ID:
++		ci->c_inf[0].wrapbase = 0x18100000;
++		ci->c_inf[0].cib = 0x27004211;
++		ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
++		ci->c_inf[1].base = 0x18002000;
++		ci->c_inf[1].wrapbase = 0x18102000;
++		ci->c_inf[1].cib = 0x07004211;
++		ci->c_inf[2].id = BCMA_CORE_INTERNAL_MEM;
++		ci->c_inf[2].base = 0x18004000;
++		ci->c_inf[2].wrapbase = 0x18104000;
++		ci->c_inf[2].cib = 0x0d080401;
++		ci->c_inf[3].id = BCMA_CORE_ARM_CM3;
++		ci->c_inf[3].base = 0x18003000;
++		ci->c_inf[3].wrapbase = 0x18103000;
++		ci->c_inf[3].cib = 0x03004211;
++		ci->ramsize = 0x48000;
++		break;
++	default:
++		brcmf_dbg(ERROR, "chipid 0x%x is not supported\n", ci->chip);
++		return -ENODEV;
++	}
++
++	switch (ci->socitype) {
++	case SOCI_SB:
++		ci->iscoreup = brcmf_sdio_sb_iscoreup;
++		ci->corerev = brcmf_sdio_sb_corerev;
++		ci->coredisable = brcmf_sdio_sb_coredisable;
++		ci->resetcore = brcmf_sdio_sb_resetcore;
++		break;
++	case SOCI_AI:
++		ci->iscoreup = brcmf_sdio_ai_iscoreup;
++		ci->corerev = brcmf_sdio_ai_corerev;
++		ci->coredisable = brcmf_sdio_ai_coredisable;
++		ci->resetcore = brcmf_sdio_ai_resetcore;
++		break;
++	default:
++		brcmf_dbg(ERROR, "socitype %u not supported\n", ci->socitype);
++		return -ENODEV;
++	}
++
++	return 0;
++}
++
++static int
++brcmf_sdio_chip_buscoreprep(struct brcmf_sdio_dev *sdiodev)
++{
++	int err = 0;
++	u8 clkval, clkset;
++
++	/* Try forcing SDIO core to do ALPAvail request only */
++	clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_ALP_AVAIL_REQ;
++	brcmf_sdio_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
++	if (err) {
++		brcmf_dbg(ERROR, "error writing for HT off\n");
++		return err;
++	}
++
++	/* If register supported, wait for ALPAvail and then force ALP */
++	/* This may take up to 15 milliseconds */
++	clkval = brcmf_sdio_regrb(sdiodev,
++				  SBSDIO_FUNC1_CHIPCLKCSR, NULL);
++
++	if ((clkval & ~SBSDIO_AVBITS) != clkset) {
++		brcmf_dbg(ERROR, "ChipClkCSR access: wrote 0x%02x read 0x%02x\n",
++			  clkset, clkval);
++		return -EACCES;
++	}
++
++	SPINWAIT(((clkval = brcmf_sdio_regrb(sdiodev,
++					     SBSDIO_FUNC1_CHIPCLKCSR, NULL)),
++			!SBSDIO_ALPAV(clkval)),
++			PMU_MAX_TRANSITION_DLY);
++	if (!SBSDIO_ALPAV(clkval)) {
++		brcmf_dbg(ERROR, "timeout on ALPAV wait, clkval 0x%02x\n",
++			  clkval);
++		return -EBUSY;
++	}
++
++	clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_FORCE_ALP;
++	brcmf_sdio_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
++	udelay(65);
++
++	/* Also, disable the extra SDIO pull-ups */
++	brcmf_sdio_regwb(sdiodev, SBSDIO_FUNC1_SDIOPULLUP, 0, NULL);
++
++	return 0;
++}
++
++static void
++brcmf_sdio_chip_buscoresetup(struct brcmf_sdio_dev *sdiodev,
++			     struct chip_info *ci)
++{
++	u32 base = ci->c_inf[0].base;
++
++	/* get chipcommon rev */
++	ci->c_inf[0].rev = ci->corerev(sdiodev, ci, ci->c_inf[0].id);
++
++	/* get chipcommon capabilites */
++	ci->c_inf[0].caps = brcmf_sdio_regrl(sdiodev,
++					     CORE_CC_REG(base, capabilities),
++					     NULL);
++
++	/* get pmu caps & rev */
++	if (ci->c_inf[0].caps & CC_CAP_PMU) {
++		ci->pmucaps =
++			brcmf_sdio_regrl(sdiodev,
++					 CORE_CC_REG(base, pmucapabilities),
++					 NULL);
++		ci->pmurev = ci->pmucaps & PCAP_REV_MASK;
++	}
++
++	ci->c_inf[1].rev = ci->corerev(sdiodev, ci, ci->c_inf[1].id);
++
++	brcmf_dbg(INFO, "ccrev=%d, pmurev=%d, buscore rev/type=%d/0x%x\n",
++		  ci->c_inf[0].rev, ci->pmurev,
++		  ci->c_inf[1].rev, ci->c_inf[1].id);
++
++	/*
++	 * Make sure any on-chip ARM is off (in case strapping is wrong),
++	 * or downloaded code was already running.
++	 */
++	ci->coredisable(sdiodev, ci, BCMA_CORE_ARM_CM3);
++}
++
++int brcmf_sdio_chip_attach(struct brcmf_sdio_dev *sdiodev,
++			   struct chip_info **ci_ptr, u32 regs)
++{
++	int ret;
++	struct chip_info *ci;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	/* alloc chip_info_t */
++	ci = kzalloc(sizeof(struct chip_info), GFP_ATOMIC);
++	if (!ci)
++		return -ENOMEM;
++
++	ret = brcmf_sdio_chip_buscoreprep(sdiodev);
++	if (ret != 0)
++		goto err;
++
++	ret = brcmf_sdio_chip_recognition(sdiodev, ci, regs);
++	if (ret != 0)
++		goto err;
++
++	brcmf_sdio_chip_buscoresetup(sdiodev, ci);
++
++	brcmf_sdio_regwl(sdiodev, CORE_CC_REG(ci->c_inf[0].base, gpiopullup),
++			 0, NULL);
++	brcmf_sdio_regwl(sdiodev, CORE_CC_REG(ci->c_inf[0].base, gpiopulldown),
++			 0, NULL);
++
++	*ci_ptr = ci;
++	return 0;
++
++err:
++	kfree(ci);
++	return ret;
++}
++
++void
++brcmf_sdio_chip_detach(struct chip_info **ci_ptr)
++{
++	brcmf_dbg(TRACE, "Enter\n");
++
++	kfree(*ci_ptr);
++	*ci_ptr = NULL;
++}
++
++static char *brcmf_sdio_chip_name(uint chipid, char *buf, uint len)
++{
++	const char *fmt;
++
++	fmt = ((chipid > 0xa000) || (chipid < 0x4000)) ? "%d" : "%x";
++	snprintf(buf, len, fmt, chipid);
++	return buf;
++}
++
++void
++brcmf_sdio_chip_drivestrengthinit(struct brcmf_sdio_dev *sdiodev,
++				  struct chip_info *ci, u32 drivestrength)
++{
++	struct sdiod_drive_str *str_tab = NULL;
++	u32 str_mask = 0;
++	u32 str_shift = 0;
++	char chn[8];
++	u32 base = ci->c_inf[0].base;
++
++	if (!(ci->c_inf[0].caps & CC_CAP_PMU))
++		return;
++
++	switch (SDIOD_DRVSTR_KEY(ci->chip, ci->pmurev)) {
++	case SDIOD_DRVSTR_KEY(BCM4330_CHIP_ID, 12):
++		str_tab = (struct sdiod_drive_str *)&sdiod_drvstr_tab1_1v8;
++		str_mask = 0x00003800;
++		str_shift = 11;
++		break;
++	default:
++		brcmf_dbg(ERROR, "No SDIO Drive strength init done for chip %s rev %d pmurev %d\n",
++			  brcmf_sdio_chip_name(ci->chip, chn, 8),
++			  ci->chiprev, ci->pmurev);
++		break;
++	}
++
++	if (str_tab != NULL) {
++		u32 drivestrength_sel = 0;
++		u32 cc_data_temp;
++		int i;
++
++		for (i = 0; str_tab[i].strength != 0; i++) {
++			if (drivestrength >= str_tab[i].strength) {
++				drivestrength_sel = str_tab[i].sel;
++				break;
++			}
++		}
++
++		brcmf_sdio_regwl(sdiodev, CORE_CC_REG(base, chipcontrol_addr),
++				 1, NULL);
++		cc_data_temp =
++			brcmf_sdio_regrl(sdiodev,
++					 CORE_CC_REG(base, chipcontrol_addr),
++					 NULL);
++		cc_data_temp &= ~str_mask;
++		drivestrength_sel <<= str_shift;
++		cc_data_temp |= drivestrength_sel;
++		brcmf_sdio_regwl(sdiodev, CORE_CC_REG(base, chipcontrol_addr),
++				 cc_data_temp, NULL);
++
++		brcmf_dbg(INFO, "SDIO: %dmA drive strength selected, set to 0x%08x\n",
++			  drivestrength, cc_data_temp);
++	}
++}
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.h b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.h
+new file mode 100644
+index 0000000..ce974d7
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.h
+@@ -0,0 +1,136 @@
++/*
++ * Copyright (c) 2011 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#ifndef _BRCMFMAC_SDIO_CHIP_H_
++#define _BRCMFMAC_SDIO_CHIP_H_
++
++/*
++ * Core reg address translation.
++ * Both macro's returns a 32 bits byte address on the backplane bus.
++ */
++#define CORE_CC_REG(base, field) \
++		(base + offsetof(struct chipcregs, field))
++#define CORE_BUS_REG(base, field) \
++		(base + offsetof(struct sdpcmd_regs, field))
++#define CORE_SB(base, field) \
++		(base + SBCONFIGOFF + offsetof(struct sbconfig, field))
++
++/* SDIO function 1 register CHIPCLKCSR */
++/* Force ALP request to backplane */
++#define SBSDIO_FORCE_ALP		0x01
++/* Force HT request to backplane */
++#define SBSDIO_FORCE_HT			0x02
++/* Force ILP request to backplane */
++#define SBSDIO_FORCE_ILP		0x04
++/* Make ALP ready (power up xtal) */
++#define SBSDIO_ALP_AVAIL_REQ		0x08
++/* Make HT ready (power up PLL) */
++#define SBSDIO_HT_AVAIL_REQ		0x10
++/* Squelch clock requests from HW */
++#define SBSDIO_FORCE_HW_CLKREQ_OFF	0x20
++/* Status: ALP is ready */
++#define SBSDIO_ALP_AVAIL		0x40
++/* Status: HT is ready */
++#define SBSDIO_HT_AVAIL			0x80
++#define SBSDIO_AVBITS		(SBSDIO_HT_AVAIL | SBSDIO_ALP_AVAIL)
++#define SBSDIO_ALPAV(regval)	((regval) & SBSDIO_AVBITS)
++#define SBSDIO_HTAV(regval)	(((regval) & SBSDIO_AVBITS) == SBSDIO_AVBITS)
++#define SBSDIO_ALPONLY(regval)	(SBSDIO_ALPAV(regval) && !SBSDIO_HTAV(regval))
++#define SBSDIO_CLKAV(regval, alponly) \
++	(SBSDIO_ALPAV(regval) && (alponly ? 1 : SBSDIO_HTAV(regval)))
++
++#define BRCMF_MAX_CORENUM	6
++
++struct chip_core_info {
++	u16 id;
++	u16 rev;
++	u32 base;
++	u32 wrapbase;
++	u32 caps;
++	u32 cib;
++};
++
++struct chip_info {
++	u32 chip;
++	u32 chiprev;
++	u32 socitype;
++	/* core info */
++	/* always put chipcommon core at 0, bus core at 1 */
++	struct chip_core_info c_inf[BRCMF_MAX_CORENUM];
++	u32 pmurev;
++	u32 pmucaps;
++	u32 ramsize;
++
++	bool (*iscoreup)(struct brcmf_sdio_dev *sdiodev, struct chip_info *ci,
++			 u16 coreid);
++	u32 (*corerev)(struct brcmf_sdio_dev *sdiodev, struct chip_info *ci,
++			 u16 coreid);
++	void (*coredisable)(struct brcmf_sdio_dev *sdiodev,
++			struct chip_info *ci, u16 coreid);
++	void (*resetcore)(struct brcmf_sdio_dev *sdiodev,
++			struct chip_info *ci, u16 coreid);
++};
++
++struct sbconfig {
++	u32 PAD[2];
++	u32 sbipsflag;	/* initiator port ocp slave flag */
++	u32 PAD[3];
++	u32 sbtpsflag;	/* target port ocp slave flag */
++	u32 PAD[11];
++	u32 sbtmerrloga;	/* (sonics >= 2.3) */
++	u32 PAD;
++	u32 sbtmerrlog;	/* (sonics >= 2.3) */
++	u32 PAD[3];
++	u32 sbadmatch3;	/* address match3 */
++	u32 PAD;
++	u32 sbadmatch2;	/* address match2 */
++	u32 PAD;
++	u32 sbadmatch1;	/* address match1 */
++	u32 PAD[7];
++	u32 sbimstate;	/* initiator agent state */
++	u32 sbintvec;	/* interrupt mask */
++	u32 sbtmstatelow;	/* target state */
++	u32 sbtmstatehigh;	/* target state */
++	u32 sbbwa0;		/* bandwidth allocation table0 */
++	u32 PAD;
++	u32 sbimconfiglow;	/* initiator configuration */
++	u32 sbimconfighigh;	/* initiator configuration */
++	u32 sbadmatch0;	/* address match0 */
++	u32 PAD;
++	u32 sbtmconfiglow;	/* target configuration */
++	u32 sbtmconfighigh;	/* target configuration */
++	u32 sbbconfig;	/* broadcast configuration */
++	u32 PAD;
++	u32 sbbstate;	/* broadcast state */
++	u32 PAD[3];
++	u32 sbactcnfg;	/* activate configuration */
++	u32 PAD[3];
++	u32 sbflagst;	/* current sbflags */
++	u32 PAD[3];
++	u32 sbidlow;		/* identification */
++	u32 sbidhigh;	/* identification */
++};
++
++extern int brcmf_sdio_chip_attach(struct brcmf_sdio_dev *sdiodev,
++				  struct chip_info **ci_ptr, u32 regs);
++extern void brcmf_sdio_chip_detach(struct chip_info **ci_ptr);
++extern void brcmf_sdio_chip_drivestrengthinit(struct brcmf_sdio_dev *sdiodev,
++					      struct chip_info *ci,
++					      u32 drivestrength);
++extern u8 brcmf_sdio_chip_getinfidx(struct chip_info *ci, u16 coreid);
++
++
++#endif		/* _BRCMFMAC_SDIO_CHIP_H_ */
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h b/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h
+new file mode 100644
+index 0000000..29bf78d2
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h
+@@ -0,0 +1,272 @@
++/*
++ * Copyright (c) 2010 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#ifndef	_BRCM_SDH_H_
++#define	_BRCM_SDH_H_
++
++#include <linux/skbuff.h>
++
++#define SDIO_FUNC_0		0
++#define SDIO_FUNC_1		1
++#define SDIO_FUNC_2		2
++
++#define SDIOD_FBR_SIZE		0x100
++
++/* io_en */
++#define SDIO_FUNC_ENABLE_1	0x02
++#define SDIO_FUNC_ENABLE_2	0x04
++
++/* io_rdys */
++#define SDIO_FUNC_READY_1	0x02
++#define SDIO_FUNC_READY_2	0x04
++
++/* intr_status */
++#define INTR_STATUS_FUNC1	0x2
++#define INTR_STATUS_FUNC2	0x4
++
++/* Maximum number of I/O funcs */
++#define SDIOD_MAX_IOFUNCS	7
++
++/* mask of register map */
++#define REG_F0_REG_MASK		0x7FF
++#define REG_F1_MISC_MASK	0x1FFFF
++
++/* as of sdiod rev 0, supports 3 functions */
++#define SBSDIO_NUM_FUNCTION		3
++
++/* function 0 vendor specific CCCR registers */
++#define SDIO_CCCR_BRCM_SEPINT		0xf2
++
++#define  SDIO_SEPINT_MASK		0x01
++#define  SDIO_SEPINT_OE			0x02
++#define  SDIO_SEPINT_ACT_HI		0x04
++
++/* function 1 miscellaneous registers */
++
++/* sprom command and status */
++#define SBSDIO_SPROM_CS			0x10000
++/* sprom info register */
++#define SBSDIO_SPROM_INFO		0x10001
++/* sprom indirect access data byte 0 */
++#define SBSDIO_SPROM_DATA_LOW		0x10002
++/* sprom indirect access data byte 1 */
++#define SBSDIO_SPROM_DATA_HIGH		0x10003
++/* sprom indirect access addr byte 0 */
++#define SBSDIO_SPROM_ADDR_LOW		0x10004
++/* sprom indirect access addr byte 0 */
++#define SBSDIO_SPROM_ADDR_HIGH		0x10005
++/* xtal_pu (gpio) output */
++#define SBSDIO_CHIP_CTRL_DATA		0x10006
++/* xtal_pu (gpio) enable */
++#define SBSDIO_CHIP_CTRL_EN		0x10007
++/* rev < 7, watermark for sdio device */
++#define SBSDIO_WATERMARK		0x10008
++/* control busy signal generation */
++#define SBSDIO_DEVICE_CTL		0x10009
++
++/* SB Address Window Low (b15) */
++#define SBSDIO_FUNC1_SBADDRLOW		0x1000A
++/* SB Address Window Mid (b23:b16) */
++#define SBSDIO_FUNC1_SBADDRMID		0x1000B
++/* SB Address Window High (b31:b24)    */
++#define SBSDIO_FUNC1_SBADDRHIGH		0x1000C
++/* Frame Control (frame term/abort) */
++#define SBSDIO_FUNC1_FRAMECTRL		0x1000D
++/* ChipClockCSR (ALP/HT ctl/status) */
++#define SBSDIO_FUNC1_CHIPCLKCSR		0x1000E
++/* SdioPullUp (on cmd, d0-d2) */
++#define SBSDIO_FUNC1_SDIOPULLUP		0x1000F
++/* Write Frame Byte Count Low */
++#define SBSDIO_FUNC1_WFRAMEBCLO		0x10019
++/* Write Frame Byte Count High */
++#define SBSDIO_FUNC1_WFRAMEBCHI		0x1001A
++/* Read Frame Byte Count Low */
++#define SBSDIO_FUNC1_RFRAMEBCLO		0x1001B
++/* Read Frame Byte Count High */
++#define SBSDIO_FUNC1_RFRAMEBCHI		0x1001C
++
++#define SBSDIO_FUNC1_MISC_REG_START	0x10000	/* f1 misc register start */
++#define SBSDIO_FUNC1_MISC_REG_LIMIT	0x1001C	/* f1 misc register end */
++
++/* function 1 OCP space */
++
++/* sb offset addr is <= 15 bits, 32k */
++#define SBSDIO_SB_OFT_ADDR_MASK		0x07FFF
++#define SBSDIO_SB_OFT_ADDR_LIMIT	0x08000
++/* with b15, maps to 32-bit SB access */
++#define SBSDIO_SB_ACCESS_2_4B_FLAG	0x08000
++
++/* valid bits in SBSDIO_FUNC1_SBADDRxxx regs */
++
++#define SBSDIO_SBADDRLOW_MASK		0x80	/* Valid bits in SBADDRLOW */
++#define SBSDIO_SBADDRMID_MASK		0xff	/* Valid bits in SBADDRMID */
++#define SBSDIO_SBADDRHIGH_MASK		0xffU	/* Valid bits in SBADDRHIGH */
++/* Address bits from SBADDR regs */
++#define SBSDIO_SBWINDOW_MASK		0xffff8000
++
++#define SDIOH_READ              0	/* Read request */
++#define SDIOH_WRITE             1	/* Write request */
++
++#define SDIOH_DATA_FIX          0	/* Fixed addressing */
++#define SDIOH_DATA_INC          1	/* Incremental addressing */
++
++/* internal return code */
++#define SUCCESS	0
++#define ERROR	1
++
++/* Packet alignment for most efficient SDIO (can change based on platform) */
++#define BRCMF_SDALIGN	(1 << 6)
++
++/* watchdog polling interval in ms */
++#define BRCMF_WD_POLL_MS	10
++
++struct brcmf_sdreg {
++	int func;
++	int offset;
++	int value;
++};
++
++struct brcmf_sdio;
++
++struct brcmf_sdio_dev {
++	struct sdio_func *func[SDIO_MAX_FUNCS];
++	u8 num_funcs;			/* Supported funcs on client */
++	u32 func_cis_ptr[SDIOD_MAX_IOFUNCS];
++	u32 sbwad;			/* Save backplane window address */
++	void *bus;
++	atomic_t suspend;		/* suspend flag */
++	wait_queue_head_t request_byte_wait;
++	wait_queue_head_t request_word_wait;
++	wait_queue_head_t request_chain_wait;
++	wait_queue_head_t request_buffer_wait;
++	struct device *dev;
++	struct brcmf_bus *bus_if;
++#ifdef CONFIG_BRCMFMAC_SDIO_OOB
++	unsigned int irq;		/* oob interrupt number */
++	unsigned long irq_flags;	/* board specific oob flags */
++	bool irq_en;			/* irq enable flags */
++	spinlock_t irq_en_lock;
++	bool irq_wake;			/* irq wake enable flags */
++#endif		/* CONFIG_BRCMFMAC_SDIO_OOB */
++};
++
++/* Register/deregister interrupt handler. */
++extern int brcmf_sdio_intr_register(struct brcmf_sdio_dev *sdiodev);
++extern int brcmf_sdio_intr_unregister(struct brcmf_sdio_dev *sdiodev);
++
++/* sdio device register access interface */
++extern u8 brcmf_sdio_regrb(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret);
++extern u32 brcmf_sdio_regrl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret);
++extern void brcmf_sdio_regwb(struct brcmf_sdio_dev *sdiodev, u32 addr,
++			     u8 data, int *ret);
++extern void brcmf_sdio_regwl(struct brcmf_sdio_dev *sdiodev, u32 addr,
++			     u32 data, int *ret);
++
++/* Buffer transfer to/from device (client) core via cmd53.
++ *   fn:       function number
++ *   addr:     backplane address (i.e. >= regsva from attach)
++ *   flags:    backplane width, address increment, sync/async
++ *   buf:      pointer to memory data buffer
++ *   nbytes:   number of bytes to transfer to/from buf
++ *   pkt:      pointer to packet associated with buf (if any)
++ *   complete: callback function for command completion (async only)
++ *   handle:   handle for completion callback (first arg in callback)
++ * Returns 0 or error code.
++ * NOTE: Async operation is not currently supported.
++ */
++extern int
++brcmf_sdcard_send_pkt(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
++		      uint flags, struct sk_buff *pkt);
++extern int
++brcmf_sdcard_send_buf(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
++		      uint flags, u8 *buf, uint nbytes);
++
++extern int
++brcmf_sdcard_recv_pkt(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
++		      uint flags, struct sk_buff *pkt);
++extern int
++brcmf_sdcard_recv_buf(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
++		      uint flags, u8 *buf, uint nbytes);
++extern int
++brcmf_sdcard_recv_chain(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
++			uint flags, struct sk_buff_head *pktq);
++
++/* Flags bits */
++
++/* Four-byte target (backplane) width (vs. two-byte) */
++#define SDIO_REQ_4BYTE	0x1
++/* Fixed address (FIFO) (vs. incrementing address) */
++#define SDIO_REQ_FIXED	0x2
++/* Async request (vs. sync request) */
++#define SDIO_REQ_ASYNC	0x4
++
++/* Read/write to memory block (F1, no FIFO) via CMD53 (sync only).
++ *   rw:       read or write (0/1)
++ *   addr:     direct SDIO address
++ *   buf:      pointer to memory data buffer
++ *   nbytes:   number of bytes to transfer to/from buf
++ * Returns 0 or error code.
++ */
++extern int brcmf_sdcard_rwdata(struct brcmf_sdio_dev *sdiodev, uint rw,
++			       u32 addr, u8 *buf, uint nbytes);
++
++/* Issue an abort to the specified function */
++extern int brcmf_sdcard_abort(struct brcmf_sdio_dev *sdiodev, uint fn);
++
++/* platform specific/high level functions */
++extern int brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev);
++extern int brcmf_sdio_remove(struct brcmf_sdio_dev *sdiodev);
++
++extern int brcmf_sdcard_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev,
++					  u32 address);
++
++/* attach, return handler on success, NULL if failed.
++ *  The handler shall be provided by all subsequent calls. No local cache
++ *  cfghdl points to the starting address of pci device mapped memory
++ */
++extern int brcmf_sdioh_attach(struct brcmf_sdio_dev *sdiodev);
++extern void brcmf_sdioh_detach(struct brcmf_sdio_dev *sdiodev);
++
++/* read or write one byte using cmd52 */
++extern int brcmf_sdioh_request_byte(struct brcmf_sdio_dev *sdiodev, uint rw,
++				    uint fnc, uint addr, u8 *byte);
++
++/* read or write 2/4 bytes using cmd53 */
++extern int
++brcmf_sdioh_request_word(struct brcmf_sdio_dev *sdiodev,
++			 uint rw, uint fnc, uint addr,
++			 u32 *word, uint nbyte);
++
++/* read or write any buffer using cmd53 */
++extern int
++brcmf_sdioh_request_buffer(struct brcmf_sdio_dev *sdiodev,
++			   uint fix_inc, uint rw, uint fnc_num, u32 addr,
++			   struct sk_buff *pkt);
++extern int
++brcmf_sdioh_request_chain(struct brcmf_sdio_dev *sdiodev, uint fix_inc,
++			  uint write, uint func, uint addr,
++			  struct sk_buff_head *pktq);
++
++/* Watchdog timer interface for pm ops */
++extern void brcmf_sdio_wdtmr_enable(struct brcmf_sdio_dev *sdiodev,
++				    bool enable);
++
++extern void *brcmf_sdbrcm_probe(u32 regsva, struct brcmf_sdio_dev *sdiodev);
++extern void brcmf_sdbrcm_disconnect(void *ptr);
++extern void brcmf_sdbrcm_isr(void *arg);
++
++extern void brcmf_sdbrcm_wd_timer(struct brcmf_sdio *bus, uint wdtick);
++#endif				/* _BRCM_SDH_H_ */
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+new file mode 100644
+index 0000000..be1edc8
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+@@ -0,0 +1,1617 @@
++/*
++ * Copyright (c) 2011 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#include <linux/init.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/kthread.h>
++#include <linux/slab.h>
++#include <linux/skbuff.h>
++#include <linux/netdevice.h>
++#include <linux/spinlock.h>
++#include <linux/ethtool.h>
++#include <linux/fcntl.h>
++#include <linux/fs.h>
++#include <linux/uaccess.h>
++#include <linux/firmware.h>
++#include <linux/usb.h>
++#include <linux/vmalloc.h>
++#include <net/cfg80211.h>
++
++#include <defs.h>
++#include <brcmu_utils.h>
++#include <brcmu_wifi.h>
++#include <dhd_bus.h>
++#include <dhd_dbg.h>
++
++#include "usb_rdl.h"
++#include "usb.h"
++
++#define IOCTL_RESP_TIMEOUT  2000
++
++#define BRCMF_USB_SYNC_TIMEOUT		300	/* ms */
++#define BRCMF_USB_DLIMAGE_SPINWAIT	100	/* in unit of ms */
++#define BRCMF_USB_DLIMAGE_LIMIT		500	/* spinwait limit (ms) */
++
++#define BRCMF_POSTBOOT_ID		0xA123  /* ID to detect if dongle
++						   has boot up */
++#define BRCMF_USB_RESETCFG_SPINWAIT	1	/* wait after resetcfg (ms) */
++
++#define BRCMF_USB_NRXQ	50
++#define BRCMF_USB_NTXQ	50
++
++#define CONFIGDESC(usb)         (&((usb)->actconfig)->desc)
++#define IFPTR(usb, idx)         ((usb)->actconfig->interface[(idx)])
++#define IFALTS(usb, idx)        (IFPTR((usb), (idx))->altsetting[0])
++#define IFDESC(usb, idx)        IFALTS((usb), (idx)).desc
++#define IFEPDESC(usb, idx, ep)  (IFALTS((usb), (idx)).endpoint[(ep)]).desc
++
++#define CONTROL_IF              0
++#define BULK_IF                 0
++
++#define BRCMF_USB_CBCTL_WRITE	0
++#define BRCMF_USB_CBCTL_READ	1
++#define BRCMF_USB_MAX_PKT_SIZE	1600
++
++#define BRCMF_USB_43236_FW_NAME	"brcm/brcmfmac43236b.bin"
++
++enum usbdev_suspend_state {
++	USBOS_SUSPEND_STATE_DEVICE_ACTIVE = 0, /* Device is busy, won't allow
++						  suspend */
++	USBOS_SUSPEND_STATE_SUSPEND_PENDING,	/* Device is idle, can be
++						 * suspended. Wating PM to
++						 * suspend the device
++						 */
++	USBOS_SUSPEND_STATE_SUSPENDED	/* Device suspended */
++};
++
++struct brcmf_usb_probe_info {
++	void *usbdev_info;
++	struct usb_device *usb; /* USB device pointer from OS */
++	uint rx_pipe, tx_pipe, intr_pipe, rx_pipe2;
++	int intr_size; /* Size of interrupt message */
++	int interval;  /* Interrupt polling interval */
++	int vid;
++	int pid;
++	enum usb_device_speed device_speed;
++	enum usbdev_suspend_state suspend_state;
++	struct usb_interface *intf;
++};
++static struct brcmf_usb_probe_info usbdev_probe_info;
++
++struct brcmf_usb_image {
++	void *data;
++	u32 len;
++};
++static struct brcmf_usb_image g_image = { NULL, 0 };
++
++struct intr_transfer_buf {
++	u32 notification;
++	u32 reserved;
++};
++
++struct brcmf_usbdev_info {
++	struct brcmf_usbdev bus_pub; /* MUST BE FIRST */
++	spinlock_t qlock;
++	struct list_head rx_freeq;
++	struct list_head rx_postq;
++	struct list_head tx_freeq;
++	struct list_head tx_postq;
++	enum usbdev_suspend_state suspend_state;
++	uint rx_pipe, tx_pipe, intr_pipe, rx_pipe2;
++
++	bool activity;
++	int rx_low_watermark;
++	int tx_low_watermark;
++	int tx_high_watermark;
++	bool txoff;
++	bool rxoff;
++	bool txoverride;
++
++	struct brcmf_usbreq *tx_reqs;
++	struct brcmf_usbreq *rx_reqs;
++
++	u8 *image;	/* buffer for combine fw and nvram */
++	int image_len;
++
++	wait_queue_head_t wait;
++	bool waitdone;
++	int sync_urb_status;
++
++	struct usb_device *usbdev;
++	struct device *dev;
++	enum usb_device_speed  device_speed;
++
++	int ctl_in_pipe, ctl_out_pipe;
++	struct urb *ctl_urb; /* URB for control endpoint */
++	struct usb_ctrlrequest ctl_write;
++	struct usb_ctrlrequest ctl_read;
++	u32 ctl_urb_actual_length;
++	int ctl_urb_status;
++	int ctl_completed;
++	wait_queue_head_t ioctl_resp_wait;
++	wait_queue_head_t ctrl_wait;
++	ulong ctl_op;
++
++	bool rxctl_deferrespok;
++
++	struct urb *bulk_urb; /* used for FW download */
++	struct urb *intr_urb; /* URB for interrupt endpoint */
++	int intr_size;          /* Size of interrupt message */
++	int interval;           /* Interrupt polling interval */
++	struct intr_transfer_buf intr; /* Data buffer for interrupt endpoint */
++
++	struct brcmf_usb_probe_info probe_info;
++
++};
++
++static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
++				struct brcmf_usbreq  *req);
++
++MODULE_AUTHOR("Broadcom Corporation");
++MODULE_DESCRIPTION("Broadcom 802.11n wireless LAN fullmac usb driver.");
++MODULE_SUPPORTED_DEVICE("Broadcom 802.11n WLAN fullmac usb cards");
++MODULE_LICENSE("Dual BSD/GPL");
++
++static struct brcmf_usbdev *brcmf_usb_get_buspub(struct device *dev)
++{
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	return bus_if->bus_priv.usb;
++}
++
++static struct brcmf_usbdev_info *brcmf_usb_get_businfo(struct device *dev)
++{
++	return brcmf_usb_get_buspub(dev)->devinfo;
++}
++
++#if 0
++static void
++brcmf_usb_txflowcontrol(struct brcmf_usbdev_info *devinfo, bool onoff)
++{
++	dhd_txflowcontrol(devinfo->bus_pub.netdev, 0, onoff);
++}
++#endif
++
++static int brcmf_usb_ioctl_resp_wait(struct brcmf_usbdev_info *devinfo,
++	 uint *condition, bool *pending)
++{
++	DECLARE_WAITQUEUE(wait, current);
++	int timeout = IOCTL_RESP_TIMEOUT;
++
++	/* Convert timeout in millsecond to jiffies */
++	timeout = msecs_to_jiffies(timeout);
++	/* Wait until control frame is available */
++	add_wait_queue(&devinfo->ioctl_resp_wait, &wait);
++	set_current_state(TASK_INTERRUPTIBLE);
++
++	smp_mb();
++	while (!(*condition) && (!signal_pending(current) && timeout)) {
++		timeout = schedule_timeout(timeout);
++		/* Wait until control frame is available */
++		smp_mb();
++	}
++
++	if (signal_pending(current))
++		*pending = true;
++
++	set_current_state(TASK_RUNNING);
++	remove_wait_queue(&devinfo->ioctl_resp_wait, &wait);
++
++	return timeout;
++}
++
++static int brcmf_usb_ioctl_resp_wake(struct brcmf_usbdev_info *devinfo)
++{
++	if (waitqueue_active(&devinfo->ioctl_resp_wait))
++		wake_up_interruptible(&devinfo->ioctl_resp_wait);
++
++	return 0;
++}
++
++static void
++brcmf_usb_ctl_complete(struct brcmf_usbdev_info *devinfo, int type, int status)
++{
++
++	if (unlikely(devinfo == NULL))
++		return;
++
++	if (type == BRCMF_USB_CBCTL_READ) {
++		if (status == 0)
++			devinfo->bus_pub.stats.rx_ctlpkts++;
++		else
++			devinfo->bus_pub.stats.rx_ctlerrs++;
++	} else if (type == BRCMF_USB_CBCTL_WRITE) {
++		if (status == 0)
++			devinfo->bus_pub.stats.tx_ctlpkts++;
++		else
++			devinfo->bus_pub.stats.tx_ctlerrs++;
++	}
++
++	devinfo->ctl_urb_status = status;
++	devinfo->ctl_completed = true;
++	brcmf_usb_ioctl_resp_wake(devinfo);
++}
++
++static void
++brcmf_usb_ctlread_complete(struct urb *urb)
++{
++	struct brcmf_usbdev_info *devinfo =
++		(struct brcmf_usbdev_info *)urb->context;
++
++	devinfo->ctl_urb_actual_length = urb->actual_length;
++	brcmf_usb_ctl_complete(devinfo, BRCMF_USB_CBCTL_READ,
++		urb->status);
++}
++
++static void
++brcmf_usb_ctlwrite_complete(struct urb *urb)
++{
++	struct brcmf_usbdev_info *devinfo =
++		(struct brcmf_usbdev_info *)urb->context;
++
++	brcmf_usb_ctl_complete(devinfo, BRCMF_USB_CBCTL_WRITE,
++		urb->status);
++}
++
++static int brcmf_usb_pnp(struct brcmf_usbdev_info *devinfo, uint state)
++{
++	return 0;
++}
++
++static int
++brcmf_usb_send_ctl(struct brcmf_usbdev_info *devinfo, u8 *buf, int len)
++{
++	int ret;
++	u16 size;
++
++	if (devinfo == NULL || buf == NULL ||
++	    len == 0 || devinfo->ctl_urb == NULL)
++		return -EINVAL;
++
++	/* If the USB/HSIC bus in sleep state, wake it up */
++	if (devinfo->suspend_state == USBOS_SUSPEND_STATE_SUSPENDED)
++		if (brcmf_usb_pnp(devinfo, BCMFMAC_USB_PNP_RESUME) != 0) {
++			brcmf_dbg(ERROR, "Could not Resume the bus!\n");
++			return -EIO;
++		}
++
++	devinfo->activity = true;
++	size = len;
++	devinfo->ctl_write.wLength = cpu_to_le16p(&size);
++	devinfo->ctl_urb->transfer_buffer_length = size;
++	devinfo->ctl_urb_status = 0;
++	devinfo->ctl_urb_actual_length = 0;
++
++	usb_fill_control_urb(devinfo->ctl_urb,
++		devinfo->usbdev,
++		devinfo->ctl_out_pipe,
++		(unsigned char *) &devinfo->ctl_write,
++		buf, size,
++		(usb_complete_t)brcmf_usb_ctlwrite_complete,
++		devinfo);
++
++	ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
++	if (ret < 0)
++		brcmf_dbg(ERROR, "usb_submit_urb failed %d\n", ret);
++
++	return ret;
++}
++
++static int
++brcmf_usb_recv_ctl(struct brcmf_usbdev_info *devinfo, u8 *buf, int len)
++{
++	int ret;
++	u16 size;
++
++	if ((devinfo == NULL) || (buf == NULL) || (len == 0)
++		|| (devinfo->ctl_urb == NULL))
++		return -EINVAL;
++
++	size = len;
++	devinfo->ctl_read.wLength = cpu_to_le16p(&size);
++	devinfo->ctl_urb->transfer_buffer_length = size;
++
++	if (devinfo->rxctl_deferrespok) {
++		/* BMAC model */
++		devinfo->ctl_read.bRequestType = USB_DIR_IN
++			| USB_TYPE_VENDOR | USB_RECIP_INTERFACE;
++		devinfo->ctl_read.bRequest = DL_DEFER_RESP_OK;
++	} else {
++		/* full dongle model */
++		devinfo->ctl_read.bRequestType = USB_DIR_IN
++			| USB_TYPE_CLASS | USB_RECIP_INTERFACE;
++		devinfo->ctl_read.bRequest = 1;
++	}
++
++	usb_fill_control_urb(devinfo->ctl_urb,
++		devinfo->usbdev,
++		devinfo->ctl_in_pipe,
++		(unsigned char *) &devinfo->ctl_read,
++		buf, size,
++		(usb_complete_t)brcmf_usb_ctlread_complete,
++		devinfo);
++
++	ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
++	if (ret < 0)
++		brcmf_dbg(ERROR, "usb_submit_urb failed %d\n", ret);
++
++	return ret;
++}
++
++static int brcmf_usb_tx_ctlpkt(struct device *dev, u8 *buf, u32 len)
++{
++	int err = 0;
++	int timeout = 0;
++	bool pending;
++	struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
++
++	if (devinfo->bus_pub.state != BCMFMAC_USB_STATE_UP) {
++		/* TODO: handle suspend/resume */
++		return -EIO;
++	}
++
++	if (test_and_set_bit(0, &devinfo->ctl_op))
++		return -EIO;
++
++	err = brcmf_usb_send_ctl(devinfo, buf, len);
++	if (err) {
++		brcmf_dbg(ERROR, "fail %d bytes: %d\n", err, len);
++		return err;
++	}
++
++	devinfo->ctl_completed = false;
++	timeout = brcmf_usb_ioctl_resp_wait(devinfo, &devinfo->ctl_completed,
++					    &pending);
++	clear_bit(0, &devinfo->ctl_op);
++	if (!timeout) {
++		brcmf_dbg(ERROR, "Txctl wait timed out\n");
++		err = -EIO;
++	}
++	return err;
++}
++
++static int brcmf_usb_rx_ctlpkt(struct device *dev, u8 *buf, u32 len)
++{
++	int err = 0;
++	int timeout = 0;
++	bool pending;
++	struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
++
++	if (devinfo->bus_pub.state != BCMFMAC_USB_STATE_UP) {
++		/* TODO: handle suspend/resume */
++		return -EIO;
++	}
++	if (test_and_set_bit(0, &devinfo->ctl_op))
++		return -EIO;
++
++	err = brcmf_usb_recv_ctl(devinfo, buf, len);
++	if (err) {
++		brcmf_dbg(ERROR, "fail %d bytes: %d\n", err, len);
++		return err;
++	}
++	devinfo->ctl_completed = false;
++	timeout = brcmf_usb_ioctl_resp_wait(devinfo, &devinfo->ctl_completed,
++					    &pending);
++	err = devinfo->ctl_urb_status;
++	clear_bit(0, &devinfo->ctl_op);
++	if (!timeout) {
++		brcmf_dbg(ERROR, "rxctl wait timed out\n");
++		err = -EIO;
++	}
++	if (!err)
++		return devinfo->ctl_urb_actual_length;
++	else
++		return err;
++}
++
++static struct brcmf_usbreq *brcmf_usb_deq(struct brcmf_usbdev_info *devinfo,
++					  struct list_head *q)
++{
++	unsigned long flags;
++	struct brcmf_usbreq  *req;
++	spin_lock_irqsave(&devinfo->qlock, flags);
++	if (list_empty(q)) {
++		spin_unlock_irqrestore(&devinfo->qlock, flags);
++		return NULL;
++	}
++	req = list_entry(q->next, struct brcmf_usbreq, list);
++	list_del_init(q->next);
++	spin_unlock_irqrestore(&devinfo->qlock, flags);
++	return req;
++
++}
++
++static void brcmf_usb_enq(struct brcmf_usbdev_info *devinfo,
++			  struct list_head *q, struct brcmf_usbreq *req)
++{
++	unsigned long flags;
++	spin_lock_irqsave(&devinfo->qlock, flags);
++	list_add_tail(&req->list, q);
++	spin_unlock_irqrestore(&devinfo->qlock, flags);
++}
++
++static struct brcmf_usbreq *
++brcmf_usbdev_qinit(struct list_head *q, int qsize)
++{
++	int i;
++	struct brcmf_usbreq *req, *reqs;
++
++	reqs = kzalloc(sizeof(struct brcmf_usbreq) * qsize, GFP_ATOMIC);
++	if (reqs == NULL) {
++		brcmf_dbg(ERROR, "fail to allocate memory!\n");
++		return NULL;
++	}
++	req = reqs;
++
++	for (i = 0; i < qsize; i++) {
++		req->urb = usb_alloc_urb(0, GFP_ATOMIC);
++		if (!req->urb)
++			goto fail;
++
++		INIT_LIST_HEAD(&req->list);
++		list_add_tail(&req->list, q);
++		req++;
++	}
++	return reqs;
++fail:
++	brcmf_dbg(ERROR, "fail!\n");
++	while (!list_empty(q)) {
++		req = list_entry(q->next, struct brcmf_usbreq, list);
++		if (req && req->urb)
++			usb_free_urb(req->urb);
++		list_del(q->next);
++	}
++	return NULL;
++
++}
++
++static void brcmf_usb_free_q(struct list_head *q, bool pending)
++{
++	struct brcmf_usbreq *req, *next;
++	int i = 0;
++	list_for_each_entry_safe(req, next, q, list) {
++		if (!req->urb) {
++			brcmf_dbg(ERROR, "bad req\n");
++			break;
++		}
++		i++;
++		if (pending) {
++			usb_kill_urb(req->urb);
++		} else {
++			usb_free_urb(req->urb);
++			list_del_init(&req->list);
++		}
++	}
++}
++
++static void brcmf_usb_del_fromq(struct brcmf_usbdev_info *devinfo,
++				struct brcmf_usbreq *req)
++{
++	unsigned long flags;
++
++	spin_lock_irqsave(&devinfo->qlock, flags);
++	list_del_init(&req->list);
++	spin_unlock_irqrestore(&devinfo->qlock, flags);
++}
++
++
++static void brcmf_usb_tx_complete(struct urb *urb)
++{
++	struct brcmf_usbreq *req = (struct brcmf_usbreq *)urb->context;
++	struct brcmf_usbdev_info *devinfo = req->devinfo;
++
++	brcmf_usb_del_fromq(devinfo, req);
++	if (urb->status == 0)
++		devinfo->bus_pub.bus->dstats.tx_packets++;
++	else
++		devinfo->bus_pub.bus->dstats.tx_errors++;
++
++	dev_kfree_skb(req->skb);
++	req->skb = NULL;
++	brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req);
++
++}
++
++static void brcmf_usb_rx_complete(struct urb *urb)
++{
++	struct brcmf_usbreq  *req = (struct brcmf_usbreq *)urb->context;
++	struct brcmf_usbdev_info *devinfo = req->devinfo;
++	struct sk_buff *skb;
++	int ifidx = 0;
++
++	brcmf_usb_del_fromq(devinfo, req);
++	skb = req->skb;
++	req->skb = NULL;
++
++	if (urb->status == 0) {
++		devinfo->bus_pub.bus->dstats.rx_packets++;
++	} else {
++		devinfo->bus_pub.bus->dstats.rx_errors++;
++		dev_kfree_skb(skb);
++		brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req);
++		return;
++	}
++
++	if (devinfo->bus_pub.state == BCMFMAC_USB_STATE_UP) {
++		skb_put(skb, urb->actual_length);
++		if (brcmf_proto_hdrpull(devinfo->dev, &ifidx, skb) != 0) {
++			brcmf_dbg(ERROR, "rx protocol error\n");
++			brcmu_pkt_buf_free_skb(skb);
++			devinfo->bus_pub.bus->dstats.rx_errors++;
++		} else {
++			brcmf_rx_packet(devinfo->dev, ifidx, skb);
++			brcmf_usb_rx_refill(devinfo, req);
++		}
++	} else {
++		dev_kfree_skb(skb);
++	}
++	return;
++
++}
++
++static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
++				struct brcmf_usbreq  *req)
++{
++	struct sk_buff *skb;
++	int ret;
++
++	if (!req || !devinfo)
++		return;
++
++	skb = dev_alloc_skb(devinfo->bus_pub.bus_mtu);
++	if (!skb) {
++		brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req);
++		return;
++	}
++	req->skb = skb;
++
++	usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->rx_pipe,
++			  skb->data, skb_tailroom(skb), brcmf_usb_rx_complete,
++			  req);
++	req->urb->transfer_flags |= URB_ZERO_PACKET;
++	req->devinfo = devinfo;
++
++	ret = usb_submit_urb(req->urb, GFP_ATOMIC);
++	if (ret == 0) {
++		brcmf_usb_enq(devinfo, &devinfo->rx_postq, req);
++	} else {
++		dev_kfree_skb(req->skb);
++		req->skb = NULL;
++		brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req);
++	}
++	return;
++}
++
++static void brcmf_usb_rx_fill_all(struct brcmf_usbdev_info *devinfo)
++{
++	struct brcmf_usbreq *req;
++
++	if (devinfo->bus_pub.state != BCMFMAC_USB_STATE_UP) {
++		brcmf_dbg(ERROR, "bus is not up\n");
++		return;
++	}
++	while ((req = brcmf_usb_deq(devinfo, &devinfo->rx_freeq)) != NULL)
++		brcmf_usb_rx_refill(devinfo, req);
++}
++
++static void
++brcmf_usb_state_change(struct brcmf_usbdev_info *devinfo, int state)
++{
++	struct brcmf_bus *bcmf_bus = devinfo->bus_pub.bus;
++	int old_state;
++
++
++	if (devinfo->bus_pub.state == state)
++		return;
++
++	old_state = devinfo->bus_pub.state;
++	brcmf_dbg(TRACE, "dbus state change from %d to to %d\n",
++		  old_state, state);
++
++	/* Don't update state if it's PnP firmware re-download */
++	if (state != BCMFMAC_USB_STATE_PNP_FWDL) /* TODO */
++		devinfo->bus_pub.state = state;
++
++	if ((old_state  == BCMFMAC_USB_STATE_SLEEP)
++		&& (state == BCMFMAC_USB_STATE_UP)) {
++		brcmf_usb_rx_fill_all(devinfo);
++	}
++
++	/* update state of upper layer */
++	if (state == BCMFMAC_USB_STATE_DOWN) {
++		brcmf_dbg(INFO, "DBUS is down\n");
++		bcmf_bus->state = BRCMF_BUS_DOWN;
++	} else {
++		brcmf_dbg(INFO, "DBUS current state=%d\n", state);
++	}
++}
++
++static void
++brcmf_usb_intr_complete(struct urb *urb)
++{
++	struct brcmf_usbdev_info *devinfo =
++			(struct brcmf_usbdev_info *)urb->context;
++	bool killed;
++
++	if (devinfo == NULL)
++		return;
++
++	if (unlikely(urb->status)) {
++		if (devinfo->suspend_state ==
++			USBOS_SUSPEND_STATE_SUSPEND_PENDING)
++			killed = true;
++
++		if ((urb->status == -ENOENT && (!killed))
++			|| urb->status == -ESHUTDOWN ||
++			urb->status == -ENODEV) {
++			brcmf_usb_state_change(devinfo, BCMFMAC_USB_STATE_DOWN);
++		}
++	}
++
++	if (devinfo->bus_pub.state == BCMFMAC_USB_STATE_DOWN) {
++		brcmf_dbg(ERROR, "intr cb when DBUS down, ignoring\n");
++		return;
++	}
++
++	if (devinfo->bus_pub.state == BCMFMAC_USB_STATE_UP)
++		usb_submit_urb(devinfo->intr_urb, GFP_ATOMIC);
++}
++
++static int brcmf_usb_tx(struct device *dev, struct sk_buff *skb)
++{
++	struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
++	struct brcmf_usbreq  *req;
++	int ret;
++
++	if (devinfo->bus_pub.state != BCMFMAC_USB_STATE_UP) {
++		/* TODO: handle suspend/resume */
++		return -EIO;
++	}
++
++	req = brcmf_usb_deq(devinfo, &devinfo->tx_freeq);
++	if (!req) {
++		brcmf_dbg(ERROR, "no req to send\n");
++		return -ENOMEM;
++	}
++	if (!req->urb) {
++		brcmf_dbg(ERROR, "no urb for req %p\n", req);
++		return -ENOBUFS;
++	}
++
++	req->skb = skb;
++	req->devinfo = devinfo;
++	usb_fill_bulk_urb(req->urb, devinfo->usbdev, devinfo->tx_pipe,
++			  skb->data, skb->len, brcmf_usb_tx_complete, req);
++	req->urb->transfer_flags |= URB_ZERO_PACKET;
++	ret = usb_submit_urb(req->urb, GFP_ATOMIC);
++	if (!ret) {
++		brcmf_usb_enq(devinfo, &devinfo->tx_postq, req);
++	} else {
++		req->skb = NULL;
++		brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req);
++	}
++
++	return ret;
++}
++
++
++static int brcmf_usb_up(struct device *dev)
++{
++	struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
++	u16 ifnum;
++
++	if (devinfo->bus_pub.state == BCMFMAC_USB_STATE_UP)
++		return 0;
++
++	/* If the USB/HSIC bus in sleep state, wake it up */
++	if (devinfo->suspend_state == USBOS_SUSPEND_STATE_SUSPENDED) {
++		if (brcmf_usb_pnp(devinfo, BCMFMAC_USB_PNP_RESUME) != 0) {
++			brcmf_dbg(ERROR, "Could not Resume the bus!\n");
++			return -EIO;
++		}
++	}
++	devinfo->activity = true;
++
++	/* Success, indicate devinfo is fully up */
++	brcmf_usb_state_change(devinfo, BCMFMAC_USB_STATE_UP);
++
++	if (devinfo->intr_urb) {
++		int ret;
++
++		usb_fill_int_urb(devinfo->intr_urb, devinfo->usbdev,
++			devinfo->intr_pipe,
++			&devinfo->intr,
++			devinfo->intr_size,
++			(usb_complete_t)brcmf_usb_intr_complete,
++			devinfo,
++			devinfo->interval);
++
++		ret = usb_submit_urb(devinfo->intr_urb, GFP_ATOMIC);
++		if (ret) {
++			brcmf_dbg(ERROR, "USB_SUBMIT_URB failed with status %d\n",
++				  ret);
++			return -EINVAL;
++		}
++	}
++
++	if (devinfo->ctl_urb) {
++		devinfo->ctl_in_pipe = usb_rcvctrlpipe(devinfo->usbdev, 0);
++		devinfo->ctl_out_pipe = usb_sndctrlpipe(devinfo->usbdev, 0);
++
++		ifnum = IFDESC(devinfo->usbdev, CONTROL_IF).bInterfaceNumber;
++
++		/* CTL Write */
++		devinfo->ctl_write.bRequestType =
++			USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
++		devinfo->ctl_write.bRequest = 0;
++		devinfo->ctl_write.wValue = cpu_to_le16(0);
++		devinfo->ctl_write.wIndex = cpu_to_le16p(&ifnum);
++
++		/* CTL Read */
++		devinfo->ctl_read.bRequestType =
++			USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE;
++		devinfo->ctl_read.bRequest = 1;
++		devinfo->ctl_read.wValue = cpu_to_le16(0);
++		devinfo->ctl_read.wIndex = cpu_to_le16p(&ifnum);
++	}
++	brcmf_usb_rx_fill_all(devinfo);
++	return 0;
++}
++
++static void brcmf_usb_down(struct device *dev)
++{
++	struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(dev);
++
++	if (devinfo == NULL)
++		return;
++
++	brcmf_dbg(TRACE, "enter\n");
++	if (devinfo->bus_pub.state == BCMFMAC_USB_STATE_DOWN)
++		return;
++
++	brcmf_usb_state_change(devinfo, BCMFMAC_USB_STATE_DOWN);
++	if (devinfo->intr_urb)
++		usb_kill_urb(devinfo->intr_urb);
++
++	if (devinfo->ctl_urb)
++		usb_kill_urb(devinfo->ctl_urb);
++
++	if (devinfo->bulk_urb)
++		usb_kill_urb(devinfo->bulk_urb);
++	brcmf_usb_free_q(&devinfo->tx_postq, true);
++
++	brcmf_usb_free_q(&devinfo->rx_postq, true);
++}
++
++static int
++brcmf_usb_sync_wait(struct brcmf_usbdev_info *devinfo, u16 time)
++{
++	int ret;
++	int err = 0;
++	int ms = time;
++
++	ret = wait_event_interruptible_timeout(devinfo->wait,
++		devinfo->waitdone == true, (ms * HZ / 1000));
++
++	if ((devinfo->waitdone == false) || (devinfo->sync_urb_status)) {
++		brcmf_dbg(ERROR, "timeout(%d) or urb err=%d\n",
++			  ret, devinfo->sync_urb_status);
++		err = -EINVAL;
++	}
++	devinfo->waitdone = false;
++	return err;
++}
++
++static void
++brcmf_usb_sync_complete(struct urb *urb)
++{
++	struct brcmf_usbdev_info *devinfo =
++			(struct brcmf_usbdev_info *)urb->context;
++
++	devinfo->waitdone = true;
++	wake_up_interruptible(&devinfo->wait);
++	devinfo->sync_urb_status = urb->status;
++}
++
++static bool brcmf_usb_dl_cmd(struct brcmf_usbdev_info *devinfo, u8 cmd,
++			     void *buffer, int buflen)
++{
++	int ret = 0;
++	char *tmpbuf;
++	u16 size;
++
++	if ((!devinfo) || (devinfo->ctl_urb == NULL))
++		return false;
++
++	tmpbuf = kmalloc(buflen, GFP_ATOMIC);
++	if (!tmpbuf)
++		return false;
++
++	size = buflen;
++	devinfo->ctl_urb->transfer_buffer_length = size;
++
++	devinfo->ctl_read.wLength = cpu_to_le16p(&size);
++	devinfo->ctl_read.bRequestType = USB_DIR_IN | USB_TYPE_VENDOR |
++		USB_RECIP_INTERFACE;
++	devinfo->ctl_read.bRequest = cmd;
++
++	usb_fill_control_urb(devinfo->ctl_urb,
++		devinfo->usbdev,
++		usb_rcvctrlpipe(devinfo->usbdev, 0),
++		(unsigned char *) &devinfo->ctl_read,
++		(void *) tmpbuf, size,
++		(usb_complete_t)brcmf_usb_sync_complete, devinfo);
++
++	ret = usb_submit_urb(devinfo->ctl_urb, GFP_ATOMIC);
++	if (ret < 0) {
++		brcmf_dbg(ERROR, "usb_submit_urb failed %d\n", ret);
++		kfree(tmpbuf);
++		return false;
++	}
++
++	ret = brcmf_usb_sync_wait(devinfo, BRCMF_USB_SYNC_TIMEOUT);
++	memcpy(buffer, tmpbuf, buflen);
++	kfree(tmpbuf);
++
++	return (ret == 0);
++}
++
++static bool
++brcmf_usb_dlneeded(struct brcmf_usbdev_info *devinfo)
++{
++	struct bootrom_id_le id;
++	u32 chipid, chiprev;
++
++	brcmf_dbg(TRACE, "enter\n");
++
++	if (devinfo == NULL)
++		return false;
++
++	/* Check if firmware downloaded already by querying runtime ID */
++	id.chip = cpu_to_le32(0xDEAD);
++	brcmf_usb_dl_cmd(devinfo, DL_GETVER, &id,
++		sizeof(struct bootrom_id_le));
++
++	chipid = le32_to_cpu(id.chip);
++	chiprev = le32_to_cpu(id.chiprev);
++
++	if ((chipid & 0x4300) == 0x4300)
++		brcmf_dbg(INFO, "chip %x rev 0x%x\n", chipid, chiprev);
++	else
++		brcmf_dbg(INFO, "chip %d rev 0x%x\n", chipid, chiprev);
++	if (chipid == BRCMF_POSTBOOT_ID) {
++		brcmf_dbg(INFO, "firmware already downloaded\n");
++		brcmf_usb_dl_cmd(devinfo, DL_RESETCFG, &id,
++			sizeof(struct bootrom_id_le));
++		return false;
++	} else {
++		devinfo->bus_pub.devid = chipid;
++		devinfo->bus_pub.chiprev = chiprev;
++	}
++	return true;
++}
++
++static int
++brcmf_usb_resetcfg(struct brcmf_usbdev_info *devinfo)
++{
++	struct bootrom_id_le id;
++	u16 wait = 0, wait_time;
++
++	brcmf_dbg(TRACE, "enter\n");
++
++	if (devinfo == NULL)
++		return -EINVAL;
++
++	/* Give dongle chance to boot */
++	wait_time = BRCMF_USB_DLIMAGE_SPINWAIT;
++	while (wait < BRCMF_USB_DLIMAGE_LIMIT) {
++		mdelay(wait_time);
++		wait += wait_time;
++		id.chip = cpu_to_le32(0xDEAD);       /* Get the ID */
++		brcmf_usb_dl_cmd(devinfo, DL_GETVER, &id,
++			sizeof(struct bootrom_id_le));
++		if (id.chip == cpu_to_le32(BRCMF_POSTBOOT_ID))
++			break;
++	}
++
++	if (id.chip == cpu_to_le32(BRCMF_POSTBOOT_ID)) {
++		brcmf_dbg(INFO, "download done %d ms postboot chip 0x%x/rev 0x%x\n",
++			  wait, le32_to_cpu(id.chip), le32_to_cpu(id.chiprev));
++
++		brcmf_usb_dl_cmd(devinfo, DL_RESETCFG, &id,
++			sizeof(struct bootrom_id_le));
++
++		/* XXX this wait may not be necessary */
++		mdelay(BRCMF_USB_RESETCFG_SPINWAIT);
++		return 0;
++	} else {
++		brcmf_dbg(ERROR, "Cannot talk to Dongle. Firmware is not UP, %d ms\n",
++			  wait);
++		return -EINVAL;
++	}
++}
++
++
++static int
++brcmf_usb_dl_send_bulk(struct brcmf_usbdev_info *devinfo, void *buffer, int len)
++{
++	int ret;
++
++	if ((devinfo == NULL) || (devinfo->bulk_urb == NULL))
++		return -EINVAL;
++
++	/* Prepare the URB */
++	usb_fill_bulk_urb(devinfo->bulk_urb, devinfo->usbdev,
++			  devinfo->tx_pipe, buffer, len,
++			  (usb_complete_t)brcmf_usb_sync_complete, devinfo);
++
++	devinfo->bulk_urb->transfer_flags |= URB_ZERO_PACKET;
++
++	ret = usb_submit_urb(devinfo->bulk_urb, GFP_ATOMIC);
++	if (ret) {
++		brcmf_dbg(ERROR, "usb_submit_urb failed %d\n", ret);
++		return ret;
++	}
++	ret = brcmf_usb_sync_wait(devinfo, BRCMF_USB_SYNC_TIMEOUT);
++	return ret;
++}
++
++static int
++brcmf_usb_dl_writeimage(struct brcmf_usbdev_info *devinfo, u8 *fw, int fwlen)
++{
++	unsigned int sendlen, sent, dllen;
++	char *bulkchunk = NULL, *dlpos;
++	struct rdl_state_le state;
++	u32 rdlstate, rdlbytes;
++	int err = 0;
++	brcmf_dbg(TRACE, "fw %p, len %d\n", fw, fwlen);
++
++	bulkchunk = kmalloc(RDL_CHUNK, GFP_ATOMIC);
++	if (bulkchunk == NULL) {
++		err = -ENOMEM;
++		goto fail;
++	}
++
++	/* 1) Prepare USB boot loader for runtime image */
++	brcmf_usb_dl_cmd(devinfo, DL_START, &state,
++			 sizeof(struct rdl_state_le));
++
++	rdlstate = le32_to_cpu(state.state);
++	rdlbytes = le32_to_cpu(state.bytes);
++
++	/* 2) Check we are in the Waiting state */
++	if (rdlstate != DL_WAITING) {
++		brcmf_dbg(ERROR, "Failed to DL_START\n");
++		err = -EINVAL;
++		goto fail;
++	}
++	sent = 0;
++	dlpos = fw;
++	dllen = fwlen;
++
++	/* Get chip id and rev */
++	while (rdlbytes != dllen) {
++		/* Wait until the usb device reports it received all
++		 * the bytes we sent */
++		if ((rdlbytes == sent) && (rdlbytes != dllen)) {
++			if ((dllen-sent) < RDL_CHUNK)
++				sendlen = dllen-sent;
++			else
++				sendlen = RDL_CHUNK;
++
++			/* simply avoid having to send a ZLP by ensuring we
++			 * never have an even
++			 * multiple of 64
++			 */
++			if (!(sendlen % 64))
++				sendlen -= 4;
++
++			/* send data */
++			memcpy(bulkchunk, dlpos, sendlen);
++			if (brcmf_usb_dl_send_bulk(devinfo, bulkchunk,
++						   sendlen)) {
++				brcmf_dbg(ERROR, "send_bulk failed\n");
++				err = -EINVAL;
++				goto fail;
++			}
++
++			dlpos += sendlen;
++			sent += sendlen;
++		}
++		if (!brcmf_usb_dl_cmd(devinfo, DL_GETSTATE, &state,
++				      sizeof(struct rdl_state_le))) {
++			brcmf_dbg(ERROR, "DL_GETSTATE Failed xxxx\n");
++			err = -EINVAL;
++			goto fail;
++		}
++
++		rdlstate = le32_to_cpu(state.state);
++		rdlbytes = le32_to_cpu(state.bytes);
++
++		/* restart if an error is reported */
++		if (rdlstate == DL_BAD_HDR || rdlstate == DL_BAD_CRC) {
++			brcmf_dbg(ERROR, "Bad Hdr or Bad CRC state %d\n",
++				  rdlstate);
++			err = -EINVAL;
++			goto fail;
++		}
++	}
++
++fail:
++	kfree(bulkchunk);
++	brcmf_dbg(TRACE, "err=%d\n", err);
++	return err;
++}
++
++static int brcmf_usb_dlstart(struct brcmf_usbdev_info *devinfo, u8 *fw, int len)
++{
++	int err;
++
++	brcmf_dbg(TRACE, "enter\n");
++
++	if (devinfo == NULL)
++		return -EINVAL;
++
++	if (devinfo->bus_pub.devid == 0xDEAD)
++		return -EINVAL;
++
++	err = brcmf_usb_dl_writeimage(devinfo, fw, len);
++	if (err == 0)
++		devinfo->bus_pub.state = BCMFMAC_USB_STATE_DL_DONE;
++	else
++		devinfo->bus_pub.state = BCMFMAC_USB_STATE_DL_PENDING;
++	brcmf_dbg(TRACE, "exit: err=%d\n", err);
++
++	return err;
++}
++
++static int brcmf_usb_dlrun(struct brcmf_usbdev_info *devinfo)
++{
++	struct rdl_state_le state;
++
++	brcmf_dbg(TRACE, "enter\n");
++	if (!devinfo)
++		return -EINVAL;
++
++	if (devinfo->bus_pub.devid == 0xDEAD)
++		return -EINVAL;
++
++	/* Check we are runnable */
++	brcmf_usb_dl_cmd(devinfo, DL_GETSTATE, &state,
++		sizeof(struct rdl_state_le));
++
++	/* Start the image */
++	if (state.state == cpu_to_le32(DL_RUNNABLE)) {
++		if (!brcmf_usb_dl_cmd(devinfo, DL_GO, &state,
++			sizeof(struct rdl_state_le)))
++			return -ENODEV;
++		if (brcmf_usb_resetcfg(devinfo))
++			return -ENODEV;
++		/* The Dongle may go for re-enumeration. */
++	} else {
++		brcmf_dbg(ERROR, "Dongle not runnable\n");
++		return -EINVAL;
++	}
++	brcmf_dbg(TRACE, "exit\n");
++	return 0;
++}
++
++static bool brcmf_usb_chip_support(int chipid, int chiprev)
++{
++	switch(chipid) {
++	case 43235:
++	case 43236:
++	case 43238:
++		return (chiprev == 3);
++	default:
++		break;
++	}
++	return false;
++}
++
++static int
++brcmf_usb_fw_download(struct brcmf_usbdev_info *devinfo)
++{
++	int devid, chiprev;
++	int err;
++
++	brcmf_dbg(TRACE, "enter\n");
++	if (devinfo == NULL)
++		return -ENODEV;
++
++	devid = devinfo->bus_pub.devid;
++	chiprev = devinfo->bus_pub.chiprev;
++
++	if (!brcmf_usb_chip_support(devid, chiprev)) {
++		brcmf_dbg(ERROR, "unsupported chip %d rev %d\n",
++			  devid, chiprev);
++		return -EINVAL;
++	}
++
++	if (!devinfo->image) {
++		brcmf_dbg(ERROR, "No firmware!\n");
++		return -ENOENT;
++	}
++
++	err = brcmf_usb_dlstart(devinfo,
++		devinfo->image, devinfo->image_len);
++	if (err == 0)
++		err = brcmf_usb_dlrun(devinfo);
++	return err;
++}
++
++
++static void brcmf_usb_detach(const struct brcmf_usbdev *bus_pub)
++{
++	struct brcmf_usbdev_info *devinfo =
++		(struct brcmf_usbdev_info *)bus_pub;
++
++	brcmf_dbg(TRACE, "devinfo %p\n", devinfo);
++
++	/* store the image globally */
++	g_image.data = devinfo->image;
++	g_image.len = devinfo->image_len;
++
++	/* free the URBS */
++	brcmf_usb_free_q(&devinfo->rx_freeq, false);
++	brcmf_usb_free_q(&devinfo->tx_freeq, false);
++
++	usb_free_urb(devinfo->intr_urb);
++	usb_free_urb(devinfo->ctl_urb);
++	usb_free_urb(devinfo->bulk_urb);
++
++	kfree(devinfo->tx_reqs);
++	kfree(devinfo->rx_reqs);
++	kfree(devinfo);
++}
++
++#define TRX_MAGIC       0x30524448      /* "HDR0" */
++#define TRX_VERSION     1               /* Version 1 */
++#define TRX_MAX_LEN     0x3B0000        /* Max length */
++#define TRX_NO_HEADER   1               /* Do not write TRX header */
++#define TRX_MAX_OFFSET  3               /* Max number of individual files */
++#define TRX_UNCOMP_IMAGE        0x20    /* Trx contains uncompressed image */
++
++struct trx_header_le {
++	__le32 magic;		/* "HDR0" */
++	__le32 len;		/* Length of file including header */
++	__le32 crc32;		/* CRC from flag_version to end of file */
++	__le32 flag_version;	/* 0:15 flags, 16:31 version */
++	__le32 offsets[TRX_MAX_OFFSET]; /* Offsets of partitions from start of
++					 * header */
++};
++
++static int check_file(const u8 *headers)
++{
++	struct trx_header_le *trx;
++	int actual_len = -1;
++
++	/* Extract trx header */
++	trx = (struct trx_header_le *) headers;
++	if (trx->magic != cpu_to_le32(TRX_MAGIC))
++		return -1;
++
++	headers += sizeof(struct trx_header_le);
++
++	if (le32_to_cpu(trx->flag_version) & TRX_UNCOMP_IMAGE) {
++		actual_len = le32_to_cpu(trx->offsets[TRX_OFFSETS_DLFWLEN_IDX]);
++		return actual_len + sizeof(struct trx_header_le);
++	}
++	return -1;
++}
++
++static int brcmf_usb_get_fw(struct brcmf_usbdev_info *devinfo)
++{
++	s8 *fwname;
++	const struct firmware *fw;
++	int err;
++
++	devinfo->image = g_image.data;
++	devinfo->image_len = g_image.len;
++
++	/*
++	 * if we have an image we can leave here.
++	 */
++	if (devinfo->image)
++		return 0;
++
++	fwname = BRCMF_USB_43236_FW_NAME;
++
++	err = request_firmware(&fw, fwname, devinfo->dev);
++	if (!fw) {
++		brcmf_dbg(ERROR, "fail to request firmware %s\n", fwname);
++		return err;
++	}
++	if (check_file(fw->data) < 0) {
++		brcmf_dbg(ERROR, "invalid firmware %s\n", fwname);
++		return -EINVAL;
++	}
++
++	devinfo->image = vmalloc(fw->size); /* plus nvram */
++	if (!devinfo->image)
++		return -ENOMEM;
++
++	memcpy(devinfo->image, fw->data, fw->size);
++	devinfo->image_len = fw->size;
++
++	release_firmware(fw);
++	return 0;
++}
++
++
++static
++struct brcmf_usbdev *brcmf_usb_attach(int nrxq, int ntxq, struct device *dev)
++{
++	struct brcmf_usbdev_info *devinfo;
++
++	devinfo = kzalloc(sizeof(struct brcmf_usbdev_info), GFP_ATOMIC);
++	if (devinfo == NULL)
++		return NULL;
++
++	devinfo->bus_pub.nrxq = nrxq;
++	devinfo->rx_low_watermark = nrxq / 2;
++	devinfo->bus_pub.devinfo = devinfo;
++	devinfo->bus_pub.ntxq = ntxq;
++
++	/* flow control when too many tx urbs posted */
++	devinfo->tx_low_watermark = ntxq / 4;
++	devinfo->tx_high_watermark = devinfo->tx_low_watermark * 3;
++	devinfo->dev = dev;
++	devinfo->usbdev = usbdev_probe_info.usb;
++	devinfo->tx_pipe = usbdev_probe_info.tx_pipe;
++	devinfo->rx_pipe = usbdev_probe_info.rx_pipe;
++	devinfo->rx_pipe2 = usbdev_probe_info.rx_pipe2;
++	devinfo->intr_pipe = usbdev_probe_info.intr_pipe;
++
++	devinfo->interval = usbdev_probe_info.interval;
++	devinfo->intr_size = usbdev_probe_info.intr_size;
++
++	memcpy(&devinfo->probe_info, &usbdev_probe_info,
++		sizeof(struct brcmf_usb_probe_info));
++	devinfo->bus_pub.bus_mtu = BRCMF_USB_MAX_PKT_SIZE;
++
++	/* Initialize other structure content */
++	init_waitqueue_head(&devinfo->ioctl_resp_wait);
++
++	/* Initialize the spinlocks */
++	spin_lock_init(&devinfo->qlock);
++
++	INIT_LIST_HEAD(&devinfo->rx_freeq);
++	INIT_LIST_HEAD(&devinfo->rx_postq);
++
++	INIT_LIST_HEAD(&devinfo->tx_freeq);
++	INIT_LIST_HEAD(&devinfo->tx_postq);
++
++	devinfo->rx_reqs = brcmf_usbdev_qinit(&devinfo->rx_freeq, nrxq);
++	if (!devinfo->rx_reqs)
++		goto error;
++
++	devinfo->tx_reqs = brcmf_usbdev_qinit(&devinfo->tx_freeq, ntxq);
++	if (!devinfo->tx_reqs)
++		goto error;
++
++	devinfo->intr_urb = usb_alloc_urb(0, GFP_ATOMIC);
++	if (!devinfo->intr_urb) {
++		brcmf_dbg(ERROR, "usb_alloc_urb (intr) failed\n");
++		goto error;
++	}
++	devinfo->ctl_urb = usb_alloc_urb(0, GFP_ATOMIC);
++	if (!devinfo->ctl_urb) {
++		brcmf_dbg(ERROR, "usb_alloc_urb (ctl) failed\n");
++		goto error;
++	}
++	devinfo->rxctl_deferrespok = 0;
++
++	devinfo->bulk_urb = usb_alloc_urb(0, GFP_ATOMIC);
++	if (!devinfo->bulk_urb) {
++		brcmf_dbg(ERROR, "usb_alloc_urb (bulk) failed\n");
++		goto error;
++	}
++
++	init_waitqueue_head(&devinfo->wait);
++	if (!brcmf_usb_dlneeded(devinfo))
++		return &devinfo->bus_pub;
++
++	brcmf_dbg(TRACE, "start fw downloading\n");
++	if (brcmf_usb_get_fw(devinfo))
++		goto error;
++
++	if (brcmf_usb_fw_download(devinfo))
++		goto error;
++
++	return &devinfo->bus_pub;
++
++error:
++	brcmf_dbg(ERROR, "failed!\n");
++	brcmf_usb_detach(&devinfo->bus_pub);
++	return NULL;
++}
++
++static int brcmf_usb_probe_cb(struct device *dev, const char *desc,
++				u32 bustype, u32 hdrlen)
++{
++	struct brcmf_bus *bus = NULL;
++	struct brcmf_usbdev *bus_pub = NULL;
++	int ret;
++
++
++	bus_pub = brcmf_usb_attach(BRCMF_USB_NRXQ, BRCMF_USB_NTXQ, dev);
++	if (!bus_pub) {
++		ret = -ENODEV;
++		goto fail;
++	}
++
++	bus = kzalloc(sizeof(struct brcmf_bus), GFP_ATOMIC);
++	if (!bus) {
++		ret = -ENOMEM;
++		goto fail;
++	}
++
++	bus_pub->bus = bus;
++	bus->brcmf_bus_txdata = brcmf_usb_tx;
++	bus->brcmf_bus_init = brcmf_usb_up;
++	bus->brcmf_bus_stop = brcmf_usb_down;
++	bus->brcmf_bus_txctl = brcmf_usb_tx_ctlpkt;
++	bus->brcmf_bus_rxctl = brcmf_usb_rx_ctlpkt;
++	bus->type = bustype;
++	bus->bus_priv.usb = bus_pub;
++	dev_set_drvdata(dev, bus);
++
++	/* Attach to the common driver interface */
++	ret = brcmf_attach(hdrlen, dev);
++	if (ret) {
++		brcmf_dbg(ERROR, "dhd_attach failed\n");
++		goto fail;
++	}
++
++	ret = brcmf_bus_start(dev);
++	if (ret == -ENOLINK) {
++		brcmf_dbg(ERROR, "dongle is not responding\n");
++		brcmf_detach(dev);
++		goto fail;
++	}
++
++	return 0;
++fail:
++	/* Release resources in reverse order */
++	if (bus_pub)
++		brcmf_usb_detach(bus_pub);
++	kfree(bus);
++	return ret;
++}
++
++static void
++brcmf_usb_disconnect_cb(struct brcmf_usbdev *bus_pub)
++{
++	if (!bus_pub)
++		return;
++	brcmf_dbg(TRACE, "enter: bus_pub %p\n", bus_pub);
++
++	brcmf_detach(bus_pub->devinfo->dev);
++	kfree(bus_pub->bus);
++	brcmf_usb_detach(bus_pub);
++
++}
++
++static int
++brcmf_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
++{
++	int ep;
++	struct usb_endpoint_descriptor *endpoint;
++	int ret = 0;
++	struct usb_device *usb = interface_to_usbdev(intf);
++	int num_of_eps;
++	u8 endpoint_num;
++
++	brcmf_dbg(TRACE, "enter\n");
++
++	usbdev_probe_info.usb = usb;
++	usbdev_probe_info.intf = intf;
++
++	if (id != NULL) {
++		usbdev_probe_info.vid = id->idVendor;
++		usbdev_probe_info.pid = id->idProduct;
++	}
++
++	usb_set_intfdata(intf, &usbdev_probe_info);
++
++	/* Check that the device supports only one configuration */
++	if (usb->descriptor.bNumConfigurations != 1) {
++		ret = -1;
++		goto fail;
++	}
++
++	if (usb->descriptor.bDeviceClass != USB_CLASS_VENDOR_SPEC) {
++		ret = -1;
++		goto fail;
++	}
++
++	/*
++	 * Only the BDC interface configuration is supported:
++	 *	Device class: USB_CLASS_VENDOR_SPEC
++	 *	if0 class: USB_CLASS_VENDOR_SPEC
++	 *	if0/ep0: control
++	 *	if0/ep1: bulk in
++	 *	if0/ep2: bulk out (ok if swapped with bulk in)
++	 */
++	if (CONFIGDESC(usb)->bNumInterfaces != 1) {
++		ret = -1;
++		goto fail;
++	}
++
++	/* Check interface */
++	if (IFDESC(usb, CONTROL_IF).bInterfaceClass != USB_CLASS_VENDOR_SPEC ||
++	    IFDESC(usb, CONTROL_IF).bInterfaceSubClass != 2 ||
++	    IFDESC(usb, CONTROL_IF).bInterfaceProtocol != 0xff) {
++		brcmf_dbg(ERROR, "invalid control interface: class %d, subclass %d, proto %d\n",
++			  IFDESC(usb, CONTROL_IF).bInterfaceClass,
++			  IFDESC(usb, CONTROL_IF).bInterfaceSubClass,
++			  IFDESC(usb, CONTROL_IF).bInterfaceProtocol);
++		ret = -1;
++		goto fail;
++	}
++
++	/* Check control endpoint */
++	endpoint = &IFEPDESC(usb, CONTROL_IF, 0);
++	if ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
++		!= USB_ENDPOINT_XFER_INT) {
++		brcmf_dbg(ERROR, "invalid control endpoint %d\n",
++			  endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK);
++		ret = -1;
++		goto fail;
++	}
++
++	endpoint_num = endpoint->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
++	usbdev_probe_info.intr_pipe = usb_rcvintpipe(usb, endpoint_num);
++
++	usbdev_probe_info.rx_pipe = 0;
++	usbdev_probe_info.rx_pipe2 = 0;
++	usbdev_probe_info.tx_pipe = 0;
++	num_of_eps = IFDESC(usb, BULK_IF).bNumEndpoints - 1;
++
++	/* Check data endpoints and get pipes */
++	for (ep = 1; ep <= num_of_eps; ep++) {
++		endpoint = &IFEPDESC(usb, BULK_IF, ep);
++		if ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) !=
++		    USB_ENDPOINT_XFER_BULK) {
++			brcmf_dbg(ERROR, "invalid data endpoint %d\n", ep);
++			ret = -1;
++			goto fail;
++		}
++
++		endpoint_num = endpoint->bEndpointAddress &
++			       USB_ENDPOINT_NUMBER_MASK;
++		if ((endpoint->bEndpointAddress & USB_ENDPOINT_DIR_MASK)
++			== USB_DIR_IN) {
++			if (!usbdev_probe_info.rx_pipe) {
++				usbdev_probe_info.rx_pipe =
++					usb_rcvbulkpipe(usb, endpoint_num);
++			} else {
++				usbdev_probe_info.rx_pipe2 =
++					usb_rcvbulkpipe(usb, endpoint_num);
++			}
++		} else {
++			usbdev_probe_info.tx_pipe =
++					usb_sndbulkpipe(usb, endpoint_num);
++		}
++	}
++
++	/* Allocate interrupt URB and data buffer */
++	/* RNDIS says 8-byte intr, our old drivers used 4-byte */
++	if (IFEPDESC(usb, CONTROL_IF, 0).wMaxPacketSize == cpu_to_le16(16))
++		usbdev_probe_info.intr_size = 8;
++	else
++		usbdev_probe_info.intr_size = 4;
++
++	usbdev_probe_info.interval = IFEPDESC(usb, CONTROL_IF, 0).bInterval;
++
++	usbdev_probe_info.device_speed = usb->speed;
++	if (usb->speed == USB_SPEED_HIGH)
++		brcmf_dbg(INFO, "Broadcom high speed USB wireless device detected\n");
++	else
++		brcmf_dbg(INFO, "Broadcom full speed USB wireless device detected\n");
++
++	ret = brcmf_usb_probe_cb(&usb->dev, "", USB_BUS, 0);
++	if (ret)
++		goto fail;
++
++	/* Success */
++	return 0;
++
++fail:
++	brcmf_dbg(ERROR, "failed with errno %d\n", ret);
++	usb_set_intfdata(intf, NULL);
++	return ret;
++
++}
++
++static void
++brcmf_usb_disconnect(struct usb_interface *intf)
++{
++	struct usb_device *usb = interface_to_usbdev(intf);
++
++	brcmf_dbg(TRACE, "enter\n");
++	brcmf_usb_disconnect_cb(brcmf_usb_get_buspub(&usb->dev));
++	usb_set_intfdata(intf, NULL);
++}
++
++/*
++ *	only need to signal the bus being down and update the suspend state.
++ */
++static int brcmf_usb_suspend(struct usb_interface *intf, pm_message_t state)
++{
++	struct usb_device *usb = interface_to_usbdev(intf);
++	struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
++
++	brcmf_dbg(TRACE, "enter\n");
++	devinfo->bus_pub.state = BCMFMAC_USB_STATE_DOWN;
++	devinfo->suspend_state = USBOS_SUSPEND_STATE_SUSPENDED;
++	return 0;
++}
++
++/*
++ *	mark suspend state active and crank up the bus.
++ */
++static int brcmf_usb_resume(struct usb_interface *intf)
++{
++	struct usb_device *usb = interface_to_usbdev(intf);
++	struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
++
++	brcmf_dbg(TRACE, "enter\n");
++	devinfo->suspend_state = USBOS_SUSPEND_STATE_DEVICE_ACTIVE;
++	brcmf_bus_start(&usb->dev);
++	return 0;
++}
++
++#define BRCMF_USB_VENDOR_ID_BROADCOM	0x0a5c
++#define BRCMF_USB_DEVICE_ID_43236	0xbd17
++#define BRCMF_USB_DEVICE_ID_BCMFW	0x0bdc
++
++static struct usb_device_id brcmf_usb_devid_table[] = {
++	{ USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_43236) },
++	/* special entry for device with firmware loaded and running */
++	{ USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_BCMFW) },
++	{ }
++};
++MODULE_DEVICE_TABLE(usb, brcmf_usb_devid_table);
++MODULE_FIRMWARE(BRCMF_USB_43236_FW_NAME);
++
++/* TODO: suspend and resume entries */
++static struct usb_driver brcmf_usbdrvr = {
++	.name = KBUILD_MODNAME,
++	.probe = brcmf_usb_probe,
++	.disconnect = brcmf_usb_disconnect,
++	.id_table = brcmf_usb_devid_table,
++	.suspend = brcmf_usb_suspend,
++	.resume = brcmf_usb_resume,
++	.supports_autosuspend = 1,
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,5,0))
++	.disable_hub_initiated_lpm = 1,
++#endif
++};
++
++void brcmf_usb_exit(void)
++{
++	usb_deregister(&brcmf_usbdrvr);
++	vfree(g_image.data);
++	g_image.data = NULL;
++	g_image.len = 0;
++}
++
++void brcmf_usb_init(void)
++{
++	usb_register(&brcmf_usbdrvr);
++}
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.h b/drivers/net/wireless/brcm80211/brcmfmac/usb.h
+new file mode 100644
+index 0000000..acfa5e8
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.h
+@@ -0,0 +1,61 @@
++/*
++ * Copyright (c) 2011 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++#ifndef BRCMFMAC_USB_H
++#define BRCMFMAC_USB_H
++
++enum brcmf_usb_state {
++	BCMFMAC_USB_STATE_DL_PENDING,
++	BCMFMAC_USB_STATE_DL_DONE,
++	BCMFMAC_USB_STATE_UP,
++	BCMFMAC_USB_STATE_DOWN,
++	BCMFMAC_USB_STATE_PNP_FWDL,
++	BCMFMAC_USB_STATE_DISCONNECT,
++	BCMFMAC_USB_STATE_SLEEP
++};
++
++enum brcmf_usb_pnp_state {
++	BCMFMAC_USB_PNP_DISCONNECT,
++	BCMFMAC_USB_PNP_SLEEP,
++	BCMFMAC_USB_PNP_RESUME,
++};
++
++struct brcmf_stats {
++	u32 tx_ctlpkts;
++	u32 tx_ctlerrs;
++	u32 rx_ctlpkts;
++	u32 rx_ctlerrs;
++};
++
++struct brcmf_usbdev {
++	struct brcmf_bus *bus;
++	struct brcmf_usbdev_info *devinfo;
++	enum brcmf_usb_state state;
++	struct brcmf_stats stats;
++	int ntxq, nrxq, rxsize;
++	u32 bus_mtu;
++	int devid;
++	int chiprev; /* chip revsion number */
++};
++
++/* IO Request Block (IRB) */
++struct brcmf_usbreq {
++	struct list_head list;
++	struct brcmf_usbdev_info *devinfo;
++	struct urb *urb;
++	struct sk_buff  *skb;
++};
++
++#endif /* BRCMFMAC_USB_H */
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb_rdl.h b/drivers/net/wireless/brcm80211/brcmfmac/usb_rdl.h
+new file mode 100644
+index 0000000..0a35c51
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmfmac/usb_rdl.h
+@@ -0,0 +1,75 @@
++/*
++ * Copyright (c) 2011 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#ifndef _USB_RDL_H
++#define _USB_RDL_H
++
++/* Control messages: bRequest values */
++#define DL_GETSTATE	0	/* returns the rdl_state_t struct */
++#define DL_CHECK_CRC	1	/* currently unused */
++#define DL_GO		2	/* execute downloaded image */
++#define DL_START	3	/* initialize dl state */
++#define DL_REBOOT	4	/* reboot the device in 2 seconds */
++#define DL_GETVER	5	/* returns the bootrom_id_t struct */
++#define DL_GO_PROTECTED	6	/* execute the downloaded code and set reset
++				 * event to occur in 2 seconds.  It is the
++				 * responsibility of the downloaded code to
++				 * clear this event
++				 */
++#define DL_EXEC		7	/* jump to a supplied address */
++#define DL_RESETCFG	8	/* To support single enum on dongle
++				 * - Not used by bootloader
++				 */
++#define DL_DEFER_RESP_OK 9	/* Potentially defer the response to setup
++				 * if resp unavailable
++				 */
++
++/* states */
++#define DL_WAITING	0	/* waiting to rx first pkt */
++#define DL_READY	1	/* hdr was good, waiting for more of the
++				 * compressed image */
++#define DL_BAD_HDR	2	/* hdr was corrupted */
++#define DL_BAD_CRC	3	/* compressed image was corrupted */
++#define DL_RUNNABLE	4	/* download was successful,waiting for go cmd */
++#define DL_START_FAIL	5	/* failed to initialize correctly */
++#define DL_NVRAM_TOOBIG	6	/* host specified nvram data exceeds DL_NVRAM
++				 * value */
++#define DL_IMAGE_TOOBIG	7	/* download image too big (exceeds DATA_START
++				 *  for rdl) */
++
++struct rdl_state_le {
++	__le32 state;
++	__le32 bytes;
++};
++
++struct bootrom_id_le {
++	__le32 chip;	/* Chip id */
++	__le32 chiprev;	/* Chip rev */
++	__le32 ramsize;	/* Size of  RAM */
++	__le32 remapbase;	/* Current remap base address */
++	__le32 boardtype;	/* Type of board */
++	__le32 boardrev;	/* Board revision */
++};
++
++#define RDL_CHUNK	1500  /* size of each dl transfer */
++
++#define TRX_OFFSETS_DLFWLEN_IDX	0
++#define TRX_OFFSETS_JUMPTO_IDX	1
++#define TRX_OFFSETS_NVM_LEN_IDX	2
++
++#define TRX_OFFSETS_DLBASE_IDX  0
++
++#endif  /* _USB_RDL_H */
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+new file mode 100644
+index 0000000..65e48d7
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+@@ -0,0 +1,3881 @@
++/*
++ * Copyright (c) 2010 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++/* Toplevel file. Relies on dhd_linux.c to send commands to the dongle. */
++
++#undef pr_fmt
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/kernel.h>
++#include <linux/printk.h>
++#include <linux/if_arp.h>
++#include <linux/sched.h>
++#include <linux/kthread.h>
++#include <linux/netdevice.h>
++#include <linux/bitops.h>
++#include <linux/etherdevice.h>
++#include <linux/ieee80211.h>
++#include <linux/uaccess.h>
++#include <net/cfg80211.h>
++
++#include <brcmu_utils.h>
++#include <defs.h>
++#include <brcmu_wifi.h>
++#include "dhd.h"
++#include "wl_cfg80211.h"
++
++#define BRCMF_ASSOC_PARAMS_FIXED_SIZE \
++	(sizeof(struct brcmf_assoc_params_le) - sizeof(u16))
++
++static const u8 ether_bcast[ETH_ALEN] = {255, 255, 255, 255, 255, 255};
++
++static u32 brcmf_dbg_level = WL_DBG_ERR;
++
++static void brcmf_set_drvdata(struct brcmf_cfg80211_dev *dev, void *data)
++{
++	dev->driver_data = data;
++}
++
++static void *brcmf_get_drvdata(struct brcmf_cfg80211_dev *dev)
++{
++	void *data = NULL;
++
++	if (dev)
++		data = dev->driver_data;
++	return data;
++}
++
++static
++struct brcmf_cfg80211_priv *brcmf_priv_get(struct brcmf_cfg80211_dev *cfg_dev)
++{
++	struct brcmf_cfg80211_iface *ci = brcmf_get_drvdata(cfg_dev);
++	return ci->cfg_priv;
++}
++
++static bool check_sys_up(struct wiphy *wiphy)
++{
++	struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
++	if (!test_bit(WL_STATUS_READY, &cfg_priv->status)) {
++		WL_INFO("device is not ready : status (%d)\n",
++			(int)cfg_priv->status);
++		return false;
++	}
++	return true;
++}
++
++#define CHAN2G(_channel, _freq, _flags) {			\
++	.band			= IEEE80211_BAND_2GHZ,		\
++	.center_freq		= (_freq),			\
++	.hw_value		= (_channel),			\
++	.flags			= (_flags),			\
++	.max_antenna_gain	= 0,				\
++	.max_power		= 30,				\
++}
++
++#define CHAN5G(_channel, _flags) {				\
++	.band			= IEEE80211_BAND_5GHZ,		\
++	.center_freq		= 5000 + (5 * (_channel)),	\
++	.hw_value		= (_channel),			\
++	.flags			= (_flags),			\
++	.max_antenna_gain	= 0,				\
++	.max_power		= 30,				\
++}
++
++#define RATE_TO_BASE100KBPS(rate)   (((rate) * 10) / 2)
++#define RATETAB_ENT(_rateid, _flags) \
++	{                                                               \
++		.bitrate        = RATE_TO_BASE100KBPS(_rateid),     \
++		.hw_value       = (_rateid),                            \
++		.flags          = (_flags),                             \
++	}
++
++static struct ieee80211_rate __wl_rates[] = {
++	RATETAB_ENT(BRCM_RATE_1M, 0),
++	RATETAB_ENT(BRCM_RATE_2M, IEEE80211_RATE_SHORT_PREAMBLE),
++	RATETAB_ENT(BRCM_RATE_5M5, IEEE80211_RATE_SHORT_PREAMBLE),
++	RATETAB_ENT(BRCM_RATE_11M, IEEE80211_RATE_SHORT_PREAMBLE),
++	RATETAB_ENT(BRCM_RATE_6M, 0),
++	RATETAB_ENT(BRCM_RATE_9M, 0),
++	RATETAB_ENT(BRCM_RATE_12M, 0),
++	RATETAB_ENT(BRCM_RATE_18M, 0),
++	RATETAB_ENT(BRCM_RATE_24M, 0),
++	RATETAB_ENT(BRCM_RATE_36M, 0),
++	RATETAB_ENT(BRCM_RATE_48M, 0),
++	RATETAB_ENT(BRCM_RATE_54M, 0),
++};
++
++#define wl_a_rates		(__wl_rates + 4)
++#define wl_a_rates_size	8
++#define wl_g_rates		(__wl_rates + 0)
++#define wl_g_rates_size	12
++
++static struct ieee80211_channel __wl_2ghz_channels[] = {
++	CHAN2G(1, 2412, 0),
++	CHAN2G(2, 2417, 0),
++	CHAN2G(3, 2422, 0),
++	CHAN2G(4, 2427, 0),
++	CHAN2G(5, 2432, 0),
++	CHAN2G(6, 2437, 0),
++	CHAN2G(7, 2442, 0),
++	CHAN2G(8, 2447, 0),
++	CHAN2G(9, 2452, 0),
++	CHAN2G(10, 2457, 0),
++	CHAN2G(11, 2462, 0),
++	CHAN2G(12, 2467, 0),
++	CHAN2G(13, 2472, 0),
++	CHAN2G(14, 2484, 0),
++};
++
++static struct ieee80211_channel __wl_5ghz_a_channels[] = {
++	CHAN5G(34, 0), CHAN5G(36, 0),
++	CHAN5G(38, 0), CHAN5G(40, 0),
++	CHAN5G(42, 0), CHAN5G(44, 0),
++	CHAN5G(46, 0), CHAN5G(48, 0),
++	CHAN5G(52, 0), CHAN5G(56, 0),
++	CHAN5G(60, 0), CHAN5G(64, 0),
++	CHAN5G(100, 0), CHAN5G(104, 0),
++	CHAN5G(108, 0), CHAN5G(112, 0),
++	CHAN5G(116, 0), CHAN5G(120, 0),
++	CHAN5G(124, 0), CHAN5G(128, 0),
++	CHAN5G(132, 0), CHAN5G(136, 0),
++	CHAN5G(140, 0), CHAN5G(149, 0),
++	CHAN5G(153, 0), CHAN5G(157, 0),
++	CHAN5G(161, 0), CHAN5G(165, 0),
++	CHAN5G(184, 0), CHAN5G(188, 0),
++	CHAN5G(192, 0), CHAN5G(196, 0),
++	CHAN5G(200, 0), CHAN5G(204, 0),
++	CHAN5G(208, 0), CHAN5G(212, 0),
++	CHAN5G(216, 0),
++};
++
++static struct ieee80211_channel __wl_5ghz_n_channels[] = {
++	CHAN5G(32, 0), CHAN5G(34, 0),
++	CHAN5G(36, 0), CHAN5G(38, 0),
++	CHAN5G(40, 0), CHAN5G(42, 0),
++	CHAN5G(44, 0), CHAN5G(46, 0),
++	CHAN5G(48, 0), CHAN5G(50, 0),
++	CHAN5G(52, 0), CHAN5G(54, 0),
++	CHAN5G(56, 0), CHAN5G(58, 0),
++	CHAN5G(60, 0), CHAN5G(62, 0),
++	CHAN5G(64, 0), CHAN5G(66, 0),
++	CHAN5G(68, 0), CHAN5G(70, 0),
++	CHAN5G(72, 0), CHAN5G(74, 0),
++	CHAN5G(76, 0), CHAN5G(78, 0),
++	CHAN5G(80, 0), CHAN5G(82, 0),
++	CHAN5G(84, 0), CHAN5G(86, 0),
++	CHAN5G(88, 0), CHAN5G(90, 0),
++	CHAN5G(92, 0), CHAN5G(94, 0),
++	CHAN5G(96, 0), CHAN5G(98, 0),
++	CHAN5G(100, 0), CHAN5G(102, 0),
++	CHAN5G(104, 0), CHAN5G(106, 0),
++	CHAN5G(108, 0), CHAN5G(110, 0),
++	CHAN5G(112, 0), CHAN5G(114, 0),
++	CHAN5G(116, 0), CHAN5G(118, 0),
++	CHAN5G(120, 0), CHAN5G(122, 0),
++	CHAN5G(124, 0), CHAN5G(126, 0),
++	CHAN5G(128, 0), CHAN5G(130, 0),
++	CHAN5G(132, 0), CHAN5G(134, 0),
++	CHAN5G(136, 0), CHAN5G(138, 0),
++	CHAN5G(140, 0), CHAN5G(142, 0),
++	CHAN5G(144, 0), CHAN5G(145, 0),
++	CHAN5G(146, 0), CHAN5G(147, 0),
++	CHAN5G(148, 0), CHAN5G(149, 0),
++	CHAN5G(150, 0), CHAN5G(151, 0),
++	CHAN5G(152, 0), CHAN5G(153, 0),
++	CHAN5G(154, 0), CHAN5G(155, 0),
++	CHAN5G(156, 0), CHAN5G(157, 0),
++	CHAN5G(158, 0), CHAN5G(159, 0),
++	CHAN5G(160, 0), CHAN5G(161, 0),
++	CHAN5G(162, 0), CHAN5G(163, 0),
++	CHAN5G(164, 0), CHAN5G(165, 0),
++	CHAN5G(166, 0), CHAN5G(168, 0),
++	CHAN5G(170, 0), CHAN5G(172, 0),
++	CHAN5G(174, 0), CHAN5G(176, 0),
++	CHAN5G(178, 0), CHAN5G(180, 0),
++	CHAN5G(182, 0), CHAN5G(184, 0),
++	CHAN5G(186, 0), CHAN5G(188, 0),
++	CHAN5G(190, 0), CHAN5G(192, 0),
++	CHAN5G(194, 0), CHAN5G(196, 0),
++	CHAN5G(198, 0), CHAN5G(200, 0),
++	CHAN5G(202, 0), CHAN5G(204, 0),
++	CHAN5G(206, 0), CHAN5G(208, 0),
++	CHAN5G(210, 0), CHAN5G(212, 0),
++	CHAN5G(214, 0), CHAN5G(216, 0),
++	CHAN5G(218, 0), CHAN5G(220, 0),
++	CHAN5G(222, 0), CHAN5G(224, 0),
++	CHAN5G(226, 0), CHAN5G(228, 0),
++};
++
++static struct ieee80211_supported_band __wl_band_2ghz = {
++	.band = IEEE80211_BAND_2GHZ,
++	.channels = __wl_2ghz_channels,
++	.n_channels = ARRAY_SIZE(__wl_2ghz_channels),
++	.bitrates = wl_g_rates,
++	.n_bitrates = wl_g_rates_size,
++};
++
++static struct ieee80211_supported_band __wl_band_5ghz_a = {
++	.band = IEEE80211_BAND_5GHZ,
++	.channels = __wl_5ghz_a_channels,
++	.n_channels = ARRAY_SIZE(__wl_5ghz_a_channels),
++	.bitrates = wl_a_rates,
++	.n_bitrates = wl_a_rates_size,
++};
++
++static struct ieee80211_supported_band __wl_band_5ghz_n = {
++	.band = IEEE80211_BAND_5GHZ,
++	.channels = __wl_5ghz_n_channels,
++	.n_channels = ARRAY_SIZE(__wl_5ghz_n_channels),
++	.bitrates = wl_a_rates,
++	.n_bitrates = wl_a_rates_size,
++};
++
++static const u32 __wl_cipher_suites[] = {
++	WLAN_CIPHER_SUITE_WEP40,
++	WLAN_CIPHER_SUITE_WEP104,
++	WLAN_CIPHER_SUITE_TKIP,
++	WLAN_CIPHER_SUITE_CCMP,
++	WLAN_CIPHER_SUITE_AES_CMAC,
++};
++
++/* tag_ID/length/value_buffer tuple */
++struct brcmf_tlv {
++	u8 id;
++	u8 len;
++	u8 data[1];
++};
++
++/* Quarter dBm units to mW
++ * Table starts at QDBM_OFFSET, so the first entry is mW for qdBm=153
++ * Table is offset so the last entry is largest mW value that fits in
++ * a u16.
++ */
++
++#define QDBM_OFFSET 153		/* Offset for first entry */
++#define QDBM_TABLE_LEN 40	/* Table size */
++
++/* Smallest mW value that will round up to the first table entry, QDBM_OFFSET.
++ * Value is ( mW(QDBM_OFFSET - 1) + mW(QDBM_OFFSET) ) / 2
++ */
++#define QDBM_TABLE_LOW_BOUND 6493	/* Low bound */
++
++/* Largest mW value that will round down to the last table entry,
++ * QDBM_OFFSET + QDBM_TABLE_LEN-1.
++ * Value is ( mW(QDBM_OFFSET + QDBM_TABLE_LEN - 1) +
++ * mW(QDBM_OFFSET + QDBM_TABLE_LEN) ) / 2.
++ */
++#define QDBM_TABLE_HIGH_BOUND 64938	/* High bound */
++
++static const u16 nqdBm_to_mW_map[QDBM_TABLE_LEN] = {
++/* qdBm:	+0	+1	+2	+3	+4	+5	+6	+7 */
++/* 153: */ 6683, 7079, 7499, 7943, 8414, 8913, 9441, 10000,
++/* 161: */ 10593, 11220, 11885, 12589, 13335, 14125, 14962, 15849,
++/* 169: */ 16788, 17783, 18836, 19953, 21135, 22387, 23714, 25119,
++/* 177: */ 26607, 28184, 29854, 31623, 33497, 35481, 37584, 39811,
++/* 185: */ 42170, 44668, 47315, 50119, 53088, 56234, 59566, 63096
++};
++
++static u16 brcmf_qdbm_to_mw(u8 qdbm)
++{
++	uint factor = 1;
++	int idx = qdbm - QDBM_OFFSET;
++
++	if (idx >= QDBM_TABLE_LEN)
++		/* clamp to max u16 mW value */
++		return 0xFFFF;
++
++	/* scale the qdBm index up to the range of the table 0-40
++	 * where an offset of 40 qdBm equals a factor of 10 mW.
++	 */
++	while (idx < 0) {
++		idx += 40;
++		factor *= 10;
++	}
++
++	/* return the mW value scaled down to the correct factor of 10,
++	 * adding in factor/2 to get proper rounding.
++	 */
++	return (nqdBm_to_mW_map[idx] + factor / 2) / factor;
++}
++
++static u8 brcmf_mw_to_qdbm(u16 mw)
++{
++	u8 qdbm;
++	int offset;
++	uint mw_uint = mw;
++	uint boundary;
++
++	/* handle boundary case */
++	if (mw_uint <= 1)
++		return 0;
++
++	offset = QDBM_OFFSET;
++
++	/* move mw into the range of the table */
++	while (mw_uint < QDBM_TABLE_LOW_BOUND) {
++		mw_uint *= 10;
++		offset -= 40;
++	}
++
++	for (qdbm = 0; qdbm < QDBM_TABLE_LEN - 1; qdbm++) {
++		boundary = nqdBm_to_mW_map[qdbm] + (nqdBm_to_mW_map[qdbm + 1] -
++						    nqdBm_to_mW_map[qdbm]) / 2;
++		if (mw_uint < boundary)
++			break;
++	}
++
++	qdbm += (u8) offset;
++
++	return qdbm;
++}
++
++/* function for reading/writing a single u32 from/to the dongle */
++static int
++brcmf_exec_dcmd_u32(struct net_device *ndev, u32 cmd, u32 *par)
++{
++	int err;
++	__le32 par_le = cpu_to_le32(*par);
++
++	err = brcmf_exec_dcmd(ndev, cmd, &par_le, sizeof(__le32));
++	*par = le32_to_cpu(par_le);
++
++	return err;
++}
++
++static void convert_key_from_CPU(struct brcmf_wsec_key *key,
++				 struct brcmf_wsec_key_le *key_le)
++{
++	key_le->index = cpu_to_le32(key->index);
++	key_le->len = cpu_to_le32(key->len);
++	key_le->algo = cpu_to_le32(key->algo);
++	key_le->flags = cpu_to_le32(key->flags);
++	key_le->rxiv.hi = cpu_to_le32(key->rxiv.hi);
++	key_le->rxiv.lo = cpu_to_le16(key->rxiv.lo);
++	key_le->iv_initialized = cpu_to_le32(key->iv_initialized);
++	memcpy(key_le->data, key->data, sizeof(key->data));
++	memcpy(key_le->ea, key->ea, sizeof(key->ea));
++}
++
++static int send_key_to_dongle(struct net_device *ndev,
++			      struct brcmf_wsec_key *key)
++{
++	int err;
++	struct brcmf_wsec_key_le key_le;
++
++	convert_key_from_CPU(key, &key_le);
++	err = brcmf_exec_dcmd(ndev, BRCMF_C_SET_KEY, &key_le, sizeof(key_le));
++	if (err)
++		WL_ERR("WLC_SET_KEY error (%d)\n", err);
++	return err;
++}
++
++static s32
++brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
++			 enum nl80211_iftype type, u32 *flags,
++			 struct vif_params *params)
++{
++	struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
++	struct wireless_dev *wdev;
++	s32 infra = 0;
++	s32 err = 0;
++
++	WL_TRACE("Enter\n");
++	if (!check_sys_up(wiphy))
++		return -EIO;
++
++	switch (type) {
++	case NL80211_IFTYPE_MONITOR:
++	case NL80211_IFTYPE_WDS:
++		WL_ERR("type (%d) : currently we do not support this type\n",
++		       type);
++		return -EOPNOTSUPP;
++	case NL80211_IFTYPE_ADHOC:
++		cfg_priv->conf->mode = WL_MODE_IBSS;
++		infra = 0;
++		break;
++	case NL80211_IFTYPE_STATION:
++		cfg_priv->conf->mode = WL_MODE_BSS;
++		infra = 1;
++		break;
++	default:
++		err = -EINVAL;
++		goto done;
++	}
++
++	err = brcmf_exec_dcmd_u32(ndev, BRCMF_C_SET_INFRA, &infra);
++	if (err) {
++		WL_ERR("WLC_SET_INFRA error (%d)\n", err);
++		err = -EAGAIN;
++	} else {
++		wdev = ndev->ieee80211_ptr;
++		wdev->iftype = type;
++	}
++
++	WL_INFO("IF Type = %s\n",
++		(cfg_priv->conf->mode == WL_MODE_IBSS) ? "Adhoc" : "Infra");
++
++done:
++	WL_TRACE("Exit\n");
++
++	return err;
++}
++
++static s32 brcmf_dev_intvar_set(struct net_device *ndev, s8 *name, s32 val)
++{
++	s8 buf[BRCMF_DCMD_SMLEN];
++	u32 len;
++	s32 err = 0;
++	__le32 val_le;
++
++	val_le = cpu_to_le32(val);
++	len = brcmf_c_mkiovar(name, (char *)(&val_le), sizeof(val_le), buf,
++			    sizeof(buf));
++	BUG_ON(!len);
++
++	err = brcmf_exec_dcmd(ndev, BRCMF_C_SET_VAR, buf, len);
++	if (err)
++		WL_ERR("error (%d)\n", err);
++
++	return err;
++}
++
++static s32
++brcmf_dev_intvar_get(struct net_device *ndev, s8 *name, s32 *retval)
++{
++	union {
++		s8 buf[BRCMF_DCMD_SMLEN];
++		__le32 val;
++	} var;
++	u32 len;
++	u32 data_null;
++	s32 err = 0;
++
++	len =
++	    brcmf_c_mkiovar(name, (char *)(&data_null), 0, (char *)(&var),
++			sizeof(var.buf));
++	BUG_ON(!len);
++	err = brcmf_exec_dcmd(ndev, BRCMF_C_GET_VAR, &var, len);
++	if (err)
++		WL_ERR("error (%d)\n", err);
++
++	*retval = le32_to_cpu(var.val);
++
++	return err;
++}
++
++static void brcmf_set_mpc(struct net_device *ndev, int mpc)
++{
++	s32 err = 0;
++	struct brcmf_cfg80211_priv *cfg_priv = ndev_to_cfg(ndev);
++
++	if (test_bit(WL_STATUS_READY, &cfg_priv->status)) {
++		err = brcmf_dev_intvar_set(ndev, "mpc", mpc);
++		if (err) {
++			WL_ERR("fail to set mpc\n");
++			return;
++		}
++		WL_INFO("MPC : %d\n", mpc);
++	}
++}
++
++static void wl_iscan_prep(struct brcmf_scan_params_le *params_le,
++			  struct brcmf_ssid *ssid)
++{
++	memcpy(params_le->bssid, ether_bcast, ETH_ALEN);
++	params_le->bss_type = DOT11_BSSTYPE_ANY;
++	params_le->scan_type = 0;
++	params_le->channel_num = 0;
++	params_le->nprobes = cpu_to_le32(-1);
++	params_le->active_time = cpu_to_le32(-1);
++	params_le->passive_time = cpu_to_le32(-1);
++	params_le->home_time = cpu_to_le32(-1);
++	if (ssid && ssid->SSID_len)
++		memcpy(&params_le->ssid_le, ssid, sizeof(struct brcmf_ssid));
++}
++
++static s32
++brcmf_dev_iovar_setbuf(struct net_device *ndev, s8 * iovar, void *param,
++		    s32 paramlen, void *bufptr, s32 buflen)
++{
++	s32 iolen;
++
++	iolen = brcmf_c_mkiovar(iovar, param, paramlen, bufptr, buflen);
++	BUG_ON(!iolen);
++
++	return brcmf_exec_dcmd(ndev, BRCMF_C_SET_VAR, bufptr, iolen);
++}
++
++static s32
++brcmf_dev_iovar_getbuf(struct net_device *ndev, s8 * iovar, void *param,
++		    s32 paramlen, void *bufptr, s32 buflen)
++{
++	s32 iolen;
++
++	iolen = brcmf_c_mkiovar(iovar, param, paramlen, bufptr, buflen);
++	BUG_ON(!iolen);
++
++	return brcmf_exec_dcmd(ndev, BRCMF_C_GET_VAR, bufptr, buflen);
++}
++
++static s32
++brcmf_run_iscan(struct brcmf_cfg80211_iscan_ctrl *iscan,
++		struct brcmf_ssid *ssid, u16 action)
++{
++	s32 params_size = BRCMF_SCAN_PARAMS_FIXED_SIZE +
++			  offsetof(struct brcmf_iscan_params_le, params_le);
++	struct brcmf_iscan_params_le *params;
++	s32 err = 0;
++
++	if (ssid && ssid->SSID_len)
++		params_size += sizeof(struct brcmf_ssid);
++	params = kzalloc(params_size, GFP_KERNEL);
++	if (!params)
++		return -ENOMEM;
++	BUG_ON(params_size >= BRCMF_DCMD_SMLEN);
++
++	wl_iscan_prep(&params->params_le, ssid);
++
++	params->version = cpu_to_le32(BRCMF_ISCAN_REQ_VERSION);
++	params->action = cpu_to_le16(action);
++	params->scan_duration = cpu_to_le16(0);
++
++	err = brcmf_dev_iovar_setbuf(iscan->ndev, "iscan", params, params_size,
++				     iscan->dcmd_buf, BRCMF_DCMD_SMLEN);
++	if (err) {
++		if (err == -EBUSY)
++			WL_INFO("system busy : iscan canceled\n");
++		else
++			WL_ERR("error (%d)\n", err);
++	}
++
++	kfree(params);
++	return err;
++}
++
++static s32 brcmf_do_iscan(struct brcmf_cfg80211_priv *cfg_priv)
++{
++	struct brcmf_cfg80211_iscan_ctrl *iscan = cfg_to_iscan(cfg_priv);
++	struct net_device *ndev = cfg_to_ndev(cfg_priv);
++	struct brcmf_ssid ssid;
++	__le32 passive_scan;
++	s32 err = 0;
++
++	/* Broadcast scan by default */
++	memset(&ssid, 0, sizeof(ssid));
++
++	iscan->state = WL_ISCAN_STATE_SCANING;
++
++	passive_scan = cfg_priv->active_scan ? 0 : cpu_to_le32(1);
++	err = brcmf_exec_dcmd(cfg_to_ndev(cfg_priv), BRCMF_C_SET_PASSIVE_SCAN,
++			&passive_scan, sizeof(passive_scan));
++	if (err) {
++		WL_ERR("error (%d)\n", err);
++		return err;
++	}
++	brcmf_set_mpc(ndev, 0);
++	cfg_priv->iscan_kickstart = true;
++	err = brcmf_run_iscan(iscan, &ssid, BRCMF_SCAN_ACTION_START);
++	if (err) {
++		brcmf_set_mpc(ndev, 1);
++		cfg_priv->iscan_kickstart = false;
++		return err;
++	}
++	mod_timer(&iscan->timer, jiffies + iscan->timer_ms * HZ / 1000);
++	iscan->timer_on = 1;
++	return err;
++}
++
++static s32
++__brcmf_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
++		   struct cfg80211_scan_request *request,
++		   struct cfg80211_ssid *this_ssid)
++{
++	struct brcmf_cfg80211_priv *cfg_priv = ndev_to_cfg(ndev);
++	struct cfg80211_ssid *ssids;
++	struct brcmf_cfg80211_scan_req *sr = cfg_priv->scan_req_int;
++	__le32 passive_scan;
++	bool iscan_req;
++	bool spec_scan;
++	s32 err = 0;
++	u32 SSID_len;
++
++	if (test_bit(WL_STATUS_SCANNING, &cfg_priv->status)) {
++		WL_ERR("Scanning already : status (%lu)\n", cfg_priv->status);
++		return -EAGAIN;
++	}
++	if (test_bit(WL_STATUS_SCAN_ABORTING, &cfg_priv->status)) {
++		WL_ERR("Scanning being aborted : status (%lu)\n",
++		       cfg_priv->status);
++		return -EAGAIN;
++	}
++	if (test_bit(WL_STATUS_CONNECTING, &cfg_priv->status)) {
++		WL_ERR("Connecting : status (%lu)\n",
++		       cfg_priv->status);
++		return -EAGAIN;
++	}
++
++	iscan_req = false;
++	spec_scan = false;
++	if (request) {
++		/* scan bss */
++		ssids = request->ssids;
++		if (cfg_priv->iscan_on && (!ssids || !ssids->ssid_len))
++			iscan_req = true;
++	} else {
++		/* scan in ibss */
++		/* we don't do iscan in ibss */
++		ssids = this_ssid;
++	}
++
++	cfg_priv->scan_request = request;
++	set_bit(WL_STATUS_SCANNING, &cfg_priv->status);
++	if (iscan_req) {
++		err = brcmf_do_iscan(cfg_priv);
++		if (!err)
++			return err;
++		else
++			goto scan_out;
++	} else {
++		WL_SCAN("ssid \"%s\", ssid_len (%d)\n",
++		       ssids->ssid, ssids->ssid_len);
++		memset(&sr->ssid_le, 0, sizeof(sr->ssid_le));
++		SSID_len = min_t(u8, sizeof(sr->ssid_le.SSID), ssids->ssid_len);
++		sr->ssid_le.SSID_len = cpu_to_le32(0);
++		if (SSID_len) {
++			memcpy(sr->ssid_le.SSID, ssids->ssid, SSID_len);
++			sr->ssid_le.SSID_len = cpu_to_le32(SSID_len);
++			spec_scan = true;
++		} else {
++			WL_SCAN("Broadcast scan\n");
++		}
++
++		passive_scan = cfg_priv->active_scan ? 0 : cpu_to_le32(1);
++		err = brcmf_exec_dcmd(ndev, BRCMF_C_SET_PASSIVE_SCAN,
++				&passive_scan, sizeof(passive_scan));
++		if (err) {
++			WL_ERR("WLC_SET_PASSIVE_SCAN error (%d)\n", err);
++			goto scan_out;
++		}
++		brcmf_set_mpc(ndev, 0);
++		err = brcmf_exec_dcmd(ndev, BRCMF_C_SCAN, &sr->ssid_le,
++				      sizeof(sr->ssid_le));
++		if (err) {
++			if (err == -EBUSY)
++				WL_INFO("system busy : scan for \"%s\" "
++					"canceled\n", sr->ssid_le.SSID);
++			else
++				WL_ERR("WLC_SCAN error (%d)\n", err);
++
++			brcmf_set_mpc(ndev, 1);
++			goto scan_out;
++		}
++	}
++
++	return 0;
++
++scan_out:
++	clear_bit(WL_STATUS_SCANNING, &cfg_priv->status);
++	cfg_priv->scan_request = NULL;
++	return err;
++}
++
++static s32
++brcmf_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
++		 struct cfg80211_scan_request *request)
++{
++	s32 err = 0;
++
++	WL_TRACE("Enter\n");
++
++	if (!check_sys_up(wiphy))
++		return -EIO;
++
++	err = __brcmf_cfg80211_scan(wiphy, ndev, request, NULL);
++	if (err)
++		WL_ERR("scan error (%d)\n", err);
++
++	WL_TRACE("Exit\n");
++	return err;
++}
++
++static s32 brcmf_set_rts(struct net_device *ndev, u32 rts_threshold)
++{
++	s32 err = 0;
++
++	err = brcmf_dev_intvar_set(ndev, "rtsthresh", rts_threshold);
++	if (err)
++		WL_ERR("Error (%d)\n", err);
++
++	return err;
++}
++
++static s32 brcmf_set_frag(struct net_device *ndev, u32 frag_threshold)
++{
++	s32 err = 0;
++
++	err = brcmf_dev_intvar_set(ndev, "fragthresh", frag_threshold);
++	if (err)
++		WL_ERR("Error (%d)\n", err);
++
++	return err;
++}
++
++static s32 brcmf_set_retry(struct net_device *ndev, u32 retry, bool l)
++{
++	s32 err = 0;
++	u32 cmd = (l ? BRCM_SET_LRL : BRCM_SET_SRL);
++
++	err = brcmf_exec_dcmd_u32(ndev, cmd, &retry);
++	if (err) {
++		WL_ERR("cmd (%d) , error (%d)\n", cmd, err);
++		return err;
++	}
++	return err;
++}
++
++static s32 brcmf_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
++{
++	struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
++	struct net_device *ndev = cfg_to_ndev(cfg_priv);
++	s32 err = 0;
++
++	WL_TRACE("Enter\n");
++	if (!check_sys_up(wiphy))
++		return -EIO;
++
++	if (changed & WIPHY_PARAM_RTS_THRESHOLD &&
++	    (cfg_priv->conf->rts_threshold != wiphy->rts_threshold)) {
++		cfg_priv->conf->rts_threshold = wiphy->rts_threshold;
++		err = brcmf_set_rts(ndev, cfg_priv->conf->rts_threshold);
++		if (!err)
++			goto done;
++	}
++	if (changed & WIPHY_PARAM_FRAG_THRESHOLD &&
++	    (cfg_priv->conf->frag_threshold != wiphy->frag_threshold)) {
++		cfg_priv->conf->frag_threshold = wiphy->frag_threshold;
++		err = brcmf_set_frag(ndev, cfg_priv->conf->frag_threshold);
++		if (!err)
++			goto done;
++	}
++	if (changed & WIPHY_PARAM_RETRY_LONG
++	    && (cfg_priv->conf->retry_long != wiphy->retry_long)) {
++		cfg_priv->conf->retry_long = wiphy->retry_long;
++		err = brcmf_set_retry(ndev, cfg_priv->conf->retry_long, true);
++		if (!err)
++			goto done;
++	}
++	if (changed & WIPHY_PARAM_RETRY_SHORT
++	    && (cfg_priv->conf->retry_short != wiphy->retry_short)) {
++		cfg_priv->conf->retry_short = wiphy->retry_short;
++		err = brcmf_set_retry(ndev, cfg_priv->conf->retry_short, false);
++		if (!err)
++			goto done;
++	}
++
++done:
++	WL_TRACE("Exit\n");
++	return err;
++}
++
++static void *brcmf_read_prof(struct brcmf_cfg80211_priv *cfg_priv, s32 item)
++{
++	switch (item) {
++	case WL_PROF_SEC:
++		return &cfg_priv->profile->sec;
++	case WL_PROF_BSSID:
++		return &cfg_priv->profile->bssid;
++	case WL_PROF_SSID:
++		return &cfg_priv->profile->ssid;
++	}
++	WL_ERR("invalid item (%d)\n", item);
++	return NULL;
++}
++
++static s32
++brcmf_update_prof(struct brcmf_cfg80211_priv *cfg_priv,
++		  const struct brcmf_event_msg *e, void *data, s32 item)
++{
++	s32 err = 0;
++	struct brcmf_ssid *ssid;
++
++	switch (item) {
++	case WL_PROF_SSID:
++		ssid = (struct brcmf_ssid *) data;
++		memset(cfg_priv->profile->ssid.SSID, 0,
++		       sizeof(cfg_priv->profile->ssid.SSID));
++		memcpy(cfg_priv->profile->ssid.SSID,
++		       ssid->SSID, ssid->SSID_len);
++		cfg_priv->profile->ssid.SSID_len = ssid->SSID_len;
++		break;
++	case WL_PROF_BSSID:
++		if (data)
++			memcpy(cfg_priv->profile->bssid, data, ETH_ALEN);
++		else
++			memset(cfg_priv->profile->bssid, 0, ETH_ALEN);
++		break;
++	case WL_PROF_SEC:
++		memcpy(&cfg_priv->profile->sec, data,
++		       sizeof(cfg_priv->profile->sec));
++		break;
++	case WL_PROF_BEACONINT:
++		cfg_priv->profile->beacon_interval = *(u16 *)data;
++		break;
++	case WL_PROF_DTIMPERIOD:
++		cfg_priv->profile->dtim_period = *(u8 *)data;
++		break;
++	default:
++		WL_ERR("unsupported item (%d)\n", item);
++		err = -EOPNOTSUPP;
++		break;
++	}
++
++	return err;
++}
++
++static void brcmf_init_prof(struct brcmf_cfg80211_profile *prof)
++{
++	memset(prof, 0, sizeof(*prof));
++}
++
++static void brcmf_ch_to_chanspec(int ch, struct brcmf_join_params *join_params,
++	size_t *join_params_size)
++{
++	u16 chanspec = 0;
++
++	if (ch != 0) {
++		if (ch <= CH_MAX_2G_CHANNEL)
++			chanspec |= WL_CHANSPEC_BAND_2G;
++		else
++			chanspec |= WL_CHANSPEC_BAND_5G;
++
++		chanspec |= WL_CHANSPEC_BW_20;
++		chanspec |= WL_CHANSPEC_CTL_SB_NONE;
++
++		*join_params_size += BRCMF_ASSOC_PARAMS_FIXED_SIZE +
++				     sizeof(u16);
++
++		chanspec |= (ch & WL_CHANSPEC_CHAN_MASK);
++		join_params->params_le.chanspec_list[0] = cpu_to_le16(chanspec);
++		join_params->params_le.chanspec_num = cpu_to_le32(1);
++
++		WL_CONN("join_params->params.chanspec_list[0]= %#X,"
++			"channel %d, chanspec %#X\n",
++			chanspec, ch, chanspec);
++	}
++}
++
++static void brcmf_link_down(struct brcmf_cfg80211_priv *cfg_priv)
++{
++	struct net_device *ndev = NULL;
++	s32 err = 0;
++
++	WL_TRACE("Enter\n");
++
++	if (cfg_priv->link_up) {
++		ndev = cfg_to_ndev(cfg_priv);
++		WL_INFO("Call WLC_DISASSOC to stop excess roaming\n ");
++		err = brcmf_exec_dcmd(ndev, BRCMF_C_DISASSOC, NULL, 0);
++		if (err)
++			WL_ERR("WLC_DISASSOC failed (%d)\n", err);
++		cfg_priv->link_up = false;
++	}
++	WL_TRACE("Exit\n");
++}
++
++static s32
++brcmf_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *ndev,
++		      struct cfg80211_ibss_params *params)
++{
++	struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
++	struct brcmf_join_params join_params;
++	size_t join_params_size = 0;
++	s32 err = 0;
++	s32 wsec = 0;
++	s32 bcnprd;
++	struct brcmf_ssid ssid;
++
++	WL_TRACE("Enter\n");
++	if (!check_sys_up(wiphy))
++		return -EIO;
++
++	if (params->ssid)
++		WL_CONN("SSID: %s\n", params->ssid);
++	else {
++		WL_CONN("SSID: NULL, Not supported\n");
++		return -EOPNOTSUPP;
++	}
++
++	set_bit(WL_STATUS_CONNECTING, &cfg_priv->status);
++
++	if (params->bssid)
++		WL_CONN("BSSID: %02X %02X %02X %02X %02X %02X\n",
++		params->bssid[0], params->bssid[1], params->bssid[2],
++		params->bssid[3], params->bssid[4], params->bssid[5]);
++	else
++		WL_CONN("No BSSID specified\n");
++
++	if (params->channel)
++		WL_CONN("channel: %d\n", params->channel->center_freq);
++	else
++		WL_CONN("no channel specified\n");
++
++	if (params->channel_fixed)
++		WL_CONN("fixed channel required\n");
++	else
++		WL_CONN("no fixed channel required\n");
++
++	if (params->ie && params->ie_len)
++		WL_CONN("ie len: %d\n", params->ie_len);
++	else
++		WL_CONN("no ie specified\n");
++
++	if (params->beacon_interval)
++		WL_CONN("beacon interval: %d\n", params->beacon_interval);
++	else
++		WL_CONN("no beacon interval specified\n");
++
++	if (params->basic_rates)
++		WL_CONN("basic rates: %08X\n", params->basic_rates);
++	else
++		WL_CONN("no basic rates specified\n");
++
++	if (params->privacy)
++		WL_CONN("privacy required\n");
++	else
++		WL_CONN("no privacy required\n");
++
++	/* Configure Privacy for starter */
++	if (params->privacy)
++		wsec |= WEP_ENABLED;
++
++	err = brcmf_dev_intvar_set(ndev, "wsec", wsec);
++	if (err) {
++		WL_ERR("wsec failed (%d)\n", err);
++		goto done;
++	}
++
++	/* Configure Beacon Interval for starter */
++	if (params->beacon_interval)
++		bcnprd = params->beacon_interval;
++	else
++		bcnprd = 100;
++
++	err = brcmf_exec_dcmd_u32(ndev, BRCM_SET_BCNPRD, &bcnprd);
++	if (err) {
++		WL_ERR("WLC_SET_BCNPRD failed (%d)\n", err);
++		goto done;
++	}
++
++	/* Configure required join parameter */
++	memset(&join_params, 0, sizeof(struct brcmf_join_params));
++
++	/* SSID */
++	ssid.SSID_len = min_t(u32, params->ssid_len, 32);
++	memcpy(ssid.SSID, params->ssid, ssid.SSID_len);
++	memcpy(join_params.ssid_le.SSID, params->ssid, ssid.SSID_len);
++	join_params.ssid_le.SSID_len = cpu_to_le32(ssid.SSID_len);
++	join_params_size = sizeof(join_params.ssid_le);
++	brcmf_update_prof(cfg_priv, NULL, &ssid, WL_PROF_SSID);
++
++	/* BSSID */
++	if (params->bssid) {
++		memcpy(join_params.params_le.bssid, params->bssid, ETH_ALEN);
++		join_params_size = sizeof(join_params.ssid_le) +
++				   BRCMF_ASSOC_PARAMS_FIXED_SIZE;
++	} else {
++		memcpy(join_params.params_le.bssid, ether_bcast, ETH_ALEN);
++	}
++
++	brcmf_update_prof(cfg_priv, NULL,
++			  &join_params.params_le.bssid, WL_PROF_BSSID);
++
++	/* Channel */
++	if (params->channel) {
++		u32 target_channel;
++
++		cfg_priv->channel =
++			ieee80211_frequency_to_channel(
++				params->channel->center_freq);
++		if (params->channel_fixed) {
++			/* adding chanspec */
++			brcmf_ch_to_chanspec(cfg_priv->channel,
++				&join_params, &join_params_size);
++		}
++
++		/* set channel for starter */
++		target_channel = cfg_priv->channel;
++		err = brcmf_exec_dcmd_u32(ndev, BRCM_SET_CHANNEL,
++					  &target_channel);
++		if (err) {
++			WL_ERR("WLC_SET_CHANNEL failed (%d)\n", err);
++			goto done;
++		}
++	} else
++		cfg_priv->channel = 0;
++
++	cfg_priv->ibss_starter = false;
++
++
++	err = brcmf_exec_dcmd(ndev, BRCMF_C_SET_SSID,
++			   &join_params, join_params_size);
++	if (err) {
++		WL_ERR("WLC_SET_SSID failed (%d)\n", err);
++		goto done;
++	}
++
++done:
++	if (err)
++		clear_bit(WL_STATUS_CONNECTING, &cfg_priv->status);
++	WL_TRACE("Exit\n");
++	return err;
++}
++
++static s32
++brcmf_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *ndev)
++{
++	struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
++	s32 err = 0;
++
++	WL_TRACE("Enter\n");
++	if (!check_sys_up(wiphy))
++		return -EIO;
++
++	brcmf_link_down(cfg_priv);
++
++	WL_TRACE("Exit\n");
++
++	return err;
++}
++
++static s32 brcmf_set_wpa_version(struct net_device *ndev,
++				 struct cfg80211_connect_params *sme)
++{
++	struct brcmf_cfg80211_priv *cfg_priv = ndev_to_cfg(ndev);
++	struct brcmf_cfg80211_security *sec;
++	s32 val = 0;
++	s32 err = 0;
++
++	if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_1)
++		val = WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED;
++	else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_2)
++		val = WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED;
++	else
++		val = WPA_AUTH_DISABLED;
++	WL_CONN("setting wpa_auth to 0x%0x\n", val);
++	err = brcmf_dev_intvar_set(ndev, "wpa_auth", val);
++	if (err) {
++		WL_ERR("set wpa_auth failed (%d)\n", err);
++		return err;
++	}
++	sec = brcmf_read_prof(cfg_priv, WL_PROF_SEC);
++	sec->wpa_versions = sme->crypto.wpa_versions;
++	return err;
++}
++
++static s32 brcmf_set_auth_type(struct net_device *ndev,
++			       struct cfg80211_connect_params *sme)
++{
++	struct brcmf_cfg80211_priv *cfg_priv = ndev_to_cfg(ndev);
++	struct brcmf_cfg80211_security *sec;
++	s32 val = 0;
++	s32 err = 0;
++
++	switch (sme->auth_type) {
++	case NL80211_AUTHTYPE_OPEN_SYSTEM:
++		val = 0;
++		WL_CONN("open system\n");
++		break;
++	case NL80211_AUTHTYPE_SHARED_KEY:
++		val = 1;
++		WL_CONN("shared key\n");
++		break;
++	case NL80211_AUTHTYPE_AUTOMATIC:
++		val = 2;
++		WL_CONN("automatic\n");
++		break;
++	case NL80211_AUTHTYPE_NETWORK_EAP:
++		WL_CONN("network eap\n");
++	default:
++		val = 2;
++		WL_ERR("invalid auth type (%d)\n", sme->auth_type);
++		break;
++	}
++
++	err = brcmf_dev_intvar_set(ndev, "auth", val);
++	if (err) {
++		WL_ERR("set auth failed (%d)\n", err);
++		return err;
++	}
++	sec = brcmf_read_prof(cfg_priv, WL_PROF_SEC);
++	sec->auth_type = sme->auth_type;
++	return err;
++}
++
++static s32
++brcmf_set_set_cipher(struct net_device *ndev,
++		     struct cfg80211_connect_params *sme)
++{
++	struct brcmf_cfg80211_priv *cfg_priv = ndev_to_cfg(ndev);
++	struct brcmf_cfg80211_security *sec;
++	s32 pval = 0;
++	s32 gval = 0;
++	s32 err = 0;
++
++	if (sme->crypto.n_ciphers_pairwise) {
++		switch (sme->crypto.ciphers_pairwise[0]) {
++		case WLAN_CIPHER_SUITE_WEP40:
++		case WLAN_CIPHER_SUITE_WEP104:
++			pval = WEP_ENABLED;
++			break;
++		case WLAN_CIPHER_SUITE_TKIP:
++			pval = TKIP_ENABLED;
++			break;
++		case WLAN_CIPHER_SUITE_CCMP:
++			pval = AES_ENABLED;
++			break;
++		case WLAN_CIPHER_SUITE_AES_CMAC:
++			pval = AES_ENABLED;
++			break;
++		default:
++			WL_ERR("invalid cipher pairwise (%d)\n",
++			       sme->crypto.ciphers_pairwise[0]);
++			return -EINVAL;
++		}
++	}
++	if (sme->crypto.cipher_group) {
++		switch (sme->crypto.cipher_group) {
++		case WLAN_CIPHER_SUITE_WEP40:
++		case WLAN_CIPHER_SUITE_WEP104:
++			gval = WEP_ENABLED;
++			break;
++		case WLAN_CIPHER_SUITE_TKIP:
++			gval = TKIP_ENABLED;
++			break;
++		case WLAN_CIPHER_SUITE_CCMP:
++			gval = AES_ENABLED;
++			break;
++		case WLAN_CIPHER_SUITE_AES_CMAC:
++			gval = AES_ENABLED;
++			break;
++		default:
++			WL_ERR("invalid cipher group (%d)\n",
++			       sme->crypto.cipher_group);
++			return -EINVAL;
++		}
++	}
++
++	WL_CONN("pval (%d) gval (%d)\n", pval, gval);
++	err = brcmf_dev_intvar_set(ndev, "wsec", pval | gval);
++	if (err) {
++		WL_ERR("error (%d)\n", err);
++		return err;
++	}
++
++	sec = brcmf_read_prof(cfg_priv, WL_PROF_SEC);
++	sec->cipher_pairwise = sme->crypto.ciphers_pairwise[0];
++	sec->cipher_group = sme->crypto.cipher_group;
++
++	return err;
++}
++
++static s32
++brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
++{
++	struct brcmf_cfg80211_priv *cfg_priv = ndev_to_cfg(ndev);
++	struct brcmf_cfg80211_security *sec;
++	s32 val = 0;
++	s32 err = 0;
++
++	if (sme->crypto.n_akm_suites) {
++		err = brcmf_dev_intvar_get(ndev, "wpa_auth", &val);
++		if (err) {
++			WL_ERR("could not get wpa_auth (%d)\n", err);
++			return err;
++		}
++		if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
++			switch (sme->crypto.akm_suites[0]) {
++			case WLAN_AKM_SUITE_8021X:
++				val = WPA_AUTH_UNSPECIFIED;
++				break;
++			case WLAN_AKM_SUITE_PSK:
++				val = WPA_AUTH_PSK;
++				break;
++			default:
++				WL_ERR("invalid cipher group (%d)\n",
++				       sme->crypto.cipher_group);
++				return -EINVAL;
++			}
++		} else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
++			switch (sme->crypto.akm_suites[0]) {
++			case WLAN_AKM_SUITE_8021X:
++				val = WPA2_AUTH_UNSPECIFIED;
++				break;
++			case WLAN_AKM_SUITE_PSK:
++				val = WPA2_AUTH_PSK;
++				break;
++			default:
++				WL_ERR("invalid cipher group (%d)\n",
++				       sme->crypto.cipher_group);
++				return -EINVAL;
++			}
++		}
++
++		WL_CONN("setting wpa_auth to %d\n", val);
++		err = brcmf_dev_intvar_set(ndev, "wpa_auth", val);
++		if (err) {
++			WL_ERR("could not set wpa_auth (%d)\n", err);
++			return err;
++		}
++	}
++	sec = brcmf_read_prof(cfg_priv, WL_PROF_SEC);
++	sec->wpa_auth = sme->crypto.akm_suites[0];
++
++	return err;
++}
++
++static s32
++brcmf_set_wep_sharedkey(struct net_device *ndev,
++		     struct cfg80211_connect_params *sme)
++{
++	struct brcmf_cfg80211_priv *cfg_priv = ndev_to_cfg(ndev);
++	struct brcmf_cfg80211_security *sec;
++	struct brcmf_wsec_key key;
++	s32 val;
++	s32 err = 0;
++
++	WL_CONN("key len (%d)\n", sme->key_len);
++
++	if (sme->key_len == 0)
++		return 0;
++
++	sec = brcmf_read_prof(cfg_priv, WL_PROF_SEC);
++	WL_CONN("wpa_versions 0x%x cipher_pairwise 0x%x\n",
++		sec->wpa_versions, sec->cipher_pairwise);
++
++	if (sec->wpa_versions & (NL80211_WPA_VERSION_1 | NL80211_WPA_VERSION_2))
++		return 0;
++
++	if (sec->cipher_pairwise &
++	    (WLAN_CIPHER_SUITE_WEP40 | WLAN_CIPHER_SUITE_WEP104)) {
++		memset(&key, 0, sizeof(key));
++		key.len = (u32) sme->key_len;
++		key.index = (u32) sme->key_idx;
++		if (key.len > sizeof(key.data)) {
++			WL_ERR("Too long key length (%u)\n", key.len);
++			return -EINVAL;
++		}
++		memcpy(key.data, sme->key, key.len);
++		key.flags = BRCMF_PRIMARY_KEY;
++		switch (sec->cipher_pairwise) {
++		case WLAN_CIPHER_SUITE_WEP40:
++			key.algo = CRYPTO_ALGO_WEP1;
++			break;
++		case WLAN_CIPHER_SUITE_WEP104:
++			key.algo = CRYPTO_ALGO_WEP128;
++			break;
++		default:
++			WL_ERR("Invalid algorithm (%d)\n",
++			       sme->crypto.ciphers_pairwise[0]);
++			return -EINVAL;
++		}
++		/* Set the new key/index */
++		WL_CONN("key length (%d) key index (%d) algo (%d)\n",
++			key.len, key.index, key.algo);
++		WL_CONN("key \"%s\"\n", key.data);
++		err = send_key_to_dongle(ndev, &key);
++		if (err)
++			return err;
++
++		if (sec->auth_type == NL80211_AUTHTYPE_OPEN_SYSTEM) {
++			WL_CONN("set auth_type to shared key\n");
++			val = 1;	/* shared key */
++			err = brcmf_dev_intvar_set(ndev, "auth", val);
++			if (err) {
++				WL_ERR("set auth failed (%d)\n", err);
++				return err;
++			}
++		}
++	}
++	return err;
++}
++
++static s32
++brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
++		    struct cfg80211_connect_params *sme)
++{
++	struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
++	struct ieee80211_channel *chan = sme->channel;
++	struct brcmf_join_params join_params;
++	size_t join_params_size;
++	struct brcmf_ssid ssid;
++
++	s32 err = 0;
++
++	WL_TRACE("Enter\n");
++	if (!check_sys_up(wiphy))
++		return -EIO;
++
++	if (!sme->ssid) {
++		WL_ERR("Invalid ssid\n");
++		return -EOPNOTSUPP;
++	}
++
++	set_bit(WL_STATUS_CONNECTING, &cfg_priv->status);
++
++	if (chan) {
++		cfg_priv->channel =
++			ieee80211_frequency_to_channel(chan->center_freq);
++		WL_CONN("channel (%d), center_req (%d)\n",
++				cfg_priv->channel, chan->center_freq);
++	} else
++		cfg_priv->channel = 0;
++
++	WL_INFO("ie (%p), ie_len (%zd)\n", sme->ie, sme->ie_len);
++
++	err = brcmf_set_wpa_version(ndev, sme);
++	if (err) {
++		WL_ERR("wl_set_wpa_version failed (%d)\n", err);
++		goto done;
++	}
++
++	err = brcmf_set_auth_type(ndev, sme);
++	if (err) {
++		WL_ERR("wl_set_auth_type failed (%d)\n", err);
++		goto done;
++	}
++
++	err = brcmf_set_set_cipher(ndev, sme);
++	if (err) {
++		WL_ERR("wl_set_set_cipher failed (%d)\n", err);
++		goto done;
++	}
++
++	err = brcmf_set_key_mgmt(ndev, sme);
++	if (err) {
++		WL_ERR("wl_set_key_mgmt failed (%d)\n", err);
++		goto done;
++	}
++
++	err = brcmf_set_wep_sharedkey(ndev, sme);
++	if (err) {
++		WL_ERR("brcmf_set_wep_sharedkey failed (%d)\n", err);
++		goto done;
++	}
++
++	memset(&join_params, 0, sizeof(join_params));
++	join_params_size = sizeof(join_params.ssid_le);
++
++	ssid.SSID_len = min_t(u32, sizeof(ssid.SSID), (u32)sme->ssid_len);
++	memcpy(&join_params.ssid_le.SSID, sme->ssid, ssid.SSID_len);
++	memcpy(&ssid.SSID, sme->ssid, ssid.SSID_len);
++	join_params.ssid_le.SSID_len = cpu_to_le32(ssid.SSID_len);
++	brcmf_update_prof(cfg_priv, NULL, &ssid, WL_PROF_SSID);
++
++	memcpy(join_params.params_le.bssid, ether_bcast, ETH_ALEN);
++
++	if (ssid.SSID_len < IEEE80211_MAX_SSID_LEN)
++		WL_CONN("ssid \"%s\", len (%d)\n",
++		       ssid.SSID, ssid.SSID_len);
++
++	brcmf_ch_to_chanspec(cfg_priv->channel,
++			     &join_params, &join_params_size);
++	err = brcmf_exec_dcmd(ndev, BRCMF_C_SET_SSID,
++			   &join_params, join_params_size);
++	if (err)
++		WL_ERR("WLC_SET_SSID failed (%d)\n", err);
++
++done:
++	if (err)
++		clear_bit(WL_STATUS_CONNECTING, &cfg_priv->status);
++	WL_TRACE("Exit\n");
++	return err;
++}
++
++static s32
++brcmf_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *ndev,
++		       u16 reason_code)
++{
++	struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
++	struct brcmf_scb_val_le scbval;
++	s32 err = 0;
++
++	WL_TRACE("Enter. Reason code = %d\n", reason_code);
++	if (!check_sys_up(wiphy))
++		return -EIO;
++
++	clear_bit(WL_STATUS_CONNECTED, &cfg_priv->status);
++
++	memcpy(&scbval.ea, brcmf_read_prof(cfg_priv, WL_PROF_BSSID), ETH_ALEN);
++	scbval.val = cpu_to_le32(reason_code);
++	err = brcmf_exec_dcmd(ndev, BRCMF_C_DISASSOC, &scbval,
++			      sizeof(struct brcmf_scb_val_le));
++	if (err)
++		WL_ERR("error (%d)\n", err);
++
++	cfg_priv->link_up = false;
++
++	WL_TRACE("Exit\n");
++	return err;
++}
++
++static s32
++brcmf_cfg80211_set_tx_power(struct wiphy *wiphy,
++			    enum nl80211_tx_power_setting type, s32 mbm)
++{
++
++	struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
++	struct net_device *ndev = cfg_to_ndev(cfg_priv);
++	u16 txpwrmw;
++	s32 err = 0;
++	s32 disable = 0;
++	s32 dbm = MBM_TO_DBM(mbm);
++
++	WL_TRACE("Enter\n");
++	if (!check_sys_up(wiphy))
++		return -EIO;
++
++	switch (type) {
++	case NL80211_TX_POWER_AUTOMATIC:
++		break;
++	case NL80211_TX_POWER_LIMITED:
++	case NL80211_TX_POWER_FIXED:
++		if (dbm < 0) {
++			WL_ERR("TX_POWER_FIXED - dbm is negative\n");
++			err = -EINVAL;
++			goto done;
++		}
++		break;
++	}
++	/* Make sure radio is off or on as far as software is concerned */
++	disable = WL_RADIO_SW_DISABLE << 16;
++	err = brcmf_exec_dcmd_u32(ndev, BRCMF_C_SET_RADIO, &disable);
++	if (err)
++		WL_ERR("WLC_SET_RADIO error (%d)\n", err);
++
++	if (dbm > 0xffff)
++		txpwrmw = 0xffff;
++	else
++		txpwrmw = (u16) dbm;
++	err = brcmf_dev_intvar_set(ndev, "qtxpower",
++			(s32) (brcmf_mw_to_qdbm(txpwrmw)));
++	if (err)
++		WL_ERR("qtxpower error (%d)\n", err);
++	cfg_priv->conf->tx_power = dbm;
++
++done:
++	WL_TRACE("Exit\n");
++	return err;
++}
++
++static s32 brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, s32 *dbm)
++{
++	struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
++	struct net_device *ndev = cfg_to_ndev(cfg_priv);
++	s32 txpwrdbm;
++	u8 result;
++	s32 err = 0;
++
++	WL_TRACE("Enter\n");
++	if (!check_sys_up(wiphy))
++		return -EIO;
++
++	err = brcmf_dev_intvar_get(ndev, "qtxpower", &txpwrdbm);
++	if (err) {
++		WL_ERR("error (%d)\n", err);
++		goto done;
++	}
++
++	result = (u8) (txpwrdbm & ~WL_TXPWR_OVERRIDE);
++	*dbm = (s32) brcmf_qdbm_to_mw(result);
++
++done:
++	WL_TRACE("Exit\n");
++	return err;
++}
++
++static s32
++brcmf_cfg80211_config_default_key(struct wiphy *wiphy, struct net_device *ndev,
++			       u8 key_idx, bool unicast, bool multicast)
++{
++	u32 index;
++	u32 wsec;
++	s32 err = 0;
++
++	WL_TRACE("Enter\n");
++	WL_CONN("key index (%d)\n", key_idx);
++	if (!check_sys_up(wiphy))
++		return -EIO;
++
++	err = brcmf_exec_dcmd_u32(ndev, BRCMF_C_GET_WSEC, &wsec);
++	if (err) {
++		WL_ERR("WLC_GET_WSEC error (%d)\n", err);
++		goto done;
++	}
++
++	if (wsec & WEP_ENABLED) {
++		/* Just select a new current key */
++		index = key_idx;
++		err = brcmf_exec_dcmd_u32(ndev, BRCMF_C_SET_KEY_PRIMARY,
++					  &index);
++		if (err)
++			WL_ERR("error (%d)\n", err);
++	}
++done:
++	WL_TRACE("Exit\n");
++	return err;
++}
++
++static s32
++brcmf_add_keyext(struct wiphy *wiphy, struct net_device *ndev,
++	      u8 key_idx, const u8 *mac_addr, struct key_params *params)
++{
++	struct brcmf_wsec_key key;
++	struct brcmf_wsec_key_le key_le;
++	s32 err = 0;
++
++	memset(&key, 0, sizeof(key));
++	key.index = (u32) key_idx;
++	/* Instead of bcast for ea address for default wep keys,
++		 driver needs it to be Null */
++	if (!is_multicast_ether_addr(mac_addr))
++		memcpy((char *)&key.ea, (void *)mac_addr, ETH_ALEN);
++	key.len = (u32) params->key_len;
++	/* check for key index change */
++	if (key.len == 0) {
++		/* key delete */
++		err = send_key_to_dongle(ndev, &key);
++		if (err)
++			return err;
++	} else {
++		if (key.len > sizeof(key.data)) {
++			WL_ERR("Invalid key length (%d)\n", key.len);
++			return -EINVAL;
++		}
++
++		WL_CONN("Setting the key index %d\n", key.index);
++		memcpy(key.data, params->key, key.len);
++
++		if (params->cipher == WLAN_CIPHER_SUITE_TKIP) {
++			u8 keybuf[8];
++			memcpy(keybuf, &key.data[24], sizeof(keybuf));
++			memcpy(&key.data[24], &key.data[16], sizeof(keybuf));
++			memcpy(&key.data[16], keybuf, sizeof(keybuf));
++		}
++
++		/* if IW_ENCODE_EXT_RX_SEQ_VALID set */
++		if (params->seq && params->seq_len == 6) {
++			/* rx iv */
++			u8 *ivptr;
++			ivptr = (u8 *) params->seq;
++			key.rxiv.hi = (ivptr[5] << 24) | (ivptr[4] << 16) |
++			    (ivptr[3] << 8) | ivptr[2];
++			key.rxiv.lo = (ivptr[1] << 8) | ivptr[0];
++			key.iv_initialized = true;
++		}
++
++		switch (params->cipher) {
++		case WLAN_CIPHER_SUITE_WEP40:
++			key.algo = CRYPTO_ALGO_WEP1;
++			WL_CONN("WLAN_CIPHER_SUITE_WEP40\n");
++			break;
++		case WLAN_CIPHER_SUITE_WEP104:
++			key.algo = CRYPTO_ALGO_WEP128;
++			WL_CONN("WLAN_CIPHER_SUITE_WEP104\n");
++			break;
++		case WLAN_CIPHER_SUITE_TKIP:
++			key.algo = CRYPTO_ALGO_TKIP;
++			WL_CONN("WLAN_CIPHER_SUITE_TKIP\n");
++			break;
++		case WLAN_CIPHER_SUITE_AES_CMAC:
++			key.algo = CRYPTO_ALGO_AES_CCM;
++			WL_CONN("WLAN_CIPHER_SUITE_AES_CMAC\n");
++			break;
++		case WLAN_CIPHER_SUITE_CCMP:
++			key.algo = CRYPTO_ALGO_AES_CCM;
++			WL_CONN("WLAN_CIPHER_SUITE_CCMP\n");
++			break;
++		default:
++			WL_ERR("Invalid cipher (0x%x)\n", params->cipher);
++			return -EINVAL;
++		}
++		convert_key_from_CPU(&key, &key_le);
++
++		brcmf_netdev_wait_pend8021x(ndev);
++		err = brcmf_exec_dcmd(ndev, BRCMF_C_SET_KEY, &key_le,
++				      sizeof(key_le));
++		if (err) {
++			WL_ERR("WLC_SET_KEY error (%d)\n", err);
++			return err;
++		}
++	}
++	return err;
++}
++
++static s32
++brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
++		    u8 key_idx, bool pairwise, const u8 *mac_addr,
++		    struct key_params *params)
++{
++	struct brcmf_wsec_key key;
++	s32 val;
++	s32 wsec;
++	s32 err = 0;
++	u8 keybuf[8];
++
++	WL_TRACE("Enter\n");
++	WL_CONN("key index (%d)\n", key_idx);
++	if (!check_sys_up(wiphy))
++		return -EIO;
++
++	if (mac_addr) {
++		WL_TRACE("Exit");
++		return brcmf_add_keyext(wiphy, ndev, key_idx, mac_addr, params);
++	}
++	memset(&key, 0, sizeof(key));
++
++	key.len = (u32) params->key_len;
++	key.index = (u32) key_idx;
++
++	if (key.len > sizeof(key.data)) {
++		WL_ERR("Too long key length (%u)\n", key.len);
++		err = -EINVAL;
++		goto done;
++	}
++	memcpy(key.data, params->key, key.len);
++
++	key.flags = BRCMF_PRIMARY_KEY;
++	switch (params->cipher) {
++	case WLAN_CIPHER_SUITE_WEP40:
++		key.algo = CRYPTO_ALGO_WEP1;
++		WL_CONN("WLAN_CIPHER_SUITE_WEP40\n");
++		break;
++	case WLAN_CIPHER_SUITE_WEP104:
++		key.algo = CRYPTO_ALGO_WEP128;
++		WL_CONN("WLAN_CIPHER_SUITE_WEP104\n");
++		break;
++	case WLAN_CIPHER_SUITE_TKIP:
++		memcpy(keybuf, &key.data[24], sizeof(keybuf));
++		memcpy(&key.data[24], &key.data[16], sizeof(keybuf));
++		memcpy(&key.data[16], keybuf, sizeof(keybuf));
++		key.algo = CRYPTO_ALGO_TKIP;
++		WL_CONN("WLAN_CIPHER_SUITE_TKIP\n");
++		break;
++	case WLAN_CIPHER_SUITE_AES_CMAC:
++		key.algo = CRYPTO_ALGO_AES_CCM;
++		WL_CONN("WLAN_CIPHER_SUITE_AES_CMAC\n");
++		break;
++	case WLAN_CIPHER_SUITE_CCMP:
++		key.algo = CRYPTO_ALGO_AES_CCM;
++		WL_CONN("WLAN_CIPHER_SUITE_CCMP\n");
++		break;
++	default:
++		WL_ERR("Invalid cipher (0x%x)\n", params->cipher);
++		err = -EINVAL;
++		goto done;
++	}
++
++	err = send_key_to_dongle(ndev, &key); /* Set the new key/index */
++	if (err)
++		goto done;
++
++	val = WEP_ENABLED;
++	err = brcmf_dev_intvar_get(ndev, "wsec", &wsec);
++	if (err) {
++		WL_ERR("get wsec error (%d)\n", err);
++		goto done;
++	}
++	wsec &= ~(WEP_ENABLED);
++	wsec |= val;
++	err = brcmf_dev_intvar_set(ndev, "wsec", wsec);
++	if (err) {
++		WL_ERR("set wsec error (%d)\n", err);
++		goto done;
++	}
++
++	val = 1;		/* assume shared key. otherwise 0 */
++	err = brcmf_exec_dcmd_u32(ndev, BRCMF_C_SET_AUTH, &val);
++	if (err)
++		WL_ERR("WLC_SET_AUTH error (%d)\n", err);
++done:
++	WL_TRACE("Exit\n");
++	return err;
++}
++
++static s32
++brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
++		    u8 key_idx, bool pairwise, const u8 *mac_addr)
++{
++	struct brcmf_wsec_key key;
++	s32 err = 0;
++	s32 val;
++	s32 wsec;
++
++	WL_TRACE("Enter\n");
++	if (!check_sys_up(wiphy))
++		return -EIO;
++
++	memset(&key, 0, sizeof(key));
++
++	key.index = (u32) key_idx;
++	key.flags = BRCMF_PRIMARY_KEY;
++	key.algo = CRYPTO_ALGO_OFF;
++
++	WL_CONN("key index (%d)\n", key_idx);
++
++	/* Set the new key/index */
++	err = send_key_to_dongle(ndev, &key);
++	if (err) {
++		if (err == -EINVAL) {
++			if (key.index >= DOT11_MAX_DEFAULT_KEYS)
++				/* we ignore this key index in this case */
++				WL_ERR("invalid key index (%d)\n", key_idx);
++		}
++		/* Ignore this error, may happen during DISASSOC */
++		err = -EAGAIN;
++		goto done;
++	}
++
++	val = 0;
++	err = brcmf_dev_intvar_get(ndev, "wsec", &wsec);
++	if (err) {
++		WL_ERR("get wsec error (%d)\n", err);
++		/* Ignore this error, may happen during DISASSOC */
++		err = -EAGAIN;
++		goto done;
++	}
++	wsec &= ~(WEP_ENABLED);
++	wsec |= val;
++	err = brcmf_dev_intvar_set(ndev, "wsec", wsec);
++	if (err) {
++		WL_ERR("set wsec error (%d)\n", err);
++		/* Ignore this error, may happen during DISASSOC */
++		err = -EAGAIN;
++		goto done;
++	}
++
++	val = 0;		/* assume open key. otherwise 1 */
++	err = brcmf_exec_dcmd_u32(ndev, BRCMF_C_SET_AUTH, &val);
++	if (err) {
++		WL_ERR("WLC_SET_AUTH error (%d)\n", err);
++		/* Ignore this error, may happen during DISASSOC */
++		err = -EAGAIN;
++	}
++done:
++	WL_TRACE("Exit\n");
++	return err;
++}
++
++static s32
++brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev,
++		    u8 key_idx, bool pairwise, const u8 *mac_addr, void *cookie,
++		    void (*callback) (void *cookie, struct key_params * params))
++{
++	struct key_params params;
++	struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
++	struct brcmf_cfg80211_security *sec;
++	s32 wsec;
++	s32 err = 0;
++
++	WL_TRACE("Enter\n");
++	WL_CONN("key index (%d)\n", key_idx);
++	if (!check_sys_up(wiphy))
++		return -EIO;
++
++	memset(&params, 0, sizeof(params));
++
++	err = brcmf_exec_dcmd_u32(ndev, BRCMF_C_GET_WSEC, &wsec);
++	if (err) {
++		WL_ERR("WLC_GET_WSEC error (%d)\n", err);
++		/* Ignore this error, may happen during DISASSOC */
++		err = -EAGAIN;
++		goto done;
++	}
++	switch (wsec) {
++	case WEP_ENABLED:
++		sec = brcmf_read_prof(cfg_priv, WL_PROF_SEC);
++		if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP40) {
++			params.cipher = WLAN_CIPHER_SUITE_WEP40;
++			WL_CONN("WLAN_CIPHER_SUITE_WEP40\n");
++		} else if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP104) {
++			params.cipher = WLAN_CIPHER_SUITE_WEP104;
++			WL_CONN("WLAN_CIPHER_SUITE_WEP104\n");
++		}
++		break;
++	case TKIP_ENABLED:
++		params.cipher = WLAN_CIPHER_SUITE_TKIP;
++		WL_CONN("WLAN_CIPHER_SUITE_TKIP\n");
++		break;
++	case AES_ENABLED:
++		params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
++		WL_CONN("WLAN_CIPHER_SUITE_AES_CMAC\n");
++		break;
++	default:
++		WL_ERR("Invalid algo (0x%x)\n", wsec);
++		err = -EINVAL;
++		goto done;
++	}
++	callback(cookie, &params);
++
++done:
++	WL_TRACE("Exit\n");
++	return err;
++}
++
++static s32
++brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
++				    struct net_device *ndev, u8 key_idx)
++{
++	WL_INFO("Not supported\n");
++
++	return -EOPNOTSUPP;
++}
++
++static s32
++brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
++			u8 *mac, struct station_info *sinfo)
++{
++	struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
++	struct brcmf_scb_val_le scb_val;
++	int rssi;
++	s32 rate;
++	s32 err = 0;
++	u8 *bssid = brcmf_read_prof(cfg_priv, WL_PROF_BSSID);
++
++	WL_TRACE("Enter\n");
++	if (!check_sys_up(wiphy))
++		return -EIO;
++
++	if (memcmp(mac, bssid, ETH_ALEN)) {
++		WL_ERR("Wrong Mac address cfg_mac-%X:%X:%X:%X:%X:%X"
++			"wl_bssid-%X:%X:%X:%X:%X:%X\n",
++			mac[0], mac[1], mac[2], mac[3], mac[4], mac[5],
++			bssid[0], bssid[1], bssid[2], bssid[3],
++			bssid[4], bssid[5]);
++		err = -ENOENT;
++		goto done;
++	}
++
++	/* Report the current tx rate */
++	err = brcmf_exec_dcmd_u32(ndev, BRCMF_C_GET_RATE, &rate);
++	if (err) {
++		WL_ERR("Could not get rate (%d)\n", err);
++	} else {
++		sinfo->filled |= STATION_INFO_TX_BITRATE;
++		sinfo->txrate.legacy = rate * 5;
++		WL_CONN("Rate %d Mbps\n", rate / 2);
++	}
++
++	if (test_bit(WL_STATUS_CONNECTED, &cfg_priv->status)) {
++		scb_val.val = cpu_to_le32(0);
++		err = brcmf_exec_dcmd(ndev, BRCMF_C_GET_RSSI, &scb_val,
++				      sizeof(struct brcmf_scb_val_le));
++		if (err)
++			WL_ERR("Could not get rssi (%d)\n", err);
++
++		rssi = le32_to_cpu(scb_val.val);
++		sinfo->filled |= STATION_INFO_SIGNAL;
++		sinfo->signal = rssi;
++		WL_CONN("RSSI %d dBm\n", rssi);
++	}
++
++done:
++	WL_TRACE("Exit\n");
++	return err;
++}
++
++static s32
++brcmf_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *ndev,
++			   bool enabled, s32 timeout)
++{
++	s32 pm;
++	s32 err = 0;
++	struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
++
++	WL_TRACE("Enter\n");
++
++	/*
++	 * Powersave enable/disable request is coming from the
++	 * cfg80211 even before the interface is up. In that
++	 * scenario, driver will be storing the power save
++	 * preference in cfg_priv struct to apply this to
++	 * FW later while initializing the dongle
++	 */
++	cfg_priv->pwr_save = enabled;
++	if (!test_bit(WL_STATUS_READY, &cfg_priv->status)) {
++
++		WL_INFO("Device is not ready,"
++			"storing the value in cfg_priv struct\n");
++		goto done;
++	}
++
++	pm = enabled ? PM_FAST : PM_OFF;
++	WL_INFO("power save %s\n", (pm ? "enabled" : "disabled"));
++
++	err = brcmf_exec_dcmd_u32(ndev, BRCMF_C_SET_PM, &pm);
++	if (err) {
++		if (err == -ENODEV)
++			WL_ERR("net_device is not ready yet\n");
++		else
++			WL_ERR("error (%d)\n", err);
++	}
++done:
++	WL_TRACE("Exit\n");
++	return err;
++}
++
++static s32
++brcmf_cfg80211_set_bitrate_mask(struct wiphy *wiphy, struct net_device *ndev,
++			     const u8 *addr,
++			     const struct cfg80211_bitrate_mask *mask)
++{
++	struct brcm_rateset_le rateset_le;
++	s32 rate;
++	s32 val;
++	s32 err_bg;
++	s32 err_a;
++	u32 legacy;
++	s32 err = 0;
++
++	WL_TRACE("Enter\n");
++	if (!check_sys_up(wiphy))
++		return -EIO;
++
++	/* addr param is always NULL. ignore it */
++	/* Get current rateset */
++	err = brcmf_exec_dcmd(ndev, BRCM_GET_CURR_RATESET, &rateset_le,
++			      sizeof(rateset_le));
++	if (err) {
++		WL_ERR("could not get current rateset (%d)\n", err);
++		goto done;
++	}
++
++	legacy = ffs(mask->control[IEEE80211_BAND_2GHZ].legacy & 0xFFFF);
++	if (!legacy)
++		legacy = ffs(mask->control[IEEE80211_BAND_5GHZ].legacy &
++			     0xFFFF);
++
++	val = wl_g_rates[legacy - 1].bitrate * 100000;
++
++	if (val < le32_to_cpu(rateset_le.count))
++		/* Select rate by rateset index */
++		rate = rateset_le.rates[val] & 0x7f;
++	else
++		/* Specified rate in bps */
++		rate = val / 500000;
++
++	WL_CONN("rate %d mbps\n", rate / 2);
++
++	/*
++	 *
++	 *      Set rate override,
++	 *      Since the is a/b/g-blind, both a/bg_rate are enforced.
++	 */
++	err_bg = brcmf_dev_intvar_set(ndev, "bg_rate", rate);
++	err_a = brcmf_dev_intvar_set(ndev, "a_rate", rate);
++	if (err_bg && err_a) {
++		WL_ERR("could not set fixed rate (%d) (%d)\n", err_bg, err_a);
++		err = err_bg | err_a;
++	}
++
++done:
++	WL_TRACE("Exit\n");
++	return err;
++}
++
++static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_priv *cfg_priv,
++				   struct brcmf_bss_info_le *bi)
++{
++	struct wiphy *wiphy = cfg_to_wiphy(cfg_priv);
++	struct ieee80211_channel *notify_channel;
++	struct cfg80211_bss *bss;
++	struct ieee80211_supported_band *band;
++	s32 err = 0;
++	u16 channel;
++	u32 freq;
++	u16 notify_capability;
++	u16 notify_interval;
++	u8 *notify_ie;
++	size_t notify_ielen;
++	s32 notify_signal;
++
++	if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
++		WL_ERR("Bss info is larger than buffer. Discarding\n");
++		return 0;
++	}
++
++	channel = bi->ctl_ch ? bi->ctl_ch :
++				CHSPEC_CHANNEL(le16_to_cpu(bi->chanspec));
++
++	if (channel <= CH_MAX_2G_CHANNEL)
++		band = wiphy->bands[IEEE80211_BAND_2GHZ];
++	else
++		band = wiphy->bands[IEEE80211_BAND_5GHZ];
++
++	freq = ieee80211_channel_to_frequency(channel, band->band);
++	notify_channel = ieee80211_get_channel(wiphy, freq);
++
++	notify_capability = le16_to_cpu(bi->capability);
++	notify_interval = le16_to_cpu(bi->beacon_period);
++	notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
++	notify_ielen = le32_to_cpu(bi->ie_length);
++	notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
++
++	WL_CONN("bssid: %2.2X:%2.2X:%2.2X:%2.2X:%2.2X:%2.2X\n",
++			bi->BSSID[0], bi->BSSID[1], bi->BSSID[2],
++			bi->BSSID[3], bi->BSSID[4], bi->BSSID[5]);
++	WL_CONN("Channel: %d(%d)\n", channel, freq);
++	WL_CONN("Capability: %X\n", notify_capability);
++	WL_CONN("Beacon interval: %d\n", notify_interval);
++	WL_CONN("Signal: %d\n", notify_signal);
++
++	bss = cfg80211_inform_bss(wiphy, notify_channel, (const u8 *)bi->BSSID,
++		0, notify_capability, notify_interval, notify_ie,
++		notify_ielen, notify_signal, GFP_KERNEL);
++
++	if (!bss)
++		return -ENOMEM;
++
++	cfg80211_put_bss(bss);
++
++	return err;
++}
++
++static struct brcmf_bss_info_le *
++next_bss_le(struct brcmf_scan_results *list, struct brcmf_bss_info_le *bss)
++{
++	if (bss == NULL)
++		return list->bss_info_le;
++	return (struct brcmf_bss_info_le *)((unsigned long)bss +
++					    le32_to_cpu(bss->length));
++}
++
++static s32 brcmf_inform_bss(struct brcmf_cfg80211_priv *cfg_priv)
++{
++	struct brcmf_scan_results *bss_list;
++	struct brcmf_bss_info_le *bi = NULL;	/* must be initialized */
++	s32 err = 0;
++	int i;
++
++	bss_list = cfg_priv->bss_list;
++	if (bss_list->version != BRCMF_BSS_INFO_VERSION) {
++		WL_ERR("Version %d != WL_BSS_INFO_VERSION\n",
++		       bss_list->version);
++		return -EOPNOTSUPP;
++	}
++	WL_SCAN("scanned AP count (%d)\n", bss_list->count);
++	for (i = 0; i < bss_list->count && i < WL_AP_MAX; i++) {
++		bi = next_bss_le(bss_list, bi);
++		err = brcmf_inform_single_bss(cfg_priv, bi);
++		if (err)
++			break;
++	}
++	return err;
++}
++
++static s32 wl_inform_ibss(struct brcmf_cfg80211_priv *cfg_priv,
++			  struct net_device *ndev, const u8 *bssid)
++{
++	struct wiphy *wiphy = cfg_to_wiphy(cfg_priv);
++	struct ieee80211_channel *notify_channel;
++	struct brcmf_bss_info_le *bi = NULL;
++	struct ieee80211_supported_band *band;
++	struct cfg80211_bss *bss;
++	u8 *buf = NULL;
++	s32 err = 0;
++	u16 channel;
++	u32 freq;
++	u16 notify_capability;
++	u16 notify_interval;
++	u8 *notify_ie;
++	size_t notify_ielen;
++	s32 notify_signal;
++
++	WL_TRACE("Enter\n");
++
++	buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
++	if (buf == NULL) {
++		err = -ENOMEM;
++		goto CleanUp;
++	}
++
++	*(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
++
++	err = brcmf_exec_dcmd(ndev, BRCMF_C_GET_BSS_INFO, buf, WL_BSS_INFO_MAX);
++	if (err) {
++		WL_ERR("WLC_GET_BSS_INFO failed: %d\n", err);
++		goto CleanUp;
++	}
++
++	bi = (struct brcmf_bss_info_le *)(buf + 4);
++
++	channel = bi->ctl_ch ? bi->ctl_ch :
++				CHSPEC_CHANNEL(le16_to_cpu(bi->chanspec));
++
++	if (channel <= CH_MAX_2G_CHANNEL)
++		band = wiphy->bands[IEEE80211_BAND_2GHZ];
++	else
++		band = wiphy->bands[IEEE80211_BAND_5GHZ];
++
++	freq = ieee80211_channel_to_frequency(channel, band->band);
++	notify_channel = ieee80211_get_channel(wiphy, freq);
++
++	notify_capability = le16_to_cpu(bi->capability);
++	notify_interval = le16_to_cpu(bi->beacon_period);
++	notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
++	notify_ielen = le32_to_cpu(bi->ie_length);
++	notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
++
++	WL_CONN("channel: %d(%d)\n", channel, freq);
++	WL_CONN("capability: %X\n", notify_capability);
++	WL_CONN("beacon interval: %d\n", notify_interval);
++	WL_CONN("signal: %d\n", notify_signal);
++
++	bss = cfg80211_inform_bss(wiphy, notify_channel, bssid,
++		0, notify_capability, notify_interval,
++		notify_ie, notify_ielen, notify_signal, GFP_KERNEL);
++
++	if (!bss) {
++		err = -ENOMEM;
++		goto CleanUp;
++	}
++
++	cfg80211_put_bss(bss);
++
++CleanUp:
++
++	kfree(buf);
++
++	WL_TRACE("Exit\n");
++
++	return err;
++}
++
++static bool brcmf_is_ibssmode(struct brcmf_cfg80211_priv *cfg_priv)
++{
++	return cfg_priv->conf->mode == WL_MODE_IBSS;
++}
++
++/*
++ * Traverse a string of 1-byte tag/1-byte length/variable-length value
++ * triples, returning a pointer to the substring whose first element
++ * matches tag
++ */
++static struct brcmf_tlv *brcmf_parse_tlvs(void *buf, int buflen, uint key)
++{
++	struct brcmf_tlv *elt;
++	int totlen;
++
++	elt = (struct brcmf_tlv *) buf;
++	totlen = buflen;
++
++	/* find tagged parameter */
++	while (totlen >= 2) {
++		int len = elt->len;
++
++		/* validate remaining totlen */
++		if ((elt->id == key) && (totlen >= (len + 2)))
++			return elt;
++
++		elt = (struct brcmf_tlv *) ((u8 *) elt + (len + 2));
++		totlen -= (len + 2);
++	}
++
++	return NULL;
++}
++
++static s32 brcmf_update_bss_info(struct brcmf_cfg80211_priv *cfg_priv)
++{
++	struct brcmf_bss_info_le *bi;
++	struct brcmf_ssid *ssid;
++	struct brcmf_tlv *tim;
++	u16 beacon_interval;
++	u8 dtim_period;
++	size_t ie_len;
++	u8 *ie;
++	s32 err = 0;
++
++	WL_TRACE("Enter\n");
++	if (brcmf_is_ibssmode(cfg_priv))
++		return err;
++
++	ssid = (struct brcmf_ssid *)brcmf_read_prof(cfg_priv, WL_PROF_SSID);
++
++	*(__le32 *)cfg_priv->extra_buf = cpu_to_le32(WL_EXTRA_BUF_MAX);
++	err = brcmf_exec_dcmd(cfg_to_ndev(cfg_priv), BRCMF_C_GET_BSS_INFO,
++			cfg_priv->extra_buf, WL_EXTRA_BUF_MAX);
++	if (err) {
++		WL_ERR("Could not get bss info %d\n", err);
++		goto update_bss_info_out;
++	}
++
++	bi = (struct brcmf_bss_info_le *)(cfg_priv->extra_buf + 4);
++	err = brcmf_inform_single_bss(cfg_priv, bi);
++	if (err)
++		goto update_bss_info_out;
++
++	ie = ((u8 *)bi) + le16_to_cpu(bi->ie_offset);
++	ie_len = le32_to_cpu(bi->ie_length);
++	beacon_interval = le16_to_cpu(bi->beacon_period);
++
++	tim = brcmf_parse_tlvs(ie, ie_len, WLAN_EID_TIM);
++	if (tim)
++		dtim_period = tim->data[1];
++	else {
++		/*
++		* active scan was done so we could not get dtim
++		* information out of probe response.
++		* so we speficially query dtim information to dongle.
++		*/
++		u32 var;
++		err = brcmf_dev_intvar_get(cfg_to_ndev(cfg_priv),
++					   "dtim_assoc", &var);
++		if (err) {
++			WL_ERR("wl dtim_assoc failed (%d)\n", err);
++			goto update_bss_info_out;
++		}
++		dtim_period = (u8)var;
++	}
++
++	brcmf_update_prof(cfg_priv, NULL, &beacon_interval, WL_PROF_BEACONINT);
++	brcmf_update_prof(cfg_priv, NULL, &dtim_period, WL_PROF_DTIMPERIOD);
++
++update_bss_info_out:
++	WL_TRACE("Exit");
++	return err;
++}
++
++static void brcmf_term_iscan(struct brcmf_cfg80211_priv *cfg_priv)
++{
++	struct brcmf_cfg80211_iscan_ctrl *iscan = cfg_to_iscan(cfg_priv);
++	struct brcmf_ssid ssid;
++
++	if (cfg_priv->iscan_on) {
++		iscan->state = WL_ISCAN_STATE_IDLE;
++
++		if (iscan->timer_on) {
++			del_timer_sync(&iscan->timer);
++			iscan->timer_on = 0;
++		}
++
++		cancel_work_sync(&iscan->work);
++
++		/* Abort iscan running in FW */
++		memset(&ssid, 0, sizeof(ssid));
++		brcmf_run_iscan(iscan, &ssid, WL_SCAN_ACTION_ABORT);
++	}
++}
++
++static void brcmf_notify_iscan_complete(struct brcmf_cfg80211_iscan_ctrl *iscan,
++					bool aborted)
++{
++	struct brcmf_cfg80211_priv *cfg_priv = iscan_to_cfg(iscan);
++	struct net_device *ndev = cfg_to_ndev(cfg_priv);
++
++	if (!test_and_clear_bit(WL_STATUS_SCANNING, &cfg_priv->status)) {
++		WL_ERR("Scan complete while device not scanning\n");
++		return;
++	}
++	if (cfg_priv->scan_request) {
++		WL_SCAN("ISCAN Completed scan: %s\n",
++				aborted ? "Aborted" : "Done");
++		cfg80211_scan_done(cfg_priv->scan_request, aborted);
++		brcmf_set_mpc(ndev, 1);
++		cfg_priv->scan_request = NULL;
++	}
++	cfg_priv->iscan_kickstart = false;
++}
++
++static s32 brcmf_wakeup_iscan(struct brcmf_cfg80211_iscan_ctrl *iscan)
++{
++	if (iscan->state != WL_ISCAN_STATE_IDLE) {
++		WL_SCAN("wake up iscan\n");
++		schedule_work(&iscan->work);
++		return 0;
++	}
++
++	return -EIO;
++}
++
++static s32
++brcmf_get_iscan_results(struct brcmf_cfg80211_iscan_ctrl *iscan, u32 *status,
++		     struct brcmf_scan_results **bss_list)
++{
++	struct brcmf_iscan_results list;
++	struct brcmf_scan_results *results;
++	struct brcmf_scan_results_le *results_le;
++	struct brcmf_iscan_results *list_buf;
++	s32 err = 0;
++
++	memset(iscan->scan_buf, 0, WL_ISCAN_BUF_MAX);
++	list_buf = (struct brcmf_iscan_results *)iscan->scan_buf;
++	results = &list_buf->results;
++	results_le = &list_buf->results_le;
++	results->buflen = BRCMF_ISCAN_RESULTS_FIXED_SIZE;
++	results->version = 0;
++	results->count = 0;
++
++	memset(&list, 0, sizeof(list));
++	list.results_le.buflen = cpu_to_le32(WL_ISCAN_BUF_MAX);
++	err = brcmf_dev_iovar_getbuf(iscan->ndev, "iscanresults", &list,
++				     BRCMF_ISCAN_RESULTS_FIXED_SIZE,
++				     iscan->scan_buf, WL_ISCAN_BUF_MAX);
++	if (err) {
++		WL_ERR("error (%d)\n", err);
++		return err;
++	}
++	results->buflen = le32_to_cpu(results_le->buflen);
++	results->version = le32_to_cpu(results_le->version);
++	results->count = le32_to_cpu(results_le->count);
++	WL_SCAN("results->count = %d\n", results_le->count);
++	WL_SCAN("results->buflen = %d\n", results_le->buflen);
++	*status = le32_to_cpu(list_buf->status_le);
++	WL_SCAN("status = %d\n", *status);
++	*bss_list = results;
++
++	return err;
++}
++
++static s32 brcmf_iscan_done(struct brcmf_cfg80211_priv *cfg_priv)
++{
++	struct brcmf_cfg80211_iscan_ctrl *iscan = cfg_priv->iscan;
++	s32 err = 0;
++
++	iscan->state = WL_ISCAN_STATE_IDLE;
++	brcmf_inform_bss(cfg_priv);
++	brcmf_notify_iscan_complete(iscan, false);
++
++	return err;
++}
++
++static s32 brcmf_iscan_pending(struct brcmf_cfg80211_priv *cfg_priv)
++{
++	struct brcmf_cfg80211_iscan_ctrl *iscan = cfg_priv->iscan;
++	s32 err = 0;
++
++	/* Reschedule the timer */
++	mod_timer(&iscan->timer, jiffies + iscan->timer_ms * HZ / 1000);
++	iscan->timer_on = 1;
++
++	return err;
++}
++
++static s32 brcmf_iscan_inprogress(struct brcmf_cfg80211_priv *cfg_priv)
++{
++	struct brcmf_cfg80211_iscan_ctrl *iscan = cfg_priv->iscan;
++	s32 err = 0;
++
++	brcmf_inform_bss(cfg_priv);
++	brcmf_run_iscan(iscan, NULL, BRCMF_SCAN_ACTION_CONTINUE);
++	/* Reschedule the timer */
++	mod_timer(&iscan->timer, jiffies + iscan->timer_ms * HZ / 1000);
++	iscan->timer_on = 1;
++
++	return err;
++}
++
++static s32 brcmf_iscan_aborted(struct brcmf_cfg80211_priv *cfg_priv)
++{
++	struct brcmf_cfg80211_iscan_ctrl *iscan = cfg_priv->iscan;
++	s32 err = 0;
++
++	iscan->state = WL_ISCAN_STATE_IDLE;
++	brcmf_notify_iscan_complete(iscan, true);
++
++	return err;
++}
++
++static void brcmf_cfg80211_iscan_handler(struct work_struct *work)
++{
++	struct brcmf_cfg80211_iscan_ctrl *iscan =
++			container_of(work, struct brcmf_cfg80211_iscan_ctrl,
++				     work);
++	struct brcmf_cfg80211_priv *cfg_priv = iscan_to_cfg(iscan);
++	struct brcmf_cfg80211_iscan_eloop *el = &iscan->el;
++	u32 status = BRCMF_SCAN_RESULTS_PARTIAL;
++
++	if (iscan->timer_on) {
++		del_timer_sync(&iscan->timer);
++		iscan->timer_on = 0;
++	}
++
++	if (brcmf_get_iscan_results(iscan, &status, &cfg_priv->bss_list)) {
++		status = BRCMF_SCAN_RESULTS_ABORTED;
++		WL_ERR("Abort iscan\n");
++	}
++
++	el->handler[status](cfg_priv);
++}
++
++static void brcmf_iscan_timer(unsigned long data)
++{
++	struct brcmf_cfg80211_iscan_ctrl *iscan =
++			(struct brcmf_cfg80211_iscan_ctrl *)data;
++
++	if (iscan) {
++		iscan->timer_on = 0;
++		WL_SCAN("timer expired\n");
++		brcmf_wakeup_iscan(iscan);
++	}
++}
++
++static s32 brcmf_invoke_iscan(struct brcmf_cfg80211_priv *cfg_priv)
++{
++	struct brcmf_cfg80211_iscan_ctrl *iscan = cfg_to_iscan(cfg_priv);
++
++	if (cfg_priv->iscan_on) {
++		iscan->state = WL_ISCAN_STATE_IDLE;
++		INIT_WORK(&iscan->work, brcmf_cfg80211_iscan_handler);
++	}
++
++	return 0;
++}
++
++static void brcmf_init_iscan_eloop(struct brcmf_cfg80211_iscan_eloop *el)
++{
++	memset(el, 0, sizeof(*el));
++	el->handler[BRCMF_SCAN_RESULTS_SUCCESS] = brcmf_iscan_done;
++	el->handler[BRCMF_SCAN_RESULTS_PARTIAL] = brcmf_iscan_inprogress;
++	el->handler[BRCMF_SCAN_RESULTS_PENDING] = brcmf_iscan_pending;
++	el->handler[BRCMF_SCAN_RESULTS_ABORTED] = brcmf_iscan_aborted;
++	el->handler[BRCMF_SCAN_RESULTS_NO_MEM] = brcmf_iscan_aborted;
++}
++
++static s32 brcmf_init_iscan(struct brcmf_cfg80211_priv *cfg_priv)
++{
++	struct brcmf_cfg80211_iscan_ctrl *iscan = cfg_to_iscan(cfg_priv);
++	int err = 0;
++
++	if (cfg_priv->iscan_on) {
++		iscan->ndev = cfg_to_ndev(cfg_priv);
++		brcmf_init_iscan_eloop(&iscan->el);
++		iscan->timer_ms = WL_ISCAN_TIMER_INTERVAL_MS;
++		init_timer(&iscan->timer);
++		iscan->timer.data = (unsigned long) iscan;
++		iscan->timer.function = brcmf_iscan_timer;
++		err = brcmf_invoke_iscan(cfg_priv);
++		if (!err)
++			iscan->data = cfg_priv;
++	}
++
++	return err;
++}
++
++static __always_inline void brcmf_delay(u32 ms)
++{
++	if (ms < 1000 / HZ) {
++		cond_resched();
++		mdelay(ms);
++	} else {
++		msleep(ms);
++	}
++}
++
++static s32 brcmf_cfg80211_resume(struct wiphy *wiphy)
++{
++	struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
++
++	/*
++	 * Check for WL_STATUS_READY before any function call which
++	 * could result is bus access. Don't block the resume for
++	 * any driver error conditions
++	 */
++	WL_TRACE("Enter\n");
++
++	if (test_bit(WL_STATUS_READY, &cfg_priv->status))
++		brcmf_invoke_iscan(wiphy_to_cfg(wiphy));
++
++	WL_TRACE("Exit\n");
++	return 0;
++}
++
++static s32 brcmf_cfg80211_suspend(struct wiphy *wiphy,
++				  struct cfg80211_wowlan *wow)
++{
++	struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
++	struct net_device *ndev = cfg_to_ndev(cfg_priv);
++
++	WL_TRACE("Enter\n");
++
++	/*
++	 * Check for WL_STATUS_READY before any function call which
++	 * could result is bus access. Don't block the suspend for
++	 * any driver error conditions
++	 */
++
++	/*
++	 * While going to suspend if associated with AP disassociate
++	 * from AP to save power while system is in suspended state
++	 */
++	if ((test_bit(WL_STATUS_CONNECTED, &cfg_priv->status) ||
++	     test_bit(WL_STATUS_CONNECTING, &cfg_priv->status)) &&
++	     test_bit(WL_STATUS_READY, &cfg_priv->status)) {
++		WL_INFO("Disassociating from AP"
++			" while entering suspend state\n");
++		brcmf_link_down(cfg_priv);
++
++		/*
++		 * Make sure WPA_Supplicant receives all the event
++		 * generated due to DISASSOC call to the fw to keep
++		 * the state fw and WPA_Supplicant state consistent
++		 */
++		brcmf_delay(500);
++	}
++
++	set_bit(WL_STATUS_SCAN_ABORTING, &cfg_priv->status);
++	if (test_bit(WL_STATUS_READY, &cfg_priv->status))
++		brcmf_term_iscan(cfg_priv);
++
++	if (cfg_priv->scan_request) {
++		/* Indidate scan abort to cfg80211 layer */
++		WL_INFO("Terminating scan in progress\n");
++		cfg80211_scan_done(cfg_priv->scan_request, true);
++		cfg_priv->scan_request = NULL;
++	}
++	clear_bit(WL_STATUS_SCANNING, &cfg_priv->status);
++	clear_bit(WL_STATUS_SCAN_ABORTING, &cfg_priv->status);
++
++	/* Turn off watchdog timer */
++	if (test_bit(WL_STATUS_READY, &cfg_priv->status)) {
++		WL_INFO("Enable MPC\n");
++		brcmf_set_mpc(ndev, 1);
++	}
++
++	WL_TRACE("Exit\n");
++
++	return 0;
++}
++
++static __used s32
++brcmf_dev_bufvar_set(struct net_device *ndev, s8 *name, s8 *buf, s32 len)
++{
++	struct brcmf_cfg80211_priv *cfg_priv = ndev_to_cfg(ndev);
++	u32 buflen;
++
++	buflen = brcmf_c_mkiovar(name, buf, len, cfg_priv->dcmd_buf,
++			       WL_DCMD_LEN_MAX);
++	BUG_ON(!buflen);
++
++	return brcmf_exec_dcmd(ndev, BRCMF_C_SET_VAR, cfg_priv->dcmd_buf,
++			       buflen);
++}
++
++static s32
++brcmf_dev_bufvar_get(struct net_device *ndev, s8 *name, s8 *buf,
++		  s32 buf_len)
++{
++	struct brcmf_cfg80211_priv *cfg_priv = ndev_to_cfg(ndev);
++	u32 len;
++	s32 err = 0;
++
++	len = brcmf_c_mkiovar(name, NULL, 0, cfg_priv->dcmd_buf,
++			    WL_DCMD_LEN_MAX);
++	BUG_ON(!len);
++	err = brcmf_exec_dcmd(ndev, BRCMF_C_GET_VAR, cfg_priv->dcmd_buf,
++			      WL_DCMD_LEN_MAX);
++	if (err) {
++		WL_ERR("error (%d)\n", err);
++		return err;
++	}
++	memcpy(buf, cfg_priv->dcmd_buf, buf_len);
++
++	return err;
++}
++
++static __used s32
++brcmf_update_pmklist(struct net_device *ndev,
++		     struct brcmf_cfg80211_pmk_list *pmk_list, s32 err)
++{
++	int i, j;
++	int pmkid_len;
++
++	pmkid_len = le32_to_cpu(pmk_list->pmkids.npmkid);
++
++	WL_CONN("No of elements %d\n", pmkid_len);
++	for (i = 0; i < pmkid_len; i++) {
++		WL_CONN("PMKID[%d]: %pM =\n", i,
++			&pmk_list->pmkids.pmkid[i].BSSID);
++		for (j = 0; j < WLAN_PMKID_LEN; j++)
++			WL_CONN("%02x\n", pmk_list->pmkids.pmkid[i].PMKID[j]);
++	}
++
++	if (!err)
++		brcmf_dev_bufvar_set(ndev, "pmkid_info", (char *)pmk_list,
++					sizeof(*pmk_list));
++
++	return err;
++}
++
++static s32
++brcmf_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *ndev,
++			 struct cfg80211_pmksa *pmksa)
++{
++	struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
++	struct pmkid_list *pmkids = &cfg_priv->pmk_list->pmkids;
++	s32 err = 0;
++	int i;
++	int pmkid_len;
++
++	WL_TRACE("Enter\n");
++	if (!check_sys_up(wiphy))
++		return -EIO;
++
++	pmkid_len = le32_to_cpu(pmkids->npmkid);
++	for (i = 0; i < pmkid_len; i++)
++		if (!memcmp(pmksa->bssid, pmkids->pmkid[i].BSSID, ETH_ALEN))
++			break;
++	if (i < WL_NUM_PMKIDS_MAX) {
++		memcpy(pmkids->pmkid[i].BSSID, pmksa->bssid, ETH_ALEN);
++		memcpy(pmkids->pmkid[i].PMKID, pmksa->pmkid, WLAN_PMKID_LEN);
++		if (i == pmkid_len) {
++			pmkid_len++;
++			pmkids->npmkid = cpu_to_le32(pmkid_len);
++		}
++	} else
++		err = -EINVAL;
++
++	WL_CONN("set_pmksa,IW_PMKSA_ADD - PMKID: %pM =\n",
++		pmkids->pmkid[pmkid_len].BSSID);
++	for (i = 0; i < WLAN_PMKID_LEN; i++)
++		WL_CONN("%02x\n", pmkids->pmkid[pmkid_len].PMKID[i]);
++
++	err = brcmf_update_pmklist(ndev, cfg_priv->pmk_list, err);
++
++	WL_TRACE("Exit\n");
++	return err;
++}
++
++static s32
++brcmf_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *ndev,
++		      struct cfg80211_pmksa *pmksa)
++{
++	struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
++	struct pmkid_list pmkid;
++	s32 err = 0;
++	int i, pmkid_len;
++
++	WL_TRACE("Enter\n");
++	if (!check_sys_up(wiphy))
++		return -EIO;
++
++	memcpy(&pmkid.pmkid[0].BSSID, pmksa->bssid, ETH_ALEN);
++	memcpy(&pmkid.pmkid[0].PMKID, pmksa->pmkid, WLAN_PMKID_LEN);
++
++	WL_CONN("del_pmksa,IW_PMKSA_REMOVE - PMKID: %pM =\n",
++	       &pmkid.pmkid[0].BSSID);
++	for (i = 0; i < WLAN_PMKID_LEN; i++)
++		WL_CONN("%02x\n", pmkid.pmkid[0].PMKID[i]);
++
++	pmkid_len = le32_to_cpu(cfg_priv->pmk_list->pmkids.npmkid);
++	for (i = 0; i < pmkid_len; i++)
++		if (!memcmp
++		    (pmksa->bssid, &cfg_priv->pmk_list->pmkids.pmkid[i].BSSID,
++		     ETH_ALEN))
++			break;
++
++	if ((pmkid_len > 0)
++	    && (i < pmkid_len)) {
++		memset(&cfg_priv->pmk_list->pmkids.pmkid[i], 0,
++		       sizeof(struct pmkid));
++		for (; i < (pmkid_len - 1); i++) {
++			memcpy(&cfg_priv->pmk_list->pmkids.pmkid[i].BSSID,
++			       &cfg_priv->pmk_list->pmkids.pmkid[i + 1].BSSID,
++			       ETH_ALEN);
++			memcpy(&cfg_priv->pmk_list->pmkids.pmkid[i].PMKID,
++			       &cfg_priv->pmk_list->pmkids.pmkid[i + 1].PMKID,
++			       WLAN_PMKID_LEN);
++		}
++		cfg_priv->pmk_list->pmkids.npmkid = cpu_to_le32(pmkid_len - 1);
++	} else
++		err = -EINVAL;
++
++	err = brcmf_update_pmklist(ndev, cfg_priv->pmk_list, err);
++
++	WL_TRACE("Exit\n");
++	return err;
++
++}
++
++static s32
++brcmf_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *ndev)
++{
++	struct brcmf_cfg80211_priv *cfg_priv = wiphy_to_cfg(wiphy);
++	s32 err = 0;
++
++	WL_TRACE("Enter\n");
++	if (!check_sys_up(wiphy))
++		return -EIO;
++
++	memset(cfg_priv->pmk_list, 0, sizeof(*cfg_priv->pmk_list));
++	err = brcmf_update_pmklist(ndev, cfg_priv->pmk_list, err);
++
++	WL_TRACE("Exit\n");
++	return err;
++
++}
++
++static struct cfg80211_ops wl_cfg80211_ops = {
++	.change_virtual_intf = brcmf_cfg80211_change_iface,
++	.scan = brcmf_cfg80211_scan,
++	.set_wiphy_params = brcmf_cfg80211_set_wiphy_params,
++	.join_ibss = brcmf_cfg80211_join_ibss,
++	.leave_ibss = brcmf_cfg80211_leave_ibss,
++	.get_station = brcmf_cfg80211_get_station,
++	.set_tx_power = brcmf_cfg80211_set_tx_power,
++	.get_tx_power = brcmf_cfg80211_get_tx_power,
++	.add_key = brcmf_cfg80211_add_key,
++	.del_key = brcmf_cfg80211_del_key,
++	.get_key = brcmf_cfg80211_get_key,
++	.set_default_key = brcmf_cfg80211_config_default_key,
++	.set_default_mgmt_key = brcmf_cfg80211_config_default_mgmt_key,
++	.set_power_mgmt = brcmf_cfg80211_set_power_mgmt,
++	.set_bitrate_mask = brcmf_cfg80211_set_bitrate_mask,
++	.connect = brcmf_cfg80211_connect,
++	.disconnect = brcmf_cfg80211_disconnect,
++	.suspend = brcmf_cfg80211_suspend,
++	.resume = brcmf_cfg80211_resume,
++	.set_pmksa = brcmf_cfg80211_set_pmksa,
++	.del_pmksa = brcmf_cfg80211_del_pmksa,
++	.flush_pmksa = brcmf_cfg80211_flush_pmksa
++};
++
++static s32 brcmf_mode_to_nl80211_iftype(s32 mode)
++{
++	s32 err = 0;
++
++	switch (mode) {
++	case WL_MODE_BSS:
++		return NL80211_IFTYPE_STATION;
++	case WL_MODE_IBSS:
++		return NL80211_IFTYPE_ADHOC;
++	default:
++		return NL80211_IFTYPE_UNSPECIFIED;
++	}
++
++	return err;
++}
++
++static struct wireless_dev *brcmf_alloc_wdev(s32 sizeof_iface,
++					  struct device *ndev)
++{
++	struct wireless_dev *wdev;
++	s32 err = 0;
++
++	wdev = kzalloc(sizeof(*wdev), GFP_KERNEL);
++	if (!wdev)
++		return ERR_PTR(-ENOMEM);
++
++	wdev->wiphy =
++	    wiphy_new(&wl_cfg80211_ops,
++		      sizeof(struct brcmf_cfg80211_priv) + sizeof_iface);
++	if (!wdev->wiphy) {
++		WL_ERR("Could not allocate wiphy device\n");
++		err = -ENOMEM;
++		goto wiphy_new_out;
++	}
++	set_wiphy_dev(wdev->wiphy, ndev);
++	wdev->wiphy->max_scan_ssids = WL_NUM_SCAN_MAX;
++	wdev->wiphy->max_num_pmkids = WL_NUM_PMKIDS_MAX;
++	wdev->wiphy->interface_modes =
++	    BIT(NL80211_IFTYPE_STATION) | BIT(NL80211_IFTYPE_ADHOC);
++	wdev->wiphy->bands[IEEE80211_BAND_2GHZ] = &__wl_band_2ghz;
++	wdev->wiphy->bands[IEEE80211_BAND_5GHZ] = &__wl_band_5ghz_a;	/* Set
++						* it as 11a by default.
++						* This will be updated with
++						* 11n phy tables in
++						* "ifconfig up"
++						* if phy has 11n capability
++						*/
++	wdev->wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
++	wdev->wiphy->cipher_suites = __wl_cipher_suites;
++	wdev->wiphy->n_cipher_suites = ARRAY_SIZE(__wl_cipher_suites);
++	wdev->wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;	/* enable power
++								 * save mode
++								 * by default
++								 */
++	err = wiphy_register(wdev->wiphy);
++	if (err < 0) {
++		WL_ERR("Could not register wiphy device (%d)\n", err);
++		goto wiphy_register_out;
++	}
++	return wdev;
++
++wiphy_register_out:
++	wiphy_free(wdev->wiphy);
++
++wiphy_new_out:
++	kfree(wdev);
++
++	return ERR_PTR(err);
++}
++
++static void brcmf_free_wdev(struct brcmf_cfg80211_priv *cfg_priv)
++{
++	struct wireless_dev *wdev = cfg_priv->wdev;
++
++	if (!wdev) {
++		WL_ERR("wdev is invalid\n");
++		return;
++	}
++	wiphy_unregister(wdev->wiphy);
++	wiphy_free(wdev->wiphy);
++	kfree(wdev);
++	cfg_priv->wdev = NULL;
++}
++
++static bool brcmf_is_linkup(struct brcmf_cfg80211_priv *cfg_priv,
++			    const struct brcmf_event_msg *e)
++{
++	u32 event = be32_to_cpu(e->event_type);
++	u32 status = be32_to_cpu(e->status);
++
++	if (event == BRCMF_E_SET_SSID && status == BRCMF_E_STATUS_SUCCESS) {
++		WL_CONN("Processing set ssid\n");
++		cfg_priv->link_up = true;
++		return true;
++	}
++
++	return false;
++}
++
++static bool brcmf_is_linkdown(struct brcmf_cfg80211_priv *cfg_priv,
++			      const struct brcmf_event_msg *e)
++{
++	u32 event = be32_to_cpu(e->event_type);
++	u16 flags = be16_to_cpu(e->flags);
++
++	if (event == BRCMF_E_LINK && (!(flags & BRCMF_EVENT_MSG_LINK))) {
++		WL_CONN("Processing link down\n");
++		return true;
++	}
++	return false;
++}
++
++static bool brcmf_is_nonetwork(struct brcmf_cfg80211_priv *cfg_priv,
++			       const struct brcmf_event_msg *e)
++{
++	u32 event = be32_to_cpu(e->event_type);
++	u32 status = be32_to_cpu(e->status);
++
++	if (event == BRCMF_E_LINK && status == BRCMF_E_STATUS_NO_NETWORKS) {
++		WL_CONN("Processing Link %s & no network found\n",
++				be16_to_cpu(e->flags) & BRCMF_EVENT_MSG_LINK ?
++				"up" : "down");
++		return true;
++	}
++
++	if (event == BRCMF_E_SET_SSID && status != BRCMF_E_STATUS_SUCCESS) {
++		WL_CONN("Processing connecting & no network found\n");
++		return true;
++	}
++
++	return false;
++}
++
++static void brcmf_clear_assoc_ies(struct brcmf_cfg80211_priv *cfg_priv)
++{
++	struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg_priv);
++
++	kfree(conn_info->req_ie);
++	conn_info->req_ie = NULL;
++	conn_info->req_ie_len = 0;
++	kfree(conn_info->resp_ie);
++	conn_info->resp_ie = NULL;
++	conn_info->resp_ie_len = 0;
++}
++
++static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_priv *cfg_priv)
++{
++	struct net_device *ndev = cfg_to_ndev(cfg_priv);
++	struct brcmf_cfg80211_assoc_ielen_le *assoc_info;
++	struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg_priv);
++	u32 req_len;
++	u32 resp_len;
++	s32 err = 0;
++
++	brcmf_clear_assoc_ies(cfg_priv);
++
++	err = brcmf_dev_bufvar_get(ndev, "assoc_info", cfg_priv->extra_buf,
++				WL_ASSOC_INFO_MAX);
++	if (err) {
++		WL_ERR("could not get assoc info (%d)\n", err);
++		return err;
++	}
++	assoc_info =
++		(struct brcmf_cfg80211_assoc_ielen_le *)cfg_priv->extra_buf;
++	req_len = le32_to_cpu(assoc_info->req_len);
++	resp_len = le32_to_cpu(assoc_info->resp_len);
++	if (req_len) {
++		err = brcmf_dev_bufvar_get(ndev, "assoc_req_ies",
++					   cfg_priv->extra_buf,
++					   WL_ASSOC_INFO_MAX);
++		if (err) {
++			WL_ERR("could not get assoc req (%d)\n", err);
++			return err;
++		}
++		conn_info->req_ie_len = req_len;
++		conn_info->req_ie =
++		    kmemdup(cfg_priv->extra_buf, conn_info->req_ie_len,
++			    GFP_KERNEL);
++	} else {
++		conn_info->req_ie_len = 0;
++		conn_info->req_ie = NULL;
++	}
++	if (resp_len) {
++		err = brcmf_dev_bufvar_get(ndev, "assoc_resp_ies",
++					   cfg_priv->extra_buf,
++					   WL_ASSOC_INFO_MAX);
++		if (err) {
++			WL_ERR("could not get assoc resp (%d)\n", err);
++			return err;
++		}
++		conn_info->resp_ie_len = resp_len;
++		conn_info->resp_ie =
++		    kmemdup(cfg_priv->extra_buf, conn_info->resp_ie_len,
++			    GFP_KERNEL);
++	} else {
++		conn_info->resp_ie_len = 0;
++		conn_info->resp_ie = NULL;
++	}
++	WL_CONN("req len (%d) resp len (%d)\n",
++	       conn_info->req_ie_len, conn_info->resp_ie_len);
++
++	return err;
++}
++
++static s32
++brcmf_bss_roaming_done(struct brcmf_cfg80211_priv *cfg_priv,
++		       struct net_device *ndev,
++		       const struct brcmf_event_msg *e)
++{
++	struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg_priv);
++	struct wiphy *wiphy = cfg_to_wiphy(cfg_priv);
++	struct brcmf_channel_info_le channel_le;
++	struct ieee80211_channel *notify_channel;
++	struct ieee80211_supported_band *band;
++	u32 freq;
++	s32 err = 0;
++	u32 target_channel;
++
++	WL_TRACE("Enter\n");
++
++	brcmf_get_assoc_ies(cfg_priv);
++	brcmf_update_prof(cfg_priv, NULL, &e->addr, WL_PROF_BSSID);
++	brcmf_update_bss_info(cfg_priv);
++
++	brcmf_exec_dcmd(ndev, BRCMF_C_GET_CHANNEL, &channel_le,
++			sizeof(channel_le));
++
++	target_channel = le32_to_cpu(channel_le.target_channel);
++	WL_CONN("Roamed to channel %d\n", target_channel);
++
++	if (target_channel <= CH_MAX_2G_CHANNEL)
++		band = wiphy->bands[IEEE80211_BAND_2GHZ];
++	else
++		band = wiphy->bands[IEEE80211_BAND_5GHZ];
++
++	freq = ieee80211_channel_to_frequency(target_channel, band->band);
++	notify_channel = ieee80211_get_channel(wiphy, freq);
++
++	cfg80211_roamed(ndev, notify_channel,
++			(u8 *)brcmf_read_prof(cfg_priv, WL_PROF_BSSID),
++			conn_info->req_ie, conn_info->req_ie_len,
++			conn_info->resp_ie, conn_info->resp_ie_len, GFP_KERNEL);
++	WL_CONN("Report roaming result\n");
++
++	set_bit(WL_STATUS_CONNECTED, &cfg_priv->status);
++	WL_TRACE("Exit\n");
++	return err;
++}
++
++static s32
++brcmf_bss_connect_done(struct brcmf_cfg80211_priv *cfg_priv,
++		       struct net_device *ndev, const struct brcmf_event_msg *e,
++		       bool completed)
++{
++	struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg_priv);
++	s32 err = 0;
++
++	WL_TRACE("Enter\n");
++
++	if (test_and_clear_bit(WL_STATUS_CONNECTING, &cfg_priv->status)) {
++		if (completed) {
++			brcmf_get_assoc_ies(cfg_priv);
++			brcmf_update_prof(cfg_priv, NULL, &e->addr,
++					  WL_PROF_BSSID);
++			brcmf_update_bss_info(cfg_priv);
++		}
++		cfg80211_connect_result(ndev,
++					(u8 *)brcmf_read_prof(cfg_priv,
++							      WL_PROF_BSSID),
++					conn_info->req_ie,
++					conn_info->req_ie_len,
++					conn_info->resp_ie,
++					conn_info->resp_ie_len,
++					completed ? WLAN_STATUS_SUCCESS :
++						    WLAN_STATUS_AUTH_TIMEOUT,
++					GFP_KERNEL);
++		if (completed)
++			set_bit(WL_STATUS_CONNECTED, &cfg_priv->status);
++		WL_CONN("Report connect result - connection %s\n",
++				completed ? "succeeded" : "failed");
++	}
++	WL_TRACE("Exit\n");
++	return err;
++}
++
++static s32
++brcmf_notify_connect_status(struct brcmf_cfg80211_priv *cfg_priv,
++			    struct net_device *ndev,
++			    const struct brcmf_event_msg *e, void *data)
++{
++	s32 err = 0;
++
++	if (brcmf_is_linkup(cfg_priv, e)) {
++		WL_CONN("Linkup\n");
++		if (brcmf_is_ibssmode(cfg_priv)) {
++			brcmf_update_prof(cfg_priv, NULL, (void *)e->addr,
++				WL_PROF_BSSID);
++			wl_inform_ibss(cfg_priv, ndev, e->addr);
++			cfg80211_ibss_joined(ndev, e->addr, GFP_KERNEL);
++			clear_bit(WL_STATUS_CONNECTING, &cfg_priv->status);
++			set_bit(WL_STATUS_CONNECTED, &cfg_priv->status);
++		} else
++			brcmf_bss_connect_done(cfg_priv, ndev, e, true);
++	} else if (brcmf_is_linkdown(cfg_priv, e)) {
++		WL_CONN("Linkdown\n");
++		if (brcmf_is_ibssmode(cfg_priv)) {
++			clear_bit(WL_STATUS_CONNECTING, &cfg_priv->status);
++			if (test_and_clear_bit(WL_STATUS_CONNECTED,
++				&cfg_priv->status))
++				brcmf_link_down(cfg_priv);
++		} else {
++			brcmf_bss_connect_done(cfg_priv, ndev, e, false);
++			if (test_and_clear_bit(WL_STATUS_CONNECTED,
++				&cfg_priv->status)) {
++				cfg80211_disconnected(ndev, 0, NULL, 0,
++					GFP_KERNEL);
++				brcmf_link_down(cfg_priv);
++			}
++		}
++		brcmf_init_prof(cfg_priv->profile);
++	} else if (brcmf_is_nonetwork(cfg_priv, e)) {
++		if (brcmf_is_ibssmode(cfg_priv))
++			clear_bit(WL_STATUS_CONNECTING, &cfg_priv->status);
++		else
++			brcmf_bss_connect_done(cfg_priv, ndev, e, false);
++	}
++
++	return err;
++}
++
++static s32
++brcmf_notify_roaming_status(struct brcmf_cfg80211_priv *cfg_priv,
++			    struct net_device *ndev,
++			    const struct brcmf_event_msg *e, void *data)
++{
++	s32 err = 0;
++	u32 event = be32_to_cpu(e->event_type);
++	u32 status = be32_to_cpu(e->status);
++
++	if (event == BRCMF_E_ROAM && status == BRCMF_E_STATUS_SUCCESS) {
++		if (test_bit(WL_STATUS_CONNECTED, &cfg_priv->status))
++			brcmf_bss_roaming_done(cfg_priv, ndev, e);
++		else
++			brcmf_bss_connect_done(cfg_priv, ndev, e, true);
++	}
++
++	return err;
++}
++
++static s32
++brcmf_notify_mic_status(struct brcmf_cfg80211_priv *cfg_priv,
++			struct net_device *ndev,
++			const struct brcmf_event_msg *e, void *data)
++{
++	u16 flags = be16_to_cpu(e->flags);
++	enum nl80211_key_type key_type;
++
++	if (flags & BRCMF_EVENT_MSG_GROUP)
++		key_type = NL80211_KEYTYPE_GROUP;
++	else
++		key_type = NL80211_KEYTYPE_PAIRWISE;
++
++	cfg80211_michael_mic_failure(ndev, (u8 *)&e->addr, key_type, -1,
++				     NULL, GFP_KERNEL);
++
++	return 0;
++}
++
++static s32
++brcmf_notify_scan_status(struct brcmf_cfg80211_priv *cfg_priv,
++			 struct net_device *ndev,
++			 const struct brcmf_event_msg *e, void *data)
++{
++	struct brcmf_channel_info_le channel_inform_le;
++	struct brcmf_scan_results_le *bss_list_le;
++	u32 len = WL_SCAN_BUF_MAX;
++	s32 err = 0;
++	bool scan_abort = false;
++	u32 scan_channel;
++
++	WL_TRACE("Enter\n");
++
++	if (cfg_priv->iscan_on && cfg_priv->iscan_kickstart) {
++		WL_TRACE("Exit\n");
++		return brcmf_wakeup_iscan(cfg_to_iscan(cfg_priv));
++	}
++
++	if (!test_and_clear_bit(WL_STATUS_SCANNING, &cfg_priv->status)) {
++		WL_ERR("Scan complete while device not scanning\n");
++		scan_abort = true;
++		err = -EINVAL;
++		goto scan_done_out;
++	}
++
++	err = brcmf_exec_dcmd(ndev, BRCMF_C_GET_CHANNEL, &channel_inform_le,
++			      sizeof(channel_inform_le));
++	if (err) {
++		WL_ERR("scan busy (%d)\n", err);
++		scan_abort = true;
++		goto scan_done_out;
++	}
++	scan_channel = le32_to_cpu(channel_inform_le.scan_channel);
++	if (scan_channel)
++		WL_CONN("channel_inform.scan_channel (%d)\n", scan_channel);
++	cfg_priv->bss_list = cfg_priv->scan_results;
++	bss_list_le = (struct brcmf_scan_results_le *) cfg_priv->bss_list;
++
++	memset(cfg_priv->scan_results, 0, len);
++	bss_list_le->buflen = cpu_to_le32(len);
++	err = brcmf_exec_dcmd(ndev, BRCMF_C_SCAN_RESULTS,
++			      cfg_priv->scan_results, len);
++	if (err) {
++		WL_ERR("%s Scan_results error (%d)\n", ndev->name, err);
++		err = -EINVAL;
++		scan_abort = true;
++		goto scan_done_out;
++	}
++	cfg_priv->scan_results->buflen = le32_to_cpu(bss_list_le->buflen);
++	cfg_priv->scan_results->version = le32_to_cpu(bss_list_le->version);
++	cfg_priv->scan_results->count = le32_to_cpu(bss_list_le->count);
++
++	err = brcmf_inform_bss(cfg_priv);
++	if (err) {
++		scan_abort = true;
++		goto scan_done_out;
++	}
++
++scan_done_out:
++	if (cfg_priv->scan_request) {
++		WL_SCAN("calling cfg80211_scan_done\n");
++		cfg80211_scan_done(cfg_priv->scan_request, scan_abort);
++		brcmf_set_mpc(ndev, 1);
++		cfg_priv->scan_request = NULL;
++	}
++
++	WL_TRACE("Exit\n");
++
++	return err;
++}
++
++static void brcmf_init_conf(struct brcmf_cfg80211_conf *conf)
++{
++	conf->mode = (u32)-1;
++	conf->frag_threshold = (u32)-1;
++	conf->rts_threshold = (u32)-1;
++	conf->retry_short = (u32)-1;
++	conf->retry_long = (u32)-1;
++	conf->tx_power = -1;
++}
++
++static void brcmf_init_eloop_handler(struct brcmf_cfg80211_event_loop *el)
++{
++	memset(el, 0, sizeof(*el));
++	el->handler[BRCMF_E_SCAN_COMPLETE] = brcmf_notify_scan_status;
++	el->handler[BRCMF_E_LINK] = brcmf_notify_connect_status;
++	el->handler[BRCMF_E_ROAM] = brcmf_notify_roaming_status;
++	el->handler[BRCMF_E_MIC_ERROR] = brcmf_notify_mic_status;
++	el->handler[BRCMF_E_SET_SSID] = brcmf_notify_connect_status;
++}
++
++static void brcmf_deinit_priv_mem(struct brcmf_cfg80211_priv *cfg_priv)
++{
++	kfree(cfg_priv->scan_results);
++	cfg_priv->scan_results = NULL;
++	kfree(cfg_priv->bss_info);
++	cfg_priv->bss_info = NULL;
++	kfree(cfg_priv->conf);
++	cfg_priv->conf = NULL;
++	kfree(cfg_priv->profile);
++	cfg_priv->profile = NULL;
++	kfree(cfg_priv->scan_req_int);
++	cfg_priv->scan_req_int = NULL;
++	kfree(cfg_priv->dcmd_buf);
++	cfg_priv->dcmd_buf = NULL;
++	kfree(cfg_priv->extra_buf);
++	cfg_priv->extra_buf = NULL;
++	kfree(cfg_priv->iscan);
++	cfg_priv->iscan = NULL;
++	kfree(cfg_priv->pmk_list);
++	cfg_priv->pmk_list = NULL;
++}
++
++static s32 brcmf_init_priv_mem(struct brcmf_cfg80211_priv *cfg_priv)
++{
++	cfg_priv->scan_results = kzalloc(WL_SCAN_BUF_MAX, GFP_KERNEL);
++	if (!cfg_priv->scan_results)
++		goto init_priv_mem_out;
++	cfg_priv->conf = kzalloc(sizeof(*cfg_priv->conf), GFP_KERNEL);
++	if (!cfg_priv->conf)
++		goto init_priv_mem_out;
++	cfg_priv->profile = kzalloc(sizeof(*cfg_priv->profile), GFP_KERNEL);
++	if (!cfg_priv->profile)
++		goto init_priv_mem_out;
++	cfg_priv->bss_info = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
++	if (!cfg_priv->bss_info)
++		goto init_priv_mem_out;
++	cfg_priv->scan_req_int = kzalloc(sizeof(*cfg_priv->scan_req_int),
++					 GFP_KERNEL);
++	if (!cfg_priv->scan_req_int)
++		goto init_priv_mem_out;
++	cfg_priv->dcmd_buf = kzalloc(WL_DCMD_LEN_MAX, GFP_KERNEL);
++	if (!cfg_priv->dcmd_buf)
++		goto init_priv_mem_out;
++	cfg_priv->extra_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
++	if (!cfg_priv->extra_buf)
++		goto init_priv_mem_out;
++	cfg_priv->iscan = kzalloc(sizeof(*cfg_priv->iscan), GFP_KERNEL);
++	if (!cfg_priv->iscan)
++		goto init_priv_mem_out;
++	cfg_priv->pmk_list = kzalloc(sizeof(*cfg_priv->pmk_list), GFP_KERNEL);
++	if (!cfg_priv->pmk_list)
++		goto init_priv_mem_out;
++
++	return 0;
++
++init_priv_mem_out:
++	brcmf_deinit_priv_mem(cfg_priv);
++
++	return -ENOMEM;
++}
++
++/*
++* retrieve first queued event from head
++*/
++
++static struct brcmf_cfg80211_event_q *brcmf_deq_event(
++	struct brcmf_cfg80211_priv *cfg_priv)
++{
++	struct brcmf_cfg80211_event_q *e = NULL;
++
++	spin_lock_irq(&cfg_priv->evt_q_lock);
++	if (!list_empty(&cfg_priv->evt_q_list)) {
++		e = list_first_entry(&cfg_priv->evt_q_list,
++				     struct brcmf_cfg80211_event_q, evt_q_list);
++		list_del(&e->evt_q_list);
++	}
++	spin_unlock_irq(&cfg_priv->evt_q_lock);
++
++	return e;
++}
++
++/*
++*	push event to tail of the queue
++*
++*	remark: this function may not sleep as it is called in atomic context.
++*/
++
++static s32
++brcmf_enq_event(struct brcmf_cfg80211_priv *cfg_priv, u32 event,
++		const struct brcmf_event_msg *msg)
++{
++	struct brcmf_cfg80211_event_q *e;
++	s32 err = 0;
++	ulong flags;
++
++	e = kzalloc(sizeof(struct brcmf_cfg80211_event_q), GFP_ATOMIC);
++	if (!e)
++		return -ENOMEM;
++
++	e->etype = event;
++	memcpy(&e->emsg, msg, sizeof(struct brcmf_event_msg));
++
++	spin_lock_irqsave(&cfg_priv->evt_q_lock, flags);
++	list_add_tail(&e->evt_q_list, &cfg_priv->evt_q_list);
++	spin_unlock_irqrestore(&cfg_priv->evt_q_lock, flags);
++
++	return err;
++}
++
++static void brcmf_put_event(struct brcmf_cfg80211_event_q *e)
++{
++	kfree(e);
++}
++
++static void brcmf_cfg80211_event_handler(struct work_struct *work)
++{
++	struct brcmf_cfg80211_priv *cfg_priv =
++			container_of(work, struct brcmf_cfg80211_priv,
++				     event_work);
++	struct brcmf_cfg80211_event_q *e;
++
++	e = brcmf_deq_event(cfg_priv);
++	if (unlikely(!e)) {
++		WL_ERR("event queue empty...\n");
++		return;
++	}
++
++	do {
++		WL_INFO("event type (%d)\n", e->etype);
++		if (cfg_priv->el.handler[e->etype])
++			cfg_priv->el.handler[e->etype](cfg_priv,
++						       cfg_to_ndev(cfg_priv),
++						       &e->emsg, e->edata);
++		else
++			WL_INFO("Unknown Event (%d): ignoring\n", e->etype);
++		brcmf_put_event(e);
++	} while ((e = brcmf_deq_event(cfg_priv)));
++
++}
++
++static void brcmf_init_eq(struct brcmf_cfg80211_priv *cfg_priv)
++{
++	spin_lock_init(&cfg_priv->evt_q_lock);
++	INIT_LIST_HEAD(&cfg_priv->evt_q_list);
++}
++
++static void brcmf_flush_eq(struct brcmf_cfg80211_priv *cfg_priv)
++{
++	struct brcmf_cfg80211_event_q *e;
++
++	spin_lock_irq(&cfg_priv->evt_q_lock);
++	while (!list_empty(&cfg_priv->evt_q_list)) {
++		e = list_first_entry(&cfg_priv->evt_q_list,
++				     struct brcmf_cfg80211_event_q, evt_q_list);
++		list_del(&e->evt_q_list);
++		kfree(e);
++	}
++	spin_unlock_irq(&cfg_priv->evt_q_lock);
++}
++
++static s32 wl_init_priv(struct brcmf_cfg80211_priv *cfg_priv)
++{
++	s32 err = 0;
++
++	cfg_priv->scan_request = NULL;
++	cfg_priv->pwr_save = true;
++	cfg_priv->iscan_on = true;	/* iscan on & off switch.
++				 we enable iscan per default */
++	cfg_priv->roam_on = true;	/* roam on & off switch.
++				 we enable roam per default */
++
++	cfg_priv->iscan_kickstart = false;
++	cfg_priv->active_scan = true;	/* we do active scan for
++				 specific scan per default */
++	cfg_priv->dongle_up = false;	/* dongle is not up yet */
++	brcmf_init_eq(cfg_priv);
++	err = brcmf_init_priv_mem(cfg_priv);
++	if (err)
++		return err;
++	INIT_WORK(&cfg_priv->event_work, brcmf_cfg80211_event_handler);
++	brcmf_init_eloop_handler(&cfg_priv->el);
++	mutex_init(&cfg_priv->usr_sync);
++	err = brcmf_init_iscan(cfg_priv);
++	if (err)
++		return err;
++	brcmf_init_conf(cfg_priv->conf);
++	brcmf_init_prof(cfg_priv->profile);
++	brcmf_link_down(cfg_priv);
++
++	return err;
++}
++
++static void wl_deinit_priv(struct brcmf_cfg80211_priv *cfg_priv)
++{
++	cancel_work_sync(&cfg_priv->event_work);
++	cfg_priv->dongle_up = false;	/* dongle down */
++	brcmf_flush_eq(cfg_priv);
++	brcmf_link_down(cfg_priv);
++	brcmf_term_iscan(cfg_priv);
++	brcmf_deinit_priv_mem(cfg_priv);
++}
++
++struct brcmf_cfg80211_dev *brcmf_cfg80211_attach(struct net_device *ndev,
++						 struct device *busdev,
++						 void *data)
++{
++	struct wireless_dev *wdev;
++	struct brcmf_cfg80211_priv *cfg_priv;
++	struct brcmf_cfg80211_iface *ci;
++	struct brcmf_cfg80211_dev *cfg_dev;
++	s32 err = 0;
++
++	if (!ndev) {
++		WL_ERR("ndev is invalid\n");
++		return NULL;
++	}
++	cfg_dev = kzalloc(sizeof(struct brcmf_cfg80211_dev), GFP_KERNEL);
++	if (!cfg_dev)
++		return NULL;
++
++	wdev = brcmf_alloc_wdev(sizeof(struct brcmf_cfg80211_iface), busdev);
++	if (IS_ERR(wdev)) {
++		kfree(cfg_dev);
++		return NULL;
++	}
++
++	wdev->iftype = brcmf_mode_to_nl80211_iftype(WL_MODE_BSS);
++	cfg_priv = wdev_to_cfg(wdev);
++	cfg_priv->wdev = wdev;
++	cfg_priv->pub = data;
++	ci = (struct brcmf_cfg80211_iface *)&cfg_priv->ci;
++	ci->cfg_priv = cfg_priv;
++	ndev->ieee80211_ptr = wdev;
++	SET_NETDEV_DEV(ndev, wiphy_dev(wdev->wiphy));
++	wdev->netdev = ndev;
++	err = wl_init_priv(cfg_priv);
++	if (err) {
++		WL_ERR("Failed to init iwm_priv (%d)\n", err);
++		goto cfg80211_attach_out;
++	}
++	brcmf_set_drvdata(cfg_dev, ci);
++
++	return cfg_dev;
++
++cfg80211_attach_out:
++	brcmf_free_wdev(cfg_priv);
++	kfree(cfg_dev);
++	return NULL;
++}
++
++void brcmf_cfg80211_detach(struct brcmf_cfg80211_dev *cfg_dev)
++{
++	struct brcmf_cfg80211_priv *cfg_priv;
++
++	cfg_priv = brcmf_priv_get(cfg_dev);
++
++	wl_deinit_priv(cfg_priv);
++	brcmf_free_wdev(cfg_priv);
++	brcmf_set_drvdata(cfg_dev, NULL);
++	kfree(cfg_dev);
++}
++
++void
++brcmf_cfg80211_event(struct net_device *ndev,
++		  const struct brcmf_event_msg *e, void *data)
++{
++	u32 event_type = be32_to_cpu(e->event_type);
++	struct brcmf_cfg80211_priv *cfg_priv = ndev_to_cfg(ndev);
++
++	if (!brcmf_enq_event(cfg_priv, event_type, e))
++		schedule_work(&cfg_priv->event_work);
++}
++
++static s32 brcmf_dongle_mode(struct net_device *ndev, s32 iftype)
++{
++	s32 infra = 0;
++	s32 err = 0;
++
++	switch (iftype) {
++	case NL80211_IFTYPE_MONITOR:
++	case NL80211_IFTYPE_WDS:
++		WL_ERR("type (%d) : currently we do not support this mode\n",
++		       iftype);
++		err = -EINVAL;
++		return err;
++	case NL80211_IFTYPE_ADHOC:
++		infra = 0;
++		break;
++	case NL80211_IFTYPE_STATION:
++		infra = 1;
++		break;
++	default:
++		err = -EINVAL;
++		WL_ERR("invalid type (%d)\n", iftype);
++		return err;
++	}
++	err = brcmf_exec_dcmd_u32(ndev, BRCMF_C_SET_INFRA, &infra);
++	if (err) {
++		WL_ERR("WLC_SET_INFRA error (%d)\n", err);
++		return err;
++	}
++
++	return 0;
++}
++
++static s32 brcmf_dongle_eventmsg(struct net_device *ndev)
++{
++	/* Room for "event_msgs" + '\0' + bitvec */
++	s8 iovbuf[BRCMF_EVENTING_MASK_LEN + 12];
++	s8 eventmask[BRCMF_EVENTING_MASK_LEN];
++	s32 err = 0;
++
++	WL_TRACE("Enter\n");
++
++	/* Setup event_msgs */
++	brcmf_c_mkiovar("event_msgs", eventmask, BRCMF_EVENTING_MASK_LEN,
++			iovbuf, sizeof(iovbuf));
++	err = brcmf_exec_dcmd(ndev, BRCMF_C_GET_VAR, iovbuf, sizeof(iovbuf));
++	if (err) {
++		WL_ERR("Get event_msgs error (%d)\n", err);
++		goto dongle_eventmsg_out;
++	}
++	memcpy(eventmask, iovbuf, BRCMF_EVENTING_MASK_LEN);
++
++	setbit(eventmask, BRCMF_E_SET_SSID);
++	setbit(eventmask, BRCMF_E_ROAM);
++	setbit(eventmask, BRCMF_E_PRUNE);
++	setbit(eventmask, BRCMF_E_AUTH);
++	setbit(eventmask, BRCMF_E_REASSOC);
++	setbit(eventmask, BRCMF_E_REASSOC_IND);
++	setbit(eventmask, BRCMF_E_DEAUTH_IND);
++	setbit(eventmask, BRCMF_E_DISASSOC_IND);
++	setbit(eventmask, BRCMF_E_DISASSOC);
++	setbit(eventmask, BRCMF_E_JOIN);
++	setbit(eventmask, BRCMF_E_ASSOC_IND);
++	setbit(eventmask, BRCMF_E_PSK_SUP);
++	setbit(eventmask, BRCMF_E_LINK);
++	setbit(eventmask, BRCMF_E_NDIS_LINK);
++	setbit(eventmask, BRCMF_E_MIC_ERROR);
++	setbit(eventmask, BRCMF_E_PMKID_CACHE);
++	setbit(eventmask, BRCMF_E_TXFAIL);
++	setbit(eventmask, BRCMF_E_JOIN_START);
++	setbit(eventmask, BRCMF_E_SCAN_COMPLETE);
++
++	brcmf_c_mkiovar("event_msgs", eventmask, BRCMF_EVENTING_MASK_LEN,
++			iovbuf, sizeof(iovbuf));
++	err = brcmf_exec_dcmd(ndev, BRCMF_C_SET_VAR, iovbuf, sizeof(iovbuf));
++	if (err) {
++		WL_ERR("Set event_msgs error (%d)\n", err);
++		goto dongle_eventmsg_out;
++	}
++
++dongle_eventmsg_out:
++	WL_TRACE("Exit\n");
++	return err;
++}
++
++static s32
++brcmf_dongle_roam(struct net_device *ndev, u32 roamvar, u32 bcn_timeout)
++{
++	s8 iovbuf[32];
++	s32 err = 0;
++	__le32 roamtrigger[2];
++	__le32 roam_delta[2];
++	__le32 bcn_to_le;
++	__le32 roamvar_le;
++
++	/*
++	 * Setup timeout if Beacons are lost and roam is
++	 * off to report link down
++	 */
++	if (roamvar) {
++		bcn_to_le = cpu_to_le32(bcn_timeout);
++		brcmf_c_mkiovar("bcn_timeout", (char *)&bcn_to_le,
++			sizeof(bcn_to_le), iovbuf, sizeof(iovbuf));
++		err = brcmf_exec_dcmd(ndev, BRCMF_C_SET_VAR,
++				   iovbuf, sizeof(iovbuf));
++		if (err) {
++			WL_ERR("bcn_timeout error (%d)\n", err);
++			goto dongle_rom_out;
++		}
++	}
++
++	/*
++	 * Enable/Disable built-in roaming to allow supplicant
++	 * to take care of roaming
++	 */
++	WL_INFO("Internal Roaming = %s\n", roamvar ? "Off" : "On");
++	roamvar_le = cpu_to_le32(roamvar);
++	brcmf_c_mkiovar("roam_off", (char *)&roamvar_le,
++				sizeof(roamvar_le), iovbuf, sizeof(iovbuf));
++	err = brcmf_exec_dcmd(ndev, BRCMF_C_SET_VAR, iovbuf, sizeof(iovbuf));
++	if (err) {
++		WL_ERR("roam_off error (%d)\n", err);
++		goto dongle_rom_out;
++	}
++
++	roamtrigger[0] = cpu_to_le32(WL_ROAM_TRIGGER_LEVEL);
++	roamtrigger[1] = cpu_to_le32(BRCM_BAND_ALL);
++	err = brcmf_exec_dcmd(ndev, BRCMF_C_SET_ROAM_TRIGGER,
++			(void *)roamtrigger, sizeof(roamtrigger));
++	if (err) {
++		WL_ERR("WLC_SET_ROAM_TRIGGER error (%d)\n", err);
++		goto dongle_rom_out;
++	}
++
++	roam_delta[0] = cpu_to_le32(WL_ROAM_DELTA);
++	roam_delta[1] = cpu_to_le32(BRCM_BAND_ALL);
++	err = brcmf_exec_dcmd(ndev, BRCMF_C_SET_ROAM_DELTA,
++				(void *)roam_delta, sizeof(roam_delta));
++	if (err) {
++		WL_ERR("WLC_SET_ROAM_DELTA error (%d)\n", err);
++		goto dongle_rom_out;
++	}
++
++dongle_rom_out:
++	return err;
++}
++
++static s32
++brcmf_dongle_scantime(struct net_device *ndev, s32 scan_assoc_time,
++		      s32 scan_unassoc_time, s32 scan_passive_time)
++{
++	s32 err = 0;
++	__le32 scan_assoc_tm_le = cpu_to_le32(scan_assoc_time);
++	__le32 scan_unassoc_tm_le = cpu_to_le32(scan_unassoc_time);
++	__le32 scan_passive_tm_le = cpu_to_le32(scan_passive_time);
++
++	err = brcmf_exec_dcmd(ndev, BRCMF_C_SET_SCAN_CHANNEL_TIME,
++			   &scan_assoc_tm_le, sizeof(scan_assoc_tm_le));
++	if (err) {
++		if (err == -EOPNOTSUPP)
++			WL_INFO("Scan assoc time is not supported\n");
++		else
++			WL_ERR("Scan assoc time error (%d)\n", err);
++		goto dongle_scantime_out;
++	}
++	err = brcmf_exec_dcmd(ndev, BRCMF_C_SET_SCAN_UNASSOC_TIME,
++			   &scan_unassoc_tm_le, sizeof(scan_unassoc_tm_le));
++	if (err) {
++		if (err == -EOPNOTSUPP)
++			WL_INFO("Scan unassoc time is not supported\n");
++		else
++			WL_ERR("Scan unassoc time error (%d)\n", err);
++		goto dongle_scantime_out;
++	}
++
++	err = brcmf_exec_dcmd(ndev, BRCMF_C_SET_SCAN_PASSIVE_TIME,
++			   &scan_passive_tm_le, sizeof(scan_passive_tm_le));
++	if (err) {
++		if (err == -EOPNOTSUPP)
++			WL_INFO("Scan passive time is not supported\n");
++		else
++			WL_ERR("Scan passive time error (%d)\n", err);
++		goto dongle_scantime_out;
++	}
++
++dongle_scantime_out:
++	return err;
++}
++
++static s32 wl_update_wiphybands(struct brcmf_cfg80211_priv *cfg_priv)
++{
++	struct wiphy *wiphy;
++	s32 phy_list;
++	s8 phy;
++	s32 err = 0;
++
++	err = brcmf_exec_dcmd(cfg_to_ndev(cfg_priv), BRCM_GET_PHYLIST,
++			      &phy_list, sizeof(phy_list));
++	if (err) {
++		WL_ERR("error (%d)\n", err);
++		return err;
++	}
++
++	phy = ((char *)&phy_list)[1];
++	WL_INFO("%c phy\n", phy);
++	if (phy == 'n' || phy == 'a') {
++		wiphy = cfg_to_wiphy(cfg_priv);
++		wiphy->bands[IEEE80211_BAND_5GHZ] = &__wl_band_5ghz_n;
++	}
++
++	return err;
++}
++
++static s32 brcmf_dongle_probecap(struct brcmf_cfg80211_priv *cfg_priv)
++{
++	return wl_update_wiphybands(cfg_priv);
++}
++
++static s32 brcmf_config_dongle(struct brcmf_cfg80211_priv *cfg_priv)
++{
++	struct net_device *ndev;
++	struct wireless_dev *wdev;
++	s32 power_mode;
++	s32 err = 0;
++
++	if (cfg_priv->dongle_up)
++		return err;
++
++	ndev = cfg_to_ndev(cfg_priv);
++	wdev = ndev->ieee80211_ptr;
++
++	brcmf_dongle_scantime(ndev, WL_SCAN_CHANNEL_TIME,
++			WL_SCAN_UNASSOC_TIME, WL_SCAN_PASSIVE_TIME);
++
++	err = brcmf_dongle_eventmsg(ndev);
++	if (err)
++		goto default_conf_out;
++
++	power_mode = cfg_priv->pwr_save ? PM_FAST : PM_OFF;
++	err = brcmf_exec_dcmd_u32(ndev, BRCMF_C_SET_PM, &power_mode);
++	if (err)
++		goto default_conf_out;
++	WL_INFO("power save set to %s\n",
++		(power_mode ? "enabled" : "disabled"));
++
++	err = brcmf_dongle_roam(ndev, (cfg_priv->roam_on ? 0 : 1),
++				WL_BEACON_TIMEOUT);
++	if (err)
++		goto default_conf_out;
++	err = brcmf_dongle_mode(ndev, wdev->iftype);
++	if (err && err != -EINPROGRESS)
++		goto default_conf_out;
++	err = brcmf_dongle_probecap(cfg_priv);
++	if (err)
++		goto default_conf_out;
++
++	/* -EINPROGRESS: Call commit handler */
++
++default_conf_out:
++
++	cfg_priv->dongle_up = true;
++
++	return err;
++
++}
++
++static int brcmf_debugfs_add_netdev_params(struct brcmf_cfg80211_priv *cfg_priv)
++{
++	char buf[10+IFNAMSIZ];
++	struct dentry *fd;
++	s32 err = 0;
++
++	sprintf(buf, "netdev:%s", cfg_to_ndev(cfg_priv)->name);
++	cfg_priv->debugfsdir = debugfs_create_dir(buf,
++					cfg_to_wiphy(cfg_priv)->debugfsdir);
++
++	fd = debugfs_create_u16("beacon_int", S_IRUGO, cfg_priv->debugfsdir,
++		(u16 *)&cfg_priv->profile->beacon_interval);
++	if (!fd) {
++		err = -ENOMEM;
++		goto err_out;
++	}
++
++	fd = debugfs_create_u8("dtim_period", S_IRUGO, cfg_priv->debugfsdir,
++		(u8 *)&cfg_priv->profile->dtim_period);
++	if (!fd) {
++		err = -ENOMEM;
++		goto err_out;
++	}
++
++err_out:
++	return err;
++}
++
++static void brcmf_debugfs_remove_netdev(struct brcmf_cfg80211_priv *cfg_priv)
++{
++	debugfs_remove_recursive(cfg_priv->debugfsdir);
++	cfg_priv->debugfsdir = NULL;
++}
++
++static s32 __brcmf_cfg80211_up(struct brcmf_cfg80211_priv *cfg_priv)
++{
++	s32 err = 0;
++
++	set_bit(WL_STATUS_READY, &cfg_priv->status);
++
++	brcmf_debugfs_add_netdev_params(cfg_priv);
++
++	err = brcmf_config_dongle(cfg_priv);
++	if (err)
++		return err;
++
++	brcmf_invoke_iscan(cfg_priv);
++
++	return err;
++}
++
++static s32 __brcmf_cfg80211_down(struct brcmf_cfg80211_priv *cfg_priv)
++{
++	/*
++	 * While going down, if associated with AP disassociate
++	 * from AP to save power
++	 */
++	if ((test_bit(WL_STATUS_CONNECTED, &cfg_priv->status) ||
++	     test_bit(WL_STATUS_CONNECTING, &cfg_priv->status)) &&
++	     test_bit(WL_STATUS_READY, &cfg_priv->status)) {
++		WL_INFO("Disassociating from AP");
++		brcmf_link_down(cfg_priv);
++
++		/* Make sure WPA_Supplicant receives all the event
++		   generated due to DISASSOC call to the fw to keep
++		   the state fw and WPA_Supplicant state consistent
++		 */
++		brcmf_delay(500);
++	}
++
++	set_bit(WL_STATUS_SCAN_ABORTING, &cfg_priv->status);
++	brcmf_term_iscan(cfg_priv);
++	if (cfg_priv->scan_request) {
++		cfg80211_scan_done(cfg_priv->scan_request, true);
++		/* May need to perform this to cover rmmod */
++		/* wl_set_mpc(cfg_to_ndev(wl), 1); */
++		cfg_priv->scan_request = NULL;
++	}
++	clear_bit(WL_STATUS_READY, &cfg_priv->status);
++	clear_bit(WL_STATUS_SCANNING, &cfg_priv->status);
++	clear_bit(WL_STATUS_SCAN_ABORTING, &cfg_priv->status);
++
++	brcmf_debugfs_remove_netdev(cfg_priv);
++
++	return 0;
++}
++
++s32 brcmf_cfg80211_up(struct brcmf_cfg80211_dev *cfg_dev)
++{
++	struct brcmf_cfg80211_priv *cfg_priv;
++	s32 err = 0;
++
++	cfg_priv = brcmf_priv_get(cfg_dev);
++	mutex_lock(&cfg_priv->usr_sync);
++	err = __brcmf_cfg80211_up(cfg_priv);
++	mutex_unlock(&cfg_priv->usr_sync);
++
++	return err;
++}
++
++s32 brcmf_cfg80211_down(struct brcmf_cfg80211_dev *cfg_dev)
++{
++	struct brcmf_cfg80211_priv *cfg_priv;
++	s32 err = 0;
++
++	cfg_priv = brcmf_priv_get(cfg_dev);
++	mutex_lock(&cfg_priv->usr_sync);
++	err = __brcmf_cfg80211_down(cfg_priv);
++	mutex_unlock(&cfg_priv->usr_sync);
++
++	return err;
++}
++
++static __used s32 brcmf_add_ie(struct brcmf_cfg80211_priv *cfg_priv,
++			       u8 t, u8 l, u8 *v)
++{
++	struct brcmf_cfg80211_ie *ie = &cfg_priv->ie;
++	s32 err = 0;
++
++	if (ie->offset + l + 2 > WL_TLV_INFO_MAX) {
++		WL_ERR("ei crosses buffer boundary\n");
++		return -ENOSPC;
++	}
++	ie->buf[ie->offset] = t;
++	ie->buf[ie->offset + 1] = l;
++	memcpy(&ie->buf[ie->offset + 2], v, l);
++	ie->offset += l + 2;
++
++	return err;
++}
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
+new file mode 100644
+index 0000000..b5d9b36
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
+@@ -0,0 +1,366 @@
++/*
++ * Copyright (c) 2010 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#ifndef _wl_cfg80211_h_
++#define _wl_cfg80211_h_
++
++struct brcmf_cfg80211_conf;
++struct brcmf_cfg80211_iface;
++struct brcmf_cfg80211_priv;
++struct brcmf_cfg80211_security;
++struct brcmf_cfg80211_ibss;
++
++#define WL_DBG_NONE		0
++#define WL_DBG_CONN		(1 << 5)
++#define WL_DBG_SCAN		(1 << 4)
++#define WL_DBG_TRACE		(1 << 3)
++#define WL_DBG_INFO		(1 << 1)
++#define WL_DBG_ERR		(1 << 0)
++#define WL_DBG_MASK		((WL_DBG_INFO | WL_DBG_ERR | WL_DBG_TRACE) | \
++				(WL_DBG_SCAN) | (WL_DBG_CONN))
++
++#define	WL_ERR(fmt, ...)					\
++do {								\
++	if (brcmf_dbg_level & WL_DBG_ERR) {			\
++		if (net_ratelimit()) {				\
++			pr_err("ERROR @%s : " fmt,		\
++			       __func__, ##__VA_ARGS__);	\
++		}						\
++	}							\
++} while (0)
++
++#if (defined DEBUG)
++#define	WL_INFO(fmt, ...)					\
++do {								\
++	if (brcmf_dbg_level & WL_DBG_INFO) {			\
++		if (net_ratelimit()) {				\
++			pr_err("INFO @%s : " fmt,		\
++			       __func__, ##__VA_ARGS__);	\
++		}						\
++	}							\
++} while (0)
++
++#define	WL_TRACE(fmt, ...)					\
++do {								\
++	if (brcmf_dbg_level & WL_DBG_TRACE) {			\
++		if (net_ratelimit()) {				\
++			pr_err("TRACE @%s : " fmt,		\
++			       __func__, ##__VA_ARGS__);	\
++		}						\
++	}							\
++} while (0)
++
++#define	WL_SCAN(fmt, ...)					\
++do {								\
++	if (brcmf_dbg_level & WL_DBG_SCAN) {			\
++		if (net_ratelimit()) {				\
++			pr_err("SCAN @%s : " fmt,		\
++			       __func__, ##__VA_ARGS__);	\
++		}						\
++	}							\
++} while (0)
++
++#define	WL_CONN(fmt, ...)					\
++do {								\
++	if (brcmf_dbg_level & WL_DBG_CONN) {			\
++		if (net_ratelimit()) {				\
++			pr_err("CONN @%s : " fmt,		\
++			       __func__, ##__VA_ARGS__);	\
++		}						\
++	}							\
++} while (0)
++
++#else /* (defined DEBUG) */
++#define	WL_INFO(fmt, args...)
++#define	WL_TRACE(fmt, args...)
++#define	WL_SCAN(fmt, args...)
++#define	WL_CONN(fmt, args...)
++#endif /* (defined DEBUG) */
++
++#define WL_NUM_SCAN_MAX		1
++#define WL_NUM_PMKIDS_MAX	MAXPMKID	/* will be used
++						 * for 2.6.33 kernel
++						 * or later
++						 */
++#define WL_SCAN_BUF_MAX			(1024 * 8)
++#define WL_TLV_INFO_MAX			1024
++#define WL_BSS_INFO_MAX			2048
++#define WL_ASSOC_INFO_MAX	512	/*
++				 * needs to grab assoc info from dongle to
++				 * report it to cfg80211 through "connect"
++				 * event
++				 */
++#define WL_DCMD_LEN_MAX	1024
++#define WL_EXTRA_BUF_MAX	2048
++#define WL_ISCAN_BUF_MAX	2048	/*
++				 * the buf length can be BRCMF_DCMD_MAXLEN
++				 * to reduce iteration
++				 */
++#define WL_ISCAN_TIMER_INTERVAL_MS	3000
++#define WL_SCAN_ERSULTS_LAST	(BRCMF_SCAN_RESULTS_NO_MEM+1)
++#define WL_AP_MAX	256	/* virtually unlimitted as long
++				 * as kernel memory allows
++				 */
++
++#define WL_ROAM_TRIGGER_LEVEL		-75
++#define WL_ROAM_DELTA			20
++#define WL_BEACON_TIMEOUT		3
++
++#define WL_SCAN_CHANNEL_TIME		40
++#define WL_SCAN_UNASSOC_TIME		40
++#define WL_SCAN_PASSIVE_TIME		120
++
++/* dongle status */
++enum wl_status {
++	WL_STATUS_READY,
++	WL_STATUS_SCANNING,
++	WL_STATUS_SCAN_ABORTING,
++	WL_STATUS_CONNECTING,
++	WL_STATUS_CONNECTED
++};
++
++/* wi-fi mode */
++enum wl_mode {
++	WL_MODE_BSS,
++	WL_MODE_IBSS,
++	WL_MODE_AP
++};
++
++/* dongle profile list */
++enum wl_prof_list {
++	WL_PROF_MODE,
++	WL_PROF_SSID,
++	WL_PROF_SEC,
++	WL_PROF_IBSS,
++	WL_PROF_BAND,
++	WL_PROF_BSSID,
++	WL_PROF_ACT,
++	WL_PROF_BEACONINT,
++	WL_PROF_DTIMPERIOD
++};
++
++/* dongle iscan state */
++enum wl_iscan_state {
++	WL_ISCAN_STATE_IDLE,
++	WL_ISCAN_STATE_SCANING
++};
++
++/* dongle configuration */
++struct brcmf_cfg80211_conf {
++	u32 mode;		/* adhoc , infrastructure or ap */
++	u32 frag_threshold;
++	u32 rts_threshold;
++	u32 retry_short;
++	u32 retry_long;
++	s32 tx_power;
++	struct ieee80211_channel channel;
++};
++
++/* cfg80211 main event loop */
++struct brcmf_cfg80211_event_loop {
++	s32(*handler[BRCMF_E_LAST]) (struct brcmf_cfg80211_priv *cfg_priv,
++				     struct net_device *ndev,
++				     const struct brcmf_event_msg *e,
++				     void *data);
++};
++
++/* representing interface of cfg80211 plane */
++struct brcmf_cfg80211_iface {
++	struct brcmf_cfg80211_priv *cfg_priv;
++};
++
++struct brcmf_cfg80211_dev {
++	void *driver_data;	/* to store cfg80211 object information */
++};
++
++/* basic structure of scan request */
++struct brcmf_cfg80211_scan_req {
++	struct brcmf_ssid_le ssid_le;
++};
++
++/* basic structure of information element */
++struct brcmf_cfg80211_ie {
++	u16 offset;
++	u8 buf[WL_TLV_INFO_MAX];
++};
++
++/* event queue for cfg80211 main event */
++struct brcmf_cfg80211_event_q {
++	struct list_head evt_q_list;
++	u32 etype;
++	struct brcmf_event_msg emsg;
++	s8 edata[1];
++};
++
++/* security information with currently associated ap */
++struct brcmf_cfg80211_security {
++	u32 wpa_versions;
++	u32 auth_type;
++	u32 cipher_pairwise;
++	u32 cipher_group;
++	u32 wpa_auth;
++};
++
++/* ibss information for currently joined ibss network */
++struct brcmf_cfg80211_ibss {
++	u8 beacon_interval;	/* in millisecond */
++	u8 atim;		/* in millisecond */
++	s8 join_only;
++	u8 band;
++	u8 channel;
++};
++
++/* dongle profile */
++struct brcmf_cfg80211_profile {
++	u32 mode;
++	struct brcmf_ssid ssid;
++	u8 bssid[ETH_ALEN];
++	u16 beacon_interval;
++	u8 dtim_period;
++	struct brcmf_cfg80211_security sec;
++	struct brcmf_cfg80211_ibss ibss;
++	s32 band;
++};
++
++/* dongle iscan event loop */
++struct brcmf_cfg80211_iscan_eloop {
++	s32 (*handler[WL_SCAN_ERSULTS_LAST])
++		(struct brcmf_cfg80211_priv *cfg_priv);
++};
++
++/* dongle iscan controller */
++struct brcmf_cfg80211_iscan_ctrl {
++	struct net_device *ndev;
++	struct timer_list timer;
++	u32 timer_ms;
++	u32 timer_on;
++	s32 state;
++	struct work_struct work;
++	struct brcmf_cfg80211_iscan_eloop el;
++	void *data;
++	s8 dcmd_buf[BRCMF_DCMD_SMLEN];
++	s8 scan_buf[WL_ISCAN_BUF_MAX];
++};
++
++/* association inform */
++struct brcmf_cfg80211_connect_info {
++	u8 *req_ie;
++	s32 req_ie_len;
++	u8 *resp_ie;
++	s32 resp_ie_len;
++};
++
++/* assoc ie length */
++struct brcmf_cfg80211_assoc_ielen_le {
++	__le32 req_len;
++	__le32 resp_len;
++};
++
++/* wpa2 pmk list */
++struct brcmf_cfg80211_pmk_list {
++	struct pmkid_list pmkids;
++	struct pmkid foo[MAXPMKID - 1];
++};
++
++/* dongle private data of cfg80211 interface */
++struct brcmf_cfg80211_priv {
++	struct wireless_dev *wdev;	/* representing wl cfg80211 device */
++	struct brcmf_cfg80211_conf *conf;	/* dongle configuration */
++	struct cfg80211_scan_request *scan_request;	/* scan request
++							 object */
++	struct brcmf_cfg80211_event_loop el;	/* main event loop */
++	struct list_head evt_q_list;	/* used for event queue */
++	spinlock_t	 evt_q_lock;	/* for event queue synchronization */
++	struct mutex usr_sync;	/* maily for dongle up/down synchronization */
++	struct brcmf_scan_results *bss_list;	/* bss_list holding scanned
++						 ap information */
++	struct brcmf_scan_results *scan_results;
++	struct brcmf_cfg80211_scan_req *scan_req_int;	/* scan request object
++						 for internal purpose */
++	struct wl_cfg80211_bss_info *bss_info;	/* bss information for
++						 cfg80211 layer */
++	struct brcmf_cfg80211_ie ie;	/* information element object for
++					 internal purpose */
++	struct brcmf_cfg80211_profile *profile;	/* holding dongle profile */
++	struct brcmf_cfg80211_iscan_ctrl *iscan;	/* iscan controller */
++	struct brcmf_cfg80211_connect_info conn_info; /* association info */
++	struct brcmf_cfg80211_pmk_list *pmk_list;	/* wpa2 pmk list */
++	struct work_struct event_work;	/* event handler work struct */
++	unsigned long status;		/* current dongle status */
++	void *pub;
++	u32 channel;		/* current channel */
++	bool iscan_on;		/* iscan on/off switch */
++	bool iscan_kickstart;	/* indicate iscan already started */
++	bool active_scan;	/* current scan mode */
++	bool ibss_starter;	/* indicates this sta is ibss starter */
++	bool link_up;		/* link/connection up flag */
++	bool pwr_save;		/* indicate whether dongle to support
++					 power save mode */
++	bool dongle_up;		/* indicate whether dongle up or not */
++	bool roam_on;		/* on/off switch for dongle self-roaming */
++	bool scan_tried;	/* indicates if first scan attempted */
++	u8 *dcmd_buf;		/* dcmd buffer */
++	u8 *extra_buf;		/* maily to grab assoc information */
++	struct dentry *debugfsdir;
++	u8 ci[0] __aligned(NETDEV_ALIGN);
++};
++
++static inline struct wiphy *cfg_to_wiphy(struct brcmf_cfg80211_priv *w)
++{
++	return w->wdev->wiphy;
++}
++
++static inline struct brcmf_cfg80211_priv *wiphy_to_cfg(struct wiphy *w)
++{
++	return (struct brcmf_cfg80211_priv *)(wiphy_priv(w));
++}
++
++static inline struct brcmf_cfg80211_priv *wdev_to_cfg(struct wireless_dev *wd)
++{
++	return (struct brcmf_cfg80211_priv *)(wdev_priv(wd));
++}
++
++static inline struct net_device *cfg_to_ndev(struct brcmf_cfg80211_priv *cfg)
++{
++	return cfg->wdev->netdev;
++}
++
++static inline struct brcmf_cfg80211_priv *ndev_to_cfg(struct net_device *ndev)
++{
++	return wdev_to_cfg(ndev->ieee80211_ptr);
++}
++
++#define iscan_to_cfg(i) ((struct brcmf_cfg80211_priv *)(i->data))
++#define cfg_to_iscan(w) (w->iscan)
++
++static inline struct
++brcmf_cfg80211_connect_info *cfg_to_conn(struct brcmf_cfg80211_priv *cfg)
++{
++	return &cfg->conn_info;
++}
++
++extern struct brcmf_cfg80211_dev *brcmf_cfg80211_attach(struct net_device *ndev,
++							struct device *busdev,
++							void *data);
++extern void brcmf_cfg80211_detach(struct brcmf_cfg80211_dev *cfg);
++
++/* event handler from dongle */
++extern void brcmf_cfg80211_event(struct net_device *ndev,
++				 const struct brcmf_event_msg *e, void *data);
++extern s32 brcmf_cfg80211_up(struct brcmf_cfg80211_dev *cfg_dev);
++extern s32 brcmf_cfg80211_down(struct brcmf_cfg80211_dev *cfg_dev);
++
++#endif				/* _wl_cfg80211_h_ */
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/Makefile b/drivers/net/wireless/brcm80211/brcmsmac/Makefile
+new file mode 100644
+index 0000000..3c1f39d
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmsmac/Makefile
+@@ -0,0 +1,48 @@
++#
++# Makefile fragment for Broadcom 802.11n Networking Device Driver
++#
++# Copyright (c) 2010 Broadcom Corporation
++#
++# Permission to use, copy, modify, and/or distribute this software for any
++# purpose with or without fee is hereby granted, provided that the above
++# copyright notice and this permission notice appear in all copies.
++#
++# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++# SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++# OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++# CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++
++ccflags-y := \
++	-D__CHECK_ENDIAN__ \
++	-I$(obj)				\
++	-I$(obj)/phy				\
++	-I$(obj)/../include
++
++BRCMSMAC_OFILES := \
++	mac80211_if.o \
++	ucode_loader.o \
++	ampdu.o \
++	antsel.o \
++	channel.o \
++	main.o \
++	phy_shim.o \
++	pmu.o \
++	rate.o \
++	stf.o \
++	aiutils.o \
++	phy/phy_cmn.o \
++	phy/phy_lcn.o \
++	phy/phy_n.o \
++	phy/phytbl_lcn.o \
++	phy/phytbl_n.o \
++	phy/phy_qmath.o \
++	dma.o \
++	brcms_trace_events.o
++
++MODULEPFX := brcmsmac
++
++obj-$(CONFIG_BRCMSMAC)	+= $(MODULEPFX).o
++$(MODULEPFX)-objs	= $(BRCMSMAC_OFILES)
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/aiutils.c b/drivers/net/wireless/brcm80211/brcmsmac/aiutils.c
+new file mode 100644
+index 0000000..94e040a
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmsmac/aiutils.c
+@@ -0,0 +1,841 @@
++/*
++ * Copyright (c) 2010 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ *
++ * File contents: support functions for PCI/PCIe
++ */
++
++#undef pr_fmt
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/printk.h>
++#include <linux/delay.h>
++
++#include <defs.h>
++#include <chipcommon.h>
++#include <brcmu_utils.h>
++#include <brcm_hw_ids.h>
++#include <soc.h>
++#include "types.h"
++#include "pub.h"
++#include "pmu.h"
++#include "aiutils.h"
++
++/* slow_clk_ctl */
++ /* slow clock source mask */
++#define SCC_SS_MASK		0x00000007
++ /* source of slow clock is LPO */
++#define	SCC_SS_LPO		0x00000000
++ /* source of slow clock is crystal */
++#define	SCC_SS_XTAL		0x00000001
++ /* source of slow clock is PCI */
++#define	SCC_SS_PCI		0x00000002
++ /* LPOFreqSel, 1: 160Khz, 0: 32KHz */
++#define SCC_LF			0x00000200
++ /* LPOPowerDown, 1: LPO is disabled, 0: LPO is enabled */
++#define SCC_LP			0x00000400
++ /* ForceSlowClk, 1: sb/cores running on slow clock, 0: power logic control */
++#define SCC_FS			0x00000800
++ /* IgnorePllOffReq, 1/0:
++  *  power logic ignores/honors PLL clock disable requests from core
++  */
++#define SCC_IP			0x00001000
++ /* XtalControlEn, 1/0:
++  *  power logic does/doesn't disable crystal when appropriate
++  */
++#define SCC_XC			0x00002000
++ /* XtalPU (RO), 1/0: crystal running/disabled */
++#define SCC_XP			0x00004000
++ /* ClockDivider (SlowClk = 1/(4+divisor)) */
++#define SCC_CD_MASK		0xffff0000
++#define SCC_CD_SHIFT		16
++
++/* system_clk_ctl */
++ /* ILPen: Enable Idle Low Power */
++#define	SYCC_IE			0x00000001
++ /* ALPen: Enable Active Low Power */
++#define	SYCC_AE			0x00000002
++ /* ForcePLLOn */
++#define	SYCC_FP			0x00000004
++ /* Force ALP (or HT if ALPen is not set */
++#define	SYCC_AR			0x00000008
++ /* Force HT */
++#define	SYCC_HR			0x00000010
++ /* ClkDiv  (ILP = 1/(4 * (divisor + 1)) */
++#define SYCC_CD_MASK		0xffff0000
++#define SYCC_CD_SHIFT		16
++
++#define CST4329_SPROM_OTP_SEL_MASK	0x00000003
++ /* OTP is powered up, use def. CIS, no SPROM */
++#define CST4329_DEFCIS_SEL		0
++ /* OTP is powered up, SPROM is present */
++#define CST4329_SPROM_SEL		1
++ /* OTP is powered up, no SPROM */
++#define CST4329_OTP_SEL			2
++ /* OTP is powered down, SPROM is present */
++#define CST4329_OTP_PWRDN		3
++
++#define CST4329_SPI_SDIO_MODE_MASK	0x00000004
++#define CST4329_SPI_SDIO_MODE_SHIFT	2
++
++/* 43224 chip-specific ChipControl register bits */
++#define CCTRL43224_GPIO_TOGGLE          0x8000
++ /* 12 mA drive strength */
++#define CCTRL_43224A0_12MA_LED_DRIVE    0x00F000F0
++ /* 12 mA drive strength for later 43224s */
++#define CCTRL_43224B0_12MA_LED_DRIVE    0xF0
++
++/* 43236 Chip specific ChipStatus register bits */
++#define CST43236_SFLASH_MASK		0x00000040
++#define CST43236_OTP_MASK		0x00000080
++#define CST43236_HSIC_MASK		0x00000100	/* USB/HSIC */
++#define CST43236_BP_CLK			0x00000200	/* 120/96Mbps */
++#define CST43236_BOOT_MASK		0x00001800
++#define CST43236_BOOT_SHIFT		11
++#define CST43236_BOOT_FROM_SRAM		0 /* boot from SRAM, ARM in reset */
++#define CST43236_BOOT_FROM_ROM		1 /* boot from ROM */
++#define CST43236_BOOT_FROM_FLASH	2 /* boot from FLASH */
++#define CST43236_BOOT_FROM_INVALID	3
++
++/* 4331 chip-specific ChipControl register bits */
++ /* 0 disable */
++#define CCTRL4331_BT_COEXIST		(1<<0)
++ /* 0 SECI is disabled (JTAG functional) */
++#define CCTRL4331_SECI			(1<<1)
++ /* 0 disable */
++#define CCTRL4331_EXT_LNA		(1<<2)
++ /* sprom/gpio13-15 mux */
++#define CCTRL4331_SPROM_GPIO13_15       (1<<3)
++ /* 0 ext pa disable, 1 ext pa enabled */
++#define CCTRL4331_EXTPA_EN		(1<<4)
++ /* set drive out GPIO_CLK on sprom_cs pin */
++#define CCTRL4331_GPIOCLK_ON_SPROMCS	(1<<5)
++ /* use sprom_cs pin as PCIE mdio interface */
++#define CCTRL4331_PCIE_MDIO_ON_SPROMCS	(1<<6)
++ /* aband extpa will be at gpio2/5 and sprom_dout */
++#define CCTRL4331_EXTPA_ON_GPIO2_5	(1<<7)
++ /* override core control on pipe_AuxClkEnable */
++#define CCTRL4331_OVR_PIPEAUXCLKEN	(1<<8)
++ /* override core control on pipe_AuxPowerDown */
++#define CCTRL4331_OVR_PIPEAUXPWRDOWN	(1<<9)
++ /* pcie_auxclkenable */
++#define CCTRL4331_PCIE_AUXCLKEN		(1<<10)
++ /* pcie_pipe_pllpowerdown */
++#define CCTRL4331_PCIE_PIPE_PLLDOWN	(1<<11)
++ /* enable bt_shd0 at gpio4 */
++#define CCTRL4331_BT_SHD0_ON_GPIO4	(1<<16)
++ /* enable bt_shd1 at gpio5 */
++#define CCTRL4331_BT_SHD1_ON_GPIO5	(1<<17)
++
++/* 4331 Chip specific ChipStatus register bits */
++ /* crystal frequency 20/40Mhz */
++#define	CST4331_XTAL_FREQ		0x00000001
++#define	CST4331_SPROM_PRESENT		0x00000002
++#define	CST4331_OTP_PRESENT		0x00000004
++#define	CST4331_LDO_RF			0x00000008
++#define	CST4331_LDO_PAR			0x00000010
++
++/* 4319 chip-specific ChipStatus register bits */
++#define	CST4319_SPI_CPULESSUSB		0x00000001
++#define	CST4319_SPI_CLK_POL		0x00000002
++#define	CST4319_SPI_CLK_PH		0x00000008
++ /* gpio [7:6], SDIO CIS selection */
++#define	CST4319_SPROM_OTP_SEL_MASK	0x000000c0
++#define	CST4319_SPROM_OTP_SEL_SHIFT	6
++ /* use default CIS, OTP is powered up */
++#define	CST4319_DEFCIS_SEL		0x00000000
++ /* use SPROM, OTP is powered up */
++#define	CST4319_SPROM_SEL		0x00000040
++ /* use OTP, OTP is powered up */
++#define	CST4319_OTP_SEL			0x00000080
++ /* use SPROM, OTP is powered down */
++#define	CST4319_OTP_PWRDN		0x000000c0
++ /* gpio [8], sdio/usb mode */
++#define	CST4319_SDIO_USB_MODE		0x00000100
++#define	CST4319_REMAP_SEL_MASK		0x00000600
++#define	CST4319_ILPDIV_EN		0x00000800
++#define	CST4319_XTAL_PD_POL		0x00001000
++#define	CST4319_LPO_SEL			0x00002000
++#define	CST4319_RES_INIT_MODE		0x0000c000
++ /* PALDO is configured with external PNP */
++#define	CST4319_PALDO_EXTPNP		0x00010000
++#define	CST4319_CBUCK_MODE_MASK		0x00060000
++#define CST4319_CBUCK_MODE_BURST	0x00020000
++#define CST4319_CBUCK_MODE_LPBURST	0x00060000
++#define	CST4319_RCAL_VALID		0x01000000
++#define	CST4319_RCAL_VALUE_MASK		0x3e000000
++#define	CST4319_RCAL_VALUE_SHIFT	25
++
++/* 4336 chip-specific ChipStatus register bits */
++#define	CST4336_SPI_MODE_MASK		0x00000001
++#define	CST4336_SPROM_PRESENT		0x00000002
++#define	CST4336_OTP_PRESENT		0x00000004
++#define	CST4336_ARMREMAP_0		0x00000008
++#define	CST4336_ILPDIV_EN_MASK		0x00000010
++#define	CST4336_ILPDIV_EN_SHIFT		4
++#define	CST4336_XTAL_PD_POL_MASK	0x00000020
++#define	CST4336_XTAL_PD_POL_SHIFT	5
++#define	CST4336_LPO_SEL_MASK		0x00000040
++#define	CST4336_LPO_SEL_SHIFT		6
++#define	CST4336_RES_INIT_MODE_MASK	0x00000180
++#define	CST4336_RES_INIT_MODE_SHIFT	7
++#define	CST4336_CBUCK_MODE_MASK		0x00000600
++#define	CST4336_CBUCK_MODE_SHIFT	9
++
++/* 4313 chip-specific ChipStatus register bits */
++#define	CST4313_SPROM_PRESENT			1
++#define	CST4313_OTP_PRESENT			2
++#define	CST4313_SPROM_OTP_SEL_MASK		0x00000002
++#define	CST4313_SPROM_OTP_SEL_SHIFT		0
++
++/* 4313 Chip specific ChipControl register bits */
++ /* 12 mA drive strengh for later 4313 */
++#define CCTRL_4313_12MA_LED_DRIVE    0x00000007
++
++/* Manufacturer Ids */
++#define	MFGID_ARM		0x43b
++#define	MFGID_BRCM		0x4bf
++#define	MFGID_MIPS		0x4a7
++
++/* Enumeration ROM registers */
++#define	ER_EROMENTRY		0x000
++#define	ER_REMAPCONTROL		0xe00
++#define	ER_REMAPSELECT		0xe04
++#define	ER_MASTERSELECT		0xe10
++#define	ER_ITCR			0xf00
++#define	ER_ITIP			0xf04
++
++/* Erom entries */
++#define	ER_TAG			0xe
++#define	ER_TAG1			0x6
++#define	ER_VALID		1
++#define	ER_CI			0
++#define	ER_MP			2
++#define	ER_ADD			4
++#define	ER_END			0xe
++#define	ER_BAD			0xffffffff
++
++/* EROM CompIdentA */
++#define	CIA_MFG_MASK		0xfff00000
++#define	CIA_MFG_SHIFT		20
++#define	CIA_CID_MASK		0x000fff00
++#define	CIA_CID_SHIFT		8
++#define	CIA_CCL_MASK		0x000000f0
++#define	CIA_CCL_SHIFT		4
++
++/* EROM CompIdentB */
++#define	CIB_REV_MASK		0xff000000
++#define	CIB_REV_SHIFT		24
++#define	CIB_NSW_MASK		0x00f80000
++#define	CIB_NSW_SHIFT		19
++#define	CIB_NMW_MASK		0x0007c000
++#define	CIB_NMW_SHIFT		14
++#define	CIB_NSP_MASK		0x00003e00
++#define	CIB_NSP_SHIFT		9
++#define	CIB_NMP_MASK		0x000001f0
++#define	CIB_NMP_SHIFT		4
++
++/* EROM AddrDesc */
++#define	AD_ADDR_MASK		0xfffff000
++#define	AD_SP_MASK		0x00000f00
++#define	AD_SP_SHIFT		8
++#define	AD_ST_MASK		0x000000c0
++#define	AD_ST_SHIFT		6
++#define	AD_ST_SLAVE		0x00000000
++#define	AD_ST_BRIDGE		0x00000040
++#define	AD_ST_SWRAP		0x00000080
++#define	AD_ST_MWRAP		0x000000c0
++#define	AD_SZ_MASK		0x00000030
++#define	AD_SZ_SHIFT		4
++#define	AD_SZ_4K		0x00000000
++#define	AD_SZ_8K		0x00000010
++#define	AD_SZ_16K		0x00000020
++#define	AD_SZ_SZD		0x00000030
++#define	AD_AG32			0x00000008
++#define	AD_ADDR_ALIGN		0x00000fff
++#define	AD_SZ_BASE		0x00001000	/* 4KB */
++
++/* EROM SizeDesc */
++#define	SD_SZ_MASK		0xfffff000
++#define	SD_SG32			0x00000008
++#define	SD_SZ_ALIGN		0x00000fff
++
++/* PCI config space bit 4 for 4306c0 slow clock source */
++#define	PCI_CFG_GPIO_SCS	0x10
++/* PCI config space GPIO 14 for Xtal power-up */
++#define PCI_CFG_GPIO_XTAL	0x40
++/* PCI config space GPIO 15 for PLL power-down */
++#define PCI_CFG_GPIO_PLL	0x80
++
++/* power control defines */
++#define PLL_DELAY		150	/* us pll on delay */
++#define FREF_DELAY		200	/* us fref change delay */
++#define	XTAL_ON_DELAY		1000	/* us crystal power-on delay */
++
++/* resetctrl */
++#define	AIRC_RESET		1
++
++#define	NOREV		-1	/* Invalid rev */
++
++/* GPIO Based LED powersave defines */
++#define DEFAULT_GPIO_ONTIME	10	/* Default: 10% on */
++#define DEFAULT_GPIO_OFFTIME	90	/* Default: 10% on */
++
++/* When Srom support present, fields in sromcontrol */
++#define	SRC_START		0x80000000
++#define	SRC_BUSY		0x80000000
++#define	SRC_OPCODE		0x60000000
++#define	SRC_OP_READ		0x00000000
++#define	SRC_OP_WRITE		0x20000000
++#define	SRC_OP_WRDIS		0x40000000
++#define	SRC_OP_WREN		0x60000000
++#define	SRC_OTPSEL		0x00000010
++#define	SRC_LOCK		0x00000008
++#define	SRC_SIZE_MASK		0x00000006
++#define	SRC_SIZE_1K		0x00000000
++#define	SRC_SIZE_4K		0x00000002
++#define	SRC_SIZE_16K		0x00000004
++#define	SRC_SIZE_SHIFT		1
++#define	SRC_PRESENT		0x00000001
++
++/* External PA enable mask */
++#define GPIO_CTRL_EPA_EN_MASK 0x40
++
++#define DEFAULT_GPIOTIMERVAL \
++	((DEFAULT_GPIO_ONTIME << GPIO_ONTIME_SHIFT) | DEFAULT_GPIO_OFFTIME)
++
++#define	BADIDX		(SI_MAXCORES + 1)
++
++#define	IS_SIM(chippkg)	\
++	((chippkg == HDLSIM_PKG_ID) || (chippkg == HWSIM_PKG_ID))
++
++#define PCIE(sih)	(ai_get_buscoretype(sih) == PCIE_CORE_ID)
++
++#define PCI_FORCEHT(sih) (PCIE(sih) && (ai_get_chip_id(sih) == BCM4716_CHIP_ID))
++
++#ifdef DEBUG
++#define	SI_MSG(fmt, ...)	pr_debug(fmt, ##__VA_ARGS__)
++#else
++#define	SI_MSG(fmt, ...)	no_printk(fmt, ##__VA_ARGS__)
++#endif				/* DEBUG */
++
++#define	GOODCOREADDR(x, b) \
++	(((x) >= (b)) && ((x) < ((b) + SI_MAXCORES * SI_CORE_SIZE)) && \
++		IS_ALIGNED((x), SI_CORE_SIZE))
++
++struct aidmp {
++	u32 oobselina30;	/* 0x000 */
++	u32 oobselina74;	/* 0x004 */
++	u32 PAD[6];
++	u32 oobselinb30;	/* 0x020 */
++	u32 oobselinb74;	/* 0x024 */
++	u32 PAD[6];
++	u32 oobselinc30;	/* 0x040 */
++	u32 oobselinc74;	/* 0x044 */
++	u32 PAD[6];
++	u32 oobselind30;	/* 0x060 */
++	u32 oobselind74;	/* 0x064 */
++	u32 PAD[38];
++	u32 oobselouta30;	/* 0x100 */
++	u32 oobselouta74;	/* 0x104 */
++	u32 PAD[6];
++	u32 oobseloutb30;	/* 0x120 */
++	u32 oobseloutb74;	/* 0x124 */
++	u32 PAD[6];
++	u32 oobseloutc30;	/* 0x140 */
++	u32 oobseloutc74;	/* 0x144 */
++	u32 PAD[6];
++	u32 oobseloutd30;	/* 0x160 */
++	u32 oobseloutd74;	/* 0x164 */
++	u32 PAD[38];
++	u32 oobsynca;	/* 0x200 */
++	u32 oobseloutaen;	/* 0x204 */
++	u32 PAD[6];
++	u32 oobsyncb;	/* 0x220 */
++	u32 oobseloutben;	/* 0x224 */
++	u32 PAD[6];
++	u32 oobsyncc;	/* 0x240 */
++	u32 oobseloutcen;	/* 0x244 */
++	u32 PAD[6];
++	u32 oobsyncd;	/* 0x260 */
++	u32 oobseloutden;	/* 0x264 */
++	u32 PAD[38];
++	u32 oobaextwidth;	/* 0x300 */
++	u32 oobainwidth;	/* 0x304 */
++	u32 oobaoutwidth;	/* 0x308 */
++	u32 PAD[5];
++	u32 oobbextwidth;	/* 0x320 */
++	u32 oobbinwidth;	/* 0x324 */
++	u32 oobboutwidth;	/* 0x328 */
++	u32 PAD[5];
++	u32 oobcextwidth;	/* 0x340 */
++	u32 oobcinwidth;	/* 0x344 */
++	u32 oobcoutwidth;	/* 0x348 */
++	u32 PAD[5];
++	u32 oobdextwidth;	/* 0x360 */
++	u32 oobdinwidth;	/* 0x364 */
++	u32 oobdoutwidth;	/* 0x368 */
++	u32 PAD[37];
++	u32 ioctrlset;	/* 0x400 */
++	u32 ioctrlclear;	/* 0x404 */
++	u32 ioctrl;		/* 0x408 */
++	u32 PAD[61];
++	u32 iostatus;	/* 0x500 */
++	u32 PAD[127];
++	u32 ioctrlwidth;	/* 0x700 */
++	u32 iostatuswidth;	/* 0x704 */
++	u32 PAD[62];
++	u32 resetctrl;	/* 0x800 */
++	u32 resetstatus;	/* 0x804 */
++	u32 resetreadid;	/* 0x808 */
++	u32 resetwriteid;	/* 0x80c */
++	u32 PAD[60];
++	u32 errlogctrl;	/* 0x900 */
++	u32 errlogdone;	/* 0x904 */
++	u32 errlogstatus;	/* 0x908 */
++	u32 errlogaddrlo;	/* 0x90c */
++	u32 errlogaddrhi;	/* 0x910 */
++	u32 errlogid;	/* 0x914 */
++	u32 errloguser;	/* 0x918 */
++	u32 errlogflags;	/* 0x91c */
++	u32 PAD[56];
++	u32 intstatus;	/* 0xa00 */
++	u32 PAD[127];
++	u32 config;		/* 0xe00 */
++	u32 PAD[63];
++	u32 itcr;		/* 0xf00 */
++	u32 PAD[3];
++	u32 itipooba;	/* 0xf10 */
++	u32 itipoobb;	/* 0xf14 */
++	u32 itipoobc;	/* 0xf18 */
++	u32 itipoobd;	/* 0xf1c */
++	u32 PAD[4];
++	u32 itipoobaout;	/* 0xf30 */
++	u32 itipoobbout;	/* 0xf34 */
++	u32 itipoobcout;	/* 0xf38 */
++	u32 itipoobdout;	/* 0xf3c */
++	u32 PAD[4];
++	u32 itopooba;	/* 0xf50 */
++	u32 itopoobb;	/* 0xf54 */
++	u32 itopoobc;	/* 0xf58 */
++	u32 itopoobd;	/* 0xf5c */
++	u32 PAD[4];
++	u32 itopoobain;	/* 0xf70 */
++	u32 itopoobbin;	/* 0xf74 */
++	u32 itopoobcin;	/* 0xf78 */
++	u32 itopoobdin;	/* 0xf7c */
++	u32 PAD[4];
++	u32 itopreset;	/* 0xf90 */
++	u32 PAD[15];
++	u32 peripherialid4;	/* 0xfd0 */
++	u32 peripherialid5;	/* 0xfd4 */
++	u32 peripherialid6;	/* 0xfd8 */
++	u32 peripherialid7;	/* 0xfdc */
++	u32 peripherialid0;	/* 0xfe0 */
++	u32 peripherialid1;	/* 0xfe4 */
++	u32 peripherialid2;	/* 0xfe8 */
++	u32 peripherialid3;	/* 0xfec */
++	u32 componentid0;	/* 0xff0 */
++	u32 componentid1;	/* 0xff4 */
++	u32 componentid2;	/* 0xff8 */
++	u32 componentid3;	/* 0xffc */
++};
++
++static bool
++ai_buscore_setup(struct si_info *sii, struct bcma_device *cc)
++{
++	/* no cores found, bail out */
++	if (cc->bus->nr_cores == 0)
++		return false;
++
++	/* get chipcommon rev */
++	sii->pub.ccrev = cc->id.rev;
++
++	/* get chipcommon chipstatus */
++	sii->chipst = bcma_read32(cc, CHIPCREGOFFS(chipstatus));
++
++	/* get chipcommon capabilites */
++	sii->pub.cccaps = bcma_read32(cc, CHIPCREGOFFS(capabilities));
++
++	/* get pmu rev and caps */
++	if (ai_get_cccaps(&sii->pub) & CC_CAP_PMU) {
++		sii->pub.pmucaps = bcma_read32(cc,
++					       CHIPCREGOFFS(pmucapabilities));
++		sii->pub.pmurev = sii->pub.pmucaps & PCAP_REV_MASK;
++	}
++
++	/* figure out buscore */
++	sii->buscore = ai_findcore(&sii->pub, PCIE_CORE_ID, 0);
++
++	return true;
++}
++
++static struct si_info *ai_doattach(struct si_info *sii,
++				   struct bcma_bus *pbus)
++{
++	struct si_pub *sih = &sii->pub;
++	u32 w, savewin;
++	struct bcma_device *cc;
++	struct ssb_sprom *sprom = &pbus->sprom;
++
++	savewin = 0;
++
++	sii->icbus = pbus;
++	sii->pcibus = pbus->host_pci;
++
++	/* switch to Chipcommon core */
++	cc = pbus->drv_cc.core;
++
++	sih->chip = pbus->chipinfo.id;
++	sih->chiprev = pbus->chipinfo.rev;
++	sih->chippkg = pbus->chipinfo.pkg;
++	sih->boardvendor = pbus->boardinfo.vendor;
++	sih->boardtype = pbus->boardinfo.type;
++
++	if (!ai_buscore_setup(sii, cc))
++		goto exit;
++
++	/* === NVRAM, clock is ready === */
++	bcma_write32(cc, CHIPCREGOFFS(gpiopullup), 0);
++	bcma_write32(cc, CHIPCREGOFFS(gpiopulldown), 0);
++
++	/* PMU specific initializations */
++	if (ai_get_cccaps(sih) & CC_CAP_PMU) {
++		si_pmu_init(sih);
++		(void)si_pmu_measure_alpclk(sih);
++		si_pmu_res_init(sih);
++	}
++
++	/* setup the GPIO based LED powersave register */
++	w = (sprom->leddc_on_time << BCMA_CC_GPIOTIMER_ONTIME_SHIFT) |
++		 (sprom->leddc_off_time << BCMA_CC_GPIOTIMER_OFFTIME_SHIFT);
++	if (w == 0)
++		w = DEFAULT_GPIOTIMERVAL;
++	ai_cc_reg(sih, offsetof(struct chipcregs, gpiotimerval),
++		  ~0, w);
++
++	if (ai_get_chip_id(sih) == BCM43224_CHIP_ID) {
++		/*
++		 * enable 12 mA drive strenth for 43224 and
++		 * set chipControl register bit 15
++		 */
++		if (ai_get_chiprev(sih) == 0) {
++			SI_MSG("Applying 43224A0 WARs\n");
++			ai_cc_reg(sih, offsetof(struct chipcregs, chipcontrol),
++				  CCTRL43224_GPIO_TOGGLE,
++				  CCTRL43224_GPIO_TOGGLE);
++			si_pmu_chipcontrol(sih, 0, CCTRL_43224A0_12MA_LED_DRIVE,
++					   CCTRL_43224A0_12MA_LED_DRIVE);
++		}
++		if (ai_get_chiprev(sih) >= 1) {
++			SI_MSG("Applying 43224B0+ WARs\n");
++			si_pmu_chipcontrol(sih, 0, CCTRL_43224B0_12MA_LED_DRIVE,
++					   CCTRL_43224B0_12MA_LED_DRIVE);
++		}
++	}
++
++	if (ai_get_chip_id(sih) == BCM4313_CHIP_ID) {
++		/*
++		 * enable 12 mA drive strenth for 4313 and
++		 * set chipControl register bit 1
++		 */
++		SI_MSG("Applying 4313 WARs\n");
++		si_pmu_chipcontrol(sih, 0, CCTRL_4313_12MA_LED_DRIVE,
++				   CCTRL_4313_12MA_LED_DRIVE);
++	}
++
++	return sii;
++
++ exit:
++
++	return NULL;
++}
++
++/*
++ * Allocate a si handle and do the attach.
++ */
++struct si_pub *
++ai_attach(struct bcma_bus *pbus)
++{
++	struct si_info *sii;
++
++	/* alloc struct si_info */
++	sii = kzalloc(sizeof(struct si_info), GFP_ATOMIC);
++	if (sii == NULL)
++		return NULL;
++
++	if (ai_doattach(sii, pbus) == NULL) {
++		kfree(sii);
++		return NULL;
++	}
++
++	return (struct si_pub *) sii;
++}
++
++/* may be called with core in reset */
++void ai_detach(struct si_pub *sih)
++{
++	struct si_info *sii;
++
++	struct si_pub *si_local = NULL;
++	memcpy(&si_local, &sih, sizeof(struct si_pub **));
++
++	sii = (struct si_info *)sih;
++
++	if (sii == NULL)
++		return;
++
++	kfree(sii);
++}
++
++/* return index of coreid or BADIDX if not found */
++struct bcma_device *ai_findcore(struct si_pub *sih, u16 coreid, u16 coreunit)
++{
++	struct bcma_device *core;
++	struct si_info *sii;
++	uint found;
++
++	sii = (struct si_info *)sih;
++
++	found = 0;
++
++	list_for_each_entry(core, &sii->icbus->cores, list)
++		if (core->id.id == coreid) {
++			if (found == coreunit)
++				return core;
++			found++;
++		}
++
++	return NULL;
++}
++
++/*
++ * read/modify chipcommon core register.
++ */
++uint ai_cc_reg(struct si_pub *sih, uint regoff, u32 mask, u32 val)
++{
++	struct bcma_device *cc;
++	u32 w;
++	struct si_info *sii;
++
++	sii = (struct si_info *)sih;
++	cc = sii->icbus->drv_cc.core;
++
++	/* mask and set */
++	if (mask || val) {
++		bcma_maskset32(cc, regoff, ~mask, val);
++	}
++
++	/* readback */
++	w = bcma_read32(cc, regoff);
++
++	return w;
++}
++
++/* return the slow clock source - LPO, XTAL, or PCI */
++static uint ai_slowclk_src(struct si_pub *sih, struct bcma_device *cc)
++{
++	return SCC_SS_XTAL;
++}
++
++/*
++* return the ILP (slowclock) min or max frequency
++* precondition: we've established the chip has dynamic clk control
++*/
++static uint ai_slowclk_freq(struct si_pub *sih, bool max_freq,
++			    struct bcma_device *cc)
++{
++	uint div;
++
++	/* Chipc rev 10 is InstaClock */
++	div = bcma_read32(cc, CHIPCREGOFFS(system_clk_ctl));
++	div = 4 * ((div >> SYCC_CD_SHIFT) + 1);
++	return max_freq ? XTALMAXFREQ : (XTALMINFREQ / div);
++}
++
++static void
++ai_clkctl_setdelay(struct si_pub *sih, struct bcma_device *cc)
++{
++	uint slowmaxfreq, pll_delay, slowclk;
++	uint pll_on_delay, fref_sel_delay;
++
++	pll_delay = PLL_DELAY;
++
++	/*
++	 * If the slow clock is not sourced by the xtal then
++	 * add the xtal_on_delay since the xtal will also be
++	 * powered down by dynamic clk control logic.
++	 */
++
++	slowclk = ai_slowclk_src(sih, cc);
++	if (slowclk != SCC_SS_XTAL)
++		pll_delay += XTAL_ON_DELAY;
++
++	/* Starting with 4318 it is ILP that is used for the delays */
++	slowmaxfreq =
++	    ai_slowclk_freq(sih, false, cc);
++
++	pll_on_delay = ((slowmaxfreq * pll_delay) + 999999) / 1000000;
++	fref_sel_delay = ((slowmaxfreq * FREF_DELAY) + 999999) / 1000000;
++
++	bcma_write32(cc, CHIPCREGOFFS(pll_on_delay), pll_on_delay);
++	bcma_write32(cc, CHIPCREGOFFS(fref_sel_delay), fref_sel_delay);
++}
++
++/* initialize power control delay registers */
++void ai_clkctl_init(struct si_pub *sih)
++{
++	struct bcma_device *cc;
++
++	if (!(ai_get_cccaps(sih) & CC_CAP_PWR_CTL))
++		return;
++
++	cc = ai_findcore(sih, BCMA_CORE_CHIPCOMMON, 0);
++	if (cc == NULL)
++		return;
++
++	/* set all Instaclk chip ILP to 1 MHz */
++	bcma_maskset32(cc, CHIPCREGOFFS(system_clk_ctl), SYCC_CD_MASK,
++		       (ILP_DIV_1MHZ << SYCC_CD_SHIFT));
++
++	ai_clkctl_setdelay(sih, cc);
++}
++
++/*
++ * return the value suitable for writing to the
++ * dot11 core FAST_PWRUP_DELAY register
++ */
++u16 ai_clkctl_fast_pwrup_delay(struct si_pub *sih)
++{
++	struct si_info *sii;
++	struct bcma_device *cc;
++	uint slowminfreq;
++	u16 fpdelay;
++
++	sii = (struct si_info *)sih;
++	if (ai_get_cccaps(sih) & CC_CAP_PMU) {
++		fpdelay = si_pmu_fast_pwrup_delay(sih);
++		return fpdelay;
++	}
++
++	if (!(ai_get_cccaps(sih) & CC_CAP_PWR_CTL))
++		return 0;
++
++	fpdelay = 0;
++	cc = ai_findcore(sih, CC_CORE_ID, 0);
++	if (cc) {
++		slowminfreq = ai_slowclk_freq(sih, false, cc);
++		fpdelay = (((bcma_read32(cc, CHIPCREGOFFS(pll_on_delay)) + 2)
++			    * 1000000) + (slowminfreq - 1)) / slowminfreq;
++	}
++	return fpdelay;
++}
++
++/*
++ *  clock control policy function throught chipcommon
++ *
++ *    set dynamic clk control mode (forceslow, forcefast, dynamic)
++ *    returns true if we are forcing fast clock
++ *    this is a wrapper over the next internal function
++ *      to allow flexible policy settings for outside caller
++ */
++bool ai_clkctl_cc(struct si_pub *sih, enum bcma_clkmode mode)
++{
++	struct si_info *sii;
++	struct bcma_device *cc;
++
++	sii = (struct si_info *)sih;
++
++	if (PCI_FORCEHT(sih))
++		return mode == BCMA_CLKMODE_FAST;
++
++	cc = ai_findcore(&sii->pub, BCMA_CORE_CHIPCOMMON, 0);
++	bcma_core_set_clockmode(cc, mode);
++	return mode == BCMA_CLKMODE_FAST;
++}
++
++void ai_pci_up(struct si_pub *sih)
++{
++	struct si_info *sii;
++	struct bcma_device *cc;
++
++	sii = (struct si_info *)sih;
++
++	if (PCI_FORCEHT(sih)) {
++		cc = ai_findcore(&sii->pub, BCMA_CORE_CHIPCOMMON, 0);
++		bcma_core_set_clockmode(cc, BCMA_CLKMODE_FAST);
++	}
++
++	if (PCIE(sih))
++		bcma_core_pci_extend_L1timer(&sii->icbus->drv_pci, true);
++}
++
++/* Unconfigure and/or apply various WARs when going down */
++void ai_pci_down(struct si_pub *sih)
++{
++	struct si_info *sii;
++	struct bcma_device *cc;
++
++	sii = (struct si_info *)sih;
++
++	/* release FORCEHT since chip is going to "down" state */
++	if (PCI_FORCEHT(sih)) {
++		cc = ai_findcore(&sii->pub, BCMA_CORE_CHIPCOMMON, 0);
++		bcma_core_set_clockmode(cc, BCMA_CLKMODE_DYNAMIC);
++	}
++
++	if (PCIE(sih))
++		bcma_core_pci_extend_L1timer(&sii->icbus->drv_pci, false);
++}
++
++/* Enable BT-COEX & Ex-PA for 4313 */
++void ai_epa_4313war(struct si_pub *sih)
++{
++	struct bcma_device *cc;
++
++	cc = ai_findcore(sih, CC_CORE_ID, 0);
++
++	/* EPA Fix */
++	bcma_set32(cc, CHIPCREGOFFS(gpiocontrol), GPIO_CTRL_EPA_EN_MASK);
++}
++
++/* check if the device is removed */
++bool ai_deviceremoved(struct si_pub *sih)
++{
++	u32 w;
++	struct si_info *sii;
++
++	sii = (struct si_info *)sih;
++
++	if (sii->icbus->hosttype != BCMA_HOSTTYPE_PCI)
++		return false;
++
++	pci_read_config_dword(sii->pcibus, PCI_VENDOR_ID, &w);
++	if ((w & 0xFFFF) != PCI_VENDOR_ID_BROADCOM)
++		return true;
++
++	return false;
++}
++
++uint ai_get_buscoretype(struct si_pub *sih)
++{
++	struct si_info *sii = (struct si_info *)sih;
++	return sii->buscore->id.id;
++}
++
++uint ai_get_buscorerev(struct si_pub *sih)
++{
++	struct si_info *sii = (struct si_info *)sih;
++	return sii->buscore->id.rev;
++}
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/aiutils.h b/drivers/net/wireless/brcm80211/brcmsmac/aiutils.h
+new file mode 100644
+index 0000000..d9f04a6
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmsmac/aiutils.h
+@@ -0,0 +1,248 @@
++/*
++ * Copyright (c) 2011 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#ifndef	_BRCM_AIUTILS_H_
++#define	_BRCM_AIUTILS_H_
++
++#include <linux/bcma/bcma.h>
++
++#include "types.h"
++
++/*
++ * SOC Interconnect Address Map.
++ * All regions may not exist on all chips.
++ */
++/* each core gets 4Kbytes for registers */
++#define SI_CORE_SIZE		0x1000
++/*
++ * Max cores (this is arbitrary, for software
++ * convenience and could be changed if we
++ * make any larger chips
++ */
++#define	SI_MAXCORES		16
++
++/* Client Mode sb2pcitranslation2 size in bytes */
++#define SI_PCI_DMA_SZ		0x40000000
++
++/* PCIE Client Mode sb2pcitranslation2 (2 ZettaBytes), high 32 bits */
++#define SI_PCIE_DMA_H32		0x80000000
++
++/* chipcommon being the first core: */
++#define	SI_CC_IDX		0
++
++/* SOC Interconnect types (aka chip types) */
++#define	SOCI_AI			1
++
++/* A register that is common to all cores to
++ * communicate w/PMU regarding clock control.
++ */
++#define SI_CLK_CTL_ST		0x1e0	/* clock control and status */
++
++/* clk_ctl_st register */
++#define	CCS_FORCEALP		0x00000001	/* force ALP request */
++#define	CCS_FORCEHT		0x00000002	/* force HT request */
++#define	CCS_FORCEILP		0x00000004	/* force ILP request */
++#define	CCS_ALPAREQ		0x00000008	/* ALP Avail Request */
++#define	CCS_HTAREQ		0x00000010	/* HT Avail Request */
++#define	CCS_FORCEHWREQOFF	0x00000020	/* Force HW Clock Request Off */
++#define CCS_ERSRC_REQ_MASK	0x00000700	/* external resource requests */
++#define CCS_ERSRC_REQ_SHIFT	8
++#define	CCS_ALPAVAIL		0x00010000	/* ALP is available */
++#define	CCS_HTAVAIL		0x00020000	/* HT is available */
++#define CCS_BP_ON_APL		0x00040000	/* RO: running on ALP clock */
++#define CCS_BP_ON_HT		0x00080000	/* RO: running on HT clock */
++#define CCS_ERSRC_STS_MASK	0x07000000	/* external resource status */
++#define CCS_ERSRC_STS_SHIFT	24
++
++/* HT avail in chipc and pcmcia on 4328a0 */
++#define	CCS0_HTAVAIL		0x00010000
++/* ALP avail in chipc and pcmcia on 4328a0 */
++#define	CCS0_ALPAVAIL		0x00020000
++
++/* Not really related to SOC Interconnect, but a couple of software
++ * conventions for the use the flash space:
++ */
++
++/* Minumum amount of flash we support */
++#define FLASH_MIN		0x00020000	/* Minimum flash size */
++
++#define	CC_SROM_OTP		0x800	/* SROM/OTP address space */
++
++/* gpiotimerval */
++#define GPIO_ONTIME_SHIFT	16
++
++/* Fields in clkdiv */
++#define	CLKD_OTP		0x000f0000
++#define	CLKD_OTP_SHIFT		16
++
++/* Package IDs */
++#define	BCM4717_PKG_ID		9	/* 4717 package id */
++#define	BCM4718_PKG_ID		10	/* 4718 package id */
++#define BCM43224_FAB_SMIC	0xa	/* the chip is manufactured by SMIC */
++
++/* these are router chips */
++#define	BCM4716_CHIP_ID		0x4716	/* 4716 chipcommon chipid */
++#define	BCM47162_CHIP_ID	47162	/* 47162 chipcommon chipid */
++#define	BCM4748_CHIP_ID		0x4748	/* 4716 chipcommon chipid (OTP, RBBU) */
++
++/* dynamic clock control defines */
++#define	LPOMINFREQ		25000	/* low power oscillator min */
++#define	LPOMAXFREQ		43000	/* low power oscillator max */
++#define	XTALMINFREQ		19800000	/* 20 MHz - 1% */
++#define	XTALMAXFREQ		20200000	/* 20 MHz + 1% */
++#define	PCIMINFREQ		25000000	/* 25 MHz */
++#define	PCIMAXFREQ		34000000	/* 33 MHz + fudge */
++
++#define	ILP_DIV_5MHZ		0	/* ILP = 5 MHz */
++#define	ILP_DIV_1MHZ		4	/* ILP = 1 MHz */
++
++/* clkctl xtal what flags */
++#define	XTAL			0x1	/* primary crystal oscillator (2050) */
++#define	PLL			0x2	/* main chip pll */
++
++/* GPIO usage priorities */
++#define GPIO_DRV_PRIORITY	0	/* Driver */
++#define GPIO_APP_PRIORITY	1	/* Application */
++#define GPIO_HI_PRIORITY	2	/* Highest priority. Ignore GPIO
++					 * reservation
++					 */
++
++/* GPIO pull up/down */
++#define GPIO_PULLUP		0
++#define GPIO_PULLDN		1
++
++/* GPIO event regtype */
++#define GPIO_REGEVT		0	/* GPIO register event */
++#define GPIO_REGEVT_INTMSK	1	/* GPIO register event int mask */
++#define GPIO_REGEVT_INTPOL	2	/* GPIO register event int polarity */
++
++/* device path */
++#define SI_DEVPATH_BUFSZ	16	/* min buffer size in bytes */
++
++/* SI routine enumeration: to be used by update function with multiple hooks */
++#define	SI_DOATTACH	1
++#define SI_PCIDOWN	2
++#define SI_PCIUP	3
++
++/*
++ * Data structure to export all chip specific common variables
++ *   public (read-only) portion of aiutils handle returned by si_attach()
++ */
++struct si_pub {
++	int ccrev;		/* chip common core rev */
++	u32 cccaps;		/* chip common capabilities */
++	int pmurev;		/* pmu core rev */
++	u32 pmucaps;		/* pmu capabilities */
++	uint boardtype;		/* board type */
++	uint boardvendor;	/* board vendor */
++	uint chip;		/* chip number */
++	uint chiprev;		/* chip revision */
++	uint chippkg;		/* chip package option */
++};
++
++struct pci_dev;
++
++struct gpioh_item {
++	void *arg;
++	bool level;
++	void (*handler) (u32 stat, void *arg);
++	u32 event;
++	struct gpioh_item *next;
++};
++
++/* misc si info needed by some of the routines */
++struct si_info {
++	struct si_pub pub;	/* back plane public state (must be first) */
++	struct bcma_bus *icbus;	/* handle to soc interconnect bus */
++	struct pci_dev *pcibus;	/* handle to pci bus */
++	struct bcma_device *buscore;
++
++	u32 chipst;		/* chip status */
++};
++
++/*
++ * Many of the routines below take an 'sih' handle as their first arg.
++ * Allocate this by calling si_attach().  Free it by calling si_detach().
++ * At any one time, the sih is logically focused on one particular si core
++ * (the "current core").
++ * Use si_setcore() or si_setcoreidx() to change the association to another core
++ */
++
++
++/* AMBA Interconnect exported externs */
++extern struct bcma_device *ai_findcore(struct si_pub *sih,
++				       u16 coreid, u16 coreunit);
++extern u32 ai_core_cflags(struct bcma_device *core, u32 mask, u32 val);
++
++/* === exported functions === */
++extern struct si_pub *ai_attach(struct bcma_bus *pbus);
++extern void ai_detach(struct si_pub *sih);
++extern uint ai_cc_reg(struct si_pub *sih, uint regoff, u32 mask, u32 val);
++extern void ai_clkctl_init(struct si_pub *sih);
++extern u16 ai_clkctl_fast_pwrup_delay(struct si_pub *sih);
++extern bool ai_clkctl_cc(struct si_pub *sih, uint mode);
++extern bool ai_deviceremoved(struct si_pub *sih);
++
++extern void ai_pci_down(struct si_pub *sih);
++extern void ai_pci_up(struct si_pub *sih);
++
++/* Enable Ex-PA for 4313 */
++extern void ai_epa_4313war(struct si_pub *sih);
++
++extern uint ai_get_buscoretype(struct si_pub *sih);
++extern uint ai_get_buscorerev(struct si_pub *sih);
++
++static inline u32 ai_get_cccaps(struct si_pub *sih)
++{
++	return sih->cccaps;
++}
++
++static inline int ai_get_pmurev(struct si_pub *sih)
++{
++	return sih->pmurev;
++}
++
++static inline u32 ai_get_pmucaps(struct si_pub *sih)
++{
++	return sih->pmucaps;
++}
++
++static inline uint ai_get_boardtype(struct si_pub *sih)
++{
++	return sih->boardtype;
++}
++
++static inline uint ai_get_boardvendor(struct si_pub *sih)
++{
++	return sih->boardvendor;
++}
++
++static inline uint ai_get_chip_id(struct si_pub *sih)
++{
++	return sih->chip;
++}
++
++static inline uint ai_get_chiprev(struct si_pub *sih)
++{
++	return sih->chiprev;
++}
++
++static inline uint ai_get_chippkg(struct si_pub *sih)
++{
++	return sih->chippkg;
++}
++
++#endif				/* _BRCM_AIUTILS_H_ */
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
+new file mode 100644
+index 0000000..95b5902
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
+@@ -0,0 +1,1236 @@
++/*
++ * Copyright (c) 2010 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++#include <net/mac80211.h>
++
++#include "rate.h"
++#include "scb.h"
++#include "phy/phy_hal.h"
++#include "antsel.h"
++#include "main.h"
++#include "ampdu.h"
++
++/* max number of mpdus in an ampdu */
++#define AMPDU_MAX_MPDU			32
++/* max number of mpdus in an ampdu to a legacy */
++#define AMPDU_NUM_MPDU_LEGACY		16
++/* max Tx ba window size (in pdu) */
++#define AMPDU_TX_BA_MAX_WSIZE		64
++/* default Tx ba window size (in pdu) */
++#define AMPDU_TX_BA_DEF_WSIZE		64
++/* default Rx ba window size (in pdu) */
++#define AMPDU_RX_BA_DEF_WSIZE		64
++/* max Rx ba window size (in pdu) */
++#define AMPDU_RX_BA_MAX_WSIZE		64
++/* max dur of tx ampdu (in msec) */
++#define	AMPDU_MAX_DUR			5
++/* default tx retry limit */
++#define AMPDU_DEF_RETRY_LIMIT		5
++/* default tx retry limit at reg rate */
++#define AMPDU_DEF_RR_RETRY_LIMIT	2
++/* default weight of ampdu in txfifo */
++#define AMPDU_DEF_TXPKT_WEIGHT		2
++/* default ffpld reserved bytes */
++#define AMPDU_DEF_FFPLD_RSVD		2048
++/* # of inis to be freed on detach */
++#define AMPDU_INI_FREE			10
++/* max # of mpdus released at a time */
++#define	AMPDU_SCB_MAX_RELEASE		20
++
++#define NUM_FFPLD_FIFO 4	/* number of fifo concerned by pre-loading */
++#define FFPLD_TX_MAX_UNFL   200	/* default value of the average number of ampdu
++				 * without underflows
++				 */
++#define FFPLD_MPDU_SIZE 1800	/* estimate of maximum mpdu size */
++#define FFPLD_MAX_MCS 23	/* we don't deal with mcs 32 */
++#define FFPLD_PLD_INCR 1000	/* increments in bytes */
++#define FFPLD_MAX_AMPDU_CNT 5000	/* maximum number of ampdu we
++					 * accumulate between resets.
++					 */
++
++#define AMPDU_DELIMITER_LEN	4
++
++/* max allowed number of mpdus in an ampdu (2 streams) */
++#define AMPDU_NUM_MPDU		16
++
++#define TX_SEQ_TO_INDEX(seq) ((seq) % AMPDU_TX_BA_MAX_WSIZE)
++
++/* max possible overhead per mpdu in the ampdu; 3 is for roundup if needed */
++#define AMPDU_MAX_MPDU_OVERHEAD (FCS_LEN + DOT11_ICV_AES_LEN +\
++	AMPDU_DELIMITER_LEN + 3\
++	+ DOT11_A4_HDR_LEN + DOT11_QOS_LEN + DOT11_IV_MAX_LEN)
++
++/* modulo add/sub, bound = 2^k */
++#define MODADD_POW2(x, y, bound) (((x) + (y)) & ((bound) - 1))
++#define MODSUB_POW2(x, y, bound) (((x) - (y)) & ((bound) - 1))
++
++/* structure to hold tx fifo information and pre-loading state
++ * counters specific to tx underflows of ampdus
++ * some counters might be redundant with the ones in wlc or ampdu structures.
++ * This allows to maintain a specific state independently of
++ * how often and/or when the wlc counters are updated.
++ *
++ * ampdu_pld_size: number of bytes to be pre-loaded
++ * mcs2ampdu_table: per-mcs max # of mpdus in an ampdu
++ * prev_txfunfl: num of underflows last read from the HW macstats counter
++ * accum_txfunfl: num of underflows since we modified pld params
++ * accum_txampdu: num of tx ampdu since we modified pld params
++ * prev_txampdu: previous reading of tx ampdu
++ * dmaxferrate: estimated dma avg xfer rate in kbits/sec
++ */
++struct brcms_fifo_info {
++	u16 ampdu_pld_size;
++	u8 mcs2ampdu_table[FFPLD_MAX_MCS + 1];
++	u16 prev_txfunfl;
++	u32 accum_txfunfl;
++	u32 accum_txampdu;
++	u32 prev_txampdu;
++	u32 dmaxferrate;
++};
++
++/* AMPDU module specific state
++ *
++ * wlc: pointer to main wlc structure
++ * scb_handle: scb cubby handle to retrieve data from scb
++ * ini_enable: per-tid initiator enable/disable of ampdu
++ * ba_tx_wsize: Tx ba window size (in pdu)
++ * ba_rx_wsize: Rx ba window size (in pdu)
++ * retry_limit: mpdu transmit retry limit
++ * rr_retry_limit: mpdu transmit retry limit at regular rate
++ * retry_limit_tid: per-tid mpdu transmit retry limit
++ * rr_retry_limit_tid: per-tid mpdu transmit retry limit at regular rate
++ * mpdu_density: min mpdu spacing (0-7) ==> 2^(x-1)/8 usec
++ * max_pdu: max pdus allowed in ampdu
++ * dur: max duration of an ampdu (in msec)
++ * txpkt_weight: weight of ampdu in txfifo; reduces rate lag
++ * rx_factor: maximum rx ampdu factor (0-3) ==> 2^(13+x) bytes
++ * ffpld_rsvd: number of bytes to reserve for preload
++ * max_txlen: max size of ampdu per mcs, bw and sgi
++ * mfbr: enable multiple fallback rate
++ * tx_max_funl: underflows should be kept such that
++ *		(tx_max_funfl*underflows) < tx frames
++ * fifo_tb: table of fifo infos
++ */
++struct ampdu_info {
++	struct brcms_c_info *wlc;
++	int scb_handle;
++	u8 ini_enable[AMPDU_MAX_SCB_TID];
++	u8 ba_tx_wsize;
++	u8 ba_rx_wsize;
++	u8 retry_limit;
++	u8 rr_retry_limit;
++	u8 retry_limit_tid[AMPDU_MAX_SCB_TID];
++	u8 rr_retry_limit_tid[AMPDU_MAX_SCB_TID];
++	u8 mpdu_density;
++	s8 max_pdu;
++	u8 dur;
++	u8 txpkt_weight;
++	u8 rx_factor;
++	u32 ffpld_rsvd;
++	u32 max_txlen[MCS_TABLE_SIZE][2][2];
++	bool mfbr;
++	u32 tx_max_funl;
++	struct brcms_fifo_info fifo_tb[NUM_FFPLD_FIFO];
++};
++
++/* used for flushing ampdu packets */
++struct cb_del_ampdu_pars {
++	struct ieee80211_sta *sta;
++	u16 tid;
++};
++
++static void brcms_c_scb_ampdu_update_max_txlen(struct ampdu_info *ampdu, u8 dur)
++{
++	u32 rate, mcs;
++
++	for (mcs = 0; mcs < MCS_TABLE_SIZE; mcs++) {
++		/* rate is in Kbps; dur is in msec ==> len = (rate * dur) / 8 */
++		/* 20MHz, No SGI */
++		rate = mcs_2_rate(mcs, false, false);
++		ampdu->max_txlen[mcs][0][0] = (rate * dur) >> 3;
++		/* 40 MHz, No SGI */
++		rate = mcs_2_rate(mcs, true, false);
++		ampdu->max_txlen[mcs][1][0] = (rate * dur) >> 3;
++		/* 20MHz, SGI */
++		rate = mcs_2_rate(mcs, false, true);
++		ampdu->max_txlen[mcs][0][1] = (rate * dur) >> 3;
++		/* 40 MHz, SGI */
++		rate = mcs_2_rate(mcs, true, true);
++		ampdu->max_txlen[mcs][1][1] = (rate * dur) >> 3;
++	}
++}
++
++static bool brcms_c_ampdu_cap(struct ampdu_info *ampdu)
++{
++	if (BRCMS_PHY_11N_CAP(ampdu->wlc->band))
++		return true;
++	else
++		return false;
++}
++
++static int brcms_c_ampdu_set(struct ampdu_info *ampdu, bool on)
++{
++	struct brcms_c_info *wlc = ampdu->wlc;
++
++	wlc->pub->_ampdu = false;
++
++	if (on) {
++		if (!(wlc->pub->_n_enab & SUPPORT_11N)) {
++			wiphy_err(ampdu->wlc->wiphy, "wl%d: driver not "
++				"nmode enabled\n", wlc->pub->unit);
++			return -ENOTSUPP;
++		}
++		if (!brcms_c_ampdu_cap(ampdu)) {
++			wiphy_err(ampdu->wlc->wiphy, "wl%d: device not "
++				"ampdu capable\n", wlc->pub->unit);
++			return -ENOTSUPP;
++		}
++		wlc->pub->_ampdu = on;
++	}
++
++	return 0;
++}
++
++static void brcms_c_ffpld_init(struct ampdu_info *ampdu)
++{
++	int i, j;
++	struct brcms_fifo_info *fifo;
++
++	for (j = 0; j < NUM_FFPLD_FIFO; j++) {
++		fifo = (ampdu->fifo_tb + j);
++		fifo->ampdu_pld_size = 0;
++		for (i = 0; i <= FFPLD_MAX_MCS; i++)
++			fifo->mcs2ampdu_table[i] = 255;
++		fifo->dmaxferrate = 0;
++		fifo->accum_txampdu = 0;
++		fifo->prev_txfunfl = 0;
++		fifo->accum_txfunfl = 0;
++
++	}
++}
++
++struct ampdu_info *brcms_c_ampdu_attach(struct brcms_c_info *wlc)
++{
++	struct ampdu_info *ampdu;
++	int i;
++
++	ampdu = kzalloc(sizeof(struct ampdu_info), GFP_ATOMIC);
++	if (!ampdu)
++		return NULL;
++
++	ampdu->wlc = wlc;
++
++	for (i = 0; i < AMPDU_MAX_SCB_TID; i++)
++		ampdu->ini_enable[i] = true;
++	/* Disable ampdu for VO by default */
++	ampdu->ini_enable[PRIO_8021D_VO] = false;
++	ampdu->ini_enable[PRIO_8021D_NC] = false;
++
++	/* Disable ampdu for BK by default since not enough fifo space */
++	ampdu->ini_enable[PRIO_8021D_NONE] = false;
++	ampdu->ini_enable[PRIO_8021D_BK] = false;
++
++	ampdu->ba_tx_wsize = AMPDU_TX_BA_DEF_WSIZE;
++	ampdu->ba_rx_wsize = AMPDU_RX_BA_DEF_WSIZE;
++	ampdu->mpdu_density = AMPDU_DEF_MPDU_DENSITY;
++	ampdu->max_pdu = AUTO;
++	ampdu->dur = AMPDU_MAX_DUR;
++	ampdu->txpkt_weight = AMPDU_DEF_TXPKT_WEIGHT;
++
++	ampdu->ffpld_rsvd = AMPDU_DEF_FFPLD_RSVD;
++	/*
++	 * bump max ampdu rcv size to 64k for all 11n
++	 * devices except 4321A0 and 4321A1
++	 */
++	if (BRCMS_ISNPHY(wlc->band) && NREV_LT(wlc->band->phyrev, 2))
++		ampdu->rx_factor = IEEE80211_HT_MAX_AMPDU_32K;
++	else
++		ampdu->rx_factor = IEEE80211_HT_MAX_AMPDU_64K;
++	ampdu->retry_limit = AMPDU_DEF_RETRY_LIMIT;
++	ampdu->rr_retry_limit = AMPDU_DEF_RR_RETRY_LIMIT;
++
++	for (i = 0; i < AMPDU_MAX_SCB_TID; i++) {
++		ampdu->retry_limit_tid[i] = ampdu->retry_limit;
++		ampdu->rr_retry_limit_tid[i] = ampdu->rr_retry_limit;
++	}
++
++	brcms_c_scb_ampdu_update_max_txlen(ampdu, ampdu->dur);
++	ampdu->mfbr = false;
++	/* try to set ampdu to the default value */
++	brcms_c_ampdu_set(ampdu, wlc->pub->_ampdu);
++
++	ampdu->tx_max_funl = FFPLD_TX_MAX_UNFL;
++	brcms_c_ffpld_init(ampdu);
++
++	return ampdu;
++}
++
++void brcms_c_ampdu_detach(struct ampdu_info *ampdu)
++{
++	kfree(ampdu);
++}
++
++static void brcms_c_scb_ampdu_update_config(struct ampdu_info *ampdu,
++					    struct scb *scb)
++{
++	struct scb_ampdu *scb_ampdu = &scb->scb_ampdu;
++	int i;
++
++	scb_ampdu->max_pdu = AMPDU_NUM_MPDU;
++
++	/* go back to legacy size if some preloading is occurring */
++	for (i = 0; i < NUM_FFPLD_FIFO; i++) {
++		if (ampdu->fifo_tb[i].ampdu_pld_size > FFPLD_PLD_INCR)
++			scb_ampdu->max_pdu = AMPDU_NUM_MPDU_LEGACY;
++	}
++
++	/* apply user override */
++	if (ampdu->max_pdu != AUTO)
++		scb_ampdu->max_pdu = (u8) ampdu->max_pdu;
++
++	scb_ampdu->release = min_t(u8, scb_ampdu->max_pdu,
++				   AMPDU_SCB_MAX_RELEASE);
++
++	if (scb_ampdu->max_rx_ampdu_bytes)
++		scb_ampdu->release = min_t(u8, scb_ampdu->release,
++			scb_ampdu->max_rx_ampdu_bytes / 1600);
++
++	scb_ampdu->release = min(scb_ampdu->release,
++				 ampdu->fifo_tb[TX_AC_BE_FIFO].
++				 mcs2ampdu_table[FFPLD_MAX_MCS]);
++}
++
++static void brcms_c_scb_ampdu_update_config_all(struct ampdu_info *ampdu)
++{
++	brcms_c_scb_ampdu_update_config(ampdu, &ampdu->wlc->pri_scb);
++}
++
++static void brcms_c_ffpld_calc_mcs2ampdu_table(struct ampdu_info *ampdu, int f)
++{
++	int i;
++	u32 phy_rate, dma_rate, tmp;
++	u8 max_mpdu;
++	struct brcms_fifo_info *fifo = (ampdu->fifo_tb + f);
++
++	/* recompute the dma rate */
++	/* note : we divide/multiply by 100 to avoid integer overflows */
++	max_mpdu = min_t(u8, fifo->mcs2ampdu_table[FFPLD_MAX_MCS],
++			 AMPDU_NUM_MPDU_LEGACY);
++	phy_rate = mcs_2_rate(FFPLD_MAX_MCS, true, false);
++	dma_rate =
++	    (((phy_rate / 100) *
++	      (max_mpdu * FFPLD_MPDU_SIZE - fifo->ampdu_pld_size))
++	     / (max_mpdu * FFPLD_MPDU_SIZE)) * 100;
++	fifo->dmaxferrate = dma_rate;
++
++	/* fill up the mcs2ampdu table; do not recalc the last mcs */
++	dma_rate = dma_rate >> 7;
++	for (i = 0; i < FFPLD_MAX_MCS; i++) {
++		/* shifting to keep it within integer range */
++		phy_rate = mcs_2_rate(i, true, false) >> 7;
++		if (phy_rate > dma_rate) {
++			tmp = ((fifo->ampdu_pld_size * phy_rate) /
++			       ((phy_rate - dma_rate) * FFPLD_MPDU_SIZE)) + 1;
++			tmp = min_t(u32, tmp, 255);
++			fifo->mcs2ampdu_table[i] = (u8) tmp;
++		}
++	}
++}
++
++/* evaluate the dma transfer rate using the tx underflows as feedback.
++ * If necessary, increase tx fifo preloading. If not enough,
++ * decrease maximum ampdu size for each mcs till underflows stop
++ * Return 1 if pre-loading not active, -1 if not an underflow event,
++ * 0 if pre-loading module took care of the event.
++ */
++static int brcms_c_ffpld_check_txfunfl(struct brcms_c_info *wlc, int fid)
++{
++	struct ampdu_info *ampdu = wlc->ampdu;
++	u32 phy_rate = mcs_2_rate(FFPLD_MAX_MCS, true, false);
++	u32 txunfl_ratio;
++	u8 max_mpdu;
++	u32 current_ampdu_cnt = 0;
++	u16 max_pld_size;
++	u32 new_txunfl;
++	struct brcms_fifo_info *fifo = (ampdu->fifo_tb + fid);
++	uint xmtfifo_sz;
++	u16 cur_txunfl;
++
++	/* return if we got here for a different reason than underflows */
++	cur_txunfl = brcms_b_read_shm(wlc->hw,
++				      M_UCODE_MACSTAT +
++				      offsetof(struct macstat, txfunfl[fid]));
++	new_txunfl = (u16) (cur_txunfl - fifo->prev_txfunfl);
++	if (new_txunfl == 0) {
++		BCMMSG(wlc->wiphy, "TX status FRAG set but no tx underflows\n");
++		return -1;
++	}
++	fifo->prev_txfunfl = cur_txunfl;
++
++	if (!ampdu->tx_max_funl)
++		return 1;
++
++	/* check if fifo is big enough */
++	if (brcms_b_xmtfifo_sz_get(wlc->hw, fid, &xmtfifo_sz))
++		return -1;
++
++	if ((TXFIFO_SIZE_UNIT * (u32) xmtfifo_sz) <= ampdu->ffpld_rsvd)
++		return 1;
++
++	max_pld_size = TXFIFO_SIZE_UNIT * xmtfifo_sz - ampdu->ffpld_rsvd;
++	fifo->accum_txfunfl += new_txunfl;
++
++	/* we need to wait for at least 10 underflows */
++	if (fifo->accum_txfunfl < 10)
++		return 0;
++
++	BCMMSG(wlc->wiphy, "ampdu_count %d  tx_underflows %d\n",
++		current_ampdu_cnt, fifo->accum_txfunfl);
++
++	/*
++	   compute the current ratio of tx unfl per ampdu.
++	   When the current ampdu count becomes too
++	   big while the ratio remains small, we reset
++	   the current count in order to not
++	   introduce too big of a latency in detecting a
++	   large amount of tx underflows later.
++	 */
++
++	txunfl_ratio = current_ampdu_cnt / fifo->accum_txfunfl;
++
++	if (txunfl_ratio > ampdu->tx_max_funl) {
++		if (current_ampdu_cnt >= FFPLD_MAX_AMPDU_CNT)
++			fifo->accum_txfunfl = 0;
++
++		return 0;
++	}
++	max_mpdu = min_t(u8, fifo->mcs2ampdu_table[FFPLD_MAX_MCS],
++			 AMPDU_NUM_MPDU_LEGACY);
++
++	/* In case max value max_pdu is already lower than
++	   the fifo depth, there is nothing more we can do.
++	 */
++
++	if (fifo->ampdu_pld_size >= max_mpdu * FFPLD_MPDU_SIZE) {
++		fifo->accum_txfunfl = 0;
++		return 0;
++	}
++
++	if (fifo->ampdu_pld_size < max_pld_size) {
++
++		/* increment by TX_FIFO_PLD_INC bytes */
++		fifo->ampdu_pld_size += FFPLD_PLD_INCR;
++		if (fifo->ampdu_pld_size > max_pld_size)
++			fifo->ampdu_pld_size = max_pld_size;
++
++		/* update scb release size */
++		brcms_c_scb_ampdu_update_config_all(ampdu);
++
++		/*
++		 * compute a new dma xfer rate for max_mpdu @ max mcs.
++		 * This is the minimum dma rate that can achieve no
++		 * underflow condition for the current mpdu size.
++		 *
++		 * note : we divide/multiply by 100 to avoid integer overflows
++		 */
++		fifo->dmaxferrate =
++		    (((phy_rate / 100) *
++		      (max_mpdu * FFPLD_MPDU_SIZE - fifo->ampdu_pld_size))
++		     / (max_mpdu * FFPLD_MPDU_SIZE)) * 100;
++
++		BCMMSG(wlc->wiphy, "DMA estimated transfer rate %d; "
++			"pre-load size %d\n",
++			fifo->dmaxferrate, fifo->ampdu_pld_size);
++	} else {
++
++		/* decrease ampdu size */
++		if (fifo->mcs2ampdu_table[FFPLD_MAX_MCS] > 1) {
++			if (fifo->mcs2ampdu_table[FFPLD_MAX_MCS] == 255)
++				fifo->mcs2ampdu_table[FFPLD_MAX_MCS] =
++				    AMPDU_NUM_MPDU_LEGACY - 1;
++			else
++				fifo->mcs2ampdu_table[FFPLD_MAX_MCS] -= 1;
++
++			/* recompute the table */
++			brcms_c_ffpld_calc_mcs2ampdu_table(ampdu, fid);
++
++			/* update scb release size */
++			brcms_c_scb_ampdu_update_config_all(ampdu);
++		}
++	}
++	fifo->accum_txfunfl = 0;
++	return 0;
++}
++
++void
++brcms_c_ampdu_tx_operational(struct brcms_c_info *wlc, u8 tid,
++	u8 ba_wsize,		/* negotiated ba window size (in pdu) */
++	uint max_rx_ampdu_bytes) /* from ht_cap in beacon */
++{
++	struct scb_ampdu *scb_ampdu;
++	struct scb_ampdu_tid_ini *ini;
++	struct ampdu_info *ampdu = wlc->ampdu;
++	struct scb *scb = &wlc->pri_scb;
++	scb_ampdu = &scb->scb_ampdu;
++
++	if (!ampdu->ini_enable[tid]) {
++		wiphy_err(ampdu->wlc->wiphy, "%s: Rejecting tid %d\n",
++			  __func__, tid);
++		return;
++	}
++
++	ini = &scb_ampdu->ini[tid];
++	ini->tid = tid;
++	ini->scb = scb_ampdu->scb;
++	ini->ba_wsize = ba_wsize;
++	scb_ampdu->max_rx_ampdu_bytes = max_rx_ampdu_bytes;
++}
++
++int
++brcms_c_sendampdu(struct ampdu_info *ampdu, struct brcms_txq_info *qi,
++	      struct sk_buff **pdu, int prec)
++{
++	struct brcms_c_info *wlc;
++	struct sk_buff *p, *pkt[AMPDU_MAX_MPDU];
++	u8 tid, ndelim;
++	int err = 0;
++	u8 preamble_type = BRCMS_GF_PREAMBLE;
++	u8 fbr_preamble_type = BRCMS_GF_PREAMBLE;
++	u8 rts_preamble_type = BRCMS_LONG_PREAMBLE;
++	u8 rts_fbr_preamble_type = BRCMS_LONG_PREAMBLE;
++
++	bool rr = true, fbr = false;
++	uint i, count = 0, fifo, seg_cnt = 0;
++	u16 plen, len, seq = 0, mcl, mch, index, frameid, dma_len = 0;
++	u32 ampdu_len, max_ampdu_bytes = 0;
++	struct d11txh *txh = NULL;
++	u8 *plcp;
++	struct ieee80211_hdr *h;
++	struct scb *scb;
++	struct scb_ampdu *scb_ampdu;
++	struct scb_ampdu_tid_ini *ini;
++	u8 mcs = 0;
++	bool use_rts = false, use_cts = false;
++	u32 rspec = 0, rspec_fallback = 0;
++	u32 rts_rspec = 0, rts_rspec_fallback = 0;
++	u16 mimo_ctlchbw = PHY_TXC1_BW_20MHZ;
++	struct ieee80211_rts *rts;
++	u8 rr_retry_limit;
++	struct brcms_fifo_info *f;
++	bool fbr_iscck;
++	struct ieee80211_tx_info *tx_info;
++	u16 qlen;
++	struct wiphy *wiphy;
++
++	wlc = ampdu->wlc;
++	wiphy = wlc->wiphy;
++	p = *pdu;
++
++	tid = (u8) (p->priority);
++
++	f = ampdu->fifo_tb + prio2fifo[tid];
++
++	scb = &wlc->pri_scb;
++	scb_ampdu = &scb->scb_ampdu;
++	ini = &scb_ampdu->ini[tid];
++
++	/* Let pressure continue to build ... */
++	qlen = pktq_plen(&qi->q, prec);
++	if (ini->tx_in_transit > 0 &&
++	    qlen < min(scb_ampdu->max_pdu, ini->ba_wsize))
++		/* Collect multiple MPDU's to be sent in the next AMPDU */
++		return -EBUSY;
++
++	/* at this point we intend to transmit an AMPDU */
++	rr_retry_limit = ampdu->rr_retry_limit_tid[tid];
++	ampdu_len = 0;
++	dma_len = 0;
++	while (p) {
++		struct ieee80211_tx_rate *txrate;
++
++		tx_info = IEEE80211_SKB_CB(p);
++		txrate = tx_info->status.rates;
++
++		if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
++			err = brcms_c_prep_pdu(wlc, p, &fifo);
++		} else {
++			wiphy_err(wiphy, "%s: AMPDU flag is off!\n", __func__);
++			*pdu = NULL;
++			err = 0;
++			break;
++		}
++
++		if (err) {
++			if (err == -EBUSY) {
++				wiphy_err(wiphy, "wl%d: sendampdu: "
++					  "prep_xdu retry; seq 0x%x\n",
++					  wlc->pub->unit, seq);
++				*pdu = p;
++				break;
++			}
++
++			/* error in the packet; reject it */
++			wiphy_err(wiphy, "wl%d: sendampdu: prep_xdu "
++				  "rejected; seq 0x%x\n", wlc->pub->unit, seq);
++			*pdu = NULL;
++			break;
++		}
++
++		/* pkt is good to be aggregated */
++		txh = (struct d11txh *) p->data;
++		plcp = (u8 *) (txh + 1);
++		h = (struct ieee80211_hdr *)(plcp + D11_PHY_HDR_LEN);
++		seq = le16_to_cpu(h->seq_ctrl) >> SEQNUM_SHIFT;
++		index = TX_SEQ_TO_INDEX(seq);
++
++		/* check mcl fields and test whether it can be agg'd */
++		mcl = le16_to_cpu(txh->MacTxControlLow);
++		mcl &= ~TXC_AMPDU_MASK;
++		fbr_iscck = !(le16_to_cpu(txh->XtraFrameTypes) & 0x3);
++		txh->PreloadSize = 0;	/* always default to 0 */
++
++		/*  Handle retry limits */
++		if (txrate[0].count <= rr_retry_limit) {
++			txrate[0].count++;
++			rr = true;
++			fbr = false;
++		} else {
++			fbr = true;
++			rr = false;
++			txrate[1].count++;
++		}
++
++		/* extract the length info */
++		len = fbr_iscck ? BRCMS_GET_CCK_PLCP_LEN(txh->FragPLCPFallback)
++		    : BRCMS_GET_MIMO_PLCP_LEN(txh->FragPLCPFallback);
++
++		/* retrieve null delimiter count */
++		ndelim = txh->RTSPLCPFallback[AMPDU_FBR_NULL_DELIM];
++		seg_cnt += 1;
++
++		BCMMSG(wlc->wiphy, "wl%d: mpdu %d plcp_len %d\n",
++			wlc->pub->unit, count, len);
++
++		/*
++		 * aggregateable mpdu. For ucode/hw agg,
++		 * test whether need to break or change the epoch
++		 */
++		if (count == 0) {
++			mcl |= (TXC_AMPDU_FIRST << TXC_AMPDU_SHIFT);
++			/* refill the bits since might be a retx mpdu */
++			mcl |= TXC_STARTMSDU;
++			rts = (struct ieee80211_rts *)&txh->rts_frame;
++
++			if (ieee80211_is_rts(rts->frame_control)) {
++				mcl |= TXC_SENDRTS;
++				use_rts = true;
++			}
++			if (ieee80211_is_cts(rts->frame_control)) {
++				mcl |= TXC_SENDCTS;
++				use_cts = true;
++			}
++		} else {
++			mcl |= (TXC_AMPDU_MIDDLE << TXC_AMPDU_SHIFT);
++			mcl &= ~(TXC_STARTMSDU | TXC_SENDRTS | TXC_SENDCTS);
++		}
++
++		len = roundup(len, 4);
++		ampdu_len += (len + (ndelim + 1) * AMPDU_DELIMITER_LEN);
++
++		dma_len += (u16) p->len;
++
++		BCMMSG(wlc->wiphy, "wl%d: ampdu_len %d"
++			" seg_cnt %d null delim %d\n",
++			wlc->pub->unit, ampdu_len, seg_cnt, ndelim);
++
++		txh->MacTxControlLow = cpu_to_le16(mcl);
++
++		/* this packet is added */
++		pkt[count++] = p;
++
++		/* patch the first MPDU */
++		if (count == 1) {
++			u8 plcp0, plcp3, is40, sgi;
++			struct ieee80211_sta *sta;
++
++			sta = tx_info->control.sta;
++
++			if (rr) {
++				plcp0 = plcp[0];
++				plcp3 = plcp[3];
++			} else {
++				plcp0 = txh->FragPLCPFallback[0];
++				plcp3 = txh->FragPLCPFallback[3];
++
++			}
++			is40 = (plcp0 & MIMO_PLCP_40MHZ) ? 1 : 0;
++			sgi = plcp3_issgi(plcp3) ? 1 : 0;
++			mcs = plcp0 & ~MIMO_PLCP_40MHZ;
++			max_ampdu_bytes =
++			    min(scb_ampdu->max_rx_ampdu_bytes,
++				ampdu->max_txlen[mcs][is40][sgi]);
++
++			if (is40)
++				mimo_ctlchbw =
++				   CHSPEC_SB_UPPER(wlc_phy_chanspec_get(
++								 wlc->band->pi))
++				   ? PHY_TXC1_BW_20MHZ_UP : PHY_TXC1_BW_20MHZ;
++
++			/* rebuild the rspec and rspec_fallback */
++			rspec = RSPEC_MIMORATE;
++			rspec |= plcp[0] & ~MIMO_PLCP_40MHZ;
++			if (plcp[0] & MIMO_PLCP_40MHZ)
++				rspec |= (PHY_TXC1_BW_40MHZ << RSPEC_BW_SHIFT);
++
++			if (fbr_iscck)	/* CCK */
++				rspec_fallback = cck_rspec(cck_phy2mac_rate
++						    (txh->FragPLCPFallback[0]));
++			else {	/* MIMO */
++				rspec_fallback = RSPEC_MIMORATE;
++				rspec_fallback |=
++				    txh->FragPLCPFallback[0] & ~MIMO_PLCP_40MHZ;
++				if (txh->FragPLCPFallback[0] & MIMO_PLCP_40MHZ)
++					rspec_fallback |=
++					    (PHY_TXC1_BW_40MHZ <<
++					     RSPEC_BW_SHIFT);
++			}
++
++			if (use_rts || use_cts) {
++				rts_rspec =
++				    brcms_c_rspec_to_rts_rspec(wlc,
++					rspec, false, mimo_ctlchbw);
++				rts_rspec_fallback =
++				    brcms_c_rspec_to_rts_rspec(wlc,
++					rspec_fallback, false, mimo_ctlchbw);
++			}
++		}
++
++		/* if (first mpdu for host agg) */
++		/* test whether to add more */
++		if ((mcs_2_rate(mcs, true, false) >= f->dmaxferrate) &&
++		    (count == f->mcs2ampdu_table[mcs])) {
++			BCMMSG(wlc->wiphy, "wl%d: PR 37644: stopping"
++				" ampdu at %d for mcs %d\n",
++				wlc->pub->unit, count, mcs);
++			break;
++		}
++
++		if (count == scb_ampdu->max_pdu)
++			break;
++
++		/*
++		 * check to see if the next pkt is
++		 * a candidate for aggregation
++		 */
++		p = pktq_ppeek(&qi->q, prec);
++		/* tx_info must be checked with current p */
++		tx_info = IEEE80211_SKB_CB(p);
++
++		if (p) {
++			if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) &&
++			    ((u8) (p->priority) == tid)) {
++				plen = p->len + AMPDU_MAX_MPDU_OVERHEAD;
++				plen = max(scb_ampdu->min_len, plen);
++
++				if ((plen + ampdu_len) > max_ampdu_bytes) {
++					p = NULL;
++					continue;
++				}
++
++				/*
++				 * check if there are enough
++				 * descriptors available
++				 */
++				if (*wlc->core->txavail[fifo] <= seg_cnt + 1) {
++					wiphy_err(wiphy, "%s: No fifo space  "
++						  "!!\n", __func__);
++					p = NULL;
++					continue;
++				}
++				p = brcmu_pktq_pdeq(&qi->q, prec);
++			} else {
++				p = NULL;
++			}
++		}
++	}			/* end while(p) */
++
++	ini->tx_in_transit += count;
++
++	if (count) {
++		/* patch up the last txh */
++		txh = (struct d11txh *) pkt[count - 1]->data;
++		mcl = le16_to_cpu(txh->MacTxControlLow);
++		mcl &= ~TXC_AMPDU_MASK;
++		mcl |= (TXC_AMPDU_LAST << TXC_AMPDU_SHIFT);
++		txh->MacTxControlLow = cpu_to_le16(mcl);
++
++		/* remove the null delimiter after last mpdu */
++		ndelim = txh->RTSPLCPFallback[AMPDU_FBR_NULL_DELIM];
++		txh->RTSPLCPFallback[AMPDU_FBR_NULL_DELIM] = 0;
++		ampdu_len -= ndelim * AMPDU_DELIMITER_LEN;
++
++		/* remove the pad len from last mpdu */
++		fbr_iscck = ((le16_to_cpu(txh->XtraFrameTypes) & 0x3) == 0);
++		len = fbr_iscck ? BRCMS_GET_CCK_PLCP_LEN(txh->FragPLCPFallback)
++		    : BRCMS_GET_MIMO_PLCP_LEN(txh->FragPLCPFallback);
++		ampdu_len -= roundup(len, 4) - len;
++
++		/* patch up the first txh & plcp */
++		txh = (struct d11txh *) pkt[0]->data;
++		plcp = (u8 *) (txh + 1);
++
++		BRCMS_SET_MIMO_PLCP_LEN(plcp, ampdu_len);
++		/* mark plcp to indicate ampdu */
++		BRCMS_SET_MIMO_PLCP_AMPDU(plcp);
++
++		/* reset the mixed mode header durations */
++		if (txh->MModeLen) {
++			u16 mmodelen =
++			    brcms_c_calc_lsig_len(wlc, rspec, ampdu_len);
++			txh->MModeLen = cpu_to_le16(mmodelen);
++			preamble_type = BRCMS_MM_PREAMBLE;
++		}
++		if (txh->MModeFbrLen) {
++			u16 mmfbrlen =
++			    brcms_c_calc_lsig_len(wlc, rspec_fallback,
++						  ampdu_len);
++			txh->MModeFbrLen = cpu_to_le16(mmfbrlen);
++			fbr_preamble_type = BRCMS_MM_PREAMBLE;
++		}
++
++		/* set the preload length */
++		if (mcs_2_rate(mcs, true, false) >= f->dmaxferrate) {
++			dma_len = min(dma_len, f->ampdu_pld_size);
++			txh->PreloadSize = cpu_to_le16(dma_len);
++		} else
++			txh->PreloadSize = 0;
++
++		mch = le16_to_cpu(txh->MacTxControlHigh);
++
++		/* update RTS dur fields */
++		if (use_rts || use_cts) {
++			u16 durid;
++			rts = (struct ieee80211_rts *)&txh->rts_frame;
++			if ((mch & TXC_PREAMBLE_RTS_MAIN_SHORT) ==
++			    TXC_PREAMBLE_RTS_MAIN_SHORT)
++				rts_preamble_type = BRCMS_SHORT_PREAMBLE;
++
++			if ((mch & TXC_PREAMBLE_RTS_FB_SHORT) ==
++			    TXC_PREAMBLE_RTS_FB_SHORT)
++				rts_fbr_preamble_type = BRCMS_SHORT_PREAMBLE;
++
++			durid =
++			    brcms_c_compute_rtscts_dur(wlc, use_cts, rts_rspec,
++						   rspec, rts_preamble_type,
++						   preamble_type, ampdu_len,
++						   true);
++			rts->duration = cpu_to_le16(durid);
++			durid = brcms_c_compute_rtscts_dur(wlc, use_cts,
++						       rts_rspec_fallback,
++						       rspec_fallback,
++						       rts_fbr_preamble_type,
++						       fbr_preamble_type,
++						       ampdu_len, true);
++			txh->RTSDurFallback = cpu_to_le16(durid);
++			/* set TxFesTimeNormal */
++			txh->TxFesTimeNormal = rts->duration;
++			/* set fallback rate version of TxFesTimeNormal */
++			txh->TxFesTimeFallback = txh->RTSDurFallback;
++		}
++
++		/* set flag and plcp for fallback rate */
++		if (fbr) {
++			mch |= TXC_AMPDU_FBR;
++			txh->MacTxControlHigh = cpu_to_le16(mch);
++			BRCMS_SET_MIMO_PLCP_AMPDU(plcp);
++			BRCMS_SET_MIMO_PLCP_AMPDU(txh->FragPLCPFallback);
++		}
++
++		BCMMSG(wlc->wiphy, "wl%d: count %d ampdu_len %d\n",
++			wlc->pub->unit, count, ampdu_len);
++
++		/* inform rate_sel if it this is a rate probe pkt */
++		frameid = le16_to_cpu(txh->TxFrameID);
++		if (frameid & TXFID_RATE_PROBE_MASK)
++			wiphy_err(wiphy, "%s: XXX what to do with "
++				  "TXFID_RATE_PROBE_MASK!?\n", __func__);
++
++		for (i = 0; i < count; i++)
++			brcms_c_txfifo(wlc, fifo, pkt[i], i == (count - 1),
++				   ampdu->txpkt_weight);
++
++	}
++	/* endif (count) */
++	return err;
++}
++
++static void
++brcms_c_ampdu_rate_status(struct brcms_c_info *wlc,
++			  struct ieee80211_tx_info *tx_info,
++			  struct tx_status *txs, u8 mcs)
++{
++	struct ieee80211_tx_rate *txrate = tx_info->status.rates;
++	int i;
++
++	/* clear the rest of the rates */
++	for (i = 2; i < IEEE80211_TX_MAX_RATES; i++) {
++		txrate[i].idx = -1;
++		txrate[i].count = 0;
++	}
++}
++
++static void
++brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb,
++			      struct sk_buff *p, struct tx_status *txs,
++			      u32 s1, u32 s2)
++{
++	struct scb_ampdu *scb_ampdu;
++	struct brcms_c_info *wlc = ampdu->wlc;
++	struct scb_ampdu_tid_ini *ini;
++	u8 bitmap[8], queue, tid;
++	struct d11txh *txh;
++	u8 *plcp;
++	struct ieee80211_hdr *h;
++	u16 seq, start_seq = 0, bindex, index, mcl;
++	u8 mcs = 0;
++	bool ba_recd = false, ack_recd = false;
++	u8 suc_mpdu = 0, tot_mpdu = 0;
++	uint supr_status;
++	bool update_rate = true, retry = true, tx_error = false;
++	u16 mimoantsel = 0;
++	u8 antselid = 0;
++	u8 retry_limit, rr_retry_limit;
++	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(p);
++	struct wiphy *wiphy = wlc->wiphy;
++
++#ifdef DEBUG
++	u8 hole[AMPDU_MAX_MPDU];
++	memset(hole, 0, sizeof(hole));
++#endif
++
++	scb_ampdu = &scb->scb_ampdu;
++	tid = (u8) (p->priority);
++
++	ini = &scb_ampdu->ini[tid];
++	retry_limit = ampdu->retry_limit_tid[tid];
++	rr_retry_limit = ampdu->rr_retry_limit_tid[tid];
++	memset(bitmap, 0, sizeof(bitmap));
++	queue = txs->frameid & TXFID_QUEUE_MASK;
++	supr_status = txs->status & TX_STATUS_SUPR_MASK;
++
++	if (txs->status & TX_STATUS_ACK_RCV) {
++		if (TX_STATUS_SUPR_UF == supr_status)
++			update_rate = false;
++
++		WARN_ON(!(txs->status & TX_STATUS_INTERMEDIATE));
++		start_seq = txs->sequence >> SEQNUM_SHIFT;
++		bitmap[0] = (txs->status & TX_STATUS_BA_BMAP03_MASK) >>
++		    TX_STATUS_BA_BMAP03_SHIFT;
++
++		WARN_ON(s1 & TX_STATUS_INTERMEDIATE);
++		WARN_ON(!(s1 & TX_STATUS_AMPDU));
++
++		bitmap[0] |=
++		    (s1 & TX_STATUS_BA_BMAP47_MASK) <<
++		    TX_STATUS_BA_BMAP47_SHIFT;
++		bitmap[1] = (s1 >> 8) & 0xff;
++		bitmap[2] = (s1 >> 16) & 0xff;
++		bitmap[3] = (s1 >> 24) & 0xff;
++
++		bitmap[4] = s2 & 0xff;
++		bitmap[5] = (s2 >> 8) & 0xff;
++		bitmap[6] = (s2 >> 16) & 0xff;
++		bitmap[7] = (s2 >> 24) & 0xff;
++
++		ba_recd = true;
++	} else {
++		if (supr_status) {
++			update_rate = false;
++			if (supr_status == TX_STATUS_SUPR_BADCH) {
++				wiphy_err(wiphy,
++					  "%s: Pkt tx suppressed, illegal channel possibly %d\n",
++					  __func__, CHSPEC_CHANNEL(
++					  wlc->default_bss->chanspec));
++			} else {
++				if (supr_status != TX_STATUS_SUPR_FRAG)
++					wiphy_err(wiphy, "%s: supr_status 0x%x\n",
++						  __func__, supr_status);
++			}
++			/* no need to retry for badch; will fail again */
++			if (supr_status == TX_STATUS_SUPR_BADCH ||
++			    supr_status == TX_STATUS_SUPR_EXPTIME) {
++				retry = false;
++			} else if (supr_status == TX_STATUS_SUPR_EXPTIME) {
++				/* TX underflow:
++				 *   try tuning pre-loading or ampdu size
++				 */
++			} else if (supr_status == TX_STATUS_SUPR_FRAG) {
++				/*
++				 * if there were underflows, but pre-loading
++				 * is not active, notify rate adaptation.
++				 */
++				if (brcms_c_ffpld_check_txfunfl(wlc,
++					prio2fifo[tid]) > 0)
++					tx_error = true;
++			}
++		} else if (txs->phyerr) {
++			update_rate = false;
++			wiphy_err(wiphy, "%s: ampdu tx phy error (0x%x)\n",
++				  __func__, txs->phyerr);
++
++			if (brcm_msg_level & LOG_ERROR_VAL) {
++				brcmu_prpkt("txpkt (AMPDU)", p);
++				brcms_c_print_txdesc((struct d11txh *) p->data);
++			}
++			brcms_c_print_txstatus(txs);
++		}
++	}
++
++	/* loop through all pkts and retry if not acked */
++	while (p) {
++		tx_info = IEEE80211_SKB_CB(p);
++		txh = (struct d11txh *) p->data;
++		mcl = le16_to_cpu(txh->MacTxControlLow);
++		plcp = (u8 *) (txh + 1);
++		h = (struct ieee80211_hdr *)(plcp + D11_PHY_HDR_LEN);
++		seq = le16_to_cpu(h->seq_ctrl) >> SEQNUM_SHIFT;
++
++		if (tot_mpdu == 0) {
++			mcs = plcp[0] & MIMO_PLCP_MCS_MASK;
++			mimoantsel = le16_to_cpu(txh->ABI_MimoAntSel);
++		}
++
++		index = TX_SEQ_TO_INDEX(seq);
++		ack_recd = false;
++		if (ba_recd) {
++			bindex = MODSUB_POW2(seq, start_seq, SEQNUM_MAX);
++			BCMMSG(wiphy,
++			       "tid %d seq %d, start_seq %d, bindex %d set %d, index %d\n",
++			       tid, seq, start_seq, bindex,
++			       isset(bitmap, bindex), index);
++			/* if acked then clear bit and free packet */
++			if ((bindex < AMPDU_TX_BA_MAX_WSIZE)
++			    && isset(bitmap, bindex)) {
++				ini->tx_in_transit--;
++				ini->txretry[index] = 0;
++
++				/*
++				 * ampdu_ack_len:
++				 *   number of acked aggregated frames
++				 */
++				/* ampdu_len: number of aggregated frames */
++				brcms_c_ampdu_rate_status(wlc, tx_info, txs,
++							  mcs);
++				tx_info->flags |= IEEE80211_TX_STAT_ACK;
++				tx_info->flags |= IEEE80211_TX_STAT_AMPDU;
++				tx_info->status.ampdu_ack_len =
++					tx_info->status.ampdu_len = 1;
++
++				skb_pull(p, D11_PHY_HDR_LEN);
++				skb_pull(p, D11_TXH_LEN);
++
++				ieee80211_tx_status_irqsafe(wlc->pub->ieee_hw,
++							    p);
++				ack_recd = true;
++				suc_mpdu++;
++			}
++		}
++		/* either retransmit or send bar if ack not recd */
++		if (!ack_recd) {
++			if (retry && (ini->txretry[index] < (int)retry_limit)) {
++				ini->txretry[index]++;
++				ini->tx_in_transit--;
++				/*
++				 * Use high prededence for retransmit to
++				 * give some punch
++				 */
++				brcms_c_txq_enq(wlc, scb, p,
++						BRCMS_PRIO_TO_HI_PREC(tid));
++			} else {
++				/* Retry timeout */
++				ini->tx_in_transit--;
++				ieee80211_tx_info_clear_status(tx_info);
++				tx_info->status.ampdu_ack_len = 0;
++				tx_info->status.ampdu_len = 1;
++				tx_info->flags |=
++				    IEEE80211_TX_STAT_AMPDU_NO_BACK;
++				skb_pull(p, D11_PHY_HDR_LEN);
++				skb_pull(p, D11_TXH_LEN);
++				BCMMSG(wiphy,
++				       "BA Timeout, seq %d, in_transit %d\n",
++				       seq, ini->tx_in_transit);
++				ieee80211_tx_status_irqsafe(wlc->pub->ieee_hw,
++							    p);
++			}
++		}
++		tot_mpdu++;
++
++		/* break out if last packet of ampdu */
++		if (((mcl & TXC_AMPDU_MASK) >> TXC_AMPDU_SHIFT) ==
++		    TXC_AMPDU_LAST)
++			break;
++
++		p = dma_getnexttxp(wlc->hw->di[queue], DMA_RANGE_TRANSMITTED);
++	}
++	brcms_c_send_q(wlc);
++
++	/* update rate state */
++	antselid = brcms_c_antsel_antsel2id(wlc->asi, mimoantsel);
++
++	brcms_c_txfifo_complete(wlc, queue, ampdu->txpkt_weight);
++}
++
++void
++brcms_c_ampdu_dotxstatus(struct ampdu_info *ampdu, struct scb *scb,
++		     struct sk_buff *p, struct tx_status *txs)
++{
++	struct scb_ampdu *scb_ampdu;
++	struct brcms_c_info *wlc = ampdu->wlc;
++	struct scb_ampdu_tid_ini *ini;
++	u32 s1 = 0, s2 = 0;
++	struct ieee80211_tx_info *tx_info;
++
++	tx_info = IEEE80211_SKB_CB(p);
++
++	/* BMAC_NOTE: For the split driver, second level txstatus comes later
++	 * So if the ACK was received then wait for the second level else just
++	 * call the first one
++	 */
++	if (txs->status & TX_STATUS_ACK_RCV) {
++		u8 status_delay = 0;
++
++		/* wait till the next 8 bytes of txstatus is available */
++		s1 = bcma_read32(wlc->hw->d11core, D11REGOFFS(frmtxstatus));
++		while ((s1 & TXS_V) == 0) {
++			udelay(1);
++			status_delay++;
++			if (status_delay > 10)
++				return; /* error condition */
++			s1 = bcma_read32(wlc->hw->d11core,
++					 D11REGOFFS(frmtxstatus));
++		}
++
++		s2 = bcma_read32(wlc->hw->d11core, D11REGOFFS(frmtxstatus2));
++	}
++
++	if (scb) {
++		scb_ampdu = &scb->scb_ampdu;
++		ini = &scb_ampdu->ini[p->priority];
++		brcms_c_ampdu_dotxstatus_complete(ampdu, scb, p, txs, s1, s2);
++	} else {
++		/* loop through all pkts and free */
++		u8 queue = txs->frameid & TXFID_QUEUE_MASK;
++		struct d11txh *txh;
++		u16 mcl;
++		while (p) {
++			tx_info = IEEE80211_SKB_CB(p);
++			txh = (struct d11txh *) p->data;
++			mcl = le16_to_cpu(txh->MacTxControlLow);
++			brcmu_pkt_buf_free_skb(p);
++			/* break out if last packet of ampdu */
++			if (((mcl & TXC_AMPDU_MASK) >> TXC_AMPDU_SHIFT) ==
++			    TXC_AMPDU_LAST)
++				break;
++			p = dma_getnexttxp(wlc->hw->di[queue],
++					   DMA_RANGE_TRANSMITTED);
++		}
++		brcms_c_txfifo_complete(wlc, queue, ampdu->txpkt_weight);
++	}
++}
++
++void brcms_c_ampdu_macaddr_upd(struct brcms_c_info *wlc)
++{
++	char template[T_RAM_ACCESS_SZ * 2];
++
++	/* driver needs to write the ta in the template; ta is at offset 16 */
++	memset(template, 0, sizeof(template));
++	memcpy(template, wlc->pub->cur_etheraddr, ETH_ALEN);
++	brcms_b_write_template_ram(wlc->hw, (T_BA_TPL_BASE + 16),
++				  (T_RAM_ACCESS_SZ * 2),
++				  template);
++}
++
++bool brcms_c_aggregatable(struct brcms_c_info *wlc, u8 tid)
++{
++	return wlc->ampdu->ini_enable[tid];
++}
++
++void brcms_c_ampdu_shm_upd(struct ampdu_info *ampdu)
++{
++	struct brcms_c_info *wlc = ampdu->wlc;
++
++	/*
++	 * Extend ucode internal watchdog timer to
++	 * match larger received frames
++	 */
++	if ((ampdu->rx_factor & IEEE80211_HT_AMPDU_PARM_FACTOR) ==
++	    IEEE80211_HT_MAX_AMPDU_64K) {
++		brcms_b_write_shm(wlc->hw, M_MIMO_MAXSYM, MIMO_MAXSYM_MAX);
++		brcms_b_write_shm(wlc->hw, M_WATCHDOG_8TU, WATCHDOG_8TU_MAX);
++	} else {
++		brcms_b_write_shm(wlc->hw, M_MIMO_MAXSYM, MIMO_MAXSYM_DEF);
++		brcms_b_write_shm(wlc->hw, M_WATCHDOG_8TU, WATCHDOG_8TU_DEF);
++	}
++}
++
++/*
++ * callback function that helps flushing ampdu packets from a priority queue
++ */
++static bool cb_del_ampdu_pkt(struct sk_buff *mpdu, void *arg_a)
++{
++	struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(mpdu);
++	struct cb_del_ampdu_pars *ampdu_pars =
++				 (struct cb_del_ampdu_pars *)arg_a;
++	bool rc;
++
++	rc = tx_info->flags & IEEE80211_TX_CTL_AMPDU ? true : false;
++	rc = rc && (tx_info->control.sta == NULL || ampdu_pars->sta == NULL ||
++		    tx_info->control.sta == ampdu_pars->sta);
++	rc = rc && ((u8)(mpdu->priority) == ampdu_pars->tid);
++	return rc;
++}
++
++/*
++ * callback function that helps invalidating ampdu packets in a DMA queue
++ */
++static void dma_cb_fn_ampdu(void *txi, void *arg_a)
++{
++	struct ieee80211_sta *sta = arg_a;
++	struct ieee80211_tx_info *tx_info = (struct ieee80211_tx_info *)txi;
++
++	if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) &&
++	    (tx_info->control.sta == sta || sta == NULL))
++		tx_info->control.sta = NULL;
++}
++
++/*
++ * When a remote party is no longer available for ampdu communication, any
++ * pending tx ampdu packets in the driver have to be flushed.
++ */
++void brcms_c_ampdu_flush(struct brcms_c_info *wlc,
++		     struct ieee80211_sta *sta, u16 tid)
++{
++	struct brcms_txq_info *qi = wlc->pkt_queue;
++	struct pktq *pq = &qi->q;
++	int prec;
++	struct cb_del_ampdu_pars ampdu_pars;
++
++	ampdu_pars.sta = sta;
++	ampdu_pars.tid = tid;
++	for (prec = 0; prec < pq->num_prec; prec++)
++		brcmu_pktq_pflush(pq, prec, true, cb_del_ampdu_pkt,
++			    (void *)&ampdu_pars);
++	brcms_c_inval_dma_pkts(wlc->hw, sta, dma_cb_fn_ampdu);
++}
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.h b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.h
+new file mode 100644
+index 0000000..421f4ba
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.h
+@@ -0,0 +1,30 @@
++/*
++ * Copyright (c) 2010 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#ifndef _BRCM_AMPDU_H_
++#define _BRCM_AMPDU_H_
++
++extern struct ampdu_info *brcms_c_ampdu_attach(struct brcms_c_info *wlc);
++extern void brcms_c_ampdu_detach(struct ampdu_info *ampdu);
++extern int brcms_c_sendampdu(struct ampdu_info *ampdu,
++			     struct brcms_txq_info *qi,
++			     struct sk_buff **aggp, int prec);
++extern void brcms_c_ampdu_dotxstatus(struct ampdu_info *ampdu, struct scb *scb,
++				 struct sk_buff *p, struct tx_status *txs);
++extern void brcms_c_ampdu_macaddr_upd(struct brcms_c_info *wlc);
++extern void brcms_c_ampdu_shm_upd(struct ampdu_info *ampdu);
++
++#endif				/* _BRCM_AMPDU_H_ */
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/antsel.c b/drivers/net/wireless/brcm80211/brcmsmac/antsel.c
+new file mode 100644
+index 0000000..55e12c3
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmsmac/antsel.c
+@@ -0,0 +1,307 @@
++/*
++ * Copyright (c) 2010 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#include <linux/slab.h>
++#include <net/mac80211.h>
++
++#include "types.h"
++#include "main.h"
++#include "phy_shim.h"
++#include "antsel.h"
++
++#define ANT_SELCFG_AUTO		0x80	/* bit indicates antenna sel AUTO */
++#define ANT_SELCFG_MASK		0x33	/* antenna configuration mask */
++#define ANT_SELCFG_TX_UNICAST	0	/* unicast tx antenna configuration */
++#define ANT_SELCFG_RX_UNICAST	1	/* unicast rx antenna configuration */
++#define ANT_SELCFG_TX_DEF	2	/* default tx antenna configuration */
++#define ANT_SELCFG_RX_DEF	3	/* default rx antenna configuration */
++
++/* useful macros */
++#define BRCMS_ANTSEL_11N_0(ant)	((((ant) & ANT_SELCFG_MASK) >> 4) & 0xf)
++#define BRCMS_ANTSEL_11N_1(ant)	(((ant) & ANT_SELCFG_MASK) & 0xf)
++#define BRCMS_ANTIDX_11N(ant)	(((BRCMS_ANTSEL_11N_0(ant)) << 2) +\
++				(BRCMS_ANTSEL_11N_1(ant)))
++#define BRCMS_ANT_ISAUTO_11N(ant) (((ant) & ANT_SELCFG_AUTO) == ANT_SELCFG_AUTO)
++#define BRCMS_ANTSEL_11N(ant)	((ant) & ANT_SELCFG_MASK)
++
++/* antenna switch */
++/* defines for no boardlevel antenna diversity */
++#define ANT_SELCFG_DEF_2x2	0x01	/* default antenna configuration */
++
++/* 2x3 antdiv defines and tables for GPIO communication */
++#define ANT_SELCFG_NUM_2x3	3
++#define ANT_SELCFG_DEF_2x3	0x01	/* default antenna configuration */
++
++/* 2x4 antdiv rev4 defines and tables for GPIO communication */
++#define ANT_SELCFG_NUM_2x4	4
++#define ANT_SELCFG_DEF_2x4	0x02	/* default antenna configuration */
++
++static const u16 mimo_2x4_div_antselpat_tbl[] = {
++	0, 0, 0x9, 0xa,		/* ant0: 0 ant1: 2,3 */
++	0, 0, 0x5, 0x6,		/* ant0: 1 ant1: 2,3 */
++	0, 0, 0, 0,		/* n.a.              */
++	0, 0, 0, 0		/* n.a.              */
++};
++
++static const u8 mimo_2x4_div_antselid_tbl[16] = {
++	0, 0, 0, 0, 0, 2, 3, 0,
++	0, 0, 1, 0, 0, 0, 0, 0	/* pat to antselid */
++};
++
++static const u16 mimo_2x3_div_antselpat_tbl[] = {
++	16, 0, 1, 16,		/* ant0: 0 ant1: 1,2 */
++	16, 16, 16, 16,		/* n.a.              */
++	16, 2, 16, 16,		/* ant0: 2 ant1: 1   */
++	16, 16, 16, 16		/* n.a.              */
++};
++
++static const u8 mimo_2x3_div_antselid_tbl[16] = {
++	0, 1, 2, 0, 0, 0, 0, 0,
++	0, 0, 0, 0, 0, 0, 0, 0	/* pat to antselid */
++};
++
++/* boardlevel antenna selection: init antenna selection structure */
++static void
++brcms_c_antsel_init_cfg(struct antsel_info *asi, struct brcms_antselcfg *antsel,
++		    bool auto_sel)
++{
++	if (asi->antsel_type == ANTSEL_2x3) {
++		u8 antcfg_def = ANT_SELCFG_DEF_2x3 |
++		    ((asi->antsel_avail && auto_sel) ? ANT_SELCFG_AUTO : 0);
++		antsel->ant_config[ANT_SELCFG_TX_DEF] = antcfg_def;
++		antsel->ant_config[ANT_SELCFG_TX_UNICAST] = antcfg_def;
++		antsel->ant_config[ANT_SELCFG_RX_DEF] = antcfg_def;
++		antsel->ant_config[ANT_SELCFG_RX_UNICAST] = antcfg_def;
++		antsel->num_antcfg = ANT_SELCFG_NUM_2x3;
++
++	} else if (asi->antsel_type == ANTSEL_2x4) {
++
++		antsel->ant_config[ANT_SELCFG_TX_DEF] = ANT_SELCFG_DEF_2x4;
++		antsel->ant_config[ANT_SELCFG_TX_UNICAST] = ANT_SELCFG_DEF_2x4;
++		antsel->ant_config[ANT_SELCFG_RX_DEF] = ANT_SELCFG_DEF_2x4;
++		antsel->ant_config[ANT_SELCFG_RX_UNICAST] = ANT_SELCFG_DEF_2x4;
++		antsel->num_antcfg = ANT_SELCFG_NUM_2x4;
++
++	} else {		/* no antenna selection available */
++
++		antsel->ant_config[ANT_SELCFG_TX_DEF] = ANT_SELCFG_DEF_2x2;
++		antsel->ant_config[ANT_SELCFG_TX_UNICAST] = ANT_SELCFG_DEF_2x2;
++		antsel->ant_config[ANT_SELCFG_RX_DEF] = ANT_SELCFG_DEF_2x2;
++		antsel->ant_config[ANT_SELCFG_RX_UNICAST] = ANT_SELCFG_DEF_2x2;
++		antsel->num_antcfg = 0;
++	}
++}
++
++struct antsel_info *brcms_c_antsel_attach(struct brcms_c_info *wlc)
++{
++	struct antsel_info *asi;
++	struct ssb_sprom *sprom = &wlc->hw->d11core->bus->sprom;
++
++	asi = kzalloc(sizeof(struct antsel_info), GFP_ATOMIC);
++	if (!asi)
++		return NULL;
++
++	asi->wlc = wlc;
++	asi->pub = wlc->pub;
++	asi->antsel_type = ANTSEL_NA;
++	asi->antsel_avail = false;
++	asi->antsel_antswitch = sprom->antswitch;
++
++	if ((asi->pub->sromrev >= 4) && (asi->antsel_antswitch != 0)) {
++		switch (asi->antsel_antswitch) {
++		case ANTSWITCH_TYPE_1:
++		case ANTSWITCH_TYPE_2:
++		case ANTSWITCH_TYPE_3:
++			/* 4321/2 board with 2x3 switch logic */
++			asi->antsel_type = ANTSEL_2x3;
++			/* Antenna selection availability */
++			if ((sprom->ant_available_bg == 7) ||
++			    (sprom->ant_available_a == 7)) {
++				asi->antsel_avail = true;
++			} else if (
++				sprom->ant_available_bg == 3 ||
++				sprom->ant_available_a == 3) {
++				asi->antsel_avail = false;
++			} else {
++				asi->antsel_avail = false;
++				wiphy_err(wlc->wiphy, "antsel_attach: 2o3 "
++					  "board cfg invalid\n");
++			}
++
++			break;
++		default:
++			break;
++		}
++	} else if ((asi->pub->sromrev == 4) &&
++		   (sprom->ant_available_bg == 7) &&
++		   (sprom->ant_available_a == 0)) {
++		/* hack to match old 4321CB2 cards with 2of3 antenna switch */
++		asi->antsel_type = ANTSEL_2x3;
++		asi->antsel_avail = true;
++	} else if (asi->pub->boardflags2 & BFL2_2X4_DIV) {
++		asi->antsel_type = ANTSEL_2x4;
++		asi->antsel_avail = true;
++	}
++
++	/* Set the antenna selection type for the low driver */
++	brcms_b_antsel_type_set(wlc->hw, asi->antsel_type);
++
++	/* Init (auto/manual) antenna selection */
++	brcms_c_antsel_init_cfg(asi, &asi->antcfg_11n, true);
++	brcms_c_antsel_init_cfg(asi, &asi->antcfg_cur, true);
++
++	return asi;
++}
++
++void brcms_c_antsel_detach(struct antsel_info *asi)
++{
++	kfree(asi);
++}
++
++/*
++ * boardlevel antenna selection:
++ *   convert ant_cfg to mimo_antsel (ucode interface)
++ */
++static u16 brcms_c_antsel_antcfg2antsel(struct antsel_info *asi, u8 ant_cfg)
++{
++	u8 idx = BRCMS_ANTIDX_11N(BRCMS_ANTSEL_11N(ant_cfg));
++	u16 mimo_antsel = 0;
++
++	if (asi->antsel_type == ANTSEL_2x4) {
++		/* 2x4 antenna diversity board, 4 cfgs: 0-2 0-3 1-2 1-3 */
++		mimo_antsel = (mimo_2x4_div_antselpat_tbl[idx] & 0xf);
++		return mimo_antsel;
++
++	} else if (asi->antsel_type == ANTSEL_2x3) {
++		/* 2x3 antenna selection, 3 cfgs: 0-1 0-2 2-1 */
++		mimo_antsel = (mimo_2x3_div_antselpat_tbl[idx] & 0xf);
++		return mimo_antsel;
++	}
++
++	return mimo_antsel;
++}
++
++/* boardlevel antenna selection: ucode interface control */
++static int brcms_c_antsel_cfgupd(struct antsel_info *asi,
++				 struct brcms_antselcfg *antsel)
++{
++	struct brcms_c_info *wlc = asi->wlc;
++	u8 ant_cfg;
++	u16 mimo_antsel;
++
++	/* 1) Update TX antconfig for all frames that are not unicast data
++	 *    (aka default TX)
++	 */
++	ant_cfg = antsel->ant_config[ANT_SELCFG_TX_DEF];
++	mimo_antsel = brcms_c_antsel_antcfg2antsel(asi, ant_cfg);
++	brcms_b_write_shm(wlc->hw, M_MIMO_ANTSEL_TXDFLT, mimo_antsel);
++	/*
++	 * Update driver stats for currently selected
++	 * default tx/rx antenna config
++	 */
++	asi->antcfg_cur.ant_config[ANT_SELCFG_TX_DEF] = ant_cfg;
++
++	/* 2) Update RX antconfig for all frames that are not unicast data
++	 *    (aka default RX)
++	 */
++	ant_cfg = antsel->ant_config[ANT_SELCFG_RX_DEF];
++	mimo_antsel = brcms_c_antsel_antcfg2antsel(asi, ant_cfg);
++	brcms_b_write_shm(wlc->hw, M_MIMO_ANTSEL_RXDFLT, mimo_antsel);
++	/*
++	 * Update driver stats for currently selected
++	 * default tx/rx antenna config
++	 */
++	asi->antcfg_cur.ant_config[ANT_SELCFG_RX_DEF] = ant_cfg;
++
++	return 0;
++}
++
++void brcms_c_antsel_init(struct antsel_info *asi)
++{
++	if ((asi->antsel_type == ANTSEL_2x3) ||
++	    (asi->antsel_type == ANTSEL_2x4))
++		brcms_c_antsel_cfgupd(asi, &asi->antcfg_11n);
++}
++
++/* boardlevel antenna selection: convert id to ant_cfg */
++static u8 brcms_c_antsel_id2antcfg(struct antsel_info *asi, u8 id)
++{
++	u8 antcfg = ANT_SELCFG_DEF_2x2;
++
++	if (asi->antsel_type == ANTSEL_2x4) {
++		/* 2x4 antenna diversity board, 4 cfgs: 0-2 0-3 1-2 1-3 */
++		antcfg = (((id & 0x2) << 3) | ((id & 0x1) + 2));
++		return antcfg;
++
++	} else if (asi->antsel_type == ANTSEL_2x3) {
++		/* 2x3 antenna selection, 3 cfgs: 0-1 0-2 2-1 */
++		antcfg = (((id & 0x02) << 4) | ((id & 0x1) + 1));
++		return antcfg;
++	}
++
++	return antcfg;
++}
++
++void
++brcms_c_antsel_antcfg_get(struct antsel_info *asi, bool usedef, bool sel,
++		      u8 antselid, u8 fbantselid, u8 *antcfg,
++		      u8 *fbantcfg)
++{
++	u8 ant;
++
++	/* if use default, assign it and return */
++	if (usedef) {
++		*antcfg = asi->antcfg_11n.ant_config[ANT_SELCFG_TX_DEF];
++		*fbantcfg = *antcfg;
++		return;
++	}
++
++	if (!sel) {
++		*antcfg = asi->antcfg_11n.ant_config[ANT_SELCFG_TX_UNICAST];
++		*fbantcfg = *antcfg;
++
++	} else {
++		ant = asi->antcfg_11n.ant_config[ANT_SELCFG_TX_UNICAST];
++		if ((ant & ANT_SELCFG_AUTO) == ANT_SELCFG_AUTO) {
++			*antcfg = brcms_c_antsel_id2antcfg(asi, antselid);
++			*fbantcfg = brcms_c_antsel_id2antcfg(asi, fbantselid);
++		} else {
++			*antcfg =
++			    asi->antcfg_11n.ant_config[ANT_SELCFG_TX_UNICAST];
++			*fbantcfg = *antcfg;
++		}
++	}
++	return;
++}
++
++/* boardlevel antenna selection: convert mimo_antsel (ucode interface) to id */
++u8 brcms_c_antsel_antsel2id(struct antsel_info *asi, u16 antsel)
++{
++	u8 antselid = 0;
++
++	if (asi->antsel_type == ANTSEL_2x4) {
++		/* 2x4 antenna diversity board, 4 cfgs: 0-2 0-3 1-2 1-3 */
++		antselid = mimo_2x4_div_antselid_tbl[(antsel & 0xf)];
++		return antselid;
++
++	} else if (asi->antsel_type == ANTSEL_2x3) {
++		/* 2x3 antenna selection, 3 cfgs: 0-1 0-2 2-1 */
++		antselid = mimo_2x3_div_antselid_tbl[(antsel & 0xf)];
++		return antselid;
++	}
++
++	return antselid;
++}
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/antsel.h b/drivers/net/wireless/brcm80211/brcmsmac/antsel.h
+new file mode 100644
+index 0000000..97ea388
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmsmac/antsel.h
+@@ -0,0 +1,29 @@
++/*
++ * Copyright (c) 2010 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#ifndef _BRCM_ANTSEL_H_
++#define _BRCM_ANTSEL_H_
++
++extern struct antsel_info *brcms_c_antsel_attach(struct brcms_c_info *wlc);
++extern void brcms_c_antsel_detach(struct antsel_info *asi);
++extern void brcms_c_antsel_init(struct antsel_info *asi);
++extern void brcms_c_antsel_antcfg_get(struct antsel_info *asi, bool usedef,
++				  bool sel,
++				  u8 id, u8 fbid, u8 *antcfg,
++				  u8 *fbantcfg);
++extern u8 brcms_c_antsel_antsel2id(struct antsel_info *asi, u16 antsel);
++
++#endif /* _BRCM_ANTSEL_H_ */
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/brcms_trace_events.c b/drivers/net/wireless/brcm80211/brcmsmac/brcms_trace_events.c
+new file mode 100644
+index 0000000..52fc9ee
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmsmac/brcms_trace_events.c
+@@ -0,0 +1,23 @@
++/*
++ * Copyright (c) 2011 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#include <linux/module.h> /* bug in tracepoint.h, it should include this */
++
++#ifndef __CHECKER__
++#include "mac80211_if.h"
++#define CREATE_TRACE_POINTS
++#include "brcms_trace_events.h"
++#endif
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/brcms_trace_events.h b/drivers/net/wireless/brcm80211/brcmsmac/brcms_trace_events.h
+new file mode 100644
+index 0000000..27dd73e
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmsmac/brcms_trace_events.h
+@@ -0,0 +1,92 @@
++/*
++ * Copyright (c) 2011 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#undef TRACE_SYSTEM
++#define TRACE_SYSTEM brcmsmac
++
++#if !defined(__TRACE_BRCMSMAC_H) || defined(TRACE_HEADER_MULTI_READ)
++
++#define __TRACE_BRCMSMAC_H
++
++#include <linux/tracepoint.h>
++#include "mac80211_if.h"
++
++#ifndef CONFIG_BRCMDBG
++#undef TRACE_EVENT
++#define TRACE_EVENT(name, proto, ...) \
++static inline void trace_ ## name(proto) {}
++#endif
++
++/*
++ * We define a tracepoint, its arguments, its printk format and its
++ * 'fast binary record' layout.
++ */
++TRACE_EVENT(brcms_timer,
++	/* TPPROTO is the prototype of the function called by this tracepoint */
++	TP_PROTO(struct brcms_timer *t),
++	/*
++	 * TPARGS(firstarg, p) are the parameters names, same as found in the
++	 * prototype.
++	 */
++	TP_ARGS(t),
++	/*
++	 * Fast binary tracing: define the trace record via TP_STRUCT__entry().
++	 * You can think about it like a regular C structure local variable
++	 * definition.
++	 */
++	TP_STRUCT__entry(
++		__field(uint, ms)
++		__field(uint, set)
++		__field(uint, periodic)
++	),
++	TP_fast_assign(
++		__entry->ms = t->ms;
++		__entry->set = t->set;
++		__entry->periodic = t->periodic;
++	),
++	TP_printk(
++		"ms=%u set=%u periodic=%u",
++		__entry->ms, __entry->set, __entry->periodic
++	)
++);
++
++TRACE_EVENT(brcms_dpc,
++	TP_PROTO(unsigned long data),
++	TP_ARGS(data),
++	TP_STRUCT__entry(
++		__field(unsigned long, data)
++	),
++	TP_fast_assign(
++		__entry->data = data;
++	),
++	TP_printk(
++		"data=%p",
++		(void *)__entry->data
++	)
++);
++
++#endif /* __TRACE_BRCMSMAC_H */
++
++#ifdef CONFIG_BRCMDBG
++
++#undef TRACE_INCLUDE_PATH
++#define TRACE_INCLUDE_PATH .
++#undef TRACE_INCLUDE_FILE
++#define TRACE_INCLUDE_FILE brcms_trace_events
++
++#include <trace/define_trace.h>
++
++#endif /* CONFIG_BRCMDBG */
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/channel.c b/drivers/net/wireless/brcm80211/brcmsmac/channel.c
+new file mode 100644
+index 0000000..eb77ac3
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmsmac/channel.c
+@@ -0,0 +1,1506 @@
++/*
++ * Copyright (c) 2010 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#include <linux/types.h>
++#include <net/mac80211.h>
++
++#include <defs.h>
++#include "pub.h"
++#include "phy/phy_hal.h"
++#include "main.h"
++#include "stf.h"
++#include "channel.h"
++
++/* QDB() macro takes a dB value and converts to a quarter dB value */
++#define QDB(n) ((n) * BRCMS_TXPWR_DB_FACTOR)
++
++#define  LOCALE_CHAN_01_11	 (1<<0)
++#define  LOCALE_CHAN_12_13	 (1<<1)
++#define  LOCALE_CHAN_14		 (1<<2)
++#define  LOCALE_SET_5G_LOW_JP1   (1<<3)	/* 34-48, step 2 */
++#define  LOCALE_SET_5G_LOW_JP2   (1<<4)	/* 34-46, step 4 */
++#define  LOCALE_SET_5G_LOW1      (1<<5)	/* 36-48, step 4 */
++#define  LOCALE_SET_5G_LOW2      (1<<6)	/* 52 */
++#define  LOCALE_SET_5G_LOW3      (1<<7)	/* 56-64, step 4 */
++#define  LOCALE_SET_5G_MID1      (1<<8)	/* 100-116, step 4 */
++#define  LOCALE_SET_5G_MID2	 (1<<9)	/* 120-124, step 4 */
++#define  LOCALE_SET_5G_MID3      (1<<10)	/* 128 */
++#define  LOCALE_SET_5G_HIGH1     (1<<11)	/* 132-140, step 4 */
++#define  LOCALE_SET_5G_HIGH2     (1<<12)	/* 149-161, step 4 */
++#define  LOCALE_SET_5G_HIGH3     (1<<13)	/* 165 */
++#define  LOCALE_CHAN_52_140_ALL  (1<<14)
++#define  LOCALE_SET_5G_HIGH4     (1<<15)	/* 184-216 */
++
++#define  LOCALE_CHAN_36_64	(LOCALE_SET_5G_LOW1 | \
++				 LOCALE_SET_5G_LOW2 | \
++				 LOCALE_SET_5G_LOW3)
++#define  LOCALE_CHAN_52_64	(LOCALE_SET_5G_LOW2 | LOCALE_SET_5G_LOW3)
++#define  LOCALE_CHAN_100_124	(LOCALE_SET_5G_MID1 | LOCALE_SET_5G_MID2)
++#define  LOCALE_CHAN_100_140	(LOCALE_SET_5G_MID1 | LOCALE_SET_5G_MID2 | \
++				  LOCALE_SET_5G_MID3 | LOCALE_SET_5G_HIGH1)
++#define  LOCALE_CHAN_149_165	(LOCALE_SET_5G_HIGH2 | LOCALE_SET_5G_HIGH3)
++#define  LOCALE_CHAN_184_216	LOCALE_SET_5G_HIGH4
++
++#define  LOCALE_CHAN_01_14	(LOCALE_CHAN_01_11 | \
++				 LOCALE_CHAN_12_13 | \
++				 LOCALE_CHAN_14)
++
++#define  LOCALE_RADAR_SET_NONE		  0
++#define  LOCALE_RADAR_SET_1		  1
++
++#define  LOCALE_RESTRICTED_NONE		  0
++#define  LOCALE_RESTRICTED_SET_2G_SHORT   1
++#define  LOCALE_RESTRICTED_CHAN_165       2
++#define  LOCALE_CHAN_ALL_5G		  3
++#define  LOCALE_RESTRICTED_JAPAN_LEGACY   4
++#define  LOCALE_RESTRICTED_11D_2G	  5
++#define  LOCALE_RESTRICTED_11D_5G	  6
++#define  LOCALE_RESTRICTED_LOW_HI	  7
++#define  LOCALE_RESTRICTED_12_13_14	  8
++
++#define LOCALE_2G_IDX_i			0
++#define LOCALE_5G_IDX_11		0
++#define LOCALE_MIMO_IDX_bn		0
++#define LOCALE_MIMO_IDX_11n		0
++
++/* max of BAND_5G_PWR_LVLS and 6 for 2.4 GHz */
++#define BRCMS_MAXPWR_TBL_SIZE		6
++/* max of BAND_5G_PWR_LVLS and 14 for 2.4 GHz */
++#define BRCMS_MAXPWR_MIMO_TBL_SIZE	14
++
++/* power level in group of 2.4GHz band channels:
++ * maxpwr[0] - CCK  channels [1]
++ * maxpwr[1] - CCK  channels [2-10]
++ * maxpwr[2] - CCK  channels [11-14]
++ * maxpwr[3] - OFDM channels [1]
++ * maxpwr[4] - OFDM channels [2-10]
++ * maxpwr[5] - OFDM channels [11-14]
++ */
++
++/* maxpwr mapping to 5GHz band channels:
++ * maxpwr[0] - channels [34-48]
++ * maxpwr[1] - channels [52-60]
++ * maxpwr[2] - channels [62-64]
++ * maxpwr[3] - channels [100-140]
++ * maxpwr[4] - channels [149-165]
++ */
++#define BAND_5G_PWR_LVLS	5	/* 5 power levels for 5G */
++
++#define LC(id)	LOCALE_MIMO_IDX_ ## id
++
++#define LC_2G(id)	LOCALE_2G_IDX_ ## id
++
++#define LC_5G(id)	LOCALE_5G_IDX_ ## id
++
++#define LOCALES(band2, band5, mimo2, mimo5) \
++		{LC_2G(band2), LC_5G(band5), LC(mimo2), LC(mimo5)}
++
++/* macro to get 2.4 GHz channel group index for tx power */
++#define CHANNEL_POWER_IDX_2G_CCK(c) (((c) < 2) ? 0 : (((c) < 11) ? 1 : 2))
++#define CHANNEL_POWER_IDX_2G_OFDM(c) (((c) < 2) ? 3 : (((c) < 11) ? 4 : 5))
++
++/* macro to get 5 GHz channel group index for tx power */
++#define CHANNEL_POWER_IDX_5G(c) (((c) < 52) ? 0 : \
++				 (((c) < 62) ? 1 : \
++				 (((c) < 100) ? 2 : \
++				 (((c) < 149) ? 3 : 4))))
++
++#define ISDFS_EU(fl)		(((fl) & BRCMS_DFS_EU) == BRCMS_DFS_EU)
++
++struct brcms_cm_band {
++	/* struct locale_info flags */
++	u8 locale_flags;
++	/* List of valid channels in the country */
++	struct brcms_chanvec valid_channels;
++	/* List of restricted use channels */
++	const struct brcms_chanvec *restricted_channels;
++	/* List of radar sensitive channels */
++	const struct brcms_chanvec *radar_channels;
++	u8 PAD[8];
++};
++
++ /* locale per-channel tx power limits for MIMO frames
++  * maxpwr arrays are index by channel for 2.4 GHz limits, and
++  * by sub-band for 5 GHz limits using CHANNEL_POWER_IDX_5G(channel)
++  */
++struct locale_mimo_info {
++	/* tx 20 MHz power limits, qdBm units */
++	s8 maxpwr20[BRCMS_MAXPWR_MIMO_TBL_SIZE];
++	/* tx 40 MHz power limits, qdBm units */
++	s8 maxpwr40[BRCMS_MAXPWR_MIMO_TBL_SIZE];
++	u8 flags;
++};
++
++/* Country names and abbreviations with locale defined from ISO 3166 */
++struct country_info {
++	const u8 locale_2G;	/* 2.4G band locale */
++	const u8 locale_5G;	/* 5G band locale */
++	const u8 locale_mimo_2G;	/* 2.4G mimo info */
++	const u8 locale_mimo_5G;	/* 5G mimo info */
++};
++
++struct brcms_cm_info {
++	struct brcms_pub *pub;
++	struct brcms_c_info *wlc;
++	char srom_ccode[BRCM_CNTRY_BUF_SZ];	/* Country Code in SROM */
++	uint srom_regrev;	/* Regulatory Rev for the SROM ccode */
++	const struct country_info *country;	/* current country def */
++	char ccode[BRCM_CNTRY_BUF_SZ];	/* current internal Country Code */
++	uint regrev;		/* current Regulatory Revision */
++	char country_abbrev[BRCM_CNTRY_BUF_SZ];	/* current advertised ccode */
++	/* per-band state (one per phy/radio) */
++	struct brcms_cm_band bandstate[MAXBANDS];
++	/* quiet channels currently for radar sensitivity or 11h support */
++	/* channels on which we cannot transmit */
++	struct brcms_chanvec quiet_channels;
++};
++
++/* locale channel and power info. */
++struct locale_info {
++	u32 valid_channels;
++	/* List of radar sensitive channels */
++	u8 radar_channels;
++	/* List of channels used only if APs are detected */
++	u8 restricted_channels;
++	/* Max tx pwr in qdBm for each sub-band */
++	s8 maxpwr[BRCMS_MAXPWR_TBL_SIZE];
++	/* Country IE advertised max tx pwr in dBm per sub-band */
++	s8 pub_maxpwr[BAND_5G_PWR_LVLS];
++	u8 flags;
++};
++
++/* Regulatory Matrix Spreadsheet (CLM) MIMO v3.7.9 */
++
++/*
++ * Some common channel sets
++ */
++
++/* No channels */
++static const struct brcms_chanvec chanvec_none = {
++	{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00}
++};
++
++/* All 2.4 GHz HW channels */
++static const struct brcms_chanvec chanvec_all_2G = {
++	{0xfe, 0x7f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00}
++};
++
++/* All 5 GHz HW channels */
++static const struct brcms_chanvec chanvec_all_5G = {
++	{0x00, 0x00, 0x00, 0x00, 0x54, 0x55, 0x11, 0x11,
++	 0x01, 0x00, 0x00, 0x00, 0x10, 0x11, 0x11, 0x11,
++	 0x11, 0x11, 0x20, 0x22, 0x22, 0x00, 0x00, 0x11,
++	 0x11, 0x11, 0x11, 0x01}
++};
++
++/*
++ * Radar channel sets
++ */
++
++/* Channels 52 - 64, 100 - 140 */
++static const struct brcms_chanvec radar_set1 = {
++	{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x11,  /* 52 - 60 */
++	 0x01, 0x00, 0x00, 0x00, 0x10, 0x11, 0x11, 0x11,  /* 64, 100 - 124 */
++	 0x11, 0x11, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  /* 128 - 140 */
++	 0x00, 0x00, 0x00, 0x00}
++};
++
++/*
++ * Restricted channel sets
++ */
++
++/* Channels 34, 38, 42, 46 */
++static const struct brcms_chanvec restricted_set_japan_legacy = {
++	{0x00, 0x00, 0x00, 0x00, 0x44, 0x44, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00}
++};
++
++/* Channels 12, 13 */
++static const struct brcms_chanvec restricted_set_2g_short = {
++	{0x00, 0x30, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00}
++};
++
++/* Channel 165 */
++static const struct brcms_chanvec restricted_chan_165 = {
++	{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00}
++};
++
++/* Channels 36 - 48 & 149 - 165 */
++static const struct brcms_chanvec restricted_low_hi = {
++	{0x00, 0x00, 0x00, 0x00, 0x10, 0x11, 0x01, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x20, 0x22, 0x22, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00}
++};
++
++/* Channels 12 - 14 */
++static const struct brcms_chanvec restricted_set_12_13_14 = {
++	{0x00, 0x70, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00}
++};
++
++/* global memory to provide working buffer for expanded locale */
++
++static const struct brcms_chanvec *g_table_radar_set[] = {
++	&chanvec_none,
++	&radar_set1
++};
++
++static const struct brcms_chanvec *g_table_restricted_chan[] = {
++	&chanvec_none,		/* restricted_set_none */
++	&restricted_set_2g_short,
++	&restricted_chan_165,
++	&chanvec_all_5G,
++	&restricted_set_japan_legacy,
++	&chanvec_all_2G,	/* restricted_set_11d_2G */
++	&chanvec_all_5G,	/* restricted_set_11d_5G */
++	&restricted_low_hi,
++	&restricted_set_12_13_14
++};
++
++static const struct brcms_chanvec locale_2g_01_11 = {
++	{0xfe, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00}
++};
++
++static const struct brcms_chanvec locale_2g_12_13 = {
++	{0x00, 0x30, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00}
++};
++
++static const struct brcms_chanvec locale_2g_14 = {
++	{0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00}
++};
++
++static const struct brcms_chanvec locale_5g_LOW_JP1 = {
++	{0x00, 0x00, 0x00, 0x00, 0x54, 0x55, 0x01, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00}
++};
++
++static const struct brcms_chanvec locale_5g_LOW_JP2 = {
++	{0x00, 0x00, 0x00, 0x00, 0x44, 0x44, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00}
++};
++
++static const struct brcms_chanvec locale_5g_LOW1 = {
++	{0x00, 0x00, 0x00, 0x00, 0x10, 0x11, 0x01, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00}
++};
++
++static const struct brcms_chanvec locale_5g_LOW2 = {
++	{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00}
++};
++
++static const struct brcms_chanvec locale_5g_LOW3 = {
++	{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x11,
++	 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00}
++};
++
++static const struct brcms_chanvec locale_5g_MID1 = {
++	{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x10, 0x11, 0x11, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00}
++};
++
++static const struct brcms_chanvec locale_5g_MID2 = {
++	{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x11,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00}
++};
++
++static const struct brcms_chanvec locale_5g_MID3 = {
++	{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00}
++};
++
++static const struct brcms_chanvec locale_5g_HIGH1 = {
++	{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x10, 0x11, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00}
++};
++
++static const struct brcms_chanvec locale_5g_HIGH2 = {
++	{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x20, 0x22, 0x02, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00}
++};
++
++static const struct brcms_chanvec locale_5g_HIGH3 = {
++	{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00}
++};
++
++static const struct brcms_chanvec locale_5g_52_140_ALL = {
++	{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x11,
++	 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11,
++	 0x11, 0x11, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00}
++};
++
++static const struct brcms_chanvec locale_5g_HIGH4 = {
++	{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x11,
++	 0x11, 0x11, 0x11, 0x11}
++};
++
++static const struct brcms_chanvec *g_table_locale_base[] = {
++	&locale_2g_01_11,
++	&locale_2g_12_13,
++	&locale_2g_14,
++	&locale_5g_LOW_JP1,
++	&locale_5g_LOW_JP2,
++	&locale_5g_LOW1,
++	&locale_5g_LOW2,
++	&locale_5g_LOW3,
++	&locale_5g_MID1,
++	&locale_5g_MID2,
++	&locale_5g_MID3,
++	&locale_5g_HIGH1,
++	&locale_5g_HIGH2,
++	&locale_5g_HIGH3,
++	&locale_5g_52_140_ALL,
++	&locale_5g_HIGH4
++};
++
++static void brcms_c_locale_add_channels(struct brcms_chanvec *target,
++				    const struct brcms_chanvec *channels)
++{
++	u8 i;
++	for (i = 0; i < sizeof(struct brcms_chanvec); i++)
++		target->vec[i] |= channels->vec[i];
++}
++
++static void brcms_c_locale_get_channels(const struct locale_info *locale,
++				    struct brcms_chanvec *channels)
++{
++	u8 i;
++
++	memset(channels, 0, sizeof(struct brcms_chanvec));
++
++	for (i = 0; i < ARRAY_SIZE(g_table_locale_base); i++) {
++		if (locale->valid_channels & (1 << i))
++			brcms_c_locale_add_channels(channels,
++						g_table_locale_base[i]);
++	}
++}
++
++/*
++ * Locale Definitions - 2.4 GHz
++ */
++static const struct locale_info locale_i = {	/* locale i. channel 1 - 13 */
++	LOCALE_CHAN_01_11 | LOCALE_CHAN_12_13,
++	LOCALE_RADAR_SET_NONE,
++	LOCALE_RESTRICTED_SET_2G_SHORT,
++	{QDB(19), QDB(19), QDB(19),
++	 QDB(19), QDB(19), QDB(19)},
++	{20, 20, 20, 0},
++	BRCMS_EIRP
++};
++
++/*
++ * Locale Definitions - 5 GHz
++ */
++static const struct locale_info locale_11 = {
++	/* locale 11. channel 36 - 48, 52 - 64, 100 - 140, 149 - 165 */
++	LOCALE_CHAN_36_64 | LOCALE_CHAN_100_140 | LOCALE_CHAN_149_165,
++	LOCALE_RADAR_SET_1,
++	LOCALE_RESTRICTED_NONE,
++	{QDB(21), QDB(21), QDB(21), QDB(21), QDB(21)},
++	{23, 23, 23, 30, 30},
++	BRCMS_EIRP | BRCMS_DFS_EU
++};
++
++static const struct locale_info *g_locale_2g_table[] = {
++	&locale_i
++};
++
++static const struct locale_info *g_locale_5g_table[] = {
++	&locale_11
++};
++
++/*
++ * MIMO Locale Definitions - 2.4 GHz
++ */
++static const struct locale_mimo_info locale_bn = {
++	{QDB(13), QDB(13), QDB(13), QDB(13), QDB(13),
++	 QDB(13), QDB(13), QDB(13), QDB(13), QDB(13),
++	 QDB(13), QDB(13), QDB(13)},
++	{0, 0, QDB(13), QDB(13), QDB(13),
++	 QDB(13), QDB(13), QDB(13), QDB(13), QDB(13),
++	 QDB(13), 0, 0},
++	0
++};
++
++static const struct locale_mimo_info *g_mimo_2g_table[] = {
++	&locale_bn
++};
++
++/*
++ * MIMO Locale Definitions - 5 GHz
++ */
++static const struct locale_mimo_info locale_11n = {
++	{ /* 12.5 dBm */ 50, 50, 50, QDB(15), QDB(15)},
++	{QDB(14), QDB(15), QDB(15), QDB(15), QDB(15)},
++	0
++};
++
++static const struct locale_mimo_info *g_mimo_5g_table[] = {
++	&locale_11n
++};
++
++static const struct {
++	char abbrev[BRCM_CNTRY_BUF_SZ];	/* country abbreviation */
++	struct country_info country;
++} cntry_locales[] = {
++	{
++	"X2", LOCALES(i, 11, bn, 11n)},	/* Worldwide RoW 2 */
++};
++
++#ifdef SUPPORT_40MHZ
++/* 20MHz channel info for 40MHz pairing support */
++struct chan20_info {
++	u8 sb;
++	u8 adj_sbs;
++};
++
++/* indicates adjacent channels that are allowed for a 40 Mhz channel and
++ * those that permitted by the HT
++ */
++struct chan20_info chan20_info[] = {
++	/* 11b/11g */
++/* 0 */ {1, (CH_UPPER_SB | CH_EWA_VALID)},
++/* 1 */ {2, (CH_UPPER_SB | CH_EWA_VALID)},
++/* 2 */ {3, (CH_UPPER_SB | CH_EWA_VALID)},
++/* 3 */ {4, (CH_UPPER_SB | CH_EWA_VALID)},
++/* 4 */ {5, (CH_UPPER_SB | CH_LOWER_SB | CH_EWA_VALID)},
++/* 5 */ {6, (CH_UPPER_SB | CH_LOWER_SB | CH_EWA_VALID)},
++/* 6 */ {7, (CH_UPPER_SB | CH_LOWER_SB | CH_EWA_VALID)},
++/* 7 */ {8, (CH_UPPER_SB | CH_LOWER_SB | CH_EWA_VALID)},
++/* 8 */ {9, (CH_UPPER_SB | CH_LOWER_SB | CH_EWA_VALID)},
++/* 9 */ {10, (CH_LOWER_SB | CH_EWA_VALID)},
++/* 10 */ {11, (CH_LOWER_SB | CH_EWA_VALID)},
++/* 11 */ {12, (CH_LOWER_SB)},
++/* 12 */ {13, (CH_LOWER_SB)},
++/* 13 */ {14, (CH_LOWER_SB)},
++
++/* 11a japan high */
++/* 14 */ {34, (CH_UPPER_SB)},
++/* 15 */ {38, (CH_LOWER_SB)},
++/* 16 */ {42, (CH_LOWER_SB)},
++/* 17 */ {46, (CH_LOWER_SB)},
++
++/* 11a usa low */
++/* 18 */ {36, (CH_UPPER_SB | CH_EWA_VALID)},
++/* 19 */ {40, (CH_LOWER_SB | CH_EWA_VALID)},
++/* 20 */ {44, (CH_UPPER_SB | CH_EWA_VALID)},
++/* 21 */ {48, (CH_LOWER_SB | CH_EWA_VALID)},
++/* 22 */ {52, (CH_UPPER_SB | CH_EWA_VALID)},
++/* 23 */ {56, (CH_LOWER_SB | CH_EWA_VALID)},
++/* 24 */ {60, (CH_UPPER_SB | CH_EWA_VALID)},
++/* 25 */ {64, (CH_LOWER_SB | CH_EWA_VALID)},
++
++/* 11a Europe */
++/* 26 */ {100, (CH_UPPER_SB | CH_EWA_VALID)},
++/* 27 */ {104, (CH_LOWER_SB | CH_EWA_VALID)},
++/* 28 */ {108, (CH_UPPER_SB | CH_EWA_VALID)},
++/* 29 */ {112, (CH_LOWER_SB | CH_EWA_VALID)},
++/* 30 */ {116, (CH_UPPER_SB | CH_EWA_VALID)},
++/* 31 */ {120, (CH_LOWER_SB | CH_EWA_VALID)},
++/* 32 */ {124, (CH_UPPER_SB | CH_EWA_VALID)},
++/* 33 */ {128, (CH_LOWER_SB | CH_EWA_VALID)},
++/* 34 */ {132, (CH_UPPER_SB | CH_EWA_VALID)},
++/* 35 */ {136, (CH_LOWER_SB | CH_EWA_VALID)},
++/* 36 */ {140, (CH_LOWER_SB)},
++
++/* 11a usa high, ref5 only */
++/* The 0x80 bit in pdiv means these are REF5, other entries are REF20 */
++/* 37 */ {149, (CH_UPPER_SB | CH_EWA_VALID)},
++/* 38 */ {153, (CH_LOWER_SB | CH_EWA_VALID)},
++/* 39 */ {157, (CH_UPPER_SB | CH_EWA_VALID)},
++/* 40 */ {161, (CH_LOWER_SB | CH_EWA_VALID)},
++/* 41 */ {165, (CH_LOWER_SB)},
++
++/* 11a japan */
++/* 42 */ {184, (CH_UPPER_SB)},
++/* 43 */ {188, (CH_LOWER_SB)},
++/* 44 */ {192, (CH_UPPER_SB)},
++/* 45 */ {196, (CH_LOWER_SB)},
++/* 46 */ {200, (CH_UPPER_SB)},
++/* 47 */ {204, (CH_LOWER_SB)},
++/* 48 */ {208, (CH_UPPER_SB)},
++/* 49 */ {212, (CH_LOWER_SB)},
++/* 50 */ {216, (CH_LOWER_SB)}
++};
++#endif				/* SUPPORT_40MHZ */
++
++static const struct locale_info *brcms_c_get_locale_2g(u8 locale_idx)
++{
++	if (locale_idx >= ARRAY_SIZE(g_locale_2g_table))
++		return NULL; /* error condition */
++
++	return g_locale_2g_table[locale_idx];
++}
++
++static const struct locale_info *brcms_c_get_locale_5g(u8 locale_idx)
++{
++	if (locale_idx >= ARRAY_SIZE(g_locale_5g_table))
++		return NULL; /* error condition */
++
++	return g_locale_5g_table[locale_idx];
++}
++
++static const struct locale_mimo_info *brcms_c_get_mimo_2g(u8 locale_idx)
++{
++	if (locale_idx >= ARRAY_SIZE(g_mimo_2g_table))
++		return NULL;
++
++	return g_mimo_2g_table[locale_idx];
++}
++
++static const struct locale_mimo_info *brcms_c_get_mimo_5g(u8 locale_idx)
++{
++	if (locale_idx >= ARRAY_SIZE(g_mimo_5g_table))
++		return NULL;
++
++	return g_mimo_5g_table[locale_idx];
++}
++
++static int
++brcms_c_country_aggregate_map(struct brcms_cm_info *wlc_cm, const char *ccode,
++			  char *mapped_ccode, uint *mapped_regrev)
++{
++	return false;
++}
++
++/*
++ * Indicates whether the country provided is valid to pass
++ * to cfg80211 or not.
++ *
++ * returns true if valid; false if not.
++ */
++static bool brcms_c_country_valid(const char *ccode)
++{
++	/*
++	 * only allow ascii alpha uppercase for the first 2
++	 * chars.
++	 */
++	if (!((0x80 & ccode[0]) == 0 && ccode[0] >= 0x41 && ccode[0] <= 0x5A &&
++	      (0x80 & ccode[1]) == 0 && ccode[1] >= 0x41 && ccode[1] <= 0x5A &&
++	      ccode[2] == '\0'))
++		return false;
++
++	/*
++	 * do not match ISO 3166-1 user assigned country codes
++	 * that may be in the driver table
++	 */
++	if (!strcmp("AA", ccode) ||        /* AA */
++	    !strcmp("ZZ", ccode) ||        /* ZZ */
++	    ccode[0] == 'X' ||             /* XA - XZ */
++	    (ccode[0] == 'Q' &&            /* QM - QZ */
++	     (ccode[1] >= 'M' && ccode[1] <= 'Z')))
++		return false;
++
++	if (!strcmp("NA", ccode))
++		return false;
++
++	return true;
++}
++
++/* Lookup a country info structure from a null terminated country
++ * abbreviation and regrev directly with no translation.
++ */
++static const struct country_info *
++brcms_c_country_lookup_direct(const char *ccode, uint regrev)
++{
++	uint size, i;
++
++	/* Should just return 0 for single locale driver. */
++	/* Keep it this way in case we add more locales. (for now anyway) */
++
++	/*
++	 * all other country def arrays are for regrev == 0, so if
++	 * regrev is non-zero, fail
++	 */
++	if (regrev > 0)
++		return NULL;
++
++	/* find matched table entry from country code */
++	size = ARRAY_SIZE(cntry_locales);
++	for (i = 0; i < size; i++) {
++		if (strcmp(ccode, cntry_locales[i].abbrev) == 0)
++			return &cntry_locales[i].country;
++	}
++	return NULL;
++}
++
++static const struct country_info *
++brcms_c_countrycode_map(struct brcms_cm_info *wlc_cm, const char *ccode,
++			char *mapped_ccode, uint *mapped_regrev)
++{
++	struct brcms_c_info *wlc = wlc_cm->wlc;
++	const struct country_info *country;
++	uint srom_regrev = wlc_cm->srom_regrev;
++	const char *srom_ccode = wlc_cm->srom_ccode;
++	int mapped;
++
++	/* check for currently supported ccode size */
++	if (strlen(ccode) > (BRCM_CNTRY_BUF_SZ - 1)) {
++		wiphy_err(wlc->wiphy, "wl%d: %s: ccode \"%s\" too long for "
++			  "match\n", wlc->pub->unit, __func__, ccode);
++		return NULL;
++	}
++
++	/* default mapping is the given ccode and regrev 0 */
++	strncpy(mapped_ccode, ccode, BRCM_CNTRY_BUF_SZ);
++	*mapped_regrev = 0;
++
++	/* If the desired country code matches the srom country code,
++	 * then the mapped country is the srom regulatory rev.
++	 * Otherwise look for an aggregate mapping.
++	 */
++	if (!strcmp(srom_ccode, ccode)) {
++		*mapped_regrev = srom_regrev;
++		mapped = 0;
++		wiphy_err(wlc->wiphy, "srom_code == ccode %s\n", __func__);
++	} else {
++		mapped =
++		    brcms_c_country_aggregate_map(wlc_cm, ccode, mapped_ccode,
++					      mapped_regrev);
++	}
++
++	/* find the matching built-in country definition */
++	country = brcms_c_country_lookup_direct(mapped_ccode, *mapped_regrev);
++
++	/* if there is not an exact rev match, default to rev zero */
++	if (country == NULL && *mapped_regrev != 0) {
++		*mapped_regrev = 0;
++		country =
++		    brcms_c_country_lookup_direct(mapped_ccode, *mapped_regrev);
++	}
++
++	return country;
++}
++
++/* Lookup a country info structure from a null terminated country code
++ * The lookup is case sensitive.
++ */
++static const struct country_info *
++brcms_c_country_lookup(struct brcms_c_info *wlc, const char *ccode)
++{
++	const struct country_info *country;
++	char mapped_ccode[BRCM_CNTRY_BUF_SZ];
++	uint mapped_regrev;
++
++	/*
++	 * map the country code to a built-in country code, regrev, and
++	 * country_info struct
++	 */
++	country = brcms_c_countrycode_map(wlc->cmi, ccode, mapped_ccode,
++					  &mapped_regrev);
++
++	return country;
++}
++
++/*
++ * reset the quiet channels vector to the union
++ * of the restricted and radar channel sets
++ */
++static void brcms_c_quiet_channels_reset(struct brcms_cm_info *wlc_cm)
++{
++	struct brcms_c_info *wlc = wlc_cm->wlc;
++	uint i, j;
++	struct brcms_band *band;
++	const struct brcms_chanvec *chanvec;
++
++	memset(&wlc_cm->quiet_channels, 0, sizeof(struct brcms_chanvec));
++
++	band = wlc->band;
++	for (i = 0; i < wlc->pub->_nbands;
++	     i++, band = wlc->bandstate[OTHERBANDUNIT(wlc)]) {
++
++		/* initialize quiet channels for restricted channels */
++		chanvec = wlc_cm->bandstate[band->bandunit].restricted_channels;
++		for (j = 0; j < sizeof(struct brcms_chanvec); j++)
++			wlc_cm->quiet_channels.vec[j] |= chanvec->vec[j];
++
++	}
++}
++
++/* Is the channel valid for the current locale and current band? */
++static bool brcms_c_valid_channel20(struct brcms_cm_info *wlc_cm, uint val)
++{
++	struct brcms_c_info *wlc = wlc_cm->wlc;
++
++	return ((val < MAXCHANNEL) &&
++		isset(wlc_cm->bandstate[wlc->band->bandunit].valid_channels.vec,
++		      val));
++}
++
++/* Is the channel valid for the current locale and specified band? */
++static bool brcms_c_valid_channel20_in_band(struct brcms_cm_info *wlc_cm,
++					    uint bandunit, uint val)
++{
++	return ((val < MAXCHANNEL)
++		&& isset(wlc_cm->bandstate[bandunit].valid_channels.vec, val));
++}
++
++/* Is the channel valid for the current locale? (but don't consider channels not
++ *   available due to bandlocking)
++ */
++static bool brcms_c_valid_channel20_db(struct brcms_cm_info *wlc_cm, uint val)
++{
++	struct brcms_c_info *wlc = wlc_cm->wlc;
++
++	return brcms_c_valid_channel20(wlc->cmi, val) ||
++		(!wlc->bandlocked
++		 && brcms_c_valid_channel20_in_band(wlc->cmi,
++						    OTHERBANDUNIT(wlc), val));
++}
++
++/* JP, J1 - J10 are Japan ccodes */
++static bool brcms_c_japan_ccode(const char *ccode)
++{
++	return (ccode[0] == 'J' &&
++		(ccode[1] == 'P' || (ccode[1] >= '1' && ccode[1] <= '9')));
++}
++
++/* Returns true if currently set country is Japan or variant */
++static bool brcms_c_japan(struct brcms_c_info *wlc)
++{
++	return brcms_c_japan_ccode(wlc->cmi->country_abbrev);
++}
++
++static void
++brcms_c_channel_min_txpower_limits_with_local_constraint(
++		struct brcms_cm_info *wlc_cm, struct txpwr_limits *txpwr,
++		u8 local_constraint_qdbm)
++{
++	int j;
++
++	/* CCK Rates */
++	for (j = 0; j < WL_TX_POWER_CCK_NUM; j++)
++		txpwr->cck[j] = min(txpwr->cck[j], local_constraint_qdbm);
++
++	/* 20 MHz Legacy OFDM SISO */
++	for (j = 0; j < WL_TX_POWER_OFDM_NUM; j++)
++		txpwr->ofdm[j] = min(txpwr->ofdm[j], local_constraint_qdbm);
++
++	/* 20 MHz Legacy OFDM CDD */
++	for (j = 0; j < BRCMS_NUM_RATES_OFDM; j++)
++		txpwr->ofdm_cdd[j] =
++		    min(txpwr->ofdm_cdd[j], local_constraint_qdbm);
++
++	/* 40 MHz Legacy OFDM SISO */
++	for (j = 0; j < BRCMS_NUM_RATES_OFDM; j++)
++		txpwr->ofdm_40_siso[j] =
++		    min(txpwr->ofdm_40_siso[j], local_constraint_qdbm);
++
++	/* 40 MHz Legacy OFDM CDD */
++	for (j = 0; j < BRCMS_NUM_RATES_OFDM; j++)
++		txpwr->ofdm_40_cdd[j] =
++		    min(txpwr->ofdm_40_cdd[j], local_constraint_qdbm);
++
++	/* 20MHz MCS 0-7 SISO */
++	for (j = 0; j < BRCMS_NUM_RATES_MCS_1_STREAM; j++)
++		txpwr->mcs_20_siso[j] =
++		    min(txpwr->mcs_20_siso[j], local_constraint_qdbm);
++
++	/* 20MHz MCS 0-7 CDD */
++	for (j = 0; j < BRCMS_NUM_RATES_MCS_1_STREAM; j++)
++		txpwr->mcs_20_cdd[j] =
++		    min(txpwr->mcs_20_cdd[j], local_constraint_qdbm);
++
++	/* 20MHz MCS 0-7 STBC */
++	for (j = 0; j < BRCMS_NUM_RATES_MCS_1_STREAM; j++)
++		txpwr->mcs_20_stbc[j] =
++		    min(txpwr->mcs_20_stbc[j], local_constraint_qdbm);
++
++	/* 20MHz MCS 8-15 MIMO */
++	for (j = 0; j < BRCMS_NUM_RATES_MCS_2_STREAM; j++)
++		txpwr->mcs_20_mimo[j] =
++		    min(txpwr->mcs_20_mimo[j], local_constraint_qdbm);
++
++	/* 40MHz MCS 0-7 SISO */
++	for (j = 0; j < BRCMS_NUM_RATES_MCS_1_STREAM; j++)
++		txpwr->mcs_40_siso[j] =
++		    min(txpwr->mcs_40_siso[j], local_constraint_qdbm);
++
++	/* 40MHz MCS 0-7 CDD */
++	for (j = 0; j < BRCMS_NUM_RATES_MCS_1_STREAM; j++)
++		txpwr->mcs_40_cdd[j] =
++		    min(txpwr->mcs_40_cdd[j], local_constraint_qdbm);
++
++	/* 40MHz MCS 0-7 STBC */
++	for (j = 0; j < BRCMS_NUM_RATES_MCS_1_STREAM; j++)
++		txpwr->mcs_40_stbc[j] =
++		    min(txpwr->mcs_40_stbc[j], local_constraint_qdbm);
++
++	/* 40MHz MCS 8-15 MIMO */
++	for (j = 0; j < BRCMS_NUM_RATES_MCS_2_STREAM; j++)
++		txpwr->mcs_40_mimo[j] =
++		    min(txpwr->mcs_40_mimo[j], local_constraint_qdbm);
++
++	/* 40MHz MCS 32 */
++	txpwr->mcs32 = min(txpwr->mcs32, local_constraint_qdbm);
++
++}
++
++/* Update the radio state (enable/disable) and tx power targets
++ * based on a new set of channel/regulatory information
++ */
++static void brcms_c_channels_commit(struct brcms_cm_info *wlc_cm)
++{
++	struct brcms_c_info *wlc = wlc_cm->wlc;
++	uint chan;
++	struct txpwr_limits txpwr;
++
++	/* search for the existence of any valid channel */
++	for (chan = 0; chan < MAXCHANNEL; chan++) {
++		if (brcms_c_valid_channel20_db(wlc->cmi, chan))
++			break;
++	}
++	if (chan == MAXCHANNEL)
++		chan = INVCHANNEL;
++
++	/*
++	 * based on the channel search above, set or
++	 * clear WL_RADIO_COUNTRY_DISABLE.
++	 */
++	if (chan == INVCHANNEL) {
++		/*
++		 * country/locale with no valid channels, set
++		 * the radio disable bit
++		 */
++		mboolset(wlc->pub->radio_disabled, WL_RADIO_COUNTRY_DISABLE);
++		wiphy_err(wlc->wiphy, "wl%d: %s: no valid channel for \"%s\" "
++			  "nbands %d bandlocked %d\n", wlc->pub->unit,
++			  __func__, wlc_cm->country_abbrev, wlc->pub->_nbands,
++			  wlc->bandlocked);
++	} else if (mboolisset(wlc->pub->radio_disabled,
++			      WL_RADIO_COUNTRY_DISABLE)) {
++		/*
++		 * country/locale with valid channel, clear
++		 * the radio disable bit
++		 */
++		mboolclr(wlc->pub->radio_disabled, WL_RADIO_COUNTRY_DISABLE);
++	}
++
++	/*
++	 * Now that the country abbreviation is set, if the radio supports 2G,
++	 * then set channel 14 restrictions based on the new locale.
++	 */
++	if (wlc->pub->_nbands > 1 || wlc->band->bandtype == BRCM_BAND_2G)
++		wlc_phy_chanspec_ch14_widefilter_set(wlc->band->pi,
++						     brcms_c_japan(wlc) ? true :
++						     false);
++
++	if (wlc->pub->up && chan != INVCHANNEL) {
++		brcms_c_channel_reg_limits(wlc_cm, wlc->chanspec, &txpwr);
++		brcms_c_channel_min_txpower_limits_with_local_constraint(wlc_cm,
++			&txpwr, BRCMS_TXPWR_MAX);
++		wlc_phy_txpower_limit_set(wlc->band->pi, &txpwr, wlc->chanspec);
++	}
++}
++
++static int
++brcms_c_channels_init(struct brcms_cm_info *wlc_cm,
++		      const struct country_info *country)
++{
++	struct brcms_c_info *wlc = wlc_cm->wlc;
++	uint i, j;
++	struct brcms_band *band;
++	const struct locale_info *li;
++	struct brcms_chanvec sup_chan;
++	const struct locale_mimo_info *li_mimo;
++
++	band = wlc->band;
++	for (i = 0; i < wlc->pub->_nbands;
++	     i++, band = wlc->bandstate[OTHERBANDUNIT(wlc)]) {
++
++		li = (band->bandtype == BRCM_BAND_5G) ?
++		    brcms_c_get_locale_5g(country->locale_5G) :
++		    brcms_c_get_locale_2g(country->locale_2G);
++		wlc_cm->bandstate[band->bandunit].locale_flags = li->flags;
++		li_mimo = (band->bandtype == BRCM_BAND_5G) ?
++		    brcms_c_get_mimo_5g(country->locale_mimo_5G) :
++		    brcms_c_get_mimo_2g(country->locale_mimo_2G);
++
++		/* merge the mimo non-mimo locale flags */
++		wlc_cm->bandstate[band->bandunit].locale_flags |=
++		    li_mimo->flags;
++
++		wlc_cm->bandstate[band->bandunit].restricted_channels =
++		    g_table_restricted_chan[li->restricted_channels];
++		wlc_cm->bandstate[band->bandunit].radar_channels =
++		    g_table_radar_set[li->radar_channels];
++
++		/*
++		 * set the channel availability, masking out the channels
++		 * that may not be supported on this phy.
++		 */
++		wlc_phy_chanspec_band_validch(band->pi, band->bandtype,
++					      &sup_chan);
++		brcms_c_locale_get_channels(li,
++					&wlc_cm->bandstate[band->bandunit].
++					valid_channels);
++		for (j = 0; j < sizeof(struct brcms_chanvec); j++)
++			wlc_cm->bandstate[band->bandunit].valid_channels.
++			    vec[j] &= sup_chan.vec[j];
++	}
++
++	brcms_c_quiet_channels_reset(wlc_cm);
++	brcms_c_channels_commit(wlc_cm);
++
++	return 0;
++}
++
++/*
++ * set the driver's current country and regulatory information
++ * using a country code as the source. Look up built in country
++ * information found with the country code.
++ */
++static void
++brcms_c_set_country_common(struct brcms_cm_info *wlc_cm,
++		       const char *country_abbrev,
++		       const char *ccode, uint regrev,
++		       const struct country_info *country)
++{
++	const struct locale_info *locale;
++	struct brcms_c_info *wlc = wlc_cm->wlc;
++	char prev_country_abbrev[BRCM_CNTRY_BUF_SZ];
++
++	/* save current country state */
++	wlc_cm->country = country;
++
++	memset(&prev_country_abbrev, 0, BRCM_CNTRY_BUF_SZ);
++	strncpy(prev_country_abbrev, wlc_cm->country_abbrev,
++		BRCM_CNTRY_BUF_SZ - 1);
++
++	strncpy(wlc_cm->country_abbrev, country_abbrev, BRCM_CNTRY_BUF_SZ - 1);
++	strncpy(wlc_cm->ccode, ccode, BRCM_CNTRY_BUF_SZ - 1);
++	wlc_cm->regrev = regrev;
++
++	if ((wlc->pub->_n_enab & SUPPORT_11N) !=
++	    wlc->protection->nmode_user)
++		brcms_c_set_nmode(wlc);
++
++	brcms_c_stf_ss_update(wlc, wlc->bandstate[BAND_2G_INDEX]);
++	brcms_c_stf_ss_update(wlc, wlc->bandstate[BAND_5G_INDEX]);
++	/* set or restore gmode as required by regulatory */
++	locale = brcms_c_get_locale_2g(country->locale_2G);
++	if (locale && (locale->flags & BRCMS_NO_OFDM))
++		brcms_c_set_gmode(wlc, GMODE_LEGACY_B, false);
++	else
++		brcms_c_set_gmode(wlc, wlc->protection->gmode_user, false);
++
++	brcms_c_channels_init(wlc_cm, country);
++
++	return;
++}
++
++static int
++brcms_c_set_countrycode_rev(struct brcms_cm_info *wlc_cm,
++			const char *country_abbrev,
++			const char *ccode, int regrev)
++{
++	const struct country_info *country;
++	char mapped_ccode[BRCM_CNTRY_BUF_SZ];
++	uint mapped_regrev;
++
++	/* if regrev is -1, lookup the mapped country code,
++	 * otherwise use the ccode and regrev directly
++	 */
++	if (regrev == -1) {
++		/*
++		 * map the country code to a built-in country
++		 * code, regrev, and country_info
++		 */
++		country =
++		    brcms_c_countrycode_map(wlc_cm, ccode, mapped_ccode,
++					&mapped_regrev);
++	} else {
++		/* find the matching built-in country definition */
++		country = brcms_c_country_lookup_direct(ccode, regrev);
++		strncpy(mapped_ccode, ccode, BRCM_CNTRY_BUF_SZ);
++		mapped_regrev = regrev;
++	}
++
++	if (country == NULL)
++		return -EINVAL;
++
++	/* set the driver state for the country */
++	brcms_c_set_country_common(wlc_cm, country_abbrev, mapped_ccode,
++			       mapped_regrev, country);
++
++	return 0;
++}
++
++/*
++ * set the driver's current country and regulatory information using
++ * a country code as the source. Lookup built in country information
++ * found with the country code.
++ */
++static int
++brcms_c_set_countrycode(struct brcms_cm_info *wlc_cm, const char *ccode)
++{
++	char country_abbrev[BRCM_CNTRY_BUF_SZ];
++	strncpy(country_abbrev, ccode, BRCM_CNTRY_BUF_SZ);
++	return brcms_c_set_countrycode_rev(wlc_cm, country_abbrev, ccode, -1);
++}
++
++struct brcms_cm_info *brcms_c_channel_mgr_attach(struct brcms_c_info *wlc)
++{
++	struct brcms_cm_info *wlc_cm;
++	char country_abbrev[BRCM_CNTRY_BUF_SZ];
++	const struct country_info *country;
++	struct brcms_pub *pub = wlc->pub;
++	struct ssb_sprom *sprom = &wlc->hw->d11core->bus->sprom;
++
++	BCMMSG(wlc->wiphy, "wl%d\n", wlc->pub->unit);
++
++	wlc_cm = kzalloc(sizeof(struct brcms_cm_info), GFP_ATOMIC);
++	if (wlc_cm == NULL)
++		return NULL;
++	wlc_cm->pub = pub;
++	wlc_cm->wlc = wlc;
++	wlc->cmi = wlc_cm;
++
++	/* store the country code for passing up as a regulatory hint */
++	if (sprom->alpha2 && brcms_c_country_valid(sprom->alpha2))
++		strncpy(wlc->pub->srom_ccode, sprom->alpha2, sizeof(sprom->alpha2));
++
++	/*
++	 * internal country information which must match
++	 * regulatory constraints in firmware
++	 */
++	memset(country_abbrev, 0, BRCM_CNTRY_BUF_SZ);
++	strncpy(country_abbrev, "X2", sizeof(country_abbrev) - 1);
++	country = brcms_c_country_lookup(wlc, country_abbrev);
++
++	/* save default country for exiting 11d regulatory mode */
++	strncpy(wlc->country_default, country_abbrev, BRCM_CNTRY_BUF_SZ - 1);
++
++	/* initialize autocountry_default to driver default */
++	strncpy(wlc->autocountry_default, "X2", BRCM_CNTRY_BUF_SZ - 1);
++
++	brcms_c_set_countrycode(wlc_cm, country_abbrev);
++
++	return wlc_cm;
++}
++
++void brcms_c_channel_mgr_detach(struct brcms_cm_info *wlc_cm)
++{
++	kfree(wlc_cm);
++}
++
++u8
++brcms_c_channel_locale_flags_in_band(struct brcms_cm_info *wlc_cm,
++				     uint bandunit)
++{
++	return wlc_cm->bandstate[bandunit].locale_flags;
++}
++
++static bool
++brcms_c_quiet_chanspec(struct brcms_cm_info *wlc_cm, u16 chspec)
++{
++	return (wlc_cm->wlc->pub->_n_enab & SUPPORT_11N) &&
++		CHSPEC_IS40(chspec) ?
++		(isset(wlc_cm->quiet_channels.vec,
++		       lower_20_sb(CHSPEC_CHANNEL(chspec))) ||
++		 isset(wlc_cm->quiet_channels.vec,
++		       upper_20_sb(CHSPEC_CHANNEL(chspec)))) :
++		isset(wlc_cm->quiet_channels.vec, CHSPEC_CHANNEL(chspec));
++}
++
++void
++brcms_c_channel_set_chanspec(struct brcms_cm_info *wlc_cm, u16 chanspec,
++			 u8 local_constraint_qdbm)
++{
++	struct brcms_c_info *wlc = wlc_cm->wlc;
++	struct txpwr_limits txpwr;
++
++	brcms_c_channel_reg_limits(wlc_cm, chanspec, &txpwr);
++
++	brcms_c_channel_min_txpower_limits_with_local_constraint(
++		wlc_cm, &txpwr, local_constraint_qdbm
++	);
++
++	brcms_b_set_chanspec(wlc->hw, chanspec,
++			      (brcms_c_quiet_chanspec(wlc_cm, chanspec) != 0),
++			      &txpwr);
++}
++
++void
++brcms_c_channel_reg_limits(struct brcms_cm_info *wlc_cm, u16 chanspec,
++		       struct txpwr_limits *txpwr)
++{
++	struct brcms_c_info *wlc = wlc_cm->wlc;
++	uint i;
++	uint chan;
++	int maxpwr;
++	int delta;
++	const struct country_info *country;
++	struct brcms_band *band;
++	const struct locale_info *li;
++	int conducted_max = BRCMS_TXPWR_MAX;
++	int conducted_ofdm_max = BRCMS_TXPWR_MAX;
++	const struct locale_mimo_info *li_mimo;
++	int maxpwr20, maxpwr40;
++	int maxpwr_idx;
++	uint j;
++
++	memset(txpwr, 0, sizeof(struct txpwr_limits));
++
++	if (!brcms_c_valid_chanspec_db(wlc_cm, chanspec)) {
++		country = brcms_c_country_lookup(wlc, wlc->autocountry_default);
++		if (country == NULL)
++			return;
++	} else {
++		country = wlc_cm->country;
++	}
++
++	chan = CHSPEC_CHANNEL(chanspec);
++	band = wlc->bandstate[chspec_bandunit(chanspec)];
++	li = (band->bandtype == BRCM_BAND_5G) ?
++	    brcms_c_get_locale_5g(country->locale_5G) :
++	    brcms_c_get_locale_2g(country->locale_2G);
++
++	li_mimo = (band->bandtype == BRCM_BAND_5G) ?
++	    brcms_c_get_mimo_5g(country->locale_mimo_5G) :
++	    brcms_c_get_mimo_2g(country->locale_mimo_2G);
++
++	if (li->flags & BRCMS_EIRP) {
++		delta = band->antgain;
++	} else {
++		delta = 0;
++		if (band->antgain > QDB(6))
++			delta = band->antgain - QDB(6);	/* Excess over 6 dB */
++	}
++
++	if (li == &locale_i) {
++		conducted_max = QDB(22);
++		conducted_ofdm_max = QDB(22);
++	}
++
++	/* CCK txpwr limits for 2.4G band */
++	if (band->bandtype == BRCM_BAND_2G) {
++		maxpwr = li->maxpwr[CHANNEL_POWER_IDX_2G_CCK(chan)];
++
++		maxpwr = maxpwr - delta;
++		maxpwr = max(maxpwr, 0);
++		maxpwr = min(maxpwr, conducted_max);
++
++		for (i = 0; i < BRCMS_NUM_RATES_CCK; i++)
++			txpwr->cck[i] = (u8) maxpwr;
++	}
++
++	/* OFDM txpwr limits for 2.4G or 5G bands */
++	if (band->bandtype == BRCM_BAND_2G)
++		maxpwr = li->maxpwr[CHANNEL_POWER_IDX_2G_OFDM(chan)];
++	else
++		maxpwr = li->maxpwr[CHANNEL_POWER_IDX_5G(chan)];
++
++	maxpwr = maxpwr - delta;
++	maxpwr = max(maxpwr, 0);
++	maxpwr = min(maxpwr, conducted_ofdm_max);
++
++	/* Keep OFDM lmit below CCK limit */
++	if (band->bandtype == BRCM_BAND_2G)
++		maxpwr = min_t(int, maxpwr, txpwr->cck[0]);
++
++	for (i = 0; i < BRCMS_NUM_RATES_OFDM; i++)
++		txpwr->ofdm[i] = (u8) maxpwr;
++
++	for (i = 0; i < BRCMS_NUM_RATES_OFDM; i++) {
++		/*
++		 * OFDM 40 MHz SISO has the same power as the corresponding
++		 * MCS0-7 rate unless overriden by the locale specific code.
++		 * We set this value to 0 as a flag (presumably 0 dBm isn't
++		 * a possibility) and then copy the MCS0-7 value to the 40 MHz
++		 * value if it wasn't explicitly set.
++		 */
++		txpwr->ofdm_40_siso[i] = 0;
++
++		txpwr->ofdm_cdd[i] = (u8) maxpwr;
++
++		txpwr->ofdm_40_cdd[i] = 0;
++	}
++
++	/* MIMO/HT specific limits */
++	if (li_mimo->flags & BRCMS_EIRP) {
++		delta = band->antgain;
++	} else {
++		delta = 0;
++		if (band->antgain > QDB(6))
++			delta = band->antgain - QDB(6);	/* Excess over 6 dB */
++	}
++
++	if (band->bandtype == BRCM_BAND_2G)
++		maxpwr_idx = (chan - 1);
++	else
++		maxpwr_idx = CHANNEL_POWER_IDX_5G(chan);
++
++	maxpwr20 = li_mimo->maxpwr20[maxpwr_idx];
++	maxpwr40 = li_mimo->maxpwr40[maxpwr_idx];
++
++	maxpwr20 = maxpwr20 - delta;
++	maxpwr20 = max(maxpwr20, 0);
++	maxpwr40 = maxpwr40 - delta;
++	maxpwr40 = max(maxpwr40, 0);
++
++	/* Fill in the MCS 0-7 (SISO) rates */
++	for (i = 0; i < BRCMS_NUM_RATES_MCS_1_STREAM; i++) {
++
++		/*
++		 * 20 MHz has the same power as the corresponding OFDM rate
++		 * unless overriden by the locale specific code.
++		 */
++		txpwr->mcs_20_siso[i] = txpwr->ofdm[i];
++		txpwr->mcs_40_siso[i] = 0;
++	}
++
++	/* Fill in the MCS 0-7 CDD rates */
++	for (i = 0; i < BRCMS_NUM_RATES_MCS_1_STREAM; i++) {
++		txpwr->mcs_20_cdd[i] = (u8) maxpwr20;
++		txpwr->mcs_40_cdd[i] = (u8) maxpwr40;
++	}
++
++	/*
++	 * These locales have SISO expressed in the
++	 * table and override CDD later
++	 */
++	if (li_mimo == &locale_bn) {
++		if (li_mimo == &locale_bn) {
++			maxpwr20 = QDB(16);
++			maxpwr40 = 0;
++
++			if (chan >= 3 && chan <= 11)
++				maxpwr40 = QDB(16);
++		}
++
++		for (i = 0; i < BRCMS_NUM_RATES_MCS_1_STREAM; i++) {
++			txpwr->mcs_20_siso[i] = (u8) maxpwr20;
++			txpwr->mcs_40_siso[i] = (u8) maxpwr40;
++		}
++	}
++
++	/* Fill in the MCS 0-7 STBC rates */
++	for (i = 0; i < BRCMS_NUM_RATES_MCS_1_STREAM; i++) {
++		txpwr->mcs_20_stbc[i] = 0;
++		txpwr->mcs_40_stbc[i] = 0;
++	}
++
++	/* Fill in the MCS 8-15 SDM rates */
++	for (i = 0; i < BRCMS_NUM_RATES_MCS_2_STREAM; i++) {
++		txpwr->mcs_20_mimo[i] = (u8) maxpwr20;
++		txpwr->mcs_40_mimo[i] = (u8) maxpwr40;
++	}
++
++	/* Fill in MCS32 */
++	txpwr->mcs32 = (u8) maxpwr40;
++
++	for (i = 0, j = 0; i < BRCMS_NUM_RATES_OFDM; i++, j++) {
++		if (txpwr->ofdm_40_cdd[i] == 0)
++			txpwr->ofdm_40_cdd[i] = txpwr->mcs_40_cdd[j];
++		if (i == 0) {
++			i = i + 1;
++			if (txpwr->ofdm_40_cdd[i] == 0)
++				txpwr->ofdm_40_cdd[i] = txpwr->mcs_40_cdd[j];
++		}
++	}
++
++	/*
++	 * Copy the 40 MHZ MCS 0-7 CDD value to the 40 MHZ MCS 0-7 SISO
++	 * value if it wasn't provided explicitly.
++	 */
++	for (i = 0; i < BRCMS_NUM_RATES_MCS_1_STREAM; i++) {
++		if (txpwr->mcs_40_siso[i] == 0)
++			txpwr->mcs_40_siso[i] = txpwr->mcs_40_cdd[i];
++	}
++
++	for (i = 0, j = 0; i < BRCMS_NUM_RATES_OFDM; i++, j++) {
++		if (txpwr->ofdm_40_siso[i] == 0)
++			txpwr->ofdm_40_siso[i] = txpwr->mcs_40_siso[j];
++		if (i == 0) {
++			i = i + 1;
++			if (txpwr->ofdm_40_siso[i] == 0)
++				txpwr->ofdm_40_siso[i] = txpwr->mcs_40_siso[j];
++		}
++	}
++
++	/*
++	 * Copy the 20 and 40 MHz MCS0-7 CDD values to the corresponding
++	 * STBC values if they weren't provided explicitly.
++	 */
++	for (i = 0; i < BRCMS_NUM_RATES_MCS_1_STREAM; i++) {
++		if (txpwr->mcs_20_stbc[i] == 0)
++			txpwr->mcs_20_stbc[i] = txpwr->mcs_20_cdd[i];
++
++		if (txpwr->mcs_40_stbc[i] == 0)
++			txpwr->mcs_40_stbc[i] = txpwr->mcs_40_cdd[i];
++	}
++
++	return;
++}
++
++/*
++ * Verify the chanspec is using a legal set of parameters, i.e. that the
++ * chanspec specified a band, bw, ctl_sb and channel and that the
++ * combination could be legal given any set of circumstances.
++ * RETURNS: true is the chanspec is malformed, false if it looks good.
++ */
++static bool brcms_c_chspec_malformed(u16 chanspec)
++{
++	/* must be 2G or 5G band */
++	if (!CHSPEC_IS5G(chanspec) && !CHSPEC_IS2G(chanspec))
++		return true;
++	/* must be 20 or 40 bandwidth */
++	if (!CHSPEC_IS40(chanspec) && !CHSPEC_IS20(chanspec))
++		return true;
++
++	/* 20MHZ b/w must have no ctl sb, 40 must have a ctl sb */
++	if (CHSPEC_IS20(chanspec)) {
++		if (!CHSPEC_SB_NONE(chanspec))
++			return true;
++	} else if (!CHSPEC_SB_UPPER(chanspec) && !CHSPEC_SB_LOWER(chanspec)) {
++		return true;
++	}
++
++	return false;
++}
++
++/*
++ * Validate the chanspec for this locale, for 40MHZ we need to also
++ * check that the sidebands are valid 20MZH channels in this locale
++ * and they are also a legal HT combination
++ */
++static bool
++brcms_c_valid_chanspec_ext(struct brcms_cm_info *wlc_cm, u16 chspec,
++			   bool dualband)
++{
++	struct brcms_c_info *wlc = wlc_cm->wlc;
++	u8 channel = CHSPEC_CHANNEL(chspec);
++
++	/* check the chanspec */
++	if (brcms_c_chspec_malformed(chspec)) {
++		wiphy_err(wlc->wiphy, "wl%d: malformed chanspec 0x%x\n",
++			wlc->pub->unit, chspec);
++		return false;
++	}
++
++	if (CHANNEL_BANDUNIT(wlc_cm->wlc, channel) !=
++	    chspec_bandunit(chspec))
++		return false;
++
++	/* Check a 20Mhz channel */
++	if (CHSPEC_IS20(chspec)) {
++		if (dualband)
++			return brcms_c_valid_channel20_db(wlc_cm->wlc->cmi,
++							  channel);
++		else
++			return brcms_c_valid_channel20(wlc_cm->wlc->cmi,
++						       channel);
++	}
++#ifdef SUPPORT_40MHZ
++	/*
++	 * We know we are now checking a 40MHZ channel, so we should
++	 * only be here for NPHYS
++	 */
++	if (BRCMS_ISNPHY(wlc->band) || BRCMS_ISSSLPNPHY(wlc->band)) {
++		u8 upper_sideband = 0, idx;
++		u8 num_ch20_entries =
++		    sizeof(chan20_info) / sizeof(struct chan20_info);
++
++		if (!VALID_40CHANSPEC_IN_BAND(wlc, chspec_bandunit(chspec)))
++			return false;
++
++		if (dualband) {
++			if (!brcms_c_valid_channel20_db(wlc->cmi,
++							lower_20_sb(channel)) ||
++			    !brcms_c_valid_channel20_db(wlc->cmi,
++							upper_20_sb(channel)))
++				return false;
++		} else {
++			if (!brcms_c_valid_channel20(wlc->cmi,
++						     lower_20_sb(channel)) ||
++			    !brcms_c_valid_channel20(wlc->cmi,
++						     upper_20_sb(channel)))
++				return false;
++		}
++
++		/* find the lower sideband info in the sideband array */
++		for (idx = 0; idx < num_ch20_entries; idx++) {
++			if (chan20_info[idx].sb == lower_20_sb(channel))
++				upper_sideband = chan20_info[idx].adj_sbs;
++		}
++		/* check that the lower sideband allows an upper sideband */
++		if ((upper_sideband & (CH_UPPER_SB | CH_EWA_VALID)) ==
++		    (CH_UPPER_SB | CH_EWA_VALID))
++			return true;
++		return false;
++	}
++#endif				/* 40 MHZ */
++
++	return false;
++}
++
++bool brcms_c_valid_chanspec_db(struct brcms_cm_info *wlc_cm, u16 chspec)
++{
++	return brcms_c_valid_chanspec_ext(wlc_cm, chspec, true);
++}
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/channel.h b/drivers/net/wireless/brcm80211/brcmsmac/channel.h
+new file mode 100644
+index 0000000..808cb4f
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmsmac/channel.h
+@@ -0,0 +1,53 @@
++/*
++ * Copyright (c) 2010 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#ifndef _BRCM_CHANNEL_H_
++#define _BRCM_CHANNEL_H_
++
++/* conversion for phy txpwr calculations that use .25 dB units */
++#define BRCMS_TXPWR_DB_FACTOR 4
++
++/* bits for locale_info flags */
++#define BRCMS_PEAK_CONDUCTED	0x00	/* Peak for locals */
++#define BRCMS_EIRP		0x01	/* Flag for EIRP */
++#define BRCMS_DFS_TPC		0x02	/* Flag for DFS TPC */
++#define BRCMS_NO_OFDM		0x04	/* Flag for No OFDM */
++#define BRCMS_NO_40MHZ		0x08	/* Flag for No MIMO 40MHz */
++#define BRCMS_NO_MIMO		0x10	/* Flag for No MIMO, 20 or 40 MHz */
++#define BRCMS_RADAR_TYPE_EU       0x20	/* Flag for EU */
++#define BRCMS_DFS_FCC             BRCMS_DFS_TPC	/* Flag for DFS FCC */
++
++#define BRCMS_DFS_EU (BRCMS_DFS_TPC | BRCMS_RADAR_TYPE_EU) /* Flag for DFS EU */
++
++extern struct brcms_cm_info *
++brcms_c_channel_mgr_attach(struct brcms_c_info *wlc);
++
++extern void brcms_c_channel_mgr_detach(struct brcms_cm_info *wlc_cm);
++
++extern u8 brcms_c_channel_locale_flags_in_band(struct brcms_cm_info *wlc_cm,
++					   uint bandunit);
++
++extern bool brcms_c_valid_chanspec_db(struct brcms_cm_info *wlc_cm,
++				      u16 chspec);
++
++extern void brcms_c_channel_reg_limits(struct brcms_cm_info *wlc_cm,
++				   u16 chanspec,
++				   struct txpwr_limits *txpwr);
++extern void brcms_c_channel_set_chanspec(struct brcms_cm_info *wlc_cm,
++				     u16 chanspec,
++				     u8 local_constraint_qdbm);
++
++#endif				/* _WLC_CHANNEL_H */
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/d11.h b/drivers/net/wireless/brcm80211/brcmsmac/d11.h
+new file mode 100644
+index 0000000..3f659e0
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmsmac/d11.h
+@@ -0,0 +1,1901 @@
++/*
++ * Copyright (c) 2010 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#ifndef	_BRCM_D11_H_
++#define	_BRCM_D11_H_
++
++#include <linux/ieee80211.h>
++
++#include <defs.h>
++#include "pub.h"
++#include "dma.h"
++
++/* RX FIFO numbers */
++#define	RX_FIFO			0	/* data and ctl frames */
++#define	RX_TXSTATUS_FIFO	3	/* RX fifo for tx status packages */
++
++/* TX FIFO numbers using WME Access Category */
++#define	TX_AC_BK_FIFO		0	/* Background TX FIFO */
++#define	TX_AC_BE_FIFO		1	/* Best-Effort TX FIFO */
++#define	TX_AC_VI_FIFO		2	/* Video TX FIFO */
++#define	TX_AC_VO_FIFO		3	/* Voice TX FIFO */
++#define	TX_BCMC_FIFO		4	/* Broadcast/Multicast TX FIFO */
++#define	TX_ATIM_FIFO		5	/* TX fifo for ATIM window info */
++
++/* Addr is byte address used by SW; offset is word offset used by uCode */
++
++/* Per AC TX limit settings */
++#define M_AC_TXLMT_BASE_ADDR         (0x180 * 2)
++#define M_AC_TXLMT_ADDR(_ac)         (M_AC_TXLMT_BASE_ADDR + (2 * (_ac)))
++
++/* Legacy TX FIFO numbers */
++#define	TX_DATA_FIFO		TX_AC_BE_FIFO
++#define	TX_CTL_FIFO		TX_AC_VO_FIFO
++
++#define WL_RSSI_ANT_MAX		4	/* max possible rx antennas */
++
++struct intctrlregs {
++	u32 intstatus;
++	u32 intmask;
++};
++
++/* PIO structure,
++ *  support two PIO format: 2 bytes access and 4 bytes access
++ *  basic FIFO register set is per channel(transmit or receive)
++ *  a pair of channels is defined for convenience
++ */
++/* 2byte-wide pio register set per channel(xmt or rcv) */
++struct pio2regs {
++	u16 fifocontrol;
++	u16 fifodata;
++	u16 fifofree;	/* only valid in xmt channel, not in rcv channel */
++	u16 PAD;
++};
++
++/* a pair of pio channels(tx and rx) */
++struct pio2regp {
++	struct pio2regs tx;
++	struct pio2regs rx;
++};
++
++/* 4byte-wide pio register set per channel(xmt or rcv) */
++struct pio4regs {
++	u32 fifocontrol;
++	u32 fifodata;
++};
++
++/* a pair of pio channels(tx and rx) */
++struct pio4regp {
++	struct pio4regs tx;
++	struct pio4regs rx;
++};
++
++/* read: 32-bit register that can be read as 32-bit or as 2 16-bit
++ * write: only low 16b-it half can be written
++ */
++union pmqreg {
++	u32 pmqhostdata;	/* read only! */
++	struct {
++		u16 pmqctrlstatus;	/* read/write */
++		u16 PAD;
++	} w;
++};
++
++struct fifo64 {
++	struct dma64regs dmaxmt;	/* dma tx */
++	struct pio4regs piotx;	/* pio tx */
++	struct dma64regs dmarcv;	/* dma rx */
++	struct pio4regs piorx;	/* pio rx */
++};
++
++/*
++ * Host Interface Registers
++ */
++struct d11regs {
++	/* Device Control ("semi-standard host registers") */
++	u32 PAD[3];		/* 0x0 - 0x8 */
++	u32 biststatus;	/* 0xC */
++	u32 biststatus2;	/* 0x10 */
++	u32 PAD;		/* 0x14 */
++	u32 gptimer;		/* 0x18 */
++	u32 usectimer;	/* 0x1c *//* for corerev >= 26 */
++
++	/* Interrupt Control *//* 0x20 */
++	struct intctrlregs intctrlregs[8];
++
++	u32 PAD[40];		/* 0x60 - 0xFC */
++
++	u32 intrcvlazy[4];	/* 0x100 - 0x10C */
++
++	u32 PAD[4];		/* 0x110 - 0x11c */
++
++	u32 maccontrol;	/* 0x120 */
++	u32 maccommand;	/* 0x124 */
++	u32 macintstatus;	/* 0x128 */
++	u32 macintmask;	/* 0x12C */
++
++	/* Transmit Template Access */
++	u32 tplatewrptr;	/* 0x130 */
++	u32 tplatewrdata;	/* 0x134 */
++	u32 PAD[2];		/* 0x138 - 0x13C */
++
++	/* PMQ registers */
++	union pmqreg pmqreg;	/* 0x140 */
++	u32 pmqpatl;		/* 0x144 */
++	u32 pmqpath;		/* 0x148 */
++	u32 PAD;		/* 0x14C */
++
++	u32 chnstatus;	/* 0x150 */
++	u32 psmdebug;	/* 0x154 */
++	u32 phydebug;	/* 0x158 */
++	u32 machwcap;	/* 0x15C */
++
++	/* Extended Internal Objects */
++	u32 objaddr;		/* 0x160 */
++	u32 objdata;		/* 0x164 */
++	u32 PAD[2];		/* 0x168 - 0x16c */
++
++	u32 frmtxstatus;	/* 0x170 */
++	u32 frmtxstatus2;	/* 0x174 */
++	u32 PAD[2];		/* 0x178 - 0x17c */
++
++	/* TSF host access */
++	u32 tsf_timerlow;	/* 0x180 */
++	u32 tsf_timerhigh;	/* 0x184 */
++	u32 tsf_cfprep;	/* 0x188 */
++	u32 tsf_cfpstart;	/* 0x18c */
++	u32 tsf_cfpmaxdur32;	/* 0x190 */
++	u32 PAD[3];		/* 0x194 - 0x19c */
++
++	u32 maccontrol1;	/* 0x1a0 */
++	u32 machwcap1;	/* 0x1a4 */
++	u32 PAD[14];		/* 0x1a8 - 0x1dc */
++
++	/* Clock control and hardware workarounds*/
++	u32 clk_ctl_st;	/* 0x1e0 */
++	u32 hw_war;
++	u32 d11_phypllctl;	/* the phypll request/avail bits are
++				 * moved to clk_ctl_st
++				 */
++	u32 PAD[5];		/* 0x1ec - 0x1fc */
++
++	/* 0x200-0x37F dma/pio registers */
++	struct fifo64 fifo64regs[6];
++
++	/* FIFO diagnostic port access */
++	struct dma32diag dmafifo;	/* 0x380 - 0x38C */
++
++	u32 aggfifocnt;	/* 0x390 */
++	u32 aggfifodata;	/* 0x394 */
++	u32 PAD[16];		/* 0x398 - 0x3d4 */
++	u16 radioregaddr;	/* 0x3d8 */
++	u16 radioregdata;	/* 0x3da */
++
++	/*
++	 * time delay between the change on rf disable input and
++	 * radio shutdown
++	 */
++	u32 rfdisabledly;	/* 0x3DC */
++
++	/* PHY register access */
++	u16 phyversion;	/* 0x3e0 - 0x0 */
++	u16 phybbconfig;	/* 0x3e2 - 0x1 */
++	u16 phyadcbias;	/* 0x3e4 - 0x2  Bphy only */
++	u16 phyanacore;	/* 0x3e6 - 0x3  pwwrdwn on aphy */
++	u16 phyrxstatus0;	/* 0x3e8 - 0x4 */
++	u16 phyrxstatus1;	/* 0x3ea - 0x5 */
++	u16 phycrsth;	/* 0x3ec - 0x6 */
++	u16 phytxerror;	/* 0x3ee - 0x7 */
++	u16 phychannel;	/* 0x3f0 - 0x8 */
++	u16 PAD[1];		/* 0x3f2 - 0x9 */
++	u16 phytest;		/* 0x3f4 - 0xa */
++	u16 phy4waddr;	/* 0x3f6 - 0xb */
++	u16 phy4wdatahi;	/* 0x3f8 - 0xc */
++	u16 phy4wdatalo;	/* 0x3fa - 0xd */
++	u16 phyregaddr;	/* 0x3fc - 0xe */
++	u16 phyregdata;	/* 0x3fe - 0xf */
++
++	/* IHR *//* 0x400 - 0x7FE */
++
++	/* RXE Block */
++	u16 PAD[3];		/* 0x400 - 0x406 */
++	u16 rcv_fifo_ctl;	/* 0x406 */
++	u16 PAD;		/* 0x408 - 0x40a */
++	u16 rcv_frm_cnt;	/* 0x40a */
++	u16 PAD[4];		/* 0x40a - 0x414 */
++	u16 rssi;		/* 0x414 */
++	u16 PAD[5];		/* 0x414 - 0x420 */
++	u16 rcm_ctl;		/* 0x420 */
++	u16 rcm_mat_data;	/* 0x422 */
++	u16 rcm_mat_mask;	/* 0x424 */
++	u16 rcm_mat_dly;	/* 0x426 */
++	u16 rcm_cond_mask_l;	/* 0x428 */
++	u16 rcm_cond_mask_h;	/* 0x42A */
++	u16 rcm_cond_dly;	/* 0x42C */
++	u16 PAD[1];		/* 0x42E */
++	u16 ext_ihr_addr;	/* 0x430 */
++	u16 ext_ihr_data;	/* 0x432 */
++	u16 rxe_phyrs_2;	/* 0x434 */
++	u16 rxe_phyrs_3;	/* 0x436 */
++	u16 phy_mode;	/* 0x438 */
++	u16 rcmta_ctl;	/* 0x43a */
++	u16 rcmta_size;	/* 0x43c */
++	u16 rcmta_addr0;	/* 0x43e */
++	u16 rcmta_addr1;	/* 0x440 */
++	u16 rcmta_addr2;	/* 0x442 */
++	u16 PAD[30];		/* 0x444 - 0x480 */
++
++	/* PSM Block *//* 0x480 - 0x500 */
++
++	u16 PAD;		/* 0x480 */
++	u16 psm_maccontrol_h;	/* 0x482 */
++	u16 psm_macintstatus_l;	/* 0x484 */
++	u16 psm_macintstatus_h;	/* 0x486 */
++	u16 psm_macintmask_l;	/* 0x488 */
++	u16 psm_macintmask_h;	/* 0x48A */
++	u16 PAD;		/* 0x48C */
++	u16 psm_maccommand;	/* 0x48E */
++	u16 psm_brc;		/* 0x490 */
++	u16 psm_phy_hdr_param;	/* 0x492 */
++	u16 psm_postcard;	/* 0x494 */
++	u16 psm_pcard_loc_l;	/* 0x496 */
++	u16 psm_pcard_loc_h;	/* 0x498 */
++	u16 psm_gpio_in;	/* 0x49A */
++	u16 psm_gpio_out;	/* 0x49C */
++	u16 psm_gpio_oe;	/* 0x49E */
++
++	u16 psm_bred_0;	/* 0x4A0 */
++	u16 psm_bred_1;	/* 0x4A2 */
++	u16 psm_bred_2;	/* 0x4A4 */
++	u16 psm_bred_3;	/* 0x4A6 */
++	u16 psm_brcl_0;	/* 0x4A8 */
++	u16 psm_brcl_1;	/* 0x4AA */
++	u16 psm_brcl_2;	/* 0x4AC */
++	u16 psm_brcl_3;	/* 0x4AE */
++	u16 psm_brpo_0;	/* 0x4B0 */
++	u16 psm_brpo_1;	/* 0x4B2 */
++	u16 psm_brpo_2;	/* 0x4B4 */
++	u16 psm_brpo_3;	/* 0x4B6 */
++	u16 psm_brwk_0;	/* 0x4B8 */
++	u16 psm_brwk_1;	/* 0x4BA */
++	u16 psm_brwk_2;	/* 0x4BC */
++	u16 psm_brwk_3;	/* 0x4BE */
++
++	u16 psm_base_0;	/* 0x4C0 */
++	u16 psm_base_1;	/* 0x4C2 */
++	u16 psm_base_2;	/* 0x4C4 */
++	u16 psm_base_3;	/* 0x4C6 */
++	u16 psm_base_4;	/* 0x4C8 */
++	u16 psm_base_5;	/* 0x4CA */
++	u16 psm_base_6;	/* 0x4CC */
++	u16 psm_pc_reg_0;	/* 0x4CE */
++	u16 psm_pc_reg_1;	/* 0x4D0 */
++	u16 psm_pc_reg_2;	/* 0x4D2 */
++	u16 psm_pc_reg_3;	/* 0x4D4 */
++	u16 PAD[0xD];	/* 0x4D6 - 0x4DE */
++	u16 psm_corectlsts;	/* 0x4f0 *//* Corerev >= 13 */
++	u16 PAD[0x7];	/* 0x4f2 - 0x4fE */
++
++	/* TXE0 Block *//* 0x500 - 0x580 */
++	u16 txe_ctl;		/* 0x500 */
++	u16 txe_aux;		/* 0x502 */
++	u16 txe_ts_loc;	/* 0x504 */
++	u16 txe_time_out;	/* 0x506 */
++	u16 txe_wm_0;	/* 0x508 */
++	u16 txe_wm_1;	/* 0x50A */
++	u16 txe_phyctl;	/* 0x50C */
++	u16 txe_status;	/* 0x50E */
++	u16 txe_mmplcp0;	/* 0x510 */
++	u16 txe_mmplcp1;	/* 0x512 */
++	u16 txe_phyctl1;	/* 0x514 */
++
++	u16 PAD[0x05];	/* 0x510 - 0x51E */
++
++	/* Transmit control */
++	u16 xmtfifodef;	/* 0x520 */
++	u16 xmtfifo_frame_cnt;	/* 0x522 *//* Corerev >= 16 */
++	u16 xmtfifo_byte_cnt;	/* 0x524 *//* Corerev >= 16 */
++	u16 xmtfifo_head;	/* 0x526 *//* Corerev >= 16 */
++	u16 xmtfifo_rd_ptr;	/* 0x528 *//* Corerev >= 16 */
++	u16 xmtfifo_wr_ptr;	/* 0x52A *//* Corerev >= 16 */
++	u16 xmtfifodef1;	/* 0x52C *//* Corerev >= 16 */
++
++	u16 PAD[0x09];	/* 0x52E - 0x53E */
++
++	u16 xmtfifocmd;	/* 0x540 */
++	u16 xmtfifoflush;	/* 0x542 */
++	u16 xmtfifothresh;	/* 0x544 */
++	u16 xmtfifordy;	/* 0x546 */
++	u16 xmtfifoprirdy;	/* 0x548 */
++	u16 xmtfiforqpri;	/* 0x54A */
++	u16 xmttplatetxptr;	/* 0x54C */
++	u16 PAD;		/* 0x54E */
++	u16 xmttplateptr;	/* 0x550 */
++	u16 smpl_clct_strptr;	/* 0x552 *//* Corerev >= 22 */
++	u16 smpl_clct_stpptr;	/* 0x554 *//* Corerev >= 22 */
++	u16 smpl_clct_curptr;	/* 0x556 *//* Corerev >= 22 */
++	u16 PAD[0x04];	/* 0x558 - 0x55E */
++	u16 xmttplatedatalo;	/* 0x560 */
++	u16 xmttplatedatahi;	/* 0x562 */
++
++	u16 PAD[2];		/* 0x564 - 0x566 */
++
++	u16 xmtsel;		/* 0x568 */
++	u16 xmttxcnt;	/* 0x56A */
++	u16 xmttxshmaddr;	/* 0x56C */
++
++	u16 PAD[0x09];	/* 0x56E - 0x57E */
++
++	/* TXE1 Block */
++	u16 PAD[0x40];	/* 0x580 - 0x5FE */
++
++	/* TSF Block */
++	u16 PAD[0X02];	/* 0x600 - 0x602 */
++	u16 tsf_cfpstrt_l;	/* 0x604 */
++	u16 tsf_cfpstrt_h;	/* 0x606 */
++	u16 PAD[0X05];	/* 0x608 - 0x610 */
++	u16 tsf_cfppretbtt;	/* 0x612 */
++	u16 PAD[0XD];	/* 0x614 - 0x62C */
++	u16 tsf_clk_frac_l;	/* 0x62E */
++	u16 tsf_clk_frac_h;	/* 0x630 */
++	u16 PAD[0X14];	/* 0x632 - 0x658 */
++	u16 tsf_random;	/* 0x65A */
++	u16 PAD[0x05];	/* 0x65C - 0x664 */
++	/* GPTimer 2 registers */
++	u16 tsf_gpt2_stat;	/* 0x666 */
++	u16 tsf_gpt2_ctr_l;	/* 0x668 */
++	u16 tsf_gpt2_ctr_h;	/* 0x66A */
++	u16 tsf_gpt2_val_l;	/* 0x66C */
++	u16 tsf_gpt2_val_h;	/* 0x66E */
++	u16 tsf_gptall_stat;	/* 0x670 */
++	u16 PAD[0x07];	/* 0x672 - 0x67E */
++
++	/* IFS Block */
++	u16 ifs_sifs_rx_tx_tx;	/* 0x680 */
++	u16 ifs_sifs_nav_tx;	/* 0x682 */
++	u16 ifs_slot;	/* 0x684 */
++	u16 PAD;		/* 0x686 */
++	u16 ifs_ctl;		/* 0x688 */
++	u16 PAD[0x3];	/* 0x68a - 0x68F */
++	u16 ifsstat;		/* 0x690 */
++	u16 ifsmedbusyctl;	/* 0x692 */
++	u16 iftxdur;		/* 0x694 */
++	u16 PAD[0x3];	/* 0x696 - 0x69b */
++	/* EDCF support in dot11macs */
++	u16 ifs_aifsn;	/* 0x69c */
++	u16 ifs_ctl1;	/* 0x69e */
++
++	/* slow clock registers */
++	u16 scc_ctl;		/* 0x6a0 */
++	u16 scc_timer_l;	/* 0x6a2 */
++	u16 scc_timer_h;	/* 0x6a4 */
++	u16 scc_frac;	/* 0x6a6 */
++	u16 scc_fastpwrup_dly;	/* 0x6a8 */
++	u16 scc_per;		/* 0x6aa */
++	u16 scc_per_frac;	/* 0x6ac */
++	u16 scc_cal_timer_l;	/* 0x6ae */
++	u16 scc_cal_timer_h;	/* 0x6b0 */
++	u16 PAD;		/* 0x6b2 */
++
++	u16 PAD[0x26];
++
++	/* NAV Block */
++	u16 nav_ctl;		/* 0x700 */
++	u16 navstat;		/* 0x702 */
++	u16 PAD[0x3e];	/* 0x702 - 0x77E */
++
++	/* WEP/PMQ Block *//* 0x780 - 0x7FE */
++	u16 PAD[0x20];	/* 0x780 - 0x7BE */
++
++	u16 wepctl;		/* 0x7C0 */
++	u16 wepivloc;	/* 0x7C2 */
++	u16 wepivkey;	/* 0x7C4 */
++	u16 wepwkey;		/* 0x7C6 */
++
++	u16 PAD[4];		/* 0x7C8 - 0x7CE */
++	u16 pcmctl;		/* 0X7D0 */
++	u16 pcmstat;		/* 0X7D2 */
++	u16 PAD[6];		/* 0x7D4 - 0x7DE */
++
++	u16 pmqctl;		/* 0x7E0 */
++	u16 pmqstatus;	/* 0x7E2 */
++	u16 pmqpat0;		/* 0x7E4 */
++	u16 pmqpat1;		/* 0x7E6 */
++	u16 pmqpat2;		/* 0x7E8 */
++
++	u16 pmqdat;		/* 0x7EA */
++	u16 pmqdator;	/* 0x7EC */
++	u16 pmqhst;		/* 0x7EE */
++	u16 pmqpath0;	/* 0x7F0 */
++	u16 pmqpath1;	/* 0x7F2 */
++	u16 pmqpath2;	/* 0x7F4 */
++	u16 pmqdath;		/* 0x7F6 */
++
++	u16 PAD[0x04];	/* 0x7F8 - 0x7FE */
++
++	/* SHM *//* 0x800 - 0xEFE */
++	u16 PAD[0x380];	/* 0x800 - 0xEFE */
++};
++
++/* d11 register field offset */
++#define D11REGOFFS(field)	offsetof(struct d11regs, field)
++
++#define	PIHR_BASE	0x0400	/* byte address of packed IHR region */
++
++/* biststatus */
++#define	BT_DONE		(1U << 31)	/* bist done */
++#define	BT_B2S		(1 << 30)	/* bist2 ram summary bit */
++
++/* intstatus and intmask */
++#define	I_PC		(1 << 10)	/* pci descriptor error */
++#define	I_PD		(1 << 11)	/* pci data error */
++#define	I_DE		(1 << 12)	/* descriptor protocol error */
++#define	I_RU		(1 << 13)	/* receive descriptor underflow */
++#define	I_RO		(1 << 14)	/* receive fifo overflow */
++#define	I_XU		(1 << 15)	/* transmit fifo underflow */
++#define	I_RI		(1 << 16)	/* receive interrupt */
++#define	I_XI		(1 << 24)	/* transmit interrupt */
++
++/* interrupt receive lazy */
++#define	IRL_TO_MASK		0x00ffffff	/* timeout */
++#define	IRL_FC_MASK		0xff000000	/* frame count */
++#define	IRL_FC_SHIFT		24	/* frame count */
++
++/*== maccontrol register ==*/
++#define	MCTL_GMODE		(1U << 31)
++#define	MCTL_DISCARD_PMQ	(1 << 30)
++#define	MCTL_WAKE		(1 << 26)
++#define	MCTL_HPS		(1 << 25)
++#define	MCTL_PROMISC		(1 << 24)
++#define	MCTL_KEEPBADFCS		(1 << 23)
++#define	MCTL_KEEPCONTROL	(1 << 22)
++#define	MCTL_PHYLOCK		(1 << 21)
++#define	MCTL_BCNS_PROMISC	(1 << 20)
++#define	MCTL_LOCK_RADIO		(1 << 19)
++#define	MCTL_AP			(1 << 18)
++#define	MCTL_INFRA		(1 << 17)
++#define	MCTL_BIGEND		(1 << 16)
++#define	MCTL_GPOUT_SEL_MASK	(3 << 14)
++#define	MCTL_GPOUT_SEL_SHIFT	14
++#define	MCTL_EN_PSMDBG		(1 << 13)
++#define	MCTL_IHR_EN		(1 << 10)
++#define	MCTL_SHM_UPPER		(1 <<  9)
++#define	MCTL_SHM_EN		(1 <<  8)
++#define	MCTL_PSM_JMP_0		(1 <<  2)
++#define	MCTL_PSM_RUN		(1 <<  1)
++#define	MCTL_EN_MAC		(1 <<  0)
++
++/*== maccommand register ==*/
++#define	MCMD_BCN0VLD		(1 <<  0)
++#define	MCMD_BCN1VLD		(1 <<  1)
++#define	MCMD_DIRFRMQVAL		(1 <<  2)
++#define	MCMD_CCA		(1 <<  3)
++#define	MCMD_BG_NOISE		(1 <<  4)
++#define	MCMD_SKIP_SHMINIT	(1 <<  5)	/* only used for simulation */
++#define MCMD_SAMPLECOLL		MCMD_SKIP_SHMINIT /* reuse for sample collect */
++
++/*== macintstatus/macintmask ==*/
++/* gracefully suspended */
++#define	MI_MACSSPNDD		(1 <<  0)
++/* beacon template available */
++#define	MI_BCNTPL		(1 <<  1)
++/* TBTT indication */
++#define	MI_TBTT			(1 <<  2)
++/* beacon successfully tx'd */
++#define	MI_BCNSUCCESS		(1 <<  3)
++/* beacon canceled (IBSS) */
++#define	MI_BCNCANCLD		(1 <<  4)
++/* end of ATIM-window (IBSS) */
++#define	MI_ATIMWINEND		(1 <<  5)
++/* PMQ entries available */
++#define	MI_PMQ			(1 <<  6)
++/* non-specific gen-stat bits that are set by PSM */
++#define	MI_NSPECGEN_0		(1 <<  7)
++/* non-specific gen-stat bits that are set by PSM */
++#define	MI_NSPECGEN_1		(1 <<  8)
++/* MAC level Tx error */
++#define	MI_MACTXERR		(1 <<  9)
++/* non-specific gen-stat bits that are set by PSM */
++#define	MI_NSPECGEN_3		(1 << 10)
++/* PHY Tx error */
++#define	MI_PHYTXERR		(1 << 11)
++/* Power Management Event */
++#define	MI_PME			(1 << 12)
++/* General-purpose timer0 */
++#define	MI_GP0			(1 << 13)
++/* General-purpose timer1 */
++#define	MI_GP1			(1 << 14)
++/* (ORed) DMA-interrupts */
++#define	MI_DMAINT		(1 << 15)
++/* MAC has completed a TX FIFO Suspend/Flush */
++#define	MI_TXSTOP		(1 << 16)
++/* MAC has completed a CCA measurement */
++#define	MI_CCA			(1 << 17)
++/* MAC has collected background noise samples */
++#define	MI_BG_NOISE		(1 << 18)
++/* MBSS DTIM TBTT indication */
++#define	MI_DTIM_TBTT		(1 << 19)
++/* Probe response queue needs attention */
++#define MI_PRQ			(1 << 20)
++/* Radio/PHY has been powered back up. */
++#define	MI_PWRUP		(1 << 21)
++#define	MI_RESERVED3		(1 << 22)
++#define	MI_RESERVED2		(1 << 23)
++#define MI_RESERVED1		(1 << 25)
++/* MAC detected change on RF Disable input*/
++#define MI_RFDISABLE		(1 << 28)
++/* MAC has completed a TX */
++#define	MI_TFS			(1 << 29)
++/* A phy status change wrt G mode */
++#define	MI_PHYCHANGED		(1 << 30)
++/* general purpose timeout */
++#define	MI_TO			(1U << 31)
++
++/* Mac capabilities registers */
++/*== machwcap ==*/
++#define	MCAP_TKIPMIC		0x80000000	/* TKIP MIC hardware present */
++
++/*== pmqhost data ==*/
++/* data entry of head pmq entry */
++#define	PMQH_DATA_MASK		0xffff0000
++/* PM entry for BSS config */
++#define	PMQH_BSSCFG		0x00100000
++/* PM Mode OFF: power save off */
++#define	PMQH_PMOFF		0x00010000
++/* PM Mode ON: power save on */
++#define	PMQH_PMON		0x00020000
++/* Dis-associated or De-authenticated */
++#define	PMQH_DASAT		0x00040000
++/* ATIM not acknowledged */
++#define	PMQH_ATIMFAIL		0x00080000
++/* delete head entry */
++#define	PMQH_DEL_ENTRY		0x00000001
++/* delete head entry to cur read pointer -1 */
++#define	PMQH_DEL_MULT		0x00000002
++/* pmq overflow indication */
++#define	PMQH_OFLO		0x00000004
++/* entries are present in pmq */
++#define	PMQH_NOT_EMPTY		0x00000008
++
++/*== phydebug ==*/
++/* phy is asserting carrier sense */
++#define	PDBG_CRS		(1 << 0)
++/* phy is taking xmit byte from mac this cycle */
++#define	PDBG_TXA		(1 << 1)
++/* mac is instructing the phy to transmit a frame */
++#define	PDBG_TXF		(1 << 2)
++/* phy is signalling a transmit Error to the mac */
++#define	PDBG_TXE		(1 << 3)
++/* phy detected the end of a valid frame preamble */
++#define	PDBG_RXF		(1 << 4)
++/* phy detected the end of a valid PLCP header */
++#define	PDBG_RXS		(1 << 5)
++/* rx start not asserted */
++#define	PDBG_RXFRG		(1 << 6)
++/* mac is taking receive byte from phy this cycle */
++#define	PDBG_RXV		(1 << 7)
++/* RF portion of the radio is disabled */
++#define	PDBG_RFD		(1 << 16)
++
++/*== objaddr register ==*/
++#define	OBJADDR_SEL_MASK	0x000F0000
++#define	OBJADDR_UCM_SEL		0x00000000
++#define	OBJADDR_SHM_SEL		0x00010000
++#define	OBJADDR_SCR_SEL		0x00020000
++#define	OBJADDR_IHR_SEL		0x00030000
++#define	OBJADDR_RCMTA_SEL	0x00040000
++#define	OBJADDR_SRCHM_SEL	0x00060000
++#define	OBJADDR_WINC		0x01000000
++#define	OBJADDR_RINC		0x02000000
++#define	OBJADDR_AUTO_INC	0x03000000
++
++#define	WEP_PCMADDR		0x07d4
++#define	WEP_PCMDATA		0x07d6
++
++/*== frmtxstatus ==*/
++#define	TXS_V			(1 << 0)	/* valid bit */
++#define	TXS_STATUS_MASK		0xffff
++#define	TXS_FID_MASK		0xffff0000
++#define	TXS_FID_SHIFT		16
++
++/*== frmtxstatus2 ==*/
++#define	TXS_SEQ_MASK		0xffff
++#define	TXS_PTX_MASK		0xff0000
++#define	TXS_PTX_SHIFT		16
++#define	TXS_MU_MASK		0x01000000
++#define	TXS_MU_SHIFT		24
++
++/*== clk_ctl_st ==*/
++#define CCS_ERSRC_REQ_D11PLL	0x00000100	/* d11 core pll request */
++#define CCS_ERSRC_REQ_PHYPLL	0x00000200	/* PHY pll request */
++#define CCS_ERSRC_AVAIL_D11PLL	0x01000000	/* d11 core pll available */
++#define CCS_ERSRC_AVAIL_PHYPLL	0x02000000	/* PHY pll available */
++
++/* HT Cloclk Ctrl and Clock Avail for 4313 */
++#define CCS_ERSRC_REQ_HT    0x00000010	/* HT avail request */
++#define CCS_ERSRC_AVAIL_HT  0x00020000	/* HT clock available */
++
++/* tsf_cfprep register */
++#define	CFPREP_CBI_MASK		0xffffffc0
++#define	CFPREP_CBI_SHIFT	6
++#define	CFPREP_CFPP		0x00000001
++
++/* tx fifo sizes values are in terms of 256 byte blocks */
++#define TXFIFOCMD_RESET_MASK	(1 << 15)	/* reset */
++#define TXFIFOCMD_FIFOSEL_SHIFT	8	/* fifo */
++#define TXFIFO_FIFOTOP_SHIFT	8	/* fifo start */
++
++#define TXFIFO_START_BLK16	 65	/* Base address + 32 * 512 B/P */
++#define TXFIFO_START_BLK	 6	/* Base address + 6 * 256 B */
++#define TXFIFO_SIZE_UNIT	256	/* one unit corresponds to 256 bytes */
++#define MBSS16_TEMPLMEM_MINBLKS	65	/* one unit corresponds to 256 bytes */
++
++/*== phy versions (PhyVersion:Revision field) ==*/
++/* analog block version */
++#define	PV_AV_MASK		0xf000
++/* analog block version bitfield offset */
++#define	PV_AV_SHIFT		12
++/* phy type */
++#define	PV_PT_MASK		0x0f00
++/* phy type bitfield offset */
++#define	PV_PT_SHIFT		8
++/* phy version */
++#define	PV_PV_MASK		0x000f
++#define	PHY_TYPE(v)		((v & PV_PT_MASK) >> PV_PT_SHIFT)
++
++/*== phy types (PhyVersion:PhyType field) ==*/
++#define	PHY_TYPE_N		4	/* N-Phy value */
++#define	PHY_TYPE_SSN		6	/* SSLPN-Phy value */
++#define	PHY_TYPE_LCN		8	/* LCN-Phy value */
++#define	PHY_TYPE_LCNXN		9	/* LCNXN-Phy value */
++#define	PHY_TYPE_NULL		0xf	/* Invalid Phy value */
++
++/*== analog types (PhyVersion:AnalogType field) ==*/
++#define	ANA_11N_013		5
++
++/* 802.11a PLCP header def */
++struct ofdm_phy_hdr {
++	u8 rlpt[3];		/* rate, length, parity, tail */
++	u16 service;
++	u8 pad;
++} __packed;
++
++#define	D11A_PHY_HDR_GRATE(phdr)	((phdr)->rlpt[0] & 0x0f)
++#define	D11A_PHY_HDR_GRES(phdr)		(((phdr)->rlpt[0] >> 4) & 0x01)
++#define	D11A_PHY_HDR_GLENGTH(phdr)	(((u32 *)((phdr)->rlpt) >> 5) & 0x0fff)
++#define	D11A_PHY_HDR_GPARITY(phdr)	(((phdr)->rlpt[3] >> 1) & 0x01)
++#define	D11A_PHY_HDR_GTAIL(phdr)	(((phdr)->rlpt[3] >> 2) & 0x3f)
++
++/* rate encoded per 802.11a-1999 sec 17.3.4.1 */
++#define	D11A_PHY_HDR_SRATE(phdr, rate)		\
++	((phdr)->rlpt[0] = ((phdr)->rlpt[0] & 0xf0) | ((rate) & 0xf))
++/* set reserved field to zero */
++#define	D11A_PHY_HDR_SRES(phdr)		((phdr)->rlpt[0] &= 0xef)
++/* length is number of octets in PSDU */
++#define	D11A_PHY_HDR_SLENGTH(phdr, length)	\
++	(*(u32 *)((phdr)->rlpt) = *(u32 *)((phdr)->rlpt) | \
++	(((length) & 0x0fff) << 5))
++/* set the tail to all zeros */
++#define	D11A_PHY_HDR_STAIL(phdr)	((phdr)->rlpt[3] &= 0x03)
++
++#define	D11A_PHY_HDR_LEN_L	3	/* low-rate part of PLCP header */
++#define	D11A_PHY_HDR_LEN_R	2	/* high-rate part of PLCP header */
++
++#define	D11A_PHY_TX_DELAY	(2)	/* 2.1 usec */
++
++#define	D11A_PHY_HDR_TIME	(4)	/* low-rate part of PLCP header */
++#define	D11A_PHY_PRE_TIME	(16)
++#define	D11A_PHY_PREHDR_TIME	(D11A_PHY_PRE_TIME + D11A_PHY_HDR_TIME)
++
++/* 802.11b PLCP header def */
++struct cck_phy_hdr {
++	u8 signal;
++	u8 service;
++	u16 length;
++	u16 crc;
++} __packed;
++
++#define	D11B_PHY_HDR_LEN	6
++
++#define	D11B_PHY_TX_DELAY	(3)	/* 3.4 usec */
++
++#define	D11B_PHY_LHDR_TIME	(D11B_PHY_HDR_LEN << 3)
++#define	D11B_PHY_LPRE_TIME	(144)
++#define	D11B_PHY_LPREHDR_TIME	(D11B_PHY_LPRE_TIME + D11B_PHY_LHDR_TIME)
++
++#define	D11B_PHY_SHDR_TIME	(D11B_PHY_LHDR_TIME >> 1)
++#define	D11B_PHY_SPRE_TIME	(D11B_PHY_LPRE_TIME >> 1)
++#define	D11B_PHY_SPREHDR_TIME	(D11B_PHY_SPRE_TIME + D11B_PHY_SHDR_TIME)
++
++#define	D11B_PLCP_SIGNAL_LOCKED	(1 << 2)
++#define	D11B_PLCP_SIGNAL_LE	(1 << 7)
++
++#define MIMO_PLCP_MCS_MASK	0x7f	/* mcs index */
++#define MIMO_PLCP_40MHZ		0x80	/* 40 Hz frame */
++#define MIMO_PLCP_AMPDU		0x08	/* ampdu */
++
++#define BRCMS_GET_CCK_PLCP_LEN(plcp) (plcp[4] + (plcp[5] << 8))
++#define BRCMS_GET_MIMO_PLCP_LEN(plcp) (plcp[1] + (plcp[2] << 8))
++#define BRCMS_SET_MIMO_PLCP_LEN(plcp, len) \
++	do { \
++		plcp[1] = len & 0xff; \
++		plcp[2] = ((len >> 8) & 0xff); \
++	} while (0)
++
++#define BRCMS_SET_MIMO_PLCP_AMPDU(plcp) (plcp[3] |= MIMO_PLCP_AMPDU)
++#define BRCMS_CLR_MIMO_PLCP_AMPDU(plcp) (plcp[3] &= ~MIMO_PLCP_AMPDU)
++#define BRCMS_IS_MIMO_PLCP_AMPDU(plcp) (plcp[3] & MIMO_PLCP_AMPDU)
++
++/*
++ * The dot11a PLCP header is 5 bytes.  To simplify the software (so that we
++ * don't need e.g. different tx DMA headers for 11a and 11b), the PLCP header
++ * has padding added in the ucode.
++ */
++#define	D11_PHY_HDR_LEN	6
++
++/* TX DMA buffer header */
++struct d11txh {
++	__le16 MacTxControlLow;	/* 0x0 */
++	__le16 MacTxControlHigh;	/* 0x1 */
++	__le16 MacFrameControl;	/* 0x2 */
++	__le16 TxFesTimeNormal;	/* 0x3 */
++	__le16 PhyTxControlWord;	/* 0x4 */
++	__le16 PhyTxControlWord_1;	/* 0x5 */
++	__le16 PhyTxControlWord_1_Fbr;	/* 0x6 */
++	__le16 PhyTxControlWord_1_Rts;	/* 0x7 */
++	__le16 PhyTxControlWord_1_FbrRts;	/* 0x8 */
++	__le16 MainRates;	/* 0x9 */
++	__le16 XtraFrameTypes;	/* 0xa */
++	u8 IV[16];		/* 0x0b - 0x12 */
++	u8 TxFrameRA[6];	/* 0x13 - 0x15 */
++	__le16 TxFesTimeFallback;	/* 0x16 */
++	u8 RTSPLCPFallback[6];	/* 0x17 - 0x19 */
++	__le16 RTSDurFallback;	/* 0x1a */
++	u8 FragPLCPFallback[6];	/* 0x1b - 1d */
++	__le16 FragDurFallback;	/* 0x1e */
++	__le16 MModeLen;	/* 0x1f */
++	__le16 MModeFbrLen;	/* 0x20 */
++	__le16 TstampLow;	/* 0x21 */
++	__le16 TstampHigh;	/* 0x22 */
++	__le16 ABI_MimoAntSel;	/* 0x23 */
++	__le16 PreloadSize;	/* 0x24 */
++	__le16 AmpduSeqCtl;	/* 0x25 */
++	__le16 TxFrameID;	/* 0x26 */
++	__le16 TxStatus;	/* 0x27 */
++	__le16 MaxNMpdus;	/* 0x28 */
++	__le16 MaxABytes_MRT;	/* 0x29 */
++	__le16 MaxABytes_FBR;	/* 0x2a */
++	__le16 MinMBytes;	/* 0x2b */
++	u8 RTSPhyHeader[D11_PHY_HDR_LEN];	/* 0x2c - 0x2e */
++	struct ieee80211_rts rts_frame;	/* 0x2f - 0x36 */
++	u16 PAD;		/* 0x37 */
++} __packed;
++
++#define	D11_TXH_LEN		112	/* bytes */
++
++/* Frame Types */
++#define FT_CCK	0
++#define FT_OFDM	1
++#define FT_HT	2
++#define FT_N	3
++
++/*
++ * Position of MPDU inside A-MPDU; indicated with bits 10:9
++ * of MacTxControlLow
++ */
++#define TXC_AMPDU_SHIFT		9	/* shift for ampdu settings */
++#define TXC_AMPDU_NONE		0	/* Regular MPDU, not an A-MPDU */
++#define TXC_AMPDU_FIRST		1	/* first MPDU of an A-MPDU */
++#define TXC_AMPDU_MIDDLE	2	/* intermediate MPDU of an A-MPDU */
++#define TXC_AMPDU_LAST		3	/* last (or single) MPDU of an A-MPDU */
++
++/*== MacTxControlLow ==*/
++#define TXC_AMIC		0x8000
++#define	TXC_SENDCTS		0x0800
++#define TXC_AMPDU_MASK		0x0600
++#define TXC_BW_40		0x0100
++#define TXC_FREQBAND_5G		0x0080
++#define	TXC_DFCS		0x0040
++#define	TXC_IGNOREPMQ		0x0020
++#define	TXC_HWSEQ		0x0010
++#define	TXC_STARTMSDU		0x0008
++#define	TXC_SENDRTS		0x0004
++#define	TXC_LONGFRAME		0x0002
++#define	TXC_IMMEDACK		0x0001
++
++/*== MacTxControlHigh ==*/
++/* RTS fallback preamble type 1 = SHORT 0 = LONG */
++#define TXC_PREAMBLE_RTS_FB_SHORT	0x8000
++/* RTS main rate preamble type 1 = SHORT 0 = LONG */
++#define TXC_PREAMBLE_RTS_MAIN_SHORT	0x4000
++/*
++ * Main fallback rate preamble type
++ *   1 = SHORT for OFDM/GF for MIMO
++ *   0 = LONG for CCK/MM for MIMO
++ */
++#define TXC_PREAMBLE_DATA_FB_SHORT	0x2000
++
++/* TXC_PREAMBLE_DATA_MAIN is in PhyTxControl bit 5 */
++/* use fallback rate for this AMPDU */
++#define	TXC_AMPDU_FBR		0x1000
++#define	TXC_SECKEY_MASK		0x0FF0
++#define	TXC_SECKEY_SHIFT	4
++/* Use alternate txpwr defined at loc. M_ALT_TXPWR_IDX */
++#define	TXC_ALT_TXPWR		0x0008
++#define	TXC_SECTYPE_MASK	0x0007
++#define	TXC_SECTYPE_SHIFT	0
++
++/* Null delimiter for Fallback rate */
++#define AMPDU_FBR_NULL_DELIM  5	/* Location of Null delimiter count for AMPDU */
++
++/* PhyTxControl for Mimophy */
++#define	PHY_TXC_PWR_MASK	0xFC00
++#define	PHY_TXC_PWR_SHIFT	10
++#define	PHY_TXC_ANT_MASK	0x03C0	/* bit 6, 7, 8, 9 */
++#define	PHY_TXC_ANT_SHIFT	6
++#define	PHY_TXC_ANT_0_1		0x00C0	/* auto, last rx */
++#define	PHY_TXC_LCNPHY_ANT_LAST	0x0000
++#define	PHY_TXC_ANT_3		0x0200	/* virtual antenna 3 */
++#define	PHY_TXC_ANT_2		0x0100	/* virtual antenna 2 */
++#define	PHY_TXC_ANT_1		0x0080	/* virtual antenna 1 */
++#define	PHY_TXC_ANT_0		0x0040	/* virtual antenna 0 */
++#define	PHY_TXC_SHORT_HDR	0x0010
++
++#define	PHY_TXC_OLD_ANT_0	0x0000
++#define	PHY_TXC_OLD_ANT_1	0x0100
++#define	PHY_TXC_OLD_ANT_LAST	0x0300
++
++/* PhyTxControl_1 for Mimophy */
++#define PHY_TXC1_BW_MASK		0x0007
++#define PHY_TXC1_BW_10MHZ		0
++#define PHY_TXC1_BW_10MHZ_UP		1
++#define PHY_TXC1_BW_20MHZ		2
++#define PHY_TXC1_BW_20MHZ_UP		3
++#define PHY_TXC1_BW_40MHZ		4
++#define PHY_TXC1_BW_40MHZ_DUP		5
++#define PHY_TXC1_MODE_SHIFT		3
++#define PHY_TXC1_MODE_MASK		0x0038
++#define PHY_TXC1_MODE_SISO		0
++#define PHY_TXC1_MODE_CDD		1
++#define PHY_TXC1_MODE_STBC		2
++#define PHY_TXC1_MODE_SDM		3
++
++/* PhyTxControl for HTphy that are different from Mimophy */
++#define	PHY_TXC_HTANT_MASK		0x3fC0	/* bits 6-13 */
++
++/* XtraFrameTypes */
++#define XFTS_RTS_FT_SHIFT	2
++#define XFTS_FBRRTS_FT_SHIFT	4
++#define XFTS_CHANNEL_SHIFT	8
++
++/* Antenna diversity bit in ant_wr_settle */
++#define	PHY_AWS_ANTDIV		0x2000
++
++/* IFS ctl */
++#define IFS_USEEDCF	(1 << 2)
++
++/* IFS ctl1 */
++#define IFS_CTL1_EDCRS	(1 << 3)
++#define IFS_CTL1_EDCRS_20L (1 << 4)
++#define IFS_CTL1_EDCRS_40 (1 << 5)
++
++/* ABI_MimoAntSel */
++#define ABI_MAS_ADDR_BMP_IDX_MASK	0x0f00
++#define ABI_MAS_ADDR_BMP_IDX_SHIFT	8
++#define ABI_MAS_FBR_ANT_PTN_MASK	0x00f0
++#define ABI_MAS_FBR_ANT_PTN_SHIFT	4
++#define ABI_MAS_MRT_ANT_PTN_MASK	0x000f
++
++/* tx status packet */
++struct tx_status {
++	u16 framelen;
++	u16 PAD;
++	u16 frameid;
++	u16 status;
++	u16 lasttxtime;
++	u16 sequence;
++	u16 phyerr;
++	u16 ackphyrxsh;
++} __packed;
++
++#define	TXSTATUS_LEN	16
++
++/* status field bit definitions */
++#define	TX_STATUS_FRM_RTX_MASK	0xF000
++#define	TX_STATUS_FRM_RTX_SHIFT	12
++#define	TX_STATUS_RTS_RTX_MASK	0x0F00
++#define	TX_STATUS_RTS_RTX_SHIFT	8
++#define TX_STATUS_MASK		0x00FE
++#define	TX_STATUS_PMINDCTD	(1 << 7) /* PM mode indicated to AP */
++#define	TX_STATUS_INTERMEDIATE	(1 << 6) /* intermediate or 1st ampdu pkg */
++#define	TX_STATUS_AMPDU		(1 << 5) /* AMPDU status */
++#define TX_STATUS_SUPR_MASK	0x1C	 /* suppress status bits (4:2) */
++#define TX_STATUS_SUPR_SHIFT	2
++#define	TX_STATUS_ACK_RCV	(1 << 1) /* ACK received */
++#define	TX_STATUS_VALID		(1 << 0) /* Tx status valid */
++#define	TX_STATUS_NO_ACK	0
++
++/* suppress status reason codes */
++#define	TX_STATUS_SUPR_PMQ	(1 << 2) /* PMQ entry */
++#define	TX_STATUS_SUPR_FLUSH	(2 << 2) /* flush request */
++#define	TX_STATUS_SUPR_FRAG	(3 << 2) /* previous frag failure */
++#define	TX_STATUS_SUPR_TBTT	(3 << 2) /* SHARED: Probe resp supr for TBTT */
++#define	TX_STATUS_SUPR_BADCH	(4 << 2) /* channel mismatch */
++#define	TX_STATUS_SUPR_EXPTIME	(5 << 2) /* lifetime expiry */
++#define	TX_STATUS_SUPR_UF	(6 << 2) /* underflow */
++
++/* Unexpected tx status for rate update */
++#define TX_STATUS_UNEXP(status) \
++	((((status) & TX_STATUS_INTERMEDIATE) != 0) && \
++	 TX_STATUS_UNEXP_AMPDU(status))
++
++/* Unexpected tx status for A-MPDU rate update */
++#define TX_STATUS_UNEXP_AMPDU(status) \
++	((((status) & TX_STATUS_SUPR_MASK) != 0) && \
++	 (((status) & TX_STATUS_SUPR_MASK) != TX_STATUS_SUPR_EXPTIME))
++
++#define TX_STATUS_BA_BMAP03_MASK	0xF000	/* ba bitmap 0:3 in 1st pkg */
++#define TX_STATUS_BA_BMAP03_SHIFT	12	/* ba bitmap 0:3 in 1st pkg */
++#define TX_STATUS_BA_BMAP47_MASK	0x001E	/* ba bitmap 4:7 in 2nd pkg */
++#define TX_STATUS_BA_BMAP47_SHIFT	3	/* ba bitmap 4:7 in 2nd pkg */
++
++/* RXE (Receive Engine) */
++
++/* RCM_CTL */
++#define	RCM_INC_MASK_H		0x0080
++#define	RCM_INC_MASK_L		0x0040
++#define	RCM_INC_DATA		0x0020
++#define	RCM_INDEX_MASK		0x001F
++#define	RCM_SIZE		15
++
++#define	RCM_MAC_OFFSET		0	/* current MAC address */
++#define	RCM_BSSID_OFFSET	3	/* current BSSID address */
++#define	RCM_F_BSSID_0_OFFSET	6	/* foreign BSS CFP tracking */
++#define	RCM_F_BSSID_1_OFFSET	9	/* foreign BSS CFP tracking */
++#define	RCM_F_BSSID_2_OFFSET	12	/* foreign BSS CFP tracking */
++
++#define RCM_WEP_TA0_OFFSET	16
++#define RCM_WEP_TA1_OFFSET	19
++#define RCM_WEP_TA2_OFFSET	22
++#define RCM_WEP_TA3_OFFSET	25
++
++/* PSM Block */
++
++/* psm_phy_hdr_param bits */
++#define MAC_PHY_RESET		1
++#define MAC_PHY_CLOCK_EN	2
++#define MAC_PHY_FORCE_CLK	4
++
++/* WEP Block */
++
++/* WEP_WKEY */
++#define	WKEY_START		(1 << 8)
++#define	WKEY_SEL_MASK		0x1F
++
++/* WEP data formats */
++
++/* the number of RCMTA entries */
++#define RCMTA_SIZE 50
++
++#define M_ADDR_BMP_BLK		(0x37e * 2)
++#define M_ADDR_BMP_BLK_SZ	12
++
++#define ADDR_BMP_RA		(1 << 0)	/* Receiver Address (RA) */
++#define ADDR_BMP_TA		(1 << 1)	/* Transmitter Address (TA) */
++#define ADDR_BMP_BSSID		(1 << 2)	/* BSSID */
++#define ADDR_BMP_AP		(1 << 3)	/* Infra-BSS Access Point */
++#define ADDR_BMP_STA		(1 << 4)	/* Infra-BSS Station */
++#define ADDR_BMP_RESERVED1	(1 << 5)
++#define ADDR_BMP_RESERVED2	(1 << 6)
++#define ADDR_BMP_RESERVED3	(1 << 7)
++#define ADDR_BMP_BSS_IDX_MASK	(3 << 8)	/* BSS control block index */
++#define ADDR_BMP_BSS_IDX_SHIFT	8
++
++#define	WSEC_MAX_RCMTA_KEYS	54
++
++/* max keys in M_TKMICKEYS_BLK */
++#define	WSEC_MAX_TKMIC_ENGINE_KEYS		12	/* 8 + 4 default */
++
++/* max RXE match registers */
++#define WSEC_MAX_RXE_KEYS	4
++
++/* SECKINDXALGO (Security Key Index & Algorithm Block) word format */
++/* SKL (Security Key Lookup) */
++#define	SKL_ALGO_MASK		0x0007
++#define	SKL_ALGO_SHIFT		0
++#define	SKL_KEYID_MASK		0x0008
++#define	SKL_KEYID_SHIFT		3
++#define	SKL_INDEX_MASK		0x03F0
++#define	SKL_INDEX_SHIFT		4
++#define	SKL_GRP_ALGO_MASK	0x1c00
++#define	SKL_GRP_ALGO_SHIFT	10
++
++/* additional bits defined for IBSS group key support */
++#define	SKL_IBSS_INDEX_MASK	0x01F0
++#define	SKL_IBSS_INDEX_SHIFT	4
++#define	SKL_IBSS_KEYID1_MASK	0x0600
++#define	SKL_IBSS_KEYID1_SHIFT	9
++#define	SKL_IBSS_KEYID2_MASK	0x1800
++#define	SKL_IBSS_KEYID2_SHIFT	11
++#define	SKL_IBSS_KEYALGO_MASK	0xE000
++#define	SKL_IBSS_KEYALGO_SHIFT	13
++
++#define	WSEC_MODE_OFF		0
++#define	WSEC_MODE_HW		1
++#define	WSEC_MODE_SW		2
++
++#define	WSEC_ALGO_OFF		0
++#define	WSEC_ALGO_WEP1		1
++#define	WSEC_ALGO_TKIP		2
++#define	WSEC_ALGO_AES		3
++#define	WSEC_ALGO_WEP128	4
++#define	WSEC_ALGO_AES_LEGACY	5
++#define	WSEC_ALGO_NALG		6
++
++#define	AES_MODE_NONE		0
++#define	AES_MODE_CCM		1
++
++/* WEP_CTL (Rev 0) */
++#define	WECR0_KEYREG_SHIFT	0
++#define	WECR0_KEYREG_MASK	0x7
++#define	WECR0_DECRYPT		(1 << 3)
++#define	WECR0_IVINLINE		(1 << 4)
++#define	WECR0_WEPALG_SHIFT	5
++#define	WECR0_WEPALG_MASK	(0x7 << 5)
++#define	WECR0_WKEYSEL_SHIFT	8
++#define	WECR0_WKEYSEL_MASK	(0x7 << 8)
++#define	WECR0_WKEYSTART		(1 << 11)
++#define	WECR0_WEPINIT		(1 << 14)
++#define	WECR0_ICVERR		(1 << 15)
++
++/* Frame template map byte offsets */
++#define	T_ACTS_TPL_BASE		(0)
++#define	T_NULL_TPL_BASE		(0xc * 2)
++#define	T_QNULL_TPL_BASE	(0x1c * 2)
++#define	T_RR_TPL_BASE		(0x2c * 2)
++#define	T_BCN0_TPL_BASE		(0x34 * 2)
++#define	T_PRS_TPL_BASE		(0x134 * 2)
++#define	T_BCN1_TPL_BASE		(0x234 * 2)
++#define T_TX_FIFO_TXRAM_BASE	(T_ACTS_TPL_BASE + \
++				 (TXFIFO_START_BLK * TXFIFO_SIZE_UNIT))
++
++#define T_BA_TPL_BASE		T_QNULL_TPL_BASE /* template area for BA */
++
++#define T_RAM_ACCESS_SZ		4	/* template ram is 4 byte access only */
++
++/* Shared Mem byte offsets */
++
++/* Location where the ucode expects the corerev */
++#define	M_MACHW_VER		(0x00b * 2)
++
++/* Location where the ucode expects the MAC capabilities */
++#define	M_MACHW_CAP_L		(0x060 * 2)
++#define	M_MACHW_CAP_H	(0x061 * 2)
++
++/* WME shared memory */
++#define M_EDCF_STATUS_OFF	(0x007 * 2)
++#define M_TXF_CUR_INDEX		(0x018 * 2)
++#define M_EDCF_QINFO		(0x120 * 2)
++
++/* PS-mode related parameters */
++#define	M_DOT11_SLOT		(0x008 * 2)
++#define	M_DOT11_DTIMPERIOD	(0x009 * 2)
++#define	M_NOSLPZNATDTIM		(0x026 * 2)
++
++/* Beacon-related parameters */
++#define	M_BCN0_FRM_BYTESZ	(0x00c * 2)	/* Bcn 0 template length */
++#define	M_BCN1_FRM_BYTESZ	(0x00d * 2)	/* Bcn 1 template length */
++#define	M_BCN_TXTSF_OFFSET	(0x00e * 2)
++#define	M_TIMBPOS_INBEACON	(0x00f * 2)
++#define	M_SFRMTXCNTFBRTHSD	(0x022 * 2)
++#define	M_LFRMTXCNTFBRTHSD	(0x023 * 2)
++#define	M_BCN_PCTLWD		(0x02a * 2)
++#define M_BCN_LI		(0x05b * 2)	/* beacon listen interval */
++
++/* MAX Rx Frame len */
++#define M_MAXRXFRM_LEN		(0x010 * 2)
++
++/* ACK/CTS related params */
++#define	M_RSP_PCTLWD		(0x011 * 2)
++
++/* Hardware Power Control */
++#define M_TXPWR_N		(0x012 * 2)
++#define M_TXPWR_TARGET		(0x013 * 2)
++#define M_TXPWR_MAX		(0x014 * 2)
++#define M_TXPWR_CUR		(0x019 * 2)
++
++/* Rx-related parameters */
++#define	M_RX_PAD_DATA_OFFSET	(0x01a * 2)
++
++/* WEP Shared mem data */
++#define	M_SEC_DEFIVLOC		(0x01e * 2)
++#define	M_SEC_VALNUMSOFTMCHTA	(0x01f * 2)
++#define	M_PHYVER		(0x028 * 2)
++#define	M_PHYTYPE		(0x029 * 2)
++#define	M_SECRXKEYS_PTR		(0x02b * 2)
++#define	M_TKMICKEYS_PTR		(0x059 * 2)
++#define	M_SECKINDXALGO_BLK	(0x2ea * 2)
++#define M_SECKINDXALGO_BLK_SZ	54
++#define	M_SECPSMRXTAMCH_BLK	(0x2fa * 2)
++#define	M_TKIP_TSC_TTAK		(0x18c * 2)
++#define	D11_MAX_KEY_SIZE	16
++
++#define	M_MAX_ANTCNT		(0x02e * 2)	/* antenna swap threshold */
++
++/* Probe response related parameters */
++#define	M_SSIDLEN		(0x024 * 2)
++#define	M_PRB_RESP_FRM_LEN	(0x025 * 2)
++#define	M_PRS_MAXTIME		(0x03a * 2)
++#define	M_SSID			(0xb0 * 2)
++#define	M_CTXPRS_BLK		(0xc0 * 2)
++#define	C_CTX_PCTLWD_POS	(0x4 * 2)
++
++/* Delta between OFDM and CCK power in CCK power boost mode */
++#define M_OFDM_OFFSET		(0x027 * 2)
++
++/* TSSI for last 4 11b/g CCK packets transmitted */
++#define	M_B_TSSI_0		(0x02c * 2)
++#define	M_B_TSSI_1		(0x02d * 2)
++
++/* Host flags to turn on ucode options */
++#define	M_HOST_FLAGS1		(0x02f * 2)
++#define	M_HOST_FLAGS2		(0x030 * 2)
++#define	M_HOST_FLAGS3		(0x031 * 2)
++#define	M_HOST_FLAGS4		(0x03c * 2)
++#define	M_HOST_FLAGS5		(0x06a * 2)
++#define	M_HOST_FLAGS_SZ		16
++
++#define M_RADAR_REG		(0x033 * 2)
++
++/* TSSI for last 4 11a OFDM packets transmitted */
++#define	M_A_TSSI_0		(0x034 * 2)
++#define	M_A_TSSI_1		(0x035 * 2)
++
++/* noise interference measurement */
++#define M_NOISE_IF_COUNT	(0x034 * 2)
++#define M_NOISE_IF_TIMEOUT	(0x035 * 2)
++
++#define	M_RF_RX_SP_REG1		(0x036 * 2)
++
++/* TSSI for last 4 11g OFDM packets transmitted */
++#define	M_G_TSSI_0		(0x038 * 2)
++#define	M_G_TSSI_1		(0x039 * 2)
++
++/* Background noise measure */
++#define	M_JSSI_0		(0x44 * 2)
++#define	M_JSSI_1		(0x45 * 2)
++#define	M_JSSI_AUX		(0x46 * 2)
++
++#define	M_CUR_2050_RADIOCODE	(0x47 * 2)
++
++/* TX fifo sizes */
++#define M_FIFOSIZE0		(0x4c * 2)
++#define M_FIFOSIZE1		(0x4d * 2)
++#define M_FIFOSIZE2		(0x4e * 2)
++#define M_FIFOSIZE3		(0x4f * 2)
++#define D11_MAX_TX_FRMS		32	/* max frames allowed in tx fifo */
++
++/* Current channel number plus upper bits */
++#define M_CURCHANNEL		(0x50 * 2)
++#define D11_CURCHANNEL_5G	0x0100;
++#define D11_CURCHANNEL_40	0x0200;
++#define D11_CURCHANNEL_MAX	0x00FF;
++
++/* last posted frameid on the bcmc fifo */
++#define M_BCMC_FID		(0x54 * 2)
++#define INVALIDFID		0xffff
++
++/* extended beacon phyctl bytes for 11N */
++#define	M_BCN_PCTL1WD		(0x058 * 2)
++
++/* idle busy ratio to duty_cycle requirement  */
++#define M_TX_IDLE_BUSY_RATIO_X_16_CCK  (0x52 * 2)
++#define M_TX_IDLE_BUSY_RATIO_X_16_OFDM (0x5A * 2)
++
++/* CW RSSI for LCNPHY */
++#define M_LCN_RSSI_0		0x1332
++#define M_LCN_RSSI_1		0x1338
++#define M_LCN_RSSI_2		0x133e
++#define M_LCN_RSSI_3		0x1344
++
++/* SNR for LCNPHY */
++#define M_LCN_SNR_A_0	0x1334
++#define M_LCN_SNR_B_0	0x1336
++
++#define M_LCN_SNR_A_1	0x133a
++#define M_LCN_SNR_B_1	0x133c
++
++#define M_LCN_SNR_A_2	0x1340
++#define M_LCN_SNR_B_2	0x1342
++
++#define M_LCN_SNR_A_3	0x1346
++#define M_LCN_SNR_B_3	0x1348
++
++#define M_LCN_LAST_RESET	(81*2)
++#define M_LCN_LAST_LOC	(63*2)
++#define M_LCNPHY_RESET_STATUS (4902)
++#define M_LCNPHY_DSC_TIME	(0x98d*2)
++#define M_LCNPHY_RESET_CNT_DSC (0x98b*2)
++#define M_LCNPHY_RESET_CNT	(0x98c*2)
++
++/* Rate table offsets */
++#define	M_RT_DIRMAP_A		(0xe0 * 2)
++#define	M_RT_BBRSMAP_A		(0xf0 * 2)
++#define	M_RT_DIRMAP_B		(0x100 * 2)
++#define	M_RT_BBRSMAP_B		(0x110 * 2)
++
++/* Rate table entry offsets */
++#define	M_RT_PRS_PLCP_POS	10
++#define	M_RT_PRS_DUR_POS	16
++#define	M_RT_OFDM_PCTL1_POS	18
++
++#define M_20IN40_IQ			(0x380 * 2)
++
++/* SHM locations where ucode stores the current power index */
++#define M_CURR_IDX1		(0x384 * 2)
++#define M_CURR_IDX2		(0x387 * 2)
++
++#define M_BSCALE_ANT0	(0x5e * 2)
++#define M_BSCALE_ANT1	(0x5f * 2)
++
++/* Antenna Diversity Testing */
++#define M_MIMO_ANTSEL_RXDFLT	(0x63 * 2)
++#define M_ANTSEL_CLKDIV	(0x61 * 2)
++#define M_MIMO_ANTSEL_TXDFLT	(0x64 * 2)
++
++#define M_MIMO_MAXSYM	(0x5d * 2)
++#define MIMO_MAXSYM_DEF		0x8000	/* 32k */
++#define MIMO_MAXSYM_MAX		0xffff	/* 64k */
++
++#define M_WATCHDOG_8TU		(0x1e * 2)
++#define WATCHDOG_8TU_DEF	5
++#define WATCHDOG_8TU_MAX	10
++
++/* Manufacturing Test Variables */
++/* PER test mode */
++#define M_PKTENG_CTRL		(0x6c * 2)
++/* IFS for TX mode */
++#define M_PKTENG_IFS		(0x6d * 2)
++/* Lower word of tx frmcnt/rx lostcnt */
++#define M_PKTENG_FRMCNT_LO	(0x6e * 2)
++/* Upper word of tx frmcnt/rx lostcnt */
++#define M_PKTENG_FRMCNT_HI	(0x6f * 2)
++
++/* Index variation in vbat ripple */
++#define M_LCN_PWR_IDX_MAX	(0x67 * 2) /* highest index read by ucode */
++#define M_LCN_PWR_IDX_MIN	(0x66 * 2) /* lowest index read by ucode */
++
++/* M_PKTENG_CTRL bit definitions */
++#define M_PKTENG_MODE_TX		0x0001
++#define M_PKTENG_MODE_TX_RIFS	        0x0004
++#define M_PKTENG_MODE_TX_CTS            0x0008
++#define M_PKTENG_MODE_RX		0x0002
++#define M_PKTENG_MODE_RX_WITH_ACK	0x0402
++#define M_PKTENG_MODE_MASK		0x0003
++/* TX frames indicated in the frmcnt reg */
++#define M_PKTENG_FRMCNT_VLD		0x0100
++
++/* Sample Collect parameters (bitmap and type) */
++/* Trigger bitmap for sample collect */
++#define M_SMPL_COL_BMP		(0x37d * 2)
++/* Sample collect type */
++#define M_SMPL_COL_CTL		(0x3b2 * 2)
++
++#define ANTSEL_CLKDIV_4MHZ	6
++#define MIMO_ANTSEL_BUSY	0x4000	/* bit 14 (busy) */
++#define MIMO_ANTSEL_SEL		0x8000	/* bit 15 write the value */
++#define MIMO_ANTSEL_WAIT	50	/* 50us wait */
++#define MIMO_ANTSEL_OVERRIDE	0x8000	/* flag */
++
++struct shm_acparams {
++	u16 txop;
++	u16 cwmin;
++	u16 cwmax;
++	u16 cwcur;
++	u16 aifs;
++	u16 bslots;
++	u16 reggap;
++	u16 status;
++	u16 rsvd[8];
++} __packed;
++#define M_EDCF_QLEN	(16 * 2)
++
++#define WME_STATUS_NEWAC	(1 << 8)
++
++/* M_HOST_FLAGS */
++#define MHFMAX		5	/* Number of valid hostflag half-word (u16) */
++#define MHF1		0	/* Hostflag 1 index */
++#define MHF2		1	/* Hostflag 2 index */
++#define MHF3		2	/* Hostflag 3 index */
++#define MHF4		3	/* Hostflag 4 index */
++#define MHF5		4	/* Hostflag 5 index */
++
++/* Flags in M_HOST_FLAGS */
++/* Enable ucode antenna diversity help */
++#define	MHF1_ANTDIV		0x0001
++/* Enable EDCF access control */
++#define	MHF1_EDCF		0x0100
++#define MHF1_IQSWAP_WAR		0x0200
++/* Disable Slow clock request, for corerev < 11 */
++#define	MHF1_FORCEFASTCLK	0x0400
++
++/* Flags in M_HOST_FLAGS2 */
++
++/* Flush BCMC FIFO immediately */
++#define MHF2_TXBCMC_NOW		0x0040
++/* Enable ucode/hw power control */
++#define MHF2_HWPWRCTL		0x0080
++#define MHF2_NPHY40MHZ_WAR	0x0800
++
++/* Flags in M_HOST_FLAGS3 */
++/* enabled mimo antenna selection */
++#define MHF3_ANTSEL_EN		0x0001
++/* antenna selection mode: 0: 2x3, 1: 2x4 */
++#define MHF3_ANTSEL_MODE	0x0002
++#define MHF3_RESERVED1		0x0004
++#define MHF3_RESERVED2		0x0008
++#define MHF3_NPHY_MLADV_WAR	0x0010
++
++/* Flags in M_HOST_FLAGS4 */
++/* force bphy Tx on core 0 (board level WAR) */
++#define MHF4_BPHY_TXCORE0	0x0080
++/* for 4313A0 FEM boards */
++#define MHF4_EXTPA_ENABLE	0x4000
++
++/* Flags in M_HOST_FLAGS5 */
++#define MHF5_4313_GPIOCTRL	0x0001
++#define MHF5_RESERVED1		0x0002
++#define MHF5_RESERVED2		0x0004
++/* Radio power setting for ucode */
++#define	M_RADIO_PWR		(0x32 * 2)
++
++/* phy noise recorded by ucode right after tx */
++#define	M_PHY_NOISE		(0x037 * 2)
++#define	PHY_NOISE_MASK		0x00ff
++
++/*
++ * Receive Frame Data Header for 802.11b DCF-only frames
++ *
++ * RxFrameSize: Actual byte length of the frame data received
++ * PAD: padding (not used)
++ * PhyRxStatus_0: PhyRxStatus 15:0
++ * PhyRxStatus_1: PhyRxStatus 31:16
++ * PhyRxStatus_2: PhyRxStatus 47:32
++ * PhyRxStatus_3: PhyRxStatus 63:48
++ * PhyRxStatus_4: PhyRxStatus 79:64
++ * PhyRxStatus_5: PhyRxStatus 95:80
++ * RxStatus1: MAC Rx Status
++ * RxStatus2: extended MAC Rx status
++ * RxTSFTime: RxTSFTime time of first MAC symbol + M_PHY_PLCPRX_DLY
++ * RxChan: gain code, channel radio code, and phy type
++ */
++struct d11rxhdr_le {
++	__le16 RxFrameSize;
++	u16 PAD;
++	__le16 PhyRxStatus_0;
++	__le16 PhyRxStatus_1;
++	__le16 PhyRxStatus_2;
++	__le16 PhyRxStatus_3;
++	__le16 PhyRxStatus_4;
++	__le16 PhyRxStatus_5;
++	__le16 RxStatus1;
++	__le16 RxStatus2;
++	__le16 RxTSFTime;
++	__le16 RxChan;
++} __packed;
++
++struct d11rxhdr {
++	u16 RxFrameSize;
++	u16 PAD;
++	u16 PhyRxStatus_0;
++	u16 PhyRxStatus_1;
++	u16 PhyRxStatus_2;
++	u16 PhyRxStatus_3;
++	u16 PhyRxStatus_4;
++	u16 PhyRxStatus_5;
++	u16 RxStatus1;
++	u16 RxStatus2;
++	u16 RxTSFTime;
++	u16 RxChan;
++} __packed;
++
++/* PhyRxStatus_0: */
++/* NPHY only: CCK, OFDM, preN, N */
++#define	PRXS0_FT_MASK		0x0003
++/* NPHY only: clip count adjustment steps by AGC */
++#define	PRXS0_CLIP_MASK		0x000C
++#define	PRXS0_CLIP_SHIFT	2
++/* PHY received a frame with unsupported rate */
++#define	PRXS0_UNSRATE		0x0010
++/* GPHY: rx ant, NPHY: upper sideband */
++#define	PRXS0_RXANT_UPSUBBAND	0x0020
++/* CCK frame only: lost crs during cck frame reception */
++#define	PRXS0_LCRS		0x0040
++/* Short Preamble */
++#define	PRXS0_SHORTH		0x0080
++/* PLCP violation */
++#define	PRXS0_PLCPFV		0x0100
++/* PLCP header integrity check failed */
++#define	PRXS0_PLCPHCF		0x0200
++/* legacy PHY gain control */
++#define	PRXS0_GAIN_CTL		0x4000
++/* NPHY: Antennas used for received frame, bitmask */
++#define PRXS0_ANTSEL_MASK	0xF000
++#define PRXS0_ANTSEL_SHIFT	0x12
++
++/* subfield PRXS0_FT_MASK */
++#define	PRXS0_CCK		0x0000
++/* valid only for G phy, use rxh->RxChan for A phy */
++#define	PRXS0_OFDM		0x0001
++#define	PRXS0_PREN		0x0002
++#define	PRXS0_STDN		0x0003
++
++/* subfield PRXS0_ANTSEL_MASK */
++#define PRXS0_ANTSEL_0		0x0	/* antenna 0 is used */
++#define PRXS0_ANTSEL_1		0x2	/* antenna 1 is used */
++#define PRXS0_ANTSEL_2		0x4	/* antenna 2 is used */
++#define PRXS0_ANTSEL_3		0x8	/* antenna 3 is used */
++
++/* PhyRxStatus_1: */
++#define	PRXS1_JSSI_MASK		0x00FF
++#define	PRXS1_JSSI_SHIFT	0
++#define	PRXS1_SQ_MASK		0xFF00
++#define	PRXS1_SQ_SHIFT		8
++
++/* nphy PhyRxStatus_1: */
++#define PRXS1_nphy_PWR0_MASK	0x00FF
++#define PRXS1_nphy_PWR1_MASK	0xFF00
++
++/* HTPHY Rx Status defines */
++/* htphy PhyRxStatus_0: those bit are overlapped with PhyRxStatus_0 */
++#define PRXS0_BAND	        0x0400	/* 0 = 2.4G, 1 = 5G */
++#define PRXS0_RSVD	        0x0800	/* reserved; set to 0 */
++#define PRXS0_UNUSED	        0xF000	/* unused and not defined; set to 0 */
++
++/* htphy PhyRxStatus_1: */
++/* core enables for {3..0}, 0=disabled, 1=enabled */
++#define PRXS1_HTPHY_CORE_MASK	0x000F
++/* antenna configation */
++#define PRXS1_HTPHY_ANTCFG_MASK	0x00F0
++/* Mixmode PLCP Length low byte mask */
++#define PRXS1_HTPHY_MMPLCPLenL_MASK	0xFF00
++
++/* htphy PhyRxStatus_2: */
++/* Mixmode PLCP Length high byte maskw */
++#define PRXS2_HTPHY_MMPLCPLenH_MASK	0x000F
++/* Mixmode PLCP rate mask */
++#define PRXS2_HTPHY_MMPLCH_RATE_MASK	0x00F0
++/* Rx power on core 0 */
++#define PRXS2_HTPHY_RXPWR_ANT0	0xFF00
++
++/* htphy PhyRxStatus_3: */
++/* Rx power on core 1 */
++#define PRXS3_HTPHY_RXPWR_ANT1	0x00FF
++/* Rx power on core 2 */
++#define PRXS3_HTPHY_RXPWR_ANT2	0xFF00
++
++/* htphy PhyRxStatus_4: */
++/* Rx power on core 3 */
++#define PRXS4_HTPHY_RXPWR_ANT3	0x00FF
++/* Coarse frequency offset */
++#define PRXS4_HTPHY_CFO		0xFF00
++
++/* htphy PhyRxStatus_5: */
++/* Fine frequency offset */
++#define PRXS5_HTPHY_FFO	        0x00FF
++/* Advance Retard */
++#define PRXS5_HTPHY_AR	        0xFF00
++
++#define HTPHY_MMPLCPLen(rxs) \
++	((((rxs)->PhyRxStatus_1 & PRXS1_HTPHY_MMPLCPLenL_MASK) >> 8) | \
++	(((rxs)->PhyRxStatus_2 & PRXS2_HTPHY_MMPLCPLenH_MASK) << 8))
++/* Get Rx power on core 0 */
++#define HTPHY_RXPWR_ANT0(rxs) \
++	((((rxs)->PhyRxStatus_2) & PRXS2_HTPHY_RXPWR_ANT0) >> 8)
++/* Get Rx power on core 1 */
++#define HTPHY_RXPWR_ANT1(rxs) \
++	(((rxs)->PhyRxStatus_3) & PRXS3_HTPHY_RXPWR_ANT1)
++/* Get Rx power on core 2 */
++#define HTPHY_RXPWR_ANT2(rxs) \
++	((((rxs)->PhyRxStatus_3) & PRXS3_HTPHY_RXPWR_ANT2) >> 8)
++
++/* ucode RxStatus1: */
++#define	RXS_BCNSENT		0x8000
++#define	RXS_SECKINDX_MASK	0x07e0
++#define	RXS_SECKINDX_SHIFT	5
++#define	RXS_DECERR		(1 << 4)
++#define	RXS_DECATMPT		(1 << 3)
++/* PAD bytes to make IP data 4 bytes aligned */
++#define	RXS_PBPRES		(1 << 2)
++#define	RXS_RESPFRAMETX		(1 << 1)
++#define	RXS_FCSERR		(1 << 0)
++
++/* ucode RxStatus2: */
++#define RXS_AMSDU_MASK		1
++#define	RXS_AGGTYPE_MASK	0x6
++#define	RXS_AGGTYPE_SHIFT	1
++#define	RXS_PHYRXST_VALID	(1 << 8)
++#define RXS_RXANT_MASK		0x3
++#define RXS_RXANT_SHIFT		12
++
++/* RxChan */
++#define RXS_CHAN_40		0x1000
++#define RXS_CHAN_5G		0x0800
++#define	RXS_CHAN_ID_MASK	0x07f8
++#define	RXS_CHAN_ID_SHIFT	3
++#define	RXS_CHAN_PHYTYPE_MASK	0x0007
++#define	RXS_CHAN_PHYTYPE_SHIFT	0
++
++/* Index of attenuations used during ucode power control. */
++#define M_PWRIND_BLKS	(0x184 * 2)
++#define M_PWRIND_MAP0	(M_PWRIND_BLKS + 0x0)
++#define M_PWRIND_MAP1	(M_PWRIND_BLKS + 0x2)
++#define M_PWRIND_MAP2	(M_PWRIND_BLKS + 0x4)
++#define M_PWRIND_MAP3	(M_PWRIND_BLKS + 0x6)
++/* M_PWRIND_MAP(core) macro */
++#define M_PWRIND_MAP(core)  (M_PWRIND_BLKS + ((core)<<1))
++
++/* PSM SHM variable offsets */
++#define	M_PSM_SOFT_REGS	0x0
++#define	M_BOM_REV_MAJOR	(M_PSM_SOFT_REGS + 0x0)
++#define	M_BOM_REV_MINOR	(M_PSM_SOFT_REGS + 0x2)
++#define	M_UCODE_DBGST	(M_PSM_SOFT_REGS + 0x40) /* ucode debug status code */
++#define	M_UCODE_MACSTAT	(M_PSM_SOFT_REGS + 0xE0) /* macstat counters */
++
++#define M_AGING_THRSH	(0x3e * 2) /* max time waiting for medium before tx */
++#define	M_MBURST_SIZE	(0x40 * 2) /* max frames in a frameburst */
++#define	M_MBURST_TXOP	(0x41 * 2) /* max frameburst TXOP in unit of us */
++#define M_SYNTHPU_DLY	(0x4a * 2) /* pre-wakeup for synthpu, default: 500 */
++#define	M_PRETBTT	(0x4b * 2)
++
++/* offset to the target txpwr */
++#define M_ALT_TXPWR_IDX		(M_PSM_SOFT_REGS + (0x3b * 2))
++#define M_PHY_TX_FLT_PTR	(M_PSM_SOFT_REGS + (0x3d * 2))
++#define M_CTS_DURATION		(M_PSM_SOFT_REGS + (0x5c * 2))
++#define M_LP_RCCAL_OVR		(M_PSM_SOFT_REGS + (0x6b * 2))
++
++/* PKTENG Rx Stats Block */
++#define M_RXSTATS_BLK_PTR	(M_PSM_SOFT_REGS + (0x65 * 2))
++
++/* ucode debug status codes */
++/* not valid really */
++#define	DBGST_INACTIVE		0
++/* after zeroing SHM, before suspending at init */
++#define	DBGST_INIT		1
++/* "normal" state */
++#define	DBGST_ACTIVE		2
++/* suspended */
++#define	DBGST_SUSPENDED		3
++/* asleep (PS mode) */
++#define	DBGST_ASLEEP		4
++
++/* Scratch Reg defs */
++enum _ePsmScratchPadRegDefinitions {
++	S_RSV0 = 0,
++	S_RSV1,
++	S_RSV2,
++
++	/* offset 0x03: scratch registers for Dot11-contants */
++	S_DOT11_CWMIN,		/* CW-minimum */
++	S_DOT11_CWMAX,		/* CW-maximum */
++	S_DOT11_CWCUR,		/* CW-current */
++	S_DOT11_SRC_LMT,	/* short retry count limit */
++	S_DOT11_LRC_LMT,	/* long retry count limit */
++	S_DOT11_DTIMCOUNT,	/* DTIM-count */
++
++	/* offset 0x09: Tx-side scratch registers */
++	S_SEQ_NUM,		/* hardware sequence number reg */
++	S_SEQ_NUM_FRAG,		/* seq num for frags (at the start of MSDU) */
++	S_FRMRETX_CNT,		/* frame retx count */
++	S_SSRC,			/* Station short retry count */
++	S_SLRC,			/* Station long retry count */
++	S_EXP_RSP,		/* Expected response frame */
++	S_OLD_BREM,		/* Remaining backoff ctr */
++	S_OLD_CWWIN,		/* saved-off CW-cur */
++	S_TXECTL,		/* TXE-Ctl word constructed in scr-pad */
++	S_CTXTST,		/* frm type-subtype as read from Tx-descr */
++
++	/* offset 0x13: Rx-side scratch registers */
++	S_RXTST,		/* Type and subtype in Rxframe */
++
++	/* Global state register */
++	S_STREG,		/* state storage actual bit maps below */
++
++	S_TXPWR_SUM,		/* Tx power control: accumulator */
++	S_TXPWR_ITER,		/* Tx power control: iteration */
++	S_RX_FRMTYPE,		/* Rate and PHY type for frames */
++	S_THIS_AGG,		/* Size of this AGG (A-MSDU) */
++
++	S_KEYINDX,
++	S_RXFRMLEN,		/* Receive MPDU length in bytes */
++
++	/* offset 0x1B: Receive TSF time stored in SCR */
++	S_RXTSFTMRVAL_WD3,	/* TSF value at the start of rx */
++	S_RXTSFTMRVAL_WD2,	/* TSF value at the start of rx */
++	S_RXTSFTMRVAL_WD1,	/* TSF value at the start of rx */
++	S_RXTSFTMRVAL_WD0,	/* TSF value at the start of rx */
++	S_RXSSN,		/* Received start seq number for A-MPDU BA */
++	S_RXQOSFLD,		/* Rx-QoS field (if present) */
++
++	/* offset 0x21: Scratch pad regs used in microcode as temp storage */
++	S_TMP0,			/* stmp0 */
++	S_TMP1,			/* stmp1 */
++	S_TMP2,			/* stmp2 */
++	S_TMP3,			/* stmp3 */
++	S_TMP4,			/* stmp4 */
++	S_TMP5,			/* stmp5 */
++	S_PRQPENALTY_CTR,	/* Probe response queue penalty counter */
++	S_ANTCNT,		/* unsuccessful attempts on current ant. */
++	S_SYMBOL,		/* flag for possible symbol ctl frames */
++	S_RXTP,			/* rx frame type */
++	S_STREG2,		/* extra state storage */
++	S_STREG3,		/* even more extra state storage */
++	S_STREG4,		/* ... */
++	S_STREG5,		/* remember to initialize it to zero */
++
++	S_ADJPWR_IDX,
++	S_CUR_PTR,		/* Temp pointer for A-MPDU re-Tx SHM table */
++	S_REVID4,		/* 0x33 */
++	S_INDX,			/* 0x34 */
++	S_ADDR0,		/* 0x35 */
++	S_ADDR1,		/* 0x36 */
++	S_ADDR2,		/* 0x37 */
++	S_ADDR3,		/* 0x38 */
++	S_ADDR4,		/* 0x39 */
++	S_ADDR5,		/* 0x3A */
++	S_TMP6,			/* 0x3B */
++	S_KEYINDX_BU,		/* Backup for Key index */
++	S_MFGTEST_TMP0,		/* Temp regs used for RX test calculations */
++	S_RXESN,		/* Received end sequence number for A-MPDU BA */
++	S_STREG6,		/* 0x3F */
++};
++
++#define S_BEACON_INDX	S_OLD_BREM
++#define S_PRS_INDX	S_OLD_CWWIN
++#define S_PHYTYPE	S_SSRC
++#define S_PHYVER	S_SLRC
++
++/* IHR SLOW_CTRL values */
++#define SLOW_CTRL_PDE		(1 << 0)
++#define SLOW_CTRL_FD		(1 << 8)
++
++/* ucode mac statistic counters in shared memory */
++struct macstat {
++	u16 txallfrm;	/* 0x80 */
++	u16 txrtsfrm;	/* 0x82 */
++	u16 txctsfrm;	/* 0x84 */
++	u16 txackfrm;	/* 0x86 */
++	u16 txdnlfrm;	/* 0x88 */
++	u16 txbcnfrm;	/* 0x8a */
++	u16 txfunfl[8];	/* 0x8c - 0x9b */
++	u16 txtplunfl;	/* 0x9c */
++	u16 txphyerr;	/* 0x9e */
++	u16 pktengrxducast;	/* 0xa0 */
++	u16 pktengrxdmcast;	/* 0xa2 */
++	u16 rxfrmtoolong;	/* 0xa4 */
++	u16 rxfrmtooshrt;	/* 0xa6 */
++	u16 rxinvmachdr;	/* 0xa8 */
++	u16 rxbadfcs;	/* 0xaa */
++	u16 rxbadplcp;	/* 0xac */
++	u16 rxcrsglitch;	/* 0xae */
++	u16 rxstrt;		/* 0xb0 */
++	u16 rxdfrmucastmbss;	/* 0xb2 */
++	u16 rxmfrmucastmbss;	/* 0xb4 */
++	u16 rxcfrmucast;	/* 0xb6 */
++	u16 rxrtsucast;	/* 0xb8 */
++	u16 rxctsucast;	/* 0xba */
++	u16 rxackucast;	/* 0xbc */
++	u16 rxdfrmocast;	/* 0xbe */
++	u16 rxmfrmocast;	/* 0xc0 */
++	u16 rxcfrmocast;	/* 0xc2 */
++	u16 rxrtsocast;	/* 0xc4 */
++	u16 rxctsocast;	/* 0xc6 */
++	u16 rxdfrmmcast;	/* 0xc8 */
++	u16 rxmfrmmcast;	/* 0xca */
++	u16 rxcfrmmcast;	/* 0xcc */
++	u16 rxbeaconmbss;	/* 0xce */
++	u16 rxdfrmucastobss;	/* 0xd0 */
++	u16 rxbeaconobss;	/* 0xd2 */
++	u16 rxrsptmout;	/* 0xd4 */
++	u16 bcntxcancl;	/* 0xd6 */
++	u16 PAD;
++	u16 rxf0ovfl;	/* 0xda */
++	u16 rxf1ovfl;	/* 0xdc */
++	u16 rxf2ovfl;	/* 0xde */
++	u16 txsfovfl;	/* 0xe0 */
++	u16 pmqovfl;		/* 0xe2 */
++	u16 rxcgprqfrm;	/* 0xe4 */
++	u16 rxcgprsqovfl;	/* 0xe6 */
++	u16 txcgprsfail;	/* 0xe8 */
++	u16 txcgprssuc;	/* 0xea */
++	u16 prs_timeout;	/* 0xec */
++	u16 rxnack;
++	u16 frmscons;
++	u16 txnack;
++	u16 txglitch_nack;
++	u16 txburst;		/* 0xf6 # tx bursts */
++	u16 bphy_rxcrsglitch;	/* bphy rx crs glitch */
++	u16 phywatchdog;	/* 0xfa # of phy watchdog events */
++	u16 PAD;
++	u16 bphy_badplcp;	/* bphy bad plcp */
++};
++
++/* dot11 core-specific control flags */
++#define	SICF_PCLKE		0x0004	/* PHY clock enable */
++#define	SICF_PRST		0x0008	/* PHY reset */
++#define	SICF_MPCLKE		0x0010	/* MAC PHY clockcontrol enable */
++#define	SICF_FREF		0x0020	/* PLL FreqRefSelect */
++/* NOTE: the following bw bits only apply when the core is attached
++ * to a NPHY
++ */
++#define	SICF_BWMASK		0x00c0	/* phy clock mask (b6 & b7) */
++#define	SICF_BW40		0x0080	/* 40MHz BW (160MHz phyclk) */
++#define	SICF_BW20		0x0040	/* 20MHz BW (80MHz phyclk) */
++#define	SICF_BW10		0x0000	/* 10MHz BW (40MHz phyclk) */
++#define	SICF_GMODE		0x2000	/* gmode enable */
++
++/* dot11 core-specific status flags */
++#define	SISF_2G_PHY		0x0001	/* 2.4G capable phy */
++#define	SISF_5G_PHY		0x0002	/* 5G capable phy */
++#define	SISF_FCLKA		0x0004	/* FastClkAvailable */
++#define	SISF_DB_PHY		0x0008	/* Dualband phy */
++
++/* === End of MAC reg, Beginning of PHY(b/a/g/n) reg === */
++/* radio and LPPHY regs are separated */
++
++#define	BPHY_REG_OFT_BASE	0x0
++/* offsets for indirect access to bphy registers */
++#define	BPHY_BB_CONFIG		0x01
++#define	BPHY_ADCBIAS		0x02
++#define	BPHY_ANACORE		0x03
++#define	BPHY_PHYCRSTH		0x06
++#define	BPHY_TEST		0x0a
++#define	BPHY_PA_TX_TO		0x10
++#define	BPHY_SYNTH_DC_TO	0x11
++#define	BPHY_PA_TX_TIME_UP	0x12
++#define	BPHY_RX_FLTR_TIME_UP	0x13
++#define	BPHY_TX_POWER_OVERRIDE	0x14
++#define	BPHY_RF_OVERRIDE	0x15
++#define	BPHY_RF_TR_LOOKUP1	0x16
++#define	BPHY_RF_TR_LOOKUP2	0x17
++#define	BPHY_COEFFS		0x18
++#define	BPHY_PLL_OUT		0x19
++#define	BPHY_REFRESH_MAIN	0x1a
++#define	BPHY_REFRESH_TO0	0x1b
++#define	BPHY_REFRESH_TO1	0x1c
++#define	BPHY_RSSI_TRESH		0x20
++#define	BPHY_IQ_TRESH_HH	0x21
++#define	BPHY_IQ_TRESH_H		0x22
++#define	BPHY_IQ_TRESH_L		0x23
++#define	BPHY_IQ_TRESH_LL	0x24
++#define	BPHY_GAIN		0x25
++#define	BPHY_LNA_GAIN_RANGE	0x26
++#define	BPHY_JSSI		0x27
++#define	BPHY_TSSI_CTL		0x28
++#define	BPHY_TSSI		0x29
++#define	BPHY_TR_LOSS_CTL	0x2a
++#define	BPHY_LO_LEAKAGE		0x2b
++#define	BPHY_LO_RSSI_ACC	0x2c
++#define	BPHY_LO_IQMAG_ACC	0x2d
++#define	BPHY_TX_DC_OFF1		0x2e
++#define	BPHY_TX_DC_OFF2		0x2f
++#define	BPHY_PEAK_CNT_THRESH	0x30
++#define	BPHY_FREQ_OFFSET	0x31
++#define	BPHY_DIVERSITY_CTL	0x32
++#define	BPHY_PEAK_ENERGY_LO	0x33
++#define	BPHY_PEAK_ENERGY_HI	0x34
++#define	BPHY_SYNC_CTL		0x35
++#define	BPHY_TX_PWR_CTRL	0x36
++#define BPHY_TX_EST_PWR		0x37
++#define	BPHY_STEP		0x38
++#define	BPHY_WARMUP		0x39
++#define	BPHY_LMS_CFF_READ	0x3a
++#define	BPHY_LMS_COEFF_I	0x3b
++#define	BPHY_LMS_COEFF_Q	0x3c
++#define	BPHY_SIG_POW		0x3d
++#define	BPHY_RFDC_CANCEL_CTL	0x3e
++#define	BPHY_HDR_TYPE		0x40
++#define	BPHY_SFD_TO		0x41
++#define	BPHY_SFD_CTL		0x42
++#define	BPHY_DEBUG		0x43
++#define	BPHY_RX_DELAY_COMP	0x44
++#define	BPHY_CRS_DROP_TO	0x45
++#define	BPHY_SHORT_SFD_NZEROS	0x46
++#define	BPHY_DSSS_COEFF1	0x48
++#define	BPHY_DSSS_COEFF2	0x49
++#define	BPHY_CCK_COEFF1		0x4a
++#define	BPHY_CCK_COEFF2		0x4b
++#define	BPHY_TR_CORR		0x4c
++#define	BPHY_ANGLE_SCALE	0x4d
++#define	BPHY_TX_PWR_BASE_IDX	0x4e
++#define	BPHY_OPTIONAL_MODES2	0x4f
++#define	BPHY_CCK_LMS_STEP	0x50
++#define	BPHY_BYPASS		0x51
++#define	BPHY_CCK_DELAY_LONG	0x52
++#define	BPHY_CCK_DELAY_SHORT	0x53
++#define	BPHY_PPROC_CHAN_DELAY	0x54
++#define	BPHY_DDFS_ENABLE	0x58
++#define	BPHY_PHASE_SCALE	0x59
++#define	BPHY_FREQ_CONTROL	0x5a
++#define	BPHY_LNA_GAIN_RANGE_10	0x5b
++#define	BPHY_LNA_GAIN_RANGE_32	0x5c
++#define	BPHY_OPTIONAL_MODES	0x5d
++#define	BPHY_RX_STATUS2		0x5e
++#define	BPHY_RX_STATUS3		0x5f
++#define	BPHY_DAC_CONTROL	0x60
++#define	BPHY_ANA11G_FILT_CTRL	0x62
++#define	BPHY_REFRESH_CTRL	0x64
++#define	BPHY_RF_OVERRIDE2	0x65
++#define	BPHY_SPUR_CANCEL_CTRL	0x66
++#define	BPHY_FINE_DIGIGAIN_CTRL	0x67
++#define	BPHY_RSSI_LUT		0x88
++#define	BPHY_RSSI_LUT_END	0xa7
++#define	BPHY_TSSI_LUT		0xa8
++#define	BPHY_TSSI_LUT_END	0xc7
++#define	BPHY_TSSI2PWR_LUT	0x380
++#define	BPHY_TSSI2PWR_LUT_END	0x39f
++#define	BPHY_LOCOMP_LUT		0x3a0
++#define	BPHY_LOCOMP_LUT_END	0x3bf
++#define	BPHY_TXGAIN_LUT		0x3c0
++#define	BPHY_TXGAIN_LUT_END	0x3ff
++
++/* Bits in BB_CONFIG: */
++#define	PHY_BBC_ANT_MASK	0x0180
++#define	PHY_BBC_ANT_SHIFT	7
++#define	BB_DARWIN		0x1000
++#define BBCFG_RESETCCA		0x4000
++#define BBCFG_RESETRX		0x8000
++
++/* Bits in phytest(0x0a): */
++#define	TST_DDFS		0x2000
++#define	TST_TXFILT1		0x0800
++#define	TST_UNSCRAM		0x0400
++#define	TST_CARR_SUPP		0x0200
++#define	TST_DC_COMP_LOOP	0x0100
++#define	TST_LOOPBACK		0x0080
++#define	TST_TXFILT0		0x0040
++#define	TST_TXTEST_ENABLE	0x0020
++#define	TST_TXTEST_RATE		0x0018
++#define	TST_TXTEST_PHASE	0x0007
++
++/* phytest txTestRate values */
++#define	TST_TXTEST_RATE_1MBPS	0
++#define	TST_TXTEST_RATE_2MBPS	1
++#define	TST_TXTEST_RATE_5_5MBPS	2
++#define	TST_TXTEST_RATE_11MBPS	3
++#define	TST_TXTEST_RATE_SHIFT	3
++
++#define SHM_BYT_CNT	0x2	/* IHR location */
++#define MAX_BYT_CNT	0x600	/* Maximum frame len */
++
++struct d11cnt {
++	u32 txfrag;
++	u32 txmulti;
++	u32 txfail;
++	u32 txretry;
++	u32 txretrie;
++	u32 rxdup;
++	u32 txrts;
++	u32 txnocts;
++	u32 txnoack;
++	u32 rxfrag;
++	u32 rxmulti;
++	u32 rxcrc;
++	u32 txfrmsnt;
++	u32 rxundec;
++};
++
++#endif				/* _BRCM_D11_H_ */
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/dma.c b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
+new file mode 100644
+index 0000000..e898266
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
+@@ -0,0 +1,1444 @@
++/*
++ * Copyright (c) 2010 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++#undef pr_fmt
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/printk.h>
++#include <linux/slab.h>
++#include <linux/delay.h>
++#include <linux/pci.h>
++
++#include <brcmu_utils.h>
++#include <aiutils.h>
++#include "types.h"
++#include "dma.h"
++#include "soc.h"
++
++/*
++ * dma register field offset calculation
++ */
++#define DMA64REGOFFS(field)		offsetof(struct dma64regs, field)
++#define DMA64TXREGOFFS(di, field)	(di->d64txregbase + DMA64REGOFFS(field))
++#define DMA64RXREGOFFS(di, field)	(di->d64rxregbase + DMA64REGOFFS(field))
++
++/*
++ * DMA hardware requires each descriptor ring to be 8kB aligned, and fit within
++ * a contiguous 8kB physical address.
++ */
++#define D64RINGALIGN_BITS	13
++#define	D64MAXRINGSZ		(1 << D64RINGALIGN_BITS)
++#define	D64RINGALIGN		(1 << D64RINGALIGN_BITS)
++
++#define	D64MAXDD	(D64MAXRINGSZ / sizeof(struct dma64desc))
++
++/* transmit channel control */
++#define	D64_XC_XE		0x00000001	/* transmit enable */
++#define	D64_XC_SE		0x00000002	/* transmit suspend request */
++#define	D64_XC_LE		0x00000004	/* loopback enable */
++#define	D64_XC_FL		0x00000010	/* flush request */
++#define	D64_XC_PD		0x00000800	/* parity check disable */
++#define	D64_XC_AE		0x00030000	/* address extension bits */
++#define	D64_XC_AE_SHIFT		16
++
++/* transmit descriptor table pointer */
++#define	D64_XP_LD_MASK		0x00000fff	/* last valid descriptor */
++
++/* transmit channel status */
++#define	D64_XS0_CD_MASK		0x00001fff	/* current descriptor pointer */
++#define	D64_XS0_XS_MASK		0xf0000000	/* transmit state */
++#define	D64_XS0_XS_SHIFT		28
++#define	D64_XS0_XS_DISABLED	0x00000000	/* disabled */
++#define	D64_XS0_XS_ACTIVE	0x10000000	/* active */
++#define	D64_XS0_XS_IDLE		0x20000000	/* idle wait */
++#define	D64_XS0_XS_STOPPED	0x30000000	/* stopped */
++#define	D64_XS0_XS_SUSP		0x40000000	/* suspend pending */
++
++#define	D64_XS1_AD_MASK		0x00001fff	/* active descriptor */
++#define	D64_XS1_XE_MASK		0xf0000000	/* transmit errors */
++#define	D64_XS1_XE_SHIFT		28
++#define	D64_XS1_XE_NOERR	0x00000000	/* no error */
++#define	D64_XS1_XE_DPE		0x10000000	/* descriptor protocol error */
++#define	D64_XS1_XE_DFU		0x20000000	/* data fifo underrun */
++#define	D64_XS1_XE_DTE		0x30000000	/* data transfer error */
++#define	D64_XS1_XE_DESRE	0x40000000	/* descriptor read error */
++#define	D64_XS1_XE_COREE	0x50000000	/* core error */
++
++/* receive channel control */
++/* receive enable */
++#define	D64_RC_RE		0x00000001
++/* receive frame offset */
++#define	D64_RC_RO_MASK		0x000000fe
++#define	D64_RC_RO_SHIFT		1
++/* direct fifo receive (pio) mode */
++#define	D64_RC_FM		0x00000100
++/* separate rx header descriptor enable */
++#define	D64_RC_SH		0x00000200
++/* overflow continue */
++#define	D64_RC_OC		0x00000400
++/* parity check disable */
++#define	D64_RC_PD		0x00000800
++/* address extension bits */
++#define	D64_RC_AE		0x00030000
++#define	D64_RC_AE_SHIFT		16
++
++/* flags for dma controller */
++/* partity enable */
++#define DMA_CTRL_PEN		(1 << 0)
++/* rx overflow continue */
++#define DMA_CTRL_ROC		(1 << 1)
++/* allow rx scatter to multiple descriptors */
++#define DMA_CTRL_RXMULTI	(1 << 2)
++/* Unframed Rx/Tx data */
++#define DMA_CTRL_UNFRAMED	(1 << 3)
++
++/* receive descriptor table pointer */
++#define	D64_RP_LD_MASK		0x00000fff	/* last valid descriptor */
++
++/* receive channel status */
++#define	D64_RS0_CD_MASK		0x00001fff	/* current descriptor pointer */
++#define	D64_RS0_RS_MASK		0xf0000000	/* receive state */
++#define	D64_RS0_RS_SHIFT		28
++#define	D64_RS0_RS_DISABLED	0x00000000	/* disabled */
++#define	D64_RS0_RS_ACTIVE	0x10000000	/* active */
++#define	D64_RS0_RS_IDLE		0x20000000	/* idle wait */
++#define	D64_RS0_RS_STOPPED	0x30000000	/* stopped */
++#define	D64_RS0_RS_SUSP		0x40000000	/* suspend pending */
++
++#define	D64_RS1_AD_MASK		0x0001ffff	/* active descriptor */
++#define	D64_RS1_RE_MASK		0xf0000000	/* receive errors */
++#define	D64_RS1_RE_SHIFT		28
++#define	D64_RS1_RE_NOERR	0x00000000	/* no error */
++#define	D64_RS1_RE_DPO		0x10000000	/* descriptor protocol error */
++#define	D64_RS1_RE_DFU		0x20000000	/* data fifo overflow */
++#define	D64_RS1_RE_DTE		0x30000000	/* data transfer error */
++#define	D64_RS1_RE_DESRE	0x40000000	/* descriptor read error */
++#define	D64_RS1_RE_COREE	0x50000000	/* core error */
++
++/* fifoaddr */
++#define	D64_FA_OFF_MASK		0xffff	/* offset */
++#define	D64_FA_SEL_MASK		0xf0000	/* select */
++#define	D64_FA_SEL_SHIFT	16
++#define	D64_FA_SEL_XDD		0x00000	/* transmit dma data */
++#define	D64_FA_SEL_XDP		0x10000	/* transmit dma pointers */
++#define	D64_FA_SEL_RDD		0x40000	/* receive dma data */
++#define	D64_FA_SEL_RDP		0x50000	/* receive dma pointers */
++#define	D64_FA_SEL_XFD		0x80000	/* transmit fifo data */
++#define	D64_FA_SEL_XFP		0x90000	/* transmit fifo pointers */
++#define	D64_FA_SEL_RFD		0xc0000	/* receive fifo data */
++#define	D64_FA_SEL_RFP		0xd0000	/* receive fifo pointers */
++#define	D64_FA_SEL_RSD		0xe0000	/* receive frame status data */
++#define	D64_FA_SEL_RSP		0xf0000	/* receive frame status pointers */
++
++/* descriptor control flags 1 */
++#define D64_CTRL_COREFLAGS	0x0ff00000	/* core specific flags */
++#define	D64_CTRL1_EOT		((u32)1 << 28)	/* end of descriptor table */
++#define	D64_CTRL1_IOC		((u32)1 << 29)	/* interrupt on completion */
++#define	D64_CTRL1_EOF		((u32)1 << 30)	/* end of frame */
++#define	D64_CTRL1_SOF		((u32)1 << 31)	/* start of frame */
++
++/* descriptor control flags 2 */
++/* buffer byte count. real data len must <= 16KB */
++#define	D64_CTRL2_BC_MASK	0x00007fff
++/* address extension bits */
++#define	D64_CTRL2_AE		0x00030000
++#define	D64_CTRL2_AE_SHIFT	16
++/* parity bit */
++#define D64_CTRL2_PARITY	0x00040000
++
++/* control flags in the range [27:20] are core-specific and not defined here */
++#define	D64_CTRL_CORE_MASK	0x0ff00000
++
++#define D64_RX_FRM_STS_LEN	0x0000ffff	/* frame length mask */
++#define D64_RX_FRM_STS_OVFL	0x00800000	/* RxOverFlow */
++#define D64_RX_FRM_STS_DSCRCNT	0x0f000000  /* no. of descriptors used - 1 */
++#define D64_RX_FRM_STS_DATATYPE	0xf0000000	/* core-dependent data type */
++
++/*
++ * packet headroom necessary to accommodate the largest header
++ * in the system, (i.e TXOFF). By doing, we avoid the need to
++ * allocate an extra buffer for the header when bridging to WL.
++ * There is a compile time check in wlc.c which ensure that this
++ * value is at least as big as TXOFF. This value is used in
++ * dma_rxfill().
++ */
++
++#define BCMEXTRAHDROOM 172
++
++/* debug/trace */
++#ifdef DEBUG
++#define	DMA_ERROR(fmt, ...)					\
++do {								\
++	if (*di->msg_level & 1)					\
++		pr_debug("%s: " fmt, __func__, ##__VA_ARGS__);	\
++} while (0)
++#define	DMA_TRACE(fmt, ...)					\
++do {								\
++	if (*di->msg_level & 2)					\
++		pr_debug("%s: " fmt, __func__, ##__VA_ARGS__);	\
++} while (0)
++#else
++#define	DMA_ERROR(fmt, ...)			\
++	no_printk(fmt, ##__VA_ARGS__)
++#define	DMA_TRACE(fmt, ...)			\
++	no_printk(fmt, ##__VA_ARGS__)
++#endif				/* DEBUG */
++
++#define	DMA_NONE(fmt, ...)			\
++	no_printk(fmt, ##__VA_ARGS__)
++
++#define	MAXNAMEL	8	/* 8 char names */
++
++/* macros to convert between byte offsets and indexes */
++#define	B2I(bytes, type)	((bytes) / sizeof(type))
++#define	I2B(index, type)	((index) * sizeof(type))
++
++#define	PCI32ADDR_HIGH		0xc0000000	/* address[31:30] */
++#define	PCI32ADDR_HIGH_SHIFT	30	/* address[31:30] */
++
++#define	PCI64ADDR_HIGH		0x80000000	/* address[63] */
++#define	PCI64ADDR_HIGH_SHIFT	31	/* address[63] */
++
++/*
++ * DMA Descriptor
++ * Descriptors are only read by the hardware, never written back.
++ */
++struct dma64desc {
++	__le32 ctrl1;	/* misc control bits & bufcount */
++	__le32 ctrl2;	/* buffer count and address extension */
++	__le32 addrlow;	/* memory address of the date buffer, bits 31:0 */
++	__le32 addrhigh; /* memory address of the date buffer, bits 63:32 */
++};
++
++/* dma engine software state */
++struct dma_info {
++	struct dma_pub dma; /* exported structure */
++	uint *msg_level;	/* message level pointer */
++	char name[MAXNAMEL];	/* callers name for diag msgs */
++
++	struct bcma_device *core;
++	struct device *dmadev;
++
++	bool dma64;	/* this dma engine is operating in 64-bit mode */
++	bool addrext;	/* this dma engine supports DmaExtendedAddrChanges */
++
++	/* 64-bit dma tx engine registers */
++	uint d64txregbase;
++	/* 64-bit dma rx engine registers */
++	uint d64rxregbase;
++	/* pointer to dma64 tx descriptor ring */
++	struct dma64desc *txd64;
++	/* pointer to dma64 rx descriptor ring */
++	struct dma64desc *rxd64;
++
++	u16 dmadesc_align;	/* alignment requirement for dma descriptors */
++
++	u16 ntxd;		/* # tx descriptors tunable */
++	u16 txin;		/* index of next descriptor to reclaim */
++	u16 txout;		/* index of next descriptor to post */
++	/* pointer to parallel array of pointers to packets */
++	struct sk_buff **txp;
++	/* Aligned physical address of descriptor ring */
++	dma_addr_t txdpa;
++	/* Original physical address of descriptor ring */
++	dma_addr_t txdpaorig;
++	u16 txdalign;	/* #bytes added to alloc'd mem to align txd */
++	u32 txdalloc;	/* #bytes allocated for the ring */
++	u32 xmtptrbase;	/* When using unaligned descriptors, the ptr register
++			 * is not just an index, it needs all 13 bits to be
++			 * an offset from the addr register.
++			 */
++
++	u16 nrxd;	/* # rx descriptors tunable */
++	u16 rxin;	/* index of next descriptor to reclaim */
++	u16 rxout;	/* index of next descriptor to post */
++	/* pointer to parallel array of pointers to packets */
++	struct sk_buff **rxp;
++	/* Aligned physical address of descriptor ring */
++	dma_addr_t rxdpa;
++	/* Original physical address of descriptor ring */
++	dma_addr_t rxdpaorig;
++	u16 rxdalign;	/* #bytes added to alloc'd mem to align rxd */
++	u32 rxdalloc;	/* #bytes allocated for the ring */
++	u32 rcvptrbase;	/* Base for ptr reg when using unaligned descriptors */
++
++	/* tunables */
++	unsigned int rxbufsize;	/* rx buffer size in bytes, not including
++				 * the extra headroom
++				 */
++	uint rxextrahdrroom;	/* extra rx headroom, reverseved to assist upper
++				 * stack, e.g. some rx pkt buffers will be
++				 * bridged to tx side without byte copying.
++				 * The extra headroom needs to be large enough
++				 * to fit txheader needs. Some dongle driver may
++				 * not need it.
++				 */
++	uint nrxpost;		/* # rx buffers to keep posted */
++	unsigned int rxoffset;	/* rxcontrol offset */
++	/* add to get dma address of descriptor ring, low 32 bits */
++	uint ddoffsetlow;
++	/*   high 32 bits */
++	uint ddoffsethigh;
++	/* add to get dma address of data buffer, low 32 bits */
++	uint dataoffsetlow;
++	/*   high 32 bits */
++	uint dataoffsethigh;
++	/* descriptor base need to be aligned or not */
++	bool aligndesc_4k;
++};
++
++/*
++ * default dma message level (if input msg_level
++ * pointer is null in dma_attach())
++ */
++static uint dma_msg_level;
++
++/* Check for odd number of 1's */
++static u32 parity32(__le32 data)
++{
++	/* no swap needed for counting 1's */
++	u32 par_data = *(u32 *)&data;
++
++	par_data ^= par_data >> 16;
++	par_data ^= par_data >> 8;
++	par_data ^= par_data >> 4;
++	par_data ^= par_data >> 2;
++	par_data ^= par_data >> 1;
++
++	return par_data & 1;
++}
++
++static bool dma64_dd_parity(struct dma64desc *dd)
++{
++	return parity32(dd->addrlow ^ dd->addrhigh ^ dd->ctrl1 ^ dd->ctrl2);
++}
++
++/* descriptor bumping functions */
++
++static uint xxd(uint x, uint n)
++{
++	return x & (n - 1); /* faster than %, but n must be power of 2 */
++}
++
++static uint txd(struct dma_info *di, uint x)
++{
++	return xxd(x, di->ntxd);
++}
++
++static uint rxd(struct dma_info *di, uint x)
++{
++	return xxd(x, di->nrxd);
++}
++
++static uint nexttxd(struct dma_info *di, uint i)
++{
++	return txd(di, i + 1);
++}
++
++static uint prevtxd(struct dma_info *di, uint i)
++{
++	return txd(di, i - 1);
++}
++
++static uint nextrxd(struct dma_info *di, uint i)
++{
++	return txd(di, i + 1);
++}
++
++static uint ntxdactive(struct dma_info *di, uint h, uint t)
++{
++	return txd(di, t-h);
++}
++
++static uint nrxdactive(struct dma_info *di, uint h, uint t)
++{
++	return rxd(di, t-h);
++}
++
++static uint _dma_ctrlflags(struct dma_info *di, uint mask, uint flags)
++{
++	uint dmactrlflags;
++
++	if (di == NULL) {
++		DMA_ERROR("NULL dma handle\n");
++		return 0;
++	}
++
++	dmactrlflags = di->dma.dmactrlflags;
++	dmactrlflags &= ~mask;
++	dmactrlflags |= flags;
++
++	/* If trying to enable parity, check if parity is actually supported */
++	if (dmactrlflags & DMA_CTRL_PEN) {
++		u32 control;
++
++		control = bcma_read32(di->core, DMA64TXREGOFFS(di, control));
++		bcma_write32(di->core, DMA64TXREGOFFS(di, control),
++		      control | D64_XC_PD);
++		if (bcma_read32(di->core, DMA64TXREGOFFS(di, control)) &
++		    D64_XC_PD)
++			/* We *can* disable it so it is supported,
++			 * restore control register
++			 */
++			bcma_write32(di->core, DMA64TXREGOFFS(di, control),
++				     control);
++		else
++			/* Not supported, don't allow it to be enabled */
++			dmactrlflags &= ~DMA_CTRL_PEN;
++	}
++
++	di->dma.dmactrlflags = dmactrlflags;
++
++	return dmactrlflags;
++}
++
++static bool _dma64_addrext(struct dma_info *di, uint ctrl_offset)
++{
++	u32 w;
++	bcma_set32(di->core, ctrl_offset, D64_XC_AE);
++	w = bcma_read32(di->core, ctrl_offset);
++	bcma_mask32(di->core, ctrl_offset, ~D64_XC_AE);
++	return (w & D64_XC_AE) == D64_XC_AE;
++}
++
++/*
++ * return true if this dma engine supports DmaExtendedAddrChanges,
++ * otherwise false
++ */
++static bool _dma_isaddrext(struct dma_info *di)
++{
++	/* DMA64 supports full 32- or 64-bit operation. AE is always valid */
++
++	/* not all tx or rx channel are available */
++	if (di->d64txregbase != 0) {
++		if (!_dma64_addrext(di, DMA64TXREGOFFS(di, control)))
++			DMA_ERROR("%s: DMA64 tx doesn't have AE set\n",
++				  di->name);
++		return true;
++	} else if (di->d64rxregbase != 0) {
++		if (!_dma64_addrext(di, DMA64RXREGOFFS(di, control)))
++			DMA_ERROR("%s: DMA64 rx doesn't have AE set\n",
++				  di->name);
++		return true;
++	}
++
++	return false;
++}
++
++static bool _dma_descriptor_align(struct dma_info *di)
++{
++	u32 addrl;
++
++	/* Check to see if the descriptors need to be aligned on 4K/8K or not */
++	if (di->d64txregbase != 0) {
++		bcma_write32(di->core, DMA64TXREGOFFS(di, addrlow), 0xff0);
++		addrl = bcma_read32(di->core, DMA64TXREGOFFS(di, addrlow));
++		if (addrl != 0)
++			return false;
++	} else if (di->d64rxregbase != 0) {
++		bcma_write32(di->core, DMA64RXREGOFFS(di, addrlow), 0xff0);
++		addrl = bcma_read32(di->core, DMA64RXREGOFFS(di, addrlow));
++		if (addrl != 0)
++			return false;
++	}
++	return true;
++}
++
++/*
++ * Descriptor table must start at the DMA hardware dictated alignment, so
++ * allocated memory must be large enough to support this requirement.
++ */
++static void *dma_alloc_consistent(struct dma_info *di, uint size,
++				  u16 align_bits, uint *alloced,
++				  dma_addr_t *pap)
++{
++	if (align_bits) {
++		u16 align = (1 << align_bits);
++		if (!IS_ALIGNED(PAGE_SIZE, align))
++			size += align;
++		*alloced = size;
++	}
++	return dma_alloc_coherent(di->dmadev, size, pap, GFP_ATOMIC);
++}
++
++static
++u8 dma_align_sizetobits(uint size)
++{
++	u8 bitpos = 0;
++	while (size >>= 1)
++		bitpos++;
++	return bitpos;
++}
++
++/* This function ensures that the DMA descriptor ring will not get allocated
++ * across Page boundary. If the allocation is done across the page boundary
++ * at the first time, then it is freed and the allocation is done at
++ * descriptor ring size aligned location. This will ensure that the ring will
++ * not cross page boundary
++ */
++static void *dma_ringalloc(struct dma_info *di, u32 boundary, uint size,
++			   u16 *alignbits, uint *alloced,
++			   dma_addr_t *descpa)
++{
++	void *va;
++	u32 desc_strtaddr;
++	u32 alignbytes = 1 << *alignbits;
++
++	va = dma_alloc_consistent(di, size, *alignbits, alloced, descpa);
++
++	if (NULL == va)
++		return NULL;
++
++	desc_strtaddr = (u32) roundup((unsigned long)va, alignbytes);
++	if (((desc_strtaddr + size - 1) & boundary) != (desc_strtaddr
++							& boundary)) {
++		*alignbits = dma_align_sizetobits(size);
++		dma_free_coherent(di->dmadev, size, va, *descpa);
++		va = dma_alloc_consistent(di, size, *alignbits,
++			alloced, descpa);
++	}
++	return va;
++}
++
++static bool dma64_alloc(struct dma_info *di, uint direction)
++{
++	u16 size;
++	uint ddlen;
++	void *va;
++	uint alloced = 0;
++	u16 align;
++	u16 align_bits;
++
++	ddlen = sizeof(struct dma64desc);
++
++	size = (direction == DMA_TX) ? (di->ntxd * ddlen) : (di->nrxd * ddlen);
++	align_bits = di->dmadesc_align;
++	align = (1 << align_bits);
++
++	if (direction == DMA_TX) {
++		va = dma_ringalloc(di, D64RINGALIGN, size, &align_bits,
++			&alloced, &di->txdpaorig);
++		if (va == NULL) {
++			DMA_ERROR("%s: DMA_ALLOC_CONSISTENT(ntxd) failed\n",
++				  di->name);
++			return false;
++		}
++		align = (1 << align_bits);
++		di->txd64 = (struct dma64desc *)
++					roundup((unsigned long)va, align);
++		di->txdalign = (uint) ((s8 *)di->txd64 - (s8 *) va);
++		di->txdpa = di->txdpaorig + di->txdalign;
++		di->txdalloc = alloced;
++	} else {
++		va = dma_ringalloc(di, D64RINGALIGN, size, &align_bits,
++			&alloced, &di->rxdpaorig);
++		if (va == NULL) {
++			DMA_ERROR("%s: DMA_ALLOC_CONSISTENT(nrxd) failed\n",
++				  di->name);
++			return false;
++		}
++		align = (1 << align_bits);
++		di->rxd64 = (struct dma64desc *)
++					roundup((unsigned long)va, align);
++		di->rxdalign = (uint) ((s8 *)di->rxd64 - (s8 *) va);
++		di->rxdpa = di->rxdpaorig + di->rxdalign;
++		di->rxdalloc = alloced;
++	}
++
++	return true;
++}
++
++static bool _dma_alloc(struct dma_info *di, uint direction)
++{
++	return dma64_alloc(di, direction);
++}
++
++struct dma_pub *dma_attach(char *name, struct si_pub *sih,
++			   struct bcma_device *core,
++			   uint txregbase, uint rxregbase, uint ntxd, uint nrxd,
++			   uint rxbufsize, int rxextheadroom,
++			   uint nrxpost, uint rxoffset, uint *msg_level)
++{
++	struct dma_info *di;
++	u8 rev = core->id.rev;
++	uint size;
++
++	/* allocate private info structure */
++	di = kzalloc(sizeof(struct dma_info), GFP_ATOMIC);
++	if (di == NULL)
++		return NULL;
++
++	di->msg_level = msg_level ? msg_level : &dma_msg_level;
++
++
++	di->dma64 =
++		((bcma_aread32(core, BCMA_IOST) & SISF_DMA64) == SISF_DMA64);
++
++	/* init dma reg info */
++	di->core = core;
++	di->d64txregbase = txregbase;
++	di->d64rxregbase = rxregbase;
++
++	/*
++	 * Default flags (which can be changed by the driver calling
++	 * dma_ctrlflags before enable): For backwards compatibility
++	 * both Rx Overflow Continue and Parity are DISABLED.
++	 */
++	_dma_ctrlflags(di, DMA_CTRL_ROC | DMA_CTRL_PEN, 0);
++
++	DMA_TRACE("%s: %s flags 0x%x ntxd %d nrxd %d "
++		  "rxbufsize %d rxextheadroom %d nrxpost %d rxoffset %d "
++		  "txregbase %u rxregbase %u\n", name, "DMA64",
++		  di->dma.dmactrlflags, ntxd, nrxd, rxbufsize,
++		  rxextheadroom, nrxpost, rxoffset, txregbase, rxregbase);
++
++	/* make a private copy of our callers name */
++	strncpy(di->name, name, MAXNAMEL);
++	di->name[MAXNAMEL - 1] = '\0';
++
++	di->dmadev = core->dma_dev;
++
++	/* save tunables */
++	di->ntxd = (u16) ntxd;
++	di->nrxd = (u16) nrxd;
++
++	/* the actual dma size doesn't include the extra headroom */
++	di->rxextrahdrroom =
++	    (rxextheadroom == -1) ? BCMEXTRAHDROOM : rxextheadroom;
++	if (rxbufsize > BCMEXTRAHDROOM)
++		di->rxbufsize = (u16) (rxbufsize - di->rxextrahdrroom);
++	else
++		di->rxbufsize = (u16) rxbufsize;
++
++	di->nrxpost = (u16) nrxpost;
++	di->rxoffset = (u8) rxoffset;
++
++	/*
++	 * figure out the DMA physical address offset for dd and data
++	 *     PCI/PCIE: they map silicon backplace address to zero
++	 *     based memory, need offset
++	 *     Other bus: use zero SI_BUS BIGENDIAN kludge: use sdram
++	 *     swapped region for data buffer, not descriptor
++	 */
++	di->ddoffsetlow = 0;
++	di->dataoffsetlow = 0;
++	/* add offset for pcie with DMA64 bus */
++	di->ddoffsetlow = 0;
++	di->ddoffsethigh = SI_PCIE_DMA_H32;
++	di->dataoffsetlow = di->ddoffsetlow;
++	di->dataoffsethigh = di->ddoffsethigh;
++	/* WAR64450 : DMACtl.Addr ext fields are not supported in SDIOD core. */
++	if ((core->id.id == SDIOD_CORE_ID)
++	    && ((rev > 0) && (rev <= 2)))
++		di->addrext = false;
++	else if ((core->id.id == I2S_CORE_ID) &&
++		 ((rev == 0) || (rev == 1)))
++		di->addrext = false;
++	else
++		di->addrext = _dma_isaddrext(di);
++
++	/* does the descriptor need to be aligned and if yes, on 4K/8K or not */
++	di->aligndesc_4k = _dma_descriptor_align(di);
++	if (di->aligndesc_4k) {
++		di->dmadesc_align = D64RINGALIGN_BITS;
++		if ((ntxd < D64MAXDD / 2) && (nrxd < D64MAXDD / 2))
++			/* for smaller dd table, HW relax alignment reqmnt */
++			di->dmadesc_align = D64RINGALIGN_BITS - 1;
++	} else {
++		di->dmadesc_align = 4;	/* 16 byte alignment */
++	}
++
++	DMA_NONE("DMA descriptor align_needed %d, align %d\n",
++		 di->aligndesc_4k, di->dmadesc_align);
++
++	/* allocate tx packet pointer vector */
++	if (ntxd) {
++		size = ntxd * sizeof(void *);
++		di->txp = kzalloc(size, GFP_ATOMIC);
++		if (di->txp == NULL)
++			goto fail;
++	}
++
++	/* allocate rx packet pointer vector */
++	if (nrxd) {
++		size = nrxd * sizeof(void *);
++		di->rxp = kzalloc(size, GFP_ATOMIC);
++		if (di->rxp == NULL)
++			goto fail;
++	}
++
++	/*
++	 * allocate transmit descriptor ring, only need ntxd descriptors
++	 * but it must be aligned
++	 */
++	if (ntxd) {
++		if (!_dma_alloc(di, DMA_TX))
++			goto fail;
++	}
++
++	/*
++	 * allocate receive descriptor ring, only need nrxd descriptors
++	 * but it must be aligned
++	 */
++	if (nrxd) {
++		if (!_dma_alloc(di, DMA_RX))
++			goto fail;
++	}
++
++	if ((di->ddoffsetlow != 0) && !di->addrext) {
++		if (di->txdpa > SI_PCI_DMA_SZ) {
++			DMA_ERROR("%s: txdpa 0x%x: addrext not supported\n",
++				  di->name, (u32)di->txdpa);
++			goto fail;
++		}
++		if (di->rxdpa > SI_PCI_DMA_SZ) {
++			DMA_ERROR("%s: rxdpa 0x%x: addrext not supported\n",
++				  di->name, (u32)di->rxdpa);
++			goto fail;
++		}
++	}
++
++	DMA_TRACE("ddoffsetlow 0x%x ddoffsethigh 0x%x dataoffsetlow 0x%x dataoffsethigh 0x%x addrext %d\n",
++		  di->ddoffsetlow, di->ddoffsethigh,
++		  di->dataoffsetlow, di->dataoffsethigh,
++		  di->addrext);
++
++	return (struct dma_pub *) di;
++
++ fail:
++	dma_detach((struct dma_pub *)di);
++	return NULL;
++}
++
++static inline void
++dma64_dd_upd(struct dma_info *di, struct dma64desc *ddring,
++	     dma_addr_t pa, uint outidx, u32 *flags, u32 bufcount)
++{
++	u32 ctrl2 = bufcount & D64_CTRL2_BC_MASK;
++
++	/* PCI bus with big(>1G) physical address, use address extension */
++	if ((di->dataoffsetlow == 0) || !(pa & PCI32ADDR_HIGH)) {
++		ddring[outidx].addrlow = cpu_to_le32(pa + di->dataoffsetlow);
++		ddring[outidx].addrhigh = cpu_to_le32(di->dataoffsethigh);
++		ddring[outidx].ctrl1 = cpu_to_le32(*flags);
++		ddring[outidx].ctrl2 = cpu_to_le32(ctrl2);
++	} else {
++		/* address extension for 32-bit PCI */
++		u32 ae;
++
++		ae = (pa & PCI32ADDR_HIGH) >> PCI32ADDR_HIGH_SHIFT;
++		pa &= ~PCI32ADDR_HIGH;
++
++		ctrl2 |= (ae << D64_CTRL2_AE_SHIFT) & D64_CTRL2_AE;
++		ddring[outidx].addrlow = cpu_to_le32(pa + di->dataoffsetlow);
++		ddring[outidx].addrhigh = cpu_to_le32(di->dataoffsethigh);
++		ddring[outidx].ctrl1 = cpu_to_le32(*flags);
++		ddring[outidx].ctrl2 = cpu_to_le32(ctrl2);
++	}
++	if (di->dma.dmactrlflags & DMA_CTRL_PEN) {
++		if (dma64_dd_parity(&ddring[outidx]))
++			ddring[outidx].ctrl2 =
++			     cpu_to_le32(ctrl2 | D64_CTRL2_PARITY);
++	}
++}
++
++/* !! may be called with core in reset */
++void dma_detach(struct dma_pub *pub)
++{
++	struct dma_info *di = (struct dma_info *)pub;
++
++	DMA_TRACE("%s:\n", di->name);
++
++	/* free dma descriptor rings */
++	if (di->txd64)
++		dma_free_coherent(di->dmadev, di->txdalloc,
++				  ((s8 *)di->txd64 - di->txdalign),
++				  (di->txdpaorig));
++	if (di->rxd64)
++		dma_free_coherent(di->dmadev, di->rxdalloc,
++				  ((s8 *)di->rxd64 - di->rxdalign),
++				  (di->rxdpaorig));
++
++	/* free packet pointer vectors */
++	kfree(di->txp);
++	kfree(di->rxp);
++
++	/* free our private info structure */
++	kfree(di);
++
++}
++
++/* initialize descriptor table base address */
++static void
++_dma_ddtable_init(struct dma_info *di, uint direction, dma_addr_t pa)
++{
++	if (!di->aligndesc_4k) {
++		if (direction == DMA_TX)
++			di->xmtptrbase = pa;
++		else
++			di->rcvptrbase = pa;
++	}
++
++	if ((di->ddoffsetlow == 0)
++	    || !(pa & PCI32ADDR_HIGH)) {
++		if (direction == DMA_TX) {
++			bcma_write32(di->core, DMA64TXREGOFFS(di, addrlow),
++				     pa + di->ddoffsetlow);
++			bcma_write32(di->core, DMA64TXREGOFFS(di, addrhigh),
++				     di->ddoffsethigh);
++		} else {
++			bcma_write32(di->core, DMA64RXREGOFFS(di, addrlow),
++				     pa + di->ddoffsetlow);
++			bcma_write32(di->core, DMA64RXREGOFFS(di, addrhigh),
++				     di->ddoffsethigh);
++		}
++	} else {
++		/* DMA64 32bits address extension */
++		u32 ae;
++
++		/* shift the high bit(s) from pa to ae */
++		ae = (pa & PCI32ADDR_HIGH) >> PCI32ADDR_HIGH_SHIFT;
++		pa &= ~PCI32ADDR_HIGH;
++
++		if (direction == DMA_TX) {
++			bcma_write32(di->core, DMA64TXREGOFFS(di, addrlow),
++				     pa + di->ddoffsetlow);
++			bcma_write32(di->core, DMA64TXREGOFFS(di, addrhigh),
++				     di->ddoffsethigh);
++			bcma_maskset32(di->core, DMA64TXREGOFFS(di, control),
++				       D64_XC_AE, (ae << D64_XC_AE_SHIFT));
++		} else {
++			bcma_write32(di->core, DMA64RXREGOFFS(di, addrlow),
++				     pa + di->ddoffsetlow);
++			bcma_write32(di->core, DMA64RXREGOFFS(di, addrhigh),
++				     di->ddoffsethigh);
++			bcma_maskset32(di->core, DMA64RXREGOFFS(di, control),
++				       D64_RC_AE, (ae << D64_RC_AE_SHIFT));
++		}
++	}
++}
++
++static void _dma_rxenable(struct dma_info *di)
++{
++	uint dmactrlflags = di->dma.dmactrlflags;
++	u32 control;
++
++	DMA_TRACE("%s:\n", di->name);
++
++	control = D64_RC_RE | (bcma_read32(di->core,
++					   DMA64RXREGOFFS(di, control)) &
++			       D64_RC_AE);
++
++	if ((dmactrlflags & DMA_CTRL_PEN) == 0)
++		control |= D64_RC_PD;
++
++	if (dmactrlflags & DMA_CTRL_ROC)
++		control |= D64_RC_OC;
++
++	bcma_write32(di->core, DMA64RXREGOFFS(di, control),
++		((di->rxoffset << D64_RC_RO_SHIFT) | control));
++}
++
++void dma_rxinit(struct dma_pub *pub)
++{
++	struct dma_info *di = (struct dma_info *)pub;
++
++	DMA_TRACE("%s:\n", di->name);
++
++	if (di->nrxd == 0)
++		return;
++
++	di->rxin = di->rxout = 0;
++
++	/* clear rx descriptor ring */
++	memset(di->rxd64, '\0', di->nrxd * sizeof(struct dma64desc));
++
++	/* DMA engine with out alignment requirement requires table to be inited
++	 * before enabling the engine
++	 */
++	if (!di->aligndesc_4k)
++		_dma_ddtable_init(di, DMA_RX, di->rxdpa);
++
++	_dma_rxenable(di);
++
++	if (di->aligndesc_4k)
++		_dma_ddtable_init(di, DMA_RX, di->rxdpa);
++}
++
++static struct sk_buff *dma64_getnextrxp(struct dma_info *di, bool forceall)
++{
++	uint i, curr;
++	struct sk_buff *rxp;
++	dma_addr_t pa;
++
++	i = di->rxin;
++
++	/* return if no packets posted */
++	if (i == di->rxout)
++		return NULL;
++
++	curr =
++	    B2I(((bcma_read32(di->core,
++			      DMA64RXREGOFFS(di, status0)) & D64_RS0_CD_MASK) -
++		 di->rcvptrbase) & D64_RS0_CD_MASK, struct dma64desc);
++
++	/* ignore curr if forceall */
++	if (!forceall && (i == curr))
++		return NULL;
++
++	/* get the packet pointer that corresponds to the rx descriptor */
++	rxp = di->rxp[i];
++	di->rxp[i] = NULL;
++
++	pa = le32_to_cpu(di->rxd64[i].addrlow) - di->dataoffsetlow;
++
++	/* clear this packet from the descriptor ring */
++	dma_unmap_single(di->dmadev, pa, di->rxbufsize, DMA_FROM_DEVICE);
++
++	di->rxd64[i].addrlow = cpu_to_le32(0xdeadbeef);
++	di->rxd64[i].addrhigh = cpu_to_le32(0xdeadbeef);
++
++	di->rxin = nextrxd(di, i);
++
++	return rxp;
++}
++
++static struct sk_buff *_dma_getnextrxp(struct dma_info *di, bool forceall)
++{
++	if (di->nrxd == 0)
++		return NULL;
++
++	return dma64_getnextrxp(di, forceall);
++}
++
++/*
++ * !! rx entry routine
++ * returns the number packages in the next frame, or 0 if there are no more
++ *   if DMA_CTRL_RXMULTI is defined, DMA scattering(multiple buffers) is
++ *   supported with pkts chain
++ *   otherwise, it's treated as giant pkt and will be tossed.
++ *   The DMA scattering starts with normal DMA header, followed by first
++ *   buffer data. After it reaches the max size of buffer, the data continues
++ *   in next DMA descriptor buffer WITHOUT DMA header
++ */
++int dma_rx(struct dma_pub *pub, struct sk_buff_head *skb_list)
++{
++	struct dma_info *di = (struct dma_info *)pub;
++	struct sk_buff_head dma_frames;
++	struct sk_buff *p, *next;
++	uint len;
++	uint pkt_len;
++	int resid = 0;
++	int pktcnt = 1;
++
++	skb_queue_head_init(&dma_frames);
++ next_frame:
++	p = _dma_getnextrxp(di, false);
++	if (p == NULL)
++		return 0;
++
++	len = le16_to_cpu(*(__le16 *) (p->data));
++	DMA_TRACE("%s: dma_rx len %d\n", di->name, len);
++	dma_spin_for_len(len, p);
++
++	/* set actual length */
++	pkt_len = min((di->rxoffset + len), di->rxbufsize);
++	__skb_trim(p, pkt_len);
++	skb_queue_tail(&dma_frames, p);
++	resid = len - (di->rxbufsize - di->rxoffset);
++
++	/* check for single or multi-buffer rx */
++	if (resid > 0) {
++		while ((resid > 0) && (p = _dma_getnextrxp(di, false))) {
++			pkt_len = min_t(uint, resid, di->rxbufsize);
++			__skb_trim(p, pkt_len);
++			skb_queue_tail(&dma_frames, p);
++			resid -= di->rxbufsize;
++			pktcnt++;
++		}
++
++#ifdef DEBUG
++		if (resid > 0) {
++			uint cur;
++			cur =
++			    B2I(((bcma_read32(di->core,
++					      DMA64RXREGOFFS(di, status0)) &
++				  D64_RS0_CD_MASK) - di->rcvptrbase) &
++				D64_RS0_CD_MASK, struct dma64desc);
++			DMA_ERROR("rxin %d rxout %d, hw_curr %d\n",
++				   di->rxin, di->rxout, cur);
++		}
++#endif				/* DEBUG */
++
++		if ((di->dma.dmactrlflags & DMA_CTRL_RXMULTI) == 0) {
++			DMA_ERROR("%s: bad frame length (%d)\n",
++				  di->name, len);
++			skb_queue_walk_safe(&dma_frames, p, next) {
++				skb_unlink(p, &dma_frames);
++				brcmu_pkt_buf_free_skb(p);
++			}
++			di->dma.rxgiants++;
++			pktcnt = 1;
++			goto next_frame;
++		}
++	}
++
++	skb_queue_splice_tail(&dma_frames, skb_list);
++	return pktcnt;
++}
++
++static bool dma64_rxidle(struct dma_info *di)
++{
++	DMA_TRACE("%s:\n", di->name);
++
++	if (di->nrxd == 0)
++		return true;
++
++	return ((bcma_read32(di->core,
++			     DMA64RXREGOFFS(di, status0)) & D64_RS0_CD_MASK) ==
++		(bcma_read32(di->core, DMA64RXREGOFFS(di, ptr)) &
++		 D64_RS0_CD_MASK));
++}
++
++/*
++ * post receive buffers
++ *  return false is refill failed completely and ring is empty this will stall
++ *  the rx dma and user might want to call rxfill again asap. This unlikely
++ *  happens on memory-rich NIC, but often on memory-constrained dongle
++ */
++bool dma_rxfill(struct dma_pub *pub)
++{
++	struct dma_info *di = (struct dma_info *)pub;
++	struct sk_buff *p;
++	u16 rxin, rxout;
++	u32 flags = 0;
++	uint n;
++	uint i;
++	dma_addr_t pa;
++	uint extra_offset = 0;
++	bool ring_empty;
++
++	ring_empty = false;
++
++	/*
++	 * Determine how many receive buffers we're lacking
++	 * from the full complement, allocate, initialize,
++	 * and post them, then update the chip rx lastdscr.
++	 */
++
++	rxin = di->rxin;
++	rxout = di->rxout;
++
++	n = di->nrxpost - nrxdactive(di, rxin, rxout);
++
++	DMA_TRACE("%s: post %d\n", di->name, n);
++
++	if (di->rxbufsize > BCMEXTRAHDROOM)
++		extra_offset = di->rxextrahdrroom;
++
++	for (i = 0; i < n; i++) {
++		/*
++		 * the di->rxbufsize doesn't include the extra headroom,
++		 * we need to add it to the size to be allocated
++		 */
++		p = brcmu_pkt_buf_get_skb(di->rxbufsize + extra_offset);
++
++		if (p == NULL) {
++			DMA_ERROR("%s: out of rxbufs\n", di->name);
++			if (i == 0 && dma64_rxidle(di)) {
++				DMA_ERROR("%s: ring is empty !\n", di->name);
++				ring_empty = true;
++			}
++			di->dma.rxnobuf++;
++			break;
++		}
++		/* reserve an extra headroom, if applicable */
++		if (extra_offset)
++			skb_pull(p, extra_offset);
++
++		/* Do a cached write instead of uncached write since DMA_MAP
++		 * will flush the cache.
++		 */
++		*(u32 *) (p->data) = 0;
++
++		pa = dma_map_single(di->dmadev, p->data, di->rxbufsize,
++				    DMA_FROM_DEVICE);
++
++		/* save the free packet pointer */
++		di->rxp[rxout] = p;
++
++		/* reset flags for each descriptor */
++		flags = 0;
++		if (rxout == (di->nrxd - 1))
++			flags = D64_CTRL1_EOT;
++
++		dma64_dd_upd(di, di->rxd64, pa, rxout, &flags,
++			     di->rxbufsize);
++		rxout = nextrxd(di, rxout);
++	}
++
++	di->rxout = rxout;
++
++	/* update the chip lastdscr pointer */
++	bcma_write32(di->core, DMA64RXREGOFFS(di, ptr),
++	      di->rcvptrbase + I2B(rxout, struct dma64desc));
++
++	return ring_empty;
++}
++
++void dma_rxreclaim(struct dma_pub *pub)
++{
++	struct dma_info *di = (struct dma_info *)pub;
++	struct sk_buff *p;
++
++	DMA_TRACE("%s:\n", di->name);
++
++	while ((p = _dma_getnextrxp(di, true)))
++		brcmu_pkt_buf_free_skb(p);
++}
++
++void dma_counterreset(struct dma_pub *pub)
++{
++	/* reset all software counters */
++	pub->rxgiants = 0;
++	pub->rxnobuf = 0;
++	pub->txnobuf = 0;
++}
++
++/* get the address of the var in order to change later */
++unsigned long dma_getvar(struct dma_pub *pub, const char *name)
++{
++	struct dma_info *di = (struct dma_info *)pub;
++
++	if (!strcmp(name, "&txavail"))
++		return (unsigned long)&(di->dma.txavail);
++	return 0;
++}
++
++/* 64-bit DMA functions */
++
++void dma_txinit(struct dma_pub *pub)
++{
++	struct dma_info *di = (struct dma_info *)pub;
++	u32 control = D64_XC_XE;
++
++	DMA_TRACE("%s:\n", di->name);
++
++	if (di->ntxd == 0)
++		return;
++
++	di->txin = di->txout = 0;
++	di->dma.txavail = di->ntxd - 1;
++
++	/* clear tx descriptor ring */
++	memset(di->txd64, '\0', (di->ntxd * sizeof(struct dma64desc)));
++
++	/* DMA engine with out alignment requirement requires table to be inited
++	 * before enabling the engine
++	 */
++	if (!di->aligndesc_4k)
++		_dma_ddtable_init(di, DMA_TX, di->txdpa);
++
++	if ((di->dma.dmactrlflags & DMA_CTRL_PEN) == 0)
++		control |= D64_XC_PD;
++	bcma_set32(di->core, DMA64TXREGOFFS(di, control), control);
++
++	/* DMA engine with alignment requirement requires table to be inited
++	 * before enabling the engine
++	 */
++	if (di->aligndesc_4k)
++		_dma_ddtable_init(di, DMA_TX, di->txdpa);
++}
++
++void dma_txsuspend(struct dma_pub *pub)
++{
++	struct dma_info *di = (struct dma_info *)pub;
++
++	DMA_TRACE("%s:\n", di->name);
++
++	if (di->ntxd == 0)
++		return;
++
++	bcma_set32(di->core, DMA64TXREGOFFS(di, control), D64_XC_SE);
++}
++
++void dma_txresume(struct dma_pub *pub)
++{
++	struct dma_info *di = (struct dma_info *)pub;
++
++	DMA_TRACE("%s:\n", di->name);
++
++	if (di->ntxd == 0)
++		return;
++
++	bcma_mask32(di->core, DMA64TXREGOFFS(di, control), ~D64_XC_SE);
++}
++
++bool dma_txsuspended(struct dma_pub *pub)
++{
++	struct dma_info *di = (struct dma_info *)pub;
++
++	return (di->ntxd == 0) ||
++	       ((bcma_read32(di->core,
++			     DMA64TXREGOFFS(di, control)) & D64_XC_SE) ==
++		D64_XC_SE);
++}
++
++void dma_txreclaim(struct dma_pub *pub, enum txd_range range)
++{
++	struct dma_info *di = (struct dma_info *)pub;
++	struct sk_buff *p;
++
++	DMA_TRACE("%s: %s\n",
++		  di->name,
++		  range == DMA_RANGE_ALL ? "all" :
++		  range == DMA_RANGE_TRANSMITTED ? "transmitted" :
++		  "transferred");
++
++	if (di->txin == di->txout)
++		return;
++
++	while ((p = dma_getnexttxp(pub, range))) {
++		/* For unframed data, we don't have any packets to free */
++		if (!(di->dma.dmactrlflags & DMA_CTRL_UNFRAMED))
++			brcmu_pkt_buf_free_skb(p);
++	}
++}
++
++bool dma_txreset(struct dma_pub *pub)
++{
++	struct dma_info *di = (struct dma_info *)pub;
++	u32 status;
++
++	if (di->ntxd == 0)
++		return true;
++
++	/* suspend tx DMA first */
++	bcma_write32(di->core, DMA64TXREGOFFS(di, control), D64_XC_SE);
++	SPINWAIT(((status =
++		   (bcma_read32(di->core, DMA64TXREGOFFS(di, status0)) &
++		    D64_XS0_XS_MASK)) != D64_XS0_XS_DISABLED) &&
++		  (status != D64_XS0_XS_IDLE) && (status != D64_XS0_XS_STOPPED),
++		 10000);
++
++	bcma_write32(di->core, DMA64TXREGOFFS(di, control), 0);
++	SPINWAIT(((status =
++		   (bcma_read32(di->core, DMA64TXREGOFFS(di, status0)) &
++		    D64_XS0_XS_MASK)) != D64_XS0_XS_DISABLED), 10000);
++
++	/* wait for the last transaction to complete */
++	udelay(300);
++
++	return status == D64_XS0_XS_DISABLED;
++}
++
++bool dma_rxreset(struct dma_pub *pub)
++{
++	struct dma_info *di = (struct dma_info *)pub;
++	u32 status;
++
++	if (di->nrxd == 0)
++		return true;
++
++	bcma_write32(di->core, DMA64RXREGOFFS(di, control), 0);
++	SPINWAIT(((status =
++		   (bcma_read32(di->core, DMA64RXREGOFFS(di, status0)) &
++		    D64_RS0_RS_MASK)) != D64_RS0_RS_DISABLED), 10000);
++
++	return status == D64_RS0_RS_DISABLED;
++}
++
++/*
++ * !! tx entry routine
++ * WARNING: call must check the return value for error.
++ *   the error(toss frames) could be fatal and cause many subsequent hard
++ *   to debug problems
++ */
++int dma_txfast(struct dma_pub *pub, struct sk_buff *p, bool commit)
++{
++	struct dma_info *di = (struct dma_info *)pub;
++	unsigned char *data;
++	uint len;
++	u16 txout;
++	u32 flags = 0;
++	dma_addr_t pa;
++
++	DMA_TRACE("%s:\n", di->name);
++
++	txout = di->txout;
++
++	/*
++	 * obtain and initialize transmit descriptor entry.
++	 */
++	data = p->data;
++	len = p->len;
++
++	/* no use to transmit a zero length packet */
++	if (len == 0)
++		return 0;
++
++	/* return nonzero if out of tx descriptors */
++	if (nexttxd(di, txout) == di->txin)
++		goto outoftxd;
++
++	/* get physical address of buffer start */
++	pa = dma_map_single(di->dmadev, data, len, DMA_TO_DEVICE);
++
++	/* With a DMA segment list, Descriptor table is filled
++	 * using the segment list instead of looping over
++	 * buffers in multi-chain DMA. Therefore, EOF for SGLIST
++	 * is when end of segment list is reached.
++	 */
++	flags = D64_CTRL1_SOF | D64_CTRL1_IOC | D64_CTRL1_EOF;
++	if (txout == (di->ntxd - 1))
++		flags |= D64_CTRL1_EOT;
++
++	dma64_dd_upd(di, di->txd64, pa, txout, &flags, len);
++
++	txout = nexttxd(di, txout);
++
++	/* save the packet */
++	di->txp[prevtxd(di, txout)] = p;
++
++	/* bump the tx descriptor index */
++	di->txout = txout;
++
++	/* kick the chip */
++	if (commit)
++		bcma_write32(di->core, DMA64TXREGOFFS(di, ptr),
++		      di->xmtptrbase + I2B(txout, struct dma64desc));
++
++	/* tx flow control */
++	di->dma.txavail = di->ntxd - ntxdactive(di, di->txin, di->txout) - 1;
++
++	return 0;
++
++ outoftxd:
++	DMA_ERROR("%s: out of txds !!!\n", di->name);
++	brcmu_pkt_buf_free_skb(p);
++	di->dma.txavail = 0;
++	di->dma.txnobuf++;
++	return -1;
++}
++
++/*
++ * Reclaim next completed txd (txds if using chained buffers) in the range
++ * specified and return associated packet.
++ * If range is DMA_RANGE_TRANSMITTED, reclaim descriptors that have be
++ * transmitted as noted by the hardware "CurrDescr" pointer.
++ * If range is DMA_RANGE_TRANSFERED, reclaim descriptors that have be
++ * transferred by the DMA as noted by the hardware "ActiveDescr" pointer.
++ * If range is DMA_RANGE_ALL, reclaim all txd(s) posted to the ring and
++ * return associated packet regardless of the value of hardware pointers.
++ */
++struct sk_buff *dma_getnexttxp(struct dma_pub *pub, enum txd_range range)
++{
++	struct dma_info *di = (struct dma_info *)pub;
++	u16 start, end, i;
++	u16 active_desc;
++	struct sk_buff *txp;
++
++	DMA_TRACE("%s: %s\n",
++		  di->name,
++		  range == DMA_RANGE_ALL ? "all" :
++		  range == DMA_RANGE_TRANSMITTED ? "transmitted" :
++		  "transferred");
++
++	if (di->ntxd == 0)
++		return NULL;
++
++	txp = NULL;
++
++	start = di->txin;
++	if (range == DMA_RANGE_ALL)
++		end = di->txout;
++	else {
++		end = (u16) (B2I(((bcma_read32(di->core,
++					       DMA64TXREGOFFS(di, status0)) &
++				   D64_XS0_CD_MASK) - di->xmtptrbase) &
++				 D64_XS0_CD_MASK, struct dma64desc));
++
++		if (range == DMA_RANGE_TRANSFERED) {
++			active_desc =
++				(u16)(bcma_read32(di->core,
++						  DMA64TXREGOFFS(di, status1)) &
++				      D64_XS1_AD_MASK);
++			active_desc =
++			    (active_desc - di->xmtptrbase) & D64_XS0_CD_MASK;
++			active_desc = B2I(active_desc, struct dma64desc);
++			if (end != active_desc)
++				end = prevtxd(di, active_desc);
++		}
++	}
++
++	if ((start == 0) && (end > di->txout))
++		goto bogus;
++
++	for (i = start; i != end && !txp; i = nexttxd(di, i)) {
++		dma_addr_t pa;
++		uint size;
++
++		pa = le32_to_cpu(di->txd64[i].addrlow) - di->dataoffsetlow;
++
++		size =
++		    (le32_to_cpu(di->txd64[i].ctrl2) &
++		     D64_CTRL2_BC_MASK);
++
++		di->txd64[i].addrlow = cpu_to_le32(0xdeadbeef);
++		di->txd64[i].addrhigh = cpu_to_le32(0xdeadbeef);
++
++		txp = di->txp[i];
++		di->txp[i] = NULL;
++
++		dma_unmap_single(di->dmadev, pa, size, DMA_TO_DEVICE);
++	}
++
++	di->txin = i;
++
++	/* tx flow control */
++	di->dma.txavail = di->ntxd - ntxdactive(di, di->txin, di->txout) - 1;
++
++	return txp;
++
++ bogus:
++	DMA_NONE("bogus curr: start %d end %d txout %d\n",
++		 start, end, di->txout);
++	return NULL;
++}
++
++/*
++ * Mac80211 initiated actions sometimes require packets in the DMA queue to be
++ * modified. The modified portion of the packet is not under control of the DMA
++ * engine. This function calls a caller-supplied function for each packet in
++ * the caller specified dma chain.
++ */
++void dma_walk_packets(struct dma_pub *dmah, void (*callback_fnc)
++		      (void *pkt, void *arg_a), void *arg_a)
++{
++	struct dma_info *di = (struct dma_info *) dmah;
++	uint i =   di->txin;
++	uint end = di->txout;
++	struct sk_buff *skb;
++	struct ieee80211_tx_info *tx_info;
++
++	while (i != end) {
++		skb = (struct sk_buff *)di->txp[i];
++		if (skb != NULL) {
++			tx_info = (struct ieee80211_tx_info *)skb->cb;
++			(callback_fnc)(tx_info, arg_a);
++		}
++		i = nexttxd(di, i);
++	}
++}
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/dma.h b/drivers/net/wireless/brcm80211/brcmsmac/dma.h
+new file mode 100644
+index 0000000..cc269ee
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmsmac/dma.h
+@@ -0,0 +1,122 @@
++/*
++ * Copyright (c) 2010 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#ifndef	_BRCM_DMA_H_
++#define	_BRCM_DMA_H_
++
++#include <linux/delay.h>
++#include <linux/skbuff.h>
++#include "types.h"		/* forward structure declarations */
++
++/* map/unmap direction */
++#define	DMA_TX	1		/* TX direction for DMA */
++#define	DMA_RX	2		/* RX direction for DMA */
++
++/* DMA structure:
++ *  support two DMA engines: 32 bits address or 64 bit addressing
++ *  basic DMA register set is per channel(transmit or receive)
++ *  a pair of channels is defined for convenience
++ */
++
++/* 32 bits addressing */
++
++struct dma32diag {	/* diag access */
++	u32 fifoaddr;	/* diag address */
++	u32 fifodatalow;	/* low 32bits of data */
++	u32 fifodatahigh;	/* high 32bits of data */
++	u32 pad;		/* reserved */
++};
++
++/* 64 bits addressing */
++
++/* dma registers per channel(xmt or rcv) */
++struct dma64regs {
++	u32 control;	/* enable, et al */
++	u32 ptr;	/* last descriptor posted to chip */
++	u32 addrlow;	/* desc ring base address low 32-bits (8K aligned) */
++	u32 addrhigh;	/* desc ring base address bits 63:32 (8K aligned) */
++	u32 status0;	/* current descriptor, xmt state */
++	u32 status1;	/* active descriptor, xmt error */
++};
++
++/* range param for dma_getnexttxp() and dma_txreclaim */
++enum txd_range {
++	DMA_RANGE_ALL = 1,
++	DMA_RANGE_TRANSMITTED,
++	DMA_RANGE_TRANSFERED
++};
++
++/*
++ * Exported data structure (read-only)
++ */
++/* export structure */
++struct dma_pub {
++	uint txavail;		/* # free tx descriptors */
++	uint dmactrlflags;	/* dma control flags */
++
++	/* rx error counters */
++	uint rxgiants;		/* rx giant frames */
++	uint rxnobuf;		/* rx out of dma descriptors */
++	/* tx error counters */
++	uint txnobuf;		/* tx out of dma descriptors */
++};
++
++extern struct dma_pub *dma_attach(char *name, struct si_pub *sih,
++				  struct bcma_device *d11core,
++				  uint txregbase, uint rxregbase,
++				  uint ntxd, uint nrxd,
++				  uint rxbufsize, int rxextheadroom,
++				  uint nrxpost, uint rxoffset, uint *msg_level);
++
++void dma_rxinit(struct dma_pub *pub);
++int dma_rx(struct dma_pub *pub, struct sk_buff_head *skb_list);
++bool dma_rxfill(struct dma_pub *pub);
++bool dma_rxreset(struct dma_pub *pub);
++bool dma_txreset(struct dma_pub *pub);
++void dma_txinit(struct dma_pub *pub);
++int dma_txfast(struct dma_pub *pub, struct sk_buff *p0, bool commit);
++void dma_txsuspend(struct dma_pub *pub);
++bool dma_txsuspended(struct dma_pub *pub);
++void dma_txresume(struct dma_pub *pub);
++void dma_txreclaim(struct dma_pub *pub, enum txd_range range);
++void dma_rxreclaim(struct dma_pub *pub);
++void dma_detach(struct dma_pub *pub);
++unsigned long dma_getvar(struct dma_pub *pub, const char *name);
++struct sk_buff *dma_getnexttxp(struct dma_pub *pub, enum txd_range range);
++void dma_counterreset(struct dma_pub *pub);
++
++void dma_walk_packets(struct dma_pub *dmah, void (*callback_fnc)
++		      (void *pkt, void *arg_a), void *arg_a);
++
++/*
++ * DMA(Bug) on bcm47xx chips seems to declare that the packet is ready, but
++ * the packet length is not updated yet (by DMA) on the expected time.
++ * Workaround is to hold processor till DMA updates the length, and stay off
++ * the bus to allow DMA update the length in buffer
++ */
++static inline void dma_spin_for_len(uint len, struct sk_buff *head)
++{
++#if defined(CONFIG_BCM47XX)
++	if (!len) {
++		while (!(len = *(u16 *) KSEG1ADDR(head->data)))
++			udelay(1);
++
++		*(u16 *) (head->data) = cpu_to_le16((u16) len);
++	}
++#endif				/* defined(CONFIG_BCM47XX) */
++}
++
++#endif				/* _BRCM_DMA_H_ */
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+new file mode 100644
+index 0000000..21f7939
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+@@ -0,0 +1,1609 @@
++/*
++ * Copyright (c) 2010 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#define __UNDEF_NO_VERSION__
++#undef pr_fmt
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/printk.h>
++#include <linux/etherdevice.h>
++#include <linux/sched.h>
++#include <linux/firmware.h>
++#include <linux/interrupt.h>
++#include <linux/module.h>
++#include <linux/bcma/bcma.h>
++#include <net/mac80211.h>
++#include <defs.h>
++#include "phy/phy_int.h"
++#include "d11.h"
++#include "channel.h"
++#include "scb.h"
++#include "pub.h"
++#include "ucode_loader.h"
++#include "mac80211_if.h"
++#include "main.h"
++
++#define N_TX_QUEUES	4 /* #tx queues on mac80211<->driver interface */
++
++/* Flags we support */
++#define MAC_FILTERS (FIF_PROMISC_IN_BSS | \
++	FIF_ALLMULTI | \
++	FIF_FCSFAIL | \
++	FIF_CONTROL | \
++	FIF_OTHER_BSS | \
++	FIF_BCN_PRBRESP_PROMISC | \
++	FIF_PSPOLL)
++
++#define CHAN2GHZ(channel, freqency, chflags)  { \
++	.band = IEEE80211_BAND_2GHZ, \
++	.center_freq = (freqency), \
++	.hw_value = (channel), \
++	.flags = chflags, \
++	.max_antenna_gain = 0, \
++	.max_power = 19, \
++}
++
++#define CHAN5GHZ(channel, chflags)  { \
++	.band = IEEE80211_BAND_5GHZ, \
++	.center_freq = 5000 + 5*(channel), \
++	.hw_value = (channel), \
++	.flags = chflags, \
++	.max_antenna_gain = 0, \
++	.max_power = 21, \
++}
++
++#define RATE(rate100m, _flags) { \
++	.bitrate = (rate100m), \
++	.flags = (_flags), \
++	.hw_value = (rate100m / 5), \
++}
++
++struct firmware_hdr {
++	__le32 offset;
++	__le32 len;
++	__le32 idx;
++};
++
++static const char * const brcms_firmwares[MAX_FW_IMAGES] = {
++	"brcm/bcm43xx",
++	NULL
++};
++
++static int n_adapters_found;
++
++MODULE_AUTHOR("Broadcom Corporation");
++MODULE_DESCRIPTION("Broadcom 802.11n wireless LAN driver.");
++MODULE_SUPPORTED_DEVICE("Broadcom 802.11n WLAN cards");
++MODULE_LICENSE("Dual BSD/GPL");
++
++
++/* recognized BCMA Core IDs */
++static struct bcma_device_id brcms_coreid_table[] = {
++	BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 23, BCMA_ANY_CLASS),
++	BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_80211, 24, BCMA_ANY_CLASS),
++	BCMA_CORETABLE_END
++};
++MODULE_DEVICE_TABLE(bcma, brcms_coreid_table);
++
++#ifdef DEBUG
++static int msglevel = 0xdeadbeef;
++module_param(msglevel, int, 0);
++#endif				/* DEBUG */
++
++static struct ieee80211_channel brcms_2ghz_chantable[] = {
++	CHAN2GHZ(1, 2412, IEEE80211_CHAN_NO_HT40MINUS),
++	CHAN2GHZ(2, 2417, IEEE80211_CHAN_NO_HT40MINUS),
++	CHAN2GHZ(3, 2422, IEEE80211_CHAN_NO_HT40MINUS),
++	CHAN2GHZ(4, 2427, IEEE80211_CHAN_NO_HT40MINUS),
++	CHAN2GHZ(5, 2432, 0),
++	CHAN2GHZ(6, 2437, 0),
++	CHAN2GHZ(7, 2442, 0),
++	CHAN2GHZ(8, 2447, IEEE80211_CHAN_NO_HT40PLUS),
++	CHAN2GHZ(9, 2452, IEEE80211_CHAN_NO_HT40PLUS),
++	CHAN2GHZ(10, 2457, IEEE80211_CHAN_NO_HT40PLUS),
++	CHAN2GHZ(11, 2462, IEEE80211_CHAN_NO_HT40PLUS),
++	CHAN2GHZ(12, 2467,
++		 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_IBSS |
++		 IEEE80211_CHAN_NO_HT40PLUS),
++	CHAN2GHZ(13, 2472,
++		 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_IBSS |
++		 IEEE80211_CHAN_NO_HT40PLUS),
++	CHAN2GHZ(14, 2484,
++		 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_IBSS |
++		 IEEE80211_CHAN_NO_HT40PLUS | IEEE80211_CHAN_NO_HT40MINUS)
++};
++
++static struct ieee80211_channel brcms_5ghz_nphy_chantable[] = {
++	/* UNII-1 */
++	CHAN5GHZ(36, IEEE80211_CHAN_NO_HT40MINUS),
++	CHAN5GHZ(40, IEEE80211_CHAN_NO_HT40PLUS),
++	CHAN5GHZ(44, IEEE80211_CHAN_NO_HT40MINUS),
++	CHAN5GHZ(48, IEEE80211_CHAN_NO_HT40PLUS),
++	/* UNII-2 */
++	CHAN5GHZ(52,
++		 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
++		 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40MINUS),
++	CHAN5GHZ(56,
++		 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
++		 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40PLUS),
++	CHAN5GHZ(60,
++		 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
++		 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40MINUS),
++	CHAN5GHZ(64,
++		 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
++		 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40PLUS),
++	/* MID */
++	CHAN5GHZ(100,
++		 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
++		 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40MINUS),
++	CHAN5GHZ(104,
++		 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
++		 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40PLUS),
++	CHAN5GHZ(108,
++		 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
++		 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40MINUS),
++	CHAN5GHZ(112,
++		 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
++		 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40PLUS),
++	CHAN5GHZ(116,
++		 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
++		 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40MINUS),
++	CHAN5GHZ(120,
++		 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
++		 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40PLUS),
++	CHAN5GHZ(124,
++		 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
++		 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40MINUS),
++	CHAN5GHZ(128,
++		 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
++		 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40PLUS),
++	CHAN5GHZ(132,
++		 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
++		 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40MINUS),
++	CHAN5GHZ(136,
++		 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
++		 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40PLUS),
++	CHAN5GHZ(140,
++		 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
++		 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40PLUS |
++		 IEEE80211_CHAN_NO_HT40MINUS),
++	/* UNII-3 */
++	CHAN5GHZ(149, IEEE80211_CHAN_NO_HT40MINUS),
++	CHAN5GHZ(153, IEEE80211_CHAN_NO_HT40PLUS),
++	CHAN5GHZ(157, IEEE80211_CHAN_NO_HT40MINUS),
++	CHAN5GHZ(161, IEEE80211_CHAN_NO_HT40PLUS),
++	CHAN5GHZ(165, IEEE80211_CHAN_NO_HT40PLUS | IEEE80211_CHAN_NO_HT40MINUS)
++};
++
++/*
++ * The rate table is used for both 2.4G and 5G rates. The
++ * latter being a subset as it does not support CCK rates.
++ */
++static struct ieee80211_rate legacy_ratetable[] = {
++	RATE(10, 0),
++	RATE(20, IEEE80211_RATE_SHORT_PREAMBLE),
++	RATE(55, IEEE80211_RATE_SHORT_PREAMBLE),
++	RATE(110, IEEE80211_RATE_SHORT_PREAMBLE),
++	RATE(60, 0),
++	RATE(90, 0),
++	RATE(120, 0),
++	RATE(180, 0),
++	RATE(240, 0),
++	RATE(360, 0),
++	RATE(480, 0),
++	RATE(540, 0),
++};
++
++static const struct ieee80211_supported_band brcms_band_2GHz_nphy_template = {
++	.band = IEEE80211_BAND_2GHZ,
++	.channels = brcms_2ghz_chantable,
++	.n_channels = ARRAY_SIZE(brcms_2ghz_chantable),
++	.bitrates = legacy_ratetable,
++	.n_bitrates = ARRAY_SIZE(legacy_ratetable),
++	.ht_cap = {
++		   /* from include/linux/ieee80211.h */
++		   .cap = IEEE80211_HT_CAP_GRN_FLD |
++			  IEEE80211_HT_CAP_SGI_20 | IEEE80211_HT_CAP_SGI_40,
++		   .ht_supported = true,
++		   .ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K,
++		   .ampdu_density = AMPDU_DEF_MPDU_DENSITY,
++		   .mcs = {
++			   /* placeholders for now */
++			   .rx_mask = {0xff, 0xff, 0, 0, 0, 0, 0, 0, 0, 0},
++			   .rx_highest = cpu_to_le16(500),
++			   .tx_params = IEEE80211_HT_MCS_TX_DEFINED}
++		   }
++};
++
++static const struct ieee80211_supported_band brcms_band_5GHz_nphy_template = {
++	.band = IEEE80211_BAND_5GHZ,
++	.channels = brcms_5ghz_nphy_chantable,
++	.n_channels = ARRAY_SIZE(brcms_5ghz_nphy_chantable),
++	.bitrates = legacy_ratetable + BRCMS_LEGACY_5G_RATE_OFFSET,
++	.n_bitrates = ARRAY_SIZE(legacy_ratetable) -
++			BRCMS_LEGACY_5G_RATE_OFFSET,
++	.ht_cap = {
++		   .cap = IEEE80211_HT_CAP_GRN_FLD | IEEE80211_HT_CAP_SGI_20 |
++			  IEEE80211_HT_CAP_SGI_40,
++		   .ht_supported = true,
++		   .ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K,
++		   .ampdu_density = AMPDU_DEF_MPDU_DENSITY,
++		   .mcs = {
++			   /* placeholders for now */
++			   .rx_mask = {0xff, 0xff, 0, 0, 0, 0, 0, 0, 0, 0},
++			   .rx_highest = cpu_to_le16(500),
++			   .tx_params = IEEE80211_HT_MCS_TX_DEFINED}
++		   }
++};
++
++/* flags the given rate in rateset as requested */
++static void brcms_set_basic_rate(struct brcm_rateset *rs, u16 rate, bool is_br)
++{
++	u32 i;
++
++	for (i = 0; i < rs->count; i++) {
++		if (rate != (rs->rates[i] & 0x7f))
++			continue;
++
++		if (is_br)
++			rs->rates[i] |= BRCMS_RATE_FLAG;
++		else
++			rs->rates[i] &= BRCMS_RATE_MASK;
++		return;
++	}
++}
++
++static void brcms_ops_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
++{
++	struct brcms_info *wl = hw->priv;
++
++	spin_lock_bh(&wl->lock);
++	if (!wl->pub->up) {
++		wiphy_err(wl->wiphy, "ops->tx called while down\n");
++		kfree_skb(skb);
++		goto done;
++	}
++	brcms_c_sendpkt_mac80211(wl->wlc, skb, hw);
++ done:
++	spin_unlock_bh(&wl->lock);
++}
++
++static int brcms_ops_start(struct ieee80211_hw *hw)
++{
++	struct brcms_info *wl = hw->priv;
++	bool blocked;
++	int err;
++
++	ieee80211_wake_queues(hw);
++	spin_lock_bh(&wl->lock);
++	blocked = brcms_rfkill_set_hw_state(wl);
++	spin_unlock_bh(&wl->lock);
++	if (!blocked)
++		wiphy_rfkill_stop_polling(wl->pub->ieee_hw->wiphy);
++
++	spin_lock_bh(&wl->lock);
++	/* avoid acknowledging frames before a non-monitor device is added */
++	wl->mute_tx = true;
++
++	if (!wl->pub->up)
++		err = brcms_up(wl);
++	else
++		err = -ENODEV;
++	spin_unlock_bh(&wl->lock);
++
++	if (err != 0)
++		wiphy_err(hw->wiphy, "%s: brcms_up() returned %d\n", __func__,
++			  err);
++	return err;
++}
++
++static void brcms_ops_stop(struct ieee80211_hw *hw)
++{
++	struct brcms_info *wl = hw->priv;
++	int status;
++
++	ieee80211_stop_queues(hw);
++
++	if (wl->wlc == NULL)
++		return;
++
++	spin_lock_bh(&wl->lock);
++	status = brcms_c_chipmatch(wl->wlc->hw->vendorid,
++				   wl->wlc->hw->deviceid);
++	spin_unlock_bh(&wl->lock);
++	if (!status) {
++		wiphy_err(wl->wiphy,
++			  "wl: brcms_ops_stop: chipmatch failed\n");
++		return;
++	}
++
++	/* put driver in down state */
++	spin_lock_bh(&wl->lock);
++	brcms_down(wl);
++	spin_unlock_bh(&wl->lock);
++}
++
++static int
++brcms_ops_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
++{
++	struct brcms_info *wl = hw->priv;
++
++	/* Just STA for now */
++	if (vif->type != NL80211_IFTYPE_STATION) {
++		wiphy_err(hw->wiphy, "%s: Attempt to add type %d, only"
++			  " STA for now\n", __func__, vif->type);
++		return -EOPNOTSUPP;
++	}
++
++	wl->mute_tx = false;
++	brcms_c_mute(wl->wlc, false);
++
++	return 0;
++}
++
++static void
++brcms_ops_remove_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
++{
++}
++
++static int brcms_ops_config(struct ieee80211_hw *hw, u32 changed)
++{
++	struct ieee80211_conf *conf = &hw->conf;
++	struct brcms_info *wl = hw->priv;
++	int err = 0;
++	int new_int;
++	struct wiphy *wiphy = hw->wiphy;
++
++	spin_lock_bh(&wl->lock);
++	if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL) {
++		brcms_c_set_beacon_listen_interval(wl->wlc,
++						   conf->listen_interval);
++	}
++	if (changed & IEEE80211_CONF_CHANGE_MONITOR)
++		wiphy_dbg(wiphy, "%s: change monitor mode: %s\n",
++			  __func__, conf->flags & IEEE80211_CONF_MONITOR ?
++			  "true" : "false");
++	if (changed & IEEE80211_CONF_CHANGE_PS)
++		wiphy_err(wiphy, "%s: change power-save mode: %s (implement)\n",
++			  __func__, conf->flags & IEEE80211_CONF_PS ?
++			  "true" : "false");
++
++	if (changed & IEEE80211_CONF_CHANGE_POWER) {
++		err = brcms_c_set_tx_power(wl->wlc, conf->power_level);
++		if (err < 0) {
++			wiphy_err(wiphy, "%s: Error setting power_level\n",
++				  __func__);
++			goto config_out;
++		}
++		new_int = brcms_c_get_tx_power(wl->wlc);
++		if (new_int != conf->power_level)
++			wiphy_err(wiphy, "%s: Power level req != actual, %d %d"
++				  "\n", __func__, conf->power_level,
++				  new_int);
++	}
++	if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
++		if (conf->channel_type == NL80211_CHAN_HT20 ||
++		    conf->channel_type == NL80211_CHAN_NO_HT)
++			err = brcms_c_set_channel(wl->wlc,
++						  conf->channel->hw_value);
++		else
++			err = -ENOTSUPP;
++	}
++	if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
++		err = brcms_c_set_rate_limit(wl->wlc,
++					     conf->short_frame_max_tx_count,
++					     conf->long_frame_max_tx_count);
++
++ config_out:
++	spin_unlock_bh(&wl->lock);
++	return err;
++}
++
++static void
++brcms_ops_bss_info_changed(struct ieee80211_hw *hw,
++			struct ieee80211_vif *vif,
++			struct ieee80211_bss_conf *info, u32 changed)
++{
++	struct brcms_info *wl = hw->priv;
++	struct wiphy *wiphy = hw->wiphy;
++
++	if (changed & BSS_CHANGED_ASSOC) {
++		/* association status changed (associated/disassociated)
++		 * also implies a change in the AID.
++		 */
++		wiphy_err(wiphy, "%s: %s: %sassociated\n", KBUILD_MODNAME,
++			  __func__, info->assoc ? "" : "dis");
++		spin_lock_bh(&wl->lock);
++		brcms_c_associate_upd(wl->wlc, info->assoc);
++		spin_unlock_bh(&wl->lock);
++	}
++	if (changed & BSS_CHANGED_ERP_SLOT) {
++		s8 val;
++
++		/* slot timing changed */
++		if (info->use_short_slot)
++			val = 1;
++		else
++			val = 0;
++		spin_lock_bh(&wl->lock);
++		brcms_c_set_shortslot_override(wl->wlc, val);
++		spin_unlock_bh(&wl->lock);
++	}
++
++	if (changed & BSS_CHANGED_HT) {
++		/* 802.11n parameters changed */
++		u16 mode = info->ht_operation_mode;
++
++		spin_lock_bh(&wl->lock);
++		brcms_c_protection_upd(wl->wlc, BRCMS_PROT_N_CFG,
++			mode & IEEE80211_HT_OP_MODE_PROTECTION);
++		brcms_c_protection_upd(wl->wlc, BRCMS_PROT_N_NONGF,
++			mode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT);
++		brcms_c_protection_upd(wl->wlc, BRCMS_PROT_N_OBSS,
++			mode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT);
++		spin_unlock_bh(&wl->lock);
++	}
++	if (changed & BSS_CHANGED_BASIC_RATES) {
++		struct ieee80211_supported_band *bi;
++		u32 br_mask, i;
++		u16 rate;
++		struct brcm_rateset rs;
++		int error;
++
++		/* retrieve the current rates */
++		spin_lock_bh(&wl->lock);
++		brcms_c_get_current_rateset(wl->wlc, &rs);
++		spin_unlock_bh(&wl->lock);
++
++		br_mask = info->basic_rates;
++		bi = hw->wiphy->bands[brcms_c_get_curband(wl->wlc)];
++		for (i = 0; i < bi->n_bitrates; i++) {
++			/* convert to internal rate value */
++			rate = (bi->bitrates[i].bitrate << 1) / 10;
++
++			/* set/clear basic rate flag */
++			brcms_set_basic_rate(&rs, rate, br_mask & 1);
++			br_mask >>= 1;
++		}
++
++		/* update the rate set */
++		spin_lock_bh(&wl->lock);
++		error = brcms_c_set_rateset(wl->wlc, &rs);
++		spin_unlock_bh(&wl->lock);
++		if (error)
++			wiphy_err(wiphy, "changing basic rates failed: %d\n",
++				  error);
++	}
++	if (changed & BSS_CHANGED_BEACON_INT) {
++		/* Beacon interval changed */
++		spin_lock_bh(&wl->lock);
++		brcms_c_set_beacon_period(wl->wlc, info->beacon_int);
++		spin_unlock_bh(&wl->lock);
++	}
++	if (changed & BSS_CHANGED_BSSID) {
++		/* BSSID changed, for whatever reason (IBSS and managed mode) */
++		spin_lock_bh(&wl->lock);
++		brcms_c_set_addrmatch(wl->wlc, RCM_BSSID_OFFSET, info->bssid);
++		spin_unlock_bh(&wl->lock);
++	}
++	if (changed & BSS_CHANGED_BEACON)
++		/* Beacon data changed, retrieve new beacon (beaconing modes) */
++		wiphy_err(wiphy, "%s: beacon changed\n", __func__);
++
++	if (changed & BSS_CHANGED_BEACON_ENABLED) {
++		/* Beaconing should be enabled/disabled (beaconing modes) */
++		wiphy_err(wiphy, "%s: Beacon enabled: %s\n", __func__,
++			  info->enable_beacon ? "true" : "false");
++	}
++
++	if (changed & BSS_CHANGED_CQM) {
++		/* Connection quality monitor config changed */
++		wiphy_err(wiphy, "%s: cqm change: threshold %d, hys %d "
++			  " (implement)\n", __func__, info->cqm_rssi_thold,
++			  info->cqm_rssi_hyst);
++	}
++
++	if (changed & BSS_CHANGED_IBSS) {
++		/* IBSS join status changed */
++		wiphy_err(wiphy, "%s: IBSS joined: %s (implement)\n", __func__,
++			  info->ibss_joined ? "true" : "false");
++	}
++
++	if (changed & BSS_CHANGED_ARP_FILTER) {
++		/* Hardware ARP filter address list or state changed */
++		wiphy_err(wiphy, "%s: arp filtering: enabled %s, count %d"
++			  " (implement)\n", __func__, info->arp_filter_enabled ?
++			  "true" : "false", info->arp_addr_cnt);
++	}
++
++	if (changed & BSS_CHANGED_QOS) {
++		/*
++		 * QoS for this association was enabled/disabled.
++		 * Note that it is only ever disabled for station mode.
++		 */
++		wiphy_err(wiphy, "%s: qos enabled: %s (implement)\n", __func__,
++			  info->qos ? "true" : "false");
++	}
++	return;
++}
++
++static void
++brcms_ops_configure_filter(struct ieee80211_hw *hw,
++			unsigned int changed_flags,
++			unsigned int *total_flags, u64 multicast)
++{
++	struct brcms_info *wl = hw->priv;
++	struct wiphy *wiphy = hw->wiphy;
++
++	changed_flags &= MAC_FILTERS;
++	*total_flags &= MAC_FILTERS;
++
++	if (changed_flags & FIF_PROMISC_IN_BSS)
++		wiphy_dbg(wiphy, "FIF_PROMISC_IN_BSS\n");
++	if (changed_flags & FIF_ALLMULTI)
++		wiphy_dbg(wiphy, "FIF_ALLMULTI\n");
++	if (changed_flags & FIF_FCSFAIL)
++		wiphy_dbg(wiphy, "FIF_FCSFAIL\n");
++	if (changed_flags & FIF_CONTROL)
++		wiphy_dbg(wiphy, "FIF_CONTROL\n");
++	if (changed_flags & FIF_OTHER_BSS)
++		wiphy_dbg(wiphy, "FIF_OTHER_BSS\n");
++	if (changed_flags & FIF_PSPOLL)
++		wiphy_dbg(wiphy, "FIF_PSPOLL\n");
++	if (changed_flags & FIF_BCN_PRBRESP_PROMISC)
++		wiphy_dbg(wiphy, "FIF_BCN_PRBRESP_PROMISC\n");
++
++	spin_lock_bh(&wl->lock);
++	brcms_c_mac_promisc(wl->wlc, *total_flags);
++	spin_unlock_bh(&wl->lock);
++	return;
++}
++
++static void brcms_ops_sw_scan_start(struct ieee80211_hw *hw)
++{
++	struct brcms_info *wl = hw->priv;
++	spin_lock_bh(&wl->lock);
++	brcms_c_scan_start(wl->wlc);
++	spin_unlock_bh(&wl->lock);
++	return;
++}
++
++static void brcms_ops_sw_scan_complete(struct ieee80211_hw *hw)
++{
++	struct brcms_info *wl = hw->priv;
++	spin_lock_bh(&wl->lock);
++	brcms_c_scan_stop(wl->wlc);
++	spin_unlock_bh(&wl->lock);
++	return;
++}
++
++static int
++brcms_ops_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif, u16 queue,
++		  const struct ieee80211_tx_queue_params *params)
++{
++	struct brcms_info *wl = hw->priv;
++
++	spin_lock_bh(&wl->lock);
++	brcms_c_wme_setparams(wl->wlc, queue, params, true);
++	spin_unlock_bh(&wl->lock);
++
++	return 0;
++}
++
++static int
++brcms_ops_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
++	       struct ieee80211_sta *sta)
++{
++	struct brcms_info *wl = hw->priv;
++	struct scb *scb = &wl->wlc->pri_scb;
++
++	brcms_c_init_scb(scb);
++
++	wl->pub->global_ampdu = &(scb->scb_ampdu);
++	wl->pub->global_ampdu->scb = scb;
++	wl->pub->global_ampdu->max_pdu = 16;
++
++	/*
++	 * minstrel_ht initiates addBA on our behalf by calling
++	 * ieee80211_start_tx_ba_session()
++	 */
++	return 0;
++}
++
++static int
++brcms_ops_ampdu_action(struct ieee80211_hw *hw,
++		    struct ieee80211_vif *vif,
++		    enum ieee80211_ampdu_mlme_action action,
++		    struct ieee80211_sta *sta, u16 tid, u16 *ssn,
++		    u8 buf_size)
++{
++	struct brcms_info *wl = hw->priv;
++	struct scb *scb = &wl->wlc->pri_scb;
++	int status;
++
++	if (WARN_ON(scb->magic != SCB_MAGIC))
++		return -EIDRM;
++	switch (action) {
++	case IEEE80211_AMPDU_RX_START:
++		break;
++	case IEEE80211_AMPDU_RX_STOP:
++		break;
++	case IEEE80211_AMPDU_TX_START:
++		spin_lock_bh(&wl->lock);
++		status = brcms_c_aggregatable(wl->wlc, tid);
++		spin_unlock_bh(&wl->lock);
++		if (!status) {
++			wiphy_err(wl->wiphy, "START: tid %d is not agg\'able\n",
++				  tid);
++			return -EINVAL;
++		}
++		ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
++		break;
++
++	case IEEE80211_AMPDU_TX_STOP:
++		spin_lock_bh(&wl->lock);
++		brcms_c_ampdu_flush(wl->wlc, sta, tid);
++		spin_unlock_bh(&wl->lock);
++		ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
++		break;
++	case IEEE80211_AMPDU_TX_OPERATIONAL:
++		/*
++		 * BA window size from ADDBA response ('buf_size') defines how
++		 * many outstanding MPDUs are allowed for the BA stream by
++		 * recipient and traffic class. 'ampdu_factor' gives maximum
++		 * AMPDU size.
++		 */
++		spin_lock_bh(&wl->lock);
++		brcms_c_ampdu_tx_operational(wl->wlc, tid, buf_size,
++			(1 << (IEEE80211_HT_MAX_AMPDU_FACTOR +
++			 sta->ht_cap.ampdu_factor)) - 1);
++		spin_unlock_bh(&wl->lock);
++		/* Power save wakeup */
++		break;
++	default:
++		wiphy_err(wl->wiphy, "%s: Invalid command, ignoring\n",
++			  __func__);
++	}
++
++	return 0;
++}
++
++static void brcms_ops_rfkill_poll(struct ieee80211_hw *hw)
++{
++	struct brcms_info *wl = hw->priv;
++	bool blocked;
++
++	spin_lock_bh(&wl->lock);
++	blocked = brcms_c_check_radio_disabled(wl->wlc);
++	spin_unlock_bh(&wl->lock);
++
++	wiphy_rfkill_set_hw_state(wl->pub->ieee_hw->wiphy, blocked);
++}
++
++static void brcms_ops_flush(struct ieee80211_hw *hw, bool drop)
++{
++	struct brcms_info *wl = hw->priv;
++
++	no_printk("%s: drop = %s\n", __func__, drop ? "true" : "false");
++
++	/* wait for packet queue and dma fifos to run empty */
++	spin_lock_bh(&wl->lock);
++	brcms_c_wait_for_tx_completion(wl->wlc, drop);
++	spin_unlock_bh(&wl->lock);
++}
++
++static const struct ieee80211_ops brcms_ops = {
++	.tx = brcms_ops_tx,
++	.start = brcms_ops_start,
++	.stop = brcms_ops_stop,
++	.add_interface = brcms_ops_add_interface,
++	.remove_interface = brcms_ops_remove_interface,
++	.config = brcms_ops_config,
++	.bss_info_changed = brcms_ops_bss_info_changed,
++	.configure_filter = brcms_ops_configure_filter,
++	.sw_scan_start = brcms_ops_sw_scan_start,
++	.sw_scan_complete = brcms_ops_sw_scan_complete,
++	.conf_tx = brcms_ops_conf_tx,
++	.sta_add = brcms_ops_sta_add,
++	.ampdu_action = brcms_ops_ampdu_action,
++	.rfkill_poll = brcms_ops_rfkill_poll,
++	.flush = brcms_ops_flush,
++};
++
++/*
++ * is called in brcms_bcma_probe() context, therefore no locking required.
++ */
++static int brcms_set_hint(struct brcms_info *wl, char *abbrev)
++{
++	return regulatory_hint(wl->pub->ieee_hw->wiphy, abbrev);
++}
++
++void brcms_dpc(unsigned long data)
++{
++	struct brcms_info *wl;
++
++	wl = (struct brcms_info *) data;
++
++	spin_lock_bh(&wl->lock);
++
++	/* call the common second level interrupt handler */
++	if (wl->pub->up) {
++		if (wl->resched) {
++			unsigned long flags;
++
++			spin_lock_irqsave(&wl->isr_lock, flags);
++			brcms_c_intrsupd(wl->wlc);
++			spin_unlock_irqrestore(&wl->isr_lock, flags);
++		}
++
++		wl->resched = brcms_c_dpc(wl->wlc, true);
++	}
++
++	/* brcms_c_dpc() may bring the driver down */
++	if (!wl->pub->up)
++		goto done;
++
++	/* re-schedule dpc */
++	if (wl->resched)
++		tasklet_schedule(&wl->tasklet);
++	else
++		/* re-enable interrupts */
++		brcms_intrson(wl);
++
++ done:
++	spin_unlock_bh(&wl->lock);
++}
++
++/*
++ * Precondition: Since this function is called in brcms_pci_probe() context,
++ * no locking is required.
++ */
++static int brcms_request_fw(struct brcms_info *wl, struct bcma_device *pdev)
++{
++	int status;
++	struct device *device = &pdev->dev;
++	char fw_name[100];
++	int i;
++
++	memset(&wl->fw, 0, sizeof(struct brcms_firmware));
++	for (i = 0; i < MAX_FW_IMAGES; i++) {
++		if (brcms_firmwares[i] == NULL)
++			break;
++		sprintf(fw_name, "%s-%d.fw", brcms_firmwares[i],
++			UCODE_LOADER_API_VER);
++		status = request_firmware(&wl->fw.fw_bin[i], fw_name, device);
++		if (status) {
++			wiphy_err(wl->wiphy, "%s: fail to load firmware %s\n",
++				  KBUILD_MODNAME, fw_name);
++			return status;
++		}
++		sprintf(fw_name, "%s_hdr-%d.fw", brcms_firmwares[i],
++			UCODE_LOADER_API_VER);
++		status = request_firmware(&wl->fw.fw_hdr[i], fw_name, device);
++		if (status) {
++			wiphy_err(wl->wiphy, "%s: fail to load firmware %s\n",
++				  KBUILD_MODNAME, fw_name);
++			return status;
++		}
++		wl->fw.hdr_num_entries[i] =
++		    wl->fw.fw_hdr[i]->size / (sizeof(struct firmware_hdr));
++	}
++	wl->fw.fw_cnt = i;
++	return brcms_ucode_data_init(wl, &wl->ucode);
++}
++
++/*
++ * Precondition: Since this function is called in brcms_pci_probe() context,
++ * no locking is required.
++ */
++static void brcms_release_fw(struct brcms_info *wl)
++{
++	int i;
++	for (i = 0; i < MAX_FW_IMAGES; i++) {
++		release_firmware(wl->fw.fw_bin[i]);
++		release_firmware(wl->fw.fw_hdr[i]);
++	}
++}
++
++/**
++ * This function frees the WL per-device resources.
++ *
++ * This function frees resources owned by the WL device pointed to
++ * by the wl parameter.
++ *
++ * precondition: can both be called locked and unlocked
++ *
++ */
++static void brcms_free(struct brcms_info *wl)
++{
++	struct brcms_timer *t, *next;
++
++	/* free ucode data */
++	if (wl->fw.fw_cnt)
++		brcms_ucode_data_free(&wl->ucode);
++	if (wl->irq)
++		free_irq(wl->irq, wl);
++
++	/* kill dpc */
++	tasklet_kill(&wl->tasklet);
++
++	if (wl->pub)
++		brcms_c_module_unregister(wl->pub, "linux", wl);
++
++	/* free common resources */
++	if (wl->wlc) {
++		brcms_c_detach(wl->wlc);
++		wl->wlc = NULL;
++		wl->pub = NULL;
++	}
++
++	/* virtual interface deletion is deferred so we cannot spinwait */
++
++	/* wait for all pending callbacks to complete */
++	while (atomic_read(&wl->callbacks) > 0)
++		schedule();
++
++	/* free timers */
++	for (t = wl->timers; t; t = next) {
++		next = t->next;
++#ifdef DEBUG
++		kfree(t->name);
++#endif
++		kfree(t);
++	}
++}
++
++/*
++* called from both kernel as from this kernel module (error flow on attach)
++* precondition: perimeter lock is not acquired.
++*/
++static void brcms_remove(struct bcma_device *pdev)
++{
++	struct ieee80211_hw *hw = bcma_get_drvdata(pdev);
++	struct brcms_info *wl = hw->priv;
++
++	if (wl->wlc) {
++		wiphy_rfkill_set_hw_state(wl->pub->ieee_hw->wiphy, false);
++		wiphy_rfkill_stop_polling(wl->pub->ieee_hw->wiphy);
++		ieee80211_unregister_hw(hw);
++	}
++
++	brcms_free(wl);
++
++	bcma_set_drvdata(pdev, NULL);
++	ieee80211_free_hw(hw);
++}
++
++static irqreturn_t brcms_isr(int irq, void *dev_id)
++{
++	struct brcms_info *wl;
++	bool ours, wantdpc;
++
++	wl = (struct brcms_info *) dev_id;
++
++	spin_lock(&wl->isr_lock);
++
++	/* call common first level interrupt handler */
++	ours = brcms_c_isr(wl->wlc, &wantdpc);
++	if (ours) {
++		/* if more to do... */
++		if (wantdpc) {
++
++			/* ...and call the second level interrupt handler */
++			/* schedule dpc */
++			tasklet_schedule(&wl->tasklet);
++		}
++	}
++
++	spin_unlock(&wl->isr_lock);
++
++	return IRQ_RETVAL(ours);
++}
++
++/*
++ * is called in brcms_pci_probe() context, therefore no locking required.
++ */
++static int ieee_hw_rate_init(struct ieee80211_hw *hw)
++{
++	struct brcms_info *wl = hw->priv;
++	struct brcms_c_info *wlc = wl->wlc;
++	struct ieee80211_supported_band *band;
++	int has_5g = 0;
++	u16 phy_type;
++
++	hw->wiphy->bands[IEEE80211_BAND_2GHZ] = NULL;
++	hw->wiphy->bands[IEEE80211_BAND_5GHZ] = NULL;
++
++	phy_type = brcms_c_get_phy_type(wl->wlc, 0);
++	if (phy_type == PHY_TYPE_N || phy_type == PHY_TYPE_LCN) {
++		band = &wlc->bandstate[BAND_2G_INDEX]->band;
++		*band = brcms_band_2GHz_nphy_template;
++		if (phy_type == PHY_TYPE_LCN) {
++			/* Single stream */
++			band->ht_cap.mcs.rx_mask[1] = 0;
++			band->ht_cap.mcs.rx_highest = cpu_to_le16(72);
++		}
++		hw->wiphy->bands[IEEE80211_BAND_2GHZ] = band;
++	} else {
++		return -EPERM;
++	}
++
++	/* Assume all bands use the same phy.  True for 11n devices. */
++	if (wl->pub->_nbands > 1) {
++		has_5g++;
++		if (phy_type == PHY_TYPE_N || phy_type == PHY_TYPE_LCN) {
++			band = &wlc->bandstate[BAND_5G_INDEX]->band;
++			*band = brcms_band_5GHz_nphy_template;
++			hw->wiphy->bands[IEEE80211_BAND_5GHZ] = band;
++		} else {
++			return -EPERM;
++		}
++	}
++	return 0;
++}
++
++/*
++ * is called in brcms_pci_probe() context, therefore no locking required.
++ */
++static int ieee_hw_init(struct ieee80211_hw *hw)
++{
++	hw->flags = IEEE80211_HW_SIGNAL_DBM
++	    /* | IEEE80211_HW_CONNECTION_MONITOR  What is this? */
++	    | IEEE80211_HW_REPORTS_TX_ACK_STATUS
++	    | IEEE80211_HW_AMPDU_AGGREGATION;
++
++	hw->extra_tx_headroom = brcms_c_get_header_len();
++	hw->queues = N_TX_QUEUES;
++	hw->max_rates = 2;	/* Primary rate and 1 fallback rate */
++
++	/* channel change time is dependent on chip and band  */
++	hw->channel_change_time = 7 * 1000;
++	hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
++
++	hw->rate_control_algorithm = "minstrel_ht";
++
++	hw->sta_data_size = 0;
++	return ieee_hw_rate_init(hw);
++}
++
++/**
++ * attach to the WL device.
++ *
++ * Attach to the WL device identified by vendor and device parameters.
++ * regs is a host accessible memory address pointing to WL device registers.
++ *
++ * brcms_attach is not defined as static because in the case where no bus
++ * is defined, wl_attach will never be called, and thus, gcc will issue
++ * a warning that this function is defined but not used if we declare
++ * it as static.
++ *
++ *
++ * is called in brcms_bcma_probe() context, therefore no locking required.
++ */
++static struct brcms_info *brcms_attach(struct bcma_device *pdev)
++{
++	struct brcms_info *wl = NULL;
++	int unit, err;
++	struct ieee80211_hw *hw;
++	u8 perm[ETH_ALEN];
++
++	unit = n_adapters_found;
++	err = 0;
++
++	if (unit < 0)
++		return NULL;
++
++	/* allocate private info */
++	hw = bcma_get_drvdata(pdev);
++	if (hw != NULL)
++		wl = hw->priv;
++	if (WARN_ON(hw == NULL) || WARN_ON(wl == NULL))
++		return NULL;
++	wl->wiphy = hw->wiphy;
++
++	atomic_set(&wl->callbacks, 0);
++
++	/* setup the bottom half handler */
++	tasklet_init(&wl->tasklet, brcms_dpc, (unsigned long) wl);
++
++	spin_lock_init(&wl->lock);
++	spin_lock_init(&wl->isr_lock);
++
++	/* prepare ucode */
++	if (brcms_request_fw(wl, pdev) < 0) {
++		wiphy_err(wl->wiphy, "%s: Failed to find firmware usually in "
++			  "%s\n", KBUILD_MODNAME, "/lib/firmware/brcm");
++		brcms_release_fw(wl);
++		brcms_remove(pdev);
++		return NULL;
++	}
++
++	/* common load-time initialization */
++	wl->wlc = brcms_c_attach((void *)wl, pdev, unit, false, &err);
++	brcms_release_fw(wl);
++	if (!wl->wlc) {
++		wiphy_err(wl->wiphy, "%s: attach() failed with code %d\n",
++			  KBUILD_MODNAME, err);
++		goto fail;
++	}
++	wl->pub = brcms_c_pub(wl->wlc);
++
++	wl->pub->ieee_hw = hw;
++
++	/* register our interrupt handler */
++	if (request_irq(pdev->irq, brcms_isr,
++			IRQF_SHARED, KBUILD_MODNAME, wl)) {
++		wiphy_err(wl->wiphy, "wl%d: request_irq() failed\n", unit);
++		goto fail;
++	}
++	wl->irq = pdev->irq;
++
++	/* register module */
++	brcms_c_module_register(wl->pub, "linux", wl, NULL);
++
++	if (ieee_hw_init(hw)) {
++		wiphy_err(wl->wiphy, "wl%d: %s: ieee_hw_init failed!\n", unit,
++			  __func__);
++		goto fail;
++	}
++
++	memcpy(perm, &wl->pub->cur_etheraddr, ETH_ALEN);
++	if (WARN_ON(!is_valid_ether_addr(perm)))
++		goto fail;
++	SET_IEEE80211_PERM_ADDR(hw, perm);
++
++	err = ieee80211_register_hw(hw);
++	if (err)
++		wiphy_err(wl->wiphy, "%s: ieee80211_register_hw failed, status"
++			  "%d\n", __func__, err);
++
++	if (wl->pub->srom_ccode[0] && brcms_set_hint(wl, wl->pub->srom_ccode))
++		wiphy_err(wl->wiphy, "%s: regulatory_hint failed, status %d\n",
++			  __func__, err);
++
++	n_adapters_found++;
++	return wl;
++
++fail:
++	brcms_free(wl);
++	return NULL;
++}
++
++
++
++/**
++ * determines if a device is a WL device, and if so, attaches it.
++ *
++ * This function determines if a device pointed to by pdev is a WL device,
++ * and if so, performs a brcms_attach() on it.
++ *
++ * Perimeter lock is initialized in the course of this function.
++ */
++static int __devinit brcms_bcma_probe(struct bcma_device *pdev)
++{
++	struct brcms_info *wl;
++	struct ieee80211_hw *hw;
++
++	dev_info(&pdev->dev, "mfg %x core %x rev %d class %d irq %d\n",
++		 pdev->id.manuf, pdev->id.id, pdev->id.rev, pdev->id.class,
++		 pdev->irq);
++
++	if ((pdev->id.manuf != BCMA_MANUF_BCM) ||
++	    (pdev->id.id != BCMA_CORE_80211))
++		return -ENODEV;
++
++	hw = ieee80211_alloc_hw(sizeof(struct brcms_info), &brcms_ops);
++	if (!hw) {
++		pr_err("%s: ieee80211_alloc_hw failed\n", __func__);
++		return -ENOMEM;
++	}
++
++	SET_IEEE80211_DEV(hw, &pdev->dev);
++
++	bcma_set_drvdata(pdev, hw);
++
++	memset(hw->priv, 0, sizeof(*wl));
++
++	wl = brcms_attach(pdev);
++	if (!wl) {
++		pr_err("%s: brcms_attach failed!\n", __func__);
++		return -ENODEV;
++	}
++	return 0;
++}
++
++static int brcms_suspend(struct bcma_device *pdev)
++{
++	struct brcms_info *wl;
++	struct ieee80211_hw *hw;
++
++	hw = bcma_get_drvdata(pdev);
++	wl = hw->priv;
++	if (!wl) {
++		pr_err("%s: %s: no driver private struct!\n", KBUILD_MODNAME,
++		       __func__);
++		return -ENODEV;
++	}
++
++	/* only need to flag hw is down for proper resume */
++	spin_lock_bh(&wl->lock);
++	wl->pub->hw_up = false;
++	spin_unlock_bh(&wl->lock);
++
++	pr_debug("brcms_suspend ok\n");
++
++	return 0;
++}
++
++static int brcms_resume(struct bcma_device *pdev)
++{
++	pr_debug("brcms_resume ok\n");
++	return 0;
++}
++
++static struct bcma_driver brcms_bcma_driver = {
++	.name     = KBUILD_MODNAME,
++	.probe    = brcms_bcma_probe,
++	.suspend  = brcms_suspend,
++	.resume   = brcms_resume,
++	.remove   = __devexit_p(brcms_remove),
++	.id_table = brcms_coreid_table,
++};
++
++/**
++ * This is the main entry point for the brcmsmac driver.
++ *
++ * This function is scheduled upon module initialization and
++ * does the driver registration, which result in brcms_bcma_probe()
++ * call resulting in the driver bringup.
++ */
++static void brcms_driver_init(struct work_struct *work)
++{
++	int error;
++
++	error = bcma_driver_register(&brcms_bcma_driver);
++	if (error)
++		pr_err("%s: register returned %d\n", __func__, error);
++}
++
++static DECLARE_WORK(brcms_driver_work, brcms_driver_init);
++
++static int __init brcms_module_init(void)
++{
++#ifdef DEBUG
++	if (msglevel != 0xdeadbeef)
++		brcm_msg_level = msglevel;
++#endif
++	if (!schedule_work(&brcms_driver_work))
++		return -EBUSY;
++
++	return 0;
++}
++
++/**
++ * This function unloads the brcmsmac driver from the system.
++ *
++ * This function unconditionally unloads the brcmsmac driver module from the
++ * system.
++ *
++ */
++static void __exit brcms_module_exit(void)
++{
++	cancel_work_sync(&brcms_driver_work);
++	bcma_driver_unregister(&brcms_bcma_driver);
++}
++
++module_init(brcms_module_init);
++module_exit(brcms_module_exit);
++
++/*
++ * precondition: perimeter lock has been acquired
++ */
++void brcms_txflowcontrol(struct brcms_info *wl, struct brcms_if *wlif,
++			 bool state, int prio)
++{
++	wiphy_err(wl->wiphy, "Shouldn't be here %s\n", __func__);
++}
++
++/*
++ * precondition: perimeter lock has been acquired
++ */
++void brcms_init(struct brcms_info *wl)
++{
++	BCMMSG(wl->pub->ieee_hw->wiphy, "wl%d\n", wl->pub->unit);
++	brcms_reset(wl);
++	brcms_c_init(wl->wlc, wl->mute_tx);
++}
++
++/*
++ * precondition: perimeter lock has been acquired
++ */
++uint brcms_reset(struct brcms_info *wl)
++{
++	BCMMSG(wl->pub->ieee_hw->wiphy, "wl%d\n", wl->pub->unit);
++	brcms_c_reset(wl->wlc);
++
++	/* dpc will not be rescheduled */
++	wl->resched = false;
++
++	return 0;
++}
++
++void brcms_fatal_error(struct brcms_info *wl)
++{
++	wiphy_err(wl->wlc->wiphy, "wl%d: fatal error, reinitializing\n",
++		  wl->wlc->pub->unit);
++	brcms_reset(wl);
++	ieee80211_restart_hw(wl->pub->ieee_hw);
++}
++
++/*
++ * These are interrupt on/off entry points. Disable interrupts
++ * during interrupt state transition.
++ */
++void brcms_intrson(struct brcms_info *wl)
++{
++	unsigned long flags;
++
++	spin_lock_irqsave(&wl->isr_lock, flags);
++	brcms_c_intrson(wl->wlc);
++	spin_unlock_irqrestore(&wl->isr_lock, flags);
++}
++
++u32 brcms_intrsoff(struct brcms_info *wl)
++{
++	unsigned long flags;
++	u32 status;
++
++	spin_lock_irqsave(&wl->isr_lock, flags);
++	status = brcms_c_intrsoff(wl->wlc);
++	spin_unlock_irqrestore(&wl->isr_lock, flags);
++	return status;
++}
++
++void brcms_intrsrestore(struct brcms_info *wl, u32 macintmask)
++{
++	unsigned long flags;
++
++	spin_lock_irqsave(&wl->isr_lock, flags);
++	brcms_c_intrsrestore(wl->wlc, macintmask);
++	spin_unlock_irqrestore(&wl->isr_lock, flags);
++}
++
++/*
++ * precondition: perimeter lock has been acquired
++ */
++int brcms_up(struct brcms_info *wl)
++{
++	int error = 0;
++
++	if (wl->pub->up)
++		return 0;
++
++	error = brcms_c_up(wl->wlc);
++
++	return error;
++}
++
++/*
++ * precondition: perimeter lock has been acquired
++ */
++void brcms_down(struct brcms_info *wl)
++{
++	uint callbacks, ret_val = 0;
++
++	/* call common down function */
++	ret_val = brcms_c_down(wl->wlc);
++	callbacks = atomic_read(&wl->callbacks) - ret_val;
++
++	/* wait for down callbacks to complete */
++	spin_unlock_bh(&wl->lock);
++
++	/* For HIGH_only driver, it's important to actually schedule other work,
++	 * not just spin wait since everything runs at schedule level
++	 */
++	SPINWAIT((atomic_read(&wl->callbacks) > callbacks), 100 * 1000);
++
++	spin_lock_bh(&wl->lock);
++}
++
++/*
++* precondition: perimeter lock is not acquired
++ */
++static void _brcms_timer(struct work_struct *work)
++{
++	struct brcms_timer *t = container_of(work, struct brcms_timer,
++					     dly_wrk.work);
++
++	spin_lock_bh(&t->wl->lock);
++
++	if (t->set) {
++		if (t->periodic) {
++			atomic_inc(&t->wl->callbacks);
++			ieee80211_queue_delayed_work(t->wl->pub->ieee_hw,
++						     &t->dly_wrk,
++						     msecs_to_jiffies(t->ms));
++		} else {
++			t->set = false;
++		}
++
++		t->fn(t->arg);
++	}
++
++	atomic_dec(&t->wl->callbacks);
++
++	spin_unlock_bh(&t->wl->lock);
++}
++
++/*
++ * Adds a timer to the list. Caller supplies a timer function.
++ * Is called from wlc.
++ *
++ * precondition: perimeter lock has been acquired
++ */
++struct brcms_timer *brcms_init_timer(struct brcms_info *wl,
++				     void (*fn) (void *arg),
++				     void *arg, const char *name)
++{
++	struct brcms_timer *t;
++
++	t = kzalloc(sizeof(struct brcms_timer), GFP_ATOMIC);
++	if (!t)
++		return NULL;
++
++	INIT_DELAYED_WORK(&t->dly_wrk, _brcms_timer);
++	t->wl = wl;
++	t->fn = fn;
++	t->arg = arg;
++	t->next = wl->timers;
++	wl->timers = t;
++
++#ifdef DEBUG
++	t->name = kmalloc(strlen(name) + 1, GFP_ATOMIC);
++	if (t->name)
++		strcpy(t->name, name);
++#endif
++
++	return t;
++}
++
++/*
++ * adds only the kernel timer since it's going to be more accurate
++ * as well as it's easier to make it periodic
++ *
++ * precondition: perimeter lock has been acquired
++ */
++void brcms_add_timer(struct brcms_timer *t, uint ms, int periodic)
++{
++	struct ieee80211_hw *hw = t->wl->pub->ieee_hw;
++
++#ifdef DEBUG
++	if (t->set)
++		wiphy_err(hw->wiphy, "%s: Already set. Name: %s, per %d\n",
++			  __func__, t->name, periodic);
++#endif
++	t->ms = ms;
++	t->periodic = (bool) periodic;
++	t->set = true;
++
++	atomic_inc(&t->wl->callbacks);
++
++	ieee80211_queue_delayed_work(hw, &t->dly_wrk, msecs_to_jiffies(ms));
++}
++
++/*
++ * return true if timer successfully deleted, false if still pending
++ *
++ * precondition: perimeter lock has been acquired
++ */
++bool brcms_del_timer(struct brcms_timer *t)
++{
++	if (t->set) {
++		t->set = false;
++		if (!cancel_delayed_work(&t->dly_wrk))
++			return false;
++
++		atomic_dec(&t->wl->callbacks);
++	}
++
++	return true;
++}
++
++/*
++ * precondition: perimeter lock has been acquired
++ */
++void brcms_free_timer(struct brcms_timer *t)
++{
++	struct brcms_info *wl = t->wl;
++	struct brcms_timer *tmp;
++
++	/* delete the timer in case it is active */
++	brcms_del_timer(t);
++
++	if (wl->timers == t) {
++		wl->timers = wl->timers->next;
++#ifdef DEBUG
++		kfree(t->name);
++#endif
++		kfree(t);
++		return;
++
++	}
++
++	tmp = wl->timers;
++	while (tmp) {
++		if (tmp->next == t) {
++			tmp->next = t->next;
++#ifdef DEBUG
++			kfree(t->name);
++#endif
++			kfree(t);
++			return;
++		}
++		tmp = tmp->next;
++	}
++
++}
++
++/*
++ * precondition: perimeter lock has been acquired
++ */
++int brcms_ucode_init_buf(struct brcms_info *wl, void **pbuf, u32 idx)
++{
++	int i, entry;
++	const u8 *pdata;
++	struct firmware_hdr *hdr;
++	for (i = 0; i < wl->fw.fw_cnt; i++) {
++		hdr = (struct firmware_hdr *)wl->fw.fw_hdr[i]->data;
++		for (entry = 0; entry < wl->fw.hdr_num_entries[i];
++		     entry++, hdr++) {
++			u32 len = le32_to_cpu(hdr->len);
++			if (le32_to_cpu(hdr->idx) == idx) {
++				pdata = wl->fw.fw_bin[i]->data +
++					le32_to_cpu(hdr->offset);
++				*pbuf = kmemdup(pdata, len, GFP_ATOMIC);
++				if (*pbuf == NULL)
++					goto fail;
++
++				return 0;
++			}
++		}
++	}
++	wiphy_err(wl->wiphy, "ERROR: ucode buf tag:%d can not be found!\n",
++		  idx);
++	*pbuf = NULL;
++fail:
++	return -ENODATA;
++}
++
++/*
++ * Precondition: Since this function is called in brcms_bcma_probe() context,
++ * no locking is required.
++ */
++int brcms_ucode_init_uint(struct brcms_info *wl, size_t *n_bytes, u32 idx)
++{
++	int i, entry;
++	const u8 *pdata;
++	struct firmware_hdr *hdr;
++	for (i = 0; i < wl->fw.fw_cnt; i++) {
++		hdr = (struct firmware_hdr *)wl->fw.fw_hdr[i]->data;
++		for (entry = 0; entry < wl->fw.hdr_num_entries[i];
++		     entry++, hdr++) {
++			if (le32_to_cpu(hdr->idx) == idx) {
++				pdata = wl->fw.fw_bin[i]->data +
++					le32_to_cpu(hdr->offset);
++				if (le32_to_cpu(hdr->len) != 4) {
++					wiphy_err(wl->wiphy,
++						  "ERROR: fw hdr len\n");
++					return -ENOMSG;
++				}
++				*n_bytes = le32_to_cpu(*((__le32 *) pdata));
++				return 0;
++			}
++		}
++	}
++	wiphy_err(wl->wiphy, "ERROR: ucode tag:%d can not be found!\n", idx);
++	return -ENOMSG;
++}
++
++/*
++ * precondition: can both be called locked and unlocked
++ */
++void brcms_ucode_free_buf(void *p)
++{
++	kfree(p);
++}
++
++/*
++ * checks validity of all firmware images loaded from user space
++ *
++ * Precondition: Since this function is called in brcms_bcma_probe() context,
++ * no locking is required.
++ */
++int brcms_check_firmwares(struct brcms_info *wl)
++{
++	int i;
++	int entry;
++	int rc = 0;
++	const struct firmware *fw;
++	const struct firmware *fw_hdr;
++	struct firmware_hdr *ucode_hdr;
++	for (i = 0; i < MAX_FW_IMAGES && rc == 0; i++) {
++		fw =  wl->fw.fw_bin[i];
++		fw_hdr = wl->fw.fw_hdr[i];
++		if (fw == NULL && fw_hdr == NULL) {
++			break;
++		} else if (fw == NULL || fw_hdr == NULL) {
++			wiphy_err(wl->wiphy, "%s: invalid bin/hdr fw\n",
++				  __func__);
++			rc = -EBADF;
++		} else if (fw_hdr->size % sizeof(struct firmware_hdr)) {
++			wiphy_err(wl->wiphy, "%s: non integral fw hdr file "
++				"size %zu/%zu\n", __func__, fw_hdr->size,
++				sizeof(struct firmware_hdr));
++			rc = -EBADF;
++		} else if (fw->size < MIN_FW_SIZE || fw->size > MAX_FW_SIZE) {
++			wiphy_err(wl->wiphy, "%s: out of bounds fw file size "
++				  "%zu\n", __func__, fw->size);
++			rc = -EBADF;
++		} else {
++			/* check if ucode section overruns firmware image */
++			ucode_hdr = (struct firmware_hdr *)fw_hdr->data;
++			for (entry = 0; entry < wl->fw.hdr_num_entries[i] &&
++			     !rc; entry++, ucode_hdr++) {
++				if (le32_to_cpu(ucode_hdr->offset) +
++				    le32_to_cpu(ucode_hdr->len) >
++				    fw->size) {
++					wiphy_err(wl->wiphy,
++						  "%s: conflicting bin/hdr\n",
++						  __func__);
++					rc = -EBADF;
++				}
++			}
++		}
++	}
++	if (rc == 0 && wl->fw.fw_cnt != i) {
++		wiphy_err(wl->wiphy, "%s: invalid fw_cnt=%d\n", __func__,
++			wl->fw.fw_cnt);
++		rc = -EBADF;
++	}
++	return rc;
++}
++
++/*
++ * precondition: perimeter lock has been acquired
++ */
++bool brcms_rfkill_set_hw_state(struct brcms_info *wl)
++{
++	bool blocked = brcms_c_check_radio_disabled(wl->wlc);
++
++	spin_unlock_bh(&wl->lock);
++	wiphy_rfkill_set_hw_state(wl->pub->ieee_hw->wiphy, blocked);
++	if (blocked)
++		wiphy_rfkill_start_polling(wl->pub->ieee_hw->wiphy);
++	spin_lock_bh(&wl->lock);
++	return blocked;
++}
++
++/*
++ * precondition: perimeter lock has been acquired
++ */
++void brcms_msleep(struct brcms_info *wl, uint ms)
++{
++	spin_unlock_bh(&wl->lock);
++	msleep(ms);
++	spin_lock_bh(&wl->lock);
++}
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
+new file mode 100644
+index 0000000..9358bd5
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
+@@ -0,0 +1,108 @@
++/*
++ * Copyright (c) 2010 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#ifndef _BRCM_MAC80211_IF_H_
++#define _BRCM_MAC80211_IF_H_
++
++#include <linux/timer.h>
++#include <linux/interrupt.h>
++#include <linux/workqueue.h>
++
++#include "ucode_loader.h"
++/*
++ * Starting index for 5G rates in the
++ * legacy rate table.
++ */
++#define BRCMS_LEGACY_5G_RATE_OFFSET	4
++
++/* softmac ioctl definitions */
++#define BRCMS_SET_SHORTSLOT_OVERRIDE		146
++
++struct brcms_timer {
++	struct delayed_work dly_wrk;
++	struct brcms_info *wl;
++	void (*fn) (void *);	/* function called upon expiration */
++	void *arg;		/* fixed argument provided to called function */
++	uint ms;
++	bool periodic;
++	bool set;		/* indicates if timer is active */
++	struct brcms_timer *next;	/* for freeing on unload */
++#ifdef DEBUG
++	char *name;		/* Description of the timer */
++#endif
++};
++
++struct brcms_if {
++	uint subunit;		/* WDS/BSS unit */
++	struct pci_dev *pci_dev;
++};
++
++#define MAX_FW_IMAGES		4
++struct brcms_firmware {
++	u32 fw_cnt;
++	const struct firmware *fw_bin[MAX_FW_IMAGES];
++	const struct firmware *fw_hdr[MAX_FW_IMAGES];
++	u32 hdr_num_entries[MAX_FW_IMAGES];
++};
++
++struct brcms_info {
++	struct brcms_pub *pub;		/* pointer to public wlc state */
++	struct brcms_c_info *wlc;	/* pointer to private common data */
++	u32 magic;
++
++	int irq;
++
++	spinlock_t lock;	/* per-device perimeter lock */
++	spinlock_t isr_lock;	/* per-device ISR synchronization lock */
++
++
++	/* timer related fields */
++	atomic_t callbacks;	/* # outstanding callback functions */
++	struct brcms_timer *timers;	/* timer cleanup queue */
++
++	struct tasklet_struct tasklet;	/* dpc tasklet */
++	bool resched;		/* dpc needs to be and is rescheduled */
++	struct brcms_firmware fw;
++	struct wiphy *wiphy;
++	struct brcms_ucode ucode;
++	bool mute_tx;
++};
++
++/* misc callbacks */
++extern void brcms_init(struct brcms_info *wl);
++extern uint brcms_reset(struct brcms_info *wl);
++extern void brcms_intrson(struct brcms_info *wl);
++extern u32 brcms_intrsoff(struct brcms_info *wl);
++extern void brcms_intrsrestore(struct brcms_info *wl, u32 macintmask);
++extern int brcms_up(struct brcms_info *wl);
++extern void brcms_down(struct brcms_info *wl);
++extern void brcms_txflowcontrol(struct brcms_info *wl, struct brcms_if *wlif,
++				bool state, int prio);
++extern bool brcms_rfkill_set_hw_state(struct brcms_info *wl);
++
++/* timer functions */
++extern struct brcms_timer *brcms_init_timer(struct brcms_info *wl,
++				      void (*fn) (void *arg), void *arg,
++				      const char *name);
++extern void brcms_free_timer(struct brcms_timer *timer);
++extern void brcms_add_timer(struct brcms_timer *timer, uint ms, int periodic);
++extern bool brcms_del_timer(struct brcms_timer *timer);
++extern void brcms_msleep(struct brcms_info *wl, uint ms);
++extern void brcms_dpc(unsigned long data);
++extern void brcms_timer(struct brcms_timer *t);
++extern void brcms_fatal_error(struct brcms_info *wl);
++
++#endif				/* _BRCM_MAC80211_IF_H_ */
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
+new file mode 100644
+index 0000000..d7d4a33
+--- /dev/null
++++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
+@@ -0,0 +1,8495 @@
++/*
++ * Copyright (c) 2010 Broadcom Corporation
++ *
++ * Permission to use, copy, modify, and/or distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
++ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
++ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
++ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
++ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
++ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
++ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
++ */
++
++#undef pr_fmt
++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
++
++#include <linux/printk.h>
++#include <linux/pci_ids.h>
++#include <linux/if_ether.h>
++#include <net/mac80211.h>
++#include <brcm_hw_ids.h>
++#include <aiutils.h>
++#include <chipcommon.h>
++#include "rate.h"
++#include "scb.h"
++#include "phy/phy_hal.h"
++#include "channel.h"
++#include "antsel.h"
++#include "stf.h"
++#include "ampdu.h"
++#include "mac80211_if.h"
++#include "ucode_loader.h"
++#include "main.h"
++#include "soc.h"
++
++/*
++ * Indication for txflowcontrol that all priority bits in
++ * TXQ_STOP_FOR_PRIOFC_MASK are to be considered.
++ */
++#define ALLPRIO				-1
++
++/* watchdog timer, in unit of ms */
++#define TIMER_INTERVAL_WATCHDOG		1000
++/* radio monitor timer, in unit of ms */
++#define TIMER_INTERVAL_RADIOCHK		800
++
++/* beacon interval, in unit of 1024TU */
++#define BEACON_INTERVAL_DEFAULT		100
++
++/* n-mode support capability */
++/* 2x2 includes both 1x1 & 2x2 devices
++ * reserved #define 2 for future when we want to separate 1x1 & 2x2 and
++ * control it independently
++ */
++#define WL_11N_2x2			1
++#define WL_11N_3x3			3
++#define WL_11N_4x4			4
++
++#define EDCF_ACI_MASK			0x60
++#define EDCF_ACI_SHIFT			5
++#define EDCF_ECWMIN_MASK		0x0f
++#define EDCF_ECWMAX_SHIFT		4
++#define EDCF_AIFSN_MASK			0x0f
++#define EDCF_AIFSN_MAX			15
++#define EDCF_ECWMAX_MASK		0xf0
++
++#define EDCF_AC_BE_TXOP_STA		0x0000
++#define EDCF_AC_BK_TXOP_STA		0x0000
++#define EDCF_AC_VO_ACI_STA		0x62
++#define EDCF_AC_VO_ECW_STA		0x32
++#define EDCF_AC_VI_ACI_STA		0x42
++#define EDCF_AC_VI_ECW_STA		0x43
++#define EDCF_AC_BK_ECW_STA		0xA4
++#define EDCF_AC_VI_TXOP_STA		0x005e
++#define EDCF_AC_VO_TXOP_STA		0x002f
++#define EDCF_AC_BE_ACI_STA		0x03
++#define EDCF_AC_BE_ECW_STA		0xA4
++#define EDCF_AC_BK_ACI_STA		0x27
++#define EDCF_AC_VO_TXOP_AP		0x002f
++
++#define EDCF_TXOP2USEC(txop)		((txop) << 5)
++#define EDCF_ECW2CW(exp)		((1 << (exp)) - 1)
++
++#define APHY_SYMBOL_TIME		4
++#define APHY_PREAMBLE_TIME		16
++#define APHY_SIGNAL_TIME		4
++#define APHY_SIFS_TIME			16
++#define APHY_SERVICE_NBITS		16
++#define APHY_TAIL_NBITS			6
++#define BPHY_SIFS_TIME			10
++#define BPHY_PLCP_SHORT_TIME		96
++
++#define PREN_PREAMBLE			24
++#define PREN_MM_EXT			12
++#define PREN_PREAMBLE_EXT		4
++
++#define DOT11_MAC_HDR_LEN		24
++#define DOT11_ACK_LEN			10
++#define DOT11_BA_LEN			4
++#define DOT11_OFDM_SIGNAL_EXTENSION	6
++#define DOT11_MIN_FRAG_LEN		256
++#define DOT11_RTS_LEN			16
++#define DOT11_CTS_LEN			10
++#define DOT11_BA_BITMAP_LEN		128
++#define DOT11_MIN_BEACON_PERIOD		1
++#define DOT11_MAX_BEACON_PERIOD		0xFFFF
++#define DOT11_MAXNUMFRAGS		16
++#define DOT11_MAX_FRAG_LEN		2346
++
++#define BPHY_PLCP_TIME			192
++#define RIFS_11N_TIME			2
++
++/* length of the BCN template area */
++#define BCN_TMPL_LEN			512
++
++/* brcms_bss_info flag bit values */
++#define BRCMS_BSS_HT			0x0020	/* BSS is HT (MIMO) capable */
++
++/* chip rx buffer offset */
++#define BRCMS_HWRXOFF			38
++
++/* rfdisable delay timer 500 ms, runs of ALP clock */
++#define RFDISABLE_DEFAULT		10000000
++
++#define BRCMS_TEMPSENSE_PERIOD		10	/* 10 second timeout */
++
++/* precedences numbers for wlc queues. These are twice as may levels as
++ * 802.1D priorities.
++ * Odd numbers are used for HI priority traffic at same precedence levels
++ * These constants are used ONLY by wlc_prio2prec_map.  Do not use them
++ * elsewhere.
++ */
++#define _BRCMS_PREC_NONE		0	/* None = - */
++#define _BRCMS_PREC_BK			2	/* BK - Background */
++#define _BRCMS_PREC_BE			4	/* BE - Best-effort */
++#define _BRCMS_PREC_EE			6	/* EE - Excellent-effort */
++#define _BRCMS_PREC_CL			8	/* CL - Controlled Load */
++#define _BRCMS_PREC_VI			10	/* Vi - Video */
++#define _BRCMS_PREC_VO			12	/* Vo - Voice */
++#define _BRCMS_PREC_NC			14	/* NC - Network Control */
++
++/* synthpu_dly times in us */
++#define SYNTHPU_DLY_APHY_US		3700
++#define SYNTHPU_DLY_BPHY_US		1050
++#define SYNTHPU_DLY_NPHY_US		2048
++#define SYNTHPU_DLY_LPPHY_US		300
++
++#define ANTCNT				10	/* vanilla M_MAX_ANTCNT val */
++
++/* Per-AC retry limit register definitions; uses defs.h bitfield macros */
++#define EDCF_SHORT_S			0
++#define EDCF_SFB_S			4
++#define EDCF_LONG_S			8
++#define EDCF_LFB_S			12
++#define EDCF_SHORT_M			BITFIELD_MASK(4)
++#define EDCF_SFB_M			BITFIELD_MASK(4)
++#define EDCF_LONG_M			BITFIELD_MASK(4)
++#define EDCF_LFB_M			BITFIELD_MASK(4)
++
++#define RETRY_SHORT_DEF			7	/* Default Short retry Limit */
++#define RETRY_SHORT_MAX			255	/* Maximum Short retry Limit */
++#define RETRY_LONG_DEF			4	/* Default Long retry count */
++#define RETRY_SHORT_FB			3	/* Short count for fb rate */
++#define RETRY_LONG_FB			2	/* Long count for fb rate */
++
++#define APHY_CWMIN			15
++#define PHY_CWMAX			1023
++
++#define EDCF_AIFSN_MIN			1
++
++#define FRAGNUM_MASK			0xF
++
++#define APHY_SLOT_TIME			9
++#define BPHY_SLOT_TIME			20
++
++#define WL_SPURAVOID_OFF		0
++#define WL_SPURAVOID_ON1		1
++#define WL_SPURAVOID_ON2		2
++
++/* invalid core flags, use the saved coreflags */
++#define BRCMS_USE_COREFLAGS		0xffffffff
++
++/* values for PLCPHdr_override */
++#define BRCMS_PLCP_AUTO			-1
++#define BRCMS_PLCP_SHORT		0
++#define BRCMS_PLCP_LONG			1
++
++/* values for g_protection_override and n_protection_override */
++#define BRCMS_PROTECTION_AUTO		-1
++#define BRCMS_PROTECTION_OFF		0
++#define BRCMS_PROTECTION_ON		1
++#define BRCMS_PROTECTION_MMHDR_ONLY	2
++#define BRCMS_PROTECTION_CTS_ONLY	3
++
++/* values for g_protection_control and n_protection_control */
++#define BRCMS_PROTECTION_CTL_OFF	0
++#define BRCMS_PROTECTION_CTL_LOCAL	1
++#define BRCMS_PROTECTION_CTL_OVERLAP	2
++
++/* values for n_protection */
++#define BRCMS_N_PROTECTION_OFF		0
++#define BRCMS_N_PROTECTION_OPTIONAL	1
++#define BRCMS_N_PROTECTION_20IN40	2
++#define BRCMS_N_PROTECTION_MIXEDMODE	3
++
++/* values for band specific 40MHz capabilities */
++#define BRCMS_N_BW_20ALL		0
++#define BRCMS_N_BW_40ALL		1
++#define BRCMS_N_BW_20IN2G_40IN5G	2
++
++/* bitflags for SGI support (sgi_rx iovar) */
++#define BRCMS_N_SGI_20			0x01
++#define BRCMS_N_SGI_40			0x02
++
++/* defines used by the nrate iovar */
++/* MSC in use,indicates b0-6 holds an mcs */
++#define NRATE_MCS_INUSE			0x00000080
++/* rate/mcs value */
++#define NRATE_RATE_MASK			0x0000007f
++/* stf mode mask: siso, cdd, stbc, sdm */
++#define NRATE_STF_MASK			0x0000ff00
++/* stf mode shift */
++#define NRATE_STF_SHIFT			8
++/* bit indicate to override mcs only */
++#define NRATE_OVERRIDE_MCS_ONLY		0x40000000
++#define NRATE_SGI_MASK			0x00800000	/* sgi mode */
++#define NRATE_SGI_SHIFT			23		/* sgi mode */
++#define NRATE_LDPC_CODING		0x00400000	/* adv coding in use */
++#define NRATE_LDPC_SHIFT		22		/* ldpc shift */
++
++#define NRATE_STF_SISO			0		/* stf mode SISO */
++#define NRATE_STF_CDD			1		/* stf mode CDD */
++#define NRATE_STF_STBC			2		/* stf mode STBC */
++#define NRATE_STF_SDM			3		/* stf mode SDM */
++
++#define MAX_DMA_SEGS			4
++
++/* Max # of entries in Tx FIFO based on 4kb page size */
++#define NTXD				256
++/* Max # of entries in Rx FIFO based on 4kb page size */
++#define NRXD				256
++
++/* try to keep this # rbufs posted to the chip */
++#define NRXBUFPOST			32
++
++/* data msg txq hiwat mark */
++#define BRCMS_DATAHIWAT			50
++
++/* max # frames to process in brcms_c_recv() */
++#define RXBND				8
++/* max # tx status to process in wlc_txstatus() */
++#define TXSBND				8
++
++/* brcmu_format_flags() bit description structure */
++struct brcms_c_bit_desc {
++	u32 bit;
++	const char *name;
++};
++
++/*
++ * The following table lists the buffer memory allocated to xmt fifos in HW.
++ * the size is in units of 256bytes(one block), total size is HW dependent
++ * ucode has default fifo partition, sw can overwrite if necessary
++ *
++ * This is documented in twiki under the topic UcodeTxFifo. Please ensure
++ * the twiki is updated before making changes.
++ */
++
++/* Starting corerev for the fifo size table */
++#define XMTFIFOTBL_STARTREV	20
++
++struct d11init {
++	__le16 addr;
++	__le16 size;
++	__le32 value;
++};
++
++struct edcf_acparam {
++	u8 ACI;
++	u8 ECW;
++	u16 TXOP;
++} __packed;
++
++const u8 prio2fifo[NUMPRIO] = {
++	TX_AC_BE_FIFO,		/* 0    BE      AC_BE   Best Effort */
++	TX_AC_BK_FIFO,		/* 1    BK      AC_BK   Background */
++	TX_AC_BK_FIFO,		/* 2    --      AC_BK   Background */
++	TX_AC_BE_FIFO,		/* 3    EE      AC_BE   Best Effort */
++	TX_AC_VI_FIFO,		/* 4    CL      AC_VI   Video */
++	TX_AC_VI_FIFO,		/* 5    VI      AC_VI   Video */
++	TX_AC_VO_FIFO,		/* 6    VO      AC_VO   Voice */
++	TX_AC_VO_FIFO		/* 7    NC      AC_VO   Voice */
++};
++
++/* debug/trace */
++uint brcm_msg_level =
++#if defined(DEBUG)
++	LOG_ERROR_VAL;
++#else
++	0;
++#endif				/* DEBUG */
++
++/* TX FIFO number to WME/802.1E Access Category */
++static const u8 wme_fifo2ac[] = {
++	IEEE80211_AC_BK,
++	IEEE80211_AC_BE,
++	IEEE80211_AC_VI,
++	IEEE80211_AC_VO,
++	IEEE80211_AC_BE,
++	IEEE80211_AC_BE
++};
++
++/* ieee80211 Access Category to TX FIFO number */
++static const u8 wme_ac2fifo[] = {
++	TX_AC_VO_FIFO,
++	TX_AC_VI_FIFO,
++	TX_AC_BE_FIFO,
++	TX_AC_BK_FIFO
++};
++
++/* 802.1D Priority to precedence queue mapping */
++const u8 wlc_prio2prec_map[] = {
++	_BRCMS_PREC_BE,		/* 0 BE - Best-effort */
++	_BRCMS_PREC_BK,		/* 1 BK - Background */
++	_BRCMS_PREC_NONE,		/* 2 None = - */
++	_BRCMS_PREC_EE,		/* 3 EE - Excellent-effort */
++	_BRCMS_PREC_CL,		/* 4 CL - Controlled Load */
++	_BRCMS_PREC_VI,		/* 5 Vi - Video */
++	_BRCMS_PREC_VO,		/* 6 Vo - Voice */
++	_BRCMS_PREC_NC,		/* 7 NC - Network Control */
++};
++
++static const u16 xmtfifo_sz[][NFIFO] = {
++	/* corerev 20: 5120, 49152, 49152, 5376, 4352, 1280 */
++	{20, 192, 192, 21, 17, 5},
++	/* corerev 21: 2304, 14848, 5632, 3584, 3584, 1280 */
++	{9, 58, 22, 14, 14, 5},
++	/* corerev 22: 5120, 49152, 49152, 5376, 4352, 1280 */
++	{20, 192, 192, 21, 17, 5},
++	/* corerev 23: 5120, 49152, 49152, 5376, 4352, 1280 */
++	{20, 192, 192, 21, 17, 5},
++	/* corerev 24: 2304, 14848, 5632, 3584, 3584, 1280 */
++	{9, 58, 22, 14, 14, 5},
++};
++
++#ifdef DEBUG
++static const char * const fifo_names[] = {
++	"AC_BK", "AC_BE", "AC_VI", "AC_VO", "BCMC", "ATIM" };
++#else
++static const char fifo_names[6][0];
++#endif
++
++#ifdef DEBUG
++/* pointer to most recently allocated wl/wlc */
++static struct brcms_c_info *wlc_info_dbg = (struct brcms_c_info *) (NULL);
++#endif
++
++/* Find basic rate for a given rate */
++static u8 brcms_basic_rate(struct brcms_c_info *wlc, u32 rspec)
++{
++	if (is_mcs_rate(rspec))
++		return wlc->band->basic_rate[mcs_table[rspec & RSPEC_RATE_MASK]
++		       .leg_ofdm];
++	return wlc->band->basic_rate[rspec & RSPEC_RATE_MASK];
++}
++
++static u16 frametype(u32 rspec, u8 mimoframe)
++{
++	if (is_mcs_rate(rspec))
++		return mimoframe;
++	return is_cck_rate(rspec) ? FT_CCK : FT_OFDM;
++}
++
++/* currently the best mechanism for determining SIFS is the band in use */
++static u16 get_sifs(struct brcms_band *band)
++{
++	return band->bandtype == BRCM_BAND_5G ? APHY_SIFS_TIME :
++				 BPHY_SIFS_TIME;
++}
++
++/*
++ * Detect Card removed.
++ * Even checking an sbconfig register read will not false trigger when the core
++ * is in reset it breaks CF address mechanism. Accessing gphy phyversion will
++ * cause SB error if aphy is in reset on 4306B0-DB. Need a simple accessible
++ * reg with fixed 0/1 pattern (some platforms return all 0).
++ * If clocks are present, call the sb routine which will figure out if the
++ * device is removed.
++ */
++static bool brcms_deviceremoved(struct brcms_c_info *wlc)
++{
++	u32 macctrl;
++
++	if (!wlc->hw->clk)
++		return ai_deviceremoved(wlc->hw->sih);
++	macctrl = bcma_read32(wlc->hw->d11core,
++			      D11REGOFFS(maccontrol));
++	return (macctrl & (MCTL_PSM_JMP_0 | MCTL_IHR_EN)) != MCTL_IHR_EN;
++}
++
++/* sum the individual fifo tx pending packet counts */
++static s16 brcms_txpktpendtot(struct brcms_c_info *wlc)
++{
++	return wlc->core->txpktpend[0] + wlc->core->txpktpend[1] +
++	       wlc->core->txpktpend[2] + wlc->core->txpktpend[3];
++}
++
++static bool brcms_is_mband_unlocked(struct brcms_c_info *wlc)
++{
++	return wlc->pub->_nbands > 1 && !wlc->bandlocked;
++}
++
++static int brcms_chspec_bw(u16 chanspec)
++{
++	if (CHSPEC_IS40(chanspec))
++		return BRCMS_40_MHZ;
++	if (CHSPEC_IS20(chanspec))
++		return BRCMS_20_MHZ;
++
++	return BRCMS_10_MHZ;
++}
++
++static void brcms_c_bsscfg_mfree(struct brcms_bss_cfg *cfg)
++{
++	if (cfg == NULL)
++		return;
++
++	kfree(cfg->current_bss);
++	kfree(cfg);
++}
++
++static void brcms_c_detach_mfree(struct brcms_c_info *wlc)
++{
++	if (wlc == NULL)
++		return;
++
++	brcms_c_bsscfg_mfree(wlc->bsscfg);
++	kfree(wlc->pub);
++	kfree(wlc->modulecb);
++	kfree(wlc->default_bss);
++	kfree(wlc->protection);
++	kfree(wlc->stf);
++	kfree(wlc->bandstate[0]);
++	kfree(wlc->corestate->macstat_snapshot);
++	kfree(wlc->corestate);
++	kfree(wlc->hw->bandstate[0]);
++	kfree(wlc->hw);
++
++	/* free the wlc */
++	kfree(wlc);
++	wlc = NULL;
++}
++
++static struct brcms_bss_cfg *brcms_c_bsscfg_malloc(uint unit)
++{
++	struct brcms_bss_cfg *cfg;
++
++	cfg = kzalloc(sizeof(struct brcms_bss_cfg), GFP_ATOMIC);
++	if (cfg == NULL)
++		goto fail;
++
++	cfg->current_bss = kzalloc(sizeof(struct brcms_bss_info), GFP_ATOMIC);
++	if (cfg->current_bss == NULL)
++		goto fail;
++
++	return cfg;
++
++ fail:
++	brcms_c_bsscfg_mfree(cfg);
++	return NULL;
++}
++
++static struct brcms_c_info *
++brcms_c_attach_malloc(uint unit, uint *err, uint devid)
++{
++	struct brcms_c_info *wlc;
++
++	wlc = kzalloc(sizeof(struct brcms_c_info), GFP_ATOMIC);
++	if (wlc == NULL) {
++		*err = 1002;
++		goto fail;
++	}
++
++	/* allocate struct brcms_c_pub state structure */
++	wlc->pub = kzalloc(sizeof(struct brcms_pub), GFP_ATOMIC);
++	if (wlc->pub == NULL) {
++		*err = 1003;
++		goto fail;
++	}
++	wlc->pub->wlc = wlc;
++
++	/* allocate struct brcms_hardware state structure */
++
++	wlc->hw = kzalloc(sizeof(struct brcms_hardware), GFP_ATOMIC);
++	if (wlc->hw == NULL) {
++		*err = 1005;
++		goto fail;
++	}
++	wlc->hw->wlc = wlc;
++
++	wlc->hw->bandstate[0] =
++		kzalloc(sizeof(struct brcms_hw_band) * MAXBANDS, GFP_ATOMIC);
++	if (wlc->hw->bandstate[0] == NULL) {
++		*err = 1006;
++		goto fail;
++	} else {
++		int i;
++
++		for (i = 1; i < MAXBANDS; i++)
++			wlc->hw->bandstate[i] = (struct brcms_hw_band *)
++			    ((unsigned long)wlc->hw->bandstate[0] +
++			     (sizeof(struct brcms_hw_band) * i));
++	}
++
++	wlc->modulecb =
++		kzalloc(sizeof(struct modulecb) * BRCMS_MAXMODULES, GFP_ATOMIC);
++	if (wlc->modulecb == NULL) {
++		*err = 1009;
++		goto fail;
++	}
++
++	wlc->default_bss = kzalloc(sizeof(struct brcms_bss_info), GFP_ATOMIC);
++	if (wlc->default_bss == NULL) {
++		*err = 1010;
++		goto fail;
++	}
++
++	wlc->bsscfg = brcms_c_bsscfg_malloc(unit);
++	if (wlc->bsscfg == NULL) {
++		*err = 1011;
++		goto fail;
++	}
++
++	wlc->protection = kzalloc(sizeof(struct brcms_protection),
++				  GFP_ATOMIC);
++	if (wlc->protection == NULL) {
++		*err = 1016;
++		goto fail;
++	}
++
++	wlc->stf = kzalloc(sizeof(struct brcms_stf), GFP_ATOMIC);
++	if (wlc->stf == NULL) {
++		*err = 1017;
++		goto fail;
++	}
++
++	wlc->bandstate[0] =
++		kzalloc(sizeof(struct brcms_band)*MAXBANDS, GFP_ATOMIC);
++	if (wlc->bandstate[0] == NULL) {
++		*err = 1025;
++		goto fail;
++	} else {
++		int i;
++
++		for (i = 1; i < MAXBANDS; i++)
++			wlc->bandstate[i] = (struct brcms_band *)
++				((unsigned long)wlc->bandstate[0]
++				+ (sizeof(struct brcms_band)*i));
++	}
++
++	wlc->corestate = kzalloc(sizeof(struct brcms_core), GFP_ATOMIC);
++	if (wlc->corestate == NULL) {
++		*err = 1026;
++		goto fail;
++	}
++
++	wlc->corestate->macstat_snapshot =
++		kzalloc(sizeof(struct macstat), GFP_ATOMIC);
++	if (wlc->corestate->macstat_snapshot == NULL) {
++		*err = 1027;
++		goto fail;
++	}
++
++	return wlc;
++
++ fail:
++	brcms_c_detach_mfree(wlc);
++	return NULL;
++}
++
++/*
++ * Update the slot timing for standard 11b/g (20us slots)
++ * or shortslot 11g (9us slots)
++ * The PSM needs to be suspended for this call.
++ */
++static void brcms_b_update_slot_timing(struct brcms_hardware *wlc_hw,
++					bool shortslot)
++{
++	struct bcma_device *core = wlc_hw->d11core;
++
++	if (shortslot) {
++		/* 11g short slot: 11a timing */
++		bcma_write16(core, D11REGOFFS(ifs_slot), 0x0207);
++		brcms_b_write_shm(wlc_hw, M_DOT11_SLOT, APHY_SLOT_TIME);
++	} else {
++		/* 11g long slot: 11b timing */
++		bcma_write16(core, D11REGOFFS(ifs_slot), 0x0212);
++		brcms_b_write_shm(wlc_hw, M_DOT11_SLOT, BPHY_SLOT_TIME);
++	}
++}
++
++/*
++ * calculate frame duration of a given rate and length, return
++ * time in usec unit
++ */
++static uint brcms_c_calc_frame_time(struct brcms_c_info *wlc, u32 ratespec,
++				    u8 preamble_type, uint mac_len)
++{
++	uint nsyms, dur = 0, Ndps, kNdps;
++	uint rate = rspec2rate(ratespec);
++
++	if (rate == 0) {
++		wiphy_err(wlc->wiphy, "wl%d: WAR: using rate of 1 mbps\n",
++			  wlc->pub->unit);
++		rate = BRCM_RATE_1M;
++	}
++
++	BCMMSG(wlc->wiphy, "wl%d: rspec 0x%x, preamble_type %d, len%d\n",
++		 wlc->pub->unit, ratespec, preamble_type, mac_len);
++
++	if (is_mcs_rate(ratespec)) {
++		uint mcs = ratespec & RSPEC_RATE_MASK;
++		int tot_streams = mcs_2_txstreams(mcs) + rspec_stc(ratespec);
++
++		dur = PREN_PREAMBLE + (tot_streams * PREN_PREAMBLE_EXT);
++		if (preamble_type == BRCMS_MM_PREAMBLE)
++			dur += PREN_MM_EXT;
++		/* 1000Ndbps = kbps * 4 */
++		kNdps = mcs_2_rate(mcs, rspec_is40mhz(ratespec),
++				   rspec_issgi(ratespec)) * 4;
++
++		if (rspec_stc(ratespec) == 0)
++			nsyms =
++			    CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
++				  APHY_TAIL_NBITS) * 1000, kNdps);
++		else
++			/* STBC needs to have even number of symbols */
++			nsyms =
++			    2 *
++			    CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
++				  APHY_TAIL_NBITS) * 1000, 2 * kNdps);
++
++		dur += APHY_SYMBOL_TIME * nsyms;
++		if (wlc->band->bandtype == BRCM_BAND_2G)
++			dur += DOT11_OFDM_SIGNAL_EXTENSION;
++	} else if (is_ofdm_rate(rate)) {
++		dur = APHY_PREAMBLE_TIME;
++		dur += APHY_SIGNAL_TIME;
++		/* Ndbps = Mbps * 4 = rate(500Kbps) * 2 */
++		Ndps = rate * 2;
++		/* NSyms = CEILING((SERVICE + 8*NBytes + TAIL) / Ndbps) */
++		nsyms =
++		    CEIL((APHY_SERVICE_NBITS + 8 * mac_len + APHY_TAIL_NBITS),
++			 Ndps);
++		dur += APHY_SYMBOL_TIME * nsyms;
++		if (wlc->band->bandtype == BRCM_BAND_2G)
++			dur += DOT11_OFDM_SIGNAL_EXTENSION;
++	} else {
++		/*
++		 * calc # bits * 2 so factor of 2 in rate (1/2 mbps)
++		 * will divide out
++		 */
++		mac_len = mac_len * 8 * 2;
++		/* calc ceiling of bits/rate = microseconds of air time */
++		dur = (mac_len + rate - 1) / rate;
++		if (preamble_type & BRCMS_SHORT_PREAMBLE)
++			dur += BPHY_PLCP_SHORT_TIME;
++		else
++			dur += BPHY_PLCP_TIME;
++	}
++	return dur;
++}
++
++static void brcms_c_write_inits(struct brcms_hardware *wlc_hw,
++				const struct d11init *inits)
++{
++	struct bcma_device *core = wlc_hw->d11core;
++	int i;
++	uint offset;
++	u16 size;
++	u32 value;
++
++	BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
++
++	for (i = 0; inits[i].addr != cpu_to_le16(0xffff); i++) {
++		size = le16_to_cpu(inits[i].size);
++		offset = le16_to_cpu(inits[i].addr);
++		value = le32_to_cpu(inits[i].value);
++		if (size == 2)
++			bcma_write16(core, offset, value);
++		else if (size == 4)
++			bcma_write32(core, offset, value);
++		else
++			break;
++	}
++}
++
++static void brcms_c_write_mhf(struct brcms_hardware *wlc_hw, u16 *mhfs)
++{
++	u8 idx;
++	u16 addr[] = {
++		M_HOST_FLAGS1, M_HOST_FLAGS2, M_HOST_FLAGS3, M_HOST_FLAGS4,
++		M_HOST_FLAGS5
++	};
++
++	for (idx = 0; idx < MHFMAX; idx++)
++		brcms_b_write_shm(wlc_hw, addr[idx], mhfs[idx]);
++}
++
++static void brcms_c_ucode_bsinit(struct brcms_hardware *wlc_hw)
++{
++	struct wiphy *wiphy = wlc_hw->wlc->wiphy;
++	struct brcms_ucode *ucode = &wlc_hw->wlc->wl->ucode;
++
++	/* init microcode host flags */
++	brcms_c_write_mhf(wlc_hw, wlc_hw->band->mhfs);
++
++	/* do band-specific ucode IHR, SHM, and SCR inits */
++	if (D11REV_IS(wlc_hw->corerev, 23)) {
++		if (BRCMS_ISNPHY(wlc_hw->band))
++			brcms_c_write_inits(wlc_hw, ucode->d11n0bsinitvals16);
++		else
++			wiphy_err(wiphy, "%s: wl%d: unsupported phy in corerev"
++				  " %d\n", __func__, wlc_hw->unit,
++				  wlc_hw->corerev);
++	} else {
++		if (D11REV_IS(wlc_hw->corerev, 24)) {
++			if (BRCMS_ISLCNPHY(wlc_hw->band))
++				brcms_c_write_inits(wlc_hw,
++						    ucode->d11lcn0bsinitvals24);
++			else
++				wiphy_err(wiphy, "%s: wl%d: unsupported phy in"
++					  " core rev %d\n", __func__,
++					  wlc_hw->unit, wlc_hw->corerev);
++		} else {
++			wiphy_err(wiphy, "%s: wl%d: unsupported corerev %d\n",
++				__func__, wlc_hw->unit, wlc_hw->corerev);
++		}
++	}
++}
++
++static void brcms_b_core_ioctl(struct brcms_hardware *wlc_hw, u32 m, u32 v)
++{
++	struct bcma_device *core = wlc_hw->d11core;
++	u32 ioctl = bcma_aread32(core, BCMA_IOCTL) & ~m;
++
++	bcma_awrite32(core, BCMA_IOCTL, ioctl | v);
++}
++
++static void brcms_b_core_phy_clk(struct brcms_hardware *wlc_hw, bool clk)
++{
++	BCMMSG(wlc_hw->wlc->wiphy, "wl%d: clk %d\n", wlc_hw->unit, clk);
++
++	wlc_hw->phyclk = clk;
++
++	if (OFF == clk) {	/* clear gmode bit, put phy into reset */
++
++		brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_FGC | SICF_GMODE),
++				   (SICF_PRST | SICF_FGC));
++		udelay(1);
++		brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_FGC), SICF_PRST);
++		udelay(1);
++
++	} else {		/* take phy out of reset */
++
++		brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_FGC), SICF_FGC);
++		udelay(1);
++		brcms_b_core_ioctl(wlc_hw, SICF_FGC, 0);
++		udelay(1);
++
++	}
++}
++
++/* low-level band switch utility routine */
++static void brcms_c_setxband(struct brcms_hardware *wlc_hw, uint bandunit)
++{
++	BCMMSG(wlc_hw->wlc->wiphy, "wl%d: bandunit %d\n", wlc_hw->unit,
++		bandunit);
++
++	wlc_hw->band = wlc_hw->bandstate[bandunit];
++
++	/*
++	 * BMAC_NOTE:
++	 *   until we eliminate need for wlc->band refs in low level code
++	 */
++	wlc_hw->wlc->band = wlc_hw->wlc->bandstate[bandunit];
++
++	/* set gmode core flag */
++	if (wlc_hw->sbclk && !wlc_hw->noreset) {
++		u32 gmode = 0;
++
++		if (bandunit == 0)
++			gmode = SICF_GMODE;
++
++		brcms_b_core_ioctl(wlc_hw, SICF_GMODE, gmode);
++	}
++}
++
++/* switch to new band but leave it inactive */
++static u32 brcms_c_setband_inact(struct brcms_c_info *wlc, uint bandunit)
++{
++	struct brcms_hardware *wlc_hw = wlc->hw;
++	u32 macintmask;
++	u32 macctrl;
++
++	BCMMSG(wlc->wiphy, "wl%d\n", wlc_hw->unit);
++	macctrl = bcma_read32(wlc_hw->d11core,
++			      D11REGOFFS(maccontrol));
++	WARN_ON((macctrl & MCTL_EN_MAC) != 0);
++
++	/* disable interrupts */
++	macintmask = brcms_intrsoff(wlc->wl);
++
++	/* radio off */
++	wlc_phy_switch_radio(wlc_hw->band->pi, OFF);
++
++	brcms_b_core_phy_clk(wlc_hw, OFF);
++
++	brcms_c_setxband(wlc_hw, bandunit);
++
++	return macintmask;
++}
++
++/* process an individual struct tx_status */
++static bool
++brcms_c_dotxstatus(struct brcms_c_info *wlc, struct tx_status *txs)
++{
++	struct sk_buff *p;
++	uint queue;
++	struct d11txh *txh;
++	struct scb *scb = NULL;
++	bool free_pdu;
++	int tx_rts, tx_frame_count, tx_rts_count;
++	uint totlen, supr_status;
++	bool lastframe;
++	struct ieee80211_hdr *h;
++	u16 mcl;
++	struct ieee80211_tx_info *tx_info;
++	struct ieee80211_tx_rate *txrate;
++	int i;
++
++	/* discard intermediate indications for ucode with one legitimate case:
++	 *   e.g. if "useRTS" is set. ucode did a successful rts/cts exchange,
++	 *   but the subsequent tx of DATA failed. so it will start rts/cts
++	 *   from the beginning (resetting the rts transmission count)
++	 */
++	if (!(txs->status & TX_STATUS_AMPDU)
++	    && (txs->status & TX_STATUS_INTERMEDIATE)) {
++		BCMMSG(wlc->wiphy, "INTERMEDIATE but not AMPDU\n");
++		return false;
++	}
++
++	queue = txs->frameid & TXFID_QUEUE_MASK;
++	if (queue >= NFIFO) {
++		p = NULL;
++		goto fatal;
++	}
++
++	p = dma_getnexttxp(wlc->hw->di[queue], DMA_RANGE_TRANSMITTED);
++	if (p == NULL)
++		goto fatal;
++
++	txh = (struct d11txh *) (p->data);
++	mcl = le16_to_cpu(txh->MacTxControlLow);
++
++	if (txs->phyerr) {
++		if (brcm_msg_level & LOG_ERROR_VAL) {
++			wiphy_err(wlc->wiphy, "phyerr 0x%x, rate 0x%x\n",
++				  txs->phyerr, txh->MainRates);
++			brcms_c_print_txdesc(txh);
++		}
++		brcms_c_print_txstatus(txs);
++	}
++
++	if (txs->frameid != le16_to_cpu(txh->TxFrameID))
++		goto fatal;
++	tx_info = IEEE80211_SKB_CB(p);
++	h = (struct ieee80211_hdr *)((u8 *) (txh + 1) + D11_PHY_HDR_LEN);
++
++	if (tx_info->control.sta)
++		scb = &wlc->pri_scb;
++
++	if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
++		brcms_c_ampdu_dotxstatus(wlc->ampdu, scb, p, txs);
++		return false;
++	}
++
++	supr_status = txs->status & TX_STATUS_SUPR_MASK;
++	if (supr_status == TX_STATUS_SUPR_BADCH)
++		BCMMSG(wlc->wiphy,
++		       "%s: Pkt tx suppressed, possibly channel %d\n",
++		       __func__, CHSPEC_CHANNEL(wlc->default_bss->chanspec));
++
++	tx_rts = le16_to_cpu(txh->MacTxControlLow) & TXC_SENDRTS;
++	tx_frame_count =
++	    (txs->status & TX_STATUS_FRM_RTX_MASK) >> TX_STATUS_FRM_RTX_SHIFT;
++	tx_rts_count =
++	    (txs->status & TX_STATUS_RTS_RTX_MASK) >> TX_STATUS_RTS_RTX_SHIFT;
++
++	lastframe = !ieee80211_has_morefrags(h->frame_control);
++
++	if (!lastframe) {
++		wiphy_err(wlc->wiphy, "Not last frame!\n");
++	} else {
++		/*
++		 * Set information to be consumed by Minstrel ht.
++		 *
++		 * The "fallback limit" is the number of tx attempts a given
++		 * MPDU is sent at the "primary" rate. Tx attempts beyond that
++		 * limit are sent at the "secondary" rate.
++		 * A 'short frame' does not exceed RTS treshold.
++		 */
++		u16 sfbl,	/* Short Frame Rate Fallback Limit */
++		    lfbl,	/* Long Frame Rate Fallback Limit */
++		    fbl;
++
++		if (queue < IEEE80211_NUM_ACS) {
++			sfbl = GFIELD(wlc->wme_retries[wme_fifo2ac[queue]],
++				      EDCF_SFB);
++			lfbl = GFIELD(wlc->wme_retries[wme_fifo2ac[queue]],
++				      EDCF_LFB);
++		} else {
++			sfbl = wlc->SFBL;
++			lfbl = wlc->LFBL;
++		}
++
++		txrate = tx_info->status.rates;
++		if (txrate[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
++			fbl = lfbl;
++		else
++			fbl = sfbl;
++
++		ieee80211_tx_info_clear_status(tx_info);
++
++		if ((tx_frame_count > fbl) && (txrate[1].idx >= 0)) {
++			/*
++			 * rate selection requested a fallback rate
++			 * and we used it
++			 */
++			txrate[0].count = fbl;
++			txrate[1].count = tx_frame_count - fbl;
++		} else {
++			/*
++			 * rate selection did not request fallback rate, or
++			 * we didn't need it
++			 */
++			txrate[0].count = tx_frame_count;
++			/*
++			 * rc80211_minstrel.c:minstrel_tx_status() expects
++			 * unused rates to be marked with idx = -1
++			 */
++			txrate[1].idx = -1;
++			txrate[1].count = 0;
++		}
++
++		/* clear the rest of the rates */
++		for (i = 2; i < IEEE80211_TX_MAX_RATES; i++) {
++			txrate[i].idx = -1;
++			txrate[i].count = 0;
++		}
++
++		if (txs->status & TX_STATUS_ACK_RCV)
++			tx_info->flags |= IEEE80211_TX_STAT_ACK;
++	}
++
++	totlen = p->len;
++	free_pdu = true;
++
++	brcms_c_txfifo_complete(wlc, queue, 1);
++
++	if (lastframe) {
++		/* remove PLCP & Broadcom tx descriptor header */
++		skb_pull(p, D11_PHY_HDR_LEN);
++		skb_pull(p, D11_TXH_LEN);
++		ieee80211_tx_status_irqsafe(wlc->pub->ieee_hw, p);
++	} else {
++		wiphy_err(wlc->wiphy, "%s: Not last frame => not calling "
++			  "tx_status\n", __func__);
++	}
++
++	return false;
++
++ fatal:
++	if (p)
++		brcmu_pkt_buf_free_skb(p);
++
++	return true;
++
++}
++
++/* process tx completion events in BMAC
++ * Return true if more tx status need to be processed. false otherwise.
++ */
++static bool
++brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
++{
++	bool morepending = false;
++	struct brcms_c_info *wlc = wlc_hw->wlc;
++	struct bcma_device *core;
++	struct tx_status txstatus, *txs;
++	u32 s1, s2;
++	uint n = 0;
++	/*
++	 * Param 'max_tx_num' indicates max. # tx status to process before
++	 * break out.
++	 */
++	uint max_tx_num = bound ? TXSBND : -1;
++
++	BCMMSG(wlc->wiphy, "wl%d\n", wlc_hw->unit);
++
++	txs = &txstatus;
++	core = wlc_hw->d11core;
++	*fatal = false;
++	s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
++	while (!(*fatal)
++	       && (s1 & TXS_V)) {
++
++		if (s1 == 0xffffffff) {
++			wiphy_err(wlc->wiphy, "wl%d: %s: dead chip\n",
++				wlc_hw->unit, __func__);
++			return morepending;
++		}
++		s2 = bcma_read32(core, D11REGOFFS(frmtxstatus2));
++
++		txs->status = s1 & TXS_STATUS_MASK;
++		txs->frameid = (s1 & TXS_FID_MASK) >> TXS_FID_SHIFT;
++		txs->sequence = s2 & TXS_SEQ_MASK;
++		txs->phyerr = (s2 & TXS_PTX_MASK) >> TXS_PTX_SHIFT;
++		txs->lasttxtime = 0;
++
++		*fatal = brcms_c_dotxstatus(wlc_hw->wlc, txs);
++
++		/* !give others some time to run! */
++		if (++n >= max_tx_num)
++			break;
++		s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
++	}
++
++	if (*fatal)
++		return 0;
++
++	if (n >= max_tx_num)
++		morepending = true;
++
++	if (!pktq_empty(&wlc->pkt_queue->q))
++		brcms_c_send_q(wlc);
++
++	return morepending;
++}
++
++static void brcms_c_tbtt(struct brcms_c_info *wlc)
++{
++	if (!wlc->bsscfg->BSS)
++		/*
++		 * DirFrmQ is now valid...defer setting until end
++		 * of ATIM window
++		 */
++		wlc->qvalid |= MCMD_DIRFRMQVAL;
++}
++
++/* set initial host flags value */
++static void
++brcms_c_mhfdef(struct brcms_c_info *wlc, u16 *mhfs, u16 mhf2_init)
++{
++	struct brcms_hardware *wlc_hw = wlc->hw;
++
++	memset(mhfs, 0, MHFMAX * sizeof(u16));
++
++	mhfs[MHF2] |= mhf2_init;
++
++	/* prohibit use of slowclock on multifunction boards */
++	if (wlc_hw->boardflags & BFL_NOPLLDOWN)
++		mhfs[MHF1] |= MHF1_FORCEFASTCLK;
++
++	if (BRCMS_ISNPHY(wlc_hw->band) && NREV_LT(wlc_hw->band->phyrev, 2)) {
++		mhfs[MHF2] |= MHF2_NPHY40MHZ_WAR;
++		mhfs[MHF1] |= MHF1_IQSWAP_WAR;
++	}
++}
++
++static uint
++dmareg(uint direction, uint fifonum)
++{
++	if (direction == DMA_TX)
++		return offsetof(struct d11regs, fifo64regs[fifonum].dmaxmt);
++	return offsetof(struct d11regs, fifo64regs[fifonum].dmarcv);
++}
++
++static bool brcms_b_attach_dmapio(struct brcms_c_info *wlc, uint j, bool wme)
++{
++	uint i;
++	char name[8];
++	/*
++	 * ucode host flag 2 needed for pio mode, independent of band and fifo
++	 */
++	u16 pio_mhf2 = 0;
++	struct brcms_hardware *wlc_hw = wlc->hw;
++	uint unit = wlc_hw->unit;
++	struct wiphy *wiphy = wlc->wiphy;
++
++	/* name and offsets for dma_attach */
++	snprintf(name, sizeof(name), "wl%d", unit);
++
++	if (wlc_hw->di[0] == NULL) {	/* Init FIFOs */
++		int dma_attach_err = 0;
++
++		/*
++		 * FIFO 0
++		 * TX: TX_AC_BK_FIFO (TX AC Background data packets)
++		 * RX: RX_FIFO (RX data packets)
++		 */
++		wlc_hw->di[0] = dma_attach(name, wlc_hw->sih, wlc_hw->d11core,
++					   (wme ? dmareg(DMA_TX, 0) : 0),
++					   dmareg(DMA_RX, 0),
++					   (wme ? NTXD : 0), NRXD,
++					   RXBUFSZ, -1, NRXBUFPOST,
++					   BRCMS_HWRXOFF, &brcm_msg_level);
++		dma_attach_err |= (NULL == wlc_hw->di[0]);
++
++		/*
++		 * FIFO 1
++		 * TX: TX_AC_BE_FIFO (TX AC Best-Effort data packets)
++		 *   (legacy) TX_DATA_FIFO (TX data packets)
++		 * RX: UNUSED
++		 */
++		wlc_hw->di[1] = dma_attach(name, wlc_hw->sih, wlc_hw->d11core,
++					   dmareg(DMA_TX, 1), 0,
++					   NTXD, 0, 0, -1, 0, 0,
++					   &brcm_msg_level);
++		dma_attach_err |= (NULL == wlc_hw->di[1]);
++
++		/*
++		 * FIFO 2
++		 * TX: TX_AC_VI_FIFO (TX AC Video data packets)
++		 * RX: UNUSED
++		 */
++		wlc_hw->di[2] = dma_attach(name, wlc_hw->sih, wlc_hw->d11core,
++					   dmareg(DMA_TX, 2), 0,
++					   NTXD, 0, 0, -1, 0, 0,
++					   &brcm_msg_level);
++		dma_attach_err |= (NULL == wlc_hw->di[2]);
++		/*
++		 * FIFO 3
++		 * TX: TX_AC_VO_FIFO (TX AC Voice data packets)
++		 *   (legacy) TX_CTL_FIFO (TX control & mgmt packets)
++		 */
++		wlc_hw->di[3] = dma_attach(name, wlc_hw->sih, wlc_hw->d11core,
++					   dmareg(DMA_TX, 3),
++					   0, NTXD, 0, 0, -1,
++					   0, 0, &brcm_msg_level);
++		dma_attach_err |= (NULL == wlc_hw->di[3]);
++/* Cleaner to leave this as if with AP defined */
++
++		if (dma_attach_err) {
++			wiphy_err(wiphy, "wl%d: wlc_attach: dma_attach failed"
++				  "\n", unit);
++			return false;
++		}
++
++		/* get pointer to dma engine tx flow control variable */
++		for (i = 0; i < NFIFO; i++)
++			if (wlc_hw->di[i])
++				wlc_hw->txavail[i] =
++				    (uint *) dma_getvar(wlc_hw->di[i],
++							"&txavail");
++	}
++
++	/* initial ucode host flags */
++	brcms_c_mhfdef(wlc, wlc_hw->band->mhfs, pio_mhf2);
++
++	return true;
++}
++
++static void brcms_b_detach_dmapio(struct brcms_hardware *wlc_hw)
++{
++	uint j;
++
++	for (j = 0; j < NFIFO; j++) {
++		if (wlc_hw->di[j]) {
++			dma_detach(wlc_hw->di[j]);
++			wlc_hw->di[j] = NULL;
++		}
++	}
++}
++
++/*
++ * Initialize brcms_c_info default values ...
++ * may get overrides later in this function
++ *  BMAC_NOTES, move low out and resolve the dangling ones
++ */
++static void brcms_b_info_init(struct brcms_hardware *wlc_hw)
++{
++	struct brcms_c_info *wlc = wlc_hw->wlc;
++
++	/* set default sw macintmask value */
++	wlc->defmacintmask = DEF_MACINTMASK;
++
++	/* various 802.11g modes */
++	wlc_hw->shortslot = false;
++
++	wlc_hw->SFBL = RETRY_SHORT_FB;
++	wlc_hw->LFBL = RETRY_LONG_FB;
++
++	/* default mac retry limits */
++	wlc_hw->SRL = RETRY_SHORT_DEF;
++	wlc_hw->LRL = RETRY_LONG_DEF;
++	wlc_hw->chanspec = ch20mhz_chspec(1);
++}
++
++static void brcms_b_wait_for_wake(struct brcms_hardware *wlc_hw)
++{
++	/* delay before first read of ucode state */
++	udelay(40);
++
++	/* wait until ucode is no longer asleep */
++	SPINWAIT((brcms_b_read_shm(wlc_hw, M_UCODE_DBGST) ==
++		  DBGST_ASLEEP), wlc_hw->wlc->fastpwrup_dly);
++}
++
++/* control chip clock to save power, enable dynamic clock or force fast clock */
++static void brcms_b_clkctl_clk(struct brcms_hardware *wlc_hw, enum bcma_clkmode mode)
++{
++	if (ai_get_cccaps(wlc_hw->sih) & CC_CAP_PMU) {
++		/* new chips with PMU, CCS_FORCEHT will distribute the HT clock
++		 * on backplane, but mac core will still run on ALP(not HT) when
++		 * it enters powersave mode, which means the FCA bit may not be
++		 * set. Should wakeup mac if driver wants it to run on HT.
++		 */
++
++		if (wlc_hw->clk) {
++			if (mode == BCMA_CLKMODE_FAST) {
++				bcma_set32(wlc_hw->d11core,
++					   D11REGOFFS(clk_ctl_st),
++					   CCS_FORCEHT);
++
++				udelay(64);
++
++				SPINWAIT(
++				    ((bcma_read32(wlc_hw->d11core,
++				      D11REGOFFS(clk_ctl_st)) &
++				      CCS_HTAVAIL) == 0),
++				      PMU_MAX_TRANSITION_DLY);
++				WARN_ON(!(bcma_read32(wlc_hw->d11core,
++					D11REGOFFS(clk_ctl_st)) &
++					CCS_HTAVAIL));
++			} else {
++				if ((ai_get_pmurev(wlc_hw->sih) == 0) &&
++				    (bcma_read32(wlc_hw->d11core,
++					D11REGOFFS(clk_ctl_st)) &
++					(CCS_FORCEHT | CCS_HTAREQ)))
++					SPINWAIT(
++					    ((bcma_read32(wlc_hw->d11core,
++					      offsetof(struct d11regs,
++						       clk_ctl_st)) &
++					      CCS_HTAVAIL) == 0),
++					      PMU_MAX_TRANSITION_DLY);
++				bcma_mask32(wlc_hw->d11core,
++					D11REGOFFS(clk_ctl_st),
++					~CCS_FORCEHT);
++			}
++		}
++		wlc_hw->forcefastclk = (mode == BCMA_CLKMODE_FAST);
++	} else {
++
++		/* old chips w/o PMU, force HT through cc,
++		 * then use FCA to verify mac is running fast clock
++		 */
++
++		wlc_hw->forcefastclk = ai_clkctl_cc(wlc_hw->sih, mode);
++
++		/* check fast clock is available (if core is not in reset) */
++		if (wlc_hw->forcefastclk && wlc_hw->clk)
++			WARN_ON(!(bcma_aread32(wlc_hw->d11core, BCMA_IOST) &
++				  SISF_FCLKA));
++
++		/*
++		 * keep the ucode wake bit on if forcefastclk is on since we
++		 * do not want ucode to put us back to slow clock when it dozes
++		 * for PM mode. Code below matches the wake override bit with
++		 * current forcefastclk state. Only setting bit in wake_override
++		 * instead of waking ucode immediately since old code had this
++		 * behavior. Older code set wlc->forcefastclk but only had the
++		 * wake happen if the wakup_ucode work (protected by an up
++		 * check) was executed just below.
++		 */
++		if (wlc_hw->forcefastclk)
++			mboolset(wlc_hw->wake_override,
++				 BRCMS_WAKE_OVERRIDE_FORCEFAST);
++		else
++			mboolclr(wlc_hw->wake_override,
++				 BRCMS_WAKE_OVERRIDE_FORCEFAST);
++	}
++}
++
++/* set or clear ucode host flag bits
++ * it has an optimization for no-change write
++ * it only writes through shared memory when the core has clock;
++ * pre-CLK changes should use wlc_write_mhf to get around the optimization
++ *
++ *
++ * bands values are: BRCM_BAND_AUTO <--- Current band only
++ *                   BRCM_BAND_5G   <--- 5G band only
++ *                   BRCM_BAND_2G   <--- 2G band only
++ *                   BRCM_BAND_ALL  <--- All bands
++ */
++void
++brcms_b_mhf(struct brcms_hardware *wlc_hw, u8 idx, u16 mask, u16 val,
++	     int bands)
++{
++	u16 save;
++	u16 addr[MHFMAX] = {
++		M_HOST_FLAGS1, M_HOST_FLAGS2, M_HOST_FLAGS3, M_HOST_FLAGS4,
++		M_HOST_FLAGS5
++	};
++	struct brcms_hw_band *band;
++
++	if ((val & ~mask) || idx >= MHFMAX)
++		return; /* error condition */
++
++	switch (bands) {
++		/* Current band only or all bands,
++		 * then set the band to current band
++		 */
++	case BRCM_BAND_AUTO:
++	case BRCM_BAND_ALL:
++		band = wlc_hw->band;
++		break;
++	case BRCM_BAND_5G:
++		band = wlc_hw->bandstate[BAND_5G_INDEX];
++		break;
++	case BRCM_BAND_2G:
++		band = wlc_hw->bandstate[BAND_2G_INDEX];
++		break;
++	default:
++		band = NULL;	/* error condition */
++	}
++
++	if (band) {
++		save = band->mhfs[idx];
++		band->mhfs[idx] = (band->mhfs[idx] & ~mask) | val;
++
++		/* optimization: only write through if changed, and
++		 * changed band is the current band
++		 */
++		if (wlc_hw->clk && (band->mhfs[idx] != save)
++		    && (band == wlc_hw->band))
++			brcms_b_write_shm(wlc_hw, addr[idx],
++					   (u16) band->mhfs[idx]);
++	}
++
++	if (bands == BRCM_BAND_ALL) {
++		wlc_hw->bandstate[0]->mhfs[idx] =
++		    (wlc_hw->bandstate[0]->mhfs[idx] & ~mask) | val;
++		wlc_hw->bandstate[1]->mhfs[idx] =
++		    (wlc_hw->bandstate[1]->mhfs[idx] & ~mask) | val;
++	}
++}
++
++/* set the maccontrol register to desired reset state and
++ * initialize the sw cache of the register
++ */
++static void brcms_c_mctrl_reset(struct brcms_hardware *wlc_hw)
++{
++	/* IHR accesses are always enabled, PSM disabled, HPS off and WAKE on */
++	wlc_hw->maccontrol = 0;
++	wlc_hw->suspended_fifos = 0;
++	wlc_hw->wake_override = 0;
++	wlc_hw->mute_override = 0;
++	brcms_b_mctrl(wlc_hw, ~0, MCTL_IHR_EN | MCTL_WAKE);
++}
++
++/*
++ * write the software state of maccontrol and
++ * overrides to the maccontrol register
++ */
++static void brcms_c_mctrl_write(struct brcms_hardware *wlc_hw)
++{
++	u32 maccontrol = wlc_hw->maccontrol;
++
++	/* OR in the wake bit if overridden */
++	if (wlc_hw->wake_override)
++		maccontrol |= MCTL_WAKE;
++
++	/* set AP and INFRA bits for mute if needed */
++	if (wlc_hw->mute_override) {
++		maccontrol &= ~(MCTL_AP);
++		maccontrol |= MCTL_INFRA;
++	}
++
++	bcma_write32(wlc_hw->d11core, D11REGOFFS(maccontrol),
++		     maccontrol);
++}
++
++/* set or clear maccontrol bits */
++void brcms_b_mctrl(struct brcms_hardware *wlc_hw, u32 mask, u32 val)
++{
++	u32 maccontrol;
++	u32 new_maccontrol;
++
++	if (val & ~mask)
++		return; /* error condition */
++	maccontrol = wlc_hw->maccontrol;
++	new_maccontrol = (maccontrol & ~mask) | val;
++
++	/* if the new maccontrol value is the same as the old, nothing to do */
++	if (new_maccontrol == maccontrol)
++		return;
++
++	/* something changed, cache the new value */
++	wlc_hw->maccontrol = new_maccontrol;
++
++	/* write the new values with overrides applied */
++	brcms_c_mctrl_write(wlc_hw);
++}
++
++void brcms_c_ucode_wake_override_set(struct brcms_hardware *wlc_hw,
++				 u32 override_bit)
++{
++	if (wlc_hw->wake_override || (wlc_hw->maccontrol & MCTL_WAKE)) {
++		mboolset(wlc_hw->wake_override, override_bit);
++		return;
++	}
++
++	mboolset(wlc_hw->wake_override, override_bit);
++
++	brcms_c_mctrl_write(wlc_hw);
++	brcms_b_wait_for_wake(wlc_hw);
++}
++
++void brcms_c_ucode_wake_override_clear(struct brcms_hardware *wlc_hw,
++				   u32 override_bit)
++{
++	mboolclr(wlc_hw->wake_override, override_bit);
++
++	if (wlc_hw->wake_override || (wlc_hw->maccontrol & MCTL_WAKE))
++		return;
++
++	brcms_c_mctrl_write(wlc_hw);
++}
++
++/* When driver needs ucode to stop beaconing, it has to make sure that
++ * MCTL_AP is clear and MCTL_INFRA is set
++ * Mode           MCTL_AP        MCTL_INFRA
++ * AP                1              1
++ * STA               0              1 <--- This will ensure no beacons
++ * IBSS              0              0
++ */
++static void brcms_c_ucode_mute_override_set(struct brcms_hardware *wlc_hw)
++{
++	wlc_hw->mute_override = 1;
++
++	/* if maccontrol already has AP == 0 and INFRA == 1 without this
++	 * override, then there is no change to write
++	 */
++	if ((wlc_hw->maccontrol & (MCTL_AP | MCTL_INFRA)) == MCTL_INFRA)
++		return;
++
++	brcms_c_mctrl_write(wlc_hw);
++}
++
++/* Clear the override on AP and INFRA bits */
++static void brcms_c_ucode_mute_override_clear(struct brcms_hardware *wlc_hw)
++{
++	if (wlc_hw->mute_override == 0)
++		return;
++
++	wlc_hw->mute_override = 0;
++
++	/* if maccontrol already has AP == 0 and INFRA == 1 without this
++	 * override, then there is no change to write
++	 */
++	if ((wlc_hw->maccontrol & (MCTL_AP | MCTL_INFRA)) == MCTL_INFRA)
++		return;
++
++	brcms_c_mctrl_write(wlc_hw);
++}
++
++/*
++ * Write a MAC address to the given match reg offset in the RXE match engine.
++ */
++static void
++brcms_b_set_addrmatch(struct brcms_hardware *wlc_hw, int match_reg_offset,
++		       const u8 *addr)
++{
++	struct bcma_device *core = wlc_hw->d11core;
++	u16 mac_l;
++	u16 mac_m;
++	u16 mac_h;
++
++	BCMMSG(wlc_hw->wlc->wiphy, "wl%d: brcms_b_set_addrmatch\n",
++		 wlc_hw->unit);
++
++	mac_l = addr[0] | (addr[1] << 8);
++	mac_m = addr[2] | (addr[3] << 8);
++	mac_h = addr[4] | (addr[5] << 8);
++
++	/* enter the MAC addr into the RXE match registers */
++	bcma_write16(core, D11REGOFFS(rcm_ctl),
++		     RCM_INC_DATA | match_reg_offset);
++	bcma_write16(core, D11REGOFFS(rcm_mat_data), mac_l);
++	bcma_write16(core, D11REGOFFS(rcm_mat_data), mac_m);
++	bcma_write16(core, D11REGOFFS(rcm_mat_data), mac_h);
++}
++
++void
++brcms_b_write_template_ram(struct brcms_hardware *wlc_hw, int offset, int len,
++			    void *buf)
++{
++	struct bcma_device *core = wlc_hw->d11core;
++	u32 word;
++	__le32 word_le;
++	__be32 word_be;
++	bool be_bit;
++	BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
++
++	bcma_write32(core, D11REGOFFS(tplatewrptr), offset);
++
++	/* if MCTL_BIGEND bit set in mac control register,
++	 * the chip swaps data in fifo, as well as data in
++	 * template ram
++	 */
++	be_bit = (bcma_read32(core, D11REGOFFS(maccontrol)) & MCTL_BIGEND) != 0;
++
++	while (len > 0) {
++		memcpy(&word, buf, sizeof(u32));
++
++		if (be_bit) {
++			word_be = cpu_to_be32(word);
++			word = *(u32 *)&word_be;
++		} else {
++			word_le = cpu_to_le32(word);
++			word = *(u32 *)&word_le;
++		}
++
++		bcma_write32(core, D11REGOFFS(tplatewrdata), word);
++
++		buf = (u8 *) buf + sizeof(u32);
++		len -= sizeof(u32);
++	}
++}
++
++static void brcms_b_set_cwmin(struct brcms_hardware *wlc_hw, u16 newmin)
++{
++	wlc_hw->band->CWmin = newmin;
++
++	bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
++		     OBJADDR_SCR_SEL | S_DOT11_CWMIN);
++	(void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
++	bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), newmin);
++}
++
++static void brcms_b_set_cwmax(struct brcms_hardware *wlc_hw, u16 newmax)
++{
++	wlc_hw->band->CWmax = newmax;
++
++	bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
++		     OBJADDR_SCR_SEL | S_DOT11_CWMAX);
++	(void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
++	bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), newmax);
++}
++
++void brcms_b_bw_set(struct brcms_hardware *wlc_hw, u16 bw)
++{
++	bool fastclk;
++
++	/* request FAST clock if not on */
++	fastclk = wlc_hw->forcefastclk;
++	if (!fastclk)
++		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
++
++	wlc_phy_bw_state_set(wlc_hw->band->pi, bw);
++
++	brcms_b_phy_reset(wlc_hw);
++	wlc_phy_init(wlc_hw->band->pi, wlc_phy_chanspec_get(wlc_hw->band->pi));
++
++	/* restore the clk */
++	if (!fastclk)
++		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
++}
++
++static void brcms_b_upd_synthpu(struct brcms_hardware *wlc_hw)
++{
++	u16 v;
++	struct brcms_c_info *wlc = wlc_hw->wlc;
++	/* update SYNTHPU_DLY */
++
++	if (BRCMS_ISLCNPHY(wlc->band))
++		v = SYNTHPU_DLY_LPPHY_US;
++	else if (BRCMS_ISNPHY(wlc->band) && (NREV_GE(wlc->band->phyrev, 3)))
++		v = SYNTHPU_DLY_NPHY_US;
++	else
++		v = SYNTHPU_DLY_BPHY_US;
++
++	brcms_b_write_shm(wlc_hw, M_SYNTHPU_DLY, v);
++}
++
++static void brcms_c_ucode_txant_set(struct brcms_hardware *wlc_hw)
++{
++	u16 phyctl;
++	u16 phytxant = wlc_hw->bmac_phytxant;
++	u16 mask = PHY_TXC_ANT_MASK;
++
++	/* set the Probe Response frame phy control word */
++	phyctl = brcms_b_read_shm(wlc_hw, M_CTXPRS_BLK + C_CTX_PCTLWD_POS);
++	phyctl = (phyctl & ~mask) | phytxant;
++	brcms_b_write_shm(wlc_hw, M_CTXPRS_BLK + C_CTX_PCTLWD_POS, phyctl);
++
++	/* set the Response (ACK/CTS) frame phy control word */
++	phyctl = brcms_b_read_shm(wlc_hw, M_RSP_PCTLWD);
++	phyctl = (phyctl & ~mask) | phytxant;
++	brcms_b_write_shm(wlc_hw, M_RSP_PCTLWD, phyctl);
++}
++
++static u16 brcms_b_ofdm_ratetable_offset(struct brcms_hardware *wlc_hw,
++					 u8 rate)
++{
++	uint i;
++	u8 plcp_rate = 0;
++	struct plcp_signal_rate_lookup {
++		u8 rate;
++		u8 signal_rate;
++	};
++	/* OFDM RATE sub-field of PLCP SIGNAL field, per 802.11 sec 17.3.4.1 */
++	const struct plcp_signal_rate_lookup rate_lookup[] = {
++		{BRCM_RATE_6M, 0xB},
++		{BRCM_RATE_9M, 0xF},
++		{BRCM_RATE_12M, 0xA},
++		{BRCM_RATE_18M, 0xE},
++		{BRCM_RATE_24M, 0x9},
++		{BRCM_RATE_36M, 0xD},
++		{BRCM_RATE_48M, 0x8},
++		{BRCM_RATE_54M, 0xC}
++	};
++
++	for (i = 0; i < ARRAY_SIZE(rate_lookup); i++) {
++		if (rate == rate_lookup[i].rate) {
++			plcp_rate = rate_lookup[i].signal_rate;
++			break;
++		}
++	}
++
++	/* Find the SHM pointer to the rate table entry by looking in the
++	 * Direct-map Table
++	 */
++	return 2 * brcms_b_read_shm(wlc_hw, M_RT_DIRMAP_A + (plcp_rate * 2));
++}
++
++static void brcms_upd_ofdm_pctl1_table(struct brcms_hardware *wlc_hw)
++{
++	u8 rate;
++	u8 rates[8] = {
++		BRCM_RATE_6M, BRCM_RATE_9M, BRCM_RATE_12M, BRCM_RATE_18M,
++		BRCM_RATE_24M, BRCM_RATE_36M, BRCM_RATE_48M, BRCM_RATE_54M
++	};
++	u16 entry_ptr;
++	u16 pctl1;
++	uint i;
++
++	if (!BRCMS_PHY_11N_CAP(wlc_hw->band))
++		return;
++
++	/* walk the phy rate table and update the entries */
++	for (i = 0; i < ARRAY_SIZE(rates); i++) {
++		rate = rates[i];
++
++		entry_ptr = brcms_b_ofdm_ratetable_offset(wlc_hw, rate);
++
++		/* read the SHM Rate Table entry OFDM PCTL1 values */
++		pctl1 =
++		    brcms_b_read_shm(wlc_hw, entry_ptr + M_RT_OFDM_PCTL1_POS);
++
++		/* modify the value */
++		pctl1 &= ~PHY_TXC1_MODE_MASK;
++		pctl1 |= (wlc_hw->hw_stf_ss_opmode << PHY_TXC1_MODE_SHIFT);
++
++		/* Update the SHM Rate Table entry OFDM PCTL1 values */
++		brcms_b_write_shm(wlc_hw, entry_ptr + M_RT_OFDM_PCTL1_POS,
++				   pctl1);
++	}
++}
++
++/* band-specific init */
++static void brcms_b_bsinit(struct brcms_c_info *wlc, u16 chanspec)
++{
++	struct brcms_hardware *wlc_hw = wlc->hw;
++
++	BCMMSG(wlc->wiphy, "wl%d: bandunit %d\n", wlc_hw->unit,
++		wlc_hw->band->bandunit);
++
++	brcms_c_ucode_bsinit(wlc_hw);
++
++	wlc_phy_init(wlc_hw->band->pi, chanspec);
++
++	brcms_c_ucode_txant_set(wlc_hw);
++
++	/*
++	 * cwmin is band-specific, update hardware
++	 * with value for current band
++	 */
++	brcms_b_set_cwmin(wlc_hw, wlc_hw->band->CWmin);
++	brcms_b_set_cwmax(wlc_hw, wlc_hw->band->CWmax);
++
++	brcms_b_update_slot_timing(wlc_hw,
++				   wlc_hw->band->bandtype == BRCM_BAND_5G ?
++				   true : wlc_hw->shortslot);
++
++	/* write phytype and phyvers */
++	brcms_b_write_shm(wlc_hw, M_PHYTYPE, (u16) wlc_hw->band->phytype);
++	brcms_b_write_shm(wlc_hw, M_PHYVER, (u16) wlc_hw->band->phyrev);
++
++	/*
++	 * initialize the txphyctl1 rate table since
++	 * shmem is shared between bands
++	 */
++	brcms_upd_ofdm_pctl1_table(wlc_hw);
++
++	brcms_b_upd_synthpu(wlc_hw);
++}
++
++/* Perform a soft reset of the PHY PLL */
++void brcms_b_core_phypll_reset(struct brcms_hardware *wlc_hw)
++{
++	BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
++
++	ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_addr),
++		  ~0, 0);
++	udelay(1);
++	ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_data),
++		  0x4, 0);
++	udelay(1);
++	ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_data),
++		  0x4, 4);
++	udelay(1);
++	ai_cc_reg(wlc_hw->sih, offsetof(struct chipcregs, chipcontrol_data),
++		  0x4, 0);
++	udelay(1);
++}
++
++/* light way to turn on phy clock without reset for NPHY only
++ *  refer to brcms_b_core_phy_clk for full version
++ */
++void brcms_b_phyclk_fgc(struct brcms_hardware *wlc_hw, bool clk)
++{
++	/* support(necessary for NPHY and HYPHY) only */
++	if (!BRCMS_ISNPHY(wlc_hw->band))
++		return;
++
++	if (ON == clk)
++		brcms_b_core_ioctl(wlc_hw, SICF_FGC, SICF_FGC);
++	else
++		brcms_b_core_ioctl(wlc_hw, SICF_FGC, 0);
++
++}
++
++void brcms_b_macphyclk_set(struct brcms_hardware *wlc_hw, bool clk)
++{
++	if (ON == clk)
++		brcms_b_core_ioctl(wlc_hw, SICF_MPCLKE, SICF_MPCLKE);
++	else
++		brcms_b_core_ioctl(wlc_hw, SICF_MPCLKE, 0);
++}
++
++void brcms_b_phy_reset(struct brcms_hardware *wlc_hw)
++{
++	struct brcms_phy_pub *pih = wlc_hw->band->pi;
++	u32 phy_bw_clkbits;
++	bool phy_in_reset = false;
++
++	BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
++
++	if (pih == NULL)
++		return;
++
++	phy_bw_clkbits = wlc_phy_clk_bwbits(wlc_hw->band->pi);
++
++	/* Specific reset sequence required for NPHY rev 3 and 4 */
++	if (BRCMS_ISNPHY(wlc_hw->band) && NREV_GE(wlc_hw->band->phyrev, 3) &&
++	    NREV_LE(wlc_hw->band->phyrev, 4)) {
++		/* Set the PHY bandwidth */
++		brcms_b_core_ioctl(wlc_hw, SICF_BWMASK, phy_bw_clkbits);
++
++		udelay(1);
++
++		/* Perform a soft reset of the PHY PLL */
++		brcms_b_core_phypll_reset(wlc_hw);
++
++		/* reset the PHY */
++		brcms_b_core_ioctl(wlc_hw, (SICF_PRST | SICF_PCLKE),
++				   (SICF_PRST | SICF_PCLKE));
++		phy_in_reset = true;
++	} else {
++		brcms_b_core_ioctl(wlc_hw,
++				   (SICF_PRST | SICF_PCLKE | SICF_BWMASK),
++				   (SICF_PRST | SICF_PCLKE | phy_bw_clkbits));
++	}
++
++	udelay(2);
++	brcms_b_core_phy_clk(wlc_hw, ON);
++
++	if (pih)
++		wlc_phy_anacore(pih, ON);
++}
++
++/* switch to and initialize new band */
++static void brcms_b_setband(struct brcms_hardware *wlc_hw, uint bandunit,
++			    u16 chanspec) {
++	struct brcms_c_info *wlc = wlc_hw->wlc;
++	u32 macintmask;
++
++	/* Enable the d11 core before accessing it */
++	if (!bcma_core_is_enabled(wlc_hw->d11core)) {
++		bcma_core_enable(wlc_hw->d11core, 0);
++		brcms_c_mctrl_reset(wlc_hw);
++	}
++
++	macintmask = brcms_c_setband_inact(wlc, bandunit);
++
++	if (!wlc_hw->up)
++		return;
++
++	brcms_b_core_phy_clk(wlc_hw, ON);
++
++	/* band-specific initializations */
++	brcms_b_bsinit(wlc, chanspec);
++
++	/*
++	 * If there are any pending software interrupt bits,
++	 * then replace these with a harmless nonzero value
++	 * so brcms_c_dpc() will re-enable interrupts when done.
++	 */
++	if (wlc->macintstatus)
++		wlc->macintstatus = MI_DMAINT;
++
++	/* restore macintmask */
++	brcms_intrsrestore(wlc->wl, macintmask);
++
++	/* ucode should still be suspended.. */
++	WARN_ON((bcma_read32(wlc_hw->d11core, D11REGOFFS(maccontrol)) &
++		 MCTL_EN_MAC) != 0);
++}
++
++static bool brcms_c_isgoodchip(struct brcms_hardware *wlc_hw)
++{
++
++	/* reject unsupported corerev */
++	if (!CONF_HAS(D11CONF, wlc_hw->corerev)) {
++		wiphy_err(wlc_hw->wlc->wiphy, "unsupported core rev %d\n",
++			  wlc_hw->corerev);
++		return false;
++	}
++
++	return true;
++}
++
++/* Validate some board info parameters */
++static bool brcms_c_validboardtype(struct brcms_hardware *wlc_hw)
++{
++	uint boardrev = wlc_hw->boardrev;
++
++	/* 4 bits each for board type, major, minor, and tiny version */
++	uint brt = (boardrev & 0xf000) >> 12;
++	uint b0 = (boardrev & 0xf00) >> 8;
++	uint b1 = (boardrev & 0xf0) >> 4;
++	uint b2 = boardrev & 0xf;
++
++	/* voards from other vendors are always considered valid */
++	if (ai_get_boardvendor(wlc_hw->sih) != PCI_VENDOR_ID_BROADCOM)
++		return true;
++
++	/* do some boardrev sanity checks when boardvendor is Broadcom */
++	if (boardrev == 0)
++		return false;
++
++	if (boardrev <= 0xff)
++		return true;
++
++	if ((brt > 2) || (brt == 0) || (b0 > 9) || (b0 == 0) || (b1 > 9)
++		|| (b2 > 9))
++		return false;
++
++	return true;
++}
++
++static void brcms_c_get_macaddr(struct brcms_hardware *wlc_hw, u8 etheraddr[ETH_ALEN])
++{
++	struct ssb_sprom *sprom = &wlc_hw->d11core->bus->sprom;
++
++	/* If macaddr exists, use it (Sromrev4, CIS, ...). */
++	if (!is_zero_ether_addr(sprom->il0mac)) {
++		memcpy(etheraddr, sprom->il0mac, 6);
++		return;
++	}
++
++	if (wlc_hw->_nbands > 1)
++		memcpy(etheraddr, sprom->et1mac, 6);
++	else
++		memcpy(etheraddr, sprom->il0mac, 6);
++}
++
++/* power both the pll and external oscillator on/off */
++static void brcms_b_xtal(struct brcms_hardware *wlc_hw, bool want)
++{
++	BCMMSG(wlc_hw->wlc->wiphy, "wl%d: want %d\n", wlc_hw->unit, want);
++
++	/*
++	 * dont power down if plldown is false or
++	 * we must poll hw radio disable
++	 */
++	if (!want && wlc_hw->pllreq)
++		return;
++
++	wlc_hw->sbclk = want;
++	if (!wlc_hw->sbclk) {
++		wlc_hw->clk = false;
++		if (wlc_hw->band && wlc_hw->band->pi)
++			wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, false);
++	}
++}
++
++/*
++ * Return true if radio is disabled, otherwise false.
++ * hw radio disable signal is an external pin, users activate it asynchronously
++ * this function could be called when driver is down and w/o clock
++ * it operates on different registers depending on corerev and boardflag.
++ */
++static bool brcms_b_radio_read_hwdisabled(struct brcms_hardware *wlc_hw)
++{
++	bool v, clk, xtal;
++	u32 flags = 0;
++
++	xtal = wlc_hw->sbclk;
++	if (!xtal)
++		brcms_b_xtal(wlc_hw, ON);
++
++	/* may need to take core out of reset first */
++	clk = wlc_hw->clk;
++	if (!clk) {
++		/*
++		 * mac no longer enables phyclk automatically when driver
++		 * accesses phyreg throughput mac. This can be skipped since
++		 * only mac reg is accessed below
++		 */
++		flags |= SICF_PCLKE;
++
++		/*
++		 * TODO: test suspend/resume
++		 *
++		 * AI chip doesn't restore bar0win2 on
++		 * hibernation/resume, need sw fixup
++		 */
++
++		bcma_core_enable(wlc_hw->d11core, flags);
++		brcms_c_mctrl_reset(wlc_hw);
++	}
++
++	v = ((bcma_read32(wlc_hw->d11core,
++			  D11REGOFFS(phydebug)) & PDBG_RFD) != 0);
++
++	/* put core back into reset */
++	if (!clk)
++		bcma_core_disable(wlc_hw->d11core, 0);
++
++	if (!xtal)
++		brcms_b_xtal(wlc_hw, OFF);
++
++	return v;
++}
++
++static bool wlc_dma_rxreset(struct brcms_hardware *wlc_hw, uint fifo)
++{
++	struct dma_pub *di = wlc_hw->di[fifo];
++	return dma_rxreset(di);
++}
++
++/* d11 core reset
++ *   ensure fask clock during reset
++ *   reset dma
++ *   reset d11(out of reset)
++ *   reset phy(out of reset)
++ *   clear software macintstatus for fresh new start
++ * one testing hack wlc_hw->noreset will bypass the d11/phy reset
++ */
++void brcms_b_corereset(struct brcms_hardware *wlc_hw, u32 flags)
++{
++	uint i;
++	bool fastclk;
++
++	if (flags == BRCMS_USE_COREFLAGS)
++		flags = (wlc_hw->band->pi ? wlc_hw->band->core_flags : 0);
++
++	BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
++
++	/* request FAST clock if not on  */
++	fastclk = wlc_hw->forcefastclk;
++	if (!fastclk)
++		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
++
++	/* reset the dma engines except first time thru */
++	if (bcma_core_is_enabled(wlc_hw->d11core)) {
++		for (i = 0; i < NFIFO; i++)
++			if ((wlc_hw->di[i]) && (!dma_txreset(wlc_hw->di[i])))
++				wiphy_err(wlc_hw->wlc->wiphy, "wl%d: %s: "
++					  "dma_txreset[%d]: cannot stop dma\n",
++					   wlc_hw->unit, __func__, i);
++
++		if ((wlc_hw->di[RX_FIFO])
++		    && (!wlc_dma_rxreset(wlc_hw, RX_FIFO)))
++			wiphy_err(wlc_hw->wlc->wiphy, "wl%d: %s: dma_rxreset"
++				  "[%d]: cannot stop dma\n",
++				  wlc_hw->unit, __func__, RX_FIFO);
++	}
++	/* if noreset, just stop the psm and return */
++	if (wlc_hw->noreset) {
++		wlc_hw->wlc->macintstatus = 0;	/* skip wl_dpc after down */
++		brcms_b_mctrl(wlc_hw, MCTL_PSM_RUN | MCTL_EN_MAC, 0);
++		return;
++	}
++
++	/*
++	 * mac no longer enables phyclk automatically when driver accesses
++	 * phyreg throughput mac, AND phy_reset is skipped at early stage when
++	 * band->pi is invalid. need to enable PHY CLK
++	 */
++	flags |= SICF_PCLKE;
++
++	/*
++	 * reset the core
++	 * In chips with PMU, the fastclk request goes through d11 core
++	 * reg 0x1e0, which is cleared by the core_reset. have to re-request it.
++	 *
++	 * This adds some delay and we can optimize it by also requesting
++	 * fastclk through chipcommon during this period if necessary. But
++	 * that has to work coordinate with other driver like mips/arm since
++	 * they may touch chipcommon as well.
++	 */
++	wlc_hw->clk = false;
++	bcma_core_enable(wlc_hw->d11core, flags);
++	wlc_hw->clk = true;
++	if (wlc_hw->band && wlc_hw->band->pi)
++		wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, true);
++
++	brcms_c_mctrl_reset(wlc_hw);
++
++	if (ai_get_cccaps(wlc_hw->sih) & CC_CAP_PMU)
++		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
++
++	brcms_b_phy_reset(wlc_hw);
++
++	/* turn on PHY_PLL */
++	brcms_b_core_phypll_ctl(wlc_hw, true);
++
++	/* clear sw intstatus */
++	wlc_hw->wlc->macintstatus = 0;
++
++	/* restore the clk setting */
++	if (!fastclk)
++		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
++}
++
++/* txfifo sizes needs to be modified(increased) since the newer cores
++ * have more memory.
++ */
++static void brcms_b_corerev_fifofixup(struct brcms_hardware *wlc_hw)
++{
++	struct bcma_device *core = wlc_hw->d11core;
++	u16 fifo_nu;
++	u16 txfifo_startblk = TXFIFO_START_BLK, txfifo_endblk;
++	u16 txfifo_def, txfifo_def1;
++	u16 txfifo_cmd;
++
++	/* tx fifos start at TXFIFO_START_BLK from the Base address */
++	txfifo_startblk = TXFIFO_START_BLK;
++
++	/* sequence of operations:  reset fifo, set fifo size, reset fifo */
++	for (fifo_nu = 0; fifo_nu < NFIFO; fifo_nu++) {
++
++		txfifo_endblk = txfifo_startblk + wlc_hw->xmtfifo_sz[fifo_nu];
++		txfifo_def = (txfifo_startblk & 0xff) |
++		    (((txfifo_endblk - 1) & 0xff) << TXFIFO_FIFOTOP_SHIFT);
++		txfifo_def1 = ((txfifo_startblk >> 8) & 0x1) |
++		    ((((txfifo_endblk -
++			1) >> 8) & 0x1) << TXFIFO_FIFOTOP_SHIFT);
++		txfifo_cmd =
++		    TXFIFOCMD_RESET_MASK | (fifo_nu << TXFIFOCMD_FIFOSEL_SHIFT);
++
++		bcma_write16(core, D11REGOFFS(xmtfifocmd), txfifo_cmd);
++		bcma_write16(core, D11REGOFFS(xmtfifodef), txfifo_def);
++		bcma_write16(core, D11REGOFFS(xmtfifodef1), txfifo_def1);
++
++		bcma_write16(core, D11REGOFFS(xmtfifocmd), txfifo_cmd);
++
++		txfifo_startblk += wlc_hw->xmtfifo_sz[fifo_nu];
++	}
++	/*
++	 * need to propagate to shm location to be in sync since ucode/hw won't
++	 * do this
++	 */
++	brcms_b_write_shm(wlc_hw, M_FIFOSIZE0,
++			   wlc_hw->xmtfifo_sz[TX_AC_BE_FIFO]);
++	brcms_b_write_shm(wlc_hw, M_FIFOSIZE1,
++			   wlc_hw->xmtfifo_sz[TX_AC_VI_FIFO]);
++	brcms_b_write_shm(wlc_hw, M_FIFOSIZE2,
++			   ((wlc_hw->xmtfifo_sz[TX_AC_VO_FIFO] << 8) | wlc_hw->
++			    xmtfifo_sz[TX_AC_BK_FIFO]));
++	brcms_b_write_shm(wlc_hw, M_FIFOSIZE3,
++			   ((wlc_hw->xmtfifo_sz[TX_ATIM_FIFO] << 8) | wlc_hw->
++			    xmtfifo_sz[TX_BCMC_FIFO]));
++}
++
++/* This function is used for changing the tsf frac register
++ * If spur avoidance mode is off, the mac freq will be 80/120/160Mhz
++ * If spur avoidance mode is on1, the mac freq will be 82/123/164Mhz
++ * If spur avoidance mode is on2, the mac freq will be 84/126/168Mhz
++ * HTPHY Formula is 2^26/freq(MHz) e.g.
++ * For spuron2 - 126MHz -> 2^26/126 = 532610.0
++ *  - 532610 = 0x82082 => tsf_clk_frac_h = 0x8, tsf_clk_frac_l = 0x2082
++ * For spuron: 123MHz -> 2^26/123    = 545600.5
++ *  - 545601 = 0x85341 => tsf_clk_frac_h = 0x8, tsf_clk_frac_l = 0x5341
++ * For spur off: 120MHz -> 2^26/120    = 559240.5
++ *  - 559241 = 0x88889 => tsf_clk_frac_h = 0x8, tsf_clk_frac_l = 0x8889
++ */
++
++void brcms_b_switch_macfreq(struct brcms_hardware *wlc_hw, u8 spurmode)
++{
++	struct bcma_device *core = wlc_hw->d11core;
++
++	if ((ai_get_chip_id(wlc_hw->sih) == BCM43224_CHIP_ID) ||
++	    (ai_get_chip_id(wlc_hw->sih) == BCM43225_CHIP_ID)) {
++		if (spurmode == WL_SPURAVOID_ON2) {	/* 126Mhz */
++			bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x2082);
++			bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0x8);
++		} else if (spurmode == WL_SPURAVOID_ON1) {	/* 123Mhz */
++			bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x5341);
++			bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0x8);
++		} else {	/* 120Mhz */
++			bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x8889);
++			bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0x8);
++		}
++	} else if (BRCMS_ISLCNPHY(wlc_hw->band)) {
++		if (spurmode == WL_SPURAVOID_ON1) {	/* 82Mhz */
++			bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0x7CE0);
++			bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0xC);
++		} else {	/* 80Mhz */
++			bcma_write16(core, D11REGOFFS(tsf_clk_frac_l), 0xCCCD);
++			bcma_write16(core, D11REGOFFS(tsf_clk_frac_h), 0xC);
++		}
++	}
++}
++
++/* Initialize GPIOs that are controlled by D11 core */
++static void brcms_c_gpio_init(struct brcms_c_info *wlc)
++{
++	struct brcms_hardware *wlc_hw = wlc->hw;
++	u32 gc, gm;
++
++	/* use GPIO select 0 to get all gpio signals from the gpio out reg */
++	brcms_b_mctrl(wlc_hw, MCTL_GPOUT_SEL_MASK, 0);
++
++	/*
++	 * Common GPIO setup:
++	 *      G0 = LED 0 = WLAN Activity
++	 *      G1 = LED 1 = WLAN 2.4 GHz Radio State
++	 *      G2 = LED 2 = WLAN 5 GHz Radio State
++	 *      G4 = radio disable input (HI enabled, LO disabled)
++	 */
++
++	gc = gm = 0;
++
++	/* Allocate GPIOs for mimo antenna diversity feature */
++	if (wlc_hw->antsel_type == ANTSEL_2x3) {
++		/* Enable antenna diversity, use 2x3 mode */
++		brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_EN,
++			     MHF3_ANTSEL_EN, BRCM_BAND_ALL);
++		brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_MODE,
++			     MHF3_ANTSEL_MODE, BRCM_BAND_ALL);
++
++		/* init superswitch control */
++		wlc_phy_antsel_init(wlc_hw->band->pi, false);
++
++	} else if (wlc_hw->antsel_type == ANTSEL_2x4) {
++		gm |= gc |= (BOARD_GPIO_12 | BOARD_GPIO_13);
++		/*
++		 * The board itself is powered by these GPIOs
++		 * (when not sending pattern) so set them high
++		 */
++		bcma_set16(wlc_hw->d11core, D11REGOFFS(psm_gpio_oe),
++			   (BOARD_GPIO_12 | BOARD_GPIO_13));
++		bcma_set16(wlc_hw->d11core, D11REGOFFS(psm_gpio_out),
++			   (BOARD_GPIO_12 | BOARD_GPIO_13));
++
++		/* Enable antenna diversity, use 2x4 mode */
++		brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_EN,
++			     MHF3_ANTSEL_EN, BRCM_BAND_ALL);
++		brcms_b_mhf(wlc_hw, MHF3, MHF3_ANTSEL_MODE, 0,
++			     BRCM_BAND_ALL);
++
++		/* Configure the desired clock to be 4Mhz */
++		brcms_b_write_shm(wlc_hw, M_ANTSEL_CLKDIV,
++				   ANTSEL_CLKDIV_4MHZ);
++	}
++
++	/*
++	 * gpio 9 controls the PA. ucode is responsible
++	 * for wiggling out and oe
++	 */
++	if (wlc_hw->boardflags & BFL_PACTRL)
++		gm |= gc |= BOARD_GPIO_PACTRL;
++
++	/* apply to gpiocontrol register */
++	bcma_chipco_gpio_control(&wlc_hw->d11core->bus->drv_cc, gm, gc);
++}
++
++static void brcms_ucode_write(struct brcms_hardware *wlc_hw,
++			      const __le32 ucode[], const size_t nbytes)
++{
++	struct bcma_device *core = wlc_hw->d11core;
++	uint i;
++	uint count;
++
++	BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
++
++	count = (nbytes / sizeof(u32));
++
++	bcma_write32(core, D11REGOFFS(objaddr),
++		     OBJADDR_AUTO_INC | OBJADDR_UCM_SEL);
++	(void)bcma_read32(core, D11REGOFFS(objaddr));
++	for (i = 0; i < count; i++)
++		bcma_write32(core, D11REGOFFS(objdata), le32_to_cpu(ucode[i]));
++
++}
++
++static void brcms_ucode_download(struct brcms_hardware *wlc_hw)
++{
++	struct brcms_c_info *wlc;
++	struct brcms_ucode *ucode = &wlc_hw->wlc->wl->ucode;
++
++	wlc = wlc_hw->wlc;
++
++	if (wlc_hw->ucode_loaded)
++		return;
++
++	if (D11REV_IS(wlc_hw->corerev, 23)) {
++		if (BRCMS_ISNPHY(wlc_hw->band)) {
++			brcms_ucode_write(wlc_hw, ucode->bcm43xx_16_mimo,
++					  ucode->bcm43xx_16_mimosz);
++			wlc_hw->ucode_loaded = true;
++		} else
++			wiphy_err(wlc->wiphy, "%s: wl%d: unsupported phy in "
++				  "corerev %d\n",
++				  __func__, wlc_hw->unit, wlc_hw->corerev);
++	} else if (D11REV_IS(wlc_hw->corerev, 24)) {
++		if (BRCMS_ISLCNPHY(wlc_hw->band)) {
++			brcms_ucode_write(wlc_hw, ucode->bcm43xx_24_lcn,
++					  ucode->bcm43xx_24_lcnsz);
++			wlc_hw->ucode_loaded = true;
++		} else {
++			wiphy_err(wlc->wiphy, "%s: wl%d: unsupported phy in "
++				  "corerev %d\n",
++				  __func__, wlc_hw->unit, wlc_hw->corerev);
++		}
++	}
++}
++
++void brcms_b_txant_set(struct brcms_hardware *wlc_hw, u16 phytxant)
++{
++	/* update sw state */
++	wlc_hw->bmac_phytxant = phytxant;
++
++	/* push to ucode if up */
++	if (!wlc_hw->up)
++		return;
++	brcms_c_ucode_txant_set(wlc_hw);
++
++}
++
++u16 brcms_b_get_txant(struct brcms_hardware *wlc_hw)
++{
++	return (u16) wlc_hw->wlc->stf->txant;
++}
++
++void brcms_b_antsel_type_set(struct brcms_hardware *wlc_hw, u8 antsel_type)
++{
++	wlc_hw->antsel_type = antsel_type;
++
++	/* Update the antsel type for phy module to use */
++	wlc_phy_antsel_type_set(wlc_hw->band->pi, antsel_type);
++}
++
++static void brcms_b_fifoerrors(struct brcms_hardware *wlc_hw)
++{
++	bool fatal = false;
++	uint unit;
++	uint intstatus, idx;
++	struct bcma_device *core = wlc_hw->d11core;
++	struct wiphy *wiphy = wlc_hw->wlc->wiphy;
++
++	unit = wlc_hw->unit;
++
++	for (idx = 0; idx < NFIFO; idx++) {
++		/* read intstatus register and ignore any non-error bits */
++		intstatus =
++			bcma_read32(core,
++				    D11REGOFFS(intctrlregs[idx].intstatus)) &
++			I_ERRORS;
++		if (!intstatus)
++			continue;
++
++		BCMMSG(wlc_hw->wlc->wiphy, "wl%d: intstatus%d 0x%x\n",
++			unit, idx, intstatus);
++
++		if (intstatus & I_RO) {
++			wiphy_err(wiphy, "wl%d: fifo %d: receive fifo "
++				  "overflow\n", unit, idx);
++			fatal = true;
++		}
++
++		if (intstatus & I_PC) {
++			wiphy_err(wiphy, "wl%d: fifo %d: descriptor error\n",
++				 unit, idx);
++			fatal = true;
++		}
++
++		if (intstatus & I_PD) {
++			wiphy_err(wiphy, "wl%d: fifo %d: data error\n", unit,
++				  idx);
++			fatal = true;
++		}
++
++		if (intstatus & I_DE) {
++			wiphy_err(wiphy, "wl%d: fifo %d: descriptor protocol "
++				  "error\n", unit, idx);
++			fatal = true;
++		}
++
++		if (intstatus & I_RU)
++			wiphy_err(wiphy, "wl%d: fifo %d: receive descriptor "
++				  "underflow\n", idx, unit);
++
++		if (intstatus & I_XU) {
++			wiphy_err(wiphy, "wl%d: fifo %d: transmit fifo "
++				  "underflow\n", idx, unit);
++			fatal = true;
++		}
++
++		if (fatal) {
++			brcms_fatal_error(wlc_hw->wlc->wl); /* big hammer */
++			break;
++		} else
++			bcma_write32(core,
++				     D11REGOFFS(intctrlregs[idx].intstatus),
++				     intstatus);
++	}
++}
++
++void brcms_c_intrson(struct brcms_c_info *wlc)
++{
++	struct brcms_hardware *wlc_hw = wlc->hw;
++	wlc->macintmask = wlc->defmacintmask;
++	bcma_write32(wlc_hw->d11core, D11REGOFFS(macintmask), wlc->macintmask);
++}
++
++u32 brcms_c_intrsoff(struct brcms_c_info *wlc)
++{
++	struct brcms_hardware *wlc_hw = wlc->hw;
++	u32 macintmask;
++
++	if (!wlc_hw->clk)
++		return 0;
++
++	macintmask = wlc->macintmask;	/* isr can still happen */
++
++	bcma_write32(wlc_hw->d11core, D11REGOFFS(macintmask), 0);
++	(void)bcma_read32(wlc_hw->d11core, D11REGOFFS(macintmask));
++	udelay(1);		/* ensure int line is no longer driven */
++	wlc->macintmask = 0;
++
++	/* return previous macintmask; resolve race between us and our isr */
++	return wlc->macintstatus ? 0 : macintmask;
++}
++
++void brcms_c_intrsrestore(struct brcms_c_info *wlc, u32 macintmask)
++{
++	struct brcms_hardware *wlc_hw = wlc->hw;
++	if (!wlc_hw->clk)
++		return;
++
++	wlc->macintmask = macintmask;
++	bcma_write32(wlc_hw->d11core, D11REGOFFS(macintmask), wlc->macintmask);
++}
++
++/* assumes that the d11 MAC is enabled */
++static void brcms_b_tx_fifo_suspend(struct brcms_hardware *wlc_hw,
++				    uint tx_fifo)
++{
++	u8 fifo = 1 << tx_fifo;
++
++	/* Two clients of this code, 11h Quiet period and scanning. */
++
++	/* only suspend if not already suspended */
++	if ((wlc_hw->suspended_fifos & fifo) == fifo)
++		return;
++
++	/* force the core awake only if not already */
++	if (wlc_hw->suspended_fifos == 0)
++		brcms_c_ucode_wake_override_set(wlc_hw,
++						BRCMS_WAKE_OVERRIDE_TXFIFO);
++
++	wlc_hw->suspended_fifos |= fifo;
++
++	if (wlc_hw->di[tx_fifo]) {
++		/*
++		 * Suspending AMPDU transmissions in the middle can cause
++		 * underflow which may result in mismatch between ucode and
++		 * driver so suspend the mac before suspending the FIFO
++		 */
++		if (BRCMS_PHY_11N_CAP(wlc_hw->band))
++			brcms_c_suspend_mac_and_wait(wlc_hw->wlc);
++
++		dma_txsuspend(wlc_hw->di[tx_fifo]);
++
++		if (BRCMS_PHY_11N_CAP(wlc_hw->band))
++			brcms_c_enable_mac(wlc_hw->wlc);
++	}
++}
++
++static void brcms_b_tx_fifo_resume(struct brcms_hardware *wlc_hw,
++				   uint tx_fifo)
++{
++	/* BMAC_NOTE: BRCMS_TX_FIFO_ENAB is done in brcms_c_dpc() for DMA case
++	 * but need to be done here for PIO otherwise the watchdog will catch
++	 * the inconsistency and fire
++	 */
++	/* Two clients of this code, 11h Quiet period and scanning. */
++	if (wlc_hw->di[tx_fifo])
++		dma_txresume(wlc_hw->di[tx_fifo]);
++
++	/* allow core to sleep again */
++	if (wlc_hw->suspended_fifos == 0)
++		return;
++	else {
++		wlc_hw->suspended_fifos &= ~(1 << tx_fifo);
++		if (wlc_hw->suspended_fifos == 0)
++			brcms_c_ucode_wake_override_clear(wlc_hw,
++						BRCMS_WAKE_OVERRIDE_TXFIFO);
++	}
++}
++
++/* precondition: requires the mac core to be enabled */
++static void brcms_b_mute(struct brcms_hardware *wlc_hw, bool mute_tx)
++{
++	static const u8 null_ether_addr[ETH_ALEN] = {0, 0, 0, 0, 0, 0};
++
++	if (mute_tx) {
++		/* suspend tx fifos */
++		brcms_b_tx_fifo_suspend(wlc_hw, TX_DATA_FIFO);
++		brcms_b_tx_fifo_suspend(wlc_hw, TX_CTL_FIFO);
++		brcms_b_tx_fifo_suspend(wlc_hw, TX_AC_BK_FIFO);
++		brcms_b_tx_fifo_suspend(wlc_hw, TX_AC_VI_FIFO);
++
++		/* zero the address match register so we do not send ACKs */
++		brcms_b_set_addrmatch(wlc_hw, RCM_MAC_OFFSET,
++				       null_ether_addr);
++	} else {
++		/* resume tx fifos */
++		brcms_b_tx_fifo_resume(wlc_hw, TX_DATA_FIFO);
++		brcms_b_tx_fifo_resume(wlc_hw, TX_CTL_FIFO);
++		brcms_b_tx_fifo_resume(wlc_hw, TX_AC_BK_FIFO);
++		brcms_b_tx_fifo_resume(wlc_hw, TX_AC_VI_FIFO);
++
++		/* Restore address */
++		brcms_b_set_addrmatch(wlc_hw, RCM_MAC_OFFSET,
++				       wlc_hw->etheraddr);
++	}
++
++	wlc_phy_mute_upd(wlc_hw->band->pi, mute_tx, 0);
++
++	if (mute_tx)
++		brcms_c_ucode_mute_override_set(wlc_hw);
++	else
++		brcms_c_ucode_mute_override_clear(wlc_hw);
++}
++
++void
++brcms_c_mute(struct brcms_c_info *wlc, bool mute_tx)
++{
++	brcms_b_mute(wlc->hw, mute_tx);
++}
++
++/*
++ * Read and clear macintmask and macintstatus and intstatus registers.
++ * This routine should be called with interrupts off
++ * Return:
++ *   -1 if brcms_deviceremoved(wlc) evaluates to true;
++ *   0 if the interrupt is not for us, or we are in some special cases;
++ *   device interrupt status bits otherwise.
++ */
++static inline u32 wlc_intstatus(struct brcms_c_info *wlc, bool in_isr)
++{
++	struct brcms_hardware *wlc_hw = wlc->hw;
++	struct bcma_device *core = wlc_hw->d11core;
++	u32 macintstatus;
++
++	/* macintstatus includes a DMA interrupt summary bit */
++	macintstatus = bcma_read32(core, D11REGOFFS(macintstatus));
++
++	BCMMSG(wlc->wiphy, "wl%d: macintstatus: 0x%x\n", wlc_hw->unit,
++		 macintstatus);
++
++	/* detect cardbus removed, in power down(suspend) and in reset */
++	if (brcms_deviceremoved(wlc))
++		return -1;
++
++	/* brcms_deviceremoved() succeeds even when the core is still resetting,
++	 * handle that case here.
++	 */
++	if (macintstatus == 0xffffffff)
++		return 0;
++
++	/* defer unsolicited interrupts */
++	macintstatus &= (in_isr ? wlc->macintmask : wlc->defmacintmask);
++
++	/* if not for us */
++	if (macintstatus == 0)
++		return 0;
++
++	/* interrupts are already turned off for CFE build
++	 * Caution: For CFE Turning off the interrupts again has some undesired
++	 * consequences
++	 */
++	/* turn off the interrupts */
++	bcma_write32(core, D11REGOFFS(macintmask), 0);
++	(void)bcma_read32(core, D11REGOFFS(macintmask));
++	wlc->macintmask = 0;
++
++	/* clear device interrupts */
++	bcma_write32(core, D11REGOFFS(macintstatus), macintstatus);
++
++	/* MI_DMAINT is indication of non-zero intstatus */
++	if (macintstatus & MI_DMAINT)
++		/*
++		 * only fifo interrupt enabled is I_RI in
++		 * RX_FIFO. If MI_DMAINT is set, assume it
++		 * is set and clear the interrupt.
++		 */
++		bcma_write32(core, D11REGOFFS(intctrlregs[RX_FIFO].intstatus),
++			     DEF_RXINTMASK);
++
++	return macintstatus;
++}
++
++/* Update wlc->macintstatus and wlc->intstatus[]. */
++/* Return true if they are updated successfully. false otherwise */
++bool brcms_c_intrsupd(struct brcms_c_info *wlc)
++{
++	u32 macintstatus;
++
++	/* read and clear macintstatus and intstatus registers */
++	macintstatus = wlc_intstatus(wlc, false);
++
++	/* device is removed */
++	if (macintstatus == 0xffffffff)
++		return false;
++
++	/* update interrupt status in software */
++	wlc->macintstatus |= macintstatus;
++
++	return true;
++}
++
++/*
++ * First-level interrupt processing.
++ * Return true if this was our interrupt, false otherwise.
++ * *wantdpc will be set to true if further brcms_c_dpc() processing is required,
++ * false otherwise.
++ */
++bool brcms_c_isr(struct brcms_c_info *wlc, bool *wantdpc)
++{
++	struct brcms_hardware *wlc_hw = wlc->hw;
++	u32 macintstatus;
++
++	*wantdpc = false;
++
++	if (!wlc_hw->up || !wlc->macintmask)
++		return false;
++
++	/* read and clear macintstatus and intstatus registers */
++	macintstatus = wlc_intstatus(wlc, true);
++
++	if (macintstatus == 0xffffffff)
++		wiphy_err(wlc->wiphy, "DEVICEREMOVED detected in the ISR code"
++			  " path\n");
++
++	/* it is not for us */
++	if (macintstatus == 0)
++		return false;
++
++	*wantdpc = true;
++
++	/* save interrupt status bits */
++	wlc->macintstatus = macintstatus;
++
++	return true;
++
++}
++
++void brcms_c_suspend_mac_and_wait(struct brcms_c_info *wlc)
++{
++	struct brcms_hardware *wlc_hw = wlc->hw;
++	struct bcma_device *core = wlc_hw->d11core;
++	u32 mc, mi;
++	struct wiphy *wiphy = wlc->wiphy;
++
++	BCMMSG(wlc->wiphy, "wl%d: bandunit %d\n", wlc_hw->unit,
++		wlc_hw->band->bandunit);
++
++	/*
++	 * Track overlapping suspend requests
++	 */
++	wlc_hw->mac_suspend_depth++;
++	if (wlc_hw->mac_suspend_depth > 1)
++		return;
++
++	/* force the core awake */
++	brcms_c_ucode_wake_override_set(wlc_hw, BRCMS_WAKE_OVERRIDE_MACSUSPEND);
++
++	mc = bcma_read32(core, D11REGOFFS(maccontrol));
++
++	if (mc == 0xffffffff) {
++		wiphy_err(wiphy, "wl%d: %s: dead chip\n", wlc_hw->unit,
++			  __func__);
++		brcms_down(wlc->wl);
++		return;
++	}
++	WARN_ON(mc & MCTL_PSM_JMP_0);
++	WARN_ON(!(mc & MCTL_PSM_RUN));
++	WARN_ON(!(mc & MCTL_EN_MAC));
++
++	mi = bcma_read32(core, D11REGOFFS(macintstatus));
++	if (mi == 0xffffffff) {
++		wiphy_err(wiphy, "wl%d: %s: dead chip\n", wlc_hw->unit,
++			  __func__);
++		brcms_down(wlc->wl);
++		return;
++	}
++	WARN_ON(mi & MI_MACSSPNDD);
++
++	brcms_b_mctrl(wlc_hw, MCTL_EN_MAC, 0);
++
++	SPINWAIT(!(bcma_read32(core, D11REGOFFS(macintstatus)) & MI_MACSSPNDD),
++		 BRCMS_MAX_MAC_SUSPEND);
++
++	if (!(bcma_read32(core, D11REGOFFS(macintstatus)) & MI_MACSSPNDD)) {
++		wiphy_err(wiphy, "wl%d: wlc_suspend_mac_and_wait: waited %d uS"
++			  " and MI_MACSSPNDD is still not on.\n",
++			  wlc_hw->unit, BRCMS_MAX_MAC_SUSPEND);
++		wiphy_err(wiphy, "wl%d: psmdebug 0x%08x, phydebug 0x%08x, "
++			  "psm_brc 0x%04x\n", wlc_hw->unit,
++			  bcma_read32(core, D11REGOFFS(psmdebug)),
++			  bcma_read32(core, D11REGOFFS(phydebug)),
++			  bcma_read16(core, D11REGOFFS(psm_brc)));
++	}
++
++	mc = bcma_read32(core, D11REGOFFS(maccontrol));
++	if (mc == 0xffffffff) {
++		wiphy_err(wiphy, "wl%d: %s: dead chip\n", wlc_hw->unit,
++			  __func__);
++		brcms_down(wlc->wl);
++		return;
++	}
++	WARN_ON(mc & MCTL_PSM_JMP_0);
++	WARN_ON(!(mc & MCTL_PSM_RUN));
++	WARN_ON(mc & MCTL_EN_MAC);
++}
++
++void brcms_c_enable_mac(struct brcms_c_info *wlc)
++{
++	struct brcms_hardware *wlc_hw = wlc->hw;
++	struct bcma_device *core = wlc_hw->d11core;
++	u32 mc, mi;
++
++	BCMMSG(wlc->wiphy, "wl%d: bandunit %d\n", wlc_hw->unit,
++		wlc->band->bandunit);
++
++	/*
++	 * Track overlapping suspend requests
++	 */
++	wlc_hw->mac_suspend_depth--;
++	if (wlc_hw->mac_suspend_depth > 0)
++		return;
++
++	mc = bcma_read32(core, D11REGOFFS(maccontrol));
++	WARN_ON(mc & MCTL_PSM_JMP_0);
++	WARN_ON(mc & MCTL_EN_MAC);
++	WARN_ON(!(mc & MCTL_PSM_RUN));
++
++	brcms_b_mctrl(wlc_hw, MCTL_EN_MAC, MCTL_EN_MAC);
++	bcma_write32(core, D11REGOFFS(macintstatus), MI_MACSSPNDD);
++
++	mc = bcma_read32(core, D11REGOFFS(maccontrol));
++	WARN_ON(mc & MCTL_PSM_JMP_0);
++	WARN_ON(!(mc & MCTL_EN_MAC));
++	WARN_ON(!(mc & MCTL_PSM_RUN));
++
++	mi = bcma_read32(core, D11REGOFFS(macintstatus));
++	WARN_ON(mi & MI_MACSSPNDD);
++
++	brcms_c_ucode_wake_override_clear(wlc_hw,
++					  BRCMS_WAKE_OVERRIDE_MACSUSPEND);
++}
++
++void brcms_b_band_stf_ss_set(struct brcms_hardware *wlc_hw, u8 stf_mode)
++{
++	wlc_hw->hw_stf_ss_opmode = stf_mode;
++
++	if (wlc_hw->clk)
++		brcms_upd_ofdm_pctl1_table(wlc_hw);
++}
++
++static bool brcms_b_validate_chip_access(struct brcms_hardware *wlc_hw)
++{
++	struct bcma_device *core = wlc_hw->d11core;
++	u32 w, val;
++	struct wiphy *wiphy = wlc_hw->wlc->wiphy;
++
++	BCMMSG(wiphy, "wl%d\n", wlc_hw->unit);
++
++	/* Validate dchip register access */
++
++	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
++	(void)bcma_read32(core, D11REGOFFS(objaddr));
++	w = bcma_read32(core, D11REGOFFS(objdata));
++
++	/* Can we write and read back a 32bit register? */
++	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
++	(void)bcma_read32(core, D11REGOFFS(objaddr));
++	bcma_write32(core, D11REGOFFS(objdata), (u32) 0xaa5555aa);
++
++	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
++	(void)bcma_read32(core, D11REGOFFS(objaddr));
++	val = bcma_read32(core, D11REGOFFS(objdata));
++	if (val != (u32) 0xaa5555aa) {
++		wiphy_err(wiphy, "wl%d: validate_chip_access: SHM = 0x%x, "
++			  "expected 0xaa5555aa\n", wlc_hw->unit, val);
++		return false;
++	}
++
++	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
++	(void)bcma_read32(core, D11REGOFFS(objaddr));
++	bcma_write32(core, D11REGOFFS(objdata), (u32) 0x55aaaa55);
++
++	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
++	(void)bcma_read32(core, D11REGOFFS(objaddr));
++	val = bcma_read32(core, D11REGOFFS(objdata));
++	if (val != (u32) 0x55aaaa55) {
++		wiphy_err(wiphy, "wl%d: validate_chip_access: SHM = 0x%x, "
++			  "expected 0x55aaaa55\n", wlc_hw->unit, val);
++		return false;
++	}
++
++	bcma_write32(core, D11REGOFFS(objaddr), OBJADDR_SHM_SEL | 0);
++	(void)bcma_read32(core, D11REGOFFS(objaddr));
++	bcma_write32(core, D11REGOFFS(objdata), w);
++
++	/* clear CFPStart */
++	bcma_write32(core, D11REGOFFS(tsf_cfpstart), 0);
++
++	w = bcma_read32(core, D11REGOFFS(maccontrol));
++	if ((w != (MCTL_IHR_EN | MCTL_WAKE)) &&
++	    (w != (MCTL_IHR_EN | MCTL_GMODE | MCTL_WAKE))) {
++		wiphy_err(wiphy, "wl%d: validate_chip_access: maccontrol = "
++			  "0x%x, expected 0x%x or 0x%x\n", wlc_hw->unit, w,
++			  (MCTL_IHR_EN | MCTL_WAKE),
++			  (MCTL_IHR_EN | MCTL_GMODE | MCTL_WAKE));
++		return false;
++	}
++
++	return true;
++}
++
++#define PHYPLL_WAIT_US	100000
++
++void brcms_b_core_phypll_ctl(struct brcms_hardware *wlc_hw, bool on)
++{
++	struct bcma_device *core = wlc_hw->d11core;
++	u32 tmp;
++
++	BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
++
++	tmp = 0;
++
++	if (on) {
++		if ((ai_get_chip_id(wlc_hw->sih) == BCM4313_CHIP_ID)) {
++			bcma_set32(core, D11REGOFFS(clk_ctl_st),
++				   CCS_ERSRC_REQ_HT |
++				   CCS_ERSRC_REQ_D11PLL |
++				   CCS_ERSRC_REQ_PHYPLL);
++			SPINWAIT((bcma_read32(core, D11REGOFFS(clk_ctl_st)) &
++				  CCS_ERSRC_AVAIL_HT) != CCS_ERSRC_AVAIL_HT,
++				 PHYPLL_WAIT_US);
++
++			tmp = bcma_read32(core, D11REGOFFS(clk_ctl_st));
++			if ((tmp & CCS_ERSRC_AVAIL_HT) != CCS_ERSRC_AVAIL_HT)
++				wiphy_err(wlc_hw->wlc->wiphy, "%s: turn on PHY"
++					  " PLL failed\n", __func__);
++		} else {
++			bcma_set32(core, D11REGOFFS(clk_ctl_st),
++				   tmp | CCS_ERSRC_REQ_D11PLL |
++				   CCS_ERSRC_REQ_PHYPLL);
++			SPINWAIT((bcma_read32(core, D11REGOFFS(clk_ctl_st)) &
++				  (CCS_ERSRC_AVAIL_D11PLL |
++				   CCS_ERSRC_AVAIL_PHYPLL)) !=
++				 (CCS_ERSRC_AVAIL_D11PLL |
++				  CCS_ERSRC_AVAIL_PHYPLL), PHYPLL_WAIT_US);
++
++			tmp = bcma_read32(core, D11REGOFFS(clk_ctl_st));
++			if ((tmp &
++			     (CCS_ERSRC_AVAIL_D11PLL | CCS_ERSRC_AVAIL_PHYPLL))
++			    !=
++			    (CCS_ERSRC_AVAIL_D11PLL | CCS_ERSRC_AVAIL_PHYPLL))
++				wiphy_err(wlc_hw->wlc->wiphy, "%s: turn on "
++					  "PHY PLL failed\n", __func__);
++		}
++	} else {
++		/*
++		 * Since the PLL may be shared, other cores can still
++		 * be requesting it; so we'll deassert the request but
++		 * not wait for status to comply.
++		 */
++		bcma_mask32(core, D11REGOFFS(clk_ctl_st),
++			    ~CCS_ERSRC_REQ_PHYPLL);
++		(void)bcma_read32(core, D11REGOFFS(clk_ctl_st));
++	}
++}
++
++static void brcms_c_coredisable(struct brcms_hardware *wlc_hw)
++{
++	bool dev_gone;
++
++	BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
++
++	dev_gone = brcms_deviceremoved(wlc_hw->wlc);
++
++	if (dev_gone)
++		return;
++
++	if (wlc_hw->noreset)
++		return;
++
++	/* radio off */
++	wlc_phy_switch_radio(wlc_hw->band->pi, OFF);
++
++	/* turn off analog core */
++	wlc_phy_anacore(wlc_hw->band->pi, OFF);
++
++	/* turn off PHYPLL to save power */
++	brcms_b_core_phypll_ctl(wlc_hw, false);
++
++	wlc_hw->clk = false;
++	bcma_core_disable(wlc_hw->d11core, 0);
++	wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, false);
++}
++
++static void brcms_c_flushqueues(struct brcms_c_info *wlc)
++{
++	struct brcms_hardware *wlc_hw = wlc->hw;
++	uint i;
++
++	/* free any posted tx packets */
++	for (i = 0; i < NFIFO; i++)
++		if (wlc_hw->di[i]) {
++			dma_txreclaim(wlc_hw->di[i], DMA_RANGE_ALL);
++			wlc->core->txpktpend[i] = 0;
++			BCMMSG(wlc->wiphy, "pktpend fifo %d clrd\n", i);
++		}
++
++	/* free any posted rx packets */
++	dma_rxreclaim(wlc_hw->di[RX_FIFO]);
++}
++
++static u16
++brcms_b_read_objmem(struct brcms_hardware *wlc_hw, uint offset, u32 sel)
++{
++	struct bcma_device *core = wlc_hw->d11core;
++	u16 objoff = D11REGOFFS(objdata);
++
++	bcma_write32(core, D11REGOFFS(objaddr), sel | (offset >> 2));
++	(void)bcma_read32(core, D11REGOFFS(objaddr));
++	if (offset & 2)
++		objoff += 2;
++
++	return bcma_read16(core, objoff);
++}
++
++static void
++brcms_b_write_objmem(struct brcms_hardware *wlc_hw, uint offset, u16 v,
++		     u32 sel)
++{
++	struct bcma_device *core = wlc_hw->d11core;
++	u16 objoff = D11REGOFFS(objdata);
++
++	bcma_write32(core, D11REGOFFS(objaddr), sel | (offset >> 2));
++	(void)bcma_read32(core, D11REGOFFS(objaddr));
++	if (offset & 2)
++		objoff += 2;
++
++	bcma_write16(core, objoff, v);
++}
++
++/*
++ * Read a single u16 from shared memory.
++ * SHM 'offset' needs to be an even address
++ */
++u16 brcms_b_read_shm(struct brcms_hardware *wlc_hw, uint offset)
++{
++	return brcms_b_read_objmem(wlc_hw, offset, OBJADDR_SHM_SEL);
++}
++
++/*
++ * Write a single u16 to shared memory.
++ * SHM 'offset' needs to be an even address
++ */
++void brcms_b_write_shm(struct brcms_hardware *wlc_hw, uint offset, u16 v)
++{
++	brcms_b_write_objmem(wlc_hw, offset, v, OBJADDR_SHM_SEL);
++}
++
++/*
++ * Copy a buffer to shared memory of specified type .
++ * SHM 'offset' needs to be an even address and
++ * Buffer length 'len' must be an even number of bytes
++ * 'sel' selects the type of memory
++ */
++void
++brcms_b_copyto_objmem(struct brcms_hardware *wlc_hw, uint offset,
++		      const void *buf, int len, u32 sel)
++{
++	u16 v;
++	const u8 *p = (const u8 *)buf;
++	int i;
++
++	if (len <= 0 || (offset & 1) || (len & 1))
++		return;
++
++	for (i = 0; i < len; i += 2) {
++		v = p[i] | (p[i + 1] << 8);
++		brcms_b_write_objmem(wlc_hw, offset + i, v, sel);
++	}
++}
++
++/*
++ * Copy a piece of shared memory of specified type to a buffer .
++ * SHM 'offset' needs to be an even address and
++ * Buffer length 'len' must be an even number of bytes
++ * 'sel' selects the type of memory
++ */
++void
++brcms_b_copyfrom_objmem(struct brcms_hardware *wlc_hw, uint offset, void *buf,
++			 int len, u32 sel)
++{
++	u16 v;
++	u8 *p = (u8 *) buf;
++	int i;
++
++	if (len <= 0 || (offset & 1) || (len & 1))
++		return;
++
++	for (i = 0; i < len; i += 2) {
++		v = brcms_b_read_objmem(wlc_hw, offset + i, sel);
++		p[i] = v & 0xFF;
++		p[i + 1] = (v >> 8) & 0xFF;
++	}
++}
++
++/* Copy a buffer to shared memory.
++ * SHM 'offset' needs to be an even address and
++ * Buffer length 'len' must be an even number of bytes
++ */
++static void brcms_c_copyto_shm(struct brcms_c_info *wlc, uint offset,
++			const void *buf, int len)
++{
++	brcms_b_copyto_objmem(wlc->hw, offset, buf, len, OBJADDR_SHM_SEL);
++}
++
++static void brcms_b_retrylimit_upd(struct brcms_hardware *wlc_hw,
++				   u16 SRL, u16 LRL)
++{
++	wlc_hw->SRL = SRL;
++	wlc_hw->LRL = LRL;
++
++	/* write retry limit to SCR, shouldn't need to suspend */
++	if (wlc_hw->up) {
++		bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
++			     OBJADDR_SCR_SEL | S_DOT11_SRC_LMT);
++		(void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
++		bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), wlc_hw->SRL);
++		bcma_write32(wlc_hw->d11core, D11REGOFFS(objaddr),
++			     OBJADDR_SCR_SEL | S_DOT11_LRC_LMT);
++		(void)bcma_read32(wlc_hw->d11core, D11REGOFFS(objaddr));
++		bcma_write32(wlc_hw->d11core, D11REGOFFS(objdata), wlc_hw->LRL);
++	}
++}
++
++static void brcms_b_pllreq(struct brcms_hardware *wlc_hw, bool set, u32 req_bit)
++{
++	if (set) {
++		if (mboolisset(wlc_hw->pllreq, req_bit))
++			return;
++
++		mboolset(wlc_hw->pllreq, req_bit);
++
++		if (mboolisset(wlc_hw->pllreq, BRCMS_PLLREQ_FLIP)) {
++			if (!wlc_hw->sbclk)
++				brcms_b_xtal(wlc_hw, ON);
++		}
++	} else {
++		if (!mboolisset(wlc_hw->pllreq, req_bit))
++			return;
++
++		mboolclr(wlc_hw->pllreq, req_bit);
++
++		if (mboolisset(wlc_hw->pllreq, BRCMS_PLLREQ_FLIP)) {
++			if (wlc_hw->sbclk)
++				brcms_b_xtal(wlc_hw, OFF);
++		}
++	}
++}
++
++static void brcms_b_antsel_set(struct brcms_hardware *wlc_hw, u32 antsel_avail)
++{
++	wlc_hw->antsel_avail = antsel_avail;
++}
++
++/*
++ * conditions under which the PM bit should be set in outgoing frames
++ * and STAY_AWAKE is meaningful
++ */
++static bool brcms_c_ps_allowed(struct brcms_c_info *wlc)
++{
++	struct brcms_bss_cfg *cfg = wlc->bsscfg;
++
++	/* disallow PS when one of the following global conditions meets */
++	if (!wlc->pub->associated)
++		return false;
++
++	/* disallow PS when one of these meets when not scanning */
++	if (wlc->filter_flags & FIF_PROMISC_IN_BSS)
++		return false;
++
++	if (cfg->associated) {
++		/*
++		 * disallow PS when one of the following
++		 * bsscfg specific conditions meets
++		 */
++		if (!cfg->BSS)
++			return false;
++
++		return false;
++	}
++
++	return true;
++}
++
++static void brcms_c_statsupd(struct brcms_c_info *wlc)
++{
++	int i;
++	struct macstat macstats;
++#ifdef DEBUG
++	u16 delta;
++	u16 rxf0ovfl;
++	u16 txfunfl[NFIFO];
++#endif				/* DEBUG */
++
++	/* if driver down, make no sense to update stats */
++	if (!wlc->pub->up)
++		return;
++
++#ifdef DEBUG
++	/* save last rx fifo 0 overflow count */
++	rxf0ovfl = wlc->core->macstat_snapshot->rxf0ovfl;
++
++	/* save last tx fifo  underflow count */
++	for (i = 0; i < NFIFO; i++)
++		txfunfl[i] = wlc->core->macstat_snapshot->txfunfl[i];
++#endif				/* DEBUG */
++
++	/* Read mac stats from contiguous shared memory */
++	brcms_b_copyfrom_objmem(wlc->hw, M_UCODE_MACSTAT, &macstats,
++				sizeof(struct macstat), OBJADDR_SHM_SEL);
++
++#ifdef DEBUG
++	/* check for rx fifo 0 overflow */
++	delta = (u16) (wlc->core->macstat_snapshot->rxf0ovfl - rxf0ovfl);
++	if (delta)
++		wiphy_err(wlc->wiphy, "wl%d: %u rx fifo 0 overflows!\n",
++			  wlc->pub->unit, delta);
++
++	/* check for tx fifo underflows */
++	for (i = 0; i < NFIFO; i++) {
++		delta =
++		    (u16) (wlc->core->macstat_snapshot->txfunfl[i] -
++			      txfunfl[i]);
++		if (delta)
++			wiphy_err(wlc->wiphy, "wl%d: %u tx fifo %d underflows!"
++				  "\n", wlc->pub->unit, delta, i);
++	}
++#endif				/* DEBUG */
++
++	/* merge counters from dma module */
++	for (i = 0; i < NFIFO; i++) {
++		if (wlc->hw->di[i])
++			dma_counterreset(wlc->hw->di[i]);
++	}
++}
++
++static void brcms_b_reset(struct brcms_hardware *wlc_hw)
++{
++	BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
++
++	/* reset the core */
++	if (!brcms_deviceremoved(wlc_hw->wlc))
++		brcms_b_corereset(wlc_hw, BRCMS_USE_COREFLAGS);
++
++	/* purge the dma rings */
++	brcms_c_flushqueues(wlc_hw->wlc);
++}
++
++void brcms_c_reset(struct brcms_c_info *wlc)
++{
++	BCMMSG(wlc->wiphy, "wl%d\n", wlc->pub->unit);
++
++	/* slurp up hw mac counters before core reset */
++	brcms_c_statsupd(wlc);
++
++	/* reset our snapshot of macstat counters */
++	memset((char *)wlc->core->macstat_snapshot, 0,
++		sizeof(struct macstat));
++
++	brcms_b_reset(wlc->hw);
++}
++
++/* Return the channel the driver should initialize during brcms_c_init.
++ * the channel may have to be changed from the currently configured channel
++ * if other configurations are in conflict (bandlocked, 11n mode disabled,
++ * invalid channel for current country, etc.)
++ */
++static u16 brcms_c_init_chanspec(struct brcms_c_info *wlc)
++{
++	u16 chanspec =
++	    1 | WL_CHANSPEC_BW_20 | WL_CHANSPEC_CTL_SB_NONE |
++	    WL_CHANSPEC_BAND_2G;
++
++	return chanspec;
++}
++
++void brcms_c_init_scb(struct scb *scb)
++{
++	int i;
++
++	memset(scb, 0, sizeof(struct scb));
++	scb->flags = SCB_WMECAP | SCB_HTCAP;
++	for (i = 0; i < NUMPRIO; i++) {
++		scb->seqnum[i] = 0;
++		scb->seqctl[i] = 0xFFFF;
++	}
++
++	scb->seqctl_nonqos = 0xFFFF;
++	scb->magic = SCB_MAGIC;
++}
++
++/* d11 core init
++ *   reset PSM
++ *   download ucode/PCM
++ *   let ucode run to suspended
++ *   download ucode inits
++ *   config other core registers
++ *   init dma
++ */
++static void brcms_b_coreinit(struct brcms_c_info *wlc)
++{
++	struct brcms_hardware *wlc_hw = wlc->hw;
++	struct bcma_device *core = wlc_hw->d11core;
++	u32 sflags;
++	u32 bcnint_us;
++	uint i = 0;
++	bool fifosz_fixup = false;
++	int err = 0;
++	u16 buf[NFIFO];
++	struct wiphy *wiphy = wlc->wiphy;
++	struct brcms_ucode *ucode = &wlc_hw->wlc->wl->ucode;
++
++	BCMMSG(wlc->wiphy, "wl%d\n", wlc_hw->unit);
++
++	/* reset PSM */
++	brcms_b_mctrl(wlc_hw, ~0, (MCTL_IHR_EN | MCTL_PSM_JMP_0 | MCTL_WAKE));
++
++	brcms_ucode_download(wlc_hw);
++	/*
++	 * FIFOSZ fixup. driver wants to controls the fifo allocation.
++	 */
++	fifosz_fixup = true;
++
++	/* let the PSM run to the suspended state, set mode to BSS STA */
++	bcma_write32(core, D11REGOFFS(macintstatus), -1);
++	brcms_b_mctrl(wlc_hw, ~0,
++		       (MCTL_IHR_EN | MCTL_INFRA | MCTL_PSM_RUN | MCTL_WAKE));
++
++	/* wait for ucode to self-suspend after auto-init */
++	SPINWAIT(((bcma_read32(core, D11REGOFFS(macintstatus)) &
++		   MI_MACSSPNDD) == 0), 1000 * 1000);
++	if ((bcma_read32(core, D11REGOFFS(macintstatus)) & MI_MACSSPNDD) == 0)
++		wiphy_err(wiphy, "wl%d: wlc_coreinit: ucode did not self-"
++			  "suspend!\n", wlc_hw->unit);
++
++	brcms_c_gpio_init(wlc);
++
++	sflags = bcma_aread32(core, BCMA_IOST);
++
++	if (D11REV_IS(wlc_hw->corerev, 23)) {
++		if (BRCMS_ISNPHY(wlc_hw->band))
++			brcms_c_write_inits(wlc_hw, ucode->d11n0initvals16);
++		else
++			wiphy_err(wiphy, "%s: wl%d: unsupported phy in corerev"
++				  " %d\n", __func__, wlc_hw->unit,
++				  wlc_hw->corerev);
++	} else if (D11REV_IS(wlc_hw->corerev, 24)) {
++		if (BRCMS_ISLCNPHY(wlc_hw->band))
++			brcms_c_write_inits(wlc_hw, ucode->d11lcn0initvals24);
++		else
++			wiphy_err(wiphy, "%s: wl%d: unsupported phy in corerev"
++				  " %d\n", __func__, wlc_hw->unit,
++				  wlc_hw->corerev);
++	} else {
++		wiphy_err(wiphy, "%s: wl%d: unsupported corerev %d\n",
++			  __func__, wlc_hw->unit, wlc_hw->corerev);
++	}
++
++	/* For old ucode, txfifo sizes needs to be modified(increased) */
++	if (fifosz_fixup)
++		brcms_b_corerev_fifofixup(wlc_hw);
++
++	/* check txfifo allocations match between ucode and driver */
++	buf[TX_AC_BE_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE0);
++	if (buf[TX_AC_BE_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_BE_FIFO]) {
++		i = TX_AC_BE_FIFO;
++		err = -1;
++	}
++	buf[TX_AC_VI_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE1);
++	if (buf[TX_AC_VI_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_VI_FIFO]) {
++		i = TX_AC_VI_FIFO;
++		err = -1;
++	}
++	buf[TX_AC_BK_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE2);
++	buf[TX_AC_VO_FIFO] = (buf[TX_AC_BK_FIFO] >> 8) & 0xff;
++	buf[TX_AC_BK_FIFO] &= 0xff;
++	if (buf[TX_AC_BK_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_BK_FIFO]) {
++		i = TX_AC_BK_FIFO;
++		err = -1;
++	}
++	if (buf[TX_AC_VO_FIFO] != wlc_hw->xmtfifo_sz[TX_AC_VO_FIFO]) {
++		i = TX_AC_VO_FIFO;
++		err = -1;
++	}
++	buf[TX_BCMC_FIFO] = brcms_b_read_shm(wlc_hw, M_FIFOSIZE3);
++	buf[TX_ATIM_FIFO] = (buf[TX_BCMC_FIFO] >> 8) & 0xff;
++	buf[TX_BCMC_FIFO] &= 0xff;
++	if (buf[TX_BCMC_FIFO] != wlc_hw->xmtfifo_sz[TX_BCMC_FIFO]) {
++		i = TX_BCMC_FIFO;
++		err = -1;
++	}
++	if (buf[TX_ATIM_FIFO] != wlc_hw->xmtfifo_sz[TX_ATIM_FIFO]) {
++		i = TX_ATIM_FIFO;
++		err = -1;
++	}
++	if (err != 0)
++		wiphy_err(wiphy, "wlc_coreinit: txfifo mismatch: ucode size %d"
++			  " driver size %d index %d\n", buf[i],
++			  wlc_hw->xmtfifo_sz[i], i);
++
++	/* make sure we can still talk to the mac */
++	WARN_ON(bcma_read32(core, D11REGOFFS(maccontrol)) == 0xffffffff);
++
++	/* band-specific inits done by wlc_bsinit() */
++
++	/* Set up frame burst size and antenna swap threshold init values */
++	brcms_b_write_shm(wlc_hw, M_MBURST_SIZE, MAXTXFRAMEBURST);
++	brcms_b_write_shm(wlc_hw, M_MAX_ANTCNT, ANTCNT);
++
++	/* enable one rx interrupt per received frame */
++	bcma_write32(core, D11REGOFFS(intrcvlazy[0]), (1 << IRL_FC_SHIFT));
++
++	/* set the station mode (BSS STA) */
++	brcms_b_mctrl(wlc_hw,
++		       (MCTL_INFRA | MCTL_DISCARD_PMQ | MCTL_AP),
++		       (MCTL_INFRA | MCTL_DISCARD_PMQ));
++
++	/* set up Beacon interval */
++	bcnint_us = 0x8000 << 10;
++	bcma_write32(core, D11REGOFFS(tsf_cfprep),
++		     (bcnint_us << CFPREP_CBI_SHIFT));
++	bcma_write32(core, D11REGOFFS(tsf_cfpstart), bcnint_us);
++	bcma_write32(core, D11REGOFFS(macintstatus), MI_GP1);
++
++	/* write interrupt mask */
++	bcma_write32(core, D11REGOFFS(intctrlregs[RX_FIFO].intmask),
++		     DEF_RXINTMASK);
++
++	/* allow the MAC to control the PHY clock (dynamic on/off) */
++	brcms_b_macphyclk_set(wlc_hw, ON);
++
++	/* program dynamic clock control fast powerup delay register */
++	wlc->fastpwrup_dly = ai_clkctl_fast_pwrup_delay(wlc_hw->sih);
++	bcma_write16(core, D11REGOFFS(scc_fastpwrup_dly), wlc->fastpwrup_dly);
++
++	/* tell the ucode the corerev */
++	brcms_b_write_shm(wlc_hw, M_MACHW_VER, (u16) wlc_hw->corerev);
++
++	/* tell the ucode MAC capabilities */
++	brcms_b_write_shm(wlc_hw, M_MACHW_CAP_L,
++			   (u16) (wlc_hw->machwcap & 0xffff));
++	brcms_b_write_shm(wlc_hw, M_MACHW_CAP_H,
++			   (u16) ((wlc_hw->
++				      machwcap >> 16) & 0xffff));
++
++	/* write retry limits to SCR, this done after PSM init */
++	bcma_write32(core, D11REGOFFS(objaddr),
++		     OBJADDR_SCR_SEL | S_DOT11_SRC_LMT);
++	(void)bcma_read32(core, D11REGOFFS(objaddr));
++	bcma_write32(core, D11REGOFFS(objdata), wlc_hw->SRL);
++	bcma_write32(core, D11REGOFFS(objaddr),
++		     OBJADDR_SCR_SEL | S_DOT11_LRC_LMT);
++	(void)bcma_read32(core, D11REGOFFS(objaddr));
++	bcma_write32(core, D11REGOFFS(objdata), wlc_hw->LRL);
++
++	/* write rate fallback retry limits */
++	brcms_b_write_shm(wlc_hw, M_SFRMTXCNTFBRTHSD, wlc_hw->SFBL);
++	brcms_b_write_shm(wlc_hw, M_LFRMTXCNTFBRTHSD, wlc_hw->LFBL);
++
++	bcma_mask16(core, D11REGOFFS(ifs_ctl), 0x0FFF);
++	bcma_write16(core, D11REGOFFS(ifs_aifsn), EDCF_AIFSN_MIN);
++
++	/* init the tx dma engines */
++	for (i = 0; i < NFIFO; i++) {
++		if (wlc_hw->di[i])
++			dma_txinit(wlc_hw->di[i]);
++	}
++
++	/* init the rx dma engine(s) and post receive buffers */
++	dma_rxinit(wlc_hw->di[RX_FIFO]);
++	dma_rxfill(wlc_hw->di[RX_FIFO]);
++}
++
++void
++static brcms_b_init(struct brcms_hardware *wlc_hw, u16 chanspec) {
++	u32 macintmask;
++	bool fastclk;
++	struct brcms_c_info *wlc = wlc_hw->wlc;
++
++	BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
++
++	/* request FAST clock if not on */
++	fastclk = wlc_hw->forcefastclk;
++	if (!fastclk)
++		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
++
++	/* disable interrupts */
++	macintmask = brcms_intrsoff(wlc->wl);
++
++	/* set up the specified band and chanspec */
++	brcms_c_setxband(wlc_hw, chspec_bandunit(chanspec));
++	wlc_phy_chanspec_radio_set(wlc_hw->band->pi, chanspec);
++
++	/* do one-time phy inits and calibration */
++	wlc_phy_cal_init(wlc_hw->band->pi);
++
++	/* core-specific initialization */
++	brcms_b_coreinit(wlc);
++
++	/* band-specific inits */
++	brcms_b_bsinit(wlc, chanspec);
++
++	/* restore macintmask */
++	brcms_intrsrestore(wlc->wl, macintmask);
++
++	/* seed wake_override with BRCMS_WAKE_OVERRIDE_MACSUSPEND since the mac
++	 * is suspended and brcms_c_enable_mac() will clear this override bit.
++	 */
++	mboolset(wlc_hw->wake_override, BRCMS_WAKE_OVERRIDE_MACSUSPEND);
++
++	/*
++	 * initialize mac_suspend_depth to 1 to match ucode
++	 * initial suspended state
++	 */
++	wlc_hw->mac_suspend_depth = 1;
++
++	/* restore the clk */
++	if (!fastclk)
++		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
++}
++
++static void brcms_c_set_phy_chanspec(struct brcms_c_info *wlc,
++				     u16 chanspec)
++{
++	/* Save our copy of the chanspec */
++	wlc->chanspec = chanspec;
++
++	/* Set the chanspec and power limits for this locale */
++	brcms_c_channel_set_chanspec(wlc->cmi, chanspec, BRCMS_TXPWR_MAX);
++
++	if (wlc->stf->ss_algosel_auto)
++		brcms_c_stf_ss_algo_channel_get(wlc, &wlc->stf->ss_algo_channel,
++					    chanspec);
++
++	brcms_c_stf_ss_update(wlc, wlc->band);
++}
++
++static void
++brcms_default_rateset(struct brcms_c_info *wlc, struct brcms_c_rateset *rs)
++{
++	brcms_c_rateset_default(rs, NULL, wlc->band->phytype,
++		wlc->band->bandtype, false, BRCMS_RATE_MASK_FULL,
++		(bool) (wlc->pub->_n_enab & SUPPORT_11N),
++		brcms_chspec_bw(wlc->default_bss->chanspec),
++		wlc->stf->txstreams);
++}
++
++/* derive wlc->band->basic_rate[] table from 'rateset' */
++static void brcms_c_rate_lookup_init(struct brcms_c_info *wlc,
++			      struct brcms_c_rateset *rateset)
++{
++	u8 rate;
++	u8 mandatory;
++	u8 cck_basic = 0;
++	u8 ofdm_basic = 0;
++	u8 *br = wlc->band->basic_rate;
++	uint i;
++
++	/* incoming rates are in 500kbps units as in 802.11 Supported Rates */
++	memset(br, 0, BRCM_MAXRATE + 1);
++
++	/* For each basic rate in the rates list, make an entry in the
++	 * best basic lookup.
++	 */
++	for (i = 0; i < rateset->count; i++) {
++		/* only make an entry for a basic rate */
++		if (!(rateset->rates[i] & BRCMS_RATE_FLAG))
++			continue;
++
++		/* mask off basic bit */
++		rate = (rateset->rates[i] & BRCMS_RATE_MASK);
++
++		if (rate > BRCM_MAXRATE) {
++			wiphy_err(wlc->wiphy, "brcms_c_rate_lookup_init: "
++				  "invalid rate 0x%X in rate set\n",
++				  rateset->rates[i]);
++			continue;
++		}
++
++		br[rate] = rate;
++	}
++
++	/* The rate lookup table now has non-zero entries for each
++	 * basic rate, equal to the basic rate: br[basicN] = basicN
++	 *
++	 * To look up the best basic rate corresponding to any
++	 * particular rate, code can use the basic_rate table
++	 * like this
++	 *
++	 * basic_rate = wlc->band->basic_rate[tx_rate]
++	 *
++	 * Make sure there is a best basic rate entry for
++	 * every rate by walking up the table from low rates
++	 * to high, filling in holes in the lookup table
++	 */
++
++	for (i = 0; i < wlc->band->hw_rateset.count; i++) {
++		rate = wlc->band->hw_rateset.rates[i];
++
++		if (br[rate] != 0) {
++			/* This rate is a basic rate.
++			 * Keep track of the best basic rate so far by
++			 * modulation type.
++			 */
++			if (is_ofdm_rate(rate))
++				ofdm_basic = rate;
++			else
++				cck_basic = rate;
++
++			continue;
++		}
++
++		/* This rate is not a basic rate so figure out the
++		 * best basic rate less than this rate and fill in
++		 * the hole in the table
++		 */
++
++		br[rate] = is_ofdm_rate(rate) ? ofdm_basic : cck_basic;
++
++		if (br[rate] != 0)
++			continue;
++
++		if (is_ofdm_rate(rate)) {
++			/*
++			 * In 11g and 11a, the OFDM mandatory rates
++			 * are 6, 12, and 24 Mbps
++			 */
++			if (rate >= BRCM_RATE_24M)
++				mandatory = BRCM_RATE_24M;
++			else if (rate >= BRCM_RATE_12M)
++				mandatory = BRCM_RATE_12M;
++			else
++				mandatory = BRCM_RATE_6M;
++		} else {
++			/* In 11b, all CCK rates are mandatory 1 - 11 Mbps */
++			mandatory = rate;
++		}
++
++		br[rate] = mandatory;
++	}
++}
++
++static void brcms_c_bandinit_ordered(struct brcms_c_info *wlc,
++				     u16 chanspec)
++{
++	struct brcms_c_rateset default_rateset;
++	uint parkband;
++	uint i, band_order[2];
++
++	BCMMSG(wlc->wiphy, "wl%d\n", wlc->pub->unit);
++	/*
++	 * We might have been bandlocked during down and the chip
++	 * power-cycled (hibernate). Figure out the right band to park on
++	 */
++	if (wlc->bandlocked || wlc->pub->_nbands == 1) {
++		/* updated in brcms_c_bandlock() */
++		parkband = wlc->band->bandunit;
++		band_order[0] = band_order[1] = parkband;
++	} else {
++		/* park on the band of the specified chanspec */
++		parkband = chspec_bandunit(chanspec);
++
++		/* order so that parkband initialize last */
++		band_order[0] = parkband ^ 1;
++		band_order[1] = parkband;
++	}
++
++	/* make each band operational, software state init */
++	for (i = 0; i < wlc->pub->_nbands; i++) {
++		uint j = band_order[i];
++
++		wlc->band = wlc->bandstate[j];
++
++		brcms_default_rateset(wlc, &default_rateset);
++
++		/* fill in hw_rate */
++		brcms_c_rateset_filter(&default_rateset, &wlc->band->hw_rateset,
++				   false, BRCMS_RATES_CCK_OFDM, BRCMS_RATE_MASK,
++				   (bool) (wlc->pub->_n_enab & SUPPORT_11N));
++
++		/* init basic rate lookup */
++		brcms_c_rate_lookup_init(wlc, &default_rateset);
++	}
++
++	/* sync up phy/radio chanspec */
++	brcms_c_set_phy_chanspec(wlc, chanspec);
++}
++
++/*
++ * Set or clear filtering related maccontrol bits based on
++ * specified filter flags
++ */
++void brcms_c_mac_promisc(struct brcms_c_info *wlc, uint filter_flags)
++{
++	u32 promisc_bits = 0;
++
++	wlc->filter_flags = filter_flags;
++
++	if (filter_flags & (FIF_PROMISC_IN_BSS | FIF_OTHER_BSS))
++		promisc_bits |= MCTL_PROMISC;
++
++	if (filter_flags & FIF_BCN_PRBRESP_PROMISC)
++		promisc_bits |= MCTL_BCNS_PROMISC;
++
++	if (filter_flags & FIF_FCSFAIL)
++		promisc_bits |= MCTL_KEEPBADFCS;
++
++	if (filter_flags & (FIF_CONTROL | FIF_PSPOLL))
++		promisc_bits |= MCTL_KEEPCONTROL;
++
++	brcms_b_mctrl(wlc->hw,
++		MCTL_PROMISC | MCTL_BCNS_PROMISC |
++		MCTL_KEEPCONTROL | MCTL_KEEPBADFCS,
++		promisc_bits);
++}
++
++/*
++ * ucode, hwmac update
++ *    Channel dependent updates for ucode and hw
++ */
++static void brcms_c_ucode_mac_upd(struct brcms_c_info *wlc)
++{
++	/* enable or disable any active IBSSs depending on whether or not
++	 * we are on the home channel
++	 */
++	if (wlc->home_chanspec == wlc_phy_chanspec_get(wlc->band->pi)) {
++		if (wlc->pub->associated) {
++			/*
++			 * BMAC_NOTE: This is something that should be fixed
++			 * in ucode inits. I think that the ucode inits set
++			 * up the bcn templates and shm values with a bogus
++			 * beacon. This should not be done in the inits. If
++			 * ucode needs to set up a beacon for testing, the
++			 * test routines should write it down, not expect the
++			 * inits to populate a bogus beacon.
++			 */
++			if (BRCMS_PHY_11N_CAP(wlc->band))
++				brcms_b_write_shm(wlc->hw,
++						M_BCN_TXTSF_OFFSET, 0);
++		}
++	} else {
++		/* disable an active IBSS if we are not on the home channel */
++	}
++}
++
++static void brcms_c_write_rate_shm(struct brcms_c_info *wlc, u8 rate,
++				   u8 basic_rate)
++{
++	u8 phy_rate, index;
++	u8 basic_phy_rate, basic_index;
++	u16 dir_table, basic_table;
++	u16 basic_ptr;
++
++	/* Shared memory address for the table we are reading */
++	dir_table = is_ofdm_rate(basic_rate) ? M_RT_DIRMAP_A : M_RT_DIRMAP_B;
++
++	/* Shared memory address for the table we are writing */
++	basic_table = is_ofdm_rate(rate) ? M_RT_BBRSMAP_A : M_RT_BBRSMAP_B;
++
++	/*
++	 * for a given rate, the LS-nibble of the PLCP SIGNAL field is
++	 * the index into the rate table.
++	 */
++	phy_rate = rate_info[rate] & BRCMS_RATE_MASK;
++	basic_phy_rate = rate_info[basic_rate] & BRCMS_RATE_MASK;
++	index = phy_rate & 0xf;
++	basic_index = basic_phy_rate & 0xf;
++
++	/* Find the SHM pointer to the ACK rate entry by looking in the
++	 * Direct-map Table
++	 */
++	basic_ptr = brcms_b_read_shm(wlc->hw, (dir_table + basic_index * 2));
++
++	/* Update the SHM BSS-basic-rate-set mapping table with the pointer
++	 * to the correct basic rate for the given incoming rate
++	 */
++	brcms_b_write_shm(wlc->hw, (basic_table + index * 2), basic_ptr);
++}
++
++static const struct brcms_c_rateset *
++brcms_c_rateset_get_hwrs(struct brcms_c_info *wlc)
++{
++	const struct brcms_c_rateset *rs_dflt;
++
++	if (BRCMS_PHY_11N_CAP(wlc->band)) {
++		if (wlc->band->bandtype == BRCM_BAND_5G)
++			rs_dflt = &ofdm_mimo_rates;
++		else
++			rs_dflt = &cck_ofdm_mimo_rates;
++	} else if (wlc->band->gmode)
++		rs_dflt = &cck_ofdm_rates;
++	else
++		rs_dflt = &cck_rates;
++
++	return rs_dflt;
++}
++
++static void brcms_c_set_ratetable(struct brcms_c_info *wlc)
++{
++	const struct brcms_c_rateset *rs_dflt;
++	struct brcms_c_rateset rs;
++	u8 rate, basic_rate;
++	uint i;
++
++	rs_dflt = brcms_c_rateset_get_hwrs(wlc);
++
++	brcms_c_rateset_copy(rs_dflt, &rs);
++	brcms_c_rateset_mcs_upd(&rs, wlc->stf->txstreams);
++
++	/* walk the phy rate table and update SHM basic rate lookup table */
++	for (i = 0; i < rs.count; i++) {
++		rate = rs.rates[i] & BRCMS_RATE_MASK;
++
++		/* for a given rate brcms_basic_rate returns the rate at
++		 * which a response ACK/CTS should be sent.
++		 */
++		basic_rate = brcms_basic_rate(wlc, rate);
++		if (basic_rate == 0)
++			/* This should only happen if we are using a
++			 * restricted rateset.
++			 */
++			basic_rate = rs.rates[0] & BRCMS_RATE_MASK;
++
++		brcms_c_write_rate_shm(wlc, rate, basic_rate);
++	}
++}
++
++/* band-specific init */
++static void brcms_c_bsinit(struct brcms_c_info *wlc)
++{
++	BCMMSG(wlc->wiphy, "wl%d: bandunit %d\n",
++		 wlc->pub->unit, wlc->band->bandunit);
++
++	/* write ucode ACK/CTS rate table */
++	brcms_c_set_ratetable(wlc);
++
++	/* update some band specific mac configuration */
++	brcms_c_ucode_mac_upd(wlc);
++
++	/* init antenna selection */
++	brcms_c_antsel_init(wlc->asi);
++
++}
++
++/* formula:  IDLE_BUSY_RATIO_X_16 = (100-duty_cycle)/duty_cycle*16 */
++static int
++brcms_c_duty_cycle_set(struct brcms_c_info *wlc, int duty_cycle, bool isOFDM,
++		   bool writeToShm)
++{
++	int idle_busy_ratio_x_16 = 0;
++	uint offset =
++	    isOFDM ? M_TX_IDLE_BUSY_RATIO_X_16_OFDM :
++	    M_TX_IDLE_BUSY_RATIO_X_16_CCK;
++	if (duty_cycle > 100 || duty_cycle < 0) {
++		wiphy_err(wlc->wiphy, "wl%d:  duty cycle value off limit\n",
++			  wlc->pub->unit);
++		return -EINVAL;
++	}
++	if (duty_cycle)
++		idle_busy_ratio_x_16 = (100 - duty_cycle) * 16 / duty_cycle;
++	/* Only write to shared memory  when wl is up */
++	if (writeToShm)
++		brcms_b_write_shm(wlc->hw, offset, (u16) idle_busy_ratio_x_16);
++
++	if (isOFDM)
++		wlc->tx_duty_cycle_ofdm = (u16) duty_cycle;
++	else
++		wlc->tx_duty_cycle_cck = (u16) duty_cycle;
++
++	return 0;
++}
++
++/*
++ * Initialize the base precedence map for dequeueing
++ * from txq based on WME settings
++ */
++static void brcms_c_tx_prec_map_init(struct brcms_c_info *wlc)
++{
++	wlc->tx_prec_map = BRCMS_PREC_BMP_ALL;
++	memset(wlc->fifo2prec_map, 0, NFIFO * sizeof(u16));
++
++	wlc->fifo2prec_map[TX_AC_BK_FIFO] = BRCMS_PREC_BMP_AC_BK;
++	wlc->fifo2prec_map[TX_AC_BE_FIFO] = BRCMS_PREC_BMP_AC_BE;
++	wlc->fifo2prec_map[TX_AC_VI_FIFO] = BRCMS_PREC_BMP_AC_VI;
++	wlc->fifo2prec_map[TX_AC_VO_FIFO] = BRCMS_PREC_BMP_AC_VO;
++}
++
++static void
++brcms_c_txflowcontrol_signal(struct brcms_c_info *wlc,
++			     struct brcms_txq_info *qi, bool on, int prio)
++{
++	/* transmit flowcontrol is not yet implemented */
++}
++
++static void brcms_c_txflowcontrol_reset(struct brcms_c_info *wlc)
++{
++	struct brcms_txq_info *qi;
++
++	for (qi = wlc->tx_queues; qi != NULL; qi = qi->next) {
++		if (qi->stopped) {
++			brcms_c_txflowcontrol_signal(wlc, qi, OFF, ALLPRIO);
++			qi->stopped = 0;
++		}
++	}
++}
++
++/* push sw hps and wake state through hardware */
++static void brcms_c_set_ps_ctrl(struct brcms_c_info *wlc)
++{
++	u32 v1, v2;
++	bool hps;
++	bool awake_before;
++
++	hps = brcms_c_ps_allowed(wlc);
++
++	BCMMSG(wlc->wiphy, "wl%d: hps %d\n", wlc->pub->unit, hps);
++
++	v1 = bcma_read32(wlc->hw->d11core, D11REGOFFS(maccontrol));
++	v2 = MCTL_WAKE;
++	if (hps)
++		v2 |= MCTL_HPS;
++
++	brcms_b_mctrl(wlc->hw, MCTL_WAKE | MCTL_HPS, v2);
++
++	awake_before = ((v1 & MCTL_WAKE) || ((v1 & MCTL_HPS) == 0));
++
++	if (!awake_before)
++		brcms_b_wait_for_wake(wlc->hw);
++}
++
++/*
++ * Write this BSS config's MAC address to core.
++ * Updates RXE match engine.
++ */
++static int brcms_c_set_mac(struct brcms_bss_cfg *bsscfg)
++{
++	int err = 0;
++	struct brcms_c_info *wlc = bsscfg->wlc;
++
++	/* enter the MAC addr into the RXE match registers */
++	brcms_c_set_addrmatch(wlc, RCM_MAC_OFFSET, bsscfg->cur_etheraddr);
++
++	brcms_c_ampdu_macaddr_upd(wlc);
++
++	return err;
++}
++
++/* Write the BSS config's BSSID address to core (set_bssid in d11procs.tcl).
++ * Updates RXE match engine.
++ */
++static void brcms_c_set_bssid(struct brcms_bss_cfg *bsscfg)
++{
++	/* we need to update BSSID in RXE match registers */
++	brcms_c_set_addrmatch(bsscfg->wlc, RCM_BSSID_OFFSET, bsscfg->BSSID);
++}
++
++static void brcms_b_set_shortslot(struct brcms_hardware *wlc_hw, bool shortslot)
++{
++	wlc_hw->shortslot = shortslot;
++
++	if (wlc_hw->band->bandtype == BRCM_BAND_2G && wlc_hw->up) {
++		brcms_c_suspend_mac_and_wait(wlc_hw->wlc);
++		brcms_b_update_slot_timing(wlc_hw, shortslot);
++		brcms_c_enable_mac(wlc_hw->wlc);
++	}
++}
++
++/*
++ * Suspend the the MAC and update the slot timing
++ * for standard 11b/g (20us slots) or shortslot 11g (9us slots).
++ */
++static void brcms_c_switch_shortslot(struct brcms_c_info *wlc, bool shortslot)
++{
++	/* use the override if it is set */
++	if (wlc->shortslot_override != BRCMS_SHORTSLOT_AUTO)
++		shortslot = (wlc->shortslot_override == BRCMS_SHORTSLOT_ON);
++
++	if (wlc->shortslot == shortslot)
++		return;
++
++	wlc->shortslot = shortslot;
++
++	brcms_b_set_shortslot(wlc->hw, shortslot);
++}
++
++static void brcms_c_set_home_chanspec(struct brcms_c_info *wlc, u16 chanspec)
++{
++	if (wlc->home_chanspec != chanspec) {
++		wlc->home_chanspec = chanspec;
++
++		if (wlc->bsscfg->associated)
++			wlc->bsscfg->current_bss->chanspec = chanspec;
++	}
++}
++
++void
++brcms_b_set_chanspec(struct brcms_hardware *wlc_hw, u16 chanspec,
++		      bool mute_tx, struct txpwr_limits *txpwr)
++{
++	uint bandunit;
++
++	BCMMSG(wlc_hw->wlc->wiphy, "wl%d: 0x%x\n", wlc_hw->unit, chanspec);
++
++	wlc_hw->chanspec = chanspec;
++
++	/* Switch bands if necessary */
++	if (wlc_hw->_nbands > 1) {
++		bandunit = chspec_bandunit(chanspec);
++		if (wlc_hw->band->bandunit != bandunit) {
++			/* brcms_b_setband disables other bandunit,
++			 *  use light band switch if not up yet
++			 */
++			if (wlc_hw->up) {
++				wlc_phy_chanspec_radio_set(wlc_hw->
++							   bandstate[bandunit]->
++							   pi, chanspec);
++				brcms_b_setband(wlc_hw, bandunit, chanspec);
++			} else {
++				brcms_c_setxband(wlc_hw, bandunit);
++			}
++		}
++	}
++
++	wlc_phy_initcal_enable(wlc_hw->band->pi, !mute_tx);
++
++	if (!wlc_hw->up) {
++		if (wlc_hw->clk)
++			wlc_phy_txpower_limit_set(wlc_hw->band->pi, txpwr,
++						  chanspec);
++		wlc_phy_chanspec_radio_set(wlc_hw->band->pi, chanspec);
++	} else {
++		wlc_phy_chanspec_set(wlc_hw->band->pi, chanspec);
++		wlc_phy_txpower_limit_set(wlc_hw->band->pi, txpwr, chanspec);
++
++		/* Update muting of the channel */
++		brcms_b_mute(wlc_hw, mute_tx);
++	}
++}
++
++/* switch to and initialize new band */
++static void brcms_c_setband(struct brcms_c_info *wlc,
++					   uint bandunit)
++{
++	wlc->band = wlc->bandstate[bandunit];
++
++	if (!wlc->pub->up)
++		return;
++
++	/* wait for at least one beacon before entering sleeping state */
++	brcms_c_set_ps_ctrl(wlc);
++
++	/* band-specific initializations */
++	brcms_c_bsinit(wlc);
++}
++
++static void brcms_c_set_chanspec(struct brcms_c_info *wlc, u16 chanspec)
++{
++	uint bandunit;
++	bool switchband = false;
++	u16 old_chanspec = wlc->chanspec;
++
++	if (!brcms_c_valid_chanspec_db(wlc->cmi, chanspec)) {
++		wiphy_err(wlc->wiphy, "wl%d: %s: Bad channel %d\n",
++			  wlc->pub->unit, __func__, CHSPEC_CHANNEL(chanspec));
++		return;
++	}
++
++	/* Switch bands if necessary */
++	if (wlc->pub->_nbands > 1) {
++		bandunit = chspec_bandunit(chanspec);
++		if (wlc->band->bandunit != bandunit || wlc->bandinit_pending) {
++			switchband = true;
++			if (wlc->bandlocked) {
++				wiphy_err(wlc->wiphy, "wl%d: %s: chspec %d "
++					  "band is locked!\n",
++					  wlc->pub->unit, __func__,
++					  CHSPEC_CHANNEL(chanspec));
++				return;
++			}
++			/*
++			 * should the setband call come after the
++			 * brcms_b_chanspec() ? if the setband updates
++			 * (brcms_c_bsinit) use low level calls to inspect and
++			 * set state, the state inspected may be from the wrong
++			 * band, or the following brcms_b_set_chanspec() may
++			 * undo the work.
++			 */
++			brcms_c_setband(wlc, bandunit);
++		}
++	}
++
++	/* sync up phy/radio chanspec */
++	brcms_c_set_phy_chanspec(wlc, chanspec);
++
++	/* init antenna selection */
++	if (brcms_chspec_bw(old_chanspec) != brcms_chspec_bw(chanspec)) {
++		brcms_c_antsel_init(wlc->asi);
++
++		/* Fix the hardware rateset based on bw.
++		 * Mainly add MCS32 for 40Mhz, remove MCS 32 for 20Mhz
++		 */
++		brcms_c_rateset_bw_mcs_filter(&wlc->band->hw_rateset,
++			wlc->band->mimo_cap_40 ? brcms_chspec_bw(chanspec) : 0);
++	}
++
++	/* update some mac configuration since chanspec changed */
++	brcms_c_ucode_mac_upd(wlc);
++}
++
++/*
++ * This function changes the phytxctl for beacon based on current
++ * beacon ratespec AND txant setting as per this table:
++ *  ratespec     CCK		ant = wlc->stf->txant
++ *		OFDM		ant = 3
++ */
++void brcms_c_beacon_phytxctl_txant_upd(struct brcms_c_info *wlc,
++				       u32 bcn_rspec)
++{
++	u16 phyctl;
++	u16 phytxant = wlc->stf->phytxant;
++	u16 mask = PHY_TXC_ANT_MASK;
++
++	/* for non-siso rates or default setting, use the available chains */
++	if (BRCMS_PHY_11N_CAP(wlc->band))
++		phytxant = brcms_c_stf_phytxchain_sel(wlc, bcn_rspec);
++
++	phyctl = brcms_b_read_shm(wlc->hw, M_BCN_PCTLWD);
++	phyctl = (phyctl & ~mask) | phytxant;
++	brcms_b_write_shm(wlc->hw, M_BCN_PCTLWD, phyctl);
++}
++
++/*
++ * centralized protection config change function to simplify debugging, no
++ * consistency checking this should be called only on changes to avoid overhead
++ * in periodic function
++ */
++void brcms_c_protection_upd(struct brcms_c_info *wlc, uint idx, int val)
++{
++	BCMMSG(wlc->wiphy, "idx %d, val %d\n", idx, val);
++
++	switch (idx) {
++	case BRCMS_PROT_G_SPEC:
++		wlc->protection->_g = (bool) val;
++		break;
++	case BRCMS_PROT_G_OVR:
++		wlc->protection->g_override = (s8) val;
++		break;
++	case BRCMS_PROT_G_USER:
++		wlc->protection->gmode_user = (u8) val;
++		break;
++	case BRCMS_PROT_OVERLAP:
++		wlc->protection->overlap = (s8) val;
++		break;
++	case BRCMS_PROT_N_USER:
++		wlc->protection->nmode_user = (s8) val;
++		break;
++	case BRCMS_PROT_N_CFG:
++		wlc->protection->n_cfg = (s8) val;
++		break;
++	case BRCMS_PROT_N_CFG_OVR:
++		wlc->protection->n_cfg_override = (s8) val;
++		break;
++	case BRCMS_PROT_N_NONGF:
++		wlc->protection->nongf = (bool) val;
++		break;
++	case BRCMS_PROT_N_NONGF_OVR:
++		wlc->protection->nongf_override = (s8) val;
++		break;
++	case BRCMS_PROT_N_PAM_OVR:
++		wlc->protection->n_pam_override = (s8) val;
++		break;
++	case BRCMS_PROT_N_OBSS:
++		wlc->protection->n_obss = (bool) val;
++		break;
++
++	default:
++		break;
++	}
++
++}
++
++static void brcms_c_ht_update_sgi_rx(struct brcms_c_info *wlc, int val)
++{
++	if (wlc->pub->up) {
++		brcms_c_update_beacon(wlc);
++		brcms_c_update_probe_resp(wlc, true);
++	}
++}
++
++static void brcms_c_ht_update_ldpc(struct brcms_c_info *wlc, s8 val)
++{
++	wlc->stf->ldpc = val;
++
++	if (wlc->pub->up) {
++		brcms_c_update_beacon(wlc);
++		brcms_c_update_probe_resp(wlc, true);
++		wlc_phy_ldpc_override_set(wlc->band->pi, (val ? true : false));
++	}
++}
++
++void brcms_c_wme_setparams(struct brcms_c_info *wlc, u16 aci,
++		       const struct ieee80211_tx_queue_params *params,
++		       bool suspend)
++{
++	int i;
++	struct shm_acparams acp_shm;
++	u16 *shm_entry;
++
++	/* Only apply params if the core is out of reset and has clocks */
++	if (!wlc->clk) {
++		wiphy_err(wlc->wiphy, "wl%d: %s : no-clock\n", wlc->pub->unit,
++			  __func__);
++		return;
++	}
++
++	memset((char *)&acp_shm, 0, sizeof(struct shm_acparams));
++	/* fill in shm ac params struct */
++	acp_shm.txop = params->txop;
++	/* convert from units of 32us to us for ucode */
++	wlc->edcf_txop[aci & 0x3] = acp_shm.txop =
++	    EDCF_TXOP2USEC(acp_shm.txop);
++	acp_shm.aifs = (params->aifs & EDCF_AIFSN_MASK);
++
++	if (aci == IEEE80211_AC_VI && acp_shm.txop == 0
++	    && acp_shm.aifs < EDCF_AIFSN_MAX)
++		acp_shm.aifs++;
++
++	if (acp_shm.aifs < EDCF_AIFSN_MIN
++	    || acp_shm.aifs > EDCF_AIFSN_MAX) {
++		wiphy_err(wlc->wiphy, "wl%d: edcf_setparams: bad "
++			  "aifs %d\n", wlc->pub->unit, acp_shm.aifs);
++	} else {
++		acp_shm.cwmin = params->cw_min;
++		acp_shm.cwmax = params->cw_max;
++		acp_shm.cwcur = acp_shm.cwmin;
++		acp_shm.bslots =
++			bcma_read16(wlc->hw->d11core, D11REGOFFS(tsf_random)) &
++			acp_shm.cwcur;
++		acp_shm.reggap = acp_shm.bslots + acp_shm.aifs;
++		/* Indicate the new params to the ucode */
++		acp_shm.status = brcms_b_read_shm(wlc->hw, (M_EDCF_QINFO +
++						  wme_ac2fifo[aci] *
++						  M_EDCF_QLEN +
++						  M_EDCF_STATUS_OFF));
++		acp_shm.status |= WME_STATUS_NEWAC;
++
++		/* Fill in shm acparam table */
++		shm_entry = (u16 *) &acp_shm;
++		for (i = 0; i < (int)sizeof(struct shm_acparams); i += 2)
++			brcms_b_write_shm(wlc->hw,
++					  M_EDCF_QINFO +
++					  wme_ac2fifo[aci] * M_EDCF_QLEN + i,
++					  *shm_entry++);
++	}
++
++	if (suspend) {
++		brcms_c_suspend_mac_and_wait(wlc);
++		brcms_c_enable_mac(wlc);
++	}
++}
++
++static void brcms_c_edcf_setparams(struct brcms_c_info *wlc, bool suspend)
++{
++	u16 aci;
++	int i_ac;
++	struct ieee80211_tx_queue_params txq_pars;
++	static const struct edcf_acparam default_edcf_acparams[] = {
++		 {EDCF_AC_BE_ACI_STA, EDCF_AC_BE_ECW_STA, EDCF_AC_BE_TXOP_STA},
++		 {EDCF_AC_BK_ACI_STA, EDCF_AC_BK_ECW_STA, EDCF_AC_BK_TXOP_STA},
++		 {EDCF_AC_VI_ACI_STA, EDCF_AC_VI_ECW_STA, EDCF_AC_VI_TXOP_STA},
++		 {EDCF_AC_VO_ACI_STA, EDCF_AC_VO_ECW_STA, EDCF_AC_VO_TXOP_STA}
++	}; /* ucode needs these parameters during its initialization */
++	const struct edcf_acparam *edcf_acp = &default_edcf_acparams[0];
++
++	for (i_ac = 0; i_ac < IEEE80211_NUM_ACS; i_ac++, edcf_acp++) {
++		/* find out which ac this set of params applies to */
++		aci = (edcf_acp->ACI & EDCF_ACI_MASK) >> EDCF_ACI_SHIFT;
++
++		/* fill in shm ac params struct */
++		txq_pars.txop = edcf_acp->TXOP;
++		txq_pars.aifs = edcf_acp->ACI;
++
++		/* CWmin = 2^(ECWmin) - 1 */
++		txq_pars.cw_min = EDCF_ECW2CW(edcf_acp->ECW & EDCF_ECWMIN_MASK);
++		/* CWmax = 2^(ECWmax) - 1 */
++		txq_pars.cw_max = EDCF_ECW2CW((edcf_acp->ECW & EDCF_ECWMAX_MASK)
++					    >> EDCF_ECWMAX_SHIFT);
++		brcms_c_wme_setparams(wlc, aci, &txq_pars, suspend);
++	}
++
++	if (suspend) {
++		brcms_c_suspend_mac_and_wait(wlc);
++		brcms_c_enable_mac(wlc);
++	}
++}
++
++static void brcms_c_radio_monitor_start(struct brcms_c_info *wlc)
++{
++	/* Don't start the timer if HWRADIO feature is disabled */
++	if (wlc->radio_monitor)
++		return;
++
++	wlc->radio_monitor = true;
++	brcms_b_pllreq(wlc->hw, true, BRCMS_PLLREQ_RADIO_MON);
++	brcms_add_timer(wlc->radio_timer, TIMER_INTERVAL_RADIOCHK, true);
++}
++
++static bool brcms_c_radio_monitor_stop(struct brcms_c_info *wlc)
++{
++	if (!wlc->radio_monitor)
++		return true;
++
++	wlc->radio_monitor = false;
++	brcms_b_pllreq(wlc->hw, false, BRCMS_PLLREQ_RADIO_MON);
++	return brcms_del_timer(wlc->radio_timer);
++}
++
++/* read hwdisable state and propagate to wlc flag */
++static void brcms_c_radio_hwdisable_upd(struct brcms_c_info *wlc)
++{
++	if (wlc->pub->hw_off)
++		return;
++
++	if (brcms_b_radio_read_hwdisabled(wlc->hw))
++		mboolset(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE);
++	else
++		mboolclr(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE);
++}
++
++/* update hwradio status and return it */
++bool brcms_c_check_radio_disabled(struct brcms_c_info *wlc)
++{
++	brcms_c_radio_hwdisable_upd(wlc);
++
++	return mboolisset(wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE) ?
++			true : false;
++}
++
++/* periodical query hw radio button while driver is "down" */
++static void brcms_c_radio_timer(void *arg)
++{
++	struct brcms_c_info *wlc = (struct brcms_c_info *) arg;
++
++	if (brcms_deviceremoved(wlc)) {
++		wiphy_err(wlc->wiphy, "wl%d: %s: dead chip\n", wlc->pub->unit,
++			__func__);
++		brcms_down(wlc->wl);
++		return;
++	}
++
++	brcms_c_radio_hwdisable_upd(wlc);
++}
++
++/* common low-level watchdog code */
++static void brcms_b_watchdog(void *arg)
++{
++	struct brcms_c_info *wlc = (struct brcms_c_info *) arg;
++	struct brcms_hardware *wlc_hw = wlc->hw;
++
++	BCMMSG(wlc->wiphy, "wl%d\n", wlc_hw->unit);
++
++	if (!wlc_hw->up)
++		return;
++
++	/* increment second count */
++	wlc_hw->now++;
++
++	/* Check for FIFO error interrupts */
++	brcms_b_fifoerrors(wlc_hw);
++
++	/* make sure RX dma has buffers */
++	dma_rxfill(wlc->hw->di[RX_FIFO]);
++
++	wlc_phy_watchdog(wlc_hw->band->pi);
++}
++
++/* common watchdog code */
++static void brcms_c_watchdog(void *arg)
++{
++	struct brcms_c_info *wlc = (struct brcms_c_info *) arg;
++
++	BCMMSG(wlc->wiphy, "wl%d\n", wlc->pub->unit);
++
++	if (!wlc->pub->up)
++		return;
++
++	if (brcms_deviceremoved(wlc)) {
++		wiphy_err(wlc->wiphy, "wl%d: %s: dead chip\n", wlc->pub->unit,
++			  __func__);
++		brcms_down(wlc->wl);
++		return;
++	}
++
++	/* increment second count */
++	wlc->pub->now++;
++
++	brcms_c_radio_hwdisable_upd(wlc);
++	/* if radio is disable, driver may be down, quit here */
++	if (wlc->pub->radio_disabled)
++		return;
++
++	brcms_b_watchdog(wlc);
++
++	/*
++	 * occasionally sample mac stat counters to
++	 * detect 16-bit counter wrap
++	 */
++	if ((wlc->pub->now % SW_TIMER_MAC_STAT_UPD) == 0)
++		brcms_c_statsupd(wlc);
++
++	if (BRCMS_ISNPHY(wlc->band) &&
++	    ((wlc->pub->now - wlc->tempsense_lasttime) >=
++	     BRCMS_TEMPSENSE_PERIOD)) {
++		wlc->tempsense_lasttime = wlc->pub->now;
++		brcms_c_tempsense_upd(wlc);
++	}
++}
++
++static void brcms_c_watchdog_by_timer(void *arg)
++{
++	brcms_c_watchdog(arg);
++}
++
++static bool brcms_c_timers_init(struct brcms_c_info *wlc, int unit)
++{
++	wlc->wdtimer = brcms_init_timer(wlc->wl, brcms_c_watchdog_by_timer,
++		wlc, "watchdog");
++	if (!wlc->wdtimer) {
++		wiphy_err(wlc->wiphy, "wl%d:  wl_init_timer for wdtimer "
++			  "failed\n", unit);
++		goto fail;
++	}
++
++	wlc->radio_timer = brcms_init_timer(wlc->wl, brcms_c_radio_timer,
++		wlc, "radio");
++	if (!wlc->radio_timer) {
++		wiphy_err(wlc->wiphy, "wl%d:  wl_init_timer for radio_timer "
++			  "failed\n", unit);
++		goto fail;
++	}
++
++	return true;
++
++ fail:
++	return false;
++}
++
++/*
++ * Initialize brcms_c_info default values ...
++ * may get overrides later in this function
++ */
++static void brcms_c_info_init(struct brcms_c_info *wlc, int unit)
++{
++	int i;
++
++	/* Save our copy of the chanspec */
++	wlc->chanspec = ch20mhz_chspec(1);
++
++	/* various 802.11g modes */
++	wlc->shortslot = false;
++	wlc->shortslot_override = BRCMS_SHORTSLOT_AUTO;
++
++	brcms_c_protection_upd(wlc, BRCMS_PROT_G_OVR, BRCMS_PROTECTION_AUTO);
++	brcms_c_protection_upd(wlc, BRCMS_PROT_G_SPEC, false);
++
++	brcms_c_protection_upd(wlc, BRCMS_PROT_N_CFG_OVR,
++			       BRCMS_PROTECTION_AUTO);
++	brcms_c_protection_upd(wlc, BRCMS_PROT_N_CFG, BRCMS_N_PROTECTION_OFF);
++	brcms_c_protection_upd(wlc, BRCMS_PROT_N_NONGF_OVR,
++			       BRCMS_PROTECTION_AUTO);
++	brcms_c_protection_upd(wlc, BRCMS_PROT_N_NONGF, false);
++	brcms_c_protection_upd(wlc, BRCMS_PROT_N_PAM_OVR, AUTO);
++
++	brcms_c_protection_upd(wlc, BRCMS_PROT_OVERLAP,
++			       BRCMS_PROTECTION_CTL_OVERLAP);
++
++	/* 802.11g draft 4.0 NonERP elt advertisement */
++	wlc->include_legacy_erp = true;
++
++	wlc->stf->ant_rx_ovr = ANT_RX_DIV_DEF;
++	wlc->stf->txant = ANT_TX_DEF;
++
++	wlc->prb_resp_timeout = BRCMS_PRB_RESP_TIMEOUT;
++
++	wlc->usr_fragthresh = DOT11_DEFAULT_FRAG_LEN;
++	for (i = 0; i < NFIFO; i++)
++		wlc->fragthresh[i] = DOT11_DEFAULT_FRAG_LEN;
++	wlc->RTSThresh = DOT11_DEFAULT_RTS_LEN;
++
++	/* default rate fallback retry limits */
++	wlc->SFBL = RETRY_SHORT_FB;
++	wlc->LFBL = RETRY_LONG_FB;
++
++	/* default mac retry limits */
++	wlc->SRL = RETRY_SHORT_DEF;
++	wlc->LRL = RETRY_LONG_DEF;
++
++	/* WME QoS mode is Auto by default */
++	wlc->pub->_ampdu = AMPDU_AGG_HOST;
++	wlc->pub->bcmerror = 0;
++}
++
++static uint brcms_c_attach_module(struct brcms_c_info *wlc)
++{
++	uint err = 0;
++	uint unit;
++	unit = wlc->pub->unit;
++
++	wlc->asi = brcms_c_antsel_attach(wlc);
++	if (wlc->asi == NULL) {
++		wiphy_err(wlc->wiphy, "wl%d: attach: antsel_attach "
++			  "failed\n", unit);
++		err = 44;
++		goto fail;
++	}
++
++	wlc->ampdu = brcms_c_ampdu_attach(wlc);
++	if (wlc->ampdu == NULL) {
++		wiphy_err(wlc->wiphy, "wl%d: attach: ampdu_attach "
++			  "failed\n", unit);
++		err = 50;
++		goto fail;
++	}
++
++	if ((brcms_c_stf_attach(wlc) != 0)) {
++		wiphy_err(wlc->wiphy, "wl%d: attach: stf_attach "
++			  "failed\n", unit);
++		err = 68;
++		goto fail;
++	}
++ fail:
++	return err;
++}
++
++struct brcms_pub *brcms_c_pub(struct brcms_c_info *wlc)
++{
++	return wlc->pub;
++}
++
++/* low level attach
++ *    run backplane attach, init nvram
++ *    run phy attach
++ *    initialize software state for each core and band
++ *    put the whole chip in reset(driver down state), no clock
++ */
++static int brcms_b_attach(struct brcms_c_info *wlc, struct bcma_device *core,
++			  uint unit, bool piomode)
++{
++	struct brcms_hardware *wlc_hw;
++	uint err = 0;
++	uint j;
++	bool wme = false;
++	struct shared_phy_params sha_params;
++	struct wiphy *wiphy = wlc->wiphy;
++	struct pci_dev *pcidev = core->bus->host_pci;
++	struct ssb_sprom *sprom = &core->bus->sprom;
++
++	if (core->bus->hosttype == BCMA_HOSTTYPE_PCI)
++		BCMMSG(wlc->wiphy, "wl%d: vendor 0x%x device 0x%x\n", unit,
++		       pcidev->vendor,
++		       pcidev->device);
++	else
++		BCMMSG(wlc->wiphy, "wl%d: vendor 0x%x device 0x%x\n", unit,
++		       core->bus->boardinfo.vendor,
++		       core->bus->boardinfo.type);
++
++	wme = true;
++
++	wlc_hw = wlc->hw;
++	wlc_hw->wlc = wlc;
++	wlc_hw->unit = unit;
++	wlc_hw->band = wlc_hw->bandstate[0];
++	wlc_hw->_piomode = piomode;
++
++	/* populate struct brcms_hardware with default values  */
++	brcms_b_info_init(wlc_hw);
++
++	/*
++	 * Do the hardware portion of the attach. Also initialize software
++	 * state that depends on the particular hardware we are running.
++	 */
++	wlc_hw->sih = ai_attach(core->bus);
++	if (wlc_hw->sih == NULL) {
++		wiphy_err(wiphy, "wl%d: brcms_b_attach: si_attach failed\n",
++			  unit);
++		err = 11;
++		goto fail;
++	}
++
++	/* verify again the device is supported */
++	if (core->bus->hosttype == BCMA_HOSTTYPE_PCI &&
++	    !brcms_c_chipmatch(pcidev->vendor, pcidev->device)) {
++		wiphy_err(wiphy, "wl%d: brcms_b_attach: Unsupported "
++			"vendor/device (0x%x/0x%x)\n",
++			 unit, pcidev->vendor, pcidev->device);
++		err = 12;
++		goto fail;
++	}
++
++	if (core->bus->hosttype == BCMA_HOSTTYPE_PCI) {
++		wlc_hw->vendorid = pcidev->vendor;
++		wlc_hw->deviceid = pcidev->device;
++	} else {
++		wlc_hw->vendorid = core->bus->boardinfo.vendor;
++		wlc_hw->deviceid = core->bus->boardinfo.type;
++	}
++
++	wlc_hw->d11core = core;
++	wlc_hw->corerev = core->id.rev;
++
++	/* validate chip, chiprev and corerev */
++	if (!brcms_c_isgoodchip(wlc_hw)) {
++		err = 13;
++		goto fail;
++	}
++
++	/* initialize power control registers */
++	ai_clkctl_init(wlc_hw->sih);
++
++	/* request fastclock and force fastclock for the rest of attach
++	 * bring the d11 core out of reset.
++	 *   For PMU chips, the first wlc_clkctl_clk is no-op since core-clk
++	 *   is still false; But it will be called again inside wlc_corereset,
++	 *   after d11 is out of reset.
++	 */
++	brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
++	brcms_b_corereset(wlc_hw, BRCMS_USE_COREFLAGS);
++
++	if (!brcms_b_validate_chip_access(wlc_hw)) {
++		wiphy_err(wiphy, "wl%d: brcms_b_attach: validate_chip_access "
++			"failed\n", unit);
++		err = 14;
++		goto fail;
++	}
++
++	/* get the board rev, used just below */
++	j = sprom->board_rev;
++	/* promote srom boardrev of 0xFF to 1 */
++	if (j == BOARDREV_PROMOTABLE)
++		j = BOARDREV_PROMOTED;
++	wlc_hw->boardrev = (u16) j;
++	if (!brcms_c_validboardtype(wlc_hw)) {
++		wiphy_err(wiphy, "wl%d: brcms_b_attach: Unsupported Broadcom "
++			  "board type (0x%x)" " or revision level (0x%x)\n",
++			  unit, ai_get_boardtype(wlc_hw->sih),
++			  wlc_hw->boardrev);
++		err = 15;
++		goto fail;
++	}
++	wlc_hw->sromrev = sprom->revision;
++	wlc_hw->boardflags = sprom->boardflags_lo + (sprom->boardflags_hi << 16);
++	wlc_hw->boardflags2 = sprom->boardflags2_lo + (sprom->boardflags2_hi << 16);
++
++	if (wlc_hw->boardflags & BFL_NOPLLDOWN)
++		brcms_b_pllreq(wlc_hw, true, BRCMS_PLLREQ_SHARED);
++
++	/* check device id(srom, nvram etc.) to set bands */
++	if (wlc_hw->deviceid == BCM43224_D11N_ID ||
++	    wlc_hw->deviceid == BCM43224_D11N_ID_VEN1)
++		/* Dualband boards */
++		wlc_hw->_nbands = 2;
++	else
++		wlc_hw->_nbands = 1;
++
++	if ((ai_get_chip_id(wlc_hw->sih) == BCM43225_CHIP_ID))
++		wlc_hw->_nbands = 1;
++
++	/* BMAC_NOTE: remove init of pub values when brcms_c_attach()
++	 * unconditionally does the init of these values
++	 */
++	wlc->vendorid = wlc_hw->vendorid;
++	wlc->deviceid = wlc_hw->deviceid;
++	wlc->pub->sih = wlc_hw->sih;
++	wlc->pub->corerev = wlc_hw->corerev;
++	wlc->pub->sromrev = wlc_hw->sromrev;
++	wlc->pub->boardrev = wlc_hw->boardrev;
++	wlc->pub->boardflags = wlc_hw->boardflags;
++	wlc->pub->boardflags2 = wlc_hw->boardflags2;
++	wlc->pub->_nbands = wlc_hw->_nbands;
++
++	wlc_hw->physhim = wlc_phy_shim_attach(wlc_hw, wlc->wl, wlc);
++
++	if (wlc_hw->physhim == NULL) {
++		wiphy_err(wiphy, "wl%d: brcms_b_attach: wlc_phy_shim_attach "
++			"failed\n", unit);
++		err = 25;
++		goto fail;
++	}
++
++	/* pass all the parameters to wlc_phy_shared_attach in one struct */
++	sha_params.sih = wlc_hw->sih;
++	sha_params.physhim = wlc_hw->physhim;
++	sha_params.unit = unit;
++	sha_params.corerev = wlc_hw->corerev;
++	sha_params.vid = wlc_hw->vendorid;
++	sha_params.did = wlc_hw->deviceid;
++	sha_params.chip = ai_get_chip_id(wlc_hw->sih);
++	sha_params.chiprev = ai_get_chiprev(wlc_hw->sih);
++	sha_params.chippkg = ai_get_chippkg(wlc_hw->sih);
++	sha_params.sromrev = wlc_hw->sromrev;
++	sha_params.boardtype = ai_get_boardtype(wlc_hw->sih);
++	sha_params.boardrev = wlc_hw->boardrev;
++	sha_params.boardflags = wlc_hw->boardflags;
++	sha_params.boardflags2 = wlc_hw->boardflags2;
++
++	/* alloc and save pointer to shared phy state area */
++	wlc_hw->phy_sh = wlc_phy_shared_attach(&sha_params);
++	if (!wlc_hw->phy_sh) {
++		err = 16;
++		goto fail;
++	}
++
++	/* initialize software state for each core and band */
++	for (j = 0; j < wlc_hw->_nbands; j++) {
++		/*
++		 * band0 is always 2.4Ghz
++		 * band1, if present, is 5Ghz
++		 */
++
++		brcms_c_setxband(wlc_hw, j);
++
++		wlc_hw->band->bandunit = j;
++		wlc_hw->band->bandtype = j ? BRCM_BAND_5G : BRCM_BAND_2G;
++		wlc->band->bandunit = j;
++		wlc->band->bandtype = j ? BRCM_BAND_5G : BRCM_BAND_2G;
++		wlc->core->coreidx = core->core_index;
++
++		wlc_hw->machwcap = bcma_read32(core, D11REGOFFS(machwcap));
++		wlc_hw->machwcap_backup = wlc_hw->machwcap;
++
++		/* init tx fifo size */
++		wlc_hw->xmtfifo_sz =
++		    xmtfifo_sz[(wlc_hw->corerev - XMTFIFOTBL_STARTREV)];
++
++		/* Get a phy for this band */
++		wlc_hw->band->pi =
++			wlc_phy_attach(wlc_hw->phy_sh, core,
++				       wlc_hw->band->bandtype,
++				       wlc->wiphy);
++		if (wlc_hw->band->pi == NULL) {
++			wiphy_err(wiphy, "wl%d: brcms_b_attach: wlc_phy_"
++				  "attach failed\n", unit);
++			err = 17;
++			goto fail;
++		}
++
++		wlc_phy_machwcap_set(wlc_hw->band->pi, wlc_hw->machwcap);
++
++		wlc_phy_get_phyversion(wlc_hw->band->pi, &wlc_hw->band->phytype,
++				       &wlc_hw->band->phyrev,
++				       &wlc_hw->band->radioid,
++				       &wlc_hw->band->radiorev);
++		wlc_hw->band->abgphy_encore =
++		    wlc_phy_get_encore(wlc_hw->band->pi);
++		wlc->band->abgphy_encore = wlc_phy_get_encore(wlc_hw->band->pi);
++		wlc_hw->band->core_flags =
++		    wlc_phy_get_coreflags(wlc_hw->band->pi);
++
++		/* verify good phy_type & supported phy revision */
++		if (BRCMS_ISNPHY(wlc_hw->band)) {
++			if (NCONF_HAS(wlc_hw->band->phyrev))
++				goto good_phy;
++			else
++				goto bad_phy;
++		} else if (BRCMS_ISLCNPHY(wlc_hw->band)) {
++			if (LCNCONF_HAS(wlc_hw->band->phyrev))
++				goto good_phy;
++			else
++				goto bad_phy;
++		} else {
++ bad_phy:
++			wiphy_err(wiphy, "wl%d: brcms_b_attach: unsupported "
++				  "phy type/rev (%d/%d)\n", unit,
++				  wlc_hw->band->phytype, wlc_hw->band->phyrev);
++			err = 18;
++			goto fail;
++		}
++
++ good_phy:
++		/*
++		 * BMAC_NOTE: wlc->band->pi should not be set below and should
++		 * be done in the high level attach. However we can not make
++		 * that change until all low level access is changed to
++		 * wlc_hw->band->pi. Instead do the wlc->band->pi init below,
++		 * keeping wlc_hw->band->pi as well for incremental update of
++		 * low level fns, and cut over low only init when all fns
++		 * updated.
++		 */
++		wlc->band->pi = wlc_hw->band->pi;
++		wlc->band->phytype = wlc_hw->band->phytype;
++		wlc->band->phyrev = wlc_hw->band->phyrev;
++		wlc->band->radioid = wlc_hw->band->radioid;
++		wlc->band->radiorev = wlc_hw->band->radiorev;
++
++		/* default contention windows size limits */
++		wlc_hw->band->CWmin = APHY_CWMIN;
++		wlc_hw->band->CWmax = PHY_CWMAX;
++
++		if (!brcms_b_attach_dmapio(wlc, j, wme)) {
++			err = 19;
++			goto fail;
++		}
++	}
++
++	/* disable core to match driver "down" state */
++	brcms_c_coredisable(wlc_hw);
++
++	/* Match driver "down" state */
++	ai_pci_down(wlc_hw->sih);
++
++	/* turn off pll and xtal to match driver "down" state */
++	brcms_b_xtal(wlc_hw, OFF);
++
++	/* *******************************************************************
++	 * The hardware is in the DOWN state at this point. D11 core
++	 * or cores are in reset with clocks off, and the board PLLs
++	 * are off if possible.
++	 *
++	 * Beyond this point, wlc->sbclk == false and chip registers
++	 * should not be touched.
++	 *********************************************************************
++	 */
++
++	/* init etheraddr state variables */
++	brcms_c_get_macaddr(wlc_hw, wlc_hw->etheraddr);
++
++	if (is_broadcast_ether_addr(wlc_hw->etheraddr) ||
++	    is_zero_ether_addr(wlc_hw->etheraddr)) {
++		wiphy_err(wiphy, "wl%d: brcms_b_attach: bad macaddr\n",
++			  unit);
++		err = 22;
++		goto fail;
++	}
++
++	BCMMSG(wlc->wiphy, "deviceid 0x%x nbands %d board 0x%x\n",
++	       wlc_hw->deviceid, wlc_hw->_nbands, ai_get_boardtype(wlc_hw->sih));
++
++	return err;
++
++ fail:
++	wiphy_err(wiphy, "wl%d: brcms_b_attach: failed with err %d\n", unit,
++		  err);
++	return err;
++}
++
++static void brcms_c_attach_antgain_init(struct brcms_c_info *wlc)
++{
++	uint unit;
++	unit = wlc->pub->unit;
++
++	if ((wlc->band->antgain == -1) && (wlc->pub->sromrev == 1)) {
++		/* default antenna gain for srom rev 1 is 2 dBm (8 qdbm) */
++		wlc->band->antgain = 8;
++	} else if (wlc->band->antgain == -1) {
++		wiphy_err(wlc->wiphy, "wl%d: %s: Invalid antennas available in"
++			  " srom, using 2dB\n", unit, __func__);
++		wlc->band->antgain = 8;
++	} else {
++		s8 gain, fract;
++		/* Older sroms specified gain in whole dbm only.  In order
++		 * be able to specify qdbm granularity and remain backward
++		 * compatible the whole dbms are now encoded in only
++		 * low 6 bits and remaining qdbms are encoded in the hi 2 bits.
++		 * 6 bit signed number ranges from -32 - 31.
++		 *
++		 * Examples:
++		 * 0x1 = 1 db,
++		 * 0xc1 = 1.75 db (1 + 3 quarters),
++		 * 0x3f = -1 (-1 + 0 quarters),
++		 * 0x7f = -.75 (-1 + 1 quarters) = -3 qdbm.
++		 * 0xbf = -.50 (-1 + 2 quarters) = -2 qdbm.
++		 */
++		gain = wlc->band->antgain & 0x3f;
++		gain <<= 2;	/* Sign extend */
++		gain >>= 2;
++		fract = (wlc->band->antgain & 0xc0) >> 6;
++		wlc->band->antgain = 4 * gain + fract;
++	}
++}
++
++static bool brcms_c_attach_stf_ant_init(struct brcms_c_info *wlc)
++{
++	int aa;
++	uint unit;
++	int bandtype;
++	struct ssb_sprom *sprom = &wlc->hw->d11core->bus->sprom;
++
++	unit = wlc->pub->unit;
++	bandtype = wlc->band->bandtype;
++
++	/* get antennas available */
++	if (bandtype == BRCM_BAND_5G)
++		aa = sprom->ant_available_a;
++	else
++		aa = sprom->ant_available_bg;
++
++	if ((aa < 1) || (aa > 15)) {
++		wiphy_err(wlc->wiphy, "wl%d: %s: Invalid antennas available in"
++			  " srom (0x%x), using 3\n", unit, __func__, aa);
++		aa = 3;
++	}
++
++	/* reset the defaults if we have a single antenna */
++	if (aa == 1) {
++		wlc->stf->ant_rx_ovr = ANT_RX_DIV_FORCE_0;
++		wlc->stf->txant = ANT_TX_FORCE_0;
++	} else if (aa == 2) {
++		wlc->stf->ant_rx_ovr = ANT_RX_DIV_FORCE_1;
++		wlc->stf->txant = ANT_TX_FORCE_1;
++	} else {
++	}
++
++	/* Compute Antenna Gain */
++	if (bandtype == BRCM_BAND_5G)
++		wlc->band->antgain = sprom->antenna_gain.a1;
++	else
++		wlc->band->antgain = sprom->antenna_gain.a0;
++
++	brcms_c_attach_antgain_init(wlc);
++
++	return true;
++}
++
++static void brcms_c_bss_default_init(struct brcms_c_info *wlc)
++{
++	u16 chanspec;
++	struct brcms_band *band;
++	struct brcms_bss_info *bi = wlc->default_bss;
++
++	/* init default and target BSS with some sane initial values */
++	memset((char *)(bi), 0, sizeof(struct brcms_bss_info));
++	bi->beacon_period = BEACON_INTERVAL_DEFAULT;
++
++	/* fill the default channel as the first valid channel
++	 * starting from the 2G channels
++	 */
++	chanspec = ch20mhz_chspec(1);
++	wlc->home_chanspec = bi->chanspec = chanspec;
++
++	/* find the band of our default channel */
++	band = wlc->band;
++	if (wlc->pub->_nbands > 1 &&
++	    band->bandunit != chspec_bandunit(chanspec))
++		band = wlc->bandstate[OTHERBANDUNIT(wlc)];
++
++	/* init bss rates to the band specific default rate set */
++	brcms_c_rateset_default(&bi->rateset, NULL, band->phytype,
++		band->bandtype, false, BRCMS_RATE_MASK_FULL,
++		(bool) (wlc->pub->_n_enab & SUPPORT_11N),
++		brcms_chspec_bw(chanspec), wlc->stf->txstreams);
++
++	if (wlc->pub->_n_enab & SUPPORT_11N)
++		bi->flags |= BRCMS_BSS_HT;
++}
++
++static struct brcms_txq_info *brcms_c_txq_alloc(struct brcms_c_info *wlc)
++{
++	struct brcms_txq_info *qi, *p;
++
++	qi = kzalloc(sizeof(struct brcms_txq_info), GFP_ATOMIC);
++	if (qi != NULL) {
++		/*
++		 * Have enough room for control packets along with HI watermark
++		 * Also, add room to txq for total psq packets if all the SCBs
++		 * leave PS mode. The watermark for flowcontrol to OS packets
++		 * will remain the same
++		 */
++		brcmu_pktq_init(&qi->q, BRCMS_PREC_COUNT,
++			  2 * BRCMS_DATAHIWAT + PKTQ_LEN_DEFAULT);
++
++		/* add this queue to the the global list */
++		p = wlc->tx_queues;
++		if (p == NULL) {
++			wlc->tx_queues = qi;
++		} else {
++			while (p->next != NULL)
++				p = p->next;
++			p->next = qi;
++		}
++	}
++	return qi;
++}
++
++static void brcms_c_txq_free(struct brcms_c_info *wlc,
++			     struct brcms_txq_info *qi)
++{
++	struct brcms_txq_info *p;
++
++	if (qi == NULL)
++		return;
++
++	/* remove the queue from the linked list */
++	p = wlc->tx_queues;
++	if (p == qi)
++		wlc->tx_queues = p->next;
++	else {
++		while (p != NULL && p->next != qi)
++			p = p->next;
++		if (p != NULL)
++			p->next = p->next->next;
++	}
++
++	kfree(qi);
++}
++
++static void brcms_c_update_mimo_band_bwcap(struct brcms_c_info *wlc, u8 bwcap)
++{
++	uint i;
++	struct brcms_band *band;
++
++	for (i = 0; i < wlc->pub->_nbands; i++) {
++		band = wlc->bandstate[i];
++		if (band->bandtype == BRCM_BAND_5G) {
++			if ((bwcap == BRCMS_N_BW_40ALL)
++			    || (bwcap == BRCMS_N_BW_20IN2G_40IN5G))
++				band->mimo_cap_40 = true;
++			else
++				band->mimo_cap_40 = false;
++		} else {
++			if (bwcap == BRCMS_N_BW_40ALL)
++				band->mimo_cap_40 = true;
++			else
++				band->mimo_cap_40 = false;
++		}
++	}
++}
++
++static void brcms_c_timers_deinit(struct brcms_c_info *wlc)
++{
++	/* free timer state */
++	if (wlc->wdtimer) {
++		brcms_free_timer(wlc->wdtimer);
++		wlc->wdtimer = NULL;
++	}
++	if (wlc->radio_timer) {
++		brcms_free_timer(wlc->radio_timer);
++		wlc->radio_timer = NULL;
++	}
++}
++
++static void brcms_c_detach_module(struct brcms_c_info *wlc)
++{
++	if (wlc->asi) {
++		brcms_c_antsel_detach(wlc->asi);
++		wlc->asi = NULL;
++	}
++
++	if (wlc->ampdu) {
++		brcms_c_ampdu_detach(wlc->ampdu);
++		wlc->ampdu = NULL;
++	}
++
++	brcms_c_stf_detach(wlc);
++}
++
++/*
++ * low level detach
++ */
++static int brcms_b_detach(struct brcms_c_info *wlc)
++{
++	uint i;
++	struct brcms_hw_band *band;
++	struct brcms_hardware *wlc_hw = wlc->hw;
++	int callbacks;
++
++	callbacks = 0;
++
++	brcms_b_detach_dmapio(wlc_hw);
++
++	band = wlc_hw->band;
++	for (i = 0; i < wlc_hw->_nbands; i++) {
++		if (band->pi) {
++			/* Detach this band's phy */
++			wlc_phy_detach(band->pi);
++			band->pi = NULL;
++		}
++		band = wlc_hw->bandstate[OTHERBANDUNIT(wlc)];
++	}
++
++	/* Free shared phy state */
++	kfree(wlc_hw->phy_sh);
++
++	wlc_phy_shim_detach(wlc_hw->physhim);
++
++	if (wlc_hw->sih) {
++		ai_detach(wlc_hw->sih);
++		wlc_hw->sih = NULL;
++	}
++
++	return callbacks;
++
++}
++
++/*
++ * Return a count of the number of driver callbacks still pending.
++ *
++ * General policy is that brcms_c_detach can only dealloc/free software states.
++ * It can NOT touch hardware registers since the d11core may be in reset and
++ * clock may not be available.
++ * One exception is sb register access, which is possible if crystal is turned
++ * on after "down" state, driver should avoid software timer with the exception
++ * of radio_monitor.
++ */
++uint brcms_c_detach(struct brcms_c_info *wlc)
++{
++	uint callbacks = 0;
++
++	if (wlc == NULL)
++		return 0;
++
++	BCMMSG(wlc->wiphy, "wl%d\n", wlc->pub->unit);
++
++	callbacks += brcms_b_detach(wlc);
++
++	/* delete software timers */
++	if (!brcms_c_radio_monitor_stop(wlc))
++		callbacks++;
++
++	brcms_c_channel_mgr_detach(wlc->cmi);
++
++	brcms_c_timers_deinit(wlc);
++
++	brcms_c_detach_module(wlc);
++
++
++	while (wlc->tx_queues != NULL)
++		brcms_c_txq_free(wlc, wlc->tx_queues);
++
++	brcms_c_detach_mfree(wlc);
++	return callbacks;
++}
++
++/* update state that depends on the current value of "ap" */
++static void brcms_c_ap_upd(struct brcms_c_info *wlc)
++{
++	/* STA-BSS; short capable */
++	wlc->PLCPHdr_override = BRCMS_PLCP_SHORT;
++}
++
++/* Initialize just the hardware when coming out of POR or S3/S5 system states */
++static void brcms_b_hw_up(struct brcms_hardware *wlc_hw)
++{
++	if (wlc_hw->wlc->pub->hw_up)
++		return;
++
++	BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
++
++	/*
++	 * Enable pll and xtal, initialize the power control registers,
++	 * and force fastclock for the remainder of brcms_c_up().
++	 */
++	brcms_b_xtal(wlc_hw, ON);
++	ai_clkctl_init(wlc_hw->sih);
++	brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
++
++	/*
++	 * TODO: test suspend/resume
++	 *
++	 * AI chip doesn't restore bar0win2 on
++	 * hibernation/resume, need sw fixup
++	 */
++
++	/*
++	 * Inform phy that a POR reset has occurred so
++	 * it does a complete phy init
++	 */
++	wlc_phy_por_inform(wlc_hw->band->pi);
++
++	wlc_hw->ucode_loaded = false;
++	wlc_hw->wlc->pub->hw_up = true;
++
++	if ((wlc_hw->boardflags & BFL_FEM)
++	    && (ai_get_chip_id(wlc_hw->sih) == BCM4313_CHIP_ID)) {
++		if (!
++		    (wlc_hw->boardrev >= 0x1250
++		     && (wlc_hw->boardflags & BFL_FEM_BT)))
++			ai_epa_4313war(wlc_hw->sih);
++	}
++}
++
++static int brcms_b_up_prep(struct brcms_hardware *wlc_hw)
++{
++	BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
++
++	/*
++	 * Enable pll and xtal, initialize the power control registers,
++	 * and force fastclock for the remainder of brcms_c_up().
++	 */
++	brcms_b_xtal(wlc_hw, ON);
++	ai_clkctl_init(wlc_hw->sih);
++	brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
++
++	/*
++	 * Configure pci/pcmcia here instead of in brcms_c_attach()
++	 * to allow mfg hotswap:  down, hotswap (chip power cycle), up.
++	 */
++	bcma_core_pci_irq_ctl(&wlc_hw->d11core->bus->drv_pci, wlc_hw->d11core,
++			      true);
++
++	/*
++	 * Need to read the hwradio status here to cover the case where the
++	 * system is loaded with the hw radio disabled. We do not want to
++	 * bring the driver up in this case.
++	 */
++	if (brcms_b_radio_read_hwdisabled(wlc_hw)) {
++		/* put SB PCI in down state again */
++		ai_pci_down(wlc_hw->sih);
++		brcms_b_xtal(wlc_hw, OFF);
++		return -ENOMEDIUM;
++	}
++
++	ai_pci_up(wlc_hw->sih);
++
++	/* reset the d11 core */
++	brcms_b_corereset(wlc_hw, BRCMS_USE_COREFLAGS);
++
++	return 0;
++}
++
++static int brcms_b_up_finish(struct brcms_hardware *wlc_hw)
++{
++	BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
++
++	wlc_hw->up = true;
++	wlc_phy_hw_state_upd(wlc_hw->band->pi, true);
++
++	/* FULLY enable dynamic power control and d11 core interrupt */
++	brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_DYNAMIC);
++	brcms_intrson(wlc_hw->wlc->wl);
++	return 0;
++}
++
++/*
++ * Write WME tunable parameters for retransmit/max rate
++ * from wlc struct to ucode
++ */
++static void brcms_c_wme_retries_write(struct brcms_c_info *wlc)
++{
++	int ac;
++
++	/* Need clock to do this */
++	if (!wlc->clk)
++		return;
++
++	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
++		brcms_b_write_shm(wlc->hw, M_AC_TXLMT_ADDR(ac),
++				  wlc->wme_retries[ac]);
++}
++
++/* make interface operational */
++int brcms_c_up(struct brcms_c_info *wlc)
++{
++	BCMMSG(wlc->wiphy, "wl%d\n", wlc->pub->unit);
++
++	/* HW is turned off so don't try to access it */
++	if (wlc->pub->hw_off || brcms_deviceremoved(wlc))
++		return -ENOMEDIUM;
++
++	if (!wlc->pub->hw_up) {
++		brcms_b_hw_up(wlc->hw);
++		wlc->pub->hw_up = true;
++	}
++
++	if ((wlc->pub->boardflags & BFL_FEM)
++	    && (ai_get_chip_id(wlc->hw->sih) == BCM4313_CHIP_ID)) {
++		if (wlc->pub->boardrev >= 0x1250
++		    && (wlc->pub->boardflags & BFL_FEM_BT))
++			brcms_b_mhf(wlc->hw, MHF5, MHF5_4313_GPIOCTRL,
++				MHF5_4313_GPIOCTRL, BRCM_BAND_ALL);
++		else
++			brcms_b_mhf(wlc->hw, MHF4, MHF4_EXTPA_ENABLE,
++				    MHF4_EXTPA_ENABLE, BRCM_BAND_ALL);
++	}
++
++	/*
++	 * Need to read the hwradio status here to cover the case where the
++	 * system is loaded with the hw radio disabled. We do not want to bring
++	 * the driver up in this case. If radio is disabled, abort up, lower
++	 * power, start radio timer and return 0(for NDIS) don't call
++	 * radio_update to avoid looping brcms_c_up.
++	 *
++	 * brcms_b_up_prep() returns either 0 or -BCME_RADIOOFF only
++	 */
++	if (!wlc->pub->radio_disabled) {
++		int status = brcms_b_up_prep(wlc->hw);
++		if (status == -ENOMEDIUM) {
++			if (!mboolisset
++			    (wlc->pub->radio_disabled, WL_RADIO_HW_DISABLE)) {
++				struct brcms_bss_cfg *bsscfg = wlc->bsscfg;
++				mboolset(wlc->pub->radio_disabled,
++					 WL_RADIO_HW_DISABLE);
++
++				if (bsscfg->enable && bsscfg->BSS)
++					wiphy_err(wlc->wiphy, "wl%d: up"
++						  ": rfdisable -> "
++						  "bsscfg_disable()\n",
++						   wlc->pub->unit);
++			}
++		}
++	}
++
++	if (wlc->pub->radio_disabled) {
++		brcms_c_radio_monitor_start(wlc);
++		return 0;
++	}
++
++	/* brcms_b_up_prep has done brcms_c_corereset(). so clk is on, set it */
++	wlc->clk = true;
++
++	brcms_c_radio_monitor_stop(wlc);
++
++	/* Set EDCF hostflags */
++	brcms_b_mhf(wlc->hw, MHF1, MHF1_EDCF, MHF1_EDCF, BRCM_BAND_ALL);
++
++	brcms_init(wlc->wl);
++	wlc->pub->up = true;
++
++	if (wlc->bandinit_pending) {
++		brcms_c_suspend_mac_and_wait(wlc);
++		brcms_c_set_chanspec(wlc, wlc->default_bss->chanspec);
++		wlc->bandinit_pending = false;
++		brcms_c_enable_mac(wlc);
++	}
++
++	brcms_b_up_finish(wlc->hw);
++
++	/* Program the TX wme params with the current settings */
++	brcms_c_wme_retries_write(wlc);
++
++	/* start one second watchdog timer */
++	brcms_add_timer(wlc->wdtimer, TIMER_INTERVAL_WATCHDOG, true);
++	wlc->WDarmed = true;
++
++	/* ensure antenna config is up to date */
++	brcms_c_stf_phy_txant_upd(wlc);
++	/* ensure LDPC config is in sync */
++	brcms_c_ht_update_ldpc(wlc, wlc->stf->ldpc);
++
++	return 0;
++}
++
++static uint brcms_c_down_del_timer(struct brcms_c_info *wlc)
++{
++	uint callbacks = 0;
++
++	return callbacks;
++}
++
++static int brcms_b_bmac_down_prep(struct brcms_hardware *wlc_hw)
++{
++	bool dev_gone;
++	uint callbacks = 0;
++
++	BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
++
++	if (!wlc_hw->up)
++		return callbacks;
++
++	dev_gone = brcms_deviceremoved(wlc_hw->wlc);
++
++	/* disable interrupts */
++	if (dev_gone)
++		wlc_hw->wlc->macintmask = 0;
++	else {
++		/* now disable interrupts */
++		brcms_intrsoff(wlc_hw->wlc->wl);
++
++		/* ensure we're running on the pll clock again */
++		brcms_b_clkctl_clk(wlc_hw, BCMA_CLKMODE_FAST);
++	}
++	/* down phy at the last of this stage */
++	callbacks += wlc_phy_down(wlc_hw->band->pi);
++
++	return callbacks;
++}
++
++static int brcms_b_down_finish(struct brcms_hardware *wlc_hw)
++{
++	uint callbacks = 0;
++	bool dev_gone;
++
++	BCMMSG(wlc_hw->wlc->wiphy, "wl%d\n", wlc_hw->unit);
++
++	if (!wlc_hw->up)
++		return callbacks;
++
++	wlc_hw->up = false;
++	wlc_phy_hw_state_upd(wlc_hw->band->pi, false);
++
++	dev_gone = brcms_deviceremoved(wlc_hw->wlc);
++
++	if (dev_gone) {
++		wlc_hw->sbclk = false;
++		wlc_hw->clk = false;
++		wlc_phy_hw_clk_state_upd(wlc_hw->band->pi, false);
++
++		/* reclaim any posted packets */
++		brcms_c_flushqueues(wlc_hw->wlc);
++	} else {
++
++		/* Reset and disable the core */
++		if (bcma_core_is_enabled(wlc_hw->d11core)) {
++			if (bcma_read32(wlc_hw->d11core,
++					D11REGOFFS(maccontrol)) & MCTL_EN_MAC)
++				brcms_c_suspend_mac_and_wait(wlc_hw->wlc);
++			callbacks += brcms_reset(wlc_hw->wlc->wl);
++			brcms_c_coredisable(wlc_hw);
++		}
++
++		/* turn off primary xtal and pll */
++		if (!wlc_hw->noreset) {
++			ai_pci_down(wlc_hw->sih);
++			brcms_b_xtal(wlc_hw, OFF);
++		}
++	}
++
++	return callbacks;
++}
++
++/*
++ * Mark the interface nonoperational, stop the software mechanisms,
++ * disable the hardware, free any transient buffer state.
++ * Return a count of the number of driver callbacks still pending.
++ */
++uint brcms_c_down(struct brcms_c_info *wlc)
++{
++
++	uint callbacks = 0;
++	int i;
++	bool dev_gone = false;
++	struct brcms_txq_info *qi;
++
++	BCMMSG(wlc->wiphy, "wl%d\n", wlc->pub->unit);
++
++	/* check if we are already in the going down path */
++	if (wlc->going_down) {
++		wiphy_err(wlc->wiphy, "wl%d: %s: Driver going down so return"
++			  "\n", wlc->pub->unit, __func__);
++		return 0;
++	}
++	if (!wlc->pub->up)
++		return callbacks;
++
++	wlc->going_down = true;
++
++	callbacks += brcms_b_bmac_down_prep(wlc->hw);
++
++	dev_gone = brcms_deviceremoved(wlc);
++
++	/* Call any registered down handlers */
++	for (i = 0; i < BRCMS_MAXMODULES; i++) {
++		if (wlc->modulecb[i].down_fn)
++			callbacks +=
++			    wlc->modulecb[i].down_fn(wlc->modulecb[i].hdl);
++	}
++
++	/* cancel the watchdog timer */
++	if (wlc->WDarmed) {
++		if (!brcms_del_timer(wlc->wdtimer))
++			callbacks++;
++		wlc->WDarmed = false;
++	}
++	/* cancel all other timers */
++	callbacks += brcms_c_down_del_timer(wlc);
++
++	wlc->pub->up = false;
++
++	wlc_phy_mute_upd(wlc->band->pi, false, PHY_MUTE_ALL);
++
++	/* clear txq flow control */
++	brcms_c_txflowcontrol_reset(wlc);
++
++	/* flush tx queues */
++	for (qi = wlc->tx_queues; qi != NULL; qi = qi->next)
++		brcmu_pktq_flush(&qi->q, true, NULL, NULL);
++
++	callbacks += brcms_b_down_finish(wlc->hw);
++
++	/* brcms_b_down_finish has done brcms_c_coredisable(). so clk is off */
++	wlc->clk = false;
++
++	wlc->going_down = false;
++	return callbacks;
++}
++
++/* Set the current gmode configuration */
++int brcms_c_set_gmode(struct brcms_c_info *wlc, u8 gmode, bool config)
++{
++	int ret = 0;
++	uint i;
++	struct brcms_c_rateset rs;
++	/* Default to 54g Auto */
++	/* Advertise and use shortslot (-1/0/1 Auto/Off/On) */
++	s8 shortslot = BRCMS_SHORTSLOT_AUTO;
++	bool shortslot_restrict = false; /* Restrict association to stations
++					  * that support shortslot
++					  */
++	bool ofdm_basic = false;	/* Make 6, 12, and 24 basic rates */
++	/* Advertise and use short preambles (-1/0/1 Auto/Off/On) */
++	int preamble = BRCMS_PLCP_LONG;
++	bool preamble_restrict = false;	/* Restrict association to stations
++					 * that support short preambles
++					 */
++	struct brcms_band *band;
++
++	/* if N-support is enabled, allow Gmode set as long as requested
++	 * Gmode is not GMODE_LEGACY_B
++	 */
++	if ((wlc->pub->_n_enab & SUPPORT_11N) && gmode == GMODE_LEGACY_B)
++		return -ENOTSUPP;
++
++	/* verify that we are dealing with 2G band and grab the band pointer */
++	if (wlc->band->bandtype == BRCM_BAND_2G)
++		band = wlc->band;
++	else if ((wlc->pub->_nbands > 1) &&
++		 (wlc->bandstate[OTHERBANDUNIT(wlc)]->bandtype == BRCM_BAND_2G))
++		band = wlc->bandstate[OTHERBANDUNIT(wlc)];
++	else
++		return -EINVAL;
++
++	/* Legacy or bust when no OFDM is supported by regulatory */
++	if ((brcms_c_channel_locale_flags_in_band(wlc->cmi, band->bandunit) &
++	     BRCMS_NO_OFDM) && (gmode != GMODE_LEGACY_B))
++		return -EINVAL;
++
++	/* update configuration value */
++	if (config)
++		brcms_c_protection_upd(wlc, BRCMS_PROT_G_USER, gmode);
++
++	/* Clear rateset override */
++	memset(&rs, 0, sizeof(struct brcms_c_rateset));
++
++	switch (gmode) {
++	case GMODE_LEGACY_B:
++		shortslot = BRCMS_SHORTSLOT_OFF;
++		brcms_c_rateset_copy(&gphy_legacy_rates, &rs);
++
++		break;
++
++	case GMODE_LRS:
++		break;
++
++	case GMODE_AUTO:
++		/* Accept defaults */
++		break;
++
++	case GMODE_ONLY:
++		ofdm_basic = true;
++		preamble = BRCMS_PLCP_SHORT;
++		preamble_restrict = true;
++		break;
++
++	case GMODE_PERFORMANCE:
++		shortslot = BRCMS_SHORTSLOT_ON;
++		shortslot_restrict = true;
++		ofdm_basic = true;
++		preamble = BRCMS_PLCP_SHORT;
++		preamble_restrict = true;
++		break;
++
++	default:
++		/* Error */
++		wiphy_err(wlc->wiphy, "wl%d: %s: invalid gmode %d\n",
++			  wlc->pub->unit, __func__, gmode);
++		return -ENOTSUPP;
++	}
++
++	band->gmode = gmode;
++
++	wlc->shortslot_override = shortslot;
++
++	/* Use the default 11g rateset */
++	if (!rs.count)
++		brcms_c_rateset_copy(&cck_ofdm_rates, &rs);
++
++	if (ofdm_basic) {
++		for (i = 0; i < rs.count; i++) {
++			if (rs.rates[i] == BRCM_RATE_6M
++			    || rs.rates[i] == BRCM_RATE_12M
++			    || rs.rates[i] == BRCM_RATE_24M)
++				rs.rates[i] |= BRCMS_RATE_FLAG;
++		}
++	}
++
++	/* Set default bss rateset */
++	wlc->default_bss->rateset.count = rs.count;
++	memcpy(wlc->default_bss->rateset.rates, rs.rates,
++	       sizeof(wlc->default_bss->rateset.rates));
++
++	return ret;
++}
++
++int brcms_c_set_nmode(struct brcms_c_info *wlc)
++{
++	uint i;
++	s32 nmode = AUTO;
++
++	if (wlc->stf->txstreams == WL_11N_3x3)
++		nmode = WL_11N_3x3;
++	else
++		nmode = WL_11N_2x2;
++
++	/* force GMODE_AUTO if NMODE is ON */
++	brcms_c_set_gmode(wlc, GMODE_AUTO, true);
++	if (nmode == WL_11N_3x3)
++		wlc->pub->_n_enab = SUPPORT_HT;
++	else
++		wlc->pub->_n_enab = SUPPORT_11N;
++	wlc->default_bss->flags |= BRCMS_BSS_HT;
++	/* add the mcs rates to the default and hw ratesets */
++	brcms_c_rateset_mcs_build(&wlc->default_bss->rateset,
++			      wlc->stf->txstreams);
++	for (i = 0; i < wlc->pub->_nbands; i++)
++		memcpy(wlc->bandstate[i]->hw_rateset.mcs,
++		       wlc->default_bss->rateset.mcs, MCSSET_LEN);
++
++	return 0;
++}
++
++static int
++brcms_c_set_internal_rateset(struct brcms_c_info *wlc,
++			     struct brcms_c_rateset *rs_arg)
++{
++	struct brcms_c_rateset rs, new;
++	uint bandunit;
++
++	memcpy(&rs, rs_arg, sizeof(struct brcms_c_rateset));
++
++	/* check for bad count value */
++	if ((rs.count == 0) || (rs.count > BRCMS_NUMRATES))
++		return -EINVAL;
++
++	/* try the current band */
++	bandunit = wlc->band->bandunit;
++	memcpy(&new, &rs, sizeof(struct brcms_c_rateset));
++	if (brcms_c_rate_hwrs_filter_sort_validate
++	    (&new, &wlc->bandstate[bandunit]->hw_rateset, true,
++	     wlc->stf->txstreams))
++		goto good;
++
++	/* try the other band */
++	if (brcms_is_mband_unlocked(wlc)) {
++		bandunit = OTHERBANDUNIT(wlc);
++		memcpy(&new, &rs, sizeof(struct brcms_c_rateset));
++		if (brcms_c_rate_hwrs_filter_sort_validate(&new,
++						       &wlc->
++						       bandstate[bandunit]->
++						       hw_rateset, true,
++						       wlc->stf->txstreams))
++			goto good;
++	}
++
++	return -EBADE;
++
++ good:
++	/* apply new rateset */
++	memcpy(&wlc->default_bss->rateset, &new,
++	       sizeof(struct brcms_c_rateset));
++	memcpy(&wlc->bandstate[bandunit]->defrateset, &new,
++	       sizeof(struct brcms_c_rateset));
++	return 0;
++}
++
++static void brcms_c_ofdm_rateset_war(struct brcms_c_info *wlc)
++{
++	u8 r;
++	bool war = false;
++
++	if (wlc->bsscfg->associated)
++		r = wlc->bsscfg->current_bss->rateset.rates[0];
++	else
++		r = wlc->default_bss->rateset.rates[0];
++
++	wlc_phy_ofdm_rateset_war(wlc->band->pi, war);
++}
++
++int brcms_c_set_channel(struct brcms_c_info *wlc, u16 channel)
++{
++	u16 chspec = ch20mhz_chspec(channel);
++
++	if (channel < 0 || channel > MAXCHANNEL)
++		return -EINVAL;
++
++	if (!brcms_c_valid_chanspec_db(wlc->cmi, chspec))
++		return -EINVAL;
++
++
++	if (!wlc->pub->up && brcms_is_mband_unlocked(wlc)) {
++		if (wlc->band->bandunit != chspec_bandunit(chspec))
++			wlc->bandinit_pending = true;
++		else
++			wlc->bandinit_pending = false;
++	}
++
++	wlc->default_bss->chanspec = chspec;
++	/* brcms_c_BSSinit() will sanitize the rateset before
++	 * using it.. */
++	if (wlc->pub->up && (wlc_phy_chanspec_get(wlc->band->pi) != chspec)) {
++		brcms_c_set_home_chanspec(wlc, chspec);
++		brcms_c_suspend_mac_and_wait(wlc);
++		brcms_c_set_chanspec(wlc, chspec);
++		brcms_c_enable_mac(wlc);
++	}
++	return 0;
++}
++
++int brcms_c_set_rate_limit(struct brcms_c_info *wlc, u16 srl, u16 lrl)
++{
++	int ac;
++
++	if (srl < 1 || srl > RETRY_SHORT_MAX ||
++	    lrl < 1 || lrl > RETRY_SHORT_MAX)
++		return -EINVAL;
++
++	wlc->SRL = srl;
++	wlc->LRL = lrl;
++
++	brcms_b_retrylimit_upd(wlc->hw, wlc->SRL, wlc->LRL);
++
++	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
++		wlc->wme_retries[ac] =	SFIELD(wlc->wme_retries[ac],
++					       EDCF_SHORT,  wlc->SRL);
++		wlc->wme_retries[ac] =	SFIELD(wlc->wme_retries[ac],
++					       EDCF_LONG, wlc->LRL);
++	}
++	brcms_c_wme_retries_write(wlc);
++
++	return 0;
++}
++
++void brcms_c_get_current_rateset(struct brcms_c_info *wlc,
++				 struct brcm_rateset *currs)
++{
++	struct brcms_c_rateset *rs;
++
++	if (wlc->pub->associated)
++		rs = &wlc->bsscfg->current_bss->rateset;
++	else
++		rs = &wlc->default_bss->rateset;
++
++	/* Copy only legacy rateset section */
++	currs->count = rs->count;
++	memcpy(&currs->rates, &rs->rates, rs->count);
++}
++
++int brcms_c_set_rateset(struct brcms_c_info *wlc, struct brcm_rateset *rs)
++{
++	struct brcms_c_rateset internal_rs;
++	int bcmerror;
++
++	if (rs->count > BRCMS_NUMRATES)
++		return -ENOBUFS;
++
++	memset(&internal_rs, 0, sizeof(struct brcms_c_rateset));
++
++	/* Copy only legacy rateset section */
++	internal_rs.count = rs->count;
++	memcpy(&internal_rs.rates, &rs->rates, internal_rs.count);
++
++	/* merge rateset coming in with the current mcsset */
++	if (wlc->pub->_n_enab & SUPPORT_11N) {
++		struct brcms_bss_info *mcsset_bss;
++		if (wlc->bsscfg->associated)
++			mcsset_bss = wlc->bsscfg->current_bss;
++		else
++			mcsset_bss = wlc->default_bss;
++		memcpy(internal_rs.mcs, &mcsset_bss->rateset.mcs[0],
++		       MCSSET_LEN);
++	}
++
++	bcmerror = brcms_c_set_internal_rateset(wlc, &internal_rs);
++	if (!bcmerror)
++		brcms_c_ofdm_rateset_war(wlc);
++
++	return bcmerror;
++}
++
++int brcms_c_set_beacon_period(struct brcms_c_info *wlc, u16 period)
++{
++	if (period < DOT11_MIN_BEACON_PERIOD ||
++	    period > DOT11_MAX_BEACON_PERIOD)
++		return -EINVAL;
++
++	wlc->default_bss->beacon_period = period;
++	return 0;
++}
++
++u16 brcms_c_get_phy_type(struct brcms_c_info *wlc, int phyidx)
++{
++	return wlc->band->phytype;
++}
++
++void brcms_c_set_shortslot_override(struct brcms_c_info *wlc, s8 sslot_override)
++{
++	wlc->shortslot_override = sslot_override;
++
++	/*
++	 * shortslot is an 11g feature, so no more work if we are
++	 * currently on the 5G band
++	 */
++	if (wlc->band->bandtype == BRCM_BAND_5G)
++		return;
++
++	if (wlc->pub->up && wlc->pub->associated) {
++		/* let watchdog or beacon processing update shortslot */
++	} else if (wlc->pub->up) {
++		/* unassociated shortslot is off */
++		brcms_c_switch_shortslot(wlc, false);
++	} else {
++		/* driver is down, so just update the brcms_c_info
++		 * value */
++		if (wlc->shortslot_override == BRCMS_SHORTSLOT_AUTO)
++			wlc->shortslot = false;
++		else
++			wlc->shortslot =
++			    (wlc->shortslot_override ==
++			     BRCMS_SHORTSLOT_ON);
++	}
++}
++
++/*
++ * register watchdog and down handlers.
++ */
++int brcms_c_module_register(struct brcms_pub *pub,
++			    const char *name, struct brcms_info *hdl,
++			    int (*d_fn)(void *handle))
++{
++	struct brcms_c_info *wlc = (struct brcms_c_info *) pub->wlc;
++	int i;
++
++	/* find an empty entry and just add, no duplication check! */
++	for (i = 0; i < BRCMS_MAXMODULES; i++) {
++		if (wlc->modulecb[i].name[0] == '\0') {
++			strncpy(wlc->modulecb[i].name, name,
++				sizeof(wlc->modulecb[i].name) - 1);
++			wlc->modulecb[i].hdl = hdl;
++			wlc->modulecb[i].down_fn = d_fn;
++			return 0;
++		}
++	}
++
++	return -ENOSR;
++}
++
++/* unregister module callbacks */
++int brcms_c_module_unregister(struct brcms_pub *pub, const char *name,
++			      struct brcms_info *hdl)
++{
++	struct brcms_c_info *wlc = (struct brcms_c_info *) pub->wlc;
++	int i;
++
++	if (wlc == NULL)
++		return -ENODATA;
++
++	for (i = 0; i < BRCMS_MAXMODULES; i++) {
++		if (!strcmp(wlc->modulecb[i].name, name) &&
++		    (wlc->modulecb[i].hdl == hdl)) {
++			memset(&wlc->modulecb[i], 0, sizeof(struct modulecb));
++			return 0;
++		}
++	}
++
++	/* table not found! */
++	return -ENODATA;
++}
++
++void brcms_c_print_txstatus(struct tx_status *txs)
++{
++	pr_debug("\ntxpkt (MPDU) Complete\n");
++
++	pr_debug("FrameID: %04x   TxStatus: %04x\n", txs->frameid, txs->status);
++
++	pr_debug("[15:12]  %d  frame attempts\n",
++		  (txs->status & TX_STATUS_FRM_RTX_MASK) >>
++		 TX_STATUS_FRM_RTX_SHIFT);
++	pr_debug(" [11:8]  %d  rts attempts\n",
++		 (txs->status & TX_STATUS_RTS_RTX_MASK) >>
++		 TX_STATUS_RTS_RTX_SHIFT);
++	pr_debug("    [7]  %d  PM mode indicated\n",
++		 txs->status & TX_STATUS_PMINDCTD ? 1 : 0);
++	pr_debug("    [6]  %d  intermediate status\n",
++		 txs->status & TX_STATUS_INTERMEDIATE ? 1 : 0);
++	pr_debug("    [5]  %d  AMPDU\n",
++		 txs->status & TX_STATUS_AMPDU ? 1 : 0);
++	pr_debug("  [4:2]  %d  Frame Suppressed Reason (%s)\n",
++		 (txs->status & TX_STATUS_SUPR_MASK) >> TX_STATUS_SUPR_SHIFT,
++		 (const char *[]) {
++			"None",
++			"PMQ Entry",
++			"Flush request",
++			"Previous frag failure",
++			"Channel mismatch",
++			"Lifetime Expiry",
++			"Underflow"
++		 } [(txs->status & TX_STATUS_SUPR_MASK) >>
++		    TX_STATUS_SUPR_SHIFT]);
++	pr_debug("    [1]  %d  acked\n",
++		 txs->status & TX_STATUS_ACK_RCV ? 1 : 0);
++
++	pr_debug("LastTxTime: %04x Seq: %04x PHYTxStatus: %04x RxAckRSSI: %04x RxAckSQ: %04x\n",
++		 txs->lasttxtime, txs->sequence, txs->phyerr,
++		 (txs->ackphyrxsh & PRXS1_JSSI_MASK) >> PRXS1_JSSI_SHIFT,
++		 (txs->ackphyrxsh & PRXS1_SQ_MASK) >> PRXS1_SQ_SHIFT);
++}
++
++bool brcms_c_chipmatch(u16 vendor, u16 device)
++{
++	if (vendor != PCI_VENDOR_ID_BROADCOM) {
++		pr_err("unknown vendor id %04x\n", vendor);
++		return false;
++	}
++
++	if (device == BCM43224_D11N_ID_VEN1)
++		return true;
++	if ((device == BCM43224_D11N_ID) || (device == BCM43225_D11N2G_ID))
++		return true;
++	if (device == BCM4313_D11N2G_ID)
++		return true;
++	if ((device == BCM43236_D11N_ID) || (device == BCM43236_D11N2G_ID))
++		return true;
++
++	pr_err("unknown device id %04x\n", device);
++	return false;
++}
++
++#if defined(DEBUG)
++void brcms_c_print_txdesc(struct d11txh *txh)
++{
++	u16 mtcl = le16_to_cpu(txh->MacTxControlLow);
++	u16 mtch = le16_to_cpu(txh->MacTxControlHigh);
++	u16 mfc = le16_to_cpu(txh->MacFrameControl);
++	u16 tfest = le16_to_cpu(txh->TxFesTimeNormal);
++	u16 ptcw = le16_to_cpu(txh->PhyTxControlWord);
++	u16 ptcw_1 = le16_to_cpu(txh->PhyTxControlWord_1);
++	u16 ptcw_1_Fbr = le16_to_cpu(txh->PhyTxControlWord_1_Fbr);
++	u16 ptcw_1_Rts = le16_to_cpu(txh->PhyTxControlWord_1_Rts);
++	u16 ptcw_1_FbrRts = le16_to_cpu(txh->PhyTxControlWord_1_FbrRts);
++	u16 mainrates = le16_to_cpu(txh->MainRates);
++	u16 xtraft = le16_to_cpu(txh->XtraFrameTypes);
++	u8 *iv = txh->IV;
++	u8 *ra = txh->TxFrameRA;
++	u16 tfestfb = le16_to_cpu(txh->TxFesTimeFallback);
++	u8 *rtspfb = txh->RTSPLCPFallback;
++	u16 rtsdfb = le16_to_cpu(txh->RTSDurFallback);
++	u8 *fragpfb = txh->FragPLCPFallback;
++	u16 fragdfb = le16_to_cpu(txh->FragDurFallback);
++	u16 mmodelen = le16_to_cpu(txh->MModeLen);
++	u16 mmodefbrlen = le16_to_cpu(txh->MModeFbrLen);
++	u16 tfid = le16_to_cpu(txh->TxFrameID);
++	u16 txs = le16_to_cpu(txh->TxStatus);
++	u16 mnmpdu = le16_to_cpu(txh->MaxNMpdus);
++	u16 mabyte = le16_to_cpu(txh->MaxABytes_MRT);
++	u16 mabyte_f = le16_to_cpu(txh->MaxABytes_FBR);
++	u16 mmbyte = le16_to_cpu(txh->MinMBytes);
++
++	u8 *rtsph = txh->RTSPhyHeader;
++	struct ieee80211_rts rts = txh->rts_frame;
++
++	/* add plcp header along with txh descriptor */
++	brcmu_dbg_hex_dump(txh, sizeof(struct d11txh) + 48,
++			   "Raw TxDesc + plcp header:\n");
++
++	pr_debug("TxCtlLow: %04x ", mtcl);
++	pr_debug("TxCtlHigh: %04x ", mtch);
++	pr_debug("FC: %04x ", mfc);
++	pr_debug("FES Time: %04x\n", tfest);
++	pr_debug("PhyCtl: %04x%s ", ptcw,
++	       (ptcw & PHY_TXC_SHORT_HDR) ? " short" : "");
++	pr_debug("PhyCtl_1: %04x ", ptcw_1);
++	pr_debug("PhyCtl_1_Fbr: %04x\n", ptcw_1_Fbr);
++	pr_debug("PhyCtl_1_Rts: %04x ", ptcw_1_Rts);
++	pr_debug("PhyCtl_1_Fbr_Rts: %04x\n", ptcw_1_FbrRts);
++	pr_debug("MainRates: %04x ", mainrates);
++	pr_debug("XtraFrameTypes: %04x ", xtraft);
++	pr_debug("\n");
++
++	print_hex_dump_bytes("SecIV:", DUMP_PREFIX_OFFSET, iv, sizeof(txh->IV));
++	print_hex_dump_bytes("RA:", DUMP_PREFIX_OFFSET,
++			     ra, sizeof(txh->TxFrameRA));
++
++	pr_debug("Fb FES Time: %04x ", tfestfb);
++	print_hex_dump_bytes("Fb RTS PLCP:", DUMP_PREFIX_OFFSET,
++			     rtspfb, sizeof(txh->RTSPLCPFallback));
++	pr_debug("RTS DUR: %04x ", rtsdfb);
++	print_hex_dump_bytes("PLCP:", DUMP_PREFIX_OFFSET,
++			     fragpfb, sizeof(txh->FragPLCPFallback));
++	pr_debug("DUR: %04x", fragdfb);
++	pr_debug("\n");
++
++	pr_debug("MModeLen: %04x ", mmodelen);
++	pr_debug("MModeFbrLen: %04x\n", mmodefbrlen);
++
++	pr_debug("FrameID:     %04x\n", tfid);
++	pr_debug("TxStatus:    %04x\n", txs);
++
++	pr_debug("MaxNumMpdu:  %04x\n", mnmpdu);
++	pr_debug("MaxAggbyte:  %04x\n", mabyte);
++	pr_debug("MaxAggbyte_fb:  %04x\n", mabyte_f);
++	pr_debug("MinByte:     %04x\n", mmbyte);
++
++	print_hex_dump_bytes("RTS PLCP:", DUMP_PREFIX_OFFSET,
++			     rtsph, sizeof(txh->RTSPhyHeader));
++	print_hex_dump_bytes("RTS Frame:", DUMP_PREFIX_OFFSET,
++			     (u8 *)&rts, sizeof(txh->rts_frame));
++	pr_debug("\n");
++}
++#endif				/* defined(DEBUG) */
++
++#if defined(DEBUG)
++static int
++brcms_c_format_flags(const struct brcms_c_bit_desc *bd, u32 flags, char *buf,
++		     int len)
++{
++	int i;
++	char *p = buf;
++	char hexstr[16];
++	int slen = 0, nlen = 0;
++	u32 bit;
++	const char *name;
++
++	if (len < 2 || !buf)
++		return 0;
++
++	buf[0] = '\0';
++
++	for (i = 0; flags != 0; i++) {
++		bit = bd[i].bit;
++		name = bd[i].name;
++		if (bit == 0 && flags != 0) {
++			/* print any unnamed bits */
++			snprintf(hexstr, 16, "0x%X", flags);
++			name = hexstr;
++			flags = 0;	/* exit loop */
++		} else if ((flags & bit) == 0)
++			continue;
++		flags &= ~bit;
++		nlen = strlen(name);
++		slen += nlen;
++		/* count btwn flag space */
++		if (flags != 0)
++			slen += 1;
++		/* need NULL char as well */
++		if (len <= slen)
++			break;
++		/* copy NULL char but don't count it */
++		strncpy(p, name, nlen + 1);
++		p += nlen;
++		/* copy btwn flag space and NULL char */
++		if (flags != 0)
++			p += snprintf(p, 2, " ");
++		len -= slen;
++	}
++
++	/* indicate the str was too short */
++	if (flags != 0) {
++		if (len < 2)
++			p -= 2 - len;	/* overwrite last char */
++		p += snprintf(p, 2, ">");
++	}
++
++	return (int)(p - buf);
++}
++#endif				/* defined(DEBUG) */
++
++#if defined(DEBUG)
++void brcms_c_print_rxh(struct d11rxhdr *rxh)
++{
++	u16 len = rxh->RxFrameSize;
++	u16 phystatus_0 = rxh->PhyRxStatus_0;
++	u16 phystatus_1 = rxh->PhyRxStatus_1;
++	u16 phystatus_2 = rxh->PhyRxStatus_2;
++	u16 phystatus_3 = rxh->PhyRxStatus_3;
++	u16 macstatus1 = rxh->RxStatus1;
++	u16 macstatus2 = rxh->RxStatus2;
++	char flagstr[64];
++	char lenbuf[20];
++	static const struct brcms_c_bit_desc macstat_flags[] = {
++		{RXS_FCSERR, "FCSErr"},
++		{RXS_RESPFRAMETX, "Reply"},
++		{RXS_PBPRES, "PADDING"},
++		{RXS_DECATMPT, "DeCr"},
++		{RXS_DECERR, "DeCrErr"},
++		{RXS_BCNSENT, "Bcn"},
++		{0, NULL}
++	};
++
++	brcmu_dbg_hex_dump(rxh, sizeof(struct d11rxhdr), "Raw RxDesc:\n");
++
++	brcms_c_format_flags(macstat_flags, macstatus1, flagstr, 64);
++
++	snprintf(lenbuf, sizeof(lenbuf), "0x%x", len);
++
++	pr_debug("RxFrameSize:     %6s (%d)%s\n", lenbuf, len,
++	       (rxh->PhyRxStatus_0 & PRXS0_SHORTH) ? " short preamble" : "");
++	pr_debug("RxPHYStatus:     %04x %04x %04x %04x\n",
++	       phystatus_0, phystatus_1, phystatus_2, phystatus_3);
++	pr_debug("RxMACStatus:     %x %s\n", macstatus1, flagstr);
++	pr_debug("RXMACaggtype:    %x\n",
++	       (macstatus2 & RXS_AGGTYPE_MASK));
++	pr_debug("RxTSFTime:       %04x\n", rxh->RxTSFTime);
++}
++#endif				/* defined(DEBUG) */
++
++u16 brcms_b_rate_shm_offset(struct brcms_hardware *wlc_hw, u8 rate)
++{
++	u16 table_ptr;
++	u8 phy_rate, index;
++
++	/* get the phy specific rate encoding for the PLCP SIGNAL field */
++	if (is_ofdm_rate(rate))
++		table_ptr = M_RT_DIRMAP_A;
++	else
++		table_ptr = M_RT_DIRMAP_B;
++
++	/* for a given rate, the LS-nibble of the PLCP SIGNAL field is
++	 * the index into the rate table.
++	 */
++	phy_rate = rate_info[rate] & BRCMS_RATE_MASK;
++	index = phy_rate & 0xf;
++
++	/* Find the SHM pointer to the rate table entry by looking in the
++	 * Direct-map Table
++	 */
++	return 2 * brcms_b_read_shm(wlc_hw, table_ptr + (index * 2));
++}
++
++static bool
++brcms_c_prec_enq_head(struct brcms_c_info *wlc, struct pktq *q,
++		      struct sk_buff *pkt, int prec, bool head)
++{
++	struct sk_buff *p;
++	int eprec = -1;		/* precedence to evict from */
++
++	/* Determine precedence from which to evict packet, if any */
++	if (pktq_pfull(q, prec))
++		eprec = prec;
++	else if (pktq_full(q)) {
++		p = brcmu_pktq_peek_tail(q, &eprec);
++		if (eprec > prec) {
++			wiphy_err(wlc->wiphy, "%s: Failing: eprec %d > prec %d"
++				  "\n", __func__, eprec, prec);
++			return false;
++		}
++	}
++
++	/* Evict if needed */
++	if (eprec >= 0) {
++		bool discard_oldest;
++
++		discard_oldest = ac_bitmap_tst(0, eprec);
++
++		/* Refuse newer packet unless configured to discard oldest */
++		if (eprec == prec && !discard_oldest) {
++			wiphy_err(wlc->wiphy, "%s: No where to go, prec == %d"
++				  "\n", __func__, prec);
++			return false;
++		}
++
++		/* Evict packet according to discard policy */
++		p = discard_oldest ? brcmu_pktq_pdeq(q, eprec) :
++			brcmu_pktq_pdeq_tail(q, eprec);
++		brcmu_pkt_buf_free_skb(p);
++	}
++
++	/* Enqueue */
++	if (head)
++		p = brcmu_pktq_penq_head(q, prec, pkt);
++	else
++		p = brcmu_pktq_penq(q, prec, pkt);
++
++	return true;
++}
++
++/*
++ * Attempts to queue a packet onto a multiple-precedence queue,
++ * if necessary evicting a lower precedence packet from the queue.
++ *
++ * 'prec' is the precedence number that has already been mapped
++ * from the packet priority.
++ *
++ * Returns true if packet consumed (queued), false if not.
++ */
++static bool brcms_c_prec_enq(struct brcms_c_info *wlc, struct pktq *q,
++		      struct sk_buff *pkt, int prec)
++{
++	return brcms_c_prec_enq_head(wlc, q, pkt, prec, false);
++}
++
++void brcms_c_txq_enq(struct brcms_c_info *wlc, struct scb *scb,
++		     struct sk_buff *sdu, uint prec)
++{
++	struct brcms_txq_info *qi = wlc->pkt_queue;	/* Check me */
++	struct pktq *q = &qi->q;
++	int prio;
++
++	prio = sdu->priority;
++
++	if (!brcms_c_prec_enq(wlc, q, sdu, prec)) {
++		/*
++		 * we might hit this condtion in case
++		 * packet flooding from mac80211 stack
++		 */
++		brcmu_pkt_buf_free_skb(sdu);
++	}
++}
++
++/*
++ * bcmc_fid_generate:
++ * Generate frame ID for a BCMC packet.  The frag field is not used
++ * for MC frames so is used as part of the sequence number.
++ */
++static inline u16
++bcmc_fid_generate(struct brcms_c_info *wlc, struct brcms_bss_cfg *bsscfg,
++		  struct d11txh *txh)
++{
++	u16 frameid;
++
++	frameid = le16_to_cpu(txh->TxFrameID) & ~(TXFID_SEQ_MASK |
++						  TXFID_QUEUE_MASK);
++	frameid |=
++	    (((wlc->
++	       mc_fid_counter++) << TXFID_SEQ_SHIFT) & TXFID_SEQ_MASK) |
++	    TX_BCMC_FIFO;
++
++	return frameid;
++}
++
++static uint
++brcms_c_calc_ack_time(struct brcms_c_info *wlc, u32 rspec,
++		      u8 preamble_type)
++{
++	uint dur = 0;
++
++	BCMMSG(wlc->wiphy, "wl%d: rspec 0x%x, preamble_type %d\n",
++		wlc->pub->unit, rspec, preamble_type);
++	/*
++	 * Spec 9.6: ack rate is the highest rate in BSSBasicRateSet that
++	 * is less than or equal to the rate of the immediately previous
++	 * frame in the FES
++	 */
++	rspec = brcms_basic_rate(wlc, rspec);
++	/* ACK frame len == 14 == 2(fc) + 2(dur) + 6(ra) + 4(fcs) */
++	dur =
++	    brcms_c_calc_frame_time(wlc, rspec, preamble_type,
++				(DOT11_ACK_LEN + FCS_LEN));
++	return dur;
++}
++
++static uint
++brcms_c_calc_cts_time(struct brcms_c_info *wlc, u32 rspec,
++		      u8 preamble_type)
++{
++	BCMMSG(wlc->wiphy, "wl%d: ratespec 0x%x, preamble_type %d\n",
++		wlc->pub->unit, rspec, preamble_type);
++	return brcms_c_calc_ack_time(wlc, rspec, preamble_type);
++}
++
++static uint
++brcms_c_calc_ba_time(struct brcms_c_info *wlc, u32 rspec,
++		     u8 preamble_type)
++{
++	BCMMSG(wlc->wiphy, "wl%d: rspec 0x%x, "
++		 "preamble_type %d\n", wlc->pub->unit, rspec, preamble_type);
++	/*
++	 * Spec 9.6: ack rate is the highest rate in BSSBasicRateSet that
++	 * is less than or equal to the rate of the immediately previous
++	 * frame in the FES
++	 */
++	rspec = brcms_basic_rate(wlc, rspec);
++	/* BA len == 32 == 16(ctl hdr) + 4(ba len) + 8(bitmap) + 4(fcs) */
++	return brcms_c_calc_frame_time(wlc, rspec, preamble_type,
++				   (DOT11_BA_LEN + DOT11_BA_BITMAP_LEN +
++				    FCS_LEN));
++}
++
++/* brcms_c_compute_frame_dur()
++ *
++ * Calculate the 802.11 MAC header DUR field for MPDU
++ * DUR for a single frame = 1 SIFS + 1 ACK
++ * DUR for a frame with following frags = 3 SIFS + 2 ACK + next frag time
++ *
++ * rate			MPDU rate in unit of 500kbps
++ * next_frag_len	next MPDU length in bytes
++ * preamble_type	use short/GF or long/MM PLCP header
++ */
++static u16
++brcms_c_compute_frame_dur(struct brcms_c_info *wlc, u32 rate,
++		      u8 preamble_type, uint next_frag_len)
++{
++	u16 dur, sifs;
++
++	sifs = get_sifs(wlc->band);
++
++	dur = sifs;
++	dur += (u16) brcms_c_calc_ack_time(wlc, rate, preamble_type);
++
++	if (next_frag_len) {
++		/* Double the current DUR to get 2 SIFS + 2 ACKs */
++		dur *= 2;
++		/* add another SIFS and the frag time */
++		dur += sifs;
++		dur +=
++		    (u16) brcms_c_calc_frame_time(wlc, rate, preamble_type,
++						 next_frag_len);
++	}
++	return dur;
++}
++
++/* The opposite of brcms_c_calc_frame_time */
++static uint
++brcms_c_calc_frame_len(struct brcms_c_info *wlc, u32 ratespec,
++		   u8 preamble_type, uint dur)
++{
++	uint nsyms, mac_len, Ndps, kNdps;
++	uint rate = rspec2rate(ratespec);
++
++	BCMMSG(wlc->wiphy, "wl%d: rspec 0x%x, preamble_type %d, dur %d\n",
++		 wlc->pub->unit, ratespec, preamble_type, dur);
++
++	if (is_mcs_rate(ratespec)) {
++		uint mcs = ratespec & RSPEC_RATE_MASK;
++		int tot_streams = mcs_2_txstreams(mcs) + rspec_stc(ratespec);
++		dur -= PREN_PREAMBLE + (tot_streams * PREN_PREAMBLE_EXT);
++		/* payload calculation matches that of regular ofdm */
++		if (wlc->band->bandtype == BRCM_BAND_2G)
++			dur -= DOT11_OFDM_SIGNAL_EXTENSION;
++		/* kNdbps = kbps * 4 */
++		kNdps =	mcs_2_rate(mcs, rspec_is40mhz(ratespec),
++				   rspec_issgi(ratespec)) * 4;
++		nsyms = dur / APHY_SYMBOL_TIME;
++		mac_len =
++		    ((nsyms * kNdps) -
++		     ((APHY_SERVICE_NBITS + APHY_TAIL_NBITS) * 1000)) / 8000;
++	} else if (is_ofdm_rate(ratespec)) {
++		dur -= APHY_PREAMBLE_TIME;
++		dur -= APHY_SIGNAL_TIME;
++		/* Ndbps = Mbps * 4 = rate(500Kbps) * 2 */
++		Ndps = rate * 2;
++		nsyms = dur / APHY_SYMBOL_TIME;
++		mac_len =
++		    ((nsyms * Ndps) -
++		     (APHY_SERVICE_NBITS + APHY_TAIL_NBITS)) / 8;
++	} else {
++		if (preamble_type & BRCMS_SHORT_PREAMBLE)
++			dur -= BPHY_PLCP_SHORT_TIME;
++		else
++			dur -= BPHY_PLCP_TIME;
++		mac_len = dur * rate;
++		/* divide out factor of 2 in rate (1/2 mbps) */
++		mac_len = mac_len / 8 / 2;
++	}
++	return mac_len;
++}
++
++/*
++ * Return true if the specified rate is supported by the specified band.
++ * BRCM_BAND_AUTO indicates the current band.
++ */
++static bool brcms_c_valid_rate(struct brcms_c_info *wlc, u32 rspec, int band,
++		    bool verbose)
++{
++	struct brcms_c_rateset *hw_rateset;
++	uint i;
++
++	if ((band == BRCM_BAND_AUTO) || (band == wlc->band->bandtype))
++		hw_rateset = &wlc->band->hw_rateset;
++	else if (wlc->pub->_nbands > 1)
++		hw_rateset = &wlc->bandstate[OTHERBANDUNIT(wlc)]->hw_rateset;
++	else
++		/* other band specified and we are a single band device */
++		return false;
++
++	/* check if this is a mimo rate */
++	if (is_mcs_rate(rspec)) {
++		if ((rspec & RSPEC_RATE_MASK) >= MCS_TABLE_SIZE)
++			goto error;
++
++		return isset(hw_rateset->mcs, (rspec & RSPEC_RATE_MASK));
++	}
++
++	for (i = 0; i < hw_rateset->count; i++)
++		if (hw_rateset->rates[i] == rspec2rate(rspec))
++			return true;
++ error:
++	if (verbose)
++		wiphy_err(wlc->wiphy, "wl%d: valid_rate: rate spec 0x%x "
++			  "not in hw_rateset\n", wlc->pub->unit, rspec);
++
++	return false;
++}
++
++static u32
++mac80211_wlc_set_nrate(struct brcms_c_info *wlc, struct brcms_band *cur_band,
++		       u32 int_val)
++{
++	u8 stf = (int_val & NRATE_STF_MASK) >> NRATE_STF_SHIFT;
++	u8 rate = int_val & NRATE_RATE_MASK;
++	u32 rspec;
++	bool ismcs = ((int_val & NRATE_MCS_INUSE) == NRATE_MCS_INUSE);
++	bool issgi = ((int_val & NRATE_SGI_MASK) >> NRATE_SGI_SHIFT);
++	bool override_mcs_only = ((int_val & NRATE_OVERRIDE_MCS_ONLY)
++				  == NRATE_OVERRIDE_MCS_ONLY);
++	int bcmerror = 0;
++
++	if (!ismcs)
++		return (u32) rate;
++
++	/* validate the combination of rate/mcs/stf is allowed */
++	if ((wlc->pub->_n_enab & SUPPORT_11N) && ismcs) {
++		/* mcs only allowed when nmode */
++		if (stf > PHY_TXC1_MODE_SDM) {
++			wiphy_err(wlc->wiphy, "wl%d: %s: Invalid stf\n",
++				  wlc->pub->unit, __func__);
++			bcmerror = -EINVAL;
++			goto done;
++		}
++
++		/* mcs 32 is a special case, DUP mode 40 only */
++		if (rate == 32) {
++			if (!CHSPEC_IS40(wlc->home_chanspec) ||
++			    ((stf != PHY_TXC1_MODE_SISO)
++			     && (stf != PHY_TXC1_MODE_CDD))) {
++				wiphy_err(wlc->wiphy, "wl%d: %s: Invalid mcs "
++					  "32\n", wlc->pub->unit, __func__);
++				bcmerror = -EINVAL;
++				goto done;
++			}
++			/* mcs > 7 must use stf SDM */
++		} else if (rate > HIGHEST_SINGLE_STREAM_MCS) {
++			/* mcs > 7 must use stf SDM */
++			if (stf != PHY_TXC1_MODE_SDM) {
++				BCMMSG(wlc->wiphy, "wl%d: enabling "
++				       "SDM mode for mcs %d\n",
++				       wlc->pub->unit, rate);
++				stf = PHY_TXC1_MODE_SDM;
++			}
++		} else {
++			/*
++			 * MCS 0-7 may use SISO, CDD, and for
++			 * phy_rev >= 3 STBC
++			 */
++			if ((stf > PHY_TXC1_MODE_STBC) ||
++			    (!BRCMS_STBC_CAP_PHY(wlc)
++			     && (stf == PHY_TXC1_MODE_STBC))) {
++				wiphy_err(wlc->wiphy, "wl%d: %s: Invalid STBC"
++					  "\n", wlc->pub->unit, __func__);
++				bcmerror = -EINVAL;
++				goto done;
++			}
++		}
++	} else if (is_ofdm_rate(rate)) {
++		if ((stf != PHY_TXC1_MODE_CDD) && (stf != PHY_TXC1_MODE_SISO)) {
++			wiphy_err(wlc->wiphy, "wl%d: %s: Invalid OFDM\n",
++				  wlc->pub->unit, __func__);
++			bcmerror = -EINVAL;
++			goto done;
++		}
++	} else if (is_cck_rate(rate)) {
++		if ((cur_band->bandtype != BRCM_BAND_2G)
++		    || (stf != PHY_TXC1_MODE_SISO)) {
++			wiphy_err(wlc->wiphy, "wl%d: %s: Invalid CCK\n",
++				  wlc->pub->unit, __func__);
++			bcmerror = -EINVAL;
++			goto done;
++		}
++	} else {
++		wiphy_err(wlc->wiphy, "wl%d: %s: Unknown rate type\n",
++			  wlc->pub->unit, __func__);
++		bcmerror = -EINVAL;
++		goto done;
++	}
++	/* make sure multiple antennae are available for non-siso rates */
++	if ((stf != PHY_TXC1_MODE_SISO) && (wlc->stf->txstreams == 1)) {
++		wiphy_err(wlc->wiphy, "wl%d: %s: SISO antenna but !SISO "
++			  "request\n", wlc->pub->unit, __func__);
++		bcmerror = -EINVAL;
++		goto done;
++	}
++
++	rspec = rate;
++	if (ismcs) {
++		rspec |= RSPEC_MIMORATE;
++		/* For STBC populate the STC field of the ratespec */
++		if (stf == PHY_TXC1_MODE_STBC) {
++			u8 stc;
++			stc = 1;	/* Nss for single stream is always 1 */
++			rspec |= (stc << RSPEC_STC_SHIFT);
++		}
++	}
++
++	rspec |= (stf << RSPEC_STF_SHIFT);
++
++	if (override_mcs_only)
++		rspec |= RSPEC_OVERRIDE_MCS_ONLY;
++
++	if (issgi)
++		rspec |= RSPEC_SHORT_GI;
++
++	if ((rate != 0)
++	    && !brcms_c_valid_rate(wlc, rspec, cur_band->bandtype, true))
++		return rate;
++
++	return rspec;
++done:
++	return rate;
++}
++
++/*
++ * Compute PLCP, but only requires actual rate and length of pkt.
++ * Rate is given in the driver standard multiple of 500 kbps.
++ * le is set for 11 Mbps rate if necessary.
++ * Broken out for PRQ.
++ */
++
++static void brcms_c_cck_plcp_set(struct brcms_c_info *wlc, int rate_500,
++			     uint length, u8 *plcp)
++{
++	u16 usec = 0;
++	u8 le = 0;
++
++	switch (rate_500) {
++	case BRCM_RATE_1M:
++		usec = length << 3;
++		break;
++	case BRCM_RATE_2M:
++		usec = length << 2;
++		break;
++	case BRCM_RATE_5M5:
++		usec = (length << 4) / 11;
++		if ((length << 4) - (usec * 11) > 0)
++			usec++;
++		break;
++	case BRCM_RATE_11M:
++		usec = (length << 3) / 11;
++		if ((length << 3) - (usec * 11) > 0) {
++			usec++;
++			if ((usec * 11) - (length << 3) >= 8)
++				le = D11B_PLCP_SIGNAL_LE;
++		}
++		break;
++
++	default:
++		wiphy_err(wlc->wiphy,
++			  "brcms_c_cck_plcp_set: unsupported rate %d\n",
++			  rate_500);
++		rate_500 = BRCM_RATE_1M;
++		usec = length << 3;
++		break;
++	}
++	/* PLCP signal byte */
++	plcp[0] = rate_500 * 5;	/* r (500kbps) * 5 == r (100kbps) */
++	/* PLCP service byte */
++	plcp[1] = (u8) (le | D11B_PLCP_SIGNAL_LOCKED);
++	/* PLCP length u16, little endian */
++	plcp[2] = usec & 0xff;
++	plcp[3] = (usec >> 8) & 0xff;
++	/* PLCP CRC16 */
++	plcp[4] = 0;
++	plcp[5] = 0;
++}
++
++/* Rate: 802.11 rate code, length: PSDU length in octets */
++static void brcms_c_compute_mimo_plcp(u32 rspec, uint length, u8 *plcp)
++{
++	u8 mcs = (u8) (rspec & RSPEC_RATE_MASK);
++	plcp[0] = mcs;
++	if (rspec_is40mhz(rspec) || (mcs == 32))
++		plcp[0] |= MIMO_PLCP_40MHZ;
++	BRCMS_SET_MIMO_PLCP_LEN(plcp, length);
++	plcp[3] = rspec_mimoplcp3(rspec); /* rspec already holds this byte */
++	plcp[3] |= 0x7; /* set smoothing, not sounding ppdu & reserved */
++	plcp[4] = 0; /* number of extension spatial streams bit 0 & 1 */
++	plcp[5] = 0;
++}
++
++/* Rate: 802.11 rate code, length: PSDU length in octets */
++static void
++brcms_c_compute_ofdm_plcp(u32 rspec, u32 length, u8 *plcp)
++{
++	u8 rate_signal;
++	u32 tmp = 0;
++	int rate = rspec2rate(rspec);
++
++	/*
++	 * encode rate per 802.11a-1999 sec 17.3.4.1, with lsb
++	 * transmitted first
++	 */
++	rate_signal = rate_info[rate] & BRCMS_RATE_MASK;
++	memset(plcp, 0, D11_PHY_HDR_LEN);
++	D11A_PHY_HDR_SRATE((struct ofdm_phy_hdr *) plcp, rate_signal);
++
++	tmp = (length & 0xfff) << 5;
++	plcp[2] |= (tmp >> 16) & 0xff;
++	plcp[1] |= (tmp >> 8) & 0xff;
++	plcp[0] |= tmp & 0xff;
++}
++
++/* Rate: 802.11 rate code, length: PSDU length in octets */
++static void brcms_c_compute_cck_plcp(struct brcms_c_info *wlc, u32 rspec,
++				 uint length, u8 *plcp)
++{
++	int rate = rspec2rate(rspec);
++
++	brcms_c_cck_plcp_set(wlc, rate, length, plcp);
++}
++
++static void
++brcms_c_compute_plcp(struct brcms_c_info *wlc, u32 rspec,
++		     uint length, u8 *plcp)
++{
++	if (is_mcs_rate(rspec))
++		brcms_c_compute_mimo_plcp(rspec, length, plcp);
++	else if (is_ofdm_rate(rspec))
++		brcms_c_compute_ofdm_plcp(rspec, length, plcp);
++	else
++		brcms_c_compute_cck_plcp(wlc, rspec, length, plcp);
++}
++
++/* brcms_c_compute_rtscts_dur()
++ *
++ * Calculate the 802.11 MAC header DUR field for an RTS or CTS frame
++ * DUR for normal RTS/CTS w/ frame = 3 SIFS + 1 CTS + next frame time + 1 ACK
++ * DUR for CTS-TO-SELF w/ frame    = 2 SIFS         + next frame time + 1 ACK
++ *
++ * cts			cts-to-self or rts/cts
++ * rts_rate		rts or cts rate in unit of 500kbps
++ * rate			next MPDU rate in unit of 500kbps
++ * frame_len		next MPDU frame length in bytes
++ */
++u16
++brcms_c_compute_rtscts_dur(struct brcms_c_info *wlc, bool cts_only,
++			   u32 rts_rate,
++			   u32 frame_rate, u8 rts_preamble_type,
++			   u8 frame_preamble_type, uint frame_len, bool ba)
++{
++	u16 dur, sifs;
++
++	sifs = get_sifs(wlc->band);
++
++	if (!cts_only) {
++		/* RTS/CTS */
++		dur = 3 * sifs;
++		dur +=
++		    (u16) brcms_c_calc_cts_time(wlc, rts_rate,
++					       rts_preamble_type);
++	} else {
++		/* CTS-TO-SELF */
++		dur = 2 * sifs;
++	}
++
++	dur +=
++	    (u16) brcms_c_calc_frame_time(wlc, frame_rate, frame_preamble_type,
++					 frame_len);
++	if (ba)
++		dur +=
++		    (u16) brcms_c_calc_ba_time(wlc, frame_rate,
++					      BRCMS_SHORT_PREAMBLE);
++	else
++		dur +=
++		    (u16) brcms_c_calc_ack_time(wlc, frame_rate,
++					       frame_preamble_type);
++	return dur;
++}
++
++static u16 brcms_c_phytxctl1_calc(struct brcms_c_info *wlc, u32 rspec)
++{
++	u16 phyctl1 = 0;
++	u16 bw;
++
++	if (BRCMS_ISLCNPHY(wlc->band)) {
++		bw = PHY_TXC1_BW_20MHZ;
++	} else {
++		bw = rspec_get_bw(rspec);
++		/* 10Mhz is not supported yet */
++		if (bw < PHY_TXC1_BW_20MHZ) {
++			wiphy_err(wlc->wiphy, "phytxctl1_calc: bw %d is "
++				  "not supported yet, set to 20L\n", bw);
++			bw = PHY_TXC1_BW_20MHZ;
++		}
++	}
++
++	if (is_mcs_rate(rspec)) {
++		uint mcs = rspec & RSPEC_RATE_MASK;
++
++		/* bw, stf, coding-type is part of rspec_phytxbyte2 returns */
++		phyctl1 = rspec_phytxbyte2(rspec);
++		/* set the upper byte of phyctl1 */
++		phyctl1 |= (mcs_table[mcs].tx_phy_ctl3 << 8);
++	} else if (is_cck_rate(rspec) && !BRCMS_ISLCNPHY(wlc->band)
++		   && !BRCMS_ISSSLPNPHY(wlc->band)) {
++		/*
++		 * In CCK mode LPPHY overloads OFDM Modulation bits with CCK
++		 * Data Rate. Eventually MIMOPHY would also be converted to
++		 * this format
++		 */
++		/* 0 = 1Mbps; 1 = 2Mbps; 2 = 5.5Mbps; 3 = 11Mbps */
++		phyctl1 = (bw | (rspec_stf(rspec) << PHY_TXC1_MODE_SHIFT));
++	} else {		/* legacy OFDM/CCK */
++		s16 phycfg;
++		/* get the phyctl byte from rate phycfg table */
++		phycfg = brcms_c_rate_legacy_phyctl(rspec2rate(rspec));
++		if (phycfg == -1) {
++			wiphy_err(wlc->wiphy, "phytxctl1_calc: wrong "
++				  "legacy OFDM/CCK rate\n");
++			phycfg = 0;
++		}
++		/* set the upper byte of phyctl1 */
++		phyctl1 =
++		    (bw | (phycfg << 8) |
++		     (rspec_stf(rspec) << PHY_TXC1_MODE_SHIFT));
++	}
++	return phyctl1;
++}
++
++/*
++ * Add struct d11txh, struct cck_phy_hdr.
++ *
++ * 'p' data must start with 802.11 MAC header
++ * 'p' must allow enough bytes of local headers to be "pushed" onto the packet
++ *
++ * headroom == D11_PHY_HDR_LEN + D11_TXH_LEN (D11_TXH_LEN is now 104 bytes)
++ *
++ */
++static u16
++brcms_c_d11hdrs_mac80211(struct brcms_c_info *wlc, struct ieee80211_hw *hw,
++		     struct sk_buff *p, struct scb *scb, uint frag,
++		     uint nfrags, uint queue, uint next_frag_len)
++{
++	struct ieee80211_hdr *h;
++	struct d11txh *txh;
++	u8 *plcp, plcp_fallback[D11_PHY_HDR_LEN];
++	int len, phylen, rts_phylen;
++	u16 mch, phyctl, xfts, mainrates;
++	u16 seq = 0, mcl = 0, status = 0, frameid = 0;
++	u32 rspec[2] = { BRCM_RATE_1M, BRCM_RATE_1M };
++	u32 rts_rspec[2] = { BRCM_RATE_1M, BRCM_RATE_1M };
++	bool use_rts = false;
++	bool use_cts = false;
++	bool use_rifs = false;
++	bool short_preamble[2] = { false, false };
++	u8 preamble_type[2] = { BRCMS_LONG_PREAMBLE, BRCMS_LONG_PREAMBLE };
++	u8 rts_preamble_type[2] = { BRCMS_LONG_PREAMBLE, BRCMS_LONG_PREAMBLE };
++	u8 *rts_plcp, rts_plcp_fallback[D11_PHY_HDR_LEN];
++	struct ieee80211_rts *rts = NULL;
++	bool qos;
++	uint ac;
++	bool hwtkmic = false;
++	u16 mimo_ctlchbw = PHY_TXC1_BW_20MHZ;
++#define ANTCFG_NONE 0xFF
++	u8 antcfg = ANTCFG_NONE;
++	u8 fbantcfg = ANTCFG_NONE;
++	uint phyctl1_stf = 0;
++	u16 durid = 0;
++	struct ieee80211_tx_rate *txrate[2];
++	int k;
++	struct ieee80211_tx_info *tx_info;
++	bool is_mcs;
++	u16 mimo_txbw;
++	u8 mimo_preamble_type;
++
++	/* locate 802.11 MAC header */
++	h = (struct ieee80211_hdr *)(p->data);
++	qos = ieee80211_is_data_qos(h->frame_control);
++
++	/* compute length of frame in bytes for use in PLCP computations */
++	len = p->len;
++	phylen = len + FCS_LEN;
++
++	/* Get tx_info */
++	tx_info = IEEE80211_SKB_CB(p);
++
++	/* add PLCP */
++	plcp = skb_push(p, D11_PHY_HDR_LEN);
++
++	/* add Broadcom tx descriptor header */
++	txh = (struct d11txh *) skb_push(p, D11_TXH_LEN);
++	memset(txh, 0, D11_TXH_LEN);
++
++	/* setup frameid */
++	if (tx_info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
++		/* non-AP STA should never use BCMC queue */
++		if (queue == TX_BCMC_FIFO) {
++			wiphy_err(wlc->wiphy, "wl%d: %s: ASSERT queue == "
++				  "TX_BCMC!\n", wlc->pub->unit, __func__);
++			frameid = bcmc_fid_generate(wlc, NULL, txh);
++		} else {
++			/* Increment the counter for first fragment */
++			if (tx_info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)
++				scb->seqnum[p->priority]++;
++
++			/* extract fragment number from frame first */
++			seq = le16_to_cpu(h->seq_ctrl) & FRAGNUM_MASK;
++			seq |= (scb->seqnum[p->priority] << SEQNUM_SHIFT);
++			h->seq_ctrl = cpu_to_le16(seq);
++
++			frameid = ((seq << TXFID_SEQ_SHIFT) & TXFID_SEQ_MASK) |
++			    (queue & TXFID_QUEUE_MASK);
++		}
++	}
++	frameid |= queue & TXFID_QUEUE_MASK;
++
++	/* set the ignpmq bit for all pkts tx'd in PS mode and for beacons */
++	if (ieee80211_is_beacon(h->frame_control))
++		mcl |= TXC_IGNOREPMQ;
++
++	txrate[0] = tx_info->control.rates;
++	txrate[1] = txrate[0] + 1;
++
++	/*
++	 * if rate control algorithm didn't give us a fallback
++	 * rate, use the primary rate
++	 */
++	if (txrate[1]->idx < 0)
++		txrate[1] = txrate[0];
++
++	for (k = 0; k < hw->max_rates; k++) {
++		is_mcs = txrate[k]->flags & IEEE80211_TX_RC_MCS ? true : false;
++		if (!is_mcs) {
++			if ((txrate[k]->idx >= 0)
++			    && (txrate[k]->idx <
++				hw->wiphy->bands[tx_info->band]->n_bitrates)) {
++				rspec[k] =
++				    hw->wiphy->bands[tx_info->band]->
++				    bitrates[txrate[k]->idx].hw_value;
++				short_preamble[k] =
++				    txrate[k]->
++				    flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE ?
++				    true : false;
++			} else {
++				rspec[k] = BRCM_RATE_1M;
++			}
++		} else {
++			rspec[k] = mac80211_wlc_set_nrate(wlc, wlc->band,
++					NRATE_MCS_INUSE | txrate[k]->idx);
++		}
++
++		/*
++		 * Currently only support same setting for primay and
++		 * fallback rates. Unify flags for each rate into a
++		 * single value for the frame
++		 */
++		use_rts |=
++		    txrate[k]->
++		    flags & IEEE80211_TX_RC_USE_RTS_CTS ? true : false;
++		use_cts |=
++		    txrate[k]->
++		    flags & IEEE80211_TX_RC_USE_CTS_PROTECT ? true : false;
++
++
++		/*
++		 * (1) RATE:
++		 *   determine and validate primary rate
++		 *   and fallback rates
++		 */
++		if (!rspec_active(rspec[k])) {
++			rspec[k] = BRCM_RATE_1M;
++		} else {
++			if (!is_multicast_ether_addr(h->addr1)) {
++				/* set tx antenna config */
++				brcms_c_antsel_antcfg_get(wlc->asi, false,
++					false, 0, 0, &antcfg, &fbantcfg);
++			}
++		}
++	}
++
++	phyctl1_stf = wlc->stf->ss_opmode;
++
++	if (wlc->pub->_n_enab & SUPPORT_11N) {
++		for (k = 0; k < hw->max_rates; k++) {
++			/*
++			 * apply siso/cdd to single stream mcs's or ofdm
++			 * if rspec is auto selected
++			 */
++			if (((is_mcs_rate(rspec[k]) &&
++			      is_single_stream(rspec[k] & RSPEC_RATE_MASK)) ||
++			     is_ofdm_rate(rspec[k]))
++			    && ((rspec[k] & RSPEC_OVERRIDE_MCS_ONLY)
++				|| !(rspec[k] & RSPEC_OVERRIDE))) {
++				rspec[k] &= ~(RSPEC_STF_MASK | RSPEC_STC_MASK);
++
++				/* For SISO MCS use STBC if possible */
++				if (is_mcs_rate(rspec[k])
++				    && BRCMS_STF_SS_STBC_TX(wlc, scb)) {
++					u8 stc;
++
++					/* Nss for single stream is always 1 */
++					stc = 1;
++					rspec[k] |= (PHY_TXC1_MODE_STBC <<
++							RSPEC_STF_SHIFT) |
++						    (stc << RSPEC_STC_SHIFT);
++				} else
++					rspec[k] |=
++					    (phyctl1_stf << RSPEC_STF_SHIFT);
++			}
++
++			/*
++			 * Is the phy configured to use 40MHZ frames? If
++			 * so then pick the desired txbw
++			 */
++			if (brcms_chspec_bw(wlc->chanspec) == BRCMS_40_MHZ) {
++				/* default txbw is 20in40 SB */
++				mimo_ctlchbw = mimo_txbw =
++				   CHSPEC_SB_UPPER(wlc_phy_chanspec_get(
++								 wlc->band->pi))
++				   ? PHY_TXC1_BW_20MHZ_UP : PHY_TXC1_BW_20MHZ;
++
++				if (is_mcs_rate(rspec[k])) {
++					/* mcs 32 must be 40b/w DUP */
++					if ((rspec[k] & RSPEC_RATE_MASK)
++					    == 32) {
++						mimo_txbw =
++						    PHY_TXC1_BW_40MHZ_DUP;
++						/* use override */
++					} else if (wlc->mimo_40txbw != AUTO)
++						mimo_txbw = wlc->mimo_40txbw;
++					/* else check if dst is using 40 Mhz */
++					else if (scb->flags & SCB_IS40)
++						mimo_txbw = PHY_TXC1_BW_40MHZ;
++				} else if (is_ofdm_rate(rspec[k])) {
++					if (wlc->ofdm_40txbw != AUTO)
++						mimo_txbw = wlc->ofdm_40txbw;
++				} else if (wlc->cck_40txbw != AUTO) {
++					mimo_txbw = wlc->cck_40txbw;
++				}
++			} else {
++				/*
++				 * mcs32 is 40 b/w only.
++				 * This is possible for probe packets on
++				 * a STA during SCAN
++				 */
++				if ((rspec[k] & RSPEC_RATE_MASK) == 32)
++					/* mcs 0 */
++					rspec[k] = RSPEC_MIMORATE;
++
++				mimo_txbw = PHY_TXC1_BW_20MHZ;
++			}
++
++			/* Set channel width */
++			rspec[k] &= ~RSPEC_BW_MASK;
++			if ((k == 0) || ((k > 0) && is_mcs_rate(rspec[k])))
++				rspec[k] |= (mimo_txbw << RSPEC_BW_SHIFT);
++			else
++				rspec[k] |= (mimo_ctlchbw << RSPEC_BW_SHIFT);
++
++			/* Disable short GI, not supported yet */
++			rspec[k] &= ~RSPEC_SHORT_GI;
++
++			mimo_preamble_type = BRCMS_MM_PREAMBLE;
++			if (txrate[k]->flags & IEEE80211_TX_RC_GREEN_FIELD)
++				mimo_preamble_type = BRCMS_GF_PREAMBLE;
++
++			if ((txrate[k]->flags & IEEE80211_TX_RC_MCS)
++			    && (!is_mcs_rate(rspec[k]))) {
++				wiphy_err(wlc->wiphy, "wl%d: %s: IEEE80211_TX_"
++					  "RC_MCS != is_mcs_rate(rspec)\n",
++					  wlc->pub->unit, __func__);
++			}
++
++			if (is_mcs_rate(rspec[k])) {
++				preamble_type[k] = mimo_preamble_type;
++
++				/*
++				 * if SGI is selected, then forced mm
++				 * for single stream
++				 */
++				if ((rspec[k] & RSPEC_SHORT_GI)
++				    && is_single_stream(rspec[k] &
++							RSPEC_RATE_MASK))
++					preamble_type[k] = BRCMS_MM_PREAMBLE;
++			}
++
++			/* should be better conditionalized */
++			if (!is_mcs_rate(rspec[0])
++			    && (tx_info->control.rates[0].
++				flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE))
++				preamble_type[k] = BRCMS_SHORT_PREAMBLE;
++		}
++	} else {
++		for (k = 0; k < hw->max_rates; k++) {
++			/* Set ctrlchbw as 20Mhz */
++			rspec[k] &= ~RSPEC_BW_MASK;
++			rspec[k] |= (PHY_TXC1_BW_20MHZ << RSPEC_BW_SHIFT);
++
++			/* for nphy, stf of ofdm frames must follow policies */
++			if (BRCMS_ISNPHY(wlc->band) && is_ofdm_rate(rspec[k])) {
++				rspec[k] &= ~RSPEC_STF_MASK;
++				rspec[k] |= phyctl1_stf << RSPEC_STF_SHIFT;
++			}
++		}
++	}
++
++	/* Reset these for use with AMPDU's */
++	txrate[0]->count = 0;
++	txrate[1]->count = 0;
++
++	/* (2) PROTECTION, may change rspec */
++	if ((ieee80211_is_data(h->frame_control) ||
++	    ieee80211_is_mgmt(h->frame_control)) &&
++	    (phylen > wlc->RTSThresh) && !is_multicast_ether_addr(h->addr1))
++		use_rts = true;
++
++	/* (3) PLCP: determine PLCP header and MAC duration,
++	 * fill struct d11txh */
++	brcms_c_compute_plcp(wlc, rspec[0], phylen, plcp);
++	brcms_c_compute_plcp(wlc, rspec[1], phylen, plcp_fallback);
++	memcpy(&txh->FragPLCPFallback,
++	       plcp_fallback, sizeof(txh->FragPLCPFallback));
++
++	/* Length field now put in CCK FBR CRC field */
++	if (is_cck_rate(rspec[1])) {
++		txh->FragPLCPFallback[4] = phylen & 0xff;
++		txh->FragPLCPFallback[5] = (phylen & 0xff00) >> 8;
++	}
++
++	/* MIMO-RATE: need validation ?? */
++	mainrates = is_ofdm_rate(rspec[0]) ?
++			D11A_PHY_HDR_GRATE((struct ofdm_phy_hdr *) plcp) :
++			plcp[0];
++
++	/* DUR field for main rate */
++	if (!ieee80211_is_pspoll(h->frame_control) &&
++	    !is_multicast_ether_addr(h->addr1) && !use_rifs) {
++		durid =
++		    brcms_c_compute_frame_dur(wlc, rspec[0], preamble_type[0],
++					  next_frag_len);
++		h->duration_id = cpu_to_le16(durid);
++	} else if (use_rifs) {
++		/* NAV protect to end of next max packet size */
++		durid =
++		    (u16) brcms_c_calc_frame_time(wlc, rspec[0],
++						 preamble_type[0],
++						 DOT11_MAX_FRAG_LEN);
++		durid += RIFS_11N_TIME;
++		h->duration_id = cpu_to_le16(durid);
++	}
++
++	/* DUR field for fallback rate */
++	if (ieee80211_is_pspoll(h->frame_control))
++		txh->FragDurFallback = h->duration_id;
++	else if (is_multicast_ether_addr(h->addr1) || use_rifs)
++		txh->FragDurFallback = 0;
++	else {
++		durid = brcms_c_compute_frame_dur(wlc, rspec[1],
++					      preamble_type[1], next_frag_len);
++		txh->FragDurFallback = cpu_to_le16(durid);
++	}
++
++	/* (4) MAC-HDR: MacTxControlLow */
++	if (frag == 0)
++		mcl |= TXC_STARTMSDU;
++
++	if (!is_multicast_ether_addr(h->addr1))
++		mcl |= TXC_IMMEDACK;
++
++	if (wlc->band->bandtype == BRCM_BAND_5G)
++		mcl |= TXC_FREQBAND_5G;
++
++	if (CHSPEC_IS40(wlc_phy_chanspec_get(wlc->band->pi)))
++		mcl |= TXC_BW_40;
++
++	/* set AMIC bit if using hardware TKIP MIC */
++	if (hwtkmic)
++		mcl |= TXC_AMIC;
++
++	txh->MacTxControlLow = cpu_to_le16(mcl);
++
++	/* MacTxControlHigh */
++	mch = 0;
++
++	/* Set fallback rate preamble type */
++	if ((preamble_type[1] == BRCMS_SHORT_PREAMBLE) ||
++	    (preamble_type[1] == BRCMS_GF_PREAMBLE)) {
++		if (rspec2rate(rspec[1]) != BRCM_RATE_1M)
++			mch |= TXC_PREAMBLE_DATA_FB_SHORT;
++	}
++
++	/* MacFrameControl */
++	memcpy(&txh->MacFrameControl, &h->frame_control, sizeof(u16));
++	txh->TxFesTimeNormal = cpu_to_le16(0);
++
++	txh->TxFesTimeFallback = cpu_to_le16(0);
++
++	/* TxFrameRA */
++	memcpy(&txh->TxFrameRA, &h->addr1, ETH_ALEN);
++
++	/* TxFrameID */
++	txh->TxFrameID = cpu_to_le16(frameid);
++
++	/*
++	 * TxStatus, Note the case of recreating the first frag of a suppressed
++	 * frame then we may need to reset the retry cnt's via the status reg
++	 */
++	txh->TxStatus = cpu_to_le16(status);
++
++	/*
++	 * extra fields for ucode AMPDU aggregation, the new fields are added to
++	 * the END of previous structure so that it's compatible in driver.
++	 */
++	txh->MaxNMpdus = cpu_to_le16(0);
++	txh->MaxABytes_MRT = cpu_to_le16(0);
++	txh->MaxABytes_FBR = cpu_to_le16(0);
++	txh->MinMBytes = cpu_to_le16(0);
++
++	/* (5) RTS/CTS: determine RTS/CTS PLCP header and MAC duration,
++	 * furnish struct d11txh */
++	/* RTS PLCP header and RTS frame */
++	if (use_rts || use_cts) {
++		if (use_rts && use_cts)
++			use_cts = false;
++
++		for (k = 0; k < 2; k++) {
++			rts_rspec[k] = brcms_c_rspec_to_rts_rspec(wlc, rspec[k],
++							      false,
++							      mimo_ctlchbw);
++		}
++
++		if (!is_ofdm_rate(rts_rspec[0]) &&
++		    !((rspec2rate(rts_rspec[0]) == BRCM_RATE_1M) ||
++		      (wlc->PLCPHdr_override == BRCMS_PLCP_LONG))) {
++			rts_preamble_type[0] = BRCMS_SHORT_PREAMBLE;
++			mch |= TXC_PREAMBLE_RTS_MAIN_SHORT;
++		}
++
++		if (!is_ofdm_rate(rts_rspec[1]) &&
++		    !((rspec2rate(rts_rspec[1]) == BRCM_RATE_1M) ||
++		      (wlc->PLCPHdr_override == BRCMS_PLCP_LONG))) {
++			rts_preamble_type[1] = BRCMS_SHORT_PREAMBLE;
++			mch |= TXC_PREAMBLE_RTS_FB_SHORT;
++		}
++
++		/* RTS/CTS additions to MacTxControlLow */
++		if (use_cts) {
++			txh->MacTxControlLow |= cpu_to_le16(TXC_SENDCTS);
++		} else {
++			txh->MacTxControlLow |= cpu_to_le16(TXC_SENDRTS);
++			txh->MacTxControlLow |= cpu_to_le16(TXC_LONGFRAME);
++		}
++
++		/* RTS PLCP header */
++		rts_plcp = txh->RTSPhyHeader;
++		if (use_cts)
++			rts_phylen = DOT11_CTS_LEN + FCS_LEN;
++		else
++			rts_phylen = DOT11_RTS_LEN + FCS_LEN;
++
++		brcms_c_compute_plcp(wlc, rts_rspec[0], rts_phylen, rts_plcp);
++
++		/* fallback rate version of RTS PLCP header */
++		brcms_c_compute_plcp(wlc, rts_rspec[1], rts_phylen,
++				 rts_plcp_fallback);
++		memcpy(&txh->RTSPLCPFallback, rts_plcp_fallback,
++		       sizeof(txh->RTSPLCPFallback));
++
++		/* RTS frame fields... */
++		rts = (struct ieee80211_rts *)&txh->rts_frame;
++
++		durid = brcms_c_compute_rtscts_dur(wlc, use_cts, rts_rspec[0],
++					       rspec[0], rts_preamble_type[0],
++					       preamble_type[0], phylen, false);
++		rts->duration = cpu_to_le16(durid);
++		/* fallback rate version of RTS DUR field */
++		durid = brcms_c_compute_rtscts_dur(wlc, use_cts,
++					       rts_rspec[1], rspec[1],
++					       rts_preamble_type[1],
++					       preamble_type[1], phylen, false);
++		txh->RTSDurFallback = cpu_to_le16(durid);
++
++		if (use_cts) {
++			rts->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
++							 IEEE80211_STYPE_CTS);
++
++			memcpy(&rts->ra, &h->addr2, ETH_ALEN);
++		} else {
++			rts->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
++							 IEEE80211_STYPE_RTS);
++
++			memcpy(&rts->ra, &h->addr1, 2 * ETH_ALEN);
++		}
++
++		/* mainrate
++		 *    low 8 bits: main frag rate/mcs,
++		 *    high 8 bits: rts/cts rate/mcs
++		 */
++		mainrates |= (is_ofdm_rate(rts_rspec[0]) ?
++				D11A_PHY_HDR_GRATE(
++					(struct ofdm_phy_hdr *) rts_plcp) :
++				rts_plcp[0]) << 8;
++	} else {
++		memset((char *)txh->RTSPhyHeader, 0, D11_PHY_HDR_LEN);
++		memset((char *)&txh->rts_frame, 0,
++			sizeof(struct ieee80211_rts));
++		memset((char *)txh->RTSPLCPFallback, 0,
++		      sizeof(txh->RTSPLCPFallback));
++		txh->RTSDurFallback = 0;
++	}
++
++#ifdef SUPPORT_40MHZ
++	/* add null delimiter count */
++	if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && is_mcs_rate(rspec))
++		txh->RTSPLCPFallback[AMPDU_FBR_NULL_DELIM] =
++		   brcm_c_ampdu_null_delim_cnt(wlc->ampdu, scb, rspec, phylen);
++
++#endif
++
++	/*
++	 * Now that RTS/RTS FB preamble types are updated, write
++	 * the final value
++	 */
++	txh->MacTxControlHigh = cpu_to_le16(mch);
++
++	/*
++	 * MainRates (both the rts and frag plcp rates have
++	 * been calculated now)
++	 */
++	txh->MainRates = cpu_to_le16(mainrates);
++
++	/* XtraFrameTypes */
++	xfts = frametype(rspec[1], wlc->mimoft);
++	xfts |= (frametype(rts_rspec[0], wlc->mimoft) << XFTS_RTS_FT_SHIFT);
++	xfts |= (frametype(rts_rspec[1], wlc->mimoft) << XFTS_FBRRTS_FT_SHIFT);
++	xfts |= CHSPEC_CHANNEL(wlc_phy_chanspec_get(wlc->band->pi)) <<
++							     XFTS_CHANNEL_SHIFT;
++	txh->XtraFrameTypes = cpu_to_le16(xfts);
++
++	/* PhyTxControlWord */
++	phyctl = frametype(rspec[0], wlc->mimoft);
++	if ((preamble_type[0] == BRCMS_SHORT_PREAMBLE) ||
++	    (preamble_type[0] == BRCMS_GF_PREAMBLE)) {
++		if (rspec2rate(rspec[0]) != BRCM_RATE_1M)
++			phyctl |= PHY_TXC_SHORT_HDR;
++	}
++
++	/* phytxant is properly bit shifted */
++	phyctl |= brcms_c_stf_d11hdrs_phyctl_txant(wlc, rspec[0]);
++	txh->PhyTxControlWord = cpu_to_le16(phyctl);
++
++	/* PhyTxControlWord_1 */
++	if (BRCMS_PHY_11N_CAP(wlc->band)) {
++		u16 phyctl1 = 0;
++
++		phyctl1 = brcms_c_phytxctl1_calc(wlc, rspec[0]);
++		txh->PhyTxControlWord_1 = cpu_to_le16(phyctl1);
++		phyctl1 = brcms_c_phytxctl1_calc(wlc, rspec[1]);
++		txh->PhyTxControlWord_1_Fbr = cpu_to_le16(phyctl1);
++
++		if (use_rts || use_cts) {
++			phyctl1 = brcms_c_phytxctl1_calc(wlc, rts_rspec[0]);
++			txh->PhyTxControlWord_1_Rts = cpu_to_le16(phyctl1);
++			phyctl1 = brcms_c_phytxctl1_calc(wlc, rts_rspec[1]);
++			txh->PhyTxControlWord_1_FbrRts = cpu_to_le16(phyctl1);
++		}
++
++		/*
++		 * For mcs frames, if mixedmode(overloaded with long preamble)
++		 * is going to be set, fill in non-zero MModeLen and/or
++		 * MModeFbrLen it will be unnecessary if they are separated
++		 */
++		if (is_mcs_rate(rspec[0]) &&
++		    (preamble_type[0] == BRCMS_MM_PREAMBLE)) {
++			u16 mmodelen =
++			    brcms_c_calc_lsig_len(wlc, rspec[0], phylen);
++			txh->MModeLen = cpu_to_le16(mmodelen);
++		}
++
++		if (is_mcs_rate(rspec[1]) &&
++		    (preamble_type[1] == BRCMS_MM_PREAMBLE)) {
++			u16 mmodefbrlen =
++			    brcms_c_calc_lsig_len(wlc, rspec[1], phylen);
++			txh->MModeFbrLen = cpu_to_le16(mmodefbrlen);
++		}
++	}
++
++	ac = skb_get_queue_mapping(p);
++	if ((scb->flags & SCB_WMECAP) && qos && wlc->edcf_txop[ac]) {
++		uint frag_dur, dur, dur_fallback;
++
++		/* WME: Update TXOP threshold */
++		if (!(tx_info->flags & IEEE80211_TX_CTL_AMPDU) && frag == 0) {
++			frag_dur =
++			    brcms_c_calc_frame_time(wlc, rspec[0],
++					preamble_type[0], phylen);
++
++			if (rts) {
++				/* 1 RTS or CTS-to-self frame */
++				dur =
++				    brcms_c_calc_cts_time(wlc, rts_rspec[0],
++						      rts_preamble_type[0]);
++				dur_fallback =
++				    brcms_c_calc_cts_time(wlc, rts_rspec[1],
++						      rts_preamble_type[1]);
++				/* (SIFS + CTS) + SIFS + frame + SIFS + ACK */
++				dur += le16_to_cpu(rts->duration);
++				dur_fallback +=
++					le16_to_cpu(txh->RTSDurFallback);
++			} else if (use_rifs) {
++				dur = frag_dur;
++				dur_fallback = 0;
++			} else {
++				/* frame + SIFS + ACK */
++				dur = frag_dur;
++				dur +=
++				    brcms_c_compute_frame_dur(wlc, rspec[0],
++							  preamble_type[0], 0);
++
++				dur_fallback =
++				    brcms_c_calc_frame_time(wlc, rspec[1],
++							preamble_type[1],
++							phylen);
++				dur_fallback +=
++				    brcms_c_compute_frame_dur(wlc, rspec[1],
++							  preamble_type[1], 0);
++			}
++			/* NEED to set TxFesTimeNormal (hard) */
++			txh->TxFesTimeNormal = cpu_to_le16((u16) dur);
++			/*
++			 * NEED to set fallback rate version of
++			 * TxFesTimeNormal (hard)
++			 */
++			txh->TxFesTimeFallback =
++				cpu_to_le16((u16) dur_fallback);
++
++			/*
++			 * update txop byte threshold (txop minus intraframe
++			 * overhead)
++			 */
++			if (wlc->edcf_txop[ac] >= (dur - frag_dur)) {
++				uint newfragthresh;
++
++				newfragthresh =
++				    brcms_c_calc_frame_len(wlc,
++					rspec[0], preamble_type[0],
++					(wlc->edcf_txop[ac] -
++						(dur - frag_dur)));
++				/* range bound the fragthreshold */
++				if (newfragthresh < DOT11_MIN_FRAG_LEN)
++					newfragthresh =
++					    DOT11_MIN_FRAG_LEN;
++				else if (newfragthresh >
++					 wlc->usr_fragthresh)
++					newfragthresh =
++					    wlc->usr_fragthresh;
++				/* update the fragthresh and do txc update */
++				if (wlc->fragthresh[queue] !=
++				    (u16) newfragthresh)
++					wlc->fragthresh[queue] =
++					    (u16) newfragthresh;
++			} else {
++				wiphy_err(wlc->wiphy, "wl%d: %s txop invalid "
++					  "for rate %d\n",
++					  wlc->pub->unit, fifo_names[queue],
++					  rspec2rate(rspec[0]));
++			}
++
++			if (dur > wlc->edcf_txop[ac])
++				wiphy_err(wlc->wiphy, "wl%d: %s: %s txop "
++					  "exceeded phylen %d/%d dur %d/%d\n",
++					  wlc->pub->unit, __func__,
++					  fifo_names[queue],
++					  phylen, wlc->fragthresh[queue],
++					  dur, wlc->edcf_txop[ac]);
++		}
++	}
++
++	return 0;
++}
++
++void brcms_c_sendpkt_mac80211(struct brcms_c_info *wlc, struct sk_buff *sdu,
++			      struct ieee80211_hw *hw)
++{
++	u8 prio;
++	uint fifo;
++	struct scb *scb = &wlc->pri_scb;
++	struct ieee80211_hdr *d11_header = (struct ieee80211_hdr *)(sdu->data);
++
++	/*
++	 * 802.11 standard requires management traffic
++	 * to go at highest priority
++	 */
++	prio = ieee80211_is_data(d11_header->frame_control) ? sdu->priority :
++		MAXPRIO;
++	fifo = prio2fifo[prio];
++	if (brcms_c_d11hdrs_mac80211(wlc, hw, sdu, scb, 0, 1, fifo, 0))
++		return;
++	brcms_c_txq_enq(wlc, scb, sdu, BRCMS_PRIO_TO_PREC(prio));
++	brcms_c_send_q(wlc);
++}
++
++void brcms_c_send_q(struct brcms_c_info *wlc)
++{
++	struct sk_buff *pkt[DOT11_MAXNUMFRAGS];
++	int prec;
++	u16 prec_map;
++	int err = 0, i, count;
++	uint fifo;
++	struct brcms_txq_info *qi = wlc->pkt_queue;
++	struct pktq *q = &qi->q;
++	struct ieee80211_tx_info *tx_info;
++
++	prec_map = wlc->tx_prec_map;
++
++	/* Send all the enq'd pkts that we can.
++	 * Dequeue packets with precedence with empty HW fifo only
++	 */
++	while (prec_map && (pkt[0] = brcmu_pktq_mdeq(q, prec_map, &prec))) {
++		tx_info = IEEE80211_SKB_CB(pkt[0]);
++		if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
++			err = brcms_c_sendampdu(wlc->ampdu, qi, pkt, prec);
++		} else {
++			count = 1;
++			err = brcms_c_prep_pdu(wlc, pkt[0], &fifo);
++			if (!err) {
++				for (i = 0; i < count; i++)
++					brcms_c_txfifo(wlc, fifo, pkt[i], true,
++						       1);
++			}
++		}
++
++		if (err == -EBUSY) {
++			brcmu_pktq_penq_head(q, prec, pkt[0]);
++			/*
++			 * If send failed due to any other reason than a
++			 * change in HW FIFO condition, quit. Otherwise,
++			 * read the new prec_map!
++			 */
++			if (prec_map == wlc->tx_prec_map)
++				break;
++			prec_map = wlc->tx_prec_map;
++		}
++	}
++}
++
++void
++brcms_c_txfifo(struct brcms_c_info *wlc, uint fifo, struct sk_buff *p,
++	       bool commit, s8 txpktpend)
++{
++	u16 frameid = INVALIDFID;
++	struct d11txh *txh;
++
++	txh = (struct d11txh *) (p->data);
++
++	/* When a BC/MC frame is being committed to the BCMC fifo
++	 * via DMA (NOT PIO), update ucode or BSS info as appropriate.
++	 */
++	if (fifo == TX_BCMC_FIFO)
++		frameid = le16_to_cpu(txh->TxFrameID);
++
++	/*
++	 * Bump up pending count for if not using rpc. If rpc is
++	 * used, this will be handled in brcms_b_txfifo()
++	 */
++	if (commit) {
++		wlc->core->txpktpend[fifo] += txpktpend;
++		BCMMSG(wlc->wiphy, "pktpend inc %d to %d\n",
++			 txpktpend, wlc->core->txpktpend[fifo]);
++	}
++
++	/* Commit BCMC sequence number in the SHM frame ID location */
++	if (frameid != INVALIDFID) {
++		/*
++		 * To inform the ucode of the last mcast frame posted
++		 * so that it can clear moredata bit
++		 */
++		brcms_b_write_shm(wlc->hw, M_BCMC_FID, frameid);
++	}
++
++	if (dma_txfast(wlc->hw->di[fifo], p, commit) < 0)
++		wiphy_err(wlc->wiphy, "txfifo: fatal, toss frames !!!\n");
++}
++
++u32
++brcms_c_rspec_to_rts_rspec(struct brcms_c_info *wlc, u32 rspec,
++			   bool use_rspec, u16 mimo_ctlchbw)
++{
++	u32 rts_rspec = 0;
++
++	if (use_rspec)
++		/* use frame rate as rts rate */
++		rts_rspec = rspec;
++	else if (wlc->band->gmode && wlc->protection->_g && !is_cck_rate(rspec))
++		/* Use 11Mbps as the g protection RTS target rate and fallback.
++		 * Use the brcms_basic_rate() lookup to find the best basic rate
++		 * under the target in case 11 Mbps is not Basic.
++		 * 6 and 9 Mbps are not usually selected by rate selection, but
++		 * even if the OFDM rate we are protecting is 6 or 9 Mbps, 11
++		 * is more robust.
++		 */
++		rts_rspec = brcms_basic_rate(wlc, BRCM_RATE_11M);
++	else
++		/* calculate RTS rate and fallback rate based on the frame rate
++		 * RTS must be sent at a basic rate since it is a
++		 * control frame, sec 9.6 of 802.11 spec
++		 */
++		rts_rspec = brcms_basic_rate(wlc, rspec);
++
++	if (BRCMS_PHY_11N_CAP(wlc->band)) {
++		/* set rts txbw to correct side band */
++		rts_rspec &= ~RSPEC_BW_MASK;
++
++		/*
++		 * if rspec/rspec_fallback is 40MHz, then send RTS on both
++		 * 20MHz channel (DUP), otherwise send RTS on control channel
++		 */
++		if (rspec_is40mhz(rspec) && !is_cck_rate(rts_rspec))
++			rts_rspec |= (PHY_TXC1_BW_40MHZ_DUP << RSPEC_BW_SHIFT);
++		else
++			rts_rspec |= (mimo_ctlchbw << RSPEC_BW_SHIFT);
++
++		/* pick siso/cdd as default for ofdm */
++		if (is_ofdm_rate(rts_rspec)) {
++			rts_rspec &= ~RSPEC_STF_MASK;
++			rts_rspec |= (wlc->stf->ss_opmode << RSPEC_STF_SHIFT);
++		}
++	}
++	return rts_rspec;
++}
++
++void
++brcms_c_txfifo_complete(struct brcms_c_info *wlc, uint fifo, s8 txpktpend)
++{
++	wlc->core->txpktpend[fifo] -= txpktpend;
++	BCMMSG(wlc->wiphy, "pktpend dec %d to %d\n", txpktpend,
++	       wlc->core->txpktpend[fifo]);
++
++	/* There is more room; mark precedences related to this FIFO sendable */
++	wlc->tx_prec_map |= wlc->fifo2prec_map[fifo];
++
++	/* figure out which bsscfg is being worked on... */
++}
++
++/* Update beacon listen interval in shared memory */
++static void brcms_c_bcn_li_upd(struct brcms_c_info *wlc)
++{
++	/* wake up every DTIM is the default */
++	if (wlc->bcn_li_dtim == 1)
++		brcms_b_write_shm(wlc->hw, M_BCN_LI, 0);
++	else
++		brcms_b_write_shm(wlc->hw, M_BCN_LI,
++			      (wlc->bcn_li_dtim << 8) | wlc->bcn_li_bcn);
++}
++
++static void
++brcms_b_read_tsf(struct brcms_hardware *wlc_hw, u32 *tsf_l_ptr,
++		  u32 *tsf_h_ptr)
++{
++	struct bcma_device *core = wlc_hw->d11core;
++
++	/* read the tsf timer low, then high to get an atomic read */
++	*tsf_l_ptr = bcma_read32(core, D11REGOFFS(tsf_timerlow));
++	*tsf_h_ptr = bcma_read32(core, D11REGOFFS(tsf_timerhigh));
++}
++
++/*
++ * recover 64bit TSF value from the 16bit TSF value in the rx header
++ * given the assumption that the TSF passed in header is within 65ms
++ * of the current tsf.
++ *
++ * 6       5       4       4       3       2       1
++ * 3.......6.......8.......0.......2.......4.......6.......8......0
++ * |<---------- tsf_h ----------->||<--- tsf_l -->||<-RxTSFTime ->|
++ *
++ * The RxTSFTime are the lowest 16 bits and provided by the ucode. The
++ * tsf_l is filled in by brcms_b_recv, which is done earlier in the
++ * receive call sequence after rx interrupt. Only the higher 16 bits
++ * are used. Finally, the tsf_h is read from the tsf register.
++ */
++static u64 brcms_c_recover_tsf64(struct brcms_c_info *wlc,
++				 struct d11rxhdr *rxh)
++{
++	u32 tsf_h, tsf_l;
++	u16 rx_tsf_0_15, rx_tsf_16_31;
++
++	brcms_b_read_tsf(wlc->hw, &tsf_l, &tsf_h);
++
++	rx_tsf_16_31 = (u16)(tsf_l >> 16);
++	rx_tsf_0_15 = rxh->RxTSFTime;
++
++	/*
++	 * a greater tsf time indicates the low 16 bits of
++	 * tsf_l wrapped, so decrement the high 16 bits.
++	 */
++	if ((u16)tsf_l < rx_tsf_0_15) {
++		rx_tsf_16_31 -= 1;
++		if (rx_tsf_16_31 == 0xffff)
++			tsf_h -= 1;
++	}
++
++	return ((u64)tsf_h << 32) | (((u32)rx_tsf_16_31 << 16) + rx_tsf_0_15);
++}
++
++static void
++prep_mac80211_status(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
++		     struct sk_buff *p,
++		     struct ieee80211_rx_status *rx_status)
++{
++	int preamble;
++	int channel;
++	u32 rspec;
++	unsigned char *plcp;
++
++	/* fill in TSF and flag its presence */
++	rx_status->mactime = brcms_c_recover_tsf64(wlc, rxh);
++	rx_status->flag |= RX_FLAG_MACTIME_MPDU;
++
++	channel = BRCMS_CHAN_CHANNEL(rxh->RxChan);
++
++	if (channel > 14) {
++		rx_status->band = IEEE80211_BAND_5GHZ;
++		rx_status->freq = ieee80211_ofdm_chan_to_freq(
++					WF_CHAN_FACTOR_5_G/2, channel);
++
++	} else {
++		rx_status->band = IEEE80211_BAND_2GHZ;
++		rx_status->freq = ieee80211_dsss_chan_to_freq(channel);
++	}
++
++	rx_status->signal = wlc_phy_rssi_compute(wlc->hw->band->pi, rxh);
++
++	/* noise */
++	/* qual */
++	rx_status->antenna =
++		(rxh->PhyRxStatus_0 & PRXS0_RXANT_UPSUBBAND) ? 1 : 0;
++
++	plcp = p->data;
++
++	rspec = brcms_c_compute_rspec(rxh, plcp);
++	if (is_mcs_rate(rspec)) {
++		rx_status->rate_idx = rspec & RSPEC_RATE_MASK;
++		rx_status->flag |= RX_FLAG_HT;
++		if (rspec_is40mhz(rspec))
++			rx_status->flag |= RX_FLAG_40MHZ;
++	} else {
++		switch (rspec2rate(rspec)) {
++		case BRCM_RATE_1M:
++			rx_status->rate_idx = 0;
++			break;
++		case BRCM_RATE_2M:
++			rx_status->rate_idx = 1;
++			break;
++		case BRCM_RATE_5M5:
++			rx_status->rate_idx = 2;
++			break;
++		case BRCM_RATE_11M:
++			rx_status->rate_idx = 3;
++			break;
++		case BRCM_RATE_6M:
++			rx_status->rate_idx = 4;
++			break;
++		case BRCM_RATE_9M:
++			rx_status->rate_idx = 5;
++			break;
++		case BRCM_RATE_12M:
++			rx_status->rate_idx = 6;
++			break;
++		case BRCM_RATE_18M:
++			rx_status->rate_idx = 7;
++			break;
++		case BRCM_RATE_24M:
++			rx_status->rate_idx = 8;
++			break;
++		case BRCM_RATE_36M:
++			rx_status->rate_idx = 9;
++			break;
++		case BRCM_RATE_48M:
++			rx_status->rate_idx = 10;
++			break;
++		case BRCM_RATE_54M:
++			rx_status->rate_idx = 11;
++			break;
++		default:
++			wiphy_err(wlc->wiphy, "%s: Unknown rate\n", __func__);
++		}
++
++		/*
++		 * For 5GHz, we should decrease the index as it is
++		 * a subset of the 2.4G rates. See bitrates field
++		 * of brcms_band_5GHz_nphy (in mac80211_if.c).
++		 */
++		if (rx_status->band == IEEE80211_BAND_5GHZ)
++			rx_status->rate_idx -= BRCMS_LEGACY_5G_RATE_OFFSET;
++
++		/* Determine short preamble and rate_idx */
++		preamble = 0;
++		if (is_cck_rate(rspec)) {
++			if (rxh->PhyRxStatus_0 & PRXS0_SHORTH)
++				rx_status->flag |= RX_FLAG_SHORTPRE;
++		} else if (is_ofdm_rate(rspec)) {
++			rx_status->flag |= RX_FLAG_SHORTPRE;
++		} else {
++			wiphy_err(wlc->wiphy, "%s: Unknown modulation\n",
++				  __func__);
++		}
++	}
++
++	if (plcp3_issgi(plcp[3]))
++		rx_status->flag |= RX_FLAG_SHORT_GI;
++
++	if (rxh->RxStatus1 & RXS_DECERR) {
++		rx_status->flag |= RX_FLAG_FAILED_PLCP_CRC;
++		wiphy_err(wlc->wiphy, "%s:  RX_FLAG_FAILED_PLCP_CRC\n",
++			  __func__);
++	}
++	if (rxh->RxStatus1 & RXS_FCSERR) {
++		rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
++		wiphy_err(wlc->wiphy, "%s:  RX_FLAG_FAILED_FCS_CRC\n",
++			  __func__);
++	}
++}
++
++static void
++brcms_c_recvctl(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
++		struct sk_buff *p)
++{
++	int len_mpdu;
++	struct ieee80211_rx_status rx_status;
++	struct ieee80211_hdr *hdr;
++
++	memset(&rx_status, 0, sizeof(rx_status));
++	prep_mac80211_status(wlc, rxh, p, &rx_status);
++
++	/* mac header+body length, exclude CRC and plcp header */
++	len_mpdu = p->len - D11_PHY_HDR_LEN - FCS_LEN;
++	skb_pull(p, D11_PHY_HDR_LEN);
++	__skb_trim(p, len_mpdu);
++
++	/* unmute transmit */
++	if (wlc->hw->suspended_fifos) {
++		hdr = (struct ieee80211_hdr *)p->data;
++		if (ieee80211_is_beacon(hdr->frame_control))
++			brcms_b_mute(wlc->hw, false);
++	}
++
++	memcpy(IEEE80211_SKB_RXCB(p), &rx_status, sizeof(rx_status));
++	ieee80211_rx_irqsafe(wlc->pub->ieee_hw, p);
++}
++
++/* calculate frame duration for Mixed-mode L-SIG spoofing, return
++ * number of bytes goes in the length field
++ *
++ * Formula given by HT PHY Spec v 1.13
++ *   len = 3(nsyms + nstream + 3) - 3
++ */
++u16
++brcms_c_calc_lsig_len(struct brcms_c_info *wlc, u32 ratespec,
++		      uint mac_len)
++{
++	uint nsyms, len = 0, kNdps;
++
++	BCMMSG(wlc->wiphy, "wl%d: rate %d, len%d\n",
++		 wlc->pub->unit, rspec2rate(ratespec), mac_len);
++
++	if (is_mcs_rate(ratespec)) {
++		uint mcs = ratespec & RSPEC_RATE_MASK;
++		int tot_streams = (mcs_2_txstreams(mcs) + 1) +
++				  rspec_stc(ratespec);
++
++		/*
++		 * the payload duration calculation matches that
++		 * of regular ofdm
++		 */
++		/* 1000Ndbps = kbps * 4 */
++		kNdps = mcs_2_rate(mcs, rspec_is40mhz(ratespec),
++				   rspec_issgi(ratespec)) * 4;
++
++		if (rspec_stc(ratespec) == 0)
++			nsyms =
++			    CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
++				  APHY_TAIL_NBITS) * 1000, kNdps);
++		else
++			/* STBC needs to have even number of symbols */
++			nsyms =
++			    2 *
++			    CEIL((APHY_SERVICE_NBITS + 8 * mac_len +
++				  APHY_TAIL_NBITS) * 1000, 2 * kNdps);
++
++		/* (+3) account for HT-SIG(2) and HT-STF(1) */
++		nsyms += (tot_streams + 3);
++		/*
++		 * 3 bytes/symbol @ legacy 6Mbps rate
++		 * (-3) excluding service bits and tail bits
++		 */
++		len = (3 * nsyms) - 3;
++	}
++
++	return (u16) len;
++}
++
++static void
++brcms_c_mod_prb_rsp_rate_table(struct brcms_c_info *wlc, uint frame_len)
++{
++	const struct brcms_c_rateset *rs_dflt;
++	struct brcms_c_rateset rs;
++	u8 r